44w ago - Following up on his
initial release, today PlayStation 3 developer
andbey0nd has updated his PS3 C2D.exe CEX to DEX Flash Patcher to version 2 which now includes Region / TargetID changing in the PS3 NOR Flash as outlined below.
Download:
PS3 C2D CEX to DEX Flash Patcher v2 /
PS3 C2D CEX to DEX Flash Patcher v2 (Mirror) /
PS3 C2D CEX to DEX Flash Patcher v2 (Mirror #2) /
PS3 C2D CEX to DEX Flash Patcher v2 (Mirror #3) /
Metldrpwn (Pre-compiled) /
C2D for 0x8D (China) Targets /
C2D for 0x8E (HK) Targets by
deank
To quote from the ReadMe file (via pastie.org/4282714):
c2d.exe (win32 app)
Requires:
- OpenSSL 1.0.1 installed in c:\openssl or d:\openssl (http://slproweb.com/download/Win32OpenSSL_Light-1_0_1c.exe)
- EID root key (per_console_key) obtained with metldrpwn
- PS3 (NOR) flash dump
- Extract c2d.rar in a local folder (c:\c2d or d:\c2d)
Purpose:
- Allows changing the Region / TargetID of your PS3 system
- Allows "converting" any Retail PS3 into Debug unit (target_id 0x82)
- Allows "converting" a Retail PS3 from one region to another (i.e. EUR PS3 -> JAP PS3, USA PS3 -> RUSSIAN PS3)
- Changing a Retail PS3 region unlocks playback for region-locked DVD/Blu-ray movies and PS1/PS3 games
WARNING: For best results flash the output NOR file with a tool which rewrites *ONLY the EID0 sector* (one sector / 512 bytes @ sector #376 / 0x178; NOR file offset 0x2f000-0x2f1ff). Flashing the whole 16MB NOR is not needed and can easily brick the PS3.
TIPS:
- Use your original NOR flash to create new files for different regions for your PS3 to have them handy later:
For example you can have (each file is 16MB):
- my-slim-JAP.EID0.NORBIN
- my-slim-EUR.EID0.NORBIN
- my-slim-USA.EID0.NORBIN
- my-slim-DEX.EID0.NORBIN
* Using a proper tool you can switch regions in one second when needed
PROTIPS:
- The latest online debug update of multiMAN 04.04.03 handles writing to NOR in the right fashion (1 sector) from .EID0.NORBIN files.
- To dump NOR: mmOS->Select any file->Open in HEX viewer->[SELECT]->[START]->DUMP LV2(NO)->DUMP LV1(NO)->DUMP FLASH(YES)
- To write EID0 sector: mmOS->Double-click on a .EID0.NORBIN 16MB full NOR dump file->Follow the on-screen instructions->Reboot.
Usage:
c2d - Changes REGION/TARGET_ID in PS3 NOR flash
Usage: c2d.exe eid_key_file.bin in_flash.bin out_flash.bin [target_id]
[target_id]: 82..8C
82 (DEX) (default)
83 (JAPAN)
84 (USA/CANADA)
85 (EUROPE)
86 (KOREA)
87 (UK)
88 (MEXICO)
89 (AUSTRALIA)
8A (SE ASIA)
8B (TAIWAN)
8C (RUS/ASIA)
Output:
c:\c2d> c2d.exe eid_root_key.bin flashCEX.bin flashDEX.bin 82
EID key : 48 bytes (eid_root_key.bin)
Flash size : 16 MB (flashCEX.bin)
Target ID : $85
EID ROOT KEY: 64D20967DEACDA16ACADBE289B0EE2C25EE77331A5040C5DC9DF67B3FE574F6D
EID ROOT IV : 6BD7C324D3B213A647DC31987345595E
EID0 KEY : 9C1C4A93666EF67941F54679A7199D7553C8F0F50F3548C8966D6872FC8CD668
EID0 IV : 2DC374E270F851EB0D524F89790F2563
EID0 SEC KEY: 4C40F3E244EF2BF29A9D48BE26FEEEEB
Target ID : $85 (from decrypted EID0 section)
New TargetID: $82 (for modified flash)
CMAC HASH : F1053CC3818DD6CE2775F0273DFC212E
Writing modified flash with TargetID: $82 (flashDEX.bin)...
