Page 26 of 67 FirstFirst ... 1625262736 ... LastLast
Results 251 to 260 of 663

Thread: PS3 CEX (Retail) to DEX (Debug) Conversion Method is Released!

  1. #251
    Join Date
    Apr 2005


    Quote Originally Posted by ISSAlcatraz View Post
    Can Someone upload PS3 CEX2DEX Application r1 to any other site plz?
    I have attached it below now.. or this may also be a mirror as well:

    Also untested from cotojestwtf (via,10992.msg80981.html?#msg80981) comes what appears to be a CEX to DEX Rapid Method for those willing to take the risk. Rough translation:

    PlayStation 3 CEX to DEX Rapid Method

    Here my conversion without play in the linuxy etc.. Just download and install the update as normal firmware.

    Download: CEX355TODEX355.PUP

    Read Before Download:
    • This is only interesting for those who want to check what is DEX - but it is probably from this is Rebug
    • Install the FW only 3.55.
    • After this operation, you can not install such a higher DEX FW 4.11.
    • Tested on CECHJ facie do not know how to slimami other models as well as FAT. You install at your own risk.
    • I do not know whether there back to CEX without flasher. trololol.
    • Publish only because, to show that such a softmod is possible.
    • It works homebrew is peek & poke.
    • Games you can fire off using multiman, or method known to DEX.

    • CECHJ

  2. #252
    ISSAlcatraz Guest

    Big Grin

    Quote Originally Posted by PS3 News View Post
    I have attached it below now..
    Thaaaaaank You

    You saved my day

  3. #253
    Join Date
    Apr 2005

    PS3 C2D CEX to DEX Flash Patcher v2, Changes Region / TargetID

    Following up on his initial release, today PlayStation 3 developer andbey0nd has updated his PS3 C2D.exe CEX to DEX Flash Patcher to version 2 which now includes Region / TargetID changing in the PS3 NOR Flash as outlined below.

    Download: PS3 C2D CEX to DEX Flash Patcher v2 / PS3 C2D CEX to DEX Flash Patcher v2 (Mirror) / PS3 C2D CEX to DEX Flash Patcher v2 (Mirror #2) / PS3 C2D CEX to DEX Flash Patcher v2 (Mirror #3) / Metldrpwn (Pre-compiled) / C2D for 0x8D (China) Targets / C2D for 0x8E (HK) Targets by deank

    To quote from the ReadMe file (via

    c2d.exe (win32 app)


    • Allows changing the Region / TargetID of your PS3 system
    • Allows "converting" any Retail PS3 into Debug unit (target_id 0x82)
    • Allows "converting" a Retail PS3 from one region to another (i.e. EUR PS3 -> JAP PS3, USA PS3 -> RUSSIAN PS3)
    • Changing a Retail PS3 region unlocks playback for region-locked DVD/Blu-ray movies and PS1/PS3 games

    WARNING: For best results flash the output NOR file with a tool which rewrites *ONLY the EID0 sector* (one sector / 512 bytes @ sector #376 / 0x178; NOR file offset 0x2f000-0x2f1ff). Flashing the whole 16MB NOR is not needed and can easily brick the PS3.

    • Use your original NOR flash to create new files for different regions for your PS3 to have them handy later:

    For example you can have (each file is 16MB):
    • my-slim-JAP.EID0.NORBIN
    • my-slim-EUR.EID0.NORBIN
    • my-slim-USA.EID0.NORBIN
    • my-slim-DEX.EID0.NORBIN

    * Using a proper tool you can switch regions in one second when needed

    • The latest online debug update of multiMAN 04.04.03 handles writing to NOR in the right fashion (1 sector) from .EID0.NORBIN files.
    • To dump NOR: mmOS->Select any file->Open in HEX viewer->[SELECT]->[START]->DUMP LV2(NO)->DUMP LV1(NO)->DUMP FLASH(YES)
    • To write EID0 sector: mmOS->Double-click on a .EID0.NORBIN 16MB full NOR dump file->Follow the on-screen instructions->Reboot.


