Rogero PS3 MFW Fixes Trophies Problem After a 3.70 Downgrade

Category: PS3 CFW & MFW By: PS3 News - (tortuga-cove.com)
Tags: rogero ps3 mfw ps3 mfw fixes ps3 trophies fix ps3 trophies problem ps3 3.70 downgrade

89w ago - Today PlayStation 3 developer Rogero has made available a PS3 MFW (Modified Firmware) that fixes the Trophies problem after a 3.70 to 3.55 PS3 console downgrade followed by V2 below.

Download: Rogero MFW355 370 Spoof Internet Blocked LV1 Checks Patched PUP / Rogero MFW V2 (BD Patch) PUP / WinSkeet40000

To quote: Last night I had the chance to try and downgrade a Slim Ps3 (JSD-001 board with Spansion NOR) version 3.70 to CFW 3.55 using Dospiedra's downgrade v2 patches.

I managed to get a clean dump of the NOR using my ProgSkeet (latest QT port used), created a patched Downgrade.bin image using the 6 patched files from Dospiedra and a hex editor, then I flashed the image to the PS3 NOR, dumped the NOR another time and verified that all was written fine.

Then I continued with the normal downgrade procedure, go into service mode, update using the 3.55_no_check.PUP, then exit service mode and all was good, it was back into CFW 3.55.

Here the problems started, I tried to start a game and I got the famous Trophy error, so I decided to update it to my personal Modified Firmware, so I started the update and after installing the firmware, the PS3 turned off by itself, I tried to turn it on again, It turned on for almost 2 or 3 seconds then turned off completely (No Screen Output, No Red Led either) so I knew-ed at this point that the PS3 was Bricked

N.B: this was never mentioned in any of the downgrade tutorials floating on the net, although this is a very important point to warn the users who are downgrading their Ps3 machines not to update using usual Modified firmwares unless the firmware have the LV1.self file patched to Disable all checks, anything else will result into a Bricked PS3, and this is not good at all especially if the Hardware flasher used to downgrade was removed from the Ps3's NOR or Nand Flash.

After doing some research and discussing the issue with my friend eussNL <-- a wiki by himself

I realized what happened to the Ps3, after the downgrade procedure, the machine's syscon still had a version > 3.55 (3.56 or higher) and this needs a Patched LV1.self (checks disabled) in the NOR for the PS3 to be able to boot fine, and when I updated it to my own MFW, the LV1.self file in the NOR was replaced with a non-patched version (checks enabled) and the PS3 detected the higher syscon version (3.56+) and Bricked.

To Fix it, I had to re-flash the NOR again with the patched Downgrade.bin image (to get rid of the un-patched LV1.self) then the Ps3 was fixed and booting fine again.

N.B: in case you're using ProgSkeet, make sure you are using the Latest released flasher (QT port) as of 11 Sep 2011 from this link: WinSkeet40000.zip

This one have Preset parameter values for each NOR type, I used it on Win7 and it flashed my Spansion NOR just fine.

At this point, the Ps3 was working again, but the Trophy problem was always there, so I prepared another Modified firmware with 3.70 spoof, Privacy Patch and this time the LV1.self Checks Disabled (the patches were provided by eussNL too so Credits here goes to him), then while still having Progskeet soldered to the NOR flash, I updated the Ps3 with the new MFW, everything
went fine, and it rebooted fine into the XMB, did some tests and the Trophy problem was gone for good and all games working fine.

For all the users who had successfully downgraded their PS3 machines to 3.55 again, I share with you my MFW with Lv1 Checks patched to bypass the 3.56+ syscon version and prevent any brick after updating to it, and to get rid of the annoying Trophy problem encountered after the usual downgrade procedure.

These are the 25 Patches applied to LV1.self contained in my MFW:

# Description: Patch LV1 checks

# Option --patch-lv1checks: Disables many checks in lv1

# Type --patch-lv1checks: boolean

namespace eval :: patch_lv1checks {

array set :: patch_lv1checks:: options {
--patch-lv1checks true
}

proc main { } {
set self "lv1.self"

::modify_coreos_file $self :: patch_lv1checks:: patch_self
}

proc patch_self {self} {
if {!$:: patch_lv1checks:: options(--patch-lv1checks)} {
log "WARNING: Enabled task has no enabled option" 1
} else {
::modify_self_file $self :: patch_lv1checks:: patch_elf
}
}

proc patch_elf {elf} {
if {$:: patch_lv1checks:: options(--patch-lv1checks)} {
log "Patching LV1 Checks"

# ss_server1
# Patch core OS Hash check // product mode always on
log "--------------- Patching ss_server1.fself ----------------------------"
log "Patch core OS Hash check // product mode always on"

set search "\x41\x9E\x00\x1C\x7F\x63\xDB\x78\xE8\xA2\x85\x68\ x38\x80\x00\x01"
set replace "\x60\x00\x00\x00\x7F\x63\xDB\x78\xE8\xA2\x85\x68\ x38\x80\x00\x01"

catch_die {:: patch_elf $elf $search 0 $replace} "Unable to patch self [file tail $elf]"

