brad-lin / freepsxboot

Exploit to allow loading arbitrary code on the PSX using only a memory card (no game needed)

FreePSXBoot

Exploit to allow loading arbitrary code on the PSX (i.e. PlayStation 1) using only a memory card (no game needed).

In other words, it's a softmod which requires a memory card, and a way to write raw data to it.

For support or discussion about this exploit and associated tools, you may join the PSXDev Network Discord server:

To use it, you will need a way to copy full memory card images (not individual files) to a memory card. Some possibilities are:

• A PS2 and the software Memory Card Annihilator v2 (use "Restore MC image")
• Memcarduino. Requires soldering wires to the memory card.
• Using a Memcard Pro, which lets you create your own virtual memory cards on an sdcard. Simply drop the card image file you want to use as Memory Card 1, Channel 1.
• Using Unirom and NOTPSXserial with a serial/USB cable, using the command : nops /fast /mcup 0 FILE.mcd COMPORT where FILE is the mcd file corresponding to your model, and COMPORT corresponds to your computer serial port.
• Unirom bootdisc can be used with the disc swap trick to install FreePSXBoot on a memory card.
• MemcardRex with a DexDrive, Memcarduino, PS3 Memory Card Adaptor (CECHZM1), or PS1CardLink. Make sure to use the latest release, which allows to write raw data to the memory card (required for FreePSXBoot).
• ps3mca-ps1 with PS3 Memory Card Adaptor (CECHZM1).
• PSXGameEdit with a DexDrive (success not guaranteed)

Slot 1 or slot 2?

FreePSXBoot memory card images are provided for slot 1 or slot 2. The memory card must be plugged in the corresponding slot on the PlayStation for FreePSXBoot to work. It is recommended to use images for slot 2, as they allow the FreePSXBoot memory card to remain plugged in while using another memory card in slot 1 for normal operations.

When launched from a memory card in slot 2, FreePSXBoot patches the PlayStation kernel to disable the memory card in slot 2, ensuring that the exploit doesn't trigger while playing a game. This means that the memory card doesn't have to be unplugged before launching a game.

If you are using a Memcard Pro, or need to use the two memory card slots normally, use slot 1 images instead.

In short: use the memory card images for slot 2, unless you have a Memcard Pro.

WARNING

By flashing FreePSXBoot to your Memory Card, you need to be aware of the following:

• The .mcd image files replace the whole contents of your card, meaning that your Memory Card will be ENTIRELY WIPED after flashing a .mcd image, so creating a backup of your saves is compulsory.

• Because the exploit has corrupt Memory Card filesystem on purpose for it to run, your card will become unusable for normal operations. That is, you won't be able to use this card for saving and loading game saves and it will cause crashes on your PS1 or your PS2 console (if you have any).

• Once installed, it may become difficult to uninstall, as the normal software to re-format a memory card won't work, due to the exploit itself. You could end up with no means to recover the memory card; if for example your installation method was Memory Card Annihilator v2, then it will also crash. Memcarduino, Unirom, or using the Memcard Pro would currently be safe bets.

Usage

• Copy the full memory card image corresponding to your model/BIOS to a memory card.
• Insert it in the correct slot (images for slot 2 are strongly recommended, unless you have a Memcard pro).
• Power up your PlayStation with the lid open, and go to the memory card manager.
• After a few seconds, the screen will be filled with cyan. Wait ~30 seconds for the Unirom welcome screen to appear.
• If the cyan screen doesn't appear, you have either used a wrong memory card image, or the memory card image was not written properly (the mcd file must be written as raw data to the memory card), or something else went wrong. If you are 100% certain that the memory card image was written properly, and that you are using the correct image, please open an issue.
• Once Unirom is loaded, you can insert a CD, close the lid, and press R1 to load the game; for more information see Unirom usage. Note: Japanese PlayStation cannot have their CD drive unlocked by Unirom, and need a specific manipulation to load backups.
• Only if you are using a slot 1 image and don't have a Memcard Pro: remove your memory card, as its exploit will trigger into games as well.

Restoring the memory card

• Use MemcardRex.
• Use ps3mca-ps1 with PS3 Memory Card Adaptor (CECHZM1).
• Some games that have a save file manager (shows the contents of the memory card before saving) built into them, like OddWorld: Abe's Oddysee and Cool Boarders 4 (suffers from a caveat that keeps the game from loading the memory card with certain exploit versions) for example, can be used to overwrite FreePSXBoot when saving progress.
• Memory Card Annihilator v2 may be able to format a card, but it has to be inserted at the last moment. This method is not guaranteed to work.
• In general, tools and games crash when attempting to format a memory card loaded with FreePSXBoot, but may be able to format it by first inserting a normal memory card, and switching it with the FreePSXBoot memory card just before the format operation starts.
• Unirom's memory card manager can format memory cards.

