Hacking Better USB Image for ps4 hack.

mrdude · Sep 1, 2022

Here you go people, I have created a better image file for your usb drives to replace exfathax.img.

This is better for the following reasons:

With exfathax.img there is an error dispalyed on the ps4 because the exfat file system doesn't exist and the ps4 can see that there is an error in the usb file system. I have created a new image which fixes this error and has a very tiny exfat partition only a few bytes, but stil shows up on pc without the need to format error. This also stops the usb error message showing up on the ps4. This should make booting into the hack easier.

To use - just use win32diskimager to write to the image to your usb drive. You can also create a partition on the existsing space on your usb drive and use that on the ps4 for installing pkg files.

I tried to post this on poobs4 github but there's no way to post on that page, so I'll release here and someone can pass it on.

peteruk · Sep 2, 2022

Fantastic!!! thank you very much for this Mr Dude <3

Nakedfoxy · Sep 2, 2022

thank you.
what is the different between this one and that magic usb?

mrdude · Sep 2, 2022

Nakedfoxy said:
thank you.
what is the different between this one and that magic usb?

That guide is a waste of time, there was no need to mess about with the system files in the first place, with this image there's no messing about - just flash and you're done! Also on a PC you can't create an exfat partiton less than 7 meg, I manually edited the pico image file that's going about to add the fat32 partition table and make it only 256Kb, then once done, plugged the usb in and formatted it, then used winhex to dump the boot part of the drive and then manually stripped it down. The file I posted makes things far easier and you can use the rest of your drive space to create another partition and format it however you want for use on pc or the ps4. Also for those that have chips with usb features such as lolin s2 mini, raspberry pi etc, you can mod your code to use this image file and there's no need for USB at all as the chip can emulate a usb drive and this image is small enough to fit on the chip and can be pushed to the ps4.

I use this board: https://www.wemos.cc/en/latest/s2/s2_mini.html (I got 4 of them from ali express for about £10 delivered + vat)

Baiscally no soldering is required - just a usb c cable to plug it into the ps4 and that's it.

marek256 · Sep 3, 2022

Hello MrDude,
I always love this kind of effort to do something better for the others.
I would like to try it, but honestly I do use ESP32-S2 to make everything automatic.
Could you maybe fork this stooged repo: https://github.com/stooged/ESP32-Server-900u to use your exfat hack?
I would love to try it, but seems that it has to be replaced it somehow tougher than just a simple replacement.
Thank you

mrdude · Sep 4, 2022

marek256 said:
Hello MrDude,
I always love this kind of effort to do something better for the others.
I would like to try it, but honestly I do use ESP32-S2 to make everything automatic.
Could you maybe fork this stooged repo: https://github.com/stooged/ESP32-Server-900u to use your exfat hack?
I would love to try it, but seems that it has to be replaced it somehow tougher than just a simple replacement.
Thank you

I wrote a python script to convert it to decimal numbers like the exfathax.h file, however with the arduino sketch you linked it doesn't compile because there's not enough ram on the esp32-s2 to hold all the info the buffer (usb) at one time - so the the only way to overcome this is to use a chip with a larger ram buffer, or change the sketch do that it doesn't try and load everything into the buffer at once, mabey put in a while loop and read 512bytes at a time then send, clear the buffer and repeat until all the bytes are sent. That would probably work.

Also I sent an issue request on that github and the owner deleted it - so probably doesn't want to use it.

You can test like this to convert the image I posted above.
1: Rename as anything.bin and put in the same folder as this python script:

Code:

#!/usr/bin/python3
import os
import gzip
path = os.getcwd() #set path to the directory this script is running from


myext='.bin'

for filename in (fn for fn in os.listdir(os.curdir) if fn.endswith(myext)):
    if os.path.exists(filename.replace(myext, ".h")):
        os.remove(filename.replace(myext, ".h"))
    if os.path.exists(filename.replace(myext, myext + ".gz")):
        os.remove(filename.replace(myext, myext + ".gz"))

f = open(filename, 'rb')
filename = (filename).replace(myext, '')
bindat = f.read()
f.close()
f = gzip.open(filename + myext + ".gz", 'wb')
f.write(bindat)
f.close()
cnt = 0
cnt2 = 1
splitval = 1

tmpdat = "    {"

