PS2 [UPDATE-2] Meet "FreeDVDBoot" by @CTurtE - Now supports EVERY "PStwo" Slim Model!

Discussion in 'PS2 News' started by Roxanne, Jun 27, 2020 at 5:38 PM.

By Roxanne on Jun 27, 2020 at 5:38 PM
  1. 509

    Roxanne Moderator

    Mar 3, 2018
    Likes Received:
    Trophy Points:
    Home Page:
    We are nearly at the half of this year over but 2020 was an weird year so far, don't you agree? First we lost one of our greatest athletes in Basketball history who was a great father and human as well - shortly after that we are still battling with the worldwide Corona virus outbreak - "and now you tell me that there are still people releasing brand new Exploits for the PS2 released in 2020 ?!?!?!" :) Yeah, you read it correctly. Today well-known Developer @CTurt showcases his newest achievements in "PS2 Hacking". While his previous method saw some critics due to its limitation using the official Sony PS2 YaBasic Interpreter, which was only bundled in very first PS2 Demo Discs released for the PAL region only, Developer @CTurt was so kind to find an even better entry point in launching Homebrew on an unmodified PS2. And guess what, he found a way to achieve exactly that by fully exploiting the DVD Video Player Functionality from a PS2 Console. And it comes even better. Not only you can enjoy all of the old but still good Homebrews and Emulators released back in the old days, this exploit also supports running your legally obtained Backups as well! And all that WITHOUT any need of an modified Memory Card, without any use any old and dirty Swap Magic Trick or to open your PS2 and install an Modchip like many did in the old days? Doesn't sound that cool or what do you think right now when reading this? I kinda mean it when I said that 2020 is a weird year so far. :P

    UPDATE-2: FreeDVDBoot now supports EVERY "PStwo" Slim Model! Check the "Further Information"-Tab for additional Information and frequently updates.

    Our Moderator @Fin9ersMcGee was so kind to provide a FreeMCBoot (FMCB) Installation Tutorial in combination with the newest FreeDVDBoot Exploit, which will give you any easy step-by-step guide to run FreeDVDBoot on your PS2. Check it out here!

    Check also his new
    All-in-One Guide if you are new in PS2 Hacking!

    Screenshot of running an recompiled Version of uLaunchELF on an UNMODIFIED PS2 using the newest FreeDVDBoot Exploit by @CTurt [Source: YouTube]

    • I've previously discussed how the PlayStation 2 doesn't have any good entry-point software exploits for launching homebrew. You need to either purchase a memory card with an exploit pre-installed, open up the console to block the disc tray sensors, or install a modchip. For the best selling console of all time, it deserves better hacks.

      My initial attempt to solve this problem was to exploit the BASIC interpreter that came bundeld with early PAL region PS2s. Although I was successful at producing the first software based entry-point exploit that can be triggered using only hardware that came with the console, the attack was largely criticized due to the requirement of having to enter the payload manually through the controller or keyboard, and limitation of being PAL only. I decided to write-off that exploit as being impractical, and so the hunt continued for a better attack scenario for the PlayStation 2.

      The PlayStation 2 has other sources of untrusted input that we could attack; games which support online multiplayer or USB storage could almost definitely be exploited. But unlike say the Nintendo 64, where we don't really have any other choice but to resort to exploiting games over interfaces like modems, the PlayStation 2 has one key difference: its primary input is optical media (CD / DVD discs), a format which anyone can easily burn with readily available consumer hardware. This leaves an interesting question which I've wanted to solve since I was a child:
      Ultimately, I was successfully able to achieve my goal by exploiting the console's DVD player functionality. This blog post will describe the technical details and process of reversing and exploiting the DVD player. All of my code is available on GitHub.

      Demonstration video of new PlayStation 2 exploit through the DVD player, which allows burning homebrew games and running them on an unmodified console the same way you would with official discs. This demo shows the result of the PS2SDK patch which adds support for reading DVD video discs (uLaunchELF can now load homebrews from disc, and emulators can now load ROMs from disc).

    • Whilst the exploit itself is now complete, there's not a huge amount we can currently do beyond loading small standalone homebrew games like Tetris.

