{"id":27200844,"url":"https://github.com/betterwayelectronics/sce-syscon-writer-guide","last_synced_at":"2025-07-01T00:07:13.522Z","repository":{"id":64697855,"uuid":"577562211","full_name":"BetterWayElectronics/sce-syscon-writer-guide","owner":"BetterWayElectronics","description":" Guide to writing and dumping the original PS4 Syscon (Renesas R78) - Improved methodology, requires no desoldering of Syscon. Proprietary.","archived":false,"fork":false,"pushed_at":"2023-08-29T05:43:47.000Z","size":169,"stargazers_count":24,"open_issues_count":0,"forks_count":2,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-04-09T21:47:29.699Z","etag":null,"topics":["arduino","bwe","glitching","ps4","ps4-downgrade","ps4-exploit","ps4-jailbreak","ps4exploit","ps4xploit","rl78","shellcode","syscon"],"latest_commit_sha":null,"homepage":"https://betterwayelectronics.com.au/sce_syscon.html","language":null,"has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/BetterWayElectronics.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-12-13T02:25:21.000Z","updated_at":"2025-01-14T21:04:38.000Z","dependencies_parsed_at":"2025-04-09T21:45:27.035Z","dependency_job_id":"22ceadf1-8942-4491-a82d-df569226f682","html_url":"https://github.com/BetterWayElectronics/sce-syscon-writer-guide","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/BetterWayElectronics/sce-syscon-writer-guide","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BetterWayElectronics%2Fsce-syscon-writer-guide","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BetterWayElectronics%2Fsce-syscon-writer-guide/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BetterWayElectronics%2Fsce-syscon-writer-guide/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BetterWayElectronics%2Fsce-syscon-writer-guide/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/BetterWayElectronics","download_url":"https://codeload.github.com/BetterWayElectronics/sce-syscon-writer-guide/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BetterWayElectronics%2Fsce-syscon-writer-guide/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":262870872,"owners_count":23377312,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["arduino","bwe","glitching","ps4","ps4-downgrade","ps4-exploit","ps4-jailbreak","ps4exploit","ps4xploit","rl78","shellcode","syscon"],"created_at":"2025-04-09T21:45:22.370Z","updated_at":"2025-07-01T00:07:13.359Z","avatar_url":"https://github.com/BetterWayElectronics.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"\n\u003ch2\u003eSyscon Guide - SCE Syscon Method\u003c/h2\u003e\n\u003cb\u003eLast Updated 26/6/23\u003c/b\u003e\n\u003cbr\u003e\u003cbr\u003e\n\u003cli\u003e\u003cb\u003eWhat is this?\u003c/b\u003e This is a tool to read and write your PS4's Syscon on-board (and off-board) without the need to replace it with a blank (the now considered 'old way').\n\u003cli\u003e\u003cb\u003eWhy do I need this?\u003c/b\u003e Modifying the Syscon allows for downgrading (via CoreOS swap), repairing of loadBios -8 type errors and enables service mode.\n\u003cli\u003e\u003cb\u003eWhy isn't this free?\u003c/b\u003e This uses a proprietary and unreleased exploit on the R78 chip. It must be pre-flashed and locked on a fresh Arduino. The target market are repariers, hence the price.\n\u003cli\u003e\u003cb\u003eIs there a cheaper way?\u003c/b\u003e Yes, it requires replacing Sony's Syscon with blank RL78 chips. If its cheap/free you get what you pay for!\n\u003cli\u003e\u003cb\u003eIs this difficult to install?\u003c/b\u003e You have to solder 1 lifted wire to the Syscon whilst on-board and 3 others to alternative points. Once glitched you drop that pin and keep rest of the alternative points on the board.\n\u003cli\u003e\u003cb\u003eAny discounts?\u003c/b\u003e If you buy in bulk, yes.\n\u003cli\u003e\u003cb\u003eDo you need a backup of the previous version syscon?\u003c/b\u003e No you don't need a backup of anything to do this downgrade process, you are switching slots!\n\n\u003cli\u003e\u003cb\u003eCan I go from 10.50 to 9.00?\u003c/b\u003e Only if 9.00 was your PREVIOUS firmware.\n\u003cli\u003e\u003cb\u003eCan I go from 10.01 to 9.00?