Hacking PS1/2 Tonyhax International: Backup Loader For All Japanese, USA, and PAL PS1 Consoles/Early PS2 Consoles + GameShark/Cheat Cart Flasher

SylverReZ

Dat one with the Rez
Member
GBAtemp Patron
Joined
Sep 13, 2022
Messages
7,150
Trophies
3
Location
The Wired
Website
m4x1mumrez87.neocities.org
XP
21,933
Country
United Kingdom
Thanks for the bypass code as well. Look forward to inching closer each release to 100% compatibility with APV2 games.
You're welcome, that's what I'm here for. Also gonna do exploitable save files at one point if I can get one game to work right.
 

SylverReZ

Dat one with the Rez
Member
GBAtemp Patron
Joined
Sep 13, 2022
Messages
7,150
Trophies
3
Location
The Wired
Website
m4x1mumrez87.neocities.org
XP
21,933
Country
United Kingdom
The save game exploits are really important because it's the only boot method for Japanese ps2s. Look forward to it.
I'll have to first find a game that works, wish me luck with that.
 
  • Like
Reactions: alexfree

alexfree

Well-Known Member
OP
Member
Joined
Nov 17, 2021
Messages
182
Trophies
0
Website
alex-free.github.io
XP
1,146
Country
United States

Version 1.1.7 (1/3/2023)​

Changes:

  • Added save game exploit support for Final Fantasy IX Japan, Final Fantasy IX USA Rev 0, and Final Fantasy IX USA Rev 1 thanks to Patchouli (karehaani)!
  • Fixed the tonyhax.mcs and HAX loader files for the save game exploit boot method. Previously, only the HAX loader file copied via uLaunchElf specifically to a memory card was working due to an error accommodating the larger size of the Tonyhax International loader since v1.1.3. This issue has now been resolved and everything works as expected with both the tonyhax.mcs and HAX loader files as they are in the correct ‘linked’ format (you can see this in the memcardrex software for example).
  • Updated crosstool-ng to the latest version. Fixed and updated the crosstool-ng config file used to build the Tonyhax International toolchain to work with the latest version. The new config file also makes a more tuned PSX toolchain. The toolchain is set to be tuned for the r3000, for little-endian, for soft-float (no hardware float support), and for a 32-bit ABI. This means the previous CFLAGS setting these options explicitly are no longer necessary and have been removed from the various variable.mk* files in the source.
  • Updated the APv2 decompilation documentation (from the latest official Tonyhax).
  • Added more info on the RAM setups used by Tonyhax International and how they work. This information can be found in the ram-setups.txt file in the docs directory of the source.
  • Substantially rewrote the documentation with more information.
 

SylverReZ

Dat one with the Rez
Member
GBAtemp Patron
Joined
Sep 13, 2022
Messages
7,150
Trophies
3
Location
The Wired
Website
m4x1mumrez87.neocities.org
XP
21,933
Country
United Kingdom

Version 1.1.7 (1/3/2023)​

Changes:

  • Added save game exploit support for Final Fantasy IX Japan, Final Fantasy IX USA Rev 0, and Final Fantasy IX USA Rev 1 thanks to Patchouli (karehaani)!
  • Fixed the tonyhax.mcs and HAX loader files for the save game exploit boot method. Previously, only the HAX loader file copied via uLaunchElf specifically to a memory card was working due to an error accommodating the larger size of the Tonyhax International loader since v1.1.3. This issue has now been resolved and everything works as expected with both the tonyhax.mcs and HAX loader files as they are in the correct ‘linked’ format (you can see this in the memcardrex software for example).
  • Updated crosstool-ng to the latest version. Fixed and updated the crosstool-ng config file used to build the Tonyhax International toolchain to work with the latest version. The new config file also makes a more tuned PSX toolchain. The toolchain is set to be tuned for the r3000, for little-endian, for soft-float (no hardware float support), and for a 32-bit ABI. This means the previous CFLAGS setting these options explicitly are no longer necessary and have been removed from the various variable.mk* files in the source.
  • Updated the APv2 decompilation documentation (from the latest official Tonyhax).
  • Added more info on the RAM setups used by Tonyhax International and how they work. This information can be found in the ram-setups.txt file in the docs directory of the source.
  • Substantially rewrote the documentation with more information.
Excellent work, Alex.
 
