Welcome to PS3Hax, your official PS3 hacks, PS3 Homebrew, and PS3 Downloads scene. Check back daily to keep up with the latest PS3 Hacks and drop by our forums for more PS3 Hacks discussions.
Most of you have heard the news of the PS3 slim downgrade on firmware 3.70, helping those buying newer or updated PS3 slim consoles to the scene. At the moment push aside “soft modding” and its time to bring on the good ole’ soldering iron back out.
This new method of downgrading basically requires the soldering of a multi-console-compatible chip known as ProgSkeet (or clone) which you can find or purchase HERE…or you can use Teensy++ board if you still have those from the good dongle days. A solder-less ProgSkeet is in the works, more info here.
Now the original tutorial was released in a very technical form and in Spanish, but we at PS3Hax have got you covered, and are bringing you easy to follow tutorial that a noob can follow on. This tutorial is long, but it is more detailed than complicated, making sure your bases are all covered.
So lets get started, this tutorial is split into multisteps. You should also check out the posts made here, and the posts that will be made in this thread to get assistance. The following tutorial was modified from the original Spanish translation by Dospiedras1973, and the tutorial/images were modified from PS3Hax member Mattr92 tutorial over at his site: RootedSystem and and thanks to the many PS3Hax members that brought us the proper/native translation of the original instructions .
Highly advised you read this tutorial fully once, and then again and read the comments in this thread and the other threads linked above to get a GOOD understanding of what your getting yourself into and how the entire process works. Remember, this should be a fun and rewarding experience
DISCLAIMER: PS3Hax.net is not responsible for any damage caused to your system. We do not claim credit for this method, we simply have compiled and reorganized the information so it is easier to follow. I kindly request for other sites to not rip this entire tutorial to their websites, but instead link to this page if you wish to share it on your webpage. This page will be actively updated so please keep checking back to find solutions to encountered/discovered problems.
A PS3 (phat or slim) running PS3 original firmware 3.70 and has NOR memory, not NAND, and has ProgSkeet/Teensy++/Clone installed(click here to check if your console has NAND or NOR) – Note: This guide covers ProgSkeet install.
If your a noob (and I assume most of you are), it may be a good idea to have some what of a idea on what NAND/NOR is. It is basically the PS3 flash memory. If you want to get a better understanding of the PS3 system and its various components, you should check this out.
To quote:
The PS3 has 256 megabytes of flash memory to store firmware, using two NAND 128MB Samsung flash chips. The installed firmware data is interleaved between the two flash chips for speed. To prevent errors, Error Correcting Code Checksum (ECC) is added/used on the data in the PS3 flash chips. In newer PS3, a single 16MB Spansion flash chip is used.
Because of the smaller flash chips in later versions, newer firmware versions allow for the firmware data to be partially stored on the harddrive (instead of totally inside the flash), making the flash purely responsible for holding data involved in the critical booting up process. This allows for cheaper flash chips, while using the harddrive for later bootup stages.
To summarize now we are going to be downgrading a PS3 via NOR flasher, so the PS3 MUST have NOR memory most PS3 units have NOR now, the stock/initial PS3s (phat) that were released had NAND, there is a chart linked above so you can make sure. As of now, all SLIMs have NOR memory so your good to go .
First thing is first you have to install ProgSkeet. You can install Teensy++ board as well, or any other ProgSkeet clone but I don’t know how they work and I assume you need to substitute the tools/files for Teensy++.
So there are plenty of good threads to first checkout related to ProgSkeet, for starters this is what ProgSkeet is:
ProgSkeet is your one and only solution to your flashing needs. Whether it is NAND, NOR or any other kind of non-volatile memory – just solder, plug in and operate!
Works on various other devices (in addition to PS3) and consoles including Xbox 360 and Wii.
Here is a sample image of some ProgSkeet installs (gets you an idea what your getting into):
THERE IS CURRENTLY A SOLDERLESS CHIP IN THE MAKING, BUT AS OF NOW (8/20/2011), YOU MUST SOLDER AND PERFORM THIS METHOD IF YOU WISH TO DOWNGRADE FIRMWARE 3.70
Make sure your PS3 first has NOR memory, all SLIM PS3′s do, the older “phat” PS3 have NAND. Check if your console has NOR memory here.
Find the right pinout for your PS3 motherboard HERE. (Scroll down to “Pinout Gallery“). Additional ProgSkeet pinouts HERE. Teensy++ Pinouts located HERE.
Gather soldering tools, resin, and wire.Recommended gauge for wires: 24 (anything from 20-26 AWG is fine). Keep them at ~20cm each. – Note: 40/80 wire Floppy cables won’t work, to see a full list of compatible wires see this table.
Here are 2 “prep” videos for your ProgSkeet:
STEP 4 – The NOR Dumping
Now the actual work begins and the part you all have been waiting for, the NOR dumping!
Install Microsoft Visual C++ 2008 SP1 Redistributable Package (x86) [Download Here]
Restart your computer.
Launch the ProgSkeet Dumper
Plug in your ProgSkeet and wait for for the jingle/beep
Insert the following values for the NOR: if you have a SPANSION branded flash memory on your PS3 then: NOR Sector Size = 128kb / NOR Sectors = 128. If you have a SAMSUNG branded flash memory on your PS3 then NOR Sector Size = 4kb / NOR Sectors = 4096.
After getting the correct values inserted, select output and then press DUMP, and you should have the exact dump generated as seen in Part B.
