1. ps2.jpg

    The gaming community may be itching to read all the latest news about Sony's upcoming console, but that doesn't mean homebrew enthusiasts have left the previous generations behind just yet. In fact, one developer in particular (@CTurt, a name already familiar to those in the PS4 scene) has decided to go back a whopping 19 years to revisit the PlayStation 2 not for a quick nostalgia dive, but to crack it even further than it's ever been!

    As a lot of you readers may know by now, Sony's best-selling console is by no means a stranger to hacks: a plethora of modchips, software exploits and other types of clever tricks to bypass the platform's security have popped up over the years, all of them with their own methods and pros/cons. However, most of them require either purchasing some pieces of hardware or having a pre-modded console at hand to later pass an exploit over to your own, which is by no means ideal for a multitude of reasons. But this is about to change starting today, as @CTurt has managed to find an exploit which only needs a PS2 Yabasic demo disk to work.

    The exploit consists of two stages: the first overflows one of the interpreter's built-in functions and gains arbitrary code execution, while the second is a payload that launches an ELF from a medium available to the system (the repo includes one that loads the FIFA demo bundled with a specific revision of the disc, however, someone could technically choose whichever executable they want - even on a different/burned CD). Support for USB/HDD drives and loading ELFs over the network is also reportedly possible, but no compatible payload has been written for those yet. Everything said so far only requires a stock PlayStation 2 and an aforementioned Yabasic demo disk (something many European owners may already have as Sony originally included one with the consoles to avoid EU import taxes) so this should not only open up the doors to hacking & homebrew for many more people, but the exploit also works with late Slim models that don't support FreeMCBoot at all!

    There are, however, a few things you should keep in mind. First and foremost, while everything is already in a working state and the code has been made public, it's not really that user-friendly yet: you need to compile the exploit yourself and, as previously stated, some otherwise useful payloads are still missing and will be added sometime in the future (other devs are welcome to make their own contributions!). Secondly, while most demo disks containing Yabasic are supported (serials PBPX-95204, PBPX-95205 and PBPX-95506), one of them is still not compatible as it uses a different executable version and the developer wasn't able to get their hands on it (serial PBPX-95520 - if you have it, please consider contacting the dev!). Lastly, those discs have only been produced for PAL consoles, so NTSC PS2 cannot take advantage of the exploit due to region locking.

    Here is the usage guide included in the README:
    Feeling experimental? You can find PS2-Yabasic-Exploit's GitHub repo by clicking the source link below! You can also find out more about how the exploit works by reading the technical writeup here.

    :arrow: Source
     
    Milozaki, kimotori, matpower and 37 others like this.
  2. Discussion (64 replies)

  3. Mythical

    Mythical GBAtemp Advanced Maniac
    Member

    Joined:
    May 11, 2017
    Messages:
    1,983
    Country:
    United States
    Cool!
     
    Reynardine and TunaKetchup like this.
  4. Sakitoshi

    Sakitoshi GBAtemp Official Lolimaster
    Member

    Joined:
    May 8, 2012
    Messages:
    2,239
    Country:
    Chile
    and having a demo disc that only exist in pal format isn't more specific than the current methods??
     
    Azael_inf, ReUnmei, Waster and 11 others like this.
  5. gamesquest1

    gamesquest1 Nabnut
    Moderator

    Joined:
    Sep 23, 2013
    Messages:
    15,061
    lol i remember messing about with the yabasic demo disk as a kid, honestly i cant imagine a world where someone would practically use this, but still funny to see it done
     
  6. Kwyjor

    Kwyjor GBAtemp Maniac
    Member

    Joined:
    May 23, 2018
    Messages:
    1,183
    Country:
    Canada
    Yeah, that's a bit of a tease.

    I hadn't heard of this Yabasic thing before. Did anyone take that seriously? It's a little surprising an exploit wasn't found sooner. (Recall that SmileBASIC used to have an exploit on the 3DS.)
     
  7. The Real Jdbye

    The Real Jdbye Always Remember 30/07/08
    Member

    Joined:
    Mar 17, 2010
    Messages:
    20,034
    Country:
    Norway
    My dad has one of those demo discs laying around somewhere, I remember playing around with it as a kid, pretty neat, but not very usable without a keyboard.
    This is pretty cool though. How do you actually load external code in Yabasic? Will it load off a USB drive? The GitHub doesn't really give you much idea about how to actually load the thing.
     
    Subtle Demise and Reynardine like this.
  8. gamesquest1

    gamesquest1 Nabnut
    Moderator

    Joined:
    Sep 23, 2013
    Messages:
    15,061
    from what i gather it can only load from the disk its on, but i guess you might be able to use it as a glorified swap-magic disk, and swap out the disk while in yabasic then use the exploit to load a different elf file

    i guess it might be useful for a 1-off MCfreeboot install method without needing a action replay max or other method for running home-brew
     
    Last edited by gamesquest1, Oct 13, 2019
    Reynardine likes this.
  9. The Real Jdbye

    The Real Jdbye Always Remember 30/07/08
    Member

    Joined:
    Mar 17, 2010
    Messages:
    20,034
    Country:
    Norway
    I mean, how do you load the yabasic exploit itself?
     
