Welcome to PS3Hax, your official PS3 hacks, PS3 Homebrew, and PS3 Downloads scene. Check back daily to keep up with the latest PS3 Hacks and drop by our forums for more PS3 Hacks discussions.
Posted by PS3Hax Member News, on 10/09/2011, @ 05:23pm
Remember Rogero? The man behind Rogero Backup manager? Well he has released some information about the downgrade from 3.70 by Dospiedras and states that any MFW that does not have LV1.self file patched to Disable all checks will result in a brick.Now he has released his own MFW that fixes this trophy error.
Last night I had the chance to try and downgrade a Slim Ps3 (JSD-001 board with Spansion NOR) version 3.70 to CFW 3.55 using Dospiedra’s downgrade v2 patches.
I managed to get a clean dump of the NOR using my ProgSkeet (latest QT port used), created a patched Downgrade.bin image
using the 6 patched files from Dospiedra and a hex editor, then I flashed the image to the PS3 NOR, dumped the NOR another
time and verified that all was written fine.
Then I continued with the normal downgrade procedure, go into service mode, update using the 3.55_no_check.PUP, then exit
service mode and all was good, it was back into CFW 3.55.
Here the problems started, I tried to start a game and I got the famous Trophy error, so I decided to update it to my
personal Modified Firmware, so I started the update and after installing the firmware, the PS3 turned off by itself,
I tried to turn it on again, It turned on for almost 2 or 3 seconds then turned off completely ( No Screen Output, No Red Led either )
so I knew-ed at this point that the PS3 was Bricked
N.B: this was never mentioned in any of the downgrade tutorials floating on the net, although this is a very important point
to warn the users who are downgrading their Ps3 machines not to update using usual Modified firmwares unless the firmware
have the LV1.self file patched to Disable all checks, anything else will result into a Bricked PS3, and this is not good at
all especially if the Hardware flasher used to downgrade was removed from the Ps3′s NOR or Nand Flash.
After doing some research and discussing the issue with my friend eussNL <– a wiki by himself
I realized what happened to the Ps3, after the downgrade procedure, the machine’s syscon still had a version > 3.55
(3.56 or higher) and this needs a Patched LV1.self (checks disabled) in the NOR for the PS3 to be able to boot fine, and when
I updated it to my own MFW, the LV1.self file in the NOR was replaced with a non-patched version (checks enabled) and the PS3
detected the higher syscon version (3.56+) and Bricked.
To Fix it, I had to re-flash the NOR again with the patched Downgrade.bin image (to get rid of the patched LV1.self)
then the Ps3 was fixed and booting fine again.
At this point, the Ps3 was working again, but the Trophy problem was always there, so I prepared another Modified firmware with
3.70 spoof, Privacy Patch and this time the LV1.self Checks Disabled
(the patches were provided by eussNL too so Credits here goes to him),
then while still having Progskeet soldered to the NOR flash, I updated the Ps3 with the new MFW, everything
went fine, and it rebooted fine into the XMB, did some tests and the Trophy problem was gone for good and all games working fine.
For all the users who had successfully downgraded their PS3 machines to 3.55 again, I share with you my MFW with Lv1 Checks patched to bypass the 3.56+ syscon version and prevent any brick after updating to it, and to get rid of the annoying Trophy problem encountered after the usual downgrade procedure.
Posted by GregoryRasputin, on 10/09/2011, @ 06:50am
Now whilst others try and stall the scene, by leaking information and other important stuff that should be kept secret, there are decent people hard at work, trying to keep the scene alive, like the cool guys at Digital Angel, who have released this important application, which works in conjunction with Progskeet, here is a quote from the source:
Hi Guys!
Today i would like to introduce you the new step in the Progskeet evolution: the “QT” Flasher…
The actual public version is a bit “buggy” and difficult to use, and it works well only on Windows XP, as Windows 7 and other OS have compatibility problems with it (some are just crappy things that you can fix with some tricks, while other makes the Flasher crash).
During the last times, the Flasher developer which constantly works on it to improve the stability and the features, has gave a big push to the Flasher, making the choice of using a powerful and multi-platform framework such as QT!
QT is a framework which can allow the developer to write a program and make it work the same way on the 3 main platforms : Windows,Linux and Mac OS X without worrying about write tons of lines to make it work on the currently running platform: QT will do the dirty work for you.
Because of this, @uf6667, helped by two other good coders named Ago and bmx, started to port the original Flasher to QT… and as always we (DiGiTaLAnGeL) and some others have the privilege to beta-test this new and awesome version of the Flasher.
Let’s start with some hightlights: at the moment, the version we have is the Windows one, which then will be called WinSkeet40000,followed by Linuxkeet (Linux) and iSkeet(MAC OS X).
The interface is full of new things… and for now we can use these features:
The “evil” progskeet.log is gone, and the event log is now embedded in the flasher itself, in realtime!
You can manually read,write and now erase too.
You can use presets and create new ones, matching your NOR/NAND flash -now there are some presets for the PS3 flashes and XBOX360 NAND-.
You can change the write method, between buffered write (the default one) or use the “single word” or “double word” mode (you can use it when something goes wrong or your tasks fails).
Now the flasher is splitted in tabs: “Common”,”NOR”,”NAND” and “Patcher” making it more easier and faster to use.
The byteswap function is still here, working flawlessly on both writing and reading.
You can use the “patcher” tab:useful to apply patch to your dump on the fly.
There is an option to change to refresh-cycle of the flash (for slower/faster flashes).
Progskeet Flasher is being translated! For now there are english,french and german languages -italian and all the others are coming-
The “verify” task is now done at the end of the read->erase->write process.
More news for Team E3DIY, on the E3 Flasher. Today they have sent me installation videos on PS3 slim, and have clarified on the “premium” version price which was reported $88.
To quote:
And we also upload universal screwer picture and E3 linker in the picture.
Please note E3 linker is only for FAT console , come with E3 FLASHER LIMITED suit.
