Wildcard: PS4 downgrade a possibility, but…

by TheGuardian · July 20, 2020

Developer Wildcard has released SYSGLITCH last week, a tool designed to dump the syscon ~~flash drive~~ of the PS4 (and the PS Vita), based on an attack described by Fail0verflow back in 2018.

Dumping the internals of one’s PS4 is useful for many purposes, but in particular for backup, for devs who would like to tinker with the console a bit too much, at the risk of bricking it. It could also be useful for downgrading purposes, ultimately.

Downgrading A PS4 TL,DR

Long story short, dumping your syscon contents (through SYSGLITCH) Makes PS4 downgrade a possibility but:

It requires you to have a backup of specific files of your own console, at the version you want to go back to. So, think of it more as a “revert to a previous backup” than an actual downgrade.
- In other words if you want to downgrade your console to e.g. firmware 5.05, you need to have that 5.05 backup ready, from your own console
It involves good hardware skills: you will need them to do your firmware backup with a development board such as a teensy, and you will need them again to replace your PS4’s SYSCON with a generic one when you want to downgrade.
Tutorials on this technique still need to show up, so this is for very advanced users for now

PS4 Downgrade with SYSGLITCH, details

Fail0verflow had already hinted at possible PS4 downgrades back in their 2018 article, but just as a theoretical possibility. Wildcard went a bit further by stating that with his tool being released, an actual downgrade might actually be possible today… with a lot of “IFs”.

First of all, an actual downgrade (and matching tutorial) has yet to be seen publicly, and SYSGLITCH itself requires soldering skills, and being used to work with extra hardware such as the Teensy development board. One also needs to dump their sflash0 file, which according to Wildcard does not require a hackable PS4.

If anyone is brave enough to try this.. you probs can downgrade (firmware reverting in this case) your ps4 if you have a copy of sc flash(via SYSGLITCH), dump of sflash, and possibly needed hdd clone using dd. All of that from the fw you are to revert to…
— wildcard (@VVildCard777) July 16, 2020

no, in fact you could do it on 2 fws that have no exploit. as you are replacing all the data storage on the ps4. sc flash, hdd, and sflash. there is no other locations to store data other than hardcoded keys/bootroms.

— wildcard (@VVildCard777) July 16, 2020

for replacing sc with older dumps you’d need one that does not have flash write protection. R5F100PLAFB for SAA/SAB and R5F100LLAFB for SAC/SAE and up*(not sure about later board revisions). and 0xc3 in flash set to 0x85 to enable debugging if you want. pic.twitter.com/9FSym1QWGe
— wildcard (@VVildCard777) July 16, 2020

Of course, the most painful and obvious limitation is that one could only go back to a firmware for which they actually have a backup (from their own console)… bottom line, don’t hope for a downgrade of your 7.xx console if you never created a backup of your console back when it was on 5.xx. But you could imagine making a backup of your 7.xx console today, then keep your console up to date for a while, until ultimately a 7.xx firmware gets released…

Unless you feel extremely adventurous though, I would wait for experts to come up with foolproof (or as close as it gets) tutorials before trying yourself. Not only does it require you to dump your console system, the actual downgrade process itself would involve more soldering, and replacement of the PS4 Syscon with a generic one on which you’ll have written the backup.

Yeah, that is part of the bravery :p. There is a patch method via kexploit f0f mentioned(idk how to use it personally) And possibly some ideas on how to write sc flash directly via shellcode. But that can brick it if something goes wrong. Better solutions will come in time 🙂
— wildcard (@VVildCard777) July 16, 2020