Supported models

• All models are supported and tested on emulator or real hardware, except the debug models (DTL-H) and Net Yaroze (they may work, but are not tested).
• As of version 20210419, the exploit is 100% reliable on all supported models. Nevertheless, some exploit images were only tested on emulators and may not work on real hardware; feedback is welcome.
• See the table below for more details and download links.

Troubleshooting

• It is recommended to use a normal game pad when running the exploit. Special game pads may interfere with the exploit and prevent it to run.
• Some third party memory cards cannot be written properly with a slim PS2, because they need the 7.5V line to work.
• Some models (e.g. SCPH-102) may have different BIOS versions. Either try them one by one, or use the Unirom CD (with the disc swap trick) to get your BIOS version.

Changelog

• 2022-09-19: Unirom version updated to 8.0.K
• 2022-04-07: Duplicate payload in images to support fake memcards with 512 kb chips
• 2022-03-18: New kernel patch for slot 2; should fix games which can't handle wrong memory card handshake
• 2021-10-04: Unirom version updated to 8.0.J
• 2021-07-03: FreePSXBoot patches the kernel when run from slot 2 (memory card can remain inserted)
• 2021-07-03: Exploit updated to work on slot 2
• 2021-07-03: Unirom version updated to 8.0.I
• 2021-05-05: Unirom version updated to 8.0.H
• 2021-04-28: Fixed exploit for BIOS versions 2.1 (A) and 2.2 (A) (read dummy frame to avoid errors)
• 2021-04-27: Added support for more BIOS versions, which are now identified by their CRC32
• 2021-04-22: Added support for BIOS 2.0 (1995-05-07), 4.0 and 4.1 (1997-11-14)
• 2021-04-21: Added support for BIOS 1.1, and fixed BIOS 2.0 exploit (needs icache flush to work)
• 2021-04-21: Progress bar added in stage2 payload (thanks Nicolas Noble)
• 2021-04-20: Added support for BIOS 3.0 1996-09-09 (SCPH-5500) (thanks sickle)
• 2021-04-19: Added support for BIOS 1.0 and 4.3 (SCPH-1000 and SCPH-100 respectively)
• 2021-04-19: Exploit 100% reliable for every supported BIOS; now hooks an ISR (thanks sickle)
• 2021-04-19: Unirom version updated to 8.0.F
• 2021-04-14: Exploit uses fastload, which reads the memory card much faster than Sony's code (thanks Nicolas Noble)
• 2021-04-12: New version of Unirom, able to load games. Huge thanks to the psxdev contributors.
• 2021-04-11: 100% reliable exploit for the SCPH-7002, SCPH-7502 and SCPH-9002.

Information

Technical details

Demonstration

Downloads

These images are pre-built with Unirom.

There are different downloads for different BIOS versions. Please download the correct ROM for your BIOS version. If a model or BIOS version is missing, it means it is not supported yet.

As more reliable or faster versions of the exploit are developed, the images are updated. Older versions can be found in the images directory.

BIOS version/region	BIOS CRC32	Models	100% reliable	Download Link Slot 2 (recommended)	Download Link Slot 1 (For Memcard Pro)
1.0 (1994-09-22) I	3b601fc8	SCPH-1000	Yes	20220919 Slot 2	20220919 Slot 1
1.1 (1995-01-22) I	3539def6	SCPH-3000	Yes	20220919 Slot 2	20220919 Slot 1
2.0 (1995-05-07) A	55847d8c	SCPH-1001	Yes; see note below	20220919 Slot 2	20220919 Slot 1
2.0 (1995-05-10) E	9bb87c4b	SCPH-1002	Yes; see note below	20220919 Slot 2	20220919 Slot 1
2.1 (1995-07-17) A	aff00f2f	SCPH-1001	Yes	20220919 Slot 2	20220919 Slot 1
2.1 (1995-07-17) E	86c30531	SCPH-1002	Yes	20220919 Slot 2	20220919 Slot 1
2.1 (1995-07-17) I	bc190209	SCPH-3500	Yes	20220919 Slot 2	20220919 Slot 1
2.2 (1995-12-04) A	37157331	SCPH-1001 SCPH-5003	Yes	20220919 Slot 2	20220919 Slot 1
2.2 (1995-12-04) E	1e26792f	SCPH-1002	Yes	20220919 Slot 2	20220919 Slot 1
2.2 (1995-12-04) I	24fc7e17	SCPH-5000	Yes	20220919 Slot 2	20220919 Slot 1
3.0 (1996-09-09) I	ff3eeb8c	SCPH-5500	Yes	20220919 Slot 2	20220919 Slot 1
3.0 (1996-11-18) A	8d8cb7e4	SCPH-5001 SCPH-5501 SCPH-5503 SCPH-7003	Yes	20220919 Slot 2	20220919 Slot 1
3.0 (1997-01-06) E	d786f0b9	SCPH-5502 SCPH-5552	Yes	20220919 Slot 2	20220919 Slot 1
4.0 (1997-08-18) I	ec541cd0	SCPH-7000 SCPH-7500 SCPH-9000	Yes	20220919 Slot 2	20220919 Slot 1
4.1 (1997-11-14) A	b7c43dad	SCPH-7000W	Yes	20220919 Slot 2	20220919 Slot 1
4.1 (1997-12-16) A	502224b6	SCPH-7001 SCPH-7501 SCPH-7503 SCPH-9001 SCPH-9003 SCPH-9903	Yes	20220919 Slot 2	20220919 Slot 1
4.1 (1997-12-16) E	318178bf	SCPH-7002 SCPH-7502 SCPH-9002	Yes	20220919 Slot 2	20220919 Slot 1
4.3 (2000-03-11) I	f2af798b	SCPH-100	Yes	20220919 Slot 2	20220919 Slot 1
4.4 (2000-03-24) A	6a0e22a0	SCPH-101	Yes	20220919 Slot 2	20220919 Slot 1
4.4 (2000-03-24) E	0bad7ea9	SCPH-102	Yes	20220919 Slot 2	20220919 Slot 1
4.5 (2000-05-25) A	171bdcec	SCPH-101 SCPH-103	Yes	20220919 Slot 2	20220919 Slot 1
4.5 (2000-05-25) E	76b880e5	SCPH-102	Yes	20220919 Slot 2	20220919 Slot 1