We noticed some player complain E3 FLASHER LIMITED SUIT price, I think people are forgetting that:
E3 FLASHER LIMITED SUIT come with 8 accessory, the cost is about 6times than similar flasher.
Ok, so at least you can get USD88-USD34-USD3-??= about USD50 only !
This means you get downgrade and dual boot function with similar price as other brand flasher ! And don’t foget E3 FLASHER include 4 BIG COST BOARD !
So this is what E3 do, 6times cost but similar price for all user !
I would imagine many of you already have some of these components, and won’t need this premium version and could expect a stripped down version of just the board for $50 which is not too bad, and still cheaper than a second PS3.
More details form the E3DIY team about their E3Flasher. Today they have posted on their site official pictures, and pricing. We can expect the product to start shipping around September 12th, at a retail price of $88.
To quote email:
E3 Flasher = The world’s first Dual-Boot, with simple 1 key operation = Surprising Arrival!
Features:
Dual Boot 3.7OFW and 3.55CFW on same PS3
Downgrade 3.7 to 3.55 in 5min
16M NOR FLASH ON board
3 save MODE, can save data in TF, NOR FLASH on board and PC HD
1 KEY operation, simple is best
Upgradable from TF card or PC USB
Compatiable all device like PS3/WII/XBOX360/MP3/DVD/BD/MP4/Table PC which has NAND or NOR flash memory.
Integrated lots of interface, perfectly extension, will have more function with future new E3 accessory.
E3 flasher Limited version includes 8 accessory, suggested retail price $88 USD, total production run only 3000 units!
Team E3DIY has contacted PS3Hax today, bringing another proof of concept video this time demonstrating PSN support. Ofcourse this is OFW 3.70 so you won’t be able to play online with your backed up games (as of now anyways) – but some PSN is better than no PSN.
To quote email:
Clear up doubt ,E3 FLASHER dual boot, 3.7 play PSN and 3.55 play HD game
After we release dual boot video, most player love it and also with some doubt.
We understand, so today release a new video, and do some clarification .
1: E3 FLASHER not only a flasher, but with perfectly extension because integrated lots of interface, we will release
more useful function later, all will be free just like we release golden finger function on E3 card reader.
2: E3 FLASHER can be upgrade from PC USB or TF card, very simple.
3: E3 FLASHER dual boot need 2 harddisk, one for 3.7 , another for 3.55. if you use only one HD, it will be required format everytime.
we will release a kit include ESATA station for you switch harddisk. (support 2.5 and 3.5′ DISK)
4: At present, on nand flash console, it need solder wire. And no dual boot function because no 256M NAND FLASH ON E3 FLASHER.
on nor flash fat console, it need solder wire , and include dual boot function.
on slim console, it no need solder wire but need solder some point.it is easy can be done in 3min. (don’t misunderstand no solder wire means no solder)
5: we will release 2 new version E3 FLASHER at the end of this month.
One is 256M nand flash on board and with CLIP, to get dual boot and no solder function.
Another is same as present E3 FLASHER but with CLIP, so all nor flash console no need any solder at that time. (sure cost will higher)
6: If all go well, we will release official picture and retail price on this wensday !
We also have more insight on the price which is expected to be around ~$100 USD so for those interested in purchasing one this is the price range to aim for.
There also is a review sample coming in for us that I will review and be giving away to one of our members for free
Stay tuned for more exciting n’ exclusive updates @ PS3Hax.
Team EDIY is creating some hot news lately and this one might just drop the bomb on those who already have a jailbroken 3.55 console. For those of you that don’t know the E3 flasher is a chip, similar to Progkeet, that is releasing a SOLDERLESS solution and allows you to downgrade (click here for more info).
Today team EDIY contacted us bringing another video showing dual booting form 3.70 to 3.55, in one simple click and in seconds! Reminds me of the good devhook days on the PSP, looks promising and you can bet this is the best solution your going to get with PSN with CFW without dishing out for a second PS3!
The video below shows the quick switching of the firmwares, notice that the MAC ID for the PS3 consoles is the same throughout the video:
Here is the email I received this morning:
E3DIY team success dual boot with E3 FLASHER, you can switch 3.7 and 3.55 in few only a few seconds!
- Easy with 1 key operation.
- E3 company will release all details like picture, installation, operation and price next week.
-Team E3DIY get another great progress for PS3 with E3 FLASHER, it will release at the same time next week.
- PS: 4times switch showes same MAC address, to prove it is the same console.
With bringing a solderless solution this flasher seems very interesting now and opens up the market to many people, answer the poll below and let us know what YOU would do.
Loading ...
Team E3DIY is in contact with us, so stay tuned for more exclusive news @ PS3Hax
Team E3DIY contacted us today showing and confirming that they have managed to successively downgrade PS3 firmware 3.70 to 3.55 from their chip. They told us that this method requires NO soldering for SLIM PS3 consoles (required for phat), works for NAND and NOR, and is a simple one click and under five minute downgrade.
The video:
The email:
E3DIY team success downgrade 3.7 to 3.55 with E3 FLASHER !
In 5min, E3DIY team success downgrade 3.7 to 3.55 with E3 FLASHER. Time is short and operation
is very easy, this depend on E3 FLASHER special design, 1key operation and nor flash on board !
we not record any image about E3 FLASHER regards it’s not release by far, hope eveyone understand.
the official version should release next week, more video and picture will be public at that time .
PS: E3 FLASHER compatiable all NAND FLASH and NOR FLASH console .
with slim console no need solder wire but fat console need .
E3DIY team success downgrade 3.7 to 3.55 with E3 FLASHER ! In 5min, E3DIY team success downgrade 3.7 to 3.55 with E3 FLASHER. Time is short and operationis very easy, this depend on E3 FLASHER special design, 1key operation and nor flash on board ! we not record any image about E3 FLASHER regards it’s not release by far, hope eveyone understand. the official version should release next week, more video and picture will be public at that time . PS: E3 FLASHER compatiable all NAND FLASH and NOR FLASH console .with slim console no need solder wire but fat console need .
