PS2 [UPDATE-3] Meet "FreeDVDBoot" by @CTurtE - (PARTIAL) First PS2 FAT (PHAT) Model supported!

We are nearly at the half of this year over but 2020 was an weird year so far, don't you agree? First we lost one of our greatest athletes in Basketball history who was a great father and human as well - shortly after that we are still battling with the worldwide Corona virus outbreak - "and now you tell me that there are still people releasing brand new Exploits for the PS2 released in 2020 ?!?!?!" Yeah, you read it correctly. Today well-known Developer @CTurt showcases his newest achievements in "PS2 Hacking". While his previous method saw some critics due to its limitation using the official Sony PS2 YaBasic Interpreter, which was only bundled in very first PS2 Demo Discs released for the PAL region only, Developer @CTurt was so kind to find an even better entry point in launching Homebrew on an unmodified PS2. And guess what, he found a way to achieve exactly that by fully exploiting the DVD Video Player Functionality from a PS2 Console. And it comes even better. Not only you can enjoy all of the old but still good Homebrews and Emulators released back in the old days, this exploit also supports running your legally obtained Backups as well! And all that WITHOUT any need of an modified Memory Card, without any use any old and dirty Swap Magic Trick or to open your PS2 and install an Modchip like many did in the old days? Doesn't sound that cool or what do you think right now when reading this? I kinda mean it when I said that 2020 is a weird year so far. :P​

UPDATE-2: FreeDVDBoot now supports EVERY "PStwo" Slim Model! Check the "Further Information"-Tab for additional Information and frequently updates.

UPDATE-3: Support added for DVD Version "2.10" which makes it the very first Firmware for FAT support and more vulnerabilities found for most PS2 FAT consoles from DVD Player Versions 1.00 up to 2.13. Check the "Further Information"-Tab for additional information and frequently updates.

Our Moderator @Fin9ersMcGee was so kind to provide a FreeMCBoot (FMCB) Installation Tutorial in combination with the newest FreeDVDBoot Exploit, which will give you any easy step-by-step guide to run FreeDVDBoot on your PS2. Check it out here!

Check also his new All-in-One Guide if you are new in PS2 Hacking!

Screenshot of running an recompiled Version of uLaunchELF on an UNMODIFIED PS2 using the newest FreeDVDBoot Exploit by @CTurt [Source: YouTube]​

FreeDVDBoot Further developments Loading backups with ESR Optimisation and Conclusion Further Information

• 
  I've previously discussed how the PlayStation 2 doesn't have any good entry-point software exploits for launching homebrew. You need to either purchase a memory card with an exploit pre-installed, open up the console to block the disc tray sensors, or install a modchip. For the best selling console of all time, it deserves better hacks.
  
  My initial attempt to solve this problem was to exploit the BASIC interpreter that came bundeld with early PAL region PS2s. Although I was successful at producing the first software based entry-point exploit that can be triggered using only hardware that came with the console, the attack was largely criticized due to the requirement of having to enter the payload manually through the controller or keyboard, and limitation of being PAL only. I decided to write-off that exploit as being impractical, and so the hunt continued for a better attack scenario for the PlayStation 2.
  
  The PlayStation 2 has other sources of untrusted input that we could attack; games which support online multiplayer or USB storage could almost definitely be exploited. But unlike say the Nintendo 64, where we don't really have any other choice but to resort to exploiting games over interfaces like modems, the PlayStation 2 has one key difference: its primary input is optical media (CD / DVD discs), a format which anyone can easily burn with readily available consumer hardware. This leaves an interesting question which I've wanted to solve since I was a child:
  

  Is it possible to just burn our own homebrew games and launch them on an unmodified console the same way we would launch official discs (without going through any user interaction like disc swapping or triggering a network exploit in a game)?

  
  Ultimately, I was successfully able to achieve my goal by exploiting the console's DVD player functionality. This blog post will describe the technical details and process of reversing and exploiting the DVD player. All of my code is available on GitHub.
  
