Hacking PS1/2 Tonyhax International: Backup Loader For All Japanese, USA, and PAL PS1 Consoles/Early PS2 Consoles + GameShark/Cheat Cart Flasher

SylverReZ

Dat one with the Rez
Member
GBAtemp Patron
Joined
Sep 13, 2022
Messages
7,150
Trophies
3
Location
The Wired
Website
m4x1mumrez87.neocities.org
XP
21,926
Country
United Kingdom
There still things that can be added in the future but compatibility wise it is in a great place now and I'm really happy with it. Just took 8 months to cook :) Thanks for your help with it as well.
No problem, mate. So far I feel like there's nothing that needs to be changed at this time, but if you need any small additions, then I'd be happy to help. :D
 
  • Like
Reactions: alexfree

alexfree

Well-Known Member
OP
Member
Joined
Nov 17, 2021
Messages
182
Trophies
0
Website
alex-free.github.io
XP
1,145
Country
United States
No problem, mate. So far I feel like there's nothing that needs to be changed at this time, but if you need any small additions, then I'd be happy to help. :D
There are still some APv2 games out there, I never really exhaustively went through all of them. But I definitely found most of them...

The issue is the redump pages can't be trusted on identifying games with protection, because they use some tool that is 1) closed source and 2) sometimes has false positives. The false positives are probably caused by the fact that many games contain disabled APv1/APv2 code that while present is never actually executed in the game for whatever reason. This happens a lot with different regional releases. MottZilla has a private list somewhere with confirmed games. But I know for sure that there are some Madden NFL games at least from what I remember that have the APv2 protection.

There are also still some save game exploits that can be ported to different versions. Cool Boarders 4 Japan, Final Fantasy 9 Europe, Castlevania Chronicles Japan Rev 1. Maybe there are a few more. I've yet to find my own save game exploit, but I've ported some to Japanese versions (like I did Castrol Honda Japan before). It's a lot easier to port the exploits then to find a new one in a game. Usually just the RAM values shift around, sometimes the exploit needs changing with the length of the overflow. But yea, definitely a todo item.

GameSharkHAX might get a lot easier to develop codes for games in the future. Me and MottZilla are working on a more consistent method to develop codes that might work and make it somewhat automated similar to aprip possibly.

But yea, the loader itself is complete at this point in time to me anyways.
Post automatically merged:

@SylverReZ one of the consoles I got awhile ago actually has a non-stealth mod chip and I didn’t realize until very recently! Its a 5501 that I just got back into working order yesterday, a nice surprise. So now I can actually see APv1 being triggered on real hardware.
 
Last edited by alexfree,

alexfree

Well-Known Member
OP
Member
Joined
Nov 17, 2021
Messages
182
Trophies
0
Website
alex-free.github.io
XP
1,145
Country
United States
Tonyhax International v1.2.1 is out: https://github.com/alex-free/tonyhax/releases/download/v1.2.1i/tonyhax-v1.2.1-international.zip

Changes:

  • Updated GSHAX Tool to v2.0. All GameSharkHAX codes have been updated to improved versions. Usage has changed for the WipEout and Parasite Eve codes!
  • Thanks to the new GSHAX Tool v2.0 update, a GameSharkHAX code for Ridge Racer is now available.
  • The first stage loaders: entry.bin and entry-bb.bin are now included in each release to aid in the development of GameSharkHAX and save game exploits.
  • Added the missing source code to the GameShark cheat engine that MottZilla wrote to the source tree, as well as instructions on assembling it (available at docs/mottzilla-gameshark-engine.txt). It is not however ‘dynamically generated’ by the build system, yet… The compiled version is still hardcoded as an unsigned char array.
 

alexfree

Well-Known Member
OP
Member
Joined
Nov 17, 2021
Messages
182
Trophies
0
Website
alex-free.github.io
XP
1,145
Country
United States

Version 1.2.2 (4/26/2023)​

Changes:

  • The Tonyhax International loader now does SetMemSize(8), SysInitMemory (0xA000E000, 0x2000), and InitDefInt(3). This makes it much more similar to how the real PSX BIOS boots games, and it fixes all known issues with booting games via the GameShark Code method.
  • Fixed a race condition that rarely effected booting games via the flashed cheat cart and GameShark Code. The issue was that sometimes the console BIOS would execute CD commmands before starting the ROM too closely to when Tonyhax International would call the first CD INIT on startup. This issue also could happen in GSHAX, when a game was sending CD commands right before the GSHAX exploit would trigger and then starting the Tonyhax International loader. The issue previously manifested as being stuck on the first Initializing CD text forever.
  • Updated GSHAX Tool to v2.0.1, which auto-calculates the MIPS assembly binary offset during code generation in the build step.
  • Fixed an issue with the build.sh script due to missing template folders in the gshax directory since the last update.
  • Improved documentation.
 

