• PS3HaX member judges has release his NORway project for the public to enjoy.  He has be working on improving the original code for the noralizer released by Marcan of FailOverflow.  You can expect a downgrade tutorial soon, but remember this is for NOR based PS3s. below is a qoute of his post:

    Hi there..

    Here comes my initial release of a NOR flasher soft for the PS3 called “NORway”. I know, there are other “WIP” projects, but I got a little impatient, so I’ve decided to create my own solution. It’s a port of “noralizer” by marcan, a pretty good working NOR flasher implementation for another FPGA board.

    Anyway, here’s the README.txt, which should explain everything:

    NORway v0.1
    This project has been ported for the Teensy++ 2.0 from the original NOR flasher tool
    (“noralizer” by Hector Martin “marcan” <[email protected]>) that was used to flash
    AsbestOS onto the demo PS3 at 27C3, and for experimentation.

    Contents:
    teensyNORway.avrsln - Source code for the Teensy++ 2.0 (AVR Studio 5.0)
    teensydefaultNORway.hex - Compiled hex-file for the Teensy++ 2.0 (AT90USB1286)
    hwinstallinstall-*.jpg - Some pics of how I’ve mounted the Teensy (CECH-2504A/B)
    hwinstallnor_testpoints.png - Connection diagram of the NOR testpoints (CECH-2504A/B)
    serial_install.exe - Teensy serial drivers for Windows
    README.txt - this file
    NORway.py - PC Python client

    Hardware connections (see “hwinstallnor_testpoints.png”):
    PS3 Teensy
    A0-7 PF0-7
    A8-15 PA0-7
    A16-22 PB0-7
    D0-7 PD0-7
    D8-15 PC0-7
    CE# PE0
    OE# PE1
    RESET# PE4
    WE# PE5
    RY/BY# PE6
    TRISTATE# PE7
    GND GND

    There are no modifications to the Teensy itself required. Don’t install any power regulators,
    don’t cut any traces.

    DON’T CONNECT THE VCC SOLDER PADS TO ANYTHING!

    Connection diagrams for other boards can be found at:
    http://ps3devwiki.com/index.php?title=Hardware_flashing

    Prerequisites for Windows:
    Python 2.7.2 (http://www.python.org/ftp/python/2.7.2/python-2.7.2.msi)
    pyserial 2.5 (http://pypi.python.org/packages/any/…-2.5.win32.exe)

    Usage:
    Install Python + pyserial (see “Prerequisites for Windows”). Install drivers. Connect Teensy
    to your PC. Flash Teensy with “teensydefaultNORway.hex” and reset it after completion. Start
    Windows’ “Device Manager”, expand the “Ports (COM & LPT)” node, you should see something like
    “USB Serial (Communication Class, Abstract Control Model) (COM4)”. This tells you that “COM4″
    (or whatever shows up) is the COM port used by Teensy.

    At the command prompt enter “NORway.py” to display help.

    Procedure to dump your flash:
    - PS3 is turned off
    - At the command prompt enter:
    NORway.py <your com port>
    - Turn on your PS3, it shouldn’t boot
    - At the command prompt enter:
    NORway.py <your com port> dump flash.bin
    - When dumping is finished enter:
    NORway.py <your com port> release
    - Power off your PS3 (disconnect Teensy if PS3 doesn’t boot when restarted)

    Dumping takes about 3 minutes. A file “flash.bin” with a size of exactly 16 MB (16.777.216 bytes)
    has been created in your current directory.

    Flashing is rather slow. Writing a complete flash with the “write” command takes about 2 hours.
    Might be improved in future versions…

    IMPORTANT:
    Before you flash your PS3 with anything new, make sure that the content of your dump is correct
    (e.g. compare ros0/ros1 area of your dump against “CORE_OS_PACKAGE.bin” from an actual PS3UPDAT.PUP
    of your current firmware). And keep your original dump in a safe place. You might need it.

    It’s tested on Win7 x86, but should also work just fine on any x86 Windows >=XP.
    Basically it should also work on Linux, but I didn’t test. If you’re running Linux, you
    probably know what to do. ;-) Serial drivers are not required for Linux.

    Unfortunately I couldn’t manage to make it work on any x64 version of Windows, because of
    the Python pyserial module.

    Thanks to “marcan” for the original implementation.

    - judges ([email protected]

    PS: I’ve already managed to downgrade my OFW 3.61 to CFW 3.55. There’re minor things to rule out, but expect a downgrade tutorial coming soon..
    PPS: Thanks to defyboy for the original idea of using a Teensy for flashing!

    Download

    Source - Right here on PS3HaX

    Tags: , , ,

    Discuss in Forums (1623)


  • 1623 Comments

    1. BobbyBlunt
      07-26-2011
      05:55 PM
      1

      That is great work. Looking forward to the tutorial. Maybe those teensy boards people were using to jailbreak with are not useless after all

    2. wizdumb
      07-26-2011
      06:24 PM
      2

      Thanks and great work. I was wondering when you were going to pop up with this. Going to give this a go.

    3. bpear96
      07-26-2011
      06:31 PM
      3

      This i great, thanks so much for this. 1 question these are the correct points to solder the teensy to right? http://dl.dropbox.com/u/14745788/DYN...Y%2B%2B2.0.jpg just wanna make sure

    4. judges
      07-26-2011
      06:47 PM
      4

      Originally Posted by bpear96
      This i great, thanks so much for this. 1 question these are the correct points to solder the teensy to right? http://dl.dropbox.com/u/14745788/DYN...Y%2B%2B2.0.jpg just wanna make sure
      No. Looks like you're referring to the DYN-001 board. Have a look at this connection layout: http://ps3devwiki.com/index.php?titl...YN-001_NOR.JPG

      And compare that to the info from the readme.txt (e.g. [Blue]Data0 -> [Teensy]PD0, [Green]Address0 -> [Teensy]PF0, etc.)

    5. Pockets69
      07-26-2011
      07:08 PM
      5

      Great job judges already saw it posted on ps3crunch thanks for sharing man

    6. jarmster
      07-26-2011
      07:53 PM
      6

      Props to the judge....

    7. Thelostdeathknight
      07-26-2011
      08:16 PM
      7

      PS3HaX member judges has release his NORway project for the public to enjoy. He has be working on improving the original code for the noralizer released by Marcan of FailOverflow. You can expect a downgrade tutorial soon, but remember this is fo... [Read More]

    8. quilapayun
      07-26-2011
      08:22 PM
      8

      So.. this allows you to downgrade to 3.55? Sorry haven't been looking at the news recently.

    9. Annelies
      07-26-2011
      08:23 PM
      9

      Originally Posted by quilapayun
      So.. this allows you to downgrade to 3.66? Sorry haven't been looking at the news recently.
      Yes, it allows you to downgrade from 3.66.

    10. quilapayun
      07-26-2011
      08:28 PM
      10

      Originally Posted by Annelies
      Yes, it allows you to downgrade from 3.66.
      Oh goody, lol

    11. Pirate
      07-26-2011
      08:34 PM
      11

      Threads merged

    12. KillerBug
      07-26-2011
      08:43 PM
      12

      I love it...now we just need an easy-to-use guide and maybe some wire stickers to make the mainboard connections easier for noobs.

    13. lukethomasx
      07-26-2011
      09:10 PM
      13

      There has been so much progress lately, I love this

    14. Joecatshoe
      07-26-2011
      09:13 PM
      14

      I would definitely consider giving this a try if some more documentation became available.
      Soldering the wires isn't the issue, but I have no experience with ps3 firmwares whatsoever so I'd probably end up bricking it without a guide.

      Funny how all of a sudden everyone starts revealing their flashers. I hope some documented downgrade solutions will follow soon.

    15. hellsing9
      07-26-2011
      11:42 PM
      15

      wow Just = WOW. Have no words to thanks sharing this info.

      IT'S ALIVEEEEEEEEE! Oh yes Oh yes.

    16. bpear96
      07-26-2011
      11:57 PM
      16

      Originally Posted by KillerBug
      I love it...now we just need an easy-to-use guide and maybe some wire stickers to make the mainboard connections easier for noobs.
      Haha wire stickers I like it LOL or a clip like pockets69 keeps saying

    17. blackfeet96
      07-27-2011
      12:01 AM
      17

      YES .! Well , No , I dont have a teensy board , and not an expert on the soldering things , i mean i wish i was , but i have neither a teensy nor a soldering kit . HURRY UP AND MAKE SOMETHING EASY . please

    18. <GEEK>
      07-27-2011
      02:04 AM
      18

      Originally Posted by blackfeet96
      YES .! Well , No , I dont have a teensy board , and not an expert on the soldering things , i mean i wish i was , but i have neither a teensy nor a soldering kit . HURRY UP AND MAKE SOMETHING EASY . please
      Hardware mods tend to come before soft mods. Patience is a virtue

    19. mechlord
      07-27-2011
      02:17 AM
      19

      i know nothing about NAND /NOR differences, so ima be a noob and ask:
      If there is NOR flasher that downgrades 3.6, (this one), is it very complicated to adapt it to be a NAND flasher?

    20. WalangAlam
      07-27-2011
      02:22 AM
      20

      @judges, Thanks for this. Could you post a pic of what you did? Pic of the connections would be nice.

      Yey. Time to open my ps3 slim.

    21. fl0PPsy
      07-27-2011
      03:16 AM
      21

      Hmmm I wonder if this will work with the Teensy 2.0. The non ++ version.

    22. Natedogg20050
      07-27-2011
      03:28 AM
      22

      i hope there is non solderless version soon i dont know how to solder things on the play slim , its awsome to have a hardware mod but i hope soon a way for people like me , i am not lazy to do it but i cant

    23. Sidewinder_2011
      07-27-2011
      04:51 AM
      23

      does anyone know where to get a Teensy++ 2.0 in the uk , i cant find anywhere just mainly in the usa . wanna downgrade my slim and have my fat ps3 online cos i wanna build a ps3 laptop like pirates but not with water cooling system . my laptop blew up lol so thought instead of buying a new laptop i build one from my slim ps3 and use linux deul boot for surfing the net etc

    24. baball
      07-27-2011
      05:18 AM
      24

      do you think if this will be ported to other Teensy Project (Avr Gold, etc) ?

    25. EckoUnltd
      07-27-2011
      06:24 AM
      25

      great job, now for a guide and me to find my dusty teensy around the house xD

    26. judges
      07-27-2011
      06:56 AM
      26

      Originally Posted by WalangAlam
      @judges, Thanks for this. Could you post a pic of what you did? Pic of the connections would be nice.
      Look at the first post. It's all included in the download archive.
      ************* [ - Post Merged - ] *************
      Originally Posted by baball
      do you think if this will be ported to other Teensy Project (Avr Gold, etc) ?
      At least probably not by me. But provided that the board got enough IO pins, it might be fairly simple.
      ************* [ - Post Merged - ] *************
      Originally Posted by fl0PPsy
      Hmmm I wonder if this will work with the Teensy 2.0. The non ++ version.
      No. Not enough IO pins.

    27. baball
      07-27-2011
      07:30 AM
      27

      Thx Judge.

      I think that not possible for Avr Gold... Not enough IO pins...

      So... Just wait for a tutorial and maybe buy a real teensy.

    28. jester
      07-27-2011
      10:04 AM
      28

      Thanks very much for your work, Judge.

      I have just a doubt: you said...

      There are no modifications to the Teensy itself required. Don't install any power regulators,
      don't cut any traces.

      DON'T CONNECT THE VCC SOLDER PADS TO ANYTHING!
      So you are flashing nor chip with the 5v from usb???? i am pretty sure you will destroy it doing that.

      Contrariwise, i saw in your pics that you soldered the nor VCC testpoint, and also the Teensy VCC pad is soldered :P

      I am a little bit confused, can you explain that?
      Thanks in advance

    29. chaos theory
      07-27-2011
      10:34 AM
      29

      Originally Posted by jester
      Thanks very much for your work, Judge.

      I have just a doubt: you said...


      So you are flashing nor chip with the 5v from usb???? i am pretty sure you will destroy it doing that.

      Contrariwise, i saw in your pics that you soldered the nor VCC testpoint, and also the Teensy VCC pad is soldered :P

      I am a little bit confused, can you explain that?
      Thanks in advance
      You need to power on the PS3 to dump/write the NOR. The power for the NOR is supplied by the PS3 itself.

    30. jester
      07-27-2011
      10:48 AM
      30

      @chaos theory, that's not the point...

      obviously you are powering the nor by the ps3 itself, but if you run teensy at 5v you are also sending 5v signals to the nor... and this is bad

      (in my old project i used nor vcc to power the AT90USB646 avr)

    31. sege5641
      07-27-2011
      11:27 AM
      31

      Originally Posted by jester
      @chaos theory, that's not the point...

      obviously you are powering the nor by the ps3 itself, but if you run teensy at 5v you are also sending 5v signals to the nor... and this is bad

      (in my old project i used nor vcc to power the AT90USB646 avr)
      I believe that you can do it this way, BUT you can not have the Teensy connected to the PS3 WITH the USB at the same time. This WILL fry your NOR.

      SO this means having a way to disconnect the Teensy from the PS3 and being able to reconnect it back. I had the idea of using a IDE ribbon cable with the end plugs (Male and Female plug) then you can easily plug and unplug from PS3.

    32. garyferg
      07-27-2011
      11:31 AM
      32

      Is it possible to make this work on the fat nand ps3s?

    33. jarmster
      07-27-2011
      11:45 AM
      33

      judges words from another forum.....

      Vcc is not necessarily required. Teensy can be powered by USB, NOR can be powered by the PS3.
      ************* [ - Post Merged - ] *************
      Originally Posted by sege5641
      I believe that you can do it this way, BUT you can not have the Teensy connected to the PS3 WITH the USB at the same time. This WILL fry your NOR.
      then where does the dump write to or how do you read the bin to write. You need to be connected to the pc.

      But if you look at the pic closely, he does appear to have the 5v pin wired and the gnd not. Idk but thats how it looks.

      How about a closer pic from above the teensy wiring judge.

    34. judges
      07-27-2011
      12:01 PM
      34

      Originally Posted by jester
      So you are flashing nor chip with the 5v from usb???? i am pretty sure you will destroy it doing that.
      Originally Posted by jester
      obviously you are powering the nor by the ps3 itself, but if you run teensy at 5v you are also sending 5v signals to the nor... and this is bad
      jester, you're absolutely right. I missed this, thanks for that. Although it didn't do any harm yet, but I just might have been lucky, because the voltages fall within tolerance if only applied for 20ns or so.

      I'll update this right now, so the way to go definitely is to use the 3.3V regulator.

      Originally Posted by jester
      Contrariwise, i saw in your pics that you soldered the nor VCC testpoint, and also the Teensy VCC pad is soldered :P

      I am a little bit confused, can you explain that?
      Thanks in advance
      Well, the NOR VCC test point was soldered to an IO pin of Teensy, so I would be able to detect VCC. But this has been changed.

      But the Teensy VCC pad isn't soldered, don't know where you've seen that. Alright, just looked at the picture again, and yes, it might look like that. But there're 2 more pads just barely visible on the top side.

    35. jarmster
      07-27-2011
      12:30 PM
      35

      Originally Posted by judges

      I'll update this right now, so the way to go definitely is to use the 3.3V regulator.
      I was wondering about that...
      I didn't order the MCP1825 voltage regulator, damn i was hoping i didn't need it.

      I did though find a Mt1117 3.30736N on an old usb hub. Do you think i'd get away using that? I'm preety sure it fits the footprint and its rated 3.3V. It just has a higher current rating from what i can see.


      edit: I guess i dont need it, cool

    36. jester
      07-27-2011
      12:48 PM
      36

      Originally Posted by judges
      I'll update this right now, so the way to go definitely is to use the 3.3V regulator.
      Someone told me that the regulator gets pretty hot in a small amount of time. I personally never tested that. I usally power the chip using the nor vcc line. (pretty stable 3.3v)
      Ah..! Remember to write in the README that if someone wants to run it at 3.3, he needs to set the clock prescale to 8mhz At 16mhz it can work but usually you have bad dumps and strange behaviors :P

      Sorry for the picture, my fault

    37. wizdumb
      07-27-2011
      12:53 PM
      37

      Just a word of warning. While having the 3.3 voltage regulator on the teensy works, the damn thing gets extremely hot to the point of concern; That is only with the 3 minute read time. I don't think it will hold up against the 2+ hour write time. The way that I have been using is cut the 5 volt trace and bridge the 3 volt pads. Reading/writing is then done with the ps3 on.


      Edit: Jester you beat me to it.

    38. judges
      07-27-2011
      01:01 PM
      38

      Originally Posted by jarmster
      I was wondering about that...
      I didn't order the MCP1825 voltage regulator, damn i hoping i didn't need it.

      I did though find a Mt1117 3.30736N on an old usb hub. Do you think i'd get away using that? I'm preety sure it fits the footprint and its rated 3.3V. It just has a higher current rating from what i can see.
      Should work. Of course USB is limited to 0.5A at 5V (off the top of my head).

    39. jester
      07-27-2011
      01:05 PM
      39

      @wizdump, I never thought of powering the NOR flash with the little 3.3 regulator!
      I don't understand if it gets hot when used to power either the teensy and NOR flash or when used to power only teensy...

    40. hackoncrack
      07-27-2011
      01:06 PM
      40

      Originally Posted by BobbyBlunt
      That is great work. Looking forward to the tutorial. Maybe those teensy boards people were using to jailbreak with are not useless after all
      yeah i still got mine...it's antsy to start hacking again...lol

    41. judges
      07-27-2011
      01:07 PM
      41

      Originally Posted by jester
      Someone told me that the regulator gets pretty hot in a small amount of time. I personally never tested that. I usally power the chip using the nor vcc line. (pretty stable 3.3v)
      Ah..! Remember to write in the README that if someone wants to run it at 3.3, he needs to set the clock prescale to 8mhz At 16mhz it can work but usually you have bad dumps and strange behaviors :P

      Sorry for the picture, my fault
      My understanding was that the regulator only gets very hot if you use the teensy to power the NOR (which then also powers southbridge, etc). That's why you shouldn't connect Teensy VCC pad to PS3's VCC solder point.

      And it might be a disadvantage to power the teensy using nor vcc line, because it already happend to me, that in case of a bricked system, the PS3 immediately shuts down. Although I didn't measure whether 3V were still available.

      And yes, according to the Teensy specs, it should only run at 8 MHz on 3.3V. I'll also update this.

    42. jester
      07-27-2011
      01:14 PM
      42

      Originally Posted by judges
      And it might be a disadvantage to power the teensy using nor vcc line, because it already happend to me, that in case of a bricked system, the PS3 immediately shuts down. Although I didn't measure whether 3V were still available.
      This is exactly my case =) You have to power on the PS3, then connect the teensy to USB and suddenly take control over the NOR before the ps3 shutdown, (the system freeze and you can work with it undisturbed).
      It's annoying i know, but it works :P

    43. tupac4u
      07-27-2011
      01:45 PM
      43

      great work,

    44. bpear96
      07-27-2011
      01:46 PM
      44

      If theres anyone who isnt sure they can solder this to there ps3 and want a professional, i contacted modchipcentral.com and they said they can solder it for you for $75 pretty expensive but its an option.

    45. jarmster
      07-27-2011
      02:20 PM
      45

      LOL, $75
      I'll do it for $50 you supply the teensy and pay the shipping.

      Teensy wiring pic
      At least thats how i translated it

    46. baball
      07-27-2011
      05:45 PM
      46

      Read judge post. Don't need regulator...

    47. jarmster
      07-27-2011
      05:48 PM
      47

      Originally Posted by baball
      Read judge post. Don't need regulator...
      I know that...where do i say use it?

      Actually, heres pics of the power mod, except you dont need to add the regulator

      Originally Posted by judges
      And yes, according to the Teensy specs, it should only run at 8 MHz on 3.3V. I'll also update this.
      The AVR processor is not specified to run faster than 8 MHz when running at 3.3 volts, even though it often can operate at 16 MHz at room temperature.
      You do NOT need to replace the 16 MHz crystal. Just set the CPU prescaler to 0x01 so the processor runs at 8 MHz.

      #define CPU_PRESCALE(n) (CLKPR = 0x80, CLKPR = (n))

      int main(void)
      {
      // set for 8 MHz clock because 3.3 volts
      CPU_PRESCALE(0x01);

      // rest of program....]
      You also need to edit your Makefile to change F_CPU to 8000000.
      # Processor frequency.
      # Normally the first thing your program should do is set the clock prescaler,
      # so your program will run at the correct speed. You should also set this
      # variable to same clock speed. The _delay_ms() macro uses this, and many
      # examples use this variable to calculate timings. Do not add a "UL" here.
      F_CPU = 8000000
      Looking at the schematic, don't you tie the 3.3v nor vcc to the teensy 5v. Your hardware connections doesn't show the 3.3 volt tie to the teensy

    48. Nikitis
      07-27-2011
      06:45 PM
      48

      Judges do you have another url you can put it to so we can grab it?

      The download link for this article has been removed by megaupload.

    49. wizdumb
      07-27-2011
      06:50 PM
      49

      Reup http://www.mediafire.com/?ir89sxupwspp3j4

    50. mindping
      07-27-2011
      07:05 PM
      50

      Can this be ported to a teensy 2.0 ( not a ++ ) - never mind missed the post on page 3.

    51. judges
      07-27-2011
      10:01 PM
      51

      Originally Posted by jarmster
      Teensy wiring pic
      At least thats how i translated it
      Absolutely correct!

    52. rumblpak
      07-28-2011
      12:17 AM
      52

      Thanks for the great work judges. Any reason why you're using 9600 baud vs the 115200 baud the teensy supports?

      [edit]
      Also,
      "My understanding was that the regulator only gets very hot if you use the teensy to power the NOR (which then also powers southbridge, etc). That's why you shouldn't connect Teensy VCC pad to PS3's VCC solder point."
      The reason for this is probably because you're tying the voltage from the 5V USB (after its been regulated) to the voltage rail of the ps3. THIS IS BAD. The only way to be able to connect them would be to solder a second usb on the teensy to do the transfer (which is not possible with the amount of pins you're using) and power the teensy using the voltage from the ps3. Since we don't care to do that, we may as well not connect it.

    53. judges
      07-28-2011
      12:37 AM
      53

      Originally Posted by rumblpak
      Thanks for the great work judges. Any reason why you're using 9600 baud vs the 115200 baud the teensy supports?
      You can set it to 115200 baud, but it won't make the transfer any faster. Here's a quote from https://www.pjrc.com/teensy/usb_serial.html

      Data is always tranferred at full USB speed. This is merely the setting selected by the PC or Macintosh software, which is not used by USB. You do NOT need to constrain your transmission to this rate. However, many serial communication programs are coded very inefficiently because the programmer assumes "slow" data. You can easily overwhelm these programs, even when running on very fast machines, if you sustain full USB speed transfers!
      ************* [ - Post Merged - ] *************
      Originally Posted by rumblpak
      "My understanding was that the regulator only gets very hot if you use the teensy to power the NOR (which then also powers southbridge, etc). That's why you shouldn't connect Teensy VCC pad to PS3's VCC solder point."
      The reason for this is probably because you're tying the voltage from the 5V USB (after its been regulated) to the voltage rail of the ps3. THIS IS BAD.
      I absolutely agree. Just to be on the same page here, I DO NOT recommend to power the NOR using Teensy's (regulated 3V) VCC output.

    54. rumblpak
      07-28-2011
      12:49 AM
      54

      Originally Posted by judges
      You can set it to 115200 baud, but it won't make the transfer any faster. Here's a quote from https://www.pjrc.com/teensy/usb_serial.html
      Currently the baud is set by norway.py:
      self.ser = serial.Serial(port, 9600, timeout=5, rtscts=0, dsrdtr=1, xonxoff=0)

      From the way I read it, the data can be sent at full speed but if the communication doesn't accept it because it is USB the buffer will be fine. I don't see a reason to not raise the baud there.

      usb_serial_get_baud()
      Get the baud rate. Returned as a 32 bit unsigned long.

      Data is always tranferred at full USB speed. This is merely the setting selected by the PC or Macintosh software, which is not used by USB. You do NOT need to constrain your transmission to this rate. However, many serial communication programs are coded very inefficiently because the programmer assumes "slow" data. You can easily overwhelm these programs, even when running on very fast machines, if you sustain full USB speed transfers!

      Likewise, the host does not enforce this baud rate upon the software that is sending data to you. However, unlike real serial communication where you could lose data if you do not read fast enough, USB will always buffer data until you have read it. If the software does not implement timeouts, you may read at any speed and never lose a byte.

    55. calimba
      07-28-2011
      12:57 AM
      55

      i have this error when i try write

    56. judges
      07-28-2011
      12:58 AM
      56

      Originally Posted by rumblpak
      I don't see a reason to not raise the baud there.
      Sure, go ahead. Still it won't get any faster.

    57. rumblpak
      07-28-2011
      01:20 AM
      57

      Originally Posted by judges
      Sure, go ahead. Still it won't get any faster.
      Would it be advantageous to store 64 bytes to send at once rather than sending 1 byte at a time? At least then you would be maximizing the buffer. It would be fairly easy to do it with usb_serial_write(buffer, size) (rather than usb_serial_putchar) sending a char array.

      Also, I don't want to seem like a jackass, I just want this to be as fast as it can be

    58. judges
      07-28-2011
      01:35 AM
      58

      Originally Posted by rumblpak
      Would it be advantageous to store 64 bytes to send at once rather than sending 1 byte at a time? At least then you would be maximizing the buffer. It would be fairly easy to do it with usb_serial_write(buffer, size) (rather than usb_serial_putchar) sending a char array.

      Also, I don't want to seem like a jackass, I just want this to be as fast as it can be
      I appreciate any kind of improvement and suggestions. Sources are available, go give it a try. I called it version 0.1 for a reason.
      ************* [ - Post Merged - ] *************
      Originally Posted by calimba
      i have this error when i try write
      You want to write just the last sector of your flash? Make sure that "flash.bin" isn't bigger than one sector (=128KB).

      But that's not the problem here. Have you verified that dumping your flash works correctly? I.e. that the content of your flash dump is correct?

    59. calimba
      07-28-2011
      02:04 AM
      59

      i want to write all 16mb the content is correct
      what is the command for all 16mb "flash.bin" is all 16.777.216 bytes

    60. judges
      07-28-2011
      02:34 AM
      60

      Originally Posted by calimba
      i want to write all 16mb the content is correct
      what is the command for all 16mb "flash.bin" is all 16.777.216 bytes
      NORway.py COM3 write flash.bin

    61. jarmster
      07-28-2011
      03:40 AM
      61

      Is there any reason we can't power the teensy with the 3.3 nor Vcc. Forget the regulator, cut the 5v trace, tie the 3.3 v pads and wire the nor Vcc to the teensys 5v pin?
      Instead of regulating down the 5v usb voltage.

      ......or is this bad aswell

    62. jester
      07-28-2011
      04:42 AM
      62

      Originally Posted by jarmster
      Is there any reason we can't power the teensy with the 3.3 nor Vcc. Forget the regulator, cut the 5v trace, tie the 3.3 v pads and wire the nor Vcc to the teensys 5v pin?
      Instead of regulating down the 5v usb voltage.

      ......or is this bad aswell
      It will work, but obviously you need to turn on the ps3 to power teensy
      I used this method for some time with a custum at90usb646 board (not a teensy). The only problem is that, as judges said, if the ps3 is bricked it stays on for about 3 - 4 seconds. So you need to take control over the nor before the shutdown.

    63. judges
      07-28-2011
      05:22 AM
      63

      Originally Posted by jester
      It will work, but obviously you need to turn on the ps3 to power teensy
      I used this method for some time with a custum at90usb646 board (not a teensy). The only problem is that, as judges said, if the ps3 is bricked it stays on for about 3 - 4 seconds. So you need to take control over the nor before the shutdown.
      Mine even shut down after ~1 second once...

    64. jarmster
      07-28-2011
      05:46 AM
      64

      But that is in regards to bricked units, right? operational unit should flash fine?

    65. judges
      07-28-2011
      06:07 AM
      65

      Originally Posted by jarmster
      But that is in regards to bricked units, right? operational unit should flash fine?
      Bricked units also flash fine, you just have to be fast enough..

      And you can brick (and unbrick) it easily while playing with the flasher. I tried to downgrade to 3.41 -> shutdown after 1sec. I doubt that your PC detects the Teensy and that you're able to set tristate that fast.

    66. chaos theory
      07-28-2011
      07:25 AM
      66

      Originally Posted by judges
      Bricked units also flash fine, you just have to be fast enough..

      And you can brick (and unbrick) it easily while playing with the flasher. I tried to downgrade to 3.41 -> shutdown after 1sec. I doubt that your PC detects the Teensy and that you're able to set tristate that fast.
      What about changing the code for the Teensy to, by default, set the tristate when it powers up, without the need to do it via the PC? It probably wouldn't be great for normal operation, but could be used as an alternative when trying to unbrick a console or something when there's no other option, no?
      Just a thought

    67. zetbet
      07-28-2011
      08:48 AM
      67

      Thanks a lot for your work. At least a cheap NOR flasher.

      I'm doing a tuto in french and I was wondering : Do you plan to release a tutorial for downgrading? If yes, I'll wait the time you need. If no, I'll look at it. Do you have some steps?

      My PS3 is still CFW 3.55. I would like to play a bit online with OFW 3.66. I could check both dumps but if you can help me, it'll be easier.

    68. calimba
      07-28-2011
      10:17 AM
      68

      same error with the 0.2 version

      Code:
      C:\....\teensy>NORway.py COM3 write flash.bin
      Pinging...
      Set SB to tristate
      STATUS_DRIVE:   False
      STATUS_TRIST_N: True
      STATUS_RESET_N: True
      STATUS_READY:   True
      STATUS_CE_N:    False
      STATUS_WE_N:    True
      STATUS_OE_N:    True
      Resetting NOR...
      Ready.
      Sector 000000 (1/128) [M]...
      Traceback (most recent call last):
        File "C:\....\teensy\NORway.py", line 320, in <module>
          n.writerange(addr, data)
        File "C:\....\teensy\NORway.py", line 210, in writerange
          self.writesector(addr/2, data[:0x20000])
        File "C:\....\teensy\NORway.py", line 177, in writesector
          raise NORError("Verification failed")
      __main__.NORError: Verification failed

    69. chaos theory
      07-28-2011
      01:39 PM
      69

      Originally Posted by calimba
      same error with the 0.2 version

      Code:
      C:\....\teensy>NORway.py COM3 write flash.bin
      Pinging...
      Set SB to tristate
      STATUS_DRIVE:   False
      STATUS_TRIST_N: True
      STATUS_RESET_N: True
      STATUS_READY:   True
      STATUS_CE_N:    False
      STATUS_WE_N:    True
      STATUS_OE_N:    True
      Resetting NOR...
      Ready.
      Sector 000000 (1/128) [M]...
      Traceback (most recent call last):
        File "C:\....\teensy\NORway.py", line 320, in <module>
          n.writerange(addr, data)
        File "C:\....\teensy\NORway.py", line 210, in writerange
          self.writesector(addr/2, data[:0x20000])
        File "C:\....\teensy\NORway.py", line 177, in writesector
          raise NORError("Verification failed")
      __main__.NORError: Verification failed
      Make sure you have connected your Teensy correctly.
      Are you using a 64 bit OS?
      I get the exact same error, my Teensy is not (yet) connected to my PS3 (was just trying out the software) and I'm running Windows 7 64 bit.

    70. tthousand
      07-28-2011
      04:12 PM
      70

      Here is a tutorial from demonhades.org. Not exactly sure what all of this means, but I thought I would share it with you all!

      DemonHades.Org [Lugar alternativo de Scene,Investigacion,Fomentacion de Proyectos,Didactica no lucrativa y Critica Argumentada] • Ver Tema - [Tutorial]Dump NOR con Teensy 2.0++

      The following has been badly translated via Google :D

      It looks like the author of the tutorial is here with us !!! If you could please give me a better translation, that would help everyone out !!!

      Originally Posted by calimba
      Community Well this is my first tutorial I hope you understand me I'll be putting images to be more clear, then began:

      requirements:
      Teensy 2.0 + +
      Norway 0.1
      Obviously a PC

      1. Unzip the Norway where we want and install the serial_install.exe that comes inside the zip
      then download it and install it
      Python 2.7.2 (http://www.python.org/ftp/python/2.7.2/python-2.7.2.msi)
      pyserial 2.5 (http://pypi.python.org/packages/any/p/p .... win32.exe)

      2.Program with the hex that is inside the folder "default" of Norway



      3.Soldamos to play the 3 because of the review board is different from the diagram, here are a few Hardware flashing - PS3 Development Wiki
      I used this

      and these are the points of the teensy


      4.Ya all welded to the plate and console ps3 off with the red LED and connect the usb to pc teensy then went into the Device Manager and look for Ports (COM & LPT) as you can see the next image to I really teensy detected in COM3


      5.Open the windows command line CMD and go as far as Norway and unpack the NORway.py write in my case COM3


      6.Luego ignition internal green LED console and type in CMD flash.bin NORway.py COM3 dump and start making the dump, as you'll see in the image does not take much 2 minutes 38 seconds



      7.Ultimo step. After the dump CMD wrote in COM3 NORway.py NOR release to reset and turn off the console and disconnect the teensy and ready and we have the dump of the NOR


      PS: I'm not very good with this photocase
      PD2: I did everything in windows 7 x64

      I want to thank Demonhades, Jaicrab rather the entire mark HadesTeam also thank the Judges and Norway

    71. judges
      07-28-2011
      04:34 PM
      71

      Originally Posted by chaos theory
      What about changing the code for the Teensy to, by default, set the tristate when it powers up, without the need to do it via the PC? It probably wouldn't be great for normal operation, but could be used as an alternative when trying to unbrick a console or something when there's no other option, no?
      Just a thought
      Just to make it clear about what we're talking: teensy is powered by PS3 (not USB), so you wouldn't need a voltage regulator. You can do this, but with previously mentioned disadvantages.

      Surely you can change the Teensy code to set tristate immediately after power up. But how do you boot the PS3 afterwards?
      ************* [ - Post Merged - ] *************
      Originally Posted by zetbet
      Thanks a lot for your work. At least a cheap NOR flasher.

      I'm doing a tuto in french and I was wondering : Do you plan to release a tutorial for downgrading? If yes, I'll wait the time you need. If no, I'll look at it. Do you have some steps?

      My PS3 is still CFW 3.55. I would like to play a bit online with OFW 3.66. I could check both dumps but if you can help me, it'll be easier.
      It would be probably the easiest way to just release a modified core_os file, but since it's copyrighted material, I cannot do this. So the tutorial will get a bit more complicated, but I'll create one. Just need the time to do it.

      BTW, it's not like the information is not out there. I haven't invented all this and credit must go to different people.

      And one important info: ONCE YOU DOWNGRADED TO 3.55 YOU CANNOT GO BACK TO 3.6x!!!

      This is just what I figured. Just so you know if anyone want to try on their own.
      ************* [ - Post Merged - ] *************
      Originally Posted by calimba
      same error with the 0.2 version
      That's very hard to say. Since you obviously can dump your NOR, you might want to check the connection of the RY/BY# pin. It's required for writing/erasing. Plus I don't know your board revision. WP# also has to be tied to VCC (default for my board), else no writing is possible.

    72. jarmster
      07-28-2011
      05:11 PM
      72

      What does it mean WP# and Byte# are tied to Vcc? Does that mean i have to wire those traces to 3.3v? or are they already? Sorry, just unsure in regards to that.

      And the statement we can't go back after the downgrade. Can that be fixed. Is that the case with the nand too or is it just something with flashing the nor?

    73. wizdumb
      07-28-2011
      05:26 PM
      73

      Originally Posted by jarmster
      What does it mean WP# and Byte# are tied to Vcc? Does that mean i have to wire those traces to 3.3v? or are they already? Sorry, just unsure in regards to that.
      I assume what he means is by default (on his ps3 motherboard) WP# is tied to the Vcc solder pads and act as one. Some ps3 motherboard revisions have both Vcc and WP separated. So, using his .hex file as it is, writing will work on ps3 motherboards that have WP tied to Vcc.

      Not too sure what Byte refers to.

      What I would like to know is what about those who own a ps3 with WP not tied to Vcc. Would that need some change in the source?

    74. judges
      07-28-2011
      05:43 PM
      74

      Originally Posted by wizdumb
      I assume what he means is by default (on his ps3 motherboard) WP# is tied to the Vcc solder pads and act as one. Some ps3 motherboard revisions have both Vcc and WP separated. So, using his .hex file as it is, writing will work on ps3 motherboards that have WP tied to Vcc.

      Not too sure what Byte refers to.

      What I would like to know is what about those who own a ps3 with WP not tied to Vcc. Would that need some change in the source?
      Well, I'm really not much of a hardware guy, but if WP# isn't set to "HIGH", you cannot write (refer to the data sheet). I didn't care about it, because it's always "HIGH" on my board ("WP# tied to VCC"). If there are other boards out there, you might want to adjust that.

      You could connect it to the last available IO pin (PB7) and adjust the code or connect WP# to VCC (please double check, "I'm not much of a hardware guy").

      BYTE# also has to be "HIGH", to set the NOR to word instead of byte operation mode.
      ************* [ - Post Merged - ] *************
      Originally Posted by jarmster
      And the statement we can't go back after the downgrade. Can that be fixed. Is that the case with the nand too or is it just something with flashing the nor?
      Don't know about NANDs. But your current firmware version isn't just stored in the flash (I guess in syscon). If you downgrade (with a service jig) the version in syscon isn't updated. You run on e.g. 3.55, but syscon still thinks you're on 3.66 (or whatever).

      So from here on updates are only possible with a service jig, because your systems always expects to run on e.g. 3.66, but it doesn't. All updates without being in factory mode are rejected.

      In factory mode you can go back to e.g. 3.66, but you cannot get out of factory mode, because there's no Lv2Diag.self available for 3.56+.

    75. jarmster
      07-28-2011
      06:14 PM
      75

      and i take it your board is the JSD-001 since thats what you included in the norway hwinstall folder, so same as mine.
      and if you didn't have to do anything with those lines then i don't need to worry about it...cool

      Now as far as not being able to go back up to 3.56+..........That sucks man

      I guess that means we need the 3.56+ public keys so we can patch the hash checks...........ah ****, we can't resign.....still sucks

    76. bpear96
      07-28-2011
      06:32 PM
      76

      Originally Posted by jarmster
      and i take it your board is the JSD-001 since thats what you included in the norway hwinstall folder, so same as mine.
      and if you didn't have to do anything with those lines then i don't need to worry about it...cool

      Now as far as not being able to go back up to 3.56+..........That sucks man

      I guess that means we need the 3.56+ public keys so we can patch the hash checks...........ah ****, we can't resign.....still sucks
      What about when 3.70 or 3.67 or whatever came out if someone really wanted to (who would) could they update to that since its greater then 3.66?

    77. judges
      07-28-2011
      06:48 PM
      77

      Originally Posted by jarmster
      I guess that means we need the 3.56+ public keys so we can patch the hash checks...........ah ****, we can't resign.....still sucks
      Actually, you'd need the 3.56+ private keys to sign Lv2Diag.elf. At least to get out of factory mode. But that's just my thoughts. Maybe someone else knows different ways.
      ************* [ - Post Merged - ] *************
      Originally Posted by bpear96
      What about when 3.70 or 3.67 or whatever came out if someone really wanted to (who would) could they update to that since its greater then 3.66?
      No, you can't.

    78. jarmster
      07-28-2011
      07:15 PM
      78

      Originally Posted by judges
      So from here on updates are only possible with a service jig, because your systems always expects to run on e.g. 3.66, but it doesn't. All updates without being in factory mode are rejected.

      In factory mode you can go back to e.g. 3.66, but you cannot get out of factory mode, because there's no Lv2Diag.self available for 3.56+.
      I'm not sure i understand, your description seems to indicate updates that are performed through firmware processes. We are bypassing that by flashing directly to the flash with our hardware. I don't understand why we can't reflash what was there originally. The syscon would actually match again. I understand why we can't update through the firmware, but lost why we can't reinstall our original dump.

    79. judges
      07-28-2011
      07:41 PM
      79

      Originally Posted by jarmster
      I'm not sure i understand, your description seems to indicate updates that are performed through firmware processes. We are bypassing that by flashing directly to the flash with our hardware. I don't understand why we can't reflash what was there originally. The syscon would actually match again. I understand why we can't update through the firmware, but lost why we can't reinstall our original dump.
      I've tried so many different things that I'm currently a little uncertain myself. Can't really remember whether I've just reflashed it with the original dump. Sounds like it might work actually.

    80. chaos theory
      07-28-2011
      07:53 PM
      80

      What exactly is the problem with running the Teensy at 16MHz when using 3.3V? Because it looks like writing will take a looong time at 8MHz.

      Also, would it be possible to use this to dump the NOR from devices other than the PS3? I found that an old router of mine also had a 16MB NOR memory and wanted to try it out, but it only has A0-19 pins :s

    81. calimba
      07-28-2011
      08:45 PM
      81

      i dont solder the #WP, #BYTE or VCC to any pin, my board is CECHL01 but is the same CECHL04 im running windows 7 x64 the dump is perfect

    82. judges
      07-28-2011
      09:46 PM
      82

      Originally Posted by chaos theory
      What exactly is the problem with running the Teensy at 16MHz when using 3.3V? Because it looks like writing will take a looong time at 8MHz.

      Also, would it be possible to use this to dump the NOR from devices other than the PS3? I found that an old router of mine also had a 16MB NOR memory and wanted to try it out, but it only has A0-19 pins :s
      Teensy at 16 Mhz at 3.3V might work. But it's past specs. Meaning that it only runs reliable at 8 Mhz at 3.3V. And I didn't test, but I guess writing doesn't even take longer at 8Mhz. Dumping is slower, but writing seems to be as slow as before..

      Might work for other devices as well. But I wonder how you can address 16MB with 20 address lines..

    83. butnut
      07-28-2011
      10:09 PM
      83

      I first want to say thanks to judges for his work.

      I also have a question/idea: lets say you are on 3.66 and you use NORway to downgrade to 3.55, according to judges your ps3 is now unable to be updated anymore, well now that you are on 3.55, if you put your ps3 into service mode and flash 3.55 ofw would that not correct the SYSCON discrepancy?

    84. mindping
      07-28-2011
      10:13 PM
      84

      I thought 3.55 gets stuck in service mode?

    85. butnut
      07-28-2011
      11:33 PM
      85

      Originally Posted by mindping
      I thought 3.55 gets stuck in service mode?
      I just updated to 3.55 entered service mode and then exited it.

    86. Annelies
      07-28-2011
      11:52 PM
      86

      Originally Posted by mindping
      I thought 3.55 gets stuck in service mode?
      3.56+ machines are the ones that are unable to exit Service Mode.

    87. elzincho
      07-29-2011
      01:03 AM
      87

      would this work in the ps3 slim becuase of the slim is nor based

    88. jester
      07-29-2011
      03:01 AM
      88

      Originally Posted by chaos theory
      What exactly is the problem with running the Teensy at 16MHz when using 3.3V? Because it looks like writing will take a looong time at 8MHz.
      The problem is that the board does not have enough power to run so fast. Apparently it can work, but it's an overclock and there is a very good chance that you mess the dump.

    89. calimba
      07-29-2011
      11:49 AM
      89

      i need to solder #WP pin to VCC on the teensy?

      same error with the #WP solder to vcc

    90. jester
      07-29-2011
      02:52 PM
      90

      Originally Posted by calimba
      i need to solder #WP pin to VCC on the teensy?

      same error with the #WP solder to vcc
      nope, WP and BYTE are tied to VCC in the ps3 circuit. (for the NOR these are always set HIGH).

      About your problem, check carefully every connection.
      Are you running teensy at 16mhz?

    91. jarmster
      07-29-2011
      03:19 PM
      91

      What other patches were needed to convert my 3.66 dump to a 3.55 to flash besides writing the 3.55 core os? Patching the hash checks in the core os? or was there a few things that need patched?

    92. calimba
      07-29-2011
      04:11 PM
      92

      im running the NORway 0.2

    93. jester
      07-29-2011
      04:17 PM
      93

      Originally Posted by jarmster
      What other patches were needed to convert my 3.66 dump to a 3.55 to flash besides writing the 3.55 core os? Patching the hash checks in the core os? or was there a few things that need patched?
      i want to know that too what's the process to downgrade? (maybe it can help me with my briked unit :P )

    94. jarmster
      07-29-2011
      04:22 PM
      94

      your jestero from the irc,lol
      Did you patch the hash checks?

      I think you need to patch the Lvl1 hash checks in the 3.55 core os.
      im not entirly sure though, I've not messed with the 355 core os yet.
      Im assuming you need to decrypt the lvl1, patch, and resign it....makes sense i think. I dont think the patch will work on encrypted files, idk though.

      Have you tried to reflash your orig dump yet?

    95. jester
      07-29-2011
      06:58 PM
      95

      Originally Posted by jarmster
      your jestero from the irc,lol
      Did you patch the hash checks?

      I think you need to patch the Lvl1 hash checks in the 3.55 core os.
      im not entirly sure though, I've not messed with the 355 core os yet.
      Im assuming you need to decrypt the lvl1, patch, and resign it....makes sense i think. I dont think the patch will work on encrypted files, idk though.

      Have you tried to reflash your orig dump yet?
      Yes I am the problem is that i bricked my ps3 trying to flash a 3.41 modified by me, to downgrade from 3.55. The installation progress was interrupted at 30%.

      And yes, i have already tried to load the old dump but nothing, 3/4 sec on then 3 bips.

    96. jarmster
      07-29-2011
      07:26 PM
      96

      Your dump was good?
      sounds like hardware issue, connection?
      you checked all connections for continuity, and all connection points?
      You shouldn't have problems flashing even if your dump was all zeros. the hardware should still flash it. Triple check everything. Hell, if you have to, disconnect it and resolder the points again just to be sure.
      not sure what else to tell you.
      I dont think errors in the bin would cause an error in flashing. 30% flash sounds like a bad connection.......find it

      id want to be sure your dump was good too. that would be really important right now since you already started to flash over your original

    97. jester
      07-29-2011
      07:53 PM
      97

      ehm no, maybe i wasn't so clear i hadn't bricked with nor flasher but with a normal upgrade. so i set up a flasher to repair it xD (and the flasher is working properly)

    98. jarmster
      07-29-2011
      08:07 PM
      98

      Ahhhhhhhhhh, ok

      You were able to get a dump though right? It just won't flash.
      I wouldn't flash the orig dump, its corrupt. That won't work.
      Hopefully still good enough to patch with the 3.55 core os

      2nd, the ps3 stays on to read? but not to flash?

    99. calimba
      07-29-2011
      08:11 PM
      99

      im solve the problem
      C:\....\....\....\teensy>NORway.py COM3 write flash.bin
      Pinging...
      Set SB to tristate

      STATUS_DRIVE: False
      STATUS_TRIST_N: True
      STATUS_RESET_N: True
      STATUS_READY: True
      STATUS_CE_N: False
      STATUS_WE_N: True
      STATUS_OE_N: True

      Resetting NOR...
      Ready.

      Sector fe0000 (128/128) [M]...
      Done. [1:08:48]

      thank you very much judges, jester and wizdumb

    100. ps3 prodigy
      07-29-2011
      10:34 PM
      100

      Originally Posted by judges
      Hi there..

      Here comes my initial release of a NOR flasher soft for the PS3 called "NORway". I know, there are other "WIP" projects, but I got a little impatient, so I've decided to create my own solution. It's a port of "noralizer" by marcan, a pretty good working NOR flasher implementation for another FPGA board.

      Anyway, here's the README.txt, which should explain everything:



      PS: I've already managed to downgrade my OFW 3.61 to CFW 3.55. There're minor things to rule out, but expect a downgrade tutorial coming soon..
      PPS: Thanks to defyboy for the original idea of using a Teensy for flashing!

      Update 28th July, 2011:
      v0.2 released! Documentation updated to include the required 3.3V voltage regulator plus Teensy clock rate changed to 8 MHz!
      Download: http://www.megaupload.com/?d=NGLZWRFA
      Hey bro i got a quick question about the soldering pinout i have the jsd-001 board and i know the pinout but my question is there are several points labled GND on the ps3 motherboard but only one GND point on the teensy so which GND on the ps3 motherboard do i solder to the teensy. Thanx alot in advance for your help

    101. calimba
      07-29-2011
      11:38 PM
      101

      you need to solder only one GND

    102. ps3 prodigy
      07-30-2011
      01:04 AM
      102

      Originally Posted by calimba
      you need to solder only one GND
      Thanx thats what i thought. i just asked to double check

    103. judges
      07-30-2011
      02:30 AM
      103

      Originally Posted by jarmster
      your jestero from the irc,lol
      Did you patch the hash checks?

      I think you need to patch the Lvl1 hash checks in the 3.55 core os.
      im not entirly sure though, I've not messed with the 355 core os yet.
      Im assuming you need to decrypt the lvl1, patch, and resign it....makes sense i think. I dont think the patch will work on encrypted files, idk though.
      That's excactly what you have to do. It's just the one patch. First one here ("Patch core OS Hash check //product mode always on"):

      http://ps3devwiki.com/index.php?titl...:Dual_Firmware

      For 3.55: in lv1.elf change 4 bytes at offset 0x2C1FA4 from 0x41 0x9E 0x00 0x1C to 0x60 0x00 0x00 0x00. That's it.
      ************* [ - Post Merged - ] *************
      Originally Posted by calimba
      im solve the problem
      C:\....\....\....\teensy>NORway.py COM3 write flash.bin
      Pinging...
      Good to hear. So what did you do? Maybe others can benefit from it..

    104. dandza
      07-30-2011
      03:05 AM
      104

      Is it possible to write a 3.55 dump from one console and write it to other that is on 3.66?

      Or you have to make some modifications to dump?

    105. GeniusP
      07-30-2011
      05:55 AM
      105

      Will this work on PHAT PS3.

    106. judges
      07-30-2011
      06:28 AM
      106

      Originally Posted by judges
      Originally Posted by jarmster
      I'm not sure i understand, your description seems to indicate updates that are performed through firmware processes. We are bypassing that by flashing directly to the flash with our hardware. I don't understand why we can't reflash what was there originally. The syscon would actually match again. I understand why we can't update through the firmware, but lost why we can't reinstall our original dump.
      I've tried so many different things that I'm currently a little uncertain myself. Can't really remember whether I've just reflashed it with the original dump. Sounds like it might work actually.
      I stand corrected. Of course you can go back to 3.6x if you use the flasher.

    107. GeniusP
      07-30-2011
      07:18 AM
      107

      Is this Teensy 2.0++ with pins or without pins?

    108. dandza
      07-30-2011
      07:20 AM
      108

      I was about to ask the same question, if you are on 3.6x and make a backup flash and then downgrade to 3.55, why would it be not possible to revert back to 3.6x by flasher.
      Now its all clear, thanks judges.

      And about my other question, is it possible to downgrade from flash dump of another console or there has to be some changes made with dump?
      ************* [ - Post Merged - ] *************

      Originally Posted by GeniusP
      Is this Teensy 2.0++ with pins or without pins?
      It doesnt matter if it is with or without pins, its the same board...

    109. Redblade20XX
      07-30-2011
      07:58 AM
      109

      Hey everyone,

      Just a quick question, has anyone tried to re-flash a OtherOS++ NOR dump?
      Thanks for any responses!

      -Red

    110. judges
      07-30-2011
      09:04 AM
      110

      Originally Posted by dandza
      And about my other question, is it possible to downgrade from flash dump of another console or there has to be some changes made with dump?
      No, it's not possible to use a dump from another console. You have to use a modified dump from the same console.
      ************* [ - Post Merged - ] *************
      Originally Posted by GeniusP
      Will this work on PHAT PS3.
      As long as it's NOR flash, it will. Check this out for identification: http://ps3devwiki.com/index.php?title=SKU_Models

    111. jarmster
      07-30-2011
      09:15 AM
      111

      thats awesome judges, thanks for the update

    112. rumblpak
      07-30-2011
      10:33 AM
      112

      Originally Posted by GeniusP
      Is this Teensy 2.0++ with pins or without pins?
      You can technically solder to either one but to put it inside a ps3 I'd recommend the one without pins. Even having said that, if you have to ask that question I really don't think you're up to doing this project.

      @judges Any thought on putting this on a repository to assist with bugs and suggested updates? I got a version that should be working (have a teensy but no time to solder it up) that should dump the NOR at 64 byte chunks from the teensy anyway. I know nothing about python and won't have time to learn what with finals and moving.

    113. toxie
      07-30-2011
      11:06 AM
      113

      Has anyone tried to use the NOR flasher based on UBW32 board ?
      It`s based on a PIC32 controller. According to it`s readme file for dump write it takes 4hours instead of Teensy++ 2hours.

    114. jarmster
      07-30-2011
      11:28 AM
      114

      Originally Posted by calimba
      Resetting NOR...
      Ready.

      Sector fe0000 (128/128) [M]...
      Done. [1:08:48]

      thank you very much judges, jester and wizdumb
      I question the whole 2 hours thing, looks like calimba flashed in 1:08:48.

    115. judges
      07-30-2011
      11:36 AM
      115

      Originally Posted by jarmster
      I question the whole 2 hours thing, looks like calimba flashed in 1:08:48.
      Depends on how many bytes are different from current NOR content and content to be flashed.

      The "write" command only writes bytes that are actually different (read-compare-write). Calimba only replaced cos0 in his dump. If you replace cos0 and cos1 it takes about twice as long. If you use the "program" command (just erase-write), it will always take 128 sectors * 94 secs = ~200 mins.

    116. GeniusP
      07-30-2011
      12:06 PM
      116

      Which is better Teensy++2.0, infectus or progskeet?

    117. wizdumb
      07-30-2011
      01:36 PM
      117

      Originally Posted by GeniusP
      Which is better Teensy++2.0, infectus or progskeet?
      Out of the three I would go with a progskeet as being the best because it can work with both NAND (256mb) and NOR (16mb) flash.

      Although, all of them work great, it just depends on your purpose/needs and budget.

      Infectus- NAND only consoles, older product so support may not be available or limited

      Teensy++- NOR only consoles, price is reasonable, open source

      Progskeet- Both NAND/NOR consoles, higher price, newer product, support will most likely be very good, not limited to reading/writing only to console flash and can be used in other devices.