    c2d - Changes REGION/TARGET_ID in PS3 NOR flash

    Usage: c2d.exe eid_key_file.bin in_flash.bin out_flash.bin [target_id]
           [target_id]: 82..8C
                        82 (DEX) (default)
                        83 (JAPAN)
                        84 (USA/CANADA)
                        85 (EUROPE)
                        86 (KOREA)
                        87 (UK)
                        88 (MEXICO)
                        89 (AUSTRALIA)
                        8A (SE ASIA)
                        8B (TAIWAN)
                        8C (RUS/ASIA)
    c:\c2d> c2d.exe eid_root_key.bin flashCEX.bin flashDEX.bin 82
    EID key     : 48 bytes (eid_root_key.bin)
    Flash size  : 16 MB (flashCEX.bin)
    Target ID   : $85
    EID ROOT KEY: 64D20967DEACDA16ACADBE289B0EE2C25EE77331A5040C5DC9DF67B3FE574F6D
    EID ROOT IV : 6BD7C324D3B213A647DC31987345595E
    EID0 KEY    : 9C1C4A93666EF67941F54679A7199D7553C8F0F50F3548C8966D6872FC8CD668
    EID0 IV     : 2DC374E270F851EB0D524F89790F2563
    Target ID   : $85 (from decrypted EID0 section)
    New TargetID: $82 (for modified flash)
    CMAC HASH   : F1053CC3818DD6CE2775F0273DFC212E
    Writing modified flash with TargetID: $82 (flashDEX.bin)...

    Note: TargetID/RegionCode is one and the same. DEX target/region is 82. 0x84 is USA RETAIL PS3, 0x82 is Debug/DEX.

    Below are a few additional guides from Sony PlayStation 3 hacker deank as follows:

    DeanK's OtherOS with METLDRPWN PUP Installation / Usage Tutorial (via

    Ok, folks... I prepared a 218MB rar package to make things easier. It includes everything you need, except for RedRibbon (you'll have to download it yourself ->

    PS3_OTHEROS_LINUX_METLDRPWN.rar (218.21MB) (Original Version)

    PS3_OTHEROS_LINUX_METLDRPWN.rar (217.49MB) (New Version - Recommended)

    You can also use this smaller download if you already have OTHEROS-22GB.PUP downloaded:

    PS3_OTHEROS_SETUP_METLDRPWN.rar (48.33MB) (Original Version)

    PS3_OTHEROS_SETUP_METLDRPWN.rar (52.25MB) (Older Version)

    PS3_OTHEROS_SETUP_METLDRPWN.rar (46.67MB) (Old Version)

    PS3_OTHEROS_SETUP_METLDRPWN.rar (46.85MB) (New Version - Recommended)

    You can download the OTHEROS PUP separately directly from glevand's repo and save it as \PS3\UPDATE\PS3UPDAT.PUP on your USB:

    Download and follow the instructions. You need a USB hdd to extract this package to the root folder of the USB and also Red-Ribbon.iso extracted in the root folder of the same USB. The rar contains:
    • c2d tool / openssl installer
    • metldrpwn folder with precompiled metldrpwn.ko module for Red Ribbon
    • multiMAN (for CEX and DEX) (no backups on DEX)
    • norunpack (+cygwin1.dll)
    • PS3\UPDATE\PS3UPDAT.PUP (otheros-22GB.PUP)
    • 4 packages needed to setup OtherOS from XMB/GameOS + flash image for NORs (dtbImage.ps3.bin)


