Playstation 3 Downgrade (dospiedra v2)

In this quick tutorial I will cover how to downgrade your PS3 (NOR flash type only) using dospiedra’s latest downgrade method.

You will need the following:

–Tutorial Start–
Step 1: Dump the NOR of your PS3 using the ProgSkeet Device and Software. Make sure you dump your NOR a number of times and verify that both the read is valid and that all the dumps are exactly the same.
  • Make sure you have ByteSwap checked, so we can eliminate the usage of FlowRebuilder.
  • Your dump should be exacltly 16,777,216 bytes.
  • Save the dump as NOR_3.70_OFW.bin for this guide.
ProgSkeet Flasher
  • Spansion NOR: 128KB sector, 128 sectors
  • Samsung NOR: 4KB sector, 4096 sectors
  • Macronix NOR: 128KB sector, 128 sectors
Step 2: Open NOR_3.70_OFW.bin with HxD. Make sure OFFSET 200 reads “IFI” and nothing else (otherwise you might need to go back and ByteSwap your dump)
NOR_3.70_OFW.bin open in HxDStep 3: Open the 6 patches found inside the downgrade v2 archive with HxD.
6 Patches open in HxDStep 4: Now we want to patch our NOR_3.70_OFW.bin with the 6 patches provided.

patch1: OFFSET 0C0010 LENGTH 6FFFE0
patch2: OFFSET 7C0010 LENGTH 6FFFE0
patch3: OFFSET 80000 LENGTH 20000
patch4: OFFSET A0000 LENGTH 20000
patch5: OFFSET 40000 LENGTH 20000
patch6: OFFSET 60000 LENGTH 20000

For each patch perform the following (using patch 1 as an example):

  • Open patch1 and select all (ctrl+a) and copy (ctrl+c).
  • Open NOR_3.70_OFW.bin and goto (ctrl+g) OFFSET 0C0010

HxD Goto OFFSET

  • Paste write with ctrl-b (not Paste Insert! – the file size should never change) the changes you make should be coloured red.
Red changes in HxD

Keep repeating (using the different offsets for each patch) until all 6 patches have been applied.

Step 5: Save patched NOR_3.70_OFW.bin as NOR_downgrade.bin

Step 6: Flash NOR_downgrade.bin to the PS3 using the ProgSkeet Device and Software.

Step 7: Turn on the PS3 but do not press anything. Wait 1 minute or so, and remove power from the PS3 - we need to put it into factory service mode.

Step 8: Format a FAT32 thumb-drive and place the following files on it.

  • usb:\\Lv2diag.self (Get this file from the Lv2Diag-patch-par-Jaicrab.zip archive – ‘\Lv2Diag-patch-par-Jaicrab\STEP1\Lv2diag.self’)
  • usb:\\PS3UPDAT.PUP (Rename 355checkoff.PUP to PS3UPDAT.PUP)

Step 9: Plug the thumb-drive with the files from step 8 into the right-most USB port on the PS3.

Step 10: Boot the PS3 into Factory Service Mode (see other guides on how to achieve this)

Step 11: Wait for the PS3 to power off automatically (this should take somewhere between 10-20 minutes)

Step 12: Remove the USB from the right-most USB port on the PS3.

Step 13: Power on the PS3  – you should now see the XMB.

Step 14: Shutdown the PS3 again.

Step 15: Replace the first stage Lv2diag.self with the second stage Lv2diag.self on the thumb-drive and re-plug the thumb-drive into the right-most USB port on the PS3.

  • usb:\\Lv2diag.self (Get this file from the Lv2diag_355.rar archive – ‘\\Lv2diag_355\Archivo 2\Lv2diag.self’)
  • usb:\\PS3UPDAT.PUP (Keep from before)

Step 16: Power on the PS3 - Wait for the PS3 to power off automatically (this should take somewhere between 10-20 seconds)

Step 17: Remove the USB from the right-most USB port on the PS3.

Step 18: Boot the PS3 and enjoy your 3.55 CFW No Check by dospiedra (equivalent to 3.55 CFW by kweaw)

29 thoughts on “Playstation 3 Downgrade (dospiedra v2)

  1. Pingback: How-to downgrade PS3 firmware v3.70 | JailbreakScene

  2. Pingback: 3.70 – Downgrade v2 for All NOR Models – For Teensy++ OR ProgSkeet — CONSOLE DEMON

  3. You said:

    Step 2: Open NOR_3.70_OFW.bin with HxD. Make sure OFFSET 200 reads “IFI” and nothing else (otherwise you might need to go back and ByteSwap your dump)

    My Offset is “FI.I” what have to I do for this? Will I fix the numbers ?

  4. Pingback: [TUTORIAL] Dospiedra rilascia il downgrade v2 per tutte le PS3 NOR (Richiesto Progskeet o Norway++) | DiGiTaL AnGeL - Notizie su hacking,cracking,modding,iphone,apple,mac os x, windows 7, office, xbox 360,wii,nds,nintendo,cupertino,live,tutorials,adobe,ph

  5. Hi… how do we connect the progskeet with the console? and with the pc? Does it have to solder or only use a usb connect? Thanks! Sorry my english
    Congratulations!!

