[racer0018]

Software needed:
•Hardware flasher (Progskeet, Infectus)
•Flow Rebuilder v4.1.3.2
•Hexeditor (HxD is FREE)

Ok first make sure that you have your drivers installed on your computer. Also make sure that your hardware is installed on your ps3.

Next make a dump using your software for your flasher.

1. When making your first dump, make 100% sure you have a good dump, make several to be safe and compare them with HxD. If you don’t have a good backup and erase your NANDs then you’re pretty much screwed... THIS IS IMPORTANT!

2. Once you have your NAND flash dumps, use FlowRebuilder v.4.1.3.2 unscramble then interleave flashes into one unified dump. Let’s call the output file 256Mb.bin

3. Open 256Mb.bin with HxD (Included in rar files)

3a. Go to offset: 000C0020 (Ctrl+G) which should look something like this

(BRICKED PS3 DUMP @ 000C0020)


Code:
00 00 00 00 00 00 00 00 00 00 00 00 00 53 CC 78 .............SÌx
00 00 00 01 00 00 00 18 00 53 CC 78 00 00 00 00 .........SÌx.... OR SIMILAR TO THIS (WORKING CONSOLE)


Code:
00 00 00 00 00 00 00 00 00 00 00 00 00 6F FF E0 .............oÿà
00 00 00 01 00 00 00 17 00 00 00 00 00 6F FF E0 .............oÿà
00 00 00 00 00 00 04 60 00 00 00 00 00 00 44 98 .......`......D˜
61 69 6D 5F 73 70 75 5F 6D 6F 64 75 6C 65 2E 73 aim_spu_module.s
65 6C 66 00 00 00 00 00 00 00 00 00 00 00 00 00 elf.............
00 00 00 00 00 00 49 00 00 00 00 00 00 01 E2 54 ......I.......âT
61 70 70 6C 64 72 00 00 00 00 00 00 00 00 00 00 appldr..........

Open 1patchcos.bin in HxD, Select All and Copy
Go back to your NAND dump and go Edit – Select Block
In the box that pops up, tick the length button to enable the text and enter DFFFE1 as block length. Then go Edit – Paste Write (not insert!)

This next step is optional, I would suggest trying without this patch first as I did have success without it. 1patchcos.bin is based on 3.41 CoreOS, and 1patchcos355.bin is based on 3.55 CoreOS. The second worked for me. The original 1patchcos.bin should work so try that first, in rare cases it doesn’t then try 1patchcos355.bin.

3b. Now go to offset: 00093800 and you should find something like this:


Code:
00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 20 ....... ....... <-PASTE WRITE FROM HERE
00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 ...... .........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 60 ...............`
53 43 45 00 00 00 00 02 00 00 00 02 00 00 00 00 SCE.............
00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 60 ...............` Open 2patchtrvk.bin and copy all of its content and paste WRITE from the above offset

4. Save the changes – IF THE FILESIZE HAS CHANGED YOU DID SOMETHING WRONG!

5. Again open FlowRebuilder v.4.1.3.2 and this time we want to Re-scramble the modified dump then de-interleave it into two new flashes. Choose your flash0.bin, flash1.bin and the 256Mb.bin you modified. When done it should say 42 or 43 blocks modified each NAND depends on if you only did one or both patches

Now you end up with 2 new files called flash0.bin.new.bin and flash1.bin.new.bin. You will also get A folder called ‘Differential Flashing’ which contain 2 txt files. These can GREATLY speed up the flashing/restoring process.

6. With the flasher software you are using flash both dumps back.

7. When done, power your console up. If you get YLOD then you should try the second patch as mentioned earlier. If all went well you should have a green light but black screen (might differ slightly, mine powered off after about 20/30 seconds) You MAY need to put your console into service mode at this point if you were brick-fixing (usual dongle method). The Lv2diag files are included.

8. Make a downgrade to your desired firmware – If your PS3 refuses to work with a particular PS3UPDAT.PUP, try again with a different one. I tried 3 times before mine would accept a firmware.

NOTES: if you are patching with 3.55 cos you have to use the special 3.55 downgrade PUP, which means you will get 3.41 as min version. This can be changed with doing the "DOWNGRADE" Procedure again, choosing another firmware in service mode downgrade.

If you get YLOD after flashing, check your soldering & do a full dump & compare the NANDS. Even 1 write error will prevent your console from booting.

