Join Us and become a Member for a Verified Badge on Discord to access private areas with the latest PS4 FPKGs.
PS4 CFW and Hacks       Thread starter PSXHAX       Start date Sep 3, 2018 at 11:13 PM       21,309       39      
Since his previous work on the BwE NOR / NAND Patcher and BwE NOR Validator updates for PS3, developer @BwE of has made available a BwE PS4 WiFi / BT Patcher & Extractor v1.00 followed by a v1.3.3 / v1.3.4 and v1.3.5 update for PlayStation 4 developers.

He also states on their Downloads page and Profile that he's currently working on a BwE PS4 NOR Validator as well for those interested.

In related news, pearlxcore (Twitter) also made available a PS4-BT_WIFI-PATCHER which is a PS4 Patcher for BT_WIFI (TORUS) firmware. (y)

PS4 BT_WIFI Patcher is a simple tool to repair Torus Firmware (Bt/Wifi related). This firmware known to be corrupted and causing the DS4 controller fail to connect to PS4 console wirelessly.

Download: BwE_PS4_WiFi-BT_Patcher.rar (12.3 MB) / BwE PS4 NOR WiFi/BT Patcher & Extractor / GIT / PS4.BT_WIFI.PATCHER.exe / PS4-BT_WIFI-PATCHER GIT

Spoiler: Depreciated

To quote from BwE on the PS4 WiFi / BT Patcher & Extractor v1.00 release:

Hello! This program, a micro version of my PS4 NOR Validator, is designed solely to validate and repair the WiFi/BT module of your PS4.

How do I know I need it repaired? Well if your controller does not sync anywhere but the safe mode menu then your module is corrupted.

Note: If your controller does not sync in safe mode, this program is not for you! You have a southbridge/usb port issue.

I have included a small sample of VALID patches for you to use, but you may have to source more yourself. Just place them in the /Patches/ directory with any file name.

If your patch isnt listed and you enjoy risk, my program will allow this. You can patch a mis-matched firmware for your WiFi/BT module.

Doing this will wipe c0020001.bin and its header from your PS4's NOR entirely and replace it with whatever you have chosen. I recommend you stick with the correct Torus version, which will be displayed on screen. Slim & Pro models are generally Torus 2.

If you hate risk but still want to patch, simply ask around for your matching patch file. Just quote the file size.

If you have found a patch that is not on my list, let me know at [email protected] and send me a link to it. Feel free to use my EXTRACTOR to verify its validity and ensure proper extracting!

I will add any new patches to my program in future revisions.

NOTE: My program is designed for Windows 64 - If this is a problem, please upgrade (if you can call it that...) Released 4/9/18 as Version 1.0.

And from the related PSDevWiki page, to quote: Software Wireless BT


The firmware for the WiFi/BT Module is found within the Flash-Main of the PS4 in a file designated C0020001. Its location is 0x144200 and its length can be determined from reading the header information at the start of 0x144000. This is periodically updated during the firmware updates of the PS4 itself. This is the reasoning behind storing the firmware for the module within the firmware of the PS4 itself.

This software is known to get corrupt and once it is will render the WiFi and Bluetooth useless. This means that controller cannot function in the XMB. However, the controller can still be used in safe mode as this is the only area of the PS4 that does not utilize the WiFi/BT Module, rather it only connects to the controller via USB. This problem is repairable, given you have a copy of the same firmware for your module.

User:BwE has developed a program to aid in the validation, repair and extraction of the C0020001.bin for this sole reason.

Version History:
  • 1.3.4 (1/3/19) - Added FW/BIOS Versioning, Prettied It Up (Behind The Scenes Too) & Released to GitHub!
  • 1.3.3 (1/3/19) - Combined Patcher & Extractor, Added Additional Patch & Added Version Checker.
  • 1.3 (22/12/18) - Converted to 32bit (Hello 3absiso!), No Other Changes (Because this program is GREAT)
  • 1.2 (27/11/18) - Fixed Entropy + Added Better MD5 Validation + Added Better Header Validation
  • 1.1 (25/11/18) - Added Entropy
If you like what I do, or just like me for me, buy me a coffeeeee!
BwE PS4 WiFi  BT Patcher & Extractor v1.00 by BetterWayElectronics.jpg

BwE PS4 WiFi  BT Patcher & Extractor v1.00 by BetterWayElectronics 2.jpg




Senior Member

I don't like the socket or the clip very much as it is less reliable. The PCB behind the Teensy in the above photo is the best method. Just desolder it, solder it onto that PCB, plug it into Teensy and Ta-Da! Once finished, desolder it off the pcb and solder it back onto the PS4. This is the best possible way.

Now if you're asking about my technique to actually solder and desolder things, that is a longer story.,


Senior Member
@pearlxcore I find that the clip AND socket can give invalid dumps.

Using the PCB board and wiring direct to headers - that has had 100% success rate (for me).

But hey this is why I make a validator - that and the ps4 seems to love corrupting itself.

