NOR Studio — PS5 NOR & UART Toolkit

Dump

Open a 2 MB NOR dump (.bin / .BIN). Your original file is never modified — edits are saved as a new file.

Drop a NOR dump here

or click to browse · Ctrl+O

What you can do here

✓
Read serial, motherboard serial, SKU, region, board, MACs, firmwarePlus active slot, IDU flag and hashes (MD5 / SHA-256)
✓
Switch between Disc and Digital editionPatches are confined to the NVS area, with a full byte diff before saving
✓
Change serial number and model/SKULength and character checks prevent silent corruption
✓
Compare two dumps field by field

CH341A programmer

Read the NOR straight into the editor, then write your patched dump back. Only the 4 KB sectors that changed are rewritten, and everything is verified.

Read

Dumps the whole chip. Reading twice and comparing catches a loose clip before you trust the dump.

Read twice & compare

Write

Load or read a dump first. If you've made edits in the NOR Editor, the patched version is what gets written.

Verify whole chip after writing

Progress

Idle

Before you start

⚡
CH341A must have the 3.3 V modStock black CH341A boards output ~5 V on CS/MOSI/CLK. Measure the pins to GND before clipping on — ≈3.3 V is OK, ≈5 V is not.
!
Check the chip voltageEDM-010/020 use a 3.3 V Winbond W25Q16JV (no adapter needed). Otherwise read the marking: MX25U…, W25Q…W and GD25LQ… are 1.8 V parts and need a 1.8 V adapter — a plain CH341A drives 3.3 V (some cheap boards 5 V). NOR Studio also flags 1.8 V chips it detects.
!
Wiring without a clip?MISO goes to the chip's DO (pin 2) and MOSI to DI (pin 5); they're not crossed like UART. Open the CH341A wiring guide.
!
Board fully unpoweredUnplug AC before clipping on. Pin 1 of the clip goes to the dot on the chip.
!
Windows needs the WinUSB driverOnce: run Zadig → Options → List all devices → pick the CH341A ("USB-EPP/I2C… CH341A") → WinUSB → Replace driver. See Help for details.

Connection

USB-TTL adapter (CH340, CP2102, FT232…) wired to the PS5 UART pads at 3.3 V.

Baud rate

Error log

Reads every slot until the console reports the end of the log (FFFFFFFF).

Hide duplicates

Connect and read the log to see codes here.

Terminal

Append checksum automatically ↑ / ↓ for history

Tips

⚡
3.3 V logic onlySet FT232R/CH340/CP2102 jumpers to 3.3 V. A black CH341A used for UART needs the 3.3 V mod. Connect TX, RX and GND only, never VCC.
!
UART can't read or write the NORUART only talks to the console for error codes. Dumping or flashing the NOR needs the programmer clipped onto the NOR chip itself (Programmer tab).
!
No response? Swap TX and RX first.Then confirm common ground, 3.3 V logic and that fuse F7003 isn't blown.
!
Separate standby from power-on faultsClear the log, unplug for 5 s, plug in without powering on, wait 10 s, read. Then press power once and read again.

Error code database

0 codes

Update

No database yet.

Source

Import accepts the old errorDB.xml from PS5 NOR Modifier, Console Service Tool's ErrorCodes.json, or a CSV of code,description.

Your notes

Add your own fix notes to any code. They show up next to the code when you read the log.

Hardware guide

Where the NOR and UART points are, how to wire them, and whether you need to remove the chip. EDM-010/020 details come from Sony's board service manuals (CFI-1000/1100 series). Always confirm with a multimeter before connecting anything.

NOR chip IC5001

Winbond W25Q16JVSNIM: 2 MB, 3.3 V, SOIC-8. Top side (Side A), right next to the southbridge (IC5006). The same part is used on EDM-010 and EDM-020.

UART test pads JL5101–JL5110

Bottom side of the board, just below a metal shield can. A small black ribbon connector sits on the left and a white 3-pin connector on the right. The layout below is as you see it on the board, and it matches the service manual rotated 180°.

PS5 pad (right-hand column)	Signal	Adapter pin
JL5109 · top	GND	GND
JL5105 · middle	SSB_UART0_TX (console talks)	RX
JL5104 · bottom	SSB_UART0_RX (console listens)	TX
JL5101	3.3 V standby, right next to GND: measure only	do not connect

The right-hand column is GND / TX / RX from top to bottom. That matches the reference photo in Console Service Tool. The schematic shows no net on JL5109, so confirm it has continuity to ground before you use it. "FC" pads belong to the SSD controller.

