User Manual & files for Downgrade PS4 through the Sysglich procedure
Material:
- R5F100PLA (for SAA and SAB) or R5F100LLA (for SAC, SAD ecc ecc) RL78 family stock
- E2 Lite Renesas
- Teensy 4.0 (sysglitch)
- Teensy 2.0++ (dump nor)
- Serial UART to USB
- TQFP 100pin 0.5mm
- Soldering station (my AOYUE 968A+)
- A lot of patience and a lot of passion
1. SYSGLITCH wiring diagram by Wildcard
This is the schematic for a R5F100PL which is SAA and SAB motherboards and has a 100pin pinout.
While the R5F100LL chip for SAC SAD etc has 64pin and the schematic is
2. Assemble the pieces
Getting a Millefori Tablet (Bakelite) Amazon is your friend.
- Let's take teensy 4.0 and program with hex (glitch Marcan):
- Place the syscon on the board (only the desired pinout)
- So we begin to compose the circuit. For the pulldown we have to use a 4k ohm resistor and a small diode, I used a jumper so that when ready we start the glitch
- This is the final result
3. Dump SYSCON with REALTERM
- We connect the device via USB (the pulldown jumper must be disconnected) now we start. Realterm and set the band speed to 115,200 bps and choose the serial port now click on change.
- We choose where to write the dump and then click on Start: Overwrite. Well if you did everything right it should turn red and we can ”pulldown” the jumper to start the GLITCH
- the count of characters will begin, we arrive at about 4Mb and then we stop
4. Data analysis and payload preparation
- Let's open the dump with HxD and delete until we find the 2 hexadecimal values 94 94.
- Let's go to offset 7FFFF and delete everything else
- Let's go to File \ Save As
- In order for the dump to be read by the program, we need to convert it to the appropriate language. File \ Export \ Motorola S28 Records
5. Connect E2 Lite with stock RL78
- 1. Let's take the pinout of the E2 Lite at 14pin, while we already know it for the RL78
- 2. This is the result:
6. Renesas Flash Programmer
-
We connect the E2 Lite device via the USB cable and launch the Renesas Flash Program, create a new project with the following parameters:
- .Microcontroller: RL78
- .Tool: E2 Emulation Lite
- .Tool Detail select 3.3v
- Select the file previously created with HxD with extension s28 and press START.
- If you've done everything right so far, writing your syscon backup will begin
7. NOR BACKUP with Teensy 2.0++
- Version SAA and SAB
- Version SAC, SAD etc.
- Soldering 10 testpoints or anyone with a TSOP avoids soldering
- I assume that the teensy must be set with HEX SPI, so we also start the dump backup of our Downgrade
Credits
Special Thanks to Wildcard
by MaxLab81