Even the slim/pro chips can be externalized and run off a little PCB. This is pretty much the only way with this type of chip.


Senior Member
@BwE thanks the tips. Looks like I need to buy extra tools.

Can you share dump sample from 5.xx fw? I don’t mind if you delete mac/idps. I just want to compare it.


Senior Member

There are some free samples on psdevwiki, I used them to start my validator. Just don't bother with the dev/test firmwares, nobody will realistically own one - yet i still validate it - stupid me.

The extra tools cost almost NOTHING - so don't stress. Just buy a Teensy from the manufacturer, they're quite reliable, everything else can come from China.


Senior Member
@BwE I have a 5.53 dump but can't find the firmware version.

On ps4devwiki it stated that the offset for fw version is at 0x1CA604/0x1CA5D8.

I got "FF FF FF FF". Is the fw version is on difference offset or mine is not valid ;)


Senior Member

its not a very reliable place to check the firmware, I wouldn't worry. I can generally tell tacitly by the files within the flash itself.

I was going to make a 'perfect' way of doing this, but I don't have dumps of every version...

I think one day I will get my 1.00 ps4 and update it, very slowly, through each version. But I really cannot be bothered!


Senior Member
Im making a tool that include displaying fw version, mac address etc <- I know there is already tool to do that. But im making it for educational purpose :D tested with some fw with difference fw version. Some dump show the fw version and some not (included from ps4devwiki). So im not sure whether im checking on the right offset or not.

That will be a lot of work. Im looking forward to that and also your dump validator :D:tup:


Senior Member

in PERL? get it? haha.

MAC: 0x1C4021 (0x6)
Serial: 0x1C8030 (0xA)
SKU: 0x1C8041 (Length Varies)
HD: 0x1C9C00 (0x3C)

There's a whole bunch of crap in CID....

