PS2 [UPDATE-3] Meet "FreeDVDBoot" by @CTurtE - (PARTIAL) First PS2 FAT (PHAT) Model supported!

We are nearly at the half of this year over but 2020 was an weird year so far, don't you agree? First we lost one of our greatest athletes in Basketball history who was a great father and human as well - shortly after that we are still battling with the worldwide Corona virus outbreak - "and now you tell me that there are still people releasing brand new Exploits for the PS2 released in 2020 ?!?!?!" Yeah, you read it correctly. Today well-known Developer @CTurt showcases his newest achievements in "PS2 Hacking". While his previous method saw some critics due to its limitation using the official Sony PS2 YaBasic Interpreter, which was only bundled in very first PS2 Demo Discs released for the PAL region only, Developer @CTurt was so kind to find an even better entry point in launching Homebrew on an unmodified PS2. And guess what, he found a way to achieve exactly that by fully exploiting the DVD Video Player Functionality from a PS2 Console. And it comes even better. Not only you can enjoy all of the old but still good Homebrews and Emulators released back in the old days, this exploit also supports running your legally obtained Backups as well! And all that WITHOUT any need of an modified Memory Card, without any use any old and dirty Swap Magic Trick or to open your PS2 and install an Modchip like many did in the old days? Doesn't sound that cool or what do you think right now when reading this? I kinda mean it when I said that 2020 is a weird year so far. :P​

UPDATE-2: FreeDVDBoot now supports EVERY "PStwo" Slim Model! Check the "Further Information"-Tab for additional Information and frequently updates.

UPDATE-3: Support added for DVD Version "2.10" which makes it the very first Firmware for FAT support and more vulnerabilities found for most PS2 FAT consoles from DVD Player Versions 1.00 up to 2.13. Check the "Further Information"-Tab for additional information and frequently updates.

Our Moderator @Fin9ersMcGee was so kind to provide a FreeMCBoot (FMCB) Installation Tutorial in combination with the newest FreeDVDBoot Exploit, which will give you any easy step-by-step guide to run FreeDVDBoot on your PS2. Check it out here!

Check also his new All-in-One Guide if you are new in PS2 Hacking!

Screenshot of running an recompiled Version of uLaunchELF on an UNMODIFIED PS2 using the newest FreeDVDBoot Exploit by @CTurt [Source: YouTube]​

FreeDVDBoot Further developments Loading backups with ESR Optimisation and Conclusion Further Information

• 
  I've previously discussed how the PlayStation 2 doesn't have any good entry-point software exploits for launching homebrew. You need to either purchase a memory card with an exploit pre-installed, open up the console to block the disc tray sensors, or install a modchip. For the best selling console of all time, it deserves better hacks.
  
  My initial attempt to solve this problem was to exploit the BASIC interpreter that came bundeld with early PAL region PS2s. Although I was successful at producing the first software based entry-point exploit that can be triggered using only hardware that came with the console, the attack was largely criticized due to the requirement of having to enter the payload manually through the controller or keyboard, and limitation of being PAL only. I decided to write-off that exploit as being impractical, and so the hunt continued for a better attack scenario for the PlayStation 2.
  
  The PlayStation 2 has other sources of untrusted input that we could attack; games which support online multiplayer or USB storage could almost definitely be exploited. But unlike say the Nintendo 64, where we don't really have any other choice but to resort to exploiting games over interfaces like modems, the PlayStation 2 has one key difference: its primary input is optical media (CD / DVD discs), a format which anyone can easily burn with readily available consumer hardware. This leaves an interesting question which I've wanted to solve since I was a child:
  

  Is it possible to just burn our own homebrew games and launch them on an unmodified console the same way we would launch official discs (without going through any user interaction like disc swapping or triggering a network exploit in a game)?

  
  Ultimately, I was successfully able to achieve my goal by exploiting the console's DVD player functionality. This blog post will describe the technical details and process of reversing and exploiting the DVD player. All of my code is available on GitHub.
  
  
  Demonstration video of new PlayStation 2 exploit through the DVD player, which allows burning homebrew games and running them on an unmodified console the same way you would with official discs. This demo shows the result of the PS2SDK patch which adds support for reading DVD video discs (uLaunchELF can now load homebrews from disc, and emulators can now load ROMs from disc).​
• 
  Whilst the exploit itself is now complete, there's not a huge amount we can currently do beyond loading small standalone homebrew games like Tetris.
  
