Join Us and become a Member for a Verified Badge to access private areas with the latest PS4 PKGs.
PS4 CFW and Hacks       Thread starter PSXHAX       2,021       0      
Not open for further replies.


Staff Member
Following up on the PS4 Eye Camera Tools / PlayStation 4 USB Comm Dump and PS4EyeCam PS4 Camera PC Driver, today PlayStation 4 developer bigboss returns with more function names and details on reversing the PlayStation 4 DualEye camera below!

To quote: Reversing PlayStation 4 Camera

I have been working with PlayStation 4 Camera since 2013. So i want to share with you all the things learned since then.

First of all, if device has not a public/free driver , you need to make reverse engineering and you need to look for information about its chipset and make a research about it. So you need to open the device and look for information about its different chips. After making some research we can show the next high level design diagram.

PlayStation 4 Camera is using a proprietary connector called AUX, however it is a USB 3 cable so our first goal was to cut off the AUX connector and connect it to an USB3 male connector, after this we can connect directly to Mac/PC with USB3 female ports. Next step was to get an USB sniffer capture from PlayStation 4 with a beagle device in the middle, without this we could not have learnt about how to initialize the device and their different options.

Chips description:

It is an asic from Omnivision a typical custom USB bridge solution to manage all other chip. No information or datasheet about it without signing a NDA with Omnivision. Other companies using it are Mantis Vision and LeapMotion. I have worked with others Omnivision USB bridge solutions included in PlayStation EyeToy (OV519) and PlayStation Eye (OV534) so basically it is the same work i made with other drivers for Omnivision.

OV9713. Two cmos sensors well documented with full datasheet available in google.

AK5703. An analogical to digital converter connected with an microphone array (4). Datasheet is available. The datasheet was very helpfull to get audio properly from PlayStation 4 Camera.

4g51A. An eeprom chip. It contains the initial configuration for PlayStation 4 Camera.

When you connect device to a Mac/PC with USB3 it is in boot mode waiting for loading firmware. Analizing sniffer capture we got the firmware and steps needed to load it to device. So after loading firmware you have and special UVC Camera device and you can learn about their different streaming modes.

Interface 1 alt setting 0 describe all video modes with these possible options:
  • mode 0 fps 60(default), 30, 15, 8 video left and video right frames 1280x800
  • mode 1 fps 120(default), 60, 30, 15, 8 video left and video right frames 640x400
  • mode 2 fps 240(default), 120, 60, 30 video left and video right frames 320x192
OV580 is delivering in each mode:
  • mode 0 3448x2x808 bytes frame each row with:
header 32 bytes
audio 64 bytes
video left 1280x2 bytes
video right 1280x2 bytes
video interleave 840x2 bytes
  • mode 1 1748x2x408 bytes frame each row with:
header 32 bytes
audio 64 bytes
video left 640x2 bytes
video right 640x2 bytes
video interleave 420x2 bytes
  • mode 2 898x2x200 bytes frame each row with
header 32 bytes
audio 64 bytes
video left 320x2 bytes
video right 320x2 bytes
video interleave 210x2 bytes

Part of Header is showed in the next screenshot. Part of Audio is showed in the next screenshot.

Audio has 4 channel i use Audicity tool loading a 10 second capture a reproducing 4 audio channels with success. AK5703 datasheet was very helpful.

A screenshot from audicity tool. Videl Left and Right can be converted to RGB with CV_YUV2RGB_YUY2 conversion:
  • cv::Mat yuv(size_y,size_x,CV_8UC2 ,in);
  • cv::Mat rgb(size_y,size_x,CV_8UC3, out);
  • cv::cvtColor(yuv, rgb, CV_YUV2RGB_YUY2);
Video interleave it is also the same video format but it is making a mix of two sensor.

A sample application made using basic PS4EYECam driver showing a 640x400 mode for two PlayStation Cameras at the same time.

Low level usb stuff is implemented and available in my repository. EyeLab is a poc of multi camera application using PS4EYECam driver and it is not in the repository, you don't need to make changes in the driver to support multi cameras you need to do it at application level.

So after this i can say that PlayStation 4 Camera is full documented and it can be supported on other platforms. All information needed is here and in my repository.

PlayStation 4 receives frames with format explained here. I suppose that secondary processor makes all the job to parse frames (video and audio) and connect with image/audio libraries from *** (if someone want to share it with me you can contact with me :p). PlayStation 4 only has 1 AUX port so a multicam solution would be hard to implement like i am doing now in Osx.

