No, there's no typo in the title. It's 2020 and Sony's second home console, the PlayStation 2, got a new exploit; and an interesting one at that! Aptly named FreeDVDBoot, this exploit allows users to run burnt homebrew games on an unmodified PS2. Just slide in a DVD into the console as you would with any other game and boot it without any additional tools.

@CTurt , the software engineer behind FreeDVDBoot and fellow GBAtemp member, explained in length his method that exploits the console's DVD player functionality in a blog post. He also made all of FreeDVDBoot's code available on GitHub, along with a step-by-step guide.

​

In case you're wondering about actual PS2 games rather than homebrew titles, yes, FreeDVDBoot also enables you to run backup copy of those. CTurt shared a video using his exploit to run a backup of Shadow of the Colossus:

​

It doesn't end there either. CTurt further goes on to speculate that this method could potentially work on every single PlayStation home consoles and that he will investigate this possibility in the future:

There's really no reason this general attack scenario is specific to the PlayStation 2 as all generations support some combination of burned media: from the PlayStation 1's CD support, to the PlayStation 3 and 4's Blu-ray support, with the PlayStation 4 having only removed CD support. Hacking the PS4 through Blu-ray BD-J functionality has long been discussed as an idea for an entry point. This may be something I would be interested in looking into for a long-term future project: imagine being able to burn your own PlayStation games for all generations; 1 down, 3 to go...

SOURCE
FreeDVDBoot code and guide on GitHub

 

[Alexander1970]

https://new.reddit.com/r/ps4homebrew/comments/him4ev/cturt_ps4_bluray_vulnerable_like_ps2_dvd/

As the say in that Thread,Sony would Patch it "out".

 

[Pokemon_Tea_Sea_Jee]

Would have been much better in 2010. Still, the prospect of this happening for PS4 is interesting.

 

[rs1n]

No, you can raw copy an image preinstalled with FHDB onto HDD, and put it inside the PS2.

You can also use existing multi-elf games to use as a swap disc to boot FMCBInstaller.

Here is a nice guide explaining the various entrypoints and using them for modding your PS2: https://www.psx-place.com/threads/tutorial-the-great-ps2-aio-guide.30219/

I’m curious how you would install this image on a slim model — because the fact is you can’t. I’m aware early slims can be modified to accept an internal drive but that already is a major drawback.

This method means the only cost of entry is a computer (which just about everyone has) and blank media (which is dirt cheap). Even my grandma can get this set up... and she’s been dead for years.

 

[arjunpatel]

As the say in that Thread,Sony would Patch it "out".

huh this whole time i thought it was a hardware problem well that sucks , doesn't even bother me though the home-brew community for ps4 is nonexistent

 

[HaloEffect17]

So can you load mcboot on the dvd and save it to the memory card? I dont want to keep burning multiple dvds for backups.

 

[Goku1992A]

As the say in that Thread,Sony would Patch it "out".

I wish DEV's can be discreet because 9/10 times whenever they broadcast a new exploit Sony/Microsoft/Nintendo kills it. This is mainly why soft mods are basically dead now in this gen if the devs waited for PS4 to be EOL we could have had a fully exploited system but sometimes a DEV's "5 minutes of fame" killed the PS4 jailbreak scene. Another reason why "software updates" exist is to combat any type of exploit if found. As of right now the only current gen is currently modded is Nintendo so basically Next Gen is going to be the same thing or no systems modded from the look of things.

 

[RaZoRNo1]

Nice exploit
I just checked my slim 0C PS2 and it has the 3.11E driver on it, so it should work (at the moment I dont have an empty disc here...)

It is really awesome to have this kind of exploit still hapening to old devices.

BTW:
Has anyone checked, if any Xbox /other DVD devices are impacted by this, too or is it just a Playstation specific hack?

 

[Ryccardo]

Out of curiosity how is this free mcboot thing this days, has it ever been updated on say the last ten years? I tried it once and found compatibility to be a bit spotty. I remember the getaway not streaming assets in properly,

FMCB/FHDB only provide a persistent homebrew entrypoint (via an unofficial system update), they do not run game backups from HDD/USB/Ethernet/FireWire (OPL does), and yes all of those are receiving updates (though you need to be realistic about the performance of USB 1)

There was a model of slim PS2 that had squared off buttons instead of rounded ones that I recall had some major difficulty with FMCB

You're thinking of the superslim (SCPH-9xxxx) - some of them (not all - most of R-chassis ones but still some exceptions) have rom version 2.30 which removed support for updates from memory card

PS3 has ps2 backwards compatibility

Hell no!
Not even the CECH-A and B are 100% accurate to a real PS2... and they run hotter and consume over 3x the power anyway

So can you load mcboot on the dvd and save it to the memory card? I dont want to keep burning multiple dvds for backups.

