PlayStation 4 Glitch Pinout, PS4 Slim / Pro Downgrading Update

Following the PS4 Linux 33c3 Demo and the start of a community-driven PS4Webkit Project, today I (@juansbeck on Twitter aka HybridComputers) am continuing from my UniversalFlash App work-in-progress bringing an update on the PlayStation 4 glitch pinout used by Marcan and the possibility to downgrade a PlayStation 4 Slim / PS4 Pro with details below.

Rough translation: Failoverflow's Marcan made a 'glitch' attack TOOL0 combined other ports like RX and TX (rs232) to PS4 Southbridge (sysconf-hypervisor) to give read and write permissions to its devboard lattice ECP3 to intercept the signals and return them in a Payload as we showed CTurt in its extensive article, but how?

Anyone can give us the datasheet? Or if at PSDevWiki oops... the blessed datasheet is a farce. It's a troll from a dodgy blog... one has to be very stupid to believe that the r32c is the hypervisor to attack Marcan... not even the VSS nor the VCC agree

Never fool us, not all the other developers that have their functional CFW that the downgrade key or the way we can get to exploit versions 3.55, 4.01, 4.05 or whatever is in this simple sysconf RL78G14 there are 100 pin and 64 and even less as it is ps4 pro the chip is from the company renesas company and although it cost us more 8 months without sleeping here I attach the datasheet, I can say that there is a pin the TOOOL0 credits (JaiCraB) which is the evolution of RX and TX.

For now the datasheet of sysconf and a small drawing for the devs who want to investigate meanwhile we do ours to keep this team that continues adding more than 8,000 euros a month I tell you why not everything is lost, here we keep moving forward and something has to come out of this.

This can be used to find a way to downgrade to the minimum version of any PS4 (including PS4 Pro)

1. Correct hypervisor datasheet (ps3devwiki blunder this farce). This is the real 64 pin LQFP for ps4 slim and 1215A pages (18) and for PS4 fat page (21) PS4 Pro pending.

hypervisor final sony (sysconf).pdf

2. Correct way to program the hypervisor to create the glitch (sysconf)

forma correcta de programar hypervisor.pdf

3. Pinout glitch hypervisor PS4

https://drive.google.com/open?id=0B2cZly5GV8y-bDhFZWhKVFJtc3c

4. PS4 Pro (unconfirmed) some ports on which Sony is based on its hypervisor (sysconf)

https://drive.google.com/open?id=0B2cZly5GV8y-RjA5dnJiQXRJUFE

A greeting to all and wish you from Universal Team a Merry Christmas!

Note

As if you are a handyman, those who try to do this and you are bundled in short layout of connections so that it is if you do not make the plate yourselves and you stay like this.

https://drive.google.com/open?id=0B2cZly5GV8y-SHJac05IUVUwUUU

In the end will be something like this, we need your support in the kickstarter.

https://drive.google.com/open?id=0B2cZly5GV8y-MGF3Z0I4bS1ORk0

We based on that development board and we added reading and writing of XBox One, PS Vita, Wii U and we are working for iPhone reading
Sony did not (and still does not) uses eFuses to prevent downgrading (they are dedicated to store per console settings at factory)
Downgrading is prevented using hashes in syscon's NVS, revocation lists (on ps4/ps vita) and stripping PUP header keys from existing modules
I can confirm that they do not burn e-fuses to prevent downgrading (or during updates) and instead rely on a "Secure Non Volatile Storage" (aka SNVS), which only SAMU modules access the (per console) keys to read and write data from.
which only SAMU modules can access the (per console) keys to read and write data from * (just fixed a typo)
Of course, this also means that in the unlikely event that you do get SAMU code execution on a specific console, you can then downgrade it (but if you can achieve that, why the hell would you need to downgrade anyway?)

• PS4 SysGlitch Tool and SysCon Glitching Pinout by VVildCard777

 

[LightningMods]

This is a generic aproach to the system s hardware, basically all models known today could be benefit of a hardware flasher/downgrader, so we are talking about to "reset" the system to its minimum factory fw version.

