128w ago -
Update: According to several members (including
jensen76,
evilsperm, and
sk group) when you downgrade a PS3 with the Modified 3.41 PUP (below), it currently cripples the Blu-ray player functionality. Some additional PS3 Blu-ray fix updates are outlined
HERE, however, a more stable solution is still being worked on.
To quote from
garyopa on one work-around: "I was able to restore one machine I had, by copying over all the files I had in the /dev_flash2 and /dev_flash3 back to the HDD, that I had saved before when it was on v3.41"
Forum member
p666 also has expanded on the PS3 Blu-ray fix a bit
HERE for those who need it, and
atlask2 let us know of yet another Blu-ray drive solution
HERE by
Maes along with another
PS3 Blu-ray Drive WIP Fix.
Although PSGrade won't currently work on the patched and recently released
PS3 Firmware v3.55 update, yesterday the
PSGrade free PS3 Downgrading hex codes and Master Key arrived along with PlayStation 3 downgrade hex codes for various PS3 JailBreak USB modchip devices alongside a
PS3 Demo / Kiosk to Retail Console Guide by
starcube.
Downloads:
PSGrade PS3 Downgrading Hex Codes /
DGF.rar (Includes
Modified 3.41 PUP,
Lv2diag.self FILE 1 and
Lv2diag.self FILE 2) /
PSGrade Source Code /
GIT
This will be our ongoing thread covering them as they are released- complete with the related files and guides for each below, and to recap:
From
Mathieulh: Dongle master key: 0x46, 0xDC, 0xEA, 0xD3, 0x17, 0xFE, 0x45, 0xD8, 0x09,0x23,0xEB, 0x97, 0xE4, 0x95, 0x64, 0x10, 0xD4, 0xCD, 0xB2, 0xC2 Real one this time, sorry for the mix up, thanks
graf.
By the way in case people missed it, this is the dongle master key (not the 0xAAAA device key): 0x04 0x4E 0x61 0x1B 0xA6 0xA6 0xE3 0x9A 0x98 0xCF 0x35 0x81 0x2C 0x80 0x68 0xC7 0xFC 0x5F 0x7A 0xE8. It works up to version 3.55 included. You can generate keys for any dongles' device id with it if people care.
The people having bluray movies playback issues after downgrading, this happens because you updated to a modified PUP (psjb one) which has its /dev_flash3/ tarball swapped (probably to a debug one, debug consoles do not sport bd movies playback) with other CRL/DRL revocation files.
0x24000 - USB Dongle Authenticator
0x24001 - Generate Challenge
0x24002 - Verify Response
0x24001 - Generate Challenge
- I have got access to this service through DM and tested it
- The service expects no input parameters except those in SS packet header
- It uses 0x5003 service (Generate Random Number) to generate random numbers that are used in challenge body
- The length of a challnge body is always 23 bytes, first 3 bytes are always the same: 0x2E 0x02 0x01
Here are hexdumps of some challenge bodies i let 0x24001 service generate:
2E 02 01 72 3A 0A 76 BB 81 CB 29 BC E7 B5 D6 62 7C 0E EE 23 18 A9 1D
2E 02 01 F0 DA 78 D4 1D CB D7 C9 C7 F0 32 F4 2E 92 39 BD 3F 32 93 AA
2E 02 01 3B B2 9D FD A8 83 AF 9A C0 E9 13 BB AE D5 6C 8C 45 2E DE 13
0x24002 - Verify Response
- I have got access to this service and tested it with PSGroove
- The response body is 25 bytes large
- The first 3 bytes have to be 0x2E 0x02 0x02 or else the check fails
- The 16 bit at offset 3 is a dongle ID
- The dongle ID is checked if it's revoked or not
- When the verification succeedes then product mode is set to 1
- The service calculates USB Dongle Key from USB Dongle ID and USB Dongle Master Key by using HMAC SHA-1
- The service uses HMAC SHA-1 to calculate the correct response body from the challenge body and USB Dongle Key
- After that the service compares the calculated response body with the given one that was sent to the service
- It seems that laid and paid from SS packet header are used in decryption process
USB Dongle Master Key
- USB Dongle Master Key is stored encrypted in Process 6
- The encrypted key is 64 bytes large
- The decrypted key is 20 bytes large
- The USB Dongle Master Key is decrypted first time the service 0x24002 is used
- The USB Dongle Master Key is decrypted by using the service 0x200E (Decrypt Master) of Vitual TRM Manager
- The decrypted USB Dongle Master Key is stored in Process 6 in clear text (after first usage of this service)
- When decryption of USB Dongle Master Key fails then a dummy key is used
- Unfortunately, in the HV dump 3.15 the USB Dongle Master Key was not decrypted at the moment of dumping
- The first 12 bytes of decrypted USB Dongle Master Key is a magic value: _USB_DONGLE_. After these 12 bytes follows the real USB Dongle Master Key of size 20 bytes. So, if after decryption of USB Dongle Master Key, you see this magic value then the decryption was successful.
