NORway PS3 NOR Flasher Software for Teensy++ 2.0 Dev Boards

95w ago - Following up on the previous PS3 NOR Flash dumping updates from uf6667 and No_One, today judges has released Teensy++ 2.0 Flasher Software called NORway for PlayStation 3 developers.

Download: NORway v0.1 for PS3 / NORway v0.1 for PS3 (Mirror) / PS3 NOR Testpoints / NORway v0.2 for PS3 / NORway v0.3 for PS3 / NORway (Python Script) v0.3 for PS3 by jevin / NORway v0.4 for PS3 / NORway v0.5 for PS3 / PS3 NOR Dump with Teensy 2.0++ Guide / GIT

To quote: Here comes my initial release of a NOR flasher soft for the PS3 called "NORway". I know, there are other "WIP" projects, but I got a little impatient, so I've decided to create my own solution. It's a port of "noralizer" by marcan, a pretty good working NOR flasher implementation for another FPGA board.

Anyway, here's the README.txt, which should explain everything: NORway v0.1

This project has been ported for the Teensy++ 2.0 from the original NOR flasher tool ("noralizer" by Hector Martin "marcan" ) that was used to flash AsbestOS onto the demo PS3 at 27C3, and for experimentation.

Contents:

\teensy\NORway.avrsln - Source code for the Teensy++ 2.0 (AVR Studio 5.0)
\teensy\default\NORway.hex - Compiled hex-file for the Teensy++ 2.0 (AT90USB1286)
\hwinstall\install-*.jpg - Some pics of how I've mounted the Teensy (CECH-2504A/B)
\hwinstall\nor_testpoints.png - Connection diagram of the NOR testpoints (CECH-2504A/B)
\serial_install.exe - Teensy serial drivers for Windows
\README.txt - this file
\NORway.py - PC Python client

Hardware connections (see "\hwinstall\nor_testpoints.png"):

PS3 Teensy
A0-7 PF0-7
A8-15 PA0-7
A16-22 PB0-7
D0-7 PD0-7
D8-15 PC0-7
CE# PE0
OE# PE1
RESET# PE4
WE# PE5
RY/BY# PE6
TRISTATE# PE7
GND GND

There are no modifications to the Teensy itself required. Don't install any power regulators, don't cut any traces.

DON'T CONNECT THE VCC SOLDER PADS TO ANYTHING!

Connection diagrams for other boards can be found at: http://ps3devwiki.com/index.php?title=Hardware_flashing

Prerequisites for Windows:

Python 2.7.2 (http://www.python.org/ftp/python/2.7.2/python-2.7.2.msi)
pyserial 2.5 (http://pypi.python.org/packages/any/p/pyserial/pyserial-2.5.win32.exe)

Usage:

Install Python + pyserial (see "Prerequisites for Windows"). Install drivers. Connect Teensy to your PC. Flash Teensy with "\teensy\default\NORway.hex" and reset it after completion. Start Windows' "Device Manager", expand the "Ports (COM & LPT)" node, you should see something like "USB Serial (Communication Class, Abstract Control Model) (COM4)". This tells you that "COM4" (or whatever shows up) is the COM port used by Teensy.

At the command prompt enter "NORway.py" to display help.

Procedure to dump your flash:

- PS3 is turned off
- At the command prompt enter:

NORway.py
- Turn on your PS3, it shouldn't boot
- At the command prompt enter:
NORway.py dump flash.bin
- When dumping is finished enter:
NORway.py release
- Power off your PS3 (disconnect Teensy if PS3 doesn't boot when restarted)

Dumping takes about 3 minutes. A file "flash.bin" with a size of exactly 16 MB (16.777.216 bytes) has been created in your current directory.

Flashing is rather slow. Writing a complete flash with the "write" command takes about 2 hours. Might be improved in future versions...

IMPORTANT:

Before you flash your PS3 with anything new, make sure that the content of your dump is correct (e.g. compare ros0/ros1 area of your dump against "CORE_OS_PACKAGE.bin" from an actual PS3UPDAT.PUP of your current firmware). And keep your original dump in a safe place. You might need it.

It's tested on Win7 x86, but should also work just fine on any x86 Windows >=XP. Basically it should also work on Linux, but I didn't test. If you're running Linux, you probably know what to do. Serial drivers are not required for Linux.

Unfortunately I couldn't manage to make it work on any x64 version of Windows, because of the Python pyserial module.

Thanks to "marcan" for the original implementation.

-- judges (judges at eEcho.com)

P.S: I've already managed to downgrade my OFW 3.61 to CFW 3.55. There're minor things to rule out, but expect a downgrade tutorial coming soon..
PPS: Thanks to defyboy for the original idea of using a Teensy for flashing!

Update 28th July, 2011: v0.2 released! Documentation updated to include the required 3.3V voltage regulator plus Teensy clock rate changed to 8 MHz!

Update 9th August, 2011: NORway v0.3 has been released!

Dumping now only takes 45 secs instead of over 5 mins! Writing now only takes about 8.5 mins instead of over 2 hours!

[jevin] judges check out http://pastie.org/2527251
[jevin] its modified to support samsung chips
[jevin] it does chip erase twice (a22 low/high)
[jevin] and does single-word, unlocked programming of the entire chip
[jevin] it doesnt support programming ranges because i haven't bothered with partial erases yet
[jevin] 99% untested
[jevin] it executes when not hooked up to my ps3