  • Like
Reactions: alexfree

alexfree

Well-Known Member
OP
Member
Joined
Nov 17, 2021
Messages
182
Trophies
0
Website
alex-free.github.io
XP
1,146
Country
United States

Version 1.1.8 (1/11/2023)​

Changes:

  • A new and exciting boot method known as GameSharkHAX has been added to Tonyhax International. This is a brand new ‘way in’ to the Tonyhax International loader for all PS1 and PS2 consoles that are supported by Tonyhax International (SCPH-1000-SCPH-39004). It uses GameShark codes to boot the Tonyhax International loader off a memory card file mid-game.
  • Condensed the Boot CD back to just one BIN+CUE file set. It is not actually necessary to have 2 different versions of the Boot CD, the single BIN+CUE file set in all Tonyhax International releases from here on out will work in every supported use case.
  • The documentation has been split into multiple markdown and html files. This makes it much more easy to maintain for me, and easier for you to comprehend, read, and share. The ‘all in one html file’ style before became unmanageable due to the sheer amount of info that has been added since the initial release.
 

AngelDavil88

Well-Known Member
Newcomer
Joined
May 18, 2019
Messages
54
Trophies
0
Age
35
XP
336
Country
Italy
@alexfree Hi, I have a ps2 Scph-30004, Original Cool Boarders 4 PAL SCES-02283 disc and original Sony memory card. I copied both the BESCES-0228316 (raw) and the HAX file (raw) to the ps1 memory card on slot 1 via ps2. When I start the game Cool Boarders 4 nothing is loaded automatically (records and settings). Can you verify please? Thank you!

EDIT: Only the tonyhax original 1.4.5 works with its save and its loader, with international nothing to do. I think the European save in the 1.1.8 package is corrupted (previous packages don't work either). If you can please help me I would be grateful!

EDIT 2: I temporarily fixed it like this: I put the original tonyhax save and then renamed the "hax" raw file to "BESLEM-99999TONYHAX". So tonyhax 1.1.8 started normally!
 

Attachments

  • Screenshot_20230207_184132_Samsung Internet.jpg
    Screenshot_20230207_184132_Samsung Internet.jpg
    339.4 KB · Views: 43
Last edited by AngelDavil88,
  • Like
Reactions: alexfree

alexfree

Well-Known Member
OP
Member
Joined
Nov 17, 2021
Messages
182
Trophies
0
Website
alex-free.github.io
XP
1,146
Country
United States
@alexfree Hi, I have a ps2 Scph-30004, Original Cool Boarders 4 PAL SCES-02283 disc and original Sony memory card. I copied both the BESCES-0228316 (raw) and the HAX file (raw) to the ps1 memory card on slot 1 via ps2. When I start the game Cool Boarders 4 nothing is loaded automatically (records and settings). Can you verify please? Thank you!

EDIT: Only the tonyhax original 1.4.5 works with its save and its loader, with international nothing to do. I think the European save in the 1.1.8 package is corrupted (previous packages don't work either). If you can please help me I would be grateful!

EDIT 2: I temporarily fixed it like this: I put the original tonyhax save and then renamed the "hax" raw file to "BESLEM-99999TONYHAX". So tonyhax 1.1.8 started normally!
I'll look into this, thanks for the bug report. Other games work as intended, it is possible something got messed up with that specific game in International.
Post automatically merged:

@alexfree Hi, I have a ps2 Scph-30004, Original Cool Boarders 4 PAL SCES-02283 disc and original Sony memory card. I copied both the BESCES-0228316 (raw) and the HAX file (raw) to the ps1 memory card on slot 1 via ps2. When I start the game Cool Boarders 4 nothing is loaded automatically (records and settings). Can you verify please? Thank you!

EDIT: Only the tonyhax original 1.4.5 works with its save and its loader, with international nothing to do. I think the European save in the 1.1.8 package is corrupted (previous packages don't work either). If you can please help me I would be grateful!

EDIT 2: I temporarily fixed it like this: I put the original tonyhax save and then renamed the "hax" raw file to "BESLEM-99999TONYHAX". So tonyhax 1.1.8 started normally!
There was indeed an issue, I have fixed it in the files attached to work as expected.

These fixes will be in Tonyhax International v1.1.9 (not out yet), thanks for the report. The checksum wasn't being written in the correct spot for Cool Boarders 4 for some reason, that script got modified.