    That's all you need.
    • These instructions are only for PS3 systems with NOR flash
    • Following these instructions will result in formatting your internal PS3 HDD. All data will be lost.
    • Before you continue, make sure that you backup all valuable data, saves, games
    • USB required with 1GB free space
    • Extract the contents of this package to the root folder of your USB drive
    • Download and extract RedRibbon Linux (steps 13, 14) to the root folder of your USB drive
    • Create a dump of your NOR (use multiMAN to create a .NORBIN file - USB connected as /dev_usb000 required) - To dump NOR: mmOS->Select any file->Open in HEX viewer->[SELECT]->[START]->DUMP LV2(NO)->DUMP LV1(NO)->DUMP FLASH(YES)
    • Transfer to your PC and unpack it with norunpack.exe or cex2dex to a folder and grab "metldr" from the "asecure_loader" folder
    • Put "metldr" into the "metldrpwn" folder on your USB
    1. Go to "System Update" and Install OTHEROS-22GB.PUP from USB (provided as \PS3\UPDATE\PS3UPDAT.PUP in this package) 2. When installation is finished, reboot in "Recovery Mode" and choose "Restore PS3 System" (not the Backup/Restore in XMB) 3. Now 22GB are reserved for OtherOS 4. Install and run setup_flash_for_otheros.pkg 5. Reboot (It's important to shut down and turn on your PS3) 6. Install and run install_otheros.pkg (Try different USB ports if you don't get any beeps.) 7. Install and run boot_otheros.pkg 8. Install and run reboot.pkg (use the package, do NOT reboot manually) 9. You should be in Petitboot now. 10. Quit to Shell and execute from your USB: /tmp/petitboot/mnt/sda1/ or /tmp/petitboot/mnt/sdb1/ or /var/tmp/petitboot/mnt/sda1/ or /var/tmp/petitboot/mnt/sdb1/ 11. Reboot your PS3 12. From GameOS run "Reboot" to get into Petitboot again (if not already in Petitboot) 13. Download Red Ribbon: 14. Extract the rar and extract the ISO in the root of your USB stick/or burn the image to a DVD 15. Plug in your USB/Insert the disc in your PS3 and you should see 2 different boot options in Petitboot 16. Boot the one that says "otheros" (not asbestos or failsafe) 17. From the desktop icon "Install Red Ribbon" - double-click to install it on the HDD. Use default username/password during installation: ps3/ps3 PROTIP:
    • During partitioning you can resize the default /dev/ps3dd1 partition from 21GB to just 4GB (4096MB)
    • It will speed up installation/formatting (all will take less than 5 mins)
    18. Restart the PS3 after installation is complete (use "Reboot" package from GameOS if reboot doesn't bring you to Petitboot) 19. Select "Red-Ribbon" from petitboot (not the live/asbestos/failsafe) 20. Login with ps3/ps3 21. Use FileManager to copy your "metldrpwn" folder from the USB to your linux home folder (/home/ps3) 22. Start TERMINAL 23. Type: cd metldrpwn sudo chmod +x ./ sudo sh ./ 24. You may have to repeat the last command (sudo sh ./ if exploit fails 25. You will find your EID dump (256KB) if everything went well in your home folder (/home/ps3/dump_eid0.bin) 26. Transfer it to your USB drive 27. On your PC use "c2d.exe" to convert your CEX NOR dump to DEX (use command prompt) (you may have to install openssl from c2d folder): c2d.exe dump_eid0.bin my-original-cex.NORBIN my-DEX-flash.EID0.NORBIN 82 If the dump-eid0.bin doesn't have the proper keys at the begining (0x00-0x2f) you will have to search for the keys. Mark the first 16 bytes (0x00-0x0F) and search for them in the dump. You'll find them at another location. Save the 48 bytes following from the location you found the keys to a new file (eid_root_keys.bin) and use the file with "c2d" 28. Rename your DEX flash to my-DEX-flash.EID0.NORBIN and copy it to USB 29. Install multiMAN on your PS3 and from mmOS double-click the my-DEX-flash.EID0.NORBIN from your USB 30. Quit multiMAN and REBOOT your PS3 31. Install DEX 3.55 firmware or higher from XMB->System Update->Storage Media. 32. To get back to CEX/CFW from DEX:
    • Install 3.55DEX_downgrader firmware:
    • Use your original NOR dump (my-original-cex.NORBIN) and rename it to (my-original-cex.EID0.NORBIN)
    • Double click on your CEX NOR file in mmOS (i.e. /dev_usb000/my-original-cex.EID0.NORBIN)
    • Quit multiMAN, Reboot your PS3 and install OFW/CFW 3.55 from XMB
    From andreus: To avoid the DEX2CEX brick in Step 32 of deank's CEX2DEX tutorial, do this: 1. Before you start be in Rogero DEX CFW 2. Flash your CEX.EID0.NORBIN in multiman CEX 3. Exit Multiman 4. In XMB update your PS3 with Rogero CEX CFW v3.4 (this CEX fw have LV1 syscon checks patched to avoid Bricking) 5. Done DO NOT TURN OFF YOUR PS3 in all the process or you will have the DEX2CEX brick because of CEX syscon hash checks!!! It seems is not possible to update from XMB so another alternative is needed, meanwhile don't do this process. Maybe first you will have to be in factory service mode or one of the other alternatives euss point out in IRC. Then if you want to go back to DEX: 1. Before you start be in Rogero CEX CFW 2. Flash your DEX.EID0.NORBIN in multiman CEX 3. Exit Multiman 4. In XMB update your PS3 with Rogero DEX CFW v2 ( 5. Done
    Notes: NAND should be also supported (Refer to the PS3 NAND CEX to DEX Guide by CaptainCPS-X). While I was converting my PS3 from CEX to DEX and then back from DEX to CEX I NEVER used the POWER BUTTON to turn-off/restart the PS3. The only time I had to do that is at the beginning when you have to enter the Recovery Menu after OTHEROS PUP is installed.