SylverReZ

Dat one with the Rez
Member
GBAtemp Patron
Joined
Sep 13, 2022
Messages
7,150
Trophies
3
Location
The Wired
Website
m4x1mumrez87.neocities.org
XP
21,926
Country
United Kingdom

Version 1.2.2 (4/26/2023)​

Changes:

  • The Tonyhax International loader now does SetMemSize(8), SysInitMemory (0xA000E000, 0x2000), and InitDefInt(3). This makes it much more similar to how the real PSX BIOS boots games, and it fixes all known issues with booting games via the GameShark Code method.
  • Fixed a race condition that rarely effected booting games via the flashed cheat cart and GameShark Code. The issue was that sometimes the console BIOS would execute CD commmands before starting the ROM too closely to when Tonyhax International would call the first CD INIT on startup. This issue also could happen in GSHAX, when a game was sending CD commands right before the GSHAX exploit would trigger and then starting the Tonyhax International loader. The issue previously manifested as being stuck on the first Initializing CD text forever.
  • Updated GSHAX Tool to v2.0.1, which auto-calculates the MIPS assembly binary offset during code generation in the build step.
  • Fixed an issue with the build.sh script due to missing template folders in the gshax directory since the last update.
  • Improved documentation.
Good job on the update.
 

duwen

Old Man Toad
Member
Joined
Sep 6, 2013
Messages
3,191
Trophies
2
Location
Bullet Hell
Website
www.exophase.com
XP
4,294
Country
United Kingdom
I've been silently (since post 2 in this thread) keeping up with all the improvements, but felt that it was about time I again thanked all involved.

From my own personal use case, I think that the only additional feature I could wish for (which isn't new, and has been a request since virtually release one of Socrams OG TonyHax) is the ability to trigger the PS1VModeNeg (on PS2) after the exploit launches (as an option on the exploit screen?) rather than prior to launching the entrypoint title. As I primarily use TonyHax to run my legit NTSC imports on a PAL PS2, anything that can be done to simplify the number of steps in the process would be welcome... but I'd been led to believe that it HAS to be done prior to launching the entrypoint title, because the title launched after the exploit 'inherits' the video mode settings of the entrypoint title. Maybe you can let me know if I'm understanding it correctly, and if not what the obstacles are that would prevent a videomode switching option within the exploit.

...and thanks again to all involved for maintaining and improving TonyHax!
 

alexfree

Well-Known Member
OP
Member
Joined
Nov 17, 2021
Messages
182
Trophies
0
Website
alex-free.github.io
XP
1,145
Country
United States
I've been silently (since post 2 in this thread) keeping up with all the improvements, but felt that it was about time I again thanked all involved.

From my own personal use case, I think that the only additional feature I could wish for (which isn't new, and has been a request since virtually release one of Socrams OG TonyHax) is the ability to trigger the PS1VModeNeg (on PS2) after the exploit launches (as an option on the exploit screen?) rather than prior to launching the entrypoint title. As I primarily use TonyHax to run my legit NTSC imports on a PAL PS2, anything that can be done to simplify the number of steps in the process would be welcome... but I'd been led to believe that it HAS to be done prior to launching the entrypoint title, because the title launched after the exploit 'inherits' the video mode settings of the entrypoint title. Maybe you can let me know if I'm understanding it correctly, and if not what the obstacles are that would prevent a videomode switching option within the exploit.

...and thanks again to all involved for maintaining and improving TonyHax!
Ah yes, for the PS2 the video mode can not be set while in ‘PS1 mode’. The PS1 can set the video mode in comparison. The reason you need that VMODENEG is because it sets the video mode in ‘PS2 mode’ which works around the above issue.

While it’s widely understood to be impossible to change the video mode of the PS2 in ‘PS1 mode’, Socram is still looking for a way AFAIK. If I he figures that out I can implement it in Tonyhax International.

