​

Those wanting to take their original PlayStation to the next level usually needed to open up the system and install a modchip; that's been common knowledge since even the '90s. However, a user named Socram, previously known for creating amiitool, has released an exploit that makes modding your PS1 easier than ever before. Called "tonyhax", because it utilizes Tony Hawk's Pro Skater 2 or 3, it loads specific data off of the PS1's memory card that "unlocks" the system's disc drive, which then lets you run other region games or even backups.

tonyhax is a save game exploit that uses a specially crafted save game for the Tony Hawk's Pro Skater 2 and 3, in both PAL and NTSC-U versions, to load a custom backup loader that uses no$psx' secret CD unlock commands to enable loading backups on a totally unmodded and stock PS1.

After "extensive testing", Socram has decided to release their exploit to the public, source code and all. The full project is available on GitHub, while a writeup and documentation as to how tonyhax works is available on their website. The creator says that the exploit is possible because in either Tony Hawk's Pro Skater 2 or Tony Hawk's Pro Skater 3 (NTSC or PAL), the game doesn't check if a skater profile name has been edited or messed with in any way. Should you edit the skater name in a dramatic way, it overwrites the memory of the system, which in turn allows custom code to be run.

This first stage payload is about 144 bytes, and its sole purpose is to load the secondary program loader (or SPL for short) from an additional save file in the memory card using the PS1 BIOS calls. Once loaded, it jumps straight to it.

As the console is left in an inconsistent state, the SPL first reinitializes the system kernel (RAM, devices…), by using the very same calls the ROM executes during the booting of the console.

After that, the GPU is reset. Once the GPU is ready again, the sets up the video to a resolution of 320x240, unpacks the 1bpp font from the BIOS ROM into VRAM, and draws the basic border and program name to know everything is working fine until this point.

With a fully working screen, it then proceeds to unlocks the CD drive to accept discs missing the SCEx signature, leveraging the CD BIOS unlock commands found by Martin Korth. These unlock commands are a sort of backdoor, and the drive, probably in order to keep them secret, returns an error instead of a success message. The SPL is coded to expect a particular error to be returned, and will actually abort if the drive returns that it succeeded or if it returns another unexpected error code.

After unlocking it, it waits for the lid to be opened and closed, allowing the user to insert a new CD.

After that, the CD filesystem is reinitialized. It proceeds to read the SYSTEM.CNF configuration file, reinitializes the kernel with the parameters the game needs, and finally loads and runs the game’s main executable.

You'll need a PS1 memory card with tonyhax on it, to which Socram recommends using a PS2 and Free MCBoot to copy it. After loading the profile in-game, the exploit will boot up, and your CD drive will then accept games, even if they're burned CD-R backups, or games from other regions. Tonyhax works on all PAL PlayStation consoles, NetYaroze, and all NTSC-U systems except the original SCPH-1000.

Source
Download Link

 

[mistamontiel]

SCPH 101, NTSC-U, THPS3, not having it unfortunate

In PS2 I put the raw save with wLE in my PS1 memory card, red screened, looked further looks like SPL missing needed another I re-acquired THPS3 save and with BESLEM99999-TONYHAX then on Create Skater just freezes screen

 

[Tweaker_Modding]

my tests so far

tonyhax works on both my pal ps1 scph-102 and my pal ps2 phat scph-39002

i’m using a 3rd party memory card from a company named skream

here are the games i have tested

-magical drop 3 (pal) - works perfectly with no issues
-magical drop +1 (pal) - works perfectly with no issues
-toca world touring cars (pal) - crashes on a loading screen, emulators do this same thing most likely a bad rom
-wwf smackdown 1 (pal) - works perfectly with no issues
-monopoly (pal) - works perfectly with no issues
-destruction derby (ntsc-u) - doesn’t boot it gets stuck at initialising cd likely because i used a cd-rw and the ps1 hates cd-rw the ps2 does the same thing
-lsd dream emulator (ntsc-j) - works perfectly with no issues did crash once but the disc was dirty so an issue on my part

 

[Ponlork]

wouldnt it be great if someone creates a homebrew that boots immediately into the tonyhax exploit? and somehow press their own boot discs like how datel and breaker pro did back in the day. i would buy it in a heartbeat. though some dont think something like that will sell today but u got people spending over $100 for a PS1 memory card in 2021 so who knows

 

[driverdis]

wouldnt it be great if someone creates a homebrew that boots immediately into the tonyhax exploit? and somehow press their own boot discs like how datel and breaker pro did back in the day. i would buy it in a heartbeat. though some dont think something like that will sell today but u got people spending over $100 for a PS1 memory card in 2021 so who knows

since Sony does not go after people selling PS1 modchips and other stuff due to the console being vintage now, I wonder if they would go after people making pressed discs with the wobble groove. Obviously if people did this for retail games Sony may do something but for homebrew or a NoCash unlocker disc I doubt they would.

 

[mistamontiel]

Now switched over to 7501 fat PS1 and still the same chit

THPS3 just freezes screen music continues

 

[Lindaru]

Tested with 1.2.2 and 1.2.3b (beta found on github) on EU console phat PS1 using THPS2:

All my PAL discs work
Einhänder boots up
Chrono Cross (disc 1 for now) boots up just fine on 1.2.3b but not on 1.2.2 (freezes on said error earlier)
Thrill Kill (Uncensored Full NTSC Ver.) boots up
Final Fantasy Tactics worked

 

[Leon11]

It could be useful a datasheet with working\not working\partial or problematic working games.

 

[duwen]

I finally got around to running this on my PS2 (pointless to run it on my modchipped PS1) after acquiring one of the entry point titles (I went with Cool Boarders 4, while not the cheapest of the options it's not the most expensive and it has the most streamlined entry to the hack).
Worked like a charm! I guess I'm lucky enough to have a PS2 that this works with, as I've heard results are pretty mixed.

