TUTORIAL LENGKAP cara downgrade manggunakan PROGSKEET TEENSY [ NOR GUIDE ]

Teensy++2.0 NORway Guide

1. Downloading & Installing

A. Download the needed files

File Dropper
or
[url=http://www.filefactory.com/file/54fh8w24dga5/U.F.P.G. V4.60.exe]FileFactory[/url]
This will put all the needed files in the correct locations on your pc

SAVE THE ABOVE TO YOUR PC
RUN IT BY DOUBLE CLICKING THE INSTALLER.
WAIT FOR IT TO START (IT MAY TAKE A WHILE TO START)



1. click next until you get to this screen



2. select TEENSY++2.0 NOR
and click NEXT



3. don't change the default directory but remember where it is as you will need to go into that folder later on.
now click NEXT then NEXT again



4. it will install the needed files into the correct folders.



5. it doesn't take long before you see this screen.
click EXIT and your done.

B. Install python 2.7.2

1.click the "DOWNGRADE TOOL" icon on your desk top and select the [SETTINGS] tap then click [INSTALL PYTHON]



2 click run


 
3 click next


 
4 click next again


 
5 click next again



6 wait for it to install



7 click finish

C. Install pyserial-2.5.win32

1. Click [INSTALL PYSERIAL]



2 click run



3 click next



4 click next



5 click next again



6 it will install



7 click finish

D. Install teensy++2.0 driver

1. Click [Install teensy++2.0 driver]



2 click next



3 click done

E. The Teensy Loader Application

1. Click [Flash For NOR (Teensy++2.0)]



2 Connect the TEENSY++ then press the red button then click ok



3 now you will see this

if you don't see the above then click here

4 found new wizard will open select not this time and click next



5 click next again



6 click continue anyway



7 it will install the driver



8 click finish



9 Click [Device manager] 



10 you should see the above take note of the COM NUMBER 
Nb the one above is COM3 so you know what you’re looking for



11 select your com port. mine is com3 so that is what is shown. put your own com number in here

Setting Up The TEENSY++ 2

The recommended way to have the TEENSY++ is to use the voltage regulator, bridge the 3.3v pads and break the 5v track

SEE THE FIRST POST UNDER :-
Requied tools for downgrading > 3.Teensy++ 2.0 NOR & NAND

soldering the TEENSY++ to ps3

printed on the edge of the ps3's motherboard you will see your board number


DIA-001 & DIA-002 BOARDS



DNY-001



VER-001 BOARD



JSD-001 & SUR-001 & JTP-001 & KTE-001

Connecting the TEENSY++ with the 56pin NOR 360CLIP

the 360CLIP (you dont use the flat cable with "*SUNKEY Connect FPC" printed on it)


wiring diagram for original 360clip


wiring diagram for the newer UNIclip (made by 360clip)

3. create the dumps

SIGNAL BOOSTER EDITION


A. the main screen (NAND tab)
ensure the Teensy is connected to the pc and the ps3's NOR chip or test points
also turn on the powering option that you are using.



B. Select NAND in the [Step 1 select NOR in the [NAND type] box and any function in the [write type] box (don't leave it empty or the tool will crash)



C. Click [Step 2 (check connection)]



D. If you get this message then close the tool
Right click on the (NANDway Downgrade Tool) icon
select (Properties)
select (Compatibility)
at the bottom tick (Run this program as an Administrator)
Click (Apply) then (ok)
re-start the tool and follow the steps from A. again


E. you will should see the chip type as highlited above. if you don't then:-
the clip is attached propperly (99% reason for this)
the wires are soldered correctly / not shorting
and the board actually powered up

Press any key to close the CMD window



F. now click [Step 3 (Read NAND)



G. you should have something like the above
in red you can see it has detected the NOR chip correctly (Nb the chip type can be a slightly different one)
in blue you can see it is dumping. you don't want any errors to come up bellow this line. if you do then stop the dump
then either :-
1. [clean the NOR legs with alcohol. re clamp the clip down]
2. [check all your soldering and that the wires are in the correct places]




H. if you get the above however then check:-
the clip is attached propperly (99% reason for this)
the wires are soldered correctly / not shorting
and the board actually powered up