0x1C4000 -> 0x1CA000:
CID Static Section 1: 0302010102010601  ✔
CID Filler 1:  ✔
CID Static Section 2: 01  ✔
CID MAC Address: 709E2972D3CF  ✔
CID Filler 2:  ✔
CID Dynamic Section 1: 338E  ✔
CID Static Section 3: 04  ✔
CID Filler 3:  ✔
CID Static Section 4: 0301010202  ✔
CID Filler 4:  ✔
CID Static Section 5: 01  ✔
CID Filler 5:  ✔
CID Static Section 6: 00000000000000  ✔
CID Filler 6:  ✔
CID Static Section 7: 000000  ✔
CID Filler 7:  ✔
CID Static Section 8: 0000  ✔
CID Filler 8:  ✔
CID Static Section 9: 00000039  ✔
CID Filler 9:  ✔
CID Static Section 10: BECC  ✔
CID Filler 10:  ✔
CID Static Section 11: 00  ✔
CID Filler 11:  ✔
CID Static Section 12: 006100600002004800470002004800470002  ✔
CID Filler 12:  ✔
CID Static Section 13: 0001  ✔
CID Filler 13:  ✔
CID Static Section 14: 0001  ✔
CID Filler 14:  ✔
CID Static Section 15: 005000000008000080000000  ✔
CID Filler 15:  ✔
CID Static Section 16: 00500000000900000000450000009000003B00000005000005000000  ✔
CID Filler 16:  ✔
CID Dynamic Section 2: B9290007  ✔
CID Filler 17:  ✔
CID Dynamic Section 3: 070007  ✔
CID Filler 18:  ✔
CID Dynamic Section 4: 0700030C04000000040000  ✔
CID Filler 19:  ✔
CID Static Section 17: 00000000000000000000  ✔
CID Filler 20:  ✔
CID Dynamic Section 5: 240A0000200A0000527EE90000000000E4070000E4070000DC0E4A040000000044050000380500008F2E800300000000  ✔
CID Filler 21 Dynamic Spacer:  ✔
CID Filler 21:  ✔
CID Dynamic Section 6: 020101C0B191450C0140FF000001000082001F00FFFF0025  ✔
CID Filler 22:  ✔
CID Dynamic Section 7: 110081805B94450C0410FF0000010000AC001F00FFFF8026  ✔
CID Filler 23:  ✔
CID Dynamic Section 9: 060000804D153B0C014010000000010081001F0040448034  ✔
CID Filler 25:  ✔
CID Dynamic Section 10: 04000080F3153B0C0500100000000100CA001F00404A0037  ✔
CID Filler 26:  ✔
CID Dynamic Section 11: 05000080F3153B0C0140100000000100CA001F00FFFF0037  ✔
CID Filler 27:  ✔
CID Dynamic Section 12: 06000080F3153B0C0140100000000100CA001F00FFFF0037  ✔
CID Filler 28:  ✔
CID Dynamic Section 13: 000083804286450C0500000000010000CA001F0000414031  ✔
CID Filler 29:  ✔
CID Dynamic Section 14: 04000080EC86450C050010000000010081001F00C041402C  ✔
CID Filler 30:  ✔
CID Dynamic Section 15: 05000080EC86450C014010000000010081001F00C041402C  ✔
CID Filler 31:  ✔
CID Dynamic Section 16: 06000080EC86450C014010000000010081001F00C041402C  ✔
CID Filler 32:  ✔
CID Dynamic Section 17: 00008380E387450C0500000000000100CA001F0000420034  ✔
CID Filler 33:  ✔
CID Dynamic Section 18: 040000805C88450C050010000000010081001F008041002F  ✔
CID Filler 34:  ✔
CID Dynamic Section 19: 050000805C88450C014010000000010081001F008041002F  ✔
CID Filler 35:  ✔
CID Dynamic Section 20: 060000805C88450C014010000000010081001F008041002F  ✔
CID Filler 36:  ✔
CID Dynamic Section 21: 040000801A89450C0500100000000800CA001F00804D4034  ✔
CID Filler 37:  ✔
CID Dynamic Section 22: 050000801A89450C0140100000000800CA001F00804D4034  ✔
CID Filler 38:  ✔
CID Dynamic Section 23: 060000801A89450C0140100000000800CA001F00804D4034  ✔
CID Filler 39:  ✔
CID Dynamic Section 24: 000083800F8B450C0500BF0000010000CA001F00C03C802C  ✔
CID Filler 40:  ✔
CID Dynamic Section 25: 04000080988B450C050010000000010081001F00403C002C  ✔
CID Filler 41:  ✔
CID Dynamic Section 26: 05000080988B450C014010000000010081001F00403CC02B  ✔
CID Filler 42:  ✔
CID Dynamic Section 27: 06000080988B450C014010000000010081001F00FFFFC02B  ✔
CID Filler 43:  ✔
CID Dynamic Section 28: 040000808191450C0500100000010000CA001F00C03A0025  ✔
CID Dynamic Identifier 1 (Unknown): B6D63F6D661C0003  ✔
CID Dynamic Identifier 1 (2) (Unknown): 98490793FDAC0003  ✔
CID Dynamic Identifier 1 (3) (Unknown): 82F9395A961C0003  ✔
CID Dynamic Identifier Filler 1 (0x1C6018):  ✔
CID Dynamic Identifier Filler 1 (0x1C6020):  ✔
CID Dynamic Identifier 2 (Unknown): 0309FC0000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000007FF0000000000000000000000000000  ✔
CID Identifier Filler 1:  ✔
CID Dynamic Identifier 3 (Motherboard S/N): 40001D92657691  ✔
CID Identifier Filler 2:  ✔
CID Dynamic Identifier 4 (Unknown): 7AC3D4A4BD4BD6C0A3657D604BAB3C430000002600020AF50001000000000710  ✔
CID Dynamic Identifier 5 (Console S/N): MB08172631  ✔
CID Dynamic Identifier 6 (SKU Model): CUH-1001A B01  ✔
CID Identifier Filler 4:  ✔
CID Dynamic Identifier 7 (Unknown): 00030003001800180007000100010001000100020037001900310045  ✔
CID Dynamic Identifier 8 (Unknown): 526F1BF66146013007C230C372DB9157078F3140000000C20101010106060606  ✔
CID Identifier Filler 5:  ✔
CID Dynamic Identifier 9 (Unknown): 0000027452229  ✔
CID Dynamic Filler 2:  ✔
CID Identifier Filler 6:  ✔
CID Identifier Filler 7:  ✔
CID Static Section 18:  ✔
CID Identifier Filler 8:  ✔
CID Static Section 19: 01  ✔
CID Identifier Filler 9:  ✔
CID Static Section 20: 00  ✔
CID Identifier Filler 10:

'00' found at offset: 0x1C9022 [WARNING]

CID Dynamic Identifier 11 (Unknown): FF (Dev/Test)  ✔
CID Dynamic Identifier (1C9100) (Unknown): E00311000AFF0600700000008C00000028006C7FA5C00001000000000000E300C241185B00000000E00311000AFF0700700000008C00000028006C7FAA400001000000000000E300C541185B00000000E00311000AFF0800700000008C00000028006C7FAAC00001000000000000E300C841185B00000000E00311000AFF0900700000008C00000028006D0A4C400001000000000000E3007742185B00000000E00311000AFF0A00700000008C00000028006D0A4CC00001000000000000E3007A42185B00000000E00311000AFF0500700000008C00000028006C7FA5400001000000000000E300BF41185B00000000  ✔
CID Identifier Filler 12:  ✔
CID Static Section 21: E5E5E501  ✔
CID Dynamic Identifier 12 (Console Specific): 9C29BE403877549A981BDE3A0A4583D3278B57FA6D59BE1219509E3D9584BDBF5F06570B9682FD13158B155C75F50A93099AAF49BB0CCC80C1A169F36D4957DC  ✔
CID Identifier Filler 13:  ✔
CID Dynamic Identifier 13 (Hard Drive): GHTSH ST2701019A6E03 GJ0400P6PG3VCU  ✔

:fire: Latest Help Topics