123w ago - Just under a week ago we
reported on news of a successful PS3 downgrade from 3.55 to 3.41 Firmware, however, it ended up not being reproducible until a PS3 3.55 to 3.41 Firmware Downgrader arrived today courtesy of
solidpsycho through a guide from
AmazingLarry.
Download:
Lv2diag_355 /
PS3 3.55 Downgrade (3.41)
To quote: Here is a patched 3.41 that allows you to downgrade. I patched the info0 to 356, and I also used Warrens method to bypass the br drive during the update. I have tested this on both of my PS3's and haven't run into any problems.
3.55 Downgrade has been confirmed on both FAT and SLIM consoles.
Please note you CANNOT use these files if you bought a PS3 that came stock with FW 3.50. DO NOT DO IT. STOP NOW.
THE SAME WARNINGS AND RULES APPLY:
You may want to download
geo's 3.55-jb and install that and blackb0x ftp if you have not, it will be very useful for the next bit.
Blackb0x FTP server 1.2:
Blackb0xFTP for 3.55 FW
If you have a fat PS3 with 256MB NAND you will need to back up your dev_flash folders, as you WILL LOSE
BLURAY PLAYBACK. (on my FAT model i restored the DRL1 and DRL2 files in del_flash(2?) I did get to however keep all of my signed 3.55-jb homebrew, and it all works in retail mode except of course backup managers)
If you have a Small NAND SLIM or FAT console it would be a good idea to do one or both of the following:
In the XMB perform a system backup to save installed Homebrew you may have and gamesaves etc.. to an external device (i did this with my slim and it worked perfectly, all my installed signed homebrew from 3.55-jb works in retail 3.41 now)
-or-
make a COMPLETE backup of your HDD on your ps3 using ftp, although i dont think installed packages can be moved back over simply by ftp. i only tested the first method.
And now to downgrade:
You will need a downgrader dongle, search the forums for a DIY or buy one, or get an android/iphone, or an ipod nano, etc...
1) Unplug or switch off your console and then switch back on or plug back in.
2) While still OFF connect your Jailbreak/Downgrade device and press POWER then quickly Eject, you PS3 console should turn itself off automatically
3) OPTIONAL - Turn your PS3 on to verify you are in Service Mode (you will see a big red box, you can't miss it) then turn your PS3 back OFF
4) Place the lv2diag.self (FILE 1) from the archive and the PS3UPDAT.PUP (3.41 FW) from the archive on the root of a usb device and plug into the rightmost port on your console (dev_usb0)
5) Power on your PS3 with the usb device in and have a coffee, it can take a few moments for the PUP to install, your PS3 will turn off automatically
NOTE: if your system seems unresponsive and the light just stays green for ten minutes or more you need to use a different usb stick. i've had sporadic results with several different sticks.
6) Power your ps3 back on, you should still be in service mode, check your FW version now to verify you have downgraded successfully. Turn Off
7) Remove previous archive files from usb stick and now place lv2diag.self (FILE 2) on the root of your usb stick
8) Place usb stick in rightmost port of your PS3 (dev_usb0)
9) Turn PS3 back on with usb in place, it should turn itself off very shortly after.
10) Turn your PS3 back on and go through the configuration again.
MD5's
5C3B09C7FB0655D3F8852D3AAD778025 PS3UPDAT.PUP (3.41 FW)
099F33A7967F99E91C07E870FD78B3DB Lv2diag.self (FILE 1)
7A20BFDAE65EEFB47A4425DB1B52DCDE Lv2diag.self (FILE 2)
All done!
Thanks mathieulh, solidpsycho, and everyone else.
Below is a video from PSGroove (linked above) and from
Quakes69:
Log: Notice "os version = 03.4100" 8 lines from the bottom.
manufacturing updating start
PackageName = /dev_usb000/PS3UPDAT.PUP
settle polling interval success
vflash is disabled...
boot from nand flash...
creating flash regions...
create storage region: (region id = 2)
format partition: (region_id = 2, CELL_FS_IOS:BUILTIN_FLSH1, CELL_FS_FAT)
create storage region: (region id = 3)
format partition: (region_id = 3, CELL_FS_IOS:BUILTIN_FLSH2, CELL_FS_FAT)
create storage region: (region id = 4)
format partition: (region_id = 4, CELL_FS_IOS:BUILTIN_FLSH3, CELL_FS_FAT)
create storage region: (region id = 5)
create storage region: (region id = 6)
Initializing
taking a while...
