OFFICIAL PS3HAX TUTORIAL CAN BE FOUND HERE: http://www.ps3hax.net/2011/08/noob-tutorial-how-to-downgradeflash-your-ps3-from-firmware-3-70-to-3-55-via-progskeetteensy-and-install-3-55-kmeaw-cfw/
Important updates to this article follow below. Spanish Developer dospiedras1973, has released his method to downgrade Slim PS3 Consoles on firmware 3.70, here is a roughly translated native spanish-to-english quote from the source:
Hello everyone, i finally got it, we have a downgrader for slims consoles , this time a bit different that i did with fat models, i made it by the two flashers, progskeet and teensy ++,dope
We need:
fat or slim console with nor updated to 3.70 “DO NOT TRY With ANOTHER VERSION”Solution to write and read the nor of the console ( flasher progskeet or teensy + +)
hxd program (which I use to edit hex)
FlowRebuilder v.4.1.3.2
a cold beer (this is important)
Http://pastebin.com/yuvJ5Leh Downgrade.binFirst we dump our NOR with a flasher, the file size must be “16,777,216 bytes” no byte more or a byte less, take several to be absolutely sure of what you do..get the dump “example jakemcallister.bin”and we have to get it in flowrebuilder to make it readable,the option is called bytereverse dump and extract
we do it and we will have a file but the extension will be bin.REV open it with the hxd and take out our personal data of the console EID, BOOTLOADER, CSID and METLDR
no need to put more data
We get it with the following way:in this case we get our METLDR in our prepatched image for downgrade attached in this tutorial
inside the folder where flowrebuilder had placed our.rev also has created another folder called “nameofthedump.EXT”in there are our personal files of our console and we need to get some to place em inside the pre-patched image that i attachedOpen the hxd and open downgrade.bin and the metldr file that is inside the folder asecure_loader, we pick the tab on the hxd metldr and copy all the HEX content to get in inside the downgrade.bin
press control + g and write “820″thats the position of the metldr right click on the first line of the position 820
And choose “paste writing” and in the same way we introduce the other ones
the files to get in are
:METLDR: offset“810″ size “E960″
BOOTLOADER_0 Offset“FC0000″ size “40000″
EID: Offset “2F000″ size “10000″
CISD: Offset“3F000″ size “800″then we take the downgrade.bin with the saved changes and we get in flowrebuilder with the option bytereverse dump and extract
This time the program will give us a error, but is a normal error, in fact is okay and will give us a file called downgrade.bin.REVAnd thats the file you have to get in in the “flash” console
if all went well at writing ,turn on the console and you will see in the screen press the ps button or in English push ps button, DONT PRESS ANYTHING, turn off the console and put it in factory service mode, once done we need to put the correct file system for 3.55 lv2diag of jaicrab without reader and a special cfwlv2diag:http://www.logic-sunrise.com/telecharge … icrab.html
cfw: http://pastebin.com/03MFDLGV turn onthe console with the usbstick with these two files in the right usb port (in the last) of the console and it will shut down for 10 / 15 minutes, turn on the console without any usb connected to verify that you did it correctly it will take you to xmb,
If all went well turn off the console and put your lv2diag
FILE2 of this pack:http://pastebin.com/gGETcxMRthe console will turn on for 20 seconds will turn off itself and CONGRATULATIONS you have your console in functional 100% and kmeaw cfw 3.55 100%
Thanks to
iGiTaLAnGeL (Tester with progskeet)
Glevand & mfw builder team (cfw)
NDT (Assistant) is a very good person
JaiCraB (lv2diag without reader)
Robs1 (my guide with the nor flash)
EussNL (his great support in the wiki that I use every day PS3DEVWIKI.COM)
Defyboy (for creating ps3devwiki)
To the whole channel darkps3 from irc-hispano.org for their support and many hours of testing we have hit hard mother****ers!
DemonHades (because if you had not post on your website with the lie you said about me, I had not met DigitalAngel or uf6667and these two helped me a lot)and finally to the people who asked me in private to place a donate paypal button
greetings and from now on i will resume my work with the dual nand and that dump 3.6x that gives me so many problems hehehe
Ive updated the position of METLDR that was misplaced offset 810 ” e960″size
UPDATE 1:
dospiedras1973 has updated the post with the following new details:
PLEASE UPDATE NOTICE:
i fixed metldr location and leght please update
METLDR : offset “810″ size “E960″
UPDATE 2:
PS3Hax member mximposter has brought us a correct and actual Spanish to English translation, the big quote box above has been edited to reflect this change.
