73w ago - Following up on the recent PS3 C2D CEX to DEX Flash Patcher and PS3Tools GUI Edition v2.6, today I have released a CEX2DEX application that will allow you to extract the METLDR from ANY (NOR / NAND) PlayStation 3 flash dump and create a valid DEX (Debug / Test) flash from the given CEX (Retail) flash.
Can be used to extract the METLDR from ANY (NOR/NAND) flash dump.
Can be used to create a valid DEX flash from any given CEX flash (NOR/NAND).
I will explain the two main options the program has.
Extract METLDR - This extracts the metldr from your flash dump so you can use this in the metldrpwn exploit and dump your root key. The dump file created by the metldrpwn exploit can then be loaded into the program (METLDR Dump).
CEX -> DEX - This creates a modified flash dump to convert your CEX into a DEX, the dump created can then be used to be flashed back to your PS3.
I assume you are getting those CMAC errors because you are attempting to use the extracted metldr as the metldr dump. These are two completely different files, the METLDR Dump is the dump file produced by the metldrpwn exploit. Could you show me part of your root key so I can get a better understanding of what you're actually loading.
Also, make it clear that the Extract METLDR function only extracts the METLDR Binary from the flash and DOES NOT dump the root key, linux is required for this!
Also, some insight on how I dumped/flashed my NAND.
Using Preloader Advance 3.1 (JFW is NOT required) I put my PS3 into service mode, put Lv2diag.self and the advance.cfg on a memory stick and put it into USB000 (far right slot). Powered the PS3 on and let it do its work.
Dump NAND Flash
#Backup "rflash" to "/dev_usb000/Backuprflash.bin"
# 0 = Disabled
# 1 = 16MB Nor models and first 16MB from NAND models.
# 2 = 16MB Nor models and 256MB from NAND models.
Use my program to create a modified dump, put the dump on the memory stick and name it rflash.bin, make the previous setting (#Backup "rflash" to "/dev_usb000/Backuprflash.bin") to 0 and set this (look below) setting to 1 :
Write NAND Flash
#Restore "rflash" Fichero origen "/dev_usb000/rflash.bin"
# 0 = Disabled
# 1 = Delete and restore all sectors.
# 2 = Check sectors and only delete/write the differents sectors.(SLOW)
From aldostools on comparing CEX2DEX to the C2D application: If I understand it right, the major differences from this and andbey0nd's C2D.exe are that:
1- This tool supports NAND/NOR flash dumps of CEX, while C2D only supports NOR flash dump of CEX
2- This tool extracts the EID root key (per_console_key) directly from the metldrpwn. So it is not required to hex edit the metldr to extract the first 3 lines (48 bytes).
3- This tool does not require the Win32OpenSSL_Light installed
For the CEX dump, it is still necessary the glevand's dump_flash.pkg (aka USB Flash Dump.pkg I guess that 2 dumps are recommended to compare md5/sha-1 hashes and be sure that it's valid)
For the metldr dump, it is still necessary to have an OFW (<=3.15) or a CFW with dual boot support to boot linux (CFW355-OTHEROS++.PUP), then make and run metldrpwn to dump metldr and a flasher or a tool like JaiCrab's Preloader Advance v3.1 to flash the NOR DEX dump created by this tool. Am I right? or am I missing something ?
PS3 CEX 2 DEX Guide:
1) A PS3 with Firmware 3:55 or less (if less than you should upgrade to 3.55), you must install this CFW using Recovery Mode: gitbrew.org/~glevand/ps3/cfw/CFW355-OTHEROS++-SPECIAL.PUP
2) A USB keyboard and mouse;
3) Red Ribbon Linux on your PS3, you should download and burn this ISO: http://garr.dl.sourceforge.net/project/redribbon/red_ribbon_rc5.rar (Mirrors: http://sourceforge.net/projects/redribbon/files/red_ribbon_rc5.rar/download or also ps3devwiki.com/files/devtools/dump-metldr/Red_Ribbon_RC5.iso)
4) CEX2DEX, downloadable from here: http://puu.sh/IY92
5) metldrpwn, downloadable from here: ps3devwiki.com/files/devtools/dump-metldr/metldrpwn.zip
6) (Optional) although unlikely, is possible brick, so I recommend you have E3 flasher.
