PS4 CFW and Hacks

Last month we covered an Alexa PS4 Project, and recently developer FreeTHX shared PyWakePS4onBT which is a Python library to wakeup the PS4 console on Bluetooth for those interested in checking it out!

Download: setup.py / pywakeps4onbt-master.zip / GIT

And from the README.md: PyWakePs4 On BlueTooth

This is a simple Python library to switch on a ps4 using Bluetooth Based on :

• PS4 Dev Wiki Spoofing and HCI CC
• bdaddr BT spoofing first imp
• bdaddr github ... and another one available on github
• Frank Zhao Article to get DS4 and PS4 BT Addr

The main objective is to include it into Home Assistant components to provide a "Wake Ps4 On Bt" service.

Supported Devices

The module tests the adapter support via a hci_read_local_version python implementation and read the manufacturer returned value (bytes[5:7])

Currently supported adapter :

• Broadcom devices (manufacturer = 15)
• Raspberry 3 devices ( Broadcom too but specific hci_read_local_version returned value)

Cheers to @HydrogenNGU for the heads-up on this PS4 homebrew scene news.

As you know to develop on PS4, game studios use PS4 development systems.

Now, following my PS4 Debug Settings Overview I'm interested in finding how the Serial Number works and with the recent gameplay of Call Of Duty Modern Warfare.

Some Youtubers made the mistake to show the UI of the PS4... and in this UI you can see the Serial Number of the PS4 Testkit.

I've saw 2 PS4 Pro Testkits (DUH-T200AA) and it was enough for me to have a result since I already have 2 PS4 FAT Testkits which I've discussed on Twitter.

• 00-27455734-005XXXX = PS4 Pro Testkit
• 00-274557XX-005XXXX = PS4 Slim Testkit
• 00-27455722-005XXXX = PS4 Fat Testkit

• 34 = PS4 Pro
• XX = PS4 Slim (I still have not found it yet)
• 22 = PS4 FAT

The 4 XXXX could be the number of system given to studios

Examples:

PS4 FAT Testkit:

• 00-27455722-0054121
• 00-27455722 0054028

PS4 Pro Testkit:

• 00-27455734-0050735
• 00-27455734-0050914

Spoiler

• 00-27455721-020XXXX DUH-D1000AA
• 00-27455727-020XXXX DUH-D7000AA

• My first FAT Testkit : 00-27455722-0054121
• My Second FAT Testkit : 00-27455722-0057180

Proceeding his previous updates, this weekend PlayStation 4 developer @0x199 released via Twitter a PS4 Lotus 1.03 Mod Menu for GTA V 1.27 followed by v1.04 complete with a demonstration video by @NagatoRevenge on Twitter from Nagato's Revenge YouTube Channel and the changes detailed below.

Download: latest.bin (1.0 MB)

From his Tweets below: Lotus 1.04 for PS4 5.05 GTAV 1.27

This version includes Riot Mode, as shown in the video below. Also Super Punch for Pedestrians, Flamethrower Gun, and a bunch of fixes. Enjoy!

And from the official page, some Lotus Menu 1.04 Highlighted Features:

• Super Punch - A highly powerful punch which works for both pedestrians and vehicles.
• Noclip - Clip through walls and objects.
• Meteor Rain - Make it rain... meteors.

Changelog: Lotus 1.03

Menu

• Smoothscroll speed improved
• Added more tiptexts to options
• Fixed minor menu base bugs

Player Options

• Added Super Punch
• Firebreather has been improved, you can now control the fire duration by holding R1
• Added the ability to hover in mid-air when holding R1 in Superman mode
• Added the ability to land on your feet when you're close to the ground in Superman mode
• Player can no longer fly out of the vehicle windscreen in a crash when No Ragdoll is enabled

Vehicle Options

• Nitrous has been improved to be more smooth, and the restriction to be on the ground has been removed
• Added Disable Collision
• Added Reduce Grip

Weapon Options

• Gravity Gun has been improved to be more stable
• Slow Motion Gun has been fixed
• Added Cartoon Gun
• Added Rainbow Tint, loops through the weapon tints

NPC Options

• NPCs will now spawn in the direction of the player camera
• Particle FX have been added when spawning NPCs
• A "holo" marker has been added to better identify the selected NPC

Object Options

• Added Maps scroller option...

Following the Spider-Man PS4 Skeletal Models & Textures Tool comes a LittleBigPlanet File Editor / Texture Viewer with source code for LBP 1, 2 and 3 called Farctool2 by philosophofee on Github spanning PS3, PS Vita and PS4 consoles.

Download: farctool2.jar / GIT

According to the author's documentation, there is also an active Farctool2 fork from ennuo available HERE (farctool2mod.zip) for the FARC, FAR4 and MAP file manipulation tool written in Java that includes mod support.

From the forked README.md, to quote: About

What is farctool2?

Farctool2 is a program I wrote for two reasons:

1. To learn how Java can read and manipulate data streams, and
2. Because I already knew the structures of the file formats this game used.

Why farctool "2"?

Farctool2 is the sequel to the original farctool, which was written in Game Maker 8.0.

Features

• Supports the loading of the FAR4, FARC, and MAP formats from the LittleBigPlanet games.
• Supports texture viewing from every LBP game (excluding certain SDF types) except LBP Vita.
• Supports extracting textures in 3 different formats: PNG, JPG, and DDS.
• Supports extraction of any file as-is or decompressed.
• Features adding files to the FARC.
• Features adding, replacing, deleting, and zeroing entries from the MAP.
• Features the ability to build packages from PLANs for ease of modding.
• Features the ability to install said packages to any FARC and MAP.
• Hex viewer (ft. Sporst)
• Plaintext viewer for text-based files.
• Supports dumping dependency list of LBP assets with reverse-lookup on GUIDs to filenames.

Disclaimer

I did not create any of the games in question nor am I affiliated with any of the developers of these video games. All researched data was acquired via means of downloading game package files through a public database of direct-to-PSN URLs with no protection. Nothing malicious is intended. This program...

Tested on IDA 7.0-7.2 and geared towards PS4 scene devs who haven't jumped to GhidraPS4Loader / GhidraOrbisTools yet, today PlayStation 4 developer @SocraticBliss made available on Twitter a PS4 Module Loader for Userland Modules following his recent PS4 Kernel Loader updates.

Download: ps4_module.py / ps4_module_loader-master.zip / GIT

And from the README.md to quote: PS4 Module Loader

SocraticBliss (R)

Major Thanks to...

• aerosoul
• balika011
• Znullptr
• Pablo (kozarovv)
• ChendoChap
• xyz
• CelesteBlue
• kiwidogg
• motoharu
• noname120
• flatz
• Team Reswitched

Extra Special Thanks for telling me my program sucks...

• zecoxao

ps4_module.py: IDA loader for reading Sony PlayStation(R) 4 Module files

Installation

IDA 7.0 - 7.2

1. Extract the IDA70-72.zip directory into your IDA directory (overwite the files when prompted)

IDA 7.5-7.7 (Requires Python 3.9)

1. Extract the IDA75.zip directory into your IDA directory (overwite the files when prompted)

IDA 8.3

1. I will eventually make a zip, just copy ps4_module.py and aerolib.csv to your loaders directory

Usage

1. Load a PS4 Module file (.prx, .sprx, .elf, .self)
2. Select the option ending with [ps4_module.py]

Spoiler: Depreciated