The Ultimate Idiots Guide: Ps3 hardware downgrading
The Ultimate Fool Proof Guide:
Ps3 hardware downgrading
Downgrade from the latest 4.41 FirmWare
[Warning]DO THIS CHECK FIRST DO NOT SKIP THIS STEP.
IF YOUR PS3 CAN BE DOWNGRADED AND WHAT FLASHER YOUR PS3 NEEDS FOR THE DOWNGRADE
Locate the manufacturing date code found on the base of your ps3.
it will look like this
Where you see the “xx” part below you will see numbers on your ps3.
so the image above shows CECH-4003A but it will be in the below table as CECH-40XX the last 2 numbers do not affect whether it can be downgraded or not so we don’t need to list that part.
Now use http://www.ps3hax.net/showthread.php?t=51288"]DEFAULTDNB's PPC+ MD5 & DATE CHECK TOOL (DCT)[/URL]
or follow the steps below
Phat type ps3’s
CECHAxx (OK To Downgrade) NAND = Progskeet / TEENSY++ 2.0 / InFeCtuS
CECHBxx(OK To Downgrade) NAND = Progskeet / TEENSY++ 2.0 / InFeCtuS
CECHCxx(OK To Downgrade) NAND = Progskeet / TEENSY++ 2.0 / InFeCtuS
CECHExx (OK To Downgrade) NAND = Progskeet / TEENSY++ 2.0 / InFeCtuS
CECHGxx (OK To Downgrade) NAND = Progskeet / TEENSY++ 2.0 / InFeCtuS
CECHHxx(OK To Downgrade) NOR = Teensy++ / Progskeet / E3 Flasher
CECHJxx (OK To Downgrade) NOR = Teensy++ / Progskeet / E3 Flasher
CECHKxx (OK To Downgrade) NOR = Teensy++ / Progskeet / E3 Flasher
CECHLxx (OK To Downgrade) NOR = Teensy++ / Progskeet / E3 Flasher
CECHMxx(OK To Downgrade) NOR = Teensy++ / Progskeet / E3 Flasher
CECHPxx (OK To Downgrade) NOR = Teensy++ / Progskeet / E3 Flasher
CECHQxx (OK To Downgrade) NOR = Teensy++ / Progskeet / E3 Flasher
DECHAxx (OK To Downgrade)
This information was taken from HERE[/URL] and HERE[/URL]
Slim type ps3’s
CECH-20xx(OK To Downgrade) NOR = Teensy++ / Progskeet / E3 Flasher
CECH-21xx (OK To Downgrade) NOR = Teensy++ / Progskeet / E3 Flasher
CECH-25xx (DOUBLE CHECK THIS WITH MIN VERSION CHECKER[/URL] OR http://www.ps3hax.net/showthread.php?t=51288"]DEFAULTDNB's PPC+ MD5 & DATE CHECK TOOL (DCT)[/URL] AS SOME CANNOT BE DOWNGRADED) (IF OK To Downgrade) NOR = Teensy++ / ProgSkeet / E3 Flasher
CECH-30xx (CANNOT Downgrade)
CECH-40XX (CANNOT Downgrade)
This information was taken from HERE[/URL] & HERE[/URL] & HERE[/URL]
1a. JTAG Programmer called INJECTUS (to update the bitstream if you’re using the Progskeet with a NAND solder less clip)
1b."Y" Adaptor (NAND Adaptor PCB)
1c. NAND clip (360-clip)
nand clip sellers
this has both experts in soldering and ppl who want to minimise soldering in mind.
for the experts
there is a new product out that allows you to flash the NAND off board
this means you remove each NAND one at a time solder each in turn to the new board then you can read and write much easer than if it was on board
for ppl who wish to minimise soldering
there is a new product out that allows you to simply attach the nand clip to the progskeet and not have to buy or solder the injectus to the progskeet.
as this allows you to use the default bitstream that is allready on the progskeet.
so simply put this can be plug and play.
it works with all progskeets
You can remove tsop and use this
Or use a clip
All with retail bitstream without the need of injectus
Sale of adaptor is at: http://www.ps3hax.net/showpost.php?p=510994
ProgSkeet 1.2 / 1.21 full kit
360clip (NAND)
this has both experts in soldering and ppl who want to minimise soldering in mind.
for the experts
there is a new product out that allows you to flash the NAND off board
this means you remove each NAND one at a time solder each in turn to the new board then you can read and write much easer than if it was on board
for ppl who wish to minimise soldering
there is a new product out that allows you to simply attach the nand clip to the progskeet
so simply put this can be plug and play.
it works with all progskeets
You can remove tsop and use this
Or use a clip
All with retail bitstream without the need of injectus
Sale of adaptor is at: http://www.ps3hax.net/showpost.php?p=510994
A development board (to get into factory service mode) Teensy++ is a development board so if you do the TEENSY++ guide then you can skip this
for psp see THIS[/URL] thread
Development Boards
Dongles, HUB’s & Unknown Jailbreak Devices (with an encasing, like an USB-stick)
Compatible USB mass storage (usb stick)
Ok this is where I need your help please post any USB sticks that you know work along with a link to where to buy one from. This way we can have a list here for others to use
The following is a direct paste from the wiki (see below)
o Don't use any USB Mass Storage Device with enhanced functions as: encryption, finger print reader, U3, pin code etc.
o Don't use USB Mass Storage Devices with a long initialization time (e.g. some MP3 players)
o Don't use multi partition USB Mass Storage Devices, only use 1 single primary FAT32 partition.
o Make sure they are formatted according to specifications with FAT32 (e.g. HP USB Format Tool - or TOKIWA / Ridgecrop FAT32 formatter)
I have 4 USB Stick’s and only a 5 year old 512mb stick worked (“GURU” Brand Name) the other 3 NOT WORKING are : (HP 4GB)(Kingston Data Traveler 2GB)(SanDisk cruzer 4GB)
I wonder if they have to be 1GB or below. Or cheep & nasty devices to work?
Info taken from here: http://www.ps3devwiki.com/wiki/Downg...PSgrade_Dongle
Philips driver’s (PH1 & PH0)
anti tamper Torx driver (T8)
or a console opening tool kit
5. Soldering iron 30w iron with a fine end
6. Solder
7. Flux (to help the solder bind (stops what’s called dead solder where the solder hasn’t made a connection))
(jumper wires work great) (to connect the flasher to the ps3) 1 wire is still needed for E3 Flasher
Wire reference For wiring, use 20-26 AWG. 18 can be too stiff while 28 is too fragile. 24-26 AWG works fine in most cases. The Grounds and VCC wires may ofcourse be thicker than the signal wires. Keep wires short, up to ~20cm max (longer gives errors). The shorter the better : 15cm and shorter mostly works fine with AWG26 on NOR.
For NOR wiring the solderarea (the NORpoints) is 10x larger than the solderarea used with NAND (pitch 0.5mm, just as NOR chips btw), so for NOR you have much more headroom (and also need!) to use thicker wires (for NAND you most likely want to use 28 AWG and cannot use much thicker)
Use caliper to measure unknown/unmarked wires and compare with above table/listing.
[edit] Table: AWG (inch) / Euro (mm) American
Wire
Gauge Diameter Cross
Sectional
Area Diameter Cross
Sectional
Area Notes
(AWG) d (inch) A (inch2) d (mm) A (mm2)
0000 (-3) 0,4600 0,1662 11,6839 107,2172
000 (-2) 0,4096 0,1318 10,4048 85,0279
00 (-1) 0,3648 0,1045 9,2658 67,4308
0 0,3249 0,0829 8,2515 53,4756
1 0,2893 0,0657 7,3482 42,4085
2 0,2576 0,0521 6,5438 33,6318
3 0,2294 0,0413 5,8275 26,6715
4 0,2043 0,0328 5,1895 21,1516
5 0,1819 0,0260 4,6214 16,7742
6 0,1620 0,0206 4,1155 13,3027
7 0,1443 0,0164 3,6650 10,5496
8 0,1285 0,0130 3,2638 8,3663
9 0,1144 0,0103 2,9065 6,6348
10 0,1019 0,0082 2,5883 5,2617
12 0,0808 0,0051 2,0527 3,3092
13 0,0720 0,0041 1,8279 2,6243
14 0,0641 0,0032 1,6278 2,0812
15 0,0571 0,0026 1,4496 1,6505
16 0,0508 0,0020 1,2910 1,3089
17 0,0453 0,0016 1,1496 1,0380
18 0,0403 0,0013 1,0238 0,8232
19 0,0359 0,0010 0,9117 0,6528
20 0,0320 0,0008 0,8119 0,5177
21 0,0285 0,0006 0,7230 0,4106
22 0,0253 0,0005 0,6439 0,3256
23 0,0226 0,0004 0,5734 0,2582
24 0,0201 0,0003 0,5106 0,2048
25 0,0179 0,0003 0,4547 0,1624
26 0,0159 0,0002 0,4049 0,1288 Best used for NOR consoles
27 0,0142 0,0002 0,3606 0,1021
28 0,0126 0,0001 0,3211 0,0810 Best used for NAND consoles
29 0.0113 0.286 0.064
30 0.0100 0.255 0.051
31 0.00893 0.227 0.040
32 0.00795 0.202 0.032
33 0.00708 0.180 0.025
34 0.00631 0.160 0.020
35 0.00562 0.143 0.016
36 0.00500 0.127 0.013
37 0.00445 0.113 0.010
38 0.00397 0.101 0.008
39 0.00353 0.0897 0.006
40 0.00314 0.0799 0.005
[edit] Alternative/cable comparison PATA/floppy 40-conductor cable - AWG28 (0.0126" / 0.321mm) with 0.0333" pitch +/- 0.002"
PATA/floppy 40-conductor cable - AWG30 (0.0100" / 0.255mm) with 0.0333" pitch +/- 0.002"
Category 5e patch (TIA/EIA 568-5-A) network cable: 4 twisted pairs of 26AWG (0.0159" / 0.405mm)
SATA : solid 26 AWG - 0.0159" / 0.405mm
SATA : solid 28 AWG - 0.0126" / 0.321mm
SATA : solid 30 AWG - 0.0100" / 0.255mm
9. Heat transfer compound also known as thermal paste (your removing your heat sink so you should replace the compound)
10. Your controller USB cable (to connect the flasher to your pc)
11. A PC (computer)
Open your ps3
Slim Strip Down
the ps3 slim
A blue Phillips screw is hidden beneath the screw cover. Remove this screw.
Next, remove the hard drive cover.
The drive enclosure has a metal pull tab attached to it. Pull on it to release the drive from the bay.
Remove the three T8 security Torx screws on the underside of the PS3 slim.
remove the warranty sticker (there are ways to remove these without damaging the sticker. Using a hair dryer (but you can warp the casing if you get it too hot) and sticky stuff remover (yes that’s what it is called) but if you put too much on it can get into the system & you don’t want that)
Seven Phillips screws need to be removed from the bottom. the rubber pad on the front-right corner of the PS3 has no screw hidden underneath. Remove the other 3 and the 4 plastic screw covers. You should be able to simply lift these off with your finger nail.
Flip the PS3 over & remove the top case lifting the rear first (like opening a door)
Disconnecting two power supply cables in red and two screws in blue
Removing the power supply.
remove the inlet power connector
Unplug the fan
Remove the bdvd drive flat cable. can be lifted with a finger nail & Remove the screw
The Blue-ray drive comes right out.
pull out the power panel’s flat cable
remove 3 black in red and 2 silver screws in blue
the logic board lifts free of the chassis
Unscrew 5 silver screws in red securing the shield do not remove the 2 black screws in yellow & Remove The screws for the two identical brackets in blue
remove the metal shield from the logic board. and in red you can see your board type
lift the logic board it will feel like its glued down but lift till there is pressure and wait as it will slowly un stick with a “pop”
take note of where the heat transfer pads are in red. They may be stuck to components on the logic board.& clean the old heat transfer paste from these areas with alcohol wipes in blue
clean the two chips with alcohol wipes in blue & you will notice your NOR chip in red
a close up of the NOR chip (you need to either jot down every detail from the chip or its better to take a clear photo and check you can zoom in and read it)
all the old heat transfer paste removed
place a line of heat transfer paste to both chips
using a credit card spread the compound over both chips going top to bottom, left to right, bottom to top, and right to left. Until it’s on evenly. Then put the logic board back onto the bottom heat shield (the one you just cleaned)
place 2 folded pieces of card in the areas shown
screw the two identical brackets back in place insuring they are sat on the card NOT touching the logic board.
plug in the fan (DO NOT MISS THIS STEP)
re attach the power brick connect the wires in red and screw it down in blue
flip it back over and your all set
Phat Strip Down
the "phat" ps3
On the left side of the console you will see a few rubber feet. The first screw to be removed is underneath the rubber foot circled in red in the picture below. The foot can be pried out with a small screw driver. Then underneath is a Torx security screw.
Once the screw is removed, slide the top of the case to the left. It may require a bit of force to slide if you’re opening the console for the first time. After the top slides as far as it will go, lift the top and it should come off as seen in the picture below:
After the top is off, there will be another cover.
You will need to remove the 7 long screws circled in red.
After the 7 screws are removed, gently lift up the back corners of the top half of the console. There are 2 small clips near the back you may need to undo with a small screw driver. Now the top of the console should just lift off (with a bit of gentle force) and you will see the guts of the PS3.
First, the power supply (The silver box on the left) has to be removed. Remove the screws circled in red, and take out the plug, the power supply will just lift out.
take out the mains plug in the back of the power supply. The power supply should now be completely disconnected from the PS3.
the Bluetooth board (in the 60GB models, it also has wireless). Unscrew the 4 screws and unplug the ribbon cable and the board will just lift out
Now to remove the Blue-ray drive. This is relatively easy. Lift the drive up about 2” and you will see a really wide ribbon cable connecting the drive to the motherboard. Unplug it.
There will also be a plug near the front of the Blue-ray drive. Unplug it as well. The drive will then just lift out.
Now you will (hopefully) see this
Next, we have to remove the small circuit board that has the Reset and Eject buttons. This board is attached to a small metal bracket. Remove the 4 screws holding the board and the metal bracket and unplug the small ribbon cable. The board should now easily lift out.
Now remove the screws circled in red
After the screws are removed, gently lift out the whole motherboard along with the back panel like the pictures below: Make sure you have taken out the plastic cover with the HDD sticker on it! Otherwise the clips on it will get bent!
After the bottom of the PS3 case is out of the way, you can see the cooling system on the bottom of the motherboard. Now remove the plastic back panel. There are 4 small plastic clips (2 on either side of the motherboard) that you need to lift to take off the back panel.
Flip the motherboard back over. Unscrew the 4 screws (circled in red) holding 2 metal brackets down. Once these screws are undone, take off the 2 metal brackets.
It will now look like this
After that, flip the motherboard over again. Now gently pull up on the heat sink. Be gentle here. The cooling system will lift up off the CPU and GPU and come off completely. A bit of force will be required here as the heat sink will be stuck down to the CPU and GPU with white thermal paste.
This picture shows the fan removed. Don’t remove it as the fan and heat sink need to be re-attached during the downgrade.
On the bottom of the heat sink and on the CPU and GPU will be white thermal paste. This is used to help transfer heat from the chip to the heat sink. This needs cleaning off as you should put fresh thermal paste on again when you reassemble the PS3. If you don’t and the paste is dry or doesn’t re-sit properly then there is a high risk of the system over heating and you will get a ylod error later on.
