PS4 News on Facebook! PS4 News on Twitter! PS4 News on YouTube! PS4 News RSS Feed!

Home PS4 News - Latest PlayStation 4 and PS3 News

December 2, 2010 // 7:10 am - A few weeks back we saw a video of PS Downgrade in action, and today ANTONIOPS at Spanish site (linked above) has posted up some videos showing PS3 Debug Firmware v2.15 being installed via PSDowngrade on a 40GB Retail version 3.41 console followed by running a PS Store demo.

Normally PlayStation 3 service boxes require a proper downgrade PUP file, however, comparing the SHA1 hash of the released PUP confirms it contains nothing special (just the old 3.41) so there appears to be something 'interesting' taking place when downgrading via PS Downgrade.

To quote, roughly translated: The noise you hear when you turn on the PS3 is the reader who is half repaired.

The Debug firmware I've installed the firmware downgrade PSDowngrade 3.41 to 2.15 Debug.

At the moment can only run signed code, such as a PS Store demo.

Those interested can check out the videos below!

Finally, in related news comes a brief guide from gliitch on installing PS3 Debug Firmware v1.0 on a Retail Console:

[ROoT] Level2Diag.self(1)/UPDAT.PUP(DEBUG1.0)

Put your PS3 into service mode, then once its powered down, plug in your usb stick with the files. it takes about 4 or so minutes to complete.

Wait for it to finish, and then turn the PS3 back on O_0 and vollia! 1.0 Debug on a retail PS3. Now, there isn't much point in doing this as it doesn't really have anything on it.

You can update straight back to FW 3.41 via usb by [RoOT] PS3/UPDAT.PUP/

Videos: Debug Firmware on Retail PS3 via PS Downgrade Demo

PlayStation Follow us on Twitter, Facebook and join us at our new site WWW.PSXHAX.COM!

#51 - cfwprophet - December 3, 2010 // 3:47 pm
cfwprophet's Avatar
to evilsperm
Hey i want to ask you to join our team. Noticed that you have some skills in case of payload moddifying is that right?
Maybe i have some ideas to get a full cfw done.

to FMAranda
Send it to us or post it and we can do some tests with it. In worst case we will have it for future purpose in case that if some times it will be possible to change files from flash.

#50 - mushy409 - December 3, 2010 // 2:49 pm
mushy409's Avatar
This is some interesting reading! cfwprophet - thanks for clearing that up!

I've been scouring the net for a decent-ish priced PS3 debug console and fingers crossed I might have it before xmas

At the moment it's like trying to play poker without and cards...

#49 - DeViL303 - December 3, 2010 // 2:24 am
DeViL303's Avatar
Yes, I think a very important part of Hacking the PS3 is to somehow get write access to the PS3s flash memory, hopefully a payload can achieve this, then we can start permanently modifying the XMB and the sky is the limit! For now the only permenant mods we can do are to the registry.

#48 - FMAranda - December 3, 2010 // 2:19 am
FMAranda's Avatar
Yes, i have the old sound here ready to change, but we can't write on dev_flash yet.

#47 - DeViL303 - December 3, 2010 // 2:17 am
DeViL303's Avatar
I already have my FTP app installed to network, I think thats where it belongs really as its certainly not a game.

P.S. I found after modifying install category (CB) in param.sfo I had to run the app once before it moved over to network category. Now it appears under network every boot.

#46 - hacked2123 - December 3, 2010 // 2:16 am
hacked2123's Avatar
If someone does a dump of the old firmware we can easily replace the sound... I think...

Its called coldboot_multi.ac3 and coldboot_stereo.ac3. Not sure what exactly coldboot.raf is.

#45 - DeViL303 - December 3, 2010 // 2:08 am
DeViL303's Avatar
be great if you can get a payload compiled for 3.41 debug, I'm sure there are plenty of PS3Test owners out there wanting to get in on the scene !

#44 - cfwprophet - December 3, 2010 // 1:56 am
cfwprophet's Avatar
Jop in case debug files even have install_pkg_file and app_home already defined into normal root id of category_game.xml placed in vsh\resources\explore\xmb.

But we want a own HAXXX cat with all the debug options in and later the hb app's too.

Games will not move from game cat. Also hb games shouldnt move i mean only apps... anyway from thread.

#43 - evilsperm - December 3, 2010 // 1:50 am
evilsperm's Avatar
I know the partial dump is missing a lot lol.

We can't get a proper dump until we get to correct offsets to get psgroove to run on this test console. We have tried RichDevX debug payload and it doesn't work at all, and we have come up with every payload under the sun to try to get it to take.

Now we are forced to have to dump elfs through lan and wireshark it to find the correct offsets, then we will be able to make a working payload and finely get a full dump of a debug.

#42 - cfwprophet - December 3, 2010 // 1:37 am
cfwprophet's Avatar
Ok, but you forgot how the ps3 will boot a os to download those fw and install it?

First the hardware starts let us say this is lv0.Then hardware loads lv1,lv2,metldr,ect.ect. and devflash.

The JIG sends response code and gain access over the ps3's RAM.Now the files from usb stick come into the play and the JIG patch normall lv2 from cxd chip loaded to ram with lv2diag from usb stick. Still the console load the files from dev_flash wich will be the visible part of the whole thing.Remember dev_flash holds xregistry.sys among a lot other importend files like rco's,sprx's,xml's and even the vsh.self including a lot of other self's.

I'm not sure if we really can unbrick a fullbricked con only truth jig or software. If we where able to read and write both flash chips cxd and samsung we would be able to unbrick a full bricked ps3.