Note for BIOS 2.0 (SCPH-1001 or SCPH-1002) slot 1 only: the memory card containing FreePSXBoot must be inserted in slot 1, and another memory card must be present in slot 2. The memory card in slot 2 can have any content.

See the folder builder for a tool that can be used to generate your own payloads and memory cards.

The exploit works in emulators as well. Tested with no$psx, pcsx-redux, and DuckStation.

freepsxboot's Issues

Third party MC

Hi, I'm planning to install FPSXB on a not original MC (I have a BILBO 1MB one and two 2MB MC I don't know the brand). They always worked flawlessly.

I see there isn't any warning about third party MCs in the readme, so I should be good, right?

One last question. After I install it (with MCA), in case there will be an update or I'd want another installation for use it on a different Ps1 model, I guess I can't just overwrite the installation, it's correct?

I read in this other issue: #31 about PSX Hacker Kit 18 in 1. If it is really reliable, I think it should be added (or at least the link on the readme).

Thank you and sorry for grammatical mistakes (I'm not english).

Another method to let freepsxboot card return to normal

1.use memcarduino makes a ps memory card reader by arduino.

2.use memcardRex 1.8 format the memory card.

Name conflict with other project for the actual PSX (the Japanese DVR)

List of BIOS-versions to be confirmed on hardware?

Hello.
In the latest README-change a sentence was added that not all BIOS-versions were tested on hardware but only with an emulator.
Is there a list of those versions still waiting to be confirmed on hardware?
THanks.

I have some doubts can someone please clearified them please?

When I create a Freepsxboot mc, can I use it in any ps1 and psone? (like freemcboot) or I only can use it in that model and bios version?

This works on ntsc-j ps1 and psone consoles?

Motor Toon Grand Prix (JPN) freezes unless you yank the memory card out.

I don't know if this is the right place to put this but I've been having trouble with loading this particular game. So I have a legit copy and I'm using a Memcard Pro loaded with FreePSXBoot and a PSOne (the slim one). I do have the right image on my card because I was able to easily load my copy of Fire Pro Wrestling G easily with no problems.

After FreePSXBoot does it's thing, it freezes on the Sony Computer Entertainment Presents screen. I thought something was wrong, until I pulled out the memory card and it would boot normally. So as an alternative, I used another memory card I had lying around it was able to save and load fine and during all of that, I noticed that my Memcard wouldn't create another virtual memory card dedicated to the game. And I'm assuming the game is trying to read the memory card, but it's obviously "corrupt" according to the games standards.

TL;DR: Motor Toon Grand Prix (
SCPS-10001) doesn't play well with Memcard Pro installed with FreePSXBoot, it tries to read the data on the card and create a save on said card, a VMC dedicated to the game isn't being created and because of all this mess, the game freezes after the game is loaded.

Memory Card flashed with SCPH-101 BIOS v4.5 can't boot up UniROM

I've reflashed the memory card various times with the correct .mcd image, and yet I cannot trigger a flashing orange screen and eventually a UniROM execution (the memory card icon remains filled in black). Also, I've tested the image on various PlayStation emulators including pcsx-redux, and what it only does is show a solid orange screen and then restart the BIOS when opening the memory card menu.

Wrong project name

PSX is the DVR based on PS2
PS1 is PS-X

Manual swap on ntsc-j 3500 not working

Manual swap on ntsc-j 3500 not working, when I remove the memory card, the tv goes black and appears the message "no signal"

SCPH-100 not valid CD...

tested
pal-scph7002 pal/jp/us work .backup do not work
pal-scph102 pal/jp/us/backup work

jp-scph100
I try your last 3 images for the 4.3Bios.
Exploit is running , but i can not start any game ,except jp.
Not a valid CD or the drive is locked!