@AngelDavil88
 

Attachments

  • fixed-cb4-eu.zip
    19.2 KB · Views: 32
  • Screenshot_2023-02-16_12-14-17.png
    Screenshot_2023-02-16_12-14-17.png
    60.5 KB · Views: 48
Last edited by alexfree,

AngelDavil88

Well-Known Member
Newcomer
Joined
May 18, 2019
Messages
54
Trophies
0
Age
35
XP
336
Country
Italy
I'll look into this, thanks for the bug report. Other games work as intended, it is possible something got messed up with that specific game in International.
Post automatically merged:


There was indeed an issue, I have fixed it in the files attached to work as expected.

These fixes will be in Tonyhax International v1.1.9 (not out yet), thanks for the report. The checksum wasn't being written in the correct spot for Cool Boarders 4 for some reason, that script got modified.

@AngelDavil88
Thanks! ;)
 

alexfree

Well-Known Member
OP
Member
Joined
Nov 17, 2021
Messages
182
Trophies
0
Website
alex-free.github.io
XP
1,146
Country
United States
Tonyhax International v1.1.9 is out: https://github.com/alex-free/tonyhax/releases/download/v1.1.9i/tonyhax-v1.1.9-international.zip

Changes:

  • Fixes potential lockups/freezing right before booting.
  • Fixed the Cool Boarders 4 save game exploit not working correctly (thank you AngelDavil88 for pointing this out)!
  • The save game file template ‘hack’ I was using has been replaced with a proper equivalent for the 24KB tonyhax.exe maximum file size RAM setup currently in use (thanks Shendo)!
  • A new GameSharkHAX code for Parasite Eve USA is now available.
  • GameSharkHAX codes are all now auto-generated in the build step thanks to my new program GSHAX Tool.
  • Added more info on the GameSharkHAX code method, specifically on which exact GameShark model versions are useful with this boot method (even though all GameShark model versions work regardless of their usefulness).
  • The documentation is now only in markdown format (the website is only using auto-generated HTML from said markdown via GitHub pages now). The pandoc requirement hence has been removed from the build step.
  • The build-tool-chain.sh script now automatically compiles MKPSXISO at the end of building the MIPS toolchain for the PSX.
  • Updated [MKPSXISO] to the latest commit as of 3/6/2023.
  • Added info to the Boot CD documentation that explains how to use specific GameShark cartridge or GameShark CD versions to start the Tonyhax International Boot CD.
 

alexfree

Well-Known Member
OP
Member
Joined
Nov 17, 2021
Messages
182
Trophies
0
Website
alex-free.github.io
XP
1,146
Country
United States

Version 1.2.0 (3/17/2023)​

Changes:

  • Fixes lockup/freezing that only occurred in specific games (i.e. Tekken 3) when using the FreePSXBoot exploit boot method. Now however, Before starting any backup or import disc in the loader YOU MUST REMOVE THE FREEPSXBOOT MEMORY CARD to ensure successful booting of your backup or import disc. THIS APPLIES TO BOTH SLOT 1 AND SLOT 2 FREEPSXBOOT CARDS. This enables more games to work through this boot method and simplifies the loader. The loader will tell you to remove the FreePSXBoot memory card as well now.
 

KleinesSinchen

GBAtemp's Backup Reminder + Fearless Testing Sina
Member
GBAtemp Patron
Joined
Mar 28, 2018
Messages
4,432
Trophies
2
XP
14,878
Country
Germany

Version 1.2.0 (3/17/2023)​

Changes:

  • Fixes lockup/freezing that only occurred in specific games (i.e. Tekken 3) when using the FreePSXBoot exploit boot method. Now however, Before starting any backup or import disc in the loader YOU MUST REMOVE THE FREEPSXBOOT MEMORY CARD to ensure successful booting of your backup or import disc. THIS APPLIES TO BOTH SLOT 1 AND SLOT 2 FREEPSXBOOT CARDS. This enables more games to work through this boot method and simplifies the loader. The loader will tell you to remove the FreePSXBoot memory card as well now.
This is awesome. I'm very impressed by the development of PS1 and PS2 stuff in the last few years.

What we would need now is a way of producing a self-booting disc with Tonyhax International. An PS1 unlocking disc in 8cm size.
Stop dreaming, Sinchen!
 

alexfree

Well-Known Member
OP
Member
Joined
Nov 17, 2021
Messages
182
Trophies
0
Website
alex-free.github.io
XP
1,146
Country
United States
This is awesome. I'm very impressed by the development of PS1 and PS2 stuff in the last few years.

What we would need now is a way of producing a self-booting disc with Tonyhax International. An PS1 unlocking disc in 8cm size.
Stop dreaming, Sinchen!
You know, this is totally possible (in theory).

Someone needs to hook me up with either the CD pressing factory that did the Datel GameShark CD-ROMs for the PS1 or the PSX Change CD-ROM discs. Then I’d just need to win the lottery and could afford it.

Thanks for the kind words.
 

KleinesSinchen

GBAtemp's Backup Reminder + Fearless Testing Sina
Member
GBAtemp Patron
Joined
Mar 28, 2018
Messages
4,432
Trophies
2
XP
14,878
Country
Germany
Forgive me the following long text. Just blathering away a bit. It goes off-topic, but is somehow still relevant for PS1 homebrew in general and Tonyhax International in particular.

You know, this is totally possible (in theory).
Of course it is possible. It has been done. Unfortunately I don't see a way with consumer equipment.

Someone needs to hook me up with either the CD pressing factory that did the Datel GameShark CD-ROMs for the PS1 or the PSX Change CD-ROM discs.
After all this years Datel should spill the beans how exactly they did it. There is no harm for either Datel or rights holders of PS1 games. The latter are out of production for eternity and can be pirated in numerous ways. It is not that this knowledge would open a previously tightly closed gate.
Quite the contrary: I see plenty of legal possibilities. I mean there are new commercial Dreamcast games using the MIL-CD loophole. Producing unlicensed (not licensed by Sony) discs of homebrew software would be nice. There are new releases for NES, Game Boy and the like on cartridges.
Just that d*mn SCEx protection is preventing new PS1 discs.

Regarding Tonyhax and similar software unlocking the drive: They can and will be interpreted as piracy tools. Realistically speaking it is true. Just look how often people use the word "backups" (putting it in quotes) as an euphemism for illegal copies (opposed to legitimate backups when owning an original). With that argumentation Nintendo successfully outlawed R4 cards – despite many legal areas applications:
Can be (ab)used as piracy tool → 100% just a piracy tool​

Then I’d just need to win the lottery and could afford it.
Not really. CD pressing is not expensive. Some companies offer starting as low as 100 copies for creating a glass master with a total cost of about 300 to 400 Euros (master + 100 copies). Once you have the glass master each produced disc is penny article. It has always been like this. That is why N64 games were so much more expensive compared to PS1. The financial risk of not selling enough N64 carts was also way higher than not selling the whole stock of a PS1 shovelware title.
It would be easy enough to sell one key disc for about 5 Dollar/Euro while producing them for pennies. Problematic is the legal problem: I wouldn't dare to sell an unlocker (or just contact a CD pressing plant for such a task) because fearing to get f…ed in court for piracy business.
You never know what happens. Just look at eBay. It is full of obvious piracy ("reproduction cartridges" as euphemism, R4 clones loaded with several 100 ROMs) and nobody seems to care. I bet if I was to even think about doing such a thing (which I wouldn't), the police would knock at my door a minute later.
=========

What follows from the long text? It would be so nice to find a way to do it at home. But the thing is a beast. I've read through the patent (which seems to be full of OCR errors online) and it is just a general idea. Just a few buzzwords connected in an intelligent looking way… and there you have it: Patent worthy invention. The underlying idea is ingenious though, as normal consumer hardware is thoroughly unable to even gather the tracking data – let alone reproduce it.
 

alexfree

Well-Known Member
OP
Member
Joined
Nov 17, 2021
Messages
182
Trophies
0
Website
alex-free.github.io
XP
1,146
Country
United States
Forgive me the following long text. Just blathering away a bit. It goes off-topic, but is somehow still relevant for PS1 homebrew in general and Tonyhax International in particular.


Of course it is possible. It has been done. Unfortunately I don't see a way with consumer equipment.


After all this years Datel should spill the beans how exactly they did it. There is no harm for either Datel or rights holders of PS1 games. The latter are out of production for eternity and can be pirated in numerous ways. It is not that this knowledge would open a previously tightly closed gate.
Quite the contrary: I see plenty of legal possibilities. I mean there are new commercial Dreamcast games using the MIL-CD loophole. Producing unlicensed (not licensed by Sony) discs of homebrew software would be nice. There are new releases for NES, Game Boy and the like on cartridges.
Just that d*mn SCEx protection is preventing new PS1 discs.

Regarding Tonyhax and similar software unlocking the drive: They can and will be interpreted as piracy tools. Realistically speaking it is true. Just look how often people use the word "backups" (putting it in quotes) as an euphemism for illegal copies (opposed to legitimate backups when owning an original). With that argumentation Nintendo successfully outlawed R4 cards – despite many legal areas applications:
Can be (ab)used as piracy tool → 100% just a piracy tool​


Not really. CD pressing is not expensive. Some companies offer starting as low as 100 copies for creating a glass master with a total cost of about 300 to 400 Euros (master + 100 copies). Once you have the glass master each produced disc is penny article. It has always been like this. That is why N64 games were so much more expensive compared to PS1. The financial risk of not selling enough N64 carts was also way higher than not selling the whole stock of a PS1 shovelware title.
It would be easy enough to sell one key disc for about 5 Dollar/Euro while producing them for pennies. Problematic is the legal problem: I wouldn't dare to sell an unlocker (or just contact a CD pressing plant for such a task) because fearing to get f…ed in court for piracy business.
You never know what happens. Just look at eBay. It is full of obvious piracy ("reproduction cartridges" as euphemism, R4 clones loaded with several 100 ROMs) and nobody seems to care. I bet if I was to even think about doing such a thing (which I wouldn't), the police would knock at my door a minute later.
=========

What follows from the long text? It would be so nice to find a way to do it at home. But the thing is a beast. I've read through the patent (which seems to be full of OCR errors online) and it is just a general idea. Just a few buzzwords connected in an intelligent looking way… and there you have it: Patent worthy invention. The underlying idea is ingenious though, as normal consumer hardware is thoroughly unable to even gather the tracking data – let alone reproduce it.
Datel totally should, but they won't because there is nothing in it from them. The PSX-Change discs (a.k.a 'Import Enabler') were sold until quite recently AFAICT, and even though they are not seemingly sold any longer, same deal. No upside (to them).

I feel like you really can't outlaw something like this, because now more then ever it is needed. CD-ROMs get bit-rot and scratched and are getting expensive again to replace due to time and age. DMCA even allows you to make personal backups totally legit. And Import discs are a real use case.

Now this is my super hot take on reproducing the SCEX wobble protection (which from what everyone can tell is just custom ATIP information, possibly just containing the SCEX string over and over). The Sega V.S. Accolade case set the precedent that if the only way to create an unlicensed copy is to display a logo/have some code somewhere to make it start then that is protected by law as a right at least in the USA. So I think It would totally be fine. This is also why I think the license data needed to make backups on the PSX work (in some cases) is also fine.

The wobble is insanely impressive. The patent is indeed vague, but the idea is really smart. Essentially from what I understand is that CD-ROMs can have data pressed earlier (closer to the center lead-in) then a CD-R because a CD-R has to have an ATIP area which under normal circumstances is containing info for the burner firmware to use when burning the disc. The CD-ROM is pressed not burned so it doesn't have that area, unless your Sony who made an artificial ATIP like area that has their SCEX string pressed instead. The ATIP info is probably more advanced then this though, it probably causes specific read errors which somehow send the expected SCEX string.

The real solution is to find a CD-ROM pressing factory. Send them a PSX disc and have them extract the exact ATIP information pressed into the disc. Then reproduce that ATIP information in a glass master and then append whatever PSX software to the rest of the disc. Maybe just tell them to extract the first 2 minutes of the disc or something... Apparently, there used to be something called Hong Kong Silvers that were actually exactly like this, self-booting bootlegs.

Square Enix still actually makes PSX discs a few times a year and sells them on their website. The technology is still out there.

The current situation is really not that bad though. You can use a PSX-Change disc to simply boot the Tonyhax International Boot CD. You can also use many GameSharks to do the same since almost all of them include a 'back door' that allows that. For the GameSharks that don't, you can use my GameSharkHAX codes to hack a game into starting the Tonyhax International loader PS-EXE off of a memory card. The super early launch PlayStations also have the CD Player Swap Trick backdoor built in that does not require swapping a moving disc (the only swap trick that allows swapping a stopped disc actually). Plus all of the other boot methods now available in International.
 
Last edited by alexfree,

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    K3Nv2 @ K3Nv2: they be like which lite firefox exe pls