  
  Demonstration video of new PlayStation 2 exploit through the DVD player, which allows burning homebrew games and running them on an unmodified console the same way you would with official discs. This demo shows the result of the PS2SDK patch which adds support for reading DVD video discs (uLaunchELF can now load homebrews from disc, and emulators can now load ROMs from disc).​
• 
  Whilst the exploit itself is now complete, there's not a huge amount we can currently do beyond loading small standalone homebrew games like Tetris.
  
  Multi-file homebrew
  Ideally, it would nice for the exploit to boot into a menu which would allow you to select a different homebrew program out of multiple stored on the same disc, and which could then in turn load further data from the disc (such as an emulator loading ROMs). Unfortunately, the PS2SDK filesystem code, and by extension all PS2 homebrew, doesn't support DVD videos. Since DVD videos are the only type of disc that unmodified consoles will accept which we can burn, I assume that everyone was previously satisfied with just loading data over USB.
  
  I decided to show the exploit to some PS2 enthusiasts in the hope that it might inspire someone to take a look, and uyjulian was kind enough to spend some time adding support and submit a pull request. If you recompile the PS2SDK with this fix, and then recompile your homebrew application, it will have support for loading DVD video disc files from cdfs device.
  
  This isn't a perfect solution since we don't have source code for all PS2 homebrew produced over the last 20 years, but it is also possible to binary patch homebrew to manually replace the cdvd.irx IOP module with a new one to add DVD video support. For instance, ChelseaFantasy patched the closed source SNES Station emulator, allowing me to make the following demo (special thanks!):
  
  
  Demonstration video of new PlayStation 2 exploit through the DVD player, which allows burning homebrew games and running them on an unmodified console the same way you would with official discs. This demo shows the result of the PS2SDK patch which adds support for reading DVD video discs (uLaunchELF can now load homebrews from disc, and emulators can now load ROMs from disc).​
• 
  There already exists a tool (ESR patcher) which patches games to appear like DVD videos so that they'll be accepted by the 'mechacon' (security processor), and an associated loader program (ESR) that boots these patched "video discs". Chaining together this new exploit with that ESR loader would allow you to patch your backups so that they could just be burned and run on your console from boot as though they were official discs.
  
  I don't really want to be responsible for maintaining a tool that does this, so I'm not including any of the code to do this in the repo, but the gist of it can be explained pretty quickly, so I'll just provide some notes explaining how to do it:
  
  ESR patcher will add two files, VIDEO_TS.IFO and VIDEO_TS.BUP, to the disc's UDF filesystem. Our exploit requires two files named VIDEO_TS.IFO and VTS_01_0.IFO, so just replace the VIDEO_TS.BUP string it writes with VTS_01_0.IFO to create the filesystem structure we need.
  
  Attributes we care about for those files are size (4-bytes) and LBA position (2-bytes). In the UDF specification these fields are adjacent, with LBA being stored as an offset from the directory descriptor containing these fields (VIDEO_TS at LBA 134 in our case). The tool creates these files with size 2032 bytes, and LBAs 138 and 139, so the byte patterns we are interested in are:
  

  VIDEO_TS.IFO: f0 07 00 00 0a 00
  VIDEO_TS.BUP: f0 07 00 00 0b 00

  
  Contents of the ISO 9660 filesystem used by games generally seem to start at around 260, which I believe is a requirement by Sony. This is great for us since it means that we have roughly 250KB ((262-137) * 0x800) of space to place the exploit files and loader, and we only need a fraction of that. Given this amount of space, it would even be possible to include some kind of Action Replay cheat menu or something on the disc, which could be a fun future project.
  
  Keeping VIDEO_TS.IFO at LBA 138, we just need to extend its size to 14336, and copy the file contents to 138 * 0x800 = 0x45000 in the ISO. Our next free space is 7 sectors later at LBA 145, and will store the contents of our 12288 byte VTS_01_0.IFO file. Finally, the ESR loader program can be copied to the next available sector at 151; we won't bother creating an entry in the UDF filesystem for it since we've already had to manually modify the ISO anyway.
  