      Multi-file homebrew
      Ideally, it would nice for the exploit to boot into a menu which would allow you to select a different homebrew program out of multiple stored on the same disc, and which could then in turn load further data from the disc (such as an emulator loading ROMs). Unfortunately, the PS2SDK filesystem code, and by extension all PS2 homebrew, doesn't support DVD videos. Since DVD videos are the only type of disc that unmodified consoles will accept which we can burn, I assume that everyone was previously satisfied with just loading data over USB.

      I decided to show the exploit to some PS2 enthusiasts in the hope that it might inspire someone to take a look, and uyjulian was kind enough to spend some time adding support and submit a pull request. If you recompile the PS2SDK with this fix, and then recompile your homebrew application, it will have support for loading DVD video disc files from cdfs device.

      This isn't a perfect solution since we don't have source code for all PS2 homebrew produced over the last 20 years, but it is also possible to binary patch homebrew to manually replace the cdvd.irx IOP module with a new one to add DVD video support. For instance, ChelseaFantasy patched the closed source SNES Station emulator, allowing me to make the following demo (special thanks!):

      Demonstration video of new PlayStation 2 exploit through the DVD player, which allows burning homebrew games and running them on an unmodified console the same way you would with official discs. This demo shows the result of the PS2SDK patch which adds support for reading DVD video discs (uLaunchELF can now load homebrews from disc, and emulators can now load ROMs from disc).

    • There already exists a tool (ESR patcher) which patches games to appear like DVD videos so that they'll be accepted by the 'mechacon' (security processor), and an associated loader program (ESR) that boots these patched "video discs". Chaining together this new exploit with that ESR loader would allow you to patch your backups so that they could just be burned and run on your console from boot as though they were official discs.

      I don't really want to be responsible for maintaining a tool that does this, so I'm not including any of the code to do this in the repo, but the gist of it can be explained pretty quickly, so I'll just provide some notes explaining how to do it:

      ESR patcher will add two files, VIDEO_TS.IFO and VIDEO_TS.BUP, to the disc's UDF filesystem. Our exploit requires two files named VIDEO_TS.IFO and VTS_01_0.IFO, so just replace the VIDEO_TS.BUP string it writes with VTS_01_0.IFO to create the filesystem structure we need.

      Attributes we care about for those files are size (4-bytes) and LBA position (2-bytes). In the UDF specification these fields are adjacent, with LBA being stored as an offset from the directory descriptor containing these fields (VIDEO_TS at LBA 134 in our case). The tool creates these files with size 2032 bytes, and LBAs 138 and 139, so the byte patterns we are interested in are:
      VIDEO_TS.IFO: f0 07 00 00 0a 00
      VIDEO_TS.BUP: f0 07 00 00 0b 00
      Contents of the ISO 9660 filesystem used by games generally seem to start at around 260, which I believe is a requirement by Sony. This is great for us since it means that we have roughly 250KB ((262-137) * 0x800) of space to place the exploit files and loader, and we only need a fraction of that. Given this amount of space, it would even be possible to include some kind of Action Replay cheat menu or something on the disc, which could be a fun future project.

      Keeping VIDEO_TS.IFO at LBA 138, we just need to extend its size to 14336, and copy the file contents to 138 * 0x800 = 0x45000 in the ISO. Our next free space is 7 sectors later at LBA 145, and will store the contents of our 12288 byte VTS_01_0.IFO file. Finally, the ESR loader program can be copied to the next available sector at 151; we won't bother creating an entry in the UDF filesystem for it since we've already had to manually modify the ISO anyway.

      In summary, the patches we need to make to the UDF data to add our exploit to a patched game are:
      VIDEO_TS.BUP -> VTS_01_0.IFO (to rename the file)
      f0 07 00 00 0a 00 -> 00 38 00 00 0a 00 (VIDEO_TS.IFO filesize to 14336)
      0x45000: paste VIDEO_TS.IFO exploit contents (compiled with LOAD_FROM_SECTOR_RELATIVE_TO_VIDEO_TS_IFO so as to boot the ELF from disc at 0x4B800)
      f0 07 00 00 0b 00 -> 00 30 00 00 11 00 (VIDEO_TS.BUP/VTS_01_0.IFO LBA to 145 and filesize to 12288)
      0x48800: paste VTS_01_0.IFO contents
      0x4B800: paste loader ELF
      I only did this once, manually, but it should be pretty straight forward to modify the tool to change these patches. The result is a pretty cool demo showing total defeat of the PlayStation 2 copy-protection security model:

      Demonstration video of new PlayStation 2 exploit through the DVD player, which allows burning homebrew games and running them on an unmodified console the same way you would with official discs. This demo shows loading ESR to boot a backup of an official game stored on the same disc, which is for all intents and purposes complete destruction of the PS2 copy protection security model.

