CEX2DEX Application for Any PS3 NOR / NAND Flash Dump Arrives

48w ago - Following up on the recent PS3 C2D CEX to DEX Flash Patcher and PS3Tools GUI Edition v2.6, today I have released a CEX2DEX application that will allow you to extract the METLDR from ANY (NOR / NAND) PlayStation 3 flash dump and create a valid DEX (Debug / Test) flash from the given CEX (Retail) flash.

Download: PS3 CEX2DEX Application / PS3 CEX2DEX Application (Mirror) / MSVCP100.DLL (Required) / Microsoft Visual C++ 2010 Redistributable Package (x86) / PS3 CEX2DEX Application r1 (Runtime Libraries are built in, shouldn't require MS VC++)

Features:

• Can be used to extract the METLDR from ANY (NOR/NAND) flash dump.
  
• Can be used to create a valid DEX flash from any given CEX flash (NOR/NAND).
  

I will explain the two main options the program has.

Extract METLDR - This extracts the metldr from your flash dump so you can use this in the metldrpwn exploit and dump your root key. The dump file created by the metldrpwn exploit can then be loaded into the program (METLDR Dump).
CEX -> DEX - This creates a modified flash dump to convert your CEX into a DEX, the dump created can then be used to be flashed back to your PS3.

I assume you are getting those CMAC errors because you are attempting to use the extracted metldr as the metldr dump. These are two completely different files, the METLDR Dump is the dump file produced by the metldrpwn exploit. Could you show me part of your root key so I can get a better understanding of what you're actually loading.

P.S : Controversy to what the main post says, I flashed my FAT 256MB NAND PS3 via Preloader Advance 3.1.

Also, make it clear that the Extract METLDR function only extracts the METLDR Binary from the flash and DOES NOT dump the root key, linux is required for this!

Also, some insight on how I dumped/flashed my NAND.

Using Preloader Advance 3.1 (JFW is NOT required) I put my PS3 into service mode, put Lv2diag.self and the advance.cfg on a memory stick and put it into USB000 (far right slot). Powered the PS3 on and let it do its work.

Dump NAND Flash
Use my program to create a modified dump, put the dump on the memory stick and name it rflash.bin, make the previous setting (#Backup "rflash" to "/dev_usb000/Backuprflash.bin") to 0 and set this (look below) setting to 1 :

Write NAND Flash
From aldostools on comparing CEX2DEX to the C2D application: If I understand it right, the major differences from this and andbey0nd's C2D.exe are that:

1- This tool supports NAND/NOR flash dumps of CEX, while C2D only supports NOR flash dump of CEX
2- This tool extracts the EID root key (per_console_key) directly from the metldrpwn. So it is not required to hex edit the metldr to extract the first 3 lines (48 bytes).

3- This tool does not require the Win32OpenSSL_Light installed

For the CEX dump, it is still necessary the glevand's dump_flash.pkg (aka USB Flash Dump.pkg I guess that 2 dumps are recommended to compare md5/sha-1 hashes and be sure that it's valid)

For the metldr dump, it is still necessary to have an OFW (<=3.15) or a CFW with dual boot support to boot linux (CFW355-OTHEROS++.PUP), then make and run metldrpwn to dump metldr and a flasher or a tool like JaiCrab's Preloader Advance v3.1 to flash the NOR DEX dump created by this tool. Am I right? or am I missing something ?

PS3 CEX 2 DEX Guide:

Requirements:

1) A PS3 with Firmware 3:55 or less (if less than you should upgrade to 3.55), you must install this CFW using Recovery Mode: gitbrew.org/~glevand/ps3/cfw/CFW355-OTHEROS++-SPECIAL.PUP
2) A USB keyboard and mouse;
3) Red Ribbon Linux on your PS3, you should download and burn this ISO: http://garr.dl.sourceforge.net/project/redribbon/red_ribbon_rc5.rar (Mirrors: http://sourceforge.net/projects/redribbon/files/red_ribbon_rc5.rar/download or also ps3devwiki.com/files/devtools/dump-metldr/Red_Ribbon_RC5.iso)
4) CEX2DEX, downloadable from here: http://puu.sh/IY92
5) metldrpwn, downloadable from here: ps3devwiki.com/files/devtools/dump-metldr/metldrpwn.zip
6) (Optional) although unlikely, is possible brick, so I recommend you have E3 flasher.