  Multi-file homebrew
  Ideally, it would nice for the exploit to boot into a menu which would allow you to select a different homebrew program out of multiple stored on the same disc, and which could then in turn load further data from the disc (such as an emulator loading ROMs). Unfortunately, the PS2SDK filesystem code, and by extension all PS2 homebrew, doesn't support DVD videos. Since DVD videos are the only type of disc that unmodified consoles will accept which we can burn, I assume that everyone was previously satisfied with just loading data over USB.
  
  I decided to show the exploit to some PS2 enthusiasts in the hope that it might inspire someone to take a look, and uyjulian was kind enough to spend some time adding support and submit a pull request. If you recompile the PS2SDK with this fix, and then recompile your homebrew application, it will have support for loading DVD video disc files from cdfs device.
  
  This isn't a perfect solution since we don't have source code for all PS2 homebrew produced over the last 20 years, but it is also possible to binary patch homebrew to manually replace the cdvd.irx IOP module with a new one to add DVD video support. For instance, ChelseaFantasy patched the closed source SNES Station emulator, allowing me to make the following demo (special thanks!):
  
  
  Demonstration video of new PlayStation 2 exploit through the DVD player, which allows burning homebrew games and running them on an unmodified console the same way you would with official discs. This demo shows the result of the PS2SDK patch which adds support for reading DVD video discs (uLaunchELF can now load homebrews from disc, and emulators can now load ROMs from disc).​
• 
  There already exists a tool (ESR patcher) which patches games to appear like DVD videos so that they'll be accepted by the 'mechacon' (security processor), and an associated loader program (ESR) that boots these patched "video discs". Chaining together this new exploit with that ESR loader would allow you to patch your backups so that they could just be burned and run on your console from boot as though they were official discs.
  
  I don't really want to be responsible for maintaining a tool that does this, so I'm not including any of the code to do this in the repo, but the gist of it can be explained pretty quickly, so I'll just provide some notes explaining how to do it:
  
  ESR patcher will add two files, VIDEO_TS.IFO and VIDEO_TS.BUP, to the disc's UDF filesystem. Our exploit requires two files named VIDEO_TS.IFO and VTS_01_0.IFO, so just replace the VIDEO_TS.BUP string it writes with VTS_01_0.IFO to create the filesystem structure we need.
  
  Attributes we care about for those files are size (4-bytes) and LBA position (2-bytes). In the UDF specification these fields are adjacent, with LBA being stored as an offset from the directory descriptor containing these fields (VIDEO_TS at LBA 134 in our case). The tool creates these files with size 2032 bytes, and LBAs 138 and 139, so the byte patterns we are interested in are:
  

  VIDEO_TS.IFO: f0 07 00 00 0a 00
  VIDEO_TS.BUP: f0 07 00 00 0b 00

  
  Contents of the ISO 9660 filesystem used by games generally seem to start at around 260, which I believe is a requirement by Sony. This is great for us since it means that we have roughly 250KB ((262-137) * 0x800) of space to place the exploit files and loader, and we only need a fraction of that. Given this amount of space, it would even be possible to include some kind of Action Replay cheat menu or something on the disc, which could be a fun future project.
  
  Keeping VIDEO_TS.IFO at LBA 138, we just need to extend its size to 14336, and copy the file contents to 138 * 0x800 = 0x45000 in the ISO. Our next free space is 7 sectors later at LBA 145, and will store the contents of our 12288 byte VTS_01_0.IFO file. Finally, the ESR loader program can be copied to the next available sector at 151; we won't bother creating an entry in the UDF filesystem for it since we've already had to manually modify the ISO anyway.
  
  In summary, the patches we need to make to the UDF data to add our exploit to a patched game are:
  

  VIDEO_TS.BUP -> VTS_01_0.IFO (to rename the file)
  f0 07 00 00 0a 00 -> 00 38 00 00 0a 00 (VIDEO_TS.IFO filesize to 14336)
  0x45000: paste VIDEO_TS.IFO exploit contents (compiled with LOAD_FROM_SECTOR_RELATIVE_TO_VIDEO_TS_IFO so as to boot the ELF from disc at 0x4B800)
  f0 07 00 00 0b 00 -> 00 30 00 00 11 00 (VIDEO_TS.BUP/VTS_01_0.IFO LBA to 145 and filesize to 12288)
  0x48800: paste VTS_01_0.IFO contents
  0x4B800: paste loader ELF