Here is the encrypted USB Dongle Master Key from HV 3.15:
0x22 0xD5 0xD1 0x8C 0xFF 0xE2 0x4F 0xAC 0xEC 0x72 0xA2 0x42 0xA7 0x18 0x98 0x10
0x25 0x33 0xE0 0x96 0xF2 0xC1 0x91 0x0D 0x15 0x23 0xD3 0x07 0x74 0xE7 0x2B 0x72
0xDF 0xA6 0xDD 0xE9 0x68 0x8B 0x76 0x2A 0x6A 0x87 0x51 0x7F 0x85 0x39 0x0B 0xD4
0x20 0x3F 0x46 0x89 0x04 0x82 0xB7 0x30 0x84 0x89 0x4B 0xCC 0x9D 0xB1 0x24 0x7C
This is the
decrypted dongle master key which works up to 3.55:
0x04 0x4E 0x61 0x1B 0xA6 0xA6 0xE3 0x9A 0x98 0xCF 0x35 0x81 0x2C 0x80 0x68 0xC7
0xFC 0x5F 0x7A 0xE8
Here is the USB Dongle Master Dummy Key from HV 3.15:
0xD1 0xFC 0x57 0x55 0xBF 0x20 0xFA 0xB2 0xD4 0xA5 0x4A 0x0A 0x0C 0x5D 0x52 0x8E
0xDF 0x66 0xCD 0x74
USB Dongle ID Revoke List
- Process 6 contains a revoke list for USB Dongle IDs
- The revoke list is 0x2000 bytes large. It's a bitmap.
- Each bit represents a USB Dongle ID. If bit is 0 then USB Dongle ID is revoked.
The following USB Dongle IDs are revoked in HV 3.15:
0, 2, 13, 32, 34, 176, 241
0x25000 - User Token Manager
Packet ID Description
0x25001 Encrypt User Token
0x25002 Decrypt User Token
User Token
- Before User Token Manager encrypts a received user token it checks it's format.
- User Tokens are processed by spu_utoken_processor.self
- Before User Token is processed, User Token Manager reads IDPS by sending SS requests to Indi Info Manager (packet ids 0x17001 and 0x17002). Indi Info Manager runs in HV Process 5.
User Token Format
stuct user_token_attr
{
uint32_t type; /* 0x00000001, value != 0x00000001 means attribute list ends here */
uint32_t size; /* 8 + sizeof(data) */
/* data follows here, size of data may be 0 */
}
struct user_token
{
uint32_t magic; /* 0x73757400 = "sut\0" */
uint32_t format_version; /* 0x00000001 */
uint64_t size;
uint8_t idps[16];
uint64_t expire_date;
uint64_t capability;
union
{
stuct user_token_attr attrs[0];
uint8_t dummy[3072];
} attrs;
/* 0xC30 */
uint8_t digest[20];
}
PS3 Master Key (obfuscated, xor-ed with 0x36 and swapped bytes 11 and 16) for Jig: 0x32, 0x78, 0x57, 0x2D, 0x90, 0x90, 0xD5, 0xAC, 0xAE, 0xF9, 0x03, 0xCA, 0x1A, 0xB6, 0x5E, 0xF1, 0xB7, 0x69, 0x4C, 0xDE
From
KaKaRoToKS:
PS3 Master Key for Jig: 0xAAAA dongle key: 0x04, 0x4E, 0x61, 0x1B, 0xA6, 0xA6, 0xE3, 0x9A, 0x98, 0xCF, 0x35, 0x81, 0x2C, 0x80, 0x68, 0xC7, 0xFC, 0x5F, 0x7A, 0xE8
From
PS3Yes.com:
We now confirm the Key for AAAA was: 04 4E 61 1B A6 A6 E3 9A 98 CF 35 81 2C 80 68 C7 FC 5F 7A E8
From
PS3Yes.com:
Part 1: How to update PS3YES-Pro's firmware
Step 1. Connect PS3YES-Pro to your PC's USB port
Step 2. About 6 seconds later , PS3YES-Pro's 8MB USB storage will be install on you PC.
Step 3. Right-click on the USB disk's root path, and create a new text file and renamed it to 'enterduf'.
Step 4. Eject the USB disk to PS3YES-Pro, remove it from PC and re-plug it to your PC's USB port.
