PSGrade - PS3 Downgrading, Master Key and Hex Codes Arrive!


175w ago - Update: According to several members (including jensen76, evilsperm, and sk group) when you downgrade a PS3 with the Modified 3.41 PUP (below), it currently cripples the Blu-ray player functionality. Some additional PS3 Blu-ray fix updates are outlined HERE, however, a more stable solution is still being worked on.

To quote from garyopa on one work-around: "I was able to restore one machine I had, by copying over all the files I had in the /dev_flash2 and /dev_flash3 back to the HDD, that I had saved before when it was on v3.41"

Forum member p666 also has expanded on the PS3 Blu-ray fix a bit HERE for those who need it, and atlask2 let us know of yet another Blu-ray drive solution HERE by Maes along with another PS3 Blu-ray Drive WIP Fix.

Although PSGrade won't currently work on the patched and recently released PS3 Firmware v3.55 update, yesterday the PSGrade free PS3 Downgrading hex codes and Master Key arrived along with PlayStation 3 downgrade hex codes for various PS3 JailBreak USB modchip devices alongside a PS3 Demo / Kiosk to Retail Console Guide by starcube.

Downloads: PSGrade PS3 Downgrading Hex Codes / DGF.rar (Includes Modified 3.41 PUP, Lv2diag.self FILE 1 and Lv2diag.self FILE 2) / PSGrade Source Code / GIT

This will be our ongoing thread covering them as they are released- complete with the related files and guides for each below, and to recap:

From Mathieulh: Dongle master key: 0x46, 0xDC, 0xEA, 0xD3, 0x17, 0xFE, 0x45, 0xD8, 0x09,0x23,0xEB, 0x97, 0xE4, 0x95, 0x64, 0x10, 0xD4, 0xCD, 0xB2, 0xC2 Real one this time, sorry for the mix up, thanks graf.

By the way in case people missed it, this is the dongle master key (not the 0xAAAA device key): 0x04 0x4E 0x61 0x1B 0xA6 0xA6 0xE3 0x9A 0x98 0xCF 0x35 0x81 0x2C 0x80 0x68 0xC7 0xFC 0x5F 0x7A 0xE8. It works up to version 3.55 included. You can generate keys for any dongles' device id with it if people care.

The people having bluray movies playback issues after downgrading, this happens because you updated to a modified PUP (psjb one) which has its /dev_flash3/ tarball swapped (probably to a debug one, debug consoles do not sport bd movies playback) with other CRL/DRL revocation files.

0x24000 - USB Dongle Authenticator

0x24001 - Generate Challenge
0x24002 - Verify Response

0x24001 - Generate Challenge

  • I have got access to this service through DM and tested it
  • The service expects no input parameters except those in SS packet header
  • It uses 0x5003 service (Generate Random Number) to generate random numbers that are used in challenge body
  • The length of a challnge body is always 23 bytes, first 3 bytes are always the same: 0x2E 0x02 0x01

Here are hexdumps of some challenge bodies i let 0x24001 service generate:






0x24002 - Verify Response

  • I have got access to this service and tested it with PSGroove
  • The response body is 25 bytes large
  • The first 3 bytes have to be 0x2E 0x02 0x02 or else the check fails
  • The 16 bit at offset 3 is a dongle ID
  • The dongle ID is checked if it's revoked or not
  • When the verification succeedes then product mode is set to 1
  • The service calculates USB Dongle Key from USB Dongle ID and USB Dongle Master Key by using HMAC SHA-1
  • The service uses HMAC SHA-1 to calculate the correct response body from the challenge body and USB Dongle Key
  • After that the service compares the calculated response body with the given one that was sent to the service
  • It seems that laid and paid from SS packet header are used in decryption process

USB Dongle Master Key

  • USB Dongle Master Key is stored encrypted in Process 6
  • The encrypted key is 64 bytes large
  • The decrypted key is 20 bytes large
  • The USB Dongle Master Key is decrypted first time the service 0x24002 is used
  • The USB Dongle Master Key is decrypted by using the service 0x200E (Decrypt Master) of Vitual TRM Manager
  • The decrypted USB Dongle Master Key is stored in Process 6 in clear text (after first usage of this service)
  • When decryption of USB Dongle Master Key fails then a dummy key is used
  • Unfortunately, in the HV dump 3.15 the USB Dongle Master Key was not decrypted at the moment of dumping
  • The first 12 bytes of decrypted USB Dongle Master Key is a magic value: _USB_DONGLE_. After these 12 bytes follows the real USB Dongle Master Key of size 20 bytes. So, if after decryption of USB Dongle Master Key, you see this magic value then the decryption was successful.