Stay tuned for more exclusive PS3 developments and details of this flash chip, price and availability soon @PS3Hax
Posted by PS3Hax Member News, on 20/08/2011, @ 06:05am
You don’t want to downgrade your PS3 on OFW 3.70 (you’ll loose all your data), but want to enjoy Homebrew and capabilities of Official Firmware 3.70 with one Console? Then this is the right tutorial for you. DiGiTaLAnGeL from Italy has managed to “fast-swap” between Custom Firmware (3.55) and Official Firmware (3.70) with the ProgSkeet Flasher and a second Harddrive.
English Version for international blogs, greetz from Italy -Google Translate sucks- (and my english too… sorry )
Today i’ll write a tutorial to “fast-swap” between CFW 3.55 and OFW 3.70, using 2 HDDs… at the end of the tutorial, you i’ll be able to swap between the firmware just flashing a dump on your PS3 using Progskeet. (instead of downgrading and loosing all data).
The first steps are not so easy, so take your time and go on, by the way, you must have some skill with Progskeet, and it must be 100% working on your console.
What we need:
PS3 Slim running with FW 3.70
2 Hard Disks
Progskeet installed and working on your PS3 Slim
Downgrade.bin edited with your personal data (there are tons of tutorials for do this)
3.55 Downgrade Dongle to do the downgrade process.
Lv2Diag “FILE 2″ to go out of Service/Factory Mode. (DOWNLOAD)
We need 2 HDD because the NOR flashes stores some parts of the current FW on the HDD… so we will need 2 HDDs, one is for 3.55, and one is for 3.70..
We will call those HDD “A” (for 3.70) and “B” (for 3.55) dont mix them up!
Starting with a PS3 Slim with OFW 3.70.
Plug in HDD “B”, format and prepare it if it’s required by the PS3 and you should have your 3.70 up and running.
DUMP your actual NOR and call it “original dump 3.70.bin”
Now flash your “downgrade.bin” (edited with the personal data found in “original dump 3.70.bin”)
Turn on your PS3 and be sure that the PS3 is asking you to press the PS button (downgrade.bin flashed correctly )
Insert a 3.55 Downgrade dongle and enter factory/service mode.
Copy Lv2Diag.self by Jaicrab and the 3.55 NO CHECK UPDATE renamed as “PS3UPDAT.PUP” in the root of your USB Stick.
Plug in the USB Stick in the most-right USB port of your PS3 and wait for it to turn OFF.
Leave the factory mode using the other Lv2Diag.self
After the reboot, you need to configure and set up your system… now you have a fully working 3.55 CFW based on KMEAW “NO CHECK”.
DUMP your actual NOR and call it “swap dump 3.55.bin”
Unplug HDD B and Plug in HDD A.
Turn on your PS3, plug in your USB Stick containing official 3.70 update and press start+select when asked.
When the PS3 reboots, check that the system is fully working and DUMP your actual NOR and call it “swap dump 3.70.bin”.
NOW IT’S OVER! You should have “swap dump 3.55.bin” and “swap dump 3.70.bin” … Now you just have to swap HDD and flash the corrispondent dump:
HDD A = swap dump 3.70.bin
HDD B = swap dump 3.55.bin
WARNING: Do not install other CFW than the “NO CHECK” one… because it’s used to make the “fast-swap” working… if you flash something different you will not be able to go between the 2 FWs. This CFW disable the Syscon checking at the startup… so it will not freeze or complain when the syscon says “3.70″ and your FW is 3.55
WARNING: In case you wanna update your console with a future “3.80″ or-so firmware. Do not update your console when you are running 3.55 firmware! You have to go to “swap dump 3.70.bin” and then update as usual (XMB or recovery)… -By the way, the downgrade is confirmed working only on 3.70… we haven’t tested it on other FWs, you could loose the possibility to go back to 3.55!-
Most of you have heard the news of the PS3 slim downgrade on firmware 3.70, helping those buying newer or updated PS3 slim consoles to the scene. At the moment push aside “soft modding” and its time to bring on the good ole’ soldering iron back out.
This new method of downgrading basically requires the soldering of a multi-console-compatible chip known as ProgSkeet (or clone) which you can find or purchase HERE…or you can use Teensy++ board if you still have those from the good dongle days. A solder-less ProgSkeet is in the works, more info here.
Now the original tutorial was released in a very technical form and in Spanish, but we at PS3Hax have got you covered, and are bringing you easy to follow tutorial that a noob can follow on. This tutorial is long, but it is more detailed than complicated, making sure your bases are all covered.
So lets get started, this tutorial is split into multisteps. You should also check out the posts made here, and the posts that will be made in this thread to get assistance. The following tutorial was modified from the original Spanish translation by Dospiedras1973, and the tutorial/images were modified from PS3Hax member Mattr92 tutorial over at his site: RootedSystem and and thanks to the many PS3Hax members that brought us the proper/native translation of the original instructions .
Highly advised you read this tutorial fully once, and then again and read the comments in this thread and the other threads linked above to get a GOOD understanding of what your getting yourself into and how the entire process works. Remember, this should be a fun and rewarding experience
DISCLAIMER: PS3Hax.net is not responsible for any damage caused to your system. We do not claim credit for this method, we simply have compiled and reorganized the information so it is easier to follow. I kindly request for other sites to not rip this entire tutorial to their websites, but instead link to this page if you wish to share it on your webpage. This page will be actively updated so please keep checking back to find solutions to encountered/discovered problems.
A PS3 (phat or slim) running PS3 original firmware 3.70 and has NOR memory, not NAND, and has ProgSkeet/Teensy++/Clone installed(click here to check if your console has NAND or NOR) – Note: This guide covers ProgSkeet install.
If your a noob (and I assume most of you are), it may be a good idea to have some what of a idea on what NAND/NOR is. It is basically the PS3 flash memory. If you want to get a better understanding of the PS3 system and its various components, you should check this out.