I. when it is done you will see the same as above.
it takes aprox XXmin to dump



J. a new popup window will ask where to save the dump. put it in
Desktop > NORway programs > Dumps click save

Verify the dumps

A. Check your dump with norpatch.exe

1. copy your dump dump.bin into NORway programs > verifiers



2. drag and drop the dump onto norpatch.exe
you should get the above window
you want the 2 ROS0 & ROS1 to detect a firmware version

if you recived a unknown for either then re-dump and start again.(you may get an unknown if your currently on a higher firmware then what norpatcher checks. eg norpatch 4.50 will give unknown if your on 4.53)
Now carry on to the next step

Check your dump with BwE_NOR_Validator

open BwE_NOR_Validator


copy your dump into this folder



run BwE_NOR_Validator



click "start"



type "y" and press "enter" if you are going to 3.55 or "n" and press "enter" if your going to 4.40
it will now patch the dump for 3.55. it takes a few minuets to start so just wait don't click anything



after patching it will ask if you want to byte-reverse. click "n" and press "enter"
it will now check the dump. it takes a few minuets to start so just wait don't click anything



if you typed "n" above then now you type "y" and press "enter"
it will now patch the dump for 4.40. it takes a few minuets to start so just wait don't click anything



after patching it will ask if you want to byte-reverse. click "n" and press "enter"
it will now check the dump. it takes a few minuets to start so just wait don't click anything



it will now start to check the dump. this takes xx minuets so again just wait for it to finish



it gives you some indication of the state of the dump at the bottom. 
you ideally want no warning and no danger this one has 1 warning
now press "ENTER"



The program will then open a html output illustrating everything that has been validated. Scroll through or use the menu at the top and read each section. 


If a validation says 'warning' or 'danger' investigate it yourself manually using a hex editor.
(how to use HxD is shown in the next validation spoiler) or contact somebody knowledgeable. Only corruption messages will show you the exact offset to look at, everything else won't so this is the reason you have to read/learn about it on the ps3devwiki. 

This one has a percentage WARNING as its only just below the recomended % and its the only warning then we can now move on to the next validation step

Some validations will tell you that you need to patch it, if this is the case then do so and re-validate the patched dump. (you should have done this when asked in the validator)



If your dump has any 'danger' messages in the per console sections (find them in the menu) then there is a good chance the dump is completely ruined and unfixable. Also, if your dump has a large amount of 'danger' messages then there is a serious issue - bad wiring can be discovered if you have any repetition in the dump.


if you recived a bad dump then re-dump and start again.
if you recived a good dump then carry on to the next strep



in the BwE folder you will now heve the above
rename the dump.bin.patched to dump.bin.patched.bin
and then put that one safe if it just verified ok.
put the origional dump.bin into swizzy's verify folder ready for the next step

C. Check your dump with Swizzy & rogero's PS3 Flash Tool

open PS3 Flash Tool



1. put the original dump into the Swizzy & rogero's PS3 Flash Tool folder
then drag and drop it onto PS3_Dump_Tool



2. The Program will Open and check the dump.
on the left it shows what areas are being checked text is green for good red for bad
the rest is self explanatory if everything is good then you will get a OK (carry on following the steps)

if you get BAD then skip to step 6


3 you will then get this popup asking if you want to patch for the latest cfw
click yes 




4 rogero auto patcher will open and patch the dump



5 once done click ENTER



6. click on any listed item to read a description in the "Advanced view" windows

if you have any in red then you need to re-dump as there bad and it is un-safe to flash this dump back to the ps3


7. you can now close this tool and in the Swizzy & Rogero's PS3 Flash Tool you will find your new patched dump NOR_patched.bin for going direct to the latest cfw

if you recived a bad dump then re-dump and start again.
if you recived a good dump then carry on to the next step

now if your going direct to the latest cfw then put NOR_patched.bin into the DUMPS folder

D. Check your dump with sinsizer_dumpstatistic_low_res

open sinsizer_NOR_NAND_Statistic



1. put the original dump into the sinsizer_dumpstatistic_low_res folder
then click on dumpstatistic to open it



2. if you want to patch the dump now then make the selection from the above box.
once you have selected your patch then tick the Progskeet / TEENSY box.

if you don't want to patch or you have a patched dump created from one of the other validators then just leave this as it is.



3 Now drag and drop dump.joined.bin into the box as shown



3b. NAND dumps will allways have this. its normal as its unreferenced area.




