Tonyhax International: Backup Loader For All Japanese, USA, and PAL PS1 Consoles/Early PS2 Consoles + GameShark Flasher

[karehaani]

I don't know why I can't make FF9 work in no $ psx. Can you double check the files you sent me? When I load the save no $ psx emu shows a bunch of empty file save slots...

https://dotup.org/uploda/dotup.org2909288.jpg
40= 2bolk 16k
tonyhax 1.1.6 over size

60 or 80 ok

FF9 does not work for me in no $ psx emu there is no crash. Please double check and send working files. Can't do FF9 exploit in no $ psx.

Only special HAX file will work for FF9. File size must be correct for it to work, which is why 40 00 won't work anymore. Filesize was not the issue, it was where it is in ram.

https://mega.nz/file/raYD2R7C#tLiURyKd- ... tvEkpEtUAM

the data was fine!

works fine
there was no error in the file

Since it worked without problems with no$psx, upload the file

[alexfree]

https://dotup.org/uploda/dotup.org2909288.jpg
40= 2bolk 16k
tonyhax 1.1.6 over size

60 or 80 ok

FF9 does not work for me in no $ psx emu there is no crash. Please double check and send working files. Can't do FF9 exploit in no $ psx.

Only special HAX file will work for FF9. File size must be correct for it to work, which is why 40 00 won't work anymore. Filesize was not the issue, it was where it is in ram.

https://mega.nz/file/raYD2R7C#tLiURyKd- ... tvEkpEtUAM

the data was fine!

works fine
there was no error in the file

Since it worked without problems with no$psx, upload the file

Your no $ psx emulator works.
Mine does not crash or boot tonyhax. Weird.

[alexfree]

https://dotup.org/uploda/dotup.org2909288.jpg
40= 2bolk 16k
tonyhax 1.1.6 over size

60 or 80 ok

FF9 does not work for me in no $ psx emu there is no crash. Please double check and send working files. Can't do FF9 exploit in no $ psx.

Only special HAX file will work for FF9. File size must be correct for it to work, which is why 40 00 won't work anymore. Filesize was not the issue, it was where it is in ram.

https://mega.nz/file/raYD2R7C#tLiURyKd- ... tvEkpEtUAM

the data was fine!

works fine
there was no error in the file

Since it worked without problems with no$psx, upload the file

YAY! So for some reason, the PSX-BIOS.ROM file matters?
No $ PSX High-level clone bios will not trigger the exploit.
SCPH-100 PSone v4.3 Japanese Bios triggers exploit!

[karehaani]

FF9 does not work for me in no $ psx emu there is no crash. Please double check and send working files. Can't do FF9 exploit in no $ psx.

Only special HAX file will work for FF9. File size must be correct for it to work, which is why 40 00 won't work anymore. Filesize was not the issue, it was where it is in ram.

https://mega.nz/file/raYD2R7C#tLiURyKd- ... tvEkpEtUAM

the data was fine!

works fine
there was no error in the file

Since it worked without problems with no$psx, upload the file

YAY! So for some reason, the PSX-BIOS.ROM file matters?
No $ PSX High-level clone bios will not trigger the exploit.
SCPH-100 PSone v4.3 Japanese Bios triggers exploit!

Bios is necessary to derive the same result as the actual machine, so verify the operation with multiple bios
I have checked the operation with the actual ps1 and ps2.

[alexfree]

https://dotup.org/uploda/dotup.org2909288.jpg
40= 2bolk 16k
tonyhax 1.1.6 over size

60 or 80 ok

FF9 does not work for me in no $ psx emu there is no crash. Please double check and send working files. Can't do FF9 exploit in no $ psx.

Only special HAX file will work for FF9. File size must be correct for it to work, which is why 40 00 won't work anymore. Filesize was not the issue, it was where it is in ram.

https://mega.nz/file/raYD2R7C#tLiURyKd- ... tvEkpEtUAM

the data was fine!

works fine
there was no error in the file

Since it worked without problems with no$psx, upload the file

Try with BIOS v1.0, BIOS v1.1, or BIOS v2.0. All fail to do the exploit.

BIOS v2.1 and newer do the exploit correctly.

Unsure why BIOS version matters.

[alexfree]

https://mega.nz/file/raYD2R7C#tLiURyKd- ... tvEkpEtUAM

the data was fine!

works fine
there was no error in the file

Since it worked without problems with no$psx, upload the file

YAY! So for some reason, the PSX-BIOS.ROM file matters?
No $ PSX High-level clone bios will not trigger the exploit.
SCPH-100 PSone v4.3 Japanese Bios triggers exploit!

