====== Sony PlayStation ====== This page has no intention to be complete. I am not responsible for you bricking your devices: It is just a summary of things I find useful/interesting. \\ See actual forums for PlayStation to read about more/better information. \\ Additionally, [[https://web.archive.org/web/20211029190307/http://www.ps3hax.net/forum.html|ps3hax.net is still readable thanks to archive.org]], containing threads and tutorials for PS3+PS4. \\ As always: **DO NOT AUTO-UPDATE your devices** if you want to run exploits. \\ ===== DualShock4 ===== **DO NOT USE FAST CHARGERS ON DS4!** They might kill your PMIC. Charge on console USB port or with dumb 5V USB charger (<1A) only. \\ ==== USB charging ==== DS4 JDM-055 seems to be the worst, as PMICs (S2PG00 / S2PG001) die. This is mostly due to voltage spikes on USB port. DO NOT USE QC FAST CHARGERS. There is no TVS diode or high-side clamp to kill a sudden surge - even if the spike is only microseconds, it can punch through the PMIC’s internal FETs. \\ If battery voltage drops like with a short (~0.4V in my case), cut VCC trace of PMIC (no desoldering necessary). There is a "replacement" fix using another LiPo-charger IC and AMS1117-3.3 LDO. See [[https://www.reddit.com/r/AskElectronics/comments/1j15lf9/changing_ps4_jdm055_charging_ic_s2pg001_with_a/|reddit comments]] - if you read the following schematics on acidmods, you will quickly see that you will lose audio and rumble, as the PMIC is also the DSP. \\ [[https://acidmods.com/forum/index.php?topic=44645.0|Schematics of JDM-055 on acidmods.com]] \\ There are [[https://acidmods.com/forum/index.php/topic,43542.0.html|PCB scans of other DS4 controllers too]]. \\ There are USB-C replacement boards available (e.g. on aliexpress) to convert DS4 from micro-USB for convenience. \\ Also consider to add a small fuse and a VBUS TVS / ESD protector with VRWM ~5–5.5 V (reverse standoff) so it doesn’t clamp during normal 5.0–5.25 V USB - //Vishay VBUS053// would be suitable part. ==== DS4 battery upgrade / replacement ==== The max size of LiPo battery is: w/o the original plastics casing. ==== other DS4 resources ==== DS4 EXT connector pinout: \\ [[https://www.psdevwiki.com/ps4/DualShock_4#3.5mm_earset_connector_+_EXT_connector]] \\ Pwn a DS4 //write-up//: [[https://fail0verflow.com/blog/2018/ps4-ds4/]] \\ Use DS4 with Arduino: [[https://docs.arduino.cc/libraries/ps4controller/]] \\ ===== PS4 SysCon Renesas glitching ===== It is possible to glitch Renesas RL78/G13 (which is PS4 SysCon in some models) to roll back to previous installed FW version (no real downgrade, only one version back!). It uses a recovery feature of SysCon to reverse on failed FW update. \\ [[https://www.psxhax.com/threads/ps4-sysglitch-tool-and-syscon-glitching-pinout-by-vvildcard777.7545/]] \\ [[https://github.com/VV1LD/SYSGLITCH]] \\ [[https://www.psxhax.com/threads/ps4-syscon-tools-released-by-abkarino-egycnq-with-guide-demo-videos.15904/]] \\ [[https://github.com/AbkarinoMHM/PS4SysconTools]] \\ Also see [[https://github.com/andy-man/ps4-wee-tools]] \\ For more, read writeup of fail0verflow [[https://fail0verflow.com/blog/2018/ps4-syscon/]] and see [[https://www.psdevwiki.com/ps4/Syscon_Hardware|psdevwiki]] \\ there even is [[https://www.psx-place.com/threads/ps4-syscon-tools-ps4-syscon-flasher-full-tutorial-by-abkarino-egycnq.40987/|a tutorial on psx-place.com]] \\ #TODO: Teensy is expensive, port to RP2040. \\ ===== PS3 ===== ==== DS3 SixAxis ==== [[https://github.com/nefarius/DsHidMini|Windows driver]] \\ === DS3 battery upgrade / replacement === The max size of LiPo battery is: w/o the original plastics casing. ==== other ==== * There are cheap USB-Adapters for PS1/2 controllers to use on PS3 and PC, e.g. found on aliexpress or ebay. \\ * The BD-drive of PS3 is married to the motherboard/firmware. DO NOT THROW AWAY THE BOARD OF THE DRIVE. \\ * Instead of remarrying PS3 BD-drive, install CFW and play games from HDD. \\ * To fix YLOD syscon error 1001 or 1002 [[https://www.psx-place.com/threads/research-experimental-nec-tokin-capacitors-replacement-ylod.25260/|replace PS3 