EXCLUSIVE: C2D v2 (PS3 Flash Patcher) - Now Allows Users to Modify TargetID Settings

[gDrive]

Well, it looks like andbey0nd has been busting his cojones once again to give the PS3 console mod-tool users an update of the first newbie-friendly CEX-to-DEX-based application.

Readme: http://pastie.org/4282714
c2d.exe (win32 app)
===================

Requires:

* OpenSSL 1.0.1 installed in c:\openssl or d:\openssl (http://slproweb.com/download/Win32Op...ght-1_0_1c.exe)
* EID root key (per_console_key) obtained with metldrpwn
* PS3 (NOR) flash dump
* Extract c2d.rar in a local folder (c:\c2d or d:\c2d)


Purpose:

* Allows changing the Region / TargetID of your PS3 system
* Allows "converting" any Retail PS3 into Debug unit (target_id 0x82)
* Allows "converting" a Retail PS3 from one region to another (i.e. EUR PS3 -> JAP PS3, USA PS3 -> RUSSIAN PS3)
  Changing a Retail PS3 region unlocks playback for region-locked DVD/Blu-ray movies and PS1/PS3 games

* WARNING:
  For best results flash the output NOR file with a tool which rewrites *ONLY the EID0 sector*
  (one sector / 512 bytes @ sector #376 / 0x178; NOR file offset 0x2f000-0x2f1ff).
  Flashing the whole 16MB NOR is not needed and can easily brick the PS3.


TIPS:

* Use your original NOR flash to create new files for different regions for your PS3 to have them handy later:
  For example you can have (each file is 16MB):
  my-slim-JAP.EID0.NORBIN
  my-slim-EUR.EID0.NORBIN
  my-slim-USA.EID0.NORBIN
  my-slim-DEX.EID0.NORBIN

* Using a proper tool you can switch regions in one second when needed

PROTIPS:

* The latest online debug update of multiMAN 04.04.03 handles writing to NOR in the right fashion (1 sector) from .EID0.NORBIN files.
* To dump NOR: mmOS->Select any file->Open in HEX viewer->[SELECT]->[START]->DUMP LV2(NO)->DUMP LV1(NO)->DUMP FLASH(YES)
* To write EID0 sector: mmOS->Double-click on a .EID0.NORBIN 16MB full NOR dump file->Follow the on-screen instructions->Reboot.


Usage:

c2d  - Changes REGION/TARGET_ID in PS3 NOR flash
Usage: c2d.exe eid_key_file.bin in_flash.bin out_flash.bin [target_id]
       [target_id]: 82..8C
                    82 (DEX) (default)
                    83 (JAPAN)
                    84 (USA/CANADA)
                    85 (EUROPE)
                    86 (KOREA)
                    87 (UK)
                    88 (MEXICO)
                    89 (AUSTRALIA)
                    8A (SE ASIA)
                    8B (TAIWAN)
                    8C (RUS/ASIA)


Output:

c:\c2d> c2d.exe eid_root_key.bin flashCEX.bin flashDEX.bin 82

EID key     : 48 bytes (eid_root_key.bin)
Flash size  : 16 MB (flashCEX.bin)
Target ID   : $85

EID ROOT KEY: 64D20967DEACDA16ACADBE289B0EE2C25EE77331A5040C5DC9DF67B3FE574F6D
EID ROOT IV : 6BD7C324D3B213A647DC31987345595E

EID0 KEY    : 9C1C4A93666EF67941F54679A7199D7553C8F0F50F3548C8966D6872FC8CD668
EID0 IV     : 2DC374E270F851EB0D524F89790F2563

EID0 SEC KEY: 4C40F3E244EF2BF29A9D48BE26FEEEEB

Target ID   : $85 (from decrypted EID0 section)
New TargetID: $82 (for modified flash)

CMAC HASH   : F1053CC3818DD6CE2775F0273DFC212E

Writing modified flash with TargetID: $82 (flashDEX.bin)...
Done!

Enjoy!
andbey0nd

Note that the debug (DEX system unit compatible) update of multiMAN is available as USUAL when you start multiMAN while holding L2+R2 and updating online.