\u003c/b\u003e Only if 9.00 was your PREVIOUS firmware.\n\u003cli\u003e\u003cb\u003eCan I go from 9.50 to 9.00?\u003c/b\u003e Only if 9.00 was your PREVIOUS firmware.\n\u003cli\u003e\u003cb\u003eCan I go from 9.00 to 5.50?\u003c/b\u003e Only if 5.50 was your PREVIOUS firmware.\n\u003cli\u003e\u003cb\u003eWhich firmware will I go back to?\u003c/b\u003e Whichever was your PREVIOUS firmware.\n\n\u003c/li\u003e\n\n\n\u003ch3\u003eVideo Guides\u003c/h3\u003e\n\u003ca href=\"https://www.youtube.com/watch?v=hcmMSYmwSUQ/\" class=\"thumbnail-container\"\u003e\n    \u003cimg src=\"https://i.ytimg.com/vi/hcmMSYmwSUQ/hqdefault.jpg\" alt=\"Video thumbnail\" width=\"320\" height=\"180\"\u003e\n    \u003cdiv class=\"thumbnail-text\"\u003eEnglish\u003c/div\u003e\n\u003c/a\u003e\n\u003ca href=\"https://www.youtube.com/watch?v=q1F0AL3ttjY/\" class=\"thumbnail-container\"\u003e\n    \u003cimg src=\"https://i.ytimg.com/vi/q1F0AL3ttjY/hqdefault.jpg\" alt=\"Video thumbnail\" width=\"320\" height=\"180\"\u003e\n    \u003cdiv class=\"thumbnail-text\"\u003ePortuguese\u003c/div\u003e\n\u003c/a\u003e\n\u003ca href=\"https://www.youtube.com/watch?v=W7RpkG5hiA0/\" class=\"thumbnail-container\"\u003e\n    \u003cimg src=\"https://i.ytimg.com/vi/W7RpkG5hiA0/hqdefault.jpg\" alt=\"Video thumbnail\" width=\"320\" height=\"180\"\u003e\n    \u003cdiv class=\"thumbnail-text\"\u003eHindi/Urdo\u003c/div\u003e\n\u003c/a\u003e\n\n\n\n\u003ch3\u003eShopping List\u003c/h3\u003e\n\t\u003cli\u003e\u003ca href=\"https://betterwayelectronics.com.au/bweps4sysconwriter\"\u003e\u003cb\u003eBwE PS4 Syscon Writer\u003c/b\u003e\u003c/a\u003e\n\t\u003cli\u003e\u003ca href=\"https://betterwayelectronics.com.au/downloads/BwE_PS4_Syscon_Software.rar\"\u003eBwE PS4 Syscon Software (Reader \u0026 Writer) (Free w/ Writer)\u003c/a\u003e\n\t\u003cli\u003e\u003ca href=\"https://betterwayelectronics.com.au/downloads/BwE_PS4_NOR_Validator.rar\"\u003eBwE PS4 NOR Validator\u003c/a\u003e\n\u003c/li\u003e\n\u003cbr\u003e\n\u003cb\u003eOptional:\u003c/b\u003e\n\t\u003cli\u003e\u003ca href=\"https://www.aliexpress.com/item/1005001437032289.html\"\u003eMulti LQFP (64-100) to DIP Board ($4AUD)\u003c/a\u003e\n\t\u003cli\u003e\u003ca href=\"https://www.aliexpress.com/item/1005002888994993.html\"\u003eLQFP64 to DIP Board ($4AUD)\u003c/a\u003e\n\t\u003cli\u003e\u003ca href=\"https://www.aliexpress.com/item/1762279813.html\"\u003eLQFP64 Socket Adapter ($45AUD)\u003c/a\u003e\n\t\u003cli\u003e\u003ca href=\"https://www.aliexpress.com/item/1005003352270633.html\"\u003eLQFP100 Socket Adapter ($45AUD\u003c/a\u003e\n\u003c/li\u003e\n\u003cbr\u003e\n\u003cb\u003eSoldering, Whats That?:\u003c/b\u003e\n  \u003cli\u003e\u003ca href=\"https://www.aliexpress.com/item/4001063621549.html\"\u003eT12-942 QUICKO Soldering Station (SET 5) ($58AUD)\u003c/a\u003e\u003c/li\u003e\n  \u003cli\u003e\u003ca href=\"https://www.aliexpress.com/item/1005004623323483.html\"\u003eDC24v 6A Adapter for Soldering Station ($28AUD)\u003c/a\u003e\u003c/li\u003e\n  \u003cli\u003e\u003ca href=\"https://www.aliexpress.com/item/32948598235.html\"\u003eFake Amtech Flux ($7AUD)\u003c/a\u003e\u003c/li\u003e\n  \u003cli\u003e\u003ca href=\"https://www.aliexpress.com/item/1005004532993074.html\"\u003eLead Solder Low-ish Melt ($3AUD)\u003c/a\u003e\u003c/li\u003e\n  \u003cli\u003e\u003ca href=\"https://www.aliexpress.com/item/33022639575.html\"\u003eSolder Wick ($1AUD)\u003c/a\u003e\u003c/li\u003e\n  \u003cli\u003e\u003ca href=\"https://www.aliexpress.com/item/1005003102463009.html\"\u003eLove Heart Tweezers ($7AUD)\u003c/a\u003e\u003c/li\u003e\n  \u003cli\u003e\u003ca href=\"https://www.aliexpress.com/item/4000315816666.html\"\u003e32-34AWG Cable 10m ($4.50AUD)\u003c/a\u003e\u003c/li\u003e\n\u003c/li\u003e\n\n\u003ch3\u003ePurchase Links:\u003c/h3\u003e\n\t\u003cdiv style=\"font-size: 18px; display: flex; flex-wrap: wrap;\"\u003e\n\t\t\u003cdiv style=\"width: 340px; padding: 10px;\"\u003e\n\n\n\u003ca href=\"https://buy.stripe.com/cN29DA6aN2tweHK8xj\"\u003e\n\t\u003cimg src=\"https://i.imgur.com/kVXxlqH.jpeg\" width=\"40%\" height=\"40%\"\u003e\n\u003c/a\u003e\n\u003cbr\u003e\n\u003ca href=\"https://buy.stripe.com/cN29DA6aN2tweHK8xj\"\u003e\u003cb\u003eSyscon Writer Black Edition\u003cspan style=\"color:green\"\u003e (New Release!)