After you get the heat sink off, you can lift up the metal shielding. Be gentle with this as the shielding is very thin and if it bends it could possibly cause the shielding to short out something on the motherboard when the PS3 is reassembled.
Now flip the motherboard over again, and remove the metal shielding on the other side and you will now see the naked motherboard
YOU MUST BE ON 3.55CFW TO USE ALL THESE FILES
Download remarry-3.55-files.rar[/URL]
1. Extract remarry-355-files. you will have 3 folders & 3 readme.txt files
FactoryServiceMode-v0.2
remarry-3.55
MD5
FactoryServiceMode-v0.2 readme.txt
remarry-3.55 readme.txt
MD5 readme.txt
2. open the MD5 folder and run MD5.exe. then check the following
----------------------------------------
the hash files for the FactoryServiceMode-v0.2 files are:-
----------------------------------------
FactoryServiceMode.gnpdrm.pkg
md5: 5A497659B48134B65BD45D9DD089BA86
FactoryServiceMode.pkg
md5: 960ECADFCA52ABBA6D4C555188840CC4
----------------------------------------
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
----------------------------------------
the hash files for the remarry-3.55 files are:-
----------------------------------------
(in fsm remarry files folder)
Lv2Diag.self (enter fsm)
MD5: C48E5EBFC00ABD89094CB73A2B0BEA59
PS3UPDAT.PUP (3.30 RETAIL/CEX)
MD5: 6bdf1b2409d705a0136c40746c62e85d
(in get out of fsm folder)
Lv2Diag.self (exit fsm)
MD5: 7A20BFDAE65EEFB47A4425DB1B52DCDE
----------------------------------------
3. put the contents of FactoryServiceMode-v0.2 files on a fat32 formatted USB Mass Storage device should look like:-
----------------------------------------
FactoryServiceMode.gnpdrm.pkg
FactoryServiceMode.pkg
----------------------------------------
4. Put the USB Mass Storage device into port 0 (closest to the reader)
5. Install the appropriate pkg for your system;
FactoryServiceMode.gnpdrm.pkg for CEX and
FactoryServiceMode.pkg for DEX.
Leave the USB Flash Drive in the PS3.
6. Run the app and listen for the single beep, you should now enter FSM automatically.
Usage:
------
When you run the app it will beep once and reboot if successful.
NB. Three beeps indicates a failure, report the contents of factory.txt in this thread for help.
(Factory.txt will be saved to the USB flash.)
At this point you will now be in Factory Service Mode (FSM).
NB. This app will not work on any of the "reDRM" firmwares, aka Cobra or TrueBlue CFW.
7. Inside the remarry-3.55 folder you will have 2 more folders.
fsm remarry files
get out of fsm
8. put the contents of fsm remarry files on a fat32 formatted USB Mass Storage device should look like:-
---------------------------------------
Lv2diag.self
manufacturing_updater_for_reset.self
fdm_spu_module.self
PS3UPDAT.PUP
cfg/standalone.cfg
----------------------------------------
9. Put the created USB Mass Storage device into port 0 (closest to the reader) and run.
Drive Init Executing means it is starting the remarry process
Drive Init Failed with big pink letters 'NG' (No Good!) means the process failed. Most likely solved by fixing the communication issue with the drive. (check the cables to the drive)
10. After you run the initial remarry process, do not take it out of factory service mode.
11. Put a BD movie disc in and run it on the PS3. (This restores your DRL files!)
alternatively in the latest multiman there is the option to restore these files in the "system" collum
12. now delete the current files on the USB Mass Storage Device
then put the contents of get out of fsm on the fat32 formatted USB Mass Storage device.
it should now look like:-
Lv2diag.self
13. Put the service mode JIG/dongle/PSGrade into port 0 (closest to the reader) and turn on the ps3 to get into factory service mode.
14. Launch PS3 as normal.
judges lots of time spent helping me with various issues PS3 Development Wiki[/URL] (without this awesome site this guide would not be possible) master737373[/URL] (Who helped me allot with my first downgrade & is always willing to answer my questions) gDrive[/URL] (for the hours & hours of his personal time he gave me to help with problems with the creation of this thread. I won’t forget "this" )
eussNL on #ps3downgrade for always being helpful and (along with the rest of the guy's & gal's on there) always helpful with testing peoples dumps.
I have done my best to insure this has a low brick possibility. but you are messing with your system files and hardware so there will never be a brick proof guide[/COLOR]
I am not a dev etc. just someone who wanted an easy to follow up to date guide that was fool proof.
I call it the ultimate Fool Proof guide as this guide was made for me.
so if I can follow it anyone can.
don’t bash anyone asking for help
don’t use this thread to start a flame war
don’t use unsuitable language (this is a child friendly thread)
if you find an error with this thread please post it in red (like this line) with your help we will keep any brick possibilities to a minimum
Do not use red for anything else.
if you have a problem either with the guide or getting your ps3 to do something or your simply looking for an answer regarding downloading.
then please ask here before starting a new thread.
Click HERE[/URL] for a list of trusted Downgraders
Click HERE[/URL] to sell on your flasher once you have finished with it. or to buy a second hand one
Last edited by baileyscream; 05-07-2013 at 04:29 PM.
Reason: major update
for the progskeet v1.2 guide see this first CLICK HERE[/URL]
and the latest bitstreem HERE[/URL]
Downloading and installing
Needed Downloads
download ProgSkeet NOR programs.rar from HERE[/URL] and put it into My Documents
Install the ProgSkeet’s drivers (called “winskeet”)
1. Install the ProgSkeet’s drivers (called “winskeet”):-
2. go to the "ProgSkeet programs" folder and select extract here with WinZip
3. scroll to the bottom to find winskeet
4. right click and send to desktop
Plug in the Progskeet to the pc with the ps3's controller usb cable
5. the card will be detected and the install new hardware wizard will run. click not this time
6. click install from a list or specific location
7. browse to location
8. select location
9. installing
10. completed
Now the board needs testing for shorts. ( DO NOT do this with the board connected to the PS3.)
1. Run Winskeet from the desktop icon
2. Warning message
3. Opening screen
4. click Tools TAB
5. click Test for Shorts
6. No Shorts Found
7. if it’s not plugged in or no driver installed or you have a problem you will see this
8. now Close winskeet
Setting Up The ProgSkeet
1. With the new Blue Boards (currently in production) there are 2 jumpers to create (bridge) and 1 resistor to remove. The areas in YELLOW circles (R9 & R 11 the 3.3v setting) need soldering (bridge). And in RED Circle the R7 needs the resistor removing. Nb if you heard about removing R8 this is old news and needs to remain attached now.
2. it should look like this
3. in the diagrams folder find your board's diagram (printed on the edge of the ps3's motherboard you will see your board number mine is DNY-001)
4. now follow the diagram to solder your Progskeet to your board
5. this is mine using the zif to pin out adaptor I had made from proto advantage
Attaching the ProgSkeet with the NOR clip
create your dumps
Run winskeet
Power on ps3 and connect Progskeet to the pc via usb to halt the boot up
you should be on the main screen so first select your NOR type
MINES THE SPANSION 128P
A CLICK “DUMP CFI” save it as cfi dump (this will verify your NOR if this fail’s double check your wiring and that you have selected the right NOR in the first page)
click dump
Dumping (it takes seconds so don’t go anywhere)
Complete dump. Click clear and then dump again (number your dumps i.e. nor dump 1 , nor dump 2 etc (repeat this 10 times)
if the dump fail's
If it fail’s (I made a cuppa after my 4th dump when I came back and did a 5th it failed I just unplugged the usb and re-inserted it again to get good dumps again)
Why does it give verification errors when writing or halt/freeze when dumping?
Bad wiring
30AWG (bad) instead of 26AWG (ok) for NOR
Too long wires (>15cm)
Bad PC / USB chipset, just try an old PC with Windows XP/Linux
Bad USB cable
Interference
Bus not free / Halted incorrect
Power drops
Bad grounding
verify the dumps
In the “program’s” folder find the HxD (hex editor) (install it like you did with Progskeet) and then run it.
first time opening
click file click open
select all your dumps and select compare
leave the top as it is and change the bottom as you check each dump.
you should see this message after each dump has been checked. If you don’t delete all your dumps and try dumping again. If you still get errors at this point check your wiring.
When there all the same just have 1 dump open (we will use this all the time now)
get a statistics.
The fine blue bars at either side are what need checking (the one to the left is highlighted in red put your mouse on the left line and you should get a reading between 18.71% - 29.01% (in the area circled in blue) and the line on the right should be between 10.42% - 10.48%
Now close the statistics tab
The first thing you should see at offset 00000010 is FACEOFF , DEADBEEF
if you see AC OF FF EO , AD DE EF BE then your dump’s need byte reversing if you don’t see either then you have a bad dump. Re-do all your wiring and start again
Byte reverse
Inside “programs” folder find FlowRebuilder run it
this is the main screen
select byte reverse a dump
click the box next to brows, drag & drop, drop down
select your dump
click execute operation
and it’s done it in the same place as the dump and its added “swap” to the name
you should see at offset 00000200 is IFI
if you see FI.I then your dump’s needs byte reversing. again if you don’t see either then you have a bad dump. Re-do all your wiring and start again
If you did see FI.I in your dump then you need to use flow rebuilder with the byte reverse option if it says IFI then you can skip this step
Byte reverse
Inside “programs” folder find FlowRebuilder run it
this is the main screen
select byte reverse a dump
click the box next to brows, drag & drop, drop down
select your dump
click execute operation
and it’s done it in the same place as the dump and its added “swap” to the name
First find the IDPS/TARGET ID & METLDR and then BOOTLDR (were still using the hex editor)
The area to find these depends on your ps3 model
IDPS/TARGET ID is at 0002F077 (scroll down to 0002F070 then the top row of numbers is your last digit)
CECH-20xx (DYN-001 boards) it should have the value 09 (this is what is in the image)
CECH-21xx (SUR-001 boards) it should have the value 0A
CECH-25xx (JTP-001 boards) it should have the value 0B
CECH-25xx (JSD-001 boards) it should have the value 0B
CECHHxx (DIA-001 boards) it should have the value 05 or 06 or 07
METLDR is at 0000081E & 00000842
CECH-20xx (DYN-001 boards) it should have either one of these value’s E9 20 at 0000081E & 0E 8E at 00000842 “OR” E8 90 at 0000081E & 0E 85 at 00000842 (this is what’s shown in the picture)
CECH-21xx (SUR-001 boards) it should have the value E9 20 at 0000081E & 0E 8E at 00000842
CECH-25xx (JTP-001 boards) it should have either one of these value’s E9 20 at 0000081E & 0E 8E at 00000842 “OR” E9 60 at 0000081E & 0E 92 at 00000842 WARNING IF IT HAS THIS F9 20 at 0000081E & 0F 8E at 00000842 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODELCECH-25xx (JSD-001 boards) it should have this value E9 20 at 0000081E & 0E 8E at 00000842 WARNING IF IT HAS THIS F9 20 at 0000081E & 0F 8E at 00000842 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODEL
CECHHxx (DIA-001 boards) it should have either one of these value’s E7 B0 at 0000081E & 0E 77 at 00000842 “OR” E8 C0 at 0000081E & 0E 88 at 00000842 “OR” E8 E0 at 0000081E & 0E 8A at 00000842 “OR” EA 60 at 0000081E & 0E A2 at 00000842
BOOTLDR is at 00FC0002 & 00FC0012
CECH-20xx (DYN-001 boards) it should have either one of these value’s 2F 3B at 00FC0002 & 2F 3B at 00FC0012 “OR” 2F 13 at 00FC0002 & 2F 13 at 00FC0012 (this is what’s shown in the picture)
CECH-21xx (SUR-001 boards) it should have the value 2F 4B at 00FC0002 & 2F 4B at 00FC0012
CECH-25xx (JTP-001 boards) it should have either one of these value’s 2F 4B at 00FC0002 & 2F 4B at 00FC0012 “OR” 2F 53 at 00FC0002 & 2F 53 at 00FC0012 WARNING IF IT HAS THIS 2F 5B at 00FC0002 & 2F 5B at 00FC0012 OR 2F FB at 00FC0002 & 2F FB at 00FC0012 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODELCECH-25xx (JSD-001 boards) it should have this value 2F 4B at 00FC0002 & 2F 4B at 00FC0012 WARNING IF IT HAS THIS 2F FB at 00FC0002 & 2F FB at 00FC0012 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODEL
CECHHxx (DIA-001 boards) it should have either one of these value’s 2F 1C at 00FC0002 & 2F 1C at 00FC0012 “OR” 2E F4 at 00FC0002 & 2E F4 at 00FC0012 “OR” 2E E3 at 00FC0002 & 2E E3 at 00FC0012
If you’re not getting some or none of these then you need to check your wiring and re-dump
Ok now we need to take a look and check there are no malformed headers / file names / region names. This is what we are looking for:-
Now find the same positions as shown in blue in the following pictures yours should match
ASECURE LOADER (00000800)
eEID (0002f000)
cISD (0003f000)
cCSD (0003F800)
Look for SCE on the line below the blue in the following pictures
trvk_prg0 (00040010)
trvk_prg1 (00060010)
trvk_pkg0 (00080010)
trvk_pkg1 (000A0010)
Make sure all the words below the blue in the following pictures match yours
ros0 (000C0000)
ros1 (007C0000)
Make sure the following in blue matches
cvtrm (00EC0000)
note you may get this instead in the blue highlight:
00EC0000 53 43 45 49 FF FF FF FF FF FF FF FF FF FF FF FF SCEIÿÿÿÿÿÿÿÿÿÿÿÿ
0FACEOFF DEADFACE (00F00010)
CELL EXTNOR AREA (00F20000)
bootldr (00FC0000)
go to FlowRebuilder for extracting your dump
Click extract a byte reversed NOR dump or an interleaved and unscrambled NAND dump
click button next to input file
select your nor dump
click execute program
dump extraction complete. It will put the extracted files into a folder called i.e. (dump.ext) in the same folder where you selected the original one
You should now have these files
If any are missing try extracting again.
now go to the ps3devwiki's validating flash dumps pages and do the checks there MAIN VALIDATE PAGE[/URL] DISCUSSION PAGE WITH MORE CHECKS[/URL]
Once it all checks out ok upload your dump NOT the file you just created. to a file share site copy the link and CLICK HERE[/URL] to post your dump. do not use "#ps3downgrade" they nolonget wish to check dumps.
paste your link with “can someone please check my dump. I have followed the guide here (this guide) I have checked it myself.
Once it comes back ok it’s time to patch it (don’t forget to thank the person or persons who checked it for you)
Patching the dump
Open flow rebuilder and select “PATCH a Byte reversed NOR dump or an interleaved and unscrambled NAND dump”.
