Playstation 3 Downgrade (dospiedra v2)

Posted on September 1, 2011 by damox

In this quick tutorial I will cover how to downgrade your PS3 (NOR flash type only) using dospiedra’s latest downgrade method.

You will need the following:

PS3 Fat or Slim (NOR flash type only)
A USB Thumbdrive.
A method to enter your PS3 into Factory Service Mode
Firmware 3.70 OFW (.PUP MD5: 7EE6B91BBD07DDE1E65A0681DE66745B)
ProgSkeet Universal Programmer
Latest Version of the ProgSkeet Software
Downgrade V2 by dospiedra (.RAR MD5: F768F4B0E8BA1D300495C5F6A1CFB1E4)
HEX Editor – I will be using HxD (.ZIP MD5: 18DF5E00110513F15882709D06947F95)
3.55 CFW No Check by dospiedra (.PUP MD5: 89FEDBF48A4FFEB74F68D30E3E684608)
1st stage Lv2diag.self by jaicrab (.ZIP MD5: 3499B86C34D2E11D0AF74C7B125B6758)
2nd stage Lv2diag.self by jaicrab (.RAR MD5: 5A70B6019FD801554305B7A802EB9285)

–Tutorial Start–

Step 1: Dump the NOR of your PS3 using the ProgSkeet Device and Software. Make sure you dump your NOR a number of times and verify that both the read is valid and that all the dumps are exactly the same.

Make sure you have ByteSwap checked, so we can eliminate the usage of FlowRebuilder.
Your dump should be exacltly 16,777,216 bytes.
Save the dump as NOR_3.70_OFW.bin for this guide.

Spansion NOR: 128KB sector, 128 sectors

Samsung NOR: 4KB sector, 4096 sectors

Macronix NOR: 128KB sector, 128 sectors

Step 2: Open NOR_3.70_OFW.bin with HxD. Make sure OFFSET 200 reads “IFI” and nothing else (otherwise you might need to go back and ByteSwap your dump)

Step 3: Open the 6 patches found inside the downgrade v2 archive with HxD.

Step 4: Now we want to patch our NOR_3.70_OFW.bin with the 6 patches provided.

patch1: OFFSET 0C0010 LENGTH 6FFFE0 patch2: OFFSET 7C0010 LENGTH 6FFFE0 patch3: OFFSET 80000 LENGTH 20000 patch4: OFFSET A0000 LENGTH 20000 patch5: OFFSET 40000 LENGTH 20000 patch6: OFFSET 60000 LENGTH 20000

For each patch perform the following (using patch 1 as an example):

Open patch1 and select all (ctrl+a) and copy (ctrl+c).
Open NOR_3.70_OFW.bin and goto (ctrl+g) OFFSET 0C0010

Paste write with ctrl-b (not Paste Insert! – the file size should never change) the changes you make should be coloured red.

Keep repeating (using the different offsets for each patch) until all 6 patches have been applied.

Step 5: Save patched NOR_3.70_OFW.bin as NOR_downgrade.bin

Step 6: Flash NOR_downgrade.bin to the PS3 using the ProgSkeet Device and Software.

Step 7: Turn on the PS3 but do not press anything. Wait 1 minute or so, and remove power from the PS3 - we need to put it into factory service mode.

Step 8: Format a FAT32 thumb-drive and place the following files on it.

usb:\\Lv2diag.self (Get this file from the Lv2Diag-patch-par-Jaicrab.zip archive – ‘\Lv2Diag-patch-par-Jaicrab\STEP1\Lv2diag.self’)
usb:\\PS3UPDAT.PUP (Rename 355checkoff.PUP to PS3UPDAT.PUP)

Step 9: Plug the thumb-drive with the files from step 8 into the right-most USB port on the PS3.

Step 10: Boot the PS3 into Factory Service Mode (see other guides on how to achieve this)

Step 11: Wait for the PS3 to power off automatically (this should take somewhere between 10-20 minutes)

Step 12: Remove the USB from the right-most USB port on the PS3.

Step 13: Power on the PS3 – you should now see the XMB.

Step 14: Shutdown the PS3 again.

Step 15: Replace the first stage Lv2diag.self with the second stage Lv2diag.self on the thumb-drive and re-plug the thumb-drive into the right-most USB port on the PS3.

usb:\\Lv2diag.self (Get this file from the Lv2diag_355.rar archive – ‘\\Lv2diag_355\Archivo 2\Lv2diag.self’)
usb:\\PS3UPDAT.PUP (Keep from before)

Step 16: Power on the PS3 - Wait for the PS3 to power off automatically (this should take somewhere between 10-20 seconds)

Step 17: Remove the USB from the right-most USB port on the PS3.