\u003c/span\u003e\u003c/b\u003e\u003c/a\u003e\n\u003cbr\u003eVoltage Switch, UART Mode, Faster Processor, Fully Integrated Design. Warranty!\n\u003cbr\u003e\u003cs\u003e$385AUD (233Euro, $252USD)\u003c/s\u003e\n\u003cbr\u003e\u003cb\u003e$300AUD (177Euro, $192USD, 1406RMB)\u003c/b\u003e\n\n\u003c/div\u003e\n\t\t\n\n\u003cbr\u003e\u003cb\u003eNote: All Syscon Writers Come With HWID Locked \u003ca href=\"#software\"\u003eSyscon Writer \u0026 Reader Software\u003c/a\u003e For Free!\u003c/b\u003e\u003cbr\u003e(Available with USB License for Multi-PC Use)\n\u003cbr\u003e\n\n\n\n\u003ch3\u003eCompatibilitiy\u003c/h3\u003e\n\u003cimg src=\"https://i.imgur.com/4fpFJvI.jpg\" width=\"50%\" height=\"50%\"\u003e\u003cbr\u003e\nDo you have the Syscon on the right? You're outta luck. The glitch only works on Renesas RL78 chips. The guide ends here.\u003cbr\u003e\n\u003cb\u003eThe chip MUST have A0#-COL or A0#-COL2 where the # is a number.\u003c/b\u003e\n\n\u003ch3\u003eSyscon Pinout\u003c/h3\u003e\n\n\u003cdiv style=\"display: flex;\"\u003e\n  \u003cdiv style=\"width: 420px; padding: 10px;\"\u003e\n    \u003cimg src=\"https://i.imgur.com/UnGh1ne.png\" width=\"40%\" height=\"40%\"\u003e\n    \u003cbr\u003e\u003cb\u003eFAT Syscon\u003c/b\u003e\n  \u003c/div\u003e\n  \u003cdiv style=\"width: 420px; padding: 10px;\"\u003e\n      \u003cimg src=\"https://i.imgur.com/mzsNJHP.png\" width=\"40%\" height=\"40%\"\u003e\n    \u003cbr\u003e\u003cb\u003eSlim/Pro Syscon\u003c/b\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\n\u003cbr\u003e\n\n\u003cimg src=\"https://i.imgur.com/frGD9v1.jpeg\" width=\"90%\" height=\"90%\"\u003e\n\u003cbr\u003e\u003cb\u003eConnection Points\u003c/b\u003e\n\n\n\u003cbr\u003e\u003cbr\u003e\n\u003cb\u003eDumping On-Board\u003c/b\u003e\u003cbr\u003e\n\u003cli\u003eIf you are dumping on board, \u003cb\u003elift pin 15 (Pro) or pin 22 (Fat)\u003c/b\u003e. To do this add flux and low melt solder to the pins and let it soak in.\n\u003cli\u003eUse tweezers and a thin tip and while applying heat to the pin push from behind with the tweezers until the pin is lifted.\n\u003cli\u003eWire pin 5 and 6 flat against the resistors, directly to the pins or the alternative solder points. Following best practice.\n\u003cli\u003eYou do not have to wire pin 16 as you can have the console on standby mode.\n\u003cbr\u003e\u003cbr\u003e\n\u003cb\u003eDumping Off-Board\u003c/b\u003e\u003cbr\u003e\n\u003cli\u003eTo remove the Syscon chip entirely, apply flux to all of the pins and flood them with low melt solder (chipquik if not using hot air).\n\u003cli\u003eApply 480c at 40% pressure from a height of approximately 15cm until the solder is visibly liquidous on all sides.\n\u003cli\u003ePull up the chip with an SMD vacuum pen.\n\u003cli\u003eTin the pads on the PS4 with low melt solder.\n\u003cli\u003eClean pins 1-16 on the Syscon of any solder bridges and solder to pre-tinned breakout board (or place into DIP socket).\n\u003cbr\u003e\u003cbr\u003e\n\u003cli\u003eWhen reattaching the Syscon first apply a light layer of flux on the already tinned pads.\n\u003cli\u003eLine up Syscon appropriately or solder each corner manually to ensure the chip does not move during reflow.\n\u003cli\u003eApply 480c at 40% pressure from a height of approximately 20cm and slowly drop until you see flux bubble/move and solder shine/glimmer.\n\u003cli\u003eIf you do not want to use hot air, use drag soldering technique or manually solder each pin individually with thin tip tinned with low melt solder.\n\u003cbr\u003e\n\u003cbr\u003eNote: When reading/writing Syscon on-board (\u003cb\u003eafter patching\u003c/b\u003e) wire only pin 5, 6 and ground either directly to the chip or alternative points and have the console on standby.