Using the memory card on an incorrect BIOS destroys the payload

I was trying to load tonyhax using the exploit on an emulator, but had the wrong BIOS accidentally loaded. This resulted in the exploit failing to load (which is totally benign), but also I ended up with the frame 0x3F overwritten as part of the write check, which destroyed the payload.

I see two ways of working around this issue:

• Modify the script to load from 0x40 onwards only, which means the payload would be limited to 122880 bytes. Easiest solution to implement, and the one that implies simpler logic.
• Modify the builder script to skip sector 0x3F, and loading script to do the same. We'd have 128768 bytes in total, but would complicate the loading and building procedure.

EDIT: This seems to also happen if using the correct BIOS:

tonyhax-scph9002.mcd.zip

Formatting using memory card annihilator v2 guide, UPDATED

I have 100% success formatting FreePSXBoot MC with MCA v2.

I follow this step to format with a ps2 without freezing it.

1.-insert an USB with MCA V2 in it.
2.-Run and old version of launchELF (uLaunchELF v4.39) from here https://drive.google.com/file/d/14QEU0CW3vI_T1xma1BDGk-mKDbOGKaZK/view?usp=sharing
3.-Insert FreePSXboot MC in slot1
4.-Insert a normal PS2 MC in slot 2 (Do not skip this step, is necessary)
5.-In uLaunch open MC1:\ (You will see nothing there)
6.-go Back to root
7.-In uLaunch open MC2:\ (You will see its content)
8.-go Back to root
9.-In uLaunch open mass:
10.-Run MCA from the USB
11.-The two MC will appear as options and the program will work normally.
12.-Format MC1 using MCA.

If you go directly to MCA Skipping the first steps the PS2 will freeze.

UPDATED1: step 4 is necessary, works with an old version of launchELF, I shared mine.
UPDATED2: Thanks to VRtinker for testing and confirming that this does not work with newer version of LaunchELF.
UPDATED3: Work with a few images only not all, tested with 2.0, 2.1, 2,2 and 3.0. Issue closed. Needs more testing. I'm formatting with unirom CD now.

Are BIOS 4.0 or SCPH-7000W incompatible or covered by 4.1?

Just noticed that BIOS 4.0 (ps-40j) and SCPH-7000W (ps-41a(w)) are absent from the list.
Or can the 4.1-image be used with them?

1997-08-18
🇯🇵
ps-40j
SCPH-7000, SCPH-7500, SCPH-9000
ec541cd0
8e4c14f567745eff2f0408c8129f72a6

1997-11-14
🇺🇸
ps-41a(w)
SCPH-7000W
b7c43dad
b84be139db3ee6cbd075630aa20a6553

Exploit not working on certain SCPH-5501 models

Hello,
I have a SCPH-5501 PU-18\1-664-537-62\September 1997 model Playstation and have verified the Bios is 3.0 , checksum 8d8cb7e4, and a date of 11/18/96.
I've written the freepsxboot-unirom-fastload-20210419-bios-3.0.mcd image to a first party memory card using PSXGameEdit 1.6 and a DexDrive. This method has been confirmed to be working in issue #22 .
Selecting Memory Card from the Playstation menu makes the screen flash from orange to a pale light blue very quickly and then it locks there. I've left the Playstation in that state for hours. Tonyhax also does not work using the Castrol Superbike save game exploit. It will load the save game successfully but starting a race to initialize the payload locks up the Playstation.
I've read a few posts about some 5501's just not working with the exploit. Let me know if there is some information I can provide about my Playstation which may help get it working.

Thanks.

Medievil 2 PAL save file corrupted on Memory card 1

Using Unirom with freepsxboot on Memory Card in slot 2, Medievil 2 won't allow you to load the save file from memory card 1, telling you that the save file is corrupted while is not.
I'm using latest 8.0.J version.
Medievil 2 is PAL version.
Game works and load save file just fine if boot with Unirom through an action replay cartridge or other methods. So I think there is something wrong with how Freepsxboot disable slot 2.

Installing FreePSXBoot via UNIROM Menu

I noticed in UNIROM 8.0.F there is an item called "Install UNIROM". When I go to it, there is "Install FreePSXBoot to MemCard".
Upon selecting it, it says: "Waiting for CD to become ready & unlocked... Not a valid CD or the drive is locked"
The console is a 9002 and the drive is unlocked. What CD is it talking about?
Thanks.

Not working on a SCPH-102 (with modchip) - 5502 works fine !

I tested it in my SCPH-5502 (without modchip) and it works every time (I renamed the .mcd to .mcr and wrote it with my PS2 Slim using Memory Card Annihilator v2.0. I tested it many times in my SCPH-102 (with modchip) without success (hangs after hitting the memory card icon); I used the same writing method as for SCPH-5502. Is modchip a problem ?

JFYI: I also managed to correctly format and restore the memory card using the full format under Memory Card Annihilator v2.0 so the memory card was usable again.