start Updating Proccess
Initialize elapsed time = 177 msec
check UPL
Check UPL elapsed time = 97 msec
check Package Size
get package size elapsed time = 9 msec
start Updating Package
Update packages num = 28
Update packages total size = 160291533
Update Package Revoke list
read package revoke list package (576 bytes) elapsed = 66 msec
update package revoke list elapsed = 112 msec
Update Package Revoke list done(0x8002f000)
Update Core OS Package
read core os package (5182208 bytes) elapsed = 678 msec
update core os package elapsed = 1837 msec
Update Core OS Package done(0x8002f000)
Update VSH Package
sys_memory_container_create() success(id = 0xc0effffe)
Update VSH's package : 1/22
read vsh package (1841 bytes) elapsed = 18 msec
decrypt and verify vsh package elapsed = 27 msec
write vsh package elapsed = 7968 msec
compare vsh package elapsed = 0 msec
Update VSH's package : 2/22
read vsh package (4779240 bytes) elapsed = 616 msec
decrypt and verify vsh package elapsed = 305 msec
write vsh package elapsed = 2757 msec
compare vsh package elapsed = 489 msec
Update VSH's package : 3/22
read vsh package (1927089 bytes) elapsed = 258 msec
decrypt and verify vsh package elapsed = 129 msec
write vsh package elapsed = 680 msec
compare vsh package elapsed = 182 msec
Update VSH's package : 4/22
read vsh package (5498561 bytes) elapsed = 710 msec
decrypt and verify vsh package elapsed = 344 msec
write vsh package elapsed = 3384 msec
compare vsh package elapsed = 558 msec
Update VSH's package : 5/22
read vsh package (2010269 bytes) elapsed = 275 msec
decrypt and verify vsh package elapsed = 138 msec
write vsh package elapsed = 1028 msec
compare vsh package elapsed = 207 msec
Update VSH's package : 6/22
read vsh package (25301 bytes) elapsed = 25 msec
decrypt and verify vsh package elapsed = 29 msec
write vsh package elapsed = 1454 msec
compare vsh package elapsed = 10 msec
Update VSH's package : 7/22
read vsh package (7663270 bytes) elapsed = 988 msec
decrypt and verify vsh package elapsed = 393 msec
write vsh package elapsed = 15190 msec
compare vsh package elapsed = 587 msec
Update VSH's package : 8/22
read vsh package (10258879 bytes) elapsed = 1335 msec
decrypt and verify vsh package elapsed = 287 msec
write vsh package elapsed = 16220 msec
compare vsh package elapsed = 642 msec
Update VSH's package : 9/22
read vsh package (8773195 bytes) elapsed = 1138 msec
decrypt and verify vsh package elapsed = 244 msec
write vsh package elapsed = 7000 msec
compare vsh package elapsed = 512 msec
Update VSH's package : 10/22
read vsh package (8827678 bytes) elapsed = 1145 msec
decrypt and verify vsh package elapsed = 324 msec
write vsh package elapsed = 11278 msec
compare vsh package elapsed = 619 msec
Update VSH's package : 11/22
read vsh package (6182668 bytes) elapsed = 825 msec
decrypt and verify vsh package elapsed = 209 msec
write vsh package elapsed = 2076 msec
compare vsh package elapsed = 441 msec
Update VSH's package : 12/22
read vsh package (10251215 bytes) elapsed = 1331 msec
decrypt and verify vsh package elapsed = 259 msec
write vsh package elapsed = 3966 msec
compare vsh package elapsed = 584 msec
Update VSH's package : 13/22
read vsh package (10187344 bytes) elapsed = 1327 msec
decrypt and verify vsh package elapsed = 264 msec
write vsh package elapsed = 6108 msec
compare vsh package elapsed = 591 msec
Update VSH's package : 14/22
read vsh package (10381187 bytes) elapsed = 1354 msec
decrypt and verify vsh package elapsed = 265 msec
write vsh package elapsed = 5917 msec
compare vsh package elapsed = 604 msec
Update VSH's package : 15/22
read vsh package (9899962 bytes) elapsed = 1324 msec
decrypt and verify vsh package elapsed = 265 msec
write vsh package elapsed = 7215 msec
compare vsh package elapsed = 585 msec
Update VSH's package : 16/22
read vsh package (8210627 bytes) elapsed = 1086 msec
decrypt and verify vsh package elapsed = 206 msec
write vsh package elapsed = 5136 msec
compare vsh package elapsed = 485 msec
Update VSH's package : 17/22