  
  I only did this once, manually, but it should be pretty straight forward to modify the tool to change these patches. The result is a pretty cool demo showing total defeat of the PlayStation 2 copy-protection security model:
  
  
  Demonstration video of new PlayStation 2 exploit through the DVD player, which allows burning homebrew games and running them on an unmodified console the same way you would with official discs. This demo shows loading ESR to boot a backup of an official game stored on the same disc, which is for all intents and purposes complete destruction of the PS2 copy protection security model.​
• 
  Optimisation
  As previously mentioned, the exploit could probably be optimised to boot a fraction of a second faster by reducing the size of the overflow. Also worth noting is that part of the reason the screen flickers whilst triggering the exploit is because I happened to encode my base DVD video as NTSC, and so some of that flickering is an artifact of switching from PAL to NTSC back to PAL. If this bothers you, you can re-make the exploit based on a PAL base DVD instead. Some of the weird white pattern displayed is probably a result of the overflow, and you might be able to remove it by manipulating more of the overflow data.
  
  Conclusion
  I was successfully able to exploit the PlayStation 2 DVD Player to allow me to run my own burned homebrew discs simply by inserting them and booting, just as you would launch an official disc.
  
  Although I only exploited version 3.10E, as its the version on the console I happen to own, it's a pretty late version (3.11J was the final version ever released), and so I'm confident that all other versions also contain these same trivial IFO parsing buffer overflows. If those prove to be difficult to exploit on other firmware versions, I'm also confident that there probably exist more generically exploitable bugs like stack buffer overflows if you reverse deeper, after all, I only got as far as reverse engineering the initial IFO parsing before I identified sufficient vulnerabilities for my exploit. I hope this article and these demos inspire others to have a crack at hacking their own console's firmware versions and share their methods in a centralised repo for the community to share.
  
  The idea of booting discs with no user interaction was extremely appealing to me, but if you instead value having a single disc with compatibility against multiple different firmware versions, it may be possible to build a DVD video which starts with a DVD menu where you select your version and it plays a different video which launches a different exploit, depending on user selection.
  
  As a final thought, there's really no reason this general attack scenario is specific to the PlayStation 2 as all generations support some combination of burned media: from the PlayStation 1's CD support, to the PlayStation 3 and 4's Blue-ray support, with the PlayStation 4 having only removed CD support. Hacking the PS4 through Blue-ray BD-J functionality has long been discussed as an idea for an entry point. This may be something I would be interested in looking into for a long-term future project: imagine being able to burn your own PlayStation games for all generations; 1 down, 3 to go...
• 
  
  • [Tutorial] FMCB Installation with FreeDVDBoot by @Fin9ersMcGee
  • SNES Station and FCEU with updated libcdvd by @HWNJ
  • DVD Player Version 3.10A confirmed working thanks to @Tupakaveli
  • DVD Player Version 3.10U confirmed working as well thanks to the updated full Blog Post by @CTurt
  • [Tutorial] The Great PS2 All-in-One (AIO) Guide by @Fin9ersMcGee
  • FreeDVDBoot Compatibility List by @Roxanne
  • PREBUILT ISOs working for both 3.10, 3.11 and HYBRID for every Region by @CTurt
    • This means that the Exploit works on EVERY "PStwo" Slim Model including the "Sony BRAVIA PS2 HYBRID TV (KDL22PX300)! [Latter one tested by @InnocentX]
  • Support for DVD Player Version 3.04 released for Testing purposes by @CTurt
  • New HYBRID Test Version for DVD Player Version 3.10 + 3.11 released by @CTurt
  • Announcement that more vulnerabilites have been found to support most PS2 FAT consoles by @CTurt
  • New DVD Player Version 2.10 has been released by @CTurt
  • Showcase of running the new Version 2.10 running on a SCPH-30001 PS2 FAT Console by @krHACKen

Source: Twitter @CTurtE
Download .iso-Image: PREBUILT ISOs
Complete Blog Post: FreeDVDBoot
FreeDVDBoot on GitHub: CTurt
YouTube Channel: CTurt​

 

Is there anything for 3.00E ?

 

Is there anything for 3.00E ?

https://github.com/CTurt/FreeDVDBoot/tree/master/PREBUILT ISOs.

Currently no.