    • Optimisation
      As previously mentioned, the exploit could probably be optimised to boot a fraction of a second faster by reducing the size of the overflow. Also worth noting is that part of the reason the screen flickers whilst triggering the exploit is because I happened to encode my base DVD video as NTSC, and so some of that flickering is an artifact of switching from PAL to NTSC back to PAL. If this bothers you, you can re-make the exploit based on a PAL base DVD instead. Some of the weird white pattern displayed is probably a result of the overflow, and you might be able to remove it by manipulating more of the overflow data.

      I was successfully able to exploit the PlayStation 2 DVD Player to allow me to run my own burned homebrew discs simply by inserting them and booting, just as you would launch an official disc.

      Although I only exploited version 3.10E, as its the version on the console I happen to own, it's a pretty late version (3.11J was the final version ever released), and so I'm confident that all other versions also contain these same trivial IFO parsing buffer overflows. If those prove to be difficult to exploit on other firmware versions, I'm also confident that there probably exist more generically exploitable bugs like stack buffer overflows if you reverse deeper, after all, I only got as far as reverse engineering the initial IFO parsing before I identified sufficient vulnerabilities for my exploit. I hope this article and these demos inspire others to have a crack at hacking their own console's firmware versions and share their methods in a centralised repo for the community to share.

      The idea of booting discs with no user interaction was extremely appealing to me, but if you instead value having a single disc with compatibility against multiple different firmware versions, it may be possible to build a DVD video which starts with a DVD menu where you select your version and it plays a different video which launches a different exploit, depending on user selection.

      As a final thought, there's really no reason this general attack scenario is specific to the PlayStation 2 as all generations support some combination of burned media: from the PlayStation 1's CD support, to the PlayStation 3 and 4's Blue-ray support, with the PlayStation 4 having only removed CD support. Hacking the PS4 through Blue-ray BD-J functionality has long been discussed as an idea for an entry point. This may be something I would be interested in looking into for a long-term future project: imagine being able to burn your own PlayStation games for all generations; 1 down, 3 to go...

    Source: Twitter @CTurtE
    Download .iso-Image: PREBUILT ISOs
    Complete Blog Post: FreeDVDBoot
    FreeDVDBoot on GitHub: CTurt
    YouTube Channel: CTurt
    Last edited: Jul 2, 2020 at 1:57 PM


Discussion in 'PS2 News' started by Roxanne, Jun 27, 2020 at 5:38 PM.

    1. DoublesAdvocate
      Extremely cool, amazing to see progress like this just in time for the 20th anniversary.
    2. Fin9ersMcGee
      An amazing feat, well done @CTurt.

      This takes a lot of the complication out of creating an FMCB memory card.
      Im all over this tomorrow, bit too late in the evening here to be firing up the dvd burner lol
      MixeryMaxe and DeViL303 like this.
    3. nCadeRegal
      Yea i like how he jumped from ps4 to ps2 to work on xploiting it. Awesome work here man @CTurt. Keep working on what you love and have a passion for, not what these crybaby pirates always cry and complain about. Those types of people aren't what the homebrew scene is and make up a small minority within it. Much appreciation for your hard work. Thank you
      sandungas, DeViL303 and TnA like this.
    4. agablex
      snap !! mine has the 3.00E i guess it won't work
    5. Coro
      yeah this is awesome...i wanted fmcb 10 years ago and only finally got it installed on my own just like two months ago. it was a thrill to accomplish but this would have been so much quicker.

      thanks @CTurt !!!
      TnA likes this.
    6. remlei
      wow, this will greatly ease up the process for fmcb installs now.
      TnA likes this.
    7. Coro
      maybe some of the ps2 devs will continue the work and get it going on other versions.
    8. Berion
      Awesome. So now Dreamcast starting to be jealous. :D

