PS4 EBOOT / ELF FW Patcher Barthen Method, Playable Scene Group

To kick things off on this Valentine's Day hot on the heels of recent PS4 scene group MarvTM comes news via Malatya of another known as Playable, who is also doing PS4 4.05 PKG releases including The_Last_of_US_Remastered_EUR_FW_405_PS4-Playable... and even DUPLEX is now doing 4.05-friendly PS4 releases including Uncharted.4.A.Thiefs.End.PS4-DUPLEX.

Next up, @CelesteBlue passed along a Pastebin guide via Twitter from Barthen on how to lower the firmware requirement in ELF and PRX files which can be found below.

Following that method and the Free PS2 Pub Gen / Fake PKG Tools releases, PlayStation 4 developer @cfwprophet shared some updates on Twitter including Fake_PKG_Tools_v1.3.rar and an ELF FW Patcher v1.0 which patches the Firmware Version hex number of one or more PS4 ELF files for those working on getting newer titles running on 4.05 OFW.

From Barthen: How to lower the firmware requirement in ELF and PRX files

Example of lowering the firmware required for files compiled with the leaked 4.50 *** (tested on 4.05) hex editing some bytes:

1. In the ELF section called "sce_process_param" we patch the reversed *** version (there should only be one instance of the pattern): search for "01 81 50 04" and replace with "31 80 50 03"

2. In the ELF section called "sceversion" we patch the *** version (multiple instances of the pattern will be found): search for "04 50 81 01" and replace with "03 50 80 31"

3. Resign it with flatz's make_fself.py or add it to a PKG with cfwprophet's Fake_PKG_Generator

4. Profit

5. A side effect of this is that if someone is able to dump games on higher firmwares (ex. 5.05) it SHOULD be possible to play those games in lower firmwares (ex 4.05) with this method, unless the games uses functionality added on newer ***s

From the ReadMe.txt: ELF FW Patcher v1.

• Select one or more Files or a Folder to patch.
• Enter FW version hex numbers into the to Lookup Text Field.
• Enter FW version hex numbers into the to Patch Text Field.
• Click Patch FW Button.

Status Strip is currently broken......need to invoke it. I'll ix that later.

Patch Method by Barthen

Have Fun -cfwprpht-

Here's a video via @toni1988 from Cyb3r on YouTube, with a rough translation as follows:

We already have the clear sign that there is something forceful in PS4 firmware 5.05 where it looks like can massively launch games from a USB external storage disk. Still better than in 4.05. Everyone's question is when will the release be? We will not be able to prove it but if it comes out we will have to update.

Finally, @Bassabov shared a Horizon Zero Dawn Russian Video Demo (a translation would be great) alongside another via @GritNGrind from kbarticle for those interested.

Thanks to @bonusball, @kizabg, @Orgad, @sdlc, @spyro2670 and @ziobleed for the news tips in the PSXHAX Shoutbox today, and enjoy your Valentine's Day everyone!

 

[czuser]

no

 

[xxdylanxx45]

@73n1x69 what if i have a digital 4.05> can i install it then ftp the need files to patch?? we can download digitally purchased games psx download helper

 

[Goldenboy22]

Like i said in another discussion (HZD i think but it get lost in a LOT of WHINING POSTs....damn release ) we might try THIS METHOD (a lot of speculation...nothing tested..probably a bunch of crap).

BUT LET ME EXPLAIN AGAIN MY IDEA:

1) Install a beta firmware like 5.00 beta3 upon 4.05 (this is my homemade spoof )
2) Install game (no problem here i think)
3) Uninstall beta firmware (it possible with beta firmwares)
4) Try to lunch game and hope it SOMEWHAT mount pkg before trowing errors of FIRMWARE REQUIREMENT (HARD SUPPOSE NOT TRIED)
4b) Another option i thinked is to edit .sfo so it skips the preliminary check and SOMEWHAT mount (THROWING ERROR as i expect)
5) DON'T CLOSE ERROR DISPLAY (background) and try FTP the files...
6) CHANGE .ELF with barth method.
7) PROFIT.