(The following steps also used on PS3YES! and PS3YES-Pro too)
Step 5. About 30 seconds later, the LED on PS3YES-Pro will switch off, you should install the ATMEL DFU driver to run the FLIP tool. You can jump to Step 8 if it was istealled aleady.
Step 6. Install drivers to "AT90USB162" device, you should download and install FLIP tool from ATMEL (http://www.atmel.com/dyn/resources/prod_documents/JRE_Flip_Installer_3.4.2.exe).
Step 7. You can found drivers to "AT90USB162" in the path of FLIP was installed, for example : "C:\Program Files\Atmel\Flip 3.4.2\usb".
Step 8. Download the correct firmware's hex file. Make sure it was storage in a full English path and without space. for example "c:\".
Step 9. Run the FLIP tool. Make sure at the first use the "Load Hex File..." menu under "File" menu to load the new firmware hex file.
Step 10. Click the USB icon on FLIP and select "USB" , or press CTRL-U , and click "open" button in the following dialoag.
Step 11. Click "Run" button start update PS3YES-Pro's firmware. it will display like this : if done.
(The fimware was updated now, the following step just fit to PS3YES-Pro, for stop enter DFU mode next time.)
Step 12. Remove PS3YES-Pro from PC and plugin it again.
Step 13. Delete the file "enterdfu" from the USB disks's root path in 30 seconds.
Part 2: How to use PS3YES-Pro downgrade the console's firmware from 3.50
Prepare: Download the downgrade files (http://www.sendspace.com/file/qlfoyi), an USB disk large to storage the upgrade files.
Step 1: Please update your PS3YES-Pro with downgrade firware as Part 1.
Step 2: Plug the "downgrade" PS3YES-Pro to the right port (close the Blue-Ray Driver), Power down the connsole and cut of the power. Re-connect power to the console, Press power on button, press the "EJECT" button in 200ms atfter power on button was pressed. Untill finished your downgrade, you don't need cut off the power angin.
Step 3: The screen to the console will flash servral time and auto-turn-off, you can remove the PS3YES-Pro now (You console now ready to enter "Factory Mode" now)
Step 4: Prepare an USB disk and formate it as FAT32 file system, copy two files to the USB disk: Lv2diag.self and PS3UPDAT.PUP, and place them under the root path. the the named "Lv2diag.self" should copy from the "Lv2diag.self FILE 1" folder.
Step 5: Plug the USB disk to the right USB port to the console, and remove any other USB disk from your console, press power on button to boot.
Step 6: Wait untill the console turn off again. Remove the USB disk from your console, and delete all the files, copy the "Lv2diag.self" from "Lv2diag.self FILE 2" folder to the USB disk's root path.
Step 7: Plug the USB disk to the right USB port to the console, and press power on button, It will leave "Factory Mode" now.
Last Step: After finished downgrade the console , you can update PS3YES-Pro back
From
PS3Key.com:
If you need to downgrade a PS3 with firmware version 3.50 or below you can now grab the PS3KEY JIG firmware from the downloads section! Please note that we do not host the modified PUP file or any other file that may contain copyrighted code.
From
PS3USBJailBreak.com:
Downgrader for ps3usbjailbreak has released. Please download progtramming tools 1.2.8 to reflash. Tutorial:
1. Insert PS3USBJailbreak to PC
2. Run 1.2.8 updater
3. Click START.
4. Insert PS3USBJailbreak device that has been reprogrammed as downgrader into your console
5. Turn on the console using the same boot method as all other jailbreaks: Press power then immediately press eject. Your console will turn on.
6. Turn off system via menu
7. Remove PS3USBJailbreak dongle and turn on console to make sure you are in Factory Service Mode. You will see a huge red box on the screen saying Factory Service Mode.
8. Load any blank FAT32 USB flash drive device with 2 files in the root directory:
a. Modified 3.41 PUP
b. Lv2Diag.self (File 1)
9. These must be the only files on the USB key and must be placed in the main (root) directory.
10. Insert flash drive into the last USB port to the right -- the first USB port in from the right side if you're facing the console. Turn the PS3 on and you will see black screen but the PS3 HDD light will flash.
11. The process takes 3-4 minutes for the system to install the old firmware. Towards the end, the power button on the console will start flashing green and then your console will power off.
12. Remove the flash drive and turn on the console, you will still be in Factory Service Mode. Please verify you have downgraded successfully to version 3.41 by going to "System Information".
13. (Optional) - If you wish to downgrade to any older firmware you can follow step 4, 5, 6 using any regular firmware PUP. (You do not need to use modified custom firmware now that you are on 3.41).
