To quote: Here comes my initial release of a NOR flasher soft for the PS3 called "NORway". I know, there are other "WIP" projects, but I got a little impatient, so I've decided to create my own solution. It's a port of "noralizer" by marcan, a pretty good working NOR flasher implementation for another FPGA board.
Anyway, here's the README.txt, which should explain everything: NORway v0.1
This project has been ported for the Teensy++ 2.0 from the original NOR flasher tool ("noralizer" by Hector Martin "marcan" ) that was used to flash AsbestOS onto the demo PS3 at 27C3, and for experimentation.
\teensy\NORway.avrsln - Source code for the Teensy++ 2.0 (AVR Studio 5.0)
\teensy\default\NORway.hex - Compiled hex-file for the Teensy++ 2.0 (AT90USB1286)
\hwinstall\install-*.jpg - Some pics of how I've mounted the Teensy (CECH-2504A/B)
\hwinstall\nor_testpoints.png - Connection diagram of the NOR testpoints (CECH-2504A/B)
\serial_install.exe - Teensy serial drivers for Windows
\README.txt - this file
\NORway.py - PC Python client
Hardware connections (see "\hwinstall\nor_testpoints.png"):
Install Python + pyserial (see "Prerequisites for Windows"). Install drivers. Connect Teensy to your PC. Flash Teensy with "\teensy\default\NORway.hex" and reset it after completion. Start Windows' "Device Manager", expand the "Ports (COM & LPT)" node, you should see something like "USB Serial (Communication Class, Abstract Control Model) (COM4)". This tells you that "COM4" (or whatever shows up) is the COM port used by Teensy.
At the command prompt enter "NORway.py" to display help.
Procedure to dump your flash:
- PS3 is turned off
- At the command prompt enter:
- Turn on your PS3, it shouldn't boot
- At the command prompt enter:
NORway.py dump flash.bin
- When dumping is finished enter:
- Power off your PS3 (disconnect Teensy if PS3 doesn't boot when restarted)
Dumping takes about 3 minutes. A file "flash.bin" with a size of exactly 16 MB (16.777.216 bytes) has been created in your current directory.
Flashing is rather slow. Writing a complete flash with the "write" command takes about 2 hours. Might be improved in future versions...
Before you flash your PS3 with anything new, make sure that the content of your dump is correct (e.g. compare ros0/ros1 area of your dump against "CORE_OS_PACKAGE.bin" from an actual PS3UPDAT.PUP of your current firmware). And keep your original dump in a safe place. You might need it.
It's tested on Win7 x86, but should also work just fine on any x86 Windows >=XP. Basically it should also work on Linux, but I didn't test. If you're running Linux, you probably know what to do. Serial drivers are not required for Linux.
Unfortunately I couldn't manage to make it work on any x64 version of Windows, because of the Python pyserial module.
Thanks to "marcan" for the original implementation.
-- judges (judges at eEcho.com)
P.S: I've already managed to downgrade my OFW 3.61 to CFW 3.55. There're minor things to rule out, but expect a downgrade tutorial coming soon..
PPS: Thanks to defyboy for the original idea of using a Teensy for flashing!
Update 28th July, 2011: v0.2 released! Documentation updated to include the required 3.3V voltage regulator plus Teensy clock rate changed to 8 MHz!
Update 9th August, 2011: NORway v0.3 has been released!
Dumping now only takes 45 secs instead of over 5 mins! Writing now only takes about 8.5 mins instead of over 2 hours!
[jevin] judges check out http://pastie.org/2527251
[jevin] its modified to support samsung chips
[jevin] it does chip erase twice (a22 low/high)
[jevin] and does single-word, unlocked programming of the entire chip
[jevin] it doesnt support programming ranges because i haven't bothered with partial erases yet
[jevin] 99% untested
[jevin] it executes when not hooked up to my ps3
Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!
Thanks for this great tutorial, I try dump my flash on a 3.56v1 FAT Ps3 (the motherboard is the same in this post) but I'm not sure if the dump are correctly dumped. Who I can check it? I would not try to flash it and finally kill the Ps3
Sorry for my bad English, and thanks for the help.
Below is a roughly translated guide from calimba on how to do a PS3 NOR dump with a Teensy 2.0++ device: demonhades.org/foro/viewtopic.php?f=224&t=4892#p31010. I have also added the NORway v0.2 for PS3 update to the first post.
Community well this is my first tutorial I hope you understand me. I'll be putting images to be more clear, then began:
Teensy 2.0 + +
Obviously a PC
1. Unzip the Norway where we want and install the serial_install.exe that comes inside the zip then download it and install it.
2. Program with the Teensy hex that is inside the folder "default" of Norway
3. Solder to play the 3 because of the review board is different from the diagram, here are a few. I used this:
And these are the points of the teensy:
4. Ya all welded to the plate and console ps3 off with the red LED and connect the usb to pc teensy then went into the Device Manager and look for Ports (COM & LPT) as you can see the next image to I really teensy detected in COM3
5. Open the windows command line CMD and go as far as Norway and unpack the NORway.py write in my case COM3
6. Then ignition internal green LED console and type in CMD flash.bin NORway.py COM3 dump and start making the dump, as you'll see in the image does not take much 2 minutes 38 seconds
7. Last step. After the dump CMD wrote in COM3 NORway.py NOR release to reset and turn off the console and disconnect the teensy and ready and we have the dump of the NOR
PS: I'm not very good with photocase this
PD2: I did everything in windows 7 x64
I want to thank Demonhades, Jaicrab rather the entire mark HadesTeam also thank the Judges and Norway