I was able to use the wrong Image

I was able to use the wrong Image, I have 3 SCPH-1001 (The model with the RCA jacks), in the 3 of them the MC images labeled to work in them were 2.0, 2.1 and 2.2, but none of them worked, I then experimented with different images and the one that worked was 3.0 (1996-11-18) marked to work with SCPH-5001, SCPH-5501, SCPH-5503 and SCPH-7003.

Scph 102 not working

I did every step and when I press X on memory card it just enter in the memory card, doesn't boot psxboot

How to determine BIOS of SCHP-1001

Hello, all! I heard about this project a little while ago and finally got time to looking into it. I dug out my early NA model PS-X. The sticker on the bottom says "SCPH-1001". I see there are different BIOS and some hardware revisions all called by this same model #. I can't find any good information on how to tell which version my box has.

I should probably plug it in to see if it even still works. I don't think I've had it powered on since the 90's.

Exploit runs but games won't play

Hello, I have an SCPH-102 (PAL) console. I have tried both the slot 2 images for this model (0bad7ea9 and 76b880e5 which are for BIOS 4.4 and 4.5, respectively) and the exploit runs and I can get into Unirom. However, when I try to play a game, I get

"Waiting for CD to become ready & unlocked. . . .

Not a valid CD or the drive is locked
Press X to exit."

The console still works with legit PAL games so the optical drive is functional. Any help appreciated.

FFVIII Original Copy Not Booting With FreePSXBoot Memory Card in Slot 2

I happened upon an odd issue which I have not experienced with any other game. With version 2.0, I tend to keep my FreePSXBoot memory card plugged into slot 2 at all times. However, whenever I try to boot up an original copy of FFVIII, the game boots to a black screen. When I remove the FreePSXBoot memory card, the game boots up with no problems at all.

PU-23(PAL)...SCPH9002? not working

Downloaded the memory card image, used PS2 Memory card annihilator to flash memory card. Put in slot 2...boot with lid open, select memory card(No flashing or anything).

This is an Asian PAL PU 23(Probably similar to what was sold in Australia?)

SCPH-5502, SCPH-7500, neither working with 20210419

Both flashed with Memory Card Annihilator 2.0 on a PS2 SCPH-50002. The memory card for the 5502 freezes when the memory card option is selected and nothing happens. The memory card for the 7500 continues straight into the memory card screen and the PS1 BIOS does not detect any data. The memory card for the 7500 cannot be copied to however, and no games read it as existing. It also freezes any PS2 software. Both cards are currently unrecoverable (I don't have any software that can format them without freezing), and both cards were fully formatted in MCA before the files were written.

FPSXB MC on slot 2

It is possibile to make FPSXB also booting from MC Slot 2??

I think it would be convenitent since many Ps1 games only see Slot 1.

So this way you'd have to just remove the FPSXB MC from Slot 2, leaving your good-for-saving MC always plugged into Slot 1.

RGB/HDMI support

I use a Bitfunx HDMI adapter (RGB signal), which works wonderfully. Unfortunately, there are problems when I start Unirom (screen stays black). I suspect that the resolution is no longer compatible from that point. Is it possible that the next update you choose a resolution that could then work with the Bitfunx? Thanks a lot!

Tried 4.5 bios version on 2 PSone, able to restore memory card afterwards with PS2 and PS1 itself.

Just reporting that it is working fine on 2 PSOne consoles I've tried. Both with 4.5 version. With 4.4 wasn't working.
Probably both consoles have latest bios revision. Tried with an old third party memory card flashed with PS2 Memory Card Annihilator v2.
What I noticed is that I was able to reflash the memory card from 4.4 to 4.5 always using Memory Card Annihilator without it stopping from recognising the memory card and freezing.
But then I flashed the memory card with the "bios 3.x" version to try on an SCPH-1002 PS1 and then I wasn't able to use Memory Card Annihilator anymore... Until I tried Memory Card Manager (MCM.EXE for PS1) and I was able to format the memory card and get it working normally again!
You can find MCM on PAV_PSXHKB7 cd image collection to use on the console. I'll attach here only the MCM.exe
MCM.zip
Note: MCM won't load with the modified memory card inserted. Let the program load and then insert the memory card to format with the PS1. Tried this on a real PS1 model SCPH-1002.

NTSC-J SCPH-5500

I tested today new file for Japan 5500 and it works.
3.0 (1996-09-09) | SCPH-5500 | 20210420

But it can't load PAL and US backups, getting error.
I found out that with the licensed NTSC-J disk inserted and the lid closed, you can select a menu item "Stop Disc" https://i2.paste.pics/6a3513584d8296f5cb55517e2f9d21ac.png, swap disc to backup and press play. Then game loading correctly. But you can't release the lid closing switch when making swap, it must be pressed all the time).
There is a question: is it fixable?

upd.
Pirate stamp CD Tekken 3 (NTSC-J SLPS_013.00) reports an error on startup too. It turns out that you need a license disk in any case?