Dump the NOR from your PS3 with the ProgSkeet/Teensy++ it should be exactly 16,777,216 bytes. If it is not, go back to part A, and keep re-dumping until it is. Make sure its down to the byte.
Next open up Transplante.exe, in “donador” select your nor-dump.bin.REV and for “receptor” select downgrade.bin and click GO.
Now that your downgrade.bin is successfully hexed open Flow Rebuilder back up. Select “Byte reverse and extract a NOR Dump” and drag downgrade.bin to the bottom option and click “Execute Operation”.
You will now be presented with an error, this is normal. All you are interested in is the file generated: “downgrade.bin.REV” -> This file will be flashed onto your PS3.
Now comes the last, and actual flashing part. Make sure you follow all the instructions above to the letter, and if you have any issues report them before continuing.
From the ProgSkeet flasher you downloaded in step 1, flash the file you generated in step 2 #5: downgrade.bin.REV to your PS3 (make sure your PS3 is on during this process).
If you flashed your PS3 correctly, your PS3 will reboot and show this message: “Push PS button”. DO NOT PRESS THE PS BUTTON!
Turn off the PS3 console as we will now place it in Factory/Service mode.
Copy these files to the ROOT (not subforulder!) of USB Mass Storage Device-: **WARNING: Make sure that this is a USB stick formatted to FAT 32. DO NOT use your MP3 player, phone, or anything except a USB stick as the timings are crucial for the downgrading process! If your having issues, we recommend you reformat your pen drive/usb drive with THIS tool.
Kmeaw CFW PUP File (3.55) [Download HERE or Mirror]
Insert to right most USB port on PS3
Now turn on your PS3 and leave it alone, the PS3 should turn off by itself in 10-15mins.
Unplug your USB from the PS3, and turn the console back on. It should boot to the XMB menu, once it does this turn your PS3 off again.
Now copy and replace this file on your USB: Modded LV2Diag [Download Here]
Insert once again to the right most USB port on your PS3
Turn on your PS3, it should turn off by itself in about ~20 seconds.
You have now successfully downgraded, and installed 3.55 KMEAW CFW on your PS3! You can check out our forums for more info on various homebrew, or drop by our tutorial section for more neat things you can do with your unlocked PS3 .
Don’t use any USB Mass Storage Device with enhanced functions as: encryption, fingerprintreader, U3, pincode etc.
Don’t use USB Mass Storage Devices with a long initialisation time (e.g. some MP3 players)
Don’t use multipartitioned USB Mass Storage Devices, only use 1 single primary FAT32 partition.
Make sure they are formatted according to specifications with FAT32 (e.g. HP USB Format Tool – or TOKIWA / Ridgecrop FAT32 formatter)
Most USB Mass Storage Devices that’ll work effortless with PenDrive Linux, will also work with the PS3 (for downgrading, upgrading, storage of your Game dumps and any normal filestorage under the XMB). Those USB Mass Storage Devices are most likely also the ones giving you the least problems under more exotic platforms like PSX/PSone, PS2/PStwo, Xbox/X360, Gamecube/Wii etc.
The libusb-win32 Kernel Driver needed for the the flasher to get access to the USB port was not installed. Make sure you unpacked the drivers_xxxxxx file and installed the Progskeet driver (VendorID:1988 / ProductID:0001 in case you need it).
In case of “the application has failed to start because its side-by-side configuration is incorrect” make sure Microsoft Visual C 9.0 runtime is installed and “Windows Installer” is not disabled (set to manual or automatic) in Services.msc
XBReboot v0.05:by phonsey and tuxuser on XBH – Has now also been released for Zephyr, Falcon and Jasper-16mb motherboards. *Update* They are all available with the latest 8955_1 patch revision now, so each 16mb motherboard can now run XBR v0.05 8955_1! Only support for Jasper 256/512mb motherboards is still missing now. Don’t forget to inject your own KeyVault and Config before flashing!
360 Flash Dump Tool:by MODFREAKz on XBH – Since Robinsod released the source of “360 Flash Dump Tool” and stopped developing a few people decided to continue develop this great app.
This tool will allow you to decrypt/encrypt and extract various parts of a XBOX360 flash dump and much more!!
Note: Jasper dumps are not supported in this version, largeblock is being worked on.
What’s new/fixed:
- Bugfix, regarding to CD decryption. If you have a 1920+ CD version it doesn’t decrypt CD properly. (by arnezami)
- Bugfix, if a CPU key starts with 00 then the program crashed. (by arnezami)
- Added, separate extract option for all important stuff (Security Data, Extended Key Vault, Console Revocation List, AP25 Challenge Database, Config Blocks)
- Added, console ID generation method (source from xorloser)
- Added, detection and correction of 1 wrong byte in the CPU-Key (by MODFREAKz)
- Added, XValue decryption (by Redline99)
- Added, support when raw extracting a file that it sets the Date/Time stamps as per original in Nand
- Fixed, decryption for “Console Revocation List” (Thanks to xorloser and Redline99)
- Fixed, “Kernels not extracted (CPU Key required, CD Ver == 1920)”
- Changed, full KV.bin extract and patch
- Added new OSIG types and unspoof possibility
- Added/Changed new regions
- 1BL, XEX1 and XEX2 are set as standard
- Improved exception handling
- Added Drag and Drop
- Changed Icon
- Code cleanup
- Fixed a lot of other small bugs
.