    All other firmware updates are performed from XMB (not from recovery menu) and all restarts/turn-offs are performed with {PS}->Turn Off in GameOS, or reboot/shutdown/restart/boot-to-game-os while in petitboot or linux.

    The PS3 I used for my tests is SLIM, which came with 2.70, never downgraded and no need for special firmwares with checks-disabled, etc. If you're console is downgraded from 3.56+ following this tutorial may brick it.

    You only need linux once just to obtain your key. After you have the keys you can switch to CEX/DEX/change the ps3 region from GameOS. Yes, it may be possible to obtain the key without installing linux (either from livecd or using some other method), but not at the moment.

    EASIEST WAY: When you boot your PS3 in PETITBOOT you can see the paths to the kernels. Two of these (first two lines) will show the correct path to your USB HDD (look for /......../petitboot/.....).

    If you see ...../sda1.... or ...../sdb1.... <--- this is your USB HDD so use the path with cd and then launch

    You can either use:
    cd /tmp/petitboot/mnt/sda1
    You can easily find your USB HDD by trying the folders:

    try to type these:
    cd /
    cd var
    cd tmp
    cd petitboot
    cd mnt
    here you can type
    ls -al
    and find your usb (sda* / sdb* / sdc*) (sda1 means Storage Device "A", partition 1, sdb1 means Storage Device "B", partition 1, etc) and then you can
    cd sda1
    (change "cd sda1" appropriately - if you use USB HDD, 1st partition is sda1, second is sda2, etc... If you use USB STICK/FLASH then sdb1/sdb2..)

    Below is a PS3 Real Debug (DEX) video from gt41 who used an E3 Flasher to dump the NOR, converted NORCEX to NORDEX and reflashed it back (without risk of bricking) to play PS3 game backups including Pro Evolution Soccer (PES) 2012.

    Also below is a PS3 DEX 4.11 - Pro Evolution Soccer 2012 (Italian) M109 by PS3DEX:

    Finally, from PS3 developer Rogero who recently released a Rogero 3.55 DEX Downgrader CFW Peek / Poke PS3UPDAT.PUP for Custom Firmware users:

    For all owners of PS3 consoles downgraded from 3.55+ using hardware flashers and Rogero_CFW_v3.x:

    Before attempting to convert to DEX and to avoid Bricking the PS3, please reset the PS3 syscon hashes to eliminate the need of using CEX/DEX firmwares with Patched LV1 checks.

    To Reset the syscon and have the PS3 back to normal safer mode like any original (non Downgraded ) PS3, here are the steps:

    1- After completing the downgrade process and having Rogero CFW 3.x up and running, make sure you have the Blu-Ray drive attached or the QA Toggle package won't work.
    2- Download the Rebug QA_Toggle package from here ( ---> toggle_qa.pkg
    3- Put the "toggle_qa.pkg" on USB and Install it on the PS3.
    4- Run the "Rebug Toggle QA" from XMB, the screen will go Black and you will see HDD Led activity then if all went fine you will hear one Beep and the PS3 will Restart back to XMB.
    5- If you want to make sure QA flag was set, go to "Network Settings" then apply the following key combo (all at the same time):

    L1 + L2 + L3 (press left stick) + R1 + R2 + dpad_down

    You should see Edy Viewer, Debug Settings, and Install Package Files if done correctly.