Here is the encrypted USB Dongle Master Key from HV 3.15:


This is the decrypted dongle master key which works up to 3.55:


Here is the USB Dongle Master Dummy Key from HV 3.15:


USB Dongle ID Revoke List

  • Process 6 contains a revoke list for USB Dongle IDs
  • The revoke list is 0x2000 bytes large. It's a bitmap.
  • Each bit represents a USB Dongle ID. If bit is 0 then USB Dongle ID is revoked.

The following USB Dongle IDs are revoked in HV 3.15:


0x25000 - User Token Manager
Packet ID Description
0x25001 Encrypt User Token
0x25002 Decrypt User Token

User Token

  • Before User Token Manager encrypts a received user token it checks it's format.
  • User Tokens are processed by spu_utoken_processor.self
  • Before User Token is processed, User Token Manager reads IDPS by sending SS requests to Indi Info Manager (packet ids 0x17001 and 0x17002). Indi Info Manager runs in HV Process 5.

User Token Format


PS3 Master Key (obfuscated, xor-ed with 0x36 and swapped bytes 11 and 16) for Jig: 0x32, 0x78, 0x57, 0x2D, 0x90, 0x90, 0xD5, 0xAC, 0xAE, 0xF9, 0x03, 0xCA, 0x1A, 0xB6, 0x5E, 0xF1, 0xB7, 0x69, 0x4C, 0xDE

From KaKaRoToKS:

PS3 Master Key for Jig: 0xAAAA dongle key: 0x04, 0x4E, 0x61, 0x1B, 0xA6, 0xA6, 0xE3, 0x9A, 0x98, 0xCF, 0x35, 0x81, 0x2C, 0x80, 0x68, 0xC7, 0xFC, 0x5F, 0x7A, 0xE8

From PS3Yes.com:

We now confirm the Key for AAAA was: 04 4E 61 1B A6 A6 E3 9A 98 CF 35 81 2C 80 68 C7 FC 5F 7A E8

From PS3Yes.com:

Part 1: How to update PS3YES-Pro's firmware

Step 1. Connect PS3YES-Pro to your PC's USB port
Step 2. About 6 seconds later , PS3YES-Pro's 8MB USB storage will be install on you PC.
Step 3. Right-click on the USB disk's root path, and create a new text file and renamed it to 'enterduf'.
Step 4. Eject the USB disk to PS3YES-Pro, remove it from PC and re-plug it to your PC's USB port.
(The following steps also used on PS3YES! and PS3YES-Pro too)
Step 5. About 30 seconds later, the LED on PS3YES-Pro will switch off, you should install the ATMEL DFU driver to run the FLIP tool. You can jump to Step 8 if it was istealled aleady.
Step 6. Install drivers to "AT90USB162" device, you should download and install FLIP tool from ATMEL (http://www.atmel.com/dyn/resources/prod_documents/JRE_Flip_Installer_3.4.2.exe).
Step 7. You can found drivers to "AT90USB162" in the path of FLIP was installed, for example : "C:\Program Files\Atmel\Flip 3.4.2\usb".
Step 8. Download the correct firmware's hex file. Make sure it was storage in a full English path and without space. for example "c:\".
Step 9. Run the FLIP tool. Make sure at the first use the "Load Hex File..." menu under "File" menu to load the new firmware hex file.
Step 10. Click the USB icon on FLIP and select "USB" , or press CTRL-U , and click "open" button in the following dialoag.
Step 11. Click "Run" button start update PS3YES-Pro's firmware. it will display like this : if done.
(The fimware was updated now, the following step just fit to PS3YES-Pro, for stop enter DFU mode next time.)
Step 12. Remove PS3YES-Pro from PC and plugin it again.
Step 13. Delete the file "enterdfu" from the USB disks's root path in 30 seconds.

