TUTORIAL LENGKAP cara downgrade manggunakan PROGSKEET [ NOR ]

tools needed

1. ProgSkeet 1.1

optional but recomended

2. NOR 56 pin 360-clip (360-clip old type)


3. NOR 56 pin uni-clip (360-clip new type)

Downloading and installing

File Dropper
or
[url=http://www.filefactory.com/file/54fh8w24dga5/U.F.P.G. V4.60.exe]FileFactory[/url]
This will put all the needed files in the correct locations on your pc

setting up progskeet 1.0 / 1.1

soldering the ProgSkeet

1. With the Blue Boards there are 2 jumpers to create (bridge). for both white & blue boards there is 1 resistor to remove. The areas in YELLOW circles (R9 & R 11 the 3.3v setting) need soldering (bridge). And in RED Circle the R7 needs the resistor removing. Nb if you heard about removing R8 this is old news and needs to remain attached now.



2. it should look like this

soldering diagrams

find your board's diagram (printed on the edge of the ps3's motherboard you will see your board number eg DNY-001


DIA-001


DYN-001


JSD-001 & JTP-001


VER-001

Install the ProgSkeet’s drivers

1. Install the ProgSkeet’s drivers (called “winskeet”):-



2. go to the "ProgSkeet programs" folder and select extract here with WinZip



3. scroll to the bottom to find winskeet



4. right click and send to desktop
Plug in the Progskeet to the pc with the ps3's controller usb cable



5. the card will be detected and the install new hardware wizard will run. click not this time



6. click install from a list or specific location



7. browse to location



8. select location



9. installing



10. completed

setting up progskeet v1.2 & v1.21

soldering the ProgSkeet

remove R7 and solder R8
this puts the progskeet into NOR mode

soldering diagrams

DO NOT THE 3.3V POINT IT WILL DAMAGE THE PROGSKEET 


VER-001



JSD-001 & SUR-001



DYN-001



DIA-001

Install the ProgSkeet’s drivers

UNDER CONSTRUCTION

create your dump

connect Progskeet to the pc via usb
and start winskeet



you should be on the main screen so first select your NOR type



MINES THE SPANSION 128P

{image to be added}
click the NOR tab then click "take over"


{image to be added}
this window will pop up. Power on ps3 to halt the boot up and click ok
(if it doesnt halt the ps3 then just turn off the ps3 then back on. it should halt now)

halting is where the ps3 wont boot. look for the orange hdd light it should not flash. if it doesnt halt then even with no hdd plugged in the hdd light will still give 1 or 2 blinks. 




A CLICK “DUMP CFI” save it as cfi dump (this will verify your NOR if this fail’s double check your wiring and that you have selected the right NOR in the first page)



click dump



Dumping (it doesnt take long so don’t go anywhere)



if the dump fail's

If it fail’s

Why does it give verification errors when writing or halt/freeze when dumping? 
Bad wiring 
30AWG (bad) instead of 26AWG (ok) for NOR 
Too long wires (>15cm) 
Bad PC / USB chipset, just try an old PC with Windows XP/Linux 
Bad USB cable (i have found the 1 mini usb to 2 usb cables work great)
Interference 
Bus not free / Halted incorrect 
Power drops 
Bad grounding

verify the dumps

Check your dump with BwE_NOR_Validator

open BwE_NOR_Validator


copy your dump into this folder



run BwE_NOR_Validator



click "start"



type "y" and press "enter" if you are going to 3.55 or "n" and press "enter" if your going to 4.40
it will now patch the dump for 3.55. it takes a few minuets to start so just wait don't click anything



after patching it will ask if you want to byte-reverse. click "n" and press "enter"
it will now check the dump. it takes a few minuets to start so just wait don't click anything



if you typed "n" above then now you type "y" and press "enter"
it will now patch the dump for 4.40. it takes a few minuets to start so just wait don't click anything



after patching it will ask if you want to byte-reverse. click "n" and press "enter"
it will now check the dump. it takes a few minuets to start so just wait don't click anything



it will now start to check the dump. this takes xx minuets so again just wait for it to finish



it gives you some indication of the state of the dump at the bottom. 
you ideally want no warning and no danger this one has 1 warning
now press "ENTER"



The program will then open a html output illustrating everything that has been validated. Scroll through or use the menu at the top and read each section. 


If a validation says 'warning' or 'danger' investigate it yourself manually using a hex editor.
(how to use HxD is shown in the next validation spoiler) or contact somebody knowledgeable. Only corruption messages will show you the exact offset to look at, everything else won't so this is the reason you have to read/learn about it on the ps3devwiki. 

This one has a percentage WARNING as its only just below the recomended % and its the only warning then we can now move on to the next validation step

Some validations will tell you that you need to patch it, if this is the case then do so and re-validate the patched dump. (you should have done this when asked in the validator)



If your dump has any 'danger' messages in the per console sections (find them in the menu) then there is a good chance the dump is completely ruined and unfixable. Also, if your dump has a large amount of 'danger' messages then there is a serious issue - bad wiring can be discovered if you have any repetition in the dump.


if you recived a bad dump then re-dump and start again.
if you recived a good dump then carry on to the next strep



in the BwE folder you will now heve the above
rename the dump.bin.patched to dump.bin.patched.bin
and then put that one safe if it just verified ok.
put the origional dump.bin into swizzy's verify folder ready for the next step

Check your dump with Swizzy's PS3DumpChecker

open Swizzy's PS3DumpChecker



Click on PS3DumpChecker



This Program will Open



Click "Check Image"



direct it to the dump and click the dump to open it



you will be back at the tool. just wait it's running the tests



as it works a list will be created in the left panel
they will be in green if there good or red if there bad



At the bottom right it will say BAD / OK etc as shown in the red box
in the green box you will see the lowest firmware you ps3 can go to.

if you recived a bad dump then re-dump and start again from the first verify tool.
if you recived a good dump then carry on.


image 7
if there are any errors you will get a pop up warning like this



click on any listed item to read a description in the "Advanced view" windows



you can now close this tool



you will now have these files in the swizzy folder
have the notepad has the results saved for future reference
move the dump.bin from this folder and put it back into the main folder ready for the next verify step

How to use HxD editor and some example checks

Open the “program’s” folder find the HxD (hex editor) (install it like you did with Progskeet) and then run it. 


first time opening



click file>>click open



get a statistics. 