Also, before you think about converting your retail firmware (CEX)-installed console into a debug firmware (DEX)-installed console, please read TomatOsaUce's newbie-friendly conversion tutorial here: TomatOsaUce's CEX-to-DEX Conversion Tutorial.

Update #1: deank has prepared a METLDRPWN/OtherOS-ready PUP for end-users to make the CEX-to-DEX conversion process even easier, with a tutorial on how to use it here: DeanK's OtherOS with METLDRPWN PUP Installation/Usage Tutorial (also read Updates #5 and #6 if you do not want to brick your console during the conversion process).

Update #2: BNDVS has translated the CEX-to-DEX Conversion tutorial in Russian for those who are fluent in speaking/reading/writing the language - click here: DeanK's OtherOS with METLDRPWN PUP (CEX-to-DEX Conversion) Installation/Usage Tutorial (Russian).

Update #3: Rogero has written up a tutorial on how to reset the syscon hashes so that users who have downgraded their PS3s via the use of a hardware flasher and with Rogero's CFW v3 can actually convert their consoles without bricking it and without the need for LV1-patched firmwares - click here: Rogero's Syscon Hash Resetting Tutorial, and for the Rogero DEX 3.55 Peek/Poke & DEX Firmware Downgrade-Supported firmware, click here: Rogero's DEX 3.55 CFW with Peek/Poke & Downgrade Support (Rogero's DEX CFW v2 is now here).

Update #4: tul and andreus have written up a tutorial on how to unbrick your PS3 when your PS3 is bricked due to a DEX-to-CEX rollback conversion - click here: Tul's DEX-to-CEX Rollback Conversion Unbricking Tutorial and here: Tul's DEX-to-CEX Rollback Conversion Unbricking Tutorial (rewritten by andreus with an improved layout).

Update #5: butnut has given some tips on how to prevent a PS3 from bricking during the CEX-DEX changeover - click here: butnut's Tips On Preventing PS3s From Bricking During The CEX-DEX Changeover.

Update #6: andreus and Rogero has posted up a brick-prevention tutorial for those who want to switch back and forth between the CEX and DEX TargetIDs, and is a MUST-READ if you want to prevent your console from bricking and if you do not want to resort to having to go through a tedious process of unbricking your PS3 - click here: andreus/Rogero's CEX-DEX Swap-Over/DEX-CEX Rollback Brick Prevention Tutorial.

Update #7: gDrive has posted up a newbie-friendly CEX-to-DEX conversion tutorial for those who want to convert their systems without going through the hassle of installing/using OtherOS/Command Prompt - click here for the tutorial: gDrive's Noob-Friendly CEX-to-DEX Tutorial

DOWNLOAD LINK: C2D (~2MB) (via Sendspace) (latest version)

PROGRAM README: C2D.EXE Readme - Pastie

Special thanks to JLM, deank, TomatOsaUce, acab, tul, andreus, Rogero, Zadow and everyone else who I have not mentioned but are involved in helping out with the CEX-to-DEX conversion/unbricking processes.

[acab]

quick change cex -dex via MM without the need of Linux or flasher after you obtained a valid dex eid0 .. thats almost like fake cex-dex dualboot .. kudos !!!

[CloneD]

Seems it's getting pretty darn easy to convert, but wouldn't I need debug eboots for all my game backups or have I read wrong ? I like my cex

[evilsperm]

you still need linux...

[acab]

not AFTER you obtained a valid dex eid0 ..

[TomatOsaUce]

If someone uploads a compiled metldrpwn... all you'd have to do in Linux is type "sudo ./run
sh". My dog could do that!
Love the region change & as acab said, psuedo dualboot.

[acab]

here you go .. just insert your own dumped metldr and you are good to go..
http://www.share-online.biz/dl/5QMNJE7MD2W

[nextbike]

Trying to fix a old ylod ps3.
Hopefully I can get in on this debug action soon.

[renanbianchi]

here you go .. just insert your own dumped metldr and you are good to go..
http://www.share-online.biz/dl/5QMNJE7MD2W

that img file is the linux image file? Sorry aif it's a stupid question, i'm really interested on going dex, but i don't know nothing about linux lol

Any tutorial you recommend?

Thanks!

[uber]

Just to confirm, once we go dex we completely lose BD movie playback?

Seems people are ignoring this if it is true, that's 1/2 of what I use my ps3 for!