PS3 PS3UART Script By Mina Ralwasser: Control your ps3 SYSCON via UART

After the findings made on CXR SYSCON, ps3 developer @M4j0r , known on twitter handle as Mina Ralwasser released a script that lets you authenticate over ANY PS3 syscon (FAT /,SLIM /,SUPERSLIM) and use the privileged commands to do fun stuff on the system. View the psdevwiki links included to see some of the commands that are now possible with this new script release ​

​

About

• 
  You can find some of these commands on the ps3devwiki page:
  
  • https://www.psdevwiki.com/ps3/System_Controller_Firmware#Internal_commands
  • https://www.psdevwiki.com/ps3/System_Controller_Firmware#External_commands_.28COK-001.29
  • https://www.psdevwiki.com/ps3/System_Controller_Firmware#SW-301_Command_List
  • https://www.psdevwiki.com/ps3/System_Controller_Firmware#SW2-301_Command_List
  • https://www.psdevwiki.com/ps3/System_Controller_Firmware#SW3-304_Commandlist
  
  
  The usage is: python Syscon.py <COMN> <CXR,CXRF,SW> where COMN is COM number and second arg is the chip you are communicating with
  To authenticate you just type "auth" or "AUTH" (sometimes this will fail, you need to keep trying until it succeeds)
  To know list of commands, after successfull auth type "help"
  To exit the command line you type "exit"
  

See Release & Discussion(s) for additional details

• https://twitter.com/MinaRalwasser/status/1346569260055855105
• https://www.psx-place.com/threads/s...o-what-does-it-mean.26148/page-17#post-273608

 

Sorry if these are stupid questions, in my defense I have not been following these syscon discoveries that closely and things change all the time.

Is this something that can be done via software alone on a hacked CFW/HEN PS3 (without additional hardware), or is this only done by probing pins on the motherboard using special hardware?

If it does require hardware is it just something cheap and easily available?
and does it require advanced soldering skills?

 

Use any UART adaptor. I still need some time to explain. Is simple as faulty ylod thread, probably will be updated with more details there as well.
Need to test some of scripts to dump nvs part of syscon on dyn001. I have mixed something and I tried to understand how to do it automatically, not manually copy and paste.

 

Use any UART adaptor.

Ok I see thanks, I wasn't sure if one of the PS3 chips had this built in and this could be done via software alone.

 

"ANY ps3 syscon (FAT,SLIM,SUPERSLIM)".. Super Slim too? This means we can access SSs to get errors codes? O.O

I still barely understand what all of you say about Syscon, how data is treated actually and how it works, so almost everything haha. But you people are awesome with this stuff, kudos for @M4j0r and @zecoxao for their great findings (and other people if I missing one), and also @db260179 who started the Syscon thread.

Thanks, great job

 

"ANY ps3 syscon (FAT,SLIM,SUPERSLIM)".. Super Slim too? This means we can access SSs to get errors codes? O.O

I still barely understand what all of you say about Syscon, how data is treated actually and how it works, so almost everything haha. But you people are awesome with this stuff, kudos for @M4j0r and @zecoxao for their great findings (and other people if I missing one), and also @db260179 who started the Syscon thread.

Thanks, great job

Yes, you can access the superslim syscon and do fun stuff with it (some of it is dangerous so be careful with what you're doing!)

https://www.psdevwiki.com/ps3/System_Controller_Firmware#SW3-304_Commandlist
This is the commandlist for one of the superslims syscon chips.
Most of these commands use GET and SET as parameters

 

1x https://thepihut.com/products/usb-to-ttl-serial-cable - Has to be 3.3v usb ttl serial cable, NOT 5v serial!

4x 30 AWG wire to connect the pins TX,RX,GND and DIAG (this pin is on the ps3 motherboard that is grounded to activate diag mode) to the usb ttl cable (TX,RX and GND - DIAG is connected to GND lead once EEP SET mode is done)

I was looking at software way to talk to the syscon, but hit a dead end. Only possible way, was booting in linux - but that was too cumbersome.

Can be any ps3 state, firmware doesn't matter, but only tested properly on the FAT models.

But the newer syscon uart script can talk to the slim models and newer fat models using the sherwood syscons.

Sorry if these are stupid questions, in my defense I have not been following these syscon discoveries that closely and things change all the time.

Is this something that can be done via software alone on a hacked CFW/HEN PS3 (without additional hardware), or is this only done by probing pins on the motherboard using special hardware?

If it does require hardware is it just something cheap and easily available?
and does it require advanced soldering skills?

 

Due to a small error it's possible that some Python 2 users experience crashes if an internal error gets detected, which is fixed with this version: https://twitter.com/MinaRalwasser/status/1346569260055855105

 

I think I may be out of the faulty table?

https://r.tapatalk.com/shareLink/to...share_fid=179881&share_type=t&link_source=app

Fault finding YLOD with the SYSCON - First steps and Error reporting

 

Well sorry for the noob here, I have not understand anything XD

But I got a question, can this be used to turn a non-CFW model into a CFW model?