And download one of these two files (if you have a NOR take the first, if you have a second NAND).
1. dtbImage.ps3.bin (NOR): http://gitbrew.org/~glevand/ps3/petitboot/dtbImage.ps3.bin
2. dtbImage.ps3.bin.minimal (NAND, to be renamed in dtbImage.ps3.bin): http://gitbrew.org/~glevand/ps3/petitboot/dtbImage.ps3.bin.minimal
Put everything in the root of a USB device and install the PKG. Each application you start before returning to the XMB will make 3 beeps the console, if you do not hear these 3 beeps try again.
1. Run "Setup for OtherOS FLASH", turn the console back to the XMB and restart.
2. Start the "Install OtherOS" (the key with the file dtbImage.ps3.bin must be inserted).
Now connect a USB keyboard and a USB to the console and launched from the XMB "OtherOS Boot" and "Reboot". You'll find yourself in "Petitboot". Using the keyboard, select "Exit to shell" and press enter. Type the following commands:
mount -n -o remount,rw /dev/sda1 /tmp/petitboot/mnt/sda1
Now you dump your NOR / NAND USB stick. Turn off the console (ctrl + alt + delete or power button).
Now insert the stick into your PC and extract the folder "metldrpwn" from the "metldrpwn.zip" in the root of the USB stick.
CEX2DEX Start, select your dump and click "Extract metldr", save the file as "metldr" folder "metldrpwn" on your USB stick.
Go back to your PS3, plug in the USB key and the CD with the iso burned previously. From the XMB start again "OtherOS Boot" and "Reboot". This time from Petitboot selected "Red Ribbon OTHEROS live" and wait for the upload. If you do not have a USB hub you unplug the keyboard and mouse to attack, click the first icon in the upper left -> Accessories -> Terminal. Reconnect the keyboard.
Type the following commands in Terminal:
sudo umount /dev/sda1
sudo mkdir usb
sudo mount /dev/sda1 usb
sudo sh run.sh
Will appear written, if all goes well you should read it somewhere "problem status (0x00000089)". Type the following commands:
sudo cp /proc/metldrpwn/dump usb/dump
sudo shutdown -h now
The system will shut down. Go back to your PC and start CEX2DEX, select new dump your flash and the file "dump" that will be on your USB stick, click CEX-> DEX, now you save a file, name it "flashDEX.bin" and save it in the root USB stick.
Return to the PS3, connect the USB stick and remove the CD. Start again "OtherOS Boot" and "Reboot" on Petitboot select "Exit to shell" and Type the following commands:
mount -n -o remount,rw /dev/sda1 /tmp/petitboot/mnt/sda1
WARNING : The following command will write the changes on your flash (NOR / NAND) and if you did something wrong you could brick. I do not take responsibility.
And place it in X: \ PS3 \ UPDATE \ PS3UPDAT.PUP (X: is your USB stick)
Turn on the console in recovery mode and select system update. Now you have a Debugging Station.
Finally, below is another PS3 CEX to DEX Guide with No Linux or Hardware Required by ChocoErased (via nextgenupdate.com/forums/playstation-3-exploits-hacks/572924-full-tutorial-cex-dex-no-linux-hardware-required.html):
This is a tutorial from start to finish on how to convert a CEX console to a DEX console. If you don't know what you're doing or need someone to explain what DEX is to you, you should probably leave now. Also, be warned - if you mess up anything in this tutorial, you risk bricking your console. Follow the instructions right and you should be fine.
