PS4 Part 1: Reversing PlayStation VR (PSVR) device [by bigboss]

Discussion in 'PS4 News' started by STLcardsWS, Oct 2, 2017.

By STLcardsWS on Oct 2, 2017 at 9:41 PM
  1. 7,115

    STLcardsWS Administrator

    Sep 18, 2014
    Likes Received:
    Trophy Points:
    If you go back to the very first article ever posted on psx-place you will seen developer bigboss (aka psxdev) released details & information on reverse engineering of the PS4 EyE Toy. Now, The developer has released today Part 1: of Reversing PlayStation VR Device We know bigboss from various research on PlayStation Hardware, The PS4 EyE Toy, PS Move Controllers among others, but not the developer has set his sights on the PlayStatiion VR (PSVR), so reverse engineering of the Processor Unit that communicates to the PS4 is the target of discussion in Part 1. bigboss motivation and end goal with this research is having the ability to use the PSVR on other platforms.


    • First i need to give thanks to:
      The title of this blog article explains very well about which is the main purpose of this blog entry. PlayStation VR (before known by Morpheus) is the new device from Sony for Virtual Reality marketplace. As you know there are a few actors right now in this marketplace:
      • Oculus.
      • HTC.
      • Sony.
      • Google.
      • Samsung.
      • Others vendors.

      PlayStation VR need different parts:
      • VR headset.
      • Processor Unit.
      • PlayStation 4
      • PlayStation 4 Camera
      • PlayStation Move and PlayStation dualshock
      • TV with hdmi

      Connection schema from Sony:

      I have spoken already about PlayStation Move and PlayStation Camera here in this blog and about its new design in my twitter account:

      CuvTTWaWYAAhN5i.jpg large.jpg

      So now we are going to speak about usb connection between Processor Unit and PlayStation 4 because we want to use PlayStation VR in other platform different than PlayStation 4.

      Processor Unit is a black box, if you want to know more about it you will need two things:
      1. Information about hardware. Sony published morpheus_bridge source for 1.50 and 2.0 and it will give you good information about how usb device is build and detailed information about all their 9 interfaces.
      2. An usb dump made with a usb protocol hardware analyzer.
      1 was already published and 2 was shared by tokkyo_tw so...


      What happen when you connect usb connector from Processor Unit to a Mac/PC?
      Easy you can see a new usb device with these usb descriptors
      You can check in morpheus_bridge source code that all information is already there.

      Usb dump was done with:
      • Software: USB Protocol Suite 7.35
      • Hardware: USBTrace 2500H
      USB Protocol Suite can be downloaded from here you must register your user to dowload it.

      We are going to work with files from dump:
      • connect-to-ps4 (psvr off).usb
      • connect-to-ps4 (psvr on in game (rez))-then-vrmode-on.usb
      • connect-to-ps4 (psvr on in game (rez)).usb
      • switch-to-vr-mode (in rez).usb
      We will choose connect-to-ps4 (psvr off).usb file first opening it with USB Protocol Suite.

      With PlayStation Camera we got dump from beagle hardware analyzer from totalphase and their tool is multiplatform and easy to use for me.

      USB Protocol Suite is for windows only and it is a little hard to use but task can be done with it.

      After opening file, choose in menu View Apply Decoding Scripts and check that you have following interfaces and their usb class applied:

      Captura de pantalla 2016-10-24 a las 20.12.02.png
      and in the endpoint option the same:
      Captura de pantalla 2016-10-24 a las 20.12.25.png

      A problem that i find with this tool is that sometimes it can't put the right type of endponint , class and packet size , so check it with usb descriptors first.(Some weird sometimes identify some endpoint with bulk type when they are interrupt type check with usb descriptor that info is correct)

      Choose in menu View Transfer Level and Hide all except Transfers options and in menu Report Detail, View Data and Decode Field View options.

      After that we can go transfer by transfer to make our analysis.

      I am not going to tech you how usb protocol works for that you have plenty of information, if you don't know about it stop here.

      First transfers are about get device and config ,interaface and endpoint descriptors, basically a dump for all descriptors

      Captura de pantalla 2016-10-24 a las 20.39.01.png

      For your reference these standard request transfer give you all information about device:
      • Transfer 4 device descriptor
      • Transfer 11 configuration descriptor
      • Transfer 12 all descriptor
      • Transfer 13 status
      All these transfer can give you all usb descriptor for this device and you can compare with information in morpheus_bridge source and lsusb output. It is the same. Check Decoded Field View Tab to see values from these standard requests transfers.

      Translation to c/c++ code with libusb api call is direct with all information from dump. All repoorts are described in morpheus_bridge source code so it's confirm all is fine.


    djluiluv and bitsbubba like this.


Discussion in 'PS4 News' started by STLcardsWS, Oct 2, 2017.

Share This Page