Tonyhax is a new softmod backup loader for the PlayStation 1



Those wanting to take their original PlayStation to the next level usually needed to open up the system and install a modchip; that's been common knowledge since even the '90s. However, a user named Socram, previously known for creating amiitool, has released an exploit that makes modding your PS1 easier than ever before. Called "tonyhax", because it utilizes Tony Hawk's Pro Skater 2 or 3, it loads specific data off of the PS1's memory card that "unlocks" the system's disc drive, which then lets you run other region games or even backups.

tonyhax is a save game exploit that uses a specially crafted save game for the Tony Hawk's Pro Skater 2 and 3, in both PAL and NTSC-U versions, to load a custom backup loader that uses no$psx' secret CD unlock commands to enable loading backups on a totally unmodded and stock PS1.

After "extensive testing", Socram has decided to release their exploit to the public, source code and all. The full project is available on GitHub, while a writeup and documentation as to how tonyhax works is available on their website. The creator says that the exploit is possible because in either Tony Hawk's Pro Skater 2 or Tony Hawk's Pro Skater 3 (NTSC or PAL), the game doesn't check if a skater profile name has been edited or messed with in any way. Should you edit the skater name in a dramatic way, it overwrites the memory of the system, which in turn allows custom code to be run.

This first stage payload is about 144 bytes, and its sole purpose is to load the secondary program loader (or SPL for short) from an additional save file in the memory card using the PS1 BIOS calls. Once loaded, it jumps straight to it.

As the console is left in an inconsistent state, the SPL first reinitializes the system kernel (RAM, devices…), by using the very same calls the ROM executes during the booting of the console.

After that, the GPU is reset. Once the GPU is ready again, the sets up the video to a resolution of 320x240, unpacks the 1bpp font from the BIOS ROM into VRAM, and draws the basic border and program name to know everything is working fine until this point.

With a fully working screen, it then proceeds to unlocks the CD drive to accept discs missing the SCEx signature, leveraging the CD BIOS unlock commands found by Martin Korth. These unlock commands are a sort of backdoor, and the drive, probably in order to keep them secret, returns an error instead of a success message. The SPL is coded to expect a particular error to be returned, and will actually abort if the drive returns that it succeeded or if it returns another unexpected error code.

After unlocking it, it waits for the lid to be opened and closed, allowing the user to insert a new CD.

After that, the CD filesystem is reinitialized. It proceeds to read the SYSTEM.CNF configuration file, reinitializes the kernel with the parameters the game needs, and finally loads and runs the game’s main executable.

You'll need a PS1 memory card with tonyhax on it, to which Socram recommends using a PS2 and Free MCBoot to copy it. After loading the profile in-game, the exploit will boot up, and your CD drive will then accept games, even if they're burned CD-R backups, or games from other regions. Tonyhax works on all PAL PlayStation consoles, NetYaroze, and all NTSC-U systems except the original SCPH-1000.

:arrow: Source
:download: Download Link
 

NeonBlack79

New Member
Newbie
Joined
Mar 19, 2021
Messages
3
Trophies
0
Age
44
XP
45
Country
Italy
Just to be absolutely sure, does this method work for import games, bypassing the region lock, or it's only for backups?
 

driverdis

I am Justice
Member
Joined
Sep 21, 2011
Messages
2,867
Trophies
2
Age
31
Location
1.048596β
XP
2,838
Country
United States
Just to be absolutely sure, does this method work for import games, bypassing the region lock, or it's only for backups?

works fine for imports. Be aware that you will have NTSC->PAL and PAL->NTSC conversion issues with this method as the console will output what the game wants and a PS1 by default is missing components to generate proper signals for out of region color standards. You can use RGB scart cables to get around this but the game will still be out of sync by around 1% speed wise.

I ended up playing original imports on a PS2 using component cables with gsm mode switcher to output a proper signal for PS1 games.
 
Last edited by driverdis,

DaisyAge12

Member
Newcomer
Joined
Mar 19, 2021
Messages
6
Trophies
0
Age
26
XP
46
Country
United States
I have tried playing an NTSC-J copy of Gunner's Heaven (Rapid Reload in EU) and it always comes up with an error. American Spyro and EU Rapid Reload work (Rapid Reload is in black and white) Am I doing something wrong or is this game unplayable? Are all NTSC-J games unplayable?
 