4 after a short moment you will be shown some basic results on this screen
Ignore the eid root key and the more tab as these have no functionality in this build


5 there are more results under the info tab

if you get no errors in a pop up then you have a good dump to this point.
if you get any errors then patch the dump if you haven't already. and see if it solves the errors
if not then save your error log and investigate the area(s) in the next validate step.

once you have checked everything being displayed is green you can close this tool



6 if you ticked one of the patch options then you will now find this in the same folder.
if you wish to use this patched dump then move it to the dumps folder.



if you recived a bad dump then re-dump and start again.
if you recived a good dump then carry on to the next step

Please note this from sinsizer:-

 Originally Posted by sinsizer 
Patching and validating again is not needed with the tool. Areas which get patched are excluded from validation.
Important infos can be found in the first post.(FOUND HERE) NAND validation is not very reliable, due to missing remapping and ECC algo. Always keep an eye on the badblock count from flowrebuilder. etc.
I can only guarantee for NOR validation. 
It would be good to mention that eid root key and the more tab has no functionality in this build.
I don´t want people to be confused about it 

I would also recommend installing 3.55 rogero/rebug after patching and flashing. 
Grabbing the eid root key with flatz RKdumper and updating to CFW4.46.
This allows eid decryption, HDD recovery, c2d and setting the QAflags via toggleQA.
The last sentence he refers to eid decription, HDD recovery, c2d is not something I have looked into.
so if you think it may be of interest to you then please search the forums. 
please don't ask me as I cannot help with this as yet.

E. How to use HxD editor and some example checks

In the “NORway programs” folder find the HxD hex editor install it and then run it. 


1 first time opening



2 click file click open



3 select all your dumps and select compare



4 leave the top as it is and change the bottom as you check each dump.



5 you should see this message after each dump has been checked. If you don’t delete all your dumps and try dumping again. If you still get errors at this point check your wiring.
When there all the same just have 1 dump open (we will use this all the time now) 



6 get a statistics. 



7 The fine blue bars at either side are what need checking (the one to the left is highlighted in red put your mouse on the left line and you should get a reading between 18.38% - 29.01%(in the area circled in blue) and the line on the right should be between 10.42% - 10.48%
Now close the statistics tab



8 The first thing you should see at offset 00000010 is FACEOFF , DEADBEEF 



9 if you see AC OF FF EO , AD DE EF BE then your dumps need byte reversing (see below the next 2 images for byte reverse steps) if you don’t see either then you have a bad dump. Re-do all your wiring and start again



10 you should see at offset 00000200 is IFI



11 if you see FI.I then your dump’s needs byte reversing. again if you don’t see either then you have a bad dump. Re-do all your wiring and start again

If you did see FI.I in your dump then you need to use flow rebuilder with the byte reverse option if it says IFI then you can skip this step

Byte reverse

First find the IDPS/TARGET ID & METLDR and then BOOTLDR (were still using the hex editor)
The area to find these depends on your ps3 model


12IDPS/TARGET ID is at 0002F077 (scroll down to 0002F070 then the top row of numbers is your last digit)

CECH-20xx (DYN-001 boards) it should have the value 09 (this is what is in the image)

CECH-21xx (SUR-001 boards) it should have the value 0A

CECH-25xx (JTP-001 boards) it should have the value 0B

CECH-25xx (JSD-001 boards) it should have the value 0B

CECHHxx (DIA-001 boards) it should have the value 05 or 06 or 07 

CECHJxx (DIA-002 boards) it should have the value 06 or 07

CECHKxx (DIA-002 boards) it should have the value 07

CECHLxx (VER-001 boards) it should have the value 07 or 08 or 09

CECHMxx (DIA-001 boards) it should have the value 03 or 06

CECHPxx (VER-001 boards) it should have the value 07 or 08


13 METLDR is at 0000081E & 00000842

CECH-20xx (DYN-001 boards) it should have the value 
E9 20 at 0000081E & 0E 8E at 00000842 “OR” 
E8 90 at 0000081E & 0E 85 at 00000842 (this is what’s shown in the picture)

CECH-21xx (SUR-001 boards) it should have the value 
E9 20 at 0000081E & 0E 8E at 00000842