\n\n\u003c/li\u003e\n\u003cdiv style=\"display: flex;\"\u003e\n\n  \u003cdiv style=\"width: 380px; padding: 10px;\"\u003e\n    \u003cimg src=\"https://i.imgur.com/Pkq9Oha.jpg\" width=\"750px\" height=\"650px\"\u003e\n    \u003cbr\u003e\u003cb\u003eDumping on-board example\u003c/b\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\n\n\u003ch4\u003eBest Practice\u003c/h4\u003e\n\u003cdiv style=\"display: flex;\"\u003e\n  \u003cdiv style=\"width: 320px; padding: 10px;\"\u003e\n    \u003cimg src=\"https://i.imgur.com/pjizFZc.png\" width=\"300px\" height=\"200px\"\u003e\n    \u003cbr\u003e\u003cb\u003eSolder the jumper wires flat against the legs.\u003c/b\u003e\n  \u003c/div\u003e\n  \u003cdiv style=\"width: 320px; padding: 10px;\"\u003e\n    \u003cimg src=\"https://i.imgur.com/wm4PrwP.png\" width=\"300px\" height=\"200px\"\u003e\n    \u003cbr\u003e\u003cb\u003eThe entire jumper wire must fill the entire pad.\u003c/b\u003e\n  \u003c/div\u003e\n  \u003cdiv style=\"width: 320px; padding: 10px;\"\u003e\n    \u003cimg src=\"https://i.imgur.com/nXx3oep.png\" width=\"300px\" height=\"200px\"\u003e\n    \u003cbr\u003e\u003cb\u003eThe wire must be parallel to the component termination.\u003c/b\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\n\n\u003ch3\u003eReading Syscon (Currently ONLY works on A0#-COL/2 chips):\u003c/h3\u003e\n\u003cimg src=\"https://i.imgur.com/zV8EvTU.png\" width=\"55%\" height=\"55%\"\u003e\n\n  \u003cli\u003eConnect from your Arduino to the Syscon Chip (See Wiring To Syscon Below)\n  \u003cli\u003eLaunch BwE_PS4_Syscon_Reader.exe, it will auto detect your COM port or prompt you for one.\n  \u003cli\u003eIt will glitch the chip (if this is your first read and you have not enabled OCD mode) and then dump!\n  \u003cli\u003eIt will then re-dump and compare in order to validate them.\n  \u003c/li\u003e\n  \u003cbr\u003eIf the dumps do not match change resistors (100ohm, 510ohm, 1kohm).\n  \u003cbr\u003eIf it does not even dump check your connections (seriously) or change your Optocoupler.\n\n\u003ch3\u003ePatching Syscon Dump:\u003c/h3\u003e\n\u003cimg src=\"https://i.imgur.com/TqBuRXV.png\" width=\"45%\" height=\"45%\"\u003e\n\n\u003col\u003e\n  \u003cli\u003eRun BwE PS4 NOR Validator\n  \u003cli\u003eSelect Option 2 - Scan \u0026 Patch PS4 Syscon\n  \u003cli\u003eSyscon will scan for a patchable slot, if there is one available it will say at the bottom in \"Final Results\".\n  \u003cli\u003eIf it says \"Active Slot Patchable\" select Option 1 \"Auto Patch\"\n  \u003cli\u003eIf it says \"Unable to Auto-Patch\" it will prompt you to Manually Patch - If so you must select an earlier 080B (Use Verbose Mode) to overwrite the last 080B.\n  \u003cli\u003eIf it says \"Syscon NOT Patchable\" then call it quits, game over. Your PS4 has either had its initialisation overwritten or some other historical event is blocking the patch.\n  \u003cli\u003eAny other errors you can likely fix by \u003ca href=\"https://betterwayelectronics.com.au/#sysconrebuilder\"\u003erebuilding\u003c/a\u003e the Syscon\u003c/li\u003e\n\n  \u003cli\u003eApply the patch!\n  \u003cli\u003eIt will show you what you are overwriting (and potentially the data you are overwriting it with).\n  \u003cli\u003eFile will be saved as \"???_080B_patched.bin\" - Keep this and the original, label it appropriately and store it!\n\u003c/ol\u003e\n\n\n\u003ch3\u003eProgramming SCE Syscon:\u003c/h3\u003e\n\u003cimg src=\"https://i.imgur.com/TyqZ3wU.png\" width=\"85%\" height=\"85%\"\u003e\n\u003col\u003e\n  \u003cli\u003eConnect from your Arduino to the Syscon Chip (\u003cb\u003elift pin 15 and 16 (Pro) or pin 22 and 23 (Fat)if writing on board\u003c/b\u003e).\n  \u003cli\u003eLaunch BwE_PS4_Syscon_Writer.exe it will auto detect your COM port or prompt you for one.\n  \u003cli\u003eSelect OCD mode for your first write only (option 3), this will disable the need to lift pins ever again! \n  \u003cli\u003eWrite the patched dump (or original if you only want to enable OCD mode) \n  \u003cli\u003eIf you selected confirm it will check the dump was written correctly - If there was an error, restart the Arduino and run full and OCD mode (regardless if you have done it before or not).\n  \u003cli\u003e\u003cb\u003eDo NOT boot the console with patched syscon until you have ALSO patched the NOR\u003c/b\u003e. Doing so is only useful for seeing what the previous version is - only do this with NOR backup also.