read vsh package (10382360 bytes) elapsed = 1363 msec
decrypt and verify vsh package elapsed = 269 msec
write vsh package elapsed = 6811 msec
compare vsh package elapsed = 682 msec
Update VSH's package : 18/22
read vsh package (9649989 bytes) elapsed = 1288 msec
decrypt and verify vsh package elapsed = 372 msec
write vsh package elapsed = 35307 msec
compare vsh package elapsed = 1052 msec
Update VSH's package : 19/22
read vsh package (7751745 bytes) elapsed = 1040 msec
decrypt and verify vsh package elapsed = 354 msec
write vsh package elapsed = 26124 msec
compare vsh package elapsed = 931 msec
Update VSH's package : 20/22
read vsh package (8165430 bytes) elapsed = 1091 msec
decrypt and verify vsh package elapsed = 371 msec
write vsh package elapsed = 12873 msec
compare vsh package elapsed = 864 msec
Update VSH's package : 21/22
read vsh package (8287111 bytes) elapsed = 1111 msec
decrypt and verify vsh package elapsed = 353 msec
write vsh package elapsed = 21142 msec
compare vsh package elapsed = 937 msec
Update VSH's package : 22/22
read vsh package (5315230 bytes) elapsed = 749 msec
decrypt and verify vsh package elapsed = 227 msec
write vsh package elapsed = 1840 msec
compare vsh package elapsed = 456 msec
Update VSH Package done(0x8002f000)
Bul-ray Disc Player Revoke
Bul-ray Disc Player Revoke done(0x8002f000)
Update Program Revoke list
read program revoke list package (736 bytes) elapsed = 67 msec
update program revoke list elapsed = 323 msec
Update Program Revoke list done(0x8002f000)
move_2block_status_into_the_region(): region id = 3
rewrite_region() region id = 0x3, start_lba = 0x0, end_lba = 0x4000
rewrite region done (ret = 0x8002f000)
rewrite region elapsed time = 1198 msec
touch_1st_sector_in_block() region id = 0x3, start_lba = 0x0, end_lba = 0x4000
touch_1st_sector() done (ret = 0x8002f000)
touch_1st_sector() elapsed time = 1320 msec
rewrite_region() region id = 0x3, start_lba = 0x0, end_lba = 0x4000
rewrite region done (ret = 0x8002f000)
rewrite region elapsed time = 1200 msec
Update BD firmware
Update BD firmware done(0x8002f000)
Update Multi-Card controller firmware
read MCC package (28636 bytes) elapsed = 69 msec
update MCC elapsed = 5027 msec
Update Multi-Card controller firmware done(0x8002f000)
Update BlueTooth firmware
read BT package (644322 bytes) elapsed = 104 msec
update BT elapsed = 60 msec
Update BlueTooth firmware done(0x8002f000)
Update System controller firmware
read SC patch package (4864 bytes) elapsed = 79 msec
read SC patch package (4864 bytes) elapsed = 67 msec
Update System controller firmware done(0x8002f000)
update package elapsed time = 255949 msec
post processiong...
post processiong done
cleanup update status (ret = 0)
os version = 03.4100
build_version = 45039,20100721
region of core os package = 0x40000000
build_target = CEX-ww
build target id = 0x83
manufacturing updating SUCCESS(0x8002f000)
set product mode (ret = 0)
Total Elapsed time = 258865 msec
Finally, from
rms: http://rms.dukio.com/?p=19
The downgrade process
Ok, so today's topic is on how the service mode updater works, and why it does what it does, and what the updater logs on /dev_usb000 mean.
manufacturing updating start
PackageName = /dev_usb000/PS3UPDAT.PUP
settle polling interval success
This means that the manufacturing_updater_for_reset.self file was started successfully, and it found a PS3 update file on the drive, and it set the polling interval so the SELF can retrieve the file using some poll() like function. Now, here's where updaters diverge. Older PS3s use NAND and newer PS3s use NOR and vFlash. vFlash is where the flash device is actually the hard disk. If vflash is enabled, you get this in the updater log:
vflash is enabled...
creating system regions...
create storage region: (region id = 1)
create storage region: (region id = 2)
format partition: (region_id = 2, CELL_FS_UTILITY:HDD0, CELL_FS_UFS)
create storage region: (region id = 3)
format partition: (region_id = 3, CELL_FS_UTILITY:HDD1, CELL_FS_FAT)
creating system regions done.
