Advanced sFlash tools - andy-man/ps4-wee-tools GitHub Wiki

Extract/Build sflash' partitions

These options allows you to extract partitions to folder (SN of console) and make some changes (f.e. replace/patch wifi fw or anything else)

And then you can build everything back

s0_header        > s0_head
s0_active_slot   > s0_act_slot
s0_MBR1          > s0_mbr1
s0_MBR2          > s0_mbr2
s0_emc_ipl_a     > sflash0s0x32
s0_emc_ipl_b     > sflash0s0x32b
s0_eap_kbl       > sflash0s0x33
s0_wifi          > sflash0s0x38
s0_nvs           > sflash0s0x34
s0_blank         > sflash0s0x0
s1_header        > s1_head.crypt
s1_active_slot   > s1_act_slot.crypt
s1_MBR1          > s1_mbr1.crypt
s1_MBR2          > s1_mbr2.crypt
s1_samu_ipl_a    > sflash0s1.cryptx2
s1_samu_ipl_b    > sflash0s1.cryptx2b
s1_idata         > sflash0s1.cryptx1
s1_bd_hrl        > sflash0s1.cryptx39
s1_VTRM          > sflash0s1.cryptx6
s1_CoreOS_A      > sflash0s1.cryptx3
s1_CoreOS_B      > sflash0s1.cryptx3b
s1_blank         > sflash0s1.cryptx40

View/Recover HDD EAP keys

Eap key may have 0x40 and 0x60 bytes length. PS4 10xx/11xx models usually have only one key and 12xx/Slim/PRO models have backup key.

Magic is E5E5E501 and is located at few bytes before the key offset

Setting the right key can fix "EAP key panic" errors

Get HDD EAP keys [keys.bin]

Additional info can be found here PsDevWiki

After you get keys.bin you can use Сryptmount to access your PS4 hdd via PC (Linux or WSL for win10)

Сryptmount/cmtab example

    # /etc/cryptmount/cmtab - encrypted filesystem information for cryptmount
    # try 'man 8 cryptmount' or 'man 5 cmtab' for more details
    user {
        dev=/dev/sdc13
        dir=/mnt/c/Users/username/Desktop/user
        flags=user,nofsck
        fstype=ufs mountoptions=ro,noatime,noexec,ufstype=ufs2
        cipher=aes-xts-plain64
        keyfile=/mnt/c/Users/username/Desktop/keys.bin
        keyformat=raw
    }

Commands

Get Disk List (PowerShell Admin)

GET-CimInstance -query "SELECT * from Win32_DiskDrive"

Mount Disk with WSL2 (CommandLine Admin)

wsl --mount \\.\PHYSICALDRIVE1

Copy bzImage to User Profile (WSL)

powershell.exe /C 'Copy-Item .\arch\x86\boot\bzImage $env:USERPROFILE'

Add kernel entry to .wslconfig (WSL)

powershell.exe /C 'Write-Output [wsl2] nkernel=$env:USERPROFILE\bzImage | % {$_.replace("\","\\")} | Out-File $env:USERPROFILE\.wslconfig -encoding ASCII'

Mount user partition (found either at /dev/sdX27 or at /dev/sdX13)

sudo cryptmount user

Base validation and entropy stats

Checks some known values (hash of emc, eap, wifi) and gets entropy stats

    FW version 10.50 / Active slot B

    Checking magics

    header     : OK
    MBR1       : OK
    MBR2       : OK

    Checking partitions

    emc_ipl_a  : [1ec53a02094b615655d537dc2528be7c] OK FW 8.50 <-> 9.60
    emc_ipl_b  : [78bcc7e6fcafd9a5de8c32d5bf802d09] OK FW OK
    eap_kbl    : [536214ca8cd665157ce3e48b375c9496] OK FW OK
    wifi       : [50b0085e8917ffca236bb449a81fd3eb] OK FW OK

    Entropy statistics

    Entropy    : 7.53813
    0xFF       : 11.80%
    0x00       : 2.34%
    Other      : 85.85%

EMC CFW for Aeolia

EMC (External Micro Controller / southbridge) is a “peripheral” processor on the PS4, that is mostly used for diagnostics/debug/peripheral control.

You can use this CFW to change temperature limits, generate some beeps, change the PS4’s fan speed, control leds and syscon. This will only work on Phat PS4s models CUH-1000 and CUH-1100.