To quote:
The PS3 has 256 megabytes of flash memory to store firmware, using two NAND 128MB Samsung flash chips. The installed firmware data is interleaved between the two flash chips for speed. To prevent errors, Error Correcting Code Checksum (ECC) is added/used on the data in the PS3 flash chips. In newer PS3, a single 16MB Spansion flash chip is used.
Because of the smaller flash chips in later versions, newer firmware versions allow for the firmware data to be partially stored on the harddrive (instead of totally inside the flash), making the flash purely responsible for holding data involved in the critical booting up process. This allows for cheaper flash chips, while using the harddrive for later bootup stages.
To summarize now we are going to be downgrading a PS3 via NOR flasher, so the PS3 MUST have NOR memory most PS3 units have NOR now, the stock/initial PS3s (phat) that were released had NAND, there is a chart linked above so you can make sure. As of now, all SLIMs have NOR memory so your good to go .
First thing is first you have to install ProgSkeet. You can install Teensy++ board as well, or any other ProgSkeet clone but I don’t know how they work and I assume you need to substitute the tools/files for Teensy++.
So there are plenty of good threads to first checkout related to ProgSkeet, for starters this is what ProgSkeet is:
ProgSkeet is your one and only solution to your flashing needs. Whether it is NAND, NOR or any other kind of non-volatile memory – just solder, plug in and operate!
Works on various other devices (in addition to PS3) and consoles including Xbox 360 and Wii.
Here is a sample image of some ProgSkeet installs (gets you an idea what your getting into):
THERE IS CURRENTLY A SOLDERLESS CHIP IN THE MAKING, BUT AS OF NOW (8/20/2011), YOU MUST SOLDER AND PERFORM THIS METHOD IF YOU WISH TO DOWNGRADE FIRMWARE 3.70
Make sure your PS3 first has NOR memory, all SLIM PS3′s do, the older “phat” PS3 have NAND. Check if your console has NOR memory here.
Find the right pinout for your PS3 motherboard HERE. (Scroll down to “Pinout Gallery“). Additional ProgSkeet pinouts HERE. Teensy++ Pinouts located HERE.
Gather soldering tools, resin, and wire.Recommended gauge for wires: 24 (anything from 20-26 AWG is fine). Keep them at ~20cm each. – Note: 40/80 wire Floppy cables won’t work, to see a full list of compatible wires see this table.
Here are 2 “prep” videos for your ProgSkeet:
STEP 4 – The NOR Dumping
Now the actual work begins and the part you all have been waiting for, the NOR dumping!
Install Microsoft Visual C++ 2008 SP1 Redistributable Package (x86) [Download Here]
Restart your computer.
Launch the ProgSkeet Dumper
Plug in your ProgSkeet and wait for for the jingle/beep
Insert the following values for the NOR: if you have a SPANSION branded flash memory on your PS3 then: NOR Sector Size = 128kb / NOR Sectors = 128. If you have a SAMSUNG branded flash memory on your PS3 then NOR Sector Size = 4kb / NOR Sectors = 4096.
After getting the correct values inserted, select output and then press DUMP, and you should have the exact dump generated as seen in Part B.
Dump the NOR from your PS3 with the ProgSkeet/Teensy++ it should be exactly 16,777,216 bytes. If it is not, go back to part A, and keep re-dumping until it is. Make sure its down to the byte.
Next open up Transplante.exe, in “donador” select your nor-dump.bin.REV and for “receptor” select downgrade.bin and click GO.
Now that your downgrade.bin is successfully hexed open Flow Rebuilder back up. Select “Byte reverse and extract a NOR Dump” and drag downgrade.bin to the bottom option and click “Execute Operation”.
You will now be presented with an error, this is normal. All you are interested in is the file generated: “downgrade.bin.REV” -> This file will be flashed onto your PS3.
Now comes the last, and actual flashing part. Make sure you follow all the instructions above to the letter, and if you have any issues report them before continuing.
From the ProgSkeet flasher you downloaded in step 1, flash the file you generated in step 2 #5: downgrade.bin.REV to your PS3 (make sure your PS3 is on during this process).
If you flashed your PS3 correctly, your PS3 will reboot and show this message: “Push PS button”. DO NOT PRESS THE PS BUTTON!
Turn off the PS3 console as we will now place it in Factory/Service mode.
Copy these files to the ROOT (not subforulder!) of USB Mass Storage Device-: **WARNING: Make sure that this is a USB stick formatted to FAT 32. DO NOT use your MP3 player, phone, or anything except a USB stick as the timings are crucial for the downgrading process! If your having issues, we recommend you reformat your pen drive/usb drive with THIS tool.
Kmeaw CFW PUP File (3.55) [Download HERE or Mirror]
Insert to right most USB port on PS3
Now turn on your PS3 and leave it alone, the PS3 should turn off by itself in 10-15mins.
Unplug your USB from the PS3, and turn the console back on. It should boot to the XMB menu, once it does this turn your PS3 off again.
Now copy and replace this file on your USB: Modded LV2Diag [Download Here]
Insert once again to the right most USB port on your PS3
Turn on your PS3, it should turn off by itself in about ~20 seconds.
You have now successfully downgraded, and installed 3.55 KMEAW CFW on your PS3! You can check out our forums for more info on various homebrew, or drop by our tutorial section for more neat things you can do with your unlocked PS3 .
Don’t use any USB Mass Storage Device with enhanced functions as: encryption, fingerprintreader, U3, pincode etc.
Don’t use USB Mass Storage Devices with a long initialisation time (e.g. some MP3 players)
Don’t use multipartitioned USB Mass Storage Devices, only use 1 single primary FAT32 partition.
Make sure they are formatted according to specifications with FAT32 (e.g. HP USB Format Tool – or TOKIWA / Ridgecrop FAT32 formatter)
Most USB Mass Storage Devices that’ll work effortless with PenDrive Linux, will also work with the PS3 (for downgrading, upgrading, storage of your Game dumps and any normal filestorage under the XMB). Those USB Mass Storage Devices are most likely also the ones giving you the least problems under more exotic platforms like PSX/PSone, PS2/PStwo, Xbox/X360, Gamecube/Wii etc.