NEC/TOKINs]], e.g. [[https://www.pcbway.com/project/shareproject/PS3_Tantalizer_6f95a7fc.html|with Tantalizer]] or [[https://www.reddit.com/r/PS3/comments/1icqngc/tantalacer_vs_bootylizer_vs_tantalizers/|similar choices]] \\ * Syscon can tell you what's wrong with your defective PS3: [[https://www.psx-place.com/threads/syscon-tutorial-windows.41664/|syscon tutorial]] - read [[https://www.psdevwiki.com/ps3/Syscon_Hardware|psdevwiki]] and [[https://consolemods.org/wiki/PS3:Syscon_Diagnosis|wiki on consolemods]] \\ * See other [[https://www.psx-place.com/forums/tutorials-guides.60/|tutorials/guides on psx-place]] \\ === MCU / ESP32 stuff === [[https://gitlab.com/ricardoquesada/esp-idf-arduino-bluepad32-template]] \\ [[https://github.com/darthcloud/BlueRetro]] \\ [[https://github.com/jvpernis/esp32-ps3]] \\ [[https://dronebotworkshop.com/ps3-esp32]] \\ ===== Other ===== - There are [[https://acidmods.com/forum/index.php/topic,44714.0.html|PCB scans of DS5 controllers on acidmods.com]] too. \\ - [[https://acidmods.com/forum/index.php?topic=43204.0|PCB scans are available for XBox1 controller]] too. \\ - [[https://wololo.net/2024/06/15/hacker-theflow-discloses-playstation-portal-exploit-for-firmwares-2-06/|PS Portal has been hacked in 2024]]. It runs a [[https://en.wikipedia.org/wiki/PlayStation_Portal#cite_note-:0-16|heavily modified version of Android 13]] \\ - See this Library to integrate wired PSX/PS2 controllers to your project: [[https://github.com/GiuseppePorcheddu/PsxLib]] \\ Or if you must use Arduino: [[https://github.com/SukkoPera/PsxNewLib]] or [[https://github.com/madsci1016/Arduino-PS2X]] \\ - Also see various modifications for consoles here: [[https://circuit-board.de/forum/index.php/CustomPage/11/]] \\ - For PlayStation Cameras see [[projects:camera#playstation_camera]] \\ ==== PS2 ==== - For PS2 psx-place has a good [[https://www.psx-place.com/threads/tutorial-the-great-ps2-aio-guide.30219/|AIO guide on psx-place.com]] and a [[https://www.psx-place.com/threads/how-to-hack-playstation-2-in-2025-roadmap.37271/|comparison of choices]]. See how to use FreeMCBoot with FreeDVDBoot and use USB-Loader with it, e.g. Open PS2 Loader (OPL), to not need any discs anymore (in case of broken drive). \\ - If you use a modchip on PS2, see if you need a [[https://www.psx-place.com/threads/preservation-of-all-ps2-laser-fixes.38567/|laser protection circuit for LA chip]] to prevent laser burnout. \\ - There is [[https://www.psx-place.com/threads/mx4sio-sio2sd-sd-card-adapter-and-sd-driver-for-the-ps2-sio2-interface.29210/|MX4SIO/SIO2SD SD Card Adapter]] \\ - There is a new way (2024) to [[https://ps2wiki.github.io/ps2-app-system/sas/2024/12/13/how-to-install-app-psus.html|load Apps from Memory Card with 3D icons]]. \\ - For Homebrews, see [[https://www.psx-place.com/forums/ps2-homebrew.76/|psx-place forums]] and [[https://github.com/orgs/ps2homebrew/repositories|PS2Homebrew repos]] \\ - There a good wiki pages: [[https://www.psdevwiki.com/ps2/|psdevwiki]] and [[https://consolemods.org/wiki/PS2:PS2_Mods_Wiki|consolemods]] \\ - Read [[https://github.com/terremoth/awesome-ps2|Awesome-PS2 page]] \\ - For creating homebrews use [[https://ps2dev.github.io/|the PS2SDK]] [[https://github.com/ps2dev/ps2toolchain|with its toolchain]] and [[https://github.com/ps2dev/gsKit|gsKit graphics library]]. Read [[https://www.psx-place.com/threads/archive-ps2dev-network.51/|how to begin]]\\ - [[https://quade.co/ps2-modchip-guide/modbo/|ModBo modchip PCB points]] and FYI read how [[https://github.com/mlafeldt/ps2logo/|ps2logo]] works \\ ==== PSX / PS1 ==== - How to install modchip on PSX: [[https://quade.co/ps1-modchip-guide/]] \\ - PSX has an [[https://github.com/kalymos/PsNee|open source modchip: PsNee]] and a derived [[https://blog.kchung.co/making-playstation-modchips/|python version with a write-up]] \\ - Modchips are not needed anymore since there is [[https://github.com/brad-lin/FreePSXBoot|FreePSXBoot]] \\ - There is an effort for open source ODE [[https://github.com/paulocode/picostation|Picostation]], based on Pi Pico - to replace expensive [[https://github.com/x-station/xstation-releases|x-station]]. \\ - As DIY solution to connect memory card to PC, use [[https://github.com/ShendoXT/memcarduino|memcarduino]]. There is also a [[https://github.com/dangiu/PicoMemcard|DIY memory card PicoMemcard]] using Pi Pico. \\ - SDKs for homebrew PlayStation 1 development: [[https://github.com/Lameguy64/psn00bsdk|PSn00bSDK]] and [[https://github.com/gecko0307/psxlib|PSXLib library]] \\ - There is a [[https://github.com/mateusfavarin/psx-modding-toolchain|PSX modding toolchain]] with a scene creating CTR mods with [[https://github.com/CTR-tools/CTR-ModSDK|CTR-ModSDK]]. Yes, [[https://github.com/RetailGameSourceCode/PSXDOOM-RE|of course there is DOOM, called PSXDOOM-RE]]. \\ - To learn how to decompile PSX games, read [[https://github.com/tetracorp/tokimeki-memorial|tetracorp]] and learn how to use [[https://github.com/lab313ru/ghidra_psx_ldr|Ghidra PSX plugin]] (also see [[https://www.youtube.com/playlist?list=PL9T2Lv4uZytRjvrbINZy58wy23_WTOGZJ|YT videos by its dev]]), also see the workflow of [[https://github.com/xeeynamo/sotn-decomp]] and [[https://github.com/open-ribbon/open-ribbon#how-to-decompile|open-ribbon#how-to-decompile]]. [[https://github.com/grumpycoders/pcsx-redux|PCSX-Redux]] is also a good source. \\ ==== Portable PlayStations: PSP / Vita ==== - For PSP there are µSD to Memory Stick adapters (even for dual µSD). \\ - SD2Vita: µSD-Card adapter for Vita game card slot. \\ - See [[https://www.psdevwiki.com/psp/Serial_Adapter|PSP Serial Adapter]] and [[https://www.psdevwiki.com/vita/Pinout|Vita Pinout]] \\ - Vita has solderless USB-C breakout boards available. Alternatively, you can remove the inner contacts of the vita socket - use the hollow connector to solder an USB-socket on, close the gaps with glue, solder up the wires to the PCB. \\ - You can [[projects:usb-c-ify|modify nearly any system to USB-C]], also for >5V with IC, thanks to USB-PD (or QC). \\ - You can [[add rumble/vibration for nearly any system capturing the sound output with an MCU]] and even add LEDs for fancy blinking (to integrate into transparent shoulder buttons). \\ - You can [[add accelerometer to nearly any system having an analog joystick]] by connecting a digital potentiometer IC with an MCU. \\ - Somebody tries to add L2/R2 buttons to Vita: [[https://github.com/Zucchy00/PsVitaCustomController/]] \\ - PSP development: [[https://github.com/pspdev|PSPDev PSPSDK]] and [[https://github.com/pmlopes/minpsp|minimal SDK minPSP]] \\ - PS Vita AIO installer: [[https://github.com/SKGleba/VitaDeploy|VitaDeploy]] and [[https://github.com/psv-plugins-archive|a plugin archive collection]]\\ - PS Vita development: [[https://vitasdk.org]] \\ ===== Sony (Playstation) (fun) facts ===== - PSX game Spyro 2 had antipiracy protection [[https://www.reddit.com/r/psx/comments/144u874/spyro_2_antipiracy_measure/|which randomly removed items]] from game and told that functionality is not guaranteed on hacked version. \\ - PSX game Crash Bandicoot 3 Warped (naughtydog) had playable Spyro the Dragon (Insomniac) demo game included and hidden in title screen - and vice versa. In CB hold L1+R1, then press Start; in Spyro use button combo (Up, Up, Down, Down, Left, Right, Left, Right, then Square). \\ - [[https://all-things-andy-gavin.com/2011/02/02/making-crash-bandicoot-part-1/|making of Crash Bandicoot]] is a nice write-up and there is an [[https://www.youtube.com/watch?v=pSHj5UKSylk|extended video documentary]] (2h14m) and a [[https://www.youtube.com/watch?v=izxXGuVL21o|short version]] of it (32min) \\ - PSX discs have a wobble in the inner, unwriteable disc tracks, which modchips worked around. There is [[https://github.com/kalymos/PsNee|AtTiny85 OSS modchip 'PsNee']]. There used to be black coloured burner CD-Rs (for aesthetics).