brad-lin / FreePSXBoot

Exploit to allow loading arbitrary code on the PSX using only a memory card (no game needed)
MIT License
614 stars 46 forks source link

FreePSXBoot

Exploit to allow loading arbitrary code on the PSX (i.e. PlayStation 1) using only a memory card (no game needed).

In other words, it's a softmod which requires a memory card, and a way to write raw data to it.

For support or discussion about this exploit and associated tools, you may join the PSXDev Network Discord server: Discord

To use it, you will need a way to copy full memory card images (not individual files) to a memory card. Some possibilities are:

Slot 1 or slot 2?

FreePSXBoot memory card images are provided for slot 1 or slot 2. The memory card must be plugged in the corresponding slot on the PlayStation for FreePSXBoot to work. It is recommended to use images for slot 2, as they allow the FreePSXBoot memory card to remain plugged in while using another memory card in slot 1 for normal operations.

When launched from a memory card in slot 2, FreePSXBoot patches the PlayStation kernel to disable the memory card in slot 2, ensuring that the exploit doesn't trigger while playing a game. This means that the memory card doesn't have to be unplugged before launching a game.

If you are using a Memcard Pro, or need to use the two memory card slots normally, use slot 1 images instead.

In short: use the memory card images for slot 2, unless you have a Memcard Pro.

WARNING

By flashing FreePSXBoot to your Memory Card, you need to be aware of the following:

Usage

Restoring the memory card

Supported models

Troubleshooting

Changelog

Information

Technical details

Demonstration

Downloads

These images are pre-built with Unirom.

There are different downloads for different BIOS versions. Please download the correct ROM for your BIOS version. If a model or BIOS version is missing, it means it is not supported yet.

As more reliable or faster versions of the exploit are developed, the images are updated. Older versions can be found in the images directory.

BIOS version/region BIOS CRC32 Models 100% reliable Download Link Slot 2 (recommended) Download Link Slot 1 (For Memcard Pro)
1.0 (1994-09-22) I 3b601fc8 SCPH-1000 Yes 20220919 Slot 2 20220919 Slot 1
1.1 (1995-01-22) I 3539def6 SCPH-3000 Yes 20220919 Slot 2 20220919 Slot 1
2.0 (1995-05-07) A 55847d8c SCPH-1001 Yes; see note below 20220919 Slot 2 20220919 Slot 1
2.0 (1995-05-10) E 9bb87c4b SCPH-1002 Yes; see note below 20220919 Slot 2 20220919 Slot 1
2.1 (1995-07-17) A aff00f2f SCPH-1001 Yes 20220919 Slot 2 20220919 Slot 1
2.1 (1995-07-17) E 86c30531 SCPH-1002 Yes 20220919 Slot 2 20220919 Slot 1
2.1 (1995-07-17) I bc190209 SCPH-3500 Yes 20220919 Slot 2 20220919 Slot 1
2.2 (1995-12-04) A 37157331 SCPH-1001
SCPH-5003
Yes 20220919 Slot 2 20220919 Slot 1
2.2 (1995-12-04) E 1e26792f SCPH-1002 Yes 20220919 Slot 2 20220919 Slot 1
2.2 (1995-12-04) I 24fc7e17 SCPH-5000 Yes 20220919 Slot 2 20220919 Slot 1
3.0 (1996-09-09) I ff3eeb8c SCPH-5500 Yes 20220919 Slot 2 20220919 Slot 1
3.0 (1996-11-18) A 8d8cb7e4 SCPH-5001
SCPH-5501
SCPH-5503
SCPH-7003
Yes 20220919 Slot 2 20220919 Slot 1
3.0 (1997-01-06) E d786f0b9 SCPH-5502
SCPH-5552
Yes 20220919 Slot 2 20220919 Slot 1
4.0 (1997-08-18) I ec541cd0 SCPH-7000
SCPH-7500
SCPH-9000
Yes 20220919 Slot 2 20220919 Slot 1
4.1 (1997-11-14) A b7c43dad SCPH-7000W Yes 20220919 Slot 2 20220919 Slot 1
4.1 (1997-12-16) A 502224b6 SCPH-7001
SCPH-7501
SCPH-7503
SCPH-9001
SCPH-9003
SCPH-9903
Yes 20220919 Slot 2 20220919 Slot 1
4.1 (1997-12-16) E 318178bf SCPH-7002
SCPH-7502
SCPH-9002
Yes 20220919 Slot 2 20220919 Slot 1
4.3 (2000-03-11) I f2af798b SCPH-100 Yes 20220919 Slot 2 20220919 Slot 1
4.4 (2000-03-24) A 6a0e22a0 SCPH-101 Yes 20220919 Slot 2 20220919 Slot 1
4.4 (2000-03-24) E 0bad7ea9 SCPH-102 Yes 20220919 Slot 2 20220919 Slot 1
4.5 (2000-05-25) A 171bdcec SCPH-101
SCPH-103
Yes 20220919 Slot 2 20220919 Slot 1
4.5 (2000-05-25) E 76b880e5 SCPH-102 Yes 20220919 Slot 2 20220919 Slot 1

Note for BIOS 2.0 (SCPH-1001 or SCPH-1002) slot 1 only: the memory card containing FreePSXBoot must be inserted in slot 1, and another memory card must be present in slot 2. The memory card in slot 2 can have any content.

See the folder builder for a tool that can be used to generate your own payloads and memory cards.

The exploit works in emulators as well. Tested with no$psx, pcsx-redux, and DuckStation.