    118. jarmster
      07-30-2011
      09:00 PM
      118

      I was able to unpack the 3.55 core os
      i was able to unself the lv1
      i was able to patch lv1

      Im stuck on makeself new lv1

      Then i have recreate the core_os_package.pkg with my new lv1
      Then i take it you have to depkg core_os_package.pkg core_os_package.bin

      Then cut that bin into your flash dump
      using what wiz said

      And to swap CORE_OS I would remove 7,340,000 bytes after the second "6F FF E0" then replace it
      with a 3.55 CORE_OS from a retail 3.55 PUP

      Does all this sound about right and if so what the hell is the cmd line for makeself the level 1

      I have all the keys i believe. and i've readself the orig lv1.self so i thought i had the right version and type but it aint working. Someone wanna share, please.
      I'm not even sure if im going about this right, maybe im supposed to use flukes tools?

      And now after thinking about it, should i have used cfw core os instead of ofw. lol im thinking i should have seeing i won't be able to update to cfw.

    119. calimba
      07-30-2011
      11:08 PM
      119

      Originally Posted by jarmster
      I was able to unpack the 3.55 core os
      i was able to unself the lv1
      i was able to patch lv1

      Im stuck on makeself new lv1

      Then i have recreate the core_os_package.pkg with my new lv1
      Then i take it you have to depkg core_os_package.pkg core_os_package.bin

      Then cut that bin into your flash dump
      using what wiz said

      And to swap CORE_OS I would remove 7,340,000 bytes after the second "6F FF E0" then replace it
      with a 3.55 CORE_OS from a retail 3.55 PUP

      Does all this sound about right and if so what the hell is the cmd line for makeself the level 1

      I have all the keys i believe. and i've readself the orig lv1.self so i thought i had the right version and type but it aint working. Someone wanna share, please.
      I'm not even sure if im going about this right, maybe im supposed to use flukes tools?

      And now after thinking about it, should i have used cfw core os instead of ofw. lol im thinking i should have seeing i won't be able to update to cfw.
      only for downgrade NAND consoles and repair brick NOR

      1. Make a dump of the NOR
      2. Open you dump with the HxD and search "6F FF E0" in the offset "C0000"

      3. Open patchcos.bin with HxD too and select all content then paste all content to the dump


      4. Save and flash the modified file, and wait 2 hours
      if you have a black screen use the jig to enter to service mode and try downgrade with necesary files

      http://www.megaupload.com/?d=EOHW4OS2

      thanks to dospiedras for the coreospatch
      DemonHades thank you for trusting me and support and all HadesTeam

    120. butnut
      07-30-2011
      11:41 PM
      120

      @calimba

      I have a slim that came with 3.40 installed I tried to downgrade it from 3.55 kmeaw with the 3.41 that reports as 3.56, but I did not use service mode I just ran the "update" from recovery mode. The install was successful but the ps3 was bricked.

      I believe what I have is a ps3 with 3.41 on the NOR but the SYSCON firmware is 3.55.

      Do you think the patchcos.bin you posted would solve my problem or are the offsets going to be different because my dump will be 3.41 and not 3.55?

    121. jarmster
      07-30-2011
      11:43 PM
      121

      Thanks for the patch, but did you notice that its the core_os twice.....

      K, sorry. i just looked at a dump now and its the same way

    122. calimba
      07-31-2011
      12:19 AM
      122

      Originally Posted by butnut
      @calimba

      I have a slim that came with 3.40 installed I tried to downgrade it from 3.55 kmeaw with the 3.41 that reports as 3.56, but I did not use service mode I just ran the "update" from recovery mode. The install was successful but the ps3 was bricked.

      I believe what I have is a ps3 with 3.41 on the NOR but the SYSCON firmware is 3.55.

      Do you think the patchcos.bin you posted would solve my problem or are the offsets going to be different because my dump will be 3.41 and not 3.55?
      the patch work fine too if you have a brick
      follow the guide and tell me, remember save the dump on a security place

      Thanks for the patch, but did you notice that its the core_os twice
      the patch have the 2 coreos

    123. dandza
      07-31-2011
      03:33 AM
      123

      @calimba Thank you os much for this, is there anything else i should do for a downgrade or this will be enough?

    124. GeniusP
      07-31-2011
      04:22 AM
      124

      Originally Posted by wizdumb
      Out of the three I would go with a progskeet as being the best because it can work with both NAND (256mb) and NOR (16mb) flash.

      Although, all of them work great, it just depends on your purpose/needs and budget.

      Infectus- NAND only consoles, older product so support may not be available or limited

      Teensy++- NOR only consoles, price is reasonable, open source

      Progskeet- Both NAND/NOR consoles, higher price, newer product, support will most likely be very good, not limited to reading/writing only to console flash and can be used in other devices.
      Thank you for your replay very much!!
      I have PS3-CECHH04 40GB is which way is the easiest for me?

    125. calimba
      07-31-2011
      11:13 AM
      125

      Originally Posted by dandza
      @calimba Thank you os much for this, is there anything else i should do for a downgrade or this will be enough?
      that's all

    126. jester
      07-31-2011
      03:19 PM
      126

      Originally Posted by calimba
      you want to do a downgrade?

      1. Make a dump of the NOR
      2. Open you dump with the HxD and search "6F FF E0" in the offset "C0000"
      3. Open patchcos.bin with HxD too and select all content then paste all content to the dump
      4. Save and flash the modified file, and wait 2 hours
      if you have a black screen use the jig to enter to service mode and try downgrade with necesary files
      This patch is for NAND only. I wasted a lot of hours trying that

    127. jarmster
      07-31-2011
      04:19 PM
      127

      Thanks for the heads up jester. We need some sort of procedure. I wasn't really interested in a ready made patch as i was the procedure for patching lv1 or 2 and resigning it.
      If i could figure that out, i could use the disable checks patch on kmeaw cfw, extract the core_os from it and patch it into a nor dump. Not sure if thats the way to go, no one seems to be talking....lol

      ok...
      Ive figured out ps3mfw enough to do some testing and i've patched the lv1 hash checks in kmeaw and 355ofw. I actually opened up the pup's, decrypted the lv1.self's and located the new string.Its all good

      now i was just going to use depkg cmd to create the core_os.bin (cos patch for my nor dump) using the core_os_package.pkg from the modded kmeaw pup, but it create a file size of 0. I was sure it worked on ofw, so i tried with ofw core_os_package.pkg and it did work. So i tried again using ofw that was patched.....no go. Even kmeaw orig pup wouldn't let me make the bin.

      It seems any firmware that has been modified will not work with the depkg cmd to make a .bin file.
      But the unpkg cmd included in cygwin will still unpkg the modded core_os_packages fine. hmmmmm...wtf
      Anyone know a work around to get the bin file from a modded core_os_package.pkg file?
      Will just patching the ofw core_os.bin with a patched kmeaw lv1.self and lv2_kernal.self work?

    128. jester
      08-01-2011
      01:49 PM
      128

      why are you doing that so hard ?
      unpack a pup,
      unself lv1.self,
      patch it by hand,
      rebuild lv1.self using self_rebuilder
      paste it at right offset in your nor dump,
      reflash it

    129. jarmster
      08-01-2011
      02:59 PM
      129

      Originally Posted by jester
      why are you doing that so hard ?
      LMFAO, cause i've had to figure it out myself. But thanks for the tip
      sorry, not by myself, with the help of old threads and trying things for myself...

      This is what i was missing
      rebuild lv1.self using self_rebuilder although this is cmd used by ps3mfw, so in essence i had that too

      Im still a little confused. In order to downgrade to a certain f/w. You need to patch your dump with the complete core_os of the firmware your downgrading to,not just the patched lv1.self.

      2nd, i wont be able to install any other f/w after the downgrade so i need to install the core_os from cfw like kmeaw.

      Kmeaw has lv1 patches and lv2 kernel patches so both selfs need to be patched into the dump, do they not?
      Not to mention the install pkg's and /app_home debug options. Im not even sure about those patches ,lol

      Btw jester, was dospiedra able to fix your flash for you? just curious?

    130. butnut
      08-01-2011
      05:42 PM
      130

      Originally Posted by jester
      This patch is for NAND only. I wasted a lot of hours trying that
      Maybe I am wrong, but if you transfer only ros0 or ros1 it should work even on NOR.

      On another note...
      Does any one know of a program that preforms the reverse operation of norunpack.

    131. jarmster
      08-02-2011
      12:41 AM
      131

      jester,I think i understand now why you said only patch the lv1.self...
      I was really making more work then i had to....

    132. toxie
      08-02-2011
      07:28 AM
      132

      Is it possible to read the dump from other patched 3.55 from offset 0xC0000, and use that to patch the newer fw ?

    133. jester
      08-02-2011
      05:49 PM
      133

      Originally Posted by jarmster
      Btw jester, was dospiedra able to fix your flash for you? just curious?
      Oh yes! It happened that i've prepared a fixed backup ready to flash when i get home, then i spoken with him and he prepared another fix for me. I just gave him trust and tried his fix first (cause you know, you need to choose carefully because flashing takes a lot of time :P). It worked! only later i noticed that he did the same lv1 fixes that i did on my backup He was very kind trying to help me

    134. dandza
      08-03-2011
      12:21 AM
      134

      Ok, same question as toxie. I have dumped nor flash and it was from kmeaw3.55 cfw. I believe that it already has some hash checks disabled and patched core os, am i right? So i was wondering if i only take that core os and paste it in place of 3.66 core os in bin file and flash that back to nor, will it work?

    135. jester
      08-03-2011
      03:13 AM
      135

      Originally Posted by dandza
      Ok, same question as toxie. I have dumped nor flash and it was from kmeaw3.55 cfw. I believe that it already has some hash checks disabled and patched core os, am i right? So i was wondering if i only take that core os and paste it in place of 3.66 core os in bin file and flash that back to nor, will it work?
      I don't know if kmeaw have patched hash checks, but you can give it a try
      If it doesn't work, restore your 3.66 dump.

    136. jarmster
      08-03-2011
      10:45 AM
      136

      Kmaew 3.55 doesnt have the hash check disabled. If you want to install
      Kmeaw3.55 first flash kmeaw355 core_os with hash checks disabled.
      Then make a kmeaw 3.55 pup with hash checks disabled as well and install it
      afterward.

      Im not sure but i think if you just use kmeaw 3.55 core os with checks disabled, and edit your dump with it and flash that. You'll be without install package files icon. Hense the need to install the cfw after you flash.

      I THINK

      I dont think formatting the hard drive after will bring back the icon.
      Those xml edits are made to the dev flash when you install the cfw. I
      dont think those edits are included in the hdd backup on the flash, which is used when you reformat you harddrive after.

      Im still waiting on solderwick and some wire but it would be nice if someone
      could confirm that for me.

    137. judges
      08-03-2011
      11:21 AM
      137

      Originally Posted by jarmster
      Kmaew 3.55 doesnt have the hash check disabled. If you want to install Kmeaw3.55 first flash kmeaw355 core_os with hash checks disabled. Then make a kmeaw 3.55 pup with hash checks disabled as well and install it afterward.
      You don't need to do this. Simply use a ofw 3.55 core os that has hash checks disabled, flash it, put console in service mode and now you can flash whatever firmware pup you like (ofw 3.55, kmeaw, etc., all unpatched).

    138. jarmster
      08-03-2011
      01:00 PM
      138

      And how does that work with the syscon still having the 3.66 hashes?
      Doez the new f/w install rewrite those hashes?

      I was under the impression the reason you couldnt upgrade 3.56+ fw afterwards
      was because the hashes in the syscon were still 3.66. i thought you would have to disable the hash
      checks in any firmware you wanted to use.

    139. judges
      08-03-2011
      04:57 PM
      139

      Originally Posted by jarmster
      And how does that work with the syscon still having the 3.66 hashes? Doez the new f/w install rewrite those hashes?
      No, apparently the new fw doensn't rewrite the hashes. Syscon still thinks you're on 3.66. At least if you're on a downgraded 3.55 (from 3.66) and you're trying to update to any other fw (through xmb or recovery mode), it will say 3.66 or higher is required.

      So in conclusion it seems like syscon hashes are only checked during the update process and only if you're not in service mode.

      So what's the reason for flashing a patched 3.55 coreos? If syscon hash checks aren't patched, you'll not be able to enter service mode (on a system that only has a 3.55 coreos, remaining fw on hdd is e.g. 3.66).

      You can read in many places that you cannot exit service mode from +3.6x fw, because you cannot sign Lv2diag.self for 3.6x. True. But my findings were that you cannot even enter service mode on 3.6x. Simply doesn't work with a standard service jig. And if you could, you'd still need a 3.6x signed Lv2diag.self to downgrade. So you need to flash a 3.55 coreos.

      Well, these are just my experiences, there're probably people out there having more knowledge about this.

    140. jarmster
      08-03-2011
      05:44 PM
      140

      swap drives, format drive....the 3.55 core_os has hdd_copy it writes to the hdd.

      ---just a though

    141. WalangAlam
      08-03-2011
      08:42 PM
      141

      Originally Posted by judges
      I stand corrected. Of course you can go back to 3.6x if you use the flasher.

      Hmm I was actually going to ask this. Got confused and had doubts when you said we can't go back to 3.6 if we downgrade to 3.55. So we could upgrade and downgrade several times by flashing our original dump right?

    142. butnut
      08-03-2011
      09:00 PM
      142

      Originally Posted by calimba
      same error with the 0.2 version

      Code:
      C:\....\teensy>NORway.py COM3 write flash.bin
      Pinging...
      Set SB to tristate
      STATUS_DRIVE:   False
      STATUS_TRIST_N: True
      STATUS_RESET_N: True
      STATUS_READY:   True
      STATUS_CE_N:    False
      STATUS_WE_N:    True
      STATUS_OE_N:    True
      Resetting NOR...
      Ready.
      Sector 000000 (1/128) [M]...
      Traceback (most recent call last):
        File "C:\....\teensy\NORway.py", line 320, in <module>
          n.writerange(addr, data)
        File "C:\....\teensy\NORway.py", line 210, in writerange
          self.writesector(addr/2, data[:0x20000])
        File "C:\....\teensy\NORway.py", line 177, in writesector
          raise NORError("Verification failed")
      __main__.NORError: Verification failed
      I am having this same problem. How did you make it work?

    143. WalangAlam
      08-03-2011
      09:12 PM
      143

      Does the length of the wires have any effect in the reading and flashing of nor? I'm planning to place the teensy outside the ps3 shell, make socket or something so I can plug and unplug the teensy outside the shell. Or maybe cut the wires in the middle and solder them again if I need to reflash.

      nvm. I checked marcan post it seems ok.

    144. Dumbelek
      08-04-2011
      02:47 AM
      144

      can anyone confirm this, patched CORE_OS_PACKAGE.pkg is very different (comparing byte by byte) from the decrypted original CORE_OS_PACKAGE.pkg. So before flash my nor can you pls check this out? Looks like when packing CORE_OS_PACKAGE.pkg file order changing (assuming).

      These 2 pkgs must be the same byte by byte. (am i wrong?)
      dCOS.pkg : decrypted,unpacked,unselfed,no change,selfed,packed "CORE_OS_PACKAGE.pkg"
      odCOS.pkg : decrypted "CORE_OS_PACKAGE.pkg"

    145. toxie
      08-04-2011
      02:47 AM
      145

      Originally Posted by WalangAlam
      Does the length of the wires have any effect in the reading and flashing of nor?
      The length of the wires do have effect on reading and writing.
      Correct me if i`m wrong, but by my oppinion the wire length up to 15-20" should be ok.

    146. jarmster
      08-04-2011
      05:41 AM
      146

      Thats a bit long, lol
      20" is damn near 2 feet

    147. judges
      08-04-2011
      07:21 AM
      147

      Originally Posted by butnut
      I am having this same problem. How did you make it work?
      He told me that he only got that error when the bluray drive was disconnected. Don't know whether it's related..
      ************* [ - Post Merged - ] *************
      Originally Posted by Dumbelek
      can anyone confirm this, patched CORE_OS_PACKAGE.pkg is very different (comparing byte by byte) from the decrypted original CORE_OS_PACKAGE.pkg. So before flash my nor can you pls check this out? Looks like when packing CORE_OS_PACKAGE.pkg file order changing (assuming).
      Yes, it's "very" different. Yes, file order is different. Have a look at the source if you want to know in detail: http://git.dashhacks.com/allps3tools...tools/cospkg.c
      ************* [ - Post Merged - ] *************
      Originally Posted by WalangAlam
      Hmm I was actually going to ask this. Got confused and had doubts when you said we can't go back to 3.6 if we downgrade to 3.55. So we could upgrade and downgrade several times by flashing our original dump right?
      Yes, you can.

    148. butnut
      08-04-2011
      01:41 PM
      148

      Originally Posted by judges
      He told me that he only got that error when the bluray drive was disconnected. Don't know whether it's related..
      I connected my bluray drive but I still get the same error.

      The firmware dumps just fine but I can't write...

    149. jarmster
      08-04-2011
      04:35 PM
      149

      Ok i got some wire today and layed it out. If your installing like judges, (which is a nice setup). You only need 10 inches to start. 10 inches is plenty as you can see

    150. judges
      08-05-2011
      12:45 AM
      150

      Originally Posted by butnut
      I connected my bluray drive but I still get the same error.

      The firmware dumps just fine but I can't write...
      Check your wiring is all I can recommend. If this is occurring with the very first sector, it's probable that you cannot even read correctly (and just don't notice). Upload you dump somewhere, send me a pm with the link and I can have a look at it.

    151. butnut
      08-05-2011
      02:25 AM
      151

      PM has been sent.

    152. jester
      08-05-2011
      06:50 AM
      152

      Originally Posted by butnut
      I connected my bluray drive but I still get the same error.

      The firmware dumps just fine but I can't write...
      I don't think bluray drive connection is relevant. I read and write with the drive disconnected. Is more likely to be a wiring problem. It also can be due to electrical interferences, it happened to me. Try to move the wires and change teensy position

    153. toxie
      08-05-2011
      10:56 AM
      153

      Originally Posted by jester
      I don't think bluray drive connection is relevant. I read and write with the drive disconnected. Is more likely to be a wiring problem. It also can be due to electrical interferences, it happened to me. Try to move the wires and change teensy position
      I agree that the bluray drive connection has nothing to do with the writing, because you have connected the Teensy directly to the chip and have direct access to it.
      I vote for a wiring problem, or some interference.

      butnut, have you connected the GND from Teensy to PS3 ?

    154. jarmster
      08-05-2011
      05:11 PM
      154

      asecure_loader 0x00000820
      eEID 0x0002f000
      cISD 0x0003f000
      cCSD 0x0003f800
      trvk_prg0 0x00040010
      trvk_prg1 0x00060010
      trvk_pkg0 0x00080010
      trvk_pkg1 0x000a0010
      p..ros0 0x000c0000
      p..ros1 0x007c0000
      cvtrm 0x00ec0000

      Some dump offsets
      p..ros0 3.66 start 0x000c0000


      sdk_version---------------- 0x00100470
      spu_pkg_rvk_verifier.self---0x00100478
      spu_token_processor.self----0x0010ffc4
      spu_utoken_procewssor.self--0x0011c8f4
      sc_iso.self-----------------0x00122cc4
      aim_spu_module.self---------0x0013ff9c
      spp_verifier.self-----------0x00144234
      mc_iso_spu_module.self------0x00151a24
      me_iso_spu_module.self------0x00159ab0
      sv_iso_spu_module.self------0x00162368
      sb_iso_spu_module.self------0x0016e3e0
      default.spp-----------------0x00174190
      lv1.self--------------------0x00176490
      lv0-------------------------0x0029a890
      lv2_kernel.self-------------0x00382210
      eurus_fw.bin----------------0x004faea0
      emer_init.sel---------------0x0056be34
      hdd_copy.self---------------0x005ea09c
      manu_info_spu_module.self---0x0064b8b4
      prog.srvk-------------------0x0064cb5c
      pkg.srvk--------------------0x0064ce3c



      And the easiest way i found to actually patch the hash check in any firmware is to use ps3mfw...


      go into the task directory and open up the patch_lv1.tcl file

      set search "\x41\x9E\x00\x1C\x7F\x63\xDB\x78\xE8\xA2\x85\x68\x38\x80\x00\x01"
      set replace "\x60\x00\x00\x00\x7F\x63\xDB\x78\xE8\xA2\x85\x68\x38\x80\x00\x01"
      replace the lines in the file with what you see above. save it (remember to back up original...)
      open ps3mfw and only apply the lv1 patch to ofw355
      When done you have patch ofw. extract coreos, and cut into your dump
      easy peasy.....

    155. butnut
      08-05-2011
      06:50 PM
      155

      @toxie I have connected the GND and made all connections that the directions said to. I will re connect the teensy and see if that helps.

    156. dandza
      08-06-2011
      01:15 AM
      156

      Originally Posted by jarmster
      asecure_loader 0x00000820
      eEID 0x0002f000
      cISD 0x0003f000
      cCSD 0x0003f800
      trvk_prg0 0x00040010
      trvk_prg1 0x00060010
      trvk_pkg0 0x00080010
      trvk_pkg1 0x000a0010
      p..ros0 0x000c0000
      p..ros1 0x007c0000
      cvtrm 0x00ec0000

      Some dump offsets
      p..ros0 3.66 start 0x000c0000


      sdk_version---------------- 0x00100470
      spu_pkg_rvk_verifier.self---0x00100478
      spu_token_processor.self----0x0010ffc4
      spu_utoken_procewssor.self--0x0011c8f4
      sc_iso.self-----------------0x00122cc4
      aim_spu_module.self---------0x0013ff9c
      spp_verifier.self-----------0x00144234
      mc_iso_spu_module.self------0x00151a24
      me_iso_spu_module.self------0x00159ab0
      sv_iso_spu_module.self------0x00162368
      sb_iso_spu_module.self------0x0016e3e0
      default.spp-----------------0x00174190
      lv1.self--------------------0x00176490
      lv0-------------------------0x0029a890
      lv2_kernel.self-------------0x00382210
      eurus_fw.bin----------------0x004faea0
      emer_init.sel---------------0x0056be34
      hdd_copy.self---------------0x005ea09c
      manu_info_spu_module.self---0x0064b8b4
      prog.srvk-------------------0x0064cb5c
      pkg.srvk--------------------0x0064ce3c



      And the easiest way i found to actually patch the hash check in any firmware is to use ps3mfw...


      go into the task directory and open up the patch_lv1.tcl file


      replace the lines in the file with what you see above. save it (remember to back up original...)
      open ps3mfw and only apply the lv1 patch to ofw355
      When done you have patch ofw. extract coreos, and cut into your dump
      easy peasy.....
      Awesome Jarmster, thanks for the tip. That is what i have been trying. instead of modifying it i made another tcl patch task for ps3mf.
      So if we make a custom firmware like kmeaw and insert this hash check patch also, extract cos and write it in binary and then finally flash it back to nor, that way we should get downgraded ps3 with custom firmware and no need to flash it again, right?
      What about the firmware on HDD?

    157. jarmster
      08-06-2011
      01:36 AM
      157

      Just flash an ofw patched cos, then install the cfw. That takes care of the f/w on the hdd.
      If you flashed a patched kmeaw cos....same. install the cfw overtop

    158. dandza
      08-06-2011
      01:46 AM
      158

      Ok, will try that this weekend and post results, thanks every1.

    159. Dumbelek
      08-06-2011
      08:24 AM
      159

      Originally Posted by jarmster
      asecure_loader 0x00000820
      eEID 0x0002f000
      cISD 0x0003f000
      cCSD 0x0003f800
      trvk_prg0 0x00040010
      trvk_prg1 0x00060010
      trvk_pkg0 0x00080010
      trvk_pkg1 0x000a0010
      p..ros0 0x000c0000
      p..ros1 0x007c0000
      cvtrm 0x00ec0000

      Some dump offsets
      p..ros0 3.66 start 0x000c0000


      sdk_version---------------- 0x00100470
      spu_pkg_rvk_verifier.self---0x00100478
      spu_token_processor.self----0x0010ffc4
      spu_utoken_procewssor.self--0x0011c8f4
      sc_iso.self-----------------0x00122cc4
      aim_spu_module.self---------0x0013ff9c
      spp_verifier.self-----------0x00144234
      mc_iso_spu_module.self------0x00151a24
      me_iso_spu_module.self------0x00159ab0
      sv_iso_spu_module.self------0x00162368
      sb_iso_spu_module.self------0x0016e3e0
      default.spp-----------------0x00174190
      lv1.self--------------------0x00176490
      lv0-------------------------0x0029a890
      lv2_kernel.self-------------0x00382210
      eurus_fw.bin----------------0x004faea0
      emer_init.sel---------------0x0056be34
      hdd_copy.self---------------0x005ea09c
      manu_info_spu_module.self---0x0064b8b4
      prog.srvk-------------------0x0064cb5c
      pkg.srvk--------------------0x0064ce3c



      And the easiest way i found to actually patch the hash check in any firmware is to use ps3mfw...


      go into the task directory and open up the patch_lv1.tcl file


      replace the lines in the file with what you see above. save it (remember to back up original...)
      open ps3mfw and only apply the lv1 patch to ofw355
      When done you have patch ofw. extract coreos, and cut into your dump
      easy peasy.....
      i cant decrypt CORE_OS_PACKAGE.pkg this way...
      1- Edited "patch_lv1.tcl" and started PS3MFW checked only "Patch LV1 Hypervisor" task. And in task options unchecked "Allow mapping of any memory area (Needed for LV2 Poke)" option
      2- Build MFW --successful
      3- Extracted M355.PUP with PUPExtractor, extracted CORE_OS_PACKAGE.pkg from File_7.tar. ( Size : 5.090 KB - 5.212.160 bytes )
      4- >fwpkg d "CORE_OS_PACKAGE.pkg" "DECRYPTED_COS.pkg" --no error ( Size : 5.089 KB - 5.211.094 bytes )
      When I check decrypted cos with hex editor its not start with "o�� - 6F FF E0 hex pattern"

      Can you check it out from your process? There must be a difference between our processes.

    160. jarmster
      08-06-2011
      10:10 AM
      160

      sorry that wont work,lol

      give me a sec,lol



      kkk, use geo's ( depkg core_os_package.pkg core_os.bin) on ofw 3.55
      this cmd wont work on patched pkg files, hense the 3.55 ofw

      This will create one big bin file of your 355 core_os.
      Now you need to patch it with a modded lv1.self

      Now do the ps3mfw patch i showed you
      leave the checkmark in the task box. some patches do more then one task. if you uncheck it it wont do the patch.

      After the pup is patched, extract the core_os, and grab lv1.self

      open both lv1.self and you core_os.bin in a hex editor
      select all of your lv1.self / right click /copy
      click over to your core_os.bin
      goto offset 0x0010fb80 / click it
      scroll down to offset 0x0023661f/ hold shift/click it-----------this should highlight the selection
      rightclick / paste

      Save modded_core_os.bin
      Patch cos0 from dump with that bin

      And make sure when you patch the cos0 you dont change cos1 offset from 0x007c0000, understand

    161. wizdumb
      08-06-2011
      11:19 AM
      161

      Jarmster, your first process on how to patch modify CORE_OS worked for me using PS3 Firmware ToolBox and the decrypt .pkg function to decrypt the extracted CORE_OS package after using mfwbuilder to patch lv1 from ofw 3.55. I would post it but I think it is not allowed.

    162. jarmster
      08-06-2011
      11:50 AM
      162

      Man it would have been so much easier if the depkg worked on a modded core os package....oh well. theres enough info, people shouldn't have a problem now.

      Does decrypt.pkg create a bin file like the depkg.exe does?

    163. wizdumb
      08-06-2011
      12:36 PM
      163

      For me it stays as a .pkg file but all the info is how it should be when opened in a hex editor.

    164. dandza
      08-06-2011
      04:35 PM
      164

      Originally Posted by Dumbelek
      i cant decrypt CORE_OS_PACKAGE.pkg this way...
      1- Edited "patch_lv1.tcl" and started PS3MFW checked only "Patch LV1 Hypervisor" task. And in task options unchecked "Allow mapping of any memory area (Needed for LV2 Poke)" option
      2- Build MFW --successful
      3- Extracted M355.PUP with PUPExtractor, extracted CORE_OS_PACKAGE.pkg from File_7.tar. ( Size : 5.090 KB - 5.212.160 bytes )
      4- >fwpkg d "CORE_OS_PACKAGE.pkg" "DECRYPTED_COS.pkg" --no error ( Size : 5.089 KB - 5.211.094 bytes )
      When I check decrypted cos with hex editor its not start with "o�� - 6F FF E0 hex pattern"

      Can you check it out from your process? There must be a difference between our processes.
      I have the same problem here... problem with decrypting patched cos.
      ************* [ - Post Merged - ] *************
      Originally Posted by wizdumb
      Jarmster, your first process on how to patch modify CORE_OS worked for me using PS3 Firmware ToolBox and the decrypt .pkg function to decrypt the extracted CORE_OS package after using mfwbuilder to patch lv1 from ofw 3.55. I would post it but I think it is not allowed.
      I tried PS3 Firmware ToolBox but I get the same result. Dumbelek used the "fwpkg d "CORE_OS_PACKAGE.pkg" "DECRYPTED_COS.pkg" and its the same command that PS3 Firmware ToolBox uses, so i really dont know how you got a good decrypted patched cos?
      ************* [ - Post Merged - ] *************
      Originally Posted by jarmster
      sorry that wont work,lol

      give me a sec,lol



      kkk, use geo's ( depkg core_os_package.pkg core_os.bin) on ofw 3.55
      this cmd wont work on patched pkg files, hense the 3.55 ofw

      This will create one big bin file of your 355 core_os.
      Now you need to patch it with a modded lv1.self

      Now do the ps3mfw patch i showed you
      leave the checkmark in the task box. some patches do more then one task. if you uncheck it it wont do the patch.

      After the pup is patched, extract the core_os, and grab lv1.self

      open both lv1.self and you core_os.bin in a hex editor
      select all of your lv1.self / right click /copy
      click over to your core_os.bin
      goto offset 0x0010fb80 / click it
      scroll down to offset 0x0023661f/ hold shift/click it-----------this should highlight the selection
      rightclick / paste

      Save modded_core_os.bin
      Patch cos0 from dump with that bin

      And make sure when you patch the cos0 you dont change cos1 offset from 0x007c0000, understand
      This is not going to work because of this line: "After the pup is patched, extract the core_os, and grab lv1.self"

      How can we grab lv1.self if we cant decrypt modified core_os? Or am i missing something?

      If we could decrypt modified core_os to grab lv1.self then we dont need this procedure, the first one would work, right?

    165. jarmster
      08-06-2011
      05:51 PM
      165

      "After the pup is patched, extract the core_os, and grab lv1.self"

      pupXtractor the pup
      extract the core_os from the update_files rar
      using cygwin use the cmd unpkg core_os_package.pkg core_os

      That will unpackage the files in the core_os directory
      the patched lv1.self will be in that folder.
      open that in your hex editor.

      The only reason i use ps3mfw to patch, was i was having problems making the new modified self with cygwin. This program did it all for me.
      The only thing was, i would need to go back into the pup to recover the modified lv1.self to patch the core_os with. eh, it works

      depkg core_os_package.pkg core_os.bin---------used at a dos prompt and creates 1 large bin file of your core_os---doesn't work with patched pkgs
      unpkg.exe core_os_package.pkg core_os---------used with cygwin, creates a core_os directory with all the files in it---works with all patched pkgs

      i hope that clears some confusion....

    166. butnut
      08-07-2011
      02:58 AM
      166

      I was told by someone very reputable that I should make sure WP#/ACC was tied to VCC but I am unsure how to proceed. Should I physically tie the corresponding pin from the flash chip to any NOR VCC test point? Is that how it is done? I have tried checking the resistance between the two points, and I came up with 0.00 so I would like to try tying WP#/ACC and BYTE# to VCC before succumbing to the possibility that I may have a hardware issue.

    167. dandza
      08-07-2011
      06:51 AM
      167

      I would go for NOR VCC since its 3.3V and that stands for logical 1 = enable
      ************* [ - Post Merged - ] *************

      Originally Posted by jarmster
      "After the pup is patched, extract the core_os, and grab lv1.self"

      pupXtractor the pup
      extract the core_os from the update_files rar
      using cygwin use the cmd unpkg core_os_package.pkg core_os

      That will unpackage the files in the core_os directory
      the patched lv1.self will be in that folder.
      open that in your hex editor.

      The only reason i use ps3mfw to patch, was i was having problems making the new modified self with cygwin. This program did it all for me.
      The only thing was, i would need to go back into the pup to recover the modified lv1.self to patch the core_os with. eh, it works

      depkg core_os_package.pkg core_os.bin---------used at a dos prompt and creates 1 large bin file of your core_os---doesn't work with patched pkgs
      unpkg.exe core_os_package.pkg core_os---------used with cygwin, creates a core_os directory with all the files in it---works with all patched pkgs

      i hope that clears some confusion....
      Thanks, i managed to decrypt with unpkg from ps3mfw builder and then renamed content to content.pkg and then used ps3 toolbox to unpack it and got my modified lv1.self.
      That means that tutorial 1 is also working.

      BUT, the thing is when i unself lv1.self (original) and lv1.self (patched) and get lv1.elf, it seems like the patching is not good.
      set search and set replace command starts to modify it from x78 instead of x41. Like its moved for 7 fields.
      Here is a picture of comparing those two elfs in hxd.

      Can anyone check that please?

    168. jarmster
      08-07-2011
      08:18 AM
      168

      hmmmm, your right....
      Thats weird..

      change
      catch_die {:atch_elf $elf $search 7 $replace} \
      to
      catch_die {:atch_elf $elf $search 0 $replace} \


      should be good to go now....


      http://www.mediafire.com/?59aap9do9452h3g
      here you guys go....modded_core_os.bin

    169. dandza
      08-07-2011
      09:05 AM
      169

      In the meantime i modified another script i had and tested it few minutes ago, now its all ok.

      If anyone needs it just pm me.

      Thanks again to every1 that helped me and others.

      By the way, to jump over a few steps and make things easier, when you finish with patching in ps3mfw builder,
      go to "\Temp\PS3MFW-MFW\update_files\CORE_OS_PACKAGE.unpkg\" in your ps3mfw folder, there is a file named "content" that is a decrypted modified CORE_OS_PACKAGE, just rename it to whatever you like and paste its content in your NOR dump at previously mentioned offsets by jarmster.

    170. jarmster
      08-07-2011
      09:27 AM
      170

      sweet dandza, thanks for the working script
      I don't know what i was doing wrong but i couldn't get the original script to work. Thats why i was patching the lv1 script....

    171. WalangAlam
      08-07-2011
      08:00 PM
      171

      Is it advisable to replace the thermal paste after teardown and flashing? or we just put it back using the original thermal paste?

    172. jarmster
      08-07-2011
      08:19 PM
      172

      replace.....

    173. WalangAlam
      08-08-2011
      01:52 AM
      173

      ops sorry I was thinking I will have to remove the heat sink at replace later the thermal paste. Mine is JSD-001. Now to look for diagram and solder the wires... Which part of the ps3 shell can we pass the wires?

    174. toxie
      08-08-2011
      01:56 AM
      174

      You can just solder the wires, and flip the board, so the wires are down. I was doing like that on JSD-001. After i flipped it, i`ve attached the PSU, and the buttons, so i could turn it on, to ensure proper power supply to the NOR. (Haven`t connected the 3.3V from the flasher to the JSD-001). If the board is heating, you could place some fan over there to cool it.

    175. WalangAlam
      08-08-2011
      02:23 AM
      175

      Originally Posted by toxie
      You can just solder the wires, and flip the board, so the wires are down. I was doing like that on JSD-001. After i flipped it, i`ve attached the PSU, and the buttons, so i could turn it on, to ensure proper power supply to the NOR. (Haven`t connected the 3.3V from the flasher to the JSD-001). If the board is heating, you could place some fan over there to cool it.
      I'm thinking of just leaving the wires there so I can reflash later without opening. So I can do the dump, flashing, then turn on the ps3 without putting back the fan, bd drive, and other ps3 cables? I just need the PSU and switch attached?

    176. toxie
      08-08-2011
      02:30 AM
      176

      Originally Posted by WalangAlam
      I'm thinking of just leaving the wires there so I can reflash later without opening. So I can do the dump, flashing, then turn on the ps3 without putting back the fan, bd drive, and other ps3 cables? I just need the PSU and switch attached?
      For flashing, dumping, you don`t need to have the bd and the other cables connected. You need the fan, switch and the PSU. Without fan, it will overheat, start beeping and it will turn off due to the thermal protection. Without his fan you could damage the PS3 unit.

    177. dandza
      08-08-2011
      03:15 AM
      177

      If, for example, the firmware in NOR is damaged and there are no good backups, can it be fixed by taking some other NOR dump with the same version (lets say its 3.66) make a core os patch and lv1 hashcheck patch from 3.55, and write it back to a bricked unit?

    178. WalangAlam
      08-08-2011
      03:34 AM
      178

      how about the 2 clips with 4 big screws for the heat sinks? do I need to put them back?
      Any tutorial link for downgrading firmware yet?

    179. toxie
      08-08-2011
      08:58 AM
      179

      Originally Posted by WalangAlam
      how about the 2 clips with 4 big screws for the heat sinks? do I need to put them back?
      Any tutorial link for downgrading firmware yet?
      i removed them.

    180. WalangAlam
      08-08-2011
      09:17 AM
      180

      now to find that 3v voltage regulator...any 3v in 3rld xbox :D

    181. toxie
      08-08-2011
      10:32 AM
      181

      why do you need the 3.3V regulator? you could use the ps3 psu . anybody should correct me if i`m wrong.

    182. Dumbelek
      08-08-2011
      11:36 AM
      182

      so after judges any success story?
      ************* [ - Post Merged - ] *************

      Originally Posted by toxie
      why do you need the 3.3V regulator? you could use the ps3 psu . anybody should correct me if i`m wrong.
      they say, 5V can damage your teensy. I read somewhere but i cant remember now, check first post there is an update about 3.3V regulator.

    183. judges
      08-08-2011
      01:16 PM
      183

      Originally Posted by Dumbelek
      they say, 5V can damage your teensy. I read somewhere but i cant remember now, check first post there is an update about 3.3V regulator.
      5V might damage your NOR, not your teensy. You can use the console to feed the teensy with 3V, but it has the disadvantage that you cannot lock TRISTATE fast enough.

      Btw, those of you who dump their flashs all day long might be happy to hear that I've just optimized the dumping speed to 45secs for a complete NOR. Let's see whether writing speed can be optimized as well and I'll release an update..

    184. judges
      08-09-2011
      05:52 AM
      184

      NORway v0.3 has been released!

      Dumping now only takes 45 secs instead of over 5 mins!
      Writing now only takes about 8.5 mins instead of over 2 hours!

      Please refer to the first post for an updated download link.

    185. bluemimmosa
      08-09-2011
      06:00 AM
      185

      Well done judges, you have done a very hardwork and its been seen here, a very great time reduction and now very comparable to progskeet.
      and what about the downgrade solution for 3.56 and above on ps3 slim. Are you still working on it or are there any hurdles down, can u discuss them?

    186. WalangAlam
      08-09-2011
      08:01 AM
      186

      Originally Posted by judges
      5V might damage your NOR, not your teensy. You can use the console to feed the teensy with 3V, but it has the disadvantage that you cannot lock TRISTATE fast enough.

      Btw, those of you who dump their flashs all day long might be happy to hear that I've just optimized the dumping speed to 45secs for a complete NOR. Let's see whether writing speed can be optimized as well and I'll release an update..
      how do I use the console to feed the teensy with 3v? I can't find 3v and I will need to buy from the internet again. Cannot lock TRISTATE fast enough? what does this mean?

      wow you did a good job judges speeding it up

    187. toxie
      08-09-2011
      09:56 AM
      187

      Need, help, PS3 CECHL04 when you turn it on it gives me :
      Cannot start.The correct hard disk was not found.
      After inserting the hard drive it gives me :
      The system software cannot be run correctly,press the PS button to try restart the system.
      After pressing the PS button, it gives me:
      The system software cannot be run correctly.Press the PS button to try to restart the system.
      If the system cannot be restarted, the system partition of the hard disk must be reformatted and you must reinstall the system sofware.
      Connect storage media that contains update data of version 3,56 or later, and then press the START and SELECT buttons at the same time.
      For information on how to obtain update data, refer to the SCE Web site for your region.

      Is this error fixable or not ?

      My friend says that he just formatted the hdd, and also says that it was 3.55 kmeaw in it.

    188. wizdumb
      08-09-2011
      10:17 AM
      188

      Originally Posted by bluemimmosa
      Well done judges, you have done a very hardwork and its been seen here, a very great time reduction and now very comparable to progskeet.
      and what about the downgrade solution for 3.56 and above on ps3 slim. Are you still working on it or are there any hurdles down, can u discuss them?
      All the needed info to downgrade is within this thread. Although it is scattered, one should be able to piece it together and perform the the downgrade with the given info.

      In short:

      - Dump NOR (multiple times to be safe) and verify with norpatch.exe (included)
      - Grab a modified CORE_OS (the steps/updated script to do this are a few pages back
      - Open a hex editor with your NOR and the modified CORE_OS
      - Copy all contents within the modified CORE_OS
      - Using the hex editor search for "6FFFE0" in your original NOR and replace the copied contents of the modified CORE_OS after the second "6FFFE0"
      - Lastly, flash your console with your new modified NOR

      From there, I believe you have to lv2diag.self into service mode with a dongle, flash 3.55, and finally lv2diag.self out of service mode (someone correct me if I'm wrong.)

    189. judges
      08-09-2011
      02:16 PM
      189

      Originally Posted by bluemimmosa
      Well done judges, you have done a very hardwork and its been seen here, a very great time reduction and now very comparable to progskeet.
      and what about the downgrade solution for 3.56 and above on ps3 slim. Are you still working on it or are there any hurdles down, can u discuss them?
      Well, I was under the impression that you guys figured out how to downgrade. I personally wouldn't create a MFW task to do it as described in this thread, but who cares as long as it does the job. But if I get bored, I might still create a tutorial..
      ************* [ - Post Merged - ] *************
      Originally Posted by wizdumb
      - Open a hex editor with your NOR and the modified CORE_OS
      - Copy all contents within the modified CORE_OS
      - Using the hex editor search for "6FFFE0" in your original NOR and replace the copied contents of the modified CORE_OS after the second "6FFFE0"
      This can also be done with norpatch.exe that is provided with v0.3. Not a big deal, but helps preventing mistakes.

      And depending on your console you might always want to replace cos0 and cos1. The older ones have a backup core os stored at cos1 (and it never changes, eg. OFW 2.80). But eg. my console is alternating cos0 and cos1 between updates.

      Originally Posted by wizdumb
      From there, I believe you have to lv2diag.self into service mode with a dongle, flash 3.55, and finally lv2diag.self out of service mode (someone correct me if I'm wrong.)
      To be correct, you enter service mode with a dongle (service jig, psgrade), put lv2diag.self (file1) together with a PS3UPDAT.PUP in the root folder on a stick, update, put lv2diag.self (file2) on the stick and leave service mode.
      ************* [ - Post Merged - ] *************
      Originally Posted by toxie
      Is this error fixable or not ?

      My friend says that he just formatted the hdd, and also says that it was 3.55 kmeaw in it.
      Don't know why the console should ask for 3.56 if it has been on 3.55 before (unless it has been flashed to 3.55 from 3.56).

      But first I would try to enter service mode and re-install a 3.55. If that doesn't work you still should be able to flash your way back.
      ************* [ - Post Merged - ] *************
      Originally Posted by WalangAlam
      how do I use the console to feed the teensy with 3v? I can't find 3v and I will need to buy from the internet again. Cannot lock TRISTATE fast enough? what does this mean?

      wow you did a good job judges speeding it up
      Thanks. Please follow this guide to power teensy externally: https://www.pjrc.com/teensy/external_power.html

      Apply "Option #1" and "Option #2" and also short the 3V pads on teensy. Then connect teensy's Vcc pad to any of the console's Vcc pads.

      "norway.py comx" sets tristate to logic "1", which prevents the console from booting. If your teensy is powered by the console you cannot set tristate fast enough, because teensy's USB is not yet powered and you can't send any commands. This might lead to the console shutting down again if it's bricked.

    190. WalangAlam
      08-09-2011
      03:58 PM
      190

      Originally Posted by wizdumb
      From there, I believe you have to lv2diag.self into service mode with a dongle, flash 3.55, and finally lv2diag.self out of service mode (someone correct me if I'm wrong.)
      how to lv2diag.self into service mode? what dongle?

      I guess I have to read about downgrading yet.

    191. Dumbelek
      08-09-2011
      08:39 PM
      191

      Originally Posted by judges
      To be correct, you enter service mode with a dongle (service jig, psgrade), put lv2diag.self (file1) together with a PS3UPDAT.PUP in the root folder on a stick, update, put lv2diag.self (file2) on the stick and leave service mode.
      When I decided to turn back to 3.66, just dumping original nor will be enough?? ( no service mode , etc.. right?)

    192. judges
      08-09-2011
      11:07 PM
      192

      Originally Posted by Dumbelek
      When I decided to turn back to 3.66, just dumping original nor will be enough?? ( no service mode , etc.. right?)
      That's right. Of course you'd still have to have an OFW 3.66 PUP ready (to update the hdd part).

    193. Dumbelek
      08-10-2011
      03:31 AM
      193

      Originally Posted by judges
      That's right. Of course you'd still have to have an OFW 3.66 PUP ready (to update the hdd part).
      Sorry, I'm confused now..

      Everytime we change (upgrade or downgrade) firmware with nor dumping method, do we have to "Enter service mode -> lv2diag.self (file1) + PS3UPDAT.PUP -> lv2diag.self (file2)" routine?

    194. dandza
      08-10-2011
      03:35 AM
      194

      Yes, you have to reconstruct the firmware on hdd, and that is the easiest way.

      Sent from my LG-P920 using Tapatalk

    195. jarmster
      08-10-2011
      05:14 AM
      195

      and what would happen if swapped out the drive for a empty one before i rebooted after i flashed the nor

    196. dandza
      08-10-2011
      05:23 AM
      196

      On boot sony detects an empty drive and ask you to format it. After format it ask you to update firmware, since it is still 3.66 in syscon it will ask for 3.66 update, so only way to bypass this is to go into service mode and update to 3.55 and then leave service mode, but only if you have patched 3.55 coreOS in NOR.

    197. judges
      08-10-2011
      05:29 AM
      197

      Originally Posted by Dumbelek
      Sorry, I'm confused now..

      Everytime we change (upgrade or downgrade) firmware with nor dumping method, do we have to "Enter service mode -> lv2diag.self (file1) + PS3UPDAT.PUP -> lv2diag.self (file2)" routine?
      Let's assume you downgraded from 3.66 and you want to go back to 3.66 or greater. Then 3.66 is the version that syscon knows about and you can update to >=3.66 without entering service mode. Service mode is only required for installations smaller than syscon version.

    198. bluemimmosa
      08-10-2011
      06:27 AM
      198

      ok, so this means, that we dump the nor and patch the core os with 3.55 info and then write it back to nor, after that we enter service mode and flash 3.55 and exit service mode.
      the problem with normal downgrade with psgrade was we cannot downgrade to 3.55 from service mode but by patching core os we can downgrade and exit service mode with old lv2diag.self files right.? ok thats what i understood.

    199. judges
      08-10-2011
      06:52 AM
      199

      Originally Posted by bluemimmosa
      ok, so this means, that we dump the nor and patch the core os with 3.55 info and then write it back to nor, after that we enter service mode and flash 3.55 and exit service mode.
      the problem with normal downgrade with psgrade was we cannot downgrade to 3.55 from service mode but by patching core os we can downgrade and exit service mode with old lv2diag.self files right.? ok thats what i understood.
      That's correct. You cannot even enter service mode on 3.56+ (at least I couldn't on 3.61). And even if you could, you don't have signed lv2diag.self files for 3.56+ because of missing private keys.

    200. bluemimmosa
      08-10-2011
      07:09 AM
      200

      Originally Posted by judges
      That's correct. You cannot even enter service mode on 3.56+ (at least I couldn't on 3.61). And even if you could, you don't have signed lv2diag.self files for 3.56+ because of missing private keys.
      So by patching coreos the ps3 will need 3.55 keys to enter and exit servic emode right?
      great hack indeed. and one more question?
      After we downgrade to 3.55 what will the syscon have in it? does it still refer to newer firmware or it is also updated by mfg_updating prodecure through service mode?
      :D

    201. jarmster
      08-10-2011
      10:57 AM
      201

      ok..........

      i wish we could just patch out the whole version check in the cfw so we dont need service mode in 3.55. The f/w wouldn't give a **** what the syscon says and install. Obviously the hash check isn't the only check that needs patched.

    202. Dumbelek
      08-10-2011
      07:42 PM
      202

      i hope they cant fix this with firmware update. for example 3.70

    203. judges
      08-10-2011
      11:29 PM
      203

      Originally Posted by bluemimmosa
      So by patching coreos the ps3 will need 3.55 keys to enter and exit servic emode right?
      Correct.

      Originally Posted by bluemimmosa
      After we downgrade to 3.55 what will the syscon have in it? does it still refer to newer firmware or it is also updated by mfg_updating prodecure through service mode?
      :D
      Syscon always claims to be on the newest firmware ever installed.

    204. Nikitis
      08-11-2011
      01:27 AM
      204

      Someone should post an honest to goodness step by step picture guide with links to needed files etc.

      I just read through all the pages, and am still confused. So many questions being asked which could all be resolved with a good detailed guide.

    205. bluemimmosa
      08-11-2011
      02:45 AM
      205

      Originally Posted by jarmster
      hmmmm, your right....
      Thats weird..

      change
      catch_die {:atch_elf $elf $search 7 $replace} \
      to
      catch_die {:atch_elf $elf $search 0 $replace} \


      should be good to go now....


      http://www.mediafire.com/?59aap9do9452h3g
      here you guys go....modded_core_os.bin
      @judges @jarmaster
      Can we use this modified core_os.bin and replace the nor from the offset we find that 6FFFE0 and just flash the resulting nor flash image. Is this core_os.bin ok to downgrade ps3 slim to 3.55. If yes, i am gonna try now.
      ************* [ - Post Merged - ] *************
      Originally Posted by judges
      Correct.



      Syscon always claims to be on the newest firmware ever installed.
      So its the patch on core_os that is not letting the syscon hash to be checked... hence we can format our hdd back to 3.55 right?

    206. judges
      08-11-2011
      03:36 AM
      206

      Originally Posted by bluemimmosa
      @judges @jarmaster
      Can we use this modified core_os.bin and replace the nor from the offset we find that 6FFFE0 and just flash the resulting nor flash image. Is this core_os.bin ok to downgrade ps3 slim to 3.55. If yes, i am gonna try now.
      Don't know, didn't try that one. Just make sure that your dump is okay and keep the original in a safe place! Use "norpatch.exe" provided with v0.3 to verify your dump. If you were on an OFW, it will recognize the fw version of your dump. If it can't recognize the fw version, you most likely have a corrupt dump. Then by all means DO NOT RE-FLASH YOUR CONSOLE.

      You can also use norpatch.exe to integrate the new coreos into your dump.

      Originally Posted by bluemimmosa
      So its the patch on core_os that is not letting the syscon hash to be checked... hence we can format our hdd back to 3.55 right?
      Without the patch you wouldn't be able to enter service mode.

    207. wizdumb
      08-11-2011
      10:08 AM
      207

      Originally Posted by judges
      Use "norpatch.exe" provided with v0.3 to verify your dump. If you were on an OFW, it will recognize the fw version of your dump. If it can't recognize the fw version, you most likely have a corrupt dump. Then by all means DO NOT RE-FLASH YOUR CONSOLE.

      You can also use norpatch.exe to integrate the new coreos into your dump.
      @Judges (or to anyone who knows the answer), just to clarify using the norpatch.exe app, only ros0 and r0s1 are needed to show to confirm the dump is good?

      For example:



      Does it matter if PRG0, PRG1, PKG0, and PKG1 are unknown?

    208. kada
      08-11-2011
      10:25 AM
      208

      I dumped flash but when checked with norpatch is says all areas unknown.I dumped 50 times but still same.Any idea?

    209. judges
      08-11-2011
      10:28 AM
      209

      Originally Posted by wizdumb
      @Judges (or to anyone who knows the answer), just to clarify using the norpatch.exe app, only ros0 and r0s1 are needed to show to confirm the dump is good?

      Does it matter if PRG0, PRG1, PKG0, and PKG1 are unknown?
      It should be sufficient if ros0/1 can be identified. On my console I also was only able to identify PRG0 plus ros areas.

      But you might want to do more than one dump and binary compare the different dumps to be on the safe side.
      ************* [ - Post Merged - ] *************
      Originally Posted by kada
      I dumped flash but when checked with norpatch is says all areas unknown.I dumped 50 times but still same.Any idea?
      Is your console running an OFW? Or is it eg. a bricked 3.55 or something like that?

    210. kada
      08-11-2011
      10:43 AM
      210

      FW was 3.55 kmeaw then I soldered teensy ++ so I think at least i have 3.55 kmeaw dump.Then I installed ofw 3.55 when teensy still soldered(not connected to pc) then updated 3.61 but my dumps are unknown.maybe problem i update teensy soldered?

    211. judges
      08-11-2011
      11:03 AM
      211

      Originally Posted by kada
      FW was 3.55 kmeaw then I soldered teensy ++ so I think at least i have 3.55 kmeaw dump.Then I installed ofw 3.55 when teensy still soldered(not connected to pc) then updated 3.61 but my dumps are unknown.maybe problem i update teensy soldered?
      norpatch.exe does only recognize OFWs, so it would report a 3.55 kmeaw (and any other CFW) as unknown. But if you updated to 3.61 (doesn't matter whether teensy is soldered) and dumped your flash again, norpatch should recognize it. If it doesn't it's most likely that your dump is corrupt (-> check wiring).

    212. kada
      08-11-2011
      11:08 AM
      212

      I desoldered and reflash 3.61 and resoldered teensy but still same.MB rev DYN-001 is there any additional wires?

      Edit:

      I checked wires and solder pads, changed USB cable reflash teensy.Still unknown version by norpatcher.
      I'm using win7 x64.I cant get what im doing wrong...

      I think its wiring problem but im using 80pin IDE HDD cable wires.these are used for data carrying

    213. judges
      08-11-2011
      02:29 PM
      213

      Originally Posted by kada
      I desoldered and reflash 3.61 and resoldered teensy but still same.MB rev DYN-001 is there any additional wires?

      Edit:

      I checked wires and solder pads, changed USB cable reflash teensy.Still unknown version by norpatcher.
      I'm using win7 x64.I cant get what im doing wrong...

      I think its wiring problem but im using 80pin IDE HDD cable wires.these are used for data carrying
      After inspecting the dumps you've send me, it seems like your wiring might actually be okay. Still both of your dumps are corrupted.

      What NORway version are you using?
      Have you recompiled the source?
      Are you using a voltage regulator?
      Were both dumps made with the same wiring?

