Dump PS4 SPI Flash rom with Teensy 2.0++

Consoles / Leave a Comment

This is hopefully a one-stop guide on how to get the Teensy 2.0++ board to read/write your PS4 SPI flash.

The following guide was written by Thomas Ng, for console repair tips please join the facebook group Game Console Repair Legion

Clearly I’m not the first to present this information, but for those that like to have all the info in one place, this guide should cover that.

I bought the Teensy 2.0++ back in January 2021. Time to do something with it. I’ve been using my TotalPhase SPI bus analyzer for most of the work over the past year, but the device doesn’t support the latest SPI flash from Spansion/Cypress Semi.


Much more information can also be found online. Google is your friend. For those of you that are more visual learners, check out Andrew Paul’s YouTube video that covers the hardware setup as well. https://www.youtube.com/watch?v=O612Mtz43OI

This guide does not cover disassembly of the console, how to desolder the SPI flash, or hooking up the UART to the console.

Some of that information is covered in my previous writeup: https://www.facebook.com/…/79890…/posts/1669911543203561

1. Buy a Teensy 2.0++ development board from PJRF/Amazon/eBay – https://www.pjrc.com/store/teensypp.html

BE SURE TO DO THIS STEP BELOW. The SPI flash operates at 3.3V logic; the absolute max input voltage is around 3.6V.

If you plug in your SPI flash to 5V, you may damage the device and that PS4 you are trying to fix becomes an expensive door stop.

2. Modify the Teensy board to operate on 3.3V instead of 5V on the power pin next to the USB connector. The backside of the Teensy has a pad location for a 5V to 3.3V LDO.

Solder the LDO onto the back of the Teensy. If you are looking at the part with the “tab” facing “north”, the “tab” is ground. Left is 5V (input), middle is ground, and right is 3.3V (output)

3. You will also need to also modify the back of the Teensy to support the LDO mod.

  • Look at the back – You will see three exposed pads – one pad says 5V, an unlabeled middle pad, and the other says 3V.
  • Look under the microscope – there is a very small trace connecting the “5V” pad to the middle – cut that trace.

Information about it from the vendor site is here: https://www.pjrc.com/teensy/3volt.html

4. Add a solder blob between the middle pad and the “3V” pad.

5. Use wire and wire up Pads B0 through B6, the “5V” pin and “GND” pin. If you don’t have wires already, something like these wires on Amazon will work and allow you to easily remove the SPI flash from your adapter: https://www.amazon.com/gp/product/B01EV70C78/

Of course, you can also use whatever wire is convenient for you.

6. Plug in the Teensy via the USB cable. Measure the “5V” pad to make sure it is really 3.3V. If you get something odd, or it reads 5V still, then recheck your work from above.

7. Download the Teensy loader application. This will be used to load the correct programming on to the Teensy microcontroller for SPI flash control. https://www.pjrc.com/teensy/loader.html

8. Download SPIWay and unzip the contents. You should see a Python script and a hex file. Version 0.50 is linked below. https://playstationhax.xyz/…/6269-released-spiway-v050…/

9. Connect your Teensy to the computer with a Micro USB cable.

10. Run the Teensy loader application. The program will instruct you to “Press button on Teensy to manually enter Program Mode” – do that.

11. The image in the loader application should change.

12. Go to File –> Open HEX file. Navigate to where you downloaded SPIWay v0.50 and select the hex file. Click Open.

13. Go to Operation –> Program. programming should take a second. A “Download complete” message will appear when done.

14. Close the Teensy loader app.

15. Disconnect the Teensy from USB.

16. Wire up your SPI flash to the Teensy. The pinout is shown in the listing below for a WSON8 package. For reference, the connections are: https://www.psdevwiki.com/ps4/SPIway

WSON8 pinout:
SPI Flash Pin # — Teensy I/O
1 Chip Select (CS#) – B0
2 Serial Out (SIO1) – B3
3 WP# /SIO2 – B4
4 Ground – GND
5 Serial In (SIO0) – B2
6 Serial Clock (SCLK) – B1
7 Reset#/SIO3 – B6
8 VCC – “+5V” pad (that is now operating as 3.3V because we modded the board)

Note that “B5” is not used on the WSON8 SPI flash. “B5” is SIO3 on the larger 16 pin Macronix MX25L25635FMI-10G flash.

17. Connect the Teensy USB port to your computer. Check Device Manager and see which COM port this enumerated as. In my example – COM3. Replace “COM3” with the COM port number that shows up on your setup.

NOTE: I assume you already have Python installed. I have version 2.7.18. If not, you can download it from: https://www.python.org/downloads/windows/

18. In the SPIWay folder, open a command window. And type the following. This will get the SPI flash device vendor, part number and parameters. If the output here results in an error, something isn’t hooked up properly:

python spiway.py COM3 info

In my case, the SPI flash is a Spansion S25FL256. Looks sane.

19. Dump the flash. You’ll want to do this twice (we’ll compare them). Use a useful file name – maybe something that uses the board serial number or unique identifier that you use at your shop so you don’t get them mixed up. The SPI dump should take ~3 minutes in quad SPI mode.

python spiway.py COM3 dump c:\mg395720286_dump1.bin
python spiway.py COM3 dump c:\mg395720286_dump2.bin

20. Run a binary compare on both files – make sure they are the same.

21. Patch with BwE NOR validator See this post:

22. Erase, write the PATCHED spi flash back to the board and verify with “vwrite” –

python spiway.py COM3 erasechip
python spiway.py COM3 vwrite c:\mg395720286_dump1_uart_patched.bin

23. Reinstall the SPI flash on to the console; then proceed to wiring up the UART pins. Examine the output and hopefully that tells you something useful.

Must Read