Installing Linux:

PKG download these:

• http://gitbrew.org/~glevand/ps3/pkgs/setup_flash_for_otheros.pkg
  
• http://gitbrew.org/~glevand/ps3/pkgs/install_otheros.pkg
  
• http://gitbrew.org/~glevand/ps3/pkgs/boot_otheros.pkg
  
• http://gitbrew.org/~glevand/ps3/pkgs/reboot.pkg
  

And download one of these two files (if you have a NOR take the first, if you have a second NAND).
1. dtbImage.ps3.bin (NOR): http://gitbrew.org/~glevand/ps3/petitboot/dtbImage.ps3.bin

2. dtbImage.ps3.bin.minimal (NAND, to be renamed in dtbImage.ps3.bin): http://gitbrew.org/~glevand/ps3/petitboot/dtbImage.ps3.bin.minimal

Put everything in the root of a USB device and install the PKG. Each application you start before returning to the XMB will make 3 beeps the console, if you do not hear these 3 beeps try again.

1. Run "Setup for OtherOS FLASH", turn the console back to the XMB and restart.
2. Start the "Install OtherOS" (the key with the file dtbImage.ps3.bin must be inserted).

Now connect a USB keyboard and a USB to the console and launched from the XMB "OtherOS Boot" and "Reboot". You'll find yourself in "Petitboot". Using the keyboard, select "Exit to shell" and press enter. Type the following commands:

Now you dump your NOR / NAND USB stick. Turn off the console (ctrl + alt + delete or power button).

Now insert the stick into your PC and extract the folder "metldrpwn" from the "metldrpwn.zip" in the root of the USB stick.
CEX2DEX Start, select your dump and click "Extract metldr", save the file as "metldr" folder "metldrpwn" on your USB stick.

Go back to your PS3, plug in the USB key and the CD with the iso burned previously. From the XMB start again "OtherOS Boot" and "Reboot". This time from Petitboot selected "Red Ribbon OTHEROS live" and wait for the upload. If you do not have a USB hub you unplug the keyboard and mouse to attack, click the first icon in the upper left -> Accessories -> Terminal. Reconnect the keyboard.

Type the following commands in Terminal:

Will appear written, if all goes well you should read it somewhere "problem status (0x00000089)". Type the following commands:

The system will shut down. Go back to your PC and start CEX2DEX, select new dump your flash and the file "dump" that will be on your USB stick, click CEX-> DEX, now you save a file, name it "flashDEX.bin" and save it in the root USB stick.

Return to the PS3, connect the USB stick and remove the CD. Start again "OtherOS Boot" and "Reboot" on Petitboot select "Exit to shell" and Type the following commands:

WARNING : The following command will write the changes on your flash (NOR / NAND) and if you did something wrong you could brick. I do not take responsibility.
Now download a firmware from here DEX: http://www.ps3news.com/forums/downloads.php?do=cat&id=21

And place it in X: \ PS3 \ UPDATE \ PS3UPDAT.PUP (X: is your USB stick)

Turn on the console in recovery mode and select system update. Now you have a Debugging Station.

Finally, below is another PS3 CEX to DEX Guide with No Linux or Hardware Required by ChocoErased (via nextgenupdate.com/forums/playstation-3-exploits-hacks/572924-full-tutorial-cex-dex-no-linux-hardware-required.html):

This is a tutorial from start to finish on how to convert a CEX console to a DEX console. If you don't know what you're doing or need someone to explain what DEX is to you, you should probably leave now. Also, be warned - if you mess up anything in this tutorial, you risk bricking your console. Follow the instructions right and you should be fine.

Note: This conversion does not require the installation of Linux or any hardware modifications, but it is recommended you have an E3 flasher or similar device in case you do end up bricking your console.

You're going to need:

• 3.55 PS3 (preferably running Kmeaw's custom firmware): http://www.ps3news.com/forums/ps3-cfw-mfw/ps3-custom-firmware-modified-firmware-repository-118021.html
  
• USB Device with around 1 gigabyte of free space
  
• Jaicrab's preloader: http://www.mediafire.com/?mtk7t01hkjd3814
  
• FactoryServiceMode Tool: http://www.mediafire.com/?svog7c0zckdhodj
  
• eEID_RKDumper: http://www.ps3news.com/ps3-hacks-jailbreak/ps3-eeid-rkdumper-from-gameos-pkg-by-flat-z-is-now-available/
  
• CEX2DEX Tool: http://www.mediafire.com/?2n0jhx7838qfpq1
  

Once you have all of the above, you're ready to get started

Tutorial

1. Install the FactoryServiceMode pkg on your PS3 and use it to boot your PS3 into Factory Service Mode. When done, confirm your console is in service mode by turning it on and seeing if the red box is there in the lower right hand corner. Power down your PS3.

