Syscon Guide

What even is this? Well its a guide on how to read and write your PS4's Syscon (albeit writing is on a new chip for this guide).
Why Tho? You can downgrade (via CoreOS swapping) and repair LoadBIOS type corruptions. You can also enable service mode!
Where's the rest of the guide? It is TBA, but my software handles most of the downgrade process anyways.

Note: You can write to the original chip but requires a totally different method and requires a pre-flashed arduino that you must purchase from BwE.
The new method has its own unique exploit that reads/writes SCE chips on-board. If you want to do this, then this guide is not for you.
The benefit of this new method is that it requires only 2 wires (initially to glitch) to the syscon then 3 to alternative points. Read and write the original chip on the board. No desoldering!
The target market for this are repairers who will constantly be downgrading or fixing LoadBIOS errors. This will then remove the need to constantly desolder/resolder and buy chips.

Preview the paid method's guide here

Shopping List

Required:

Arduino Nano v3 ATMEGA168P (OR 328P) w/ CH340 ($6.50AUD)

FT232RL TTL Serial Module ($2AUD)

Multi LQFP (64-100) to DIP Board ($4AUD)

Breakable Pin Headers (Any Nice Colour) ($0.80AUD)

x2 Colourful Mini Breadboards ($1AUD)

Male->Female Dupont Cables ($2AUD)

220ohm Resistor ($1AUD)

x2 1N4148/1N4448 Diodes ($2AUD)

Requisite Software (Reader, Writer, Verifier, Patcher)

Optional:

LQFP64 to DIP Board ($4AUD)

LQFP64 Socket Adapter ($45AUD)

LQFP100 Socket Adapter ($45AUD

Soldering, Whats That?:

T12-942 QUICKO Soldering Station (SET 5) ($58AUD)

DC24v 6A Adapter for Soldering Station ($28AUD)

Fake Amtech Flux ($7AUD)

Lead Solder Low-ish Melt ($3AUD)

Solder Wick ($1AUD)

Love Heart Tweezers ($7AUD)

32-34AWG Cable 10m ($4.50AUD)

Atten ST0862D Hot Air Station ($257AUD) (You Can Avoid This With ChipQuik)

SMD Vacuum Pen ($1AUD)

Syscon Types & Pinout

With this method that's provided you need to replace Sony's Syscon chip with a new one.

Why? Well this method is based on the public glitch and its function is to glitch to dump, not to write.

You can however easily write to a fresh blank R78 chip with a TTL device very easily.

You must then buy one of the below chips from whatever source you can find. I have about 50-100 in total, so I may be able to supply some if you cannot find any.

FAT	SLIM/PRO
R5F100PLAFB	R5F100LLAFB
R5F100PLDFB	R5F100LLDFB
R5F100PLGFB	R5F100LLGFB
R5F101PLAFB	R5F101LLAFB
R5F101PLDFB	R5F101LLDFB

FAT Syscon

Slim/Pro Syscon

Reading Syscon (Currently does NOT work on SIE INC Chips):

1. Program Arduino with .hex File
2. Connect from your Arduino to the Syscon Chip (On or Off Board)
3. Launch SysconReader.exe in Terminal with your COM port (Eg: SysconReader.exe COM4)

If the dumps do not match change resistors (100ohm, 510ohm 1kohm).



5v	GND	D4	D2	TXD	RXD
EVVD0 (Lift if on board)	EVSS0	VDD (Lift if on board)	RESET	220ohm Resistor	TOOL0
Pin 16 Pro	Pin 14 Pro	Pin 15 Pro	Pin 6 Pro	RXD (Arduino)	Pin 5 Pro
Pin 23 FAT	Pin 21 FAT	Pin 22 FAT	Pin 13 FAT		Pin 12 FAT

Schematic

Dumping off-board example

Wiring To Syscon & Removing/Replacing

If you are dumping on board, lift pin 15 and 16. To do this add flux and low melt solder to the pins and let it soak in.

Use tweezers and a thin tip and while applying heat to the pin push from behind with the tweezers until the pin is lifted.

Wire pin 5 and 6 flat against the resistors, directly to the pins or the alternative solder points. Following best practice.

To remove the Syscon chip entirely, apply flux to all of the pins and flood them with low melt solder (chipquik if not using hot air).

Apply 480c at 40% pressure from a height of approximately 15cm until the solder is visibly liquidous on all sides.

Pull up the chip with an SMD vacuum pen.

Tin the pads on the PS4 with low melt solder.

Clean pins 1-16 on the Syscon of any solder bridges and solder to pre-tinned breakout board (or place into DIP socket).