Part 2: How to use PS3YES-Pro downgrade the console's firmware from 3.50

Prepare: Download the downgrade files (http://www.sendspace.com/file/qlfoyi), an USB disk large to storage the upgrade files.
Step 1: Please update your PS3YES-Pro with downgrade firware as Part 1.
Step 2: Plug the "downgrade" PS3YES-Pro to the right port (close the Blue-Ray Driver), Power down the connsole and cut of the power. Re-connect power to the console, Press power on button, press the "EJECT" button in 200ms atfter power on button was pressed. Untill finished your downgrade, you don't need cut off the power angin.
Step 3: The screen to the console will flash servral time and auto-turn-off, you can remove the PS3YES-Pro now (You console now ready to enter "Factory Mode" now)
Step 4: Prepare an USB disk and formate it as FAT32 file system, copy two files to the USB disk: Lv2diag.self and PS3UPDAT.PUP, and place them under the root path. the the named "Lv2diag.self" should copy from the "Lv2diag.self FILE 1" folder.
Step 5: Plug the USB disk to the right USB port to the console, and remove any other USB disk from your console, press power on button to boot.
Step 6: Wait untill the console turn off again. Remove the USB disk from your console, and delete all the files, copy the "Lv2diag.self" from "Lv2diag.self FILE 2" folder to the USB disk's root path.
Step 7: Plug the USB disk to the right USB port to the console, and press power on button, It will leave "Factory Mode" now.
Last Step: After finished downgrade the console , you can update PS3YES-Pro back

From PS3Key.com:

If you need to downgrade a PS3 with firmware version 3.50 or below you can now grab the PS3KEY JIG firmware from the downloads section! Please note that we do not host the modified PUP file or any other file that may contain copyrighted code.

From PS3USBJailBreak.com:

Downgrader for ps3usbjailbreak has released. Please download progtramming tools 1.2.8 to reflash. Tutorial:

1. Insert PS3USBJailbreak to PC
2. Run 1.2.8 updater
3. Click START.
4. Insert PS3USBJailbreak device that has been reprogrammed as downgrader into your console
5. Turn on the console using the same boot method as all other jailbreaks: Press power then immediately press eject. Your console will turn on.
6. Turn off system via menu
7. Remove PS3USBJailbreak dongle and turn on console to make sure you are in Factory Service Mode. You will see a huge red box on the screen saying Factory Service Mode.
8. Load any blank FAT32 USB flash drive device with 2 files in the root directory:
a. Modified 3.41 PUP
b. Lv2Diag.self (File 1)
9. These must be the only files on the USB key and must be placed in the main (root) directory.
10. Insert flash drive into the last USB port to the right – the first USB port in from the right side if you're facing the console. Turn the PS3 on and you will see black screen but the PS3 HDD light will flash.
11. The process takes 3-4 minutes for the system to install the old firmware. Towards the end, the power button on the console will start flashing green and then your console will power off.
12. Remove the flash drive and turn on the console, you will still be in Factory Service Mode. Please verify you have downgraded successfully to version 3.41 by going to "System Information".
13. (Optional) - If you wish to downgrade to any older firmware you can follow step 4, 5, 6 using any regular firmware PUP. (You do not need to use modified custom firmware now that you are on 3.41).
14. Insert USB flash drive back into your PC and delete the PUP and Lv2Diag.self file (File 1) and copy the other Lv2Diag.self (File 2) to the root of the flash drive.
15. Insert USB flash drive back into the same USB port on the PS3 and power on your PS3. After 10 seconds it will power off.
16. Remove USB flash drive and turn on your console again. You will be out of factory service mode and back in retail mode with your chosen firmware version installed. You will need to go through setting up settings configuration.

From TeknoConsolas.es:

"PSFreedom JIG" for Dingoo is a special version of "PSFreedom" created to behave as the JIG device. Thanks to this any user can enable the factory/service mode in his PS3.

From PS3Break.com:
All series of PS3BREAK dongles support downgrade 3.5 perfectly

PS3BREAK team release the latest downgrade mode firmware. Referring to reasons unexpected, delay to release these for this time. Sorry for the inconvenience caused.