    214. kada
      08-11-2011
      02:37 PM
      214

      Norway 0.3,
      I'm using voltage regulator dumps are from same wiring.
      i didnt compile source just use hex provided.

    215. toxie
      08-11-2011
      03:31 PM
      215

      Originally Posted by kada
      Norway 0.3,
      I'm using voltage regulator dumps are from same wiring.
      i didnt compile source just use hex provided.
      After every dump, you`re getting different dumps ?

    216. bpear96
      08-11-2011
      10:17 PM
      216

      Hey, looks like this is making some great progress. i really want one for my ps3 but 1. dont have a soldering iron 2. never soldered before 3. dont want to screw things up so.. i was wondering if there is anyone out there who would be willing to solder it for me. Like maybe i could ship it to you can you solder it for me then send it back. Right now im just looking to see how much someone would charge to do this. Prefer someone in the USA. Also you need to somehow prove you are a trustworthy person

    217. jarmster
      08-12-2011
      06:43 AM
      217

      I use to use wire wrap wire for all my mods, i never really liked it. Brittle
      Then i seen someones post about the kynar wire. Its very similar to the wire wrap wire but i thought the quality was 10 fold better. I had no problems with wires breaking while taking insulation of the ends. If your going to do the mod, do it right. Keep the wires short (under a foot) and use the right wire. I picked up a 50' roll of the kynar for 6 bucks.
      You may have your wiring all right but too much copper between test point and teensy can cause issues. Less is always better. Good luck

    218. kada
      08-12-2011
      07:29 AM
      218

      Originally Posted by toxie
      After every dump, you`re getting different dumps ?
      They are similar.I dont check all but first codes all same.Is there any COM settings do i need to change.

      And my nor is Samsung brand.judges said maybe this effect.Is here anyone succeed with Samsung nor.

    219. calimba
      08-12-2011
      09:59 AM
      219

      Originally Posted by kada
      They are similar.I dont check all but first codes all same.Is there any COM settings do i need to change.

      And my nor is Samsung brand.judges said maybe this effect.Is here anyone succeed with Samsung nor.
      if you have this error with samsung nor:

      C:\....\teensy>NORway.py COM3 write flash.bin Pinging... Set SB to tristate STATUS_DRIVE: False STATUS_TRIST_N: True STATUS_RESET_N: True STATUS_READY: True STATUS_CE_N: False STATUS_WE_N: True STATUS_OE_N: True Resetting NOR... Ready. Sector 000000 (1/128) [M]... Traceback (most recent call last): File "C:\....\teensy\NORway.py", line 320, in <module> n.writerange(addr, data) File "C:\....\teensy\NORway.py", line 210, in writerange self.writesector(addr/2, data[:0x20000]) File "C:\....\teensy\NORway.py", line 177, in writesector raise NORError("Verification failed") __main__.NORError: Verification failed
      unfortunately your NOR device have bad sectors and need change

    220. judges
      08-12-2011
      10:30 AM
      220

      Samsung flash memory is currently not supported by NORway. You should be able to dump your flash, but writing is definitely not supported. I've never checked the Samsung datasheet before, but Samsung NOR is organized a bit differently (284 blocks vs. 128 sectors). I'll add support for Samsung eventually, but cannot yet tell when. Sorry for any trouble this might have caused..

    221. calimba
      08-12-2011
      10:59 AM
      221

      Originally Posted by judges
      Samsung flash memory is currently not supported by NORway. You should be able to dump your flash, but writing is definitely not supported. I've never checked the Samsung datasheet before, but Samsung NOR is organized a bit differently (284 blocks vs. 128 sectors). I'll add support for Samsung eventually, but cannot yet tell when. Sorry for any trouble this might have caused..
      oohh i see, thank you very much

      here is the datasheet
      http://www.samsung.com/global/system...5uqb_rev11.pdf

    222. jarmster
      08-12-2011
      02:09 PM
      222

      lol, so none of the slims are supported then?

    223. kada
      08-12-2011
      04:23 PM
      223

      Originally Posted by calimba
      if you have this error with samsung nor:



      unfortunately your NOR device have bad sectors and need change
      I havent tried writing coz i dont have a good dump.PS3 operating without problem.Idont think nor has bad sectors...

    224. judges
      08-12-2011
      05:55 PM
      224

      Originally Posted by jarmster
      lol, so none of the slims are supported then?
      No. I don't know what consoles have samung or spansion. But I'm pretty sure that most of them have Spansions. And Samsung flash will be supported shortly.
      ************* [ - Post Merged - ] *************
      Originally Posted by kada
      I havent tried writing coz i dont have a good dump.PS3 operating without problem.Idont think nor has bad sectors...
      Don't try writing. Whatever is your dumping problem, we don't know yet. And I've never heard about a NOR having bad sectors...

    225. Dumbelek
      08-13-2011
      09:14 AM
      225

      So all DYN-001 have samsung flash?

    226. jarmster
      08-13-2011
      09:43 AM
      226

      CECHA/COK-001 up to including CECHE/COK-002W : 2x Samsung K9F1G08U0A-PIB0 (NAND 2x1Gbit=256MB total)

      CECHG/SEM-001 : 2x Samsung K9F1G08UOB-PIB0 (NAND 2x1Gbit=256MB total)

      CECHH/DIA-001 up to including CECHK/DIA-002 : 1x Spansion S29GL128N90TFIR2 (NOR 16MB)

      CECHL/VER-001 : 1x Spansion S29GL128P90TFIR2 (NOR 16MB)

      CECHL/VER-001 and PS3 Slim 2... : 1x Samsung K8Q2815UQB-PI4B (NOR 16MB)

      CECH-30../KTE-001 : 1x Spansion S29GL128P90TFIR2 (NOR 16MB)

      This is from the wiki but i opened a slim CHCH-2101B , it had a SUR-001 and a Spansion chip so idk what 2 think.

    227. kada
      08-13-2011
      02:17 PM
      227

      Originally Posted by Dumbelek
      So all DYN-001 have samsung flash?
      It seems like coz I opened 2 consoles with DYN-001 have Samsung...

    228. jarmster
      08-14-2011
      09:24 AM
      228

      k for those without a dongle, i found some software for the psp called ps3jig.....
      It'll get you into service mode.......if you have a psp

      ....wish i had found it before ordering a jig,lol

    229. kada
      08-14-2011
      10:06 AM
      229

      Originally Posted by jarmster
      k for those without a dongle, i found some software for the psp called ps3jig.....
      It'll get you into service mode.......if you have a psp

      ....wish i had found it before ordering a jig,lol
      But this homebrew needs kernel accessible PSP.I could run 5.03 gen but cant run with 6.39 pro b9

    230. jarmster
      08-14-2011
      10:34 AM
      230

      ya your right...thanks for mentioning that.

      All my psp's are 1000's so its not really an issue for me

    231. kada
      08-16-2011
      05:31 PM
      231

      Originally Posted by Dumbelek
      i hope they cant fix this with firmware update. for example 3.70
      It seems Sony didnt patch or already cant be?

      http://www.ps3hax.net/2011/08/downgr...-digitalangel/

    232. postal worker
      08-16-2011
      07:43 PM
      232

      can anyone help me? i have a system that was rsod. i dumped the nor( ps3 80gb cechl )

      i just want to flash it with ofw using teensy.

      do i still have to follow this?

      - Dump NOR (multiple times to be safe) and verify with norpatch.exe (included)
      - Grab a modified CORE_OS (the steps/updated script to do this are a few pages back
      - Open a hex editor with your NOR and the modified CORE_OS
      - Copy all contents within the modified CORE_OS
      - Using the hex editor search for "6FFFE0" in your original NOR and replace the copied contents of the modified CORE_OS after the second "6FFFE0"
      - Lastly, flash your console with your new modified NOR

      * quoted wizdumb post 189
      my problem is i got the hex editor but there is no offset 000c0000(http://img594.imageshack.us/img594/74/nordump.jpg)
      also my norpatch gives me this result (http://img221.imageshack.us/img221/4990/norpatch.jpg) the rsod came after an update. does this just mean that the memory is corrupted and i have no hope?

      *update guess ill go back and redo wiring gonna try on my old 60gb next

    233. wizdumb
      08-16-2011
      08:01 PM
      233

      Have you compared your dumps to see if they match? Something is wrong if norpatch.exe wasn't able to detect your fw version. I have a dump from a RSOD machine and it is still able to show the info in at least the R0S0 and R0S1 areas. You might want to check your wiring. And if your board so happens to have a Samsung NOR, take your time as NORway is only able to write to Spansion NOR flash at the moment.

    234. judges
      08-17-2011
      02:43 AM
      234

      Originally Posted by postal worker
      my problem is i got the hex editor but there is no offset 000c0000
      In Hex Workshop goto Options->Preferences and adjust the setting shown below:



      And increase your screen resolution and/or get a bigger monitor..

      Originally Posted by postal worker
      also my norpatch gives me this result
      Please keep in mind that norpatch can only identify OFWs. So if you've been on a CFW before, that result is normal.

    235. Dumbelek
      08-17-2011
      08:55 AM
      235

      Did you see the news about 3.70 downgrade, its guide very confusing. When we compare with judges' dump patching guide, it is different but results must be same, right?. I cant verify cuz i cant understand 3.70 downgrade guide. Any idea?

    236. postal worker
      08-17-2011
      09:11 AM
      236

      Originally Posted by judges
      In Hex Workshop goto Options->Preferences and adjust the setting shown below:



      And increase your screen resolution and/or get a bigger monitor..
      i am giving her(netbook) all she's got lol

      ohh this worked thanks :]

      not so sure about norpatch thing. haven't started re-wiring it yet...thinking about making the wire stick like shown in the example pictures.

    237. judges
      08-17-2011
      11:56 AM
      237

      Originally Posted by Dumbelek
      Did you see the news about 3.70 downgrade, its guide very confusing. When we compare with judges' dump patching guide, it is different but results must be same, right?. I cant verify cuz i cant understand 3.70 downgrade guide. Any idea?
      I didn't check in detail, but it's indeed a little more complicated than it could be. At least the "flowrebuilder" thingy that reverses byte order is totally not required for NORway. Don't really know why progskeet would reverse byte order..

      And yes, the result most certainly is the same. The only "complicated" thing about the way I've described it, is to patch core_os, because I simply didn't want to post a pre-patched core_os for (c) reasons.

    238. delsol
      08-18-2011
      02:50 PM
      238

      Hello,

      i have problems dumping the Spansion-NOR of my CECHH04 (DIA-001) with Teensy.
      The command "norway.py com3" works fine, but everytime when I try to dump,
      the Teensy immediately loose the USB-Connection to PC and Norway 0.3 returns
      with an error.

      My PS3 is not bricked and I�m using the "no voltage regulator mod" for my Teensy.

    239. kada
      08-18-2011
      04:42 PM
      239

      I think you need regulator.maybe teensy cant get enough voltage or even worse get more voltage.I suggest do not attemp without regulator.

    240. ogel2
      08-18-2011
      09:41 PM
      240

      i hope samsung NOR will be supported soon...

    241. Dumbelek
      08-19-2011
      10:43 AM
      241

      Originally Posted by ogel2
      i hope samsung NOR will be supported soon...
      I'm waiting for samsung nor support too, and still waiting my teensy

    242. Nikitis
      08-23-2011
      11:46 AM
      242

      Yeah I got the samsung as well.

      Apparently the CECH 200X model was pretty popular as it was the first slim console.

      Save us OBI-WAN Judges! You're our only hope!

      Can't afford the likes of progskeet.

    243. judges
      08-26-2011
      04:25 AM
      243

      Originally Posted by Nikitis
      Yeah I got the samsung as well.

      Apparently the CECH 200X model was pretty popular as it was the first slim console.

      Save us OBI-WAN Judges! You're our only hope!

      Can't afford the likes of progskeet.
      I actually do have a beta that supports writing to Samsung, but currently noone to test it. So if anyone has a Samsung and already successfully dumped it, let me know.
      ************* [ - Post Merged - ] *************
      Originally Posted by WesTek
      OK... @ judges... You hit the nail on the head with the WP#... My board (DIA-002) is missing that point, didn't think much of it as the teensy diagram did not have it on their either, figured that was a progskeet thing that was not necessary... So, I have no WP# at all. Any idea where I can find that on my board and what point on the teensy that would connect to? It also was not in the v0.1 list of points. I think you can fix me by explaining what to do about the WP# line! Getting hopeful! Look forward to your response!

      Update: Also tried re-dumping. Looks like about a 10th of my NOR has been wiped then after that the new dump matches my old dump... Looks like it partially erased before it started messing up. So NOR is still accessible, just partially wiped at the moment. I also checked out your V0.3, still indicates no WP# line necessary but the situation fits, unable to write because the write protect is kicking it's ass... Really hope you have a suggestion or two to throw my way.
      I moved my reply over to this thread, it's kind of more suitable.

      I guess the WP# line isn't really your problem, since you're obviously able to erase (which requires WP=HIGH).

      The only situation I can think of that does an erase of the 1st sector and then just sits and waits forever, is if your RY/BY line is not connected properly. You might want to double check that as well.

    244. jarmster
      08-26-2011
      04:33 AM
      244

      ill test it....

    245. judges
      08-27-2011
      05:17 AM
      245

      Originally Posted by WesTek
      Thanks for the info. That diagram was the same one I used to wire up my board although as I mentioned, the WP# point is not on the DIA-002, other than that the wiring was identical to DIA-001.
      Did you verify all the connection points for your board? I.e. did you measure the resistance between the points and the NOR pins? The DIA-002 might look the same as DIA-001, but as far as I can tell noone has ever confirmed that they actually are.

      Originally Posted by WesTek
      Update: Also just noticed CE in Norway comes up as false in the status when dumping and writing... I am assuming that should be true for everything to work since it is a chip enable input?
      No, CE# has to be low (false).

      And please check my previous post regarding the RY/BY line. Also check whether the (presumed) RY/BY solder pad actually connects to the RY/BY pin of your NOR chip.

    246. ogel2
      08-27-2011
      01:34 PM
      246

      Originally Posted by judges
      I actually do have a beta that supports writing to Samsung, but currently noone to test it. So if anyone has a Samsung and already successfully dumped it, let me know.
      i'll swap my teensy to my slim with samsung then (was on fat with spansion). i'll give you a report soon as i get a correct dump

    247. WesTek
      08-27-2011
      02:12 PM
      247

      Originally Posted by judges
      Did you verify all the connection points for your board? I.e. did you measure the resistance between the points and the NOR pins? The DIA-002 might look the same as DIA-001, but as far as I can tell noone has ever confirmed that they actually are.



      No, CE# has to be low (false).

      And please check my previous post regarding the RY/BY line. Also check whether the (presumed) RY/BY solder pad actually connects to the RY/BY pin of your NOR chip.
      OK, right forum, cool... So I have gone and verified EVERY connection on the DIA-002 board from the NOR chip straight to my teensy board. All connections are good, only SLIGHT resistance coming from the RESET point... Ended up tossing a wire on the reset leg of the NOR chip just in case that slight resistance had anything to do with my issue... Hooked it all back up, tried to write and same deal. Nothing has changed. So yeah, the points between the board revisions match with the exception of the lack of the WP# point which is not on the DIA-002 board, and the slight resistance coming off the reset, although for all I know, that is normal. Now, the only thing I cannot confirm off the NOR chip itself is this TRISTATE line. This obviously is not on the NOR chip as it is not even listed in the datasheet. No way to confirm this is the proper point without more info about it... But between the diagram and my teensy board, that line is good also.

      Scratching my head now, I've hit a complete dead-end. Now, as I mentioned, the CE is showing up as false in NORway which you mentioned is normal, what about drive status? When I write, the two of those are false and the rest are true... Does the blueray have anything to do with this? Blueray is present but needs a laser, I don't see how that could be an issue but hey, what do I know!

      Any other ideas? We can rule out incorrectly used points as I tested straight from the NOR chip to my Teensy board, also rule out my wiring/soldering the same way. Everything hardware wise is good to go but still unable to write. Still waiting on my power regulators, any more harm in running V0.3 without the regulator as with V0.1? If there is no extra risk with V0.3, maybe I'll give it a shot now?? Or wait on my regulators??? Open to any and all suggestions at this point. Just please don't make me test the NOR chip end of the board anymore, running out of thermal paste Appreciate all the help!

    248. jarmster
      08-27-2011
      04:10 PM
      248

      WOW, what a cluster f**k that turned out to be......

      I had some issues wiring up the teensy to the motherboard.
      Don't lose any pads,lol

      I lost the A0 and the OE pads on the motherboard. I was able to wire the chip directly but the ps3 would only boot black screen.
      I removed the teensy only to have the ps3 boot to black screen and then shut off.

      After closer inspection, the OE pad has a trace after the pad. With the pad gone i had to jump from one side to the other. F*#$@ BullS&*T man....
      Anyway i got it and my ps3 now boots normally again

      BEWARE

      I never got to try the beta norway,sorry
      I'll try again later when the kids are gone. This time i'll wire it from the mobo first.

    249. judges
      08-27-2011
      08:50 PM
      249

      Originally Posted by jarmster
      I lost the A0 and the OE pads on the motherboard. I was able to wire the chip directly but the ps3 would only boot black screen.

      After closer inspection, the OE pad has a trace after the pad. With the pad gone i had to jump from one side to the other. F*#$@ BullS&*T man....
      I'm with you.. How do you do that? User butnut also lost a pad. Don't use those 150W soldering irons being used for soldering pipes..
      ************* [ - Post Merged - ] *************
      Originally Posted by WesTek
      Scratching my head now, I've hit a complete dead-end. Now, as I mentioned, the CE is showing up as false in NORway which you mentioned is normal, what about drive status? When I write, the two of those are false and the rest are true... Does the blueray have anything to do with this? Blueray is present but needs a laser, I don't see how that could be an issue but hey, what do I know!

      Any other ideas? Still waiting on my power regulators, any more harm in running V0.3 without the regulator as with V0.1? If there is no extra risk with V0.3, maybe I'll give it a shot now?? Or wait on my regulators???
      Forget about the drive status, it's irrelevant. Wait for your voltage regulator. The different versions have nothing to do with the regulator. It's just a hardware mod. No regulator might damage your NOR.

      A user over at psx-scene with a DIA-002 board just had exactly the same problem. But currently I'm also out of ideas. I might provide a version that does not rely on the RY/BY line for writing since that seems to be the problem.

    250. WesTek
      08-27-2011
      10:50 PM
      250

      Originally Posted by judges
      I'm with you.. How do you do that? User butnut also lost a pad. Don't use those 150W soldering irons being used for soldering pipes..
      ************* [ - Post Merged - ] *************


      Forget about the drive status, it's irrelevant. Wait for your voltage regulator. The different versions have nothing to do with the regulator. It's just a hardware mod. No regulator might damage your NOR.

      A user over at psx-scene with a DIA-002 board just had exactly the same problem. But currently I'm also out of ideas. I might provide a version that does not rely on the RY/BY line for writing since that seems to be the problem.
      At least I am not alone. I'll quit pissing around until the regulators arrive, at which time I'll see if v0.3 gives me better results. Appreciate all your help on this and look forward to your ry/by workaround for us poor dia-002 bastards.

      Thanks again.

    251. jarmster
      08-27-2011
      11:46 PM
      251

      Originally Posted by judges
      I'm with you.. How do you do that? User butnut also lost a pad. Don't use those 150W soldering irons being used for soldering pipes..
      Yep, completely my fault. It wasn't 150W lol, but it was 80W.(One you use for stain glass projects i had milled a tip down on.)My bad
      I should have pulled out the 25W. I should have started wiring from the mobo too, but instead i started from the teensy and ended up with a bouquet of wires and lables that was madness to deal with. I should have planned it better but i was in a hurry. Im not trying again on that ps3. I'll try again on my 3.70 after my kids go home and im not hearing i wanna go to the park every 2 min. LOL

    252. butnut
      08-28-2011
      12:43 AM
      252

      I messed up my teensy with a 25W. I'll have to buy another one, and try again with a 15 watt iron.

    253. micronot
      08-28-2011
      10:42 AM
      253

      Hi WesTek & Judges,
      Im the one with the same problem from psx-scene..

      I got exactly the same issue, but when I tried an older version of norway, the teensy led blinked, but in the sector bar there wasnt any progress(maybe helps you understand the problem).
      I think it is tristate issue too..so I was thinking of powering the nor by external power supply, so maybe while the ps is off the south bridge I/O reststance is lower -is this possible??

      BTW I tried to write to the nor while the tristate pin were disconnected from teensy and it was exactly the same as before - the sector bar stucked on zero.

      BTW 2: I used the 3.3V regulator

    254. micronot
      08-28-2011
      03:33 PM
      254

      Hi,

      Today I decided to check the WP and Byte pins.
      I suprised to see that WP is in "0".
      so I connected it to the VCC(from the chip itself).
      after connecting it I tried writing, the teensy board starts to blink but after two sec I got the following error:

      Sector 000000 (1/128) [M]...
      Traceback (most recent call last):
      File "C:\NORway v0.3\NORway.py", line 317, in <module>
      n.writerange(addr, data)
      File "C:\NORway v0.3\NORway.py", line 207, in writerange
      self.writesector(addr/2, data[:0x20000])
      File "C:\NORway v0.3\NORway.py", line 174, in writesector
      raise NORError("Verification failed")
      __main__.NORError: Verification failed

    255. judges
      08-29-2011
      05:55 AM
      255

      Originally Posted by micronot
      I think it is tristate issue too..so I was thinking of powering the nor by external power supply, so maybe while the ps is off the south bridge I/O reststance is lower -is this possible??
      Tristate line shouldn't be an issue.
      ************* [ - Post Merged - ] *************
      Originally Posted by micronot
      Today I decided to check the WP and Byte pins.
      I suprised to see that WP is in "0".
      so I connected it to the VCC(from the chip itself).
      after connecting it I tried writing, the teensy board starts to blink but after two sec I got the following error:
      Now that's interesting. I wonder though how you or westek could have erased the first sector with WP=0. According to the datasheet this shouldn't be possible.

      Have you verified that dumping your NOR works correctly? Dump your NOR a couple of times and compare the results.

      Btw, you have asked for the datasheet (Spansion):
      http://www.sltdigital.com/product/pr...y/S29GL256.pdf

    256. micronot
      08-29-2011
      12:14 PM
      256

      Hi judges,

      Do you want me to measure some resistance/voltage or do anrhing else that help us figure what is worng

    257. judges
      08-29-2011
      12:30 PM
      257

      Originally Posted by micronot
      Hi judges,

      Do you want me to measure some resistance/voltage or do anrhing else that help us figure what is worng
      Have you verified that dumping works?

    258. micronot
      08-29-2011
      02:09 PM
      258

      as far as I know the dump worked fine.

      just to be sure I will upload my dump file and send you the link by private message

    259. judges
      08-29-2011
      02:29 PM
      259

      Originally Posted by micronot
      as far as I know the dump worked fine.

      just to be sure I will upload my dump file and send you the link by private message
      Your dump looks fine. Keep it in a safe place.

      Only thing left that might prevent you from writing is the WE# line. Please check the connection to the teensy and check the connection from the solder pad to the NOR chip (pin 13).

    260. micronot
      08-30-2011
      10:40 AM
      260

      Judges I find somthing realy intersting..

      1) in standby mode WP is connected to VCC but in the moment of start writing the voltage of this pad goes to zero(the pad isnt connected to anything).
      2) the WE is always in High, (this chip is lower enabled as I understands)
      so we cant write...

      just to be sure, I used this image for connecting teensy:
      http://www.ps3devwiki.com/images/2/2...y2.0%2B%2B.jpg

    261. dandza
      08-30-2011
      02:20 PM
      261

      Whats your mobo version?

    262. micronot
      08-30-2011
      03:46 PM
      262

      ver. DIA-002

    263. judges
      08-30-2011
      04:26 PM
      263

      Originally Posted by micronot
      Judges I find somthing realy intersting..

      1) in standby mode WP is connected to VCC but in the moment of start writing the voltage of this pad goes to zero(the pad isnt connected to anything).
      2) the WE is always in High, (this chip is lower enabled as I understands)
      so we cant write...

      just to be sure, I used this image for connecting teensy:
      http://www.ps3devwiki.com/images/2/2...y2.0%2B%2B.jpg
      The connection diagram is correct. For WP, didn't you say you connected it to Vcc? Shouldn't it be high all the time? Of course you probably cannot write in standby mode..

      For WE, the teensy pulls it high at the moment teensy is powered up. It's only pulled low for a few nano/milliseconds after writing each byte. So the question is, does WE=high (pulled high by the board) all the time when teensy is not connected? That could be a problem..

    264. micronot
      08-30-2011
      10:44 PM
      264

      I connected WP to VCC but Im trying to understand what is worng, so I checked the WP voltage without the VCC connected to it and realized that the WP in High in stby and low when start writing.

      about the WE, I dont have osillcscope so with the Voltmeter I cant see changeds of msec so probly it goes to low and than goes back to high state..


      I start thinking of connecting the wires to the chip legs instead of the current mthood of test point connection. do you think there is a chance it may help solving the problem?

    265. judges
      08-31-2011
      06:37 AM
      265

      Originally Posted by micronot
      about the WE, I dont have osillcscope so with the Voltmeter I cant see changeds of msec so probly it goes to low and than goes back to high state..
      But the question is, is it high when teensy is not powered/connected?

      Originally Posted by micronot
      I start thinking of connecting the wires to the chip legs instead of the current mthood of test point connection. do you think there is a chance it may help solving the problem?
      I don't think so. If you have verified that all test points are connected to the corresponding pins.

    266. micronot
      08-31-2011
      12:50 PM
      266

      When I disconnected the WE wire(only it) the WE was in low.
      I cant disconnect the teensy becuse the PS wont boot, it doing some pibs and goes back to stby


      I took a photo of the front side of my motherboard.
      http://www.megaupload.com/?d=JTEBW1IJ

      It not so similar to DIA-001..

      judges please upload the image to ps3devwiki..I dont know how to upload the file to the wiki site


      image of closeup on the nor:
      http://www.megaupload.com/?d=2YYVC9V0

    267. judges
      08-31-2011
      04:42 PM
      267

      Originally Posted by micronot
      When I disconnected the WE wire(only it) the WE was in low.
      I cant disconnect the teensy becuse the PS wont boot, it doing some pibs and goes back to stby
      That's alright. Not powering the teensy would have been sufficient actually.

      Currently I don't have any more ideas. From my perspective you should be able to write.

      After trying to write, what does your dump look like? First 128KB all "FF"s?

      Originally Posted by micronot
      I took a photo of the front side of my motherboard.
      http://www.megaupload.com/?d=JTEBW1IJ
      It not so similar to DIA-001..
      judges please upload the image to ps3devwiki..I dont know how to upload the file to the wiki site
      mage of closeup on the nor:
      http://www.megaupload.com/?d=2YYVC9V0
      Thanks for that, I don't know whether they need those though. I'll just wait until you took a picture of the test pads area.

    268. micronot
      09-01-2011
      11:22 AM
      268

      In the first 132Kbytes all "FF"

      Judges,
      Norway works for sure with other motherboard revs, so the problem must be in something that connected to the nor inside the motherboard?

      Im thinking of disconnecting only the vcc pin of the nor chip from the motherboard and power the nor from the teensy - without tuning on the PS3.
      What your opinion about this theory?

      Thanks for all your help

    269. judges
      09-01-2011
      03:57 PM
      269

      Originally Posted by micronot
      In the first 132Kbytes all "FF"
      At least erase works fine. Which contradicts a little my theory. Later.

      Originally Posted by micronot
      Norway works for sure with other motherboard revs, so the problem must be in something that connected to the nor inside the motherboard?
      Might be a reason.

      Originally Posted by micronot
      Im thinking of disconnecting only the vcc pin of the nor chip from the motherboard and power the nor from the teensy - without tuning on the PS3.
      What your opinion about this theory?
      It's a theory worth testing. But if you power the NOR externally, please keep in mind that it draws a lot of ppower, since you're also powering southbridge and other parts. Don't know whether USB current (500mA) is enough.

      There are also other people having problems with writing also with progskeet. An idea I got on the progskeet support channel on IRC is that there might be some kind of protection involved.

      The NOR chip itself offers different kinds of sector protection. I've never evaluated this, since my mobo obviously isn't protected. But there are ways to read protection bits from the NOR. I should modify NORway to read these protection bits, maybe it solves the puzzle. Certain protections can be overridden, if it's a password protection there's not much I can do. But I will look into it and provide a test version for you.

      The only thing that puzzles me is that you can erase the first sector. Shouldn't be possible if it's protected. But what do I know..

    270. micronot
      09-02-2011
      12:45 AM
      270

      Originally Posted by judges


      It's a theory worth testing. But if you power the NOR externally, please keep in mind that it draws a lot of ppower, since you're also powering southbridge and other parts. Don't know whether USB current (500mA) is enough.
      Im going to lift a little bit the vcc pin of the nor chip from the motherboard so it will be disconnected from the motherboard and connect the power source only to the nor. so I will power only the nor chip without all the components around.


      Editing:
      You can look here for the protection methood of the nor: http://www.spansion.com/Support/Rela...N_overview.pdf
      The full model name of the chip is S29GL128N90TFIR2
      and from link I attached that means that the nor have "Lowest address sector protect"

    271. micronot
      09-03-2011
      05:18 AM
      271

      I decided to wait with the VCC pin disconnecting because it may be risky, this is complex soldering and I can damage the motherboard or the chip.

    272. ogel2
      09-04-2011
      08:51 PM
      272

      judges, if you don't mind, i'd like to try your beta version of NORway. i have slim ps3 with samsung NOR. thanks

    273. kada
      09-06-2011
      02:17 PM
      273

      Sorry for not posting my results but I was really busy.And already sold my PS3 with Samsung(which I couldnt dump correctly).I have a new one What about other boards?I have now JTP-001 board with Spansion Nor. Its exactly same as JSD-001 but I hope wiring just same not like DIA-001&DIA-002. Anyone tried or I'll be first And wondering about SUR-001. I think guys from Sony service not thinking as much as we did.

    274. LordX
      09-09-2011
      01:47 PM
      274

      Originally Posted by kada
      Sorry for not posting my results but I was really busy.And already sold my PS3 with Samsung(which I couldnt dump correctly).I have a new one What about other boards?I have now JTP-001 board with Spansion Nor. Its exactly same as JSD-001 but I hope wiring just same not like DIA-001&DIA-002. Anyone tried or I'll be first And wondering about SUR-001. I think guys from Sony service not thinking as much as we did.
      I Installed the SUR-001, works well, downgrade was done from 3.60>3.55 all ok.

    275. Khalkedon
      09-09-2011
      03:54 PM
      275

      Originally Posted by LordX
      I Installed the SUR-001, works well, downgrade was done from 3.60>3.55 all ok.
      Hi LordX,

      There is no any picture of points sur-001 ?

      JSD-001 pics points same with SUR-001.

      Please help us?

    276. judges
      09-11-2011
      10:23 AM
      276

      There's a new NORway beta version available that supports writing to Samsung and checks for protected sectors.. Anyone who wants to test it please drop me a PM.

    277. straith
      09-11-2011
      09:17 PM
      277

      Originally Posted by judges
      There's a new NORway beta version available that supports writing to Samsung and checks for protected sectors.. Anyone who wants to test it please drop me a PM.
      Hi judges, im having the same problem, i would like to prove the beta norway. I sent you several PMs.

      Let me know please.

      Heres is a screenshot

    278. LordX
      09-16-2011
      08:56 AM
      278

      Originally Posted by Khalkedon
      Hi LordX,

      There is no any picture of points sur-001 ?

      JSD-001 pics points same with SUR-001.

      Please help us?
      I used this diagram :

    279. juice777
      09-19-2011
      04:44 PM
      279

      Big thanks to judges for your work on norway!!! I've recently installed a teensy and it seems to be working just fine.

      I'm having some problems which started directly after hard-flashing from gleveland's 355OtherOS to 355OFW/355Kmeaw dumps. A few seconds into booting the PS3 malfunctions. There isnt an OtherOS dump to try revert to

      I've dissected the 355OFW and 355Kmeaw dumps and their contents with the aid of fail0verflow ps3 tools, hex editors, ps3devwiki, hash calculators, etc. and the dumps seem fine. Also, the teensy writes and verifies the NOR reliably.

      Would someone be able to donate a 355 OtherOS NOR dump for me to inspect? Everything seems fine so all I can imagine is that OtherOS has modded another internal memory causing the PS3 to expect an OtherOS flash?

      Installation wise; the teensy is drawing 3.3V from NOR_Vcc, the 5V track has been cut, and the 3.3V pad has been bridged.

    280. randuev
      09-22-2011
      04:07 AM
      280

      juice777: what dumps of your NOR do you have? what firmware did you have before attempting to reflash? what is the latest OFW your ps3 had?

      i think you have to take NOR that you have had working, patch it with Dospiedra's v2 patches, flash it. and after that you have to go into service mode with ps3 jig and lv2diag and reflash/reformat everything perhaps with Rogero MFW.

    281. cvp
      09-22-2011
      09:33 AM
      281

      Hello, is it possible to patch the last Rebug CFW with No Check? or it is exist a download link?

    282. xNand
      09-22-2011
      07:00 PM
      282

      Originally Posted by judges
      There's a new NORway beta version available that supports writing to Samsung and checks for protected sectors.. Anyone who wants to test it please drop me a PM.
      Hi, i PM'd you, not sure if you got it..

    283. dodther
      09-23-2011
      03:56 AM
      283

      i have cechh with dia-001 motherboard. i solder teensy++ with this diagram. nor read successfully, but dump contains only FF. i check my solder twice. its ok



      sorry for my english

    284. Dudshl
      09-23-2011
      10:27 AM
      284

      i have cechh with dia-001 motherboard.
      I have correct dumped firmware, but when I try write - I see "sector 000000 [1/128] [M]" forewer. I stop it manualy and now I have RLOD.

      http://webfile.ru/5563145
      This archive contain 2 dumps: before_write and after_write

      I check all connections by multimeter. All connections are fine.

    285. Dudshl
      09-23-2011
      01:38 PM
      285

      Originally Posted by judges
      There's a new NORway beta version available that supports writing to Samsung and checks for protected sectors.. Anyone who wants to test it please drop me a PM.
      Can You give me Your new NORway with protected sectors check? I think it solve my problem.

      kilel [AT] yandex [dt] ru

    286. juice777
      09-23-2011
      02:59 PM
      286

      Thanks randuev. To answer your questions:
      1) I have 355Kmeaw and 355OFW dumps only
      2) The PS3 was running well on glevands 3.55 OtherOS firmware before hard-flashing to the firmwares mentioned in 1)
      3) The PS3 has never been updated past v3.55

      The PS3 has the same no video/red led failure as mentioned in this Rogero MFW news so, although my case isn't a downgrade, perhaps that method will work. Will update when I get chance to resolder the teensy.

    287. randuev
      09-24-2011
      03:23 AM
      287

      juice777: i think that problem you have is because kmeaw and ofw firmware doesn't have patches to disable checks.

      i still don't understand how you have managed to write an ofw or kmeaw dump without reading it first. care to explain?

    288. juice777
      09-24-2011
      12:26 PM
      288

      randuev: dospiedra's v2 did the trick! Luckily I didn't need to use ps3 jig or Rogero CFW (really wasn't looking forward to compiling a PSGradePIC for my homebrew dongle). All is great now! Thanks!

      misunderstanding, the 1st thing i did after installing the teensy was to dump kmeaw and ofw. Armed with nor-flasher I decided to brave OtherOS. The problem came in because I didn't also make OtherOS dump, and then tried to flash from OtherOS to Kmeaw (I made wrong assumption that it would be fine because both were using the same base FW).

      Moral of the story... make a backup of your most current flash before modifying your flash! Old flash dumps might not be good enough!

      Edit: Added more info
      Edit 2: I used all of dospiedra's v2 patches to get it working... previously I tried to patch only the CoreOS hash checks which failed to solve the problem.
      Edit 3: The PS3 is now stuck on CFW with lv1 hash checks patched. Any FW that doesn't have lvl1 hash checks patched will cause a brick after installation. I haven't figured out if it's possible to get the hashes matching again in my special non-downgrade case. I will update if I make any progress on this.

    289. randuev
      09-24-2011
      01:41 PM
      289

      Originally Posted by dodther
      i have cechh with dia-001 motherboard. i solder teensy++ with this diagram. nor read successfully, but dump contains only FF. i check my solder twice. its ok



      sorry for my english
      very important to have proper ground (GND) connections. i've had to solder several of them in order to get reliable dump.

      anyhow, FF all the way can mean only two things - you either have wrong HEX installed into teensy, or PS3 is not turned on

    290. cvp
      09-24-2011
      02:18 PM
      290

      Hello, is there new news about MX29GL128ELT2I-90G NOR Flash? i installed the Teensy in my ps3 (CECH2004B) but i dont read that it is only for Spansion

    291. dodther
      09-25-2011
      04:33 AM
      291

      Originally Posted by randuev
      very important to have proper ground (GND) connections. i've had to solder several of them in order to get reliable dump.

      anyhow, FF all the way can mean only two things - you either have wrong HEX installed into teensy, or PS3 is not turned on
      I did read my NOR, but when I try to flash my dump - i see "sector 000000 [1/128] [M]". entry does not occur.

    292. Dudshl
      09-25-2011
      07:12 AM
      292

      Originally Posted by dodther
      I did read my NOR, but when I try to flash my dump - i see "sector 000000 [1/128] [M]". entry does not occur.
      I have the same problem with the same motherboard.

    293. Dudshl
      09-25-2011
      07:54 PM
      293

      Can somebody give me correct 3.70(OFW) and 3.55(OFW) NOR dump?

    294. randuev
      09-26-2011
      02:44 AM
      294

      dudshl - nor dump from other machine won't do you any good, because of different security and id tokens.

    295. cvp
      09-26-2011
      08:59 AM
      295

      Hello, can anyone tell me if this NOR Flash will be Supported?



      And is at the moment possible to downgrade FW 3.72 to 3.55?

      thanks a lot

    296. judges
      09-26-2011
      10:48 AM
      296

      Originally Posted by cvp
      Hello, can anyone tell me if this NOR Flash will be Supported?



      And is at the moment possible to downgrade FW 3.72 to 3.55?

      thanks a lot
      Yes and yes.

    297. cvp
      09-26-2011
      11:18 AM
      297

      thanks... but Read/Write is now possible? or i have wait for next release or Beta?
      I've soldered the Teensy. As far as them all right. The dumps have a different content each time.
      No IFI entry in Section 0000200. Only HBH or what ever... whats wrong ?

      thanks a lot

    298. judges
      09-26-2011
      12:09 PM
      298

      Originally Posted by cvp
      thanks... but Read/Write is now possible? or i have wait for next release or Beta?
      I've soldered the Teensy. As far as them all right. The dumps have a different content each time.
      No IFI entry in Section 0000200. Only HBH or what ever... whats wrong ?

      thanks a lot
      For Macronix read/write should be okay with v0.3.

      But first your dump should be okay of course..
      - connect more gnd wires
      - use thicker wires
      - shorten your wires
      - route wires somewhere else
      - shield wires
      - don't use ps3 without shielding

    299. cvp
      09-27-2011
      07:02 AM
      299

      so, i take new cable and resoldering all them. If i use 0.3 release i get this information:

      Code:
      C:\ps3\old>norway.py co
      Pinging...
      Set SB to tristate
      STATUS_DRIVE:   False
      STATUS_TRIST_N: True
      STATUS_RESET_N: True
      STATUS_READY:   True
      STATUS_CE_N:    False
      STATUS_WE_N:    True
      STATUS_OE_N:    True
      Resetting NOR...
      Ready.
      But the dumped bin are bad.

      if i use the Beta 0.4, than i take this information:

      Code:
      C:\ps3\old>cd..
      C:\ps3>norway.py com11
      NORway.py v0.4 beta - Teensy++ 2.0 NOR flasher for PS3 ([email protected])
      (Orignal noralizer.py by Hector Martin "marcan" <hector[MENTION=60324]marcan[/MENTION]soft.com>)
      Pinging...
      Set SB to tristate
      Traceback (most recent call last):
        File "C:\ps3\NORway.py", line 510, in <module>
          n.printstate()
        File "C:\ps3\NORway.py", line 179, in printstate
          self.MF_ID = self.manufacturer_id()
        File "C:\ps3\NORway.py", line 100, in manufacturer_id
          self.ping()
        File "C:\ps3\NORway.py", line 78, in ping
          raise NORError("Ping failed (expected 42, got %02x)"%val)
      __main__.NORError: Ping failed (expected 42, got 22)
      => If i try again...
      C:\ps3>norway.py com11
      NORway.py v0.4 beta - Teensy++ 2.0 NOR flasher for PS3 ([email protected])
      (Orignal noralizer.py by Hector Martin "marcan" <hector[MENTION=60324]marcan[/MENTION]soft.com>)
      Pinging...
      Traceback (most recent call last):
        File "C:\ps3\NORway.py", line 504, in <module>
          n.ping()
        File "C:\ps3\NORway.py", line 78, in ping
          raise NORError("Ping failed (expected 42, got %02x)"%val)
      __main__.NORError: Ping failed (expected 42, got 00)
      I try now more GND to Teensy GND
      EDIT01: => two GND wire solderin on board to GND from NOR... and from GND NOR to directly Teensy GND
      EDIT02: => i disconnected the NOR GND and Soldering only on one of antoher GND place from diagram... same Problem
      EDIT03: i dont have the MCP1825S-3302E/DB inside... its hard to buy here... i have the Taiwan TS2940 CW-3.3 on teensy

    300. Dudshl
      09-27-2011
      09:39 AM
      300

      My PS3 fat With DIA-001 do not start XMB: it ask connect controller and give FW 3.55 or higher. When I try update it (put PUP-file if usb:/PS3/UPDATE/) to any firmware 3.55 or higher - it says "data is corrupted" (errors 8002F225 or 8002F2B5 or 8002F2C5). In revicery menu I have same errors.

      I can`t put it into factory/service mode by PSP with PS3JIG - console just boot and ask to connect controller and give correct firmware. (PS3JIG works fine on my another slim console).
      I tried to make dospedros_v2 "downgrade" with TEENSY (now it soldered and ready to flash any NOR dumps) - console just boot and ask to connect controller and give correct firmware on italian language. PS#JIG does not work too.

      Previous consoles owner says that he just format HDD on PC. After that he saw this errors. I try format it on PC in different filesystems. I formated it on another 3.55 consoles. There is no result.

      I think that firmware was damaged and now it can not update correctly.

      Any ideas how fix it?

    301. randuev
      09-27-2011
      09:45 AM
      301

      Originally Posted by cvp
      so, i take new cable and resoldering all them. If i use 0.3 release i get this information:

      ...

      if i use the Beta 0.4, than i take this information:

      [CODE]
      C:\ps3\old>cd..

      C:\ps3>norway.py com11
      NORway.py v0.4 beta - Teensy++ 2.0 NOR flasher for PS3 ([email protected])
      (Orignal noralizer.py by Hector Martin "marcan" <hector[MENTION=60324]marcan[/MENTION]soft.com>)

      Pinging...
      Set SB to tristate

      Traceback (most recent call last):
      File "C:\ps3\NORway.py", line 510, in <module>
      n.printstate()
      File "C:\ps3\NORway.py", line 179, in printstate
      self.MF_ID = self.manufacturer_id()
      File "C:\ps3\NORway.py", line 100, in manufacturer_id
      self.ping()
      File "C:\ps3\NORway.py", line 78, in ping
      raise NORError("Ping failed (expected 42, got %02x)"%val)
      __main__.NORError: Ping failed (expected 42, got 22)
      update your teensy firmware with new hex binary. you can't use beta with old hex.

    302. cvp
      09-27-2011
      10:28 AM
      302

      thanks, it works but only FF maybe wrong Voltage Regulator?

      Code:
      C:\ps3>norway.py com11
      NORway.py v0.4 beta - Teensy++ 2.0 NOR flasher for PS3 ([email protected])
      (Orignal noralizer.py by Hector Martin "marcan" <hector[MENTION=60324]marcan[/MENTION]soft.com>)
      Pinging...
      Set SB to tristate
      NOR chip manufacturer: unknown (0x8b)
      NOR chip type: unknown (0x6b68e9)
      STATUS_TRIST_N: True
      STATUS_RESET_N: True
      STATUS_READY:   True
      STATUS_CE_N:    False
      STATUS_WE_N:    True
      STATUS_OE_N:    True
      Resetting NOR...
      Ready.
      do i need to wire the NOR VVC to teensy oder what ever?

    303. judges
      09-27-2011
      10:54 AM
      303

      Originally Posted by cvp
      thanks, it works but only FF maybe wrong Voltage Regulator?
      Don't know. Did you get it from pjrc? Then it's probably correct. Did you follow their instructions to mount it (cut 5V trace, etc)?

      http://www.pjrc.com/teensy/3volt.html

      Originally Posted by cvp
      do i need to wire the NOR VVC to teensy oder what ever?
      No.

      Edit: You've read the "README.txt" and your PS3 is turned on, right?

    304. juice777
      09-27-2011
      11:05 AM
      304

      Originally Posted by cvp
      EDIT03: i dont have the MCP1825S-3302E/DB inside... its hard to buy here... i have the Taiwan TS2940 CW-3.3 on teensy
      Originally Posted by cvp
      maybe wrong Voltage Regulator?
      TS2940 should be good because:
      1) TS2940 and MCP1825 are pin-compatible
      2) TS2940 is able to supply more than enough current (1 Amp)

      Edit: If you want to make sure the regulator is working properly you will need a multimeter. Plug teensy in with USB, set multimeter to measure volts, put black probe on teensy GND and red probe on teensy 5V. If the multimeter shows 3.3V then the reg is OK.

    305. cvp
      09-27-2011
      12:10 PM
      305

      EDIT: OOK now works ^^

      i forget to tun on the PS3. Now i find the IFI in the dumped NOR Flash! great job guys and thanks for help...

      EDIT:.. uhh... i think is not working perfectly... i read out the dump.. sometime IFI Information ist reading.. but not the same dump... oO

    306. xNand
      09-27-2011
      01:40 PM
      306

      Just tested NORway 0.4 BETA 9 and i got a few successful dumps but i can't get it to erase or write to my Samsung p14B with ANY of the commands.
      It just says unknown chip manufacturer and exits...

      Is it because i'm not turning the PS3 on and flashing????

      My Bad.... I forgot 2 connections... sorry :/

      Still Not working

    307. cvp
      09-28-2011
      03:41 AM
      307

      Code:
      Pinging...
      Set SB to tristate
      NOR chip manufacturer: Macronix (0xc2)
      NOR chip type: MX29GL128 (0x7e2101)
      Checking sector protection...
      No protected sectors found!
      STATUS_TRIST_N: True
      STATUS_RESET_N: True
      STATUS_READY:   True
      STATUS_CE_N:    False
      STATUS_WE_N:    True
      STATUS_OE_N:    True
      is this maybe a wire problem? That the Wire from Teensy E0 to Mainboard CE is not working? Is all True need it? Or is that normal?

      EDIT: My Voltage Regulator give 3.24V is it enough?

    308. CrackMyDay
      09-28-2011
      01:17 PM
      308

      Originally Posted by cvp
      Code:
      Pinging...
      Set SB to tristate
      NOR chip manufacturer: Macronix (0xc2)
      NOR chip type: MX29GL128 (0x7e2101)
      Checking sector protection...
      No protected sectors found!
      STATUS_TRIST_N: True
      STATUS_RESET_N: True
      STATUS_READY:   True
      STATUS_CE_N:    False
      STATUS_WE_N:    True
      STATUS_OE_N:    True
      is this maybe a wire problem? That the Wire from Teensy E0 to Mainboard CE is not working? Is all True need it? Or is that normal?

      EDIT: My Voltage Regulator give 3.24V is it enough?
      Its normal. Keep in mind that all those showned STATEs are outputs, not inputs, so they are not verified. You could have all those pins unconnected to PS3 chip and have those same "fake valid" STATEs..

      3.0-3.6V is OK to work.

      I tried with a Samsung K8Q2815UQB(tough one).
      I want to say that in my case i never had the same MD5 from dumped files, so im having troubles to read too.
      For those who cant write the upper chip in Samsung K8Q2815UQB, check out my experiment:
      I unplugged line A22 from Teensy++ and get 3.3V from line. So, the only way to write the upper chip was to put a series resistor in A22 to GND.

      I've been coding based on judges excellent work, and made some experiments that could confirm my theory.

      PS3 flash chip lines are both driven by PS3 and flasher hardware(Teensy++ in my case) so i think reading/writing problems are associated with this. I don't know why problems are different in differents PS3, but i do know this:

      If i power suppy PS3 flash chip from an external source, the only chip that seems to get warmed in the PS3 is the black one near Samsung FLASH chip, were all FLASH memory lines go...

    309. cvp
      09-28-2011
      04:08 PM
      309

      ah ok, thanks CrackMyDay...

      ... so i cut again all wire... realy...shorter is not possible on CECH2004B. I dumpe tje NOR three times... all dumps have the IFI on 00000200. But if i check two dumpes... like flash.bin and flash2.bin... he finde many different entrys...

      http://www.imagebanana.com/view/j2jmc8v8/ps3.PNG
      http://www.imagebanana.com/view/9dch3hof/ps3a.PNG

      i think its no normal right ?

    310. CrackMyDay
      09-28-2011
      06:48 PM
      310

      NO. That isn't normal. Its wrong. Its exactly the kind of differences i get.

      �DO NOT ERASE OR WRITE THE MEMORY UNTIL YOUR DUMPS HAVE THE SAME MD5!

      judges told me that some people with dumping problems connect more GND lines of the PS3 to common GND with teensy++ and that solved the problem.

      I removed all wiring from the PS3 i was having troubles with, so for now, no more field experiments.

      Perhaps i will gain strength again and resolder all wiring and keep trying it.

      Hope you can make it, and please share all your experiments and results.

      Cheers.

    311. cvp
      09-29-2011
      05:04 AM
      311

      Today i solder three thicker wire on three different gnd points, but no luck. I think four gnd wire is more than enough. I solder now 2 times on ps3 mainboard, cut the wires smaller three times and solderin them three times on teensy. The last one on the back side from teensy... Thats s uck s, i dont know whats the problem is.

      maybe i solder one wire to gnd from teensy and connect them to a gnd power socket, i think more GND can i not connect

    312. juice777
      09-29-2011
      11:40 AM
      312

      Be careful guys... just because the multimeter detects continuity betweem solder points doesnt mean the wiring/soldering is good. Check that the solder flows smoothly onto each wire (if the solder falls down rapidly before meeting the wire, it could be a dry joint). Also be careful not to twist and bend the wires too much while installing/using the teensy (a small crack in the copper might not be detected by multimeter, but will cause enough capacitance to cause the teensy to malfunction).

      I'm hypothesising (I have no means to test) that you could get a teensy with small capacitance problems to start working just by bringing the operating frequency down.

      Edit: Actually, the best way to troubleshoot capacitance problems would be with a good oscilloscope though most ppl won't have access to one. Check that all lines produce square waves. If you see pointy waves or noise in the signal then you know that line is having a problem.

      Edit 2: Removed some statements to avoid repeating what CrackMyDay has already said.

    313. judges
      09-29-2011
      12:05 PM
      313

      Originally Posted by CrackMyDay
      Its normal. Keep in mind that all those showned STATEs are outputs, not inputs, so they are not verified. You could have all those pins unconnected to PS3 chip and have those same "fake valid" STATEs..
      True, except for RY/BY..

      Originally Posted by CrackMyDay
      I tried with a Samsung K8Q2815UQB(tough one).
      I want to say that in my case i never had the same MD5 from dumped files, so im having troubles to read too.
      For those who cant write the upper chip in Samsung K8Q2815UQB, check out my experiment:
      I unplugged line A22 from Teensy++ and get 3.3V from line. So, the only way to write the upper chip was to put a series resistor in A22 to GND.
      Shouldn't be required (check your eMail). Too bad that you've disconnected Teensy from your troublesome console...

      ************* [ - Post Merged - ] *************

      Just finished NORway v0.4 beta 10. Implemented CrackMyDay's excellent bulk writing method, which reduces programming time for "writeword" mode from 60mins to less than 10mins. "writewordubm" mode also doubled its speed (<10mins now).

      But the most important thing is that I've found a bug in the RY/BY wait function. Before checking RY/BY state it requires a delay of 90ns. Made it very unreliable.

      Although this version is totally untested except by me of course.

      As always, before trying to write, make sure that your dump is perfect!

      Here's the link:
      http://www.multiupload.com/DHKAZT1KXV

      See "changes.txt" for new write commands if you're not familiar with previous betas.

      Please post your results... Thanks.

    314. cvp
      09-29-2011
      03:40 PM
      314

      thx for your beta... unfortunately i couldn't do it with the different dump content either

    315. underdik
      09-30-2011
      06:52 AM
      315

      Anyone can to correct my dump ofw 3.70 for flashing with Teensy&NORway 0.3? I have black screen after flashing my PS3 with corrected dump, DYN-001. But i can flash my OFW dump i stay in 3.70. See my dump in attachment. Please help with this problem.

      http://dl.dropbox.com/u/2885438/orig..._downgrade.rar

      My diagram (handmade for DYN-001):
      http://dl.dropbox.com/u/2885438/teensy%20dyn001.pdf

    316. Dudshl
      09-30-2011
      07:48 AM
      316

      Originally Posted by underdik
      Anyone can to correct my dump ofw 3.70 for flashing with Teensy&NORway 0.3? I have black screen after flashing my PS3 with corrected dump, DYN-001. But i can flash my OFW dump i stay in 3.70. See my dump in attachment. Please help with this problem.

      http://dl.dropbox.com/u/2885438/orig..._downgrade.rar

      My diagram (handmade for DYN-001):
      http://dl.dropbox.com/u/2885438/teensy%20dyn001.pdf
      http://www.megaupload.com/?d=O31PKQPB
      There is Your FW patched with dospedras v2

    317. underdik
      09-30-2011
      01:02 PM
      317

      Originally Posted by Dudshl
      http://www.megaupload.com/?d=O31PKQPB
      There is Your FW patched with dospedras v2
      THX! It works!
      How you make it? I tried many times, but no results! What you do?

    318. Dudshl
      09-30-2011
      01:44 PM
      318

      I just read that

    319. CrackMyDay
      09-30-2011
      01:46 PM
      319

      Originally Posted by judges
      True, except for RY/BY..
      I must insist. ALL lines including RY/BY.
      If you leave RY/BY unconnected, well... look at NORway.c:

      Originally Posted by NORway.c; lines 231/232
      CONT_DDR &= ~(1<<CONT_RYBY); //except RY/BY# (input)
      CONT_PORT |= (1<<CONT_RYBY); //enable pull up
      You have a pull up forcing high level(= READY) state on that line when unplugged. You'll need a pull down, not up, to truly get RY/!BY chip status..