Problem with Third Party MC

Hi! Some days ago i bought another PSX MC to do the exploit with it. i already tried it with the same kind of MC and it worked i think. because on Issue #28 i reported that my psx didn't boot into unirom. But the problem now is that i can't restore the MCD file provided in here. I don't know if someone is having the same problem as me. Im trying to use Memory Card Annihilator btw.

EDIT: Don't need it anymore, i figured out a way and im on UNIROM basic now.

PSone SCPH-102 (+SCPH-152 LCD screen) with 76B880E5 (REV.B) BIOS does not go to cyan screen

Hello (I also go by wishing4thesun at PSX-Place).

The BIOS CRC is 76B880E5 and the System ROM version is 4.5 (25th May 2000), Europe.

I installed using the Unirom CD via the disc swap trick, it verified fine. I've tried three PS1 memory cards, all are original and all verified against the installer correctly, so I doubt that that's the issue (I've heard about the '64K masquerading as 128K' cards being sold on eBay).

I've tried both slots 1 and 2 and I am using an SCPH-110 controller manufactured by Hosiden, so nothing out of the ordinary there either.

Rebooting with the lid open (and the Blu-Tack removed so it doesn't try to read the disc), I go to the memory card info, and I don't get a cyan screen after 30 seconds; instead, just locks up when the memory card icon fades to black. Nothing. Nothing.

I wonder if this indicates some kind of compatibility issue as apparently someone else filed the same thing over at PSX-Place so I have been told.

The serial number(s), if it helps, are S01-8502538-H / B8502538 for the console, and S01-5031737-C / 5031737 for the LCD screen.

Thank you for any assistance/debugging/troubleshooting, since I am not a programmer in any way, and thank you for the project as a whole. (I love the Unirom UI by the way, reminds me of the C64).

-nyuchiko

Does not work on SCPH-7000 & SCPH-7500

I've tried both slot 1 and 2lot 2 images on 2 separate SCPH-7000 and one SCPH-7500 using different cards and both slot 1 and slot 2 images, nothing seams to work at all, I go straight to memory card menu. I have some 50 spare Japanese PS1s so I can keep on testing it. Edit: ps2 reports each card as unformatted so I suppose the files have been copied correctly, I've downloaded the file multiple times and used some older and newest versions of MC annihilator multiple times.

PS1 Slim SCPH-101 4.5 not working

I'm having issues when I'm trying to boot to the FreePSXBoot hack in both my original and cheap gamestop memory card. When I press the X button in the memory card menu, it simply doesn't boot. I've been doing this with the Swap disc method and Unirom8 Disc to flash my memory card. Am I doing something wrong? Let me know.

Typo in Reminder Text

Just a minor issue. I saw that the Reminder text states "ou can leave the FreePSXBoot card in Slot 2!" When it should say "You can leave the FreePSXBoot card in Slot 2!"

GameIDs not read/recognized/provided for old (first gen) JPN games

Hello,

I am using freebootpsx along with MemCard Pro to automatically manage virtual memory cards. I am using a "slim" PS One (SCPH-100 [JPN]) that is unmodified and am using only original discs from my personal collection. First off, thank you for this great software! It works 99% perfectly for my uses.

However, I've run into issues with just a handful of games, all of which are very early JPN releases (1994-1995):

• Jumping Flash (SCPS 10007)
• Arc the Lad (SCPS 10008)
• King's Field (SLPS 91401) (PSone Books release; original ID: SLPS-00017)

freebootpsx does not recognize/provide a GameID for any of these when I launch them with R1 (though the games do boot).
In all cases, the only messages I get are:
Skipping nocash unlock...
Loaded system.cnf from sector 0xC3E2
Fastload locating CDROM:\PSX.EXE;1

[edit] It looks like these games may not have a system.cnf file on the disc!

SCPH-9002

I have not been able to run the exploit on a SCHP-9002, I did the process 2 times with a ps2 and nothing, any ideas?
run the normal mc menu

thx

Add ps3mca-ps1 as an installation method

The following project exists which allows writing raw images to PS1 memory cards using a PC and the PS3 Memory Card Adapter:

https://github.com/paolo-caroni/ps3mca-ps1

Assuming someone can confirm this works (I've lost my adapter or I'd try it myself) this would be the most convenient method to use with an original unmodified memory card as it should be possible to remove the exploit simply by writing a backup taken beforehand.

I have an OG SCPH-1002 (BIOS v2.2 ) I can test

Actually it's my SCEE Net Yaroze ;)

SCPH-5502 not working with 20210421

I have reformatted my cheapy Aliexpress memory card that I was using for TonyHax using MCA v2 on a ps2 (SCPH 50003). I performed a full format, selected to restore an image and used 'freepsxboot-unirom-fastload-20210421-bios-3.0-19970106.mcr'.
I boot the PSX with the lid open, select the memory card manager and it just opens as normal. If I put the card back in to the PS2, MCA will see it and format it without a problem (I've tried full and fast). I tried the same process 3 times just to make sure it didn't work. I then booted an original copy of Tony Hawks 3 and started a new career with the FreePSXBoot card in slot 1 (to see what it would do if I tried to save a career). It detects the card as unformatted, asks me if I'd like to format it and saves the game, I can see the saved game block on the card after. I then tried to create the FreePSXBoot card again with MCA and the result is the same.

