Well I did a deep dive of the viewable part of the ps4 firmware. Some of this is public some is not. I got to wondering what exactly does the ps4 report back to Sony and apparently a lot:
Let me pull the current findings doc together so these lists are complete and accurate.
The doc matches what we've built. I have everything I need to consolidate. Here are the three lists.
1. What it sends back to Sony
On every telemetry event, regardless of Limited/Full (the mandatory environment):
Store/commerce events (need sign‑in, so won't fire on your account‑free unit):
Destinations: smetrics/metrics.aem.playstation.com (Adobe), mcrevents.api.playstation.com and event.api.*.km.playstation.net (Kamaji/Clairvoyance). Plus, at the system level: update checks, time sync, connection/status checks, and DNAS console authentication — all of which expose your IP and MAC regardless of account.
2. Everything it records (on‑device)
System Logger (system_log.db) — per queued event: event ID, timestamp, session ID, number of users, up to 4 PSN account IDs, up to 4 local user IDs, firmware version, config version, create/update/delivery times, and up to 99 parameters.
Second logger (sl2_log.db) — per entry: event type, client ID (which subsystem), the Limited/Full setting at capture time (ws1_setting), log type/data type, created/tried‑to‑deliver times, retry count, and the raw log payload.
Delivery stats (sl_performance.db): counts of inserted/success/failure/dropped, HTTP timing, retry histograms, last error/HTTP status.
Config state (tbl_status, fetched from Sony and merged): config version, last config check, last merge — i.e., the event list itself is server‑controlled and can change without a firmware update.
Other local records: media‑gallery metadata (per up to 20 accounts), browser history/bookmarks (empty templates on a fresh unit), per‑title workaround matching, and a stored npGeoLocation value. The system logger also keeps records for local (non‑PSN) users and for no user — the account field just stays 0.
3. What can differ between firmware versions and give the real version away
This is the fingerprint surface — the signals that would reveal a console's true firmware even if something claimed otherwise. I'm listing what identifies the version; I'm not getting into altering these:
Explicit version strings it transmits/stores:
Behavioral / implicit tells:
Confirmed changes 6.72 → 7.00
Let me pull the current findings doc together so these lists are complete and accurate.
The doc matches what we've built. I have everything I need to consolidate. Here are the three lists.
1. What it sends back to Sony
On every telemetry event, regardless of Limited/Full (the mandatory environment):
- OpenPSID — the per‑console identifier
- System software (firmware) version
- Hashed PSN account ID (only if an account is signed in — on your console, blank)
- Console model (PS4 vs PS4 Pro)
- Account locale: language + country
- Network type (Wi‑Fi / wired)
- Screen resolution
- PS Plus status, PS Now membership status
- App name + build, and your current privacy setting itself (Limited/Full)
Store/commerce events (need sign‑in, so won't fire on your account‑free unit):
- Purchases: product name, SKU, price, currency, transaction ID, payment method by brand (Visa/Amex/PayPal/etc.), pre‑orders, coupons/vouchers, wallet top‑ups
- Browsing: search terms as typed, which result you clicked, filters, sort order, how you found an item
- Pages/screens visited, tiles/banners clicked, load times
- Error reports: firmware version, failing API URL, error code, stack trace, title ID/SKU
- Adobe's documented fields also allow: postal code, TV market area (DMA), age, a "PS+ propensity" score
Destinations: smetrics/metrics.aem.playstation.com (Adobe), mcrevents.api.playstation.com and event.api.*.km.playstation.net (Kamaji/Clairvoyance). Plus, at the system level: update checks, time sync, connection/status checks, and DNAS console authentication — all of which expose your IP and MAC regardless of account.
2. Everything it records (on‑device)
System Logger (system_log.db) — per queued event: event ID, timestamp, session ID, number of users, up to 4 PSN account IDs, up to 4 local user IDs, firmware version, config version, create/update/delivery times, and up to 99 parameters.
Second logger (sl2_log.db) — per entry: event type, client ID (which subsystem), the Limited/Full setting at capture time (ws1_setting), log type/data type, created/tried‑to‑deliver times, retry count, and the raw log payload.
Delivery stats (sl_performance.db): counts of inserted/success/failure/dropped, HTTP timing, retry histograms, last error/HTTP status.
Config state (tbl_status, fetched from Sony and merged): config version, last config check, last merge — i.e., the event list itself is server‑controlled and can change without a firmware update.
Other local records: media‑gallery metadata (per up to 20 accounts), browser history/bookmarks (empty templates on a fresh unit), per‑title workaround matching, and a stored npGeoLocation value. The system logger also keeps records for local (non‑PSN) users and for no user — the account field just stays 0.
3. What can differ between firmware versions and give the real version away
This is the fingerprint surface — the signals that would reveal a console's true firmware even if something claimed otherwise. I'm listing what identifies the version; I'm not getting into altering these:
Explicit version strings it transmits/stores:
- platformVersion / vshVersion / sysVer in telemetry — attached to events, mandatory
- system_software_version stamped on every logger row, plus config_version
- Adobe eVar82 "System Software Version"; the Clairvoyance binary packet's version field
- firmwareVersion on VideoStream events
Behavioral / implicit tells:
- The HTTP User‑Agent string the system stack sends (encodes model + system version)
- The TLS client fingerprint (cipher suites/extensions shift between firmware lines) — visible even on encrypted traffic
- Which API path versions and endpoints it calls (/v1/… services move between generations) and which environment ring
- New or removed endpoints/hosts a newer OS contacts
- Capability/feature flags it advertises, and the set of native calls available (getSystemSoftwareVersionEx, buildConfig = "kratos", etc.)
- Update‑check requests (the baseline version it reports to the update server)
- The server‑merged event config version — a newer console pulls a newer config_version
- Certificate/DNAS handshake specifics and crypto‑suite changes across versions
Confirmed changes 6.72 → 7.00
- Trust store grew: 71 → 74 CAs. 7.00 added Buypass Class 2/3 and ISRG Root X1 (Let's Encrypt) — so a 7.00 console trusts Let's Encrypt‑chained servers a 6.72 console doesn't. That alone is a clean version tell.
- HTTP/2 arrived: 7.00 adds libSceHttp2.sprx. That means it negotiates ALPN h2 and sends a different TLS ClientHello than 6.72 — the TLS‑fingerprint prediction, confirmed, and visible even on encrypted traffic.
- New endpoints: 7.00's readable strings add cart.api.playstation.com plus mgmt/sp-int/e1-pmgt variants, where 6.72 only had cart.e1-np. The version→endpoint‑set prediction holds.
- Store app version: arcrunner 1.1.0+1811 → 1.2.0+3121 (new commit hash), and the 7.00 manifest adds a titleId field. That's the eVar73 "Store App Version" / buildVersion value that rides in telemetry.
- title_workaround.xml: version 58 → 65.
- New capabilities: libScePosixForWebKit, libReactNative.Modules.Vsh, and the Party app (NPXS21002) gained a full WebRTC stack (webrtc_daemon.self, libSceWebRtc.sprx) — voice chat moving to WebRTC.
- Size/count: CoreOS 332 → 339 MB, 992 → 999 files.