      Originally Posted by judges
      Shouldn't be required (check your eMail). Too bad that you've disconnected Teensy from your troublesome console...
      I've successfully downgraded a SLIM yesterday. Now i resoldered the FAT one, and im trying to revive this bricked one right now.

      Originally Posted by judges
      Just finished NORway v0.4 beta 10. Implemented CrackMyDay's excellent bulk writing method, which reduces programming time for "writeword" mode from 60mins to less than 10mins. "writewordubm" mode also doubled its speed (<10mins now).
      Im glad to help.

      Keep it coming.

      Cheers.

    320. sentosa
      09-30-2011
      11:05 PM
      320

      Hello ,

      I want to know wheather samsung NOR now support with teensy 2.0 ++ ..

      Also are spansion NOR all support ? I found there are 2 types .. 128 p and 228n ..
      are both support ?



      Thank you ...
      ************* [ - Post Merged - ] *************
      Hello ,

      Also norway is a byteswap dump ? do you need flow rebuilder?

    321. juice777
      10-01-2011
      04:40 AM
      321

      Originally Posted by sentosa
      Hello ,

      I want to know wheather samsung NOR now support with teensy 2.0 ++ ..

      Also are spansion NOR all support ? I found there are 2 types .. 128 p and 228n ..
      are both support ?



      Thank you ...
      ************* [ - Post Merged - ] *************
      Hello ,

      Also norway is a byteswap dump ? do you need flow rebuilder?
      Samsung NOR support is W.I.P. Spansion 128p works, not sure about 228n. Norway dumps are not byteswapped so no need for flow rebuilder.

    322. sentosa
      10-01-2011
      10:31 AM
      322

      I tried to dump samsung NOR ... k8 but my dumps always diffrent 4 times dump , 4 diffrent sfv .. can not see METLDR CSID in hexedit.

      I think it is a bad dump.

    323. Dumbelek
      10-01-2011
      04:50 PM
      323

      Originally Posted by Dudshl
      I just read that
      so you byteswap your norway dump, patch the dump, then turn back to non-byteswap dump before flash?

    324. sentosa
      10-01-2011
      05:46 PM
      324

      no I didn't ...
      I tried MCix nor ... went fine .. 2 or 3 dump md5 are same .
      I tried SPansion Nor also went fine 2 or 3 dump md5 are same.
      but Samsung k8 dump is always diffrent all the time.

    325. Dudshl
      10-01-2011
      08:19 PM
      325

      Originally Posted by Dumbelek
      so you byteswap your norway dump, patch the dump, then turn back to non-byteswap dump before flash?
      NORway does not need byteswap. Just dump,patch,write,fun

    326. judges
      10-02-2011
      07:56 AM
      326

      Originally Posted by sentosa
      I want to know wheather samsung NOR now support with teensy 2.0 ++ ..

      Also are spansion NOR all support ? I found there are 2 types .. 128 p and 228n ..
      are both support ?
      Samsung K8Q2815 is still causing problems. I'm working on it.

      Spansion N and P are working just fine with the latest beta.

    327. sentosa
      10-02-2011
      04:12 PM
      327

      Originally Posted by judges
      Samsung K8Q2815 is still causing problems. I'm working on it.

      Spansion N and P are working just fine with the latest beta.
      Thank you judges for your response ....

      keep working....

    328. sentosa
      10-05-2011
      06:34 AM
      328

      Im having problem with Spansion NOR ... every time I dump diffrent md5 ...

    329. Dudshl
      10-05-2011
      10:17 AM
      329

      You can try to solder more GND points.

    330. cvp
      10-05-2011
      07:12 PM
      330

      I try now this all...

      CECH2004B:
      3 times Soldeing on Mainboard
      3 times Soldering new on Teensy
      More GND from Teensy to PS3 Mainboard
      i cute 3 times the wire smaler...

      CECH2504B:
      2 times Soldering
      2 Time different cable
      first teensy and than my second teensy
      More GND (6 Wire on PS3 Mainboard)

      ... evry time different Dumps
      i used Beta 4 - 10

      realy, now i dont know whats wrong?

    331. Dudshl
      10-05-2011
      11:01 PM
      331

      Originally Posted by cvp
      I try now this all...

      CECH2004B:
      3 times Soldeing on Mainboard
      3 times Soldering new on Teensy
      More GND from Teensy to PS3 Mainboard
      i cute 3 times the wire smaler...

      CECH2504B:
      2 times Soldering
      2 Time different cable
      first teensy and than my second teensy
      More GND (6 Wire on PS3 Mainboard)

      ... evry time different Dumps
      i used Beta 4 - 10

      realy, now i dont know whats wrong?
      What is NOR chips on Your motherboards?

    332. cvp
      10-06-2011
      02:37 AM
      332

      CECH2004B: MX...
      CECH2504B: Spansion

    333. Dudshl
      10-06-2011
      03:04 AM
      333

      And whats dumps do You compare?
      "Dump,dump,dump" without boot XMB? - in this case dumps must be identical.
      Or dump,boot,dump,boot? - in this case dumps may difference because of changed settings in XMB.

    334. cvp
      10-06-2011
      03:33 AM
      334

      i try two procedur:

      first:
      - i connect the USB cable to teensy and USB port on my Notebook.
      - i connect than the Power Cable to PS3
      - NORway.py COM11... waiting for restart NOR Info...than
      - i turn on the PS3 and...
      - waiting a few seconds, like 10 seconds
      - than NORway.py COM11 dump xxxx.bin
      - after than NORway.py COM11 release
      - than disconnect the Power Cable + USB Cable
      -... than i try all again

      second:
      - i connect the USB cable to teensy and USB port on my Notebook.
      - i connect than the Power Cable to PS3
      - NORway.py COM11... waiting for restart NOR Info...than
      - i turn on the PS3 and...
      - waiting a few seconds, like 10 seconds
      - than NORway.py COM11 dump xxxx.bin
      - if finish ... again NORway.py COM11 dump xxxx1.bin
      - if finish ... and again NORway.py COM11 dump xxxx2.bin
      - after than NORway.py COM11 release
      - Disconnect all cable


      ________
      i try now on USB3.0 and USB2.0 Port... like the same

    335. Dudshl
      10-06-2011
      05:06 AM
      335

      Try such procedure:
      1. connect USB (power is disconnected)
      2. NORway.py COM11
      3. connect power cable and turn on console
      4. NORway.py COM11
      5. NORway.py COM11 dump xxxxx.bin
      6. NORway.py COM11 dump yyyyy.bin
      7. NORway.py COM11 release
      8. disconnect power cable

      check MD5
      Must be same

    336. cvp
      10-06-2011
      05:28 AM
      336

      thanks for help... but no luck MD5 are different.

      i try this to:
      USB to PC
      NORway.py COm11
      Power Cable + Turn On
      NORway.py COm11 dump xxxx.bin
      NORway.py COm11 dump yyyy.bin
      NORway.py COm11 release
      Power disconnect

      and this:
      USB to PC
      Power Cable
      NORway.py COm11
      Turn On
      NORway.py COm11
      NORway.py COm11 dump xxxx.bin
      NORway.py COm11 dump yyyy.bin
      NORway.py COm11 release
      Power disconnect

      no luck....

    337. Dudshl
      10-06-2011
      06:22 AM
      337

      Is Your teensy modded to 3.3V? Or it uses 5V?

    338. cvp
      10-06-2011
      07:14 AM
      338

      voltage regulator is inside. i cut the 5V line

    339. judges
      10-06-2011
      12:16 PM
      339

      Here's the link to the latest v0.4 beta12:

      http://www.multiupload.com/FK0ZOV7LJ0

      It's been confirmed to write successfully to Samsung K8Q2815 using "writeword" and "writewordubm" modes.

      Not yet verified, but hopefully also (still) working for Spansion N, Macronix and Samsung K8P2716. Spansion P (the one I got) is doing well in all writing modes.

      Let me know your results..

      -- judges

    340. sentosa
      10-06-2011
      01:31 PM
      340

      Im having the same problem ...

      especially with SPansion N ....

      Itu matrionix 100% ... easy ..

      Originally Posted by cvp
      i try two procedur:

      first:
      - i connect the USB cable to teensy and USB port on my Notebook.
      - i connect than the Power Cable to PS3
      - NORway.py COM11... waiting for restart NOR Info...than
      - i turn on the PS3 and...
      - waiting a few seconds, like 10 seconds
      - than NORway.py COM11 dump xxxx.bin
      - after than NORway.py COM11 release
      - than disconnect the Power Cable + USB Cable
      -... than i try all again

      second:
      - i connect the USB cable to teensy and USB port on my Notebook.
      - i connect than the Power Cable to PS3
      - NORway.py COM11... waiting for restart NOR Info...than
      - i turn on the PS3 and...
      - waiting a few seconds, like 10 seconds
      - than NORway.py COM11 dump xxxx.bin
      - if finish ... again NORway.py COM11 dump xxxx1.bin
      - if finish ... and again NORway.py COM11 dump xxxx2.bin
      - after than NORway.py COM11 release
      - Disconnect all cable


      ________
      i try now on USB3.0 and USB2.0 Port... like the same

    341. sentosa
      10-06-2011
      06:41 PM
      341

      Cable lenght ? maybe ? make the cable very2 short... cause every dump is diffrent ..

    342. cvp
      10-07-2011
      11:18 AM
      342

      To all at which it goes:
      How many inches have used their cable? do you have photos from inside the PS3? so that we can see how you've laid the cables?
      It would possibly help us.

    343. judges
      10-07-2011
      12:39 PM
      343

      Originally Posted by cvp
      To all at which it goes:
      How many inches have used their cable? do you have photos from inside the PS3? so that we can see how you've laid the cables?
      It would possibly help us.
      The NORway distribution includes installation pictures...

    344. boxmodz
      10-08-2011
      05:02 PM
      344

      A HUGE thanks to judges, without his tutorial i wouldn't have tried this, and to to jarmster for the os_package (after half a day of flashing his worked first time) i downgraded my fat ps3 from 3.70 to 3.55 :D

    345. djhazee
      10-08-2011
      09:44 PM
      345

      Originally Posted by judges
      It should be sufficient if ros0/1 can be identified. On my console I also was only able to identify PRG0 plus ros areas.

      But you might want to do more than one dump and binary compare the different dumps to be on the safe side.
      ************* [ - Post Merged - ] *************


      Is your console running an OFW? Or is it eg. a bricked 3.55 or something like that?
      Do we need both ros0 and ros1, or is one of the two sufficient? I have only ros0.

    346. jeerum
      10-09-2011
      03:23 AM
      346

      is there possible downgrade 3.72 with teensy?
      i have 3.72 and it looks little different, have made 5-8 dumps, all has same md5 checksum

    347. Dudshl
      10-09-2011
      11:41 AM
      347

      I Just updated my slim console to 3.72 and then downgrade it to 3.55-rogero.
      It works.

    348. underdik
      10-10-2011
      01:55 AM
      348

      Originally Posted by Dudshl
      I Just updated my slim console to 3.72 and then downgrade it to 3.55-rogero.
      It works.
      Well! It dospiedra v2 method?

    349. Dudshl
      10-10-2011
      02:16 AM
      349

      Originally Posted by underdik
      Well! It dospiedra v2 method?
      Yep.
      I used dospiedra v2 method.

    350. randuev
      10-10-2011
      06:02 AM
      350

      Originally Posted by jeerum
      is there possible downgrade 3.72 with teensy?
      i have 3.72 and it looks little different, have made 5-8 dumps, all has same md5 checksum
      your data lines are ***xored, i wouldn't flash until you get a right dump. those strings should read "asecure_loader" and so on

      check your data lines. you must have a short somewhere.

    351. djhazee
      10-10-2011
      06:50 AM
      351

      I am getting some weird behavior. I used the downgrade v2 files and was able to get the ps3 to boot again, however I get stuck at a message "Cannot Start. The correct hard disk was not found". I am wondering if I patched the files correctly. I can send someone my original flash dump if they want to try editing it for me. Any suggestions?

    352. jeerum
      10-10-2011
      11:40 AM
      352

      Originally Posted by randuev
      your data lines are ***xored, i wouldn't flash until you get a right dump. those strings should read "asecure_loader" and so on

      check your data lines. you must have a short somewhere.
      thanks, i have already removed teensy and give a try on my ps3 slim :D
      seems my dia-002 mobo with this nor dont like teensy.

    353. Dudshl
      10-10-2011
      10:07 PM
      353

      Originally Posted by jeerum
      thanks, i have already removed teensy and give a try on my ps3 slim :D
      seems my dia-002 mobo with this nor dont like teensy.
      I had DIA-002. It likes teensy and was successfully downgraded.

    354. djhazee
      10-10-2011
      11:18 PM
      354

      Successfully downgraded! I think the "Noob Tutorial" could use some work. Here is what I ran into that held me back:

      1) If you get a hard drive error, make sure your HDD is plugged in all the way! (Doh!)
      2) You need a jig to put the PS3 into factory mode (I used PSGrade with my spare teensy 2.0).
      3) Use the SECOND file in the lv2diag_355 folder.

      Big ups to the scene and to judges for his NOR flasher!

      I would also suggest this tutorial:

    355. portals94
      10-11-2011
      10:02 AM
      355

      Is there are any solution to flash SEM-001(NAND 2x Samsung K9F1G08UOА-PIB0) via teensy ++ 2.0 ?

    356. butnut
      10-13-2011
      03:55 AM
      356

      Originally Posted by judges
      ...It's been confirmed to write successfully to Samsung K8Q2815 using "writeword" and "writewordubm" modes.



      -- judges

      Man I need to get another teensy...

      Thanks for doing this judges.

    357. Dumbelek
      10-16-2011
      10:24 AM
      357

      Hi,

      I have DYN-001 board and I was waiting for Samsung support. According to ps3devwiki DYN-001 has Samsung nor but I have Spansion nor (I learnt today). I hope this wont be a problem.

      I would like to ask something about wiring, cant we just connect wires with silicone?

    358. jeerum
      10-16-2011
      01:19 PM
      358

      can someone patch my nor dump for me?
      my own pc is broken and i'm too noob in ubuntu.
      thanks1

    359. rick#2
      10-17-2011
      01:40 AM
      359

      Hi, hoping someone out there can help me out.

      First, big thanks to judges for sharing his work with the community!

      Here's a copy of the ROM dump from my DIA-001/CECHH (Spansion S29GL128N90TFIR2-NOR 16MB) era PS3:

      http://dl.dropbox.com/u/22632665/flash.bin

      Now, here's a copy of the ROM I wrote to my PS3 via NORWay v0.4R12:

      http://dl.dropbox.com/u/22632665/NORdowngrade.bin

      Both the original, unmodified dump (flash.bin) and the 3.55 downgrade-ready patched dump (NORdowngrade.bin) looked pretty good to me at a glance in a hex editor, but I must admit that I am new to PS3 patching/hacking.

      It seems I've now got a rather expensive paperweight, as when I turn it on, it acts as though NORWay hasn't "released" it; ie: green light but no video output. (And yes, I did run NORway with the "release" argument after I was finished writing). I've tried using an Arduino Mega2560 flashed with PSGrade to put the PS3 into Factory Service Mode but no dice, it just remains on the green light on startup with no other activity or video output. Unfortunately, I only have one Teensy++ 2.0 and now, after some buggering around, I must have fried it as it is no longer recognized as a Serial Device in either Windows or Linux, so I've ordered another one but it will take a few weeks, and in the meantime I'd like to see if anyone can point out where I went wrong.

      I was pretty confident that my original dump was good before I dove into writing a modified version into the PS3's ROM because I was able to obtain perfectly matching dumps five times in a row, but the "norpatch.exe" utility was not able to identify my ROM dump as a system running 3.70, rather I get this:

      PRG0: 3.55
      PRG1: 3.50
      PKG0: 2.10
      PKG1: unknown
      ROS0: unknown
      ROS1: unknown

      I'm thinking something corrupted somewhere along the line, but not exactly sure where. If this is the case, I've accepted that I've probably irreversibly bricked my PS3 after writing over my original, untouched ROM with my modified attempt at downgrading without a proper backup but am hopeful that there is a small chance that I can salvage the data unique to my PS3 and patch it into a "stock" 3.70 ROM dump.

      Could anybody give me some suggestions?

    360. jeerum
      10-17-2011
      11:37 AM
      360

      hi again!
      seems i cant get it done, without help
      i have byte reversed dump then taking
      :METLDR: offset“810″ size “E960″
      BOOTLOADER_0 Offset“FC0000″ size “40000″
      EID: Offset “2F000″ size “10000″
      CISD: Offset“3F000″ size “800″
      and pasting to downgrade.bin then byte reversed downgrade.bin
      and i get rsod or without bytereversing - no signal in video :D

    361. Dudshl
      10-18-2011
      04:04 AM
      361

      Now I have DIA-002 with Samsung K8Q2815UQB chip.
      I can not dump this chip correctly: all dumps have different MD5.
      I try dump with all NORway versions (0.3,0.4b9,b10,b12)
      3 GND pionts soldered.
      Teensy resoldered twice.

      Usually chip manufacturer and type detects correctly, but sometimes chip manufacturer and/or type are "unknown".


      Any Ideas?

    362. boxmodz
      10-18-2011
      01:32 PM
      362

      Originally Posted by jeerum
      hi again!
      seems i cant get it done, without help
      i have byte reversed dump then taking
      :METLDR: offset�810″ size �E960″
      BOOTLOADER_0 Offset�FC0000″ size �40000″
      EID: Offset �2F000″ size �10000″
      CISD: Offset�3F000″ size �800″
      and pasting to downgrade.bin then byte reversed downgrade.bin
      and i get rsod or without bytereversing - no signal in video :D
      Only way i got it to work was using norpatch, manually editing did nothing..
      ************* [ - Post Merged - ] *************
      Originally Posted by rick#2
      My 3.70 fat with same specs as yours looked like this as well

      PRG0: 3.55
      PRG1: 3.50
      PKG0: 2.10
      PKG1: unknown
      ROS0: unknown
      ROS1: unknown
      I Patched your flash files with norpatch and got different results to yours, i patched mine with the core_os file as this what worked first time for me after spending a day flashing and erasing!!

      here is your patched (by me) flash http://www.4shared.com/file/yNkKsYmy/newflash.html

      After i flashed it, enter service mode with a dongle (jig, psgrade), put lv2diag.self (file1) together with a PS3UPDAT.PUP (Rogero_CFW_V2_Kmeaw_LV1_Patched_3.72_spoof_Privacy_Patch renamed to PS3UPDAT.PUP) in the root folder on a stick, let it update(it will take a while!!) then put lv2diag.self (file2) on the stick, power up and leave service mode.

      Hope this helps!!

    363. jeerum
      10-19-2011
      12:08 PM
      363

      seems i get trouble after trouble. i have try'd to make patched nor dump. at least i get my norpatch to working (virtualbox) flashed nor and restarting ps3 i get some check to harddrive and then beep and red light blinking.
      oh yeah, i have dumped my patched nor and have same md5 as my original patched file.

      C:\123>norpatch.exe 1.bin CORE_OS_PACKAGE.bin uuskatse.bin
      norpatch.exe v3.72 - Verify/Patch PS3 NOR flash dumps [(c) [email protected]]

      PRG0 version is 3.50
      PRG1 version is 3.55
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is 3.70
      ROS1 version is 3.70
      CORE_OS_PACKAGE version is OFW 3.55
      everything is ok?

      if i write ofw 3.70 nor dump pack, then my ps3 works fine. I cant get find, what is wrong.

    364. Dudshl
      10-19-2011
      12:40 PM
      364

      Originally Posted by jeerum
      seems i get trouble after trouble.
      http://psx-scene.com/forums/content/...rogskeet-1391/
      Try this method.

      I get my first "metldr.2" slim console.
      It is cech-2508B data code 1B with Samsung K8P2716.
      It writes fine with NORway v0.4b10, but after downgrade it just turns off.

    365. boxmodz
      10-19-2011
      12:59 PM
      365

      Originally Posted by jeerum
      seems i get trouble after trouble. i have try'd to make patched nor dump. at least i get my norpatch to working (virtualbox) flashed nor and restarting ps3 i get some check to harddrive and then beep and red light blinking.
      oh yeah, i have dumped my patched nor and have same md5 as my original patched file.

      everything is ok?

      if i write ofw 3.70 nor dump pack, then my ps3 works fine. I cant get find, what is wrong.
      Are you patching your original dump or a fresh one?
      Are you using the jig and self files once you have flashed firmware back, if so have a look at the log file it will have generated on the usb stick might give you some clues.
      ************* [ - Post Merged - ] *************
      Originally Posted by Dudshl
      http://psx-scene.com/forums/content/...rogskeet-1391/
      Try this method.

      I get my first "metldr.2" slim console.
      It is cech-2508B data code 1B with Samsung K8P2716.
      It writes fine with NORway v0.4b10, but after downgrade it just turns off.
      This method didn't work for me, i just used norpatch with modified core_os and rogero firmware and then followed from step 6 of that tut.

    366. jeerum
      10-19-2011
      01:05 PM
      366

      Originally Posted by boxmodz
      Are you patching your original dump or a fresh one?
      Are you using the jig and self files once you have flashed firmware back, if so have a look at the log file it will have generated on the usb stick might give you some clues.
      ************* [ - Post Merged - ] *************


      This method didn't work for me, i just used norpatch with modified core_os and rogero firmware and then followed from step 6 of that tut.
      i use hd2 for jig.
      and i cant see any log file.
      i have patched my dump with norpatcher and 3.55 core os
      i have manualy patched downgrader.bin
      now i try dospiedra v2 - i have missed this!

    367. boxmodz
      10-19-2011
      01:26 PM
      367

      you only need to patch it once,maybe your over patching it.
      ok stole this from the other link, pretty much what i did.
      after flashing firmware into ps3,

      Step 7: Turn on the PS3 but do not press anything. Wait 1 minute or so, and remove power from the PS3 - we need to put it into factory service mode.

      Step 8: Format a FAT32 thumb-drive and place the following files on it.

      * usb:\\Lv2diag.self (Get this file from the Lv2Diag-patch-par-Jaicrab.zip archive - ‘\Lv2Diag-patch-par-Jaicrab\STEP1\Lv2diag.self’)
      * usb:\\PS3UPDAT.PUP (Rename 355checkoff.PUP to PS3UPDAT.PUP)


      Step 9: Plug the thumb-drive with the files from step 8 into the right-most USB port on the PS3.

      Step 10: Boot the PS3 into Factory Service Mode (see other guides on how to achieve this)

      Step 11: Wait for the PS3 to power off automatically (this should take somewhere between 10-20 minutes)

      Step 12: Remove the USB from the right-most USB port on the PS3.

      Step 13: Power on the PS3 - you should now see the XMB.

      Step 14: Shutdown the PS3 again.

      Step 15: Replace the first stage Lv2diag.self with the second stage Lv2diag.self on the thumb-drive and re-plug the thumb-drive into the right-most USB port on the PS3.

      * usb:\\Lv2diag.self (Get this file from the Lv2diag_355.rar archive - ‘\\Lv2diag_355\Archivo 2\Lv2diag.self’)
      * usb:\\PS3UPDAT.PUP (Keep from before)


      Step 16: Power on the PS3 - Wait for the PS3 to power off automatically (this should take somewhere between 10-20 seconds)

      Step 17: Remove the USB from the right-most USB port on the PS3.

      Step 18: Boot the PS3 and enjoy your 3.55 CFW No Check by dospiedra (equivalent to 3.55 CFW by kweaw)

    368. jeerum
      10-19-2011
      01:50 PM
      368

      dospiedra v2 is not working for me, i have sur-001 motherboard with S29GL128N90TFIR2.
      can someone patch it my flash, maybe i get it wrong :D
      no success, just red blinking. i just dont get it

    369. boxmodz
      10-19-2011
      02:08 PM
      369

      send me your original dump flash (pm'd you my email)

    370. Dudshl
      10-19-2011
      02:09 PM
      370

      Originally Posted by jeerum
      dospiedra v2 is not working for me, i have sur-001 motherboard with S29GL128N90TFIR2.
      can someone patch it my flash, maybe i get it wrong :D
      no success, just red blinking. i just dont get it
      Give me your original NOR dump and i patch it.

    371. boxmodz
      10-19-2011
      03:12 PM
      371

      Originally Posted by jeerum
      dospiedra v2 is not working for me, i have sur-001 motherboard with S29GL128N90TFIR2.
      can someone patch it my flash, maybe i get it wrong :D
      no success, just red blinking. i just dont get it
      patched your flash here http://www.upload.ee/files/1744638/1new.bin.html

    372. jeerum
      10-19-2011
      04:16 PM
      372

      now i have problem, i get to service mode, but then ps3 just shut down, hard drive is blinking few times and thats it.
      ok now i get it, usb drive must be in right and jig in left.

    373. ICCcode
      10-19-2011
      04:49 PM
      373

      Hello all,

      First off, nice looking program Judges. I am on a CECHL04 MB version VER-001. I think my problem is probably due to the board. I have verified my original dump with norpatch.exe. I have been able to flash several different CFW's but I end up getting trophy errors sporadically. I thought maybe this was just the CFW I was using, but I have tried building my own, rebug, kmean 3.55 no check, rogero and the OtherOS versions. I have been able to install each of them, but I still get the errors. I have been using the dospiedra v2 downgrade method. Has anyone else been having this issue and if so...any luck fixing it?

      Thanks in advance

    374. butnut
      10-19-2011
      05:22 PM
      374

      Originally Posted by ICCcode
      Hello all,

      First off, nice looking program Judges. I am on a CECHL04 MB version VER-001. I think my problem is probably due to the board. I have verified my original dump with norpatch.exe. I have been able to flash several different CFW's but I end up getting trophy errors sporadically. I thought maybe this was just the CFW I was using, but I have tried building my own, rebug, kmean 3.55 no check, rogero and the OtherOS versions. I have been able to install each of them, but I still get the errors. I have been using the dospiedra v2 downgrade method. Has anyone else been having this issue and if so...any luck fixing it?

      Thanks in advance
      After searching for "downgrade trophy error"

      http://www.ps3hax.net/search.php?searchid=846472

    375. ICCcode
      10-19-2011
      05:25 PM
      375

      Originally Posted by jeerum
      now i have problem, i get to service mode, but then ps3 just shut down, hard drive is blinking few times and thats it.
      ok now i get it, usb drive must be in right and jig in left.
      You begin that process by putting the jig in the right most usb port. Once it shutsdown replace your jig with a usb drive that has your PS3UPDAT.pup and the hacked Lv2diag.self. The PS3 will stay on for a bit and then shutdown again. You can check the jaicrab logfile created to make sure the update was applied correctly. If so, delete the logfile and replace the hacked Lv2diag.self with the standard 3.55 file. The PS3 will power on and then reboot again. You should now be in your CFW.
      ************* [ - Post Merged - ] *************
      Originally Posted by butnut
      After searching for "downgrade trophy error"

      http://www.ps3hax.net/search.php?searchid=846472
      Thanks for the link. Unfortunately, I have read the five of those already. I have tried both the initial release of rogero's cfw created from a standard PUP as well as the version 2 based off of kmeaw. I am not experiencing the blueray playback problem. The third link is related to rogero v1 which I have also read and tried. The Progskeet article while interesting, I think is irrelevant to my issue since the fix was to upgrade his version of winskeet. The last link is a good collection of homebrew apps, but doesn't address the issue.

      Additionally, I have also attempted altering the binary flash directly with visual studio. After reading a breakdown on demonhades.org, I have an additional question. Does the PS3UPDAT.PUP write different files to the flash based on the board revision. The PS3 dev wiki had a binary patch specific to JTP-001 boards. I have not seen this answered in my reading, but my guess would be that during the upgrade process a flash (or write to flash is generated based upon board revision, and perhaps other factors

    376. butnut
      10-19-2011
      08:54 PM
      376

      Originally Posted by ICCcode
      Thanks for the link. Unfortunately, I have read the five of those already. I have tried both the initial release of rogero's cfw created from a standard PUP as well as the version 2 based off of kmeaw. I am not experiencing the blueray playback problem. The third link is related to rogero v1 which I have also read and tried. The Progskeet article while interesting, I think is irrelevant to my issue since the fix was to upgrade his version of winskeet. The last link is a good collection of homebrew apps, but doesn't address the issue.

      Additionally, I have also attempted altering the binary flash directly with visual studio. After reading a breakdown on demonhades.org, I have an additional question. Does the PS3UPDAT.PUP write different files to the flash based on the board revision. The PS3 dev wiki had a binary patch specific to JTP-001 boards. I have not seen this answered in my reading, but my guess would be that during the upgrade process a flash (or write to flash is generated based upon board revision, and perhaps other factors
      I was only trying to let you know that other people have had trophy errors after downgrading.

    377. qljiea784hl1
      10-19-2011
      11:20 PM
      377

      Thanks and great work. I was wondering when you were going to pop up with this. Going to give this a go.



    378. Dudshl
      10-20-2011
      04:53 AM
      378

      Originally Posted by Dudshl
      Now I have DIA-002 with Samsung K8Q2815UQB chip.
      I can not dump this chip correctly: all dumps have different MD5.
      I try dump with all NORway versions (0.3,0.4b9,b10,b12)
      3 GND pionts soldered.
      Teensy resoldered twice.

      Usually chip manufacturer and type detects correctly, but sometimes chip manufacturer and/or type are "unknown".


      Any Ideas?
      When I resolder Teensy to 5V - I get many correct dumps with identical MD5 and norpatch recognize correct PRG0,PRG1,ROS0,ROS1.
      It do not wont to write in 5V-mode. I make "erasechip" and now I can not programm it.

    379. boxmodz
      10-20-2011
      12:43 PM
      379

      Originally Posted by Dudshl
      When I resolder Teensy to 5V - I get many correct dumps with identical MD5 and norpatch recognize correct PRG0,PRG1,ROS0,ROS1.
      It do not wont to write in 5V-mode. I make "erasechip" and now I can not programm it.
      have you got the regulator on the teensy?
      have your tried the other writing commands?

    380. Dudshl
      10-20-2011
      01:05 PM
      380

      Originally Posted by boxmodz
      have you got the regulator on the teensy?
      have your tried the other writing commands?
      I have regulator on my teensy and yes, I tried writeword and writewordubm command.
      In 5V-mode "erasechip" does not work.

    381. Melgar
      10-22-2011
      07:25 AM
      381

      hi All,

      got a PS3 Slim CECH that was "stucked in service mode" after a wrong downgrade attempt and had also a faulty HDD that was exchanged for a brand new one.

      so right now the PS3 doesnt turn ON(because of the new HDD), but i can read and write flash with NORway without problems.

      i would like to ask if somebody already have fixed this kind of problem.
      i have uploaded the dump here: http://www.multiupload.com/VNYP44RZ39

      any help is much appreciated, i am even ready to donate a teensy++ to a developer in order to get this fixed.

      thanks in advance

      Best Regards,
      Dave

      some info about my dump:

      PRG0 version is 3.40
      PRG1 version is unknown
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is 3.56_2
      ROS1 version is 3.40

    382. jeerum
      10-22-2011
      09:42 AM
      382

      Originally Posted by Melgar
      hi All,

      got a PS3 Slim CECH that was "stucked in service mode" after a wrong downgrade attempt and had also a faulty HDD that was exchanged for a brand new one.

      so right now the PS3 doesnt turn ON(because of the new HDD), but i can read and write flash with NORway without problems.

      i would like to ask if somebody already have fixed this kind of problem.
      i have uploaded the dump here: http://www.multiupload.com/VNYP44RZ39

      any help is much appreciated, i am even ready to donate a teensy++ to a developer in order to get this fixed.

      thanks in advance

      Best Regards,
      Dave

      some info about my dump:

      PRG0 version is 3.40
      PRG1 version is unknown
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is 3.56_2
      ROS1 version is 3.40
      if not have flashed correctly, then you will be able to see push ps button, but if you in service mode, change jig to left side usb port and usbflash drive into rightside with 3.55 cfw and boot again :D

    383. Melgar
      10-22-2011
      10:18 AM
      383

      Originally Posted by jeerum
      if not have flashed correctly, then you will be able to see push ps button, but if you in service mode, change jig to left side usb port and usbflash drive into rightside with 3.55 cfw and boot again :D
      ok, let me clarify some things first.
      this PS3 was v3.56, then put in "service mode" with a "jailbreak-dongle", but of course there was no way out. after that it happend that the HDD got water damaged and i had to replace it.
      with the new HDD the PS3 now even doesnt boot anymore, so i cant see anything on the screen.
      to me it seems that if the device was in "service-mode" and HDD is replaced, the device can�t boot anymore. or am i wrong here?

    384. jeerum
      10-22-2011
      10:44 AM
      384

      Originally Posted by Melgar
      ok, let me clarify some things first.
      this PS3 was v3.56, then put in "service mode" with a "jailbreak-dongle", but of course there was no way out. after that it happend that the HDD got water damaged and i had to replace it.
      with the new HDD the PS3 now even doesnt boot anymore, so i cant see anything on the screen.
      to me it seems that if the device was in "service-mode" and HDD is replaced, the device can�t boot anymore. or am i wrong here?
      have you try'd to patch your fw?

    385. Melgar
      10-22-2011
      11:03 AM
      385

      not yet, because none of the mentioned downgrade-scenarios matches my situation.
      but if you have a suggestion that could help, i�ll give it a try.

    386. jeerum
      10-22-2011
      11:08 AM
      386

      basicaly you need find keys and copy them to 3.55 core os package, place to nor and try to downgrade. first be sure you have good nor dump

    387. Melgar
      10-23-2011
      09:16 AM
      387

      Originally Posted by jeerum
      basicaly you need find keys and copy them to 3.55 core os package, place to nor and try to downgrade. first be sure you have good nor dump
      just tried that.
      i flashed it with patched 3.55 firmware with my keys.
      after that the PS3 turned ON, and askes for a 3.56 UPDATE PUP file.
      did that, it installed the 3.56 orignal FW from the usb-device and formated the HDD.
      after the reboot it asked again for same 3.56 update, did it again, but still asking on every reboot for the same 3.56 update.
      so i tried with the patched 3.41 PUP file that is used for downgrade, it did install it and after success the PS3 went OFF.
      but now it doesn�t boot up anymore.
      it just turn on for 3sec�s, then short yellow LED and turn�s fully OFF.
      tried to flash it again with the backup-file a few times, but still doesnt boot.
      i verified each flashing process by reading dump after flash and comparing, all is 100% ok.

      any ideaon that problem?

      thanks for any help...

      regards,

    388. jeerum
      10-23-2011
      09:27 AM
      388

      Originally Posted by Melgar
      just tried that.
      i flashed it with patched 3.55 firmware with my keys.
      after that the PS3 turned ON, and askes for a 3.56 UPDATE PUP file.
      did that, it installed the 3.56 orignal FW from the usb-device and formated the HDD.
      after the reboot it asked again for same 3.56 update, did it again, but still asking on every reboot for the same 3.56 update.
      so i tried with the patched 3.41 PUP file that is used for downgrade, it did install it and after success the PS3 went OFF.
      but now it doesn�t boot up anymore.
      it just turn on for 3sec�s, then short yellow LED and turn�s fully OFF.
      tried to flash it again with the backup-file a few times, but still doesnt boot.
      i verified each flashing process by reading dump after flash and comparing, all is 100% ok.

      any ideaon that problem?

      thanks for any help...

      regards,
      flash the 3.55 fw again to nor, if screen tell you press ps button - then don't
      just use downgrade method, puting updat.pup to root in usb drive and use ps3 jig. ps3 wont show any screen on this proccess, only inticators are flashing lights :D

    389. Melgar
      10-23-2011
      10:45 AM
      389

      Originally Posted by jeerum
      flash the 3.55 fw again to nor, if screen tell you press ps button - then don't
      just use downgrade method, puting updat.pup to root in usb drive and use ps3 jig. ps3 wont show any screen on this proccess, only inticators are flashing lights :D
      i flashed the NOR with same FW again that worked before, but still can�t TURN ON the PS3. flashed it few times, verified it, but result is same: PS3 TURNs ON for 3 seconds, then the yellow HDD LED shortly lit�s, and then it fully POWER�s OFF(after that even the red POWER-LED is OFF, need to press power-button twice to TURN ON again).
      so no way to make a firmware update from a usb-drive since the PS3 isn�t powering up/booting correctly.

    390. judges
      10-24-2011
      09:29 AM
      390

      Originally Posted by rick#2
      I'm thinking something corrupted somewhere along the line, but not exactly sure where. If this is the case, I've accepted that I've probably irreversibly bricked my PS3 after writing over my original, untouched ROM with my modified attempt at downgrading without a proper backup but am hopeful that there is a small chance that I can salvage the data unique to my PS3 and patch it into a "stock" 3.70 ROM dump.
      Well, the bad news is that your original dump is corrupted. If norpatch isn't able to identify ros0/1, it's in general not a good idea to flash it back.

      After analyzing your dump I figured that you've switched address lines A21 and A22 (all address lines = A0-A22). The contents of your dump from 0x400000-0x7FFFFF and from 0x800000-0xBFFFFF were identical (and wrong).

      Now the good news is that luckily for you these are about the only two address lines that you can switch while still being able to restore a working version from your original dump. Content starting from 0xC00000 till the end is still functional, because A21 and A22 are both high for all following addresses, so switching them doesn't matter. So only ROS0 and ROS1 areas were affected.

      Here's the link to the fixed version with an unmodified 3.70 core os:
      http://www.multiupload.com/5FELNOUDRB

      Of course you have to fix your wiring for A21 and A22 first.

    391. Melgar
      10-24-2011
      10:58 AM
      391

      Originally Posted by judges
      Well, the bad news is that your original dump is corrupted. If norpatch isn't able to identify ros0/1, it's in general not a good idea to flash it back.

      After analyzing your dump I figured that you've switched address lines A21 and A22 (all address lines = A0-A22). The contents of your dump from 0x400000-0x7FFFFF and from 0x800000-0xBFFFFF were identical (and wrong).

      Now the good news is that luckily for you these are about the only two address lines that you can switch while still being able to restore a working version from your original dump. Content starting from 0xC00000 till the end is still functional, because A21 and A22 are both high for all following addresses, so switching them doesn't matter. So only ROS0 and ROS1 areas were affected.

      Here's the link to the fixed version with an unmodified 3.70 core os:
      http://www.multiupload.com/5FELNOUDRB

      Of course you have to fix your wiring for A21 and A22 first.
      wow!
      first of all, thank you very much for taking your time to analyze my dump and finding the "problem".
      i�ll do the changes and let you know about my progress.

      once again, thanks a lot for that!

      regards,

    392. judges
      10-24-2011
      11:36 AM
      392

      Originally Posted by Melgar
      wow!
      first of all, thank you very much for taking your time to analyze my dump and finding the "problem".
      i�ll do the changes and let you know about my progress.

      once again, thanks a lot for that!
      Thanks for the flowers, but my reply was directed to "rick#2", not to you.. ;-)

      Unfortunately I don't know a solution to your problem. OFW 3.56_2 has a general problem with new hdds and I haven't heard of any fix yet.

    393. Melgar
      10-24-2011
      12:26 PM
      393

      Originally Posted by judges
      Thanks for the flowers, but my reply was directed to "rick#2", not to you.. ;-)

      Unfortunately I don't know a solution to your problem. OFW 3.56_2 has a general problem with new hdds and I haven't heard of any fix yet.
      ok, thanks anyway

    394. Dudshl
      10-24-2011
      12:59 PM
      394

      Originally Posted by Melgar
      ok, thanks anyway
      Someone at DemonHades made a tutorial to fix this error, http://www.demonhades.org/foro/viewt...p?t=5210&f=297
      It's in spanish but you can use google translate xD

    395. postal worker
      10-24-2011
      02:10 PM
      395

      [MENTION=200600]Dudshl[/MENTION] - have you had any progress with your ps3? the one where when you try to flash it gives you a "unknown manufacture" and each dump is slightly different? currently i am in the same boat...

    396. jeerum
      10-24-2011
      02:26 PM
      396

      i have soldered 2 times ps3 and this 2 times are my first soldering in life :D
      i can say, it is not hard, but you can't hurry. first of all, be sure you have right diagrams, check wirering i dont believe that problem is in soldering, if you have checked after each wire soldering, if its observed - make easy pull test!
      I have damaged on track/trace on motherboard, and this fixing takes me a week.
      Picture here :D
      http://www.upload.ee/image/1757443/IMAG0122.jpg
      jeah, on top is track fixing.

    397. cvp
      10-24-2011
      03:22 PM
      397

      i solder today again... i think i try this now 6 times ? in two different Console.... and i can solder its my hobby... and i dont have luck... all dumps are different. Different MD5... use two different Notebooks... different USB Ports, different NORway Version. Different USB cable, different cables.... NO F***ing luck! What is the Problem ?

      i have PS3 Slim CECH2504B - Board: JTP-001 , i use JSD-001 Diagrams. Windows 7 64Bit (Both Notebooks), i7 CPU

      it is possible on a Win 64Bit system? better use ubuntu?

    398. bahaa_monier
      10-24-2011
      06:46 PM
      398

      Hi guys ,
      Great work
      iam following from long time but didn't try it , so i start now , soldered the teensy++ successfully .
      - dumped like 20 idintical dump
      - checked with norpatch but all UNKNOWN
      - patched
      tried to write , but iam getting ( Unknown chip manufacturer! )
      my flash is : spansion S29GL128P90TFIR2

      tried a lot of time , and checked all cables .
      what can i do ???


      using v04 Beta12 :

      Pinging...
      Set SB to tristate

      NOR chip manufacturer: unknown (0x81)
      NOR chip type: unknown (0xffa181)

      STATUS_TRIST_N: True
      STATUS_RESET_N: True
      STATUS_READY: True
      STATUS_CE_N: False
      STATUS_WE_N: True
      STATUS_OE_N: True

      Resetting NOR...
      Ready.

      Unknown chip manufacturer! Exiting...

      Note: i'm using 3.3v from teensy++ because my PS broken from bad downgrade . ( Boot for 3 seconds only )
      i didn't found IFI in all dumbe , all started with :

      A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 AF AD E0 FF A0 81 A0 81 FE AD BE EF A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 F8 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 E9 C7 E9 81 A0 81 A0 81 A0 81 A0 83 A0 81 A0 81 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF A0 81 A0 81 A0 81 A0 8B A0 81 A0 81 A0 EF FC 81 A0 81 A0 81 A0 81 A4 81 A0 81 A0 81 A0 83 E8 81 E1 F3 E5 E3 F5 F3 E5 DF EC EF E1 E5 E5 F3 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 83 EC 81 A0 81 A0 81 A0 81 A0 81 E5 C5 E9 C5 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 83 EC 81 A0 81 A0 81 A0 81 A8 81 E3 C9 F3 C5 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 83 F4 81 A0 81 A0 81 A0 81 A8 81 E3 C3 F3 C5 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 83 FC 81 A0 81 A0 81 A0 83 A0 81 F4 F3 F6 EB FF F1 F2 E7 B0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 85 FC 81 A0 81 A0 81 A0 83 A0 81 F4 F3 F6 EB FF F1 F2 E7 B1 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 87 FC 81 A0 81 A0 81 A0 83 A0 81 F4 F3 F6 EB FF F1 EB E7 B0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 89 FC 81 A0 81 A0 81 A0 83 A0 81 F4 F3 F6 EB FF F1 EB E7 B1 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 8B FC 81 A0 81 A0 81 A0 F1 A0 81 F2 EF F3 B1 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 FB FC 81 A0 81 A0 81 A0 F1 A0 81 F2 EF F3 B1 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 EB FC 81 A0 81 A0 81 A0 85 A0 81 E3 F7 F4 F3 ED 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 83 E8 81 A0 81 A0 81 A0 81 A0 C1 A0 81 A0 81 A0 81 E9 E1 ED E5 F4 ED E4 F3 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 A0 81 AE 93 E3 A7 EE CB BB A9 AE F7 B7 E7 F0 95 A0 81 AE 93 FF F7 EA A3 A7 DF F8 CF A6 D5 F4 CF F1 AF F0 FF F7 F7 B8 A1 E8 95 E8 E7 EA DB B1 FF FD BF E3 83 B7 C1 EA 9F A2 F7 AB 89 F7 91 AF E1 F3 FD AD F1 B2 ED E9 C9 BE FD AE F1 F6 AF E6 8D FF 8F B3 B9 F0 D9 AA 8B BF A3 BD 91 F2 8F A2 F5 E3 AD EC C7 B0 B5 E7 BF B5 EF E3 BB B1 AD F7 BF A3 CB F6 A5 BC AD EB F9 AE EB E1 F9 F9 D7 FE A3 EB F7 A1 87 F6 D9 AF B7 EC 97 F9 8D A5 BB BF E5 F8 FF F6 C7 A5 CB E7 D9 F8 A7 FF C3 A5 DF EA DB BF BD A4 E5 BA E3 F9 97 AA F3 BF 89 FC E7 E8 B9 BE 9B B2 B7 B3 95 F3 DD E0 9B EF E7 E4 E1 E0 BD ED EF FB CD B0 89 E6 EF A2 D7 FC A7 AF C5 AB 85 E9 FF B2 A5 B3 E9 F7 F9 EF AD E4 A5 B2 ED E1 ED AA D5 B1 FB A4 CD EF 99 A6 9D B1 91 B0 B5 A2 C1 F6 EB EB 99 AC ED AE F9 BD BD E9 D7 E0 9F BA 95 EF 8D AE F3 B1 DB EF A3 F2 B7 A9 AF A1 F5 B7 C3 E7 9F B6 F5 F4 83 B4 F1 E1 D3 A2 99 E0 D9 A5 CF B4 C7 B7 FF F8 9B A1 99 FD AB A5 A5 FB DD A7 A1 A5 F9 A8 87 A6 C7 E6 8B A2 EB B9 A9 B8 FF B8 A5 EA AF BC 95 E8 85 F6 99 E5 B7 AE 97 E2 A3 AE CF A9 B1 EC B1 F9 B3 F7 C9 B4 C5 F3 A5 A2 CB B9 A3 F2 C5 E5 C9 F6 8F BD E3 A6 A1 A6 AD FA D1 AC AD F2 89 ED B1 FC CF E3 DB F9 F9 FD DD E9 B1 FC BD AC C5 B1 8B A8 C5 FC F1 F0 A3 B1 AD B0 A9 AF 9D AA BD EA ED EF BB B9 97 FF CD EB F7 B9 9B BA F1 EA A5 FB 9B E2 CF F3 CD EE D7 ED B5 E5 9F FE E9 FA 89 F7 E3 BA E7 A0 D1 FA EF F5 B5 AF 93 E0 F5 EE A3 B0 ED EF B5 BC B5 BE 83 A0 AD E9 C9 A0 D9 EA F9 BF A1 E8 CF EF 95 B6 F3 E2 FD EB BD F3 A7 F9 B7 AC A5 A3 D1 B9 BD A5 E5 EE ED A3 AF B2 B1 E4 A9 BC BD B5 F1 A2 C1 F6 F5 F9 C1 FB AB BC C5 F6 A9 EC A7 E5 9D B8 B3 AC E7 A0 93 E7 A3 A2 E3 EF 9B F1 F1 EE 8D FC C3 EA CB E1 A3 F8 BB EF 89 BF 8F F5 C5 A0 D9 ED A9 A2 8D EA AD EC 8F AE D7 B4 89 AA A7 B7 CD EE BF BB E3 FC 99 EE CD A6 F5 B9 C7 F1 EB B6 81 B5 D5 FE 89 FC B1 A2 9F BA 9D BD A9 A2 D3 B2 F9 A8 B1 B8 C1 F2 AB AC 95 EF EF B9 A1 FE A7 FD 97 AB C5 A5 9F A2 FD AE 89 AC CF A9 C1 EF BD A0 FF FE D7 E2 9B BC E1 BB 99 EC 9B FB 91 AC AB F9 F7 AC D5 AD EF A0 99 ED A1 F0 99 E6 85 AF B1 EC 89 BB CF B9 AB EF BF B9 C9 FC 8B E3 9D B5 EF F6 F1 B3 CD F5 E5 E2 DD B0 FF A8 CF A2 EF FA D7 FF B3 BD C3 A8 D1 B0 8D E1 DB A5 E5

      regards .

    399. Dudshl
      10-24-2011
      10:17 PM
      399

      Originally Posted by postal worker
      [MENTION=200600]Dudshl[/MENTION] - have you had any progress with your ps3? the one where when you try to flash it gives you a "unknown manufacture" and each dump is slightly different? currently i am in the same boat...
      What NOR chip do You have? Do You see "unknown manufacture" every time or some times?
      I had Spansion,Macronix,Samsung K8P2716, but problems with reading I had only with Samsung K8Q2815. Other chips read and write correctly. (Samsung K8Q2815 sometimes shows "unknown manufacturer")

      (MY INSTRUCTION IS VERY RESKY!!!!!!!!! Think TWICE before do it!!!!! You do it at You own risk)

      I used NORway_v0.4_beta12

      I do so: I switched teensy to 5V-mod and received correct dump (5 dumps had same MD5 and norpatch find correct ros0/ros1). Then I switched it to 3.3V and erase chip. I patched my dump with dospiedras_v2. Then I open NORway.py and replace all "rdata = self.readsector(addr+(block/2), 0x1000)" with "rdata == data[block:block+0x1000]", save it and make "writeword" with patched dump. My console returned to life and I successfully update it with rogero_v2 firmware.
      Try "writeword" several times until You console boots correctly.
      Good luck

      (MY INSTRUCTION IS VERY RESKY!!!!!!!!! Think TWICE before do it!!!!! You do it at You own risk)
      --------------------------------------------------------------------------------------------
      ************* [ - Post Merged - ] *************
      Originally Posted by bahaa_monier
      Note: i'm using 3.3v from teensy++ because my PS broken from bad downgrade . ( Boot for 3 seconds only )
      If norpatch says "unknown" in each row - You dump is not correct!
      Do not connect Teensys 3.3V to anywhere! Disconnect it from console!
      Try such procedure:
      1. connect USB (power is disconnected)
      2. NORway.py YOUR_COM
      3. connect power cable and turn on console (console just turns on and do not show you "red flashes" or "beeps")
      4. NORway.py YOUR_COM
      5. NORway.py YOUR_COM dump xxxxx.bin
      6. NORway.py YOUR_COM dump yyyyy.bin
      7. NORway.py YOUR_COM release
      8. disconnect power cable
      Your dumps must have same MD5, norpatch must find correct ros0/ros1 and you must find IFI!!!

    400. judges
      10-25-2011
      12:46 AM
      400

      Originally Posted by cvp
      i solder today again... i think i try this now 6 times ? in two different Console.... and i can solder its my hobby... and i dont have luck... all dumps are different. Different MD5... use two different Notebooks... different USB Ports, different NORway Version. Different USB cable, different cables.... NO F***ing luck! What is the Problem ?

      i have PS3 Slim CECH2504B - Board: JTP-001 , i use JSD-001 Diagrams. Windows 7 64Bit (Both Notebooks), i7 CPU

      it is possible on a Win 64Bit system? better use ubuntu?
      What can I say? I do have the very same configuration, soldered the teensy, re-assembled my ps3, created the initial NORway version and it worked correctly right away.

      To rule out some error sources: Win7 x64 does work, I'm also using it. Win7 x86 (on a notebook) does work, tried it several times.

      Wiring? I used 30AWG Kynar wire (single strand) with just one GND connection (use more GND connections for testing). Works like a charme. EMI? Maybe. Try routing your wires the same way as I did (have a look at the installation pics in the NORway archive). Re-assemble your PS3, so that shielding is in place.

      What's left? Teensy might be defective or power regulator isn't providing enough current. You might wanna try running it at 5V without regulator (at your own risk). I did it, it didn't do any harm, but be aware that it is beyond NOR specs.

    401. randuev
      10-25-2011
      11:43 AM
      401

      Originally Posted by cvp
      i solder today again... i think i try this now 6 times ? in two different Console.... and i can solder its my hobby... and i dont have luck... all dumps are different. Different MD5... use two different Notebooks... different USB Ports, different NORway Version. Different USB cable, different cables.... NO F***ing luck! What is the Problem ?

      i have PS3 Slim CECH2504B - Board: JTP-001 , i use JSD-001 Diagrams. Windows 7 64Bit (Both Notebooks), i7 CPU

      it is possible on a Win 64Bit system? better use ubuntu?
      hey, apart recommending you to solder several GND points especially if you use AWG32 or higher, here's another thing that bugged me first couple of tries:
      when you turn your ps3 on, wait for 20 whole seconds before trying to dump nor.

      it took me too long a time to figure this one out i doubt it is a fluke, maybe 20 seconds is too long, but it sure worked for me.

    402. X-Treme_Fe4r
      10-25-2011
      05:09 PM
      402

      Hey,

      I've dumped my NOR (PS3 80GB CECHK04) succsessfully...

      now I want to prepare the downgrade.bin...

      I have extract my dump with FlowRebuilder v.4.1.3.2... but I've got Errors

      OPERATION COMPLETED WITH ERRORS!

      Could not successfully extract all Dump files because an error occured.
      Part of file has been extract here:

      "$PATH TO FILE$"
      Is that normal... or is anything wrong??

      PS: Sorry for my bad English

    403. bahaa_monier
      10-25-2011
      05:28 PM
      403

      I did what you told me ,
      succesfully dumber 3 identical dumps :

      NOR chip manufacturer: Spansion (0x01)
      NOR chip type: S29GL128 (0x7e2101)

      Checking sector protection...
      No protected sectors found!

      STATUS_TRIST_N: True
      STATUS_RESET_N: True
      STATUS_READY: True
      STATUS_CE_N: False
      STATUS_WE_N: True
      STATUS_OE_N: True

      Resetting NOR...
      Ready.

      Dumping NOR...
      16384 KB / 16384 KB
      Done. [0:01:13.956000]

      i modified the dump and wrote it :

      Pinging...
      Set SB to tristate

      NOR chip manufacturer: Spansion (0x01)
      NOR chip type: S29GL128 (0x7e2101)

      Checking sector protection...
      No protected sectors found!

      STATUS_TRIST_N: True
      STATUS_RESET_N: True
      STATUS_READY: True
      STATUS_CE_N: False
      STATUS_WE_N: True
      STATUS_OE_N: True

      Resetting NOR...
      Ready.

      Writing...
      16384 KB / 16384 KB
      Done. [0:06:01.407000]

      but the PS3 when tern it on , it just tern on and don't turn off or detect the usb connected with files on usb2 port .
      ( The Tennsy++ still wired )

      tried to write again using this method but i got :

      Pinging...
      Set SB to tristate

      NOR chip manufacturer: Spansion (0x01)
      NOR chip type: unknown (0x7e2505)

      STATUS_TRIST_N: True
      STATUS_RESET_N: True
      STATUS_READY: True
      STATUS_CE_N: True
      STATUS_WE_N: True
      STATUS_OE_N: True

      Resetting NOR...
      Ready.