Bios is necessary to derive the same result as the actual machine, so verify the operation with multiple bios
I have checked the operation with the actual ps1 and ps2.

I do have real consoles with BIOS v1.0, v1.1, and v2.0. Not sure if real hardware will act differently? All of those BIOS versions don't work if you assign it as the 'PSX-BIOS.ROM' file in no $ psx emulator.

[karehaani]

I will re-upload when I fix it

[alexfree]

I will re-upload when I fix it

Thanks. BIOS v2.0 and below use a different kernel version if that helps I think. Different offsets.

[alexfree]

Kernel Versions (from no $ psx SPX)

28-Jul-1994 "DTL-H2000" ;v0.x (pre-retail devboard)
22-Sep-1994 "CEX-1000 KT-3 by S.O." ;v1.0 through v2.0
no-new-date "CEX-3000 KT-3 by K.S." ;v2.1 only (old Port 1F801060h)
04-Dec-1995 "CEX-3000/1001/1002 by K.S." ;v2.2 through v4.5 (except v4.0)
29-May-1997 "CEX-7000/-7001 by K.S. " ;v4.0 only (new Port 1F801010h)
17-Jan-2000 "PS compatible mode by M.T." ;v5.0 (Playstation 2)

CEX-1000 is the only one failing to trigger the exploit...

[karehaani]

Kernel Versions (from no $ psx SPX)

28-Jul-1994 "DTL-H2000" ;v0.x (pre-retail devboard)
22-Sep-1994 "CEX-1000 KT-3 by S.O." ;v1.0 through v2.0
no-new-date "CEX-3000 KT-3 by K.S." ;v2.1 only (old Port 1F801060h)
04-Dec-1995 "CEX-3000/1001/1002 by K.S." ;v2.2 through v4.5 (except v4.0)
29-May-1997 "CEX-7000/-7001 by K.S. " ;v4.0 only (new Port 1F801010h)
17-Jan-2000 "PS compatible mode by M.T." ;v5.0 (Playstation 2)

CEX-1000 is the only one failing to trigger the exploit...

should probably be fine....

I would appreciate it if you could confirm

https://mega.nz/file/SCx11SSa#T4E0h01M7 ... GzaxeTSTTY
?new fix data

[alexfree]

Kernel Versions (from no $ psx SPX)

28-Jul-1994 "DTL-H2000" ;v0.x (pre-retail devboard)
22-Sep-1994 "CEX-1000 KT-3 by S.O." ;v1.0 through v2.0
no-new-date "CEX-3000 KT-3 by K.S." ;v2.1 only (old Port 1F801060h)
04-Dec-1995 "CEX-3000/1001/1002 by K.S." ;v2.2 through v4.5 (except v4.0)
29-May-1997 "CEX-7000/-7001 by K.S. " ;v4.0 only (new Port 1F801010h)
17-Jan-2000 "PS compatible mode by M.T." ;v5.0 (Playstation 2)

CEX-1000 is the only one failing to trigger the exploit...

should probably be fine....

I would appreciate it if you could confirm

Crashes now with BIOS v1.0, v1.1, and v2.0 but doesn't load tonyhax. Try in no $ psx emu use one of those BIOS versions as PSX-BIOS.ROM.

[alexfree]

@karehaani has fixed the exploit to work on all BIOS versions.https://mega.nz/file/SCx11SSa#T4E0h01M7 ... GzaxeTSTTY

There is a type A exploit (BIOS v1.0-v2.0, old CEX-1000 Kernels) and type B exploit (BIOS v2.1 and up, including PS2 BIOS!). Many months in the making, and it finally all works. For this to get into Tonyhax International, I need to do many changes to the Tonyhax International source and figure out how the checksum works for FF9. We are almost there, FF9HAX!!! I just bought FF9 discs!

[alexfree]

All of the pieces are in place. The FF9 exploit actually crashes before the checksum is checked, so I don't even have to figure that out. Will be in Tonyhax International v1.1.7.

[karehaani]

All of the pieces are in place. The FF9 exploit actually crashes before the checksum is checked, so I don't even have to figure that out. Will be in Tonyhax International v1.1.7.

thanks for the great update

[masterg0r0]

You're welcome, karehanni!~

[alexfree]

All of the pieces are in place. The FF9 exploit actually crashes before the checksum is checked, so I don't even have to figure that out. Will be in Tonyhax International v1.1.7.

thanks for the great update

V1.1.7 is not yet released, but will be soon with FF9 included!