If there's a DEVELOPER that want to reply to this thread i'll gladly accept any comment or critic about what i wrote (please don't be too rude with a noob ).

Like i said i'm still A TOTAL NOOB that read a lot of document and have not programming skill... only a lot of curiosity...it's a very interesting topic and i want to learn more about...

PS: Only a LOT of SUPPOSITION by A FOOL/TOTAL NOOB.. .

Thanks to the FANTASTIC COMMUNITY.

 

[SkysTheLimit]

Nice that somebody brings up the topic of the Method again @Goldenboy22

To "3) Uninstall beta firmware (it possible with beta firmwares)": I would really love to know if that is possible, I even have a 2nd PS4 on 4.07 with that I can try this out on the weekend, if nobody can disprove this before.

My guesses btw is something like this:

1st guess: One PKG needs a certain FW or higher to be decrypted and load. If the encryption Keys in the SAMU are the same for 4.05 and 4.07, then you might be able to use the naked SAMU calls/api to decrypt a PKG without using the official Kernel Functions, which will check for the right firmware before decrypting/loading a pkg. Like said, this is only possible if decryption Keys in the SAMU are the same for (at least) some FW, like 4.05 and 4.07.

2nd guess: Maybe somebody was able the extract the SAMU microcode/encryption keys Firmware Update from a higher Firmware and just updated the SAMU microcode/encryption keys on a FW 4.05. Like the SAMU is 5.00 and the System FW is still 4.05. This assumes that there are no further Checks in the SAMU nor OS to validate the matching SAMU Firmware and OS Version. With this method you would be able to have a 4.05 rooted OS with a SAMU that could possibly decrypt higher FW games (in combination with the 1st guess).

I would like to have an own thread just for the ideas on which method they could have used - but I can't create one (less than 20 Posts on my account ).

 

[Goldenboy22]

@SkysTheLimit That's the EXACT reason why i expect errors...but i don't know the EXACT order in which the THINGs HAPPENS..

BUT i think that first of LAUNCHING .ELF (that as you said FOR CERTAIN will fail and i'm on of the same opinion), in some SPOT THE PS4 have to mount THE FILESYSTEM...in that SPOT we can try the DUMP...

Also is interesting your speculation of the same keys of 4.05 and 4.07 i think that THIS brought to HZD...nice to have other people to talk of these topics

 

[Picalo]

My 2cents.
The file to which the disk installs the higher firmware is blocked. When the game tries to update the fw it runs into an error and it temporary unlocks the game allowing it to be dump. Once dump the elf fw patcher is used to make the proper changes and fake sign the pkg.

Sorta like the update prevention that is out (it creates a fake pup and the system does not look for a update).

By the way there's a new video of posted by cib3r.

 

[Goldenboy22]

Interesting..That could be a GOOD DUMP SPOT.....nice guys..very nice/interesting...

 

[SkysTheLimit]

The guess to get a game in an decrypted state somehow even without loading the game could be the answer.

Process of starting a game:

1. FW Check <-- here the process usually stops for us 4.05 users
[...]
2. Decryption <-- here we want to get for dumping the game
[...]
3. Game Loads <-- this is not absolutely necessary for dumping

But the question if the SAMU is even capable to decrypt a higher fw game with the 4.05 firmware still remains...

Off Topic: Going to bed now, lets see what happens on the Weekend

 

[PSXHAX]

I would like to have an own thread just for the ideas on which method they could have used

Sounds like a plan... I created a topic for everyone to discuss their research and theories here now:

• Discussion of Theories for Newer PS4 Games on 4.05 Firmware

Also for those following, there is another new PS4 scene group:

• Dark.Souls.II.Scholar.of.the.First.Sin.PS4-GCMR
• Diablo.III.Reaper.of.Souls.PS4-GCMR