Remarrying PS3 Blu-ray Drives on 3.55 FW Without Downgrading


111w ago - Following up on the previous article, today some anonymous PlayStation 3 developers have shared details on remarrying PS3 Blu-ray drives on Firmware 3.55 without the need for downgrading the console any longer.

Download: Remarry PS3 Blu-ray Drive on 3.55 FW / Remarry PS3 Blu-ray Drive on 3.55 FW (Mirror)

From the included ReadMe file via the PS3 Developer Wiki (ps3devwiki.com/files/lv2diag/remarry/remarry-3.55/), to quote:

PS3 Remarry Guide for 3.55 Firmware

1. Have the console on a working 3.55 firmware

2. Download the Remarry files (remarry-3.55.rar) and unpack to root of USM Mass Storage device. The following line is already changed from 1 to 0:

This will make sure the drive init PUP is not installed, thus preventing RLOD because of syscon hashes on downgraded consoles.

3. Download official firmware <=3.30 as drive init PUP and put it root of USB Mass Storage device

Content of USB Mass Storage device should be thus be:

MD5: / SHA1: / CRC32: / CRC16:

  • Lv2diag.self C48E5EBFC00ABD89094CB73A2B0BEA59 / D229AC694910272DDEA9276B9FD4A2664800638C / C2D0A2B0 / 5327
  • manufacturing_updater_for_reset.self 9E3C9024E9243478D21C78E1C9DF2376 / 922EA202CA2EA36EBF2B5054605E17409B9A56E6 / 93F18A95 / EA0D
  • fdm_spu_module.self 33E8D3C12349CFD203930FD0C237054D / F660FD6EBEB12DC7F52B4E707A1F0D1BD05DF9F3 / 85701A9B / B75B
  • PS3UPDAT.PUP
  • cfg/standalone.cfg

4. Put the service mode JIG/dongle/PSGrade into port 0 (closest to the reader) and get into factory service mode.

5. Put the created USB Mass Storage device from step 3 into port 0 (closest to the reader) and run.

  • Drive Init Executing means it is starting the remarry process
  • Drive Init Failed with big pink letters 'NG' (No Good!) means the process failed. Most likely solved by fixing the communication issue with the drive.

6. After you run the initial remarry process, do not take it out of factory service mode.

7. Put a BD movie disc in and run it on the PS3. (This restores your DRL files!)

8. Then you can take it out of factory service mode.

9. Launch as normal.




Stay tuned for more PS3 Hacks and PS3 CFW news, follow us on Twitter and be sure to drop by the PS3 Hacks and PS3 Custom Firmware Forums for the latest PlayStation 3 scene updates and homebrew releases!

Comments 72 Comments - Go to Forum Thread »

Quick Reply Quick Reply

Foo's Avatar
#57 - Foo - 85w ago
Fixing DRL and CRL Hashes Tutorial by Glevand

Introduction

It's a small and easy guide (via ps3devwiki.com/wiki/Fixing_DRL_and_CRL_Hashes) how to fix your DRL/CRL issues on GameOS with PS3 Linux.

Tools

You need my latest ps3dm tool with VTRM commands retrieve and store_with_update.

ps3vuart-tools: gitorious.ps3dev.net/ps3linux/ps3vuart-tools

DRL and CRL Hashes

DRL and CRL SHA1 hashes are stored on VTRM FLASH region. First 20 bytes are SHA1 hash of DRL. Then following 20 bytes SHA1 hash of CRL.

Read current DRL and CRL SHA1 hashes from FLASH using VTRM service:



Write current DRL and CRL SHA1 hashes to FLASH using VTRM service:




If you write wrong hashes intentionally then you won't be able to play BD movies and you will get the following message:



How to get correct DRL and CRL hashes:




Test

  • I intentionally wrote wrong DRL and CRL hashes with VTRM service store_with_update.
  • After that i couldn't play my BD movies on GameOS.
  • Then i wrote correct hashes again and BD playback is working again

pinoytechno's Avatar
#56 - pinoytechno - 85w ago
thanks for the info sir

bladerunner6's Avatar
#55 - bladerunner6 - 86w ago
is there an easy way to decrypt eid 2, 4 ?

i got the encrypted dumps already

Foo's Avatar
#54 - Foo - 86w ago
EID2

You will new decrypted EID2 data. How to get it on Linux is described here: (ps3devwiki.com/wiki/Spuisofs#Dumping_EID2_Key_with_spuisofs)

EID2 contains encrypted P-Block and S-Block. To get decrypted S-Block and P-Block first you have to decrypt EID2 with EID2 key and IV and then decrypt the blocks with DES-CBC. P-Block and S-Block DES-CBC IV and key:




Writing P-Block

  • P-Block is stored in BD buffer 2.
  • BD buffer 2 is of size 0x60 bytes.
  • P-Block is in decryoted EID2 at offset 0x20 and of size 0x80.
  • Not all P-Block data is sent to BD drive. Only data starting at offset 0x10 and of size 0x60 bytes is written to BD drive buffer 2.

Test


Writing S-Block

  • S-Block is stored in BD buffer 3.
  • BD buffer 3 is of size 0x670 bytes.
  • S-Block is in decryoted EID2 at offset 0xa0 and of size 0x690.

Writing New HRL to BD Drive

HRL is stored in BD buffer 4. BD buffer 4 is of size 0x8000 bytes.
glevand@debian:~$ sudo sg_read_buffer -i 4 -m 2 -o 0 -l 0x8000 -r /dev/sr0 | hexdump -C
00000000 10 00 00 0c 00 03 10 03 00 00 00 01 21 00 00 34 |............!..4|
00000010 00 00 00 00 00 00 00 00 1b 0b f2 6d 47 9e 77 62 |...........mG.wb|
00000020 3d 91 fc 78 b1 59 c9 52 ca a4 c7 41 85 24 96 64 |=..x.Y.R...A.$.d|
00000030 8d 1d 95 8e 9b 84 c6 fa 4a dd 43 9b 42 98 fe ff |........J.C.B...|
00000040 df e6 f3 56 85 81 e1 1b 27 53 08 14 16 6d 97 3c |...V....'S...m.

madrigal77's Avatar
#53 - madrigal77 - 105w ago
I got a pink "NG" like the picture below. What does that mean and how do I fix it?













Affiliates - Contact Us - PS3 Downloads - Privacy Statement - Site Rules - Top - © 2014 PlayStation 3 News