alex-free.github.io

Save Game Exploit

The original way to boot the Tonyhax International loader is with a special game save file that is placed on a PS1 memory card that you load while playing a specific, supported authentic PS1 game disc on your console.

Requirements

Usage

You need to copy the Tonyhax International Loader and Save Game Exploit files specific to your exact exploitable PSX game disc to the PS1 memory card. Then you can load the Save Game Exploit file in a specific way in-game to trigger an exploit that starts the Tonyhax International loader. The exact filenames and disc-specific instructions can be found in the Save Game Exploit Supported Games List.

There are 2 methods that I personally use to copy the save game exploit files to a PS1 memory card, they are the Modded PS2 Method, and the PS3 Memory Card USB Adaptor Method. There are other methods that I haven’t tried though they would also work. You just need to get the correct files on the PS1 memory card.

scph 1000 crash 2 load from save

scph 1000 crash 2 load save game exploit file

scph 1000 crash 2 exploit loading

scph 1000 crash 2 exploit loader

Modded PS2 Method

You can use a PS2 console to copy the save game exploit files to a PS1 memory card from a USB flash drive.

You want to use the RAW save game exploit file for your exploitable game (in the entrypoints directory) and the RAW loader file (in the loader directory) when using this installation method. The RAW filenames are in the list below.

Installation:

Copy the Tonyhax International Loader RAW File file and the Save Game Exploit RAW file to the FAT32 USB flash drive using a computer.

copy Tonyhax International loader file HAX

copy save game exploit file of Crash Bandicoot 2 Japan

Eject the USB flash drive from your computer and insert it along with a PS1 memory card into your PS2.

Eject USB drive

Start the WLaunchELF homebrew program on your PS2 console. Navigate to the mass device (this is your USB flash drive) with the DPAD on the controller, then select it with the circle button.

scph 10000 wlaunchelf main menu

wlaunchelf

wlaunchelf select mass

Using the DPAD to navigate, press the cross button on the controller to highlight both the Tonyhax International Loader RAW file and the Save Game Exploit RAW file that you previously copied to the USB flash drive. Press the R1 button on the controller to make the file operations menu appear in WLaunchELF. Use the DPAD to move to the copy function and then press the circle button to select it.

wlaunchelf copy crash 2 exploit files

wlaunchelf copied crash 2 exploit files

Press the triangle button to navigate out of the mass device. Use the DPAD and the circle button to navigate into either the MC0 (if the PS1 memory card is in slot 1 of the PS2) or MC1 (if the PS1 memory card is in slot 2 of the PS2) device.

wlaunchelf copy to memory card slot 1

wlaunchelf copying to memory card slot 1

wlaunchelf copied to memory card slot 1

PS3 Memory Card USB Adapter Method

You can use a PS3 Memory Card adapter in combination with the MemcardRex and a Windows PC to copy the save game exploit files to a PS1 memory card.

Get the latest version of MemcardRex and follow the instructions to install the driver for the PS3 Memory card adapter. Those instructions are found in the previous link, as well as copied verbatim below:

PS3 Memory Card Adaptor The PS3 Memory Card Adaptor is an official Sony USB adapter that allows reading and writing PS1 Memory Cards on a PlayStation 3. To use it on a Windows PC, a custom USB driver needs to be installed.

This USB driver can be easily created and installed using [Zadig](https://zadig.akeo.ie/) by following these steps:

Plug the PS3 Memory Card Adaptor into a free USB port and start Zadig. Zadig should display the PS3 MCA as an "Unknown Device". Verify that the USB ID matches: 054C 02EA

Click the Edit checkbox and name the device "PS3 Memory Card Adaptor" Ensure that "WinUSB" is selected from the list of Driver options and click the Install Driver button.

After about 30 seconds Zadig should show a message that the driver was installed successfully.

With the USB driver installed and the PS3 Memory Card Adaptor plugged in, you should now be able to read, write and format PS1 Memory Cards.

With everything ready, start up memcardrex and start copying/writing the save game exploit files, as displayed in the following images:

memcardrex

memcard rex read mc

memcard rex reading mc

memcardrex import loader save file mcs.png

memcardrex importing loader save file mcs.png

memcardrex import save game exploit file

memcardrex importing save game exploit file

memcard rex write mc

memcard rex writing mc

You want to use the MCS save game exploit file for your exploitable game (in the entrypoints directory) and the MCS loader file (in the loader directory) when using this installation method. The MCS filenames are in the list below.

Save Game Exploit Supported Games List

Notes:

Brunswick Circuit Pro Bowling

Brunswick Circuit Pro Bowling 2

Castlevania Chronicles

Castrol Honda Super Bike Racing

Castrol Honda VTR

Cool Boarders 4

Crash Bandicoot 2: Cortex Strikes Back

Crash Bandicoot 3: Warped

Dokiou-ki

Downhill Snow

Final Fantasy IX (Disc 1)

Note 1: Final Fantasy IX has 2 different types of exploits. Exploit type A works on consoles with BIOS versions 1.0-2.0. Exploit type B works on all newer BIOS versions (v2.1 to 5.0).

Note 2: If you have the Final Fantasy IX save exploit on a memory card and use the memory card manager of a SCPH-1000 console the entire console will lock up. This only happens when using the SCPH-1000’s memory card manager, so please avoid doing that :) If you delete the Final Fantasy IX save exploit file this will stop the console from locking up with the default memory card manager of the SCPH-1000.

Note 3: If you have the Final Fantasy IX save exploit on a memory card and use the memory card manager of a SCPH-3000 or newer the filenames of every save displayed will be bugged. This is visual only and doesn’t affect any functionality.

Consoles with BIOS v1.0-v2.0:

Consoles with BIOS v2.1-v5.0:

Note: there are no colors displayed when using the Finaly Fantasy IX exploit, the screen will directly boot to the Tonyhax International loader in a few seconds after being triggered in-game. Make sure you use the correct Type A or Type B exploit, or else the exploit won’t trigger!

Sports Superbike 2

Tekken 2

Tekken 3

The Legend of Heroes I & II: Eiyuu Densetsu

Tony Hawk’s Pro Skater 2

Tony Hawk’s Pro Skater 3

Tony Hawk’s Pro Skater 4

XS Moto