Required Tools

  • A programmer to dump the flash (I use CH341A for example)
  • Proper adapter for the bios chip (see below)
  • Programmer Software (I use AsProgrammer)
  • Serial monitoring software (I use Putty)
  • A USB to TTL 3.3v converter (I use CH341A)
  • Insulated wire (needs to be thick enough)
  • Hex Editing Software (I use HxD)
  • Soldering Iron
  • Hot air station
  • Solder
  • Flux

Required Software

BwE has provided a UART & Programmer Collection pack which will aid in this project. It contains all of the following:

  • CH341A Programming Software
  • AsProgrammer 2.03a
  • SkyGz CH341A Mini Programmer Black Edition 1.18
  • NeoProgrammer 2.2.0.8
  • Modified SkyGz CH341 Programmer v1.1.1.25 by Kovzhun Mikkhail Alexandrovich (English/Russian)
  • CH341A Drivers
  • Logic Analyzer Software
  • Pulseview
  • Zadig (USB Driver)
  • PuTTY
  • USB TTL Drivers
  • FT232
  • PL2303
FT232RL PL2303 CH341A Programmer (And USB TTL)

Depending on the USB TTL device you have you need to install the drivers for it. If you are not using the above pack, download the appropriate driver below. PL2303 is not recommended.

Reading/Writing NOR (Removing Chip)

Desolder your NOR chip from the board. I recommend 350c from your hot air station (not heatgun). I also recommend masking the surrounding area, especially the southbridge and its crystal.

Next you solder the chip to a breakout board (comes for free with CH341A) if its a slim/pro NOR it is a WSON type chip, so you will need to mask the ground pad (as pictured above).

Plug it into your CH341A and you're good to go! Read using AsProgrammer or any other software you like.

Use the software to dump the NOR at least twice and compare the MD5 of each dump. Validate your NOR for corruption or errors using the BwE PS4 NOR Validator or using the PS4 Web Tools if you're not doing this as a business.


Desoldered NOR (WSON8)
Masked to avoid ground shorting on reader

Placing NOR on breakout board

NOR being read from breakout board

Reading/Writing NOR (Chip On-Board)

  • Dump the NOR using SPIWay (illustrated below) or through a modified CH341A or something faster like the XGECU (illustrated below).
  • You can either solder directly to the pins or their resistors/pads and dump/flash on-board (@ ~3.0v Only)


    XGECU

    CH341A (Modified for 2.8v)

    Teensy (SPIWay)


    8-Pin 16-pin Usage Teensy++ 2.0
    SPIway    		 Description
    - 1 SIO3 B5 8pin: Not Available - not used / 16pin: Serial Data Input & Output (for 4xI/O read mode)
    8 2 VCC +5V pad +3V DC Power Supply
    7 3 HOLD#/RESET# B6 8pin: Hold, to pause the device without deselecting the device / 16pin: Hardware Reset Pin Active low
    - 4 NC NC No Connection
    - 5 NC NC No Connection
    - 6 NC NC No Connection
    1 7 CS# B0 Chip Select
    2 8 SO/SIO1 B3 Serial Data Output (for 1 x I/O) or Serial Data Input & Output (for 2x I/O or 4x I/O read mode)
    3 9 WP#/SIO2 B4 Write Protection: connect to GND or Serial Data Input & Output (for 4x I/O read mode)
    4 10 GND GND Ground
    - 11 NC NC No Connection
    - 12 NC NC No Connection
    - 13 NC NC No Connection
    - 14 NC NC No Connection
    5 15 SI/SIO0 B2 Serial Data Input (for 1 x I/O) or Serial Data Input & Output (for 2x I/O or 4x I/O read mode)
    6 16 SCLK B1 Clock Input


    8 Pin WSON8 - Pro & Slim

    16 Pin SOP16 - Fat


    Hardwiring Example

    Non-Invasive Method

    2.8v CH341A Mod

    2.8v CH341A Mod

    Patching (And Validating)

    UART will produce empty characters unless patched. However, you can validate and patch your PS4 NOR (and Syscon) for only $20AUD ($13USD) if you're interested in determining and fixing software faults in the NOR.

    If you're not interested in repairing the NOR or commercial software solutions such as BwE PS4 NOR Validator or BwE PS4 NOR Patcher you can manually patch your NOR on offsets 0x1C931F and 0x1CC31F by changing both to 01.

    Soldering UART Pins

    The only 2 pins you will need to solder is Ground, and TX.

    BwE PS4 UART Pinout & UART Offset Guide

    Assembly

    You don't have to fully reassemble the console, just place a large heatsink on the APU and let the UART run until it stops. If the console actually boots properly, turn it off before it overheats.

    UART on a 72xx

    Reading the UART

    Use BwE UART Reader to read the UART output: Download here

    Diagnostics

    Boot the console. Whatever the UART stops at is often the issue.

    Common Errors

    • ERROR:DCT[0/1] is disabled: The first ram block has a failure.
    • ERROR: main(####) loadBios -8: Your syscon is not decrypting the CoreOS.
    • SAMU Enter/Leave: SAMU is responsible for managing keys and decryption. APU is likely the cause.
    • IDPS Error: Console is a brick, unfixable.
    • Panic EAP Key Not Available: Fixable with BwE PS4 NOR Validator.
    RAM blocks as shown on a PS4 Slim. Also applies to 12xxx fat model.

    Example Outputs