The libusb-win32 Kernel Driver needed for the the flasher to get access to the USB port was not installed. Make sure you unpacked the drivers_xxxxxx file and installed the Progskeet driver (VendorID:1988 / ProductID:0001 in case you need it).
In case of “the application has failed to start because its side-by-side configuration is incorrect” make sure Microsoft Visual C 9.0 runtime is installed and “Windows Installer” is not disabled (set to manual or automatic) in Services.msc
Important updates to this article follow below. Spanish Developer dospiedras1973, has released his method to downgrade Slim PS3 Consoles on firmware 3.70, here is a roughly translated native spanish-to-english quote from the source:
Hello everyone, i finally got it, we have a downgrader for slims consoles , this time a bit different that i did with fat models, i made it by the two flashers, progskeet and teensy ++,dope
We need:
fat or slim console with nor updated to 3.70 “DO NOT TRY With ANOTHER VERSION”Solution to write and read the nor of the console ( flasher progskeet or teensy + +)
hxd program (which I use to edit hex)
FlowRebuilder v.4.1.3.2
a cold beer (this is important)
Http://pastebin.com/yuvJ5Leh Downgrade.bin
First we dump our NOR with a flasher, the file size must be “16,777,216 bytes” no byte more or a byte less, take several to be absolutely sure of what you do..get the dump “example jakemcallister.bin”and we have to get it in flowrebuilder to make it readable,the option is called bytereverse dump and extract
we do it and we will have a file but the extension will be bin.REV open it with the hxd and take out our personal data of the console EID, BOOTLOADER, CSID and METLDR
no need to put more data
We get it with the following way:in this case we get our METLDR in our prepatched image for downgrade attached in this tutorial
inside the folder where flowrebuilder had placed our.rev also has created another folder called “nameofthedump.EXT”in there are our personal files of our console and we need to get some to place em inside the pre-patched image that i attached
Open the hxd and open downgrade.bin and the metldr file that is inside the folder asecure_loader, we pick the tab on the hxd metldr and copy all the HEX content to get in inside the downgrade.bin
press control + g and write “820″thats the position of the metldr right click on the first line of the position 820
And choose “paste writing” and in the same way we introduce the other ones
the files to get in are
:METLDR: offset“810″ size “E960″
BOOTLOADER_0 Offset“FC0000″ size “40000″
EID: Offset “2F000″ size “10000″
CISD: Offset“3F000″ size “800″
then we take the downgrade.bin with the saved changes and we get in flowrebuilder with the option bytereverse dump and extract
This time the program will give us a error, but is a normal error, in fact is okay and will give us a file called downgrade.bin.REV
And thats the file you have to get in in the “flash” console
if all went well at writing ,turn on the console and you will see in the screen press the ps button or in English push ps button, DONT PRESS ANYTHING, turn off the console and put it in factory service mode, once done we need to put the correct file system for 3.55 lv2diag of jaicrab without reader and a special cfw
lv2diag:http://www.logic-sunrise.com/telecharge … icrab.html
cfw: http://pastebin.com/03MFDLGV turn onthe console with the usbstick with these two files in the right usb port (in the last) of the console and it will shut down for 10 / 15 minutes, turn on the console without any usb connected to verify that you did it correctly it will take you to xmb,
If all went well turn off the console and put your lv2diag
FILE2 of this pack:http://pastebin.com/gGETcxMR
the console will turn on for 20 seconds will turn off itself and CONGRATULATIONS you have your console in functional 100% and kmeaw cfw 3.55 100%
Thanks to iGiTaLAnGeL (Tester with progskeet)
Glevand & mfw builder team (cfw)
NDT (Assistant) is a very good person
JaiCraB (lv2diag without reader)
Robs1 (my guide with the nor flash)
EussNL (his great support in the wiki that I use every day PS3DEVWIKI.COM)
Defyboy (for creating ps3devwiki)
To the whole channel darkps3 from irc-hispano.org for their support and many hours of testing we have hit hard mother****ers!
DemonHades (because if you had not post on your website with the lie you said about me, I had not met DigitalAngel or uf6667and these two helped me a lot)
and finally to the people who asked me in private to place a donate paypal button
greetings and from now on i will resume my work with the dual nand and that dump 3.6x that gives me so many problems hehehe
Ive updated the position of METLDR that was misplaced offset 810 ” e960″size
PS3Hax member mximposter has brought us a correct and actual Spanish to English translation, the big quote box above has been edited to reflect this change.
UPDATE 3:
Dospiedras1973was kind enough to post this update here on PS3HaX:
psicoleo, uf6667 and I have made an application to automate the use hex editors to modify the downgrade.bin
Posted by PS3Hax Member News, on 15/08/2011, @ 06:23pm
Remember this? Well the same person has been in contact with an Italian team called DiGiTaLAnGeL and through twitter they have announced that they managed to downgrade a PS3 slim from 3.70 down to 3.55 CFW using the well known NAND/nor flasher Progskeet. This looks like good news for the scene and people stuck on 3.70. They have said that a tutorial will be released soon.
To quote:
For the first time, we have been involved in something truly spectacular
We were the first in the world to test the downgrade from 3.70 to 3:55 on a PS3 Slim (With flash memory, ” NOR “) using the ProgSkeet and patched some files provided by dospiedra, a famous Spanish coder already discovered on the crest of the wave for the method of going back to 3:55 / 3:41 with the PS3 (FAT flash memory “NAND”).
After several attempts, in collaboration with dospiedra, we got to go back from 3.70 to 3:55, enter the factory mode with a simple key to jailbreak, rifleshare a modified version of 3:55 to prevent the SYSCON (the registry in between downgrades) was consulted during the downgrade and now we are happily at 3:55 KMEAW!
With this version of moddata 3:55, you can perform a memory dump today and you can switch on the fly from 3:55 to 3.70 without having to make all this long procedure times: progskeet using it you can go straight to 3.70 changed to 3:55!