  In summary, the patches we need to make to the UDF data to add our exploit to a patched game are:
  

  VIDEO_TS.BUP -> VTS_01_0.IFO (to rename the file)
  f0 07 00 00 0a 00 -> 00 38 00 00 0a 00 (VIDEO_TS.IFO filesize to 14336)
  0x45000: paste VIDEO_TS.IFO exploit contents (compiled with LOAD_FROM_SECTOR_RELATIVE_TO_VIDEO_TS_IFO so as to boot the ELF from disc at 0x4B800)
  f0 07 00 00 0b 00 -> 00 30 00 00 11 00 (VIDEO_TS.BUP/VTS_01_0.IFO LBA to 145 and filesize to 12288)
  0x48800: paste VTS_01_0.IFO contents
  0x4B800: paste loader ELF

  
  I only did this once, manually, but it should be pretty straight forward to modify the tool to change these patches. The result is a pretty cool demo showing total defeat of the PlayStation 2 copy-protection security model:
  
  
  Demonstration video of new PlayStation 2 exploit through the DVD player, which allows burning homebrew games and running them on an unmodified console the same way you would with official discs. This demo shows loading ESR to boot a backup of an official game stored on the same disc, which is for all intents and purposes complete destruction of the PS2 copy protection security model.​
• 
  Optimisation
  As previously mentioned, the exploit could probably be optimised to boot a fraction of a second faster by reducing the size of the overflow. Also worth noting is that part of the reason the screen flickers whilst triggering the exploit is because I happened to encode my base DVD video as NTSC, and so some of that flickering is an artifact of switching from PAL to NTSC back to PAL. If this bothers you, you can re-make the exploit based on a PAL base DVD instead. Some of the weird white pattern displayed is probably a result of the overflow, and you might be able to remove it by manipulating more of the overflow data.
  
  Conclusion
  I was successfully able to exploit the PlayStation 2 DVD Player to allow me to run my own burned homebrew discs simply by inserting them and booting, just as you would launch an official disc.
  
  Although I only exploited version 3.10E, as its the version on the console I happen to own, it's a pretty late version (3.11J was the final version ever released), and so I'm confident that all other versions also contain these same trivial IFO parsing buffer overflows. If those prove to be difficult to exploit on other firmware versions, I'm also confident that there probably exist more generically exploitable bugs like stack buffer overflows if you reverse deeper, after all, I only got as far as reverse engineering the initial IFO parsing before I identified sufficient vulnerabilities for my exploit. I hope this article and these demos inspire others to have a crack at hacking their own console's firmware versions and share their methods in a centralised repo for the community to share.
  
  The idea of booting discs with no user interaction was extremely appealing to me, but if you instead value having a single disc with compatibility against multiple different firmware versions, it may be possible to build a DVD video which starts with a DVD menu where you select your version and it plays a different video which launches a different exploit, depending on user selection.
  
  As a final thought, there's really no reason this general attack scenario is specific to the PlayStation 2 as all generations support some combination of burned media: from the PlayStation 1's CD support, to the PlayStation 3 and 4's Blue-ray support, with the PlayStation 4 having only removed CD support. Hacking the PS4 through Blue-ray BD-J functionality has long been discussed as an idea for an entry point. This may be something I would be interested in looking into for a long-term future project: imagine being able to burn your own PlayStation games for all generations; 1 down, 3 to go...
• 
  
  • [Tutorial] FMCB Installation with FreeDVDBoot by @Fin9ersMcGee
  • SNES Station and FCEU with updated libcdvd by @HWNJ
  • DVD Player Version 3.10A confirmed working thanks to @Tupakaveli
  • DVD Player Version 3.10U confirmed working as well thanks to the updated full Blog Post by @CTurt
  • [Tutorial] The Great PS2 All-in-One (AIO) Guide by @Fin9ersMcGee
  • FreeDVDBoot Compatibility List by @Roxanne
  • PREBUILT ISOs working for both 3.10, 3.11 and HYBRID for every Region by @CTurt
    • This means that the Exploit works on EVERY "PStwo" Slim Model including the "Sony BRAVIA PS2 HYBRID TV (KDL22PX300)! [Latter one tested by @InnocentX]
  • Support for DVD Player Version 3.04 released for Testing purposes by @CTurt
  • New HYBRID Test Version for DVD Player Version 3.10 + 3.11 released by @CTurt
  • Announcement that more vulnerabilites have been found to support most PS2 FAT consoles by @CTurt
  • New DVD Player Version 2.10 has been released by @CTurt
  • Showcase of running the new Version 2.10 running on a SCPH-30001 PS2 FAT Console by @krHACKen

