PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!

Home PS4 News - Latest PlayStation 4 and PS3 News

July 23, 2012 // 6:38 pm - Following up on his previous release, today PlayStation 3 developer judges has updated the Teensy++ 2.0 NOR flasher NORway for PS3 to version 0.5 with additional updates and their changes outlined below.

Download: NORway PS3 NOR Flasher for PS3 v0.5 / NORway PS3 NOR Flasher for PS3 v0.5 (Mirror) / NORway PS3 NOR Flasher for PS3 v0.6 Beta / NORway Latest Beta / norpatch.exe (v4.60.0) / norpatch.exe (v4.65.0) / norpatch.exe (v4.66.0) / norpatch.exe (v4.70.0) / norpatch.exe (v4.75.0) / GIT / Teensy++2.0 NOR Flashing with NORway: Only Write PerFirmware Data Trick / WAY-launchers v2.04.exe by littlebalup

NORway v0.5 Changelog:

  • Added block table for Samsung K8Q2815UQB. The programming modes "writeword" and "writewordubm" don't require manual chip/sector erase prior to writing anymore!
  • Bugfix: "NORway.py COMx release" didn't work. Now you can leave Teensy powered at all times and console will boot up correctly after issuing a "release" command
  • Bugfix: increased TRANSMIT_TIMEOUT for Teensy's serial device to 10000ms (required for OS X)
  • Bugfix: disabled DSR/DTR flow control (wasn't working reliably on OS X)
  • Bugfix: TRISTATE wasn't set correctly
  • Added additional verification when writing is done. Although each write command verifies each written sector/block, it happened that written bytes weren't persistent
  • Added "verify" command

NORway v0.6 Beta Changelog:

  • Changed programming modes "write", "writeword" and "writewordubm" to "vwrite", "vwriteword" and "vwritewordubm".
  • Added new programming modes that skip verification for single 4KB blocks: "write", "writeword" and "writewordubm".
  • Moved verification algorithm to Teensy.

Update: From littlebalup: Hi ladies and gents, As an alternative to WAYgui by Swizzy, here comes my personal simple programs, written in batch and compiled as exe, to easily launch and work with the well known NORway and NANDway python scripts by Judges.

Download: NANDway_launcher.zip / NORway_launcher.zip / WAY-launchers v2.01.zip / WAY-launchers v2.02.exe / WAY-launchers v2.03.exe / NORway_launcher.sh / NORway_launcher.sh (Fully Compatible Linux / Mac) / NORway_launcher.sh (NORway_launcher script) / NANDway_launcher.sh (NANDway_launcher script) / WAY-launchers-master.zip / GIT

Features:

  • Multi-lingual (English and french only for the moment, with auto-detection per windows language) If someones would like to translate to another languages, sources are available.
  • Teensy COM port auto-detection
  • Multi-dumps (I mean you can define a quantity of dumps to perform)
  • Binary dumps comparison after dumps (if multi-dumps) with log file.

Install note:

  • Simply paste the exe files into the same directory as NORway.py / NANDway.py
  • Execute

Update #2: Small update of the batch versions (now v1.9, same download links above).

New release v1.01 of the GUI:

  • Added Teensy programming feature: can load .hex file by clicking on the teensy picture.
  • Dump file extention changed: was "*.x.bin", now is *.bin" if only one dump and "*_x.bin if multi-dumps.

New version v2.00 of the GUI:

  • Removed embedded console due to problems with scripts output redirection.
  • Now scripts launched in a separate regular console prompt window.
  • "Save screen" and "Kill process" buttons removed as well. Instead, you can copy from console to save screen and use Ctrl+C to kill process if needed.

New version v2.01:

  • v2.01: Bug correction about Multi-dumps and binary checks. (Thanks to Joris 73 from LS)

WAY-launchers v2.02:

  • v2.02: Added compatibility with the latest USB serial drivers from PRJC: "Teensy USB Serial" driver now detected as well as the old one.

Here a new release of my GUI for NORway/NANway/SPIway: v2.02: Added compatibility with the latest USB serial drivers from PRJC. "Teensy USB Serial" driver now detected as well as the old one. Also means it is working well on Windows 8.1 now.