    • The ProgSkeet has to be soldered to the PS3 – it is just under 50 wires before you can even dump the NOR.

      There is a solder-less solution in the works by the ProgSkeet team – it might be better to wait for that.

      To connect it to your PC it uses a USB connection.

  6. A buddy of mine tried this but was following a bad tutorial
    Basically he dumped his nor 3 times and they all matched
    problem is is his dump reads
    88 C1 88 C1 88 C1 88 C1 88 C1 88 C1 88 C1 88 C1
    on every line…. so they matched…
    so he went a head and flashed and said it got to 5-40% i dont remember exactly what precent but im guessing its a perm brick unless i can do something to recover the nor
    or use a donor any one got a ideas?

  7. Hi damox,

    I test your [how to] but I have issue… this is my original dump –snipped– (not byteswap) and this is my Nor_downgrade.bin –snipped– (after you how to) and this the dump after flash with Nor_downgrade.bin –snipped– …

    I think the writing is not good… could you give me help?

    damox EDIT: Please don’t post links to your dumps here.

    • If you have written your Nor_downgrade.bin and then re-dumped it and they don’t much – then yes, there is something wrong.

      It could be read or write (I hope it is write!).

      You need to check your wiring – make sure there are no shorts, and everything is connected where it should be – make use of a multimeter to test connectivity.

  8. Damox firstly thanks your answers and helpful heart.

    I tried many many many many times lots of things but no succesful. Is there any way to make this? My nor flash is Macronix (MXIC).

    I made your tutorial step by step (I’m sure). I have a question?

    If my dump is broken can it make mischief?

    When I flash original dump to PS3 then it works perfectly. It means my original dump is safer, isn’t it?

    • Are you able to tell me what SKU model your PS3 is – have a look at this page for more info: http://www.ps3devwiki.com/index.php?title=SKU_Models

      Also: looking at your hex dump – goto HEX OFFSET: 800

      it should read:

      00 00 00 01 00 00 00 01 00 00 00 00 00 02 E8 00
      00 00 00 00 00 00 00 40 00 00 00 00 00 00 E9 20
      6D 65 74 6C 64 72 00 00 00 00 00 00 00 00 00 00
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

      or

      00 00 00 01 00 00 00 01 00 00 00 00 00 02 E8 00
      00 00 00 00 00 00 00 40 00 00 00 00 00 00 F9 20
      6D 65 74 6C 64 72 2E 32 00 00 00 00 00 00 00 00
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

      Which one is yours?

    • The ProgSkeet should never be powering the PS3 – it is the other way around – either the PS3 powers the ProgSkeets FPGA (via the 3.3v JTAG header – R7) or the ProgSkeets FPGA is powered via USB – R8.

      The PS3 should always be powering its own NAND/NOR chips.

      You should have either R8 closed OR R7 closed – not both.

      Leave R8 open, and R7 switch-able.

  9. Damox sorry I wrote cut by cut.

    When I check the original dump with Hex Editor values so;

    00 00 01 00 00 00 01 00 00 00 00 00 02 00 00 E8
    00 00 00 00 00 00 40 00 00 00 00 00 00 00 20 E9
    65 6D 6C 74 72 64 00 00 00 00 00 00 00 00 00 00
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  10. Is Japanese. Translated into English so that Google, it may be just a little grammar is wrong.
    What you need in addition to those listed here are available?
    Also, the PS3 can not put regular CFW or can be introduced at once?
    Part of the PS3 have now is CECH-2500A.

  11. Pingback: Can you downgrade your PS3? | damox's rambling

  12. Damox I uploaded my files (original dump.bin and I hexed nor-downgrade.bin) Thank you for everything if it doesn’t work even thank you for everything. You are the one real helper on world about ProgSkeet.

    This is link:

    damox EDIT: Don’t post dumps here – I got the link though, give me some time to look at them.

  13. Pingback: 3.70 – Downgrade v2 for All NOR Models – For Teensy++ OR ProgSkeet | PlayStation Gates - PlayStation 3 , WII , PS3 , PS , PS2 , PS3 Jailbreak, PlayStation Jailbreak

  14. Hi

    I succesfully downgraded my ps3 from 3.70 to 3.55. Everything seems fine but when i try to play trophy games, I got this error, “Registration of trophy information could not be found. (80010505)”

    Is there any solution for trophy error?

  15. My Slim PS3 is stuck on 3.56V1. The HDD broke before I was able to update to 3.56V2 and since that time I am unable to get it work “Data Corrupted Error”, will this guide work to downgrade to 3.55 (from 3.56V1) and get my PS3 working again? or do I need different instructions? or ??

    Thanks,

  16. hi
    thank you for tutorial i have reach Step 6: Flash NOR_downgrade.bin to the PS3 using the ProgSkeet Device and Software.
    i’m using ProgSkeet flash it successful but now my console when turn it on after 5 second the light turn red and blinking
    when flash the original it works
    please help

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>