Guys if i understand this right then we can install any 4.xx CFW on OFW above 3.55.We need to patch this files... can someone help me with that?
Check it out! > pastie.org/private/3np6uj6md1occbctdeir6a
Since the LV0 keys have now been leaked, I believe I can now share this info with you, to help out those who are trying to build their own 4.x CFW :
The NPDRM ECDSA signature in the SELF footer is checked by lv2. It first asks appldr to tell it whether or not the signature is to be checked, and appldr will only set the flag if the SELF is a NPDRM with key revision from 3.56+ (the ones without private keys). This means that the SELF files signed with the new 3.56+ keys still don't have their ecdsa checked (probably to speed up file loading).
If appldr says the ecdsa signature must be checked, then lv2 will verify it itself, and return an error if it's not correct. There are many ways to patch this check out.
1 - Patch out the check for the key revision in appldr
2 - Patch out the "set flag to 1" in appldr if the key revision is < 0xB
3 - Patch out the code in lv2 that stores the result from appldr
4 - Patch out the actual sigcheck function from lv2.
5 - Ignore the result of the ecdsa from lv2.
Here is one of the patches (the 4th one, patching out the check function from lv2) :
In memory 0x800000000005A2A8, which corresponds to offset 0x6a2a8 in lv2_kernel.elf, replace :
e9 22 99 90 7c 08 02 a6
38 60 00 00 4e 80 00 20
This is for the 4.21 kernel (that was the latest one when I investigated this), I will leave it as an exercise to the reader to find the right offsets for the 4.25 and upcoming 4.30 kernel files.
And here's another bit of info... in 4.21 lv2, at memory address 0x800000000005AA98 (you figure out the file offset yourself), that's where lv2 loads the 'check_signature_flag' result from appldr, so if you prefer implementing method 3 above, just replace the 'ld %r0, flag_result_from_appldr' by 'ld %r0, 0' and you got another method of patching it out. Either solutions should work just the same though.
Enjoy homebrew back on 4.x CFW....
p.s: Thanks to flatz and glu0n who helped reversed this bit of info.
This is only for a relatively small section of console models, the ones that don't have metldr2 but came from factory with 3.56+ and were hardware locked to downgrades: ps3devwiki.com/wiki/SKU_Models
This hack will apply to all the 25xx models, including the latest ones. It will not apply to the 3k models.
Also, in their page it's explained that it can NOT be used to downgrade. On these consoles you are stuck at the firmware you have, but the hack will allow you to update into a CFW as long as the CFW is of higher or equal version as the one you are using (according to them, anyway).
So you cannot go to 3.55 by any means, but if you are on 4.30 or lower you can install a CFW ( They specifically mention the E3 CFW, no idea if others).
So again, this DOES NOT apply to all current PS3 consoles, but it does broaden the amount of consoles that can now be hacked into CFW by adding all the CECH-25xx models.
What? Where did you get that? iPhones just can't replace flashers.
Originally Posted by pollicin123
Sadly, no, but the way the scene is moving is quite amazing, so perhaps you will get lucky soon. I said that this was impossible a few days ago, glad the "Three Musketeers" proved me wrong.
There are several downgrading tutorials, so I'd say you should try to look for those. There is lot's of info you should know before getting a flasher, so if you're either unwilling or uncapable of doing some of the search yourself, sadly, they aren't for you then, as flashers aren't fool-proof or newbie friendly. Anyway, once you know the basics, feel free to post on the support section and I will gladly help you.