Fix 8002F2C5 and 8002F225 PS3, and downgrade to 3.55. (Google translation)

After almost 10 months I ran out of my old PS3 because of a "splendid" Sony service center never thought I'd find the solution to this problem which made ​​me catch another PS3 I think that there was no solution ... and look at the end I found it! :-) And downgreando above the console.

To say that the solution is not trivial that requires some skill with the soldering iron and of course open the console. But even more patience and throw it forward.

The first is would like to thank people who helped me with lots of their work I managed to get it forward, these are:

Paula: Has had to endure a Jesus absorbed absent things even understand, and there is :-).

Judges: Undoubtedly without Norway would not have gotten anywhere. And above all for their support and letting me be your Betatester.

Javi_Santa: Without you friend and your passion for all micro controllers do not know many things that now is the internal flash.

demon_hades: For trying to seek help for the project. :-)

Jaicrab: By creating the Lv2Diag.self that does not perform checks of the reader drive and SYSCON.

No doubt all these people is as author as the writer of this feat.

The second, give thanks to $ ony, thanks to his ineptitude as a company has given me the opportunity to meet people and learn a lot, hopefully break your company. On the other hand also thank the fucking vague, which are nothing but lazy that instead of putting consumer complaint denouncing the abuse by Sony prefer to be quietly scratching their balls on the couch waiting for something like that will solve life. And I better not because I had no idea till I started had no idea either of these issues. I am quite sure is more one will still find something before installing your flasher at the console will continue scratching their eggs on the couch as is the "computer friend" to be done for him. And then there is a crisis ... My initial idea was simply to offer the solution to people who had bothered to put the consumer complaint but in the end I decided to be above these people and think people like the above named have currado galore and I think ill hide some of their work.

1- What do we need?

The unsecured PS3 (if you have the miss, and this error if Sony fix it under warranty). So far it has done successfully in the following models:

One solution to read and write flash (I have used the teensy, but you have the progskeet too, although more expensive)

Another way to put the console in service mode. (I've used a PIC or even the teensy)

HxD hex editor download

The first is that we have a solution to read / write our NOR flash type that is necessary (I have not carefully tested in a NAND type, but I guess it's just applying the patch in the direction of corresponding ROS0). I in my personal test I used a teensy + + 2.0 with Norway of Judges.

Download this pack: link - reuploaded - reuploaded Mega

For probably the E3 Flasher you use, you will need this program.

Patience in large doses.

2- Go for it

1. Well the first step is to get a flasher our clean dump our flash and make a thousand copies in a thousand devices, if something went wrong flash is back and at least we were as we were. To check it recently (in my tests) I wrote a tutorial here it is: link. This is very important that you have a copy is intact and that you are sure you are well. Very safe forever be able to return back.
2. In some cases (at least where I have gone through Flasher E3), need to have made a filebytereverses BEFORE and AFTER of the patch, to know you have to open your HxD DUMP and find the position 0x1f0, if you can read "FI.I" You need the flowrebuider if you read it otherwise "IFI" is not necessary. To perform this operation open Flowrebuilder program that you downloaded above select the option "Byte NOR reverse and extract a dump file." Select your DUMP and finally the click in the button. If everything is correct you will create a folder and a file ending in .REV. Although this file is that you must patch.
3. Well once we have this copy and ensure it is done we can start testing without fear. No joke I consider it an important step and if we have to pull one month till have our correct flash back as a month just for that.
4. Well now it's the time of patching, for this we take the pack that you have downloaded the file parche.bin and open it with HxD. This file is not more than 3.55 REBUG CORE_OS of another console that used to fix this. The good thing about this version is that LV1 is patched not to check the latest version at the SYSCON.
5. Good in the editor, select all (CTRL + A) and copy. Now open a copy of our flash dump and go to the position: 0C0000 and paste with CTRL + B, the letters will be red and will NOT notice that going to change the file size. Finally keep using File> Save As .. you put the name you want.
6. If you have had to make the point 2 of the tutorial, you will be the same operation with flowrebuider but you have patched the file if you have it you again echo to generate only one file. REV and the program will show a ERROR, if not fails and creates a folder, you have not taken the dump you had to be caught.
7. Well now we take our Flash and Flash file you just saved. If all goes well, come to our screen but this time it will give us the damn error but when we install will fail again. Do not worry will not last long;-)
8. Now it's time to put the console in service mode. We put our doongle and the usual way and followed Power - Eject. The console apparently does nothing and immediately turns off.
9. Now we take a flash drive that is formatted in FAT32. And we take PS3UPDAT.PUP file and the file is inside the folder Lv2Diag.self \ step1. Copy everything to the root of the pendrive.
10. Once done put the device into the USB on the right, and turn on the console again.
11. After 8-10 minutes the console will flash the LED and turn off.
12. And finally delete the USB flash drive and we put the contents of the folder Lv2Diag.self \ step 2. Put the USB flash drive into the port on the right. Turn on the console and after 10 seconds off.
13. Ready, you turn to light and you will be in version 3.55 V2 Rogero, with fully functional console. At this point, reset the console before I advise taking a copy of the flash function. And thus will not have to go with touch-if you have problems in the future.

If you want from the menu itself or the Recovery Console you can install the version you wish or even donwgrear to 3.41.

Now will just enjoy the console is resurrected. :-)

- gokuhs -

In some cases (at least where I have gone through Flasher E3), need to have made a file to your bytereverse patch it BEFORE and AFTER, to know you have to open your HxD DUMP and fix the position 0x1f0, if you can read "FI.I" You need the program if you read it otherwise "IFI" is not necessary. To perform this operation abreis Flowrebuilder program that you downloaded above haberis and You select the option "Byte NOR reverse and extract a dump file." Further down the asset is fitting that You select your picais DUMP and finally the button. If everything is correct you will create a folder and a file ending in. REV. Although this file is that you must patch.