      Try it, as it is quite possible that will works. ;) On github You can find in his repository also ready to burn *.iso file. Use DVD-R (or DVD+R if You are sure that Your console read it without problems) and tell us the results. uLE should be booted.
      Algol and TnA like this.
    9. Windows10User
      I have 3.11E. Anyway, this looks too hard for me. I never jailbroke a PS2.
    10. Berion
      Just burn the disc image in ISO format from his repo (i.e by ImgBurn). You don't need to do anything else than just place this disc into PS2 drive. This will boot homebrew app called uLE which is i.e file manager (so i.e You would be able to copy saves from Memory Card ("mc0:/") to pendrive (FAT32 on MBR) by exporting them to *.psu container). Just an example. Or boot any homebrew which support USB from USB (in PS2 nomenclature is called "mass:/"). By the same way but in opposite direction You can place Fortuna exploit (use my repack *.psu format so You will don't need to change date and time in console settings).
      Yugonibblit, DeViL303, Algol and 2 others like this.
    11. Windows10User
      Thanks. I understood that. I think I have to download other homebrew to be able to play PS2 (and maybe PS1) backups and ROMs via RetroArch. I think it's called FMCB but there's a lot of PS2 homebrew so I don't know which one to use and how to use it. It looks like I can download FMCB's installer and FMCB itself so how can I use it with this method? From what I understood, FMCB installs files to the MC.
    12. Coro
      if you can boot the ule disc mentioned above, you can use it start fmcb installer from usb. after fcmb is installed you can just turn on ps2 with mc plugged in. you would no longer need the disc unless mc gets messed up.
      Algol and Windows10User like this.
    13. Windows10User
      So, if it works I can use a program on the disk to load another program in USB to install a program in a MC? Where should I put FMCB installer and FMCB itself (there are two different downloads) in the USB and should it be formatted as FAT32 and MBR? Also, do I have to use a different MC for FCMB and can I use the same MC for more than a single homebrew?
    14. Berion
      FMCB will not work on firmware 2.30 and newer. When You boot uLE, go to informations and check ROMVER string. If You see 0220* or lower You can launch FMCB Installer from USB and of course installing it. If is higher, then only Fortuna is a way for You (or can still using FreeDVDBoot as boot disc to launch homebrew apps; however this is inconvenient IMO).

      Place FMCB Installer stuff in root directory of pendrive, and run it on via uLE of course. But before that, export all saves to *.psu container or make Memory Card image (via Memory Card Annihilator v2.0) or You will loose everything (I don't remember that but FMCB demand format memory card first). Anyway. You can launch anything from USB by uLE (or other file managers).

      MBR is partition table type, FAT32 is file system type. The only two which PS2 homebrew support.

      You will not be able to play PSX games in other ways than via emulators (POPS via POPS Starter or PS2PSXe).
      Algol likes this.
    15. Windows10User
      So, just to start, should I burn the 3.10E ISO? What about the FreeDVDBoot-master's folder remainings?
      Last edited: Jun 27, 2020 at 8:47 PM
    16. agablex
      yeah that's exactly what CTurt said when i hit him up
    17. Berion
      Source code and other binaries. Of course place for such things are release category but not all care. I'm making few months ago "Vita AIO" and often saw mixed data in peoples repositories (i.e debug binaries left over, source code attached in release category while app is written in lua so every VPK also contain all src etc.). In this case, /PAYLOAD dir contain source but also binaries, VIDEO_TS contain what must be placed on Your own "FreeDVDBoot" (to not bother extracting files from disc image, because image cannot be just rebuild while other 1st binary must be placed on specific address in main IFO).

      @agablex This means he didn't add and test support for other dvd players, which doesn't mean they cannot be exploited without any modifications to make.

      So I understood that he just not test it because he have only console with 3.10E, not that he stated that offsets on other versions are different and exploit won't work without modifications.
      Algol likes this.
    18. TnA
      Burn a DVD, insert it into the PS2... Hacked... :'-D

      It is actually wLE! ;)
      Algol and Coro like this.
    19. Windows10User
      I only burned the 3.10E ISO and I had a black screen and no signal message in my TV.

Share This Page