14. Insert USB flash drive back into your PC and delete the PUP and Lv2Diag.self file (File 1) and copy the other Lv2Diag.self (File 2) to the root of the flash drive.
15. Insert USB flash drive back into the same USB port on the PS3 and power on your PS3. After 10 seconds it will power off.
16. Remove USB flash drive and turn on your console again. You will be out of factory service mode and back in retail mode with your chosen firmware version installed. You will need to go through setting up settings configuration.
From
TeknoConsolas.es:
"PSFreedom JIG" for Dingoo is a special version of "PSFreedom" created to behave as the JIG device. Thanks to this any user can enable the factory/service mode in his PS3.
From
PS3Break.com:
All series of PS3BREAK dongles support downgrade 3.5 perfectly
PS3BREAK team release the latest downgrade mode firmware. Referring to reasons unexpected, delay to release these for this time. Sorry for the inconvenience caused.
Ps3break V1.0 Downgrade Mode Firmware will be issued today, but PS3BREAK V1.1 and V1.2 Downgrade Mode Firmware all the users concerned is testing and will be released later. Please pay more your attention to PS3BREAK official news closely.
From
GogSoftware.com:
How to downgrade firmware 3.42/3.50 or above to firmware 3.41 with PS3break dongle:
1. Insert PS3break dongle device into computer and flash in downgrade mode firmware as downgrader.
2. Insert PS3break dongle device that has been reprogrammed as downgrader into your console.
3. Turn on the console using the same boot method as all other jailbreaks: Press power then immediately press eject. Your console will turn on and PS3break dongle will light up green LED.
4. After few minutes, the ps3 console power off automatic and red LED light up.
5. Remove PS3break dongle and turn on console to make sure you are in Factory Service Mode. You will see a huge red box on the screen saying Factory Service Mode.
6. Load any blank FAT32 USB flash drive device with 2 files in the root directory:
1. Modified 3.41 PUP
2. Lv2Diag.self (File 1)
7. These must be the only files on the USB key and must be placed in the main (root) directory.
8. Insert flash drive into the last USB port to the right -- the first USB port in from the right side if you're facing the console. Turn the PS3 on and you will see black screen but the PS3 HDD light will flash.
9. The process takes 3-4 minutes for the system to install the old firmware.
Towards the end, the power button on the console will start flashing green and then your console will power off.
10. Remove the flash drive and turn on the console, you will still be in Factory Service Mode. Please verify you have downgraded successfully to version 3.41 by going to "System Information".
11. (Optional) - If you wish to downgrade to any older firmware you can follow step 4, 5, 6 using any regular firmware PUP. (You do not need to use modified custom firmware now that you are on 3.41).
12. Insert USB flash drive back into your PC and delete the PUP and Lv2Diag.self file (File 1) and copy the other Lv2Diag.self (File 2) to the root of the flash drive.
13. Insert USB flash drive back into the same USB port on the PS3 and power on your PS3. After 10 seconds it will power off.
14. Remove USB flash drive and turn on your console again. You will be out of factory service mode and back in retail mode with your chosen firmware version installed. You will need to go through setting up settings configuration. To go back to PS3break dongle device, just drag back the normal .hex files.
From
GameBox.hk:
P3Go Downgrade - Here is how it works:
1. Download this attachment, unrar it.
2. Plug p3go to computer and file update.bin goes to p3go root dir. (flashdisk not TF!)
3. Unplug it and plug it in again (this will flash p3go to V10 core)
4. Send file update.bin again to ps3go root dir and rename it to downgrade.bin
5. Use normail jailbreak procedure (press start and enject) to switch on ps3
6. Turn off system via xmb.
7. Power on and its factory / service mode!
Note: Rename downgrade.bin to anything to get back with jailbreak function (and it disable p3go factory/serivce mode)
From
PSFreedom.com:
iPhone 3G/2G and iPT 1G PS3 Service Mode
WARNING: Downgrades using service mode have been causing loss of blu-ray movie playback on some consoles. Not everyone has experienced the problem but it is not clear what combination of downgrade FW/jig emulation/ps3 model/region will cause the problem so beware.
- Enabled Factory/Service Mode - copy android.img.gz and zImage to /var/idroid and use normal JB process. Unit will power off and be in Service mode after you power it back on. Use at your own risk. iphone3G/2G ipt1G For FW 3.5 and below
- Once you download the correct files above go into the iPhoDroid folder, click resources, iPhoDroid_image and replace the android.img.gz and zImage with the ones in the service_jig zip downloaded above, once done run iPhoDroid and shoot the files to your iPhone/iPod touch, this will enable factory service mode when powering on.