Dospiedra said it will release details on the patches applied to the NOR and the update file as soon as possible.
New life for those who arrived too late to enjoy the benefits of the 3:55?——Google Translate
It has also been announced by uf6667 (developer behind Progskeet) that a surprise is waiting for 3.56-3.70 users.
PS3HaX member judges has release his NORway project for the public to enjoy. He has be working on improving the original code for the noralizer released by Marcan of FailOverflow. You can expect a downgrade tutorial soon, but remember this is for NOR based PS3s. below is a qoute of his post:
Hi there..
Here comes my initial release of a NOR flasher soft for the PS3 called “NORway”. I know, there are other “WIP” projects, but I got a little impatient, so I’ve decided to create my own solution. It’s a port of “noralizer” by marcan, a pretty good working NOR flasher implementation for another FPGA board.
Anyway, here’s the README.txt, which should explain everything:
NORway v0.1
This project has been ported for the Teensy++ 2.0 from the original NOR flasher tool
(“noralizer” by Hector Martin “marcan” <hector@marcansoft.com>) that was used to flash
AsbestOS onto the demo PS3 at 27C3, and for experimentation.
Contents:
teensyNORway.avrsln – Source code for the Teensy++ 2.0 (AVR Studio 5.0)
teensydefaultNORway.hex – Compiled hex-file for the Teensy++ 2.0 (AT90USB1286)
hwinstallinstall-*.jpg – Some pics of how I’ve mounted the Teensy (CECH-2504A/B)
hwinstallnor_testpoints.png – Connection diagram of the NOR testpoints (CECH-2504A/B)
serial_install.exe – Teensy serial drivers for Windows
README.txt – this file
NORway.py – PC Python client
Usage:
Install Python + pyserial (see “Prerequisites for Windows”). Install drivers. Connect Teensy
to your PC. Flash Teensy with “teensydefaultNORway.hex” and reset it after completion. Start
Windows’ “Device Manager”, expand the “Ports (COM & LPT)” node, you should see something like
“USB Serial (Communication Class, Abstract Control Model) (COM4)”. This tells you that “COM4″
(or whatever shows up) is the COM port used by Teensy.
At the command prompt enter “NORway.py” to display help.
Procedure to dump your flash:
- PS3 is turned off
- At the command prompt enter:
NORway.py <your com port>
- Turn on your PS3, it shouldn’t boot
- At the command prompt enter:
NORway.py <your com port> dump flash.bin
- When dumping is finished enter:
NORway.py <your com port> release
- Power off your PS3 (disconnect Teensy if PS3 doesn’t boot when restarted)
Dumping takes about 3 minutes. A file “flash.bin” with a size of exactly 16 MB (16.777.216 bytes)
has been created in your current directory.
Flashing is rather slow. Writing a complete flash with the “write” command takes about 2 hours.
Might be improved in future versions…
IMPORTANT:
Before you flash your PS3 with anything new, make sure that the content of your dump is correct
(e.g. compare ros0/ros1 area of your dump against “CORE_OS_PACKAGE.bin” from an actual PS3UPDAT.PUP
of your current firmware). And keep your original dump in a safe place. You might need it.
It’s tested on Win7 x86, but should also work just fine on any x86 Windows >=XP.
Basically it should also work on Linux, but I didn’t test. If you’re running Linux, you
probably know what to do. Serial drivers are not required for Linux.
Unfortunately I couldn’t manage to make it work on any x64 version of Windows, because of
the Python pyserial module.
Thanks to “marcan” for the original implementation.
PS: I’ve already managed to downgrade my OFW 3.61 to CFW 3.55. There’re minor things to rule out, but expect a downgrade tutorial coming soon..
PPS: Thanks to defyboy for the original idea of using a Teensy for flashing!
You may have to read the title of this article a few times to soak in what I just said. Spanish hacker and PS3Hax member, dospiedras1973, has released a method he has been working on for 2 months to downgrade 265mb NAND PS3s, aka Phat PS3′s from firmware 3.6x. His method requires fancy flashing, and the use of the Infectus mod chip for PS3…so it requires soldering skills and is no “easy feat”. This also fixes the Waninkoko brick that many people had issues with a while back.
To quote (translated):
Hello, I’ve been working on this project about two months nowsince I’ve gotten to work as public so that everyone can use,this tutorial is for consoles with 256MB NAND flash does not mean it does not work in 16MB in itself is changed almostthe same in those with normal flash, but because even I havemy fat fucking 16mb 80GB I have not been able to neither prove nor verified.
Nougat (the phrase I owe to some forero around here that I really liked the expression):
With INFECTUS flash0.bin and we get our nand flash1.bin asin the tutorial to repair bad lukin nands do the same process until we get our dump flashfinal.bin 256MB
nand we open this with a simple hex editor and look for this part editor
“00 00 00 00 00 00 00 00 00 00 00 00 00 6F FF E0”
ay you will see that just under a very similar line, I find this datain the offset 000C0020 may vary according to the nand andthe party starts here:-D
EVEN replace that line with the file if you use the hxd1patchcos.bin get in the first 0 of the line -> right click and paste writing before you have to have an open 1patchcos.binhxd in hex and copy its contents to can paste .[ps3hax.net]
and in the same way as the first patched patched this alsocojemos 2patchtrvk.bin pack the file and replace the entire contents including the “00 00 00 00 00 00 10 10 00 00 00 00 00 00 10 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 40”
then we take the option we use reescramble flowrebuilder thisdump so we rebuild our flash0.ECC.bin and flash1.ECC.bin
and flash the result, when you finish you will notice that the PS3 now has a nice on but black screen, it cojemos ourfactory jig to put it into service mode and put it in factory, thenthe typical cojemos lv2diag of yore and the pup you please
(NOTE: the first pup that metais will stay in the console as the minimum version that you can downgrade then, if you want tolose 3.55 to 3.41 then you will have to put the pup up to 3.41before 3.55 or 3.55 will remain in that if cost will not rewrite thedump again to downgrade to lower the pup that you put thefirst time.)