Source: Twitter @CTurtE
Download .iso-Image: PREBUILT ISOs
Complete Blog Post: FreeDVDBoot
FreeDVDBoot on GitHub: CTurt
YouTube Channel: CTurt​

 

i have 3.11U. burned disc with imgburn. i get hang on black screen.

also tried on older fat (1.30?) just to see what happens but it could not read my disc.

 

Here's a quick little tutorial I whipped up to use FreeDVDBoot as a stepping stone to installing FMCB. Enjoy.

https://www.psx-place.com/threads/tutorial-fmcb-installation-with-free-dvd-boot.30211/

Edit: Ps2 AIO guide coming SoonTM (I promise.....)

 

Is it just me or does this feel like the Ps2 is starting to take its final form?

Pic sort of related

 

Confirmed working on 3.10A

 

3.00U (phat) says "playback halted due to malfunction"

 

@CTurtE
99% most of the users want ps4 exploit
1% no one want ps2 exploit because ps2 already fully jailbreaked and hacked via modchip since 2005

 

99% The first paragraph explains their motivation and people can research and exploit whatever they're interested in at the time. They don't have to exploit what you want exploited.
1% There seems to be more than a couple people in this thread that are pretty excited about this and "install a modchip" isn't necessarily an option for everybody, some people don't have the skills and others don't have the money to pay someone with the skills.
Posts like yours aren't going to motivate anybody to exploit anything and as said in the conclusion this could eventually lead to further exploits for other systems that you might actually care about.

 

It's going (or already is) VIRAL!

 

@CTurtE
99% most of the users want ps4 exploit
1% no one want ps2 exploit because ps2 already fully jailbreaked and hacked via modchip since 2005

Modchips were mostly for games (piracy or not). The other arm of DRM, MagicGate, wasn't explored until much later.
We don't need discs (and hence modchips) for homebrew software.

 

FMCB-selling-services = OBSOLETE (if they don't offer more than a normal install... [Noobie-Package or release-package])
Well, maybe not obsolete but of less importance, especially once more DVD-Player-Versions work with this!

I also like the name!
We have a "Free ~device~ Boot"-series!

 

Mines a phat so probably wont work (not got any blanks to test) it has ps2loader and a hard drive.

Got a slim just goto dig it out hopefully it will work on that!

 

Here's a quick little tutorial I whipped up to use FreeDVDBoot as a stepping stone to installing FMCB. Enjoy.

https://www.psx-place.com/threads/tutorial-fmcb-installation-with-free-dvd-boot.30211/

Edit: Ps2 AIO guide coming SoonTM (I promise.....)

Tutorial added to the Main article!


EDIT: Btw guys if you have good Homebrew suggestions tested with FreeDVDBoot, you are welcome to show your results here in this Thread. We will keep the Main Article regularly updated under the "Further Information" Tab!

 

Tutorial added to the Main article!


EDIT: Btw guys if you have good Homebrew suggestions tested with FreeDVDBoot, you are welcome to show your results here in this Thread. We will keep the Main Article regularly updated under the "Further Information" Tab!

can you add this thread too? it has the emulators from the dev's video.

EDIT:
sorry forgot to add link

 

@CTurtE
99% most of the users want ps4 exploit
1% no one want ps2 exploit because ps2 already fully jailbreaked and hacked via modchip since 2005

This is exactly why there isn't an xploit or ps4 scene. People like you who can't even show a tiny grain of appreciation for this accomplishment. Go pound salt somewhere else man, you are not welcome in this thread.