From PlayStation 4 Camera driver function names and kernel offset from 5.05
cameraInitializeUtility  0000000000658340
cameraFinalizeUtility  00000000006583F0
utilSemaDestroy  0000000000658450
utilCondDestroy  0000000000658460
utilMalloc  0000000000658480
utilFree  00000000006584A0
utilGiantLock  00000000006584C0
utilGiantUnlock  00000000006584F0
utilEventLock  0000000000658520
utilEventUnlock  0000000000658550
utilSyncLock  0000000000658580
utilSyncUnlock  00000000006585B0
utilListLock  00000000006585E0
utilListUnlock  0000000000658610
utilGetSystemTime  0000000000658640
utilGetProcessTime  0000000000658690
utilGetProcessTimeOffset  00000000006586F0
utilGetDelta64  0000000000658780
utilConvertProcessTime  00000000006587A0
utilConvertProcessTimeByOffset  0000000000658840
utilThreadCreate  0000000000658850
utilKThreadCheckSuspend  00000000006588B0
utilKThreadSuspend  00000000006588F0
utilThreadSuspend  0000000000658900
utilThreadResume  0000000000658940
utilSemaInit  0000000000658980
utilSemaPost  00000000006589A0
utilSemaWait  00000000006589D0
utilSemaTimedWait  0000000000658A00
utilCondInit  0000000000658A60
utilCondWait  0000000000658A90
utilCondTimedWait  0000000000658AB0
utilListCondTimedWait  0000000000658B00
utilCondSignal  0000000000658B50
utilListCondSignal  0000000000658B70
utilCopyin  0000000000658B90
utilCopyout  0000000000658BE0
utilUSleep  0000000000658C30
utilUSleepWithPriority  0000000000658CA0
utilInitRegistry  0000000000658CE0
utilGetRegistry  0000000000658D20
utilSetRegistry  0000000000658E00
sceCameraCtrlTransfer  0000000000658F00
sceCameraDevConfigInit  0000000000659480
sceCameraDevSetup  0000000000659760
sceCameraGetDeviceConfig  0000000000659850
sceCameraDeviceDetach  0000000000659890
sceCameraDeviceAttach  00000000006598A0
sceCameraDevInitialize  0000000000659C70
sceCameraDevFinalize  0000000000659CA0
sceCameraDevOpen  0000000000659CB0
sceCameraDevClose  0000000000659E20
sceCameraDevIsSameConfig  0000000000659F20
sub_659FC0  0000000000659FC0
sceCameraDevSetResumeStatusByConfig  000000000065A0A0
sceCameraDevSetResumeStatusByAttribute  000000000065A200
sub_65A430  000000000065A430
sceCameraDevSetConfig  000000000065A460
sceCameraDevGetConfig  000000000065B900
sceCameraDevStart  000000000065B950
sceCameraDevStop  000000000065BAA0
sceCameraDevVideoSync  000000000065BB70
sceCameraDevKill  000000000065BDD0
sceCameraDevResumeAttribute  000000000065BF00
sceCameraDevResume  000000000065C4A0
sceCameraDevUpdateLed  000000000065C760
sceCameraGetDeviceFrameData  000000000065C7E0
sceCameraDevSetAttribute  000000000065CA60
sceCameraDevGetAttribute  000000000065CC60
sceCameraDevSetAttributeSingle  000000000065CCC0
sceCameraDevGetAttributeSingle  000000000065D7C0
sceCameraDevSetProcessFocus  000000000065DCB0
sceCameraDevSetForceActivate  000000000065DCD0
sub_65DCF0  000000000065DCF0
sub_65DD40  000000000065DD40
sceCameraDevGetConfigInfo  000000000065DD50
sceCameraDevSetConfigInfo  000000000065DE00
sceCameraDevSetExposureInfo  000000000065DEB0
sceCameraDevSetWhiteBalanceInfo  000000000065DF70
createBaseConfig  000000000065E030
sceCameraProcGetHandleList  000000000065E2A0
sceCameraProcGetConfig  000000000065E420
sub_65E430  000000000065E430
sceCameraProcConfigSetDevice  000000000065E640
sceCameraProcConfigInit  000000000065E940
sceCameraProcCreateHandle  000000000065EB30
sceCameraProcConfigRegister  000000000065EC20
sceCameraProcConfigUnregister  000000000065EFD0
sceCameraProcConfigOpen  000000000065F2F0
set_config  000000000065F3C0
sceCameraProcConfigSetConfig  000000000065F9E0
sceCameraProcConfigGetConfig  000000000065FAC0
sceCameraProcConfigStartPid  000000000065FB60
sceCameraProcConfigSetStartedPid  000000000065FC70
j_sceCameraProcConfigStartPid  000000000065FD00
sceCameraProcConfigStopPid  000000000065FD10
j_sceCameraProcConfigStopPid  000000000065FE80
sceCameraProcConfigVideoSync  000000000065FE90
sceCameraProcConfigGetVideoSync  000000000065FF60
sub_660010  0000000000660010
sub_660070  0000000000660070
sub_660210  0000000000660210
sceCameraProcConfigClosePid  00000000006602A0