UPDATE 3:
Dospiedras1973 was kind enough to post this update here on PS3HaX:
psicoleo, uf6667 and I have made an application to automate the use hex editors to modify the downgrade.bin
http://www.multiupload.com/AE8W5HADWM
bytereversed you put your flash in donor and recipient and will downgrade.bin in the process hxd without … xD
you not need hex edit anymore…
and “If at any time during the downgrade DISPLAY RED (RSOD) STOP PROCESS IMMEDIATELY I WILL RELEASE A FIX SOON” Please be patient
08-16-2011
06:37 PM
wtf thats so complicated
08-16-2011
06:41 PM
LOL..... It may get easier, but it will never be a simple job me thinks
08-16-2011
06:41 PM
That is awesome. Ignore the ***** complaining about how complicated it is. Good work
08-16-2011
06:42 PM
No offense to anyone but this kinda looks complicated
08-16-2011
06:44 PM
It's complicated, but if you want to downgrade from 3.70 it's not an easy way to do it.
P.s: If PS3hax needs some spanish translator, Im all in. Cause i read some incorrectiones on the translation.
Keep it coming!! i love this
08-16-2011
06:47 PM
I do agree that we need some Spanish translators, because Google Translate sucks.
08-16-2011
06:51 PM
can i use the progskeet chip on 2 ps3s?
08-16-2011
06:58 PM
Translate it with pleasure
08-16-2011
07:13 PM
can anyone explain it in a simpler way ???
08-16-2011
07:14 PM
cant find “nombredeldump.EXT” i bytereversed and got the bin.REV but no EXT? also, can someone make a more comprehensible tut. anyway, this is great work thank you.
08-16-2011
07:16 PM
Very nice, but if someone could make a proper translation, this is really hard to understand.
Not very noob friendly either
08-16-2011
07:19 PM
What is the difference with this method then the already known swapping core os method? Just wondering
08-16-2011
07:26 PM
Beautiful and if u need translation , tell me, i speak spanish, native language
08-16-2011
07:34 PM
:O NICE! Got released pretty quick. 400th POST...umm yeah!
08-16-2011
07:53 PM
How wonder how many people will try to do this! but good job btw!
08-16-2011
08:19 PM
Do you guys think they will come out with a way to dowgrade that is easy liek the old usb flash drives method someday?
08-16-2011
08:38 PM
I am willing to give this a go, I am pretty good with computers and following instructions, but I got a question.
I have a Maximus AVR 1.0 from when I used to have 3.41 firmware on my PS3
I remember Maximus AVR being very similar to the Teensy in hardware, so I bought the Maximus since Teensy were sold out.
You guys think that flashing the Maximus would work like the Teensy++ or do I need to wait for someone to make a Maximus compatible bios to flash?
EDIT: Just checked out images of ProgSkeet and Teensy++ I am guessing this method is not SOLDER LESS and that is why it requires these boards?
08-16-2011
08:57 PM
Video tutorial please!!!!
08-16-2011
09:11 PM
So, is this worth upgrading from 3.61 to 3.70 to try, or is it something that noobs shouldn't be attempting?
08-16-2011
09:14 PM
In my opinion, its not a noob friendly thing to do. Anyway, if you are at 3.61 you cant homebrew and you cant go online so I dont know what you want to save staying at 3.61
08-16-2011
09:23 PM
Theres most likely going to be some noob friendly tutorials in the morning anyways.
08-16-2011
09:24 PM
Nvm that was fake
08-16-2011
09:30 PM
edit: lol i didn't see your edit.
08-16-2011
09:31 PM
Im just going to go ahead and say no, if it was we wouldn't be looking at news about downgrading. Also start a new thread if your going to go off topic.
08-16-2011
09:58 PM
A lot of those steps could easily be automated...but the hard part (the soldering) is still going to be there.
Looking forward to the english translation!
08-16-2011
10:15 PM
please, if anyone has one of those new chech-3000 models, that are hack proff, test this and let us know!
haha
08-16-2011
10:24 PM
This is easier than a virgin on prom night. Although I do have leet soldering skills, and my progskeet already installed.
08-16-2011
10:56 PM
Im translating properly right now
08-16-2011
10:57 PM
Im a noob but i want to give this a try do i need a teensy or progskeet board?
08-16-2011
11:15 PM
Well I don't live in the us so I can't but the flasher, so I'm hoping someone figures out how to do it qith a normal usb drive.without having to but anything. Even though chances for this are very very VERY unlikely, still keep my hopes up
08-16-2011
11:19 PM
PLEASE UPDATE NOTICE:
i fixed metldr location and leght please update
METLDR : offset "810" size "E960"
this is dangerous error! please fix in the mainpage
08-16-2011
11:23 PM
08-16-2011
11:33 PM
08-16-2011
11:36 PM
Here's my translation, this stuff took me like 40 minutes to do, sh!t
[SPOILER]Hi everyone, finally, we have a downgrade method for slim consoles and this time is different
from the method fat models followed. I was able to accomplish this with 2 flashers, Teensy++
and progskeet. Let's get started!