What this means, is that its creating 3 regions, 1 FAT16, that's where the dev_flash directory is, and one UFS partition, along with another raw. If you're using NAND, you'll see:
vflash is disabled...
boot from nand flash...
creating flash regions...
create storage region: (region id = 2)
format partition: (region_id = 2, CELL_FS_IOS:BUILTIN_FLSH1, CELL_FS_FAT)
create storage region: (region id = 3)
format partition: (region_id = 3, CELL_FS_IOS:BUILTIN_FLSH2, CELL_FS_FAT)
create storage region: (region id = 4)
format partition: (region_id = 4, CELL_FS_IOS:BUILTIN_FLSH3, CELL_FS_FAT)
create storage region: (region id = 5)
create storage region: (region id = 6)
What's happening here is that it's formatting /dev_flash, dev_flash2, and dev_flash3 as FAT16, and flagging the other 2 regions as ROS, both backup and current Core OS. If one uses NOR, they will see:
boot from nor flash...
creating nor flash regions...
create storage region: (region id = 2)
create storage region: (region id = 3)
creating flash regions...
create storage region: (region id = 1)
create storage region: (region id = 2)
format partition: (region_id = 2, CELL_FS_IOS:BUILTIN_FLSH1, CELL_FS_FAT)
create storage region: (region id = 3)
format partition: (region_id = 3, CELL_FS_IOS:BUILTIN_FLSH2, CELL_FS_FAT)
create storage region: (region id = 4)
format partition: (region_id = 4, CELL_FS_IOS:BUILTIN_FLSH3, CELL_FS_FAT)
create storage region: (region id = 5)
create storage region: (region id = 6)
What's happening is here that the regions on the hard disk are abstracted to the fake devices dev_flash2/3 and dev_flash, along with the 2 ROS regions. Remember, the header stays static, but the 7,340,000 byte part is replaced. ROS is never formatted. Then UPL.xml.pkg is read and then the updater enumerated which packages to install. It first starts with Package revoke, which is stored as trvk_pkg0/1 in NOR/NAND, then it updates Core OS, followed by VSH and all of the tarballs it has. Then, the updater updates the Bluray drive Revoke list which it calls "Bul-ray". Here's another place where the 2 PS3 types diverge:
read bdp revoke package (1904 bytes) elapsed = 27 msec
decrypt and verify bdp revoke package elapsed = 49 msec
write bdp revoke package elapsed = 135 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare bdprevoke package elapsed = 101 msec
Here, we can see that the BD revoke list is also updated, but on NAND, since the dev_flash3 files were wiped, we have the out of sync situation. Then the program revoke list is flashed as trvk_prg0/1. On NOR consoles, the BD drive firmware is also flashed:
Update BD firmware
read BD firmware package (1966992 bytes) elapsed = 224 msec
update BD firmware elapsed = 293 msec
read BD firmware package (951040 bytes) elapsed = 123 msec
update BD firmware elapsed = 251 msec
read BD firmware package (951040 bytes) elapsed = 127 msec
update BD firmware elapsed = 250 msec
read BD firmware package (951040 bytes) elapsed = 126 msec
update BD firmware elapsed = 256 msec
read BD firmware package (1639296 bytes) elapsed = 199 msec
update BD firmware elapsed = 263 msec
read BD firmware package (787200 bytes) elapsed = 111 msec
update BD firmware elapsed = 250 msec
Update BD firmware done(0x8002f000)
After this BD firmware is also updated. Following that, MultiCard firmware is flashed, followed by Bluetooth firmware, then we see that the SYSCON is patched with the 4864 byte firmware update. Then, the updater does some postprocessing on the system to finalize firmware installation, then verifies the firmware. We then see the output of the log, the final installed system information, along with updater time:
cleanup update status (ret = 0)
os version = 03.1500
build_version = 38031,20091206
region of core os package = 0x40000000
build_target = CEX-ww
build target id = 0x83
manufacturing updating SUCCESS(0x8002f000)
set product mode (ret = 0)
Total Elapsed time = 163245 msec
any fix for fuse 3.55?interested to see what the games like.thanks!...
mine is cech2054b will it work to downgrade? or cause brick?
I would like to spoof it at 3.55 so I can play GT5 without going through the network update to 3.55. And I'm not interested in PSN
Thanks