Ps3break V1.0 Downgrade Mode Firmware will be issued today, but PS3BREAK V1.1 and V1.2 Downgrade Mode Firmware all the users concerned is testing and will be released later. Please pay more your attention to PS3BREAK official news closely.

From GogSoftware.com:

How to downgrade firmware 3.42/3.50 or above to firmware 3.41 with PS3break dongle:

1. Insert PS3break dongle device into computer and flash in downgrade mode firmware as downgrader.
2. Insert PS3break dongle device that has been reprogrammed as downgrader into your console.
3. Turn on the console using the same boot method as all other jailbreaks: Press power then immediately press eject. Your console will turn on and PS3break dongle will light up green LED.
4. After few minutes, the ps3 console power off automatic and red LED light up.
5. Remove PS3break dongle and turn on console to make sure you are in Factory Service Mode. You will see a huge red box on the screen saying Factory Service Mode.
6. Load any blank FAT32 USB flash drive device with 2 files in the root directory:

1. Modified 3.41 PUP
2. Lv2Diag.self (File 1)

7. These must be the only files on the USB key and must be placed in the main (root) directory.
8. Insert flash drive into the last USB port to the right – the first USB port in from the right side if you're facing the console. Turn the PS3 on and you will see black screen but the PS3 HDD light will flash.
9. The process takes 3-4 minutes for the system to install the old firmware.
Towards the end, the power button on the console will start flashing green and then your console will power off.
10. Remove the flash drive and turn on the console, you will still be in Factory Service Mode. Please verify you have downgraded successfully to version 3.41 by going to "System Information".
11. (Optional) - If you wish to downgrade to any older firmware you can follow step 4, 5, 6 using any regular firmware PUP. (You do not need to use modified custom firmware now that you are on 3.41).
12. Insert USB flash drive back into your PC and delete the PUP and Lv2Diag.self file (File 1) and copy the other Lv2Diag.self (File 2) to the root of the flash drive.
13. Insert USB flash drive back into the same USB port on the PS3 and power on your PS3. After 10 seconds it will power off.
14. Remove USB flash drive and turn on your console again. You will be out of factory service mode and back in retail mode with your chosen firmware version installed. You will need to go through setting up settings configuration. To go back to PS3break dongle device, just drag back the normal .hex files.

From GameBox.hk:
P3Go Downgrade - Here is how it works:

1. Download this attachment, unrar it.
2. Plug p3go to computer and file update.bin goes to p3go root dir. (flashdisk not TF!)
3. Unplug it and plug it in again (this will flash p3go to V10 core)
4. Send file update.bin again to ps3go root dir and rename it to downgrade.bin
5. Use normail jailbreak procedure (press start and enject) to switch on ps3
6. Turn off system via xmb.
7. Power on and its factory / service mode!

Note: Rename downgrade.bin to anything to get back with jailbreak function (and it disable p3go factory/serivce mode)

From PSFreedom.com:
iPhone 3G/2G and iPT 1G PS3 Service Mode

WARNING: Downgrades using service mode have been causing loss of blu-ray movie playback on some consoles. Not everyone has experienced the problem but it is not clear what combination of downgrade FW/jig emulation/ps3 model/region will cause the problem so beware.

  • Enabled Factory/Service Mode - copy android.img.gz and zImage to /var/idroid and use normal JB process. Unit will power off and be in Service mode after you power it back on. Use at your own risk. iphone3G/2G ipt1G For FW 3.5 and below
  • Once you download the correct files above go into the iPhoDroid folder, click resources, iPhoDroid_image and replace the android.img.gz and zImage with the ones in the service_jig zip downloaded above, once done run iPhoDroid and shoot the files to your iPhone/iPod touch, this will enable factory service mode when powering on.
  • To use: remove desired payload from zip file and upload to /var/psfreedom/payloads/
  • For example, default_payload_3_41.bin would go in /var/psfreedom/payloads/3.41/default_payload_3_41.bin
  • default_payload=previously called "MOH" this is the recommended payload w/GAIA, payload_dev=peek+poke (not supported by GAIA manager),payload_no_unauth_syscall=previously called "NOS", this payload has the same functionality as Hermes 4b

From EclipseMod.com:
EcliPS3 Downgrade

Here is the release of our 1.4c Firmware. This firmware update includes the downgrader and the new V1.4 Eclipse Firmware.