Select your nor dump (the one you just had checked)
Select the patch file (c:/progskeet NOR programs/NOR downgrade/progskeet_patch.txt)
Click execute
completed it will put the patched dump in the same folder as your original dump called dump.patch.bin (you won’t see the word .bin at the end)
Flashing the ps3
Turn on ps3 then plug the Progskeet into your pc
Open winskeet & select your NOR
click the NOR tab and click “Dump CFI” this will insure your nor is set right in winskeet
at the bottom it says “options” under that you have 2 drop down boxes set yours as it shows here (these seem to be the best settings) if you don’t change them you may get freezing issues.
if you have some address that simply wont verify then simply change the bottom box to [USB transfer timing (avoid)] (yes i know it says avoid) it takes about 3 min to write each 128kb address but let it. once it has finnished you shouldnt get any verify errors
(if you have a spansion p chip then you may get (verification error's) if you do then try (Ready Triggered Timing) as this seems to work on this NOR chip. (thanks to MHMProSoft (ps3hax) for informing me about this)
Originally Posted by 3absiso
[MENTION=245343]Sarah1331[/MENTION]
Hi;
Will i really do not know if you tried that but; i have done a lot of Spansion P chip and they are a pain:
For sure if you have verification errors: it is one of two things or both combined :-):
1- check your wires again and again and make sure they are not touching anything else but since you are doing RGH and you are good in wiring we can roll this out. (but double check). Reading Good Dumb does not mean your wiring is perfect since i had this issue with two Ps3 and get good read but bad write so i did re-wired every thing.
2- the second issue which is the common one and it solved 90% of the problem is:
- Use WinSkeet40000_111004 instead of the newest one
- connect the Progskeet as libusb Via zadig
- write the dumb at 8bit.
- use X86 windows 7 or XP
this done it for all my Spansion
if you still has issues try bridge the (gp4 on progskeet) with (rdy on progskeet) with small wire and wire the (RY/BY# on PS3) to (rdy on progskeet) alone as usual.
this is the links for the Programs: http://www.ps3devwiki.com/wiki/Hardware_flashing
click the “flash” tab & select your patched NOR dump (now called dump.patched)
it will read
erase
flash
verify
Repeat the steps until you get this message
Now turn off the ps3, unplug the Progskeet from pc, disconnect the Progskeet from the ps3 (un plug the flat cable if you have the adaptor like mine) (if no adaptor then you need to de-solder the Progskeet)
Finishing the down grade in service mode
re-insert the hdd then connect the ps3 to a TV the usual way
turn on your ps3 and you should have this on screen
Turn the ps3 back off insert your dev usb board (programmed with the correct files) into the right usb slot.
a full list of boards are listed at the start of the thread in the second tab down called
"Wrong you need these tools before you even think about following a guide"
inside that tab you will see the second tab down called "A development board" in there is lists of the different dev boards.
Unplug the ps3 from the mains. Wait 10 - 15 seconds then plug it back in.
(the wiki says its to discharge the capacitors but as the ps3 is not turned on the capacitors will take many months to discharge.)
Turn the ps3 back on then immediately press eject within ~200ms. Your console will turn on and if your dev usb has led's then the dongle will light up the red LED followed by the green LED and turn back off.
After triggering Factory Service Mode, go to the folder called “service mode files” & in there is a folder called “service mode 3.55 downgrade files” put the contents of that folder into your usb stick and plug it in the PS3's right most USB port (remove the dev usb & put your usb memory stick in its place) REPLACE YOUR HDD (the files are rogero cfw v3.2 and the normal Lv2diag.self (365.5 KB) 3.55 get in FSM )
Turn PS3 on, it will install the firmware you had put there (even though you have no screen output, you can see it is busy by looking at the activity led of the hard drive and of your USB Mass Storage Device).
if you get the flashing green power light then this is due to the firmware not installing. first check your hdd is plugged in properly. this is usually what I forget to do. if it still flashes remove your usb stick put it in your pc and you will see “UPDATER_LOG” as a notepad file upload this to a file share site copy the link and CLICK HERE[/URL] to enter the chat room. create your nic name press enter then click the green word "#ps3downgrade" to enter the correct room.
paste your link with “can someone please check my updater log. I have followed the guide here (this guide) I cannot get rogero cfw to install in service mode.
PS3 will turn itself back off when it has finished installing the f/w.
Now remove your usb stick put it in your pc and you will see “UPDATER_LOG” as a notepad file open it & look through it to see if it contains errors (if it does upload the log to your file share account and ask for help online on IRC) (it should say at the bottom “0x83manufacturing updating SUCCESS(0x8002f000)”)
Now you need to get the ps3 out of service mode.
Open the folder “service mode files” and inside you will see a folder called “get out of service mode” copy the file inside to your usb stick. Put the usb stick back into your ps3 it will boot then the hdd light will flash then turn off. Remove the usb stick. (the file is Lv2diag.self (201.42 KB) get out FSM)
after that re-build your ps3
turn on your ps3 and it should now boot to this screen follow the on screen instructions
Now to DeHash the console so it is brick protected when / if you decide to upgrade the firmware
THIS IS THE RECOMENDED WAY
Install and run QA-toggle and make sure it beeps
if you just get a blank screen and nothing happens then you have a faulty bdvd and you cannot do this step. try re-marry bdvd found in the main post then try this step again.
to check you are QA flagged Set your cursor on Network Settings and press the key combo (all at the same time):L1 + L2 + L3 (press left stick) + R1 + R2 + dpad_down
if you are QA flagged a new option will show up right below network settings
Power off console
Put unpatched official firmware (e.g. 3.55) on USB Mass Storage device as /PS3/UPDATE/PS3UPDAT.PUP and insert in PS3
Boot into Recovery Menu:
press and hold power button you get 1 beep then a wait then a second beep then the ps3 turns off
press and hold power button again you get 1 beep then 2 beeps let go of power button
select "6. System Update" to reinstall firmware.
If installation finishes without error (there will be no logs you can check!) and boots XMB OK, then dehashing was successful.
Congrats, you now finished downgrading and dehashing. Console runs 3.55 and any firmware of choice can be installed, no longer needing to be patched for downgrader.
DO NOT DO THE SERVICE MODE WAY AS I AND OTHERS GET RLOD EVERYTIME IT IS DONE
Now you should be on 3.55ofw
You can now install the 3.55cfw of your choice
that’s it simple.
Last edited by baileyscream; 12-01-2012 at 06:08 AM.
for the progskeet v1.2 guide see this first CLICK HERE[/URL]
and the latest bitstreem HERE[/URL]
Downloading and installing
Needed Downloads
download ProgSkeet NAND programs.rar from HERE[/URL] and put then into c:/ your main hdd found in My Computer
Install the ProgSkeet’s drivers (called “winskeet”)
1. Install the ProgSkeet’s drivers (called “winskeet”):-
2. go to the "ProgSkeet NAND programs" folder and select extract here with WinZip
3. scroll to the bottom to find winskeet
4. right click and send to desktop
Plug in the Progskeet to the pc with the ps3's controller usb cable
5. the card will be detected and the install new hardware wizard will run. click not this time
6. click install from a list or specific location
7. un select (search removable media (floppy CD ROM....)) and select (Include this location in the search) then click (browse)
8. browse to (Local Disk c: ) > (ProgSkeet NAND programs) > (drivers_winusb_111121)
9. installing
10. completed
Now the board needs testing for shorts. ( DO NOT do this with the board connected to anything but the pc.)
1. Run Winskeet from the desktop icon
2. Warning message
3. Opening screen
4. click Tools TAB
5. click Test for Shorts
6. No Shorts Found
7. if it’s not plugged in or no driver installed or you have a problem you will see this
8. now Close winskeet
Setting Up The ProgSkeet
injectus diagram from ps3devwiki
solder the pads on the injectus to the pads on the progskeet. the flat cable that comes with the injectus is not to be used.
connect progskeet with usb to pc.
connect injectus with usb to pc.
found new hardware will open.
click (not this time) click (next)
screen will change to this
click (install from a list or specific location (Advanced))
click (next)
screen will change to this
un-click (Search removable media (floppy, CD-ROM...)
click (Include this location in the search.)
click ((browse) button)
goto (My Computer) > (Local Disk (c: )) > (ProgSkeet NAND programs) > (InfectusProgrammer-3.9.9.0) > (USB-Drivers3.1) > then click (ok)
then click (next)
it will install
you will get the warning just click (Continue anyway)
its done just click (finish)
you should get this bubble message.
goto (My Computer) > (Local Disk (c: )) > (ProgSkeet NAND programs) > (InfectusProgrammer-3.9.9.0) and click (InfectusProgrammer_3.9.9.0)
the infectus program will start and you will get this message. just click (ok)
you will hear the "bing" sound of the injectus being disconected then reconected to the pc and then you will just have this screen.
close then re-start the injectus programer so it will detect the board
click (tools) > (Open Infectus)
this window will open "Actel Panel" click (Load DAT)
this window will open. NB it has a delay before opening so dont keep clicking it.
goto (My Computer) > (Local Disk (c: )) > (ProgSkeet NAND programs) > (ProgSkeet_Bitstreams_111126) > (DAT) and select the file (ProgSkeet_Retail_SL_NAND111126) then click (open)
you will be back at this screen (no changes to see)
click (Program)
it will check the dat file
then erase > write the bitstream to the progskeet
after a few min's it will finish. just click (ok) then close the 2 infectus windows and the progskeet is now ready for connecting the NAND clip(s)
NOW DESOLDER THE WIRES FROM INJECTUS TO PROGSKEET
1. With the new Blue Boards (currently in production) there are 2 jumpers to create (bridge). The areas in YELLOW circles (R9 & R 11 the 3.3v setting) need soldering (bridge) (ignore the RED Circle) and donot remove R7 & R8.
2. it should look like this (ignore the RED line)
Attaching the ProgSkeet with the NAND clip
[QUOTE=Dark_hades;467957]
The biggest pain by far of the whole process was getting that solderless clip on correctly for WinSkeet to recognise it. I would add that gently scrubbing the pins with some cleaning Alcohol on a clean toothbrush (on the solderless clip and NAND chips) can help in making sure it's won't fail due to the pins being dirty (as that was the case with my solderless clip).
QUOTE]
this is the COK-001 board. i have marked which NAND is which take note which is which or print this image for reference
for boards with a NAND chip on eithes side of the board then the cpu / gpu is the "bottom" nand
a close up of the clips in place
the clip in the blue circle will clip on no problem.
the clip in the red circle needs altering to sit flush.
the circle in red on both clips is a nipple on the clip marking pin 1 position.
you will find the same on the NAND chips.
just put the clip on the chip with the nipple in the same position
this NAND chip has 5 components too close for the clip to sit flush
a closeup of the NAND and components circled in red
the different types of cut needed (cut as in file very gently )
a different angle of the cuts
once done the clip will sit flush
conect the flat cables to the clip(s).
right now the progskeet can only read from the (A) side of the "Y" adaptor.
so you can only connect one clip at a time.
the one shown is the "TOP" "0 NAND chip"
you also need to conect the "3.3v" pad on the "Y" adaptor to the "3.3v" pad on the progskeet
this is done as we are not powering up the ps3 but using the progskeet to power the NAND chips
yes i still have the injectus connected to mine.
use good strong "quick clamps" to hold the clips in place
i have the mainboard sat on an angle on the ps3's base as it holds it just right with the clamps inplace
create your dumps
Run winskeet
connect Progskeet to the pc via usb cable
you should be on the main screen so first select your NAND type
Mines the samsung
select the NAND tab
you just want (NAND 1) ticked
(NB both NAND 1 & NAND 2 are linked to the "A" connector on the "Y" adaptor)
click (AUTO) and the details of your NAND should be shown next to the (AUTO) button. if its not then check the clip is attached correctly.
click dump
this window will open asking where to save and what to call the dump.
create a new folder called dumps and go into that and call this dump dump 1 top then click (save)
Dumping (i found the TOP / NAND 0 takes 12 min to dump)
Complete dump. Click clear and then dump again (number your dumps i.e. dump 1 TOP , dump 2 TOP etc (repeat this 3 times)
un-plug the ProgSkeet and connect the clip to the other NAND.
this is the "bottom" "NAND 1" NAND
now re-connect the ProgSkeet to the pc
still in the NAND tab
you just want (NAND 1) ticked still
(remember both NAND 1 & NAND 2 are linked to the "A" connector on the "Y" adaptor)
click (AUTO) and the details of your NAND should still be shown next to the (AUTO) button. if its not then check the clip is attached correctly.
click dump
the window will open asking where to save and what to call the dump again.
just select the dumps and go into that and call this dump dump 1 bottom then click (save)
Dumping (i found the bottom / NAND 1 takes 13 min to dump)
Complete dump. Click clear and then dump again (number your dumps i.e. dump 1 bottom , dump 2 bottom etc (repeat this 3 times)
Why does it give verification errors when writing or halt/freeze when dumping?
Bad wiring
30AWG (bad) instead of 26AWG (ok) for NOR
Too long wires (>15cm)
Bad PC / USB chipset, just try an old PC with Windows XP/Linux
Bad USB cable
Interference
Bus not free / Halted incorrect
Power drops
Bad grounding
go to (local drive (c: )) > (ProgSkeet NAND programs) and run (FlowRebuilder v.4.2.2.0)
Select (UNSCRAMBLE then interleave two NAND flashes into one unified dump.)
click button next to (Select the NANDbackup "Flash0"(TOP) file.) and the above window will open.
goto (local drive (c: )) > (ProgSkeet NAND programs) > (Winskeet111205) > (dumps) and select (dump 1 top)
click button next to (Select the NANDbackup "Flash1"(BOTTOM) file.) and the above window will open.
goto (local drive (c: )) > (ProgSkeet NAND programs) > (Winskeet111205) > (dumps) and select (dump 1 bottom)
under (Select the OUTPUT (interleaved) file.) type (C:\ProgSkeet NAND programs\Winskeet111205\dumps\extracted\dump 1)
then click execute program
dump extraction complete. It will put the extracted files into (C:\ProgSkeet NAND programs\Winskeet111205\dumps\extracted\dump 1)
now do the same with the other 2 top & bottom NAND dumps (changing the destination from (dump 1) to (dump 2) then (dump 3)
now goto (local disk (C: )) > (ProgSkeet NAND programs) > (Winskeet111205) > (dumps) > (extracted) and you should see the same as above
You should now have these files in each folder
If any are missing try extracting again. if you still dont then you will have to re-dump and check the clips are on tight
verify the dumps
In the progskeet NAND programs folder find the HxD (hex editor) (install it like you did with Progskeet) and then run it.
first time opening
click file click open
select all your dumps then select compare
leave the top as it is and change the bottom as you check each dump.
you should see this message after each dump has been checked. If you don’t delete all your dumps check your clips are on ok then dump again.
When there all the same just have 1 dump open (we will use this all the time now)
get a statistics.
