PS4 Syscon Read-Write Helper for System Controller Dumps via Egycnq

Proceeding the PS4 Syscon NVS Dumps, PS4 Syscon Aux Hax, PS4 Syscon Firmware Decrypter, PS4 SysGlitch Tool with SysCon Pinout, PS4 Syscon Loader and PS4 / PS5 Unlimited Gameshare Method Patched recently @egycnq shared on Github a PS4 Syscon Read-Write Helper for System Controller Dumps Python script via Twitter for those seeking to dump, validate and convert their PlayStation 4 Syscon to Motorola s28 format for RL78 flashing without any external tools.

Download: SysconV1.py / Ps4-Syscon-Read-Write-Helper-main.zip / GIT / PS4 Syscon Research & Development Repository / PS4 Syscon Firmware Dumps Archive

# *************************************************************************
# Syscon.py - Read-Write Ps4 Syscon helper Script
# You can use this script to read Sony Ps4 syscon and validate it also produce 512kb firmware after that.
# You Still need stock RL78 for flashing the firmware.
# special thanks to VVildCard777 - Fail0verflow - droogie - juansbeck -Zecoxao - M4j0r - SSL - msalau
# Copyright (C) 2021 RedTeam - egycnq https://twitter.com/egycnq
# *************************************************************************
import subprocess
import filecmp
import serial
import os
import re

def step2 () :
    raw_input("connect Syscon in read mode [check 'SYSGLITCH' Guide] and press any key when you are ready")
    ser = serial.Serial(com2, baudrate=115200, timeout=1)

    while 1:
        data = ser.read_all()
        f = open('syscon.bin', 'ab')
        data = str(data)
        f.write(data)
        f.close()
        print os.stat("syscon.bin").st_size
        if os.stat("syscon.bin").st_size >= 3094304:
            print "done"
            break
    f = open('syscon.bin', 'rb')
    data = f.read()
    pattern = "\x80\x01\xFF\xFF\xFF\xFF"
    regex = re.compile(pattern)
    asd = "syscon"
    for match_obj in regex.finditer(data):
        offset = match_obj.start()
        a = "{:02X}".format(offset)
        a = int(a, 16)
        hex_value = hex(a)
        hex_value = int(hex_value, 16)
        f.seek(hex_value, 0)
        data = f.read(0x80000)
        with open(asd, "wb") as outfile:
            outfile.write(data)
            asd = asd + "a"
    comp = filecmp.cmp("syscon", "syscona", shallow=False)
    if comp == False:
        print "\nError: check your connections Something Wrong"
        os.remove("syscon.bin")
        os.remove("syscon")
        os.remove("syscona")
        step2()

    subprocess.call(["srec_cat.exe", "syscon", "-binary", "-o", "syscon.srec", "-address-length=3"])
    os.rename("syscon.srec", "syscon.mot")
    os.remove("syscona")
    f.close()
    print "\nWell Done"
    start()


def step3():
    com3 = raw_input("Connect USB tty then enter Com (connect RL78 in write mode [check 'rl78flash' guide]")
    a = subprocess.call(["rl78flash.exe", "-i", "com3"])
    if a == 0:

            subprocess.call(["rl78flash.exe", "-ivvewc", com3,"syscon.mot"])
            print "done"

    else:
        print "Oh Nooooooo"
        step3()
    start()



def start():
    user_input = input("Enter 1 for Step 1 [read] \nEnter 2 for Step 2 [write]\n")
    if user_input == 1 :
        step2()
    elif user_input == 2 :
        step3()
    else :
        print "enter correct Input"
        start()

start()

And from the README.md: Ps4 Syscon Read-Write helper

A python script using SYSGLITCH to dump Ps4 syscon and validate it - extract 512kb firmware and convert it to motorola s28 file format - write stock RL78 (using rl78flash) Its time saving tool you will just need this script to read and write no need for other external tools.

How to use it :

Step 1 [Read]:

You must first check SYSGLITCH guide, then after you connect your syscon correctly run the script and go for step 1

If everything goes well you will get a "syscon" full dump 3mb<~ and "syscon.mot" 512kb , if anything went wrong the script should show you "check your connections Something Wrong"

Step 2 [Write]:

You will need stock RL78 also check rl78flash, then after you connect your RL78 correctly run the script and go for step 2

Credits:

Special thanks to VVildCard777 - Fail0verflow - droogie - juansbeck -Zecoxao - M4j0r - SSL - msalau

Also special thanks to Abkarino for his always support

• NandAnalyzer for Saleae Logic via shuffle2

• AES Key Extraction in TSEC

Spoiler

 

[tungatung]

Will this also help in finding vulnerabilities in the system which could lead to jailbreak when worked upon.

 

[blimblim04]

Soon or later they are going to take over.

 

[Habte456]

What can we do with this new tool?

 

[Pardus79]

in other words, it's possible to downgrade ps4 firmware

 

[tungatung]

@Pardus79
are you guessing or you are sure ?

 

[PSXHAX]

Back when the SYSGLITCH_TEENSY4.0.hex / SYSGLITCH_TEENSY2.0++.hex / SYSGLITCH_DOWNGRADE.pdf were released last summer it was noted both heavy soldering and the foresight to backup everything first is required, which is why 'downgrading' (or the Firmware Reverting / Regression Method as some devs refer to it) is not recommended for most end-users.

Those new should carefully read through This Article from last year that contains links to the required hexcodes, diagrams, PDF guide and all the developer feedback in the 'Related Tweets' spoiler below the article.