      Unknown device id! Exiting...

      is it wiring problem ( Maybe disconnected )
      Please Advise ?

      Thanks

    404. Dudshl
      10-25-2011
      11:27 PM
      404

      Originally Posted by X-Treme_Fe4r
      now I want to prepare the downgrade.bin...
      http://psx-scene.com/forums/content/...rogskeet-1391/
      try this method.


      bahaa_monier,
      If You want to Use Teensy as psgrooev/psgrade when it wired - just desolder D6-wire from Teensy and it will works so
      If You want to use NORway - just solder D6 back.

      I use switch on D6 pin to avoid soldering/resoldering D6. 'Cliclk' and It becomes ps3 dongle, 'click' again and it become NOR flasher.

    405. cvp
      10-26-2011
      01:25 AM
      405

      Originally Posted by randuev
      hey, apart recommending you to solder several GND points especially if you use AWG32 or higher, here's another thing that bugged me first couple of tries:
      when you turn your ps3 on, wait for 20 whole seconds before trying to dump nor.

      it took me too long a time to figure this one out i doubt it is a fluke, maybe 20 seconds is too long, but it sure worked for me.


      thanks for help... i solder now 4 GND cable. I wait 20 seconds... same sh**
      What is AWG32 ?

    406. Dudshl
      10-26-2011
      02:07 AM
      406

      Originally Posted by cvp
      thanks for help... i solder now 4 GND cable. I wait 20 seconds... same sh**
      What is AWG32 ?
      What NOR chip do You have?

    407. bahaa_monier
      10-26-2011
      03:31 AM
      407

      Originally Posted by Dudshl
      http://psx-scene.com/forums/content/...rogskeet-1391/
      try this method.


      bahaa_monier,
      If You want to Use Teensy as psgrooev/psgrade when it wired - just desolder D6-wire from Teensy and it will works so
      If You want to use NORway - just solder D6 back.

      I use switch on D6 pin to avoid soldering/resoldering D6. 'Cliclk' and It becomes ps3 dongle, 'click' again and it become NOR flasher.
      thank you
      but i still can't flash my Nor again ,
      my nor chip type : unknown
      and i tried to use my flasher for downgrade , but the ps3 don't detect any usb connected to it .
      is it normal ?
      or i did some thing wrong
      i can dumb
      but can't write on my nor .

      please help and thank you

    408. Dudshl
      10-26-2011
      04:01 AM
      408

      Originally Posted by bahaa_monier
      my nor chip type : unknown
      i can dumb
      but can't write on my nor .
      If chip manufacturer is unknown - You can not dump correct. Check Your dumps with norpatch. Is it detect ros0/ros1.
      If chip manufacturer is unknown - there is wires/soldering problem. Check all connections and resolder if needed.

    409. bahaa_monier
      10-26-2011
      04:26 AM
      409

      Originally Posted by Dudshl
      If chip manufacturer is unknown - You can not dump correct. Check Your dumps with norpatch. Is it detect ros0/ros1.
      If chip manufacturer is unknown - there is wires/soldering problem. Check all connections and resolder if needed.
      i checked when dumped :

      PRG0 version is 3.50
      PRG1 version is 3.41_2
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is 3.41_2
      ROS1 version is 3.50


      and after modification using transplante and FlowRebuilder v.4.1.3.2

      PRG0 version is unknown
      PRG1 version is unknown
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is unknown
      ROS1 version is unknown

      and i wrote it ( downgrade.bin.rev )
      then when i tried to write it again : my NOR chip type: unknown
      i checkd the cables , all connected

      may be the file i flashed changed the nor type?
      is it possible ?????

      and what i should do after that ?
      connect my downgrade flash and press power eject ?
      or connect the usb with files only ?
      or the downgrade.bin.rev is corrupted ??????

    410. jeerum
      10-26-2011
      04:36 AM
      410

      Originally Posted by bahaa_monier
      i checked when dumped :

      PRG0 version is 3.50
      PRG1 version is 3.41_2
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is 3.41_2
      ROS1 version is 3.50


      and after modification using transplante and FlowRebuilder v.4.1.3.2

      PRG0 version is unknown
      PRG1 version is unknown
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is unknown
      ROS1 version is unknown

      and i wrote it ( downgrade.bin.rev )
      then when i tried to write it again : my NOR chip type: unknown
      i checkd the cables , all connected

      may be the file i flashed changed the nor type?
      is it possible ?????

      and what i should do after that ?
      connect my downgrade flash and press power eject ?
      or connect the usb with files only ?
      or the downgrade.bin.rev is corrupted ??????
      dont use byte revers on norpatch, if you use norpatch.exe.

    411. judges
      10-26-2011
      05:51 AM
      411

      Originally Posted by Dudshl
      If You want to Use Teensy as psgrooev/psgrade when it wired - just desolder D6-wire from Teensy and it will works so
      If You want to use NORway - just solder D6 back.

      I use switch on D6 pin to avoid soldering/resoldering D6. 'Cliclk' and It becomes ps3 dongle, 'click' again and it become NOR flasher.
      Or you simply use the modified version below. Its clock speed is set to 8MHz and the LED has been disabled (D6), so it doesn't interfere when it's soldered:

      PSGrade for Teensy++ 2.0 (NORway vers., 8MHz, LED disabled): http://www.multiupload.com/V547CSWZ0C

    412. Dudshl
      10-26-2011
      10:07 AM
      412

      bahaa_monier,USE this method.

      http://psx-scene.com/forums/content/...rogskeet-1391/
      It is easer and faster. And do not need FlowRebuilder and reverce.

      judges, thanks for noLED_psgrade!!!

    413. bahaa_monier
      10-26-2011
      10:11 AM
      413

      Originally Posted by jeerum
      dont use byte revers on norpatch, if you use norpatch.exe.
      Originally Posted by judges
      Or you simply use the modified version below. Its clock speed is set to 8MHz and the LED has been disabled (D6), so it doesn't interfere when it's soldered:

      PSGrade for Teensy++ 2.0 (NORway vers., 8MHz, LED disabled): http://www.multiupload.com/V547CSWZ0C
      Originally Posted by Dudshl
      bahaa_monier,USE this method.

      http://psx-scene.com/forums/content/...rogskeet-1391/
      It is easer and faster. And do not need FlowRebuilder and reverce.

      judges, thanks for noLED_psgrade!!!

      Thank you guys for tools and methods and guide ,
      but still can't write on Nor
      i checked the wires and all working fine
      is it possible to corrupt my Nor by writing bad bin ?

      my dump link is :

      http://www.megaupload.com/?d=KKFO7RQ4

    414. dandza
      10-26-2011
      10:37 AM
      414

      Originally Posted by Dudshl
      If chip manufacturer is unknown - You can not dump correct. Check Your dumps with norpatch. Is it detect ros0/ros1.
      If chip manufacturer is unknown - there is wires/soldering problem. Check all connections and resolder if needed.
      I had chip manufacturer unknown with spansion P and it made a good dump, i compared it with progskeet also.
      The problem is that i could not write it with teensy because of manufacturer unknown.
      Tried many times, always the same. Dumps are good but always get chip manufacturer unknown...

      Anyone have a clue?

      judges when you come online please contact me on mirc or pm.

    415. jeerum
      10-26-2011
      12:17 PM
      415

      Originally Posted by dandza
      I had chip manufacturer unknown with spansion P and it made a good dump, i compared it with progskeet also.
      The problem is that i could not write it with teensy because of manufacturer unknown.
      Tried many times, always the same. Dumps are good but always get chip manufacturer unknown...

      Anyone have a clue?

      judges when you come online please contact me on mirc or pm.
      chip manufacturer is unknown - it means that you have corrupted dump.

    416. judges
      10-26-2011
      12:25 PM
      416

      Originally Posted by bahaa_monier
      Thank you guys for tools and methods and guide ,
      but still can't write on Nor
      i checked the wires and all working fine
      is it possible to corrupt my Nor by writing bad bin ?

      my dump link is :

      http://www.megaupload.com/?d=KKFO7RQ4
      First of all, your dump is byte-swapped. Won't work. Don't do that. It's not required for NORway.

      Secondly, did you do the dump when the manufacturer/chip id still was reported correctly?

      You cannot fry your NOR by writing false data. It's just data. Whatever the content is.

      My assumption is that one of your wires broke. You cannot check by just looking at them. You have to measure resistance. It's easy to brake one by bending it (if you've used single strand wires).

      Since it did work correctly the first time, it's probably some hardware issue.
      ************* [ - Post Merged - ] *************
      Originally Posted by cvp
      thanks for help... i solder now 4 GND cable. I wait 20 seconds... same sh**
      What is AWG32 ?
      Did you consider the other hints? Especially routing of wires (EMI)?

      AWG32 just defines the diameter of wires: http://lmgtfy.com/?q=32awg+wiki

    417. cvp
      10-26-2011
      05:15 PM
      417

      SOooo i try now with 5V and see.... three dumps with same MD5! Yeah! ... but if i plug USB out und will start the PS3, he is not boot. No Peep or other reaktions... i have flash the Teensy again, but no luck. Any a idea what happen?

    418. jeerum
      10-26-2011
      09:44 PM
      418

      Originally Posted by cvp
      SOooo i try now with 5V and see.... three dumps with same MD5! Yeah! ... but if i plug USB out und will start the PS3, he is not boot. No Peep or other reaktions... i have flash the Teensy again, but no luck. Any a idea what happen?
      dummp yuor flashed nor again and compare if its same with your modifed flash file!

    419. judges
      10-27-2011
      01:45 AM
      419

      Originally Posted by cvp
      SOooo i try now with 5V and see.... three dumps with same MD5! Yeah! ... but if i plug USB out und will start the PS3, he is not boot. No Peep or other reaktions... i have flash the Teensy again, but no luck. Any a idea what happen?
      Did you also write to your flash or did you just dump?
      Are you using 5V from USB (removed power regular / bridged 5V pads again)?

      Can you still dump with the same result? Is the content of the dump correct (norpatch)?

    420. cvp
      10-27-2011
      02:08 AM
      420

      Hello, i have only read the NOR, nothing more. The Voltage Regulator is on the Board, but i cut the bridged from 3.3V. The bridge is now with 5V from USB.

      Ok my first three Dumps have this:

      PRG0 version is 3.55
      PRG1 version is 3.50
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is 3.72
      ROS1 version is 3.70

      My last three dumps at this
      PRG0 version is unknown
      PRG1 version is unknown
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is unknown
      ROS1 version is unknown

    421. judges
      10-27-2011
      03:49 AM
      421

      Originally Posted by cvp
      Hello, i have only read the NOR, nothing more. The Voltage Regulator is on the Board, but i cut the bridged from 3.3V. The bridge is now with 5V from USB.

      Ok my first three Dumps have this:

      PRG0 version is 3.55
      PRG1 version is 3.50
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is 3.72
      ROS1 version is 3.70

      My last three dumps at this
      PRG0 version is unknown
      PRG1 version is unknown
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is unknown
      ROS1 version is unknown
      What did you do in between? Hopefully you haven't fried your NOR with the 5V...

      At least you have a good dump now. Keep it in a safe place.. Worst case you have to replace the NOR. But I would check wiring again first.

    422. cvp
      10-27-2011
      05:49 AM
      422

      I only read the nor with 5v. Thats it. Than i see oh, he read 3 time same dump, i solder the 3 extra gnd out. So i have now one gnd on teensy and mainboard. Than i read again 3 time with same md5. After that i want to play with a friend on psn, see, that he dont boot.
      The couriouse is, that he stuck on boot. No peep, no shut down, no ylod. It looks like, that the teensy let the ps3 not booting. Wich cable i can disconnect from teensy thus the teensy is no loner active?

      Ps: i dont have write or erase the nor!
      Maybe i try to write my correct nor dump with 3v ?

    423. judges
      10-27-2011
      06:12 AM
      423

      Originally Posted by cvp
      I only read the nor with 5v. Thats it. Than i see oh, he read 3 time same dump, i solder the 3 extra gnd out. So i have now one gnd on teensy and mainboard. Than i read again 3 time with same md5. After that i want to play with a friend on psn, see, that he dont boot.
      The couriouse is, that he stuck on boot. No peep, no shut down, no ylod. It looks like, that the teensy let the ps3 not booting. Wich cable i can disconnect from teensy thus the teensy is no loner active?

      Ps: i dont have write or erase the nor!
      Maybe i try to write my correct nor dump with 3v ?
      If Teensy isn't powered (disconnect USB), it shouldn't interfere. You can de-solder the Tristate line if you're in doubt. Trying to write if you cannot dump doesn't make any sense. Better check for shorts on the mainboard caused by your gnd (de)soldering. Besides, I don't understand why you would de-solder the additional gnds if it was working well..

    424. bahaa_monier
      10-27-2011
      08:02 AM
      424

      Originally Posted by judges
      First of all, your dump is byte-swapped. Won't work. Don't do that. It's not required for NORway.

      Secondly, did you do the dump when the manufacturer/chip id still was reported correctly?

      You cannot fry your NOR by writing false data. It's just data. Whatever the content is.

      My assumption is that one of your wires broke. You cannot check by just looking at them. You have to measure resistance. It's easy to brake one by bending it (if you've used single strand wires).

      Since it did work correctly the first time, it's probably some hardware issue.
      ************* [ - Post Merged - ] *************


      Did you consider the other hints? Especially routing of wires (EMI)?

      AWG32 just defines the diameter of wires: http://lmgtfy.com/?q=32awg+wiki
      what is byte-swapped meen ?
      my dump not correct ?
      i have 3 idintical dumps with same result . and flashed the bad FW .
      and waiting till tomorrow to fix the wires .

      please advise
      is it possible to flash Downgrade.bin only ?????
      i have problem and can't correct my Dumb . can someone please correct it for me ?

      http://www.megaupload.com/?d=KKFO7RQ4

      it give me :
      PRG0 version is 3.50
      PRG1 version is 3.41_2
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is 3.41_2
      ROS1 version is 3.50
      but i don't know what is byete swapped meen ?

      if it
      can i flash my dumb again and start from scratch ?
      Note : my PS3 broken and turn on for 2 seconds ( bad downgrade )

      Thank you

    425. cvp
      10-27-2011
      10:55 AM
      425

      Originally Posted by judges
      If Teensy isn't powered (disconnect USB), it shouldn't interfere. You can de-solder the Tristate line if you're in doubt. Trying to write if you cannot dump doesn't make any sense. Better check for shorts on the mainboard caused by your gnd (de)soldering. Besides, I don't understand why you would de-solder the additional gnds if it was working well..
      because itsn Boot. I Use one of the GND wire on the Mainboard on a Goldenplace from Mainboard. I Check later the GND Wire on Mainboard an teensy.... and i isconnect Tristate, we will see if the ps3 will be boot.... i hope so.

      EDIT2:

      - So... my PS3 is working. I disconnect Tristate and start the PS3.... its booting... Puuuuh :D
      - I Check some wire... all ok... an solder the Tristate back.
      - i try with a resistor on (USB 5V + resistor = 3.23V) => result => cant read...
      - i try again 5V => Reading all ok, all three dumps have the same MD5 + norpatch info.
      - i check if my ps3 ist booting.... yes it is!

      realy, i dont know why i cant read correctly dumps with a voltage regulator (3.24V).... Only with 5V is it possible. Any a idea ? :D
      I know it is a risk. But my know is end, i dont know how to fix the problem.
      I try tomorow the downgrade and write the dump with 5V. Hope it will all ok.

    426. bahaa_monier
      10-27-2011
      07:05 PM
      426

      Please guys ,
      what is byteswap ????????
      and how can make it ??????
      iam trying to fix it but can't .
      please help

      http://www.megaupload.com/?d=KKFO7RQ4

    427. Dudshl
      10-27-2011
      09:27 PM
      427

      Originally Posted by bahaa_monier
      Please guys ,
      what is byteswap ????????
      and how can make it ??????
      iam trying to fix it but can't .
      please help

      http://www.megaupload.com/?d=KKFO7RQ4
      You make byteswap by flow rebuilder. FORGET FLOW REBUILDER! AND FORGET DOWNGRADE.BIN. It is OLD METHOD!!!

      USE this method:
      http://psx-scene.com/forums/content/...rogskeet-1391/

      Just take Your original dump, open with HEX-editor, apply 6 patches,save it and flash Your NOR with patched dump!

    428. bahaa_monier
      10-27-2011
      10:17 PM
      428

      i modified the original bin file now , but it only open * green and blue leds without anything .
      the ps3 don't detect the USB ports , so i can't put it in factory service mode .
      what can i do ?
      note :
      - it was briked from bad downgrade from 3.55 to 3.41 .
      - when dump i didn't found the IFI .

      please advise .

    429. cvp
      10-28-2011
      02:00 AM
      429

      Can anyone confirm me this steps:

      i want format my now existing HDD (OFW)!!

      Steps:
      01) Dump OFW3.72/3.73
      02) DL the OFW3.72/3.73 and put on USB Stick (:/PS3/UPDATE/UPDAT.PUP)
      03) i change now with a new HDD and put it on PS3
      04) Strt PS3 and install over USB Stick the OFW3.72/3.73
      05) than i dump again (named ofw_for_cfw.bin ...what ever)
      06) Patch this file with the 6 files
      07) do the downgrade with the new HDD
      08) Install the Rogero CFW (with new HDD)
      09) after all ... put the old HDD
      10) Flash the first OFW dump
      11) Have Fun with the files from old HDD

      is that correcly?

    430. X-Treme_Fe4r
      10-28-2011
      10:54 AM
      430

      So I just get

      PRG0 version is unknown
      PRG1 version is 3.55
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is unknown
      ROS1 version is unknown
      I've tried 3 more GND wires, shorter wires and 5V on Teensy... i belive my ps3 needs an kick


    431. jeerum
      10-30-2011
      02:41 AM
      431

      NB! Guy's, who use NorWay, please dont use FlowBuilder or any byte swaper, because because its not needed. There is the main problem here on patching :D

    432. cvp
      10-30-2011
      07:07 AM
      432

      So, i Downgrade Successful my PS3 Slim with 3.72 to 3.55. Big Thanks for Help[MENTION=129487]all[/MENTION]. I can only try with 5V. Today i write the NOR 10 times or more :P

      My last problem is, i cant do two different HDD with two FW. like...

      3.72 - OFW - 320GB - Toshiba
      3.55 - CFW - 320GB - Western Digital

      I have on the OFW HDD all my Files. i want lose them. I dump first the OFW for my HDD A than I Try to put out the HDD A (OFW) and put in the PS3 the HDD B (CFW).... i install on them the OFW 3.72... dump the NOR and Downgrade....after them i dump the NOR CFW for HDD B.... so than i put the HDD A (OFW) on the CFW Rogero... he want to Update on 3.72... i do them... after them my HDD A with FW 3.72 is startet.... i dump the NOR OFW.... than if i write the CFW and Put the CFW HDD.... the PS3 dont start... currious is that the LED ist not red or green, its off!...

      How i cant fix my Problem?

      thanks a lot

    433. Domus
      10-30-2011
      03:47 PM
      433

      Judges your wisdom is needed

      Have you ever done or thought about doing a dual nor with a switch? Im very interested in this. The dual NOR concept seems easy enoughg by piggybacking it on top of the original nor, lift the #CE leg, attach a switch between them.


      The only problem is i have no clue where to begin on putting FW/flashing that new NOR. If you can help me out with some noob friendly advice i would really appreciate it


      Edit: never mind same process i would use for the downgrade

    434. bahaa_monier
      10-30-2011
      07:17 PM
      434

      Guys , my dumb is byteswap . how can fix it ?
      is it any software to correct it or clean nand to replace some hex from my dumb to repair one like xbox ?
      or hex software to move column and replace column by another to correct it ?
      is it possible ?

    435. Hikage
      10-30-2011
      09:20 PM
      435

      Originally Posted by cvp
      So, i Downgrade Successful my PS3 Slim with 3.72 to 3.55. Big Thanks for Help[MENTION=129487]all[/MENTION]. I can only try with 5V. Today i write the NOR 10 times or more :P

      My last problem is, i cant do two different HDD with two FW. like...

      3.72 - OFW - 320GB - Toshiba
      3.55 - CFW - 320GB - Western Digital

      I have on the OFW HDD all my Files. i want lose them. I dump first the OFW for my HDD A than I Try to put out the HDD A (OFW) and put in the PS3 the HDD B (CFW).... i install on them the OFW 3.72... dump the NOR and Downgrade....after them i dump the NOR CFW for HDD B.... so than i put the HDD A (OFW) on the CFW Rogero... he want to Update on 3.72... i do them... after them my HDD A with FW 3.72 is startet.... i dump the NOR OFW.... than if i write the CFW and Put the CFW HDD.... the PS3 dont start... currious is that the LED ist not red or green, its off!...

      How i cant fix my Problem?

      thanks a lot
      i have the same problem with my ps3 slim but i use 3.3v regulator

      3.72 - OFW - 80GB - Fujitsu
      3.55 - CFW - 320GB - Toshiba

      when i'm on 3.55 and swap on 3.72 i have to reinstall my ps3 and same when i would like to swap to 3.55

      i use a third hdd (seagate 500GB) for reinstall my ps3 on 3.72 or 3.55, i don't want to lose data on 3.55.

      If i would like to use 3.72, i have to put the seagate 500GB update to 3.72 and swap with the Fujitsu 80GB.

      And when i would like to use 3.55, i flash the nor with the dospiedra v2 patches.

      Use 1st and 2nd stage Lv2diag on the seagate 500GB and when finish swap with the toshiba 320GB.

    436. Dudshl
      10-31-2011
      01:01 AM
      436

      Originally Posted by Hikage
      i have the same problem with my ps3 slim but i use 3.3v regulator

      3.72 - OFW - 80GB - Fujitsu
      3.55 - CFW - 320GB - Toshiba

      when i'm on 3.55 and swap on 3.72 i have to reinstall my ps3 and same when i would like to swap to 3.55

      i use a third hdd (seagate 500GB) for reinstall my ps3 on 3.72 or 3.55, i don't want to lose data on 3.55.

      If i would like to use 3.72, i have to put the seagate 500GB update to 3.72 and swap with the Fujitsu 80GB.

      And when i would like to use 3.55, i flash the nor with the dospiedra v2 patches.

      Use 1st and 2nd stage Lv2diag on the seagate 500GB and when finish swap with the toshiba 320GB.
      You can swap easer:
      1. Dump NOR when it work`s with 3.72 firmware with fujitsu HDD;
      2. Downgrade it with dospeidras v2 method with seagate 500GB;
      3. Dump NOR when it work`s with 3.55 firmware when it works with toshiba 320Gb;

      To swap it to 3.72 - just flash 3.72 dump and change HDD to fujitsu;
      To swap it to 3.55 - just flash 3.55 dump (not dospiedras dump, Your dump after full downgrade) and change HDD to toshiba;

    437. bahaa_monier
      10-31-2011
      02:30 AM
      437

      Originally Posted by Hikage
      i have the same problem with my ps3 slim but i use 3.3v regulator

      3.72 - OFW - 80GB - Fujitsu
      3.55 - CFW - 320GB - Toshiba

      when i'm on 3.55 and swap on 3.72 i have to reinstall my ps3 and same when i would like to swap to 3.55

      i use a third hdd (seagate 500GB) for reinstall my ps3 on 3.72 or 3.55, i don't want to lose data on 3.55.

      If i would like to use 3.72, i have to put the seagate 500GB update to 3.72 and swap with the Fujitsu 80GB.

      And when i would like to use 3.55, i flash the nor with the dospiedra v2 patches.

      Use 1st and 2nd stage Lv2diag on the seagate 500GB and when finish swap with the toshiba 320GB.
      can you please upload your 3.55 dumb to fix my broken ps3 ??????
      i will compare it with my damaged dump until fix it
      can you please ??????

    438. Dudshl
      10-31-2011
      06:00 AM
      438

      Originally Posted by bahaa_monier
      can you please upload your 3.55 dumb to fix my broken ps3 ??????
      i will compare it with my damaged dump until fix it
      can you please ??????
      Do You have Your fist dump without any changes?

    439. Hikage
      10-31-2011
      08:16 AM
      439

      Originally Posted by Dudshl
      You can swap easer:
      1. Dump NOR when it work`s with 3.72 firmware with fujitsu HDD;
      2. Downgrade it with dospeidras v2 method with seagate 500GB;
      3. Dump NOR when it work`s with 3.55 firmware when it works with toshiba 320Gb;

      To swap it to 3.72 - just flash 3.72 dump and change HDD to fujitsu;
      To swap it to 3.55 - just flash 3.55 dump (not dospiedras dump, Your dump after full downgrade) and change HDD to toshiba;
      i try this now and reply for say if ok or not.

    440. bahaa_monier
      10-31-2011
      09:06 AM
      440

      Originally Posted by Dudshl
      Do You have Your fist dump without any changes?
      yes i have it .
      but it's byteswapped .
      when write it no responding
      here is it :

      http://www.megaupload.com/?d=KKFO7RQ4

      can fix please ?

    441. Hikage
      10-31-2011
      09:40 AM
      441

      Originally Posted by bahaa_monier
      yes i have it .
      but it's byteswapped .
      when write it no responding
      here is it :

      http://www.megaupload.com/?d=KKFO7RQ4

      can fix please ?
      i think you have a problem when you byteswap your dump with flowrebuilder found here

      your hdd name is "OTHSBI AKM2356SG X H Y G0D43EBQ" but if read the dump without byteswap you have the correct name "TOSHIBA MK3265GSX H Y0G4DE3QB"

      for mine problem:
      Originally Posted by Dudshl
      You can swap easer:
      1. Dump NOR when it work`s with 3.72 firmware with fujitsu HDD;
      2. Downgrade it with dospeidras v2 method with seagate 500GB;
      3. Dump NOR when it work`s with 3.55 firmware when it works with toshiba 320Gb;

      To swap it to 3.72 - just flash 3.72 dump and change HDD to fujitsu;
      To swap it to 3.55 - just flash 3.55 dump (not dospiedras dump, Your dump after full downgrade) and change HDD to toshiba;
      1) I start with ps3 on 3.72 with the fijitsu hdd, i dump the NOR named "swap 3.72".
      2) Downgrade with the toshiba, i have backup my hdd before.
      3) dump NOR named "swap 3.55"

      Now when i swap to the 3.72 with the hdd on it, my ps3 go to the recovery mode like when i downgrade.

      I press PS button, it say '"the system doesn't work normally, please reinstall firmware 3.55".
      If i press PS button, the ps3 restart and go to the main page of the downgrade.

    442. bahaa_monier
      10-31-2011
      09:45 AM
      442

      Originally Posted by Hikage
      i think you have a problem when you byteswap your dump with flowrebuilder found here

      your hdd name is "OTHSBI AKM2356SG X H Y G0D43EBQ" but if read the dump without byteswap you have the correct name "TOSHIBA MK3265GSX H Y0G4DE3QB"
      so is it possible to mix it from clean dump or another dump from another person and replace some hexs ??????

      or reverse the first lines only ?
      or is it completly damaged ?

      in XBOX you can download clean nand and transfare sectors from one to another to make it work easily . is any another idea like this in ps3 ??????

      or what can i do ?

    443. Dudshl
      10-31-2011
      09:45 AM
      443

      Originally Posted by bahaa_monier
      yes i have it .
      but it's byteswapped .
      when write it no responding
      here is it :

      http://www.megaupload.com/?d=KKFO7RQ4

      can fix please ?
      http://www.megaupload.com/?d=V7CI5KME
      http://www.megaupload.com/?d=OTW4YL9H

      Try flash this dumps.
      May be one will works.
      ************* [ - Post Merged - ] *************
      Originally Posted by Hikage
      Now when i swap to the 3.72 with the hdd on it, my ps3 go to the recovery mode like when i downgrade.

      I press PS button, it say '"the system doesn't work normally, please reinstall firmware 3.55".
      If i press PS button, the ps3 restart and go to the main page of the downgrade.
      Did You flash NOR with 3.72 dump before you spaw HDD?
      I think You did not

    444. bahaa_monier
      10-31-2011
      10:08 AM
      444

      Originally Posted by Dudshl
      http://www.megaupload.com/?d=V7CI5KME
      http://www.megaupload.com/?d=OTW4YL9H

      Try flash this dumps.
      May be one will works.
      ************* [ - Post Merged - ] *************


      Did You flash NOR with 3.72 dump before you spaw HDD?
      I think You did not
      WOW
      i will try it now .
      Thank you Dudshl
      is it my dump fixed or your one??????????

    445. Dudshl
      10-31-2011
      10:15 AM
      445

      Originally Posted by bahaa_monier
      WOW
      i will try it now .
      Thank you Dudshl
      is it my dump fixed or your one??????????
      There is Your dump: one patched with dospiedras v2, second - byte swapped and patched with dospiedras v2

    446. bahaa_monier
      10-31-2011
      10:21 AM
      446

      it's same .,
      turning on , nothing else
      the write take 1:48 m
      what is it ?
      why it is fast ?
      can i make one mixed between both ??????

    447. Hikage
      10-31-2011
      10:33 AM
      447

      Originally Posted by Dudshl
      http://www.megaupload.com/?d=V7CI5KME
      http://www.megaupload.com/?d=OTW4YL9H

      Try flash this dumps.
      May be one will works.
      ************* [ - Post Merged - ] *************


      Did You flash NOR with 3.72 dump before you spaw HDD?
      I think You did not
      i off my ps3 disconnect teensy swap hdd, connect and write swap.

      i try flash swap 3.72 with hdd 3.55 on the ps3 after shutdown ps3 swap hdd but when i launch ps3 i have the same message "please reinstall 3.55"

    448. Dudshl
      10-31-2011
      02:03 PM
      448

      I have THE PROBLEM:
      I make erasechip before dump, but I stop erasing and save about a half of data. norpatch detect only ros1.
      Firmware version was 3.56.
      Is there any ways to repair or "re-make" erased data? Or It dies?

      Dump file: http://www.megaupload.com/?d=S35H48DG

    449. cvp
      10-31-2011
      02:17 PM
      449

      Originally Posted by bahaa_monier
      it's same .,
      turning on , nothing else
      the write take 1:48 m
      what is it ?
      why it is fast ?
      can i make one mixed between both ??????
      I have two days befor the same problem. Befor you write you have erase you nor... NORway.py.py COMxx erasechip

      Than write again

    450. bahaa_monier
      10-31-2011
      04:01 PM
      450

      Originally Posted by cvp
      I have two days befor the same problem. Befor you write you have erase you nor... NORway.py.py COMxx erasechip

      Than write again
      I did
      but no result .

    451. cvp
      10-31-2011
      04:15 PM
      451

      and you tried this one:

      NORway.py COMxx erasechip ....than...
      NORway.py COMxx writewordubm dump.bin ....(~20 minuts) or if its not work better than... erae again and try this:
      NORway.py COMxx writeword dump.bin ....(~50 minits)

    452. Hikage
      11-01-2011
      09:17 AM
      452

      my problem is solved why i don't no, now i can fast swap 3.72 <> 3.55

    453. bahaa_monier
      11-01-2011
      10:06 AM
      453

      Originally Posted by cvp
      and you tried this one:

      NORway.py COMxx erasechip ....than...
      NORway.py COMxx writewordubm dump.bin ....(~20 minuts) or if its not work better than... erae again and try this:
      NORway.py COMxx writeword dump.bin ....(~50 minits)

      I tried erase and write , it take ( 6:30m ) but not working .
      and tried writewordubm but didn't work .
      can someone send me his 3.55 dump ????????
      pleasssssse

    454. judges
      11-01-2011
      12:10 PM
      454

      Originally Posted by bahaa_monier
      I tried erase and write , it take ( 6:30m ) but not working .
      and tried writewordubm but didn't work .
      can someone send me his 3.55 dump ????????
      pleasssssse
      It won't be of any help to you. I don't know how you've created your dump, but it's just partly byte-swapped. That wouldn't even be the worst thing if you'd knew where the byte-swapping ended, but what's really not fixable is that the metldr area (0x810-0x2F010) of your dump is total rubbish (byte-swapped or not). And this area is console specific and you cannot simply replace it from another console. Someone may correct me if I'm wrong.

    455. bahaa_monier
      11-01-2011
      12:45 PM
      455

      Originally Posted by judges
      It won't be of any help to you. I don't know how you've created your dump, but it's just partly byte-swapped. That wouldn't even be the worst thing if you'd knew where the byte-swapping ended, but what's really not fixable is that the metldr area (0x810-0x2F010) of your dump is total rubbish (byte-swapped or not). And this area is console specific and you cannot simply replace it from another console. Someone may correct me if I'm wrong.
      so
      it's dead forever !!!
      is it ?
      or can fix it ?

    456. cvp
      11-02-2011
      04:52 AM
      456

      its see so that you dump bad ps3 informations from your ps3. Problem is, that you cant take other ps3 dump. If you do that, your ps3 is not starting. I Hope o for you, that someone find a good solution for that problem.

    457. cvp
      11-03-2011
      06:14 AM
      457

      So its over... i think my NOR Flash is dead. After the Upgrade to 3.72 i have play like 3-4 hour BF3 Online.... after 2 hour Gaming i see a Error Code in Game like on XMB Error Code... damn i dont write the Error Code... but i can play 1-2 hour without Problems. Than i want to close the game and return to XMB... the PS3 is freez. I cant start again. I write my downgrade.bin and put my cfw hdd b inside... its start... than i put the console into Service mode for flash the regero CFW. but it isnt work... the ps3 start sometimes for few seconds and shutdown, no Red/Green light. Sometimes is it on, but the flashing over jig files and cfw is not working....

      so for now... i can read the nor... i can erase the nor (or its not erase? i check the LED on Teensy... its blinking on the beginn, but not more... after three minits tell me the programm, its finisch!), but i cant write anymore

      its retry 20 times with writeword/writewordubm and write command.
      Once have write on the 3. Retry, but it haves not working... now i try manytimes... and nothing... it cant be write (Beta 03/04)

      Pinging...
      Set SB to tristate

      NOR chip manufacturer: Spansion (0x01)
      NOR chip type: S29GL128 (0x7e2101)

      Checking sector protection...
      No protected sectors found!

      STATUS_TRIST_N: True
      STATUS_RESET_N: True
      STATUS_READY: True
      STATUS_CE_N: False
      STATUS_WE_N: True
      STATUS_OE_N: True

      Resetting NOR...
      Ready.

      Writing...
      0 KB / 16384 KB (1. Retry)
      (2. Retry)
      (3. Retry)
      (4. Retry)
      (5. Retry)
      (6. Retry)
      (7. Retry)
      (8. Retry)
      (9. Retry)
      (10. Retry)
      (11. Retry)
      (12. Retry)
      (13. Retry)
      (14. Retry)
      (15. Retry)
      (16. Retry)
      (17. Retry)
      (18. Retry)
      (19. Retry)
      (20. Retry)
      Traceback (most recent call last):
      File "C:\Users\Chris\ps3\NORway.py", line 702, in <module>
      n.writerange(addr, data, False, True)
      File "C:\Users\Chris\ps3\NORway.py", line 512, in writerange
      self.program(addr/2, data[:0x20000], wordmode, ubm)
      File "C:\Users\Chris\ps3\NORway.py", line 444, in program
      raise NORError("Verification failed")
      __main__.NORError: Verification failed
      i think i have now to buy a NOR Flash... but i dont know if this is the right Flash:

      S29GL128P90TFIR20
      http://de.farnell.com/jsp/search/pro...sp?sku=1791253
      http://de.mouser.com/search/ProductD...252bXofg%3D%3D

      on my Spansion NOR Flash is S29GL128P90TFIR2 inside ... without the "0" "zero" at the end. Is it the same? or a another NOR?

    458. Dudshl
      11-03-2011
      12:56 PM
      458

      Originally Posted by cvp
      its retry 20 times with writeword/writewordubm and write command.
      Once have write on the 3. Retry, but it haves not working... now i try manytimes... and nothing... it cant be write (Beta 03/04)
      Make erasechip then dump. Is it clear?
      If it clean - try write in 5V mode.
      Try v04b10.

      I soldered switch 3.3v/5v and now I need not disconnect teensy.

    459. jeerum
      11-03-2011
      01:21 PM
      459

      check nor pins, maybe need only little soldering.

    460. cvp
      11-03-2011
      05:08 PM
      460

      Ok i think i have finde out the trick with my PS3... my ps3 is ok... but it suck my head

      I have to wait a few seconds ... like one minit, than i can write my NOR.... i dont know why... but befor i write, i have erase my chip.... becaus if i dont do that, he cant write my NOR... he write very fast like 3 minits, and i know its wrong... but if i erase is, than he write correctly...

      my, i think, very last problem is the Dual Boot. If my 3.55 is running corrctly, i dump the NOR, after than i put the HDD A (like OFW HDD) and Update to 3.72... it works! Than i dump them... now, if i write the 3.55 fw back and put the HDD B like CFW... the ps3 want boot, green/red light goes down. How i have to handling ?

      we go from here, I have two dumps... like CFW 3.55 and OFW 3.72 or higher.
      Now is running 3.72 and want now 3.55, how i do that? i try so:

      01) Power Cable + USB Cable from Teensy isnt connected => HDD A (OFW) is inside!
      02) Connect Teensy and than i connect Power Cable
      03) CMD => Norway.py COMxx
      04) i start the PS3 and wait my special minit trick :D
      05) norway.py comxx erasechip ... after three minits....
      06) norway.py comxx write swap 355 dump ... than
      07) i plug the power cable + teensy cable out
      08) chance the hdd A to hdd B
      09) Connect Power Cable and start PS3

      or i have to do after erasechip and write swap 355 dump the
      => norway.py comxx release and than i plug all out ?

      the and the another think what i have... i read sometimes that ros0 ros1 is needet, is that right?

      my downgrad.bin dosnt have ros1, ros2... only PRG0 and PRG1, both with 3.55
      I check my swap 3.55 cfw (i dump than after service mode) it haves the same!!! Maybe this is why my ps3 is brick if i want usw 3.55???

      My swap 3.72 dump have ros1: 3.72 and ros0 is unknown.

      have i to do after the downgrade and Service Mode (CFW Intallation under service mode) a second or threed Update with CFW 3.55 ? will it than work if i dump after the second/threed update if my dump have ros1/ros0:: 3.55 ?

    461. Hikage
      11-03-2011
      06:04 PM
      461

      Originally Posted by cvp
      Ok i think i have finde out the trick with my PS3... my ps3 is ok... but it suck my head

      I have to wait a few seconds ... like one minit, than i can write my NOR.... i dont know why... but befor i write, i have erase my chip.... becaus if i dont do that, he cant write my NOR... he write very fast like 3 minits, and i know its wrong... but if i erase is, than he write correctly...

      my, i think, very last problem is the Dual Boot. If my 3.55 is running corrctly, i dump the NOR, after than i put the HDD A (like OFW HDD) and Update to 3.72... it works! Than i dump them... now, if i write the 3.55 fw back and put the HDD B like CFW... the ps3 want boot, green/red light goes down. How i have to handling ?

      we go from here, I have two dumps... like CFW 3.55 and OFW 3.72 or higher.
      Now is running 3.72 and want now 3.55, how i do that? i try so:

      01) Power Cable + USB Cable from Teensy isnt connected => HDD A (OFW) is inside!
      02) Connect Teensy and than i connect Power Cable
      03) CMD => Norway.py COMxx
      04) i start the PS3 and wait my special minit trick :D
      05) norway.py comxx erasechip ... after three minits....
      06) norway.py comxx write swap 355 dump ... than
      07) i plug the power cable + teensy cable out
      08) chance the hdd A to hdd B
      09) Connect Power Cable and start PS3

      or i have to do after erasechip and write swap 355 dump the
      => norway.py comxx release and than i plug all out ?

      the and the another think what i have... i read sometimes that ros0 ros1 is needet, is that right?

      my downgrad.bin dosnt have ros1, ros2... only PRG0 and PRG1, both with 3.55
      I check my swap 3.55 cfw (i dump than after service mode) it haves the same!!! Maybe this is why my ps3 is brick if i want usw 3.55???

      My swap 3.72 dump have ros1: 3.72 and ros0 is unknown.

      have i to do after the downgrade and Service Mode (CFW Intallation under service mode) a second or threed Update with CFW 3.55 ? will it than work if i dump after the second/threed update if my dump have ros1/ros0:: 3.55 ?
      i have the same problem on my ps3 when i'm on 3.72 i can fast swap with the swap dump 3.55 on it without erasechip but when i'm on 3.55 and want to go on 3.72, if i dont erasechip before i cant use my swap dump 3.72

    462. Dudshl
      11-03-2011
      11:50 PM
      462

      There is instruction how to swap CFW/OFW
      1. Install latest OFW on PS3 with "OFW-HDD".
      2. Dump PS3`s NOR and call it OFW.bin (put it in safe place and do not modify it).
      3. Change HDD to "CFW-HDD" and downgrade console to 3.55 (use dospiedros_v2 patches, erasechihp, write patched firmware, get PS3 in service mode with dongle,flash 3.55no_check firmware, update firmware with rogero_v2).
      4. When downgrade fully finished and when You have working PS3 with playable 3.55 firmware - dump PS3`s NOR and call it CFW.bin.


      If You want OFW - erase chip, write OFW.bin and put "OFW-HDD" into console. PS3 boots with OFW.
      If You want CFW - erase chip, write CFW.bin and put "CFW-HDD" into console. PS3 boots with CFW.

    463. bahaa_monier
      11-04-2011
      08:37 PM
      463

      Guys , i have problem reading another Fat one,
      it's
      NOR chip manufacturer: Samsung (0xec)
      NOR chip type: K8Q2815UQB (0x7e0601)
      every time i read not identical with another dump .
      all different
      all
      tried to rewire 3 time , all same .
      what can i do ?

    464. Hikage
      11-04-2011
      08:46 PM
      464

      i follow the tutorial on ps3devwiki, the same found on ps3hax and dont read erasechip before write

      NOW IT�S FINISHED! You should have �swap dump 3.55.bin� and �swap dump 3.70.bin� � Now you just have to swap HDD and flash the correspondening dump:

      HDD A = swap dump 3.70.bin
      HDD B = swap dump 3.55.bin
      source:
      http://www.ps3devwiki.com/index.php?...d_2_harddrives
      http://www.ps3hax.net/2011/08/tutori...ofw-progskeet/

    465. judges
      11-05-2011
      04:49 AM
      465

      Originally Posted by cvp
      I have to wait a few seconds ... like one minit, than i can write my NOR.... i dont know why... but befor i write, i have erase my chip.... becaus if i dont do that, he cant write my NOR... he write very fast like 3 minits, and i know its wrong... but if i erase is, than he write correctly...
      The "write" command is doing a differential write. It means that only those sectors are erased and written that are different from the actual NOR content. So 3 mins might be okay depending on your NOR content and the dump you're writing. No "erasechip" is required here.

    466. bahaa_monier
      11-05-2011
      12:59 PM
      466

      Originally Posted by bahaa_monier
      Guys , i have problem reading another Fat one,
      it's
      NOR chip manufacturer: Samsung (0xec)
      NOR chip type: K8Q2815UQB (0x7e0601)
      every time i read not identical with another dump .
      all different
      all
      tried to rewire 3 time , all same .
      what can i do ?
      CAN HELP PLEASE ????

    467. Dudshl
      11-06-2011
      12:23 AM
      467

      Originally Posted by bahaa_monier
      CAN HELP PLEASE ????
      I got this chip twice. But I dumped it only in 5V mode. In 3.3V mode dumps always have different MD5.

    468. jeerum
      11-06-2011
      02:52 AM
      468

      Originally Posted by bahaa_monier
      CAN HELP PLEASE ????
      maybe you use bad wires?

    469. Berth4253
      11-09-2011
      01:31 AM
      469

      Thanks and great work. I was wondering when you were going to pop up with this. Going to give this a go.

    470. bahaa_monier
      11-09-2011
      03:09 AM
      470

      it's drive me to creazy !!!
      finally after dump - modify - erase - relase - writeword :
      my ps3 start in red screen of death , and can hear startup sound :D
      and if pressed on ps button long give me power off or off controller .
      if i used custom FW to downgrade give me system restore mode and want 3.56 or upper version :D

      really i will die trying to fix it . or be crazy :D
      can advise ???????????????

    471. Dudshl
      11-09-2011
      12:13 PM
      471

      Originally Posted by bahaa_monier
      it's drive me to creazy !!!
      finally after dump - modify - erase - relase - writeword :
      my ps3 start in red screen of death , and can hear startup sound :D
      and if pressed on ps button long give me power off or off controller .
      if i used custom FW to downgrade give me system restore mode and want 3.56 or upper version :D

      really i will die trying to fix it . or be crazy :D
      can advise ???????????????
      When it asks 3.56+ FW - update it to 3.72
      When You boot console with OFW 3.72 - just dump NOR and give me this dump. I will patch it and give it to You.

    472. butnut
      11-09-2011
      04:28 PM
      472

      Does anybody know where I can buy only the solderless clip for ps3 nor.

    473. Mistawes
      11-09-2011
      06:50 PM
      473

      [MENTION=193787]butnut[/MENTION] : The guys from Wii-clip are making one at the minute, there's info on their 360-clip site.

      Sep. 28th 2011 --- The new 360-Clip 56Pin version for the P3 NOR flash coming soon, will release in next month

    474. butnut
      11-09-2011
      07:25 PM
      474

      [MENTION=102388]Mistawes[/MENTION] : Hopefully they will release it soon.





      Edit: If the ps3's test point "A8" is not connected but all the rest are, would NORWAY still be able to detect chip manufacturer and type?

      Because right now I am pretty sure I have every thing connected properly except for "A8"

      And I am getting

      NOR chip manufacturer: unknown (0x00)
      NOR chip type: unknown (0x00fbfb)


      I have Samsung K8Q2815UQB flash and I am using NORway_04beta12

    475. bahaa_monier
      11-09-2011
      10:30 PM
      475

      Originally Posted by Dudshl
      When it asks 3.56+ FW - update it to 3.72
      When You boot console with OFW 3.72 - just dump NOR and give me this dump. I will patch it and give it to You.
      Thanks Dudshl for your help
      i updated to 3.73
      but after update it give me RED SCREEN OF DEATH but still hear error sound
      so ? :D
      ?

    476. Dudshl
      11-09-2011
      11:42 PM
      476

      Originally Posted by bahaa_monier
      Thanks Dudshl for your help
      i updated to 3.73
      but after update it give me RED SCREEN OF DEATH but still hear error sound
      so ? :D
      ?
      http://fixps3redscreenofdeath.com/wp...-Death-PS3.jpg

      Do You see this "RED SCREEN"?

    477. bahaa_monier
      11-10-2011
      02:28 AM
      477

      Originally Posted by Dudshl
      YESSSSSSSSSSSSS
      it make me crazy
      i tried to flash every thing ( from OFW 3.10 to 3.73 and All CFW )
      but i see it
      and hear the start up sound and clicks .
      when press PS button , see the gray screen .

    478. zaeReiroh2
      11-10-2011
      03:40 AM
      478

      That is great work. Looking forward to the tutorial. Maybe those teensy boards people were using to jailbreak with are not useless after all

    479. judges
      11-10-2011
      04:26 AM
      479

      Originally Posted by butnut
      Edit: If the ps3's test point "A8" is not connected but all the rest are, would NORWAY still be able to detect chip manufacturer and type?

      Because right now I am pretty sure I have every thing connected properly except for "A8"

      And I am getting

      NOR chip manufacturer: unknown (0x00)
      NOR chip type: unknown (0x00fbfb)

      I have Samsung K8Q2815UQB flash and I am using NORway_04beta12
      Yes, A8 is definitely required..

    480. Dudshl
      11-10-2011
      12:29 PM
      480

      Originally Posted by bahaa_monier
      YESSSSSSSSSSSSS
      it make me crazy
      i tried to flash every thing ( from OFW 3.10 to 3.73 and All CFW )
      but i see it
      and hear the start up sound and clicks .
      when press PS button , see the gray screen .
      You flash flash patched with dowsiedras_v2 dump into Your NOR and when You turn on console after flashing it asks press PS button?
      Then You turn off console and get in into service mode. (Does it turns off when You press power/eject or You turn it off manually?)
      When console in factory/service mode - You put USB flash drive with PS3UPDATE.PUP (with check-off patch) and Lv2Diag-patch-par-Jaicrab in root folder to right usb-port and turn console on. (Does it turns off when update finished? Or green led blinks forever and You turns console off manually?)
      After "check-off" 3.55 firmware installed and You turns console on again - do You see XMB with red field in bottom right corner (factory/service mode)

      When do You see RSOD?

    481. bahaa_monier
      11-10-2011
      02:41 PM
      481

      Originally Posted by Dudshl
      You flash flash patched with dowsiedras_v2 dump into Your NOR and when You turn on console after flashing it asks press PS button?
      Then You turn off console and get in into service mode. (Does it turns off when You press power/eject or You turn it off manually?)
      When console in factory/service mode - You put USB flash drive with PS3UPDATE.PUP (with check-off patch) and Lv2Diag-patch-par-Jaicrab in root folder to right usb-port and turn console on. (Does it turns off when update finished? Or green led blinks forever and You turns console off manually?)
      After "check-off" 3.55 firmware installed and You turns console on again - do You see XMB with red field in bottom right corner (factory/service mode)

      When do You see RSOD?
      Will record what happening to you.
      iam using 3.55 rogero cfw v2 .
      is it correct ?
      or must use another custom ???????
      where can download files , all links removed for some reasons .

    482. bahaa_monier
      11-12-2011
      06:41 PM
      482

      Originally Posted by bahaa_monier
      Will record what happening to you.
      iam using 3.55 rogero cfw v2 .
      is it correct ?
      or must use another custom ???????
      where can download files , all links removed for some reasons .
      My crazy video :D
      http://youtu.be/8ddM7KfEEEo

    483. Dudshl
      11-12-2011
      10:52 PM
      483

      Originally Posted by bahaa_monier
      Will record what happening to you.
      If You answer all my question in my last post - we will be closer to problem`s resolve!

    484. nzie
      11-12-2011
      11:00 PM
      484

      Originally Posted by bahaa_monier
      My crazy video :D
      http://youtu.be/8ddM7KfEEEo
      RSOD

    485. bahaa_monier
      11-13-2011
      08:02 AM
      485

      Originally Posted by Dudshl
      You flash flash patched with dowsiedras_v2 dump into Your NOR and when You turn on console after flashing it asks press PS button?
      Then You turn off console and get in into service mode. (Does it turns off when You press power/eject or You turn it off manually?)
      When console in factory/service mode - You put USB flash drive with PS3UPDATE.PUP (with check-off patch) and Lv2Diag-patch-par-Jaicrab in root folder to right usb-port and turn console on. (Does it turns off when update finished? Or green led blinks forever and You turns console off manually?)
      After "check-off" 3.55 firmware installed and You turns console on again - do You see XMB with red field in bottom right corner (factory/service mode)

      When do You see RSOD?
      - Yes i flash my PS3 by dowsiedas_v2 , but it's RSOD so it's still red . so it's not change to press ps button because i can't see it .
      - after flash i use Kemaw or Rogero v2 with Lv2Diag-patch-par-Jaicrab and after finish it turn off normally , ( if used any other FW green flash forever )
      - after turning it on i hear start up sound with RSOD screen , Thant's it .

    486. CrackMyDay
      11-16-2011
      12:51 AM
      486

      I've found the way to dump/erase/write Samsung QB memory's without problems. Tested on FAT and SLIM consoles with this kind of memories. Zero problem since then(a week ago).

      I may do a tutorial when i have some time...

    487. CrackMyDay
      11-16-2011
      09:34 AM
      487

      Hardware modifications to remove Samsung's QB memory problems whith Teensy++:


      We will "steal" 3.3V from the PS3, so the entire wiring is the same as usual except for supply and regulator part:

      To prepare the supply part, do exactly the same as the guide to convert to 3.3V, except that DO NOT PUT THE REGULATOR. If you already have the 3.3V modification, just remove the regulator.Guide to 3.3v conversion: http://www.pjrc.com/teensy/3volt.html
      Additionaly, a wire must be soldered to get 3.3V for Teensy++ from PS3.
      Please refeer to the following picture to see instructions:



      ALL 5V PINS OR PADS IN Teensy++ MUST REMAIN UNCONNECTED.

      Now, what we just did was modificate the Teensy++ to work with 3.3V, but instread of using the regulator to get the supply, we just soldered a wire that we will solder to NOR's 3.3V pad in PS3.So, wire up your Teensy++ to your Nor PS3 memory as usual. Remember to solder the wire we left hanging in Teensy++ to NOR 3.3V pad in PS3 motherboard.

      NOW, Read slowly:

      Process actions to remove Samsung's QB memory problems whith Teensy++:


      1)We will identificate the memory, if the memory is a Samsung QB we will use a method and if not we will use a different one.

      Identifying the memory model:

      Initial conditions:
      * PS3 turned OFF;
      * USB cable(Teensy++ <--> PC) unplugged;

      Turn on PS3 and wait 20 seconds. Ensure that PS3 do not turn off. If it turns off, turn it on again until it stays working properly.
      Now, plug USB cable(Teensy++ <--> PC) and dump as usual. Read memory model and see if its a Samsung QB, and:

      2)a) if memory ISNT a Samsung QB model, just continue dumping/erasing/writing as usual. The important part is that PS3 must be always turned ON during the hole process.
      You're done.

      b)if memory IS a Samsung QB model, press and hold PS3 power button until it turns OFF. Unplug PS3 power cord. DO NOT REMOVE USB CABLE. If you removed it you will loose Teensy++ supply(and USB connection) so go to 1) and try again.
      The important part is that even with PS3 turned OFF Teensy++ will still get power, same as NOR memory.

      WARNING: dumped file in 1) was only to identify the memory, discard it because it cant be trusted.

      Now, just continue dumping/erasing/writing as usual. The important part is that PS3 must be always turned OFF during the hole process.
      You're done.

    488. butnut
      11-16-2011
      07:02 PM
      488

      What version of NORWAY are you using?

      I thought NORWAY only works with teensy++ 2.0.

    489. CrackMyDay
      11-16-2011
      07:26 PM
      489

      It does. Its the same procedure for both Teensy and Teensy++ if youre refeering to the regulator modification.

    490. butnut
      11-16-2011
      08:42 PM
      490

      Originally Posted by CrackMyDay
      It does. Its the same procedure for both Teensy and Teensy++ if youre refeering to the regulator modification.
      Okay.

      I have been trying NORway_04beta12 Is that the version of NORway you are using?