#with open(filename + myext + ".gz", 'rb') as f:
with open(filename + myext + "", 'rb') as f:
    chnk = f.read(1)
    cnt = 1
    while chnk:
        #if cnt == 31:
        if cnt == 16:
            cnt = 0
            tmpdat = tmpdat + "%s,\n    " % ord(chnk)
            #
            if cnt2 == (512/16):
                cnt2 = 1
                tmpdat = tmpdat + "},\n    {"
                tmpdat = tmpdat.replace(",\n    },","},")
                splitval = splitval+1
            #
            else:
                cnt2=cnt2+1
        else:
            tmpdat = tmpdat + "%s, " % ord(chnk)
        cnt=cnt+1
        chnk = f.read(1)
 
    print (splitval)

if tmpdat.endswith(","):
    tmpdat = tmpdat[:-1]

elif tmpdat.endswith(", "):
    tmpdat = tmpdat[:-2]

elif tmpdat.endswith(",\n"):
    tmpdat = tmpdat[:-2]
f.close()
 
f = open(filename + ".h", 'w+', encoding="utf-8")
f.write(tmpdat)
f.close()

When you run the script it will print a number at the end - that will be the amount of pages of 512 bytes - then just replace the outputed .h file with the code in exfathax.h (use an editor to do this) - sorry for the incomplete script but I just quickly made it for testing. When you try and compile - if you have verbose logging turned on in arduino ide - you will see the error about the ram being full and not having enough bytes to hold all the info, that's why you will need to make a loop to load it into the buffer. (you will maybe also see some issue with wifi libraries - just ignore that)

In the Arduino sketch you will need to edit this part of the code

Code:

#if defined(CONFIG_IDF_TARGET_ESP32S2) | defined(CONFIG_IDF_TARGET_ESP32S3)
static int32_t onRead(uint32_t lba, uint32_t offset, void* buffer, uint32_t bufsize){
  if (lba > 4){lba = 4;}
  memcpy(buffer, exfathax[lba] + offset, bufsize);
  return bufsize;
}

void enableUSB()
{
  dev.vendorID("PS4");
  dev.productID("ESP32 Server");
  dev.productRevision("1.0");
  dev.onRead(onRead);
  dev.mediaPresent(true);
  dev.begin(8192, 512);
  USB.begin();
  enTime = millis();
  hasEnabled = true;
}

This bit - "onRead", is reading the entire contents of the exfat image at once - that's why you have the error.

See here for using usb:
https://espressif-docs.readthedocs-hosted.com/projects/arduino-esp32/en/latest/api/usb_msc.html

and here:
https://github.com/espressif/arduino-esp32/blob/master/libraries/USB/examples/USBMSC/USBMSC.ino

You can send upto 4MB files with usb for updating firmware etc, so it shouldn't be an issue to mod the script to work with this image.

Info on ram allocation:
https://docs.espressif.com/projects/esp-idf/en/latest/esp32s2/api-reference/system/mem_alloc.html

Info on adding extra ram:
https://arduinojson.org/v6/how-to/use-external-ram-on-esp32/

An alternative way is to use less variables - example strip out the zero bytes from the exfat image, then generate them on the fly example:

Code:

#if defined(CONFIG_IDF_TARGET_ESP32S2) | defined(CONFIG_IDF_TARGET_ESP32S3)
static int32_t onRead(uint32_t lba, uint32_t offset, void* buffer, uint32_t bufsize){
  