But even when all this sounds good, we have a long road ahead. As Juan said, it tooks months just to schematize the pinouts and their functions on the whole system.

This is not even close to a cfw, we dont even learn to walk. Dont know about the kickstarter Juan mentioned, but just to clarifie this: today seeing it all, just the hardware via could achieve the best results to open the system...again:today.

yeah...thats what i was saying

 

[PLAYER 1]

Omg.. Hardware mod means Sony warranty broken no need to worry let's see the progress I'm waiting for Jailbreak CFW my PS4 is 3.50 fw only

When something clear appears on this matter, all downgradable consoles will be out of any warranty.
But is too early to say anything more, lets wait and work.

 

[B7U3 C50SS]

This is a generic aproach to the system s hardware, basically all models known today could be benefit of a hardware flasher/downgrader, so we are talking about to "reset" the system to its minimum factory fw version.

But even when all this sounds good, we have a long road ahead. As Juan said, it tooks months just to schematize the pinouts and their functions on the whole system.

This is not even close to a cfw, we dont even learn to walk. Dont know about the kickstarter Juan mentioned, but just to clarifie this: today seeing it all, just the hardware via could achieve the best results to open the system...again:today.

@PLAYER 1 I agree, there's a long road ahead. but if people are able to load code of certain types outside WebKit via a dongle with a bit of soldering requires like E3 or what have you, you know, it should be also a possibility to load any arbitrary executable code like a bin elf sprx or pkg and what have you maybe we'll get a jailbreak after all but i think that's a long way off... LONG WAY. but it's a nice thought.

 

[PLAYER 1]

@PLAYER 1 I agree, there's a long road ahead. but if people are able to load code of certain types outside WebKit via a dongle with a bit of soldering requires like E3 or what have you, you know, it should be also a possibility to load any arbitrary executable code like a bin elf sprx or pkg and what have you maybe we'll get a jailbreak after all but i think that's a long way off... LONG WAY. but it's a nice thought.

Code are relative to code, i mean, firmware. If you are not in the right firmware, your code is useless, thats why i said we will need a hardware solution similar in concept to the flashers we have today to return to an earlier firmware, but all this is also similar to the ps3 experience in the bad way.

Next ps4s will be hard/soft blocked, just when s0ny find the way to do it. On ps3 we can reflash consoles manufactured untill march 2011, nothing more, after that only odes or the known injection, but think, always is hardware related at the end, because we need to reverse hardware to succeed.

Check f0f slides: https://fail0verflow.com/media/33c3-slides/#/2

 

[AAKASH170]

I hope right firmware is <4.06 and this hard mod are for firmware >4.05.
Everyone wants a softmod

 

[mcmrc1]

 

[BGMaxie]

This may sound repetitive but I kind of got lost reading of all that. So between the fakes, debunks and etc, etc. What happened here? What's this about?

 

[mcmrc1]

This may sound repetitive but I kind of got lost reading of all that. So between the fakes, debunks and etc, etc. What happened here? What's this about?

This is the master question all non devs wants to know ^^

 

[PLAYER 1]

This is the master question all non devs wants to know ^^

ACTUALLY, still NOTHING from the view point of a common user.
We can spect a war between soft guys and hard guys, as always.

 

[Kraken]

This may sound repetitive but I kind of got lost reading of all that. So between the fakes, debunks and etc, etc. What happened here? What's this about?

OP claims that by glitching a chip on the PS4's motherboard (via soldering a controller device to it), you can downgrade a PS4 all the way back to its original firmware.

This means in theory that older model PS4s could be downgraded to 1.76 to use the existing exploit. Newer model PS4s like the Pro can't be downgraded that far, but if an entry point is found, it could make testing custom firmware easier since it would be possible to recover to any firmware.

In practical terms, this involves taking the PS4 apart, buying a controller chip, soldering to the mainboard, and most likely losing your save data. Still, it's very much a step in the right direction.