Firmware revert/downgrade with Raspberry Pi Pico (partial guide, no teensy)
Got my hands on a 13.02 PS4. For reverting to the previous firmware, you need something to read/write into syscon and NOR chips. Did not want to spend any money to teensy. So i made a research and found out there is a tool made by 15432 (known from x360 scene) for dumping syscon with pi pico. Gave it a try and it worked perfectly. You can use 2 picos like me if you don't want to flash it again and undo the wiring multiple times.
The guide is not written extensively. Better to read it along with a video https://www.youtube.com/watch?v=7E1RGbFGzuw
Hardware requirements:
- Raspberry Pi Pico
- 200-500ohm resistor
- N-Channel MOSFET (With a low Vgs threshold (preferably < 2V) for pico to trigger it)
Software requirements:
- pico-serprog: SPI flashing firmware for pico to flash NOR
- ReneSos: (from 15432, u/pryiness) Pico firmware and PC software to read/write syscon
- Flashrom: PC software for flashing the NOR chip
- The link above is for the 1v.4 Windows build. It is better to use on linux, arch repo has the latest build
- PS4 Wee Tools: For patching the syscon and NOR
Steps
1. Unlocking/Dumping the syscon
- Go through the steps explained by the author: https://gbatemp.net/threads/ps4-exploit-guide.497858/page-1418#post-10818701
- Make sure to dump twice and compare them each other with MD5 hash or compare tool from ps4 wee tools
2. Dumping the NOR
- Flash the pico_serprog.uf2 file into the pico. Remove the syscon wiring
- Do the wiring for your motherboard. Mine was SAC-001 in the first picture. SCK, SI, SO, CS, VCC, GND is enough. No need for WP and RESET. You can find the soldering points on nor wiring section of modded warfare's video
- PS: i had no issues but WP# pin floating may cause problems. you can solder a 10k or high enough resistor to 3v3 to disable write protection the proper way
- Launch powershell/cmd within the same folder as flashrom and execute this command: (Replace COM5 with your respective pico port name, you can check on device manager)
./flashrom.exe -p serprog:dev=COM5 -r nordump.bin- It may take up around 10-15 minutes. Windows version does not have progress bar. On linux; you can add --progress parameter
- Do it again with changing nordump.bin into nordump2.bin or sth else and compare them both. If they are the same, you're good.
3. Installing recovery firmware on PS4
- Disconnect the pico from PC and remove VCC and GND wires from pico side.
- Go to safe mode and install the SAME OFW recovery firmware from USB.
4. Dump the NOR again
- Go through the same steps as 2 with different output file name
./flashrom.exe -p serprog:dev=COM5 -r nordump_update.bin
5. Legit CoreOS Patch
- On wee tools, select file browser(1) and select your first nor dump (nordump.bin).
- Select Legit CoreOS Patch
- Press y and select your second nor dump output from 4th step (nordump_update.bin)
- Press enter and go back. Now you have your patched dump in the same folder as first nor backup (nordump_legit_patch.bin)
6. SYSCON Patch
- On wee tools, select your syscon dump and select Auto SNVS patch. Choose the recommended method.
- Now you have your patched syscon file in the folder (syscondump_patch_A.bin).
7. Write the patched NOR
- Copy the patched NOR into the same folder as flashrom and execute this:
./flashrom.exe -p serprog:dev=COM5 -w nordump_update.bin- It takes longer than dumping because of the verification
8. Write the patched syscon
- Flash the relay.uf2 and do the syscon wiring again.
- You don't need the mosfet after you have unlocked the syscon chip in the first step. 3V3, GND, TOOL0, RESET wiring is enough. 2nd image for example
- Press ProgMode->CodeFlash->Write and select your patched syscon file (syscondump_patch_A.bin). Press yes if prompted for force debug in the future
9. Install the lower firmware
- Turn on the PS4 with safe mode. Select firmware update from usb, and it will ask you to update X.XX or higher; X.XX being the previous one
u/MinatoMuh — 11 days ago