Fortuna (2.0 download) (original project) and OpenTuna (open source version created by reverse engineering Fortuna) are exploits for the PS2 browser. They exploit a buffer overflow vulnerability on the browser RLE decompression routine, which is used to decompress the icons textures. OpenTuna is a specially crafted PS2 executable injected into the texture area of a modified PS2 icon file (without 3d model).
The only requirements for this exploit to work are that the hacked icon must be the first one to display on the browser and that the hacked icon is tuned to propagate the buffer overflow accordingly to the PS2 browser version. The first requirement is met by making sure the folder containing the hacked icon has its date set to something later than the console’s current date. For this purpose, the maximum date (2099-12-31, 23:59:59) is the best approach, as it makes sure the exploit could only fail on the last second of 2099.
Once set up, OpenTuna loads a program of your choice. It can also be combined with PS2BBL to add more functionality.
Compatibility
OpenTuna has 3 variations that cover a wide variety of the PS2 models:
- The "slims" variant: works on all slims, PS2TV, and SCPH-50xxx with 1.90 Boot ROM.
- The mid FAT variant: only works on SCPH-50xxx with 1.70 boot ROM.
- The FAT variant: works on all boot ROMs since 1.10 up to 1.60. This means it covers all models from SCPH-18000 up to SCPH-39xxx.
Installation
When installing with PS2BBL, you can use the PS2BBL-OpenTuna installer package. There is also an installer available which only installs the exploit. The exploit can also be installed manually.
Important Notes
- PSX is not compatible due to the XMB being quite different to common OSDSYS.
- HDD-OSD (browser 2.0) will make the console incapable of recognizing the memory cards until console is unplugged from current if it processes an OpenTuna/Fortuna icon
- ProtoKernel PS2s (SCPH-10000 and SCPH-15000) are not compatible with OpenTuna. Both Alex Parrado (OpenTuna creator) and El_isra tried their best to make it happen, but never got any significant progress. This is probably related to the fact that ProtoKernel models are the only PS2 models in which the OSDSYS program is not compressed. This was quite a shame, as OpenTuna was the last chance to get exploits for the hardest to hack PS2 models (DTL-H10000 & DTL-H10000S)