We are proud to say that Blue Ray DVD works fine with our downgrader. An updated release of V1.4 Firmware will also be done in the coming days, so check our news section

We are proud to release the Eclipse downgrader for PS3. This firmware will allow you simply to flash the eclipse to downgrade your PS3 from V3.50 to lower firmwares. You will need to use the Eclipse firmware V1.3 to reflash the Eclips3 with a working Firmware. Just follow the instrutions written into the .txt file inside the firmware zip file.

The V1.4 Firmware complete with downgrader will be released tomorrow. Files are available in our Download area. Have Fun!

Here's the BETA for proof, tomorrow official will be released. You can use any Lev2diag.self files to downgrade once jailbreaked. We will place it online in few minutes, meantime you can also use this package: http://www.sendspace.com/file/qlfoyi

We are proud to release the Eclipse downgrader for PS3. This firmware will allow you simply to flash the eclipse to downgrade your PS3 from V3.50 to lower firmwares. You will need to use the Eclipse firmware V1.3 to reflash the Eclips3 with a working Firmware. Just follow the instrutions written into the .txt file inside the firmware zip file. The V1.4 Firmware complete with downgrader will be released tomorrow. Files are available in our Download area. Have Fun!

DOWNGRADING GUIDE

Note: When downgrading you may in some cases loose saved data on the PS3 HDD.

Flashing Eclipse

Flash your Eclipse as you normally would. After you have completed the downgrading procedure as described below you must reflash your Eclipse with the standard firmware.

DOWNGRADING PROCEDURE

  • Prepare a blank USB memory stick with only 2 files inside: Lv2Diag.self (file 1) and the modified 3.41 PUP file.
    These must be in the root of the memory stick. No other file must be present.
  • Insert the Eclips3 with the downgrade firmware in your console.
  • Turn on the PS3 using the standard sequence; Remove power (or power plug) from the PS3,insert Eclips3 into USB port, power on, then quickly press eject. After a very short while the PS3 will power off.
  • Turn on the PS3 to confirm that it is in Service Mode. You should see a red box on the screen saying Factory Service Mode.
    (If you are using a component cable the image might be garbled). Turn off the PS3 and remove Eclips3.
  • Insert the USB memory stick with the 2 files on in the "right USB port" of the PS3 and turn it on.
    The screen will be black, but the LED on the PS3 will blink.
  • Wait for approximately 3 minutes. In the end the PS3 power button will flash green and then the PS3 will turn off.
    Wait 3 minutes for the system to install the old FW, towards the end the power button on the console will start flashing green and then your console will power off.
  • Remove the USB memory stick and turn on the PS3. It will still be in service mode. you can now verify that it has been downgraded to v3.41. If you wish
    to downgrade to an earlier firmware you can do so now, there is no need to use modified custom PUP when the firmware has already been downgraded to 3.41.
  • Insert USB drive in PC, delete the 2 files, and copy LV2Diag.self (file 2) to it.
  • Insert USB memory stick and power on the PS3. After approximately 10 seconds it will power off.
  • Remove the USB memory stick and power on the PS3. The procedure is now complete.

Have fun!

From AmazeBreak.cc:
Good News, Amazebreak upgradefile10 release today, you can use it to downgrade your 3.5 version to 3.41 version.

From E3DIY.net: E3DIY finds PS3 USB mass-storage support issue and work-around.
Recently, some players report that after jail-breaking, if the E3card Reader removed and re-plugged in ps3 again, the system will be halted. After look deep into the issue, we find that not only PS3 but also other Sony products have the same issue that failed to handle those devices which with multiple mass-storage devices attached and removed at the same time.

