brad-lin / FreePSXBoot

Exploit to allow loading arbitrary code on the PSX using only a memory card (no game needed)
MIT License
574 stars 44 forks source link

Formatting the memory card AFTER it's been flashed with FreePSXBoot - Definitive Solution #39

Open VRtinker opened 3 years ago

VRtinker commented 3 years ago

Hello!

First of all, this is outstanding work and a personal dream of mine since the PSX came out! Thank you @brad-lin et all for making this happen!

I'd like to report that there's absolutely no need for specific games, specialized hardware, or what have you to format the MC once it's been flashed with FreePSXBoot.

I originally intended to open a ticket to report that I wasn't having any issues whatsoever accessing the MC after flashing it with FreePSXBoot (think about it: I wanted to open an issue ticket to report no issues!). At the time, I was using the freepsxboot-unirom-fastload-20210414-bios-4.1.mcd image. I flashed it using a PS2 slim running MCA v2.0 with the cheapest aftermarket PS1 MC that money can buy (in fact I didn't even buy it, I found it!). The presence of the MC was never causing my PS2 to crash, I was able to read it's content in both uLaunchELF and the PS2 Browser (both uLaunchELF and the PS2 browser show the content of the MC hovering around 6.8GB, pretty funny)

20210421_193651 20210421_200959 20210421_201105

I was also able to create an image of it in MCA, format it, restore it, you name it, no issues whatsoever. Needless to say, the card was also working properly on my PS1s (various 7501s and 9001s).

Anyway, I ended up not reporting my results and instead flashed the freepsxboot-unirom-fastload-20210419-bios-4.1.mcd image when it came out, and didn't bother doing all the testing I had done with the previous image on my PS2 as I assumed nothing had changed.

Today, I saw freepsxboot-unirom-fastload-20210421-bios-4.1.mcd was released so I geared up to upgrade my MC, only to find out that all the issues everyone has been reporting about the card becoming unformattable, causing freezing of MCA, etc, were also happing to me now!

I "panicked" for a sec because I'm REALLY cheap and didn't want to waste a CD-R to burn PSX Hacker Kit or one of those games that are said to be able to reformat the MC, so I looked for an alternative.

First I tried to run a PS1 game through Popstarter on PS2 only to realize that it only uses VMCs, so that wasn't a go, but then it hit me that when I was perusing the menus that show up when you hit X once FreePSXBoot loads, one of the entry was "Memory Cards"

20210421_200730

On freepsxboot-unirom-fastload-20210414-bios-4.1.mcd (Unirom V8.0.E), the things you can do don't really help though (although again, on this particular image, the MC can be reformatted withouth issues using MCA)

20210421_200631

On freepsxboot-unirom-fastload-20210419-bios-4.1.mc and later freepsxboot-unirom-fastload-20210421-bios-4.1.mcd (Unirom V8.0.F) things look bright though (and thank god as otherwise I would have been stuck, cheap as I am)!

20210421_201441 20210421_203104

That's it! Hit format there, and a few seconds later the card is as good as new and ready to be flashed again or used as it was originally intended!

I'd be curious to know from a dev what changed between the 04-14 and 04-19 releases that made it so that when the MC is inserted in a PS2 at boot, or at any time really, it bombs the system right away (freeMC hangs before loading!). I mean, obviously Unirom was updated from 8.0.E to 8.0.F (thank god, otherwise the format option would have not been there), but it feels that's not the reason why this is happening. Just a curiosity really, as it's obviously not an "issue" if FreePSXBoot nukes PS2s :) (though it would be awesome if it could be used on PS2s as well).

I imagine an update to the "Restoring the memory card" section of the readme is in order :D

lzibeti commented 3 years ago

I format my memory card using the Action Replay inserted in the parallel port. It detects as not formatted in the memory card options so just format it and that's it.

VRtinker commented 3 years ago

I format my memory card using the Action Replay inserted in the parallel port. It detects as not formatted in the memory card options so just format it and that's it.

I'm not sure I understand what you are saying. Is following the method I illustrated not working for you (simply formatting the MC from within FreePSXBoot once it's loaded, without using any other device - like an Action Replay)?

lzibeti commented 3 years ago

I didn't know that there was this option that you demonstrated. Precisely why I always formatted my memory card using the Action Replay option :) Thank you for sharing this information.

hurda commented 3 years ago

@VRtinker What model is your PS2 And formatting is a new feature of 8.0F: "- Can now properly delete (format) FreePSXBoot cards"

VRtinker commented 3 years ago

@hurda The PS2 I've been using is a 77001. I have a few 70012s and a number of different phat models, but I haven't involved those in any of these shenanigans.

I figured formatting was added in 8.0.F (as I've shown in the screenshots it was missing in 8.0.E), but was wondering why the images based on 8.0.F are all causing issues on PS2 that are not occurring with the 8.0.E based one. Again, pure curiosity.

brad-lin commented 3 years ago

We changed the address that's overwritten by the exploit. Assuming the same lack of boundary check is present in the PS2 and/or MCA, then some value is changed somewhere in memory when reading the card with MCA. Maybe the previous overwritten value was meaningless (like some graphical stuff), and the new one is some code or pointer that triggers a crash.

VRtinker commented 3 years ago

@brad-lin Thanks for your answer, that's interesting to know. I guess it won't be investigated or "fixed" because who cares, right? :-) So may I ask why are you not adding to the readme the aforementioned method to format the memory card? Is there some underlying issue in formatting the MC this way that I should be aware of that makes you want to keep it under wraps? I see YT videos are popping up suggesting to burn CD utilities to achieve the same, and I can't help but thinking that's a waste (even if a CD-R is like $0.20!)

invaderlex commented 3 years ago

I used The Unirom Boot disc to format MC, in the option for installing FreePSXboot the last image is a formatted image.