    491. CrackMyDay
      11-16-2011
      09:04 PM
      491

      Yes. The last one.

    492. Melva8623
      11-16-2011
      10:17 PM
      492

      Thanks and great work. I was wondering when you were going to pop up with this. Going to give this a go.

    493. afiser13
      11-18-2011
      12:49 AM
      493

      hello, huge noob when it comes to the methods of this program. anyways

      i read you need to turn the ps3 on. my main reason for wanting to wire a teensy up is to unbrick my ps3 (bad ps3mfw apparently, all per console stuff should be intact and recoverable). my ps3 only powers on for like 4 seconds and shuts off, will this work for my situation? if so how? thanks.

      also i've read the 3.3v regulator gets really hot, is this still the case?

    494. Hikage
      11-18-2011
      08:21 AM
      494

      If you put your USB cable and power your ps3 the firmware is not loaded and you can recover it.
      If you have previously backup your nand/nor if you haven't , I don't no how teensy can help you.

      Sent from my Nexus S using Tapatalk

    495. afiser13
      11-18-2011
      04:58 PM
      495

      Originally Posted by Hikage
      If you put your USB cable and power your ps3 the firmware is not loaded and you can recover it.
      If you have previously backup your nand/nor if you haven't , I don't no how teensy can help you.

      Sent from my Nexus S using Tapatalk
      You're first sentence made me think it would work, then your next sentence really threw me off.

      I dont currently have a backup. the teensy wont power the ps3's nor?

    496. CrackMyDay
      11-19-2011
      08:31 AM
      496

      Using my method, without 3.3V regulator, NOR will only be powered by PC if memory is a Samsung QB.
      If its other model of memory, dump wont be correct if still trying to use the procedure for Samsung QB(with PS3 "turned OFF"). I didnt test if the fault is because theres no 3.3V in NOR or there are some other thing not powered up(circuits pretty different). Thats why there are two different procedures depending on memory model in my tutorial.

      You could still try to supply power with a 3.3V regulator in Teensy. If you touch a IC(i dont remember the name) near NOR you will see it turns really hot, so regulator supply power for more than just NOR, increasing the current needed and so, the dissipated heat on the regulator.
      ************* [ - Post Merged - ] *************

      Originally Posted by Hikage
      If you put your USB cable and power your ps3 the firmware is not loaded and you can recover it.
      If you have previously backup your nand/nor if you haven't , I don't no how teensy can help you.

      Sent from my Nexus S using Tapatalk
      Offtopic, i saw your NORway GUI, did u make it? Nice work!

    497. afiser13
      11-19-2011
      06:43 PM
      497

      Originally Posted by CrackMyDay
      Using my method, without 3.3V regulator, NOR will only be powered by PC if memory is a Samsung QB.
      If its other model of memory, dump wont be correct if still trying to use the procedure for Samsung QB(with PS3 "turned OFF"). I didnt test if the fault is because theres no 3.3V in NOR or there are some other thing not powered up(circuits pretty different). Thats why there are two different procedures depending on memory model in my tutorial.

      You could still try to supply power with a 3.3V regulator in Teensy. If you touch a IC(i dont remember the name) near NOR you will see it turns really hot, so regulator supply power for more than just NOR, increasing the current needed and so, the dissipated heat on the regulator.
      ************* [ - Post Merged - ] *************


      Offtopic, i saw your NORway GUI, did u make it? Nice work!
      would you consider it to be safe for the 45 second dump time (will do multiple dumps to compare of course), turn it off, do patches to the image to make the console boot, then turn it on again with the ~8 minutes write time? then after that just take the regulator off as i wouldn't need it anymore and just do any subsequent reading and writing whilst the ps3 is on?

      has anyone unbricked with a teensy? and by unbricked, i mean your console boots to a blank screen and turns off after ~5 seconds.

    498. judges
      11-20-2011
      03:23 AM
      498

      Originally Posted by afiser13
      would you consider it to be safe for the 45 second dump time (will do multiple dumps to compare of course), turn it off, do patches to the image to make the console boot, then turn it on again with the ~8 minutes write time? then after that just take the regulator off as i wouldn't need it anymore and just do any subsequent reading and writing whilst the ps3 is on?

      has anyone unbricked with a teensy? and by unbricked, i mean your console boots to a blank screen and turns off after ~5 seconds.
      That's exactly what the tristate line is good for. Simply connect Teensy as described in NORway's readme. Your console will "hang" after you turn it on and won't turn off automatically. If you then have troubles dumping/writing or a Samsung QB you might want to consider CrackMyDay's approach.

    499. afiser13
      11-20-2011
      05:25 AM
      499

      Originally Posted by judges
      That's exactly what the tristate line is good for. Simply connect Teensy as described in NORway's readme. Your console will "hang" after you turn it on and won't turn off automatically. If you then have troubles dumping/writing or a Samsung QB you might want to consider CrackMyDay's approach.
      OHHH okay, i didn't realize the tristate made the console hang.

      i feel stupid..

      I have a spansion (just checked) so i should be alright.

      okay, thanks for the clarification. and thank you for developing this great program! hopefully it will save my ps3 once i get my teensy!

      EDIT: one little thing

      when you say "- Power off your PS3 (disconnect Teensy if PS3 doesn't boot when restarted)"

      do you mean desolder the teensy from the ps3 or just disconnect the usb? im really hoping its the latter. lol

    500. judges
      11-20-2011
      06:59 AM
      500

      Originally Posted by afiser13
      when you say "- Power off your PS3 (disconnect Teensy if PS3 doesn't boot when restarted)"

      do you mean desolder the teensy from the ps3 or just disconnect the usb? im really hoping its the latter. lol
      It is the latter..

    501. dandza
      11-21-2011
      09:06 AM
      501

      Hello everyone, long time no see

      Teensy has some problems with this combination of mobo/ic

      JSD-001 and Samsung K8P2716UZC-QI4D (its the one that uses 128/128 settings)

      Problem is when reading dump you get bad reading on random sectors every time.
      Only with 5V mod it dumps good (every dump is same and correct), but then the problem is writing. It doesnt work either with 3V and 5V.
      with 3V i got verify error at sector 0 and with 5V i think it was sector 3 or maybe 2 that gave me that same error...

      The same problem is with other members, you can check it here http://www.ps3hax.net/showthread.php?t=30084

      PS Progskeet has the same problem, i tested that also...

      judges pm me when you have some time...

    502. judges
      11-22-2011
      12:01 PM
      502

      Originally Posted by dandza
      Hello everyone, long time no see

      Teensy has some problems with this combination of mobo/ic

      JSD-001 and Samsung K8P2716UZC-QI4D (its the one that uses 128/128 settings)

      Problem is when reading dump you get bad reading on random sectors every time.
      Only with 5V mod it dumps good (every dump is same and correct), but then the problem is writing. It doesnt work either with 3V and 5V.
      with 3V i got verify error at sector 0 and with 5V i think it was sector 3 or maybe 2 that gave me that same error...

      The same problem is with other members, you can check it here http://www.ps3hax.net/showthread.php?t=30084

      PS Progskeet has the same problem, i tested that also...

      judges pm me when you have some time...
      What NORway version did you use? Beta 12? Did you try all three writing modes? I've one user confirming beta 5 did work for him using that exact mobo/nor combo (beta5: http://www.multiupload.com/7MBKHLQ5MC).

      And you can pm me anytime..

    503. underdik
      11-26-2011
      01:56 PM
      503

      Halo all! I have 250B with Spansion NOR.
      Using Norway beta 12
      I dump&patch using Downgrade V2 method, but after when i write NOR to PS3 it stops at sector "0". After that Ps3 can't boot and "power off" after 2 sec.
      I flash my teensy with norway 0.3 from here https://github.com/hjudges/NORway and swith it to 5V and flash again without any errors (5V!)
      My console stays not bootable, but she dont power off and hasn't video signal
      Here is my original downgrade http://dl.dropbox.com/u/2885438/250B_orig.bin, and here is my patched http://dl.dropbox.com/u/2885438/250B_patched.bin.

      Anyone cat tell me what i doing wrong? Why my console dos'n boot?

      P.S.: Now Teensy not detecting at 3.3V

      [SPOILER]D:\MI\ps3_downgrade\NORway_beta12>NORway.py com11 write 250B_patched.bin
      NORway.py v0.4 beta - Teensy++ 2.0 NOR flasher for PS3 ([email protected])
      (Orignal noralizer.py by Hector Martin "marcan" <hector[MENTION=60324]marcan[/MENTION]soft.com>)

      Pinging...
      Set SB to tristate

      NOR chip manufacturer: Spansion (0x01)
      NOR chip type: S29GL128 (0x7e2101)

      Checking sector protection...
      No protected sectors found!

      STATUS_TRIST_N: True
      STATUS_RESET_N: True
      STATUS_READY: True
      STATUS_CE_N: False
      STATUS_WE_N: True
      STATUS_OE_N: True

      Resetting NOR...
      Ready.

      Writing...
      16384 KB / 16384 KB
      Done. [0:07:19.440000]

      D:\MI\ps3_downgrade\NORway_beta12>NORway.py com11 release
      NORway.py v0.4 beta - Teensy++ 2.0 NOR flasher for PS3 ([email protected])
      (Orignal noralizer.py by Hector Martin "marcan" <hector[MENTION=60324]marcan[/MENTION]soft.com>)

      Pinging...
      Set SB to tristate

      NOR chip manufacturer: Spansion (0x01)
      NOR chip type: S29GL128 (0x7e2101)

      Checking sector protection...
      No protected sectors found!

      STATUS_TRIST_N: True
      STATUS_RESET_N: True
      STATUS_READY: True
      STATUS_CE_N: False
      STATUS_WE_N: True
      STATUS_OE_N: True

      Resetting NOR...
      Ready.

      NOR Released[/SPOILER]

    504. Dudshl
      11-26-2011
      07:14 PM
      504

      If teensy not detected at 3.3V - check regulator soldering.

      When teensy alive - make erasechip, then try write with command writewordubm (do it on 3.3V with beta12)

    505. underdik
      11-27-2011
      05:28 AM
      505

      Originally Posted by Dudshl
      If teensy not detected at 3.3V - check regulator soldering.

      When teensy alive - make erasechip, then try write with command writewordubm (do it on 3.3V with beta12)
      Thanx! I'm checked: flash & read my NOR, then compare it and its same...
      Teensy still not detected at 3.3V

      Dudshl can you check my dump?
      P.s.: I flash my "backup.bin" and nothing.. WTF?

    506. Dudshl
      11-27-2011
      06:17 AM
      506

      Originally Posted by underdik
      Thanx! I'm checked: flash & read my NOR, then compare it and its same...
      Teensy still not detected at 3.3V

      Dudshl can you check my dump?
      P.s.: I flash my "backup.bin" and nothing.. WTF?
      It looks like Your orig_nor_dump has errors. May be shorts or bad contacts. Test Your solder it with multimeter

    507. underdik
      11-28-2011
      07:59 AM
      507

      Originally Posted by Dudshl
      It looks like Your orig_nor_dump has errors. May be shorts or bad contacts. Test Your solder it with multimeter
      Contacts are normal..
      Brick? No way to restore?

    508. bahaa_monier
      11-28-2011
      01:20 PM
      508

      i have 2 PS3s with same problem , ( NO ORIGINAL DUMB )
      but i found in E3 Flasher website , there is way to fix it , but didn't try it .
      can some one confirm ?
      http://www.e3-tech.net/

    509. underdik
      11-28-2011
      02:16 PM
      509

      Originally Posted by bahaa_monier
      i have 2 PS3s with same problem , ( NO ORIGINAL DUMB )
      but i found in E3 Flasher website , there is way to fix it , but didn't try it .
      can some one confirm ?
      http://www.e3-tech.net/
      I'll test it tomorrow! Thx.

    510. CrackMyDay
      11-29-2011
      01:31 AM
      510

      I think that method is only if console is bricked BUT assumes you have a good original DUMP.

      If you do not have a GOOD original dump then, for now, you have a nice heavy brick.

      Cheers.

    511. afiser13
      11-29-2011
      09:20 AM
      511

      as long as the per_console stuff (bootldr, metldr, csid, eid, etc) is in tact and not messed with (no updaters touch this information btw) it is very much possible to recover the brick without an original dump

    512. Hikage
      11-29-2011
      06:57 PM
      512

      Originally Posted by CrackMyDay
      Offtopic, i saw your NORway GUI, did u make it? Nice work!
      Offtopic, yep it's My own Work.

      But I have only the gui(writed with wxwidget for interoperability).

      Menu, about and quit working, no norway function for the moment ( no time to work on it).

      But my Norway batch worked with read, optional erase before write, read and write via 3 predefined file and named file of your choice, port com changer via batch or config file, support French and English language peapce more in future and if I have time, I release soon the batch and an bash version(I work on it).

      Ps: sorry for the big offtopic ^^

      Sent from my customized Nexus S running ice and fire

    513. underdik
      11-30-2011
      04:37 AM
      513

      Originally Posted by afiser13
      as long as the per_console stuff (bootldr, metldr, csid, eid, etc) is in tact and not messed with (no updaters touch this information btw) it is very much possible to recover the brick without an original dump
      I visited this link: http://ps3devwiki.com/index.php?title=Flash

      My dump is vary similar with those descriptions of flash. Metldr is same.. as
      http://ps3devwiki.com/index.php?titl...tecode_fw_3.66

      Dudshl Why did you say my dump has errors?

    514. bahaa_monier
      11-30-2011
      07:38 AM
      514

      Originally Posted by underdik
      I'll test it tomorrow! Thx.
      waiting your answer .
      i have two consoles fully bricked .

    515. underdik
      11-30-2011
      09:07 AM
      515

      Originally Posted by bahaa_monier
      waiting your answer .
      i have two consoles fully bricked .
      Read carefuly CrackMyDay. No sense if dump incorect!

      Post your bricked dumps here.

    516. Dudshl
      11-30-2011
      12:29 PM
      516

      Originally Posted by underdik

      Dudshl Why did you say my dump has errors?
      1. If You flash dump and console does not boot - dump is broken
      2. I opened Your orig_dump and 3 different dumps with hex-editor: You dump has some data offsets F7C0,F7D0,FBC0,FBD0,FDC0,FDD0... but my dumps do not have any data in this offsets. I think it is "noise". => if this part of dump has "noise" - any other part of dump may be noised too (such as metldr,bootldr,etc...)

    517. hopeididnotkillit
      12-03-2011
      12:51 PM
      517

      ok so i was following a tut on using the teensy since I'm new to all this and I have tried emailing judges about my issues but got no reply so i started an account here since he seems to be active here..

      my issue is that dumping seems to go great but flashing fails ..and the tut i was following only had you matching the dump size.. well after a lot more reading when the issue of my ps3 not booting anymore came about i noticed that i should have been checking my md5 check sums to compare my dumps.. very stupid mistake i made and i very well might have killed this ps3 by not getting a good dump at all since none of the dumps have the same md5.

      i have opened the dump in a hex editor and i see a lot of 00ff but i do see some forms of stuff like csid,metldr etc etc... im just hoping to get the ps3 back working as im really frustrated and just want to get it back like it was for now.

      my question is if the dumps i have are corrupted "i made 5 at the start"
      is there a way to patch that info in to a good dump just to get back the recovery menu and get back to a functioning ps3 because not even my recovery menu will come up.. I'm planing on getting a e3 flasher just cause all this soldering is ridiculous when there are clips out there.

      can someone look at my dump or a few of them and see if the really important stuff is there since i have no clue? sorry for the book guys but i figured better give them the gist of it. oh and just let me know if you would like me to email or post them somewhere.

    518. afiser13
      12-03-2011
      11:00 PM
      518

      anyone have any tips on wire management? i'm going to be getting mine in a few weeks, would like to have an idea about how to route these wires and make it look nice

    519. sege5641
      12-05-2011
      08:41 AM
      519

      Where do we stand on this project? Can someone update the steps of the process?

    520. judges
      12-06-2011
      12:44 PM
      520

      Originally Posted by hopeididnotkillit
      ok so i was following a tut on using the teensy since I'm new to all this and I have tried emailing judges about my issues but got no reply so i started an account here since he seems to be active here..
      Sorry for the late answer, but I've been on a business trip..

      Originally Posted by hopeididnotkillit
      well after a lot more reading when the issue of my ps3 not booting anymore came about i noticed that i should have been checking my md5 check sums to compare my dumps..
      The first thing you should have read is the "README.txt" from the NORway archive. If I may quote:

      "IMPORTANT:
      Before you flash your PS3 with anything new, make sure that the content of your dump is correct (use the supplied tool "norpatch.exe", it's able to recognize any OFW core os). And keep your original dump in a safe place. You might need it."

      Originally Posted by hopeididnotkillit
      my question is if the dumps i have are corrupted "i made 5 at the start"
      is there a way to patch that info in to a good dump just to get back the recovery menu and get back to a functioning ps3 because not even my recovery menu will come up.. I'm planing on getting a e3 flasher just cause all this soldering is ridiculous when there are clips out there.
      Unfortunately it's very unlikely that you can restore a working dump from five corrupted ones. How would you differentiate between "good" and "bad" bytes? I don't see any chance here, sorry.

      And an E3 flasher can't help you there either..

    521. hopeididnotkillit
      12-06-2011
      08:07 PM
      521

      Unfortunately it's very unlikely that you can restore a working dump from five corrupted ones. How would you differentiate between "good" and "bad" bytes? I don't see any chance here, sorry.

      And an E3 flasher can't help you there either..

      Read more: http://www.ps3hax.net/showthread.php...#ixzz1fo2udD77
      that's understandable but as I stated earlier in that post.. from what I can tell and from reading bits here and there.. as long as the console specific stuff is there it's at least possible to get it back booting up.. would you be willing to have a look at one of my dumps and see if it really is there.. and how would one go about patching that into a say "virgin 3.73" dump.. I don't care if I have to go through a million steps to get it back working as long as I do .. how can I contact you more directly [MENTION=193105]judges[/MENTION]? so this whole file transfer stuff can go down do you have a dropbox?

    522. hopeididnotkillit
      12-06-2011
      08:25 PM
      522

      can someone post a known good dump from 3.72 so i can have a look at the hex to see where mine differentiates from a good dump? and does anyone else know the exact offsets where the mandatory console specific data is stored? maybe i can try my hand at patching in what needed to get my console at least showing some form of life..
      ************* [ - Post Merged - ] *************
      and [MENTION=193105]judges[/MENTION] I actually did run my dump through your norpatch and it said


      "norpatch.exe v3.72 - Verify/Patch PS3 NOR flash dumps [(c) [email protected]]
      PRG0 version is 3.55
      PRG1 version is 3.50
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is unknown
      ROS1 version is unknown"

      but being new to all this I seen it recognized 3.72 and some older stuff and assumed since my dump size came out right and that the norpatch seen something I should have been ok.. like I said I did a lot more reading after that and became a lot more informed on stuff.. still no expert by any stretch of the imagination and I'm really hoping someone else with more knowledge and experience at this can help me.

    523. judges
      12-09-2011
      01:11 PM
      523

      Originally Posted by hopeididnotkillit
      would you be willing to have a look at one of my dumps and see if it really is there.. how can I contact you more directly @judges? so this whole file transfer stuff can go down do you have a dropbox?
      I can have a look at them, but as I said, it's very unlikely that it's fixable. Just upload them to some file hoster and send me the links either here by pm or by email.

      Originally Posted by hopeididnotkillit
      and @judges I actually did run my dump through your norpatch and it said

      "norpatch.exe v3.72 - Verify/Patch PS3 NOR flash dumps [(c) [email protected]]
      PRG0 version is 3.55
      PRG1 version is 3.50
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is unknown
      ROS1 version is unknown"

      but being new to all this I seen it recognized 3.72 and some older stuff and assumed since my dump size came out right and that the norpatch seen something I should have been ok..
      Unfortunately you totally misinterpreted norpatch's output. 3.72 is the version of norpatch.. It should have said e.g. "ROS0 version is 3.72" and "ROS1 version is 3.66".

    524. hopeididnotkillit
      12-09-2011
      08:02 PM
      524

      [MENTION=193105]judges[/MENTION] hopefully the really useful stuff is there I'm pretty sure the dumps are corrupted but I'm at the very least hoping that where the important data is that parts still intact do you or anyone else know the offset locations for the console specific data is? I would love to try and play around with it for future adventures.. below are my dumps and subsequent downgrade files ..crossing my fingers and hoping for a miracle to happen.


      http://www.megaupload.com/?d=XHEF6KRA
      http://www.megaupload.com/?d=9VKRZZ1F
      http://www.megaupload.com/?d=S7GUMNL3
      http://www.megaupload.com/?d=5N27EWG7
      http://www.megaupload.com/?d=9KMEP16W
      http://www.megaupload.com/?d=5QDMZXVO

    525. jhax78
      12-09-2011
      08:35 PM
      525

      Originally Posted by hopeididnotkillit
      [MENTION=193105]judges[/MENTION] hopefully the really useful stuff is there I'm pretty sure the dumps are corrupted but I'm at the very least hoping that where the important data is that parts still intact do you or anyone else know the offset locations for the console specific data is? I would love to try and play around with it for future adventures.. below are my dumps and subsequent downgrade files ..crossing my fingers and hoping for a miracle to happen.
      all offsets you want are on this page
      ps3dev wiki flash content

      could you try this patched bin please i patched it for downgrading for you
      http://www.mediafire.com/?fd4cdslavujrbc9

      if i did see it correct the files where patched wrong

      jhax

    526. hopeididnotkillit
      12-09-2011
      09:02 PM
      526

      Originally Posted by jhax78
      all offsets you want are on this page
      ps3dev wiki flash content

      could you try this patched bin please i patched it for downgrading for you
      http://www.mediafire.com/?fd4cdslavujrbc9

      if i did see it correct the files where patched wrong

      jhax
      I will try your bin as soon as i resolder the teensy to the board.. going to solder it on again to make doubly sure it was not a wiring issue last time.. dont think it was but who knows.. also going to make the wires as short as possible and try and insulate them from rf interference or anything else.. and then try flashing etc etc..

    527. jhax78
      12-09-2011
      09:07 PM
      527

      Originally Posted by hopeididnotkillit
      I will try your bin as soon as i resolder the teensy to the board.. going to solder it on again to make doubly sure it was not a wiring issue last time.. dont think it was but who knows.. also going to make the wires as short as possible and try and insulate them from rf interference or anything else.. and then try flashing etc etc..

      i checked your patched downgrade.bin against the bin i patched for you
      and they where diffrent
      i know my patches work to downgrade because i use them too
      maybe something went wrong while patching who know's

      let me know if it worked or not please

      jhax

    528. Richard536
      12-09-2011
      09:23 PM
      528

      Thanks and great work. I was wondering when you were going to pop up with this. Going to give this a go.

    529. hopeididnotkillit
      12-09-2011
      11:46 PM
      529

      Originally Posted by jhax78
      i checked your patched downgrade.bin against the bin i patched for you
      and they where diffrent
      i know my patches work to downgrade because i use them too
      maybe something went wrong while patching who know's

      let me know if it worked or not please

      jhax
      [MENTION=163476]jhax[/MENTION]
      sorry I may have worded that last reply wrong.. after my ps3 decided to not boot anymore I unsoldered my teensy from it.. I have not yet tried any new bin files but once I do get the teensy all soldered up I shall give the bin you patched for me a go.. sorry if I through you off I sometimes word things wrong. and thanks in advance for trying to help.. hopefully it brings some life back into a once wonderfully working console that I borked up.

    530. judges
      12-11-2011
      04:12 AM
      530

      Originally Posted by hopeididnotkillit
      @judges hopefully the really useful stuff is there I'm pretty sure the dumps are corrupted but I'm at the very least hoping that where the important data is that parts still intact do you or anyone else know the offset locations for the console specific data is? I would love to try and play around with it for future adventures.. below are my dumps and subsequent downgrade files ..crossing my fingers and hoping for a miracle to happen.
      As I said, very unlikely. There's nothing you could restore from these dumps.

    531. hopeididnotkillit
      12-11-2011
      11:02 AM
      531

      Originally Posted by judges
      As I said, very unlikely. There's nothing you could restore from these dumps.
      so it's permanently dead? there's no way to bring it back? even if it's long and drawn out... I wonder how sony does this in the factory.. I highly doubt they preprogram the flash chip. ahh who knows I'm reaching now.. this really sucks..

    532. afiser13
      12-11-2011
      12:42 PM
      532

      Originally Posted by hopeididnotkillit
      I highly doubt they preprogram the flash chip.
      thats what the testpoints we solder directly to are for

    533. hopeididnotkillit
      12-11-2011
      03:44 PM
      533

      Originally Posted by afiser13
      thats what the testpoints we solder directly to are for
      that is understood so the chips are all soldered on and then they flash the chip once the board has gone through it's soldering process.

      which begs the question do they have a way of getting this "console specific data" from the board before flashing? do they have this stuff recorded somewhere? is it generated while the flashing is occurring? etc etc... that's what I'm wondering.. you would think they would have a way of getting the console to boot back up if it occurred a hard brick like during a power outage when updating the firmware.. something along those lines.. and you would also think they would try and hide this data on the harddrive as a means of recovery if it indeed did brick on the customer during a power outage.

      im just throwing ideas im having out there. there has to be a way of getting it to boot again.. just going to take someone with lots more knowledge than me to figure it out.

    534. afiser13
      12-11-2011
      03:52 PM
      534

      my guess is IBM gives them the hardware key that they generated for the CELL (per_console_key_0)

      if we knew a way to get that key, we wouldn't be in the key fiasco we are in now.

      plus it's their console, im sure they have tools and such to get the key. we just haven't documented it yet (if ever).

      but really all of this is out of the scope of this thread.

    535. pudg
      12-22-2011
      12:29 AM
      535

      Hey guys,

      I seem to be having some problems. Im currently using norway 0.4 beta12. I have a ps3 with the Samsung K8Q2815UQB-PI4B nor. This unit is a rsod unit, but works after a couple of restarts. I currently finished soldering up my teensy and everything went well so far. I just made 5 dumps. All with the same md5 and size. Chip manufacture and type is unknown, only when I release, it shows up as proper info. Norpatch says unknown all the way around. So after dumping, I released and the ps3 will not boot. Disconnected tristate and loaded judges recomendation on teensy so it doesnt interfere. Ps3 still doesnt boot. I have NOT flashed anything to the ps3, just DUMPED it. How do I get it to boot properly, because it was working before norway took over.. lol I have inlcuded a copy of one of my dump files. Let me know if its good or bad. Im not sure.

      http://www.multiupload.com/4PQKLIF3MV

    536. jhax78
      12-22-2011
      01:22 AM
      536

      Originally Posted by pudg
      Hey guys,

      I seem to be having some problems. Im currently using norway 0.4 beta12. I have a ps3 with the Samsung K8Q2815UQB-PI4B nor. This unit is a rsod unit, but works after a couple of restarts. I currently finished soldering up my teensy and everything went well so far. I just made 5 dumps. All with the same md5 and size. Chip manufacture and type is unknown, only when I release, it shows up as proper info. Norpatch says unknown all the way around. So after dumping, I released and the ps3 will not boot. Disconnected tristate and loaded judges recomendation on teensy so it doesnt interfere. Ps3 still doesnt boot. I have NOT flashed anything to the ps3, just DUMPED it. How do I get it to boot properly, because it was working before norway took over.. lol I have inlcuded a copy of one of my dump files. Let me know if its good or bad. Im not sure.

      http://www.multiupload.com/4PQKLIF3MV
      md5 and filesize is not a way to verify a dump ever

      check this http://www.ps3hax.net/showthread.php?t=31833

    537. pudg
      12-22-2011
      09:50 AM
      537

      When I follow the guide you sent me, it is completed without errors but in the EXT folder it creates, I only have bootloader_0. No eid, metldr or anything else.. but it completes with no errors. When I check the HXD and compare with wiki, it looks fine but I dont know if the nor doesnt match in some area because the unit is a RSOD. Even if its a RSOD it should still have the console info, because it did work after a restart. My main problem is the ps3 wont release to boot again. I'd like to update to 3.72 so I can dump that flash also and compare.

    538. hopeididnotkillit
      12-24-2011
      09:16 AM
      538

      Originally Posted by pudg
      When I follow the guide you sent me, it is completed without errors but in the EXT folder it creates, I only have bootloader_0. No eid, metldr or anything else.. but it completes with no errors. When I check the HXD and compare with wiki, it looks fine but I dont know if the nor doesnt match in some area because the unit is a RSOD. Even if its a RSOD it should still have the console info, because it did work after a restart. My main problem is the ps3 wont release to boot again. I'd like to update to 3.72 so I can dump that flash also and compare.
      well given this.. it seems you may have a solder bridge or something else went very wrong.. if you did not initiate an erase command or a write command then for all intensive purposes nothing in the console was changed which leads to a user error or something else failed at a very inopportune time. once the trisate line is disconnected there is nothing the "console" needs to release.

      check for solder bridges very carefully . good luck.

    539. Dudshl
      12-24-2011
      12:27 PM
      539

      If I replace consoles NOR chip (any manufacturer, Samsung or Spansion) with S29GL128N90TFIR1 - will console works correctly? (I flash new chip with original dump before replace)
      Can Sony in future updates brick my console because of replaced chip?

    540. underdik
      12-29-2011
      01:14 PM
      540

      Hi
      I still have one ps3 slim 2508B bricked.
      I have orig_dump_2508B.bin and have others dump from others consoles (correct dumps)
      I'm extract both dumps with fl0wrebuilder in different folders.
      Who can to say me what files changes when i'm patching with standard method (dospedras v2) (ak ccsd, cisd, bootloader_0 etc..).

      P.s.: oh my bad English)
      ************* [ - Post Merged - ] *************

      Originally Posted by Dudshl
      Can Sony in future updates brick my console because of replaced chip?
      Another question: Can Sony unbrick our bricked consoles?

    541. saso
      12-31-2011
      07:13 AM
      541

      hi thank u judges fro u'r awesome work i just downgraded slim with Samsung chip

      Code:
      NORway.py v0.4 beta - Teensy++ 2.0 NOR flasher for PS3 ([email protected])
      (Orignal noralizer.py by Hector Martin "marcan" <hector[MENTION=60324]marcan[/MENTION]soft.com>)
      Pinging...
      Set SB to tristate
      NOR chip manufacturer: Samsung (0xec)
      NOR chip type: K8P2716UZC (0x7e6660)
      STATUS_TRIST_N: True
      STATUS_RESET_N: True
      STATUS_READY:   True
      STATUS_CE_N:    True
      STATUS_WE_N:    True
      STATUS_OE_N:    True
      Resetting NOR...
      Ready.
      Dumping NOR...
      16384 KB / 16384 KB
      Done. [0:01:13.861000]
      F:\4NOR>norpatch n6.bin
      norpatch.exe v3.72 - Verify/Patch PS3 NOR flash dumps [(c) [email protected]]
      PRG0 version is 3.55
      PRG1 version is unknown
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is 3.61
      ROS1 version is 3.55
      F:\4NOR>
      BTW: i used normal write command without erase the chip work %100

    542. jeerum
      01-02-2012
      02:59 PM
      542

      I'm back with my dia-002 MOBO
      What and can't get correct dumps.
      What must be result, if i remove any wires.
      I get

      NORway.py v0.4 beta - Teensy++ 2.0 NOR flasher for PS3 ([email protected])
      (Orignal noralizer.py by Hector Martin "marcan" <hector[MENTION=60324]marcan[/MENTION]soft.com>)

      Pinging...
      Set SB to tristate

      NOR chip manufacturer: unknown (0x90)
      NOR chip type: unknown (0x909090)

      STATUS_TRIST_N: True
      STATUS_RESET_N: True
      STATUS_READY: True
      STATUS_CE_N: False
      STATUS_WE_N: True
      STATUS_OE_N: True

      Resetting NOR...
      Ready.
      have used now v. o,3 and results are different, have resoldered, but no success, no regonizing chip but in v.03 i get more readable dump.

    543. zaf
      01-09-2012
      04:41 PM
      543

      Hello,
      After a long time dumping NORs, I have obtained recognizable dumps by norpatch. However, norpatch reads only the PRG0 and PRG1. The other variables are unknown. BTW, I am on OFW4.00.

      I am pretty sure that my circuit is fine since it is my 3rd time soldering it. I have got more than 10 dumps which are identical with exact same MD5 values.

      I am using Crackmyday's method of powering the teensy using the Vcc from the motherboard since I have the Samsung K8Q2815UQB chip. NORway v0.4beta12 can successfully read the chip model number while it is dumping.
      My dump is here http://dl.dropbox.com/u/21918357/flash21.bin
      Can someone verify if this is the proper dump?

      I tried to write using the Write command after modifying a dump using Dospierra's method but it says that samsung is not currently supported. Should I force write using the other write commands?

    544. Dudshl
      01-09-2012
      10:27 PM
      544

      Originally Posted by zaf
      Hello,
      Can someone verify if this is the proper dump?
      As I see - You dump is correct.

      Originally Posted by zaf
      I tried to write using the Write command after modifying a dump using Dospierra's method but it says that samsung is not currently supported. Should I force write using the other write commands?
      Use erasechip command before writing, then writeword or writewordubm to write Your patched dump.

    545. zaf
      01-10-2012
      03:09 AM
      545

      Thx dudshl. I wrote a patched file To the nor but apparently the patch is not correct since when i am starting the ps3 with my usb in right port, it is not going into service mode. I guess my patched file is wrong. Can anyone patch this file for me?
      thanks

    546. judges
      01-10-2012
      05:05 AM
      546

      Originally Posted by zaf
      Hello,
      After a long time dumping NORs, I have obtained recognizable dumps by norpatch. However, norpatch reads only the PRG0 and PRG1. The other variables are unknown. BTW, I am on OFW4.00.
      You just have to use the latest version of norpatch. It's linked on the first post of this thread.

      Btw, norpatch's version number always equals to the highest OFW version it can recognize.
      ************* [ - Post Merged - ] *************
      Originally Posted by zaf
      Thx dudshl. I wrote a patched file To the nor but apparently the patch is not correct since when i am starting the ps3 with my usb in right port, it is not going into service mode. I guess my patched file is wrong. Can anyone patch this file for me?
      thanks
      Here you go: http://www.multiupload.com/Y1GFGZ5N7Q

    547. zaf
      01-10-2012
      09:27 AM
      547

      Successful NOR write but nothing happens after I plug in the USB in the right-most port of the PS3. PS3 turns on normally with message connect controller and press PS button even with USB inside. I tried various USBs but still nothing.
      THe files Lv2diag.self and PS3UPDAT.PUP are in the root folder of the USB drive. The LV2diag is the one provided by jaicrab.
      Any idea on this?

    548. judges
      01-10-2012
      10:15 AM
      548

      Originally Posted by zaf
      Successful NOR write but nothing happens after I plug in the USB in the right-most port of the PS3. PS3 turns on normally with message connect controller and press PS button even with USB inside. I tried various USBs but still nothing.
      THe files Lv2diag.self and PS3UPDAT.PUP are in the root folder of the USB drive. The LV2diag is the one provided by jaicrab.
      Any idea on this?
      Did you put your PS3 in fsm (factory service mode)? The USB stick won't do that...

      You'll need a service jig for that. If you don't have one, you can also use your teensy to do it. You'll just need a special PSGrade version, check this out:

      http://www.ps3hax.net/showthread.php...415#post269415

      After flashing the psgrade hex, connect teensy usb to rightmost PS3 usb port. Turn on PS3, right after that press Eject (i.e. press power button, release power button, press eject button, release eject button). PS3 will beep 2 times. PS3 should power off automatically after a while. It sometimes requires more than one try...

      Once you're in fsm, you can disconnect teensy from ps3 usb and continue with your usb stick.

    549. zaf
      01-17-2012
      11:33 PM
      549

      Hello,
      I got another ps3 but here is the thing.
      When I follow your procedure with NORway 0.4beta12, I cannot get a good dump (unknown manufacturer etc) with 3.3 Voltage Regulator. I tried also Norway 0.4 beta5 and Norway 0.3. The chip is Samsung K8P2716UZC. However, if I force turn off the PS3 while teensy is plugged in, then make a dump, I get a perfect dump with everything correct. However, when I try to write (ps3 is still off), I get these errors:
      Traceback (most recent call last):
      File "C:\Users\WSUadm\Desktop\NORway\NORway.py", line 664, in <module>
      n.writerange(addr, data)
      File "C:\Users\WSUadm\Desktop\NORway\NORway.py", line 512, in writerange
      self.program(addr/2, data[:0x20000], wordmode, ubm)
      File "C:\Users\WSUadm\Desktop\NORway\NORway.py", line 499, in program
      raise NORError("Verification failed")
      __main__.NORError: Verification failed

      My log is here
      http://dl.dropbox.com/u/21918357/ps3log.txt

      Is there a way I can force write it? I have never tried 5V on this machine.

    550. judges
      01-18-2012
      07:00 AM
      550

      Originally Posted by zaf
      Hello,
      I got another ps3 but here is the thing.
      When I follow your procedure with NORway 0.4beta12, I cannot get a good dump (unknown manufacturer etc) with 3.3 Voltage Regulator. I tried also Norway 0.4 beta5 and Norway 0.3. The chip is Samsung K8P2716UZC. However, if I force turn off the PS3 while teensy is plugged in, then make a dump, I get a perfect dump with everything correct. However, when I try to write (ps3 is still off), I get these errors:
      Traceback (most recent call last):
      File "C:\Users\WSUadm\Desktop\NORway\NORway.py", line 664, in <module>
      n.writerange(addr, data)
      File "C:\Users\WSUadm\Desktop\NORway\NORway.py", line 512, in writerange
      self.program(addr/2, data[:0x20000], wordmode, ubm)
      File "C:\Users\WSUadm\Desktop\NORway\NORway.py", line 499, in program
      raise NORError("Verification failed")
      __main__.NORError: Verification failed

      My log is here
      http://dl.dropbox.com/u/21918357/ps3log.txt

      Is there a way I can force write it? I have never tried 5V on this machine.
      You cannot force it to write. Wouldn't make much sense to write false data.

      Did you try the other writing modes ("writeword" and "writewordubm")? For those you have to issue an "erasechip" command in before. Also according to your logs "erasechip" didn't even take a second to finish. So you should wait for 2 mins or so before writing to make sure that the erase is really done. This might also indicate that your RY/BY signal line is faulty, so you might wanna check that as well.

    551. zaf
      01-18-2012
      01:20 PM
      551

      I checked the wires again just to make sure. The resistance of the control wires are around 3.7 ohms which I believe is a good connection.
      I again tried to write, but still in vain. I just get verification errors again when I tried to write using all the modes (write, writewordubm or writeword). Erasechip didn't make it to the end since it ends prematurely.
      Can you think of anything on this matter?

    552. judges
      01-19-2012
      06:11 AM
      552

      Originally Posted by zaf
      I checked the wires again just to make sure. The resistance of the control wires are around 3.7 ohms which I believe is a good connection.
      I again tried to write, but still in vain. I just get verification errors again when I tried to write using all the modes (write, writewordubm or writeword). Erasechip didn't make it to the end since it ends prematurely.
      Can you think of anything on this matter?
      I don't know how you've measured the resistance, but in what world is 3.7 ohms a good connection? For AWG30 a wire length of 10m would be required to get that result. For a wire length of let's say 20cm it should be more like 0.07 ohms...

    553. zaf
      01-20-2012
      04:30 PM
      553

      I think I figured something out. I have a question though! Do WP#, ACC and BYTE# need to be connected somewhere? From ps3devwiki, it says that these has to be connected to Vcc. However, they are nowhere to be found in the pinout. My board is JSD-001. Do you think that this is the reason I can only read and not erase and write?
      Also, whee can I get a hold of you? Are you using some sort of IM?
      I am looking forward to hearing from you.
      Thanks

      I think dandza had the same kind of errors. He could read but not write! My teensy is still connected. I am open to testing. If you have any modification, I am ready to use it and test it first hand.

    554. jjblaster3
      01-21-2012
      04:46 PM
      554

      hi,
      first time for me soldering..
      so i had soldered the wires for my cech2001b ps3, and decided to try booting it up before soldering the wires onto the teensy continuing with the backup procedures.

      the thing is, ps3 boots, but no video/audio shown on screen.
      also when i press and hold the power button to try system restore it only turns off the ps3 after 10-15 secs..

      pressing the power button normally, does not turn off the ps3.. that is until i do the hold method or unplug..

      could you please help me out on what could be the issue?

      i checked for shorts but didnt notice any (at first there was a short between two grounds, but fixed it)

      my last solution would be to unsolder all wires and test, but first wanna hear any possible causes/opinions to avoid the hassle

    555. zaf
      01-21-2012
      05:26 PM
      555

      Did you try NORway.py COM# release?
      You have to release the tristate before booting the ps3!

    556. jjblaster3
      01-22-2012
      02:38 AM
      556

      Originally Posted by zaf
      Did you try NORway.py COM# release?
      You have to release the tristate before booting the ps3!
      havent soldered the wires onto the teensy yet, just onto the ps3 motherboard..

      could that still affect?

      edit:
      desoldered the tristate line just to check, and the ps3 is still havin the same issue

    557. zaf
      01-22-2012
      12:56 PM
      557

      The solder leads on the motherboard are not touching, but there exist the possibility that the other wires are touching. So I would recommend to connect the teensy and then see what happens. Try not to apply tremendous pressure on the board while soldering.
      ************* [ - Post Merged - ] *************
      Also, my other suggestion would be to use a multimeter and then test for resistance between adjacent solder leads. If you see any resistances in the order of several ohms, then this is a short.
      I hope that helps.

    558. judges
      01-23-2012
      06:41 AM
      558

      Originally Posted by zaf
      I think I figured something out. I have a question though! Do WP#, ACC and BYTE# need to be connected somewhere? From ps3devwiki, it says that these has to be connected to Vcc.
      Where does the wiki state that? No, those lines don't have to be connected. They're tied to Vcc by the mobo itself.

      I got the JSD-001 myself and no problems at all. Again, check your wiring. Make sure that there's *NO* resistance at all (not like 4 ohms or so).

      If everything else fails, you might wanna try CrackMyDay's solution:
      http://www.ps3hax.net/showpost.php?p...&postcount=488

      Originally Posted by zaf
      Also, whee can I get a hold of you? Are you using some sort of IM?
      You can PM me. Or send an email. But please don't expect me to always answer instantaneously.

    559. zaf
      01-23-2012
      12:33 PM
      559

      Thanks for your answer judges.
      I'm not sure if you got my PM but here it is...
      I have been doing some reading lately and apparently, I am not the only one having this issue. Dandza also was struck with this writing problem. He has the samsung ZC and the JSD mobo. He could read but not write unfortunately. Please take a few moments to check this post:
      http://www.ps3hax.net/showthread.php...961#post283961
      Dandza in post #8 mentions his problem.

    560. jjblaster3
      01-25-2012
      11:00 AM
      560

      Originally Posted by zaf
      The solder leads on the motherboard are not touching, but there exist the possibility that the other wires are touching. So I would recommend to connect the teensy and then see what happens. Try not to apply tremendous pressure on the board while soldering.
      ************* [ - Post Merged - ] *************
      Also, my other suggestion would be to use a multimeter and then test for resistance between adjacent solder leads. If you see any resistances in the order of several ohms, then this is a short.
      I hope that helps.
      thanks for the suggestions, i guess i should go buy a multimeter before i start soldering again..
      as for now, have desoldered everything since when i connected my teensy was having some bad dumps, which was all because of loose connections (im a noob at soldering).
      also solved the booting problem, wire routing was the issue.. the wires were blocking the pressure applied to the rsx chip and hence the booting with no vid/audio..

      im jus glad my ps3 has booted, and from now will take things nice and slow

    561. zaf
      01-26-2012
      03:02 PM
      561

      No problem. Everyone is here is ready to help.

      You have to be careful on soldering and not apply tremendous pressure on the board.

      My suggestion would be to connect the teensy and the wires first. Then solder each wire starting from the left if you are a right-hander. Also, solder them flat,; the wires should be almost horizontal when soldering. This will prevent the pressure issue!

    562. GelBoy249
      01-26-2012
      05:29 PM
      562

      Originally Posted by judges
      You just have to use the latest version of norpatch. It's linked on the first post of this thread.

      Btw, norpatch's version number always equals to the highest OFW version it can recognize.
      ************* [ - Post Merged - ] *************


      Here you go: http://www.multiupload.com/Y1GFGZ5N7Q
      Hey Judges, I have the jsd-001 mb and samsung k8p2716 nor. Just had a few questions if you dont mind:

      1.) Do I need to add the 3.3v converter to teensy?

      2.) Can I use the 4b beta 12 file or do i need the beta5 file?

      3.) If beta 5 can you reupload a link to it? (None of them are working)

      Thanks a bunch, ur kindness is very much appreciated

    563. zaf
      01-26-2012
      07:29 PM
      563

      Originally Posted by GelBoy249
      1.) Do I need to add the 3.3v converter to teensy?
      If you have it, then solder it to your teensy. Don't forget to cut the 5V trace. Also, it is wise to check the output of the Vcc using a multimeter. It should be 3.3V.
      Originally Posted by GelBoy249
      2.) Can I use the 4b beta 12 file or do i need the beta5 file?
      Yes, you don't have to use the beta5 for that. The beta 12 just work out fine. I have done it before and it worked fine.

      Originally Posted by GelBoy249
      3.) If beta 5 can you reupload a link to it? (None of them are working)
      As I said before, you don't need the beta5 to downgrade.

      Have you connected your teensy yet? There is a special procedure with the samsung QB that you have to adopt to downgrade. Let me know and then I'll share how it is to be done!

    564. GelBoy249
      01-26-2012
      08:25 PM
      564

      Zaf, thanks a bunch for the reply. Yes I have already soldered the teensy and am eternally grateful for your reply. What was it that you mentioned that I should do next? (Does this also apply to me as my NOR is a samsung k8p2716UZC-QI4D) Thanks again

    565. zaf
      01-27-2012
      12:50 AM
      565

      No, it doesn't apply for this Samsung chip.

      Now it is time to dump. It is helpful to get GOOD dumps because these kind of hold the secret keys to your PS3.
      Well, use norpatch to check your dump.
      Basically:
      %PS3 off. COM is the teensy USB to serial driver. It can be COM3 or any other number. Check in device drivers and expand ports%
      NORway.py COM4
      %Turn PS3 on%
      NORway.py COM4 dump flash.bin
      NORway.py COM4 dump flash2.bin
      NORway.py COM4 dump flash3.bin
      NORway.py COM4 release

      norpatch.exe flash.bin

      I don't remember exactly the things to be displayed, but there should be something like PKG0, PKG1, ROS0, ROS1.
      There should be some figures corresponding to your firmware like 3.55 or 3.70 or something like that.

    566. judges
      01-27-2012
      03:22 AM
      566

      Originally Posted by zaf
      Thanks for your answer judges.
      I'm not sure if you got my PM but here it is...
      I have been doing some reading lately and apparently, I am not the only one having this issue. Dandza also was struck with this writing problem. He has the samsung ZC and the JSD mobo. He could read but not write unfortunately. Please take a few moments to check this post:
      http://www.ps3hax.net/showthread.php...961#post283961
      Dandza in post #8 mentions his problem.
      So, did you ask Dandza whether he has solved the problem? Did you try CrackMyDay's method? Did you check the RY/BY line?

      My assumption is that RY/BY is always high for some reason. And that signal line is essential for writing. I might modify the current version in a way that RY/BY isn't used anymore. But it will terribly slow down the writing process, because I would have to use a fixed delay after writing each word (or sequence of words depending on the write mode).

      But please try CrackMyDay's solution first if you didn't do already.

    567. zaf
      01-27-2012
      03:29 AM
      567

      I asked him via PM, but I am still waiting for a reply. I guess that once his PS3 was downgraded, he ditched the forum. Yes, I checked my RY/BY line and everything is working. I resoldered my lines but still perfect dumps with verification errors no matter what mode I write to. I am kind of using Crackmyday's method with my PS3. I am dumping with my PS3 off so far and getting successful dumps every-time.
      If you have some extra time, then please do so. I'll be more than happy to try it.

      Thanks!!!

    568. judges
      01-27-2012
      10:17 AM
      568

      Originally Posted by zaf
      I asked him via PM, but I am still waiting for a reply. I guess that once his PS3 was downgraded, he ditched the forum. Yes, I checked my RY/BY line and everything is working. I resoldered my lines but still perfect dumps with verification errors no matter what mode I write to. I am kind of using Crackmyday's method with my PS3. I am dumping with my PS3 off so far and getting successful dumps every-time.
      If you have some extra time, then please do so. I'll be more than happy to try it. Thanks!!!
      Check out this version: https://rapidshare.com/files/2719784...b12_noryby.zip

      1. Do an "erasechip"
      2. Once finished, make a dump and check (should only contain "FF"s, if it doesn't, you can stop here (or power-cycle your ps3 and try again)
      3. Try different writing modes in this order: write, writewordubm, writeword (always do step 1 and 2 in before)

      This version uses fixed time delays instead of checking the RY/BY signal. Writing takes 10-25mins. Tested on my console, works fine.

    569. zaf
      01-27-2012
      05:11 PM
      569

      This is just impossible. erasechip finishes in 2 minutes but nothing is erased!!! I get the same exact dump just like before with same MD5!!!

    570. judges
      01-31-2012
      04:33 AM
      570

      Originally Posted by zaf
      This is just impossible. erasechip finishes in 2 minutes but nothing is erased!!! I get the same exact dump just like before with same MD5!!!
      Well, then there's not much I can do here.

      Again, check your signal lines (OE, WE, CE, RY/BY). Not just for resistance, but maybe you've swapped two of them or something like that. And also, again, try CrackMyDay's method. Not just sort of, but to the letter.

    571. judges
      02-10-2012
      10:46 AM
      571

      I've updated norpatch.exe to recognize the new OFW 4.10 in your dumps. You'll find the download link in the 1st post of this thread (github)...

      -- judges

    572. Bohemio
      02-10-2012
      12:08 PM
      572

      (First Sorry 4 my english, i do my best) .... i have a problem with a PS3 160gb CECH2511a, with Spansion S29GL128N ... i solder my Teensy++ , i extract 3 or 4 dumps , and i verify they correct.... i extracted, i apply the 6 patchs , when i re write the nor, the process finish, i power on the ps3 , and shut down in 1 or 2 seconds.... if i Write the original dump , work again..... the dump is OK , but dont work when i apply the patch.


      I add you the original dump[QUOTE]
      http://www.mediafire.com/file/yc57m1...f6c/alfin2.bin

    573. sguerrini97
      02-12-2012
      03:14 PM
      573

      Hi, I'm preparing to solder my Teensy++ to my PS3.
      What kind of cable it's better?
      THIS (the red one, wire-up 0,2mm)

      or this



      ?

      Or can someone suggest me a right cable? Thanks.

      The CrackMyDay's method can be use on different nor memory? Because i haven't the 3.3v regulator.. If yes, I need to solder the 3.3 input in all NOR Vcc or only in one of them?

      And please can someone upload the NORWay v0.4 beta12? Multiupload seems to be offline now.. Thanks.
      Sorry for my english.

    574. judges
      02-14-2012
      03:12 AM
      574

      Originally Posted by sguerrini97
      Hi, I'm preparing to solder my Teensy++ to my PS3.
      What kind of cable it's better?
      THIS (the red one, wire-up 0,2mm) or this
      The first one seems to be okay (0.2mm). The one on the picture looks kind of thick.. Of course it will work as well, but you might get problems routing the wires if you target a permanent install of your teensy. For the 0.2mm wire you might wanna consider soldering 2 or 3 wires for the ground connection.

      Originally Posted by sguerrini97
      The CrackMyDay's method can be use on different nor memory? Because i haven't the 3.3v regulator.. If yes, I need to solder the 3.3 input in all NOR Vcc or only in one of them?
      Yes, you can use it for all kinds of NORs, although I've never tested it myself. Don't really understand your second question. You pick up the 3.3V supply (ONE) from the console and solder it to your teensy according to the instructions.

      Originally Posted by sguerrini97
      And please can someone upload the NORWay v0.4 beta12? Multiupload seems to be offline now.. Thanks.
      Sorry for my english.
      Here you go:
      https://rapidshare.com/files/3990712...y_04beta12.zip

    575. sguerrini97
      02-14-2012
      05:16 AM
      575

      Originally Posted by judges
      The first one seems to be okay (0.2mm). The one on the picture looks kind of thick.. Of course it will work as well, but you might get problems routing the wires if you target a permanent install of your teensy. For the 0.2mm wire you might wanna consider soldering 2 or 3 wires for the ground connection.



      Yes, you can use it for all kinds of NORs, although I've never tested it myself. Don't really understand your second question. You pick up the 3.3V supply (ONE) from the console and solder it to your teensy according to the instructions.



      Here you go:
      https://rapidshare.com/files/3990712...y_04beta12.zip
      Thank you very much for your help
      But what's the 3.3V supply of the console? I was thinking that on the diagram was "NOR_Vcc", but in the diagram of my motherboard (JSD-001) there are 2 "NOR_Vcc"..

      And i'ts possible to run NORWay under linux? Thanks.

    576. judges
      02-14-2012
      07:46 AM
      576

      Originally Posted by sguerrini97
      Thank you very much for your help
      But what's the 3.3V supply of the console? I was thinking that on the diagram was "NOR_Vcc", but in the diagram of my motherboard (JSD-001) there are 2 "NOR_Vcc"..

      And i'ts possible to run NORWay under linux? Thanks.
      Either one of the NOR Vcc pads will do. And yes, you can run NORway on linux, it's just a python script. But don't ask me how, I'm not a linux guy...

    577. TizzyT
      02-14-2012
      08:21 AM
      577

      Originally Posted by sguerrini97
      Hi, I'm preparing to solder my Teensy++ to my PS3.
      What kind of cable it's better?
      THIS (the red one, wire-up 0,2mm)

      or this



      ?

      Or can someone suggest me a right cable? Thanks.

      The CrackMyDay's method can be use on different nor memory? Because i haven't the 3.3v regulator.. If yes, I need to solder the 3.3 input in all NOR Vcc or only in one of them?

      And please can someone upload the NORWay v0.4 beta12? Multiupload seems to be offline now.. Thanks.
      Sorry for my english.
      If you have any IDE cables laying around for those old IDE harddrives and disc drives I find those to be very good to solder with .

    578. sguerrini97
      02-14-2012
      08:41 AM
      578

      Thank you again judges.

      ====

      Originally Posted by TizzyT
      If you have any IDE cables laying around for those old IDE harddrives and disc drives I find those to be very good to solder with .
      Are you talking about this?

    579. TizzyT
      02-14-2012
      09:59 AM
      579

      Originally Posted by sguerrini97
      Thank you again judges.