sceCameraProcConfigClose  0000000000660320
sceCameraProcConfigEnd  00000000006603A0
sceCameraProcConfigGetFrameData  0000000000660590
sceCameraProcConfigAttribute  0000000000660610
sceCameraProcConfigIsActiveProcess  0000000000660680
sceCameraProcConfigGetAttribute  0000000000660700
sceCameraProcConfigSetAttribute  0000000000660760
sceCameraProcConfigSetActiveStatusPid  00000000006607C0
sceCameraProcConfigAreThereOtherProcesses  0000000000660820
sceCameraProcConfigIsStartedActivePid  00000000006608A0
sceCameraProcConfigIsStartedPid  00000000006608E0
sceCameraProcConfigIsStartedByPid  0000000000660900
sceCameraProcConfigIsStartedLed  00000000006609C0
sceCameraProcConfigStartedParse  0000000000660A80
sceCameraProcConfigSetProcSuspend  0000000000660BC0
sceCameraProcConfigGetProcSuspend  0000000000660BF0
sceCameraOVSetInitialize  0000000000660C20
sceCameraOVSetAcc  0000000000668090
sceCameraOVSetAudio  0000000000668340
audio_debug_info  0000000000669920
sceCameraOVSetup580  0000000000669D60
sceCameraOVCtrlLed  0000000000669EA0
sceCameraOvFrameRate  0000000000669FA0
sceCameraOVGetAWB  000000000066A070
sceCameraOVSetAWB  000000000066A0B0
sceCameraOVGetAECAGC  000000000066A270
sceCameraOVSetAECAGC  000000000066A2D0
sceCameraOVSetAECAGCTarget  000000000066A640
sceCameraOVGetDpcCtrl  000000000066A830
sceCameraOVSetDpcCtrl  000000000066A870
cameraSetISPOption  000000000066AB70
sceCameraOVGetLencCtrl  000000000066AEF0
sceCameraOVSetLencCtrl  000000000066AF30
sceCameraOVSetYuvTrackerISPCtrl  000000000066B230
sceCameraOVGetGammaCtrl  000000000066B3E0
sceCameraOVSetGammaCtrl  000000000066B420
sceCameraOVGetGamma  000000000066B660
sceCameraOVSetGamma  000000000066B690
sceCameraOVGetExpGain  000000000066CCD0
sceCameraOVSetExpGain  000000000066CD40
sceCameraOVGetWhiteBalance  000000000066D460
sceCameraOVSetWhiteBalance  000000000066D4D0
sceCameraOVGetSaturation  000000000066D7E0
sceCameraOVSetSaturation  000000000066D810
sceCameraOVGetHue  000000000066D9C0
sceCameraOVSetHue  000000000066D9F0
sceCameraOVGetContrast  000000000066DC70
sceCameraOVSetContrast  000000000066DCA0
sceCameraOVSetDenoise  000000000066DE20
sceCameraOVGetSharpness  000000000066F660
sceCameraOVSetSharpness  000000000066F690
sceCameraOVGetAttribute  00000000006700E0
sceCameraOVSetAttribute  0000000000670270
sceCameraOVSetAttributeForce  00000000006708F0
sceCameraOVSetflipMirror  0000000000670EF0
luke_write_transfer  00000000006711C0
usb_ctrl_xfer_for_kmod  0000000000671290
luke_write_transfer_request  00000000006719A0
luke_write_transfer_wait  0000000000671A20
luke_write_transfer_exec  0000000000671B30
sceCameraSetMultiWriteRegister  0000000000671C80
sceCameraExecMultiWriteRegister  0000000000671E40
sceCameraReadRegister  0000000000671F10
camera_driver_modevent  0000000000672120
sceCameraDriverThread  0000000000672470
sceCameraProcessIsDataThread  0000000000674A70
camera_process_exec  0000000000677AD0
camera_process_exit  0000000000677AE0
camera_process_resume_phase0  0000000000677BF0
camera_process_suspend_phase0  0000000000677DD0
camera_system_suspend_phase2_pre_sync  0000000000677F80
camera_system_resume_phase2  0000000000678050
sub_6780F0  00000000006780F0
sub_678160  0000000000678160
sub_6782D0  00000000006782D0
sub_6782E0  00000000006782E0
cameraIsoStart  0000000000678370
cameraSetMirror  00000000006784B0
sub_6785E0  00000000006785E0
luke_open  00000000006786C0
luke_close  0000000000678810
luke_read  0000000000678880
luke_write  00000000006789F0
luke_ioctl  0000000000678F90
luke_mmap  000000000067B330
luke_kqfilter  000000000067B430
luke_dtor  000000000067B4D0
sub_67B580  000000000067B580
sub_67B640  000000000067B640
sub_67BDF0  000000000067BDF0
luke_filt_detach  000000000067BEF0
luke_filt_event  000000000067C000
sceCameraMultiReadRegister  000000000067C020
camera_resume  000000000067C340
sub_67CAD0  000000000067CAD0
sub_67CE10  000000000067CE10
sub_67D300  000000000067D300
luke_probe  000000000067D3D0
luke_attach  000000000067D4A0
luke_detach  000000000067DB00
sub_67DDE0  000000000067DDE0
luke_ctl_cb  000000000067E040
Not open for further replies.