WAY-launchers v2.02 - GUI to run NORway, NANDway & SPIway scripts by Judges.

WAY-launchers v2.03:

  • v2.03: Correction of a minor bug concerning error level detection from python scripts.

WAY-launchers v2.04:

  • Added extra options to write/verify "Per Firmware" data only on NOR. Those Options require my modded NORway.py script to be enabled. See Installation Instructions for more details.

ATTENTION: The use of this program is at your own risk! The author can not be held responsible for the consequences of its use.

Simple GUI, written in VB.net and batch, to easily launch and work with the well known NORway, NANDway and SPIway python scripts by Judges for PS3 and PS4 hardware flashing using Teensy++ 2.0.

ADDITIONAL FEATURES:

  • Teensy COM port auto-detection
  • Teensy programming (load .hex file by clicking on teensy picture)
  • Multiple dumps (you can define a quantity of dumps to perform)
  • Binary dumps comparison after dumps (if multi-dumps) with log file.

SYSTEM REQUIREMENTS:


INSTALL INSTRUCTIONS:

  • Install python, pyserial, Teensy drivers, scripts... per Judges's instructions (github.com/hjudges/NORway)
  • Simply paste the "WAY-launchers.exe" file into the same directory as NORway.py / NANDway.py / SPIway.py.
  • Execute

CHANGE LOG:

  • v2.02: Added compatibility with the latest USB serial drivers from PRJC: Teensy USB Serial driver now detected as well as the old one.
  • v2.01: Bug correction about Multi-dumps and binary checks. Thanks to Joris 73 from LS.
  • v2.00: Removed embeded console due to problems with scripts output redirection. Now scripts launched in a separate regular console prompt window. Save screen and Kill process buttons removed as well. Instead, you can copy from console to save screen and use Ctrl+C to kill process if needed.
  • v1.01: Added Teensy programming feature: can load .hex file by clicking on the teensy picture. Dump file extention changed: was *.x.bin, now is *.bin if only one dump and *_x.bin if multi-dumps.
  • v1.00: First release

Update #3: New version of NORPatch available from judges: Norpatch v4.60.0

  • Added OFW 4.60 recognition

Update #4: New version of NORPatch available from judges: Norpatch v4.65.0

  • Added OFW 4.65 recognition

Update #5: New version of NORPatch available from judges: Norpatch v4.66.0

  • Added OFW 4.66 recognition

Update #6: New version of NORPatch available from judges: Norpatch v4.70.0

  • Added OFW 4.70 recognition

Update #7: New version of NORPatch available from judges: Norpatch v4.75.0

  • Added OFW 4.75 recognition

Linux Edition

A "Linux Edition" of the "NORway Launcher" console version is now available. Available soon for "NANDway Launcher" as well.

All the features of the Windows batch version are there (teensy port auto-detection, multi-dumps, binary comparisons...)

Developed and tested on debian based system (rpi / raspbian).

Quick guide to run judges scripts with linux:

- Ensure "python" and "python-serial" packages are installed:

[Register or Login to view code]



  • Get the latest Judges' files from his GitHub repo: github.com/hjudges/NORway, then unzip files.
  • Program your Teensy with the NORway.hex file using the PRJC loader and instructions available there : pjrc.com/teensy/loader_linux.html
  • Plug or unplug/re-plug your programmed Teensy, then, just after, run:

[Register or Login to view code]

So, you should obtain something like that at the end:

[Register or Login to view code]

Where " ttyACM* " is your serial port, fully named " /dev/ttyACM* ". Note this port name.

  • Go to your NORway unziped folder then make the NORway.py executable:

[Register or Login to view code]


  • Now you can start to run Judges's script with:

[Register or Login to view code]

example of dump command:

[Register or Login to view code]

To use with my script:

  • Past the "NORway_launcher.sh" file to the same folder as the "NORway.py" file.
  • Make it executable:

[Register or Login to view code]



  • Run:

[Register or Login to view code]

enjoy

Just tested on Mac OS-X as well. It works (partially).. but you have to manually set serial port which is something like /dev/tty.usbmodem*

To find it: ls /dev/tty.usbmodem* once connected. Maybe some bugs. I'll work for a full Mac support as well (so, will be "Linux & Mac edition).