What we'll need:
Slim or Fat console with 3.70 updated NOR (DO NOT TRY WITH OTHER VERSIONS)
A way to be able to write and read from the console's NOR (Teensy++ flasher or progskeet)
Application: HXD (this is what I use to edit hex files)
FlowRebuilder v.4.1.3.2
a cold beer (important point)
Downgrade.bin http://pastebin.com/yuvJ5Leh
We first dump our NOR with a flasher, the file has to be exactly "16.777.216 bytes", not one
byte less, not one byte more. I suggest you dump a couple of them just to be sure what you're
doing.
We take our dump (example: "josejuan.bin")
and we put it in Flowrebuilder so it becomes a readable file (bytereverse), the option is
called "bytereverse and extract nor dump"
Once we do it, it'll create a file BUT the extension will end in .bin.REV
So we open it with HXD and we take out our personal data EID, BOOTLOADER , CSID and METLDR, no
need to put more
So we take it out like this:
in this case, we'll choose to put our METLDR in the prepatched image for downgrade that I
attached with this tutorial.
In the folder where Flowrebuilder has put our .rev file, it also created another folder called
"nombredeldump.EXT" and that's where our console's personal files are, so what we need to do
now is grab some of them and put them in the prepatched image that I attached.
So in HXD, open downgrade.bin and the metldr file that is inside the asecure_loader folder.
and select the metldr tab in HXD and copy all its content in HEX and to put (introduce) it into
downgrade.bin, press CTRL+G and write location 820 which is the METLDR one, we right click in
the first line of location 820 and we choose "paste while writing" do the same thing with the
rest, the files that need to be introduced are the following ones:
METLDR : Location "810" size "E960" (Updated metldr location)
BOOTLOADER_0 Location "FC0000" size "40000"
EID : Location "2F000" size "10000"
cISD : Location "3F000" size "800"
Then we grab downgrade.bin with changes saved and we put it in flowrebuilder with the option
"bytereverse and extract nor dump" enabled. THIS TIME, THE PROGRAM WILL GIVE US AN ERROR but
its supposed to be like that, heck, if you get the error it'll mean you did it right and it'll
create a file named downgrade.bin.REV and this is what we're going to put in the "flash"
console.
If all went well, when you're finished writing and turn on the console, it should come out
"press ps button", DO NOT PRESS ANYTHING! Turn off the console and put it into factory service
mode. Once done, we'll need to put the correct file system for 3.55 with jaicrab's lv2diag,
without reader and special cfw.
lv2diag: http://www.logic-sunrise.com/telecha...-jaicrab.html1
cfw : http://pastebin.com/03MFDLGV
Turn on the console with a pendrive that has those 2 files inserted in the far right USB plug,
and the console should turn off about 10/15 minutes in. Now, turn on the console without USBs
plugged and see if it'll take you to the XMB correctly. If all went well, turn off the console
again and put the lv2diag FILE2 from this pack:
http://pastebin.com/gGETcxMR
The console should turn on and 20 seconds in it will turn off by itself. Congratulations, now
you're console has been succesfully downgraded to CFW 3.55 Kmeaw functioning 100%.
Thanks to:
DiGiTaLAnGeL (Progskeet Tester)
Glevand & mfw builder team( cfw )
NDT (Helper) he's a really good guy
JaiCraB ( lv2diag without reader )
Robs1 ( my guide with nor flash)
EussNL (for his great support with PS3DEVWIKI.COM which I read everyday)
Defyboy (for creating ps3devwiki)
To all the #darkps3 channel from irc-hispano.org for their help and countless hours of testing
that we've gone through!!
DemonHades (because thanks to the lie that he said about me that he posted front page in his
site I would have never known DigitalAngel or uf6667 and these 2 have helped me a lot!)
Finally, people has asked me via PMs for me to put a Paypal donations button up, well here you
have it
https://www.paypal.com/cgi-bin/websc...=QJN5EYNQJ6H62
Greetings and now I will resume my work with the dual nand and that 3.6x dump that gives me so
many headeches, heheh[/SPOILER]
08-16-2011
11:43 PM
My translation, I hope it is useful to someone. English is native language.
[SPOILER]
Hi all,
I finally got it. We now have a downgrader for slim consoles. This time it's different from how it was done on fat consoles. I've tested it with both flashers, Teensy++ and progskeet.
We'll need:
- A slim or fat ps3 on firmware 3.70. DO NOT ATTEMPT ON ANY OTHER VERSION
- Some way to read and write the console's NOR. e.g., the Teensy++ or progskeet flasher
- the program 'hxd', which we'll use to edit .hex archives
- FlowRebuilder v.4.1.3.2
- a cold beer ( this is important )
- Downgrade.bin http://pastebin.com/yuvJ5Leh
First, we dump our NOR with a flasher; the resulting file must be exactly 16,777,216 bytes in length. No more, no less! Dump it multiple times to make sure you know what you're doing.
We take the dump, <whatever>.bin and load it in FlowRebuilder to transform it into a usable file. The option is called "Bytereverse and extract NOR dump". This will create a new file with a .bin.REV extension. We open it in hxd and get our unique console data:
- Console EID,
- BOOTLOADER,
- CSID
- METLDR
None of others are needed.