Formatting the memory card AFTER it's been flashed with FreePSXBoot - Definitive Solution

Hello!

First of all, this is outstanding work and a personal dream of mine since the PSX came out! Thank you @brad-lin et all for making this happen!

I'd like to report that there's absolutely no need for specific games, specialized hardware, or what have you to format the MC once it's been flashed with FreePSXBoot.

I originally intended to open a ticket to report that I wasn't having any issues whatsoever accessing the MC after flashing it with FreePSXBoot (think about it: I wanted to open an issue ticket to report no issues!). At the time, I was using the freepsxboot-unirom-fastload-20210414-bios-4.1.mcd image. I flashed it using a PS2 slim running MCA v2.0 with the cheapest aftermarket PS1 MC that money can buy (in fact I didn't even buy it, I found it!).
The presence of the MC was never causing my PS2 to crash, I was able to read it's content in both uLaunchELF and the PS2 Browser (both uLaunchELF and the PS2 browser show the content of the MC hovering around 6.8GB, pretty funny)

I was also able to create an image of it in MCA, format it, restore it, you name it, no issues whatsoever. Needless to say, the card was also working properly on my PS1s (various 7501s and 9001s).

Anyway, I ended up not reporting my results and instead flashed the freepsxboot-unirom-fastload-20210419-bios-4.1.mcd image when it came out, and didn't bother doing all the testing I had done with the previous image on my PS2 as I assumed nothing had changed.

Today, I saw freepsxboot-unirom-fastload-20210421-bios-4.1.mcd was released so I geared up to upgrade my MC, only to find out that all the issues everyone has been reporting about the card becoming unformattable, causing freezing of MCA, etc, were also happing to me now!

I "panicked" for a sec because I'm REALLY cheap and didn't want to waste a CD-R to burn PSX Hacker Kit or one of those games that are said to be able to reformat the MC, so I looked for an alternative.

First I tried to run a PS1 game through Popstarter on PS2 only to realize that it only uses VMCs, so that wasn't a go, but then it hit me that when I was perusing the menus that show up when you hit X once FreePSXBoot loads, one of the entry was "Memory Cards"

On freepsxboot-unirom-fastload-20210414-bios-4.1.mcd (Unirom V8.0.E), the things you can do don't really help though (although again, on this particular image, the MC can be reformatted withouth issues using MCA)

On freepsxboot-unirom-fastload-20210419-bios-4.1.mc and later freepsxboot-unirom-fastload-20210421-bios-4.1.mcd (Unirom V8.0.F) things look bright though (and thank god as otherwise I would have been stuck, cheap as I am)!

That's it! Hit format there, and a few seconds later the card is as good as new and ready to be flashed again or used as it was originally intended!

I'd be curious to know from a dev what changed between the 04-14 and 04-19 releases that made it so that when the MC is inserted in a PS2 at boot, or at any time really, it bombs the system right away (freeMC hangs before loading!). I mean, obviously Unirom was updated from 8.0.E to 8.0.F (thank god, otherwise the format option would have not been there), but it feels that's not the reason why this is happening.
Just a curiosity really, as it's obviously not an "issue" if FreePSXBoot nukes PS2s :) (though it would be awesome if it could be used on PS2s as well).

I imagine an update to the "Restoring the memory card" section of the readme is in order :D

ntsc scph-9001 boots to orange screen and hangs

scph-9001, board PU-23, official sony memory card
installation method: unirom 8.0.J boot disc swap method install to memcard slot2

exploit seems to run, cyan screen, then hangs on an orange screen and never progresses? card writing verifies just fine on unirom boot disc, i've formatted and re-written it a couple times now, still failing.

It does not work on the SCPH-5552 model [SOLVED]

I have done all the procedures but when I go to the memory card option the exploit does not start

Resident Evil 3 - Nemesis for Spain/Latin America black screen

Im having issues with this game (SLES-02532) NOT runing, also its an original CD not a backup, im using an NTSC console SCPH-1001 with BIOS 2.1 and FreePSX Boot instaled on Memory Card using the Slot 2.

So i boot the hack from the MMC and then i go to Boot and Boot PAL -> NTSC, i only get a black screen, it only works if i boot Import Media Player Light 2.1 and then from there i boot the game it works just fine. But i dont want to use IMPL 2.1...

Any other bacup (PAL) game made for Spain/Latin America works just fine without any problem, the issue is with this original game.

Issue with loading backups on SCPH-5501

Made a backup of Parasite Eve for an NTSC PSX (Model number SCPH-5501). I am able to boot into FreePSXBoot, but the game won't load. FreePSXBoot also identifies the part number on the backup CD. Same issue happens on official, licensed PSX CDs. FastLoad identifies the part number, but won't actually boot into the game.