Last edited by DaisyAge12,

limpbiz411

Well-Known Member
Member
Joined
Oct 12, 2007
Messages
494
Trophies
1
XP
2,819
Country
United States
works fine for imports. Be aware that you will have NTSC->PAL and PAL->NTSC conversion issues with this method as the console will output what the game wants and a PS1 by default is missing components to generate proper signals for out of region color standards. You can use RGB scart cables to get around this but the game will still be out of sync by around 1% speed wise.

I ended up playing original imports on a PS2 using component cables with gsm mode switcher to output a proper signal for PS1 games.
playstation games are looking amazing through my ps2 with component cables on my trinitron wega 32" crt
 
  • Like
Reactions: NeonBlack79

driverdis

I am Justice
Member
Joined
Sep 21, 2011
Messages
2,867
Trophies
2
Age
31
Location
1.048596β
XP
2,838
Country
United States
It's indeed a possibility and shouldn't be too hard. I plan on doing that at some point but that'd be an entirely different project.

Yeah I know. Those lost gems etc are caused not by an anti-piracy measure but by an anti-crack check - ie if you modify the executable. Since the executable isn't modified, it is not triggered.

I've tried with both my original Spyro 3 and a copy of it and again, I can confirm Zoe doesn't complain about me using a pirated copy.

does your copy throw the antimod screen. My clean copy of Spyro 3 1.1 NTSC throws the antimod screen since it can’t read the license string on the main menu.
 
Last edited by driverdis,

Shardnax

Well-Known Member
Member
Joined
Aug 23, 2008
Messages
199
Trophies
0
Website
Visit site
XP
311
Country
United States
I have tried playing an NTSC-J copy of Gunner's Heaven (Rapid Reload in EU) and it always comes up with an error. American Spyro and EU Rapid Reload work (Rapid Reload is in black and white) Am I doing something wrong or is this game unplayable? Are all NTSC-J games unplayable?
I can't say if all games work but the random Japanese game I tested did.
 

DaisyAge12

Member
Newcomer
Joined
Mar 19, 2021
Messages
6
Trophies
0
Age
26
XP
46
Country
United States
I can't say if all games work but the random Japanese game I tested did.
So I read in a reddit post from OP that as long as the game has the SYSTEM.CNF file it should work, this game doesn't have that format. I'm wondering that's why this game won't work. Is there a way to create a dummy SYSTEM.CNF file for the purpose of loading the game?
EDIT: I managed to create a CNF file for the game and it loaded it in tonyhax but since it doesn't point to the correct sectors it doesn't load the game. So in theory it might be possible to patch games without the CNF file if someone can figure out where the CNF needs to point to in the game data
 
Last edited by DaisyAge12,

socram8888

Well-Known Member
Newcomer
Joined
Apr 6, 2009
Messages
81
Trophies
1
Age
29
Location
Valencia, Spain
Website
orca.pet
XP
560
Country
Spain
Well I'm glad to announce I've just released v1.2. This is a pretty important milestone I think since it contains a couple of really popular games that were in the top ten sold games for the PS1.

Changes since v1.1.2
  • Add new games as entry points:
    • Castrol Honda Superbike Racing (NTSC-U) (SLUS-00882)
    • Castrol Honda Superbike Racing (PAL-E) (SLES-01182)
    • Castrol Honda VTR (PAL-E) (SLES-02942)
    • Cool Boarders 4 (NTSC-U) (SCUS-94559)
    • Crash Bandicoot 2: Cortex Strikes Back (NTSC-U) (SCUS-94154)
    • Crash Bandicoot 2: Cortex Strikes Back (PAL-E) (SCES-00967)
    • Crash Bandicoot 3: Warped (NTSC-U) (SCUS-94244)
    • Crash Bandicoot 3: Warped (PAL-E) (SCES-01420)
    • Sports Superbike (PAL-E) (SLES-03057)
    • Sports Superbike 2 (PAL-E) (SLES-03827)
    • XS Moto (NTSC-U) (SLUS-01506)
    • XS Moto (PAL-E) (SLES-04095)
  • Added support for European NetYaroze consoles.
One would expect first party games like Crash Bandicoot would be better programmed. Apparently, no.

does your copy throw the antimod screen. My clean copy of Spyro 3 1.1 NTSC throws the antimod screen since it can’t read the license string on the main menu.
It does not on mine, but apparently PAL version doesn't check for it either.
 

Flame

Me > You
Global Moderator
Joined
Jul 15, 2008
Messages
7,269
Trophies
3
XP
18,699
this is amazing stuff. :wub:

now makes you think with this softmod would it possible to create a memory card with microsd fuction which will be able to play games off that?

sort of like a Vita2sd for the vita or SD2SP2 for the Gamecube.
 

