exploit installer

Memory Card Exploit Installer

The LoadBOOTer-based installer writes the MagicGate-signed system-update folders that let a PS2 or PSX start mc?:/BOOT/BOOT.ELF from a memory card. It can also sign and bind a user-supplied ELF as the payload when you provide your own PS2KEYS.dat.

It writes boot-sensitive folders

The installer creates or overwrites system-update folders on the selected memory card and can delete existing ones. Make a card backup first. It never installs a program as BOOT.ELF for you in LoadBOOTer mode: you must place your own at mcN:/BOOT/BOOT.ELF yourself.

Installer flow

1. Open Tools > Memory card exploit installer. The console’s ROM version and model are shown at the top. On ROM 2.30 and 2.50 consoles the installer stops with “Console does not support signed exploits. Install OpenTuna instead.”
2. Pick a mode: Info, MagicGate Test, This console, Cross model, Cross region, Cross model and region or PSX DESR.
3. For the install modes, pick the payload: Install LoadBOOTer or Choose other ELF.
4. Pick Memory Card 1 (mc0:) or Memory Card 2 (mc1:). Free space is checked; a card that is not a formatted PS2 card is rejected.
5. If matching update folders already exist you choose Delete folder(s), Continue and overwrite or Cancel.
6. Launchstation computes the space needed (files plus folder overhead, plus a 512 KB reserve for BOOT.ELF when none exists yet), asks you to confirm, and installs with a progress bar.
7. The completion dialog tells you whether mcN:/BOOT/BOOT.ELF already exists or still needs to be placed.

Modes

Mode	What it installs
Info	Explains LoadBOOTer: works for ROMVER 1.00–2.20 (exceptions: DTL-H10000(S) – use ProtoPwn – DTL-H3000X, DTL-T1XXXX); the exploit simply boots mc?:/BOOT/BOOT.ELF, so you can change the app without signing again (credit pcm720); recommended BOOT.ELF programs are PS2BBL Extended, OSDMenu or any program that initialises PS2/PSX at start.
MagicGate Test	Signs the payload for the chosen card in memory without writing it, to prove the card and console can bind a MagicGate payload. A failure suggests installing OpenTuna for your ROM, or on a PSX installing the OSDMenu MBR.
This console	The folder(s) matching your ROM and region (for example JP ROM 1.00 gets the osdsys.elf/osd130.elf pair; on a PSX the PSX target).
Cross model	All models of this console’s region, for a card you will use in another console of the same region.
Cross region	The targets for every region.
Cross model and region	Every PS2 target, plus the PSX target when run on a PSX.
PSX DESR	Only the PSX target (available on a DESR).

Folders written, by region: Japan BIEXEC-SYSTEM (osdsys.elf, osd110.elf, osd130.elf, osdmain.elf), USA BAEXEC-SYSTEM (osd120.elf, osd130.elf, osdmain.elf), Europe BEEXEC-SYSTEM (osd130.elf, osdmain.elf), China BCEXEC-SYSTEM (osdmain.elf), and for a PSX BIEXEC-SYSTEM/xosdmain.elf.

Bind a custom ELF

Choose Choose other ELF and select a native ELF (the name must end in .ELF and the file must have a valid ELF header). A user-provided PS2KEYS.dat must be in the same source folder:

usb0:/APPS/
├── MyApp.ELF
└── PS2KEYS.dat

PS2KEYS.dat is intentionally not bundled with this repository and stays at the source location; it is not copied onto the memory card. Launchstation validates the key set for your console family before it asks anything else. For the normal families the signed ELF replaces the LoadBOOTer payload on the card and the dialog reports “Custom ELF payload installed” (no separate BOOT.ELF is needed). For arcade and Python 2 targets, which use a dongle-style header, Launchstation instead asks where to save the signed ELF (and asks before overwriting an existing file) rather than installing to the card.

Console-family selection

Detected family	Key section	Header style
Retail SCPH	retail	DNASLOAD
DESR / PSX	retail	FMCB-style target
DTL development systems (DTL-H*, DTL-T*)	dev	DNASLOAD
Arcade / COH-* / System 246/256 / Python 1	arcade	DONGLE
Python 2 / SCPH-50000MB family	retail	DONGLE

Signing material

Launchstation does not distribute private or proprietary key material; you are responsible for supplying lawful signing data. PS2KEYS.dat is INI-style with an optional [default] section and one section per key set ([retail], [dev], [arcade]); the chosen section overlays [default]. Values are hexadecimal of exactly the stated length, ; and # start comments. Required keys: MG_SIG_MASTER_KEY, MG_SIG_HASH_KEY, MG_KBIT_IV, MG_KC_IV, MG_ROOTSIG_MASTER_KEY, MG_CONTENT_TABLE_IV, MG_CONTENT_IV (8 bytes each) and MG_KBIT_MASTER_KEY, MG_KC_MASTER_KEY, MG_ROOTSIG_HASH_KEY (16 bytes each). The arcade set also needs OVERRIDE_KBIT and OVERRIDE_KC (16 bytes each), together or not at all. Errors are reported as “PS2KEYS.dat was not found next to…” or “does not contain valid <set> keys”.

Your BOOT.ELF

After LoadBOOTer is installed, put the program you want at mcN:/BOOT/BOOT.ELF together with its config files. Suggested choices: PS2BBL Extended, OSDMenu or Launchstation itself. The installer deliberately leaves an existing BOOT.ELF alone.

Back up first, and protect the result

Back up the card before replacing an existing exploit or trying a custom payload. Afterwards the File Browser warns before you delete or modify these folders; see exploit-folder protection. Use the Set *Tuna Date action on OpenTuna-style folders if their order matters.

Troubleshooting

1. “mc%d: is not a formatted PS2 memory card”. Format the card on the console, or use another card.
2. Not enough free space. The message shows required and available KB and whether the BOOT.ELF reserve is included; delete old update folders (the installer offers to) or free space.
3. MagicGate Test fails. The card or console cannot bind the payload; try another card, or install OpenTuna for your ROM.
4. Console does not boot the card. Check that BOOT/BOOT.ELF exists and that the installed region folder matches the console. Use Cross region to install all targets.