\u003c/b\u003e\n      \u003c/ol\u003e\n  \u003c/li\u003e\n  \u003cb\u003eNotes:\u003c/b\u003e\u003cbr\u003e\n  You now only need to connect Pins 5, 6 and GND to the Syscon directly or to the alternative points for all future reads and writes!\n  \u003cbr\u003e\n  You can only write with the supplied Arduino, TTL will not function nor will Renesas Software.\u003cbr\u003e\n  \u003cb\u003eAll future writes do not require full or OCD commands (this will make it only write to 0x60000+)\u003c/b\u003e, but I highly suggest adding confirm to validate the write.\n\n\u003ch3\u003eReading \u0026 Writing NOR:\u003c/h3\u003e\n\n\u003cli\u003eDump the NOR using SPIWay (illustrated below) or through a CH341A or something faster like the XGECU (illustrated below).\n\u003cli\u003eYou can either solder directly to the pins, their resistors/pads and dump/flash on-board (\u003cb\u003e@ ~3.0v Only\u003c/b\u003e) or remove the chip entirely, I highly recommend just removing the chip entirely.\n\u003cli\u003eYou can also follow \u003ca href=\"https://repair.wiki/w/PS4_UART_Guide\"\u003ethis guide\u003c/a\u003e on the Repair Wiki in which I illustrate the process behind enabling UART (\u003cb\u003eI recommend you do this\u003c/b\u003e).\n\u003cbr\u003e\u003cbr\u003e\n\u003cimg src=\"https://i.imgur.com/6fbidS0.jpg\" width=\"50%\" height=\"50%\"\u003e\n\u003cbr\u003e\u003cb\u003eXGECU\u003c/b\u003e\u003cbr\u003e\n\u003cimg src=\"https://i.imgur.com/FJdxQpj.jpg\" width=\"50%\" height=\"50%\"\u003e\n\u003cbr\u003e\u003cb\u003eCH341A (Modified for 2.8v)\u003c/b\u003e\u003cbr\u003e\n\n\u003cimg src=\"https://i.imgur.com/8t7iBVp.png\" width=\"45%\" height=\"45%\"\u003e\n\u003cbr\u003e\u003cb\u003eTeensy (SPIWay)\u003c/b\u003e\u003cbr\u003e\n\u003cbr\u003e\u003cbr\u003e\n\n\u003ctable border=\"#999\" cellspacing=\"0\" cellpadding=\"5\" class=\"wikitable\" style=\"border:1px solid #999; border-collapse: collapse;\"\u003e\n\n\u003ctbody\u003e\u003ctr bgcolor=\"#cccccc\"\u003e\n\u003cth\u003e8-Pin\u003c/th\u003e\n\u003cth\u003e16-pin\u003c/th\u003e\n\u003cth\u003eUsage\u003c/th\u003e\n\u003cth\u003eTeensy++ 2.0\u003cbr /\u003eSPIway\u003c/th\u003e\n\u003cth\u003eDescription\n\u003c/th\u003e\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e-\u003c/td\u003e\n\u003ctd\u003e1\u003c/td\u003e\n\u003ctd\u003eSIO3\u003c/td\u003e\n\u003ctd\u003eB5\u003c/td\u003e\n\u003ctd\u003e8pin: Not Available - not used / 16pin: Serial Data Input \u0026amp; Output (for 4xI/O read mode)\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e8\u003c/td\u003e\n\u003ctd\u003e2\u003c/td\u003e\n\u003ctd\u003eVCC\u003c/td\u003e\n\u003ctd\u003e+5V pad\u003c/td\u003e\n\u003ctd\u003e+3V DC Power Supply\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e7\u003c/td\u003e\n\u003ctd\u003e3\u003c/td\u003e\n\u003ctd\u003eHOLD#/RESET#\u003c/td\u003e\n\u003ctd\u003eB6\u003c/td\u003e\n\u003ctd\u003e8pin: Hold, to pause the device without deselecting the device / 16pin: Hardware Reset Pin Active low\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e-\u003c/td\u003e\n\u003ctd\u003e4\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNC\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNC\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNo Connection\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e-\u003c/td\u003e\n\u003ctd\u003e5\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNC\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNC\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNo Connection\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e-\u003c/td\u003e\n\u003ctd\u003e6\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNC\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNC\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNo Connection\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e1\u003c/td\u003e\n\u003ctd\u003e7\u003c/td\u003e\n\u003ctd\u003eCS#\u003c/td\u003e\n\u003ctd\u003eB0\u003c/td\u003e\n\u003ctd\u003eChip Select\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e2\u003c/td\u003e\n\u003ctd\u003e8\u003c/td\u003e\n\u003ctd\u003eSO/SIO1\u003c/td\u003e\n\u003ctd\u003eB3\u003c/td\u003e\n\u003ctd\u003eSerial Data