sFlash tools - andy-man/ps4-wee-tools GitHub Wiki

SFlash (nor) dump info

 FILE             : ps4-pro-10.50.bin
 MD5              : 853fa7037754d16f3ec44c2510deda5e
 SKU              : CUH-7115B B01
 Region           : [15] US, Canada (North America)
 SN / Mobo SN     : MD85698071 / 40023C00040099
 Southbridge      : Belize 2 A0
 Torus (WiFi)     : Version 2
 MAC              : DE:AD:BE:EF:DE:AD
 HDD              : HGST / HTS541010A9E680 / 170520JD10424B2DG81S
 FW (active)      : 10.50 [B] [min 4.70]
 FW (backup)      : 8.50 <-> 9.60
 GDDR5            : 0xFF 0MHz
 SAMU BOOT        : 0 [0x00]
 UART             : Off
 Slot switch      : Extra [#9]

About Flags

UART

Turn on/off uart output Usefull for running tests and error monitoring You can leave it enabled

Memory test

Tests the memory within UART. It will do a checksum to confirm if its valid or not. Disable when finished to avoid issues!

Memtest will not start if your GDDR has bga defects (DCT channels error).

Uart example (good):

memtest: 0x000000000 - 0x040000000, size: 0x040000000, pattern: RANDOM
memtest: 0x000000000 - 0x040000000, size: 0x040000000, pattern: RANDOM(invert)
memtest: 0x25f000000 - 0x280000000, size: 0x021000000, pattern: RANDOM
memtest: 0x25f000000 - 0x280000000, size: 0x021000000, pattern: RANDOM(invert)
memtest: done. elapse=4652 msec

Uart example (error):

memtest: 0x000000000 - 0x040000000, size: 0x040000000, pattern: RANDOM
ERROR: memory hash miscompare on 0x001400000 - 0x001800000

RNG/Keystorage test

Uart example (good):

rng test: done.
keystorage test: done.

Buttons swap

Allows to select which button is for confirm/cancel. Japanese consoles usually use (X) for cancel and European (X) for confirm

HDD slow mode

Slow HDD mode loads more assets into memory instead of streaming everything in from storage as needed,

Memory budget mode

PlayStation 4 dev kits have a "Game Memory Budget Mode" in the debug settings featuring two options: normal and large. The normal mode setting confirms that 4.5GB of memory is usable for game applications. The large mode increases this considerably to 5.25GB, but the docs are clear that the extra RAM here is only available for application development, presumably in order to house debugging data.

Safe boot

Boot console in safe mode

Update mode

May fix CE-35888-2/SU-35888-2 errors and may not. You will require repair your BD chip in this case.

Arcade mode

Boot console in arcade mode

Registry recovery

Launch rebuild database procedure

IDU (Kiosk mode)

It's a mode where the ps4 keeps constantly updating to the latest firmware, used in kiosk retail consoles. There are usb configurations and also demo discs (isos) for the demos which can be used together with OMSK (cover and demo downloader)

Boot mode

FE - Development Mode, FB - Assist Mode, FF - Release Mode

MANU Mode

Will enable Service Mode on older firmwares

System flags cleaning

It just resets all system flags to off 0xFF

Memory clock editing (GDDR5)

Memory Clock Speed can be adjusted from 400mhz to 2250mhz.

Decreasing clock frequency sometimes helps to fix Loadbios and Memory errors

Most GDDR5 runs at 6000-8000 MHz. GDDR5 is quad pumped [x4]. GDDR5 at 8000 MHz technically runs at 2000 MHz

If you have problems, decrease frequency to 1000 MHz

Effective GDDR5 clock is 1350 MHz the frequency is selected experimentally

  • Too high value can lead to LOADBIOS -8 or DCT [*] error
  • Too low value leads to AMDINIT error

SAMU boot flag edit

Experemental

Slot switch (FW revert / Downgrade)

If your syscon has Not patchable status - FW revert is not possible. It's highly recommended to update FW to same version (via recovery mode), because in this state console is more vulnerable to CoreOS corruption (load bios errors), which is not fixable without backup dump.

Right pattern is not predictable (without extra steps), you need to try all of 14 patterns until you find the right one.

You can speed up search process by using spiway block write method + memtest ON

Memtest will give you extra seconds to turn of console before syscon "corruption" occurred ()

Successful revert UART log (before syscon patch):

secure loader build: Sep 1 2021 05:19:44 (r10468:release_branches/release_09.000) [711MHz]
ERROR: main(3738) checkUpdVersion 0xffffffff != 0x9008000

Successful revert UART log (after syscon patch):

secure loader build: Sep 1 2021 05:19:44 (r10468:release_branches/release_09.000) [711MHz]
standby 09600000

Legitimate CoreOS Patch

We can use real slot switch pattern which is generated during PS4 update.

Keep in mind: this method is only suitable for working consoles!

Steps:

  1. Read first dump (if you've not done it already)
  2. Update the console to the SAME version via safe mode
  3. Read second dump (both slots have equal FW)

Now you can patch first dump with data from second one using this wee-tool's option.

After you will get XXX_legit_patch.bin. Flash it and patched syscon back to console.

You are done! PS4 will load previous FW