Exploit to allow loading arbitrary code on the PSX (i.e. PlayStation 1) using only a memory card (no game needed).
In other words, it's a softmod which requires a memory card, and a way to write raw data to it.
For support or discussion about this exploit and associated tools, you may join the PSXDev Network Discord server:
To use it, you will need a way to copy full memory card images (not individual files) to a memory card. Some possibilities are:
nops /fast /mcup 0 FILE.mcd COMPORT
where FILE
is the mcd file corresponding to your model, and COMPORT
corresponds to your computer serial port.FreePSXBoot memory card images are provided for slot 1 or slot 2. The memory card must be plugged in the corresponding slot on the PlayStation for FreePSXBoot to work. It is recommended to use images for slot 2, as they allow the FreePSXBoot memory card to remain plugged in while using another memory card in slot 1 for normal operations.
When launched from a memory card in slot 2, FreePSXBoot patches the PlayStation kernel to disable the memory card in slot 2, ensuring that the exploit doesn't trigger while playing a game. This means that the memory card doesn't have to be unplugged before launching a game.
If you are using a Memcard Pro, or need to use the two memory card slots normally, use slot 1 images instead.
In short: use the memory card images for slot 2, unless you have a Memcard Pro.
By flashing FreePSXBoot to your Memory Card, you need to be aware of the following:
The .mcd image files replace the whole contents of your card, meaning that your Memory Card will be ENTIRELY WIPED after flashing a .mcd image, so creating a backup of your saves is compulsory.
Because the exploit has corrupt Memory Card filesystem on purpose for it to run, your card will become unusable for normal operations. That is, you won't be able to use this card for saving and loading game saves and it will cause crashes on your PS1 or your PS2 console (if you have any).
Once installed, it may become difficult to uninstall, as the normal software to re-format a memory card won't work, due to the exploit itself. You could end up with no means to recover the memory card; if for example your installation method was Memory Card Annihilator v2, then it will also crash. Memcarduino, Unirom, or using the Memcard Pro would currently be safe bets.
These images are pre-built with Unirom.
There are different downloads for different BIOS versions. Please download the correct ROM for your BIOS version. If a model or BIOS version is missing, it means it is not supported yet.
As more reliable or faster versions of the exploit are developed, the images are updated. Older versions can be found in the images
directory.
BIOS version/region | BIOS CRC32 | Models | 100% reliable | Download Link Slot 2 (recommended) | Download Link Slot 1 (For Memcard Pro) |
---|---|---|---|---|---|
1.0 (1994-09-22) I | 3b601fc8 | SCPH-1000 | Yes | 20220919 Slot 2 | 20220919 Slot 1 |
1.1 (1995-01-22) I | 3539def6 | SCPH-3000 | Yes | 20220919 Slot 2 | 20220919 Slot 1 |
2.0 (1995-05-07) A | 55847d8c | SCPH-1001 | Yes; see note below | 20220919 Slot 2 | 20220919 Slot 1 |
2.0 (1995-05-10) E | 9bb87c4b | SCPH-1002 | Yes; see note below | 20220919 Slot 2 | 20220919 Slot 1 |
2.1 (1995-07-17) A | aff00f2f | SCPH-1001 | Yes | 20220919 Slot 2 | 20220919 Slot 1 |
2.1 (1995-07-17) E | 86c30531 | SCPH-1002 | Yes | 20220919 Slot 2 | 20220919 Slot 1 |
2.1 (1995-07-17) I | bc190209 | SCPH-3500 | Yes | 20220919 Slot 2 | 20220919 Slot 1 |
2.2 (1995-12-04) A | 37157331 | SCPH-1001 SCPH-5003 |
Yes | 20220919 Slot 2 | 20220919 Slot 1 |
2.2 (1995-12-04) E | 1e26792f | SCPH-1002 | Yes | 20220919 Slot 2 | 20220919 Slot 1 |
2.2 (1995-12-04) I | 24fc7e17 | SCPH-5000 | Yes | 20220919 Slot 2 | 20220919 Slot 1 |
3.0 (1996-09-09) I | ff3eeb8c | SCPH-5500 | Yes | 20220919 Slot 2 | 20220919 Slot 1 |
3.0 (1996-11-18) A | 8d8cb7e4 | SCPH-5001 SCPH-5501 SCPH-5503 SCPH-7003 |
Yes | 20220919 Slot 2 | 20220919 Slot 1 |
3.0 (1997-01-06) E | d786f0b9 | SCPH-5502 SCPH-5552 |
Yes | 20220919 Slot 2 | 20220919 Slot 1 |
4.0 (1997-08-18) I | ec541cd0 | SCPH-7000 SCPH-7500 SCPH-9000 |
Yes | 20220919 Slot 2 | 20220919 Slot 1 |
4.1 (1997-11-14) A | b7c43dad | SCPH-7000W | Yes | 20220919 Slot 2 | 20220919 Slot 1 |
4.1 (1997-12-16) A | 502224b6 | SCPH-7001 SCPH-7501 SCPH-7503 SCPH-9001 SCPH-9003 SCPH-9903 |
Yes | 20220919 Slot 2 | 20220919 Slot 1 |
4.1 (1997-12-16) E | 318178bf | SCPH-7002 SCPH-7502 SCPH-9002 |
Yes | 20220919 Slot 2 | 20220919 Slot 1 |
4.3 (2000-03-11) I | f2af798b | SCPH-100 | Yes | 20220919 Slot 2 | 20220919 Slot 1 |
4.4 (2000-03-24) A | 6a0e22a0 | SCPH-101 | Yes | 20220919 Slot 2 | 20220919 Slot 1 |
4.4 (2000-03-24) E | 0bad7ea9 | SCPH-102 | Yes | 20220919 Slot 2 | 20220919 Slot 1 |
4.5 (2000-05-25) A | 171bdcec | SCPH-101 SCPH-103 |
Yes | 20220919 Slot 2 | 20220919 Slot 1 |
4.5 (2000-05-25) E | 76b880e5 | SCPH-102 | Yes | 20220919 Slot 2 | 20220919 Slot 1 |
Note for BIOS 2.0 (SCPH-1001 or SCPH-1002) slot 1 only: the memory card containing FreePSXBoot must be inserted in slot 1, and another memory card must be present in slot 2. The memory card in slot 2 can have any content.
See the folder builder for a tool that can be used to generate your own payloads and memory cards.
The exploit works in emulators as well. Tested with no$psx, pcsx-redux, and DuckStation.