43w ago - Following up on his
previous release, today PlayStation 3 developer
judges has updated the Teensy++ 2.0 NOR flasher NORway for PS3 to version 0.5 with the changes outlined below.
Download:
NORway PS3 NOR Flasher for PS3 v0.5 /
NORway PS3 NOR Flasher for PS3 v0.5 (Mirror) /
NORway PS3 NOR Flasher for PS3 v0.6 Beta /
NORway Latest Beta /
GIT
NORway v0.5 Changelog:
- Added block table for Samsung K8Q2815UQB. The programming modes "writeword" and "writewordubm" don't require manual chip/sector erase prior to writing anymore!
- Bugfix: "NORway.py COMx release" didn't work. Now you can leave Teensy powered at all times and console will boot up correctly after issuing a "release" command
- Bugfix: increased TRANSMIT_TIMEOUT for Teensy's serial device to 10000ms (required for OS X)
- Bugfix: disabled DSR/DTR flow control (wasn't working reliably on OS X)
- Bugfix: TRISTATE wasn't set correctly
- Added additional verification when writing is done. Although each write command verifies each written sector/block, it happened that written bytes weren't persistent
- Added "verify" command
NORway v0.6 Beta Changelog:
- Changed programming modes "write", "writeword" and "writewordubm" to "vwrite", "vwriteword" and "vwritewordubm".
- Added new programming modes that skip verification for single 4KB blocks: "write", "writeword" and "writewordubm".
- Moved verification algorithm to Teensy.
No.
Are you sad?...
...
Download: PS3 NOR Testpoints / PS3 NOR Dump with Teensy 2.0++ Guide / [url=http://git.dashhacks.com/norway
To quote: Here comes my initial release of a NOR flasher soft for the PS3 called "NORway". I know, there are other "WIP" projects, but I got a little impatient, so I've decided to create my own solution. It's a port of "noralizer" by marcan, a pretty good working NOR flasher implementation for another FPGA board.
Anyway, here's the README.txt, which should explain everything: NORway v0.1
This project has been ported for the Teensy++ 2.0 from the original NOR flasher tool ("noralizer" by Hector Martin "marcan" ) that was used to flash AsbestOS onto the demo PS3 at 27C3, and for experimentation.
Contents:
\teensy\NORway.avrsln - Source code for the Teensy++ 2.0 (AVR Studio 5.0)
\teensy\default\NORway.hex - Compiled hex-file for the Teensy++ 2.0 (AT90USB1286)
\hwinstall\install-*.jpg - Some pics of how I've mounted the Teensy (CECH-2504A/B)
\hwinstall\nor_testpoints.png - Connection diagram of the NOR testpoints (CECH-2504A/B)
\serial_install.exe - Teensy serial drivers for Windows
\README.txt - this file
\NORway.py - PC Python client
Hardware connections (see "\hwinstall\nor_testpoints.png"):
PS3 Teensy
A0-7 PF0-7
A8-15 PA0-7
A16-22 PB0-7
D0-7 PD0-7
D8-15 PC0-7
CE# PE0
OE# PE1
RESET# PE4
WE# PE5
RY/BY# PE6
TRISTATE# PE7
GND GND
There are no modifications to the Teensy itself required. Don't install any power regulators, don't cut any traces.
DON'T CONNECT THE VCC SOLDER PADS TO ANYTHING!
Connection diagrams for other boards can be found at: http://ps3devwiki.com/index.php?title=Hardware_flashing
Prerequisites for Windows:
Python 2.7.2 (http://www.python.org/ftp/python/2.7.2/python-2.7.2.msi)
pyserial 2.5 (http://pypi.python.org/packages/any/p/pyserial/pyserial-2.5.win32.exe)
Usage:
Install Python + pyserial (see "Prerequisites for Windows"). Install drivers. Connect Teensy to your PC. Flash Teensy with "\teensy\default\NORway.hex" and reset it after completion. Start Windows' "Device Manager", expand the "Ports (COM & LPT)" node, you should see something like "USB Serial (Communication Class, Abstract Control Model) (COM4)". This tells you that "COM4" (or whatever shows up) is the COM port used by Teensy.
At the command prompt enter "NORway.py" to display help.
Procedure to dump your flash:
- PS3 is turned off
- At the command prompt enter:
NORway.py
- Turn on your PS3, it shouldn't boot
- At the command prompt enter:
NORway.py dump flash.bin
- When dumping is finished enter:
NORway.py release
- Power off your PS3 (disconnect Teensy if PS3 doesn't boot when restarted)
Dumping takes about 3 minutes. A file "flash.bin" with a size of exactly 16 MB (16.777.216 bytes) has been created in your current directory.
Flashing is rather slow. Writing a complete flash with the "write" command takes about 2 hours. Might be improved in future versions...
IMPORTANT:
Before you flash your PS3 with anything new, make sure that the content of your dump is correct (e.g. compare ros0/ros1 area of your dump against "CORE_OS_PACKAGE.bin" from an actual PS3UPDAT.PUP of your current firmware). And keep your original dump in a safe place. You might need it.
It's tested on Win7 x86, but should also work just fine on any x86 Windows >=XP. Basically it should also work on Linux, but I didn't test. If you're running Linux, you probably know what to do.
Unfortunately I couldn't manage to make it work on any x64 version of Windows, because of the Python pyserial module.
Thanks to "marcan" for the original implementation.
-- judges (judges at eEcho.com)
P.S: I've already managed to downgrade my OFW 3.61 to CFW 3.55. There're minor things to rule out, but expect a downgrade tutorial coming soon..
PPS: Thanks to defyboy for the original idea of using a Teensy for flashing!
Update 28th July, 2011: v0.2 released! Documentation updated to include the required 3.3V voltage regulator plus Teensy clock rate changed to 8 MHz!
Update 9th August, 2011: NORway v0.3 has been released!
Dumping now only takes 45 secs instead of over 5 mins! Writing now only takes about 8.5 mins instead of over 2 hours!
[jevin] judges check out http://pastie.org/2527251
[jevin] its modified to support samsung chips
[jevin] it does chip erase twice (a22 low/high)
[jevin] and does single-word, unlocked programming of the entire chip
[jevin] it doesnt support programming ranges because i haven't bothered with partial erases yet
[jevin] 99% untested
[jevin] it executes when not hooked up to my ps3
More PlayStation 3 News...