Linked above is a new beta script that should be fully compatible Linux/Mac.

Script revised to v1.01 and renamed "Linux & Mac Edition" now supports Mac as well as Linux and certainly some other Unix based OS. NANDway script also available (linked above).

Update #8: Small update: Release v1.02

With some minor bug corrections + some improvements as:

  • NORway / NANDway version check with warning message.
  • Comparison log improvement.

Update #8: From littlebalup comes TEENSY2PS3 - PCB "Linker" Teensy++2.0 <-> PS3 with details HERE (via logic-sunrise.com/forums/topic/66446-teensy2ps3-un-linker-teensy20-ps3-nor-et-nand/), roughly translated as follows:

I present you my project of a simple PCB (printed circuit board) to facilitate the use of our teensy++2.0 for the flash of PS3 NOR and/or NAND:

Intent:

  • Simple
  • Cheap
  • Easy (to use, to assemble...)
  • Smallest as possible with board traces shorter as possible.
  • Compatible NOR and NAND (SBE) and switchable/reversable between both.
  • Compatible 360-Clips NOR and NAND.
  • Usable with existing layouts and softwares (judges' ones), teensy equiped with voltage regulator or not, etc...
  • Modular (for futur extentions as TSOP adapters for raw NOR/nand... maybe)

So I designed, built and tested a prototype since a couple of months with very good results. Some pictures:

NakedPCB:


PCB Equipped:


With Teensy and 360 clip boards:


Usage on NOR with SCSI 50 pins cable:


For those who are interested, here the gerber files to manufacture this board: TEENSY2PS3_v1.00

I'll post a "user manual" later (I have to translate it )

Meantime, I developed a new version (v1.01) with some minor improvements and the addition of optionnal "POWER LED" and "TRISTATE LED":


Build in process... For info, I just tested on Red Ribbon (otherOS)... it works great too. Not useful but fun: flash a PS3 by another PS3.

A video showing NOR tristate LED usage on the v1.01:

TEENSY2PS3 v1.01 - NOR Tristate LED Demo




v1.01 release coming very soon. v1.01 released:

Download: TEENSY2PS3_v1.01.zip / TEENSY2PS3_v1.01_manual_EN.pdf

Update #9: New update of the windows GUI "WAY-launchers" available:

v2.04: Added extra options to write/verify "Per Firmware" data only on NOR. Those Options require my modded NORway.py script to be enabled. See Installation Instructions for more details.

So, I officially released my modded NORway as well: NORway.py

[Register or Login to view code]

NORway - Teensy++ 2.0 NOR Flasher for PS3 v0.5 is Released

NORway - Teensy++ 2.0 NOR Flasher for PS3 v0.5 is Released

NORway - Teensy++ 2.0 NOR Flasher for PS3 v0.5 is Released

Follow us on Twitter, Facebook and drop by the PS3 Hacks and PS3 CFW forums for the latest PlayStation 3 scene and PS4 Hacks & JailBreak updates with PlayStation 4 homebrew PS4 Downloads.



#31 - slappyg69 - October 29, 2014 // 1:26 pm
slappyg69's Avatar
can someone direct me to a picture of the pin out for teensy with the various motherboard types?

#30 - Kenturo - October 24, 2014 // 9:45 am
Kenturo's Avatar
Nice, I need 2 posts to see the links

#29 - hafizaziz - October 21, 2014 // 10:45 pm
hafizaziz's Avatar
thanks.

please help me downgrade 3.65

#28 - petergotsole - August 15, 2014 // 6:02 am
petergotsole's Avatar
Hello everyone, thank you for taking the time to read this as im writing this 310am after 7+ hours of searching how to 'jailbreak/downgrade' my ps3 to 3.55.

Note I am a complete noob and im sorry if this has been asked a million times but believe me when i say i tried putting peoples opinions and answers together and still couldn't come up with a solution.

I have 2 Slim PS3's (second gen) and only want to jailbreak 1 due to reading a bunch of forums and opinions how one shouldn't be jailbroken, sooo...

Both are running on 4.60 but the upgrades before were 2.70 (cech2001A) for one of them and 3.40 (cech2501A) for the other so both of them are good to go but i plan on downgrading my 3.40.