- To use: remove desired payload from zip file and upload to /var/psfreedom/payloads/
- For example, default_payload_3_41.bin would go in /var/psfreedom/payloads/3.41/default_payload_3_41.bin
- default_payload=previously called "MOH" this is the recommended payload w/GAIA, payload_dev=peek+poke (not supported by GAIA manager),payload_no_unauth_syscall=previously called "NOS", this payload has the same functionality as Hermes 4b
From
EclipseMod.com:
EcliPS3 Downgrade
Here is the release of our 1.4c Firmware. This firmware update includes the downgrader and the new V1.4 Eclipse Firmware.
We are proud to say that Blue Ray DVD works fine with our downgrader. An updated release of V1.4 Firmware will also be done in the coming days, so check our news section
We are proud to release the Eclipse downgrader for PS3. This firmware will allow you simply to flash the eclipse to downgrade your PS3 from V3.50 to lower firmwares. You will need to use the Eclipse firmware V1.3 to reflash the Eclips3 with a working Firmware. Just follow the instrutions written into the .txt file inside the firmware zip file.
The V1.4 Firmware complete with downgrader will be released tomorrow. Files are available in our Download area. Have Fun!
Here's the BETA for proof, tomorrow official will be released. You can use any Lev2diag.self files to downgrade once jailbreaked. We will place it online in few minutes, meantime you can also use this package: http://www.sendspace.com/file/qlfoyi
We are proud to release the Eclipse downgrader for PS3. This firmware will allow you simply to flash the eclipse to downgrade your PS3 from V3.50 to lower firmwares. You will need to use the Eclipse firmware V1.3 to reflash the Eclips3 with a working Firmware. Just follow the instrutions written into the .txt file inside the firmware zip file. The V1.4 Firmware complete with downgrader will be released tomorrow. Files are available in our Download area. Have Fun!
DOWNGRADING GUIDE
Note: When downgrading you may in some cases loose saved data on the PS3 HDD.
Flashing Eclipse
Flash your Eclipse as you normally would. After you have completed the downgrading procedure as described below you must reflash your Eclipse with the standard firmware.
DOWNGRADING PROCEDURE
- Prepare a blank USB memory stick with only 2 files inside: Lv2Diag.self (file 1) and the modified 3.41 PUP file.
These must be in the root of the memory stick. No other file must be present.
- Insert the Eclips3 with the downgrade firmware in your console.
- Turn on the PS3 using the standard sequence; Remove power (or power plug) from the PS3,insert Eclips3 into USB port, power on, then quickly press eject. After a very short while the PS3 will power off.
- Turn on the PS3 to confirm that it is in Service Mode. You should see a red box on the screen saying Factory Service Mode.
(If you are using a component cable the image might be garbled). Turn off the PS3 and remove Eclips3.
- Insert the USB memory stick with the 2 files on in the "right USB port" of the PS3 and turn it on.
The screen will be black, but the LED on the PS3 will blink.
- Wait for approximately 3 minutes. In the end the PS3 power button will flash green and then the PS3 will turn off.
Wait 3 minutes for the system to install the old FW, towards the end the power button on the console will start flashing green and then your console will power off.
- Remove the USB memory stick and turn on the PS3. It will still be in service mode. you can now verify that it has been downgraded to v3.41. If you wish
to downgrade to an earlier firmware you can do so now, there is no need to use modified custom PUP when the firmware has already been downgraded to 3.41.
- Insert USB drive in PC, delete the 2 files, and copy LV2Diag.self (file 2) to it.
- Insert USB memory stick and power on the PS3. After approximately 10 seconds it will power off.
- Remove the USB memory stick and power on the PS3. The procedure is now complete.
Have fun!
From
AmazeBreak.cc:
Good News, Amazebreak upgradefile10 release today, you can use it to downgrade your 3.5 version to 3.41 version.
From
E3DIY.net: E3DIY finds PS3 USB mass-storage support issue and work-around.
Recently, some players report that after jail-breaking, if the E3card Reader removed and re-plugged in ps3 again, the system will be halted. After look deep into the issue, we find that not only PS3 but also other Sony products have the same issue that failed to handle those devices which with multiple mass-storage devices attached and removed at the same time.