Additional information about commands JaiBrute and PSDevWiki

Command send: cmd:code (help:A9)

Code is sum of all bytes + bitwise (&) 0xFF

def getCmd(str):
	sum = 0
	for i in range(len(str)):
		sum += ord(str[i])
	return str + ':%02X'%(sum & 0xFF)

List of commands:

Code	Command	Description
A9	help
A8	R16
A6	R32
79	R8
AD	W16
AB	W32
7E	W8
F0	_hdmi
A3	boot	Boots the console
DA	bootadr	[PSQ] boot address 00
0A	bootenable
48	bootmode	bootmode 1 - Change bootmode (AUTO/Manual)
91	buzzer	buzzer [1-7] - Beep stuff, 7 modes (?) available
B4	cb
F7	cclog	cclog [1-3] - Toggle chip communications log
96	ccul
1A	cec
B2	cktemprid
6B	combuf
70	comlog
5E	csarea
29	ddr
8C	ddrc
9B	ddrr
A0	ddrw
0B	devpm	Get devices power mode (wlan, hdd, usb, bd, acdc, pg3, hdmi, gbe, sdio)
88	dled
5F	dsarea
E4	ejectsw	Toggles eject switch
7A	errlog	errlog [0-1F] - Gets error log, 32 possibilities (0-1F)
7C	etempr	etempr get - Get (Alert Limits, Alert Hysteresis, CriticalTempr Limits)
B2	fdownmode	fdownmode [1] - Run/Stop FataldownMode
1B	fduty	fduty get - Get duty
74	flimit	flimit get - Get (MainSoc, Environment) max_duty and min_duty
FA	fmode	Fan Mode List (AutoServo, Maximun, Minimun, Manual, end)
84	fservo	fservo get - Get servo stats
E9	fsstate	fsstate get - Get ctempr, err, ierr, duty
68	fstartup
97	getmacadr
98	halt	Halts the console
3D	haltmode
03	hdmir
04	hdmis
B2	hdmistate	Get hdmi state (DP Video Setting)
08	hdmiw
98	help
33	mbu
22	mduty	mduty get - Get MainSoc and Environment duty values
FE	nvscsum	Get nvs' checksum
FA	nvsinit
CE	nvsl2sw
6A	osarea
96	osbootparam
84	osdebuginfo
F2	osstate
90	pcie	PCIe Device Status
5C	pdarea
6E	powcount
06	powersw	Toggles power switch
3B	powupcause
D3	qafinfo
C8	r16
C6	r32
99	r8
FC	resetsw	Toggles reset switch
38	rtc	Get RTC Counter / Status
8D	runseq
B6	s3state
C4	sb	Switches the bank of the ps4, ultra brick
1B	sbnvs
79	scfupdbegin	Syscon update begin, destroyer brick
44	scfupddl	Syscon update download, destroyer brick
AB	scfupdend	Syscon update end, destroyer brick
D0	scnvsinit	Initializes nvs, ultra hyper mega brick
75	scpdis
E8	screset	Resets syscon
CB	scversion	Gets syscon version
37	sdkversion
1D	sdnvs	sdnvs [partition number] [bank number]
11	smlog	smlog [1] - Packet Log [on/off]
3D	socdmode	[PSQ] Soc download mode
76	socuid	Gets socuid, also found in NVS
0D	spoff
AF	spon
15	sqlog
77	ssbdis	[PSQ] boot disable
F8	startwd
10	state
82	stinfo
90	stopwd
AF	stwb
65	subsysid
44	subsysinfo
5C	syspowdown	Shutsdown system
A2	task
17	tempr	tempr get - Get temperature values
59	temprlog
50	testpcie
AA	thrm
3E	uareq1	Command to gain more privileges, rsa
3F	uareq2	Command to gain more privileges, rsa
F5	version	Gets emc version
EC	vshinfo
CD	w16	Writes in uint16_t to any place emc controls, brick
CB	w32	Writes in uint32_t to any place emc controls, brick
9E	w8	Writes in uint8_t to any place emc controls, brick
3C	wsc

Responses:

Code	Text	Description
4E	NG E0000004	Bad Checksum
51	NG F0000006	Command no found
4C	NG F0000001	Incorrect argument
3A	OK 00000000	Correct command