      ====



      Are you talking about this?
      Yes that it, I just peel each wire off and use them to solder, it works very well for me at least. Ask around if you would like and get opinion on it. If you need a larger size use a floppy cable they work as well. I don't solder a lot but when I do I use those as its easy to work with.

    580. sguerrini97
      02-15-2012
      05:53 AM
      580

      Originally Posted by TizzyT
      Yes that it, I just peel each wire off and use them to solder, it works very well for me at least. Ask around if you would like and get opinion on it. If you need a larger size use a floppy cable they work as well. I don't solder a lot but when I do I use those as its easy to work with.
      I have 40 wires of 14 cm. I need more? How should be long each wire? Thanks.

    581. TizzyT
      02-15-2012
      12:31 PM
      581

      Originally Posted by sguerrini97
      I have 40 wires of 14 cm. I need more? How should be long each wire? Thanks.
      I am sorry I have never used a teensy nor have I soldered to one, I've only suggested the type of wire you might be able to used. [MENTION=193105]judges[/MENTION] seems to be of more help. Again I'm sorry.

    582. sguerrini97
      02-15-2012
      01:19 PM
      582

      Originally Posted by TizzyT
      I am sorry I have never used a teensy nor have I soldered to one, I've only suggested the type of wire you might be able to used. [MENTION=193105]judges[/MENTION] seems to be of more help. Again I'm sorry.
      Don't worry
      I take an old Floppy Cable long abount 50cm and with it I make 33 wires :D

    583. judges
      02-16-2012
      12:00 PM
      583

      I've updated norpatch.exe to recognize the new OFW 4.11 in your dumps. You'll find the download link in the 1st post of this thread (github)...

      -- judges

    584. jjblaster3
      02-22-2012
      07:11 AM
      584

      hi
      ok so i used this tutorial to create patched core_os..

      http://www.nextgenupdate.com/forums/...-purposes.html

      the file size required by norpatch is 7340000 bytes and the one i get is around 5212154 bytes..

      is there something i am doing wrong? could someone please post or pm me a link to a patched 3.55 core_os so i can use norpatch to patch my dump?

      p.s i used dospiedra's v2 nor patching method and it works, but only with rogero v2 firmware.. all other ones i install (in service mode or not, patched lv1 checks or not) give me yellow/red light of death..
      but, when i reflash my patched dump, the firmware works..
      so i figured the problem comes up when installing the firmware, the nor is modified somehow and this is affected by the dospiedra patch which causes yellow/red light of death.. so im guessing this method is not the way to go?

    585. judges
      02-23-2012
      01:29 AM
      585

      Originally Posted by jjblaster3
      hi
      ok so i used this tutorial to create patched core_os..

      http://www.nextgenupdate.com/forums/...-purposes.html

      the file size required by norpatch is 7340000 bytes and the one i get is around 5212154 bytes..

      is there something i am doing wrong? could someone please post or pm me a link to a patched 3.55 core_os so i can use norpatch to patch my dump?

      p.s i used dospiedra's v2 nor patching method and it works, but only with rogero v2 firmware..
      I've never used any of those tutorials, so I don't really know what the results are.

      But if your cos.bin doesn't have the required size, you probably missed step 7 from your linked tutorial. You need to unpack/decrypt your cos.pkg first. Although I don't really see the point in using MFW builder to apply the patch if you afterwards have to replace lv1.self manually in your cos.bin (shouldn't MFW builder already have done this?). But as I said, I've never done it like that.

      Btw, once you've flashed a patched cos.bin to your ps3, you should be able to install any kind of CFW (patched or not) in FSM.

    586. kabeero
      02-23-2012
      02:20 AM
      586

      Hi,

      I'm having trouble w/Teensy2++ and Samsung K8Q2815UQB running NORway 0.4 beta 12.

      I'm able to dump and issue erasechip while console is in standby, or unplugged with
      CrackMyDay's method


      I'm not able to issue writeword or writewordubm commands in any mode (on/standby/unplugged). I've tried with the power regulator installed and console in standby, which worked for dumping, but this errors out after about 1200 KB/16384 KB. I've tried removing the regulator as per CrackMyDay's method and cannot issue either write command.
      This is the message I receive:

      Code:
      __main__.NORError: Ping failed (expected 42, got ff)
      I'm not sure if this message is indicating that my Teensy is crashing, or if the NOR is overwhelmed and stopped responding to pings. I've looked at the NORway.c Teensy code and it appears that on ping attempts no data is going between Teensy to NOR, so I'm thinking that it's the first case.

      I've hooked up my ~OE (0), ~CE (1), ~WE (2), RY/~BY (3), and A22 (4) lines to a logic analyzer and got this output while issuing writewordubm. The failure occurs around the part of the graph where A22 goes high, and the write halts at about 1100-1400 KB/16384 KB with the Python error shown.

      Does anybody have any ideas on what may be my problem? My final resolution is to replace my Samsung chip with a Macronix MX29GL, but I'm not sure if my dump and PS3 (CECH2001A) will be compatible.

      Thanks for any opinions or ideas


      SOLUTION:Don't use Linux.
      After installing Python 2.7 on a Windows computer with Teensy drivers, this Python error went away.
      I was able to leave the regulator installed and not have to connect the Vdd on the NOR chip to anything, able to write with PS3 on standby.

    587. jjblaster3
      02-23-2012
      08:21 AM
      587

      Originally Posted by judges
      I've never used any of those tutorials, so I don't really know what the results are.

      But if your cos.bin doesn't have the required size, you probably missed step 7 from your linked tutorial. You need to unpack/decrypt your cos.pkg first. Although I don't really see the point in using MFW builder to apply the patch if you afterwards have to replace lv1.self manually in your cos.bin (shouldn't MFW builder already have done this?). But as I said, I've never done it like that.

      Btw, once you've flashed a patched cos.bin to your ps3, you should be able to install any kind of CFW (patched or not) in FSM.
      thanks for the help, i did not actually use that method per say, coz they already provided one patched for us, but the link was dead so i probably found a corrupt version or sumthn in other sites

      oh and also since im not able to install any other firmware apart from rogero v2, i guess its the fault of dospiedra's method..

      will try out all scenarios, thanks again

    588. cvp
      02-23-2012
      06:53 PM
      588

      --delete--

    589. sguerrini97
      03-03-2012
      10:19 AM
      589

      [MENTION=193105]judges[/MENTION] i've got a problem: i have solder a wire on the NOR Vcc bur i made it wrong, so i removed the solder but also the already existing solder on the motherboard gone away.. Here is a photo:

      What can i do? Thanks and sorry for my english.

    590. jeerum
      03-03-2012
      10:57 AM
      590

      Originally Posted by sguerrini97
      [MENTION=193105]judges[/MENTION] i've got a problem: i have solder a wire on the NOR Vcc bur i made it wrong, so i removed the solder but also the already existing solder on the motherboard gone away.. Here is a photo:

      What can i do? Thanks and sorry for my english.
      maybe make better picture, i have repaired broken track. just find where this point is connected

    591. sguerrini97
      03-04-2012
      06:50 AM
      591

      Originally Posted by jeerum
      maybe make better picture, i have repaired broken track. just find where this point is connected
      Thanks for your answer.
      Here is a better picture of my situation:

      And here is the motherboard with correct solder (from PS3 Dev Wiki):

      Thanks.

    592. jeerum
      03-04-2012
      07:55 AM
      592

      Originally Posted by sguerrini97
      Thanks for your answer.
      Here is a better picture of my situation:

      And here is the motherboard with correct solder (from PS3 Dev Wiki):

      Thanks.
      Seems all 5 are same points, you need just good soldering there :D

    593. sguerrini97
      03-04-2012
      08:46 AM
      593

      Originally Posted by jeerum
      Seems all 5 are same points, you need just good soldering there :D
      Please can you make a simple picture from my situation and highlight the points that i have to tie with the solder? Thanks.

    594. jeerum
      03-04-2012
      09:40 AM
      594

      for me it looks
      but maybe someone can confirm it, better to have direct look on this MOBO

    595. sguerrini97
      03-05-2012
      08:19 AM
      595

      Originally Posted by jeerum
      for me it looks
      but maybe someone can confirm it, better to have direct look on this MOBO
      I don't understand "all 5 are same points"..

    596. aliman
      03-08-2012
      05:17 PM
      596

      hi guys,
      i need some help:
      i've got my teensy++ today and soldered everything up.
      norway output:

      Code:
      NORway.py v0.4 beta - Teensy++ 2.0 NOR flasher for PS3 ([email protected])
      (Orignal noralizer.py by Hector Martin "marcan" <hector[MENTION=60324]marcan[/MENTION]soft.com>)
      Pinging...
      Set SB to tristate
      NOR chip manufacturer: Spansion (0x01)
      NOR chip type: S29GL128 (0x7e2101)
      Checking sector protection...
      No protected sectors found!
      STATUS_TRIST_N: True
      STATUS_RESET_N: True
      STATUS_READY:   True
      STATUS_CE_N:    False
      STATUS_WE_N:    True
      STATUS_OE_N:    True
      Resetting NOR...
      Ready.
      my problem is, when i dump the nor of my ps3 (CECH-2004A), it gives me different dumps everytime i dump it. norpatch doesn't recognize the ros0/ros1:
      Code:
      norpatch.exe v3.72 - Verify/Patch PS3 NOR flash dumps [(c) [email protected]]
      PRG0 version is 3.40
      PRG1 version is 3.55
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is unknown
      ROS1 version is unknown
      i've used awg 30 cables from ide cable which should work.
      i don't get what i'm doing wrong.
      my procedure to dump is:
      1.) shut ps3 completely off(power cord removed)
      2.) plug in teensy++ usb to laptop (win xp)
      3.) start norway (at this point it doesn't recognize nor chip type or manufracturer)
      4.) plug in power cord of ps3 and press on button(ps3 doesn't boot, instead it stays on without video output - everything up to here is right, right?)
      5.) start norway and dump flash
      6.) check it with norpatcher

      when i open the dumps in the hexeditor i can see the IFI at offset 00000200, then some FFs and then the asecure_loader and everything readable at offset 00000420,
      so i think the important stuff of my dumps aren't screwed up, right?

      Edit: forgot to say that i've checked the soldered traces and they are all like they have to be soldered.

      i appreciate every help i get^^

    597. judges
      03-09-2012
      05:13 AM
      597

      Hi there..

      Originally Posted by aliman
      hi guys,
      i need some help:
      i've got my teensy++ today and soldered everything up.
      norway output:
      Looks good.

      Originally Posted by aliman
      my problem is, when i dump the nor of my ps3 (CECH-2004A), it gives me different dumps everytime i dump it. norpatch doesn't recognize the ros0/ros1
      That's not good. If your dumps are different all the time, there's obviously something wrong. Apart from that, let me ask you this: what OFW version are you running? You're using norpatch v3.72, so that's the highest firmware version it can recognize. And it doesn't recognize any CFWs.

      Originally Posted by aliman
      i've used awg 30 cables from ide cable which should work.
      For me they do the job. But they're supposed to be more sensitive to EMI opposed to thicker wires. You might also wanna use a thicker GND wire, since that one holds all the current (or 2 or 3 awg30 wires parallel).

      Routing of wires might also be an issue (EMI). Always have the console's shielding installed. Route the wires some place else. Best practice is routing the wires outside of the shielding.

      Originally Posted by aliman
      1.) shut ps3 completely off(power cord removed)
      2.) plug in teensy++ usb to laptop (win xp)
      3.) start norway (at this point it doesn't recognize nor chip type or manufracturer)
      4.) plug in power cord of ps3 and press on button(ps3 doesn't boot, instead it stays on without video output - everything up to here is right, right?)
      5.) start norway and dump flash
      6.) check it with norpatcher
      Everything is correct so far. You might want to try to dump when the console is fully booted up. Turn off console (power cord removed). Teensy not connected. Boot up your console until it has completely started (XMB, no hdd activity). Connect Teensy. "norway.py comx". If chip is recognized, "norway.py comx dump test.bin".

      You might also wanna try a different computer.

      Originally Posted by aliman
      so i think the important stuff of my dumps aren't screwed up, right?
      If your dumps are different everytime, you can assume that they're screwed up...

      Keep me posted..

    598. aliman
      03-09-2012
      05:49 PM
      598

      soo here is what i did:
      -double checked the connections for wiring error->nothing found
      -dumped my nor with several devices:
      -laptop (win xp 32bit),
      -laptop (ubuntu 10 32bit),
      -pc (win7 64bit),
      -mobile phone (maemo 5 armel)
      ->everytimes same result: wrong dump

      i've read through this thread closely until i found the modification of CrackMyDay to let the teensy operate at 3.3v from ps3 instead of using the regulator, resulting in a working, recognizeable and same dump 10 times :D

      now everything works like it should ^^
      thanks to everyone that made the teensy a fully functional and cheap nor dumper.

      and for everyone having issues with dumping their nor: try this mod for your teensy: http://www.ps3hax.net/showpost.php?p...&postcount=488

    599. nortnil
      03-18-2012
      06:37 PM
      599

      Thank you to judges for putting together this great open source solution. Also thank you to everyone else who has contributed to this thread.

    600. nortnil
      03-20-2012
      09:00 PM
      600

      Does anyone have a download for the NORway v0.4 beta? The link earlier in the thread is now dead.

    601. judges
      03-21-2012
      01:10 AM
      601

      Originally Posted by nortnil
      Does anyone have a download for the NORway v0.4 beta? The link earlier in the thread is now dead.
      I've added the link for v0.4beta12 to the very first post of this thread..

      -- judges

    602. nortnil
      03-21-2012
      08:56 PM
      602

      Awesome, thanks judges.

      I am planning on getting this installed tonight. If I want to program my teensy with psgrade to get into service mode will I have to completely de-solder all of the connections? Or is it possible to de-solder some or none and just reprogram it where it is installed?

      Thank you.

    603. judges
      03-22-2012
      12:05 AM
      603

      Originally Posted by nortnil
      Awesome, thanks judges.

      I am planning on getting this installed tonight. If I want to program my teensy with psgrade to get into service mode will I have to completely de-solder all of the connections? Or is it possible to de-solder some or none and just reprogram it where it is installed?

      Thank you.
      Added a link to the first post to a modified psgrade. It runs at 8MHz and Teensy's LED has been disabled, so that it doesn't mess with PS3's data lines while being installed. In other words: you don't have to de-solder anything. Sometimes it doesn't enter FSM at the first try, but just keep on trying, it's working.

    604. nortnil
      03-22-2012
      07:51 AM
      604

      Thank you once again.

      I have a DYN-001 board with a Samsung K8Q2815UQB-P14 chip. I am planning on using CrackMyDay's alternative power method. In this case am I still okay to leave the 3.3v line from the NOR soldered to the Teensy? Or should I disconnect that line before using the custom psgrade you attached?

      Also when he refers to the 3.3v pad in his guide I'm assuming he means the VCC pad. Is that right?

      Thank you.

    605. nortnil
      03-23-2012
      12:26 AM
      605

      I was able to get several clean dumps and finally figured out how to patch a downgrade.bin... I think.

      I was able to get the chip to erase, but now my problem is writing. Using any of the three write commands always results in a failure at 8192 KB with the following errors. Any input would be greatly appreciated. Thank you.


      ************* [ - Post Merged - ] *************

      Originally Posted by nortnil
      I was able to get several clean dumps and finally figured out how to patch a downgrade.bin... I think.
      So apparently I haven't figured out how to create a downgrade.bin. I was able to successfully flash back to my original dump and boot the ps3. Good to know those dumps are in fact 100%.

      I did notice that using the command writeword to rewrite my original flash.bin the writing was sluggish right up to the 8192 KB point. After that it flew through the last half of the file. I am guessing this has something to do with the first flash chip being written to and the second flash still being clean from the erase?

    606. judges
      03-23-2012
      01:23 AM
      606

      Originally Posted by nortnil
      I did notice that using the command writeword to rewrite my original flash.bin the writing was sluggish right up to the 8192 KB point. After that it flew through the last half of the file. I am guessing this has something to do with the first flash chip being written to and the second flash still being clean from the erase?
      This sounds more like the second half of the nor hasn't been erased at all. That's why the 2nd half of your patched flash couldn't be written, but your original dump could be written completely (actually there isn't any writing done, if the data from your flash file and the data on the nor are identical. That's why it's so fast, it's basically just reading).

      You can try to erase your nor again, wait some minutes after erasure, power-cycle your ps3 and dump again. Check your dump. It should only contain 0xFF.

    607. nortnil
      03-23-2012
      07:34 AM
      607

      Originally Posted by judges
      This sounds more like the second half of the nor hasn't been erased at all. That's why the 2nd half of your patched flash couldn't be written, but your original dump could be written completely (actually there isn't any writing done, if the data from your flash file and the data on the nor are identical. That's why it's so fast, it's basically just reading).

      You can try to erase your nor again, wait some minutes after erasure, power-cycle your ps3 and dump again. Check your dump. It should only contain 0xFF.

      This is exactly what is happening. I did a erasechip, NORway no longer recognized the flash chip, repowered PS3 and plugged in USB cable, initiated another erasechip, repowered PS3 again, and dumped an erase.bin.

      The .bin is half 0XFF and the other half original data. Is there anyway to force erasechip to get the second half? I tried telling it to erase at a specific offset, but it didn't seem to get the command.

    608. judges
      03-23-2012
      11:55 AM
      608

      Originally Posted by nortnil
      This is exactly what is happening. I did a erasechip, NORway no longer recognized the flash chip, repowered PS3 and plugged in USB cable, initiated another erasechip, repowered PS3 again, and dumped an erase.bin.

      The .bin is half 0XFF and the other half original data. Is there anyway to force erasechip to get the second half? I tried telling it to erase at a specific offset, but it didn't seem to get the command.
      After you did an erasechip, did you wait a couple of minutes before issuing any other command? Wait like 3 minutes and then do a "norway.py comx". It should recognize the chip. Maybe the function just thinks it's done with erasing, but actually it's still working.

      You can also try a manual sector erase. Try "norway.py comx erase 0x800000". Dump afterwards and check whether the first couple of kb at 0x800000 have been erased.

    609. nortnil
      03-23-2012
      05:58 PM
      609

      Originally Posted by judges
      After you did an erasechip, did you wait a couple of minutes before issuing any other command? Wait like 3 minutes and then do a "norway.py comx". It should recognize the chip. Maybe the function just thinks it's done with erasing, but actually it's still working.

      You can also try a manual sector erase. Try "norway.py comx erase 0x800000". Dump afterwards and check whether the first couple of kb at 0x800000 have been erased.
      I did wait a bit, but I didn't wait a full 3 minutes. Each time it was telling me it took around 45 seconds to actually erase. Through persistence I was able to get it to do a full erase that took a minute and a half. That resulted in a completely erased dumped. I was able to successfully write the downgrade.bin I created earlier. It was in fact incorrect, but I got your message on how to properly set everything up. I will try again tonight and post back.

      Thanks for the heads up on the erase and then offset. For some reason I was using erasechip offset. If I run in to trouble again I think that will be most helpful.

    610. crunchienuts
      03-23-2012
      07:36 PM
      610

      Hi guys,
      working my way through the downgrade and got a few things i need cleared up.

      - PS3 Slim CECH2502 w/ NOR
      - JSD001 Testpoints
      - Teensy++ 2.0 w/ 3.3v regulator, 5v traces cut & 3v pads shorted

      First things first..when I go and do a "norway.py COM3" command here is the result...


      Pinging...
      Set SB to tristate

      NOR chip manufacturer: unknown (0x41)
      NOR chip type: unknown (0x414143)

      STATUS_TRIST_N: False
      STATUS_RESET_N: True
      STATUS_READY: True
      STATUS_CE_N: False
      STATUS_WE_N: True
      STATUS_OE_N: True

      Resetting NOR...
      Ready.
      then when i turn on the ps3 and either do a "norway.py COM3" or procede to dump the flash with "norway.py COM3 dump flash.bin" this is the output


      Pinging...
      Set SB to tristate

      NOR chip manufacturer: Spansion (0x01)
      NOR chip type: S29GL128 (0x7e2101)

      Checking sector protection...
      No protected sectors found!

      STATUS_TRIST_N: False
      STATUS_RESET_N: True
      STATUS_READY: True
      STATUS_CE_N: False
      STATUS_WE_N: True
      STATUS_OE_N: True

      Resetting NOR...
      Ready.

      Dumping NOR...
      16384 KB / 16384 KB
      Done. [0:01:13.937000]
      Now my multiple dumps are the right size & when i run them through norpatch they all result in the following

      PRG0 version is 3.50
      PRG1 version is unknown
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is 4.10
      ROS1 version is 4.00

      Now my problem is, that when i go for a "norway.py COM3 release" command, it successfully restarts the NOR however I am unable to turn on my PS3 (no video, can't use power button to turn off, video reset doesn't work, & yes, teensy is disconnected)

      I was wondering if my problem could be related to the fact that my "STATUS_TRIST_N: False" output is causing the problem. Maybe it's preventing my PS3 from operating normally?

      *NOTE* I am able to also successfully write the full 16MB to the NOR as well

      Any help would be much appreciated =]

    611. nortnil
      03-23-2012
      09:11 PM
      611

      Originally Posted by crunchienuts
      Now my problem is, that when i go for a "norway.py COM3 release" command, it successfully restarts the NOR however I am unable to turn on my PS3 (no video, can't use power button to turn off, video reset doesn't work, & yes, teensy is disconnected)

      ....

      *NOTE* I am able to also successfully write the full 16MB to the NOR as well

      Any help would be much appreciated =]
      When you wrote the NOR were you writing a downgrade.bin or your original dump? If you wrote the downgrade.bin and then started having problems with no video, etc then there may be a problem with your downgrade.bin.

      If that is the case try writing your original dump and see if that brings it back to life.

      Also did you check your dump in a hex editor against the flash wiki to visually inspect the offsets? Flash wiki

      Other than that I don't know. I am still struggling with my own problems currently.

    612. crunchienuts
      03-23-2012
      09:21 PM
      612

      Thanks for the prompt reply!
      I've had a bit of luck since last time

      To answer your question I flashed my original dump just to see if it would write successfully. (which it did)

      Anyhow, I resoldered the E7 (Tristate #) line and managed to get Norway to display "STATUS_TRIST_N: True" and the PS3 now boots to the "Press the PS Button screen" and I am able to turn it off also.

      Now I'm not exactly sure what the implications of my "STATUS_TRIST_N: False" from before means on me. But will I have received a bad dump because this output was false the first time? I also did a full write using the original dump back to the PS3 under this False state.

      I will go ahead and check my dump using the Flash wiki you mentioned.

      Anyone care to shed some light?

    613. nortnil
      03-23-2012
      09:23 PM
      613

      Edit:

      I thought I was having a problem when everything was working exactly as it should have. I didn't realize that when I went into FSM before installing the CFW I wouldn't have anything displayed on my screen and the console would shut down if there was no USB drive supplied with the PS3UPDAT.PUP and Lv2diag.self.

      When I tried booting with the USB drive the console stayed on and showed sings of reading from the flash drive. I left it on for about 15 minutes, but it wouldn't turn off. I eventually turned it off and rebooted. It went to my CFW and showed the red box that I was still in FSM.

      I used the second Lv2diag.self and exited FSM no problems.

      THANK YOU JUDGES!!!!! I literary could not have done this without you! Where is the donate button?

    614. nortnil
      03-23-2012
      09:30 PM
      614

      Originally Posted by crunchienuts
      Thanks for the prompt reply!
      I've had a bit of luck since last time

      To answer your question I flashed my original dump just to see if it would write successfully. (which it did)

      Anyhow, I resoldered the E7 (Tristate #) line and managed to get Norway to display "STATUS_TRIST_N: True" and the PS3 now boots to the "Press the PS Button screen" and I am able to turn it off also.

      Now I'm not exactly sure what the implications of my "STATUS_TRIST_N: False" from before means on me. But will I have received a bad dump because this output was false the first time? I also did a full write using the original dump back to the PS3 under this False state.

      I will go ahead and check my dump using the Flash wiki you mentioned.

      Anyone care to shed some light?
      When I flashed back to my original dump it booted back like nothing ever happened. I honestly don't know enough to know what the "Press the PS Button screen" means for your situation after flashing back to the original dump.

      When it flashed back did it seem to write really quickly? Unless you did an erasechip the write command should be looking for changes and only flashing changes to the NOR and not flashing the whole image. My only guess is if the original dump were somehow wrong then flashing it back may have written over some previously good sectors which now results in the press PS screen.

      I wish I were more help, but I'm still figuring this out too. Judges has been consistently responding to me first thing in the morning, so hopefully he can both of us later.

    615. crunchienuts
      03-23-2012
      09:58 PM
      615

      Sorry to mention but i should have pointed out that the PS3 was stuck in an update boot loop due to a broken bluetooth module. It was giving error 8002F1F9. So I'm guessing the press PS button is a sign of progress as it's not trying to update itself anymore.

      When i flashed the original dump back to the PS3 it definately wasn't quick. Chip was not erased and it did behave in a way like you mentioned.

      I cross-referenced the flash page with my dump and although I didn't go through all the addresses, the dump does in fact look like a good clean dump. But again just want to make sure of what I'm doing before I do any real damage.

      On another note, I did try the 8Mhz Teensy Psgrade .hex file to see if I could get in Factory Service Mode but to no avail. Havn't pursued it any further so not sure what to do there. I left my Teensy the way it was (3.3v reg, 5v pad traces cut, 3v pads shorted) and plugged it into the rightmost USB port but it doesn't seem to jig the PS3 and continues to just boot to the "Press the PS Button"

    616. judges
      03-24-2012
      11:41 AM
      616

      Originally Posted by crunchienuts
      Sorry to mention but i should have pointed out that the PS3 was stuck in an update boot loop due to a broken bluetooth module. It was giving error 8002F1F9. So I'm guessing the press PS button is a sign of progress as it's not trying to update itself anymore.
      You'll probably need a special CFW that has BT disabled. Check out this post, euss created an MFW task specifically for that: http://www.ps3hax.net/showpost.php?p...&postcount=136

      Originally Posted by crunchienuts
      When i flashed the original dump back to the PS3 it definately wasn't quick. Chip was not erased and it did behave in a way like you mentioned.

      I cross-referenced the flash page with my dump and although I didn't go through all the addresses, the dump does in fact look like a good clean dump. But again just want to make sure of what I'm doing before I do any real damage.
      Sounds like the hardware part is running fine. Since norpatch recognized ROS0/1 of your dump, it should be okay. There's always a slight chance for the dump to still being corrupted, but it's very unlikely, because the ROS areas are the largest part of the NOR and if those are correct, at least all of your data and address lines are working 100%. And there's no way to check to entire content..

      Originally Posted by crunchienuts
      On another note, I did try the 8Mhz Teensy Psgrade .hex file to see if I could get in Factory Service Mode but to no avail. Havn't pursued it any further so not sure what to do there. I left my Teensy the way it was (3.3v reg, 5v pad traces cut, 3v pads shorted) and plugged it into the rightmost USB port but it doesn't seem to jig the PS3 and continues to just boot to the "Press the PS Button"
      Did you do the power/eject sequence to enter fsm? Check this out: http://www.ps3devwiki.com/wiki/Boot_...F_manufacturer

      And give it a couple of tries, it doesn't always work the first time. Don't know why, but my E3 fsm jig also doesn't enter fsm all the time. Doesn't seem to be a Teensy problem.
      ************* [ - Post Merged - ] *************
      Originally Posted by nortnil
      THANK YOU JUDGES!!!!! I literary could not have done this without you! Where is the donate button?
      Good to hear that everything's working out fine for you. A "Thanks" is enough donation..

    617. nortnil
      03-24-2012
      02:06 PM
      617

      Originally Posted by judges
      Good to hear that everything's working out fine for you. A "Thanks" is enough donation..
      Then THANK YOU!!!! AMAZING WORK!!!!

      I also didn't notice until after I opened my console to push the button on the Teensy you added a "bootloader" command to NORway.py to flip to the bootloader and reprogram it with the psgrade you adapted. Very helpful, wish I had seen that earlier. Nicely done.

    618. crunchienuts
      03-24-2012
      08:22 PM
      618

      UPDATE

      In response to judges post, I continued the firmware downgrade under the assumption my dumps were fine.

      Loaded the PSgrade .hex file onto the teensy again with everything still soldered (3.3v regulator included). Plugged that into the PS3 and after giving the "Power then quickly press eject" trick, it entered FSM after about 3-4 tries. I think my issue before was that I had no idea about the mentioned trick.

      Proceded to downgrade with the USB, and everything went without a hitch. For the record, I did also use a patched CFW to bypass the update errors I was having.

      Not sure if it might be of any help to anyone or if it even makes a difference, but I actually tied the Teensy's GND point to every ground listed in my JSD-001 diagram (theres about 10). I realise now, I could probably have gotten away with just 1 or a couple, but goes to show itll still work nonetheless and I was getting consistent dumps each and every time.

      big THANKS goes out to judges for some exceptional work!

    619. judges
      03-30-2012
      05:07 AM
      619

      I've just released NORway v0.4 (see first post). Basically it's the same as v0.4beta12, just with updated readme's, change-logs, etc. Just needed to make a cut before starting to work on new features and improvements. You'll see those in the next v0.5beta...

    620. foxcool
      04-07-2012
      04:50 PM
      620

      I tell them my problem Hello I have a ps3 slim cech 2011A 120 GB, Samsung rules, placed tennsy + +, I tried a thousand ways to write the dump to achieve, I can not in any way. someone pass me a diagram or some method. I tried to norway and samsung.py file. from already thank you very much.

      PS: When I try to write with the norway.py gives me an error of Uknow chip.
      and when I try with the file samsung.py middle of the process gives me error.

    621. jasonp2506
      04-08-2012
      01:40 AM
      621

      Originally Posted by foxcool
      I tell them my problem Hello I have a ps3 slim cech 2011A 120 GB, Samsung rules, placed tennsy + +, I tried a thousand ways to write the dump to achieve, I can not in any way. someone pass me a diagram or some method. I tried to norway and samsung.py file. from already thank you very much.

      PS: When I try to write with the norway.py gives me an error of Uknow chip.
      and when I try with the file samsung.py middle of the process gives me error.
      Did u double check u soldered everything correctly? Or did u even realize this still needed to be done as any flasher?

    622. foxcool
      04-09-2012
      02:56 PM
      622

      my ps3 is a cech 2011A 120 GB. mother DYN - 001, I confirmed the correct instlacion. someone would help me.

    623. judges
      04-10-2012
      03:27 PM
      623

      Originally Posted by foxcool
      my ps3 is a cech 2011A 120 GB. mother DYN - 001, I confirmed the correct instlacion. someone would help me.
      I'm not even sure if I understood what you did..

      You already have dumped your flash successfully? Did you verify your dump? If NORway isn't able to recognize your chip, I have doubts that your dump is correct.

      What kind if NOR do you have?

      Get the latest version from github (see first post) and read everything. Also check out the links provided.

      I hope your dump is correct, since you've apparently already tried to write.. If it isn't, you're f*cked.

      If it is correct and nothing else works, try this method: http://www.ps3hax.net/showthread.php...070#post284070

    624. DiabolicGod
      04-19-2012
      04:28 AM
      624

      Heya.

      For the past couple days, I have been trying to downgrade my PS3, but its giving me quite a challenge.

      Here is the hardware I'm working with:
      - PS3 Slim with a DYN-001 motherboard and a K8Q2815UQB for NOR chip;
      - PS3 on 3.70;
      - Teensy++ 2.0 with 3.3V voltage regulator;
      - Teensy++ 2.0 flashed with (0.5b4) TRISTATE bugfix

      I also used NORway 0.5b4.

      And my "story" is...

      I installed teensy just fine, I do have quite some skills with soldering, so no issues there. I checked, and double checked, and tripled checked all my soldering, and wiring, and all seemed fine.

      After that I started following the guide, plugged in the USB into teensy, powered the PS3 and started doing dumps. Immediately the nor chip was identified and I was able to do several dumps.

      Once I had six successful dumps, I turned the PS3 off, and started checking the integrity of the dumps. I went into ps3devwiki and followed the "check-list" to make sure my dumps were valid, and I found no issues with the dumps.
      I also used Flowrebuilder to extract the dumps, and create a REV bin, and it did it just fine, no errors.
      Lastly I also used Venix Downgrade to check for the dumps integrity, all green, no errors.

      All the six dumps were identical, exactly the same file, same hash.
      All the six dumps were successfully verified by norpatch.

      Once I was confident I had a good dump I then started preparing my downgrade.bin.

      I have tried many was do it, that included the manual way with HxD, using both downgrade patch v1 and v2; I also tried to use Transplante with Flowrebuilder; Tried to use Venix Downgrade aswell...Lets just say I tried many ways, and created many downgrade.bin files.

      After that, it was time to write the prepared downgrade.bin.

      And that is where my first problem occurred. When I tried to use the write command, it gave me an error saying "Command not supported for Samsung K8Q2815UQB".

      Now, one of my questions is...is that normal? Am I doing it wrong?

      Next, I tried once again to write the downgrade.bin, this time using the writewordubm command, and this time it flashed fine, no errors.

      After the flash, I issued the release command, and turned off the PS3, unplugged teensy from the USB, and powered on the USB again, and it popped the press ps3 button screen.

      Now, second question; exactly what "press ps3 button" screen are we talking about...because I can think of more then one screen...and I'm not 100% sure that the screen I was getting was the screen I should be getting.

      After that screen, I turned off the PS3, and then attempted to put the PS3 into factory service mode, I was using my PSP to do so, but I was unsuccessfully. I'm not sure that's the correct way, or if it still works, etc, its just that on all the guides I read, that is all they specify...they simply say "put it in factory service mode".

      On the many attempts to put the PS3 in factory service mode, the PSP was outputting the log correctly, according to what it should output on a successful attempt, but the PS3 still wouldn't go into factory service mode, instead, it simply booted again into the "press ps3 button" screen.

      After many hours, several downgrade.bin files, several flashes, many many attempts to put the PS3 into factory service mode, I finally gave up. There is obviously something I'm doing wrong here, and I just run out of ideas...

      Eventual I flashed back one of the original dumps, and the PS3 is now working again, with stock 3.70.

      Does NORway support my nor chip? Is there a problem with the dumps? Or is it the downgrade.bin I'm creating? Am I flashing it wrong? Does the PSP no longer works to put the PS3 into factory service mode? Am I'm getting the wrong "press ps3 button" screen?

      So many variables...so many that can go wrong, so very very tired...I need a nap.

      If anyone could please give me a hand with this...I would be so grateful!

      Thank you,
      Dia.

    625. judges
      04-19-2012
      03:15 PM
      625

      Originally Posted by DiabolicGod
      All the six dumps were identical, exactly the same file, same hash.
      All the six dumps were successfully verified by norpatch.
      Perfect. You're on a good way..

      Originally Posted by DiabolicGod
      And that is where my first problem occurred. When I tried to use the write command, it gave me an error saying "Command not supported for Samsung K8Q2815UQB".

      Now, one of my questions is...is that normal? Am I doing it wrong?
      That's completely normal. As NORway says, the "write" command simply isn't supported for the Samsung K8Q, i.e. this particular writing mode is not implemented by Samsung.

      Originally Posted by DiabolicGod
      Next, I tried once again to write the downgrade.bin, this time using the writewordubm command, and this time it flashed fine, no errors.
      There you go.. "writeword" would also do the job, but is a little slower.

      Originally Posted by DiabolicGod
      After that screen, I turned off the PS3, and then attempted to put the PS3 into factory service mode, I was using my PSP to do so, but I was unsuccessfully. I'm not sure that's the correct way, or if it still works, etc, its just that on all the guides I read, that is all they specify...they simply say "put it in factory service mode".
      Turn off your console (remove power cord). Plug it in again and press power and eject in a fast sequence. Console should beep five times (or so). It usually also powers off automatically after that. Sometimes it needs a couple of tries.

      Originally Posted by DiabolicGod
      Eventual I flashed back one of the original dumps, and the PS3 is now working again, with stock 3.70.

      Does NORway support my nor chip? Is there a problem with the dumps? Or is it the downgrade.bin I'm creating? Am I flashing it wrong? Does the PSP no longer works to put the PS3 into factory service mode? Am I'm getting the wrong "press ps3 button" screen?
      Actually this isn't a NORway / Teensy problem, since the hardware part is working pretty well (so this might be the wrong thread). But I'm glad to hear that the latest beta is working so flawlessly with the K8Q without any further modifications (most problematic chip ever).

      But you might wanna check this out:
      http://ps3devwiki.com/wiki/Downgradi...rdware_flasher

      Let me know when you've downgraded successfully or have further questions.

    626. nortnil
      04-19-2012
      08:41 PM
      626

      Originally Posted by DiabolicGod
      Now, second question; exactly what "press ps3 button" screen are we talking about...because I can think of more then one screen...and I'm not 100% sure that the screen I was getting was the screen I should be getting.
      It sounds like you are getting the right screen here.

      Originally Posted by DiabolicGod
      After that screen, I turned off the PS3, and then attempted to put the PS3 into factory service mode, I was using my PSP to do so, but I was unsuccessfully. I'm not sure that's the correct way, or if it still works, etc, its just that on all the guides I read, that is all they specify...they simply say "put it in factory service mode".
      For this I would actually recommend using the Teensy board again. Grab the custom psgrade judges uploaded on the first post of this thread. You should be able to put the Teensy into bootloader without pressing the button on the board using the command "NORway.py bootloader". Once you are in the bootloader for Teensy, flash the psgrade hex to the board.

      Then plug the USB cable running from the still installed Teensy to the far right USB plug on the PS3 and use the power sequence Judges mentioned:

      Originally Posted by judges
      Turn off your console (remove power cord). Plug it in again and press power and eject in a fast sequence. Console should beep five times (or so). It usually also powers off automatically after that. Sometimes it needs a couple of tries.
      Once it powers off you can unplug the Teensy USB cable and re-power. At this point the PS3 should try to boot and then shut down. You can then insert your USB drive with your CFW and your LV2diag.self files into the far right USB and power on. As I mentioned in one of my previous posts my PS3 did not power down after the install process was done. I left it for about 15 minutes and then powered it down myself. Rebooted and the screen showed the XMB with the big red FSM warning in the lower right corner. I then put the second LV2diag.self file on the USB and booted to exit FSM. After that all was well.

      Best of luck. I hope you get everything working.

    627. ZackF89
      04-19-2012
      08:53 PM
      627

      ive had this problem as well. Thanks for the help

    628. XanderChaos
      04-19-2012
      08:54 PM
      628

      I also used NORway 0.5b4 i have not had any problems

    629. judges
      04-20-2012
      01:59 AM
      629

      Originally Posted by nortnil
      For this I would actually recommend using the Teensy board again. Grab the custom psgrade judges uploaded on the first post of this thread. You should be able to put the Teensy into bootloader without pressing the button on the board using the command "NORway.py bootloader". Once you are in the bootloader for Teensy, flash the psgrade hex to the board.
      One should mention that the bootloader command of course only works one way. Once you've flashed psgrade to teensy you'll need the button to activate bootloader mode to flash back norway.hex.

      Originally Posted by nortnil
      As I mentioned in one of my previous posts my PS3 did not power down after the install process was done. I left it for about 15 minutes and then powered it down myself. Rebooted and the screen showed the XMB with the big red FSM warning in the lower right corner. I then put the second LV2diag.self file on the USB and booted to exit FSM. After that all was well.
      I had the same issue that console didn't power off after update. Never cared about it since it was working just fine. But actually this usually indicates that there was an update error (check the end of the log file created by lv2diag.self). If the log ends with "manufacturing updating FAILURE (0x8002f057)" right after updating BD firmware, you have 2 options to fix it: use a PS3UPDAT.PUP with noBD patch (e.g. Rogero 3.1), this will get rid of the update error. Or disconnect teensy's (or any other flasher's) control lines (or teensy/other flasher entirely) from console. This is also supposed to fix the update problem, since in rare cases on some consoles a connected flasher causes this. Although I've never tried that latter option myself.

      You also might wanna checkout this section on ps3devwiki about de-hashing:
      http://ps3devwiki.com/wiki/Downgradi...sher#Dehashing

    630. nortnil
      04-21-2012
      08:19 PM
      630

      Originally Posted by judges
      I had the same issue that console didn't power off after update. Never cared about it since it was working just fine. But actually this usually indicates that there was an update error (check the end of the log file created by lv2diag.self). If the log ends with "manufacturing updating FAILURE (0x8002f057)" right after updating BD firmware, you have 2 options to fix it: use a PS3UPDAT.PUP with noBD patch (e.g. Rogero 3.1), this will get rid of the update error. Or disconnect teensy's (or any other flasher's) control lines (or teensy/other flasher entirely) from console. This is also supposed to fix the update problem, since in rare cases on some consoles a connected flasher causes this. Although I've never tried that latter option myself.
      Thank you, I didn't know that. I bet my error was caused by my blue-ray drive cable not being properly seated. I didn't notice the problem until i had fully flashed to a CFW. I will have to track down that log file and see.

    631. DiabolicGod
      04-21-2012
      10:38 PM
      631

      So, it turns out that the issue was the PSP. I followed nortnil advice, and used judges psgrade code for teensy and once I finished flashing the PS3 with the downgrade.bin, and did the "power+eject" trick, it did everything it should...turned off after a few seconds, and bam, it was in service factory mode.

      So basically yeh, everything was fine the first attempt I had at it, the only real issue was really the PSP not being able to put the PS3 into service factory mode...but teensy solved it!

      And after that was all straightforward..

      One quick question..anyone knows if there is a work in progress for the KTE-001 motherboard?

      Thanks for the help guys, couldn't have done it with out ya!

      Ho and by the way nortnil, they worked just fine...thank you once again!
      And judges, latest beta works lovely! No issues what so ever...

      Dia

    632. nortnil
      05-02-2012
      10:32 PM
      632

      Originally Posted by DiabolicGod
      Ho and by the way nortnil, they worked just fine...thank you once again!
      Dia
      Glad you got everything up and running. Happy to help.

    633. desperado
      05-09-2012
      05:43 AM
      633

      Check my dump, please. http://dump.ru/file/5722585. I think that something wrong with him.

    634. Bohemio
      05-09-2012
      07:22 AM
      634

      Originally Posted by desperado
      Check my dump, please. http://dump.ru/file/5722585. I think that something wrong with him.
      Check your lines again ....... what fw version is your ps3 ???

    635. desperado
      05-09-2012
      02:25 PM
      635

      Originally Posted by Bohemio
      Check your lines again ....... what fw version is your ps3 ???
      3.70 was a fw version

    636. judges
      05-09-2012
      03:27 PM
      636

      Originally Posted by desperado
      Check my dump, please. http://dump.ru/file/5722585. I think that something wrong with him.
      Data lines seem to be fine. Two or more address lines are connected wrong.

    637. desperado
      05-10-2012
      08:12 AM
      637

      Originally Posted by judges
      Data lines seem to be fine. Two or more address lines are connected wrong.
      Can you fix my dump? I am sorry, but that dump was flashed into console and now it has a green light with freeze.

      Sorry for my bad english.

    638. sguerrini97
      05-26-2012
      11:12 AM
      638

      Hi, can someone give me a 3.55 patched core_os.bin or a tutorial on how to obtain a cos.bin from the CORE_OS_PACKAGE.PKG? Thanks.

      Edit: is THIS (Ps3DevWiki)a valid patched coreos? It has the size required by norpatch, but the page says that I can install only firmwares with patched LV1, instead when I downgrade my PS3 for the first time I was able to install any 3.55 FW.. Thanks and sorry for my english.
      Edit2: Yes, that coreos works with any 3.55 firmware (tested with OFW, 3.55.2 REBUG and 3.55-OTHEROS++ via FSM):.

    639. cory1492
      05-28-2012
      08:04 PM
      639

      judges: first off, great work and thanks This ps3 slim with JPT-001 and spansion 'p' NOR now has a whole new level of functionality.

      I did the install based on this design (note I was not installing for downgrading, I was already running hermes-3.41), as I could not order from PJRC
      http://code.google.com/p/micropendou.../MicropendousA
      It has a 1287 chip on it, and I removed SRAM and the buffer chip and relocated the USB plug to something more manageable for a permanent install.

      I built firmware from the current source in you're repo with 1287 as the target. Unlike the progskeet I installed before this, it worked nearly perfectly from the get-go. The only problem I had, is the PS3 would not boot to gameos unless I connected usb to the PC and used python to de-assert tristate before hitting the power button.

      I wound up removing the 3.3V VREG I added and sourced an alternate 3.3V that is active even when the machine is off and thought I'd share, considering the mention of a regulator getting hot when used to power the samsung NOR and in the hopes it'd help someone else along the way; simply put it's a good 3.3V source and seems to have no issues handling the 15mA that this AVR needed so long as you keep VUSB separate so the current firmware doesn't force you into tristate held low. The single wire in the pic is connected to the micropendous' VCC header hole.

      When I get some time I'll dig around in the source a little and see if I can make it sleep until usb is connected, uses a fraction of the power that way. My only question is, do you think there could be some speed gains to be had by moving to a bulk protocol instead of CDC? I've written firmwares for the ARM arch before that can transfer a 16M NAND's contents to a PC in 22s, though NAND does have far less pins and states to deal with - if USB CDC is a possible bottleneck in this, I'd be glad to work on it a bit and see if I can do anything to help out.

    640. judges
      05-29-2012
      11:04 AM
      640

      Originally Posted by cory1492
      judges: first off, great work and thanks This ps3 slim with JPT-001 and spansion 'p' NOR now has a whole new level of functionality.
      Thanks, good to hear!

      Originally Posted by cory1492
      I built firmware from the current source in you're repo with 1287 as the target. Unlike the progskeet I installed before this, it worked nearly perfectly from the get-go. The only problem I had, is the PS3 would not boot to gameos unless I connected usb to the PC and used python to de-assert tristate before hitting the power button.
      That's basically the idea behind it. This way you can power it from USB using a regulator and also feed it 3.3V directly from the PS3. Tristate is automatically set once it gets connected to USB. Else you wouldn't be able to set tristate fast enough if you power it from PS3.

      Originally Posted by cory1492
      I wound up removing the 3.3V VREG I added and sourced an alternate 3.3V that is active even when the machine is off and thought I'd share, considering the mention of a regulator getting hot when used to power the samsung NOR and in the hopes it'd help someone else along the way; simply put it's a good 3.3V source and seems to have no issues handling the 15mA that this AVR needed so long as you keep VUSB separate so the current firmware doesn't force you into tristate held low. The single wire in the pic is connected to the micropendous' VCC header hole.
      The NOR should never be powered by the regulator. It drains a lot more power than USB can provide. So on Teensy it's either cut 5V trace, install regulator and don't connect Teensy to PS3's VCC - or - cut 5V trace, don't install regulator and connect VCC to PS3.

      Originally Posted by cory1492
      When I get some time I'll dig around in the source a little and see if I can make it sleep until usb is connected, uses a fraction of the power that way. My only question is, do you think there could be some speed gains to be had by moving to a bulk protocol instead of CDC? I've written firmwares for the ARM arch before that can transfer a 16M NAND's contents to a PC in 22s, though NAND does have far less pins and states to deal with - if USB CDC is a possible bottleneck in this, I'd be glad to work on it a bit and see if I can do anything to help out.
      You can certainly give it a try, but I personally think it's not worth the effort. Pure serial communication for 16MB (without actually doing anything to the NOR) takes about 50secs for dumping and 120secs for writing. So that's the max speed gain you could have.

    641. cory1492
      05-29-2012
      02:49 PM
      641

      Originally Posted by judges
      That's basically the idea behind it. This way you can power it from USB using a regulator and also feed it 3.3V directly from the PS3. Tristate is automatically set once it gets connected to USB. Else you wouldn't be able to set tristate fast enough if you power it from PS3.
      Hrm, so when I plug the PS3 into the wall using the teensy++ install method with a VREG, without ever connecting the teensy to a PC it shouldn't boot? Anything with VREG and USB power, without connecting to a PC first when I hit power on the console it would turn on, spin up the HDD then hard power off. Nothing I saw suggested this behavior was expected, and unless you say different I put it down to the micropendous or even just the 1287 parasiting the IO leads when unpowered.
      Originally Posted by judges
      The NOR should never be powered by the regulator. It drains a lot more power than USB can provide. So on Teensy it's either cut 5V trace, install regulator and don't connect Teensy to PS3's VCC - or - cut 5V trace, don't install regulator and connect VCC to PS3.
      Well I was looking at crackmyday's mod
      http://www.ps3hax.net/showthread.php...070#post284070
      and the discussion that followed said powering teensy from the NOR VCC caused issues, like the VREG by NOR getting hot for example suggesting it's not the best place to draw 3.3V from, among other things like requiring multiple attempts to poweron the PS3 before gaining access (I assume at this point it's simply because the NOR doesn't get power until late and the teensy takes a few microseconds to boot and set pin states up.)

      Originally Posted by judges
      You can certainly give it a try, but I personally think it's not worth the effort. Pure serial communication for 16MB (without actually doing anything to the NOR) takes about 50secs for dumping and 120secs for writing. So that's the max speed gain you could have.
      Hrm, yeah a few days work vs. just using what already works is always a headscratcher we'll see, if I wind up doing something repetitive that has me frustrated with the speed I might go ahead and tinker some, I exposed the reset and bootloader buttons just in case

    642. judges
      05-30-2012
      01:14 AM
      642

      Originally Posted by cory1492
      Hrm, so when I plug the PS3 into the wall using the teensy++ install method with a VREG, without ever connecting the teensy to a PC it shouldn't boot?
      No, that's not how it's supposed to work.

      Originally Posted by cory1492
      Anything with VREG and USB power, without connecting to a PC first when I hit power on the console it would turn on, spin up the HDD then hard power off. Nothing I saw suggested this behavior was expected, and unless you say different I put it down to the micropendous or even just the 1287 parasiting the IO leads when unpowered.
      Well, the thing is that code gets executed anyway, even without Teensy being connected to USB. It seems to be powered through I/O lines. In fact if I put anything else than the NORway firmware on Teensy (e.g. blinky example from PJRC), my PS3 won't boot either. But since code obviously gets executed, NORway is setting all I/O lines to input, so that it doesn't interfere. Once USB is connected, tristate gets set.

      Originally Posted by cory1492
      Well I was looking at crackmyday's mod
      http://www.ps3hax.net/showthread.php...070#post284070
      and the discussion that followed said powering teensy from the NOR VCC caused issues, like the VREG by NOR getting hot for example suggesting it's not the best place to draw 3.3V from, among other things like requiring multiple attempts to poweron the PS3 before gaining access (I assume at this point it's simply because the NOR doesn't get power until late and the teensy takes a few microseconds to boot and set pin states up.)
      CrackMyDays's method might not even be required anymore, because those problems might have been caused by a bug that was reversing tristate levels. In other words, tristate never was set correctly. Unfortunately I cannot verify this, because it never occurred on my system.

      Btw, here're some pictures of my new installation. I've installed an external port so that I can easily switch between different hardware platforms and power supply..

    643. moorewapyunco
      05-31-2012
      08:37 AM
      643

      So.. this allows you to downgrade to 3.55? Sorry haven't been looking at the news recently

    644. judges
      06-01-2012
      11:52 AM
      644

      Originally Posted by moorewapyunco
      So.. this allows you to downgrade to 3.55? Sorry haven't been looking at the news recently
      Correct. But make sure that your PS3 is downgradable. Check out this post: http://www.ps3hax.net/showpost.php?p=357424&postcount=3

    645. RuSpRay
      06-02-2012
      04:48 AM
      645

      tell me how to distinguish good from bad dump, if you use norpach?
      is it normal ?
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is unknown
      ************* [ - Post Merged - ] *************
      Could you check my dump?
      http://narod.ru/disk/51444065001.a52...lash1.bin.html

    646. judges
      06-02-2012
      07:30 AM
      646

      Originally Posted by RuSpRay
      tell me how to distinguish good from bad dump, if you use norpach?
      is it normal ?
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is unknown
      ************* [ - Post Merged - ] *************
      Could you check my dump?
      http://narod.ru/disk/51444065001.a52...lash1.bin.html
      This what my version of norpatch is reporting:

      Code:
      D:\>norpatch flash1.bin
      norpatch.exe v4.11 - Verify/Patch PS3 NOR flash dumps [(c) judges@eEcho.com]
      PRG0 version is 3.50
      PRG1 version is unknown
      PKG0 version is unknown
      PKG1 version is unknown
      ROS0 version is 3.60
      ROS1 version is 4.11
      D:\>
      So it seems to be correct. Don't bother about PRG1 and PKG0/1 being unknown. And you should get the latest version of norpatch, yours seems to be pretty old. Check out the first post of this thread for a download link...

    647. console-master
      07-01-2012
      02:08 AM
      647

      Hello. I have a problem:
      Norway 0.5b - cant write not original dump, not patched original dump(downgrade.bin)

      Remark: Original dump make by progskeet!!! But write procedure i must do with teensy(because i lost progskeet )

      Writing...
      0kb-16384kb 1.retry
      ...
      20.retry
      But: !writes ok! dump ,that made by teensy- command "dump"


      flash sasung 8q


      thanx

    648. judges
      07-04-2012
      01:59 AM
      648

      Originally Posted by console-master
      Hello. I have a problem:
      Norway 0.5b - cant write not original dump, not patched original dump(downgrade.bin)
      Are you using 0.5b4? Did you issue an "erasechip" command before writing? What writing mode did you use? Did you double-check your wiring?

      Originally Posted by console-master
      But: !writes ok! dump ,that made by teensy- command "dump"
      Is this supposed to mean that you can write a dump that you've previously made with NORway? If you didn't do an "erasechip" it's quite normal, because you're actually not writing (same content).

    649. sguerrini97
      07-17-2012
      10:39 AM
      649

      Can someone write a guide to unbrick? I've got a good backup but also when i restore it the ps3 remain bricked...
      My board was solder with CrackMyDay's method. And i'm using NORway 05b4

    650. judges
      07-23-2012
      03:22 AM
      650

      I've just released NORway v0.5 (see first post for download links).

      Changes:
      + Added block table for Samsung K8Q2815UQB. The programming modes "writeword" and "writewordubm" don't require manual chip/sector erase prior to writing anymore!
      + Bugfix: "NORway.py COMx release" didn't work. Now you can leave Teensy powered at all times and console will boot up correctly after issuing a "release" command
      + Bugfix: increased TRANSMIT_TIMEOUT for Teensy's serial device to 10000ms (required for OS X)
      + Bugfix: disabled DSR/DTR flow control (wasn't working reliably on OS X)
      + Bugfix: TRISTATE wasn't set correctly
      + Added additional verification when writing is done. Although each write command verifies each written sector/block, it happened that written bytes weren't persistent
      + Added "verify" command

      -- judges

    651. judges
      07-27-2012
      06:30 AM
      651

      New beta version available.. Now the "write" command only takes 4:30 minutes (instead of 6:45) to flash a completely empty NOR.