When reattaching New & Blank Syscon first apply a light layer of flux on the already tinned pads.

Line up Syscon appropriately or solder each corner manually to ensure the chip does not move during reflow.

Apply 480c at 40% pressure from a height of approximately 20cm and slowly drop until you see flux bubble/move and solder shine/glimmer.

If you do not want to use hot air, use drag soldering technique or manually solder each pin individually with thin tip tinned with low melt solder.

When reading Syscon on board (after patching) wire only pin 5, 6 and ground either directly to the chip or alternative points.

Soldering ALL pins to Syscon for dumping on-board (Not required)

Dumping on-board example

Best Practice

Solder the jumper wires flat against the legs.

The entire jumper wire must fill the entire pad.

The wire must be parallel to the component termination.

Patching Syscon Dump:

1. Run BwE PS4 NOR Validator
2. Select Syscon
3. Scan & Apply Downgrade/Service Mode Patches
4. Enable Debug Mode

Programming Blank Syscon:

1. Connect from your TTL to the Syscon Chip (R5F100LLAFB for Slim/Pro OR R5F100PLAFB for FAT):
   1. VDD -> VDD (Pin 15/Pin 22 FAT) & EVVD0 (Pin 16 Pro/Pin 23 FAT) (Remove If On-Board)
   2. GND -> EVSS0 (Pin 14 Pro/Pin 21 FAT) (To Common GND If On-Board)
   3. RTS (or DTR) -> 1N4148/1N4448 -> RESET (Pin 6 Pro/Pin 13 FAT) (Diode Not Required - Remove If Timeout)
   4. TXD -> 1N4148/1N4448 -> RXD (TTL) (Keep Diode On Outside Slots Of BreadBoard)
   5. RXD -> TOOL0 (Pin 5 Pro/Pin 12 FAT)



2. Install Renesas Flash Software
3. Convert dumped/patched Syscon .bin File to S28 via HXD's (Or Other HexEditor's) Export Option
4. Load Pro/FAT (LLAFB/PLAFB) project file in Renesas Flash Programmer & Load your S28 Dump
5. Set 'Reset Settings' in 'Tool Details' to RTS & Invert or DTR & Invert depending on your TTL Device (RTS is preferred)
6. In 'Operation Settings' set 'Command' to 'Erase, Program, Verify' and 'Erase Options' to 'Erase Chip' and in 'Program & Verify' to 'Erase'.
7. 'Flash Options' should all be set to NO.
8. 'Connect Settings' should be '1 Wire UART' @ '115200bps' and on your correct COM port
9. Start!

Example

Reading & Writing NOR:

Dump the NOR using SPIWay (illustrated below) or through a CH341A or other programmer.

You can either solder directly to the pins, their resistors/pads and dump/flash on-board (@ ~3.0v Only) or remove the chip entirely.

You can also follow this guide on the Repair Wiki in which I illustrate the process behind enabling UART (which you should do).

8-Pin	16-pin	Usage	Teensy++ 2.0 SPIway	Description
-	1	SIO3	B5	8pin: Not Available - not used / 16pin: Serial Data Input & Output (for 4xI/O read mode)
8	2	VCC	+5V pad	+3V DC Power Supply
7	3	HOLD#/RESET#	B6	8pin: Hold, to pause the device without deselecting the device / 16pin: Hardware Reset Pin Active low
-	4	NC	NC	No Connection
-	5	NC	NC	No Connection
-	6	NC	NC	No Connection
1	7	CS#	B0	Chip Select
2	8	SO/SIO1	B3	Serial Data Output (for 1 x I/O) or Serial Data Input & Output (for 2x I/O or 4x I/O read mode)
3	9	WP#/SIO2	B4	Write Protection: connect to GND or Serial Data Input & Output (for 4x I/O read mode)
4	10	GND	GND	Ground
-	11	NC	NC	No Connection
-	12	NC	NC	No Connection
-	13	NC	NC	No Connection
-	14	NC	NC	No Connection
5	15	SI/SIO0	B2	Serial Data Input (for 1 x I/O) or Serial Data Input & Output (for 2x I/O or 4x I/O read mode)
6	16	SCLK	B1	Clock Input

8 Pin WSON8 - Pro & Slim

16 Pin SOP16 - Fat

Hardwiring Example

Non-Invasive Method

2.8v CH341A Mod

Patching NOR Dump:

1. Run BwE PS4 NOR Validator
2. Select NOR
3. Patch and Swap CoreOS
4. Enable UART Mode

Credits/Greetz:

DARKNESMONK
PDJ
Hoea
Donators & Suppliers of Dumps/Syscons