SCPH-5501 BIOS 3.0 (03/11/96)

As I reported on YouTube I have two SCPH-5501 systems and both have BIOS 3.0 (03/11/96) A, as reported by both UniROM and tonyhax. I tested both systems using BIOS 3.0 (11/18/96) as you suggested, using two different memory cards on both systems, and both of them locked up immediately after selecting the memory card.

Broken build?

There's something wrong with your latest FREEPSX UNIROM V3 1997 build for 5502, it loads into memcardrex differently than any other version and isn't working. Memory card manager just locks up. I've successfully booted Unirom without issue on several models on prior version.

Seizure-inducing orange screen

While the payload is loading, the screen is painted orange using the 0x02 GP0 command. This works perfectly fine on an emulator, but I got a very annoying flickering on real hardware which I am not sure what could be causing it.

This is also affecting tonyhax, which uses the same command for clearing the screen.

FreePSXBoot doesn't work with some joypads / arcade sticks

Hope this is useful for anyone who has trouble starting the exploit:
this morning I tried the FreePSXboot (2021-04-21 version) on 4 ps1 (9002,2x 7502 and 5502, I prepared 2 original memory cards I launched it but it didn't work .... as soon as I clicked on the memory card it remained hanging and nothing happened. I was using an Arcade Stick Lioncast and not an original joypad, after I used the original ps1 and ps2 joypad and the exploit always worked the first time

Report about SCPH-102, SCPH-5502 not working

Hi,

firstly, thank you for the great project!

Secondly, I can report that my chipped SCPH-102 PSOne works with the 4.5 payload flawlessly - only thing that is different is that the screen doesn't blink after the exploit runs. It takes approximately 10 seconds, then shows bleak yellow-ish colour and after another ~10 seconds unirom comes up. In addition, I was able to format the card back to stock with MC Annihilator v2 on my SCPH-50004 PS2, the card did not crash the console (I also wrote the exploit with this setup).

I did the previous to test to see that my methodology is not incorrect, as the exploit does not work on my stock SCPH-5502 PAL system. I have been trying to make it work all of yesterday and even after a night with the console off and disconnected. I wasn't able to make it trigger at all, not even once.

I have a few questions:

• Is it possible that I have some uncommon BIOS revision on my SCPH-5502? I tried like 30 times and I didn't get the feeling that the exploit would be that unreliable.
• Is the only blocker for the 100% reliable exploit that you need testers? If it is so, I'm willing to test whatever you throw out there.

Thank you for any useful pointers :)

// EDIT: Also I forgot to mention, on my SCPH-102, when I select the memory card icon, it fades to black and stays like that, on the SCPH-5502, the memory card square icon fades to black and then reappears, afterwards the console freezes.

// EDIT2: Still no dice on the SCPH-5502. I have tried the 5501/5503/etc exploit version and it just goes into the memory card manager.

Model and Motherboard revisions\working or not working

Hello, I just wanted to share my findings with the SCPH-5501 model. I cannot find any reason why some of the PU-18 1-664-537-52 boards will not work with the exploit (Good candidates for an ODE!). They all have the following BIOS CRC-32 8d8cb7e4 BIOS Version: 3.0 Date 11/18/96. I would like others to share their findings, model, board revision, manufacture date on the bottom of the console, is the exploit working or not working, and BIOS version. Try to provide as much information as possible.

These are all NTSC SCPH-5501 models.

PU-18\1-664-537-62\September 1997\PSIO switchboard installed\exploit is working
PU-18\1-664-537-52\September 1997\no mods\exploit is not working
PU-18\1-664-537-52\September 1997\no mods\exploit is not working
PU-18\1-664-537-72\March 1998\no mods\exploit is working
PU-18\1-664-537-72\March 1998\no mods\exploit is working
PU-18\1-664-537-52\December 1997\no mods\exploit is working
PU-18\1-664-537-52\June 1997\XStation installed\exploit is working

V1.1 seems to be less reliable than v1.0 (SCPH-101 4.5 BIOS)

I was testing with the newest version on my 4.5 SCPH-101, but lt seems to be less reliable (at least on this specific revision) than 1.0.

I've only tested with backups of SOTN and Klonoa so far, but I still managed to find some odd behaviour on 1.1.

First, SOTN loads fine but it gets stuck when reading my MC. Obviously, I tested without the exploited MC plugged on while the game was running. I also tried formatting my mc, but that didn't work either. 1.0 works fine and reads the mc without issue. though.

Secondly, is Klonoa. The game gets stuck at the Namco logo on 1.1, but it works fine on 1.0 works just fine and also reads the mc without issue.

One last thing to note is that the payload loads faster on 1.1 vs 1.0 fastload. This also happens when pressing R1 to launch the games.

My apologies if the info I presented wasn't clear. I'm not used to opening issues, so my descriptions might sound weird.

Let me know if you need some clarification.