  //memset(buffer, 0, 512);
  
  int bytefill = 512;
  char myhex[] = "\x00";
  int fillpages = 8;

  for (int i = 0; i < (bytefill * fillpages); i++) {
    memcpy(buffer + i, myhex, sizeof(myhex));
  }

  char part1[] = "\x20";
  char part2[] = "\x01";
  char part3[] = "\x02";
  char part4[] = "\x0A";
  char part5[] = "\x09";
  char part6[] = "\x55";
  char part7[] = "\xAA";
  char part8[] = "\x04";
  char part9[] = "\x05";
  char part10[] = "\x06";
  char part11[] = "\x07";
  char part12[] = "\x08";
  char part13[] = "\x0B";
  char part14[] = "\x82";
  char part15[] = "\x03";
  char part16[] = "\x10";
  char part17[] = "\xFF";
  char part18[] = "\x40";

  int zero = 0;

  char exfathax [] = {
     0, zero, 1, zero, 2, zero, 3, zero, 4, zero, 5, zero, 6, zero, 7, zero,
     8, zero, 9, zero, 10, zero, 11, zero, 12, zero, 13, zero, 14, zero, 15, zero,
     16, zero, 17, zero, 18, zero, 19, zero, 20, zero, 21, zero, 22, zero, 23, zero,
     24, zero, 25, zero, 26, zero, 27, zero, 28, zero, 29, zero, 30, zero, 31, zero,
     32, zero, 33, zero, 34, zero, 35, zero, 36, zero, 37, zero, 38, zero, 39, zero,
     40, zero, 41, zero, 42, zero, 43, zero, 44, zero, 45, zero, 46, zero, 47, zero,
     48, zero, 49, zero, 50, zero, 51, zero, 52, zero, 53, zero, 54, zero, 55, zero,
     56, zero, 57, zero, 58, zero, 59, zero, 60, zero, 61, zero, 62, zero, 63, zero,
     64, zero, 65, zero, 66, zero, 67, zero, 68, zero, 69, zero, 70, zero, 71, zero,
     72, zero, 73, zero, 74, zero, 75, zero, 76, zero, 77, zero, 78, zero, 79, zero,
     80, zero, 81, zero, 82, zero, 83, zero, 84, zero, 85, zero, 86, zero, 87, zero,
     88, zero, 89, zero, 90, zero, 91, zero, 92, zero, 93, zero, 94, zero, 95, zero,
     96, zero, 65, zero, 66, zero, 67, zero, 68, zero, 69, zero, 70, zero, 71, zero,
     72, zero, 73, zero, 74, zero, 75, zero, 76, zero, 77, zero, 78, zero, 79, zero,
     80, zero, 81, zero, 82, zero, 83, zero, 84, zero, 85, zero, 86, zero, 87, zero,
     88, zero, 89, zero, 90, zero, 123, zero, 124, zero, 125, zero, 126, zero, 127};
  
  memcpy(buffer + 73, part1, 1);
  memcpy(buffer + 80, part2, 1);
  memcpy(buffer + 84, part2, 1);
  memcpy(buffer + 88, part3, 1);
  memcpy(buffer + 92, part4, 1);
  memcpy(buffer + 96, part3, 1);
  memcpy(buffer + 108, part5, 1);
  memcpy(buffer + 110, part2, 1);
  memcpy(buffer + 510, part6, 1);
  memcpy(buffer + 511, part7, 1);
  memcpy(buffer + 524, part8, 1);
  memcpy(buffer + 528, part9, 1);
  memcpy(buffer + 532, part10, 1);
  memcpy(buffer + 536, part11, 1);
  memcpy(buffer + 540, part12, 1);
  memcpy(buffer + 544, part5, 1);
  memcpy(buffer + 548, part4, 1);
  memcpy(buffer + 552, part13, 1);
  memcpy(buffer + 1024, part14, 1);
  memcpy(buffer + 1044, part15, 1);
  memcpy(buffer + 1049, part16, 1);
  memcpy(buffer + 1054, part17, 1);
  memcpy(buffer + 1536, exfathax, 512);
  memset(buffer + 1791, 0, 258);
  memcpy(buffer + 2049, part18, 1);
  memset(buffer + 2051, 0, 1022);
  return bufsize;
}

Also there's an example here on how to update firmware via usb using callbacks - probably you could use most of the code in his example to replace what's in your sketch:

https://espressif-docs.readthedocs-hosted.com/projects/arduino-esp32/en/latest/api/usb_msc.html

marek256 · Sep 4, 2022

mrdude said:
Here you go people, I have created a better image file for your usb drives to replace exfathax.img.