I actually realized, I don't think the issue ever was with where in RAM the executable is loaded into. The issue was more complicated then that. The tonyhax source is kind of complicated in the way it makes the tonyhax loader MCS/RAW files. It uses a template for a 16.1KB MCS file, and seems to stop working when the RAW loader is above 16KB. Ive been using the save game exploits by copying the RAW loader and RAW save game files via ulaunchelf which actually auto-fixes this issue (sometimes?) and can correctly fix the RAW loader memory card data when copied. I was able to make a new MCS template based on a loader file fixed this way, and It seems like it will fix all these issues with the save game exploit loader being bigger then 16KB (which has been the case since v1.1 3). I think it was just luck my special HAX was a correctly formatted memory card file made this way, which confused the situation even more.

The issue seemed to come down to the 'linked slots' in the memory card for the file. The old template always makes only one linked slot, while we actually need a 'linked slot' and an 'end linked slot' shown in i.e. memcardrex to make this work.

So in the next version, none of these issues will happen!

[karehaani]

All of the pieces are in place. The FF9 exploit actually crashes before the checksum is checked, so I don't even have to figure that out. Will be in Tonyhax International v1.1.7.

thanks for the great update

V1.1.7 is not yet released, but will be soon with FF9 included!

I actually realized, I don't think the issue ever was with where in RAM the executable is loaded into. The issue was more complicated then that. The tonyhax source is kind of complicated in the way it makes the tonyhax loader MCS/RAW files. It uses a template for a 16.1KB MCS file, and seems to stop working when the RAW loader is above 16KB. Ive been using the save game exploits by copying the RAW loader and RAW save game files via ulaunchelf which actually auto-fixes this issue (sometimes?) and can correctly fix the RAW loader memory card data when copied. I was able to make a new MCS template based on a loader file fixed this way, and It seems like it will fix all these issues with the save game exploit loader being bigger then 16KB (which has been the case since v1.1 3). I think it was just luck my special HAX was a correctly formatted memory card file made this way, which confused the situation even more.

The issue seemed to come down to the 'linked slots' in the memory card for the file. The old template always makes only one linked slot, while we actually need a 'linked slot' and an 'end linked slot' shown in i.e. memcardrex to make this work.

So in the next version, none of these issues will happen!

happy new year
I learned a lot Thank you very much
Thank you for your update work

[alexfree]

thanks for the great update

V1.1.7 is not yet released, but will be soon with FF9 included!

I actually realized, I don't think the issue ever was with where in RAM the executable is loaded into. The issue was more complicated then that. The tonyhax source is kind of complicated in the way it makes the tonyhax loader MCS/RAW files. It uses a template for a 16.1KB MCS file, and seems to stop working when the RAW loader is above 16KB. Ive been using the save game exploits by copying the RAW loader and RAW save game files via ulaunchelf which actually auto-fixes this issue (sometimes?) and can correctly fix the RAW loader memory card data when copied. I was able to make a new MCS template based on a loader file fixed this way, and It seems like it will fix all these issues with the save game exploit loader being bigger then 16KB (which has been the case since v1.1 3). I think it was just luck my special HAX was a correctly formatted memory card file made this way, which confused the situation even more.

The issue seemed to come down to the 'linked slots' in the memory card for the file. The old template always makes only one linked slot, while we actually need a 'linked slot' and an 'end linked slot' shown in i.e. memcardrex to make this work.

So in the next version, none of these issues will happen!

happy new year
I learned a lot Thank you very much
Thank you for your update work

I was right! So there were 2 issues with this..

FF9 does indeed require the Tonyhax International loader to be loaded at my special/specific address at 801F6300, instead of 801F8180 like every other save game exploit (and boot method) currently uses. I looked into it, and it seems like it can't jump into the expected area at 801F8180+ to start execution? The loader seems to be loaded in RAM completely OK.

The old tonyhax-tpl.mcs file from the original tonyhax used to generate the tonyhax.mcs and HAX files which can only handle a maximum of 16KB (2 linked slots as shown in memcardrex). Tonyhax v1.1.2 was the last version which was 16KB, every newer version since has been a bit bigger (and as of v1.1.6 it is like 17.3KB). The tonyhax-tpl.mcs file needed to be updated to accommodate the current loader maximum of 24KB (which I changed in v1.1.2 in preparation of needing a larger RAM setup for the loader). I did not realize I needed to also update the tonyhax-tpl.mcs file at the time to accommodate the maximum size of 24KB (3 linked slots as shown in memcardrex). I managed to make such a tonyhax-tpl.mcs file which does allow using 3-linked slots correctly, it is a bit jank but I got it to work. I'm not really sure how linked slots are supposed to be represented in the MCS/RAW files specifically, but I found a work-around by copying the RAW HAX file (created via the old incorrect tonyhax-tpl) via ulaunchelf to a memory card and then back again to a USB flash drive using a PS2. I then used that file as the new template, and it displays correctly in memcardrex so that's good enough for me.