Thanks for keeping up with the project!
Post automatically merged:
https://github.com/alex-free/tonyhax/releases/download/v1.2.3i/tonyhax-v1.2.3-international.zip
 
Last edited by alexfree,

alexfree

Well-Known Member
OP
Member
Joined
Nov 17, 2021
Messages
182
Trophies
0
Website
alex-free.github.io
XP
1,145
Country
United States

Version 1.2.3 (4/28/2023)​

Changes:

  • Optimized out many unnecessary functions, improving load speed of games slightly.
  • (Really) fixed an issue with the build.sh script due to missing template folders in the gshax directory since the last update. Git is dumb about not being able to include empty folders so the build.sh script just creates them if they don't exit now.
  • Added info related to a GameShark Lite save game file
 

alexfree

Well-Known Member
OP
Member
Joined
Nov 17, 2021
Messages
182
Trophies
0
Website
alex-free.github.io
XP
1,145
Country
United States

Version 1.2.4 (4/30/2023)​

Changes:

  • Added the ability to boot into the stock Sony BIOS from the Tonyhax International ROM version. This allows you to access the Memory Card Manager/CD Player functionallity of the stock Sony BIOS without removing the Tonyhax International flashed cheat cart from the back of your console. To use this new feature, simply start your console with the CD drive open, and with the Tonyhax International flash cart in the back of your console. Once Tonyhax International starts, press X on a controller when you get to the text stating to insert a disc into the console to continue.
  • Added info about how the HAX and FF9 save files of the Tonyhax International loader for the GameSharkHAX and Save game exploit can screw up filenames in the stock Sony BIOS (a non-fatal, just annoying issue).
 

alexfree

Well-Known Member
OP
Member
Joined
Nov 17, 2021
Messages
182
Trophies
0
Website
alex-free.github.io
XP
1,145
Country
United States

Version 1.2.5 (5/4/2023)​

Changes:

  • Added the ability to apply your own GameShark Codes to any game you want to boot! Huge thanks to MottZilla's guidance on controller support as well as the original cheat engine used to power all of this.
  • The Tonyhax International loader ROM version now only displays the Press X to access the Memory Card Manager/CD Player text when the CD drive is open when the ROM version of the loader starts, for a more clean interactive look.
 

alexfree

Well-Known Member
OP
Member
Joined
Nov 17, 2021
Messages
182
Trophies
0
Website
alex-free.github.io
XP
1,145
Country
United States

Version 1.2.6 (5/7/2023)​

Changes:

  • Fixed the ability to apply your own GameShark Codes to any game you want to boot for consoles that did not have BIOS v3.0. Only consoles with BIOS v3.0 were previously working, this has now been fixed and all PSX/PS2 consoles are now confirmed working correctly.
  • Expanded the amount of codes able to be applied by the anti-piracy bypass system for future-proofing.
  • The Tonyhax International loader ROM version now only displays the Press X to access the Memory Card Manager/CD Player text when the CD drive is open when the ROM version of the loader starts for Japanese consoles as well, to match the behavior of the other USA/PAL consoles for consistency.
  • Updated PSEXE2ROM and MKPSXISO to the latest versions.
  • Updated the Tonyhax International GameShark Generator program to v1.0.2. Now you can simply drag and drop the txt file of GameShark codes directly onto the thigsgen.exe or thigsgen executable file to generate the raw save file named TONYHAXINTGS which contains the GameShark codes you want to load with Tonyhax International.
  • Added info about how the Final Fantasy IX save exploit file being present when using the SCPH-1000 memory card manager will lock up the console (so don't use it like that :)).
 

Fien

Well-Known Member
Member
Joined
Sep 27, 2021
Messages
221
Trophies
0
XP
1,284
Country
Netherlands
Is the boot-cd version a PAL or NTSC disc? I've a PAL PS One (SCPH-102) with a MM3 modchip, so it can only boot PAL backup discs.

At this moment I use the 1.2.6 memory card version, but I want to free that card up for game saves.

Also, I've read in one of the changelogs that removing a FreePSXBoot card is not necessary when in slot 2, but that doesn't seem to be true for all games. The Crash Team Racing PAL and Harmful Park doesn't boot with the card still inserted. The first one just get stuck at a black screen, the second one boots but gets stuck at the loading screen.
 

SylverReZ

Dat one with the Rez
Member
GBAtemp Patron
Joined
Sep 13, 2022
Messages
7,150
Trophies
3
Location
The Wired
Website
m4x1mumrez87.neocities.org
XP
21,926
Country
United Kingdom
Is the boot-cd version a PAL or NTSC disc? I've a PAL PS One (SCPH-102) with a MM3 modchip, so it can only boot PAL backup discs.
Modchips are supposed to play games from other regions. You sure you got it installed correctly? And yes, Tonyhax International can be compiled as a disc image for all regions.
 
  • Like
Reactions: alexfree

Fien

Well-Known Member
Member
Joined
Sep 27, 2021
Messages
221
Trophies
0
XP
1,284
Country
Netherlands
Modchips are supposed to play games from other regions. You sure you got it installed correctly? And yes, Tonyhax International can be compiled as a disc image for all regions.
Yes, but the PAL PS One (SCPH-102) with a MM3 modchip is one of the exceptions. The SCPH-102 has a extra protection in the BIOS which is only bypassed with a more advanced modchip (Onechip or PSNee). But I only have a 12F629 PIC left which cannot be a Onechip but only a MM3. With a MM3 it can play backups, but only PAL ones.