So, E3DIY releases a new firmware to walk-around. You can upgrade your E3card Reader follow the instructions listed below:

1. Plug the E3 Card Reader in your PC USB port and wait for the removable driver E3Upgrader.
2. Copy the ResetToKernel.bin to the E3Upgrader, wait until the E3Upgrader disappeared.
3. Wait for a removable driver named Kernelboot, and then copy the "e3fix usb freeze.bin" to this driver.
4: After doing these, you can copy other normal function files such as the one used to downgrading or those used to jail-breaking or the one used to protect your TF card, or other application in the future.

iPod 5G PS3 Downgrade via OGroteKoning:

1. Jailbreak ps3 like normal with downgrade payload - power cycle
2. PS3 should blink a bit and shutdown again
3. Remove iPod from PS3
4. Turn on PS3 and confirm you are in factory mode (big red box)
5. Download DGF.rar, you will find the link in the thread above
6. Put the file 1 self file on an empty usb-stick, aswell as the modified 3.41 pup
7. Plug in the most right usb slot and start ps3 (normal, not jailbroken)
8. After about 3 minutes it should power off
9. Remove usb and boot normally to see if downgrade was succesfull
10. Put the file 2 self file on the usb stick (remove the file 1 and the pup)
11. Plug in usb stick and boot ps3
12. Remove usb and start ps3

NOTE: YOU MIGHT LOSE YOUR BD PLAYBACK ABILITY IF YOU DOWNGRADE SO USE THIS SOLELY AT YOUR OWN RISK!

PSGrade PS3 Downgrading Guides (From Above) Abridged:

FOR PS3USBJAILBREAK:

1. INSERT PS3USBJailbreak to PC
2. RUN PS3USBJAILBREAK.EXE
3. Select Downgrade from the dropdown box
4. CLICK START.
5. This will now be referred to as the DOWNGRADE JIG

FOR BLACKCAT USB:

1. On the BLACKCAT USB ENTER DFU MODE by PUSHING BOTH DFU SWITCHES TO THE RIGHT.
2. INSERT THE BLACKCAT USB to PC and PRESS RESET.
3. RUN BLACKCATUSB.EXE
4. Select the PSGrade Jig hex for the BLACKCAT USB and click program.
5. On the BLACKCAT USB EXIT DFU MODE by PUSHING BOTH DFU SWITCHES TO THE LEFT.
6. This will now be referred to as the DOWNGRADE JIG

FOR OTHER USB DONGLES:

1. LOAD the PSGrade Payload just like you would any PSGroove Payload. If you don't know how ask.
2. This will now be referred to as the DOWNGRADE JIG

PREPARING USB FLASH DRIVES

2 USB FLASH DRIVES:

1. INSERT a BLANK FAT32 USB Flash Drive and copy 2 files to the ROOT DIRECTORY:
a. Modified 3.41 PUP
b. Lv2Diag.self (File 1)
2. This will now be referred to as the USB DRIVE WITH 3.41 DOWNGRADE
3. INSERT the second BLANK FAT32 USB Flash Drive and copy 1 file to the ROOT DIRECTORY:
a. Lv2Diag.self (File 2)
4. This will now be referred to as the SERVICE MODE OFF USB DRIVE

1 USB FLASH DRIVE:

1. INSERT a BLANK FAT32 USB Flash Drive and copy 2 files to the ROOT DIRECTORY:
a. Modified 3.41 PUP
b. Lv2Diag.self (File 1)
2. This will now be referred to as the USB DRIVE WITH 3.41 DOWNGRADE
3. AFTER STEP 11. On the DOWNGRADING YOUR PS3 Section.
4. INSERT the USB DRIVE WITH 3.41 DOWNGRADE And DELETE BOTH FILES on the drive.
5. The drive should now be BLANK copy 1 file to the ROOT DIRECTORY:
a. Lv2Diag.self (File 2)
6. This will now be referred to as the SERVICE MODE OFF USB DRIVE

DOWNGRADING YOUR PS3 BEFORE DOWNGRADING BACKUP YOUR PS3:

1. INSERT the DOWNGRADE JIG into the LAST USB PORT TO THE RIGHT closest the Blu-Ray drive.
2. POWER OFF COMPLETELY either UNPLUG IT (FOR THE SLIM) or TURN OFF THE POWER SUPPLY SWITCH IN BACK (FOR THE FAT) Wait a second then TURN THE POWER SUPPLY SWITCH BACK ON OR PLUG IT BACK IN.
3. Turn on the console using the JAILBREAK BOOT METHOD: PRESS POWER, THEN IMMEDIATELY PRESS EJECT. Your console will TURN ON.
4. SHUT DOWN using the "SYSTEM MENU" NOT THE POWER BUTTON.
5. REMOVE the DOWNGRADE JIG and turn on console to make sure you are in "FACTORY/SERVICE MODE". You will see a huge red box on the screen saying "FACTORY/SERVICE MODE".
6. SHUT DOWN using the "SYSTEM MENU" NOT THE POWER BUTTON.
7. INSERT the USB DRIVE WITH 3.41 DOWNGRADE into the LAST USB PORT TO THE RIGHT closest the Blu-Ray drive.
8. TURN ON the PS3 and you will see black screen but the PS3 HDD light will flash. (Might not flash on some early models of the fat ps3).
9. The process takes 3-4 minutes for the system to install the old firmware. Towards the end, the power light on the console will start flashing green and then the PS3 will POWER OFF AUTOMATICLY.
10. REMOVE the USB DRIVE WITH 3.41 DOWNGRADE
11. TURN ON the PS3, you will still be in "FACTORY/SERVICE MODE", Please verify you have downgraded successfully to version 3.41 by going to "SYSTEM INFORMATION".

a. (OPTIONAL) -- If you only have 1 flash drive go to the 1 USB FLASH DRIVE section under number 3. And follow the instructions.
b. (OPTIONAL) - If you wish to downgrade down again to any older firmware you can use any regular firmware PUP. (You do not need to use modified custom firmware now that you are on 3.41).

12. SHUT DOWN using the "SYSTEM MENU" NOT THE POWER BUTTON.
13. INSERT the SERVICE MODE OFF USB DRIVE into the LAST USB PORT TO THE RIGHT closest the Blu-Ray drive.
14. TURN ON the PS3. After 10 seconds the PS3 will POWER OFF AUTOMATICLY.
15. REMOVE The SERVICE MODE OFF USB DRIVE. You will be out of "FACTORY/SERVICE MODE" and back in "RETAIL MODE" with your chosen firmware version installed. You will need to go through setting up settings configuration.
16. INSERT the JAILBREAK USB DEVICE Of your Choice into the LAST USB PORT TO THE RIGHT closest the Blu-Ray drive.
17. POWER OFF COMPLETELY either UNPLUG IT (FOR THE SLIM) or TURN OFF THE POWER SUPPLY SWITCH IN BACK (FOR THE FAT) Wait a second then TURN THE POWER SUPPLY SWITCH BACK ON OR PLUG IT BACK IN.
18. Turn on the console using the JAILBREAK BOOT METHOD: PRESS POWER, THEN IMMEDIATELY PRESS EJECT. Your console will TURN ON. (THE PS3 IS NOW JAILBROKEN!!!)
























Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!

Comments 260 Comments - Go to Forum Thread »

Quick Reply Quick Reply

lopaka311's Avatar
#220 - lopaka311 - 173w ago
what is the standard process to go up to 3.41?

PS3 News's Avatar
#219 - PS3 News - 173w ago
Thanks zeromx and +Rep for the upload!

zeromx's Avatar
#218 - zeromx - 173w ago
PS3DJB is an application for Android phones to downgrade to an earlier version of the current firmware on your PS3, you'll enjoy the pleasures of JailBreak in 3.41.

This new version is now compatible with PS3DJB HTC HD2, but the author of this application is currently the focus to many other Android devices like the HTC Touch Pro, HTC Touch Pro 2, HTC Diamond , HTC Diamond 2, HTC Tilt 2 as well as the HTC Fuze. Here are the changes in this version:

Version 2.5:

  • Bonton Jailbreak, backup and restore deleted.
  • The Jailbreak now has a dedicated folder containing a precompiled installer for Android
  • Added a button to launch Android dedicated to those who have compiled versions in the folder android.
  • New startup icon (thank you drkfngthdragnlrd)

What the app does:

This app will allow you to downgrade your firmware to any firmware you want. (PS3 Slim's cannot go as far back as Fat Consoles.) The downgrade only works with FW's up to 3.50. (If you have FW3.55 you are out of luck for now. Unfortunately there is no solution on the market nor in the community for that FW version.)