\\ - There is an ODE SD-card reader to replace faulty CD lasers/drives if [[https://www.retrosix.wiki/laser-tuning-ps1|laser tuning]] does not work\\ - [[https://www.tomshardware.com/video-games/playstation/first-reverse-engineered-sony-ps1-motherboard-enables-fixing-broken-systems-bare-pcbs-for-usd40-boards-with-chips-for-usd95|nsOne is a PS1 PCB recreation]] project from 2025 working with original chips. [[https://bitbuilt.net/forums/threads/psone-pm-41-2-board-scan.6598/|PCB scans of PSone]] is also a nice view. \\ - PlayStation Portable had pandora battery recovery mode long undiscovered - (Pandora battery’s EEPROM serial number makes the boot ROM enter service mode and load the Initial Program Loader (IPL) from MemoryStick). It was discovered because modified battery and MagicGate MemoryStick were still inside when someone had received it from manufacturer repair. \\ It came up with the [[https://playstation.fandom.com/wiki/Nintendo_PlayStation|"Nintendo PlayStation"]] project, a CD-Drive for upcoming SNES-console and became it's own console by Sony. \\ - You can modify a USB-C socket inside hollowed PS-Vita connector (done myself with microUSB sockets on defective ports) \\ - For Vita 3G there was an active µSD-Card adapter for mini-PCIe slot called [[https://www.gamebrew.org/wiki/Psvsd_Vita|Psvsd]], replacing the 3G modem. Instead: \\ - Buy µSD-Card adapter for Vita game card slot (passive, as game card is an electrically µSD). \\ - Buy µSD-card adapter for MemoryStick ([[https://delightlylinux.wordpress.com/2014/12/05/broken-ms-pro-duo-micro-sd-adapter-an-internal-look/|Photofast CR-5400 for dual µSD]]); works well with SE phones and Sony PSP (except for PSP recovery with pandora battery due to no real MagicGate MemoryStick); adapter has ASIC inside; needs reformatting in dual µSD-card mode \\ - M2 MemoryStick micro is basically a shrunk down MemoryStick, they are electrically the same. \\ - [[projects:ps4-glitching|Glitch PS4 Renesas MCU]] to revert to previous firmware \\ - PS4 is vulnerable to [[https://hackerone.com/reports/1379975|BD-JB exploit]] which was 12-2024 [[https://wololo.net/2024/12/06/ps4-ps5-bd-jb-gets-significant-updates/|updated]] - jar-loader integrated :) \\ - early PS3 prototype model had no GPU. As Cell Processor is complicated to programm, devs protested, Sony added NVidia GeForce 7 GPU onboard. It is impressive what Graphics can be squeezed out of Cell PS3, see Naughty dogs Uncharted 3 and its progression documentary \\ - Original PS3 SixAxis controller lacked vibration due to a patent dispute with Immersion over rumble technology. It featured motion sensing instead, hence the name SixAxis. Later, after settling, Sony reintroduced rumble as DualShock 3. \\ - All PS3 with CFW are able to run backwards-compatible PSX and PS2 games with official emulator. Phat PS3 has PS2 coprocessor.\\ - the CFW story behind PS3 Cell (+PSP) hacking is entertaining *keyword golden firmware, golden times*; fully hacked; read the [[https://en.wikipedia.org/wiki/PlayStation_Portable_homebrew|short version on wiki]]\\ - The Logo of PS1 is a standing 'P' with a lying 'S'. \\ - FreeMCBoot for PS2 uses a BIOS update function exploit to run homebrew from a memory card. There is now [[https://github.com/brad-lin/FreePSXBoot|FreePSXBoot for PS1 too]] | PS2 [[https://github.com/CTurt/FreeDVDBoot|FreeDVDBoot to setup FreeMCboot]] (2020 way for no modchip at all) \\ - For PS2 there is ESR exploit which tricks the drive into thinking it is a VIDEO_DVD in no need of game-piracy-protection (needs patching of game-image first) \\ - PSP/PS2/PS1 have tons of emulators for other systems - There are many emulators for Sony Playstation with upsampling and AntiAliasing (look@ Retroarch/Libretro) \\ - PS1 lack of FPU has become [[https://www.david-colson.com/2021/11/30/ps1-style-renderer.html|its own renderer style]]. Also good read is [[https://www.copetti.org/writings/consoles/playstation/|copetti.org]] \\ - PS1 Demo discs are still being created, read about [[https://en.wikipedia.org/wiki/Haunted_PS1|Haunted PS1]] \\ - There is an [[https://www.reddit.com/r/romhacking/|active romhacking community]] \\ - There are decompilation efforts made to port/modify games, like [[https://github.com/open-goal/jak-project]] \\ - The round Sony Ericsson logo is a [[sony_ericsson:themes|fluid joint of Sony 'S' and Ericsson 'E' (SE)]] \\ - [[sony_ericsson:links|Sony Ericsson phone scene]] is still (kept) alive :) \\ \\