Output (for 1 x I/O) or Serial Data Input \u0026amp; Output (for 2x I/O or 4x I/O read mode)\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e3\u003c/td\u003e\n\u003ctd\u003e9\u003c/td\u003e\n\u003ctd\u003eWP#/SIO2\u003c/td\u003e\n\u003ctd\u003eB4\u003c/td\u003e\n\u003ctd\u003eWrite Protection: connect to GND or Serial Data Input \u0026amp; Output (for 4x I/O read mode)\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e4\u003c/td\u003e\n\u003ctd\u003e10\u003c/td\u003e\n\u003ctd\u003eGND\u003c/td\u003e\n\u003ctd\u003eGND\u003c/td\u003e\n\u003ctd\u003eGround\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e-\u003c/td\u003e\n\u003ctd\u003e11\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNC\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNC\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNo Connection\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e-\u003c/td\u003e\n\u003ctd\u003e12\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNC\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNC\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNo Connection\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e-\u003c/td\u003e\n\u003ctd\u003e13\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNC\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNC\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNo Connection\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e-\u003c/td\u003e\n\u003ctd\u003e14\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNC\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNC\u003c/td\u003e\n\u003ctd style=\"color:white; background-color:darkgrey;\"\u003eNo Connection\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e5\u003c/td\u003e\n\u003ctd\u003e15\u003c/td\u003e\n\u003ctd\u003eSI/SIO0\u003c/td\u003e\n\u003ctd\u003eB2\u003c/td\u003e\n\u003ctd\u003eSerial Data Input (for 1 x I/O) or Serial Data Input \u0026amp; Output (for 2x I/O or 4x I/O read mode)\n\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e6\u003c/td\u003e\n\u003ctd\u003e16\u003c/td\u003e\n\u003ctd\u003eSCLK\u003c/td\u003e\n\u003ctd\u003eB1\u003c/td\u003e\n\u003ctd\u003eClock Input\n\u003c/td\u003e\u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e\n\n\u003cbr\u003e\n\u003cdiv style=\"display: flex;\"\u003e\n  \u003cdiv style=\"width: 320px; padding: 10px;\"\u003e\n    \u003cimg src=\"https://www.psdevwiki.com/ps4/images/thumb/f/fa/MX25L1006E_Pinout.png/800px-MX25L1006E_Pinout.png\" width=\"30%\" height=\"30%\"\u003e\n    \u003cbr\u003e\u003cb\u003e8 Pin WSON8 - Pro \u0026 Slim\u003c/b\u003e\n  \u003c/div\u003e\n  \u003cdiv style=\"width: 320px; padding: 10px;\"\u003e\n    \u003cimg src=\"https://www.psdevwiki.com/ps4/images/thumb/c/cd/MX25L25635FMI-10G_Pinout.png/800px-MX25L25635FMI-10G_Pinout.png\" width=\"30%\" height=\"30%\"\u003e\n    \u003cbr\u003e\u003cb\u003e16 Pin SOP16 - Fat\u003c/b\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\n\u003cbr\u003e\n\u003cdiv style=\"display: flex;\"\u003e\n  \u003cdiv style=\"width: 320px; padding: 10px;\"\u003e\n    \u003cimg src=\"https://i.imgur.com/cI0WcwT.jpeg\" width=\"40%\" height=\"40%\"\u003e\n    \u003cbr\u003e\u003cb\u003eHardwiring Example\u003c/b\u003e\n  \u003c/div\u003e\n  \u003cdiv style=\"width: 320px; padding: 10px;\"\u003e\n    \u003cimg src=\"https://i.imgur.com/wPHOhBY.jpeg\" width=\"40%\" height=\"40%\"\u003e\n    \u003cbr\u003e\u003cb\u003eNon-Invasive Method\u003c/b\u003e\n  \u003c/div\u003e\n    \u003cdiv style=\"width: 320px; padding: 10px;\"\u003e\n    \u003cimg src=\"https://i.imgur.com/wtgghfk.jpeg\" width=\"40%\" height=\"40%\"\u003e\n    \u003cbr\u003e\u003cb\u003e2.8v CH341A Mod\u003c/b\u003e\n  \u003c/div\u003e\n   \u003cdiv style=\"width: 320px; padding: 10px;\"\u003e\n    \u003cimg src=\"https://i.imgur.com/V06INO1.png\" width=\"40%\" height=\"40%\"\u003e\n    \u003cbr\u003e\u003cb\u003e2.8v CH341A Mod\u003c/b\u003e\n  \u003c/div\u003e\n\u003c/div\u003e\n\n\n\u003ch3\u003ePatching NOR Dump:\u003c/h3\u003e\n\u003cimg src=\"https://i.imgur.com/2cJJk4C.png\" width=\"55%\" height=\"55%\"\u003e\n\u003col\u003e\n  \u003cli\u003eRun BwE PS4 NOR Validator\u003c/li\u003e\n  \u003cli\u003eSelect Option 1 \"Validate or Patch PS4 NOR\"\u003c/li\u003e\n  \u003cli\u003eSelect your NOR file\u003c/li\u003e\n  \u003cli\u003eSelect Option 10 or 11 \"Validate\" and patch for UART when prompted\u003c/li\u003e\n  \u003cli\u003eIf your NOR is \u003cb\u003evalid\u003c/b\u003e go back and select Option 5 \"Patch CoreOS \u0026 Southbridge (LoadBios Repair \u0026 Downgrading)\"\u003c/li\u003e\n  \u003cli\u003e\u003cb\u003eRead the warnings!