First we'll insert our METLDR into the prepared image linked above.
In the same folder where FlowRebuilder created the .bin.rev, it will also have created a folder named "<whatever>.EXT". Inside are files containing our unique console data, and we have to grab some and copy them into the "downgrade.bin" at the appropriate offsets.
Use hxd to open "downgrade.bin" as well as the "metldr" file from the "asecure_loader" folder.
In hxd, choose the "metldr" tab and select and copy the entire contents in HEX.
Switch back to "downgrade.bin" and press Ctrl+G to GoTo the offset for pasting the metldr contents: 810.
Right-click at the beginning of the line at position 810 and choose "Paste and Overwrite" (or something like that).
Do this for each of the files:
METLDR
Offset: 810, Length: E960
BOOTLOADER_0
Offset: FC0000, Length: 40000
EID
Offset: 2F000, Length: 10000
cISD
Offset: 3F000, Length: 800
( You can verify the length in hxd's status bar. )
Next, take downgrade.bin, with all our changes saved, and load it in FlowRebuilder with the "Bytereverse and extract NOR dump" option. THIS TIME THE PROGRAM WILL GIVE AN ERROR but that's ok. It will create a file called "downgrade.bin.REV", and this is the file we'll use to reflash the PS3.
If everything has gone well, after reflashing, turn on the PS3, and it should say "Push PS button." BUT DON'T PUSH ANYTHING!! Turn off the console, and we'll put it in Factory Service Mode once. We need to put on the right file system for 3.55 with jai crab's lv2diag, and a special cfw.
lv2diag:
http://www.logic-sunrise.com/telecha...r-jaicrab.html
cfw : http://pastebin.com/03MFDLGV
Copy these two files onto a usb stick, and plug it into the console's right-most usb port. Turn on the PS3 and it will turn itself after 10-15 minutes. Disconnect all usb devices and turn it back on to make sure it loads the XMB correctly. If it does, turn it off again, and copy over the lv2diag.self from the "Archivo 2" folder:
http://pastebin.com/gGETcxMR
The console will turn on, and turn back off after 20 seconds. CONGRATULATIONS, you now have a 100% functional 3.55 kmeaw cfw.
Thanks:
DiGiTaLAnGeL (progskeet tester )
Glevand & mfw builder team( cfw )
NDT ( helper ) a great person
JaiCraB ( lv2diag without reader )
Robs1 ( my guide to NOR flashing)
EussNL ( your amazing support on the wiki I use every day: PS3DEVWIKI.COM)
Defyboy (for starting ps3devwiki)
Everyone in #darkps3 on irc-hispano.org for your support and countless hours of testing
DemonHades ( thanks because if you hadn't posted your lies, i never would've met DigitalAngel or uf6667, and they've both helped me a ton )
Lastly, people have been privmsging me to create a PayPal donation link, so here it is:
https://www.paypal.com/cgi-bin/websc...=QJN5EYNQJ6H62
Now back to dual NAND and that 3.6x dump which is such a pita, heh.
P.S. Don't take your consoles to a store named "chipdress". Two people have already contacted me to fix the damage caused at that store. BEWARE.
[/SPOILER]
08-16-2011
11:54 PM
damn im a noob and cant solder
08-17-2011
12:17 AM
This is mine transalations that took me like one hour, i speak spanish( native language)
Hello everyone, i finally got it, we have a downgrader for slims consoles , this time a bit different that i did with fat models, i made it by the two flashers, progskeet and teensy ++,dope
We need:
fat or slim console with nor updated to 3.70 “DO NOT TRY With ANOTHER VERSION”Solution to write and read the nor of the console ( flasher progskeet or teensy + +)
hxd program (which I use to edit hex)
FlowRebuilder v.4.1.3.2
a cold beer (this is important)
Http://pastebin.com/yuvJ5Leh Downgrade.bin
First we dump our NOR with a flasher, the file size must be “16,777,216 bytes” no byte more or a byte less, take several to be absolutely sure of what you do..get the dump “example jakemcallister.bin”and we have to get it in flowrebuilder to make it readable,the option is called bytereverse dump and extract
we do it and we will have a file but the extension will be bin.REV open it with the hxd and take out our personal data of the console EID, BOOTLOADER, CSID and METLDR
no need to put more data
We get it with the following way:in this case we get our METLDR in our prepatched image for downgrade attached in this tutorial
inside the folder where flowrebuilder had placed our.rev also has created another folder called “nameofthedump.EXT”in there are our personal files of our console and we need to get some to place em inside the pre-patched image that i attached
Open the hxd and open downgrade.bin and the metldr file that is inside the folder asecure_loader, we pick the tab on the hxd metldr and copy all the HEX content to get in inside the downgrade.bin
press control + g and write "820"thats the position of the metldr right click on the first line of the position 820
And choose “paste writing” and in the same way we introduce the other ones
the files to get in are
:METLDR: offset“810″ size “E960″