This is better for the following reasons:

With exfathax.img there is an error dispalyed on the ps4 because the exfat file system doesn't exist and the ps4 can see that there is an error in the usb file system. I have created a new image which fixes this error and has a very tiny exfat partition only a few bytes, but stil shows up on pc without the need to format error. This also stops the usb error message showing up on the ps4. This should make booting into the hack easier.

To use - just use win32diskimager to write to the image to your usb drive. You can also create a partition on the existsing space on your usb drive and use that on the ps4 for installing pkg files.

I tried to post this on poobs4 github but there's no way to post on that page, so I'll release here and someone can pass it on.

Hello, I have tried it with ESP8266 method and it works nicely! No popup, so for me very good work. Thank you a lot

mrdude · Sep 4, 2022

FYI, for those using the Arduino sketch posted here:
https://gbatemp.net/threads/better-usb-image-for-ps4-hack.618293/post-9928463

If using the ESP32-S2, then the max your memcpy buffer will be able to store is 146 pages of 512 bytes = 74,752 bytes, anything larger than that will give you a compile error. For using a larger file for exfat hax probably you can store that in spiffs and then send to usb from that. I didn't try that though, maybe I am wrong.

Also I'm not sure why the creator of that sketch changed the ex-fat pico that's being sent to usb, to fix the sketch so exfat-pico is the same as the one on the net mod your sketch:

Code:

#if defined(CONFIG_IDF_TARGET_ESP32S2) | defined(CONFIG_IDF_TARGET_ESP32S3)
static int32_t onRead(uint32_t lba, uint32_t offset, void* buffer, uint32_t bufsize){
  if (lba > 13){lba = 13;}
  memcpy(buffer, exfathax[lba] + offset, bufsize);
  return bufsize;
}

And exfathax.h should be like this:

Code:

#if defined(CONFIG_IDF_TARGET_ESP32S2) | defined(CONFIG_IDF_TARGET_ESP32S3)
uint8_t exfathax[12][512] = {
    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 12, 0, 0, 0, 0, 0, 0, 0,
     1, 0, 0, 0, 1, 0, 0, 0, 2, 0, 0, 0, 10, 0, 0, 0,
     2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 9, 0, 1, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 85, 170},
    {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0,
     5, 0, 0, 0, 6, 0, 0, 0, 7, 0, 0, 0, 8, 0, 0, 0,
     9, 0, 0, 0, 10, 0, 0, 0, 11},
    {130, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 3, 0, 0, 0, 0, 16, 0, 0, 0, 0, 255, 0},
    {0, 0, 1, 0, 2, 0, 3, 0, 4, 0, 5, 0, 6, 0, 7, 0,
     8, 0, 9, 0, 10, 0, 11, 0, 12, 0, 13, 0, 14, 0, 15, 0,
     16, 0, 17, 0, 18, 0, 19, 0, 20, 0, 21, 0, 22, 0, 23, 0,
     24, 0, 25, 0, 26, 0, 27, 0, 28, 0, 29, 0, 30, 0, 31, 0,
     32, 0, 33, 0, 34, 0, 35, 0, 36, 0, 37, 0, 38, 0, 39, 0,
     40, 0, 41, 0, 42, 0, 43, 0, 44, 0, 45, 0, 46, 0, 47, 0,
     48, 0, 49, 0, 50, 0, 51, 0, 52, 0, 53, 0, 54, 0, 55, 0,
     56, 0, 57, 0, 58, 0, 59, 0, 60, 0, 61, 0, 62, 0, 63, 0,
     64, 0, 65, 0, 66, 0, 67, 0, 68, 0, 69, 0, 70, 0, 71, 0,
     72, 0, 73, 0, 74, 0, 75, 0, 76, 0, 77, 0, 78, 0, 79, 0,
     80, 0, 81, 0, 82, 0, 83, 0, 84, 0, 85, 0, 86, 0, 87, 0,
     88, 0, 89, 0, 90, 0, 91, 0, 92, 0, 93, 0, 94, 0, 95, 0,
     96, 0, 65, 0, 66, 0, 67, 0, 68, 0, 69, 0, 70, 0, 71, 0,
     72, 0, 73, 0, 74, 0, 75, 0, 76, 0, 77, 0, 78, 0, 79, 0,
     80, 0, 81, 0, 82, 0, 83, 0, 84, 0, 85, 0, 86, 0, 87, 0,
     88, 0, 89, 0, 90, 0, 123, 0, 124, 0, 125, 0, 126, 0, 127},
     {0},{0},{0},{0},{0},{0},{0},{0, 64}};
#endif