\u003c/b\u003e\u003c/li\u003e\n  \u003cli\u003eSelect Option 1 \"Auto Generate CoreOS Header \u0026 UART Patches\"\u003c/li\u003e\n  \u003cli\u003eNOR will be saved as \"?_coreos-uart-patched_*.bin\" 14 times!\u003c/li\u003e\n  \u003cli\u003eApply each patch in sequence (without patching Syscon) and read the UART logs (See Final Step).\n  \u003cli\u003eWhen the correct patch has been found, then you can patch the syscon! Downgrade will be complete (See Final Step).\n\n\u003c/ol\u003e\n\n\n\u003ch3\u003eFinal Step - LoadBios Repair / Downgrade:\u003c/h3\u003e\n\n\u003cb\u003eThere are \u003cb\u003ethree\u003c/b\u003e methods, pick whichever suits you! The third is the quickest, but not as tested as the others\u003c/b\u003e\n\u003cbr\u003e\u003cbr\u003e\n\u003cb\u003eOfficial Method:\u003c/b\u003e\u003cbr\u003e\n\u003cli\u003ePatch the UART patched NOR with the CoreOS patch\n\u003cli\u003eBoot console and read UART log\n\u003cli\u003eIf UART log says \"checkUpdVersion 0xffffffff != 0x(Lower Firmware)\" \u003cb\u003eand\u003c/b\u003e has a lower Secure Loader firmware...\n\u003cli\u003eYou can then write the Syscon patch to the console\n\u003cli\u003eIf not, try another patch and repeat the process (you must try ALL patches)\n\u003cli\u003eOn success the console will boot to safe mode and prompt to install lower firmware (recovery).\n\u003cbr\u003e\u003cbr\u003e\n\u003cb\u003eLazy Method (No UART Needed)\u003c/b\u003e\u003cbr\u003e\n\u003cli\u003ePatch the NOR with CoreOS patch\n\u003cli\u003eWrite the Syscon patch to the console\n\u003cli\u003eIf the console does not boot...\n\u003cli\u003eRepeat first two steps, pick a new Patch for NOR (you must try ALL patches) and re-use the same patch for Syscon.\n\u003cli\u003eOn success the console will boot to safe mode and prompt to install lower firmware (recovery).\n\u003cbr\u003e\u003cbr\u003e\n\u003cb\u003eNew Method (Legitimate CoreOS Patch)\u003c/b\u003e\u003cbr\u003e\n\u003cli\u003eDump NOR \u0026 Syscon (keep, do not delete)\n\u003cli\u003eUpdate Console to \u003cb\u003eSAME\u003c/b\u003e firmware (if 9.03, install 9.03 again etc) via safemode\n\u003cli\u003eDump NOR again after update but rename and add '_updated_coreos' to the end of the file name (Example: nor1.bin is now nor1_updated_coreos.bin)\n\u003cli\u003eRun NOR Validator and select the \u003cb\u003efirst\u003c/b\u003e dump you made. In the CoreOS patcher (Option 5) you can now select Generate Legitimate Patch (Option 3)\n\u003cli\u003eProgram will output your dump with the name '_patched_coreos' (Example: nor1.bin is now now1_patched_coreos.bin)\n\u003cli\u003eUpload the newly patched dump back to the PS4 along with a \u003cb\u003epatched\u003c/b\u003e copy of the \u003cb\u003eoriginal\u003c/b\u003e Syscon\n\u003cbr\u003e\n\u003cbr\u003e\u003cb\u003eTroubleshooting:\u003c/b\u003e\n\u003cbr\u003e\n\u003cli\u003eIf you still have loadBios -8 and the Bootloader version has changed you have an issue with your RAM, replace and or repair it.\n\u003cli\u003eIf you have errors about wrong version at the bottom of the UART log, you need to patch your Southbridge.\n\u003cli\u003eHow can you see the previous firmware? Upload only the patched Syscon and read UART. Standby Version = Previous Firmware\n\u003cli\u003eWhy so many CoreOS patches? Because CoreOS is encrypted, we cannot make a real patch, we are corrupting it in a way that allows it to think the value is real. Different consoles behave differently so there is now 14 patches. Luckily there is a new method (see above) which is signifigantly quicker, it uses the legitimate header value from an update (even if its the same firmware) and it patches that on your old dump.