1 · Read error codes (UART)

Adapter on 3.3 V (FT232R jumper to 3.3 V; CH341A needs the 3.3 V mod).
Find the pads: with AC plugged in and the console off, JL5101 should read ≈3.3 V to ground, and JL5105 (TX) ≈3.3 V idle.
Unplug AC. Solder thin wires: JL5105→RX, JL5104→TX, JL5109 (or any ground)→GND. Never connect VCC or JL5101.
Plug AC back in (standby only) → UART tab → Connect → Read error codes.
No reply? Swap TX/RX first, then check fuse F7003 and the NOR.

2 · Dump / flash in-circuit

AC unplugged, battery-backed rails discharged (wait a minute).
3.3 V-modded CH341A, SOIC-8 clip on IC5001, pin 1 to pin 1. No 1.8 V adapter for this chip.
The clip also powers the 3.3V_SS rail that feeds the southbridge. If reads are unstable, hold JL5110 (/SSB_RESET) to GND with a wire while reading/writing so the southbridge stays off the SPI bus.
Programmer tab → Connect → expect EF 40 15 (Winbond W25Q16JV). Read with "read twice" on.
Save the backup, edit, then Write. It rewrites only changed sectors and verifies.

3 · If in-circuit won't work

Symptoms: ID reads 00 00 00/FF FF FF, or the two reads don't match even after reseating the clip and grounding JL5110.
Lift pin 8 (VCC) only and power the chip from the clip. This isolates the rest of the rail.
Or chip-off: hot air, put the chip in an SOP8 socket/adapter, read and write, then solder it back in the same orientation.
Chip-off is the most reliable method and the one most repair guides use. In-circuit is quicker when it works.

UART pads EDM-030/031/033

A cluster of round pads near the edge of the board, below a black connector, with fuse F5402 printed to the right. The layout below is from the Console Service Tool reference photo.

PS5 pad	Adapter pin
Top row, 1st (left)	GND
Top row, 3rd	RX (PS5 TX)
Second row, 3rd	TX (PS5 RX)

Reference photo: Console Service Tool, EDM_03x_UART.png. No EDM-03x schematic is included here, so check TX (≈3.3 V idle in standby) and GND (continuity) with a meter.

NOR on EDM-03x

No EDM-03x schematic is included here. Look for the 8-pin flash chip next to the southbridge, as on the launch boards.
Read its marking before clipping on. 25Q16JV means 3.3 V (CH341A with the 3.3 V mod). 25U…/…W means 1.8 V (add a 1.8 V adapter).
The Programmer tab identifies the chip and its voltage from the ID. Read twice; if the reads are unstable, lift pin 8 or remove the chip.

Wiring a CH341A straight to the chip

For when you're not using the SOIC-8 clip or the SOP8 socket adapter: wires soldered to the NOR's legs, a chip-off on a breakout, or a clip that won't fit. Applies to every PS5 board covered here, since they all use the same Winbond W25Q16JV.

CH341A label	Flash pin	Why
CS	1 /CS	Chip select. Same name both ends.
MISO	2 DO / SO	Data from the chip out to the programmer in.
MOSI	5 DI / SI	Data from the programmer out to the chip in.
CLK	6 CLK	Clock. Also printed SCK or SCLK.
GND	4 GND	Connect this first.
VCC 3.3 V	8 VCC	Only when the board is unplugged. On a powered board, leave this wire off (see below).

Why the names don't match

SPI is named from the programmer's side. MISO means "master in, slave out", so it connects to the chip's output, DO. MOSI means "master out, slave in", so it connects to the chip's input, DI.
Don't cross them like UART. In UART, TX goes to RX. In SPI, the names already account for direction: MISO→DO and MOSI→DI, never MOSI→DO.
Other names you'll see: DO = SO = IO1 = Q · DI = SI = IO0 = D · CS = CE# = SS · CLK = SCK = SCLK. Some programmer boards print DO/DI instead of MISO/MOSI, and vendors disagree on whether that's the programmer's own data out or the flash pin it goes to. Wire it one way and check the chip ID; if it reads FF FF FF or 00 00 00, swap those two wires and try again.
/WP (pin 3) and /HOLD (pin 7): on the board they're already pulled up to 3.3 V, so leave them alone in-circuit. On a chip-off with loose wires, tie both to VCC (pin 8), or writes fail and reads can stall.

Before you power anything

⚡
CH341A with the 3.3 V modStock black boards put ~5 V on CS/MISO/MOSI/CLK. Measure each signal pin to GND first: ≈3.3 V is OK.
!
Pick one power source, never bothUnplugged board: the programmer's 3.3 V powers the chip. Powered board: the console powers it and the 3.3 V wire stays off. See "Two ways to power the chip" below.
!
Short, equal wiresKeep them under ~15 cm and roughly the same length; twist GND alongside CLK if you can. Long or loose wires are the usual cause of "two reads don't match".
!
Find pin 1 by the dotPins 1–4 run along the dot side, 5–8 come back along the other side (pin 8 is opposite pin 1).