So, E3DIY releases a new firmware to walk-around. You can upgrade your E3card Reader follow the instructions listed below:
1. Plug the E3 Card Reader in your PC USB port and wait for the removable driver E3Upgrader.
2. Copy the ResetToKernel.bin to the E3Upgrader, wait until the E3Upgrader disappeared.
3. Wait for a removable driver named Kernelboot, and then copy the "e3fix usb freeze.bin" to this driver.
4: After doing these, you can copy other normal function files such as the one used to downgrading or those used to jail-breaking or the one used to protect your TF card, or other application in the future.
iPod 5G PS3 Downgrade via
OGroteKoning:
1. Jailbreak ps3 like normal with downgrade payload - power cycle
2. PS3 should blink a bit and shutdown again
3. Remove iPod from PS3
4. Turn on PS3 and confirm you are in factory mode (big red box)
5. Download DGF.rar, you will find the link in the thread above
6. Put the file 1 self file on an empty usb-stick, aswell as the modified 3.41 pup
7. Plug in the most right usb slot and start ps3 (normal, not jailbroken)
8. After about 3 minutes it should power off
9. Remove usb and boot normally to see if downgrade was succesfull
10. Put the file 2 self file on the usb stick (remove the file 1 and the pup)
11. Plug in usb stick and boot ps3
12. Remove usb and start ps3
NOTE: YOU MIGHT LOSE YOUR BD PLAYBACK ABILITY IF YOU DOWNGRADE SO USE THIS SOLELY AT YOUR OWN RISK!
PSGrade PS3 Downgrading Guides (From Above) Abridged:
FOR PS3USBJAILBREAK:
1. INSERT PS3USBJailbreak to PC
2. RUN PS3USBJAILBREAK.EXE
3. Select Downgrade from the dropdown box
4. CLICK START.
5. This will now be referred to as the DOWNGRADE JIG
FOR BLACKCAT USB:
1. On the BLACKCAT USB ENTER DFU MODE by PUSHING BOTH DFU SWITCHES TO THE RIGHT.
2. INSERT THE BLACKCAT USB to PC and PRESS RESET.
3. RUN BLACKCATUSB.EXE
4. Select the PSGrade Jig hex for the BLACKCAT USB and click program.
5. On the BLACKCAT USB EXIT DFU MODE by PUSHING BOTH DFU SWITCHES TO THE LEFT.
6. This will now be referred to as the DOWNGRADE JIG
FOR OTHER USB DONGLES:
1. LOAD the PSGrade Payload just like you would any PSGroove Payload. If you don't know how ask.
2. This will now be referred to as the DOWNGRADE JIG
PREPARING USB FLASH DRIVES
2 USB FLASH DRIVES:
1. INSERT a BLANK FAT32 USB Flash Drive and copy 2 files to the ROOT DIRECTORY:
a. Modified 3.41 PUP
b. Lv2Diag.self (File 1)
2. This will now be referred to as the USB DRIVE WITH 3.41 DOWNGRADE
3. INSERT the second BLANK FAT32 USB Flash Drive and copy 1 file to the ROOT DIRECTORY:
a. Lv2Diag.self (File 2)
4. This will now be referred to as the SERVICE MODE OFF USB DRIVE
1 USB FLASH DRIVE:
1. INSERT a BLANK FAT32 USB Flash Drive and copy 2 files to the ROOT DIRECTORY:
a. Modified 3.41 PUP
b. Lv2Diag.self (File 1)
2. This will now be referred to as the USB DRIVE WITH 3.41 DOWNGRADE
3. AFTER STEP 11. On the DOWNGRADING YOUR PS3 Section.
4. INSERT the USB DRIVE WITH 3.41 DOWNGRADE And DELETE BOTH FILES on the drive.
5. The drive should now be BLANK copy 1 file to the ROOT DIRECTORY:
a. Lv2Diag.self (File 2)
6. This will now be referred to as the SERVICE MODE OFF USB DRIVE
DOWNGRADING YOUR PS3 BEFORE DOWNGRADING BACKUP YOUR PS3:
1. INSERT the DOWNGRADE JIG into the LAST USB PORT TO THE RIGHT closest the Blu-Ray drive.
2. POWER OFF COMPLETELY either UNPLUG IT (FOR THE SLIM) or TURN OFF THE POWER SUPPLY SWITCH IN BACK (FOR THE FAT) Wait a second then TURN THE POWER SUPPLY SWITCH BACK ON OR PLUG IT BACK IN.
3. Turn on the console using the JAILBREAK BOOT METHOD: PRESS POWER, THEN IMMEDIATELY PRESS EJECT. Your console will TURN ON.
4. SHUT DOWN using the "SYSTEM MENU" NOT THE POWER BUTTON.
5. REMOVE the DOWNGRADE JIG and turn on console to make sure you are in "FACTORY/SERVICE MODE". You will see a huge red box on the screen saying "FACTORY/SERVICE MODE".
6. SHUT DOWN using the "SYSTEM MENU" NOT THE POWER BUTTON.
7. INSERT the USB DRIVE WITH 3.41 DOWNGRADE into the LAST USB PORT TO THE RIGHT closest the Blu-Ray drive.
8. TURN ON the PS3 and you will see black screen but the PS3 HDD light will flash. (Might not flash on some early models of the fat ps3).