then you put your factory lv2diag to leave the service and you’re good
Note: this applies to repair the brick Waninkoko NAND NOTDONATED plates even sem-001 (tested) (and stepdowngrade xD)
Thanks to:
all channel # irc-hispano darkps3 for supporting me for so long
to donate the INFECTUS austaquio32 to achieve to continuewith my project
to Nodial2ne paid for the help locating files in the nand
to robs1 for helping throughout the process with ideas tomake this possible
and everyone who was patient and not by private haunts mexD
Below is a pic of the infectus modchip install (so you can get an idea of kind of soldering skills required):
Maybe not the way some of you were expecting, but nevertheless, here it is! Infectus has been around since the start of PS3 so you can do some searching on old guides (disregard the old downgrades tutorials), and install videos. No doubt you will be seeing new and fresh tutorials from us related to the install, and full step by step, noob friendly guides on how to do this. This obviously enables a huge chunk of the scene that left or don’t have access to CFW to once again come back . Slim PS3 owners, hold tight – there just might be light at the end of your tunnel too.
Important updates at the Read More link. While the PS3 scene is slow now a days and some of you are dreading for the return of PSN, Mathieulh has posted some interesting discoveries on his Twitter. Mathieulh has managed to QA Flag his PS3 and show the hidden options available for it. Before I go on, most of you are probably wondering what in the world does QA Flagged mean?
To quote:
QA flag is the internal console flag used by Sony, it enables hidden options and removes restrictions for both retail and debug consoles alike. It is used for QA centers and the R&D Department, there are 2 levels of QA flags, Minimum and Advanced, this console has been set to the Advanced one.
Now Mathieulh has come out and said that he will not be telling us how he did this, but nonetheless very cool and it will be interesting to see where this will lead to.
The video below:
To quote video description:
I just QA flagged my Metal Gear Solid 4 Limited Edition console and I thought I’d show you the hidden options for the sake of it. (and because I was bored)
I am sorry for the unstable camera, I only have two hands and the options are hidden and require (along with the actual flag) a crazy button combo to pop up. (I kid you not)
Sorry I am not telling you how to do this, please do not ask.
Yes, this video is real
Here are some interesting Tweets made regarding this:
Mathieulh Mathieulh:
@dantezteam It’s an UNMODIFIED RETAIL FIRMWARE.
@KaKaRoToKS For various reasons, one of them being that you can warez with this, and the flag stays even after updating.
@KaKaRoToKS The QA flag happens to remove a bunch of restrictions that have the side effect of preventing you to warez.
@dantezteam The console is QA flagged, The firmware checks for this flag and will enable special features when it finds it.
@dantezteam Basically it’s what Sony themselves use to allow special debugging on their consoles and loosen restrictions.
@KaKaRoToKS By the way, Advanced QA flag enables downgrading, just my 2 cents… xD
Posted by PS3Hax Member News, on 13/01/2011, @ 02:17pm
Sup folks, it seems like the 3.55 firmware downgrader has been released (3.55 to 3.41), we reported previously that kakarot was working on a method to downgrade using a PUP file, but decided not to release it because it only worked in one machine, but now there is hope for you 3.55 users the downgrader has been released. (more…)
KaKaRoToKs has sure been busy these last few days. Today he posted on his Twitter that he and Xtse have managed to downgrade PS3 FW 3.55 to PS3 FW 3.41. He does say he is not ready to release the method just yet due to the risk of bricking PS3 consoles, but once perfected he promises to release it soon
To quote:
First downgrade from 3.55 to 3.41 successful, Thanks to Xtse! Method not yet ready for the masses because of risk of bricking the ps3.
Posted by GregoryRasputin, on 02/01/2011, @ 07:20pm
I have read quite a few histories on game consoles, they all have been greatly written by great authors, but they all seemed incomplete, they didn’t portray the full history, the full essence of the machine, so as i am involved in the PS3 scene and know quite a bit about it, i thought i would write a complete history, containing the good, the bad and the ugly and believe me the PS3 has quite an exciting history and future, i wanted to write a history that will be enjoyed by everyone, one where people like myself wouldn’t finish the story, thinking there is something missing, i would also like to mention, that this work is my creation, i have written it in my own words, most of it from memory, sourced from various places over the internet, but mostly from ps3hax.net, so without any more interruption, here is the history of the PS3:
2005
16th of May 2005
The world was awoken, to the news of a brand new console, this wouldn’t be a console, but a super computer, it would have everything that you needed for your gaming/media/computing needs, for ten years at least, the original console which was showcased, was silver in colour and had what appeared to be a brand new control pad design, it resembled a boomerang, it had three 10/100/1000 Ethernet ports, two HDMI ports and six USB ports, though unfortunately that wouldn’t be the final design, here are the specs revealed at Sony’s E3 presentation 2005:
Product Name: PlayStation 3
Logo: PLAYSTATION(R)3
CPU: Cell Processor
PowerPC-base Core @3.2GHz
1 VMX vector unit per core
512KB L2 cache
7 x SPE @3.2GHz
7 x 128b 128 SIMD GPRs
7 x 256KB SRAM for SPE
* 1 of 8 SPEs reserved for redundancy
Total floating point performance: 218 GFLOPS
GPU: RSX @550MHz
1.8 TFLOPS floating point performance
Full HD (up to 1080p) x 2 channels
Multi-way programmable parallel floating point shader pipelines
Sound:
Dolby 5.1ch, DTS, LPCM, etc. (Cell-based processing)
Memory:
256MB XDR Main RAM @3.2GHz
256MB GDDR3 VRAM @700MHz
USB Front x 4, Rear x 2 (USB2.0)
Memory Stick standard/Duo, PRO x 1
SD standard/mini x 1
CompactFlash (Type I, II) x 1
Communication:
Ethernet (10BASE-T, 100BASE-TX, 1000BASE-T) x 3 (input x 1 + output x 2)
Wi-Fi IEEE 802.11 b/g
Bluetooth 2.0 (EDR)
Controller:
Bluetooth (up to 7)
USB 2.0 (wired)
Wi-Fi (PSP)
Network (over IP)
AV Output
Screen size: 480i, 480p, 720p, 1080i, 1080p
HDMI: HDMI out x 2
Analog: AV MULTI OUT x 1
Digital audio: DIGITAL OUT (OPTICAL) x 1
Disc Media:
CD PlayStation CD-ROM, PlayStation 2 CD-ROM, CD-DA, CD-DA (ROM), CD-R, CD-RW, SACD, SACD Hybrid (CD layer), SACD HD, DualDisc, DualDisc (audio side), DualDisc (DVD side)
DVD: PlayStation 2 DVD-ROM, PlayStation 3 DVD-ROM, DVD-Video, DVD-ROM, DVD-R, DVD-RW, DVD+R, DVD+RW
Blu-ray Disc: PlayStation 3 BD-ROM, BD-Video, BD-ROM, BD-R, BD-RE
Below, is 2005′s E3 PS3 Presentation, it is split into 14 minute segments for easier viewing:
8th Of June 2005
Gotou Shigehiro of Japan’s PC Watch, interviews Sony Computer Entertainment CEO Ken Kutaragi regarding the PS3, i screen capped the below images from the Beyond3D forums, clicking on the images, will enlarge them, making them more readable:
A few weeks ago we told you about a new project known as #PS3BluRay who were trying to restore BluRay compatibility to downgraded PS3′s. There was a leak related a while ago, but now the OFFICIAL tool is done and ready for release by the team.
