PS5 NOR Editor
See through the whole chip.
Reads a 2 MB PS5 NOR dump, edits the per-console data with validation, repair and many more features!
Key features
The whole chip, validated
- Reports the share of the chip it read
- A verdict per partition
- Unexamined is never green
- Every verdict names its evidence
- Known builds checked byte for byte
Recovery on the surviving bits
- A NOR write only clears bits
- The surviving bits constrain the answer
- Lists the values still possible
Repair and regenerate
- A row per finding, nothing applied unseen
- Each names the source of its value
- Rebuild a whole partition from a donor
- Console identity restored before any write
What the EMC recorded
- 64-slot EMC error ring, dated
- Events and incident traces
- Power state, wake cause, temperatures
- Southbridge revision identified
Identity, and a donor
- Every field that identifies the console
- Region and board revision, decoded
rndgenerates a conforming value- Load a donor and harvest selected fields
Nothing is written unseen
- The source file is never overwritten
- Apply, then Save as — a new file
- Every byte listed first
- Validation runs on the pending edits
- Any change can be reverted
What the chip holds
2 MB NOR0x0000002 097 152 bytesEleven partitions, in scale except the four 4 KB blocks at the head. Point at one.
nvs is 2.3 % of the chip and holds everything that identifies the console.What each tab does
Come on, it’s interactive — pick a tab
PS5 NOR Editor
MD5WHOLE DUMP, AS EDITED
Everything that identifies the console, on one grid: serial, motherboard serial, Kiban, board id, SKU, SoC UID, the MACs and their checksum, model, firmware and boot slot.
Type a value, roll a valid one with rnd, or take the donor's with ← once one is loaded. Tick the fields you want and Harvest selected brings over just those.
Nothing reaches the buffer until Apply edits, and nothing reaches a file until Save dump as...
File Name dump.bin Size 2 097 152 bytes MD5 3fa9c1b0... Console stats Powered on 1 284 Time alive 213 d 04:12 Fatal errors 2 NOR map emc_ipl_a 0x004000 504 KB nvs 0x1C4000 48 KB SLB2 emc_ipl_a 2 entries, signature present
Read-only, and the first place to look. What the file is, what the console is, and the checks that either pass or do not.
Console stats is the EMC's own running total, not something the program worked out: power-ons and offs, time alive, AC detect failures, fatal errors, recoveries.
Then the magic checks, the MBR and its loader, the NOR map, the four SLB2 containers, and the byte shares under Entropy.
| Slot | Date | Code | SeqNo | PowState | UpCause | T(SoC) | T(Env) |
|---|---|---|---|---|---|---|---|
| 00 | 2024-11-03 21:14 | 80810001 | 1042 | S0 | PowerBtn | 52 | 31 |
| 01 | 2024-11-03 21:16 | 80810001 | 1043 | S0 | PowerBtn | 54 | 31 |
| 02 | 2025-01-18 09:02 | C0000001 | 1210 | S5 | ACIn | 28 | 24 |
| Source | Date | Detail |
|---|---|---|
| unk events | 2025-01-18 09:02 | power-on, AC detect |
| unk trace | 2025-01-18 09:02 | incident record, 3 frames |
Ctrl+C copies the selected rows, or the whole table when nothing is selected. Right-click for the codes on their own.
The three logs the EMC keeps, decoded and dated: the 64-slot error ring in nvs, and the events and the incident traces in unk.
Every row carries the code, the sequence number, the power state and what caused the last power-up, and the two temperatures the EMC read at the time.
Read-only and copyable, with the codes available on their own — the form you would paste into a search.
| Level | Check | Where | Size | Message |
|---|---|---|---|---|
| DANGER | mbr.copies | 0x002000 | 4 KB | MBR1 and MBR2 disagree at 12 bytes |
| WARNING | nvs.record.crc | 0x1C6820 | 64 B | record checksum does not match its body |
| OK | struct.reserved | 0x1D0000 | 192 KB | erased, as on a healthy chip |
| OK | slb2.emc_ipl_a | 0x004000 | 504 KB | container walks clean |
A structural walk of the chip, from the two MBR copies to the last erased span of the tail.
Every verdict names where it looked, how much it read, and the evidence behind it. A finding that cannot show its working does not get printed.
Advisory by design: a save is never blocked. The program says what it found and leaves the decision where it belongs.
| Finding | Where the value comes from | Now | Proposed | |
|---|---|---|---|---|
| mbr.copies | the other copy in this dump | 12 bytes differ | MBR1 ← MBR2 | Apply |
| nvs.record.crc | recomputed from the record body | 0x4C1A | 0x9E33 | Apply |
| struct.const | constant across the reference dumps | 0x00 | 0xFF | Apply |
One row per finding that can actually be answered, each naming where its value would come from before you decide anything.
Group A is the dump answering for itself: a mirrored copy, a checksum recomputed from the body it covers. It writes on the click, because nothing outside the file is being trusted.
Group B is a value that holds across the reference dumps. It asks first, every time.
A NOR write only clears bits, so the original value must carry every bit that survived. That is a hard filter. serial damaged at 3 of 17 bytes still possible 4 characters, on the surviving bits alone ruled out every value whose bits do not cover what is left
A write to NOR flash can only turn a bit off. Whatever damaged a field could not have set a single bit, so the original has to carry every bit still standing.
That turns guesswork into a filter: the tab lists the values still physically possible and rules out the rest on the bits alone.
It applies nothing. A value that survives the check goes to Repair, where writing it is a second, deliberate click.
nvs damaged unk n/a Donor found. The identity of this console is put back from the file in front of you before a single byte is written.
When a partition is too far gone to repair field by field, this rebuilds it whole against the server.
nvs is synthesised from patterns derived across many dumps; the other partitions come from a sanitised reference dump. What comes back is not written as it arrives — every field that identifies your console, and the volatile EMC log banks with them, is taken from your own dump first. Only then is the result offered.
The tab lists which partitions are damaged and which one the server can answer for, so a click is never a surprise.
Firmware
Flags
The experiments, one row each: the southbridge revision the firmware is told to expect, the IDU kiosk flag, and which slot the EMC boots from.
Every row shows what the dump says now before it offers to change it, and the ones that carry a consequence say so in their own words rather than in a dialog you learn to dismiss.
Applied one at a time, and listed in Changes like every other write.
3 change(s) pending 0x1C4020 serial 43 45 30 30 -> 43 45 31 32 0x1C4820 wifi_mac A0 B1 C2 D3 -> A0 B1 C2 FF 0x002000 mbr1 12 bytes -> from MBR2
Every byte this session would write, listed before you save: the offset, the field, what is there now, and what would replace it.
It does not matter which tab put a change here — an edit, a repair, a patch, a regenerated partition. They all land on this one list, in the same form.
The file on disk stays untouched until Save dump as..., and that proposes a new file rather than the dump you opened — keep a copy of the original all the same.
Licence
Status Active Expires 2027-03-14 Key A1B2-... Last check just now This computer 9f3c1a20b7d4
Light or dark and the font size, whether the window and the last folder come back where you left them, and whether a .txt report is written beside a saved dump.
The licence section says what state the key is in, when it runs out, and which computer is holding the seat — the two lines to quote if you ever have to write in.
Last of all, where the settings file lives, and a button to move it.