Step 18: Boot the PS3 and enjoy your 3.55 CFW No Check by dospiedra (equivalent to 3.55 CFW by kweaw)

29 thoughts on “Playstation 3 Downgrade (dospiedra v2)”

Pingback: How-to downgrade PS3 firmware v3.70 | JailbreakScene
Pingback: 3.70 – Downgrade v2 for All NOR Models – For Teensy++ OR ProgSkeet — CONSOLE DEMON
Khalkedon on September 2, 2011 at 4:21 am said:

You said:

Step 2: Open NOR_3.70_OFW.bin with HxD. Make sure OFFSET 200 reads “IFI” and nothing else (otherwise you might need to go back and ByteSwap your dump)

My Offset is “FI.I” what have to I do for this? Will I fix the numbers ?

Reply ↓
- damox on September 2, 2011 at 11:38 am said:
  
  Have a look at byte swapping your NOR dump.
  
  I just made a post about it: http://blog.damox.net/?p=20
  
  Reply ↓
Pingback: [TUTORIAL] Dospiedra rilascia il downgrade v2 per tutte le PS3 NOR (Richiesto Progskeet o Norway++) | DiGiTaL AnGeL - Notizie su hacking,cracking,modding,iphone,apple,mac os x, windows 7, office, xbox 360,wii,nds,nintendo,cupertino,live,tutorials,adobe,ph
Newbie Team on September 2, 2011 at 11:07 pm said:

Hi… how do we connect the progskeet with the console? and with the pc? Does it have to solder or only use a usb connect? Thanks! Sorry my english
Congratulations!!

Reply ↓
- damox on September 2, 2011 at 11:52 pm said:
  
  The ProgSkeet has to be soldered to the PS3 – it is just under 50 wires before you can even dump the NOR.
  
  There is a solder-less solution in the works by the ProgSkeet team – it might be better to wait for that.
  
  To connect it to your PC it uses a USB connection.
  
  Reply ↓
Jim on September 3, 2011 at 6:55 am said:

A buddy of mine tried this but was following a bad tutorial
Basically he dumped his nor 3 times and they all matched
problem is is his dump reads
88 C1 88 C1 88 C1 88 C1 88 C1 88 C1 88 C1 88 C1
on every line…. so they matched…
so he went a head and flashed and said it got to 5-40% i dont remember exactly what precent but im guessing its a perm brick unless i can do something to recover the nor
or use a donor any one got a ideas?

Reply ↓
- Jim on September 3, 2011 at 8:33 am said:
  
  you answered me at http://www.progskeet.com/forum/viewtopic.php?f=3&t=291
  
  Reply ↓
marlboro12 on September 3, 2011 at 9:30 am said:

Hi damox,

I test your [how to] but I have issue… this is my original dump –snipped– (not byteswap) and this is my Nor_downgrade.bin –snipped– (after you how to) and this the dump after flash with Nor_downgrade.bin –snipped– …

I think the writing is not good… could you give me help?

damox EDIT: Please don’t post links to your dumps here.

Reply ↓
- damox on September 3, 2011 at 4:06 pm said:
  
  If you have written your Nor_downgrade.bin and then re-dumped it and they don’t much – then yes, there is something wrong.
  
  It could be read or write (I hope it is write!).
  
  You need to check your wiring – make sure there are no shorts, and everything is connected where it should be – make use of a multimeter to test connectivity.
  
  Reply ↓
Khalkedon on September 3, 2011 at 8:42 pm said:

Damox firstly thanks your answers and helpful heart.

I tried many many many many times lots of things but no succesful. Is there any way to make this? My nor flash is Macronix (MXIC).

I made your tutorial step by step (I’m sure). I have a question?

If my dump is broken can it make mischief?

When I flash original dump to PS3 then it works perfectly. It means my original dump is safer, isn’t it?

Reply ↓
- damox on September 3, 2011 at 10:15 pm said:
  
  Are you able to tell me what SKU model your PS3 is – have a look at this page for more info: http://www.ps3devwiki.com/index.php?title=SKU_Models
  
  Also: looking at your hex dump – goto HEX OFFSET: 800
  
  it should read:
  
  00 00 00 01 00 00 00 01 00 00 00 00 00 02 E8 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 E9 20 6D 65 74 6C 64 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  
  or
  
  00 00 00 01 00 00 00 01 00 00 00 00 00 02 E8 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 F9 20 6D 65 74 6C 64 72 2E 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  
  Which one is yours?
  