While I love all the benefits of having a FMCB PS2 with a fully loaded hard drive, it always bugged me that I couldn't run my legit NTSC import PS1 disks on my PAL PS2. This hack allows me to do just that... although there are some minor issues that I hope get addressed in the future. The main one being related to output resolution; like I said, I have a PAL console that outputs a 576i signal (in PS1 mode) via component. Upon running the hack and switching to an NTSC disk the output resolution should switch to 480 but remains in 576, which results in the image being displayed with a black border at the bottom of the screen (presumably the 96 lines worth of difference between the PAL and NTSC signals).
Oddly, the 50/60hz difference doesn't seem to be an issue, and it seems to be running at the correct frame rate for the game.

Hopefully a PS2 exclusive fork of this can be developed which could eventually include some button combos for forcing various resolutions depending on output requirements.

 

[mistamontiel]

Now I've even formatted with MC Annihilator and did just the THPS3 NTSC and SPL saves

Two cards I've did this

Create Skater still refuses only freezes screen either my slim or fat

Why is this only me, @socram8888

 

[socram8888]

Now I've even formatted with MC Annihilator and did just the THPS3 NTSC and SPL saves

Two cards I've did this

Create Skater still refuses only freezes screen either my slim or fat

Why is this only me, @socram8888

I've heard reports that uLaunchELF 4.43 corrupts data when copying from USB. Try with an older version maybe?

 

[halfpricebuttes]

Could someone with a PAL Playstation try to load the "Run Crash!" demo that was just released at Revision this past week? It's posted on pouet, as a new user I can't share a link apparently but just search for PSX demos and sort by release date, it's the newest one.


Loading it from tonyhax using a copy of THPS2 on an unmodded SCPH-9001 (BIOS v4.1) results in a scrolling image with no color (expected, I was testing it on an NTSC TV and not through my GV-2USB) but it also doesn't play any of the audio from the demo and instead continues playing the THPS menu drum loop throughout the entire thing.

 

[mistamontiel]

Same thing couple random ones I saw, anyone have a wLE/uLE that did the save copy with no corrupt

 

[mistamontiel]

Now I used uLE v4.42d and same 'result' I quit!!! Hoping THPS4 just does it

 

[DarthMotzkus]

@socram8888 did you see this: http://www.psxdev.net/forum/viewtopic.php?f=62&t=3765

It's fresh! OMG! Maybe you guys could work together on that! A new exploit wich work just opening the MC Menu.

 

[malammore]

Hi Socram, thank you for your work, can you link me the procedure on how to add the savefile on the mc? thank you

 

[Leon11]

@socram8888 did you see this: http://www.psxdev.net/forum/viewtopic.php?f=62&t=3765

It's fresh! OMG! Maybe you guys could work together on that! A new exploit wich work just opening the MC Menu.

Seems like Fortuna Project for PS2, but the thing is, if i can't enter the memory card menu how can i manage the save files?

 

[DarthMotzkus]

Seems like Fortuna Project for PS2, but the thing is, if i can't enter the memory card menu how can i manage the save files?

I think it will use a memory card to exploit, and you need another to manage your saves. Or Maybe putting the memory card with exploit in slot 2 to load the hack, and in slot 1 to manage it is an option. There's a lot of possibilities and I'll follow it closely. Just hope @socram8888 see that, a collab with this new exploit will be amazing.

 

[Tweaker_Modding]

ok done some more tests and this time i used different brand CD-R's
the games are launched with tonyhax 1.2.2 using tony hawks pro skater 3 (EU)
discs used are maxell CD-R's
all of these were tested on a pal ps1 (scph 102)

destruction derby - works perfectly
croc 2 - works perfectly
crash bandicoot 2 - hangs on initializing cd
croc 1 - hangs on initializing cd

will test the last 2 games on my ps2 (scph 39002) and with tonyhax 1.2.3

EDIT: croc 1 successfully boots and works with tonyhax 1.2.2 on my ps2 though it took longer to load than most games i've tested

crash bandicoot 2 gets stuck at loading executable on the ps2 with tonyhax 1.2.2
i'm gonna test 1.2.3 now and leave an edit labelled EDIT 2 when done

EDIT 2: the 1.2.3 tests

PS2
croc 1 now gets stuck at a black screen with the pro skater 3 menu music in the background

crash 2 still gets stuck at loading executable

PS1
crash 2 successfully boots and plays fine with tonyhax 1.2.3

croc 1 successfully boots and plays fine with tonyhax 1.2.3

 

[socram8888]

@socram8888 did you see this: http://www.psxdev.net/forum/viewtopic.php?f=62&t=3765

It's fresh! OMG! Maybe you guys could work together on that! A new exploit wich work just opening the MC Menu.

I'm aware of this exploit. Looks like an interesting way to launch tonyhax, though given it requires specialized hardware I've not yet been able to use it on real hardware.

I've been considering trying something to ease its installation, but it's still in the early planning stages.

Hi Socram, thank you for your work, can you link me the procedure on how to add the savefile on the mc? thank you

This video by MrMario2011 explains it pretty well.

PS2
croc 1 now gets stuck at a black screen with the pro skater 3 menu music in the background

crash 2 still gets stuck at loading executable

It's probably related to https://github.com/socram8888/tonyhax/issues/24, which causes reloading issues on PS2 for games that work perfectly well on PS1.

 

[Tweaker_Modding]

It's probably related to https://github.com/socram8888/tonyhax/issues/24, which causes reloading issues on PS2 for games that work perfectly well on PS1.

ah that makes sense