Done!
Enjoy!
andbey0nd
Note: TargetID/RegionCode is one and the same. DEX target/region is 82. 0x84 is USA RETAIL PS3, 0x82 is Debug/DEX.
Below are a few additional guides from Sony PlayStation 3 hacker
deank as follows:
DeanK's OtherOS with METLDRPWN PUP Installation / Usage Tutorial (via ps3crunch.net/forum/threads/4111-C2D?p=45668#post45668)
Ok, folks... I prepared a 218MB rar package to make things easier. It includes everything you need, except for RedRibbon (you'll have to download it yourself -> http://sourceforge.net/projects/redribbon/files/red_ribbon_rc5.rar/download).
PS3_OTHEROS_LINUX_METLDRPWN.rar (218.21MB) http://www.sendspace.com/file/durszk (Original Version)
PS3_OTHEROS_LINUX_METLDRPWN.rar (217.49MB) http://www.sendspace.com/file/ly22vs (New Version - Recommended)
You can also use this smaller download if you already have OTHEROS-22GB.PUP downloaded:
PS3_OTHEROS_SETUP_METLDRPWN.rar (48.33MB) http://www.sendspace.com/file/odyz6z (Original Version)
PS3_OTHEROS_SETUP_METLDRPWN.rar (52.25MB) http://www.sendspace.com/file/6fmvsk (Older Version)
PS3_OTHEROS_SETUP_METLDRPWN.rar (46.67MB) http://www.sendspace.com/file/exoe5i (Old Version)
PS3_OTHEROS_SETUP_METLDRPWN.rar (46.85MB) http://www.sendspace.com/file/n238uk (New Version - Recommended)
You can download the OTHEROS PUP separately directly from glevand's repo and save it as \PS3\UPDATE\PS3UPDAT.PUP on your USB: http://gitbrew.org/~glevand/ps3/cfw/CFW355-OTHEROS++-22GB.PUP
Download and follow the instructions. You need a USB hdd to extract this package to the root folder of the USB and also Red-Ribbon.iso extracted in the root folder of the same USB. The rar contains:
- c2d tool / openssl installer
- metldrpwn folder with precompiled metldrpwn.ko module for Red Ribbon
- multiMAN (for CEX and DEX) (no backups on DEX)
- norunpack (+cygwin1.dll)
- PS3\UPDATE\PS3UPDAT.PUP (otheros-22GB.PUP)
- create_hdd_region.sh
- 4 packages needed to setup OtherOS from XMB/GameOS + flash image for NORs (dtbImage.ps3.bin)
Instructions
That's all you need.
NOTE:
- These instructions are only for PS3 systems with NOR flash
- Following these instructions will result in formatting your internal PS3 HDD. All data will be lost.
- Before you continue, make sure that you backup all valuable data, saves, games
- USB required with 1GB free space
- Extract the contents of this package to the root folder of your USB drive
- Download and extract RedRibbon Linux (steps 13, 14) to the root folder of your USB drive
- Create a dump of your NOR (use multiMAN to create a .NORBIN file - USB connected as /dev_usb000 required) - To dump NOR: mmOS->Select any file->Open in HEX viewer->[SELECT]->[START]->DUMP LV2(NO)->DUMP LV1(NO)->DUMP FLASH(YES)
- Transfer to your PC and unpack it with norunpack.exe or cex2dex to a folder and grab "metldr" from the "asecure_loader" folder
- Put "metldr" into the "metldrpwn" folder on your USB
1. Go to "System Update" and Install OTHEROS-22GB.PUP from USB (provided as \PS3\UPDATE\PS3UPDAT.PUP in this package)
2. When installation is finished, reboot in "Recovery Mode" and choose "Restore PS3 System" (not the Backup/Restore in XMB)
