EXCLUSIVE: C2D v2 (PS3 Flash Patcher) - Now Allows Users to Modify TargetID Settings
Well, it looks like andbey0nd has been busting his cojones once again to give the PS3 console mod-tool users an update of the first newbie-friendly CEX-to-DEX-based application.
c2d.exe (win32 app)
* OpenSSL 1.0.1 installed in c:\openssl or d:\openssl (http://slproweb.com/download/Win32Op...ght-1_0_1c.exe)
* EID root key (per_console_key) obtained with metldrpwn
* PS3 (NOR) flash dump
* Extract c2d.rar in a local folder (c:\c2d or d:\c2d)
* Allows changing the Region / TargetID of your PS3 system
* Allows "converting" any Retail PS3 into Debug unit (target_id 0x82)
* Allows "converting" a Retail PS3 from one region to another (i.e. EUR PS3 -> JAP PS3, USA PS3 -> RUSSIAN PS3)
Changing a Retail PS3 region unlocks playback for region-locked DVD/Blu-ray movies and PS1/PS3 games
For best results flash the output NOR file with a tool which rewrites *ONLY the EID0 sector*
(one sector / 512 bytes @ sector #376 / 0x178; NOR file offset 0x2f000-0x2f1ff).
Flashing the whole 16MB NOR is not needed and can easily brick the PS3.
* Use your original NOR flash to create new files for different regions for your PS3 to have them handy later:
For example you can have (each file is 16MB):
* Using a proper tool you can switch regions in one second when needed
* The latest online debug update of multiMAN 04.04.03 handles writing to NOR in the right fashion (1 sector) from .EID0.NORBIN files.
* To dump NOR: mmOS->Select any file->Open in HEX viewer->[SELECT]->[START]->DUMP LV2(NO)->DUMP LV1(NO)->DUMP FLASH(YES)
* To write EID0 sector: mmOS->Double-click on a .EID0.NORBIN 16MB full NOR dump file->Follow the on-screen instructions->Reboot.
c2d - Changes REGION/TARGET_ID in PS3 NOR flash
Usage: c2d.exe eid_key_file.bin in_flash.bin out_flash.bin [target_id]
82 (DEX) (default)
8A (SE ASIA)
c:\c2d> c2d.exe eid_root_key.bin flashCEX.bin flashDEX.bin 82
EID key : 48 bytes (eid_root_key.bin)
Flash size : 16 MB (flashCEX.bin)
Target ID : $85
EID ROOT KEY: 64D20967DEACDA16ACADBE289B0EE2C25EE77331A5040C5DC9DF67B3FE574F6D
EID ROOT IV : 6BD7C324D3B213A647DC31987345595E
EID0 KEY : 9C1C4A93666EF67941F54679A7199D7553C8F0F50F3548C8966D6872FC8CD668
EID0 IV : 2DC374E270F851EB0D524F89790F2563
EID0 SEC KEY: 4C40F3E244EF2BF29A9D48BE26FEEEEB
Target ID : $85 (from decrypted EID0 section)
New TargetID: $82 (for modified flash)
CMAC HASH : F1053CC3818DD6CE2775F0273DFC212E
Writing modified flash with TargetID: $82 (flashDEX.bin)...
Note that the debug (DEX system unit compatible) update of multiMAN is available as USUAL when you start multiMAN while holding L2+R2 and updating online.
Update #7: gDrive has posted up a newbie-friendly CEX-to-DEX conversion tutorial for those who want to convert their systems without going through the hassle of installing/using OtherOS/Command Prompt - click here for the tutorial: gDrive's Noob-Friendly CEX-to-DEX Tutorial
Special thanks to JLM, deank, TomatOsaUce, acab, tul, andreus, Rogero, Zadow and everyone else who I have not mentioned but are involved in helping out with the CEX-to-DEX conversion/unbricking processes.