Check your wiring with the app

Programmer tab → Connect. A correct hookup shows EF 40 15 · Winbond W25Q16JV, 3.3 V.
FF FF FF: MISO isn't reaching DO, or CS isn't connected. Check MISO→pin 2 and CS→pin 1.
00 00 00: the chip isn't powered or GND is missing, or MOSI/MISO are swapped. Check VCC→pin 8, GND→pin 4, and MOSI→pin 5.
Odd values like 7F BF 0A, or a changing ID: a loose wire or a clock problem. Shorten the wires and re-solder CLK→pin 6.
Then read with "read twice". Matching reads mean the wiring is solid enough to write.

Two ways to power the chip

The NOR needs 3.3 V from exactly one source. Which one decides whether you connect the programmer's VCC wire.

Recommended Board unplugged, programmer powers the chip

AC unplugged. Connect all six wires, including VCC 3.3 V → pin 8.
The programmer also back-feeds the standby rail the chip shares with the southbridge. If reads are unstable, ground JL5110 (/SSB_RESET) on EDM-010/020, or lift pin 8, or remove the chip.
This is the only method to use on EDM-03x and EDM-04x, where the southbridge reset point isn't mapped.

Advanced Board powered in standby, programmer doesn't

Connect CS, MISO, MOSI, CLK and GND only. Do not connect the programmer's 3.3 V wire: the console's standby rail already powers the chip, and two supplies on one rail can damage the programmer, the chip or the board.
In standby the southbridge is awake and also drives these same SPI lines. Unless it's held in reset, reads come back garbled and a write can corrupt the NOR. On EDM-010/020, hold JL5110 (/SSB_RESET) to GND for the whole read/write.
Plug AC in only after the wires (and the reset jumper) are in place, keep the console off (standby, not powered on), and unplug AC before removing anything.
Not for EDM-03x/04x until a reset point is confirmed. Use the unplugged method there.

NOR chip EDM-041

Winbond W25Q16JV (marked 25Q16JVNIM): 2 MB, 3.3 V, SOIC-8, chip ID EF 40 15. It's the same part as the launch boards. It sits right of the southbridge (SIE CXD90069GG), with a column of 8 small resistors between them.

Dump / flash on EDM-04x

Same 3.3 V chip as the launch boards: a 3.3 V-modded CH341A, no 1.8 V adapter.
AC unplugged. Clip on with the red wire on pin 1 (the dot). Programmer tab → Connect → expect EF 40 15, "Winbond W25Q16JV".
Read with "read twice" on. If the ID reads 00 00 00/FF FF FF or the reads don't match, the board is probably loading the clip's power. The EDM-04x reset point isn't mapped here, so lift pin 8 or take the chip off and use an SOP8 adapter.
Save the backup before editing. Disc ↔ Digital switching is disabled for Slim dumps; serial/SKU edits and the health check work.

UART pads EDM-040/041/044 and later

A cluster of 10 round pads near the curved board edge by the fan cut-out. A metal screw bracket and the two WiFi antenna cables (blue and white) are just above and to the right. A long ribbon connector runs below.

Wiring

PS5 pad	Adapter pin
Middle row, 1st (left)	RX (PS5 TX)
Middle row, 2nd	TX (PS5 RX)
Bottom row, 3rd	GND

Adapter at 3.3 V (FT232R jumper; a CH341A needs the 3.3 V mod). Never connect VCC.
Before soldering, check with AC in and the console off: PS5 TX ≈3.3 V idle, GND has continuity to a screw hole.
UART tab → Connect. Unplug AC, wait 5 s and plug it back in. You should see the "UART CMD READY" banner and the PS5 detected badge.
If the TX/RX voltage drops a lot once the adapter is wired, recheck the adapter's voltage and ground before going further.

Pinout from a community reference photo (TX → RX CH341, RX → TX CH341, GND). No EDM-04x schematic is included here, so confirm each pad with a meter.

Slim boards (EDM-040/041/044)

!
No official schematic or boardview in this guideThe NOR and UART points above come from photos. The pinouts and pad maps for EDM-010/020 do not carry over. Treat everything here as "verify first".
✓
The UART protocol is the sameSame 115200 baud and errlog commands. The UART tab works unchanged once you've found TX/RX/GND.
✓
Dumps are still 2 MBReading, backups, serial/SKU edits and health checks work. Disc↔Digital switching is disabled for Slim dumps (single edition flag).