[karehaani]

V1.1.7 is not yet released, but will be soon with FF9 included!

I actually realized, I don't think the issue ever was with where in RAM the executable is loaded into. The issue was more complicated then that. The tonyhax source is kind of complicated in the way it makes the tonyhax loader MCS/RAW files. It uses a template for a 16.1KB MCS file, and seems to stop working when the RAW loader is above 16KB. Ive been using the save game exploits by copying the RAW loader and RAW save game files via ulaunchelf which actually auto-fixes this issue (sometimes?) and can correctly fix the RAW loader memory card data when copied. I was able to make a new MCS template based on a loader file fixed this way, and It seems like it will fix all these issues with the save game exploit loader being bigger then 16KB (which has been the case since v1.1 3). I think it was just luck my special HAX was a correctly formatted memory card file made this way, which confused the situation even more.

The issue seemed to come down to the 'linked slots' in the memory card for the file. The old template always makes only one linked slot, while we actually need a 'linked slot' and an 'end linked slot' shown in i.e. memcardrex to make this work.

So in the next version, none of these issues will happen!

happy new year
I learned a lot Thank you very much
Thank you for your update work

I was right! So there were 2 issues with this..

FF9 does indeed require the Tonyhax International loader to be loaded at my special/specific address at 801F6300, instead of 801F8180 like every other save game exploit (and boot method) currently uses. I looked into it, and it seems like it can't jump into the expected area at 801F8180+ to start execution? The loader seems to be loaded in RAM completely OK.

The old tonyhax-tpl.mcs file from the original tonyhax used to generate the tonyhax.mcs and HAX files which can only handle a maximum of 16KB (2 linked slots as shown in memcardrex). Tonyhax v1.1.2 was the last version which was 16KB, every newer version since has been a bit bigger (and as of v1.1.6 it is like 17.3KB). The tonyhax-tpl.mcs file needed to be updated to accommodate the current loader maximum of 24KB (which I changed in v1.1.2 in preparation of needing a larger RAM setup for the loader). I did not realize I needed to also update the tonyhax-tpl.mcs file at the time to accommodate the maximum size of 24KB (3 linked slots as shown in memcardrex). I managed to make such a tonyhax-tpl.mcs file which does allow using 3-linked slots correctly, it is a bit jank but I got it to work. I'm not really sure how linked slots are supposed to be represented in the MCS/RAW files specifically, but I found a work-around by copying the RAW HAX file (created via the old incorrect tonyhax-tpl) via ulaunchelf to a memory card and then back again to a USB flash drive using a PS2. I then used that file as the new template, and it displays correctly in memcardrex so that's good enough for me.

Way to go!
That's excellent
Thanks for the detailed explanation.
you are a genius

[alexfree]

Version 1.1.7 (1/3/2023) https://github.com/alex-free/tonyhax/re ... tional.zip

Changes:

Added save game exploit support for Final Fantasy IX Japan, Final Fantasy IX USA Rev 0, and Final Fantasy IX USA Rev 1 thanks to Patchouli (karehaani)!

Fixed the tonyhax.mcs and HAX loader files for the save game exploit boot method. Previously, only the HAX loader file copied via uLaunchElf specifically to a memory card was working due to an error accommodating the larger size of the Tonyhax International loader since v1.1.3. This issue has now been resolved and everything works as expected with both the tonyhax.mcs and HAX loader files as they are in the correct ‘linked’ format (you can see this in the memcardrex software for example).

Updated crosstool-ng to the latest version. Fixed and updated the crosstool-ng config file used to build the Tonyhax International toolchain to work with the latest version. The new config file also makes a more tuned PSX toolchain. The toolchain is set to be tuned for the r3000, for little-endian, for soft-float (no hardware float support), and for a 32-bit ABI. This means the previous CFLAGS setting these options explicitly are no longer necessary and have been removed from the various variable.mk* files in the source.

Updated the APv2 decompilation documentation (from the latest official Tonyhax).

Added more info on the RAM setups used by Tonyhax International and how they work. This information can be found in the ram-setups.txt file in the docs directory of the source.

Substantially rewrote the documentation with more information.