Note: This conversion does not require the installation of Linux or any hardware modifications, but it is recommended you have an E3 flasher or similar device in case you do end up bricking your console.
Once you have all of the above, you're ready to get started
1. Install the FactoryServiceMode pkg on your PS3 and use it to boot your PS3 into Factory Service Mode. When done, confirm your console is in service mode by turning it on and seeing if the red box is there in the lower right hand corner. Power down your PS3.
2. Take all the files from Preloader.zip and extract them onto the root of your USB stick. Rename "Lv2diag.self.flash" to "Lv2diag.self".
3. Eject your USB from your PC and place it in the rightmost USB port of your PS3 (your PS3 needs to be turned off). Once it is securely in place, turn on the console. Nothing is going to come up on the screen, and eventually the PS3 power LED will start blinking. DO NOT TURN OFF THE CONSOLE, it is dumping your NAND/NOR. Wait for it to power down itself.
4. Once your console turns itself off, remove the USB from your PS3 and plug it back into your PC. There will now be a file on it named "Backuprflash.bin" (Note: You may have to enable displaying of system files in order for it to be shown). This is your dump of your NOR/NAND - if your console is NOR, the filesize should be 16mb. If your console is NAND, it will be 256mb.
5. On your USB, rename "Lv2diag.self" back to "Lv2diag.self.flash" and then rename "Lv2diag.self.exit" to "Lv2diag.self". Place the USB in the rightmost USB port of your PS3 (turned off), then turn it on. It should turn itself off after a few seconds. When it turns off, remove your USB and boot the PS3. It should now be out of factory service mode.
6. Install the eEID_RKDumper on your PS3. Run it, and it should cause your console to blackscreen. It will reboot after a few seconds, just give it it's time and don't interrupt it (it is dumping your root key). Once it reboots, proceed to the next step.
7. Use a filemanager or FTP server to retrieve your root key dump from your PS3 - it is located at dev_hdd0/tmp/eid_root_key. It should be 256kb. Get it onto your USB, it should be in the same directory as your Backuprflash.bin. Rename it to "dump" (no file extension).
9. Start up CEX2DEX again on your PC. For the NOR/NAND flash dump, select your Backuprflash.bin. For the METLDR dump, select your rootkey (file named "dump"). Click on CEX -> DEX, and when it prompts you save the new file as "rflash.bin" and put it onto the root of your USB stick. Your NOR/NAND dump is now fully converted to DEX, all that is left is to flash it back onto your PS3. The filesize for rflash.bin should be 16mb for NOR consoles and 256mb for NAND consoles.
10. On your PS3, use FactoryServiceMode Tool to boot into Factory Service Mode again. On your USB, rename "Lv2diag.self" to "Lv2diag.self.exit" and rename "Lv2diag.flash.self" to "Lv2diag.self". Delete the advance.cfg file from the USB, and put this one onto the root of it: advance.cfg
11. Make sure your PS3 is fully powered off, then plug your USB into the rightmost USB port. Turn on the PS3, and it will begin writing to your NAND/NOR. DO NOT TURN OFF THE PS3!!! If you do, it is a guaranteed brick. Just leave it alone until the PS3 turns itself off, it may take 15 minutes or more. Don't worry if it's taking too long, mine took about 40 minutes to write completely. Once your PS3 has powered itself off continue to the next step.
12. On your USB, rename "Lv2diag.self" back to "Lv2diag.self.flash" and then rename "Lv2diag.self.exit" to "Lv2diag.self". Place the USB in the rightmost USB port of your PS3 (turned off), then turn it on. It should turn itself off after a few seconds. When it turns off, remove your USB and boot the PS3. It should now be out of factory service mode. Congratulations, you are now ready to install DEX firmware. I would recommend downloading and installing this debug firmware, from there you can go to 4.20 debug or whatever other version you want.
Once you convert to DEX, your console can no longer access the Playstation Network. Your IDPS becomes invalid.