CECH-25xx (JTP-001 boards) it should have the value 
E9 20 at 0000081E & 0E 8E at 00000842 “OR”
E9 60 at 0000081E & 0E 92 at 00000842 
WARNING IF IT HAS THIS F9 20 at 0000081E & 0F 8E at 00000842 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODEL

CECH-25xx (JSD-001 boards) it should have thE value 
E9 20 at 0000081E & 0E 8E at 00000842 
WARNING IF IT HAS THIS F9 20 at 0000081E & 0F 8E at 00000842 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODEL

CECHHxx (DIA-001 boards) should have the value 
E7 B0 at 0000081E & 0E 77 at 00000842 “OR” 
E8 C0 at 0000081E & 0E 88 at 00000842 “OR” 
E8 E0 at 0000081E & 0E 8A at 00000842 “OR” 
EA 60 at 0000081E & 0E A2 at 00000842

CECHJxx (DIA-002 boards) should have the value
E8 E0 at 0000081E & 0E 8A at 00000842 "OR"
EA 60 at 0000081E & 0E A2 at 00000842

CECHKxx DIA-002 BOARD
EA 60 at 0000081E & 0E A2 at 00000842

CECHLxx VER-001 BOARD
E8 D0 at 0000081E & 0E 89 at 00000842 or:-
E8 90 at 0000081E & 0E 85 at 00000842

CECHMxx DIA-001 BOARD
EA 60 at 0000081E & 0E A2 at 00000842

CECHPxx VER-001 BOARD
E8 D0 at 0000081E & 0E 89 at 00000842


14BOOTLDR is at 00FC0002 & 00FC0012

CECH-20xx (DYN-001 boards) should have the value 
2F 3B at 00FC0002 & 2F 3B at 00FC0012 “OR” 
2F 13 at 00FC0002 & 2F 13 at 00FC0012 (this is what’s shown in the picture)

CECH-21xx (SUR-001 boards) should have the value 
2F 4B at 00FC0002 & 2F 4B at 00FC0012

CECH-25xx (JTP-001 boards) should have the value 
2F 4B at 00FC0002 & 2F 4B at 00FC0012 “OR” 
2F 53 at 00FC0002 & 2F 53 at 00FC0012 
WARNING IF IT HAS THIS 2F 5B at 00FC0002 & 2F 5B at 00FC0012 OR 
2F FB at 00FC0002 & 2F FB at 00FC0012 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODEL

CECH-25xx (JSD-001 boards) should have this value 
2F 4B at 00FC0002 & 2F 4B at 00FC0012 
WARNING IF IT HAS THIS 2F FB at 00FC0002 & 2F FB at 00FC0012 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODEL

CECHHxx (DIA-001 boards) should have the value 
2F 1C at 00FC0002 & 2F 1C at 00FC0012 “OR” 
2E F4 at 00FC0002 & 2E F4 at 00FC0012 “OR” 
2E E3 at 00FC0002 & 2E E3 at 00FC0012

CECHJxx (DIA-002 boards) should have the value
2E F4 at 00FC0002 & 2E F4 at 00FC0012 “OR”
2E E3 at 00FC0002 & 2E E3 at 00FC0012

CECHKxx (DIA-002 boards) should have the value
2E E3 at 00FC0002 & 2E E3 at 00FC0012

CECHLxx (VER-001 boards) should have the value
2E AB at 00FC0002 & 2E AB at 00FC0012 “OR”
2E B3 at 00FC0002 & 2E B3 at 00FC0012 “OR”
2F 13 at 00FC0002 & 2F 13 at 00FC0012

CECHMxx (DIA-001 boards) should have the value
2E E3 at 00FC0002 & 2E E3 at 00FC0012

CECHPxx (VER-001 boards) should have the value
2E AB at 00FC0002 & 2E AB at 00FC0012

If you’re not getting some or none of these then you need to check your wiring and re-dump


Ok now we need to take a look and check there are no malformed headers / file names / region names. This is what we are looking for:-

Correct	Malformed	location
IFI	IJI	00000200
asecure_loader	asecure_loaher	00000420
eEID	eIIH	00000450
cISD	cESH	00000480
cCSD	cCSH	000004B0
trvk_prg0	trvg_prk0	000004E0
trvk_prg1	trvg_prk1	00000510
trvk_pkg0	trvg_pkk0	00000540
trvk_pkg1	trvg_pkk1	00000570
cvtrm	cztrm	00000600
metldr	mitldr	00000820