 

Hello all,
New here in this soft modding ps2 community.
I have an SCPH-75004 (3.11E) PS2 model.
I burned the freedvdboot_all ps2 slims iso to a dvd-r but i got a black screen on boot. Waited 20 mins on that screen but nothing happens. I have done all the necessary pre-requisites mentioned on the github page. Moreover, in Browse, my ps2 detects the dvd as a play station 2 disc rather than a dvd video. I read on github that if it does this, then my ps2 has a modchip, but i know the ps2 has not been modified in any way. I used imgburn to burn the iso at 4x speed. I also tried using the 3.11-all regions iso, but got the same result. If anybody can provide any insight into this i would be grateful

 

Hello all,
New here in this soft modding ps2 community.
I have an SCPH-75004 (3.11E) PS2 model.
I burned the freedvdboot_all ps2 slims iso to a dvd-r but i got a black screen on boot. Waited 20 mins on that screen but nothing happens. I have done all the necessary pre-requisites mentioned on the github page. Moreover, in Browse, my ps2 detects the dvd as a play station 2 disc rather than a dvd video. I read on github that if it does this, then my ps2 has a modchip, but i know the ps2 has not been modified in any way. I used imgburn to burn the iso at 4x speed. I also tried using the 3.11-all regions iso, but got the same result. If anybody can provide any insight into this i would be grateful

It seems like your disc was not burn properly.
I advise you to use Verbatim DVD-R (not +R or -/+RW).

 

Moreover, in Browse, my ps2 detects the dvd as a play station 2 disc rather than a dvd video. I read on github that if it does this, then my ps2 has a modchip,

There is no way to DVD-Video disc been detected as PS2 game other than some dirty modchip which doesn't support media autodetect. So this assumption have sense. If disc is to low quality and/or to low quality burn or wrongly burn, PS2 will reject it. But instead in Yours case, she accept it as PS2 Disc (but cannot run because there is no SYSTEM.CNF in root of disc leading to executable). For the experiment, just try to burn any PS2 game as is and see what will happen.

 

The only other possibility is that his Ps2 is patched with MechaPWN + force unlock.

 

A few days ago i had patched an iso of a game with freedvdboot esr patcher and burnt it to a dvd to play the game. It worked perfectly fine.
I will also try to burn a ps2 game as is to a dvd and see what happens.

The only other possibility is that his Ps2 is patched with MechaPWN + force unlock.

I have done no such thing. Apart from the one esr patched game that i played a few days ago, i have only played games through official ps2 discs.

There is no way to DVD-Video disc been detected as PS2 game other than some dirty modchip which doesn't support media autodetect. So this assumption have sense. If disc is to low quality and/or to low quality burn or wrongly burn, PS2 will reject it. But instead in Yours case, she accept it as PS2 Disc (but cannot run because there is no SYSTEM.CNF in root of disc leading to executable). For the experiment, just try to burn any PS2 game as is and see what will happen.

I will also try to play a dvd movie and see if it plays in the ps2.

 

I will also try to play a dvd movie and see if it plays in the ps2.

The DVD movie also gets recognized as a play station 2 disc
Can these problems be due to me using the freedvdboot esr patcher gui to play iso s?
Can it just hardwire the ps2 laser to read everything as ps2 disc?

 

You need to find out, which modchip you have. Try to hold a button like SQUARE, when the Video-DVD is inserted.
...or TRIANGLE... If it kicks you to the MC-Screen, you have a modchip which is DEV.1-compatible.

 

You need to find out, which modchip you have. Try to hold a button like SQUARE, when the Video-DVD is inserted.
...or TRIANGLE... If it kicks you to the MC-Screen, you have a modchip which is DEV.1-compatible.

I bought the PS2 (brand new) when it was released from the sony store. As i said earlier i am 100 percent certain that it has not been modified in any way. I didn't even know these things were possible until about 2 months ago. I haven't given it to someone else since the time i bought it even for one day. I read somewhere that in a modified PS2 with a modchip, the guarantee void seal on the back of PS2 is broken, which in my case is still intact.
Nevertheless, i tried what you suggested and it doesn't open the MC-screen.

What else do you think i can try to install fmcb?
Just buy the fmcb installed MC?
And considering that there is no modchip, what do you think has happened to my PS2, and is there any way i can solve this issue and get to ulaunch, fmcb and opl?

 

A few days ago i had patched an iso of a game with freedvdboot esr patcher and burnt it to a dvd to play the game. It worked perfectly fine.

I do not know what this patcher doing exactly but in theory it should makes the same fake DVD-Video like author of Free DVD Boot (because it is the same concept and the same exploit used, at least in first stage).