  Reply ↓
  - Khalkedon on September 3, 2011 at 10:59 pm said:
    
    This is my hex dump values:
    00 00 00 01 00 00 00 01 00 00 00 00 00 02 E8 00
    00 00 00 00 00 00 00 40 00 00 00 00 00 00 E9 20
    6D 65 74 6C 64 72 00 00 00 00 00 00 00 00 00 00
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    
    Also my sku model is: CECH 2106A (120GB NTSC-J)
    
    Reply ↓
  - Khalkedon on September 3, 2011 at 11:03 pm said:
    
    By the way, why do we need to learn sku model?
    
    Reply ↓
    - damox on September 4, 2011 at 9:47 am said:
      
      There are a number of SKU (newer consoles) that cannot be downgraded. Yours should be fine.
      
      Can you just double check your date code for me?
      
      Reply ↓
Khalkedon on September 3, 2011 at 11:37 pm said:

Also these are my installation pictures:
http://i.imgur.com/gingW.jpg
http://i.imgur.com/tONwD.jpg
http://i.imgur.com/K4Y8q.jpg

I removed R8 then I made a short but I cuttud the short it’s not in use. When PS3′s electrical power cut if you make short the R8 you don’t have to give power to PS3, you can flash without power. USB’s power available. Of course I don’t use R8 short. I prefer of the tutorial suggestion.

Reply ↓
- damox on September 4, 2011 at 10:05 am said:
  
  The ProgSkeet should never be powering the PS3 – it is the other way around – either the PS3 powers the ProgSkeets FPGA (via the 3.3v JTAG header – R7) or the ProgSkeets FPGA is powered via USB – R8.
  
  The PS3 should always be powering its own NAND/NOR chips.
  
  You should have either R8 closed OR R7 closed – not both.
  
  Leave R8 open, and R7 switch-able.
  
  Reply ↓
Khalkedon on September 4, 2011 at 12:13 am said:

Damox sorry I wrote cut by cut.

When I check the original dump with Hex Editor values so;

00 00 01 00 00 00 01 00 00 00 00 00 02 00 00 E8
00 00 00 00 00 00 40 00 00 00 00 00 00 00 20 E9
65 6D 6C 74 72 64 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Reply ↓
Sieru on September 4, 2011 at 1:47 am said:

Is Japanese. Translated into English so that Google, it may be just a little grammar is wrong.
What you need in addition to those listed here are available?
Also, the PS3 can not put regular CFW or can be introduced at once?
Part of the PS3 have now is CECH-2500A.

Reply ↓
Pingback: Can you downgrade your PS3? | damox's rambling
Khalkedon on September 4, 2011 at 7:49 pm said:

Damox I uploaded my files (original dump.bin and I hexed nor-downgrade.bin) Thank you for everything if it doesn’t work even thank you for everything. You are the one real helper on world about ProgSkeet.

This is link:

damox EDIT: Don’t post dumps here – I got the link though, give me some time to look at them.

Reply ↓
Khalkedon on September 5, 2011 at 11:06 pm said:

Hi Damox, I think you are busy. I’m waiting your good news in a big excitement

Reply ↓
Pingback: 3.70 – Downgrade v2 for All NOR Models – For Teensy++ OR ProgSkeet | PlayStation Gates - PlayStation 3 , WII , PS3 , PS , PS2 , PS3 Jailbreak, PlayStation Jailbreak
Kaan on September 9, 2011 at 10:56 pm said:

Hi

I succesfully downgraded my ps3 from 3.70 to 3.55. Everything seems fine but when i try to play trophy games, I got this error, “Registration of trophy information could not be found. (80010505)”

Is there any solution for trophy error?

Reply ↓
Stuck on 3.56v1 on September 10, 2011 at 2:50 am said:

My Slim PS3 is stuck on 3.56V1. The HDD broke before I was able to update to 3.56V2 and since that time I am unable to get it work “Data Corrupted Error”, will this guide work to downgrade to 3.55 (from 3.56V1) and get my PS3 working again? or do I need different instructions? or ??

Thanks,

Reply ↓
Shn İstanbul on September 18, 2011 at 7:39 pm said:

khalkedon hello. I can help you:)) What is the problem, man

Shn İstanbul

Reply ↓
Link on November 21, 2011 at 12:22 pm said:

hi
thank you for tutorial i have reach Step 6: Flash NOR_downgrade.bin to the PS3 using the ProgSkeet Device and Software.
i’m using ProgSkeet flash it successful but now my console when turn it on after 5 second the light turn red and blinking
when flash the original it works
please help

Reply ↓
Algorioth on August 14, 2012 at 10:31 am said:

Had a bad NOR flash from a 3.55 console.. Followed the directions, worked perfect to fix a 5 beep issue!

Thanks!

Reply ↓

damox's rambling

!?

Playstation 3 Downgrade (dospiedra v2)

29 thoughts on “Playstation 3 Downgrade (dospiedra v2)”

Leave a Reply Cancel reply