Now find the same positions as shown in blue in the following pictures yours should match



15 ASECURE LOADER



16 eEID



17 cISD



18 cCSD


Look for SCE on the line below the blue in the following pictures



19 trvk_prg0



20 trvk_prg1



21 trvk_pkg0



22 trvk_pkg1

Make sure all the words below the blue in the following pictures match yours



23 ros0



24 ros1

Make sure the following in blue matches



25 or

25 cvtrm



26 0FACEOFF DEADFACE



27 CELL EXTNOR AREA



28 bootldr (this is mine. yours will be slightly different but you should have info here not ff ff ff etc

extracting your dump

go to FlowRebuilder for extracting your dump



1 Click extract a byte reversed NOR dump or an interleaved and unscrambled NAND dump
I know it says NAND at the end but this is to extract your NOR dump



2 click button next to input file



3 select your nor dump



4 click execute program



5 dump extraction complete. It will put the extracted files into a folder called i.e. (dump.ext) in the same folder where you selected the original one



6 You should now have these files

If any are missing try extracting again. 

now go to the ps3devwiki's validating flash dumps pages and do the checks there
MAIN VALIDATE PAGE
DISCUSSION PAGE WITH MORE CHECKS

Once it all checks out ok upload your dump NOT the file you just created. to a file share site copy the link and CLICK HERE and follow the instructions on that thread.
Once it comes back ok don’t forget to thank the person or persons who checked it for you.

Flashing the ps3

A. the main screen (NAND tab)
ensure the Teensy is connected to the pc and the ps3
and that its still connected to the NOR / test points
also turn on the powering option that you are using.

Nb. if you have moved the clip or wires then now is a good time to make a new dump then compare it in HxD with the original BOTTOM dump
this will make sure your clip / wires are attached properly and prevent a brick.



B. Select NOR in the [Step 1 (select NAND)] [NAND type] box 



C. Select Write in the [write type] box



D. Click [Step 2 (check connection)]



E. You should get the same as above in the red box
if you do not get the above but any errors then start again
errors at this point are for the teensy being connected to pc NOT teensy connection to ps3

Press any key to close the CMD window



F. now click [Step 6 (Write to NAND)



G. you will be asked for the dump to flash. select Desktop > NORway programs > Dumps[bottom.bin.new.bin]



I. you should see something like the above
in red you can see it has detected the NOR chip correctly (Nb the chip type can be a slightly different one)
in blue you can see it is writing and what block its writing. 

you don't want any errors to come up bellow this line. if you do then stop the dump
then either :-
1. [clean the NOR legs with alcohol. re clamp the clip down]
2. [check all your soldering and that the wires are in the correct places]




J. if you get the above however then check:-
the clip is attached propperly (99% reason for this)
the wires are soldered correctly / not shorting
and the board actually powered up



K. when it is done you will see the same as above.
it takes aprox 1min 20seconds to write to the NOR chip

8. Follow these steps if you patched for 3.55

A. Finishing the down grade in service mode

B. De-hashing

Now you should be on 3.55ofw 

You can now install the 3.55cfw of your choice

9. Follow these steps if you patched for going direct to the latest cfw

re-insert the hdd then connect the ps3 to a TV the usual way
turn on your ps3 and it should boot into the xmb as normal

If you were on a lower firmware than the patch 
Ie
You were on 4.41 and you used 4.46 patches

Then when you turn the console back on your going to get either a black screen or it will shut off after 5 seconds
It's normal
You simply enter recovery
Hold power beep - dubble beep turns off
Hold power beep - dubble beep let go of power
Select option 6.

open the cfw folder
select the CFW version that you want
then copy the containing "PS3" folder to a fat32 formatted Mass Storage Device

plug in the Mass Storage Device into usb 0 (closest to drive / furthest right)
install the update from xmb under "update" "install fron Mass Storage Device" insure you have no disc in the blueray drive.

once done and the ps3 has booted back to xmb.
turn off the ps3 and enter "recovery menu" hold power button. ps3 turns on & beeps......keep holding power button.......short wait......beeps again & turns off.
release and re-press & hold power button. ps3 turns on & beeps.....keep holding power button.....short wait......ps3 double beeps...let go of power button.

select option 6

once done it will re-boot to xmb.