Finding the points yourself

NOR: confirmed on EDM-041 as a 3.3 V Winbond W25Q16JV next to the southbridge (see above). On other revisions, read the marking: 25Q16JV/W25Q…V means 3.3 V; 25U…/W25Q…W/GD25LQ means 1.8 V (add a 1.8 V adapter). The Programmer tab also flags the voltage from the chip ID.
UART: look for a cluster of small round test pads near the southbridge on the underside. In standby (AC in, console off), TX idles ≈3.3 V. RX is usually also pulled up. Check GND with continuity.
Connect TX→RX and RX→TX with the adapter at 3.3 V. If the line voltage drops sharply when you connect, stop and recheck the adapter and pads.
The UART pad map is above. Other community maps exist on repair forums (e.g. TronicsFix "EDM-041 UART hook up"). Always confirm with a meter.
If you get an EDM-04x board service manual or boardview, send it over and the exact points can be added here.

Getting started

Browser

UART uses the Web Serial API, available in desktop Chrome, Edge, Opera and other Chromium browsers. Firefox and Safari can still use the NOR editor and database. Save this page and open it straight from disk — no install, no admin rights, works offline once the database is downloaded.

⚡ CH341A voltage (read this first)

Most of the common black CH341A boards put about 5 V on their signal pins even with the 3.3 V supply selected. That can damage the NOR chip or the PS5's southbridge. Before using a CH341A on a PS5, either as an SPI programmer or as a UART adapter, it needs the 3.3 V mod. Check yours with a multimeter: plug it into USB with nothing else attached and measure from GND to CS/MOSI (or TX in serial mode). About 3.3 V is safe, about 5 V is not. 1.8 V NOR chips (MX25U…, W25Q…W, GD25LQ…) additionally need a 1.8 V adapter.

UART and the programmer do different jobs. UART (the pads near the southbridge) reads and clears error codes; it cannot read or write the NOR. Dumping/flashing needs the programmer clipped onto the NOR chip itself. On CH341A boards that have a mode jumper, it switches the board between programmer mode and serial (UART) mode.

CH341A programmer setup

Windows: browsers can only talk to the CH341A through the generic WinUSB driver. Do this once: download Zadig (zadig.akeo.ie), plug in the CH341A, choose Options → List All Devices, select the CH341A entry (USB ID 1A86 5512, often shown as "USB-EPP/I2C… CH341A"), pick WinUSB and click Replace Driver. Replug it. Note: NeoProgrammer needs the original CH341PAR driver — to go back, uninstall the device in Device Manager (tick "delete the driver") and reinstall CH341PAR.

Linux: add SUBSYSTEM=="usb", ATTR{idVendor}=="1a86", ATTR{idProduct}=="5512", MODE="0666" to /etc/udev/rules.d/99-ch341a.rules, then sudo udevadm control --reload and replug. macOS: works as-is.

Workflow: Programmer tab → Connect → check the detected chip and voltage → Read chip (it lands in the NOR Editor) → Save backup → edit in the NOR Editor → back to Programmer → Write to chip. Writing re-reads the chip, saves a backup automatically, rewrites only the changed 4 KB sectors and verifies.

Other programmers: XGecu T76 — read/write with Xgpro and open the .bin here for editing. The FT232R is a UART adapter (set its jumper to 3.3 V) — use it in the UART tab.

UART adapter driver

If your adapter doesn't appear in the port picker, install its USB-serial driver (CH340/CH341, CP210x or FTDI) and replug it.

Why did the old app say "database download error"?

PS5 NOR Modifier fetched its database from http://uartcodes.com/xml.php. That plain-HTTP endpoint no longer serves the database reliably, and the app swallowed the real error. NOR Studio pulls from a maintained HTTPS source, caches the result in your browser, and lets you import a file if you're offline.

UART protocol

Commands are sent as command:XX, where XX is the sum of the command's character codes, masked to one byte, in hex. For example errlog 0 becomes errlog 0:BA. Replies start with OK or NG; the third field of an OK reply is the error code.

NOR edits

Edition, serial and SKU live in the NVS area (0x1C4000–0x1D0000). NOR Studio only patches inside that area, shows every byte it will change, and never touches your original file. Serial, motherboard serial, WiFi and LAN MAC are paired with the console's hardware — keep the matching set together.

Shortcuts

1–6 switch tabs · Ctrl+O open dump · Ctrl+S save patched dump · / search error codes

Credits & disclaimer

Part of this tool's code and logic comes from PS5 NOR Modifier by TheCod3r (GPL-2.0): the NOR offsets, edition flags, UART command format and checksum. It was rebuilt and extended with the help of AI assistance. Improvements, extra features and ideas by The Goat Tech.

NOR offsets cross-checked against ps5-wee-tools by andy-man (GPL-3.0). Default error code source, error-log field meanings, OS flag layout and UART reference photos: Console Service Tool by amoamare. Hardware guide details for EDM-010/020 come from Sony's board service manuals.

This software is provided as-is, without warranty of any kind. Modifying or flashing a NOR can permanently damage a console. You use it at your own risk. Unofficial tool, not affiliated with or endorsed by Sony Interactive Entertainment. PlayStation and PS5 are trademarks of Sony Interactive Entertainment.