The fine blue bars at either side are what need checking (the one to the left is highlighted in red put your mouse on the left line and you should get a reading between 1.43% - 2.68% (in the area circled in blue) and the line on the right should be between 18.25% - 24.54%
Now close the statistics tab
The first thing you should see at offset 00040010 is FACEOFF , DEADBEEF
if you see AC OF FF EO , AD DE EF BE then your dump’s need byte reversing if you don’t see either then you have a bad dump. Re-do all your wiring and start again (the above is from a NOR dump its used here as an example)
If you did see the above then you need to use flowrebuilder with the byte reverse option if it says (DEAD BEEF) then you can skip this step
Byte reverse
Inside progskeet NAND programs folder find FlowRebuilder run it
this is the main screen
select byte reverse a dump
click the box next to (browse, drag & drop, drop down)
and select your dump
then click (execute operation)
and it’s done it in the same place as the dump and its added “swap” to the name
First find the IDPS/TARGET ID & METLDR and then BOOTLDR (were still using the hex editor)
The area to find these depends on your ps3 model
IDPS/TARGET ID is at 00080877 (scroll down to 00080870 then the top row of numbers is your last digit)
CECHAxx (COK-001 boards) it should have the value 01 or 03 or 04
CECHBxx (COK-001 boards) it should have the value 01 or 02
CECHCxx (COK-002 boards) it should have the value 03
CECHExx (COK-002 boards) it should have the value 01 or 04
CECHGxx (SEM-001 boards) it should have the value 05 or 06
DECHAxx (COK-001 boards) it should have the value 01 or 02
METLDR is at 0004081E & 00040842
CECHAxx (COK-001 boards) it should have the value EE 10 at 0004081E & 0E DD at 00040842 or ED EO at 0004081E & 0E DA at 00040842
CECHBxx (COK-001 boards) it should have the value ED A0 at 0004081E & 0E D6 at 00040842
CECHCxx (COK-002 boards) it should have the value EB F0 at 0004081E & 0E BB at 00040842 or ED EO at 0004081E & 0E DA at 00040842
CECHExx (COK-002 boards) it should have the value EE 10 at 0004081E & 0E DD at 00040842
CECHGxx (SEM-001 boards) it should have the value E7 B0 at 0004081E & 0E 77 at 00040842 or E8 C0 at 0004081E & 0E 88 at 00040842 or E8 C0 at 0004081E & 0E 88 at 00040842
DECHAxx (COK-001 boards) it should have the value ED A0 at 0004081E & 0E D6 at 00040842
BOOTLDR is at 00000002 & 00000012
CECHAxx (COK-001 boards) it should have the value 2A 3F at 00000002 & 2A 3F at 00000012 or 2A 37 at 00000002 & 2A 37 at 00000012
CECHBxx (COK-001 boards) it should have the value 2A 2A at 00000002 & 2A 2A at 00000012
CECHCxx (COK-002 boards) it should have the value 30 44 at 00000002 & 30 44 at 00000012 or 2A 37 at 00000002 & 2A 37 at 00000012
CECHExx (COK-002 boards) it should have the value 2A 3F at 00000002 & 2A 3F at 00000012
CECHGxx (SEM-001 boards) it should have the value 2E 8C at 00000002 & 2E 8C at 00000012 or 2F 1C at 00000002 & 2F 1C at 00000012 or 2E F4 at 00000002 & 2E F4 at 00000012
DECHAxx (COK-001 boards) it should have the value 2A 2A at 00000002 & 2A 2A at 00000012
Ok now we need to take a look and check there are no malformed headers / file names / region names. This is what we are looking for:-
Correct............................Malformed...... ........................location
asecure_loader...............asecure_loaher....... ...............00040220
eEID................................eIIH.......... ..............................00040250
cISD.................................cESH......... ..............................00040280
cCSD................................cCSH.......... .............................000402B0
trvk_prg...........................trvg_prk....... ...........................000402E0
trvk_pkg...........................trvg_prk....... ...........................00040310
creserved_0.....................?????????......... ......................00040340
ros..................................??????????... ............................00040370
cvtrm...............................cztrm......... ...............................000403A0
metldr..............................mitldr........ ................................00040820
Now find the same positions as shown in blue in the following pictures yours should match
ASECURE LOADER (00040800)
eEID (00080800)
cISD (00090800)
cCSD (00091000)
Look for SCE on the line below the blue in the following pictures
trvk_prg (00091800)
trvk_pkg (00093800)
Make sure all the words below the blue in the following pictures match yours
ros0 (000C0020)
ros1 (007C0010)
Make sure the following in blue matches
bootldr (00000000)
now go to the ps3devwiki's validating flash dumps pages and do the checks there MAIN VALIDATE PAGE[/URL] DISCUSSION PAGE WITH MORE CHECKS[/URL]
Once it all checks out ok upload your dump NOT the file you just created. to a file share site copy the link and CLICK HERE[/URL] to post your dump. do not use "#ps3downgrade" they nolonget wish to check dumps.
paste your link with “can someone please check my dump. I have followed the guide here (this guide) I have checked it myself.
Once it comes back ok it’s time to patch it (don’t forget to thank the person or persons who checked it for you)
Patching the dump
Open flow rebuilder and select “PATCH a Byte reversed NOR dump or an interleaved and unscrambled NAND dump”.
Select your NAND dump (the merged one that was created from the 2 you just had checked)
& Select the patch file (progskeet_patch.txt) from (C:\ProgSkeet NAND programs\NAND downgrade\progskeet_patch.txt)
then Click (execute)
completed it will put the patched dump in the same folder as your original dump with ".patch.bin" at the end of its file name (you won’t see the word ".bin" at the end)
open FlowRebuilder and select (RE-SCRAMBLE a modified dump then de-interleave it into two new flashes.)
click the button next to (select the input NAND interleaved_modified file: )
and select your patched dump
in the box under (select the NAND backup "Flash 0 (TOP) file) select your origonal (dump 1 TOP.bin) file
in the box under (select the NAND backup "Flash 1 (BOTTOM) file) select your origonal (dump 1 TOP.bin) file
then click (execute)
compleated. the new dump files are in the same location as the origonals
with "new" added to the file names:-
dump 1 TOP.bin.new.bin
dump 1 BOTTOM.bin.new.bin
close FlowRebuilder
Flashing the ps3
connect the progskeet to the "TOP" NAND 0 and then connect the progskeet to the pc
Open winskeet & select your NAND
click the NAND tab and click (AUTO) this will insure your clip is sat right on the chip
click the “flash” tab & select (dump 1 TOP.bin.new.bin)
it will read
flash
verify it takes 19 min's all together
Repeat the steps until you get the message "nothing to flash"
now disconnect the progskeet from the pc
then connect the progskeet to the "BOTTOM" NAND 1 and then connect the progskeet back to the pc
still in the NAND tab
click (clear) then (AUTO) again this will insure your clip is sat right on the chip
click the “flash” tab & select (dump 1 BOTTOM.bin.new.bin)
it will read
flash
verify it takes 19 min's all together
Repeat the steps until you get the message "nothing to flash"
Now unplug the Progskeet from pc and disconnect the clip(s) from the ps3
now build your ps3 back together
Finishing the down grade in service mode
make sure you have re-inserted the hdd then connect the ps3 to a TV the usual way
turn on your ps3 and you might see this on screen or you might have a blank screen and the ps3 turns off aster a second (it should not beep)
Turn the ps3 back off insert your dev usb board (programmed with the correct files) into the right usb slot.
a full list of boards are listed at the start of the thread in the second tab down called
"Wrong you need these tools before you even think about following a guide"
inside that tab you will see the second tab down called "A development board" in there is lists of the different dev boards.
Unplug the ps3 from the mains. Wait 10-15 seconds then plug it back in.
(the wiki says this is to discharge the capacitors but as the ps3 is off then the capacitors will take months to discharge)
Turn the ps3 back on then immediately press eject within ~200ms. Your console will turn on and if your dev usb has led's then the dongle will light up the red LED followed by the green LED and turn back off.
After triggering Factory Service Mode, go to (local disk c: )) > (progskeet NAND programs) > (get into fsm) put the contents of that folder into your usb stick and plug it in the PS3's right most USB port (remove the dev usb & put your usb memory stick in its place) REPLACE YOUR HDD (the files are rogero cfw v3.2 and the normal Lv2diag.self (365.5 KB) 3.55 get in FSM )
Turn PS3 on, it will install the firmware you had put there (even though you have no screen output, you can see it is busy by looking at the activity led of the hard drive and of your USB Mass Storage Device).
if you get the flashing green power light then this is due to the firmware not installing. first check your hdd is plugged in properly. this is usually the problem. if it still flashes remove your usb stick put it in your pc and you will see “UPDATER_LOG” as a notepad file upload this to a file share site copy the link and CLICK HERE[/URL] to enter the chat room. create your nic name press enter then click the green word "#ps3downgrade" to enter the correct room.
paste your link with “can someone please check my updater log. I have followed the guide here (this guide) I cannot get rogero cfw to install in service mode.
PS3 will turn itself back off when it has finished installing the f/w (Nb this does take a while.
So go make a cuppa or have a cig).
Now remove your usb stick put it in your pc and you will see “UPDATER_LOG” as a notepad file open it & look through it to see if it contains errors (if it does upload the log to your file share account and ask for help online on IRC) (it should say at the bottom “0x83manufacturing updating SUCCESS(0x8002f000)”)
Now you need to get the ps3 out of service mode.
go to (local disk c: )) > (progskeet NAND programs) > (get out of fsm) put the contents of that folder into your usb stick and plug it in the PS3's right most USB port it will boot then the hdd light will flash then turn off. Remove the usb stick. (the file is Lv2diag.self (201.42 KB) get out FSM)
turn on your ps3 and it should now boot to this screen follow the on screen instructions
Now to DeHash the console so it is brick protected when / if you decide to upgrade the firmware
THIS IS THE RECOMENDED WAY
Install and run QA-toggle and make sure it beeps
if you just get a blank screen and nothing happens then you have a faulty bdvd and you cannot do this step. try re-marry bdvd found in the main post then try this step again.
to check you are QA flagged Set your cursor on Network Settings and press the key combo (all at the same time):L1 + L2 + L3 (press left stick) + R1 + R2 + dpad_down
if you are QA flagged a new option will show up right below network settings
Power off console
Put unpatched official firmware (e.g. 3.55) on USB Mass Storage device as /PS3/UPDATE/PS3UPDAT.PUP and insert in PS3
Boot into Recovery Menu:
press and hold power button you get 1 beep then a wait then a second beep then the ps3 turns off
press and hold power button again you get 1 beep then 2 beeps let go of power button
select "6. System Update" to reinstall firmware.
If installation finishes without error (there will be no logs you can check!) and boots XMB OK, then dehashing was successful.
Congrats, you now finished downgrading and dehashing. Console runs 3.55 and any firmware of choice can be installed, no longer needing to be patched for downgrader.
DO NOT DO THE SERVICE MODE WAY AS I AND OTHERS GET RLOD EVERYTIME IT IS DONE
Now you should be on 3.55ofw
You can now install the 3.55cfw of your choice
that’s it simple.
Last edited by baileyscream; 12-01-2012 at 06:09 AM.
wiring the TEENSY++ to ps3
first the TEENSY++
the new recommended way to have the TEENSY++ is NOT to use the voltage regulator and bridge 3.3v pads and break the 5v track
now connect +5V to 3.3v (VCC) pad on ps3 as this method will allow any ps3 to keep the teensy++ connected to ps3 while using the teensy as a jig as the ps3 now powers the TEENSY++
when ordering the TEENSY++ then get the pins pre-soldered if you’re not fitting it like judges hard / case mod
ask when ordering to solder 2 pins to the E4 & E5 and no pins to 3 pads next to the switch= RST & GND & Vcc
order a set of jumper wires (there are lots of sellers on eBay or your local computer store) this will make your life easier.
Second the PS3:-
printed on the edge of the ps3's motherboard you will see your board number mine is DNY-001
now follow the diagram to solder your Progskeet to your board
DNY-001
Connecting the TEENSY++ with the 56pin NOR 360CLIP
the 360CLIP (you dont use the flat cable with "*SUNKEY Connect FPC")
wiring diagram
connected to the ps3
Needed Downloads
download NORway programs.rar from HERE[/URL] and put then into c:/ your main hdd found in My Computer
3 install serial_install
1 from hjudges-NORway-972958d file that we changed the name to NORway
2 click next
3 click done
4 The Teensy Loader Application
you need the TEENSY++ conected to the ps3 and the ps3 turned on (insure the fan & heatsink is connected)
2 run the TEENSY++ loader installer
3 click RUN
4 the TEENSY++ main GUI press the button on the TEENSY++
5 the screen will change to this
6 press 'file' then 'open hex file'
7 now go to c > NORway programs > NORway > teensy > default > and select NORway.hex
8 select PROGRAM it’s the green arrow pointing down
9 then you will see this now reboot the TEENSY++ by pressing the green "pointing right" arrow
10 now you will see this
11 found new wizard will open select not this time and click next
12 click next again
13 click continue anyway
14 it will install the driver
15 click finish
16 go into device manager and you should see the above (this is from win xp) WRITE DOWN THE "COM NUMBER" YOU NEED THIS. ALSO ALWAYS USE THE SAME USB PORT FROM NOW ON Nb the one above is COM4 so you know what you’re looking for
5 create the dumps
1 go to start and click on RUN (win xp shown) in win7 type cmd in the search bar and right click the cmd icon and select RUN AS ADMINISTRATOR
2 in the search box type 'cmd' then click OK (you won’t see this in win7)
3 you will now have the cmd window
4 now type cd c:\NORway programs\NORway
5 press enter and you will see the same as above (you have just changed directory)
6 now type NORway.py
7 press ENTER and you should now see the above
8 type NORway.py COM (and your com port number)
9 press ENTER and you should see the same as above. plug in your ps3 and power it on. it should turn on (green light) but not boot (hdd light wont flash)
10 type NORway.py COM (your port number) dump flash.bin
11 press ENTER and you will see the same as above (in the red box is the progress)
12 when it is done you will see the same as above (I have kept the red box over the progress so you can see what’s what)
now repeat step 10 five times and change the name each time like so:
dump flash2.bin
dump flash3.bin
dump flash4.bin
dump flash5.bin
13 type NORway.py COM (your com port number) release
14 press ENTER and you should see the above. then power off the PS3 and unplug the TEENSY++ and close the cmd window.
15 your NOR dump has been put in c\NORway programs\NORway
6 verify the dumps
1 open cmd again like you did above (start > run > type cmd > press enter)
then type cd c:\NORway programs\NORway
2 type norpatch.exe
3 press enter and you will see the above screen
4 type norpatch flash.bin (this is to verify the dump)
5 press enter and you should see the same as in the red box above and ros0 & ros1 should have a f/w number in the blue box (I’m on 4.20 which is based on 4.11 so you know why there is 2 different f/w's in the image) IF YOU DONT HAVE A F/W NUMBER OR GET ANY ERRORS RE-DO YOUR WIRING AND RE-DUMP AS THIS IS A CORRUPT DUMP AND WILL BRICK IF USED.
6 close the cmd window
From judges:-
- verify dump: the described way is certainly a safe way, but you can also use the provided tool "norpatch.exe". If you were running on OFW, then norpatch is able to recognize the core_os areas of the dump, which make up 86% of the whole dump. If it successfully verifies you can be sure that at least all data and address lines are connected properly and working properly. And it's easy to use.
now do the next step so you know 100% that your dump is valid
I DONOT recommend skipping it
In the “NORway programs” folder find the HxD hex editor install it and then run it.
1 first time opening
2 click file click open
3 select all your dumps and select compare
4 leave the top as it is and change the bottom as you check each dump.
5 you should see this message after each dump has been checked. If you don’t delete all your dumps and try dumping again. If you still get errors at this point check your wiring.
When there all the same just have 1 dump open (we will use this all the time now)
6 get a statistics.