3. Now 22GB are reserved for OtherOS
4. Install and run setup_flash_for_otheros.pkg
5. Reboot (It's important to shut down and turn on your PS3)
6. Install and run install_otheros.pkg (Try different USB ports if you don't get any beeps.)
7. Install and run boot_otheros.pkg
8. Install and run reboot.pkg (use the package, do NOT reboot manually)
9. You should be in Petitboot now.
10. Quit to Shell and execute create_hdd_region.sh from your USB:
/tmp/petitboot/mnt/sda1/create_hdd_region.sh
or /tmp/petitboot/mnt/sdb1/create_hdd_region.sh
or /var/tmp/petitboot/mnt/sda1/create_hdd_region.sh
or /var/tmp/petitboot/mnt/sdb1/create_hdd_region.sh
11. Reboot your PS3
12. From GameOS run "Reboot" to get into Petitboot again (if not already in Petitboot)
13. Download Red Ribbon: http://sourceforge.net/projects/redribbon/files/red_ribbon_rc5.rar/download
14. Extract the rar and extract the ISO in the root of your USB stick/or burn the image to a DVD
15. Plug in your USB/Insert the disc in your PS3 and you should see 2 different boot options in Petitboot
16. Boot the one that says "otheros" (not asbestos or failsafe)
17. From the desktop icon "Install Red Ribbon" - double-click to install it on the HDD. Use default username/password during installation: ps3/ps3
PROTIP:
- During partitioning you can resize the default /dev/ps3dd1 partition from 21GB to just 4GB (4096MB)
- It will speed up installation/formatting (all will take less than 5 mins)
18. Restart the PS3 after installation is complete (use "Reboot" package from GameOS if reboot doesn't bring you to Petitboot)
19. Select "Red-Ribbon" from petitboot (not the live/asbestos/failsafe)
20. Login with ps3/ps3
21. Use FileManager to copy your "metldrpwn" folder from the USB to your linux home folder (/home/ps3)
22. Start TERMINAL
23. Type:
cd metldrpwn
sudo chmod +x ./run.sh
sudo sh ./run.sh
24. You may have to repeat the last command (sudo sh ./run.sh) if exploit fails
25. You will find your EID dump (256KB) if everything went well in your home folder (/home/ps3/dump_eid0.bin)
26. Transfer it to your USB drive
27. On your PC use "c2d.exe" to convert your CEX NOR dump to DEX (use command prompt) (you may have to install openssl from c2d folder):
c2d.exe dump_eid0.bin my-original-cex.NORBIN my-DEX-flash.EID0.NORBIN 82
If the dump-eid0.bin doesn't have the proper keys at the begining (0x00-0x2f) you will have to search for the keys. Mark the first 16 bytes (0x00-0x0F) and search for them in the dump. You'll find them at another location. Save the 48 bytes following from the location you found the keys to a new file (eid_root_keys.bin) and use the file with "c2d"
28. Rename your DEX flash to my-DEX-flash.EID0.NORBIN and copy it to USB
29. Install multiMAN on your PS3 and from mmOS double-click the my-DEX-flash.EID0.NORBIN from your USB
30. Quit multiMAN and REBOOT your PS3
31. Install DEX 3.55 firmware or higher from XMB->System Update->Storage Media.
32. To get back to CEX/CFW from DEX:
- Install 3.55DEX_downgrader firmware: http://www.ps3devwiki.com/files/firmware/OFW-DEX/3.55downgrader/PS3UPDAT.PUP
- Use your original NOR dump (my-original-cex.NORBIN) and rename it to (my-original-cex.EID0.NORBIN)
- Double click on your CEX NOR file in mmOS (i.e. /dev_usb000/my-original-cex.EID0.NORBIN)
- Quit multiMAN, Reboot your PS3 and install OFW/CFW 3.55 from XMB
From
andreus: To avoid the DEX2CEX brick in Step 32 of deank's CEX2DEX tutorial, do this:
1. Before you start be in Rogero DEX CFW
2. Flash your CEX.EID0.NORBIN in multiman CEX
3. Exit Multiman
4. In XMB update your PS3 with Rogero CEX CFW v3.4 (this CEX fw have LV1 syscon checks patched to avoid Bricking)
5. Done
DO NOT TURN OFF YOUR PS3 in all the process or you will have the DEX2CEX brick because of CEX syscon hash checks!!!