So the pre-build image in the ZIP is not a PAL one?


https://quade.co/ps1-modchip-guide/

PAL PSones have additional protection built into the BIOS. ONEchip and PsNee modchips connect to a couple BIOS pins and patch it to allow booting out of region games. Without the BIOS patch PAL PSones can only play PAL region games. Japanese systems starting with some SCPH-3000 models also have a similar region lock, but it hasn’t been bypassed by any modchips yet.
 

SylverReZ

Dat one with the Rez
Member
GBAtemp Patron
Joined
Sep 13, 2022
Messages
7,150
Trophies
3
Location
The Wired
Website
m4x1mumrez87.neocities.org
XP
21,926
Country
United Kingdom
Yes, but the PAL PS One (SCPH-102) with a MM3 modchip is one of the exceptions. The SCPH-102 has a extra protection in the BIOS which is only bypassed with a more advanced modchip (Onechip or PSNee). But I only have a 12F629 PIC left which cannot be a Onechip but only a MM3.

So the pre-build image in the ZIP is not a PAL one?
I already know that the PSone slim has additional protection. There's only the one ISO which uses a Japanese license file, so you will need to re-build the image using MKPSXISO with the appropriate license file for your region. I cannot share these files for copyright reasons, but those can be searched for on Google or found in a few PS1 games which accidentally have them in.

Here are a few list of games which have this license file on the root of the CD:

USA ("LICENSEA.DAT"):
  • Castlevania Chronicles

Japan ("LICENSEJ.DAT"):
  • Ms. Pac-Man Maze Madness

Europe ("LICENSEE.DAT"):
  • 4-4-2 Soccer
  • FIFA 2001
  • Sesame Street Sports
 
  • Like
Reactions: alexfree and Fien

alexfree

Well-Known Member
OP
Member
Joined
Nov 17, 2021
Messages
182
Trophies
0
Website
alex-free.github.io
XP
1,145
Country
United States
Is the boot-cd version a PAL or NTSC disc? I've a PAL PS One (SCPH-102) with a MM3 modchip, so it can only boot PAL backup discs.

At this moment I use the 1.2.6 memory card version, but I want to free that card up for game saves.

Also, I've read in one of the changelogs that removing a FreePSXBoot card is not necessary when in slot 2, but that doesn't seem to be true for all games. The Crash Team Racing PAL and Harmful Park doesn't boot with the card still inserted. The first one just get stuck at a black screen, the second one boots but gets stuck at the loading screen.
That was in a previous changelog but I had to reverse it. If you look at the latest versions when you boot them up they say ‘Remove FreePSXBoot memory card now” when it starts up after the freepsxboot exploit.

The ‘competition’ of tonyhax international supposedly doesn’t require you to remove the slot 2 freepsxboot card. But this is not actually true. A few games will lock up both the original Tonyhax and UniRom if you leave the slot 2 freepsxboot card inserted while the game loads up. This is because the bios patches they use to accomplish the ‘no need to remove slot 2 freepsxboot memory card’ feature are NOT actually as universal as they think.

Tonyhax International has ended up removing all those patches and simply instructs the user to remove the card right when the loader starts, before booting the game. This also has improved general compatibility with games immensely as it is cleaner (I’m not modifying any memory card handling stuff in the kernel like original Tonyhax and UniRom currently are).

I hope that makes sense!

The boot-cd version is Japanese because before I added the GameShark feature I guess there wasn’t any reason to use this on that pal 102. I can add back the pal version in the next update which is almost out with immensely improved GameShark support.
 

alexfree

Well-Known Member
OP
Member
Joined
Nov 17, 2021
Messages
182
Trophies
0
Website
alex-free.github.io
XP
1,145
Country
United States

Version 1.2.7 (5/17/2023)​

Changes:

  • REWROTE the GameShark functionality to support ALL of the following GameShark code types: 50, 80, 30, D0, E0. This rewrite includes things like a TONYHAXINTGS save file checksum system, a new and improved GameShark cheat code engine, and optimizations to THIGSGEN, now at v2.0.
  • Fixed an issue with the -rom version that would cause it to display the Press X to boot Sony BIOS text twice.
  • Added back the PAL/European Boot CD image to releases since it is now useful for GameShark code support.
  • Added some YouTube video tutorial links (by Jay Time) to the ROM and GameShark Support pages.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    Xdqwerty @ Xdqwerty: Where's everybody?