7 The fine blue bars are either side are what need checking (the one to the left is highlighted in red put your mouse on the left line and you should get a reading between 18.71% - 29.01% (in the area circled in blue) and the line on the right should be between 10.42% - 10.48%
Now close the statistics tab
8 The first thing you should see at offset 00000010 is FACEOFF , DEADBEEF
9 if you see AC OF FF EO , AD DE EF BE then your dumps need byte reversing (see below the next 2 images for byte reverse steps) if you don’t see either then you have a bad dump. Re-do all your wiring and start again
10 you should see at offset 00000200 is IFI
11 if you see FI.I then your dump’s needs byte reversing. again if you don’t see either then you have a bad dump. Re-do all your wiring and start again
If you did see FI.I in your dump then you need to use flow rebuilder with the byte reverse option if it says IFI then you can skip this step
Byte reverse
Inside NORway programs folder find FlowRebuilder run it
1 this is the main screen
2 select byte reverse a dump
3 click the box next to brows, drag & drop, drop down
4 select your dump
5 click execute operation
6 and it’s done it is in the same place as the dump and its added “swap” to the name = flash.swap.bin
create a folder called original dumps and put all your flash.bin files in it
now rename the flash.swap.bin to flash.bin (this will make it easier to follow the rest of the guide)
First find the IDPS/TARGET ID & METLDR and then BOOTLDR (were still using the hex editor)
The area to find these depends on your ps3 model
12 IDPS/TARGET ID is at 0002F077 (scroll down to 0002F070 then the top row of numbers is your last digit)
CECH-20xx (DYN-001 boards) it should have the value 09 (this is what is in the image)
CECH-21xx (SUR-001 boards) it should have the value 0A
CECH-25xx (JTP-001 boards) it should have the value 0B
CECH-25xx (JSD-001 boards) it should have the value 0B
13 METLDR is at 0000081E & 00000842
CECH-20xx (DYN-001 boards) it should have either one of these value’s E9 20 at 0000081E & 0E 8E at 00000842 “OR” E8 90 at 0000081E & 0E 85 at 00000842 (this is what’s shown in the picture)
CECH-21xx (SUR-001 boards) it should have the value E9 20 at 0000081E & 0E 8E at 00000842
CECH-25xx (JTP-001 boards) it should have either one of these value’s E9 20 at 0000081E & 0E 8E at 00000842 “OR” E9 60 at 0000081E & 0E 92 at 00000842 WARNING IF IT HAS THIS F9 20 at 0000081E & 0F 8E at 00000842 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODEL
CECH-25xx (JSD-001 boards) it should have this value E9 20 at 0000081E & 0E 8E at 00000842 WARNING IF IT HAS THIS F9 20 at 0000081E & 0F 8E at 00000842 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODEL
14 BOOTLDR is at 00FC0002 & 00FC0012
CECH-20xx (DYN-001 boards) it should have either one of these value’s 2F 3B at 00FC0002 & 2F 3B at 00FC0012 “OR” 2F 13 at 00FC0002 & 2F 13 at 00FC0012 (this is what’s shown in the picture)
CECH-21xx (SUR-001 boards) it should have the value 2F 4B at 00FC0002 & 2F 4B at 00FC0012
CECH-25xx (JTP-001 boards) it should have either one of these value’s 2F 4B at 00FC0002 & 2F 4B at 00FC0012 “OR” 2F 53 at 00FC0002 & 2F 53 at 00FC0012 WARNING IF IT HAS THIS 2F 5B at 00FC0002 & 2F 5B at 00FC0012 OR 2F FB at 00FC0002 & 2F FB at 00FC0012 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODEL
CECH-25xx (JSD-001 boards) it should have this value 2F 4B at 00FC0002 & 2F 4B at 00FC0012 WARNING IF IT HAS THIS 2F FB at 00FC0002 & 2F FB at 00FC0012 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODELIf you’re not getting some or none of these then you need to check your wiring and re-dump
Ok now we need to take a look and check there are no malformed headers / file names / region names. This is what we are looking for:-
Correct
Malformed
location
IFI
IJI
00000200
asecure_loader
asecure_loaher
00000420
eEID
eIIH
00000450
cISD
cESH
00000480
cCSD
cCSH
000004B0
trvk_prg0
trvg_prk0
000004E0
trvk_prg1
trvg_prk1
00000510
trvk_pkg0
trvg_pkk0
00000540
trvk_pkg1
trvg_pkk1
00000570
cvtrm
cztrm
00000600
metldr
mitldr
00000820
Now find the same positions as shown in blue in the following pictures yours should match
15 ASECURE LOADER
16 eEID
17 cISD
18 cCSD
Look for SCE on the line below the blue in the following pictures
19 trvk_prg0
20 trvk_prg1
21 trvk_pkg0
22 trvk_pkg1
Make sure all the words below the blue in the following pictures match yours
23 ros0
24 ros1
Make sure the following in blue matches
25 or
25 cvtrm
26 0FACEOFF DEADFACE
27 CELL EXTNOR AREA
28 bootldr
go to FlowRebuilder for extracting your dump
1 Click extract a byte reversed NOR dump or an interleaved and unscrambled NAND dump
I know it says NAND at the end but this is to extract your NOR dump
2 click button next to input file
3 select your nor dump
4 click execute program
5 dump extraction complete. It will put the extracted files into a folder called i.e. (dump.ext) in the same folder where you selected the original one
6 You should now have these files
If any are missing try extracting again.
now go to the ps3devwiki's validating flash dumps pages and do the checks there MAIN VALIDATE PAGE[/URL] DISCUSSION PAGE WITH MORE CHECKS[/URL]
Once it all checks out ok upload your dump NOT the file you just created. to a file share site copy the link and CLICK HERE[/URL] to post your dump. do not use "#ps3downgrade" they nolonget wish to check dumps.
paste your link with “can someone please check my dump. I have followed the guide here (this guide) I have checked it myself.
Once it comes back ok it’s time to patch it (don’t forget to thank the person or persons who checked it for you)
Patching the dump
1 Open flow rebuilder and select “PATCH a Byte reversed NOR dump or an interleaved and unscrambled NAND dump”.
2 Select your nor dump (the one you just had checked)
3 Select the patch file (progskeet_patch.txt) inside NOR downgrade folder that’s inside the NORway programs folder
4 Click execute
5 completed it will put the patched dump in the same folder as your original dump called flash.patch.bin (you won’t see the word .bin at the end)
Flashing the ps3
Byte reverse the dump back to how it was
Inside NORway programs folder find FlowRebuilder run it
1 this is the main screen
2 select byte reverse a dump
3 click the box next to brows, drag & drop, drop down
4 select your dump
5 click execute operation
6 and it’s done it's in the same place as the dump and its added “swap” to the name = flash.patch.swap.bin
put your flash.patch.bin into the "original dumps" folder and rename the flash.patch.swap.bin to flash.patch.bin (this will make it easier to follow the rest of the guide)
1 go to start and click on RUN (win xp shown) in win7 type cmd in the search bar and right click the cmd icon and select RUN AS ADMINISTRATOR
2 in the search box type 'cmd' then click OK (you won’t see this in win7)
3 you will now have the cmd window
4 now type cd c:\NORway programs\NORway
5 press enter and you will see the same as above (you have just changed directory)
6 now type NORway.py
7 press ENTER and you should now see the above
now plug in the TEENSY++ to your pc
8 type NORway.py COM(and your com port number)
9 press ENTER and you should see the same as above. plug in your ps3 and power it on. it should turn on (green light) but not boot (hdd light wont flash)
10 type NORway.py COM(your port number) write flash.patch.bin
11 press ENTER and you will see the same as above (in the blue is a change in the NORway.py v0.5 final if you have the Samsung K8Q NOR chip then it changes the write command to writewordubm for you) (in the red box is the progress)
12 if received an error then type NORway.py COM(your port number) writeword flash.patch.bin
if you didn’t then skip to step 13
NORway.py COMx writeword dump.bin
Programs the NOR in word programming mode. It's a four-bus-cycle operation (per word), i.e. it's the slowest, but most compatible programming mode. A full write takes about 9 minutes. Supported by all NOR types. Use this as a last resort if nothing else works.
13 when it is done you will see the same as above (I have kept the red box over the progress so you can see what’s what) check that it has verified the whole flash (in blue box)
NORway will retry to write a sector up to 20 times (you'll get a message if this happens).
i.e.:
1. Retry
2. Retry
3. Retry
4. Retry
5. Retry
6. Retry
7. Retry
8. Retry
9. Retry
10. Retry
11. Retry
12. Retry
13. Retry
14. Retry
15. Retry
16. Retry
17. Retry
18. Retry
19. Retry
if it gets to:
20. Retry then you may get a "Verification failed" exception.
At the end you might get:
"Verification failed! Please repeat command [NORway.py COMx write mydump.bin]!
The command is just an example, it's actually substituted with the command you have used for writing
so try the writeword command (step 12)
If the content on the NOR for one sector is the same as content of your flash file, it'll automatically skip that sector and doesn't write at all (called differential programming). If the content is different, it'll erase that sector one time and tries up to 20 times to write that sector (called incremental programming). The written sector is verified after each write attempt.
If the complete writing process is finished, it does a final verification of the entire nor at the end (it happened that written bytes verified correctly, but content wasn't persistent for more than a couple of seconds). If final verification fails, you'll get a message to repeat the programming process.
I just released v0.5 final. See first post of NORway thread for updated download links. You can now also use the "write" command for Samsung K8Q, NORway automatically switches to "writewordubm" then.
this is from judges via a pm to me
14 type NORway.py COM(your com port number) release
14 press ENTER and you should see the above. then power off the PS3 and close the cmd window.
Finishing the down grade in service mode
1st re-flash the teensy++ with psgrade files
2 run the TEENSY++ loader installer
3 click RUN
4 the TEENSY++ main GUI press the button on the TEENSY++
5 the screen will change to this
6 press 'file' then 'open hex file'
7 now go to c > NORway programs > NORway > psgrade_at90usb1286_8Mhz_teensy++_2.0_noLED > and select psgrade_at90usb1286_8Mhz_teensy++_2.0_noLED.hex
8 select PROGRAM it’s the green arrow pointing down
9 then you will see this now reboot the TEENSY++ by pressing the green "pointing to right" arrow
10 now you will see this
10b then this (don’t worry its now programmed to use in the ps3 not pc) un-plug the usb from the pc.
2nd re-insert the hdd then connect the ps3 to a TV the usual way.
if you have the voltage regulator then the TEENSY++ needs de-soldering from the ps3 as some ps3's wont boot with it installed.
if you don’t have the voltage regulator then you’re ok to keep the TEENSY++ soldered to the ps3.
turn on your ps3 and you should have this on screen
Turn the ps3 back off insert the TEENSY++'s usb into the right usb slot.
Unplug the ps3 from the mains. Wait 10-15 seconds then plug it back in.
(the wiki says to do this so the capacitors will discharge but as the ps3 is turned off the capacitors will actually take months to discharge)
Turn the ps3 back on then immediately press eject within ~200ms. Your console will turn on and after a moment will turn back off.
After triggering Factory Service Mode, go to the folder called “get in fsm” put the contents of that folder into your usb stick and plug it in the PS3's right most USB port (remove the TEENSY++'s usb & put your usb memory stick in its place)
Turn PS3 on, it will install the firmware you had put there (even though you have no screen output, you can see it is busy by looking at the activity led off the hard drive and of your USB Mass Storage Device).
if you get the flashing green power light then this is due to the firmware not installing. first check your hdd is plugged in properly. this is usually what I forget to do. if it still flashes remove your usb stick put it in your pc and you will see “UPDATER_LOG” as a notepad file upload this to a file share site copy the link and CLICK HERE[/URL] to enter the chat room. create your nic name press enter then click the green word "#ps3downgrade" to enter the correct room.
paste your link with “can someone please check my updater log. I have followed the guide here (this guide) I cannot get rogero cfw to install in service mode.
PS3 will turn itself back off when it has finished installing the f/w (Nb this does take a while.
Now remove your usb stick put it in your pc and you will see “UPDATER_LOG” as a notepad file open it & look through it to see if it contains errors (if it does upload the log to your file share account and ask for help online on IRC) (it should say at the bottom “0x83manufacturing updating SUCCESS(0x8002f000)”)
Now you need to get the ps3 out of service mode.
Open the folder “get out of fsm” delete the 3 files inside your usb stick then copy this file to your usb stick. Put the usb stick back into your ps3 it will boot then the hdd light will flash then turn off. Remove the usb stick. (the file is Lv2diag.self (201.42 KB) get out FSM)
after that re-build your ps3
turn on your ps3 and it should now boot to this screen follow the on screen instructions
Now to DeHash the console so it is brick protected when / if you decide to upgrade the firmware
THIS IS THE RECOMENDED WAY
Install and run QA-toggle and make sure it beeps
if you just get a blank screen and nothing happens then you have a faulty bdvd and you cannot do this step. try re-marry bdvd found in the main post then try this step again.
to check you are QA flagged Set your cursor on Network Settings and press the key combo (all at the same time):L1 + L2 + L3 (press left stick) + R1 + R2 + dpad_down
if you are QA flagged a new option will show up right below network settings
Power off console
Put unpatched official firmware (e.g. 3.55) on USB Mass Storage device as /PS3/UPDATE/PS3UPDAT.PUP and insert in PS3
Boot into Recovery Menu:
press and hold power button you get 1 beep then a wait then a second beep then the ps3 turns off
press and hold power button again you get 1 beep then 2 beeps let go of power button
select "6. System Update" to reinstall firmware.
If installation finishes without error (there will be no logs you can check!) and boots XMB OK, then dehashing was successful.
Congrats, you now finished downgrading and dehashing. Console runs 3.55 and any firmware of choice can be installed, no longer needing to be patched for downgrader.
DO NOT DO THE SERVICE MODE WAY AS I AND OTHERS GET RLOD EVERYTIME IT IS DONE
Now you should be on 3.55ofw
You can now install the 3.55cfw of your choice
that’s it simple.
Last edited by baileyscream; 12-01-2012 at 06:10 AM.
