PS4 Development Menu (Debug Mode) Enabled on Retail PlayStation 4

Just over a week ago we heard rumors of accessing the PS4 Debug Mode Settings on retail PlayStation 4 consoles, and today scene developer CTurt confirmed it's now possible to access the PS4 Dev Menu on 1.76 retail units thanks to Flat_z!

Download: Enable Dev Menu / PS4-dlclose.zip / PS4-debugmenu.bin (1.0 MB Compiled) via fx0day / PS4-debugmenu.bin (1.0 MB Compiled) via Di_Scala_ / Tutorial by Chaos Kid / PS4-dlclose GIT

From Stuart Fox via Facebook comes a video demo also.

Update: From lezek20 also comes code to enable the more advanced debug menu (dlclose.bin (1.00 MB) compiled by ultradogg), to quote:

*(char *)0xFFFFFFFF833242FD = 0x81;

Just add it into the kernel payload before this part:

writeCr0(cr0);

This could brick your console btw, so be careful!

Update #2: From @j0lama with help from @sealab (Demo video: jgoake.mp4 - 43 MB) via Twitter:
Download: Fully-Enable-Debug-Settings.bin (1 MB)

Fully enable Debug Settings:
*(uint32_t*) 0xFFFFFFFF8269C07Cull=0;
*(uint32_t*) 0xFFFFFFFF8269B56Full=0;

Thanks to B7U3 C50SS and GrimDoe in the Shoutbox for the heads-up!

 

[B7U3 C50SS]

Exactly.. @bladerunner6

 

[SorenAlke]

I'm pretty sure we are able to access the APU and not just stay jailed in the ARM AUX processor side... On 1.76
I do understand however that fail0ver linux is not yet publicly available compiledf yet which has some rudimentry radeon access.
Chaos Kid, Are you saying we are deliberatley being fed current exploits to keep us away from the real meat

not if you tear apart the current work being released right now

 

[GrimDoe]

Interesting !

 

[Chaos Kid]

Hey Chaos Kid, just wondering, which homebrews did you release in the past? You seem to know a lot about what hacks do and what not.

Emulation on non standard units is all I will say I like to keep the past behind me.
And yes I know what hacks do I do my fair share of them in non logical ways I like to break the rules and make new ground but I mainly do most my work for development.

So many rumors on this stuff but ive dug into mine hooked up an analyzer to know what it is and the triggering is a pain. 2x quad FPU which makes it quite interesting aspecialy with SSE n SSE2 support.

 

[SorenAlke]

@chaosKid the new 4k is retarded im srry
at least they fixed the frame dip with the current update but this is exactly why games like ac unity had those bugs.... clipping man!!!!!!!
You dont ,You really just dont ... *SIGH*
WHY out of anything,WHYYYY,they could of done, "Chosen to Do"
im srry i feel like i need to go cry because obviously ,nothing seems to work.

*SIGH*

 

[B7U3 C50SS]

what are you talking about?

 

[SorenAlke]

@ChaosKid https://github.com/darwin-on-arm/xnu/blob/master/libsyscall/wrappers/init_cpu_capabilities.c

#undef __APPLE_API_PRIVATE
#if defined(__i386__) || defined(__x86_64__)
/* This is in Libc on arm. */
/* Initialize the "_cpu_capabilities" vector on x86 processors. */

..... so much for lunacy not having its way

 

[Chaos Kid]

@ChaosKid https://github.com/darwin-on-arm/xnu/blob/master/libsyscall/wrappers/init_cpu_capabilities.c

#undef __APPLE_API_PRIVATE
#if defined(__i386__) || defined(__x86_64__)
/* This is in Libc on arm. */
/* Initialize the "_cpu_capabilities" vector on x86 processors. */

..... so much for lunacy not having its way

Hold on be4 you lose your apples I will see if they are using xlc/c++ no different then we use on fc5-i386

 

[SorenAlke]

im trying to m8... really really trying not scream inside. lol. its almost a pain for us to even bother now

 

[Chaos Kid]

Floating points check here

typedef unsigned long NXSwappedFloat;
typedef unsigned long long NXSwappedDouble;


#if defined(__LITTLE_ENDIAN__)
return NX_LittleEndian;
#elif defined(__BIG_ENDIAN__)
return NX_BigEndian;

There also using macros with asm and headers for top level support