Apart from the one esr patched game that i played a few days ago

ESR Discs (which are also fake DVD-Video but doesn't use any exploit on disc side and is used to fools Mechacon to allow disc recognition so other apps like ESR can handle them) cannot be used on console without any exploit. It will be recognized as DVD-Video but You wouldn't run them.

Everything points that You have modchip (or exploited via MechaPwn like @Peppe90 said) or somehow "positively damaged" that no one ever encountered. You said that You have bought new console. It still can be used because of law allowing customer to return product in two weeks; do You think they are trashing? No, they are returning to sales... So maybe You are victim of this big coincidence.

Can these problems be due to me using the freedvdboot esr patcher gui to play iso s?

No. Even if You i.e burn MechaPwn installer on prepared disc with this app, it still needs Your actions to hack the console. It will not do this automatically. Also making fake DVD-Videos cannot damage Your console by way how You describing.

- - -
There is only one none invasive way to check it. Copy original game and burn it on DVD-R. If it boots, You will know that Yours console is hacked by some way. :P And I'm pretty sure it is.

If it have modchip or MechaPwn, You can make FMCB by Yourself easily bit leave this "issue" for later. First try just normal PS2 game released on DVD (You cannot copy game released on CD and burn it on DVD just like that; just FYI) burned on DVD-R. Or You can burn this on DVD-R: https://www.psx-place.com/resources/playstation-2-aio-project.277/ (but only v2.0.1, without any patching disc image). If it boots into uLE, it means the same: Your console is hacked.

 

There is only one none invasive way to check it. Copy original game and burn it on DVD-R. If it boots, You will know that Yours console is hacked by some way. :P And I'm pretty sure it is.
.

I did what you suggested. i burned an original god of war iso ( without any modifications to the iso) to a dvd-r and sure enough the game booted and plays absolutely fine. So i am coming to terms with the fact that my console is hacked in some way. i don't how that may be possible but that is what it is.

Or You can burn this on DVD-R: https://www.psx-place.com/resources/playstation-2-aio-project.277/ (but only v2.0.1, without any patching disc image). If it boots into uLE, it means the same: Your console is hacked.

I am downloading the 2.0.1 iso, and i will burn it to a DVD-R and try and boot it. Lets see what happens.

If it have modchip or MechaPwn, You can make FMCB by Yourself easily bit leave this "issue" for later.

Can you provide a link or something where i can learn more about this?

P.S. Thank you for taking the time to respond in such detail.

 

(...) dvd-r and sure enough the game booted and plays absolutely fine. So i am coming to terms with the fact that my console is hacked in some way. i don't how that may be possible but that is what it is.

Sorry to hear that. It looks like shop tricked You and sold used unit. But, well, maybe it is not so bad after all if You are here asking about hacking console. ^^

I am downloading the 2.0.1 iso, and i will burn it to a DVD-R and try and boot it. Lets see what happens.

If Yours PS2 booted game copy than of course it will boot also AIO. That's the same type of disc.

Can you provide a link or something where i can learn more about this?

So! While You boot AIO v2.0.1, it will launch uLE with some predefined applications in main menu.

Run file manager and go to Yours Memory Card ("mc0:/" if inserted to slot 1), mark (by circle single, by square all) all folders, press R1 and choose "Copy" option. Then connect to PS2 a pendrive (FAT32 on MBR) and go to "mass:/" (this is Yours USB mass storage device like i.e pendrive), press R1 and choose option "PSU Paste". This will copy all saves from Memory Card to USB, and pack them in *.psu container. So You will have backup of Yours data. In additional, You could make also whole device image by Memory Card Annihilator (reboot PS2 with AIO or go to "cdfs:/BOOT/APPS/MCA/MCA.ELF" and press cross button on it). From menu choose Your card and image creation, choose mass. This will make whole Memory Card image as Yours second type of backup and a backup of backup (if uLE break somehow saves copies, You can retrieve saves from the image on PS2 or PC).

Once You have full copy of Your Memory Card contents, You can step to further exploitation. Again run MCA but this time choose FULL format of Memory Card. MCA will reformat it and if find bad blocks, it will disable it. It is not mandatory step by worth to do for safety reasons.