9. The process takes 3-4 minutes for the system to install the old firmware. Towards the end, the power light on the console will start flashing green and then the PS3 will POWER OFF AUTOMATICLY.
10. REMOVE the USB DRIVE WITH 3.41 DOWNGRADE
11. TURN ON the PS3, you will still be in "FACTORY/SERVICE MODE", Please verify you have downgraded successfully to version 3.41 by going to "SYSTEM INFORMATION".
a. (OPTIONAL) -- If you only have 1 flash drive go to the 1 USB FLASH DRIVE section under number 3. And follow the instructions.
b. (OPTIONAL) - If you wish to downgrade down again to any older firmware you can use any regular firmware PUP. (You do not need to use modified custom firmware now that you are on 3.41).
12. SHUT DOWN using the "SYSTEM MENU" NOT THE POWER BUTTON.
13. INSERT the SERVICE MODE OFF USB DRIVE into the LAST USB PORT TO THE RIGHT closest the Blu-Ray drive.
14. TURN ON the PS3. After 10 seconds the PS3 will POWER OFF AUTOMATICLY.
15. REMOVE The SERVICE MODE OFF USB DRIVE. You will be out of "FACTORY/SERVICE MODE" and back in "RETAIL MODE" with your chosen firmware version installed. You will need to go through setting up settings configuration.
16. INSERT the JAILBREAK USB DEVICE Of your Choice into the LAST USB PORT TO THE RIGHT closest the Blu-Ray drive.
17. POWER OFF COMPLETELY either UNPLUG IT (FOR THE SLIM) or TURN OFF THE POWER SUPPLY SWITCH IN BACK (FOR THE FAT) Wait a second then TURN THE POWER SUPPLY SWITCH BACK ON OR PLUG IT BACK IN.
18. Turn on the console using the JAILBREAK BOOT METHOD: PRESS POWER, THEN IMMEDIATELY PRESS EJECT. Your console will TURN ON. (THE PS3 IS NOW JAILBROKEN!!!)
Hi,
I'm Goran from Serbia,having my PS3 for almost a year , and i enjoy reading your articles very much ....
This downgrade process is impossible on a slim??
ERROR REPORT:
manufacturing updating start
PackageName = /dev_usb000/PS3UPDAT.PUP
settle polling interval success
vflash is enabled...
creating system regions...
create storage region: (region id = 1)
create storage region: (region id = 2)
format partition: (region_id = 2, CELL_FS_UTILITY:HDD0, CELL_FS_UFS)
create storage region: (region id = 3)
format partition: (region_id = 3, CELL_FS_UTILITY:HDD1, CELL_FS_FAT)
creating system regions done.
boot from nor flash...
creating nor flash regions...
create storage region: (region id = 2)
create storage region: (region id = 3)
creating flash regions...
create storage region: (region id = 1)
create storage region: (region id = 2)
format partition: (region_id = 2, CELL_FS_IOS:BUILTIN_FLSH1, CELL_FS_FAT)
create storage region: (region id = 3)
format partition: (region_id = 3, CELL_FS_IOS:BUILTIN_FLSH2, CELL_FS_FAT)
create storage region: (region id = 4)
format partition: (region_id = 4, CELL_FS_IOS:BUILTIN_FLSH3, CELL_FS_FAT)
create storage region: (region id = 5)
create storage region: (region id = 6)
Initializing
taking a while...