2. Take all the files from Preloader.zip and extract them onto the root of your USB stick. Rename "Lv2diag.self.flash" to "Lv2diag.self".

3. Eject your USB from your PC and place it in the rightmost USB port of your PS3 (your PS3 needs to be turned off). Once it is securely in place, turn on the console. Nothing is going to come up on the screen, and eventually the PS3 power LED will start blinking. DO NOT TURN OFF THE CONSOLE, it is dumping your NAND/NOR. Wait for it to power down itself.

4. Once your console turns itself off, remove the USB from your PS3 and plug it back into your PC. There will now be a file on it named "Backuprflash.bin" (Note: You may have to enable displaying of system files in order for it to be shown). This is your dump of your NOR/NAND - if your console is NOR, the filesize should be 16mb. If your console is NAND, it will be 256mb.

5. On your USB, rename "Lv2diag.self" back to "Lv2diag.self.flash" and then rename "Lv2diag.self.exit" to "Lv2diag.self". Place the USB in the rightmost USB port of your PS3 (turned off), then turn it on. It should turn itself off after a few seconds. When it turns off, remove your USB and boot the PS3. It should now be out of factory service mode.

6. Install the eEID_RKDumper on your PS3. Run it, and it should cause your console to blackscreen. It will reboot after a few seconds, just give it it's time and don't interrupt it (it is dumping your root key). Once it reboots, proceed to the next step.

7. Use a filemanager or FTP server to retrieve your root key dump from your PS3 - it is located at dev_hdd0/tmp/eid_root_key. It should be 256kb. Get it onto your USB, it should be in the same directory as your Backuprflash.bin. Rename it to "dump" (no file extension).

9. Start up CEX2DEX again on your PC. For the NOR/NAND flash dump, select your Backuprflash.bin. For the METLDR dump, select your rootkey (file named "dump"). Click on CEX -> DEX, and when it prompts you save the new file as "rflash.bin" and put it onto the root of your USB stick. Your NOR/NAND dump is now fully converted to DEX, all that is left is to flash it back onto your PS3. The filesize for rflash.bin should be 16mb for NOR consoles and 256mb for NAND consoles.

10. On your PS3, use FactoryServiceMode Tool to boot into Factory Service Mode again. On your USB, rename "Lv2diag.self" to "Lv2diag.self.exit" and rename "Lv2diag.flash.self" to "Lv2diag.self". Delete the advance.cfg file from the USB, and put this one onto the root of it: advance.cfg

11. Make sure your PS3 is fully powered off, then plug your USB into the rightmost USB port. Turn on the PS3, and it will begin writing to your NAND/NOR. DO NOT TURN OFF THE PS3!!! If you do, it is a guaranteed brick. Just leave it alone until the PS3 turns itself off, it may take 15 minutes or more. Don't worry if it's taking too long, mine took about 40 minutes to write completely. Once your PS3 has powered itself off continue to the next step.

12. On your USB, rename "Lv2diag.self" back to "Lv2diag.self.flash" and then rename "Lv2diag.self.exit" to "Lv2diag.self". Place the USB in the rightmost USB port of your PS3 (turned off), then turn it on. It should turn itself off after a few seconds. When it turns off, remove your USB and boot the PS3. It should now be out of factory service mode. Congratulations, you are now ready to install DEX firmware. I would recommend downloading and installing this debug firmware, from there you can go to 4.20 debug or whatever other version you want.

Important Notes:

• Once you convert to DEX, your console can no longer access the Playstation Network. Your IDPS becomes invalid.
  
• You cannot data transfer from a DEX console to a CEX console.
  
• If you choose to install a debug update of version 3.56 or higher, Peek & Poke will be disabled. This will make certain homebrew applications no longer work.
  
• Most PKGs and homebrew applications will have to be resigned as debug files before they can be installed/run on DEX firmwares above 3.55.
  

I hope this makes the whole process of converting from CEX to DEX easier for some of you. Remember, this is NOT something that the average jailbroken PS3 owner should undertake. Have fun and be safe.