This app will also allow you to patch your android build with all the files needed to jailbreak your ps3 (this will be changed real soon). It also includes many payloads so u can use the one that best matches your needs.

Install:

Make sure you have placed your android build of your choice on the root of your sd card before installing. Your android build must be placed in the Android folder.

1. install downgradeupdater.cab to storage card. (this only contains the downgrade folder)
2. install PS3DJB.cab to storage card. (this contains the main UI and all jailbreak files) (does not include modified 3.41 PUP, lv2diag.self file 1 and lv2diag.self file 2)

Pre Use:

1. run app and select backup original android build (must do this first before you run setup jailbreak if you want to keep your original zImage of your Android build.)
2. select setup jailbreak. This will transfer all the files to your android build. if you replace your android build later on with a newer version just rerun the setup jailbreak.

Use:

1. once you set up jailbreak then proceed to select Launch PS3DJB. Follow the jailbreak instructions on the process. There are tons of tuts on how to do so. It is all they same for the most part. What is different for the HD2 is Once you boot into Android go and launch Gscript and select the payload of your choice. Then wait till it starts to auto countdown then plug the phone into the ps3 and start the jailbreak process.
2. If you want to downgrade your ps3 launch downgrader. This will take you to a mini android build made specifically for downgrading your ps3. This will not affect your other android builds

Questions and Answers:

Q) how do I know when everything backed up, restored or setup for jailbreak?
A) it will complete when the button image snaps back to normal when completed.

Q) im done downgrading and cant turn off the phone with the power button?
A) If you run the downgrade portion of the app you will need to pull the battery out when your done and reboot the phone. this is not due to my app it is part of the downgrade setup.

Q) Where is the Gscript folder located at?
A) gscript folder installs to the root of your SD card. It should install when you install the PS3DJB.CAB if you do not see it. Reboot your phone. Sometimes it caches till a reboot. not sure if its a OS issue or a Rom issue.

Q) I started Gscript and only see a couple of payloads. Isnt there more?
A) if you are missing payloads in gscript listing hit the windows button then select add script. Then finally select load. find a missing script select it and save. it will now populate to your main list in gscript. you will need to add. hermes 3.50 + PSN v4b, CE-X hybrid payload, and 2.76FW payload.

Q) I have multiple android builds will this mess with them?
A) Yes and No. It will only mess the the android build located in the Android Folder. If you want to make sure your stock android build stays stock after jailbreaking run the backup original android build button first to back up a copy of your original zImage. Once your done jailbreaking just run restore original android build to restore the backedup zImage.

Q) Do I need to install the downgradeupdater.Cab if I don’t plan on downgrading?
A) No you do not. It does not affect anything releated jailbreaking. If you hit the launch downgrader button without it installed will cause the app to display a message about it missing.

Q) if i downgrade will i loss my game saves? if so how do i keep them?
A) If you downgrade you may loose your game save. Go to system settings and back up your system. the option is at the bottom of the list almost. you can restore the same way

PAYLOADS included:

  • Hermes v4b+355 FW3.41
  • CE-X FW3.41
  • Hermes FW3.41
  • Hermes v4b + psn + 3.50 FW3.41
  • PL3 FW2.76
  • PL3 FW3.01
  • PL3 FW3.10
  • PL3 FW3.15
  • PL3 FW3.41

*IMPORTANT* for downgrading you will need the 3.41 modified pup, lv2diag.self file 1 and lv2diag.self file 2. these are needed once you obtain service mode.

Download: http://www.megaupload.com/?d=14C2342D
Instructions: http://forum.xda-developers.com/showpost.php?&p=9801775&postcount=1

sniperwolf64's Avatar
#217 - sniperwolf64 - 173w ago
Thanks a lot man. Will try it and let you know

It didn't work and says device not detected eventhough my dongle shows green light. Also you mentioned that you included the psgrade files but didn't find them in the rar file. One more thing what did you mean by erase first cuz didn't find anything to erase. Hope you can help.

ajsd34's Avatar
#216 - ajsd34 - 173w ago
Thank you for the information.













Affiliates - Contact Us - PS3 Downloads - Privacy Statement - Site Rules - Top - © 2014 PlayStation 3 News