Exploit allowing to load arbitrary code on the PSX (i.e. PlayStation 1) using only a memory card (no game needed).

To use it, you will need a way to copy full memory card images (not individual files) to a memory card. Some possibilities are:

• A PS2 and the software Memory Card Annihilator v2 (use "Restore MC image")
• Memcarduino. Requires soldering wires to the memory card.
• Using a Memcard Pro, which lets you create your own virtual memory cards on an sdcard. Simply drop the card image file you want to use as Memory Card 1, Channel 1.

• Copy the full memory card image corresponding to your model/BIOS to a memory card.
• Insert it in slot 1.
• Power up your PlayStation with the lid open, and go to the memory card manager.
• After a few seconds, the screen will flash orange. Wait ~30 seconds for the Unirom welcome screen to appear.
• If the screen doesn't flash orange after 20 seconds, you have either used a wrong memory card image, or your model uses an exploit which is not 100% reliable. In that case, power off your PlayStation, wait for 1 minute, and try again.
• Once Unirom is loaded, you can insert a CD, close the lid, and press R1 to load the game.
• Don't forget to remove your memory card, as its exploit will trigger into games as well. The card is effectively unusable for normal operations, and you would need to use a different memory card. This isn't an issue when using the Memcard Pro, as it will automatically change the virtual card to the game you're booting.

• All models are supported except SCPH-1000 and SCPH-3000, which will probably be supported in the future.
• Some models use a 100% reliable exploit, other models use an earlier version of the exploit, which depends on uninitialized memory and is therefore not 100% reliable (see caveat below).
• See the table below for more details and download links.

2021-04-12: New version of Unirom, able to load games. Huge thanks to the psxdev contributors. 2021-04-11: 100% reliable exploit for the SCPH-7002, SCPH-7502 and SCPH-9002.

The earlier version of this exploit relies on uninitialized memory in kernel space to be at 0 in order to work properly. The SDRAM chips have a fairly slow decay rate, and this exploit will only be reliable if the machine has been powered off for long enough.

Technical details

Demonstration

These images are pre-built with Unirom. There are two versions: standard, which has ~30 seconds load time, and reduced, which has ~20 seconds load time.

There are different downloads for different console versions. Please download the correct ROM for your model of PlayStation. If a version is missing, it hasn't been added yet.

As more reliable versions of the exploit are developed, the images are updated.

Links marked with old are images which cannot load games yet.

See the folder builder for a tool that can be used to generate your own payloads and memory cards.

Memory card images are raw data: your memory card must have the exact same content as the files. Use Memcarduino or something similar; don't use a memory card file manager, as it will try to correct the data we're altering.

If the exploit is successful, you will see the screen flashing orange. Otherwise, power cycle your PSX and try again after a minute or so. It may take a few tries.

The exploit works in emulators as well, and works all the time due to the memory being always initialized to 0. Tested with no$psx and pcsx-redux.