BOOTLOADER_0 Offset“FC0000″ size “40000″
EID: Offset “2F000″ size “10000″
CISD: Offset“3F000″ size “800″
then we take the downgrade.bin with the saved changes and we get in flowrebuilder with the option bytereverse dump and extract
This time the program will give us a error, but is a normal error, in fact is okay and will give us a file called downgrade.bin.REV
And thats the file you have to get in in the "flash" console
if all went well at writing ,turn on the console and you will see in the screen press the ps button or in English push ps button, DONT PRESS ANYTHING, turn off the console and put it in factory service mode, once done we need to put the correct file system for 3.55 lv2diag of jaicrab without reader and a special cfw
lv2diag:http://www.logic-sunrise.com/telecharge … icrab.html
cfw: http://pastebin.com/03MFDLGV turn onthe console with the usbstick with these two files in the right usb port (in the last) of the console and it will shut down for 10 / 15 minutes, turn on the console without any usb connected to verify that you did it correctly it will take you to xmb,
If all went well turn off the console and put your lv2diag
FILE2 of this pack:http://pastebin.com/gGETcxMR
the console will turn on for 20 seconds will turn off itself and CONGRATULATIONS you have your console in functional 100% and kmeaw cfw 3.55 100%
Thanks to
:DiGiTaLAnGeL (Tester with progskeet)
Glevand & mfw builder team (cfw)
NDT (Assistant) is a very good person
JaiCraB (lv2diag without reader)
Robs1 (my guide with the nor flash)
EussNL (his great support in the wiki that I use every day PS3DEVWIKI.COM)
Defyboy (for creating ps3devwiki)
To the whole channel darkps3 from irc-hispano.org for their support and many hours of testing we have hit hard mother****ers!
DemonHades (because if you had not post on your website with the lie you said about me, I had not met DigitalAngel or uf6667and these two helped me a lot)
and finally to the people who asked me in private to place a donate paypal button
greetings and from now on i will resume my work with the dual nand and that dump 3.6x that gives me so many problems hehehe
Ive updated the position of METLDR that was misplaced offset 810 " e960"size
Transaltions by mximposter to ps3hax.net my mail mxsaiyan@hotmail.com
Sorry for missing punctuantions, im from my ipad hehe
For future translations and if im able hit me up, this is my first help for the scene, thanks to everyone and keep moving forward
08-17-2011
12:48 AM
PS3Hax member mximposter has brought us a correct and actual Spanish to English translation, the big quote box above has been edited to reflect this change.
08-17-2011
12:52 AM
Do you need progskeet or teensy++ to downgrade. If so, wouldn't it be viable to simply dual boot. Reason I'm under the presumption that this is a breakthrough in the ps3 hacking scene. Otherwise, it would seem that this is more for testing purposes than something useful to an everyday user, like me.
08-17-2011
01:47 AM
Purely awesome job this one. I will get right on it as i have a girlfriend that presses YES on every question and managed to update to 3.70
08-17-2011
01:50 AM
08-17-2011
02:48 AM
I thought you could get those files through a file manager. Means this is useless to me, as I don't own any of those.
08-17-2011
02:51 AM
I dont have tensy++, can I use Atmel AT90USB1287 Key as a flasher
08-17-2011
03:10 AM
Think i will stay in 3.6 for now....am gonna wait for a softmod.
08-17-2011
03:16 AM
08-17-2011
04:09 AM
Am I the only one that's confused
What do you do with the cold beer?
08-17-2011
04:40 AM
08-17-2011
04:48 AM
Someone tested it? Does it work? Can anyone upload on yt tutorial for us noob?:D
08-17-2011
04:52 AM
(No offense intended!)
08-17-2011
05:45 AM
08-17-2011
06:37 AM
it is possible to downgrade PS3 Model CECH-3001A using this method?
08-17-2011
06:50 AM
08-17-2011
07:07 AM
Even after the native translation..it's still rather hard to understand what you're supposed to do. Guess I'll wait for a noob friendly version.
08-17-2011
07:52 AM
i need help please help me
08-17-2011
09:39 AM
ill wait for a noob-friendly solution too
by the way , i have a P3 T-Break can i flash my ps3 with it ?
here is the specs by the manufacturer :
*Second Generation Architecture with all the features of the First Generation.
*Onboard SLC NANDFLASH Memory of 128MB (Most competing products offer 16KB with the highest being 128KB)
*High speed 32 bit CPU processor clocked at 500MHz.
*All P3GOs are fully updatable via USB on your Windows PC using a very simple and intuitive process.
*P3GO supports dual payloads. (Only device in the market with this feature)
*A microSDHC slot is inbuilt which supports up to 32GB for future expansion.
*Compatible with all PS3 models C Fat and Slim.
*Supports all PS3 regions: USA, JAP, PAL and KOREA.
*Optimized and enhanced firmware which has been developed in house by our programmers.
*Disables forced software updates and will never brick your console.