\n\u003cli\u003eThe standby version and or the release version has changed, but the console still just says checkUpdVersion 0xfffff etc. This is because the Syscon patch has failed, you need to use the \u003ca href=\"/sysconrebuilder\"\u003e\u003cb\u003eSyscon Rebuilder\u003c/b\u003e\u003c/a\u003e to rebuild the syscon and patch it with the -2 patch (Option 4), this will remove the error.\n\u003cbr\u003e\n\n\u003cbr\u003e\u003cbr\u003e\n\u003cb\u003eHow Does It Look From UART?\u003c/b\u003e\n\u003cbr\u003e\n\u003cli\u003e\u003cb\u003ePatch 1\u003c/b\u003e\u003cbr\u003e\u003cspan class=\"secure-loader\"\u003esecure loader build: May 10 2022 05:23:21 (r10568:release_branches/release_09.600) [711MHz]\u003c/span\u003e\n\u003cbr\u003eBoots Normally (Fail)\n\u003cli\u003e\u003cb\u003ePatch 2\u003c/b\u003e\u003cbr\u003e\u003cspan class=\"secure-loader\"\u003esecure loader build: May 10 2022 05:23:21 (r10568:release_branches/release_09.600) [711MHz]\u003c/span\u003e\n\u003cbr\u003eBoots Normally (Fail)\n\u003cli\u003e\u003cb\u003ePatch 3\u003c/b\u003e\u003cbr\u003e\u003cspan class=\"secure-loader\"\u003esecure loader build: May 10 2022 05:23:21 (r10568:release_branches/release_09.600) [711MHz]\u003c/span\u003e\n\u003cbr\u003eBoots Normally (Fail)\n\u003cli\u003e\u003cb\u003ePatch 4\u003c/b\u003e\u003cbr\u003e\u003cspan class=\"secure-loader\"\u003esecure loader build: May 10 2022 05:23:21 (r10568:release_branches/release_09.600) [711MHz]\n\u003cbr\u003eERROR: main(4122) loadBios -8\u003c/span\u003e\n\u003cbr\u003eBLOD (Fail)\n\u003cli\u003e\u003cb\u003ePatch 5\u003c/b\u003e\u003cbr\u003e\u003cspan class=\"secure-loader\"\u003esecure loader build: May 10 2022 05:23:21 (r10568:release_branches/release_09.600) [711MHz]\u003c/span\u003e\n\u003cbr\u003eBoots Normally (Fail)\n\u003cli\u003e\u003cb\u003ePatch 6\u003c/b\u003e\u003cbr\u003e\u003cspan class=\"secure-loader\"\u003esecure loader build: May 10 2022 05:23:21 (r10568:release_branches/release_09.600) [711MHz]\u003c/span\u003e\n\u003cbr\u003eBoots Normally (Fail)\n\u003cli\u003e\u003cb\u003ePatch 7\u003c/b\u003e\u003cbr\u003e\u003cspan class=\"secure-loader\"\u003esecure loader build: May 10 2022 05:23:21 (r10568:release_branches/release_09.600) [711MHz] \n\u003cbr\u003eERROR: main(3738) checkUpdVersion 0xffffffff != 0x9600000\u003c/span\u003e\n\u003cbr\u003eSlot Switched To Current Slot (Fail)\n\u003cli\u003e\u003cb\u003ePatch 8\u003c/b\u003e\u003cbr\u003e\u003cspan class=\"secure-loader\"\u003esecure loader build: Sep  1 2021 05:19:44 (r10468:release_branches/release_09.000) [711MHz]\n\u003cbr\u003eERROR: main(3738) checkUpdVersion 0xffffffff != 0x9008000\u003c/span\u003e\n\u003cbr\u003e\u003cb\u003eSecure Loader \u0026 CheckUpdVersion Lower = Success!! Patch Syscon Now!\u003c/b\u003e\n\u003cli\u003e\u003cb\u003eAfter Syscon Patch\u003c/b\u003e\u003cbr\u003e\u003cspan class=\"secure-loader\"\u003esecure loader build: Sep  1 2021 05:19:44 (r10468:release_branches/release_09.000) [711MHz]\n\u003cbr\u003estandby 09600000\u003c/span\u003e\n\u003cbr\u003e\u003cb\u003e9.00 Secure Loader and 9.60 Standby. Slots successfully switched! Booting into 9.00!\u003c/b\u003e\n\n\u003ch3\u003eGetting Support\u003c/h3\u003e\nIf you want support from BwE, you must provide a UART log for each NOR patch (without flashing Syscon) then another with only the patched Syscon.\n\u003cbr\u003eThat means a \u003cb\u003etotal of 15 logs\u003c/b\u003e, they must be labelled to represent each patch number and in .txt format. Zip it and email it/message it to me. \n\u003cbr\u003e\u003cb\u003eIf you do not do this, I will not provide support\u003c/b\u003e\n\n\u003ch3\u003eCredits/Greetz:\u003c/h3\u003e\nDarkNESMonk\n\u003cbr\u003eWildcard\n\u003cbr\u003efail0verflow\n\u003cbr\u003eJEFF\n  \u003cbr\u003ePDJ\n  \u003cbr\u003eHoea\n  \u003cbr\u003eDonators \u0026 Suppliers of Dumps/Syscons\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbetterwayelectronics%2Fsce-syscon-writer-guide","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbetterwayelectronics%2Fsce-syscon-writer-guide","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbetterwayelectronics%2Fsce-syscon-writer-guide/lists"}