I'm aware i need a flasher and I've seen plenty tutorials but they're a little out of my price range so i was leaning more towards the NORway teensy but even then there are many options to choose from.

So what im asking of you guys/girls is a complete checklist of things i need to get and maybe how to disassemble and solder (also wondering 1-10 how hard and chances of me bricking my system) the board or whatever it is and what i need to program to downgrade. I know theres a difference between NOR and NAND and i think i have a NOR since all slims are NOR but haven't seen any tutorials for them.

After all that downgrading now what? do i begin jailbreaking and what sources do i need? (if its anything like the iphone lol if not i apologize)

My main intention isn't to pirate anything but i have my reasons and maybe have some fun on mw3 hosting lobbies (with friends) since a lot of people are against hacking online.

Also i've read many that if i were to hack online i would get banned instantly for any game especially well known games.

so thank you to whoever can respond to these question, i really do appreciate anyone taking the time to help me with my troubles. i have an empty shopping cart waiting....

Reason why i leaned towards the teensy is after reading about NORway.. it's the software for Teensy++ 2.0 development board and brings stability and reliability to NOR flash reading.

most importantly Teensy++ 2.0 development board is made by US company and it costs USD 27 with pins solder to it, which means no custom import taxes for people in the US. so, what you need:

  • NORway: free and open source software
  • Teensy++ 2.0 development board with pins soldered to make it easier for you
  • 360-clip NOR clip 58-pin
  • female jumper wires

bottom line for less money you get much better solution, which is something from the past for me. last, but not least and for completeness i want to mention that you will need to solder few extra pins to Teensy++ 2.0, because the version with soldered pins doesn't have all necessary for NORway work pins soldered.

that again can be done from someone for you for just a few bucks - at the end you will end up with a actually NOR programmer with professional quality and reliability and you can even help other people with it and make money.

#27 - nikolass - August 20, 2012 // 7:52 am
nikolass's Avatar
can i downgrade 4.xx ps3 with just a Teensy ++ 2.0 ?

Also from littlebalup comes a Teensy++2.0 NOR Flashing with NORway: Only Write PerFirmware Data Trick:

Hi,

Maybe some of you already knows those stuff. But I never seen any real subjet/tutorial about it. So, here it is. Be warned this is rather intended for advanced users. Later, I'll maybe update my different tools to use this feature/option in a more accessible/automated way. Of course, all credit goes to Judges who made this possible with NORway.

For a long time it stuck in my head. Namely, only flash the "Per Firmware" area of a NOR flash instead of the entire NOR each time. A little bit as the "differential flashing" on NANDs. This is more safe since it does not touch to the very important "Per Console" data. So, if any corruptions have been introduced to your dump file during read process (some corruptions can be undetectable by checkers), it will not be reproduced to your NOR flash memory.

I will not develop furthermore, I think everyone understands the value of the thing. And I knew the script "Norway" by Judges has functionalities to write, erase, verify defined blocks, but I never really considered the question till now...

In any case, this trick does not exempt you to do everything to get a valid full dump before to attempt to modify your flash memory. It is and it will always remain the golden rule. Consider it only as an additional precaution.

First, what are NORway capabilities exactly?

Looking at the NORway help screen:


So, basically we learn we can ask to NORway to write from a given address in the NOR (or erase, or verify). The default adress is 0x0 (which is the beginning of the NOR. It sounds logic). It is also indicated that the addresses must be a multiple of 0x20000 (131072 Bytes, 131072/1024 = 128 KB. This represents the size of a block. I would go back further.)

However important questions remain unanswered:

  • It start to write from a given address, Ok. But, when it stops? (as example, we have the booldr to the end of NOR and we don't want to overwrite it)
  • What kind of file must we use as template for writing? The full dump? A piece of dump?

To answer, I dived into the NORway code. I'll not make the demonstration here (but you can have a look here).

Finally, full rules are:

  • NORway write block by block of 128KB (0x20000) (there are available variants for Samsung K8Q2815UQB but I will not go into these useless details).
  • NORway can begin writing from a given block address (a multiple of 128KB, so a multiple of 0x20000).
  • NORway write the entire template file content (dump) starting from the given block address, and will stop only when he has written all data contained in that file (or until it arrives at the end of the NOR ..?).
  • If the size of the template file content (dump) is not a multiple of the size of a block (128KB, 0x20000), it will truncate the last data (it will not write them).