It seems is not possible to update from XMB so another alternative is needed, meanwhile don't do this process. Maybe first you will have to be in factory service mode or one of the other alternatives euss point out in IRC.
Then if you want to go back to DEX:
1. Before you start be in Rogero CEX CFW
2. Flash your DEX.EID0.NORBIN in multiman CEX
3. Exit Multiman
4. In XMB update your PS3 with Rogero DEX CFW v2 (ps3news.com/forums/ps3-cfw-mfw/rogero-ps3-mfw-fixes-trophies-problem-after-3-70-downgrade-120831-5.html#post421843)
5. Done
Notes: NAND should be also supported (Refer to the
PS3 NAND CEX to DEX Guide by CaptainCPS-X). While I was converting my PS3 from CEX to DEX and then back from DEX to CEX I NEVER used the POWER BUTTON to turn-off/restart the PS3. The only time I had to do that is at the beginning when you have to enter the Recovery Menu after OTHEROS PUP is installed.
All other firmware updates are performed from XMB (not from recovery menu) and all restarts/turn-offs are performed with {PS}->Turn Off in GameOS, or reboot/shutdown/restart/boot-to-game-os while in petitboot or linux.
The PS3 I used for my tests is SLIM, which came with 2.70, never downgraded and no need for special firmwares with checks-disabled, etc. If you're console is downgraded from 3.56+ following this tutorial may brick it.
You only need linux once just to obtain your key. After you have the keys you can switch to CEX/DEX/change the ps3 region from GameOS. Yes, it may be possible to obtain the key without installing linux (either from livecd or using some other method), but not at the moment.
EASIEST WAY: When you boot your PS3 in PETITBOOT you can see the paths to the kernels. Two of these (first two lines) will show the correct path to your USB HDD (look for /......../petitboot/.....).
If you see ...../sda1.... or ...../sdb1.... <--- this is your USB HDD so use the path with cd and then launch create_hdd_region.sh
You can either use:
/tmp/petitboot/mnt/sda1/create_hdd_region.sh
or
cd /tmp/petitboot/mnt/sda1
./create_hdd_region.sh
You can easily find your USB HDD by trying the folders:
try to type these:
cd /
cd var
cd tmp
cd petitboot
cd mnt
here you can type
and find your usb (sda* / sdb* / sdc*) (sda1 means Storage Device "A", partition 1, sdb1 means Storage Device "B", partition 1, etc) and then you can
cd sda1
./create_hdd_region.sh
(change "cd sda1" appropriately - if you use USB HDD, 1st partition is sda1, second is sda2, etc... If you use USB STICK/FLASH then sdb1/sdb2..)
Below is a PS3 Real Debug (DEX) video from
gt41 who used an E3 Flasher to dump the NOR, converted NORCEX to NORDEX and reflashed it back (without risk of bricking) to play PS3 game backups including Pro Evolution Soccer (PES) 2012.
Also below is a PS3 DEX 4.11 - Pro Evolution Soccer 2012 (Italian) M109 by
PS3DEX:
Finally, from PS3 developer
Rogero who recently released a
Rogero 3.55 DEX Downgrader CFW Peek / Poke PS3UPDAT.PUP for Custom Firmware users:
For all owners of PS3 consoles downgraded from 3.55+ using hardware flashers and Rogero_CFW_v3.x:
Before attempting to convert to DEX and to avoid Bricking the PS3, please reset the PS3 syscon hashes to eliminate the need of using CEX/DEX firmwares with Patched LV1 checks.
To Reset the syscon and have the PS3 back to normal safer mode like any original (non Downgraded ) PS3, here are the steps:
1- After completing the downgrade process and having Rogero CFW 3.x up and running, make sure you have the Blu-Ray drive attached or the QA Toggle package won't work.
2- Download the Rebug QA_Toggle package from here (ps3devwiki.com/files/flash/Tools/toggle-qa/toggle_qa.pkg) ---> toggle_qa.pkg
3- Put the "toggle_qa.pkg" on USB and Install it on the PS3.