    6- Now that you have QA flag set, Turn Off your PS3 and Turn it back on but into "Recovery Menu"

    This Step is very important, it have to be from "Recovery Menu" and not a normal Update from XMB or the PS3 will Brick.

    Here is how to access it:

    a. Turn off PlayStation 3.
    b. Hold The power button down; The system will turn on and turn off once again.
    c. Once the System has been shutdown, re-press you finger until you hear 2 consecutive beeps
    d. When you hear the 2 beeps take finger off power button.
    e. You will be prompted to plug in your controller via usb and then hit the PS button
    f. The Recovery menu will pop up.

    Alternatively you can simply use CondorStrike's Updater package to enter Recovery Menu directly from XMB without going through the boot sequences. --> Condor Updater v2.0 (

    7- Now you must have any 3.55 OFW or CFW with original (non Patched) LV1, here's a link to 3.55-Kmeaw --> kmeaw355.PUP (

    8- Select the last option of the Recovery Menu --> System Update, then when prompted press "Start+Select" to start the update.

    Once finished the PS3 will restart into XMB with the Syscon hashes reset back to 3.55 in both "ros0" and "ros1" and your PS3 is back like any original/non Downgraded PS3 that can use any CEX/DEX Fw without having to worry about disabling LV1 checks.

    You can proceed now with converting from CEX to DEX by following Deank's tutorial normally.

    [imglink=|PS3 C2D CEX to DEX Flash Patcher v2, Changes Region / TargetID][/imglink]
    More PlayStation 3 News...

  4. #254
    tomi3 Guest
    Quote Originally Posted by segobi View Post
    there is an icon on the desktop saying "install red ribbon"

    got resistance 3 to work from usb hdd.
    How did you get resistance working? just the normal method? I got error with it and dont wanna mess around to much with it at 30gb a time, takes so long.

    Also have you (or anyone else) got resident evil raccoon city to work?

  5. #255
    vogue23 Guest
    MLB 12 The Show and Pro yakyuu spirits 2012 working? ...

  6. #256
    StanSmith Guest
    SO whats the easiest way to get a NOR dump on a retail console?

    I have a few US PS3's that need to be converted to AU.

  7. #257
    aldostools Guest
    StanSmith: The easiest way to get a NOR dump is using the latest online debug update of multiMAN 04.04.03 (keep pressing L2+R2 when you start multiMAN to enter in debug mode, then update). Then install the downloaded PKG.

    That version can dump NOR and write to NOR in the right fashion (1 sector) from .EID0.NORBIN files.

    To dump NOR: go to mmOS File Manager->Select any file and press CIRCLE->Open in HEX viewer->press [SELECT]->press [START]->answer: DUMP LV2(NO)->DUMP LV1(NO)->DUMP FLASH(YES)

    It takes only 5 seconds to dump a NOR.

    The biggest issue is dumping the metldr. It requires to install linux to run the metldrpwn. Installation of linux requires a lot of steps (including Restore PS3 System that deletes all system storage content and restores the system software to its default settings, and disk partitioning). So, before you start, make a backup of the PS3 HDD.

  8. #258
    segobi Guest
    i'd say memdump pkg is the easiest way. However you still need your methldrpwn dump - so anyway you gotta run linux and could also dump your nor/nand from commandline using dd.

  9. #259
    StanSmith Guest
    Anyone got a link for PS3 CEX2DEX Application r1 as the puush one is dead now. I found the CEX2DEX Application but its got a naming problem. It will dump the METLDR but it doesn't name it right so when you try to open it, it can't find it.

    What is it supposed to be called? There is nothing to say what its supposed to be called to put into the program so I cant convert CEX to DEX with it until I know what to call the file.

  10. #260
    segobi Guest
    May I suggest to read the tutorial ?

Page 26 of 67 FirstFirst ... 1625262736 ... LastLast

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts