Tonyhax is a new softmod backup loader for the PlayStation 1



Those wanting to take their original PlayStation to the next level usually needed to open up the system and install a modchip; that's been common knowledge since even the '90s. However, a user named Socram, previously known for creating amiitool, has released an exploit that makes modding your PS1 easier than ever before. Called "tonyhax", because it utilizes Tony Hawk's Pro Skater 2 or 3, it loads specific data off of the PS1's memory card that "unlocks" the system's disc drive, which then lets you run other region games or even backups.

tonyhax is a save game exploit that uses a specially crafted save game for the Tony Hawk's Pro Skater 2 and 3, in both PAL and NTSC-U versions, to load a custom backup loader that uses no$psx' secret CD unlock commands to enable loading backups on a totally unmodded and stock PS1.

After "extensive testing", Socram has decided to release their exploit to the public, source code and all. The full project is available on GitHub, while a writeup and documentation as to how tonyhax works is available on their website. The creator says that the exploit is possible because in either Tony Hawk's Pro Skater 2 or Tony Hawk's Pro Skater 3 (NTSC or PAL), the game doesn't check if a skater profile name has been edited or messed with in any way. Should you edit the skater name in a dramatic way, it overwrites the memory of the system, which in turn allows custom code to be run.

This first stage payload is about 144 bytes, and its sole purpose is to load the secondary program loader (or SPL for short) from an additional save file in the memory card using the PS1 BIOS calls. Once loaded, it jumps straight to it.

As the console is left in an inconsistent state, the SPL first reinitializes the system kernel (RAM, devices…), by using the very same calls the ROM executes during the booting of the console.

After that, the GPU is reset. Once the GPU is ready again, the sets up the video to a resolution of 320x240, unpacks the 1bpp font from the BIOS ROM into VRAM, and draws the basic border and program name to know everything is working fine until this point.

With a fully working screen, it then proceeds to unlocks the CD drive to accept discs missing the SCEx signature, leveraging the CD BIOS unlock commands found by Martin Korth. These unlock commands are a sort of backdoor, and the drive, probably in order to keep them secret, returns an error instead of a success message. The SPL is coded to expect a particular error to be returned, and will actually abort if the drive returns that it succeeded or if it returns another unexpected error code.

After unlocking it, it waits for the lid to be opened and closed, allowing the user to insert a new CD.

After that, the CD filesystem is reinitialized. It proceeds to read the SYSTEM.CNF configuration file, reinitializes the kernel with the parameters the game needs, and finally loads and runs the game’s main executable.

You'll need a PS1 memory card with tonyhax on it, to which Socram recommends using a PS2 and Free MCBoot to copy it. After loading the profile in-game, the exploit will boot up, and your CD drive will then accept games, even if they're burned CD-R backups, or games from other regions. Tonyhax works on all PAL PlayStation consoles, NetYaroze, and all NTSC-U systems except the original SCPH-1000.

:arrow: Source
:download: Download Link
 

Tom Bombadildo

Dick, With Balls
Member
Joined
Jul 11, 2009
Messages
14,568
Trophies
2
Age
29
Location
I forgot
Website
POCKET.LIKEITS
XP
19,129
Country
United States
This is super cool. I don't think I have any way to move a modded save to a PS1 memory card at this particular moment, but this is definitely something I'm 100% going to get around to doing at some point since I don't really want to install a modchip in my PS1 and the disc swap method is annoying :lol:
 

TwistedZeon

Well-Known Member
Member
Joined
May 15, 2014
Messages
184
Trophies
0
XP
2,504
Country
Canada
This is actually one of the coolest things in awhile! I wonder if this could lead to solderless methods for loading roms from an sd card since it seems like the only reason you need to solder for xstation and the like is for disc protection stuff or so I believe.
 

djpannda

GBAtemp's Pannda
Member
GBAtemp Patron
Joined
Sep 14, 2009
Messages
2,469
Trophies
3
XP
6,338
Country
United States
This is actually one of the coolest things in awhile! I wonder if this could lead to solderless methods for loading roms from an sd card since it seems like the only reason you need to solder for xstation and the like is for disc protection stuff or so I believe.
I just realized this....whoa I bet Tony Hawk is going to Sky Rocket
 
  • Like
Reactions: Julie_Pilgrim

smallissue

Well-Known Member
Newcomer
Joined
Nov 8, 2020
Messages
90
Trophies
0
Location
123 Street St. AZ Phoenix 56
Website
teddit.net
XP
475
Country
Antarctica
not sure if this is easier or harder than a modchip
but this is poggers either way
IJckWD.png
 
  • Like
Reactions: Julie_Pilgrim

socram8888

Well-Known Member
Newcomer
Joined
Apr 6, 2009
Messages
81
Trophies
1
Age
29
Location
Valencia, Spain
Website
orca.pet
XP
560
Country
Spain
This is actually one of the coolest things in awhile! I wonder if this could lead to solderless methods for loading roms from an sd card since it seems like the only reason you need to solder for xstation and the like is for disc protection stuff or so I believe.
tonyhax author here.

I've had some crazy ideas about maybe creating a custom SD to memory card adapter, since both SD cards and memory cards use standard SPI. It wouldn't be even necessary to open the console or touch anything inside, just an adapter much like on a GC.

For now I'm gonna focus on trying to port this exploit to other games.
 

Tom Bombadildo

Dick, With Balls
Member
Joined
Jul 11, 2009
Messages
14,568
Trophies
2
Age
29
Location
I forgot
Website
POCKET.LIKEITS
XP
19,129
Country
United States
tonyhax author here.

I've had some crazy ideas about maybe creating a custom SD to memory card adapter, since both SD cards and memory cards use standard SPI. It wouldn't be even necessary to open the console or touch anything inside, just an adapter much like on a GC.

For now I'm gonna focus on trying to port this exploit to other games.
Actually someone has made one very recently! https://8bitmods.com/memcard-pro-for-playstation-1/ < Still not released (and a little expensive, IMO) and it's just for making tons of virtual memory cards, but I assume someone could easily write a firmware to do exactly that :lol:
 

KokoseiJ

GBAtemp VOCALOID Enthusiast
Member
Joined
Jul 18, 2020
Messages
333
Trophies
0
Age
18
XP
614
Country
Korea, South
tonyhax author here.

I've had some crazy ideas about maybe creating a custom SD to memory card adapter, since both SD cards and memory cards use standard SPI. It wouldn't be even necessary to open the console or touch anything inside, just an adapter much like on a GC.

For now I'm gonna focus on trying to port this exploit to other games.
Mad respect to you. That was some amazing work.
It would be really nice to get SD to Memory Card adapter- would really be handy for both PS1 and PS2 uses. either it happens or not, I respect your decisions and appreciate all your works.
 

socram8888

Well-Known Member
Newcomer
Joined
Apr 6, 2009
Messages
81
Trophies
1
Age
29
Location
Valencia, Spain
Website
orca.pet
XP
560
Country
Spain
Actually someone has made one very recently! https://8bitmods.com/memcard-pro-for-playstation-1/ < Still not released (and a little expensive, IMO) and it's just for making tons of virtual memory cards, but I assume someone could easily write a firmware to do exactly that :lol:
The interesting bit is that you don't even need to make a custom firmware or use any fancy circuitry. If my memory serves me correctly, the PS1 on the memory card uses just standard SPI - that's exactly what SD cards use too.
You couldn't use it for saving in games since the commands are different, BUT you could indeed talk using custom software using nothing but a passive adapter.
I once did for fun a NetYaroze boot card using an Arduino. It just waited the console to emit a particular SPI command, and then replied with what the NetYaroze boot disc expected.
 

Cyan

GBATemp's lurking knight
Former Staff
Joined
Oct 27, 2002
Messages
23,754
Trophies
4
Age
45
Location
Engine room, learning
XP
15,644
Country
France
Ohh,nice.
It's always interesting to see old console's exploit being released.

I thought I wouldn't need to swap games on my PS1 anymore (it's an original launch day SCPH 1002 with swap support), but from what I understand, it's a "swap-loader" method using an original game disc, for non boot swap-compatible consoles.
I thought it was something like PS2 FreeMcBoot directly loading the memory card's exploit, but it's not like that. You always need to play Tony hawk to unlock and "wait for lid", which means it's not compatible with multi-disc games, right ? (Chrono cross or Parasite eve requires disc swapping without saving first)

or is the unlock hack working with in-game swapp ? that's very great for everyone if it works :)


Thanks for releasing it :)
It'll be helpful to many users. It's always nice to have multiple choices !

edit:
Having SDCard adapter for memory card would be great too !
 
Last edited by Cyan,

TwistedZeon

Well-Known Member
Member
Joined
May 15, 2014
Messages
184
Trophies
0
XP
2,504
Country
Canada
tonyhax author here.

I've had some crazy ideas about maybe creating a custom SD to memory card adapter, since both SD cards and memory cards use standard SPI. It wouldn't be even necessary to open the console or touch anything inside, just an adapter much like on a GC.

For now I'm gonna focus on trying to port this exploit to other games.
Hey! Wonderful work here man. That's a very intriguing idea and I honestly would love if something like this could happen. I want an sd method for my ps1 but I just cannot do the intricate soldering needed for most every option out there.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • Sicklyboy @ Sicklyboy:
    Leave
  • Sicklyboy @ Sicklyboy:
    I'm fortunate to have had some managers over the years who I've straight up told to go fuck themselves, and not get in trouble for it. Help that I've been on the receiving end of that as well lmao
  • BigOnYa @ BigOnYa:
    Agreed, you can tell him you quit when you see him in court, (For defecation on property, charges)
  • K3Nv2 @ K3Nv2:
    There's a difference in a abusive management rather than one drilling into you for messing up
  • Sicklyboy @ Sicklyboy:
    Told my last boss that I was resigning and he was confused and asked if I was serious 😭🤣
  • K3Nv2 @ K3Nv2:
    My last boss got investigated for racial slurs and guess what happened to him
  • BigOnYa @ BigOnYa:
    I luckily haven't had a boss in over 20 years, (independent contractor) but the people I do work for, it's pretty much like they my bosses, and yea some can be assholes. But there has been many jobs I've walked off and mailed they're checks back to them.
  • K3Nv2 @ K3Nv2:
    Bosses should yell at workers for mess ups they just need to know the difference in abuse and punishment
  • BigOnYa @ BigOnYa:
    I don't abuse or curse at my employess, I feel like waving the gun around gets the point across just fine.
  • K3Nv2 @ K3Nv2:
    A boss is basically a glorified baby sitter
    +1
  • K3Nv2 @ K3Nv2:
    I respect one's that tells someone what to do clearly, warn them when they mess up and actually put work in with a crew
    +1
  • Sicklyboy @ Sicklyboy:
    That's how all of my last managers have been in this job and my last one. Last time I had a manager where I was being micromanaged to hell and back was over a decade ago when I worked retail
  • Sicklyboy @ Sicklyboy:
    My managers nowadays are perfectly fine assigning me a project and just checking in once every week or two
  • K3Nv2 @ K3Nv2:
    I had to micromanage the managers
  • Sicklyboy @ Sicklyboy:
    At my last job I (as an individual contributor, not a manager or supervisor or anything) used to be the one to tell my manager when I was traveling for work "hey I'm gonna be out of office between x and y dates, I got something on the other side of the country I'm gonna go work on"
  • Sicklyboy @ Sicklyboy:
    Which was not the normal dynamic for that role lmao
  • Sicklyboy @ Sicklyboy:
    Don't get to travel for my current job :(
  • K3Nv2 @ K3Nv2:
    Had me started working 10 days in a row with different days off after that I was like no
  • Sicklyboy @ Sicklyboy:
    On the bright side, I also don't even have to leave my house for my current job, so... could be worse
  • K3Nv2 @ K3Nv2:
    Some of the shift workers were so bad it held us up from 10pm to 10am
  • wolffangalchemist @ wolffangalchemist:
    coming to the painful realization backing up my ps2's hdd to swap in a sata ssd, i need a faster more modern way to interface with old ide hard drives than using hdlgmanclient or ftp over network.
  • Sicklyboy @ Sicklyboy:
    NIC is only 10/100 right?
  • wolffangalchemist @ wolffangalchemist:
    that was fast in they year 2000
    +1
  • wolffangalchemist @ wolffangalchemist:
    i have three network adapters 2 standard us ones with the ethernet and phone jack and one slimmer Japanese one with just a ethernet port. not sure if one would be faster than the other. i installed a sata adapter thing i got off temu for 3 dollars in the Japanese one thought, was surprised it actually works. but considering i got 18 games to go, gonna be a two day endeavor at this point.
    wolffangalchemist @ wolffangalchemist: i have three network adapters 2 standard us ones with the ethernet and phone jack and one...