      Changes:
      + Changed programming modes "write", "writeword" and "writewordubm" to
      "vwrite", "vwriteword" and "vwritewordubm"
      + Added new programming modes that skip verification for single 4KB blocks:
      "write", "writeword" and "writewordubm"
      Since verification is done anyway at the end of programming, it's not
      necessarily required anymore to verify each single block individually.

      -- judges

    652. desperado
      09-01-2012
      08:27 AM
      652

      Please check me dump.
      http://dump.ru/file/5840035

      Look like a brick.

    653. judges
      09-02-2012
      11:57 PM
      653

      Originally Posted by desperado
      Please check me dump.
      http://dump.ru/file/5840035

      Look like a brick.
      Looks good to me at the first glance...

    654. CrackMyDay
      09-06-2012
      01:22 AM
      654

      Thanks for the effort and new release judges. I'll try it soon. Specially if i get a Samsung's QB memory.

      Cheers.

    655. judges
      09-06-2012
      09:52 AM
      655

      Originally Posted by CrackMyDay
      Thanks for the effort and new release judges. I'll try it soon. Specially if i get a Samsung's QB memory.

      Cheers.
      CrackMyDay's back! Hi!

      Your mods for Samsung QB might/should be obsolete now. At least the latest beta did work for a few guys on Samsung without your mod. Just give it a shot (power teensy from console). Your feedback is always appreciated! Thanks..

    656. Bohemio
      09-19-2012
      09:39 AM
      656

      Judges ... i have another issue , with a PS3 FAT with RSOD , and OFW 4.21

      it have samsung QB, i solder 2 times the teensy...


      i dumps 14 times the Nor ... and i have different MD5 nors , not all different but like that




      The last dumps are ... NUEVO1 , NUEVO2 and NUEVO3 ...

      il try with the latest beta ... with v5 , console OFF , console on ...

      then i try downgrade a ps3 slim and all the process was Okei, conclusion the teensy is fine ..

      What do you think ???



      EDIT: I compare the 2 differents Dumps and the only difference is in one field

      MD5:DC7759FAD7D0DE78174F1EB8BF98E820
      00EE4940 00 00 00 00 04 00 04 12 00 00 00 00 00 00 04 12


      MD5:B52CDFB60A16B4F9EFBE770E01782FA6
      00EE4940 00 00 00 00 00 00 04 12 00 00 00 00 00 00 04 12


      I compare with others dumps and all have "00" in thats field .....

      What do you think , what is the reason ??

    657. baileyscream
      09-19-2012
      02:24 PM
      657

      Originally Posted by Bohemio
      Judges ... i have another issue , with a PS3 FAT with RSOD , and OFW 4.21

      it have samsung QB, i solder 2 times the teensy...


      i dumps 14 times the Nor ... and i have different MD5 nors , not all different but like that




      The last dumps are ... NUEVO1 , NUEVO2 and NUEVO3 ...

      il try with the latest beta ... with v5 , console OFF , console on ...

      then i try downgrade a ps3 slim and all the process was Okei, conclusion the teensy is fine ..

      What do you think ???



      EDIT: I compare the 2 differents Dumps and the only difference is in one field

      MD5:DC7759FAD7D0DE78174F1EB8BF98E820
      00EE4940 00 00 00 00 04 00 04 12 00 00 00 00 00 00 04 12


      MD5:B52CDFB60A16B4F9EFBE770E01782FA6
      00EE4940 00 00 00 00 00 00 04 12 00 00 00 00 00 00 04 12


      I compare with others dumps and all have "00" in thats field .....

      What do you think , what is the reason ??
      i dont like coming into developers threads to answer a question aimed at said developer.

      [MENTION=193105]judges[/MENTION] the guy has p/m'd me asking to take a look. i'm not comming in to step on your toes.

      .......................................................................................................
      ok i have no idea about the creation of the md5 for all i know it could be a date/time stamp.

      go to my thread and check the dump propperly. dont mess about with md5 check's any further.

      http://www.ps3hax.net/showthread.php...466#post387466

    658. judges
      09-20-2012
      12:13 AM
      658

      Originally Posted by baileyscream
      i dont like coming into developers threads to answer a question aimed at said developer.

      @judges the guy has p/m'd me asking to take a look. i'm not comming in to step on your toes.
      That's certainly not a problem. I appreciate anyone's help. Also I'm not omniscient. Like in this case I wouldn't be able to relate this single byte difference to a flasher related issue.

      Originally Posted by baileyscream
      ok i have no idea about the creation of the md5 for all i know it could be a date/time stamp.

      go to my thread and check the dump propperly. dont mess about with md5 check's any further.
      Comparing multiple dumps from the same console is always a good idea. Using MD5 is a valid way of doing this. You just have to be aware that that's all you get. So it's just one of the steps in the validation process. Since you cannot validate the per console data, you'll never get a 100% validation. And in this case where just one single byte was different in all his dumps, you would never have noticed that without comparing the dumps.

      Long story short, we discussed this yesterday on #ps3downgrade, and [MENTION=131344]euss[/MENTION] had, as most of the times, the solution to this (thanks again!). To sum this up, the dumps were (probably) valid, the single byte difference was actually caused by the (RSOD) console itself. This makes the console change the cvtrm table in the flash.

      -- judges

    659. judges
      09-20-2012
      01:53 AM
      659

      Originally Posted by Tracy476
      So.. this allows you to downgrade to 3.55? Sorry haven't been looking at the news recently.
      Yes (depending on the model of your console). And you probably won't find it in the news, since this really isn't new anymore.. ;-)

    660. baileyscream
      09-20-2012
      07:20 AM
      660

      Originally Posted by judges
      Yes (depending on the model of your console). And you probably won't find it in the news, since this really isn't new anymore.. ;-)
      i dont see this user or question in your thread!
      i think you just replied to a spambot!

      and thanks for the reply. i just dont fully understand the whole md5 thing. but i doubt i really need to lol

    661. judges
      09-20-2012
      09:23 AM
      661

      Originally Posted by baileyscream
      i dont see this user or question in your thread!
      i think you just replied to a spambot!
      Maybe. The original message was gone a few minutes later. However, cannot delete mine.

      Originally Posted by baileyscream
      and thanks for the reply. i just dont fully understand the whole md5 thing. but i doubt i really need to lol
      It's just a checksum (128bit, 16bytes, or 32 hex digits), like many other algos for this purpose out there..

    662. DebugBrain
      09-20-2012
      10:09 AM
      662

      Originally Posted by judges
      New beta version available..
      Hello judges
      thanks for the great work you have done so far,
      I would like to try the beta version I can not find the download,
      can you help me?

      ps: sorry for my bad english

    663. judges
      09-20-2012
      11:51 AM
      663

      Originally Posted by DebugBrain
      Hello judges
      thanks for the great work you have done so far,
      I would like to try the beta version I can not find the download,
      can you help me?

      ps: sorry for my bad english
      Link is at the end of the first post of this thread:
      Originally Posted by judges

    664. DebugBrain
      09-20-2012
      12:26 PM
      664

      Thanks judges, maybe I have to do an eye examination

    665. Bohemio
      09-20-2012
      02:36 PM
      665

      Manss, i have more issues with fats ps3 ...

      now when i try to read the nor , norway give me always

      NOR chip manufacturer: unknown (0x00)
      NOR chip type: unknown (0x00adef)

      is very strange... i try with a slim and all the process was good.... but the same problem with 2 differents Fats

      i use the Crack My Day Method (5v pad cuted + 3v wire to nor vcc)

      I test it with console On / Off , with 3v disconectted , and with 3v + Gnd Disconectted


      PD: The Console boot ok

    666. baileyscream
      09-20-2012
      03:49 PM
      666

      Originally Posted by Bohemio
      Manss, i have more issues with fats ps3 ...

      now when i try to read the nor , norway give me always

      NOR chip manufacturer: unknown (0x00)
      NOR chip type: unknown (0x00adef)

      is very strange... i try with a slim and all the process was good.... but the same problem with 2 differents Fats

      i use the Crack My Day Method (5v pad cuted + 3v wire to nor vcc)

      I test it with console On / Off , with 3v disconectted , and with 3v + Gnd Disconectted
      check list:-
      1. dont have the volt reg attached
      2. the 3.3v pad solder bridged
      3. the 5v pads trace cut
      4. 5v pad on side of TEENSY++ connected to ps3's vcc pad
      5. solder all the wires between TEENSY++ to ps3
      6. connect the usb cable fron TEENSY++ to pc
      7. run NORway then type NORway.py COM (and your com port number)
      8. ps3 now has to be turned on
      9. you should now hear the TEENSY++ being connected to your pc (the "bing" noise)
      10. the ps3 will turn on (powerlight is green) but it should not boot


      also i assume your connecting the TEENSY++ by directly soldering the wires. or are you using the nor clip mod from my guide?

      this part :-
      NOR chip manufacturer: unknown (0x00)
      NOR chip type: unknown (0x00adef)
      would be either the NOR not powering up
      wires not soldered propperly
      TEENSY++ not setup propperly

    667. Bohemio
      09-21-2012
      07:59 AM
      667

      Originally Posted by baileyscream
      check list:-
      1. dont have the volt reg attached
      2. the 3.3v pad solder bridged
      3. the 5v pads trace cut
      4. 5v pad on side of TEENSY++ connected to ps3's vcc pad
      5. solder all the wires between TEENSY++ to ps3
      6. connect the usb cable fron TEENSY++ to pc
      7. run NORway then type NORway.py COM (and your com port number)
      8. ps3 now has to be turned on
      9. you should now hear the TEENSY++ being connected to your pc (the "bing" noise)
      10. the ps3 will turn on (powerlight is green) but it should not boot


      also i assume your connecting the TEENSY++ by directly soldering the wires. or are you using the nor clip mod from my guide?

      this part :-
      NOR chip manufacturer: unknown (0x00)
      NOR chip type: unknown (0x00adef)
      would be either the NOR not powering up
      wires not soldered propperly
      TEENSY++ not setup propperly


      Thankss Baileyss and Judges for your effort !!!

      All check list is Ok .. i use the same procedure to all the ps3 i downgrade.

      4 - I solder on pad of the bottom of the teensy (like Crackmydays) .. the 5v (3v) pad .... is clean ?? Is any difference between thats 2 pads ?


      When i come to job .. i try solder the teensy in a slim to test if all connectios still fine, i dont use CLIP

    668. baileyscream
      09-21-2012
      02:41 PM
      668

      Originally Posted by Bohemio
      Thankss Baileyss and Judges for your effort !!!

      All check list is Ok .. i use the same procedure to all the ps3 i downgrade.

      4 - I solder on pad of the bottom of the teensy (like Crackmydays) .. the 5v (3v) pad .... is clean ?? Is any difference between thats 2 pads ?
      just check with a mulimeter that the point your soldering is connected to the 5v pad at the side (there just "may" be a chance your soldering the wrong point)

      When i come to job .. i try solder the teensy in a slim to test if all connectios still fine, i dont use CLIP
      so steps 9 & 10 are what you get?
      i thought you said the ps3 boots up. and step 10. is where it shouldn't boot.

    669. judges
      10-25-2012
      11:02 PM
      669

      Updated norpatch.exe to recognize OFW 4.30.

      https://github.com/hjudges/NORway/bl...h.exe?raw=true

      -- judges

    670. judges
      10-31-2012
      08:52 AM
      670

      Updated norpatch.exe to recognize OFW 4.31.

      https://github.com/hjudges/NORway/bl...h.exe?raw=true

      -- judges

    671. incognita
      11-17-2012
      04:47 AM
      671

      Hello everyone,

      I have a question about Teensy++ 2
      Which NOR ps3 models are compatible with this flasher? All Phat and Slim models? Even the new superSlim model? For now I know we can't downgrade the last PS3 but we can read the NOR.

      Thank you very much.

    672. judges
      11-17-2012
      06:26 AM
      672

      Originally Posted by incognita
      Hello everyone,

      I have a question about Teensy++ 2
      Which NOR ps3 models are compatible with this flasher? All Phat and Slim models? Even the new superSlim model? For now I know we can't downgrade the last PS3 but we can read the NOR.

      Thank you very much.
      It can be used for any NOR model. And you're right, latest models can't be downgraded, but still you can read/write the flash.

      -- judges

    673. incognita
      11-17-2012
      08:19 AM
      673

      Originally Posted by judges
      It can be used for any NOR model. And you're right, latest models can't be downgraded, but still you can read/write the flash.

      -- judges
      Thank you for the reply "judges".

      And, if Teensy++ 2 is cheap, safe and relatively easy to use, why people spend money and time with E3 and Progskeet flashers? Teensy++ 2 has a problem that I don't know? Does it often fail or something like that?

      Thank you again.

    674. MJ999
      11-17-2012
      08:59 AM
      674

      Originally Posted by incognita
      Thank you for the reply "judges".

      And, if Teensy++ 2 is cheap, safe and relatively easy to use, why people spend money and time with E3 and Progskeet flashers? Teensy++ 2 has a problem that I don't know? Does it often fail or something like that?

      Thank you again.
      I heard that teensy is not as stable as progskeet and e3 flasher.

    675. judges
      11-17-2012
      09:11 AM
      675

      Originally Posted by incognita
      Thank you for the reply "judges".

      And, if Teensy++ 2 is cheap, safe and relatively easy to use, why people spend money and time with E3 and Progskeet flashers? Teensy++ 2 has a problem that I don't know? Does it often fail or something like that?

      Thank you again.
      Ask the people.. ;-)

      Seriously, I guess it's the lack of marketing.. Actually as far as I can tell, Teensy/NORway works more reliable than the other two (alright, as the developer of NORway I have to say that). Only difference is that E3/Progskeet are supposed to be solderless, but those NOR clips cause lots of trouble.

      E3 also comes with its own NOR flash, so you can basically do dual-boot, but getting it running is quite difficult and in the case of a firmware update it's a pain in the ass. You can as well just reflash your NOR with whatever you want. Granted, it takes 4 mins, but how often do you do that a day?

      So, no, Teensy doesn't have problems you don't know of, except for it's cheap and that I don't make money off it. ;-)

      -- judges
      ************* [ - Post Merged - ] *************
      Originally Posted by MJ999
      I heard that teensy is not as stable as progskeet and e3 flasher.
      I heard differently..

    676. afzoo3hax
      11-23-2012
      05:32 AM
      676

      If you have ever used an Arduino, or some equivalent microprocessor board, then the Teensy is just like that. So if you are comfortable and familiar with the Arduino platform, then this is a really good choice. It's also a good point to notice that if you aren't able to understand something as simple as the Arduino, then you should probably have no business flashing your PS3 in the first place.

      The E3 and Progskeet are different because they use some type of custom or proprietary VLSI processor, and more like an FPGA. Which is like a black-box. They run entirely closed-source firmware, are built on a commercial basis, as a custom device that can't be copied, in order to turn a profit on each unit.

      The reason Teensy is cheaper because it is based on a cheap piece of mass-produced silicone. And the hardware development board is completely general purpose (just like the Arduino). Hence with economies of scale etc built to a lowest cost for schools and so on. At the end of the day, either choice is capable of flashing / downgrading your PS3. But the Teensy is by far the more "efficient" solution in terms of requiring the absolute fewest necessary hardware components.

      If you really want to use a clip, the to 50pin (or is it 56pin?) NOR clip kit can be purchased seperately (it includes a wiring board). And can be wired up to a Teensy just the same way as you would do with any Progskeet.

      So... E3, Progskeet drawbacks = considerably higher cost?
      Teensy drawbacks = none whatsoever?

      After coming to the same independent conclusions myself, I can only agree with judges wholeheartedly. Everyone else is crazy, seems happy throwing buckets of their own money (or other people's money) down the toilet IMHO.

    677. incognita
      12-06-2012
      01:16 PM
      677

      Hello all again.
      I don't like to talk about the things I have never try so I decided some days ago buy a Teensy 2.0++ and a Progskeet v1.2

      Up to now, I have successfully downgraded two playstation 3, a slim version and a 80 GB phat version, with Teensy and the excelent NORway. Fast, easy and cheap. I have not found problems, just install, dump, patch, erease and flash. I am very happy with the teensy board because you can do a lot of things with it, not only flash playstation 3. Very very thanks to "judges", NORway is a powerfull and a great tool to downgrade

      In the other side I try everything to downgrade a PS3 with a progskeet but is imposible. You can dump your flash but you can't write. It is expensive with a lot of features that today don't work. The software has a lot of buttons and options... Why? NORway can do the same things and only have a few and clear options! Is expensive and you can't find support.

      The only thing I miss in NORway is the NAND support. I bought a Progskeet to use it with my old 60GB PS3 but I can't, as I have said before Progskeet has errors for now and you can't write.
      In ps3devwiki you can read that theoretically it would be possible if someone write the correct software, is that true?


      In short, if you only want to downgrade a NOR PS3 buy a Teensy 2.0++ and use NORway. Is cheaper, easier and safer than others.

      Thank you "judges" and "marcan" again for the NORway.
      And sorry for my bad english, I have tried to do my best.

    678. rexxar
      12-13-2012
      11:23 PM
      678

      Can someone help me? I've no idea what I've done wrong. My dumps look mostly okay, but there's random bytes all over the place that are like a bit off in either direction. For example, I get 0FADF0FF or 0FACF0FF instead of 0FACE0FF. I got about four dumps that were exactly the same, then I took the whole thing off and re-soldered every connection. I am 99% sure I have them all hooked up the right way now, but I've got another four identical dumps that are just as bad.

      The only pattern I can see between the two sets of dumps is that the bytes that differ are off by either one or four bits. The location seems random, though...

      I honestly don't know where I could have gone wrong. Surely it's just something stupid simple.

      I'm pretty sure the firmware on here was corrupt to begin with: I bought it RLoD on ebay hoping it was just the hard drive. Turns out to be an endless firmware update loop.

      Any advice at all would be much appreciated!

    679. judges
      12-16-2012
      11:08 PM
      679

      Originally Posted by rexxar
      Can someone help me? I've no idea what I've done wrong. My dumps look mostly okay, but there's random bytes all over the place that are like a bit off in either direction. For example, I get 0FADF0FF or 0FACF0FF instead of 0FACE0FF. I got about four dumps that were exactly the same, then I took the whole thing off and re-soldered every connection. I am 99% sure I have them all hooked up the right way now, but I've got another four identical dumps that are just as bad.

      The only pattern I can see between the two sets of dumps is that the bytes that differ are off by either one or four bits. The location seems random, though...
      It's not that bad as long as you get identical dumps. Obviously you had some bad wiring with your first try and now you've got a different error with your second try. It doesn't make a lot of sense to find a relation between the two soldering jobs.

      It's hard to say what's wrong with only four bytes to look at. Upload your current dump to mediafire and send me a PM with the download link. Maybe I can see a pattern.

      -- judges

    680. DSwizzy145
      12-17-2012
      12:41 AM
      680

      Will this work on other Nand usb programmers too with your new update? like: http://shop.01media.com/info.asp?ProductID=38584 & http://shop.01media.com/info.asp?ProductID=38585

    681. judges
      12-17-2012
      02:39 AM
      681

      Originally Posted by DSwizzy145
      Will this work on other Nand usb programmers too with your new update? like: http://shop.01media.com/info.asp?ProductID=38584 & http://shop.01media.com/info.asp?ProductID=38585
      Well, the quoted product is not exactly a "nand programmer". It's an avr development board. And currently NAND isn't supported by NORway (hopefully I'll get it done 'til the end of this year). And for NOR it's not suitable, because it lacks of sufficient I/O lines. Once NAND is supported, the quoted product could be used to program one NAND at a time.

      -- judges

    682. guerrierodipace
      12-17-2012
      05:22 AM
      682

      Originally Posted by judges
      And currently NAND isn't supported by NORway (hopefully I'll get it done 'til the end of this year).

      -- judges
      this is a wonderful news :D

    683. digiprog
      12-17-2012
      07:02 AM
      683

      sry judges :P but i have to ask .. is NORWAY compatible with other than teensy ++ 2.0 board ?

    684. judges
      12-17-2012
      08:42 AM
      684

      Originally Posted by digiprog
      sry judges :P but i have to ask .. is NORWAY compatible with other than teensy ++ 2.0 board ?
      Basically it's compatible (or can be easily adapted) to everything that comes with an Atmel AT90USB1286/1287 cpu and enough I/O ports.

      -- judges

    685. DSwizzy145
      12-17-2012
      09:05 AM
      685

      Originally Posted by judges
      Well, the quoted product is not exactly a "nand programmer". It's an avr development board. And currently NAND isn't supported by NORway (hopefully I'll get it done 'til the end of this year). And for NOR it's not suitable, because it lacks of sufficient I/O lines. Once NAND is supported, the quoted product could be used to program one NAND at a time.

      -- judges
      Thanks! so will i be able to dump my PS3 Slim 2x series model with those usb development thumb drives plugged in and downgrade and stuff?

    686. butnut
      12-17-2012
      09:19 AM
      686

      Originally Posted by afzoo3hax
      If you really want to use a clip, the to 50pin (or is it 56pin?) NOR clip kit can be purchased seperately (it includes a wiring board). And can be wired up to a Teensy just the same way as you would do with any Progskeet.

      Actually, the wiring board that comes with the clip is designed to connect to the e3 flasher not to the clip.

      And the wires on the clip are very small and not labeled so connecting it to a teensy would be a nightmare.

    687. judges
      12-17-2012
      09:37 AM
      687

      Originally Posted by butnut
      Actually, the wiring board that comes with the clip is designed to connect to the e3 flasher not to the clip.

      And the wires on the clip are very small and not labeled so connecting it to a teensy would be a nightmare.
      He wasn't talking about the E3 clip.

      This is what he meant: http://www.wii-clip.com/360/progskeet-NOR.htm

      -- judges

    688. butnut
      12-17-2012
      09:42 AM
      688

      Originally Posted by judges
      He wasn't talking about the E3 clip.

      This is what he meant: http://www.wii-clip.com/360/progskeet-NOR.htm

      -- judges

      I forgot about that clip

    689. judges
      12-17-2012
      09:45 AM
      689

      Originally Posted by DSwizzy145
      Thanks! so will i be able to dump my PS3 Slim 2x series model with those usb development thumb drives plugged in and downgrade and stuff?
      Not sure if you understood me correctly. It's not just about the same cpu. Teensy++ comes with 46 I/O lines (solder pads) that have to be soldered to the ps3 (or to a NOR clip). It's NOT plugging in the dev board into ps3's USB port...

      -- judges

    690. DSwizzy145
      12-17-2012
      10:10 AM
      690

      Alright i got you now! nvm sorry

    691. afzoo3hax
      12-17-2012
      01:48 PM
      691

      Here is a simple-to-follow soldering guide:

      Resource 1) Ps3DevWiki

      http://www.ps3devwiki.com/wiki/Teensy_2.0%2B%2B

      Resource 2) Youtube

      Soldering made easy: a youtube video by MrEnergyBreeze aptly called "Progskeet & Teensy++ PS3 motherboard wiring tips and preparation".

      Progskeet & Teensy++ PS3 motherboard wiring tips and preparation - YouTube

      Perhaps this video should really be added somewhere onto the Ps3DevWiki - any takers?

      Resource 3) Notes and advice:

      1) Don't rush. Do the preparatory work. For example cutting and tinning the ends of your wires to correct length, labelling them, etc. Of course, make sure beforehand you are 100% certain all the wires / solder points for your motherboard.

      2) Use Flux. You definitely need to prep the area with plenty of flux first thing, before you start waving around that soldering iron around in anger. Doesnt matter which kind of flux. The cheapest bog-standard grease flux is absolutely fine. Spread a generous layer of flux liberally on and all around the pads to protect them. It won't hurt anything and you absolutely cannot skip this step. If you don't have flux you definately can not do this solder job.

      3) After fluxing, then load the solder onto the contact pads (beading). At this point you should be in a pretty good position to go ahead and commence proper with the actual solder job.

    692. Andre@
      01-01-2013
      07:43 PM
      692

      thanks for norway. It is perfect. I've used it successfully on multiple consoles

      Today I have a problem with a DIA-001.
      I got more dump identical and valid but when I try to write, norway return error:
      256/xxx RY/BY timeout error while writing!

      What can I do?

      I tried to redo the installation, but the result is the same.
      Thanks for all reply.

      PS I am working on Spansion

    693. digiprog
      01-02-2013
      03:53 AM
      693

      [MENTION=255902]Andre@[/MENTION] i guess u have problems with ur wirings .. make sure u have the pullups wire is connected, a pic of ur soldiring might help ..

    694. Andre@
      01-02-2013
      04:23 AM
      694

      Originally Posted by digiprog
      [MENTION=255902]Andre@[/MENTION] i guess u have problems with ur wirings .. make sure u have the pullups wire is connected, a pic of ur soldiring might help ..
      I don't connect WP to VCC if you mean that becaus it was already connected to VCC from the motherboard.
      I redid the installation several times. I used cables in larger section, but the result does not change

      I am going to connect byte and VIO to VCC. Thanks for your reply
      ************* [ - Post Merged - ] *************
      Originally Posted by Andre@
      I don't connect WP to VCC if you mean that becaus it was already connected to VCC from the motherboard.
      I redid the installation several times. I used cables in larger section, but the result does not change

      I am going to connect byte and VIO to VCC. Thanks for your reply
      Ok Now I tried to connect WP, Byte and VIO to VCC, the result is the same

      I try to make a pullup on RY/BY (100k and 10K resistor for pullupping data) but the norway return this error



      This is the first time i get that error with teensy and norway.I don't know what can i do

    695. afzoo3hax
      01-02-2013
      08:35 AM
      695

      Originally Posted by Andre@
      Today I have a problem with a DIA-001.
      I got more dump identical and valid but when I try to write, norway return error:
      256/xxx RY/BY timeout error while writing!

      What can I do?
      Hmmm. Don't know myself but it seems as if this other guy experienced some similar problems...

      Originally Posted by zad
      successful downgade complete using a teensy ++ on cechj03 with a dia-002 board.

      was not a simple task but here is how i overcome some problems i had.

      i started off the task by not using a voltage regulator and used the vcc from the ps3, this worked fine without any issues, created good dumps and all was fine until flashing the patched dump back, this would stop at 256k,
      i moved to using the writeword command in norway.py however this give the same results.

      i checked the vcc and at that point the voltage was floating about a bit and even at times dropping as low as 2.5v hence it was more than likely the nor that was failing not the flash as the vcc comes from the ps3 and the nor.

      i then fitted a voltage regulator and tried the write command again once again came across the same problem still stopping at 256kb however the writeword command worked flawless and verified without problems too.
      ive now fitted a switch to switch between the voltage regulator and the vcc, ive done this so i can leave the teensy++ connected and still within my ps3 but it can also be used as a factory service unit as well when the switch is set to the vcc power and if ever i need to flash i can swap back to the regulator meaning everything boots well and works without problems.

      so here are my reccomendations

      1 i used 30swg wire, worked without any problems on cables less than 15cm (had about 0.1 ohm resistance between the teensy and the trace on the ps3)
      2 fit a voltage regulator to do the dumps as well, the voltage drop caused by the teensy++ cant be healthy for the nor chip and i was lucky i never bricked the thing.
      3 dont remove the teensy++ from your ps3 for using it to get into factory service mode, just simply remove the voltage regulator and attach the vcc (no voltage drop was seen doing this so id go as far as saying its safe and better than removing the whole chip just to enter factory service mode)

    696. Andre@
      01-02-2013
      11:07 AM
      696

      Originally Posted by afzoo3hax
      Hmmm. Don't know myself but it seems as if this other guy experienced some similar problems...
      Thank you very much! this is my problem, I tried to use external power supply, but i filed, now i am going to try with writeword command!!!! thanks I am going to try that

      I love you and Zad man! this was my solution! excuse me if I was not able to find it first

    697. incognita
      01-04-2013
      07:20 AM
      697

      Originally Posted by judges
      Well, the quoted product is not exactly a "nand programmer". It's an avr development board. And currently NAND isn't supported by NORway (hopefully I'll get it done 'til the end of this year). And for NOR it's not suitable, because it lacks of sufficient I/O lines. Once NAND is supported, the quoted product could be used to program one NAND at a time.

      -- judges
      Hello "judges"!
      Maybe I didn't understand you but do you mean you are working in a NAND programmer with Teensy++ 2.0? It would be more than fantastic!!!

    698. judges
      01-04-2013
      09:45 AM
      698

      Originally Posted by incognita
      Hello "judges"!
      Maybe I didn't understand you but do you mean you are working in a NAND programmer with Teensy++ 2.0? It would be more than fantastic!!!
      I do. Unfortunately I didn't have as much spare time as expected during my xmas holidays, so it's not yet finished.. Really can't give you any new release dates..

      -- judges

    699. incognita
      01-04-2013
      06:47 PM
      699

      Originally Posted by judges
      I do. Unfortunately I didn't have as much spare time as expected during my xmas holidays, so it's not yet finished.. Really can't give you any new release dates..

      -- judges
      You are doing a really good job!! You will finish it when you can, of course. Don't worry about release dates

      Thank you about this great news and happy new year!!

    700. afzoo3hax
      01-05-2013
      07:38 PM
      700

      Here is my connection diagram for the JSD-001 Motherboard. All of the pads are labelled exactly as they appear on the Teensy2.0++.

      https://minus.com/lErO5BlFD33gs

      Hope it helps someone.

    701. MJ999
      01-06-2013
      12:19 AM
      701

      Originally Posted by afzoo3hax
      Here is my connection diagram for the JSD-001 Motherboard. All of the pads are labelled exactly as they appear on the Teensy2.0++.

      https://minus.com/lErO5BlFD33gs

      Hope it helps someone.
      SUR-001, JTP-001, and KTE-001 have also the same testpoints.

    702. Gadorach
      01-16-2013
      05:17 PM
      702

      I've been reading everywhere I can on how to get this PS3 downgraded, but nothing's working yet. Here's my setup.

      DYN-001 + Samsung K8Q2815UQB-PI4B

      Progskeet 1.2 (Used to get perfect dumps, which all matched. As the 1.2 can't write back, I'm trying to use a Teensy++ 2.0 for that)
      Teensy++ 2.0 + NORway 0.6b3 + 3v3 from Console

      Here's what's going on.

      After I connected the Teensy the first time, using 30AWG Kynar at ~8cm, I was presented with Manufacturer Unknown (0x90) and Flash ID Unknown (0x909090).
      I then proceeded to rewire everything with 26AWG, which yielded the very same results. Then I tried to switch the power source over to 5v to read the NOR, just to see if it would work. As such, I disconnected the 3v3 and powered down the console. In the off state, NORway returned (0xb4) and (0xf4f4f4) respectfully. If the console was turned on though, it returned to the previous (0x90) and (0x909090). I've since returned to 3v3 from the board and disconnected the USB power supply. If any one has some ideas, I'd love to hear them. Thanks for your time!

      - Gadorach

    703. judges
      01-17-2013
      07:25 AM
      703

      Originally Posted by Gadorach
      After I connected the Teensy the first time, using 30AWG Kynar at ~8cm, I was presented with Manufacturer Unknown (0x90) and Flash ID Unknown (0x909090).
      I then proceeded to rewire everything with 26AWG, which yielded the very same results. Then I tried to switch the power source over to 5v to read the NOR, just to see if it would work. As such, I disconnected the 3v3 and powered down the console. In the off state, NORway returned (0xb4) and (0xf4f4f4) respectfully. If the console was turned on though, it returned to the previous (0x90) and (0x909090). I've since returned to 3v3 from the board and disconnected the USB power supply. If any one has some ideas, I'd love to hear them. Thanks for your time!

      - Gadorach
      First of all: don't cross-post your questions. And don't expect an answer within a couple of hours. Someone will answer eventually.

      Have you tried using a voltage regulator? If you have one, try that first.

      If you don't have one and your console isn't bricked (i.e. it boots to xmb), you can try this (Teensy fed with 3.3V from console):
      1. Disconnect Teensy from usb, remove power cord from console.
      2. Connect console to power, turn it on.
      3. Let it boot to xmb and wait another minute.
      4. Connect Teensy to usb.
      5. "NORway.py COMx"
      6. Check whether chip type is now recognized.
      7. If it is, issue a "NORway.py COMx vwriteword patcheddump.bin"
      8. If all goes well continue with the rest of the standard downgrade process (fsm, etc.)

      I just figured that apparently some mobos don't supply 3.3V to the nor when tristate is pulled low at boot time. Hence the unknown chip type. But be warned, this is still experimental and you might have only one try to do this. If your console doesn't boot anymore after a failed write attempt or wrongly patched dump, you might have to power it externally by using e.g. an atx psu to be able to flash again.

      -- judges

    704. Gadorach
      01-17-2013
      08:40 AM
      704

      Originally Posted by judges
      First of all: don't cross-post your questions. And don't expect an answer within a couple of hours. Someone will answer eventually.

      Have you tried using a voltage regulator? If you have one, try that first.

      If you don't have one and your console isn't bricked (i.e. it boots to xmb), you can try this (Teensy fed with 3.3V from console):
      1. Disconnect Teensy from usb, remove power cord from console.
      2. Connect console to power, turn it on.
      3. Let it boot to xmb and wait another minute.
      4. Connect Teensy to usb.
      5. "NORway.py COMx"
      6. Check whether chip type is now recognized.
      7. If it is, issue a "NORway.py COMx vwriteword patcheddump.bin"
      8. If all goes well continue with the rest of the standard downgrade process (fsm, etc.)

      I just figured that apparently some mobos don't supply 3.3V to the nor when tristate is pulled low at boot time. Hence the unknown chip type. But be warned, this is still experimental and you might have only one try to do this. If your console doesn't boot anymore after a failed write attempt or wrongly patched dump, you might have to power it externally by using e.g. an atx psu to be able to flash again.

      -- judges
      Thanks for the information, I'll try it shortly. Also, I do apologize, but I was planning to delete my post in this thread as I felt like it was hijacking over anything else. Hence why I started a new thread. I only found out that I couldn't delete my post after the fact. I didn't expect immediate help, that would've been completely unreasonable.

      Else, as I was unaware that the ProgSkeet 1.2 wouldn't write to the NOR, I attempted it at first, and now the console does not boot, but instead either hangs at a green light or shuts down after a few seconds and blinks red. As I said though, I verified my dumps so it should be safe, but I'd assume that I now need to power the NOR externally in order to make it recognizable?

      Again, thanks for your time and sorry for the misunderstanding.

      Edit: Just thinking about it, but could I use the ProgSkeet to supply the required 3.3v for both the NOR and Teensy++?

      - Gadorach

    705. judges
      01-17-2013
      09:45 AM
      705

      Originally Posted by Gadorach
      As I said though, I verified my dumps so it should be safe, but I'd assume that I now need to power the NOR externally in order to make it recognizable?

      Edit: Just thinking about it, but could I use the ProgSkeet to supply the required 3.3v for both the NOR and Teensy++?
      No, you cannot use progskeet to power nor and teensy. You would have to connect ps3's 3.3V and GND to an external power supply that is capable of providing at least 2A@3.3V. Teensy will also be powered by this. Of course console must not be connected to power cord. The thing is that you cannot just power the nor. Other parts receive power through the 3.3V rail as well, hence the 2A requirement.

      But you can try this first: http://www.ps3hax.net/showthread.php...070#post284070

      -- judges

    706. Gadorach
      01-17-2013
      10:02 AM
      706

      Originally Posted by judges
      No, you cannot use progskeet to power nor and teensy. You would have to connect ps3's 3.3V and GND to an external power supply that is capable of providing at least 2A@3.3V. Teensy will also be powered by this. Of course console must not be connected to power cord. The thing is that you cannot just power the nor. Other parts receive power through the 3.3V rail as well, hence the 2A requirement.

      -- judges
      Ah, so the ~500mA isn't enough, that's disappointing. I have a few ATX supplies I wouldn't have a problem with tearing down to get the power, but I've heard that the 3.3v from ATX supplies is only for sense, and therefore completely useless for power. Do you have any suggestions as to an item that would provide the required supply and would be readily available?

      Edit: I should also mention that I tried the other method to no avail previously.
      Edit2: I have multiple Xbox 360's here, do you think I could use one of the unswitched 3.3v outputs to power everything? That would be ideal, assuming it has enough of a load capacity.

      - Gadorach

    707. judges
      01-17-2013
      10:38 AM
      707

      Originally Posted by Gadorach
      I have a few ATX supplies I wouldn't have a problem with tearing down to get the power, but I've heard that the 3.3v from ATX supplies is only for sense, and therefore completely useless for power. Do you have any suggestions as to an item that would provide the required supply and would be readily available?

      Edit2: I have multiple Xbox 360's here, do you think I could use one of the unswitched 3.3v outputs to power everything? That would be ideal, assuming it has enough of a load capacity.
      I'm not much of an electronics guy, so I can't give a definite answer to the xbox psu's. But as long as it's stabilized 3.3V, it'll probably work.

      Guess it depends on the ATX supply. I've got an ATX2.0 supply here that provides up to 30A@3.3V. Just have a look at the label. You might also wanna check out this (load resistor required): http://www.ps3devwiki.com/wiki/Talk:...h_external_PSU

      -- judges

    708. Gadorach
      01-17-2013
      11:04 AM
      708

      Originally Posted by judges
      I'm not much of an electronics guy, so I can't give a definite answer to the xbox psu's. But as long as it's stabilized 3.3V, it'll probably work.

      Guess it depends on the ATX supply. I've got an ATX2.0 supply here that provides up to 30A@3.3V. Just have a look at the label.

      -- judges
      My 250W ATX PSU here is rated at 14A on the 3.3v rail, which is amusingly higher than it's 12v rail, which is only rated at 8A. It only needs the soft switch tied to ground to start up, so I have it all set and ready. I'll try it out in a few minutes, when my soldering iron finishes heating up again. Thanks a bunch for the suggestions and, with any luck, this will solve my problem.

      Ok, well, I got everything hooked up, and the power supply is outputting the correct voltage, but I'm still getting (0xf4) and (0xf4f4f4), which is what I got from the ProgSkeet powering it as well. I'm rather confused as 14.0A on +3.3v should be doing the job just fine. I've heard of others not being able to collect the NOR identity with newer versions, and some recommended 0.4b12. I was unable to locate that version, however, and therefore have no idea if that would work or not. If the chip was blank or full of garbage data, I'd still assume it would report it's chip versions just fine as well, so the ProgSkeet being retarded shouldn't have anything to do with it either. Any other ideas?

      - Gadorach

      PS. I have plenty of images, but as I'm yet to reach a 15-post count, I can't post any of them, or direct links to them. Should you wish to see my installation, here's a broken-up link to my album. Link: imageshack(dot)us/g/1/9969618/

    709. DebugBrain
      01-17-2013
      11:38 AM
      709

      Hello, I also use teensy 2 + + from July 2011 I consider it the most reliable flasher available on PS3 (THANKS TO JUDGES FOR NORWAY VERSIONS!) I use a different setup on samsung K8Q2815UQB (even today) and I have always gotten good dump.

      Teensy without voltage regulator,
      no short on the 3v pad
      not cut the track of 5v pad

      If you've already cut the track pad 5v make a short to restore, (example in the attached immage!)


      Connect the VCC pad on the motherboard to the 5v pad on the teensy, other wires according to the diagram

      On samsung K8Q2815UQB I always use norway-04beta12!

      Power cable connected, Ps3 off, usb cable disconnected!

      PS: Now careful, these three steps should be done in quick succession
      1) Turn on the ps3 from power button
      2) very quickly connect the USB cable to the teensy
      3) very quickly press and hold the power button, the ps3 immediately turns off, all LEDs off (this is normal)

      unplug the power cable (not neccesary but better to do it)

      type norway.py COM (your COM number) to verify that the NOR has been recognized correctly.
      enjoy

      This method works on ps3 with ylod and briked, no need to use an external power supply.
      Note: In the example image shows a teensy 1 where 5v pad and 3v pad positions are inverted respect their position on teensy2++ board, not to be confused just follow the codes printed on the teensy2++ board

      ps: sorry for my bad english!

    710. Gadorach
      01-17-2013
      11:48 AM
      710

      Originally Posted by DebugBrain
      Hello, I also use teensy 2 + + from July 2011 I consider it the most reliable flasher available on PS3, I use a different setup on samsung K8Q2815UQB (even today) and I have always gotten good dump.

      Teensy without voltage regulator,
      no short on the 3v pad
      not cut the track of 5v pad

      If you've already cut the track pad 5v make a short to restore, (example in the attached immage!)


      Connect the VCC pad on the motherboard to the pad on the 5v teensy, other wires according to the diagram

      On samsung K8Q2815UQB I always use norway-04beta12!

      Power cable connected, Ps3 off, usb cable disconnected!

      PS: Now careful, these three steps should be done in quick succession
      1) Turn on the ps3 from power button
      2) very quickly connect the USB cable to the teensy
      3) very quickly press and hold the power button, the ps3 immediately turns off, all LEDs off (this is normal)

      unplug the power cable (not neccesary but better to do it)

      type norway.py COM (your COM number) to verify that the NOR has been recognized correctly.
      So you recommend supplying the NOR with +5v for dumping and flashing? I assume it's tolerant of the +5v then. I can try that in a matter of minutes, I just need to re-attach the PSU and solder a few things again. The only thing I lack is the 0.4b12 files. If you would be so kind as to upload them for me, or otherwise direct me to them, I would be most gracious.

      Thank you for your suggestion!

      - Gadorach

    711. DebugBrain
      01-17-2013
      12:30 PM
      711

      I have three ps3 slim with samsung kB .... of these I have always used this method (100% working)

      If the first attempt failed to do correctly recognize the NOR disconnect usb to teensy and reconnect the power cable to reset the status leds (ps3off =red LED on) and then try again, after one or two tries you learn immediately

      give me time to upload the file and then send you the download link via pm

      ps: excuse my slowness but English is not my language


      EDIT:ok, pm sent, let me know
      ************* [ - Post Merged - ] *************
      I forgot! VERY IMPORTANT! Before overwriting the NOR... do some dumps to verify that the teensy is properly installed, (if do valid dumps teensy installation is correct!) then type (norway.py COM (x) erasechip) to delete the entire NOR, then type (norway.py COM (x) writeword (yourdump) . bin to flash the NOR

    712. Gadorach
      01-17-2013
      01:08 PM
      712

      Originally Posted by DebugBrain
      I have three ps3 slim with samsung kB .... of these I have always used this method (100% working)

      If the first attempt failed to do correctly recognize the NOR disconnect usb to teensy and reconnect the power cable to reset the status leds (ps3off =red LED on) and then try again, after one or two tries you learn immediately

      give me time to upload the file and then send you the download link via pm

      ps: excuse my slowness but English is not my language


      EDIT:ok, pm sent, let me know
      I'm currently without success. The console turns on, USB is plugged in, and then I quickly hit the power button again, which makes the console beep, shut down, and then flash the red status LED constantly. From there, whether I un-plug the console first or not, it always reports (0Xfd) and (0xfdfdfd). I'll keep trying, but this is my 11th attempt already. If you have any other ideas, I'm open to suggestions.

      I should probably note that when I do it wrong, it only displays as (0x90) and (0x909090), in opposition to (0xfd) and (0xfdfdfd).

      - Gadorach

    713. DebugBrain
      01-17-2013
      01:36 PM
      713

      You must be very fast, keep the usb cable very close to the teensy,
      press the power button and immediately connect the teensy, and immediately press old the power button again
      I assure you that it works perfectly, you only need to make sure that the teensy is installed properly and be quick trick in the ignition.
      I created a teensy external interface on all my three ps3 to use the teensy when I want, has worked always on all three ps3

    714. Gadorach
      01-17-2013
      08:51 PM
      714

      Originally Posted by DebugBrain
      You must be very fast, keep the usb cable very close to the teensy,
      press the power button and immediately connect the teensy, and immediately press old the power button again
      I assure you that it works perfectly, you only need to make sure that the teensy is installed properly and be quick trick in the ignition.
      I created a teensy external interface on all my three ps3 to use the teensy when I want, has worked always on all three ps3
      So, I take it 0.5 seconds per action isn't good enough? I tried a good number of times, going progressively more quickly each time, and It still never completely shut off, like you described. I'm only able to get the beep followed by the flashing red light.

      - Gadorach

    715. judges
      01-18-2013
      04:19 AM
      715

      Originally Posted by Gadorach
      So, I take it 0.5 seconds per action isn't good enough? I tried a good number of times, going progressively more quickly each time, and It still never completely shut off, like you described. I'm only able to get the beep followed by the flashing red light.

      - Gadorach
      What [MENTION=234430]DebugBrain[/MENTION] describes here is basically CrackMyDay's method posted earlier (http://www.ps3hax.net/showthread.php...070#post284070).

      Difference is that he uses 5V, which I wouldn't recommend combined with Teensy being fed with 3.3V from the console. By doing this you put 5V USB straight to console's 3.3V rail, which is powered with 3.3V at the same time. Cant be good.

      And just to make this clear, this is not a Samsung QB issue, but a mobo issue. With most boards NORway writes Samsungs just fine.

      Just had a look at the images you've posted (w/ atx supply). Your wiring looks a little fishy. GND wires look fine, but the 3V wires bother me a little. Hard to recognize, but it looks like you feed 3V from atx to one of Teensy's volatge reg. pads and then another wire from Teensy's 3V (bridged) pad to the console. In other words you're routing the 2A current through a tiny board trace of Teensy. Can only result in a voltage drop (best case). Connect one 3V wire from atx directly to mobo and another one to Teensy. If atx is powered on you should measure the voltage on the mobo. Also I guess you didn't use a load resistor. Check the wiki link I've posted earlier. Also check Teensy's 5V pads (measure). Looks like there's a little bit of solder on it and bridging it.

      Back to CrackMyDay's method. I've never tested it before, but yesterday I did. Does not only work for Samsung QBs, but also for mine (Spansion P, JSD-001). Although I have to admit that I have absolutely no idea where the console gets its 3V from when disconnected from power. But I can flash fine with power cord removed and no voltage regulator installed (5V trace cut, 3V pads bridged, wire from Teensy's 3V pad to console's Vcc).

      This is what I do:
      1. Power off console (unplug power cord)
      2. Connect Teensy to USB (not yet recognized by PC)
      3. Power on console (plug in power cord, push standby button)
      4. Teensy is now recognized by PC
      5a. (optional, I didn't do this) Press and hold standby button until console turns off (might take a while)
      5b. Unplug power cord (Teensy is still recognized by PC)
      6. "NORway.py COMx" returns mf and chip id
      7. Dump/Flash/whatever

      Before or after step 6 you might want to measure voltage on the mobo. Should be >3V.

      -- judges

    716. DebugBrain
      01-18-2013
      08:53 AM
      716

      Hello [MENTION=193105]judges[/MENTION], you're right, basically what I described is the method Crackmyday, I use this from July 2011, I always used only this, I understand that it may seem strange due to 5v power supply but it is the truth, the first time I did it by mistake, I forgot to make the short on the 3v pad instead of the 5v pad but since it worked I did not realize the error, I found out the error a long time after, so I continued to use that method.
      on my teensy I installed a button to switch the 3v pad or 5v pad but the wire between vcc and teensy is always connected, I can use all the two methods, pressing that button the teensy works to 5v and I can program it ease on my pc

    717. Gadorach
      01-18-2013
      10:28 AM
      717

      Originally Posted by judges
      What [MENTION=234430]DebugBrain[/MENTION] describes here is basically CrackMyDay's method posted earlier.

      Difference is that he uses 5V, which I wouldn't recommend combined with Teensy being fed with 3.3V from the console. By doing this you put 5V USB straight to console's 3.3V rail, which is powered with 3.3V at the same time. Cant be good.

      And just to make this clear, this is not a Samsung QB issue, but a mobo issue. With most boards NORway writes Samsungs just fine.

      Just had a look at the images you've posted (w/ atx supply). Your wiring looks a little fishy. GND wires look fine, but the 3V wires bother me a little. Hard to recognize, but it looks like you feed 3V from atx to one of Teensy's volatge reg. pads and then another wire from Teensy's 3V (bridged) pad to the console. In other words you're routing the 2A current through a tiny board trace of Teensy. Can only result in a voltage drop (best case). Connect one 3V wire from atx directly to mobo and another one to Teensy. If atx is powered on you should measure the voltage on the mobo. Also I guess you didn't use a load resistor. Check the wiki link I've posted earlier. Also check Teensy's 5V pads (measure). Looks like there's a little bit of solder on it and bridging it.

      Back to CrackMyDay's method. I've never tested it before, but yesterday I did. Does not only work for Samsung QBs, but also for mine (Spansion P, JSD-001). Although I have to admit that I have absolutely no idea where the console gets its 3V from when disconnected from power. But I can flash fine with power cord removed and no voltage regulator installed (5V trace cut, 3V pads bridged, wire from Teensy's 3V pad to console's Vcc).

      This is what I do:
      1. Power off console (unplug power cord)
      2. Connect Teensy to USB (not yet recognized by PC)
      3. Power on console (plug in power cord, push standby button)
      4. Teensy is now recognized by PC
      5a. (optional, I didn't do this) Press and hold standby button until console turns off (might take a while)
      5b. Unplug power cord (Teensy is still recognized by PC)
      6. "NORway.py COMx" returns mf and chip id
      7. Dump/Flash/whatever

      Before or after step 6 you might want to measure voltage on the mobo. Should be >3V.

      -- judges
      I was trying multiple methods, and I was using a device I had lying around for the forced load, which worked just fine. I tried multiple methods for powering both the teensy and console at once, and although it may look like it's soldered to the TO-220 pads, it's not. I soldered it between the 3v3 pads. I only noticed later on in the pictures that it looked like I did otherwise, but that's not the case.

      It was going [PSU @3.3v-14A] -> [3.3v pads on Teensy++] -> [TO-220 source pad] -> [Console VCC] as a path.

      I don't think the amperage would've dropped significantly from that, as the traces are large enough to carry at least 5A, and are right beside each other. I'm willing to try the other way as well, but it'll take a few minutes to set everything up. I hope I'm just doing it wrong, but only time will tell.

      If it really comes down to it, I could just solder directly to the NOR legs with short 30AWG Kynar, ~8cm should be fine, even for NOR.

      - Gadorach

    718. DebugBrain
      01-18-2013
      10:49 AM
      718

      Originally Posted by judges
      Back to CrackMyDay's method. I've never tested it before, but yesterday I did. Does not only work for Samsung QBs, but also for mine (Spansion P, JSD-001). Although I have to admit that I have absolutely no idea where the console gets its 3V from when disconnected from power.
      -- judges
      When ps3 power cable is disconnected the NOR takes power from teensy, but also crackmyday method with the short on 3v pad supply the NOR at 5v because there is no voltage regulator installed on teensy

    719. Gadorach
      01-18-2013
      10:57 AM
      719

      Originally Posted by DebugBrain
      When ps3 power cable is disconnected the NOR takes power from teensy, but also crackmyday method with the short on 3v pad supply the NOR at 5v because there is no voltage regulator installed on teensy
      Not really... If you follow the traces, you'll find that the 5v from USB is completely disconnected when the 3.3v traces are connected (and the 5v pad is cut, of course). Not only is there no power from the Teensy++, but the board is supplying the power for both the NOR and Teensy++ in that configuration.

      - Gadorach

    720. DebugBrain
      01-18-2013
      12:21 PM
      720

      ok, I can try but I trust what you said, the important thing is that it works, if you want to play it safe doing the short on 3v pad then follow the instructions to judges but when you turn on the ps3 press again the power button and hold it until the console turns off, then verify that the teensy be recognized.
      If you did well welds and does not have any wires reversed, the procedure should work easily, in fact you need to connect the USB cable after you have unplugged the power cable and before you press the power button

    721. judges
      01-18-2013
      12:41 PM
      721

      Originally Posted by Gadorach
      It was going [PSU @3.3v-14A] -> [3.3v pads on Teensy++] -> [TO-220 source pad] -> [Console VCC] as a path.

      ...as the traces are large enough to carry at least 5A...
      Didn't I say that? Don't know what you consider large traces, but the trace between 3.3V pad and TO-220 pad is really tiny and it carries all the current to the console.

      Originally Posted by Gadorach
      If it really comes down to it, I could just solder directly to the NOR legs with short 30AWG Kynar, ~8cm should be fine, even for NOR.
      Don't see how that changes the situation. Then you should rather consider to unsolder the nor and flash it off-board.

      So, did you measure the voltage at the nor when powering with atx? Guess that's the first thing to do..
      ************* [ - Post Merged - ] *************
      Originally Posted by Gadorach
      Not really... If you follow the traces, you'll find that the 5v from USB is completely disconnected when the 3.3v traces are connected (and the 5v pad is cut, of course). Not only is there no power from the Teensy++, but the board is supplying the power for both the NOR and Teensy++ in that configuration.
      Not really either. According to the schematics (http://www.pjrc.com/teensy/schematic.html) the i/o lines UVCC and VBUS are still powered by USB. And that certainly makes sense, the power must come from somewhere when console is turned off. I just don't know why it's 3V and not 5V. Must be some internal Atmel magic.

      -- judges

    722. Gadorach
      01-18-2013
      03:25 PM
      722

      Originally Posted by judges
      Didn't I say that? Don't know what you consider large traces, but the trace between 3.3V pad and TO-220 pad is really tiny and it carries all the current to the console.



      Don't see how that changes the situation. Then you should rather consider to unsolder the nor and flash it off-board.

      So, did you measure the voltage at the nor when powering with atx? Guess that's the first thing to do..
      ************* [ - Post Merged - ] *************


      Not really either. According to the schematics the i/o lines UVCC and VBUS are still powered by USB. And that certainly makes sense, the power must come from somewhere when console is turned off. I just don't know why it's 3V and not 5V. Must be some internal Atmel magic.

      -- judges
      Ah, I didn't look over the schematics, I just traced the visible components. I'd assume that there was a via under one of them that ate from the USB's +5v, I didn't think to check. I'd assume the voltage difference is due to many modern chips being able to push different voltages over certain pins depending on the configuration. As only the chip itself would need the +5v, it would have had +3.3v over all the other internally configured IO pins. But what do I know, I've never worked with an ATMEL chip before.

      On the topic of lifting the chip, I most certainly would, if I had a reader for them. But alas, as I do not, I have to use these methods. Now, don't get me wrong, I'm not saying these are inferior by any means, just that they take more work to, well, make them work. I'll try again, including a complete rewiring of the chip, and report my findings in a few hours. Hopefully that will solve the problem.

      Thanks again for all your help thus far, to the both of you.

      - Gadorach

      Edit: I should probably mention that I did later try the [PSU] -> [PS3 VCC] + [PSU] -> [Teensy++ TO-220 Pad] on separate wires, which yielded the same results.