*Supports all games and homebrew applications available at the moment.
*Easy-to-use software for backing up, managing, and playing games from external USB Hard Drive or the internal Hard Drive your PS3.
*Playing games from HDD gives you loads of benefits, including faster loading times and reduced strain on the lens of the Bluray drive of your PS3.
*Supports installation of homebrew applications on PS3.
08-17-2011
09:48 AM
"Josejuan.bin." They dont know what is "jose juan" so i put it like" jakemcallister.bin" to clarify the example of the name
And the other its nombredeldump they dont know what is so i translated it too for "nameofthedump.Ext"
08-17-2011
10:08 AM
okay... so when i get progskeet what do i do with it? i open my ps3 and put it where exactly? and do i need to solder?
08-17-2011
10:31 AM
Hello everyone, i finally got it, we have a downgrader for slims consoles , this time a bit different that i did with fat models, i made it by the two flashers, progskeet and teensy ++,dope
We need:
fat or slim console with nor updated to 3.70 “DO NOT TRY With ANOTHER VERSION”Solution to write and read the nor of the console (teensy + + flasher or progskeet)
hxd program (which I use to edit hex)
FlowRebuilder v.4.1.3.2
A cold beer (this is important)
Downgrade.bin Http://pastebin.com/yuvJ5Leh
First we dump our NOR with a flasher, the file size must be “16,777,216 bytes” no byte more or a byte less, take several to be absolutely sure of what you do.
Get the dump “example jakemcallister.bin”
and we have to get it in flowrebuilder to make it readable,the option is called bytereverse and extract nor dump
we do it and we will have a file but the extension will be bin.REV
open it with the hxd and take out our personal data of the console EID, BOOTLOADER, CSID and METLDR ,no need to put more data
We get it with the following way:in this case we get our METLDR in our prepatched image for downgrade attached in this tutorial
inside the folder where flowrebuilder had placed our.rev also has created another folder called “nameofthedump.EXT”in there are our personal files of our console and we need to get some to place em inside the pre-patched image that i attached
Open the hxd and open downgrade.bin and the metldr file that is inside the folder asecure_loader, we pick the tab on the hxd metldr and copy all the HEX content to get in inside the downgrade.bin
press control + g and write “810″thats the position(offset) of the metldr right click on the first line of the position 810
And choose “paste writing” and in the same way we introduce the other ones
the files to get in are
METLDR: offset“810″ size “E960″
BOOTLOADER_0 Offset“FC0000″ size “40000″
EID: Offset “2F000″ size “10000″
CISD: Offset“3F000″ size “800″
then we take the downgrade.bin with the saved changes and we get in flowrebuilder with the option bytereverse and extract nor dump
This time the program will give us a error, but is a normal error, in fact is okay and will give us a file called downgrade.bin.REV
And thats the file you have to get in in the “flash” console
if all went well at writing ,turn on the console and you will see in the screen press the ps button or in English push ps button, DONT PRESS ANYTHING, turn off the console and put it in factory service mode, once done we need to put the correct file system for 3.55 lv2diag of jaicrab without reader and a special cfw
lv2diag:http://www.logic-sunrise.com/telecha...r-jaicrab.html
cfw: http://pastebin.com/03MFDLGV
turn on the console with the usbstick with these two files in the right usb port (in the last) of the console and it will shut down for 10 / 15 minutes, turn on the console without any usb connected to verify that you did it correctly it will take you to xmb,
If all went well turn off the console and put your lv2diag
FILE2 of this pack:
http://pastebin.com/gGETcxMR
the console will turn on for 20 seconds will turn off itself and CONGRATULATIONS you have your console in functional 100% and kmeaw cfw 3.55 100%
Thanks to
DiGiTaLAnGeL (Tester with progskeet)
Glevand & mfw builder team (cfw)
NDT (Assistant) is a very good person
JaiCraB (lv2diag without reader)
Robs1 (my guide with the nor flash)
EussNL (his great support in the wiki that I use every day PS3DEVWIKI.COM)
Defyboy (for creating ps3devwiki)
To the whole channel #darkps3 from irc-hispano.org for their support and many hours of testing we have hit hard mother****ers!
DemonHades (because if you had not post on your website the lie you said about me, I had not met DigitalAngel or uf6667and these two helped me a lot)
and finally to the people who asked me in private to place a donate paypal button
and here its
https://www.paypal.com/cgi-bin/websc...=QJN5EYNQJ6H62
greetings and from now on I will resume my work with the dual nand and that dump 3.6x that gives me so many problems hehehe
Ive updated the position of METLDR that was misplaced offset” 810 ” E960″size
Spotted mistakes i fixed and some pointings
Before it said byteverse dump and extract
Now byteverse And extract nor dump
Got links (his paypal)
Offset =position
jakemcallister.bin is in his example josejuan.bin
Nombredeldump.ext is in english nameofthedump.ext
At the beggining Of the paragraph ..the solution to write and read the nor of the console it said "flasher progskeet or teensy ++"
And its in the correct way FLASHER TEENSY ++ OR PROGSKEET
So what i understand here is that u need one of those NOT BOTH
08-17-2011
11:00 AM
08-17-2011
11:10 AM
08-17-2011
11:38 AM
AMAZING... GREAT ... ps3 scene FTW . you have made lots of people happy :D
08-17-2011
11:47 AM
how about connection diagram ? i need connection diagram
i fund it
http://www.progskeet.com/downloads/diagrams_110805.rar
08-17-2011
12:29 PM
These sort of post have a way of being misleading, as in they stir up false hope. Next time be specific, and just put w/ -NorFlasherHere-, as to not lead astray, I thought this was a softmod at first.