  10. gamesquest1

    gamesquest1 Nabnut
    Moderator

    Joined:
    Sep 23, 2013
    Messages:
    15,061
    i think this is all thats required to boot the FIFA demo from within Yabasic, unless i'm missing something, i think most of the page is a writeup on how he found the exploit and how the end code is created, and thats the input required for his example code to be ran

     
    Last edited by gamesquest1, Oct 13, 2019
    The Real Jdbye likes this.
  11. MrCokeacola

    MrCokeacola The Xbox Guy
    Member

    Joined:
    Feb 26, 2018
    Messages:
    759
    Country:
    Canada
    Seems about as useful as the PSO exploit for the Gamecube. Cool but too much effort.
     
    Subtle Demise and alexander1970 like this.
  12. the_randomizer

    the_randomizer The Temp's official fox whisperer
    Member

    Joined:
    Apr 29, 2011
    Messages:
    29,951
    Country:
    United States
    Being region locked to PAL is a deal breaker to me.
     
    Flame, alexander1970 and skinnyBIGGS like this.
  13. SS4

    SS4 GBAtemp Fan
    Member

    Joined:
    Jan 13, 2010
    Messages:
    470
    Country:
    Canada
    Would be great if it wasn't for the PAL limitation . . .
     
  14. uyjulian

    uyjulian Homebrewer
    Member

    Joined:
    Nov 26, 2012
    Messages:
    2,536
    Country:
    United States
    Swap trick with multiple games and utility disks is easier to do since there are more of the aforementioned disks.

    However, an exploit with the DVD Player would be impressive.
     
  15. retrofan_k

    retrofan_k GBAtemp Addict
    Member

    Joined:
    May 31, 2013
    Messages:
    2,048
    Country:
    Belarus
    For £2.99 posted, I picked up a demo disc for the sake of it. Any new expliot is welcomed imo, regardless of how old a system is.
     
    alexander1970 likes this.
  16. VinsCool

    VinsCool Persona Secretiva Felineus
    Moderator

    Joined:
    Jan 7, 2014
    Messages:
    14,052
    Country:
    Canada
    Really damn cool! However, I found myself picking up a Free MCBoot Memory card for $10, really easy and much less troublesome :D
     
    Tony_93, x65943 and Reynardine like this.
  17. TunaKetchup

    TunaKetchup GBAtemp Advanced Fan
    Member

    Joined:
    Mar 20, 2018
    Messages:
    548
    Country:
    Vietnam
    Where did you get it?

    I couldn't find it on ebay
     
  18. retrofan_k

    retrofan_k GBAtemp Addict
    Member

    Joined:
    May 31, 2013
    Messages:
    2,048
    Country:
    Belarus
    Search for PBPX-95506 on ebay. There was quite a few.
     
    alexander1970 likes this.
  19. The Real Jdbye

    The Real Jdbye Always Remember 30/07/08
    Member

    Joined:
    Mar 17, 2010
    Messages:
    20,034
    Country:
    Norway
    Well, you only have to do it once, run the FMCB (or FHDB) installer and off you go.
    I guess you have to type it out manually, but it's not that long. I expected it to be more complex. No idea what he means by that patch though. I guess if you wanted to load homebrew with this, you would have to disc swap to a burned disc containing your .elf file. Unless someone can figure out a way to load directly from USB with the exploit, if that's even possible.
     
  20. MiiJack

    MiiJack GBAtemp Regular
    Member

    Joined:
    Sep 13, 2016
    Messages:
    294
    Country:
    Madagascar
    Finally I can delete that corrupted save on my memory card :toot:, all I need to do is search that disc.
     
  21. cearp

    cearp 瓜老外
    Developer

    Joined:
    May 26, 2008
    Messages:
    8,358
    Country:
    Tuvalu
    for the last ps2 model, the only way to play backups is with a modchip - there aren't any softmods - so this is good for those people.
    plus, the slim ps2s accept 110-240v (i believe), and so having a european ps2 in the usa (for example) is not a big issue as it would be for a fat ps2.
    that exploit was very useful!
    i remember having sonic adventure 2 connected to my computer, searching for cheats - all thanks to PSOload :)
    i forget what the iso loading compatibility was like... not sure I really made use of that.
    there is a certain demo game on a demo disk (Viewtiful Joe 2 on the Holiday 2004 Demo Disc) which is bugged, and simply loading that game will corrupt your whole memory card. some people use it on purpose when they need to get rid of a bad save, or if they want to format their memory card. (because you can't choose to format your memory card youreslf - but if it gets corrupted from something like this demo, the ps2 prompts you to wipe it)
     
    Last edited by cearp, Oct 13, 2019 - Reason: typo
Loading...

Hide similar threads Similar threads with keywords - official, exploit, Yabasic