laz305 · Sep 14, 2022

Nakedfoxy said:
thank you.
what is the different between this one and that magic usb?

I tried this and it was impossible to keep it. It worked the first time and then I would continue following the steps and it wouldn’t work again. I gave up trying

Zullivan1987 · Sep 17, 2022

Thanks.

Zullivan1987 · Oct 2, 2022

Why this image don't work's whit sleep mode?

Zullivan1987 · Oct 2, 2022

Why this image don`t work`s whit sleep mode?

Xplaya · Oct 6, 2022

marek256 said:
Hello, I have tried it with ESP8266 method and it works nicely! No popup, so for me very good work. Thank you a lot

How did you do this with a ESP8266? So it basically works automatically?

lwiz · Oct 6, 2022

Zullivan1987 said:
Why this image don't work's whit sleep mode?

Works okay with sleep mode on OFW 9.00. Crashes maybe one time out of ten when returning from sleep, but I reckon it's problem with other images+HEN as well.

mrdude · Oct 6, 2022

Xplaya said:
How did you do this with a ESP8266? So it basically works automatically?

If you are using something like Lolin/Wemos D1mini, use this sketch from here:

https://github.com/stooged/PS4-Server-900u

Instead of using exfat or the pico usb images to flash onto your usb stick, use this usb image in the first post at the top of the page.

A cheaper way that doesn't require any usb drive or soldering is to use a esp32 s2 mini as this has usb host capabilities and you can use make a dongle like this:

https://gbatemp.net/threads/show-us-your-dongle.618895/

And flash it with this:
https://gbatemp.net/threads/exfathax-h-no-error-fix.619514/#post-9949426

mrdude · Oct 6, 2022

lwiz said:
Works okay with sleep mode on OFW 9.00. Crashes maybe one time out of ten when returning from sleep, but I reckon it's problem with other images+HEN as well.

When your ps4 wakes up from sleep it re-enables usb, however as you're not visting the web page/user guide pages when you do this, the usb hack is not sent as it's not being called, so it's most likely an issue with the hack that's in the ps4 memory getting corrupted when the ps4 wakes up rather that anything to do with a usb image itself.

Jayro · Oct 13, 2022

I have an ESP8266, a Pi Zero, and a Arduino Leonardo board.

Can I use any of these to hack my PS4 Pro on the latest firmware? I like getting my free monthly games and all that.

mrdude · Oct 13, 2022

Jayro said:
I have an ESP8266, a Pi Zero, and a Arduino Leonardo board.

Can I use any of these to hack my PS4 Pro on the latest firmware? I like getting my free monthly games and all that.

Is this a troll post ?

nubie · Dec 22, 2022

I just flash my flashdisk with this imagehack , is this right ?

mrdude · Dec 22, 2022

nubie said:
I just flash my flashdisk with this imagehack , is this right ?

View attachment 343880

You flash your usb drive with it, the remaining space on the drive can be partitioned and formatted with any file system you want and you can use that in windows or any other OS for other stuff. You should then have 2 partitions - 1 with the USB hack which is very small, the other for whatever you want such as storing games or whatever.

Hacking Better USB Image for ps4 hack.

Developer

Attachments

Well-Known Member

Member

Developer

Active Member

Developer

Active Member

Developer

Well-Known Member

Member

Member

Member

Member

Well-Known Member

Developer

Developer

MediCat USB Dev

Developer

Well-Known Member

Developer

Similar threads

Popular threads in this forum