08-17-2011
12:53 PM
Nice work! Thanks :D does seem a bit long right now.. hopefully someone with the knowledge can make a program that does most of the work for you?
08-17-2011
02:21 PM
please update main post with this :
by psicoleo, uf6667 and I have made an application to automate the use hex editors to modify the downgrade.bin
http://www.multiupload.com/AE8W5HADWM
bytereversed you put your flash in donor and recipient and will downgrade.bin in the process hxd without ... xD
you not need hex edit anymore...
and "If at any time during the downgrade DISPLAY RED (RSOD) STOP PROCESS IMMEDIATELY I WILL RELEASE A FIX SOON" Please be patient
08-17-2011
02:41 PM
i keep hearing about slims being downgraded but what about fat ps3 i got a checha launch console can that be downgraded i mean if i were to update from 3.55 to 3.70 for no apparent reason
08-17-2011
02:41 PM
thanks added to main post
08-17-2011
02:57 PM
http://www.ps3hax.net/showthread.php?t=26256
08-17-2011
03:23 PM
Since my translation was first I'll say its better than any of the other 2 (lol).
08-17-2011
03:46 PM
This is pretty freaking sweet; however has anyone else confirmed this working?
As to everyone that provided better translations, ty very much, awesome to see the community working together.
Excuse me while I grab a beer and start cheer-leading.
08-17-2011
04:40 PM
08-17-2011
07:46 PM
Where do you place progskeet when you get it? Do you need to solder?
************* [ - Post Merged - ] *************
And do you need to buy both prog skeet AND teensy++
08-17-2011
08:48 PM
08-17-2011
10:06 PM
hi...just made the move from psx, this is great news as i sold my 3.55 a couple weeks ago and purchased a slim for half what i sold it for, unfortunately on 3.60. hopefully there will be a service for this soon, under 100$...cuz knowin me ill lay a big brick attempting this.
08-17-2011
11:12 PM
you guys are awesome
**** you Fony! stay in your Make.Believe bull****
hackers Make.****.Happen
keep up the good work boyz
08-17-2011
11:52 PM
If anyone wants Flow Rebuilder 4.1.3.2, click here
08-18-2011
01:39 AM
Will this method work on PS3 consoles with a factory installed base firmware of 3.56 or greater?
08-18-2011
01:53 AM
08-18-2011
02:29 AM
Otherwise that tiny fact should probably be part of the front page post.
08-18-2011
09:24 AM
Another reason to not do this until all bugs are fixed.
08-18-2011
10:04 AM
For those who are still confused I've made a tutorial with pictures and some what better English
If you find any mistakes let me know.
http://rootedsystem.com/2011/08/ps3-...ensy-tutorial/
08-18-2011
11:09 AM
This downgrade to which firmware version ?
08-18-2011
11:14 AM
08-18-2011
11:17 AM
08-18-2011
11:24 AM
08-18-2011
11:30 AM
sorry for my above post.
now i know, thank you Pockets69 :D
08-18-2011
11:33 AM
I would pay for someone to do this for me, hopefully a service comes for this.
08-18-2011
11:33 AM
I don't understand what to do at all.
~
08-18-2011
12:11 PM
I translated and clarified the downgrade instructions. [link]
What did you do to help? Oh right. :-)
08-18-2011
12:51 PM
so whats the news about the solderless version remember reading about that somewhere
08-18-2011
12:54 PM
08-18-2011
03:58 PM
is there a chance that this will be available in a software?
Like first the psjailbreak dongle was in a usb form but now you can get it in a software.
08-18-2011
04:01 PM
maybe one day but who knows what lay ahead but for 1 thing for sure it wont be anytime soon if it does happen
08-18-2011
06:17 PM
I'm also a fluent spanish speaker guys and, while this one has been translated by *lots* of different people (so you don't need my help this time).
I've translated for the scene in the past and am more than happy to do so again in the future ;-)
Anyway it's best if there's a culture of 'many hands make like work' ;-)
If anyone wants to PM me at any point for a translation of something let me know! I like to do my bit for the scene and while I've not had time to develop the skills to litterally hack the console myself this at least makes me feel I'm usefully helping the community effort!