4- Run the "Rebug Toggle QA" from XMB, the screen will go Black and you will see HDD Led activity then if all went fine you will hear one Beep and the PS3 will Restart back to XMB.
5- If you want to make sure QA flag was set, go to "Network Settings" then apply the following key combo (all at the same time):
L1 + L2 + L3 (press left stick) + R1 + R2 + dpad_down
You should see Edy Viewer, Debug Settings, and Install Package Files if done correctly.
6- Now that you have QA flag set, Turn Off your PS3 and Turn it back on but into "Recovery Menu"
This Step is very important, it have to be from "Recovery Menu" and not a normal Update from XMB or the PS3 will Brick.
Here is how to access it:
a. Turn off PlayStation 3.
b. Hold The power button down; The system will turn on and turn off once again.
c. Once the System has been shutdown, re-press you finger until you hear 2 consecutive beeps
d. When you hear the 2 beeps take finger off power button.
e. You will be prompted to plug in your controller via usb and then hit the PS button
f. The Recovery menu will pop up.
Alternatively you can simply use CondorStrike's Updater package to enter Recovery Menu directly from XMB without going through the boot sequences. --> Condor Updater v2.0 (ps3devwiki.com/files/flash/Tools/Condor%20Updater/Condor%20Updater%20v2.0.pkg)
7- Now you must have any 3.55 OFW or CFW with original (non Patched) LV1, here's a link to 3.55-Kmeaw --> kmeaw355.PUP (ps3devwiki.com/files/firmware/MFW-CEX/Kmeaw/kmeaw355.PUP)
8- Select the last option of the Recovery Menu --> System Update, then when prompted press "Start+Select" to start the update.
Once finished the PS3 will restart into XMB with the Syscon hashes reset back to 3.55 in both "ros0" and "ros1" and your PS3 is back like any original/non Downgraded PS3 that can use any CEX/DEX Fw without having to worry about disabling LV1 checks.
You can proceed now with converting from CEX to DEX by following Deank's tutorial normally.
i played on rebug 4.21.2....flawlessly with no problem...fast loading btw...
Thanks for the reply.
looks like your gonna be doing a lot of soldering too, cos progskeets are virtually impossible to get hold of at the moment and e3s are getting just as hard to find.
Unless your really comfortab'e with tiny soldering, id strongly suggest you get someone to do this for you. it usually works out cheaper, and a lot of people dont charge if they cant fix it.
I still had my original NOR dump of course, so straight away I put it on a USB stick and flashed it again using Multiman (as I had read on a tutorial). Of course that didn't work. When I attempted to turn it on again it simply gave me the infamous 10 beeps, so I searched if I could fine a solution for that.
Some said the problem would be solved by just putting a FW on a USB stick and putting the ps3 in service mode. So, I brought back my Teensy 2.0++ I used on the old days of 3.41 cfw, and put the PS3 in service mode (using the Lv2diag.self IN file) then it started flashing blue (they say after 5 minues it should re-install the fw, but it didn't). I waited for nearly 30 minutes and nothing happened, plus HDD light and USB light were off. I decided to turn it off and retry.
I retried twice and same problem, and then after re-booting the ps3 bang, YLOD. The ps3 would of course not boot in service mode, so I tried the reflowing method to try to fix this. I tried doing that THREE TIMES, and it never worked. Now I don't know what to do, the only thing I can think of about this maybe I didn't apply enough thermal compound since the syringe was almost empty.
Anyway, the only thing working now it the super-spinning fans thing. I still have my Teensy 2.0++, so I could flash it to the PS3 and try to re-flash the NOR I guess? I that would be the only solution, could you link me to a guide, since I couldn't find any.
The only thing stopping me from doing that is that I would have to solder a lot of wires, and I really don't want to. If that is the only solution, I might even consider one of those E3's or progskeet's or wait for a proper cfw to install on my third ps3
ANYWAY, thanks everyone for reading, and hopefully for helping me resolve this problem!
i did the same thing, an e3 worked for me, it got me into fsm but without screen output, you just got to do it blindly. but it did work.
saved my ps3