Reason: 360CLIP ADDED
Downloads
download E3 Flasher programs.rar from HERE[/URL] and put then into c:/ your main hdd found in My Computer
remove the fan from the heatsheild
attach the NOR clip (this is on the JSD-001 board)
carefully fold the ribbon over the clip
using 2 peices of card to prevent shorting out the board.
re-connect the fan as shown
turn board back over and plug the fan back in.
re attach and plug in the internal power pack
attach the E3 Flasher together.
the E3 cage will fix to the E3 mainboard using 2 of the origional hdd cage screws.
then push the E3 "PS Sword" (cover board) onto the E3 mainboard via the connectors
connect the ribbon cable to the E3 mainboard via the connector
then push the E3 Flasher into the sata hdd port
take the micro sd card and put it in a micro sd card reader
then put it in your pc & a blank window should open
go to the E3 Flasher programs folder and drag & drop the update.bin file to the micro sd. (this is the multi console update. you can downgrade more than 1 console with this update installed to the E3)
remove the sd card and put the micro sd into the E3 Flasher
now plug in the power / eject board & the ps3 to the mains
set the switches as shown
1 down / 2 down / 3 up / 4 up / 5 up / 6 up
power on the ps3 and you should see the above lights come on
almost instantly the E3 Flasher will update its self & you should see the above light up in blue
press the red button under the esata port (below the blue lights) to reset the E3 Flasher & the blue lights will turn off.
to double check the E3 Flasher has taken the update simply put the micro sd card into the pc and it should be empty.
if its still there just repeat the update steps
if it doesnt flash and instead some of the blue led's turn off then you have an error
a light on means 1
a light off means 0
there should also be an error code in the sd card
0 1 0 0 0 0 0 0 Failed to initialize TF card SD card not seated properly
0 1 0 0 0 1 0 0 Failed to read files in TF card SD card not seated properly
0 1 0 0 1 0 0 0 Failed to open TF card SD card not seated properly
0 1 0 0 1 1 0 0 Failed to write files to TF card SD card not seated properly
1 0 0 0 0 1 0 0 Failed to initialize NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 0 1 Failed to read NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 0 Failed to erase NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 1 Failed to write NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 1 1 0 0 Failed to initialize PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 0 1 Failed to read PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 0 Failed to erase PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 1 Failed to write PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 1 0 0 0 0 0 0 Wrong settings of switches Check toggle switch - wrong setting
1 1 0 0 0 0 1 0 PS3 is operating NOR, E3 Flasher cannot operate at the same time Check toggle switch -wrong sitting
1 1 0 0 0 1 0 0 Not the right PS3 for this backup Already used e3flasher on 1 console
1 1 0 0 1 0 0 0 Wrong PS3 version, not supported at present Metldr.2 model undowngradable
1 1 0 0 1 1 0 0 Wrong function settings Check toggle switch - wrong setting
set the switches as
1 down / 2 down / 3 up / 4 down / 5 down / 6 down
put the empty micro sd card in and power up the ps3
for phat ps3's wait until it boots to the xmb.
slims wont get this far as the hdd is not connected. so wait 30 seconds.
when the E3 Flasher is ready then the blue led's will flash between :-
1 on / 2 off / 3 on / 4 off / 5 on / 6 off / 7 on / 8 off
1 off / 2 on / 3 off / 4 on / 5 off / 6 on / 7 off 8 on
press start
the blue led's will stop flashing and go out.
then they will turn on one at a time slowly from left to right
once all the led's are on it will then start flashing again.
if it doesnt flash and instead some of the blue led's turn off then you have an error
a light on means 1
a light off means 0
there should also be an error code in the sd card
0 1 0 0 0 0 0 0 Failed to initialize TF card SD card not seated properly
0 1 0 0 0 1 0 0 Failed to read files in TF card SD card not seated properly
0 1 0 0 1 0 0 0 Failed to open TF card SD card not seated properly
0 1 0 0 1 1 0 0 Failed to write files to TF card SD card not seated properly
1 0 0 0 0 1 0 0 Failed to initialize NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 0 1 Failed to read NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 0 Failed to erase NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 1 Failed to write NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 1 1 0 0 Failed to initialize PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 0 1 Failed to read PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 0 Failed to erase PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 1 Failed to write PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 1 0 0 0 0 0 0 Wrong settings of switches Check toggle switch - wrong setting
1 1 0 0 0 0 1 0 PS3 is operating NOR, E3 Flasher cannot operate at the same time Check toggle switch -wrong sitting
1 1 0 0 0 1 0 0 Not the right PS3 for this backup Already used e3flasher on 1 console
1 1 0 0 1 0 0 0 Wrong PS3 version, not supported at present Metldr.2 model undowngradable
1 1 0 0 1 1 0 0 Wrong function settings Check toggle switch - wrong setting
turn off the ps3
put the micro sd card into your pc
the above window should open
you should have the same files as above
open e3flasher.txt
check every line for an error
at the bottom it should say :- OK. Backup PS3 BIOS OK.
if it doesnt then check the clip is on tight and try again
now make a new folder called origional dump in c:\E3 Flasher programs
and put the dump "bkpps3.bin" from your micro sd card into this folder.
goto c:\E3 Flasher programs and find FlowRebuilder run it
this is the main screen
select Byte reverse and EXTRACT a NOR dump file.
than click the box next to brows, drag & drop, drop down
a new window will open.
goto c:\E3 Flasher programs\origional dump.
select your dump
click execute operation
and it’s done it in the same place as the dump and its added “swap” to the name
first goto c:\E3 Flasher programs\origional dump\bkpps3.swap.ext
and you should have the same files as above
now goto c:\E3 Flasher programs and find the HxD (hex editor) install it and then run it.
first time opening
click file click open
select all your dump
get a statistics.
The fine blue bars at either side are what need checking (the one to the left is highlighted in red put your mouse on the left line and you should get a reading between 18.71% - 29.01% (in the area circled in blue) and the line on the right should be between 10.42% - 10.48%
Now close the statistics tab
The first thing you should see at offset 00000010 is FACEOFF , DEADBEEF
if you don’t see this then you have a bad dump. Re-do all your wiring and start again
you should see at offset 00000200 is IFI
First find the IDPS/TARGET ID & METLDR and then BOOTLDR (were still using the hex editor)
The area to find these depends on your ps3 model
IDPS/TARGET ID is at 0002F077 (scroll down to 0002F070 then the top row of numbers is your last digit)
CECH-20xx (DYN-001 boards) it should have the value 09 (this is what is in the image)
CECH-21xx (SUR-001 boards) it should have the value 0A
CECH-25xx (JTP-001 boards) it should have the value 0B
CECH-25xx (JSD-001 boards) it should have the value 0B
METLDR is at 0000081E & 00000842
CECH-20xx (DYN-001 boards) it should have either one of these value’s E9 20 at 0000081E & 0E 8E at 00000842 “OR” E8 90 at 0000081E & 0E 85 at 00000842 (this is what’s shown in the picture)
CECH-21xx (SUR-001 boards) it should have the value E9 20 at 0000081E & 0E 8E at 00000842
CECH-25xx (JTP-001 boards) it should have either one of these value’s E9 20 at 0000081E & 0E 8E at 00000842 “OR” E9 60 at 0000081E & 0E 92 at 00000842 WARNING IF IT HAS THIS F9 20 at 0000081E & 0F 8E at 00000842 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODELCECH-25xx (JSD-001 boards) it should have this value E9 20 at 0000081E & 0E 8E at 00000842 WARNING IF IT HAS THIS F9 20 at 0000081E & 0F 8E at 00000842 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODEL
BOOTLDR is at 00FC0002 & 00FC0012
CECH-20xx (DYN-001 boards) it should have either one of these value’s 2F 3B at 00FC0002 & 2F 3B at 00FC0012 “OR” 2F 13 at 00FC0002 & 2F 13 at 00FC0012 (this is what’s shown in the picture)
CECH-21xx (SUR-001 boards) it should have the value 2F 4B at 00FC0002 & 2F 4B at 00FC0012
CECH-25xx (JTP-001 boards) it should have either one of these value’s 2F 4B at 00FC0002 & 2F 4B at 00FC0012 “OR” 2F 53 at 00FC0002 & 2F 53 at 00FC0012 WARNING IF IT HAS THIS 2F 5B at 00FC0002 & 2F 5B at 00FC0012 OR 2F FB at 00FC0002 & 2F FB at 00FC0012 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODELCECH-25xx (JSD-001 boards) it should have this value 2F 4B at 00FC0002 & 2F 4B at 00FC0012 WARNING IF IT HAS THIS 2F FB at 00FC0002 & 2F FB at 00FC0012 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODELIf you’re not getting some or none of these then you need to check your wiring and re-dump
Ok now we need to take a look and check there are no malformed headers / file names / region names. This is what we are looking for:-
Now find the same positions as shown in blue in the following pictures yours should match
ASECURE LOADER
eEID
cISD
cCSD
Look for SCE on the line below the blue in the following pictures
trvk_prg0
trvk_prg1
trvk_pkg0
trvk_pkg1
Make sure all the words below the blue in the following pictures match yours
ros0
ros1
Make sure the following in blue matches
cvtrm (note you may get this instead in the blue highlight:
00EC0000 53 43 45 49 FF FF FF FF FF FF FF FF FF FF FF FF SCEIÿÿÿÿÿÿÿÿÿÿÿÿ)
0FACEOFF DEADFACE
CELL EXTNOR AREA
bootldr
now go to the ps3devwiki's validating flash dumps pages and do the checks there MAIN VALIDATE PAGE[/URL] DISCUSSION PAGE WITH MORE CHECKS[/URL]
Once it all checks out ok upload your dump NOT the file you just created. to a file share site copy the link and CLICK HERE[/URL] to post your dump. do not use "#ps3downgrade" they nolonget wish to check dumps.
paste your link with “can someone please check my dump. I have followed the guide here (this guide) I have checked it myself.
Once it comes back ok it’s time to patch it (don’t forget to thank the person or persons who checked it for you)
if it comes back ok then delete both ( bkpps3.swap.bin & the folder with the same name) all you want is the origional bkpps3.bin (don’t forget to thank the person or persons who checked it for you)
try the "one-key downgrade" first & if that doesnt work then do the "FlowRebuilder patching" way
insert your micro sd card into the pc.
delete any files on it then goto c:\E3 Flasher programs
copy the e3_downgrade.bin to the micro sd card
put the micro sd card into the E3 and set the switches as:-
1 down / 2 down / 3 down / 4 down / 5 down / 6 up
for phat ps3's wait until it boots to the xmb.
slims wont get this far as the hdd is not connected. so wait 30 seconds.
when the E3 Flasher is ready then the blue led's will flash between :-
1 on / 2 off / 3 on / 4 off / 5 on / 6 off / 7 on / 8 off
1 off / 2 on / 3 off / 4 on / 5 off / 6 on / 7 off 8 on
press start
the blue led's will stop flashing and go out.
then they will turn on one at a time slowly from left to right
dont turn off the ps3 thinking it is not doing anything it takes a 1-2 minutes for each light to come on.
once all the led's are on it will then start flashing again.
if it doesnt flash and instead some of the blue led's turn off then you have an error
a light on means 1
a light off means 0
there should also be an error code in the sd card
0 1 0 0 0 0 0 0 Failed to initialize TF card SD card not seated properly
0 1 0 0 0 1 0 0 Failed to read files in TF card SD card not seated properly
0 1 0 0 1 0 0 0 Failed to open TF card SD card not seated properly
0 1 0 0 1 1 0 0 Failed to write files to TF card SD card not seated properly
1 0 0 0 0 1 0 0 Failed to initialize NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 0 1 Failed to read NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 0 Failed to erase NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 1 Failed to write NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 1 1 0 0 Failed to initialize PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 0 1 Failed to read PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 0 Failed to erase PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 1 Failed to write PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 1 0 0 0 0 0 0 Wrong settings of switches Check toggle switch - wrong setting
1 1 0 0 0 0 1 0 PS3 is operating NOR, E3 Flasher cannot operate at the same time Check toggle switch -wrong sitting
1 1 0 0 0 1 0 0 Not the right PS3 for this backup Already used e3flasher on 1 console
1 1 0 0 1 0 0 0 Wrong PS3 version, not supported at present Metldr.2 model undowngradable
1 1 0 0 1 1 0 0 Wrong function settings Check toggle switch - wrong setting
if you have the flashing lights then there will be a text document created on the micro sd card upen it and at the bottom it shouls have ( OK.
Program Nor OK.)
now turn off the ps3 and goto (Finishing the down grade in service mode)
if you have an error then goto (FlowRebuilder patching & flashing)
Open flow rebuilder and select “PATCH a Byte reversed NOR dump or an interleaved and unscrambled NAND dump”.
Select your nor dump (c:\E3 Flasher programs\origonal dump\bkpps3.bin)
Select the patch file (c:\E3 Flasher programs\E3 downgrade\progskeet_patch.txt)
Click execute
completed it will put the patched dump in the same folder as your original dump (c:\E3 Flasher programs\origonal dump\bkpps3.patch.bin)
put the bkpps3.patch file onto the micro sd card and then change the name to bkpps3
put the micro sd card into the E3 and set the switches as:-
1 down / 2 down / 3 down / 4 down / 5 down / 6 up (the wiki says to put 6 DOWN but this didnt work for me. another error on the wiki??)
for phat ps3's wait until it boots to the xmb.
slims wont get this far as the hdd is not connected. so wait 30 seconds.
when the E3 Flasher is ready then the blue led's will flash between :-
1 on / 2 off / 3 on / 4 off / 5 on / 6 off / 7 on / 8 off
1 off / 2 on / 3 off / 4 on / 5 off / 6 on / 7 off 8 on
press start
the blue led's will stop flashing and go out.
then they will turn on one at a time slowly from left to right
dont turn off the ps3 thinking it is not doing anything it takes a 1-2 minutes for each light to come on.
once all the led's are on it will then start flashing again.
if it doesnt flash and instead some of the blue led's turn off then you have an error
a light on means 1
a light off means 0
there should also be an error code in the sd card
0 1 0 0 0 0 0 0 Failed to initialize TF card SD card not seated properly
0 1 0 0 0 1 0 0 Failed to read files in TF card SD card not seated properly
0 1 0 0 1 0 0 0 Failed to open TF card SD card not seated properly
0 1 0 0 1 1 0 0 Failed to write files to TF card SD card not seated properly
1 0 0 0 0 1 0 0 Failed to initialize NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 0 1 Failed to read NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 0 Failed to erase NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 1 Failed to write NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 1 1 0 0 Failed to initialize PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 0 1 Failed to read PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 0 Failed to erase PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 1 Failed to write PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 1 0 0 0 0 0 0 Wrong settings of switches Check toggle switch - wrong setting
1 1 0 0 0 0 1 0 PS3 is operating NOR, E3 Flasher cannot operate at the same time Check toggle switch -wrong sitting
1 1 0 0 0 1 0 0 Not the right PS3 for this backup Already used e3flasher on 1 console
1 1 0 0 1 0 0 0 Wrong PS3 version, not supported at present Metldr.2 model undowngradable
1 1 0 0 1 1 0 0 Wrong function settings Check toggle switch - wrong setting
if you have the flashing lights then there will be a text document created on the micro sd card upen it and at the bottom it shouls have ( OK.
Program Nor OK.)
now turn off the ps3 and goto (Finishing the down grade in service mode)
remove the E3 Flasher and re-build your ps3 (if your doing the dual boot then just unplug the clip fron the flasher rebuild the ps3 then reconect the E3 Flasher to the clip inside the hdd port)
re-insert the hdd then connect the ps3 to a TV the usual way
(if your doing the dual boot then connect the Esata stand and put your first hdd in that)
turn on your ps3 and you should have this on screen
Turn the ps3 back off insert your dev usb board (programmed with the correct files) into the right usb slot.
a full list of boards are listed at the start of the thread in the second tab down called
"Wrong you need these tools before you even think about following a guide"
inside that tab you will see the second tab down called "A development board" in there is lists of the different dev boards.
Unplug the ps3 from the mains. Wait 10-15 seconds then plug it back in.
(the wiki says to do this as the capacitors need to discharge but as the ps3 is not turned on then the capacitors will actually take months to discharge)
Turn the ps3 back on then immediately press eject within ~200ms. Your console will turn on and if your dev usb has led's then the dongle will light up the red LED followed by the green LED and turn back off.
After triggering Factory Service Mode, go to the folder called “service mode files” & in there is a folder called “service mode 3.55 downgrade files” put the contents of that folder into your usb stick and plug it in the PS3's right most USB port (remove the dev usb & put your usb memory stick in its place)
(the files are rogero cfw v3.2 and the normal Lv2diag.self (365.5 KB) 3.55 get in FSM )
Turn PS3 on, it will install the firmware you had put there (even though you have no screen output, you can see it is busy by looking at the activity led of the hard drive and of your USB Mass Storage Device).
if you get the flashing green power light then this is due to the firmware not installing. first check your hdd is plugged in properly. this is usually what I forget to do. if it still flashes remove your usb stick put it in your pc and you will see “UPDATER_LOG” as a notepad file upload this to a file share site copy the link and CLICK HERE[/URL] to enter the chat room. create your nic name press enter then click the green word "#ps3downgrade" to enter the correct room.
paste your link with “can someone please check my updater log. I have followed the guide here (this guide) I cannot get rogero cfw to install in service mode.