 

Well sorry for the noob here, I have not understand anything XD

But I got a question, can this be used to turn a non-CFW model into a CFW model?

No, the syscon chip is a microcntroller (like a tiny CPU) and have his own menu with a bunch of commands availables to use, to access that menu is needed to authentificate using an special encryption protocol, this is what the script does, it allows to enter in syscon menu and from there we can make a dump of his contents (or restore them) and change some settings inside it, etc...

Previouslly to this release it was only posible to do it in the syscon CXR series (used by the first PS3 fat models), and this new script allows to do it in the syscon SW series (used by last PS3 fat models, all slim, and superslim models)

 

[QUOTE = "M4j0r, post: 274001, member: 29218"] Devido a um pequeno erro, é possível que alguns usuários do Python 2 travem se um erro interno for detectado, o que foi corrigido nesta versão: https://twitter.com / MinaRalwasser / status / 1346569260055855105 [/ QUOTE]

[QUOTE = "DeViL303, post: 273948, member: 22544"] Ok, vejo, obrigado, não tinha certeza se um dos chips PS3 tinha isso integrado e isso poderia ser feito apenas através do software. [/ QUOTE]

Essas chaves da syscom estão ou não
deixando vocês perto de uma CFW compatível
Com todos os modelos de ps3?

ENGLISH:
These syscom keys are or are not leaving you close to a compatible CFW With all ps3 models?

 

[QUOTE = "M4j0r, post: 274001, member: 29218"] Devido a um pequeno erro, é possível que alguns usuários do Python 2 travem se um erro interno for detectado, o que foi corrigido nesta versão: https://twitter.com / MinaRalwasser / status / 1346569260055855105 [/ QUOTE]

[QUOTE = "DeViL303, post: 273948, member: 22544"] Ok, vejo, obrigado, não tinha certeza se um dos chips PS3 tinha isso integrado e isso poderia ser feito apenas através do software. [/ QUOTE]

Essas chaves da syscom estão ou não
deixando vocês perto de uma CFW compatível
Com todos os modelos de ps3?

ENGLISH:
These syscom keys are or are not leaving you close to a compatible CFW With all ps3 models?

please provide an english translation with non-english posts.

 

Psdevwiki is down?

 

Psdevwiki is down?

looks like it. doesn't load for me.

 

Last night trying to get some info test on 4g phone didn't work so thought someone may know something
Edit
Now is fine.

 

For anyone who wants to use the script on a DECR-1000A, you can do that via the Communication Processor, you just need to redirect the serial port to your PC, no need for any soldering.
First root the CP: https://www.psdevwiki.com/ps3/Communication_Processor#Exploiting_the_Communication_Processor and then follow the readme inside the attachment.

 

Hello everyone i am having few problems and din't knew of a right forum to ask this :

1:- I am working on a dia-002 motherboard solder uart connections
I have solder ground , rx and tx successfully but ended up destroying diag pad its deattached now and only that remains of it is very small point on board size of a solder ball can't get solder to stick on it and after studing the syscon uart at psdev wiki. I was wondering if the diag pin on service connector will function the same as the one in uart guide pinout.

2:- On the ps3 superslim pqx-001 motherboard the tx and rx points are identified but still haven't seen pinout for the diag pin. Can i use solder these two pins and attach them to uart converter along with gnd and run pyscript to fetch error codes also does the ft232rl chip has to be original or a counterfeit will work too.

 

1:- I am working on a dia-002 motherboard solder uart connections
I have solder ground , rx and tx successfully but ended up destroying diag pad its deattached now and only that remains of it is very small point on board size of a solder ball can't get solder to stick on it and after studing the syscon uart at psdev wiki. I was wondering if the diag pin on service connector will function the same as the one in uart guide pinout.

The service connector pin needs to be first connected to the diag pad using a wire, then it can be used with the FFC connector.

2:- On the ps3 superslim pqx-001 motherboard the tx and rx points are identified but still haven't seen pinout for the diag pin. Can i use solder these two pins and attach them to uart converter along with gnd and run pyscript to fetch error codes also does the ft232rl chip has to be original or a counterfeit will work too.

It has no diag pin. Only models with a Mullion (CXR) Syscon do have that.

 

The service connector pin needs to be first connected to the diag pad using a wire, then it can be used with the FFC connector.


It has no diag pin. Only models with a Mullion (CXR) Syscon do have that.

So what i am exactly saying is the trace is not available its all like now so onlyoption is pin on service connector

as compared to what I have studied on the cok-001 board the service pins and uart guide pinouts connect to same data line hidden underneath so it should work same.
is diag that important to fetch error log if its to be grounded only then won,t be much problem.