Based on those rules, we can say it is not a complete dump file that is required for our per-firmware partial write, but a piece of dump (or patches assembly) gathering per-firmware data we want to write. And no more. The size of this file must be an exact multiple of 0x20000 (128KB).

Then, looking at Per Firware data:

Based on our Holy Scriptures (wiki), Per Firmware data are "trvk"s and "ROS"s. Basically, the data we modify (patch) for jailbreaking. With:

[Register or Login to view code]

First good news, all data are contiguous. So we can write them in "one shot" using a single file. Second good news, data begin at an address that is a multiple of 0x20000 (0x40000). Third good news, whole data is a multiple of 0x20000:

0x20000 x 4 + 0x700000 x 2 = 0xE80000 (total size of perfirmware data)
0xE80000 / 0x20000 = 116 (116 full blocks)

All the conditions are there

Note it also work if you just want ROSs with a total size of 0xE00000 (0x20000 x 112) starting at address 0xC0000 (0x20000 x 6). So, theory is done. Let's go to practice.

Create PerFirmware template file:

We could create one from scratch using existing patches but that would be a bit painful and may miss some additional data (ROS headers). So, the simplest is to start on a clean patched dump file.

Basically, as you certainly understood, it is simply to copy the whole data starting from offset 0x40000, length 0xE80000. Then paste and save to a new file.

Spoiler!


We now have our per-console template for the write. A file with a size of 15204352 bytes exactly (0xE80000). Either 14848 KB or 14,5 MB. (Note that per-firmware data is 90% of the complete dump. It will not save much flash time). Those data can be flashed on any console obviously. And there is no need to redo a template for each console till you want to change patchs versions.

For you, perfirmware templates I made (if you want to try them or compare):


Write Per-Firmware data to NOR:

So far, nothing complicated. This is a classic write but using the per-firmware data template file and the start address where they must be written. 0x40000 in this case (not to forget the "0x" in front and do not forget some "0" otherwise it will not be written where it should...):

Command example:

[Register or Login to view code]

Once done, you can dump again and compare with your original patched dump. They should be exactly the same.

Finally a quick demonstration video (in French... sorry).



Enjoy your flash

Meantime, I made a modified NORway.py (v0.7) to write/verify only PerFirmware data without the need of an extra perfirmware template file.

It will directly load the perfirmware data from your dump file (from offset 0x40000, length 0xE80000), then write/verify them as described previously.

All the original functions are maintained, plus:


Works with "(v)write", "(v)writeword", "(v)writewordubm" and "verify" commands.

Teeensy to be programmed with the original NORway.hex (v0.7) by Judges: github.com/hjudges/NORway

Download: NORway_v0.7_MOD0.1.zip

For aficionados, the modified code (simple):

WAS:

[Register or Login to view code]

IS:

[Register or Login to view code]


#26 - evajoly - May 29, 2012 // 12:30 pm
evajoly's Avatar
love this thanks

#25 - ullasmanju - May 29, 2012 // 9:41 am
ullasmanju's Avatar
thanks man it helped me a lot...

#24 - PS4 News - September 29, 2011 // 4:53 am
PS4 News's Avatar
NORway - Teensy++ 2.0 NOR flasher for PS3 v0.4 is now released by judges.

Download: NORway v0.4 for PS3 / GIT

Just finished NORway v0.4 beta 10. Implemented CrackMyDay's excellent bulk writing method, which reduces programming time for "writeword" mode from 60mins to less than 10mins. "writewordubm" mode also doubled its speed (

#23 - gokuhs - September 22, 2011 // 1:31 am
gokuhs's Avatar
Hi guys!

Thanks for this great tutorial, I try dump my flash on a 3.56v1 FAT Ps3 (the motherboard is the same in this post) but I'm not sure if the dump are correctly dumped. Who I can check it? I would not try to flash it and finally kill the Ps3

Sorry for my bad English, and thanks for the help.

#22 - cvp - September 21, 2011 // 5:02 pm
cvp's Avatar
is there a testpint plan for PS3 Slim CECH-2004B? Can't find it