You cannot data transfer from a DEX console to a CEX console.
If you choose to install a debug update of version 3.56 or higher, Peek & Poke will be disabled. This will make certain homebrew applications no longer work.
Most PKGs and homebrew applications will have to be resigned as debug files before they can be installed/run on DEX firmwares above 3.55.
I hope this makes the whole process of converting from CEX to DEX easier for some of you. Remember, this is NOT something that the average jailbroken PS3 owner should undertake. Have fun and be safe.
Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!
I want to downgrade my ps3 from 4.46 to 3.55 so i can install MLT Dex firmware 4.41. The ps3 has no working bluray or logic board. There is something im worried about. Will i be able to downgrade from 4.46 to 3.55 without either bluray or logic board? i think rogero downgrade is no BT/logic board patched, but i'm wondering about the part where i need to QA Toggle the ps3. Is there a way to enable QA toggle on 4.46 or 4.50?
MLT cfw 4.46 and 4.50 has a way of launching homebrew without bluray or logic board but i dont think i can with cfw 3.55. My plan is to upgrade from 4.46 to 4.50 MLT first to pick up eid_Root_Key that is needed for dex firmware, downgrade to 3.55 then back up to dex 4.41
i really need help with this since i dont have a flasher + its PHAT 60 gb ps3 meaning if i fail then flashing it would be a lot harder/expensive. Much cheers for any replies/comments!
ok im really pissed of by "A system software is required, Go to settings > system update and perform the update." I've been trying 2 figure out how to access psn wile on 4.21 DEX. any 4.46 spoofer or any help please, rebug toolbox and eid spoofer doesnt do jack for psn? after i access psn hopefully, i gonna rtm. please help me anyone?
First you need to dump your EID Root Key which must be done on 3.55 cfw (downgrade using the 999 pup if needed).
Install and run the eEID_RKDumper.pkg, the PS3 will just show a black screen and beep several times. You can now restart the PS3 and retrieve your eid_root_key from /dev_hdd0/tmp/.
That is all you need from 3.55, you can go back to rebug 4.21.
You can do this on rebug 4.21 using the toolbox.
Find the option "Export Flash to File", this will dump it to USB001 (right slot).
Converting your CEX dump to DEX
First download and extract the c2d_openssl.rar to C:/ and install openSSL, this is required for c2d to work properly. Make sure you rename the folder to "openssl".
Now take you eid_root_key and your NOR/NAND dump and place in the folder with c2d.
Rename your original CEX dump to flashCEX.bin
Add .bin extension to eid_root_key.
Should now have a folder like this:
Open a CMD window in the current directory (CTRL+SHIFT + right click > Open a command window here)
(Note: Do not put the brackets when typing in your target id.)
Here's an example:
Should give you an output like this:
If you are unsure you have done it correctly, you can convert back to your original target ID (mine is 87)
Then compare this one with your original and they should match.
Switching to DEX using rebug 4.21
Take your two dumps (flashCEX.bin + flashDEX.bin) and rename as below:
Rename your original CEX dump to CEX-FLASH.EID0.NORBIN (16mb) or CEX-FLASH.EID0.NANDBIN (239mb or 256mb)
Rename your converted DEX dump to DEX-FLASH.EID0.NORBIN (16mb) or DEX-FLASH.EID0.NANDBIN (239mb or 256mb)
Then place on USB001 (right slot)
Load up Rebug Toolbox and first click the option:
A couple of warning boxes pop up, click YES to both.
Now Swap LV2 kernal, reboot and you are in DEX Mode within 10 seconds
Switching back to CEX
Very easy, simply rewrite target ID and it will auto swap lv2 kernal to CEX.
To access PSN in DEX mode, there is a feature in Rebug Toolbox to spoof IDPS. Choose EID5 and you will be able to sign in fine. Btw, if anything in this tut doesn't make sense - let me know so i can make it even more noob friendly.