start Updating Proccess
Initialize elapsed time = 183 msec
check UPL
Check UPL elapsed time = 60 msec
check Package Size
get package size elapsed time = 16 msec
start Updating Package
Update packages num = 30
Update packages total size = 162260138
Update Package Revoke list
read package revoke list package (576 bytes) elapsed = 11 msec
update package revoke list elapsed = 197 msec
Update Package Revoke list done(0x8002f000)
Update Core OS Package
read core os package (5182047 bytes) elapsed = 427 msec
update core os package elapsed = 56032 msec
Update Core OS Package done(0x8002f000)
Update VSH Package
sys_memory_container_create() success(id = 0xc0effffe)
Update VSH's package : 1/22
read vsh package (1841 bytes) elapsed = 12 msec
decrypt and verify vsh package elapsed = 45 msec
write vsh package elapsed = 87 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 42 msec
Update VSH's package : 2/22
read vsh package (4779240 bytes) elapsed = 395 msec
decrypt and verify vsh package elapsed = 326 msec
write vsh package elapsed = 509 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 392 msec
Update VSH's package : 3/22
read vsh package (1927089 bytes) elapsed = 167 msec
decrypt and verify vsh package elapsed = 148 msec
write vsh package elapsed = 138 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 153 msec
Update VSH's package : 4/22
read vsh package (5498561 bytes) elapsed = 453 msec
decrypt and verify vsh package elapsed = 364 msec
write vsh package elapsed = 564 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 436 msec
Update VSH's package : 5/22
read vsh package (2010269 bytes) elapsed = 176 msec
decrypt and verify vsh package elapsed = 155 msec
write vsh package elapsed = 160 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 190 msec
Update VSH's package : 6/22
read vsh package (25301 bytes) elapsed = 17 msec
decrypt and verify vsh package elapsed = 46 msec
write vsh package elapsed = 22 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 35 msec
Update VSH's package : 7/22
read vsh package (7663270 bytes) elapsed = 630 msec
decrypt and verify vsh package elapsed = 416 msec
write vsh package elapsed = 1025 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 557 msec
Update VSH's package : 8/22
read vsh package (10258879 bytes) elapsed = 843 msec
decrypt and verify vsh package elapsed = 310 msec
write vsh package elapsed = 1237 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 565 msec
Update VSH's package : 9/22
read vsh package (8773195 bytes) elapsed = 723 msec
decrypt and verify vsh package elapsed = 265 msec
write vsh package elapsed = 843 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 469 msec
Update VSH's package : 10/22
read vsh package (8827678 bytes) elapsed = 731 msec
decrypt and verify vsh package elapsed = 346 msec
write vsh package elapsed = 957 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 543 msec
Update VSH's package : 11/22
read vsh package (6182668 bytes) elapsed = 519 msec
decrypt and verify vsh package elapsed = 227 msec
write vsh package elapsed = 496 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 363 msec
Update VSH's package : 12/22
read vsh package (10251215 bytes) elapsed = 850 msec
decrypt and verify vsh package elapsed = 282 msec
write vsh package elapsed = 674 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 538 msec
Update VSH's package : 13/22
read vsh package (10187344 bytes) elapsed = 845 msec
decrypt and verify vsh package elapsed = 286 msec
write vsh package elapsed = 725 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 550 msec
Update VSH's package : 14/22
read vsh package (10381187 bytes) elapsed = 825 msec
decrypt and verify vsh package elapsed = 285 msec
write vsh package elapsed = 774 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 556 msec
Update VSH's package : 15/22
read vsh package (9899962 bytes) elapsed = 826 msec
decrypt and verify vsh package elapsed = 287 msec
write vsh package elapsed = 831 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 511 msec
Update VSH's package : 16/22
read vsh package (8210627 bytes) elapsed = 690 msec
decrypt and verify vsh package elapsed = 228 msec
write vsh package elapsed = 778 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 418 msec
Update VSH's package : 17/22
read vsh package (10382360 bytes) elapsed = 832 msec
decrypt and verify vsh package elapsed = 293 msec
write vsh package elapsed = 879 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 574 msec
Update VSH's package : 18/22
read vsh package (9649989 bytes) elapsed = 780 msec
decrypt and verify vsh package elapsed = 394 msec
write vsh package elapsed = 2083 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 830 msec
Update VSH's package : 19/22
read vsh package (7751745 bytes) elapsed = 664 msec
decrypt and verify vsh package elapsed = 376 msec
write vsh package elapsed = 1603 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 731 msec
Update VSH's package : 20/22
read vsh package (8165430 bytes) elapsed = 700 msec
decrypt and verify vsh package elapsed = 390 msec
write vsh package elapsed = 1218 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 687 msec
Update VSH's package : 21/22
read vsh package (8287111 bytes) elapsed = 711 msec
decrypt and verify vsh package elapsed = 372 msec
write vsh package elapsed = 1611 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 807 msec
Update VSH's package : 22/22
read vsh package (5315230 bytes) elapsed = 456 msec
decrypt and verify vsh package elapsed = 244 msec
write vsh package elapsed = 427 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 346 msec
Update VSH Package done(0x8002f000)
Bul-ray Disc Player Revoke
read bdp revoke package (1774 bytes) elapsed = 12 msec
decrypt and verify bdp revoke package elapsed = 51 msec
write bdp revoke package elapsed = 1 msec
Bul-ray Disc Player Revoke done(0x8002f057)
update package elapsed time = 104146 msec
Updating or Verifying failure 0x8002f057
UpMng.UpdatePackage() failure
manufacturing updating FAILURE(0x8002f057)
Total Elapsed time = 112396 msec
If yes, you can't do that on slim.
Ideas??
Updates now include the ability to specify the dongle ID to be used (instead of always 0xAAAA) when emulating the Sony official JIG stick for downgrading.