DaisyAge12

Member
Newcomer
Joined
Mar 19, 2021
Messages
6
Trophies
0
Age
26
XP
46
Country
United States
Socram8888 will there be a way later to support games that don't have SYSTEM.CNF files? I don't know how many games out there are built without it but I am curious.
 

socram8888

Well-Known Member
Newcomer
Joined
Apr 6, 2009
Messages
81
Trophies
1
Age
29
Location
Valencia, Spain
Website
orca.pet
XP
560
Country
Spain
Socram8888 will there be a way later to support games that don't have SYSTEM.CNF files? I don't know how many games out there are built without it but I am curious.
Are there any really? I've never seen one like it. In fact I assumed all had a SYSTEM.CNF file.
this is amazing stuff. :wub:

now makes you think with this softmod would it possible to create a memory card with microsd fuction which will be able to play games off that?

sort of like a Vita2sd for the vita or SD2SP2 for the Gamecube.
Yes and no. That would require coming with a generic way of redirecting BIOS calls, so it reads from a SD instead of a CD-ROM. It's not impossible, but many games that directly access the CD drive controller (for instance, every game that has audio CD tracks, a functionality the BIOS doesn't expose) would be impossible to use unless patched on a case-by-case basis, which is pretty complex.
 
Last edited by socram8888,
  • Like
Reactions: Flame

DaisyAge12

Member
Newcomer
Joined
Mar 19, 2021
Messages
6
Trophies
0
Age
26
XP
46
Country
United States
Are there any really? I've never seen one like it. In fact I assumed all had a SYSTEM.CNF file.
The only game I can confirm doesn't have the CNF file is Gunners Heaven/Rapid Reload. I found a tool to create a CNF for a game and it will load in tonyhax however I do not know what parameters are needed to get the game to boot
 

Deleted member 323844

Well-Known Member
Member
Joined
Feb 17, 2013
Messages
802
Trophies
1
XP
2,335
Country
Spain
Wipeout 3 Special Edition could be worth checking. It has a somewhat complex entry name screen. On the other hand, it was a first-party title, so idk.

this is amazing stuff. :wub:

now makes you think with this softmod would it possible to create a memory card with microsd fuction which will be able to play games off that?

sort of like a Vita2sd for the vita or SD2SP2 for the Gamecube.
According to Takeshi (trisaster.de), developer of SIO2SD/MX4SIO, MX4SIO should work on PS1, but it lacks the software. There's a big difference in speed tho.

PS2: 24 MHz (in practice ~1.1 MB/s)
PS1: 250 kHz (in practice ???)
 
Last edited by Deleted member 323844,

DaisyAge12

Member
Newcomer
Joined
Mar 19, 2021
Messages
6
Trophies
0
Age
26
XP
46
Country
United States
Ive made some progress. So far I can boot into the game but after the initial screen it hangs. I created a CNF file with PSX2CNFCreator_1.4.0 with the default parameters found here: How do I make a SYSTEM.CNF file? - PlayStation Development Network (psxdev.net)
Now I've looked at the EU release which does have a CNF and I'm trying to use some of the parameters in this file in my makeshift one. Hoping to get this figured out soon as I'm running low on CD-R's.
Edit: This one booted but quits at the same point. Right after the intro screen.
 

driverdis

I am Justice
Member
Joined
Sep 21, 2011
Messages
2,867
Trophies
2
Age
31
Location
1.048596β
XP
2,838
Country
United States
I noticed that the demo disc that comes with Spyro the Dragon PAL (Winter Releases ‘98) won’t load any of the demos once it hits the main menu. I wonder if it has to do with loading new executables after the drive is unlocked as the disc works fine using a chipped system or scph-5000x PS2 using LaunchElf or PSXLoader disc swapping but will black screen and not load the demo game it is supposed to when ran via TonyHax.

I will be able to test if the NoCash unlock is to blame once my Unirom cart arrives as it too can unlock the drive using the NoCash commands.

I will be checking a 3 in 1Crash compilation I have burned to see if it fails as well since it loads other games from it’s menu.
 
Last edited by driverdis,

socram8888

Well-Known Member
Newcomer
Joined
Apr 6, 2009
Messages
81
Trophies
1
Age
29
Location
Valencia, Spain
Website
orca.pet
XP
560
Country
Spain

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    Psionic Roshambo @ Psionic Roshambo: @SylverReZ, Indeed lol