PS3 will turn itself back off when it has finished installing the f/w (Nb this does take a while.)
Now remove your usb stick put it in your pc and you will see “UPDATER_LOG” as a notepad file open it & look through it to see if it contains errors (if it does upload the log to your file share account and ask for help online on IRC) (it should say at the bottom “0x83manufacturing updating SUCCESS(0x8002f000)”)
Now you need to get the ps3 out of service mode.
Open the folder “service mode files” and inside you will see a folder called “get out of service mode” copy the file inside to your usb stick. Put the usb stick back into your ps3 it will boot then the hdd light will flash then turn off. Remove the usb stick. (the file is Lv2diag.self (201.42 KB) get out FSM)
turn on your ps3 and it should now boot to this screen follow the on screen instructions
Now to DeHash the console so it is brick protected when / if you decide to upgrade the firmware
THIS IS THE RECOMENDED WAY
Install and run QA-toggle and make sure it beeps
if you just get a blank screen and nothing happens then you have a faulty bdvd and you cannot do this step. try re-marry bdvd found in the main post then try this step again.
to check you are QA flagged Set your cursor on Network Settings and press the key combo (all at the same time):L1 + L2 + L3 (press left stick) + R1 + R2 + dpad_down
if you are QA flagged a new option will show up right below network settings
Power off console
Put unpatched official firmware (e.g. 3.55) on USB Mass Storage device as /PS3/UPDATE/PS3UPDAT.PUP and insert in PS3
Boot into Recovery Menu:
press and hold power button you get 1 beep then a wait then a second beep then the ps3 turns off
press and hold power button again you get 1 beep then 2 beeps let go of power button
select "6. System Update" to reinstall firmware.
If installation finishes without error (there will be no logs you can check!) and boots XMB OK, then dehashing was successful.
Congrats, you now finished downgrading and dehashing. Console runs 3.55 and any firmware of choice can be installed, no longer needing to be patched for downgrader.
DO NOT DO THE SERVICE MODE WAY AS I AND OTHERS GET RLOD EVERYTIME IT IS DONE
Now you should be on 3.55ofw
You can now install the 3.55cfw of your choice
that’s it simple.
Downloads
download E3 Flasher programs.rar from HERE[/URL] and put then into c:/ your main hdd found in My Computer
remove the fan from the heatsheild
attach the NOR clip (this is on the JSD-001 board)
carefully fold the ribbon over the clip
using 2 peices of card to prevent shorting out the board.
re-connect the fan as shown
turn board back over and plug the fan back in.
re attach and plug in the internal power pack
attach the E3 Flasher together.
the E3 cage will fix to the E3 mainboard using 2 of the origional hdd cage screws.
then push the E3 "PS Sword" (cover board) onto the E3 mainboard via the connectors
connect the ribbon cable to the E3 mainboard via the connector
then push the E3 Flasher into the sata hdd port
take the micro sd card and put it in a micro sd card reader
then put it in your pc & a blank window should open
go to the E3 Flasher programs folder and drag & drop the update.bin file to the micro sd. (this is the multi console update. you can downgrade more than 1 console with this update installed to the E3)
remove the sd card and put the micro sd into the E3 Flasher
now plug in the power / eject board & the ps3 to the mains
set the switches as shown
1 down / 2 down / 3 up / 4 up / 5 up / 6 up
power on the ps3 and you should see the above lights come on
almost instantly the E3 Flasher will update its self & you should see the above light up in blue
press the red button under the esata port (below the blue lights) to reset the E3 Flasher & the blue lights will turn off.
to double check the E3 Flasher has taken the update simply put the micro sd card into the pc and it should be empty.
if its still there just repeat the update steps
if it doesnt flash and instead some of the blue led's turn off then you have an error
a light on means 1
a light off means 0
there should also be an error code in the sd card
0 1 0 0 0 0 0 0 Failed to initialize TF card SD card not seated properly
0 1 0 0 0 1 0 0 Failed to read files in TF card SD card not seated properly
0 1 0 0 1 0 0 0 Failed to open TF card SD card not seated properly
0 1 0 0 1 1 0 0 Failed to write files to TF card SD card not seated properly
1 0 0 0 0 1 0 0 Failed to initialize NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 0 1 Failed to read NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 0 Failed to erase NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 1 Failed to write NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 1 1 0 0 Failed to initialize PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 0 1 Failed to read PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 0 Failed to erase PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 1 Failed to write PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 1 0 0 0 0 0 0 Wrong settings of switches Check toggle switch - wrong setting
1 1 0 0 0 0 1 0 PS3 is operating NOR, E3 Flasher cannot operate at the same time Check toggle switch -wrong sitting
1 1 0 0 0 1 0 0 Not the right PS3 for this backup Already used e3flasher on 1 console
1 1 0 0 1 0 0 0 Wrong PS3 version, not supported at present Metldr.2 model undowngradable
1 1 0 0 1 1 0 0 Wrong function settings Check toggle switch - wrong setting
set the switches as
1 down / 2 down / 3 up / 4 down / 5 down / 6 down
put the empty micro sd card in and power up the ps3
for phat ps3's wait until it boots to the xmb.
slims wont get this far as the hdd is not connected. so wait 30 seconds.
when the E3 Flasher is ready then the blue led's will flash between :-
1 on / 2 off / 3 on / 4 off / 5 on / 6 off / 7 on / 8 off
1 off / 2 on / 3 off / 4 on / 5 off / 6 on / 7 off 8 on
press start
the blue led's will stop flashing and go out.
then they will turn on one at a time slowly from left to right
once all the led's are on it will then start flashing again.
if it doesnt flash and instead some of the blue led's turn off then you have an error
a light on means 1
a light off means 0
there should also be an error code in the sd card
0 1 0 0 0 0 0 0 Failed to initialize TF card SD card not seated properly
0 1 0 0 0 1 0 0 Failed to read files in TF card SD card not seated properly
0 1 0 0 1 0 0 0 Failed to open TF card SD card not seated properly
0 1 0 0 1 1 0 0 Failed to write files to TF card SD card not seated properly
1 0 0 0 0 1 0 0 Failed to initialize NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 0 1 Failed to read NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 0 Failed to erase NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 1 Failed to write NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 1 1 0 0 Failed to initialize PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 0 1 Failed to read PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 0 Failed to erase PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 1 Failed to write PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 1 0 0 0 0 0 0 Wrong settings of switches Check toggle switch - wrong setting
1 1 0 0 0 0 1 0 PS3 is operating NOR, E3 Flasher cannot operate at the same time Check toggle switch -wrong sitting
1 1 0 0 0 1 0 0 Not the right PS3 for this backup Already used e3flasher on 1 console
1 1 0 0 1 0 0 0 Wrong PS3 version, not supported at present Metldr.2 model undowngradable
1 1 0 0 1 1 0 0 Wrong function settings Check toggle switch - wrong setting
turn off the ps3
put the micro sd card into your pc
the above window should open
you should have the same files as above
open e3flasher.txt
check every line for an error
at the bottom it should say :- OK. Backup PS3 BIOS OK.
if it doesnt then check the clip is on tight and try again
now make a new folder called origional dump in c:\E3 Flasher programs
and put the dump "bkpps3.bin" from your micro sd card into this folder.
goto c:\E3 Flasher programs and find FlowRebuilder run it
this is the main screen
select Byte reverse and EXTRACT a NOR dump file.
than click the box next to brows, drag & drop, drop down
a new window will open.
goto c:\E3 Flasher programs\origional dump.
select your dump
click execute operation
and it’s done it in the same place as the dump and its added “swap” to the name
first goto c:\E3 Flasher programs\origional dump\bkpps3.swap.ext
and you should have the same files as above
now goto c:\E3 Flasher programs and find the HxD (hex editor) install it and then run it.
first time opening
click file click open
select all your dump
get a statistics.
The fine blue bars at either side are what need checking (the one to the left is highlighted in red put your mouse on the left line and you should get a reading between 18.71% - 29.01% (in the area circled in blue) and the line on the right should be between 10.42% - 10.48%
Now close the statistics tab
The first thing you should see at offset 00000010 is FACEOFF , DEADBEEF
if you don’t see this then you have a bad dump. Re-do all your wiring and start again
you should see at offset 00000200 is IFI
First find the IDPS/TARGET ID & METLDR and then BOOTLDR (were still using the hex editor)
The area to find these depends on your ps3 model
IDPS/TARGET ID is at 0002F077 (scroll down to 0002F070 then the top row of numbers is your last digit)
CECH-20xx (DYN-001 boards) it should have the value 09 (this is what is in the image)
CECH-21xx (SUR-001 boards) it should have the value 0A
CECH-25xx (JTP-001 boards) it should have the value 0B
CECH-25xx (JSD-001 boards) it should have the value 0B
METLDR is at 0000081E & 00000842
CECH-20xx (DYN-001 boards) it should have either one of these value’s E9 20 at 0000081E & 0E 8E at 00000842 “OR” E8 90 at 0000081E & 0E 85 at 00000842 (this is what’s shown in the picture)
CECH-21xx (SUR-001 boards) it should have the value E9 20 at 0000081E & 0E 8E at 00000842
CECH-25xx (JTP-001 boards) it should have either one of these value’s E9 20 at 0000081E & 0E 8E at 00000842 “OR” E9 60 at 0000081E & 0E 92 at 00000842 WARNING IF IT HAS THIS F9 20 at 0000081E & 0F 8E at 00000842 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODELCECH-25xx (JSD-001 boards) it should have this value E9 20 at 0000081E & 0E 8E at 00000842 WARNING IF IT HAS THIS F9 20 at 0000081E & 0F 8E at 00000842 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODEL
BOOTLDR is at 00FC0002 & 00FC0012
CECH-20xx (DYN-001 boards) it should have either one of these value’s 2F 3B at 00FC0002 & 2F 3B at 00FC0012 “OR” 2F 13 at 00FC0002 & 2F 13 at 00FC0012 (this is what’s shown in the picture)
CECH-21xx (SUR-001 boards) it should have the value 2F 4B at 00FC0002 & 2F 4B at 00FC0012
CECH-25xx (JTP-001 boards) it should have either one of these value’s 2F 4B at 00FC0002 & 2F 4B at 00FC0012 “OR” 2F 53 at 00FC0002 & 2F 53 at 00FC0012 WARNING IF IT HAS THIS 2F 5B at 00FC0002 & 2F 5B at 00FC0012 OR 2F FB at 00FC0002 & 2F FB at 00FC0012 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODELCECH-25xx (JSD-001 boards) it should have this value 2F 4B at 00FC0002 & 2F 4B at 00FC0012 WARNING IF IT HAS THIS 2F FB at 00FC0002 & 2F FB at 00FC0012 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODELIf you’re not getting some or none of these then you need to check your wiring and re-dump
Ok now we need to take a look and check there are no malformed headers / file names / region names. This is what we are looking for:-
Now find the same positions as shown in blue in the following pictures yours should match
ASECURE LOADER
eEID
cISD
cCSD
Look for SCE on the line below the blue in the following pictures
trvk_prg0
trvk_prg1
trvk_pkg0
trvk_pkg1
Make sure all the words below the blue in the following pictures match yours
ros0
ros1
Make sure the following in blue matches
cvtrm (note you may get this instead in the blue highlight:
00EC0000 53 43 45 49 FF FF FF FF FF FF FF FF FF FF FF FF SCEIÿÿÿÿÿÿÿÿÿÿÿÿ)
0FACEOFF DEADFACE
CELL EXTNOR AREA
bootldr
now go to the ps3devwiki's validating flash dumps pages and do the checks there MAIN VALIDATE PAGE[/URL] DISCUSSION PAGE WITH MORE CHECKS[/URL]
Once it all checks out ok upload your dump NOT the file you just created. to a file share site copy the link and CLICK HERE[/URL] to post your dump. do not use "#ps3downgrade" they nolonget wish to check dumps.
paste your link with “can someone please check my dump. I have followed the guide here (this guide) I have checked it myself.
Once it comes back ok it’s time to patch it (don’t forget to thank the person or persons who checked it for you)
if it comes back ok then delete both ( bkpps3.swap.bin & the folder with the same name) all you want is the origional bkpps3.bin (don’t forget to thank the person or persons who checked it for you)
try the "one-key downgrade" first & if that doesnt work then do the "FlowRebuilder patching" way
insert your micro sd card into the pc.
delete any files on it then goto c:\E3 Flasher programs
copy the e3_downgrade.bin and your checked dump (bkpps3) to the micro sd card
put the micro sd card into the E3 and set the switches as:-
1 down / 2 down / 3 down / 4 down / 5 down / 6 up
for phat ps3's wait until it boots to the xmb.
slims wont get this far as the hdd is not connected. so wait 30 seconds.
when the E3 Flasher is ready then the blue led's will flash between :-
1 on / 2 off / 3 on / 4 off / 5 on / 6 off / 7 on / 8 off
1 off / 2 on / 3 off / 4 on / 5 off / 6 on / 7 off 8 on
press start
the blue led's will stop flashing and go out.
then they will turn on one at a time slowly from left to right
dont turn off the ps3 thinking it is not doing anything it takes a 1-2 minutes for each light to come on.
once all the led's are on it will then start flashing again.
if it doesnt flash and instead some of the blue led's turn off then you have an error
a light on means 1
a light off means 0
there should also be an error code in the sd card
0 1 0 0 0 0 0 0 Failed to initialize TF card SD card not seated properly
0 1 0 0 0 1 0 0 Failed to read files in TF card SD card not seated properly
0 1 0 0 1 0 0 0 Failed to open TF card SD card not seated properly
0 1 0 0 1 1 0 0 Failed to write files to TF card SD card not seated properly
1 0 0 0 0 1 0 0 Failed to initialize NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 0 1 Failed to read NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 0 Failed to erase NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 1 Failed to write NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 1 1 0 0 Failed to initialize PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 0 1 Failed to read PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 0 Failed to erase PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 1 Failed to write PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 1 0 0 0 0 0 0 Wrong settings of switches Check toggle switch - wrong setting
1 1 0 0 0 0 1 0 PS3 is operating NOR, E3 Flasher cannot operate at the same time Check toggle switch -wrong sitting
1 1 0 0 0 1 0 0 Not the right PS3 for this backup Already used e3flasher on 1 console
1 1 0 0 1 0 0 0 Wrong PS3 version, not supported at present Metldr.2 model undowngradable
1 1 0 0 1 1 0 0 Wrong function settings Check toggle switch - wrong setting
if you have the flashing lights then there will be a text document created on the micro sd card upen it and at the bottom it should have ( OK. Program Nor OK.)
now turn off the ps3 and goto (Finishing the down grade in service mode)
if you have an error then goto (FlowRebuilder patching & flashing)
Open flow rebuilder and select “PATCH a Byte reversed NOR dump or an interleaved and unscrambled NAND dump”.