# Patch check_revoke_list_hash check // product mode always on
log "Patch check_revoke_list_hash check // product mode always on"

set search "\x41\x9E\x00\x1C\x7F\xA3\xEB\x78\xE8\xA2\x85\x68\ x38\x80\x00\x01"
set replace "\x60\x00\x00\x00\x7F\xA3\xEB\x78\xE8\xA2\x85\x68\ x38\x80\x00\x01"

catch_die {:: patch_elf $elf $search 0 $replace} "Unable to patch self [file tail $elf]"

# In product mode erase standby bank skipped
log "Patch In product mode erase standby bank skipped"

set search "\x41\x9E\x00\x0C\xE8\xA2\x8A\x38\x48\x00\x00\xCC\ x7B\xFD\x00\x20"
set replace "\x60\x00\x00\x00\xE8\xA2\x8A\x38\x48\x00\x00\xCC\ x7B\xFD\x00\x20"

catch_die {:: patch_elf $elf $search 0 $replace} "Unable to patch self [file tail $elf]"

# Patching System Manager to disable integrity check
log "Patching System Manager to disable integrity check"

set search "\x38\x60\x00\x01\xf8\x01\x00\x90\x88\x1f\x00\x00\ x2f\x80\x00\x00"
set replace "\x38\x60\x00\x00"

catch_die {:: patch_elf $elf $search 0 $replace} "Unable to patch self [file tail $elf]"

# Patching LV1 to enable skipping of ACL checks for all storage devices
log "Patching LV1 to enable skipping of ACL checks for all storage devices"

set search "\x54\x63\x06\x3e\x2f\x83\x00\x00\x41\x9e\x00\x14\ xe8\x01\x00\x70\x54\x00\x07\xfe"
append search "\x2f\x80\x00\x00\x40\x9e\x00\x18"
set replace "\x38\x60\x00\x01\x2f\x83\x00\x00\x41\x9e\x00\x14\ x38\x00\x00\x01"

catch_die {:: patch_elf $elf $search 0 $replace} "Unable to patch self [file tail $elf]"

# LV1 0021D0B4@355 patch (?Patch sys_mgr integrity lv1 and lv0 integrity check?)
log "?Patch sys_mgr integrity lv1 and lv0 integrity check?"

set search "\x48\x00\xD7\x15\x2F\x83\x00\x00\x38\x60\x00\ x01"
set replace "\x38\x60\x00\x00\x2F\x83\x00\x00\x38\x60\x00\ x01"

catch_die {:: patch_elf $elf $search 0 $replace} "Unable to patch self [file tail $elf]"

}
}
}

Finally, Rogero followed up with Rogero MFW V2 BD Patch PUP with the details as follows, to quote:

This is a better optimized version of the previous MFW released, This one is a Custom firmware built manually by patching and packing the files and the final PUP package using the well known "fail0verfl0w " public set of tools and having "Kmeaw" as the base firmware unlike it's previous version which was a Modified firmware built using the famous MFW builder application and using an OFW3.55 as the base firmware.

Usage / Compatibility:

Can be used for Downgrade directly as a replacement of the no_check.PUP to avoid the "Trophies error".
Can be used for normal system update like any other CFW/MFW from XMB or from Recovery Menu.

Internal Structure:

Kmeaw patched Lv2 with necessary patches to allow Peek/Poke support (same games compatibility as Kmeaw CFW)
Dospiedra's LV1 patches necessary to bypass the Syscon checks for downgraded consoles. (same as no_check.PUP)
Built-in system version spoof to 3.70 to prevent accidental system updates (won't allow going online in any way)
Privacy Patch was not applied like previous version to allow Game updates (can be added easily using MFW builder)
Custom Boot Logo.
Built-in "Heavy Rain" dynamic theme.

History: After several days and more testing of the first MFW released for downgrading from 3.70-->3.55, I had some users feedback from #progskeet-support that some PS3 machines are having either the Registry Corrupted/Blue Screen or just a Black Screen after downgrade that required re-installing the MFW from Recovery Menu or reflashing the NOR in some cases.

Further research about the donwgrade V2 patches and the no_check.PUP with some more testing showed that a Kmeaw based LV2 seems to have better compatibility with the Downgrade patches applied to the NOR image then a MFW built with a patched LV2, so I decided to build a new version manually which is a custom firmware that combines Kmeaw LV2 patches with Dospiedras Lv1 no-check patches and having the minimal/necessary set of patches to preserve the best overall stability.

Thanks to the all the beta testers especially Blakcat & Marlbor1

N.B: please note that Rogero Manager v8.5 (to be released soon) or newer are only compatible with this CFW V2, because the CFW have the built in version spoofed to 3.70 and older versions of the Manager (8.4 and lower) can't recognize it and won't be able to load the necessary payload.

Cheers

Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!