To quote:
Project #PS3bluray
DRLtools v0.90 for PS3 01.01.2011
BACKGROUND
Our quest to restore BD playback for those PS3s that lost it after downgrading continues. Unfortunately our project suffered a serious setback last week when one of our discoveries was prematurely leaked: A potentially harmful and incomplete method to restore BD playback was disclosed by an attention-seeking individual. It should be noted that the fix in question is only a “band-aid” solution to the problem. There is a very real possibility of future drive revocation resulting in PERMANENTLY broken playback! However, to make using it safer for those who wish to apply it, we have created this collection of DRL Tools. In the meantime we are continuing to work on a permanent and simple solution for all PS3s.
The tools in the suite are:
- DRLbackup v0.90 (PS3 pkg used to backup DRL1 / DRL2 files to a USB drive)
- DRLgen v0.90 (Windows .net 2.0 application to derive DRL1 / DRL2 files from an MKB_RO.inf file)
- DRLcopy v0.90 (PS3 pkg to restore previously backed-up DRL1 / DRL2 files or to copy derived DRL1 / DRL2 files from DRLgen)
HOW IT WORKS
Each Blu-Ray movie contains a Media Key Block (MKB) as part of its copy protection scheme. Newer movies feature higher MKBs; the latest one is MKB v20. Addtionally, each BD movie has a unique encrypted title key. Both are stored inside the AACS/MKB_RO.inf file of each disc. Fixing BD playback requires exact knowledge of which was the first instance of the highest MKB played so far. DRLgen can be used to identify the Blu-Ray movie with the highest MKB, and then create replacement DRL1/2 files for your PS3 which then restore BD playback.
REQUIREMENTS
1. A means to access Blu-Ray title discs to gather the AACS/MKB_RO.inf file, a Blu-Ray drive in a Mac / Windows PC makes the process easiest. Alternatively, SAK v1.0 can be installed as an OtherOS on the PS3 with firmware 3.15 or lower to accomplish this task.
2. Explicit knowledge of EVERY blu-ray title the blu-ray drive has played and the MKB versions of those discs. WARNING: While you can safely check every BD’s MKB with DRLgen, you should limit the number of attempts of installing DRLs on the PS3, as the full details of the AACS “traitor tracking system” are not well known.
3. A FAT32 USB storage device to store and retrieve MKB_RO.inf and DRL files.
DETAILED INSTRUCTIONS
Full instructions are available on the Project #PS3bluray wiki http://ps3bluray.info/?title=DRLtools
ABOUT THE TOOLS
DRLgen is a new and SAFER utility that uses the MKB_RO.inf from a Blu-Ray disc to derive correctly formatted DRL1 and DRL2 files easily every time. No difficult hex editing or byte-counting is involved. It is important to note that DRLgen uses the AACS’ specification for the MKB format and does not simply assume DRL records start at a specific position and are of a specific length. The previously leaked information makes all these assumptions and is flat out INCORRECT in many situations today, and is NOT future proof and could lead to permanently broken playback.
DRLbackup, previously released, has been updated to work in cooperation with the other two tools. As a best practice, a backup of the DRL1 / DRL2 files should be made prior to any system downgrade. Use in conjunction with DRLcopy for a completely recreatable process to downgrade your Large NAND PS3 and restore Blu-Ray playback in the future.
Note: The location of saved files has changed, users of the older version of the tool should place their saved DRL files into a ‘PS3bluray’ folder in the root of the USB storage device for compatability with the new DRLcopy tool.
DRLcopy is a new PS3 tool that uses the output of the new version of DRLbackup (or properly located DRL backups from the previous version) and/or the derived DRL files from DRLgen to restore your blu-ray functionality after a firmware downgrade.
WHAT YOU CAN DO TO HELP:
We are still in need of a MKB v13 DRL1. If the highest movie you have played on your (non downgraded) PS3 is MKB v13, please create a backup of your DRL1 with DRLbackup v0.90 and email it to projectps3bluray@gmail.com
Thank you!
ABOUT THIS PROJECT:
Project #PS3bluray was formed on efnet by a group of enthusiasts after the Blu-Ray playback problem was discovered, our goal is to find a permanent solution. This is a group effort; we are neither seeking individual fame nor money.
For serious discussion, join us in our IRC-channel #PS3bluray on efnet.
Thanks to everyone involved!
Your time and hard work is very much appreciated.