When attempting to do a downgrade, enter service mode before patching. It will make it easier even if you forgot its not a problem, you just need to enter service mode. (this is only possible when downgrading) BUT remember DO NOT ENTER SERVICE MODE ON v3.66 UNLESS YOU HAVE A HARDWARE FLASHER (INFECTUS, PROGSKEET, WILLEM, ETC)


This is great guide that Mushy made and it work great for downgrading. Here is the original guide in case someone want it. It was not written for the progskeet. The downgrade files you will have to google for them. I tried to post the here but are bigger then what they allow. thanks

[BobbyBlunt]

Thanks Many people have been asking about NAND downgrade guides.

[Chovoman]

A question:

Is this a solderless tuorial or not?
Furthermore,the problem is when reading FW with clips. There is 2 nands and 2 clips. in 90% of trials ,one chip wont be read good. Can i read first one chip,then second? How do we now which new flash to flash to which nand chip? Or there is no problem if we switch chips?
Example flash new 128mb flash from the second chip to the first one and vice versa.
Does it brick the console,if we mix flash files?

[racer0018]

Ok for one what are you using for settings for the software. You should have:
select big block
select raw
pages per block 64
blocks 1024

you start the ps3 and then wait to turn on progskeet 10-15 secs. close r7 and do everything thing as usual.

Also what are using for software? is it winSkeet, or progskeet.
you dont want to mix up flashes. are you using the clips that connect to both nands or one at a time. thanks

[Chovoman]

CAn you give me some pure 3.3V point on sem-001 motherboard ,so i can /read/write flash without closing teh console? I have solderless clips,and is a pita opening/closing the console evrytime some contacts is not good.

[xrinnenganx]

is there a pictured tutorial anywhere on what points to solder?

[Freesty]

In tutorial say that for flashing nand need to power on ps3, but if i use 360clip and another metod with bridge R99 & R11 and power from usb can i flash nand without power on ps3? i ask because i do everything from tut but cant downgrade console

[master737373]

Originally Posted by Freesty In tutorial say that for flashing nand need to power on ps3, but if i use 360clip and another metod with bridge R99 & R11 and power from usb can i flash nand without power on ps3? i ask because i do everything from tut but cant downgrade console

You should power on the PS3, wait about 20 seconds and power the progskeet. The console should shut off leaving the flash's powered.

Also, to the OP, to verify your dump, you don't compare multiple dumps with a hex editor. You use flowrebuilder to extract the dumps and see if all the files are in there and make sure the sizes are correct. Also, you need to make sure the files are in the correct location by model number. All on the dev wiki.

[adiczeq]

Hello, I have question regarding programmer. Is it possible to perform a downgrade using so called "stationary" programmer ? SmartPro5000U model to be exact. I've tried few times but unfortunatelly everytime it ended up with console Ylod. Dumps are ok, I'm using FlowRebuilder with autopatcher for Progskeet from ps3devwiki - it says there was 155blocks modified on each NAND. PS3 60GB fat based on COK-002 mobo with nands on one side. For all this I'm using spare NANDs ( I became a proud owner of 2 dead ps3 consoles ) from one of my consoles so my originals are intact,and if I just do a copy of them - it works fine,so I can exclude NANDs fault .I'm not a professional, I just simply have access to programmer like that at work, and I wanted to downgrade my 4.11 updated (not by me ) so I could marry BD from other console as mine is so called fried and perhaps save some money on Progskeet purchase
Thanks in advance for everyone who actualy read that post

[v8s10]

Originally Posted by adiczeq Hello, I have question regarding programmer. Is it possible to perform a downgrade using so called "stationary" programmer ? SmartPro5000U model to be exact. I've tried few times but unfortunatelly everytime it ended up with console Ylod. Dumps are ok, I'm using FlowRebuilder with autopatcher for Progskeet from ps3devwiki - it says there was 155blocks modified on each NAND. PS3 60GB fat based on COK-002 mobo with nands on one side. For all this I'm using spare NANDs ( I became a proud owner of 2 dead ps3 consoles ) from one of my consoles so my originals are intact,and if I just do a copy of them - it works fine,so I can exclude NANDs fault .I'm not a professional, I just simply have access to programmer like that at work, and I wanted to downgrade my 4.11 updated (not by me ) so I could marry BD from other console as mine is so called fried and perhaps save some money on Progskeet purchase Thanks in advance for everyone who actualy read that post

155 blocks modified is waaay too many, should only be around 42-47. Recheck your patch procedure, or try patching manually.