Reboot PS2 and again go to file manager. Copy "cdfs:/BOOT/APPS/FMCB19/" to a "mass:/" (R1 > Copy selected folder and then R1 > Paste on mass) and run from there "FMCBINST.ELF". This will run FMCB v1.966 Installer. Choose multi installation (if You want card works on all PS2 or single if You want only on this model). And that's it. FMCB should install fine and You can copy saves back to it (in uLE, choose *.psu, Copy it, and PSU Paste on mc).

BUT. If FMCB will freeze or hang, or if launching any app from hacked OSDSYS (PS2 Browser) will give You black screen, it is high probably have modchip soldered. In such case, instead of installing FMCB v1.966, install FMCB 1.8b which should works fine.

P.S. Thank you for taking the time to respond in such detail.

 

BUT. If FMCB will freeze or hang, or if launching any app from hacked OSDSYS (PS2 Browser) will give You black screen, it is high probably have modchip soldered. In such case, instead of installing FMCB v1.966, install FMCB 1.8b which should works fine.

The aio 2.0.1 dvd ran fine and from that i tried to install fmcb.
First i tried 1.966(FMCB 19) version, but during boot, after the fmcb logo, it got stuck on black screen.
Then i tried the 1.8 (FMCB 18) verison. But during the boot after its installation, it gets stuck at the FMCB logo.

Edit : Also tried the fmcb 1.965 modchip version with usb drivers, fortuna and opentuna.
None of them work.

 

If v1.8b doesn't works, none FMCB will works. For some peoples 1.953 and earlier works, but for them also 1.8b works. Yet there are modchips which interfere with all of them and You can do nothing about it.

I.e my SCPH-30004R have soldered Ripper 2 Gold. None of FMCB v1.9xx works but v1.8b works fine. I decided to unsolder it anyway because I'm start to use FHDB and disabling R2G on each start was annoying as hell. Also battery died which makes my life harder (You will not boot FMCB/FHDB with factory mode start).

 

The aio 2.0.1 dvd ran fine and from that i tried to install fmcb.
First i tried 1.966(FMCB 19) version, but during boot, after the fmcb logo, it got stuck on black screen.
Then i tried the 1.8 (FMCB 18) verison. But during the boot after its installation, it gets stuck at the FMCB logo.

Edit : Also tried the fmcb 1.965 modchip version with usb drivers, fortuna and opentuna.
None of them work.

Have you choose the cross-regional installation? Just in case your Ps2 has also MechaPWN installed (or your chip changing in some way the console region if possible, I'm not experienced on modchips).

Btw if the Ps2 main menu ID matches with the one writed on the console bottom stick the region shouldn't have been modified.

Have you tried Ps1 games (either originals and backups)?

 

Single console installation still would works on this specific console if installation also was made on this console, and if he seeing logo, it means OSD Update already run it.

 

Yes i had also tried cross-regional installation as well, but no dice. Haven't played any PS1 games yet.

I guess without FMCB, I'll never be able to play games on this console through OPL. I'll just play by burning the original game iso to dvd-r. Hope my ps2 laser lasts for a few more years
Thank you @Berion , @TnA , @Peppe90 for trying to help me figure out the issues with my ps2.
Special thanks to @Berion for maintaining the AIO project which really helped new members like me

 

You do not need FMCB to run OPL. You need anything to run OPL (like i.e OPL written on disc). I added OPL to AIO but didn't add it to menu (to be honest, I forgot to remove it from "cdfs:/BOOT/APPS/OPL.ELF"). Or like i.e via DEV1 mode which maybe Yours modchip (?) support. Put OPL as "mc0:/BOOT/BOOT.ELF" (which means file named BOOT.ELF inside folder BOOT on Memory Card) and during PS2 boot, hold R1 button and in theory, it should be run on console start (depend of modchip, different buttons can be involved, or no DEV1 support at all).

 

You do not need FMCB to run OPL. You need anything to run OPL (like i.e OPL written on disc). I added OPL to AIO but didn't add it to menu (to be honest, I forgot to remove it from "cdfs:/BOOT/APPS/OPL.ELF"). Or like i.e via DEV1 mode which maybe Yours modchip (?) support. Put OPL as "mc0:/BOOT/BOOT.ELF" (which means file named BOOT.ELF inside folder BOOT on Memory Card) and during PS2 boot, hold R1 button and in theory, it should be run on console start (depend of modchip, different buttons can be involved, or no DEV1 support at all).

I agree. Make sure the MC into where you put BOOT/BOOT.ELF is in Slot 1, if you have i.e. a matrix infinity it won't boot from Slot 2.