Select your nor dump (c:\E3 Flasher programs\origonal dump\bkpps3.bin)
Select the patch file (c:\E3 Flasher programs\E3 downgrade\progskeet_patch.txt)
Click execute
completed it will put the patched dump in the same folder as your original dump (c:\E3 Flasher programs\origonal dump\bkpps3.patch.bin)
put the bkpps3.patch file onto the micro sd card and then change the name to bkpps3
put the micro sd card into the E3 and set the switches as:-
1 down / 2 down / 3 down / 4 down / 5 down / 6 up (the wiki says to put 6 DOWN but this didnt work for me. another error on the wiki??)
for phat ps3's wait until it boots to the xmb.
slims wont get this far as the hdd is not connected. so wait 30 seconds.
when the E3 Flasher is ready then the blue led's will flash between :-
1 on / 2 off / 3 on / 4 off / 5 on / 6 off / 7 on / 8 off
1 off / 2 on / 3 off / 4 on / 5 off / 6 on / 7 off 8 on
press start
the blue led's will stop flashing and go out.
then they will turn on one at a time slowly from left to right
dont turn off the ps3 thinking it is not doing anything it takes a 1-2 minutes for each light to come on.
once all the led's are on it will then start flashing again.
if it doesnt flash and instead some of the blue led's turn off then you have an error
a light on means 1
a light off means 0
there should also be an error code in the sd card
0 1 0 0 0 0 0 0 Failed to initialize TF card SD card not seated properly
0 1 0 0 0 1 0 0 Failed to read files in TF card SD card not seated properly
0 1 0 0 1 0 0 0 Failed to open TF card SD card not seated properly
0 1 0 0 1 1 0 0 Failed to write files to TF card SD card not seated properly
1 0 0 0 0 1 0 0 Failed to initialize NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 0 1 Failed to read NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 0 Failed to erase NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 1 Failed to write NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 1 1 0 0 Failed to initialize PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 0 1 Failed to read PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 0 Failed to erase PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 1 Failed to write PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 1 0 0 0 0 0 0 Wrong settings of switches Check toggle switch - wrong setting
1 1 0 0 0 0 1 0 PS3 is operating NOR, E3 Flasher cannot operate at the same time Check toggle switch -wrong sitting
1 1 0 0 0 1 0 0 Not the right PS3 for this backup Already used e3flasher on 1 console
1 1 0 0 1 0 0 0 Wrong PS3 version, not supported at present Metldr.2 model undowngradable
1 1 0 0 1 1 0 0 Wrong function settings Check toggle switch - wrong setting
if you have the flashing lights then there will be a text document created on the micro sd card upen it and at the bottom it shouls have ( OK.
Program Nor OK.)
now turn off the ps3
insert the hdd then connect the ps3 to a TV the usual way
set the switches on the E3 as
1 down 2 up 3 down 4 down 5 down 6 down
turn on your ps3 and you should have this on screen
Turn the ps3 back off insert your dev usb board (programmed with the correct files) into the right usb slot.
a full list of boards are listed at the start of the thread in the second tab down called
"Wrong you need these tools before you even think about following a guide"
inside that tab you will see the second tab down called "A development board" in there is lists of the different dev boards.
Unplug the ps3 from the mains. Wait 10-15 seconds then plug it back in.
(the wiki says to do this as the capacitors need to discharge but as the ps3 is not turned on then the capacitors will actually take months to discharge)
Turn the ps3 back on then immediately press eject within ~200ms. Your console will turn on and if your dev usb has led's then the dongle will light up the red LED followed by the green LED and turn back off.
After triggering Factory Service Mode, go to the folder called “service mode files” & in there is a folder called “service mode 3.55 downgrade files” put the contents of that folder into your usb stick and plug it in the PS3's right most USB port (remove the dev usb & put your usb memory stick in its place)
(the files are rogero cfw v3.2 and the normal Lv2diag.self (365.5 KB) 3.55 get in FSM )
Turn PS3 on, it will install the firmware you had put there (even though you have no screen output, you can see it is busy by looking at the activity led of the hard drive and of your USB Mass Storage Device).
if you get the flashing green power light then this is due to the firmware not installing. first check your hdd is plugged in properly. this is usually what I forget to do. if it still flashes remove your usb stick put it in your pc and you will see “UPDATER_LOG” as a notepad file upload this to a file share site copy the link and CLICK HERE[/URL] to enter the chat room. create your nic name press enter then click the green word "#ps3downgrade" to enter the correct room.
paste your link with “can someone please check my updater log. I have followed the guide here (this guide) I cannot get rogero cfw to install in service mode.
PS3 will turn itself back off when it has finished installing the f/w (Nb this does take a while.)
Now remove your usb stick put it in your pc and you will see “UPDATER_LOG” as a notepad file open it & look through it to see if it contains errors (if it does upload the log to your file share account and ask for help online on IRC) (it should say at the bottom “0x83manufacturing updating SUCCESS(0x8002f000)”)
Now you need to get the ps3 out of service mode.
Open the folder “service mode files” and inside you will see a folder called “get out of service mode” copy the file inside to your usb stick. Put the usb stick back into your ps3 it will boot then the hdd light will flash then turn off. Remove the usb stick. (the file is Lv2diag.self (201.42 KB) get out FSM)
turn on your ps3 and it should now boot to this screen follow the on screen instructions
Now to DeHash the console so it is brick protected when / if you decide to upgrade the firmware
THIS IS THE RECOMENDED WAY
Install and run QA-toggle and make sure it beeps 3 times
if you just get a blank screen and nothing happens then you have a faulty bdvd and you cannot do this step. try re-marry bdvd found in the main post then try this step again.
to check you are QA flagged Set your cursor on Network Settings and press the key combo (all at the same time):L1 + L2 + L3 (press left stick) + R1 + R2 + dpad_down
if you are QA flagged a new option will show up right below network settings
Power off console
Put unpatched official firmware (e.g. 3.55) on USB Mass Storage device as /PS3/UPDATE/PS3UPDAT.PUP and insert in PS3
Boot into Recovery Menu:
press and hold power button you get 1 beep then a wait then a second beep then the ps3 turns off
press and hold power button again you get 1 beep then 2 beeps (double beep) let go of power button
select "6. System Update" to reinstall firmware.
If installation finishes without error (there will be no logs you can check!) and boots XMB OK, then dehashing was successful.
Congrats, you have now finished downgrading and dehashing. Console runs 3.55 and any firmware of choice can be installed, no longer needing to be patched for downgrader.
DO NOT DO THE SERVICE MODE WAY AS I AND OTHERS GET RLOD EVERYTIME IT IS DONE
Now you should be on 3.55ofw
You can now install the 3.55cfw of your choice
install a 3.55cfw before carrying on
take the micro sd card and put it in a micro sd card reader
then put it in your pc & a blank window should open
go into the E3 Flasher programs folder then files for dual booting folder and then 2012.01.05 update and drag & drop the update.bin (this is the dual boot one) file to the micro sd.
remove the sd card and put the micro sd into the E3 Flasher
set the switches as shown
1 down / 2 down / 3 up / 4 up / 5 up / 6 up
power on the ps3 and you should see the above lights come on
almost instantly the E3 Flasher will update its self & you should see the above light up in blue
press the red button under the esata port (below the blue lights) to reset the E3 Flasher & the blue lights will turn off.
to double check the E3 Flasher has taken the update simply put the micro sd card into the pc and it should be empty.
if its still there just repeat the update steps
if it doesnt flash and instead some of the blue led's turn off then you have an error
a light on means 1
a light off means 0
there should also be an error code in the sd card
0 1 0 0 0 0 0 0 Failed to initialize TF card SD card not seated properly
0 1 0 0 0 1 0 0 Failed to read files in TF card SD card not seated properly
0 1 0 0 1 0 0 0 Failed to open TF card SD card not seated properly
0 1 0 0 1 1 0 0 Failed to write files to TF card SD card not seated properly
1 0 0 0 0 1 0 0 Failed to initialize NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 0 1 Failed to read NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 0 Failed to erase NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 1 Failed to write NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 1 1 0 0 Failed to initialize PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 0 1 Failed to read PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 0 Failed to erase PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 1 Failed to write PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 1 0 0 0 0 0 0 Wrong settings of switches Check toggle switch - wrong setting
1 1 0 0 0 0 1 0 PS3 is operating NOR, E3 Flasher cannot operate at the same time Check toggle switch -wrong sitting
1 1 0 0 0 1 0 0 Not the right PS3 for this backup Already used e3flasher on 1 console
1 1 0 0 1 0 0 0 Wrong PS3 version, not supported at present Metldr.2 model undowngradable
1 1 0 0 1 1 0 0 Wrong function settings Check toggle switch - wrong setting
image 1
set the switches as
1 down / 2 up / 3 down / 4 up / 5 down / 6 down
and power on the ps3
wait 30 seconds.
when the E3 Flasher is ready then the blue led's will flash between :-
1 on / 2 off / 3 on / 4 off / 5 on / 6 off / 7 on / 8 off
1 off / 2 on / 3 off / 4 on / 5 off / 6 on / 7 off 8 on
press start
the blue led's will stop flashing and go out.
then they will turn on one at a time slowly from left to right
once all the led's are on it will then start flashing again.
if it doesnt flash and instead some of the blue led's turn off then you have an error
a light on means 1
a light off means 0
there should also be an error code in the sd card
0 1 0 0 0 0 0 0 Failed to initialize TF card SD card not seated properly
0 1 0 0 0 1 0 0 Failed to read files in TF card SD card not seated properly
0 1 0 0 1 0 0 0 Failed to open TF card SD card not seated properly
0 1 0 0 1 1 0 0 Failed to write files to TF card SD card not seated properly
1 0 0 0 0 1 0 0 Failed to initialize NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 0 1 Failed to read NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 0 Failed to erase NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 1 Failed to write NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 1 1 0 0 Failed to initialize PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 0 1 Failed to read PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 0 Failed to erase PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 1 Failed to write PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 1 0 0 0 0 0 0 Wrong settings of switches Check toggle switch - wrong setting
1 1 0 0 0 0 1 0 PS3 is operating NOR, E3 Flasher cannot operate at the same time Check toggle switch -wrong sitting
1 1 0 0 0 1 0 0 Not the right PS3 for this backup Already used e3flasher on 1 console
1 1 0 0 1 0 0 0 Wrong PS3 version, not supported at present Metldr.2 model undowngradable
1 1 0 0 1 1 0 0 Wrong function settings Check toggle switch - wrong setting
now i have had trouble with 1100010 error (ps3 is operating nor)
i ended up re-naming the bkpps3 backup to bkpe3 and with switches set as
1 down 2 down 3 down 4 down 5 down 6 up
then turning on the ps3. wait 30 sec then pressing start
this then coppied the dump to the E3's nor
i dont know why i had so much trouble but that was my fix.
image 2
turn off the ps3
put the micro sd card into your pc
the above window should open
you should have the same files as above
open e3flasher.txt
check every line for an error
at the bottom it should say :- OK. Backup E3 BIOS OK.
if it doesnt then check the clip is on tight and try again
image 1
set the switches as
1 down / 2 down / 3 down / 4 down / 5 down / 6 down
and power on the ps3
update your ps3 to the latest firmware (this is updating the ps3's nor)
once done remove the hdd and mark as "ofw" and mark the other hdd as "3.55cfw"
image 2
now goto E3 Flasher Programs folder then into files for dual booting folder then into e3_downgrade folder then put the e3_downgrade.bin file onto your micro sd card from c://e3downgrade to TF v1.2
and your origional backup bkpps3
image 3
set the switches as
1 down / 2 down / 3 down / 4 down / 5 down / 6 up
and power on the ps3
wait 30 seconds.
when the E3 Flasher is ready then the blue led's will flash between :-
1 on / 2 off / 3 on / 4 off / 5 on / 6 off / 7 on / 8 off
1 off / 2 on / 3 off / 4 on / 5 off / 6 on / 7 off 8 on
press start
the blue led's will stop flashing and go out.
then they will turn on one at a time slowly from left to right
once all the led's are on it will then start flashing again.
if it doesnt flash and instead some of the blue led's turn off then you have an error
a light on means 1
a light off means 0
there should also be an error code in the sd card
0 1 0 0 0 0 0 0 Failed to initialize TF card SD card not seated properly
0 1 0 0 0 1 0 0 Failed to read files in TF card SD card not seated properly
0 1 0 0 1 0 0 0 Failed to open TF card SD card not seated properly
0 1 0 0 1 1 0 0 Failed to write files to TF card SD card not seated properly
1 0 0 0 0 1 0 0 Failed to initialize NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 0 1 Failed to read NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 0 Failed to erase NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 0 1 1 1 Failed to write NOR in E3 Check pads / clip at E3 board check may not be properly seated
1 0 0 0 1 1 0 0 Failed to initialize PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 0 1 Failed to read PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 0 Failed to erase PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 0 0 0 1 1 1 1 Failed to write PS3 BIOS Check pads / clip at PS3 board check may not be properly seated
1 1 0 0 0 0 0 0 Wrong settings of switches Check toggle switch - wrong setting
1 1 0 0 0 0 1 0 PS3 is operating NOR, E3 Flasher cannot operate at the same time Check toggle switch -wrong sitting
1 1 0 0 0 1 0 0 Not the right PS3 for this backup Already used e3flasher on 1 console
1 1 0 0 1 0 0 0 Wrong PS3 version, not supported at present Metldr.2 model undowngradable
1 1 0 0 1 1 0 0 Wrong function settings Check toggle switch - wrong setting
if all went fine then you can now use the fast dual boot switch
1st. when it will only boot to ofw set your switch to cfw put your cfw hdd in and reinstall cfw via recovery menu (yes it will install) then re-do the dual boot update
2nd. when it only boots to cfw then set your switch to ofw put in your ofw hdd then reinstall ofw via recovery menu then re-do the dual boot update
3rd. re-installing cfw wont loose your games as it doesnt format the hdd (trophies etc i think are lost) its just putting the same f/w back on over the one that is still there.
4th. qa-flag de-hash the cfw boot once its up and running then you can change cfw types without fear of getting the red-light-hash-fail
Last edited by baileyscream; 12-01-2012 at 06:11 AM.
Very very very good job
I had downgraded more than 200 consoles till now using ProgSkeet and your tutorial is awesome for every n00b hardware downgrader
what i put here has now been improved in the guide by using QA flag de-hashing instead
(i found it the only way to get around the RLOD thanks to master737373 for his personal time he gave me in order to solve this issue) my origional post is saved here for the curious.
major issue found with the dehashing part. i have ammended it (the way i had put it gave you a rlod if you changed f/w
i have just updated to rebug and now i have rlod. so i know my info was wrong
the tut is now safe to follow
--------------------------------it did say-------------------------------
delete the “UPDATER_LOG” then put the usb stick back in and let it install again. When it turns off check the “UPDATER_LOG” again (it should say at the bottom “0x83manufacturing updating SUCCESS(0x8002f000)”)
--------------------------------it now says-------------------------------
delete the “UPDATER_LOG” and "PS3UPDAT" put in the official 3.55 firmware " PS3UPDAT" then put the usb stick back in and let it install again. When it turns off check the “UPDATER_LOG” again (it should say at the bottom “0x83manufacturing updating SUCCESS(0x8002f000)”)
sorry about that.
updated the guide to include rlod fix
see i'm here to get you there
Last edited by baileyscream; 07-04-2012 at 09:11 AM.
)
Reply With Quote
Originally Posted by 3absiso