08-19-2011
12:11 AM
Not worth the risk or the money
08-19-2011
12:17 AM
08-19-2011
08:29 AM
Exactly, and this will become increasingly more useful as consoles with lower firmwares become harder to find on the second hand market!
08-19-2011
10:15 AM
will the solderless version be in a usb form? And can we switch between cfw and ofw with the board?
08-19-2011
11:22 AM
that doesn't make any sense of course its not on usb, how would it acess the nand through usb?
it will be a clip attached on top of the nand or somewhere else, that will work as well as the solder version.
08-19-2011
02:51 PM
But will we be able to switch between cfw and ofw with this?
08-19-2011
02:55 PM
In theory yes using a hardware switch between them once the initial dump etc is done, but you would also need to take into account that your HDD is OS dependent as well and most likely have 2 HDDs.
08-19-2011
03:14 PM
Nice dude, de donde eres? We could do a translation together haha and you r right , thats the least we can do
08-19-2011
09:39 PM
08-20-2011
02:12 AM
08-20-2011
07:48 AM
Lets all just wait for a 3.70 CFW lmao.
08-20-2011
11:41 AM
JUST A BIG NO NO !!!
I had a ps3 stuck in 3.56 service mode so used this method get it out
Yeah it worked its comes out of service mode, but when i try to flash the 3.55 cfw the green led just starts flashing
So i tryed to flash the patched 3.41 it flashed ok and switched off
as soon i switched bk on the ps3 it was a brick flash red led
Now i think this is to do with the syscon beacause i reflashed my bricked 3.56firmware back to the nor and still same results
If any of you clever guys could give me an idea how to fix this would be gr8t full
btw the ps3 was a 80gb
Also i used a up-2008 to dump and program the nor flash
08-20-2011
12:20 PM
how about save data in the hdd will it still be there
08-20-2011
04:51 PM
08-21-2011
01:56 PM
08-21-2011
06:49 PM
im gettin this but im only 14 and im a total noob at soldering
08-23-2011
04:16 PM
Total confirm this works on 3.56 to get it out of service mode :-)
But can flash thecfw
Ok I also have a slim 2503b 320gb so I dumped the syscon and 3.55 custom firmware in game os
I then upgraded it to 3.70 and tried to downgrade it with this method
It just shuts off straight away ???
Anybody with a 2503b done this yet?
I take it to beat the syscon we need to be in service mode but service mode does not work in 3.70
Btw has anybody dumped a nor in game os, if so how do you flash it back ??
08-26-2011
08:49 AM
@update4...the clip is not watchable on my country...
i am from germany :x any other confirmed links, that are working?
08-26-2011
03:40 PM
08-31-2011
01:39 PM
i updated entire patch method with new v2 with some fixes , now be compatible with all consoles except 2504b DATECODE 1B and 3000 consoles.
http://darkconsoles.com/foro/viewtopic.php?f=7&t=16
Write a new method consisting of 6 patches, this time we will use to edit the dump hxd original of your PS3 (make backup)
steps:
first check if our standards Dump bytereversed, to start patching the original dump.bin file we must first ensure that the beginning of the flash at offset 200 is readable "IFI" if instead you see "FI.I "Your rules need to patch it bytereverse before (a and go back to him to put it in bytereverse the console to be read again" FI.I "when we patched the files and offset's a patch are these
patch1: OFFSET 0C0010
Patch2: OFFSET 7C0010
patch3: OFFSET 80000
patch4: OFFSET A0000
Patch5: OFFSET 40000
patch6: OFFSET 60000
easy, normal and cojemos the patch1 for example, copy content and paste it patch1 0C0010 writing and so the rest (the file size does not vary after the stripe)
the rest of the downgrade is the same as before, factory mode, and pup jaicrab lv2diag nochecks.pup of the previous release.
http://www.multiupload.com/ZJINMAKAEP
https://www.paypal.com/cgi-bin/websc...=7QWF9TNAPVVY4
09-01-2011
09:14 AM
So CHECH-2504B Datecode 1A is ok?
10-15-2011
02:39 AM
Hey alguien me puede pasar este articulo en spaol ! tengo una slim 160gb en v3.60 y la quiero downgradear para poder jugar copias !
10-15-2011
12:22 PM
works for slim 3000?
10-15-2011
01:16 PM
11-18-2011
07:59 PM
is this method only for ProgSkeet or can i also patch my backup from the E3 Flasher with this?
the only problem, there is a .bin.REV file that i must flash on my NOR but the e3 flasher only flashs .bin files in FUN MODE!
the reason i try my luck here, because when i flash my dump with the e3 the ps3 start and give me a message...
in german...
Starten nicht mglich.
Die richtige Festplatte wurde nicht gefunden.
in english...
start not possible.
the correct harddrive was not found.
i hope someone can help us with this problem because i'm not alone with this problem...
here my dump backup of the ofw 3.73 with the e3 flasher...
https://rapidshare.com/files/3658439079/bkpps3.rar