[Goldeneye]

Originally Posted by zecoxao a few points in this: 1. @haz367 is correct, e3 flasher does not allow you to dump your flash with metldr.2 in it. it's a "safety measure" 2. IF you have a valid dump, i don't understand what's the risk. if it doesn't work and you brick, simply use manual tristate or tristate to flasher and flash the original dump, and you'll have your ps3 back and you can flash the same or a newer firmware. 3. we should DEFINITELY try this, since the risk is minimal, PROVIDED we have a good dump. obviously we would need to use either progskeet or teensy++.

ok thats sucks...
sounds like I might get myself a progskeet soon..
does anybody wants to buy an e3 flasher? :P

EDIT: I knew I should've gotten an progskeet in the first place.. this piece of hardware from e3 isn't quite one of the best..

Originally Posted by tjhooker73 It can, Just Bootldr0.2 and Metldr2 Are what have been stopping us form doing anything.

mind telling me how I can make my e3 dump the nor w/ metldr2?
I can't seem to get it working properly..

[zecoxao]

since two people already tried this and it didn't work (on the site ps3 news .com) i guess it's safe to assume the OP of the french forum is trying to get some attention.

[walsid]

I saw an interesting post from user mistarz in the other forum....

however I have no knowledge to know what it is.

[axujen]

actuellement, une seule console, une 2504A, firmware d'usine 3.56, data code 1A, incompatible avec le 3.55 et donnait un brick avec le patch des trois mousquetaires. Elle ne supporte pas aussi le CFW 4.21 rogero. edit:Aussi,il a fallut deux redémarrage pour qu'elle arrête de s'éteindre edit2: j'ai oublié, il suffit juste que le contenu du dd soit effacé donc prend ntfs

actually, one console a 2504A, 3.56 ofw date code 1A incompatible with 3.55 and is bricked with the 3 mousquetaires patch. it also did not support 4.21 regero CFW

This is from the OP in the french forum, well so long for the 3k and 4k being hacked

[walsid]

moderation can write what the user posted in another forum?

[axujen]

Sur Logic sunrise quelqu'un a réussi sur un modèle 3K http://www.logic-sunrise.com/news-55610 ... sible.html (tout en bas)

In Logic sunrise someone succeseded in hacking a 3k model

if you go to the website search for "serie 3k" or the user named "crisetbets"
he says he managed to jailbreak his 3k console with a kte001 motherboard

EDIT: according to a post in the ps-addict.fr forum this crisetbetsguy is a technician that worked with progskeet, can anyone confirm this?it seems like this crisetbets guys is a technician that worke

[walsid]

Posted for the user mistarz in other forum:

``For gods sake!Just do a 4.++ CFW that installs over OFW 4.++ without a FLASHER or anything.

>> Since the LV0 keys have now been leaked, I believe I can now share this info with you, to help out those who are trying to build their own 4.x CFW :
The NPDRM ECDSA signature in the SELF footer is checked by lv2. It first asks appldr to tell it whether or not the signature is to be checked, and appldr will only set the flag if the SELF is a NPDRM with key revision from 3.56+ (the ones without private keys). This means that the SELF files signed with the new 3.56+ keys still don't have their ecdsa checked (probably to speed up file loading).
If appldr says the ecdsa signature must be checked, then lv2 will verify it itself, and return an error if it's not correct. There are many ways to patch this check out.
1 - Patch out the check for the key revision in appldr
2 - Patch out the "set flag to 1" in appldr if the key revision is < 0xB
3 - Patch out the code in lv2 that stores the result from appldr
4 - Patch out the actual sigcheck function from lv2.
5 - Ignore the result of the ecdsa from lv2.

Here is one of the patches (the 4th one, patching out the check function from lv2) :
In memory 0x800000000005A2A8, which corresponds to offset 0x6a2a8 in lv2_kernel.elf, replace :
e9 22 99 90 7c 08 02 a6
With :
38 60 00 00 4e 80 00 20

This is for the 4.21 kernel (that was the latest one when I investigated this), I will leave it as an exercise to the reader to find the right offsets for the 4.25 and upcoming 4.30 kernel files.
And here's another bit of info... in 4.21 lv2, at memory address 0x800000000005AA98 (you figure out the file offset yourself), that's where lv2 loads the 'check_signature_flag' result from appldr, so if you prefer implementing method 3 above, just replace the 'ld %r0, flag_result_from_appldr' by 'ld %r0, 0' and you got another method of patching it out. Either solutions should work just the same though.
Enjoy homebrew back on 4.x CFW.... ´´


does that help anything?

[manster]

Originally Posted by walsid does that help anything?

No, it's old and from KaKaRoTo (23 Oct 12)

https://twitter.com/KaKaRoToKS/statu...42786972798977

[walsid]

Originally Posted by manster No, it's old and from KaKaRoTo (23 Oct 12) https://twitter.com/KaKaRoToKS/statu...42786972798977

Thanks.

I thought it was something more current,sorry for anything,

[alexsius]

Stop post this useless post NO >3.55 private keys = NO cfw on >3.55 fws