You can use a file manager (*LaunchELF) to run the FMCB installer from USB, yep
and again, this has nothing to do (directly) with disc or digital game backups

Amazing work. Guessing this won't work with PS1 CDRs?

Your question is unclear, but no matter how you bend it it's a No:
- You can't run this exploit from a CD because the mechacon only recognizes DVDs as movie discs
- You can't run this exploit on a PS1 because of the above, the fact the PS1 doesn't have a DVD-Video player (or read DVDs at all)
- You can't use this exploit to load copies of game discs because, just like any (known to date) non-chip method, it doesn't bypass the mechacon and its protections
A "3 wire" non-stealth PS1 chip with a power switch is the most reliable and cleanest option for nonoriginal PS1 discs on a PS2 (or, of course, a fat PS1) - connect its data line to what most PS2 chips call "SX"

 

[Graxer]

So can you load mcboot on the dvd and save it to the memory card? I dont want to keep burning multiple dvds for backups.

That's what I did. I booted up the FreeMCboot installer using this exploit, installed onto my memory card and then removed the burned disc. Now all I need is to have the memory card inserted to run homebrew.

 

[duwen]

Hopefully this will re energize the ps2 homebrew scene.
Personally I'd love to see this lead to the creation of a "freeloader" style disk that will allow me to run my legit ps1 and ps2 imports on a non chipped console.

 

[Tumoche]

Working on my scph 7004 3.10E, great work.

 

[Ryccardo]

Personally I'd love to see this lead to the creation of a "freeloader" style disk that will allow me to run my legit ps1 and ps2 imports on a non chipped console.

Won't happen (unless a mechacon override is discovered, as is the case on most nonjapanese PS1s) - foreign discs* are blocked in hardware by the mechacon

* strictly speaking, there's no such thing as a foreign disc to a consumer PS2 - it's no different from a CD-R of windows 95; but if you had a 75000 or newer DEX console, there would be your officially-almost-region-free PS2

 

[chrisrlink]

assuming the ps4 (if/when it get's ported) will work will it thoreticly work on current latest fw? 7.50 as of writing well either case it has no HD drive and that channel site is always updated with past/current fw so i don't need to rely on sony when i get a new drive and have it patched out

 

[chrisrlink]

welp Cturt already posted on ps3/4 potential the bug still "exist" but another twitter user mentioned the highest privlidge you'll get is userland with elevated status but no kernel access and because of ASLR activated in later fw on ps4 it's as good as dead on updated ps4's though he mentinoned bluray java code execution as being a better alternitive

 

[cvskid]

Awesome!
I presume that this will also allow for running out-of-region legit disks too - that was the only major benefit a modchip had over FreeMcBoot... my stack of original Japanese disks will be very happy

edit

No... it won't... just read the git... it basically incorporates a custom loader on a burned disk. Useless for legit import loading

You should be able to use a .elf file of swap magic to get the same result. Thats what i used to do for imports.

--------------------- MERGED ---------------------------

Like the post above says, you need to do some kind of disc-swapping trick. One exploit involves 007: Agent Under Fire, whereby you need to open up the tray at a particular point and swap in a burned disc.

I don't know why the blog post linked in the OP says you need to "open up the console to block the disc tray sensors", as it is my understanding that people usually jab some pieces of plastic or cardboard into the tray mechanism to open it up.

It is of course much simpler to find someone else who already has Free McBoot, since it is easy to copy it to a new memory card.

You would normally open the console up to block disc tray sensors for swapping ps1 and ps2 disc. Mainly ps1 disc.

--------------------- MERGED ---------------------------

Out of curiosity how is this free mcboot thing this days, has it ever been updated on say the last ten years? I tried it once and found compatibility to be a bit spotty. I remember the getaway not streaming assets in properly, tiger woods not playing sound etc.

I would actually buy another PS2 if someone came out with a dvd drive emu thing like they have for other old consoles.

I remember esr and esr patcher having issues not loading certain games like parappa the rapper 2. I don;t know if it's been fixed to have compatibility with all ps2 games yet or not though.

 

[Deleted member 668561]

Interesting, submitted this to hackaday too..

--------------------- MERGED ---------------------------

it made it on to hackaday:

https://hackaday.com/2020/06/30/fre...-playstation-2-like-never-before/#more-420016

 

[BeastMode6]

Throwing in my 2 cents: I have a 90001 (the silver one), version 3.11U. Used the 3.11 only disk, and it worked fine. Put Fortuna Project on a USB drive, plug that in, and copy over to my memory card. Now I can use that as an entry point.

 

[konamicode89]

This is really cool stuff, showed up on my Google feed the other day and I can't wait to try this out. This is really neat for creating mcboot cards without the need of much else besides a blank DVD and the mem cards itself

 

[CactusMan]

Hello world.

 

[BeastMode6]

My only issue now is that OPL only supports SMB 1, and I’m not opening myself up with that security risk.