 

can you add this thread too? it has the emulators from the dev's video.

EDIT:
sorry forgot to add link

Added. Good Example, just add more and I will include them. Thanks.

 

@CTurtE
99% most of the users want ps4 exploit
1% no one want ps2 exploit because ps2 already fully jailbreaked and hacked via modchip since 2005

Don't pull numbers out of your butt to derail a thread.
This is nothing about the PS4. He is developing on the PS2 and if you have PS4 desires, simply find the solution yourself and be mores respectful to the devs.

People need to stop act like they are entitled or that thsee DEVS should be pleasing you.
THEY DO THE WORK FOR THEMSELVES FOR VARIOUS REASONS.. THEY THEN SHARE WITH US THEY ARE NOT OBLIGATED TO DO A THING FOR ANYONE OR SHARE ANYTHING.. TREAT ANY DEVELOPER CONTRIBUTIONS AS A BONUS AND NOT A RIGHT BECAUSE ITS NOT A RIGHT.. So lets quit acting like it is.

Lets apply some common sense (which is not such a common thing anymore), and instead of being demanding lets be a little appreciative of what they do and share, does not have to be all for you or what someone else wants, Why can't it be about the people who actually are doing the work??? Wow what a strange thought...
..

 

Don't pull numbers out of your butt to derail a thread.
This is nothing about the PS4. He is developing on the PS2 and if you have PS4 desires, simply find the solution yourself and be mores respectful to the devs.

People need to stop act like they are entitled or that thsee DEVS should be pleasing you.
THEY DO THE WORK FOR THEMSELVES FOR VARIOUS REASONS.. THEY THEN SHARE WITH US THEY ARE NOT OBLIGATED TO DO A THING FOR ANYONE OR SHARE ANYTHING.. TREAT ANY DEVELOPER CONTRIBUTIONS AS A BONUS AND NOT A RIGHT BECAUSE ITS NOT A RIGHT.. So lets quit acting like it is.

SO lets apply some common sense (which is not such a common thing anymore), and instead of being demanding lets be a little appreciative of what they do, does not have to be all for you or what someone else wants..

Here here

 

@CTurtE
99% most of the users want ps4 exploit
1% no one want ps2 exploit because ps2 already fully jailbreaked and hacked via modchip since 2005

I shouldn't answer to this but maybe You are not aware of that:

1. You cannot demand from anyone anything, especially while You don't pay for that. That's the main rule in western civilisation which makes our world in the today position. I also really, really want exploited my PS4 but I can do nothing about that and such attitude like Yours is one of the reasons why TheFl0w said to himself: "oh, well, then f* this" and I'm pretty sure we lost in this simple moment of time solution for our PS4 in far future...

2. This is thread about new exploit, superior to all with working lens and/or just to those who want costless entry point to further exploration like FMCB/FHDB or Fortuna. This makes Swap Magic, Code Breaker and Action Replay obsolete (not as cheat engine but as entry point).

3. Modchips has stopped evolving ages ago, they now have very outdated code and in consequence, doing dirty patching, sometimes causing troubles for homebrew.

4. Modchips are not legal on entire world. I.e in my Poland, they are as long user will not be catch with pirate software, but no one sell them or soldering them.

5. And there are plenty peoples who want keep their consoles in original state, without messing with cables, tin and risking to damage mother board. If I would have some rare unit like PSX, debug or devkit, I wouldn't touch anything inside to reducing it's value.

 

Finally got round to testing this.
Burned the 3.10E.iso file using IMGBurn.

My DVD Player version is 2.13E

Nothing at the OSDSYS menu.
Browser menu says "Disk Read Error"

 

This means that You aren't boot it (ODD was reject it before allow PS2 firmware to run it). Try different disc and/or clean laser lens. This should be launched on all models (doesn't mean exploit works on all), and i.e in browser, in menu with MC and HDD, yellow disc should appear with DVD-Video description.

If console have modchip installed. Boot console with turned it off (if possible) because all second generation modchips needs special tricks to boot DVDV (i.e Ripper 2 Gold demand as I remember 3xReset).