The fine blue bars at either side are what need checking (the one to the left is highlighted in red put your mouse on the left line and you should get a reading between 18.38% - 29.01%(in the area circled in blue) and the line on the right should be between 10.42% - 10.48%
Now close the statistics tab



The first thing you should see at offset 00000010 is FACEOFF , DEADBEEF 



if you see AC OF FF EO , AD DE EF BE then your dump’s need byte reversing if you don’t see either then you have a bad dump. Re-do all your wiring and start again

Byte reverse

Byte reverse

Inside “programs” folder find FlowRebuilder run it



this is the main screen




select byte reverse a dump



click the box next to brows, drag & drop, drop down



select your dump



click execute operation



and it’s done it in the same place as the dump and its added “swap” to the name




you should see at offset 00000200 is IFI



if you see FI.I then your dump’s needs byte reversing. again if you don’t see either then you have a bad dump. Re-do all your wiring and start again

If you did see FI.I in your dump then you need to use flow rebuilder with the byte reverse option if it says IFI then you can skip this step

Byte reverse

Byte reverse

Inside “programs” folder find FlowRebuilder run it



this is the main screen




select byte reverse a dump



click the box next to brows, drag & drop, drop down



select your dump



click execute operation



and it’s done it in the same place as the dump and its added “swap” to the name


First find the IDPS/TARGET ID & METLDR and then BOOTLDR (were still using the hex editor)
The area to find these depends on your ps3 model


IDPS/TARGET ID is at 0002F077 (scroll down to 0002F070 then the top row of numbers is your last digit)

CECH-20xx (DYN-001 boards) it should have the value 09 (this is what is in the image)

CECH-21xx (SUR-001 boards) it should have the value 0A

CECH-25xx (JTP-001 boards) it should have the value 0B

CECH-25xx (JSD-001 boards) it should have the value 0B

CECHHxx (DIA-001 boards) it should have the value 05 or 06 or 07 

CECHJxx (DIA-002 boards) it should have the value 06 or 07

CECHKxx (DIA-002 boards) it should have the value 07

CECHLxx (VER-001 boards) it should have the value 07 or 08 or 09

CECHMxx (DIA-001 boards) it should have the value 03 or 06

CECHPxx (VER-001 boards) it should have the value 07 or 08


METLDR is at 0000081E & 00000842

CECH-20xx (DYN-001 boards) it should have the value 
E9 20 at 0000081E & 0E 8E at 00000842 “OR” 
E8 90 at 0000081E & 0E 85 at 00000842 (this is what’s shown in the picture)

CECH-21xx (SUR-001 boards) it should have the value 
E9 20 at 0000081E & 0E 8E at 00000842

CECH-25xx (JTP-001 boards) it should have the value 
E9 20 at 0000081E & 0E 8E at 00000842 “OR”
E9 60 at 0000081E & 0E 92 at 00000842 
WARNING IF IT HAS THIS F9 20 at 0000081E & 0F 8E at 00000842 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODEL

CECH-25xx (JSD-001 boards) it should have thE value 
E9 20 at 0000081E & 0E 8E at 00000842 
WARNING IF IT HAS THIS F9 20 at 0000081E & 0F 8E at 00000842 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODEL

CECHHxx (DIA-001 boards) should have the value 
E7 B0 at 0000081E & 0E 77 at 00000842 “OR” 
E8 C0 at 0000081E & 0E 88 at 00000842 “OR” 
E8 E0 at 0000081E & 0E 8A at 00000842 “OR” 
EA 60 at 0000081E & 0E A2 at 00000842

CECHJxx (DIA-002 boards) should have the value
E8 E0 at 0000081E & 0E 8A at 00000842 "OR"
EA 60 at 0000081E & 0E A2 at 00000842

CECHKxx DIA-002 BOARD
EA 60 at 0000081E & 0E A2 at 00000842

CECHLxx VER-001 BOARD
E8 D0 at 0000081E & 0E 89 at 00000842 or:-
E8 90 at 0000081E & 0E 85 at 00000842

CECHMxx DIA-001 BOARD
EA 60 at 0000081E & 0E A2 at 00000842

CECHPxx VER-001 BOARD
E8 D0 at 0000081E & 0E 89 at 00000842



BOOTLDR is at 00FC0002 & 00FC0012

CECH-20xx (DYN-001 boards) should have the value 
2F 3B at 00FC0002 & 2F 3B at 00FC0012 “OR” 
2F 13 at 00FC0002 & 2F 13 at 00FC0012 (this is what’s shown in the picture)

CECH-21xx (SUR-001 boards) should have the value 
2F 4B at 00FC0002 & 2F 4B at 00FC0012

CECH-25xx (JTP-001 boards) should have the value 
2F 4B at 00FC0002 & 2F 4B at 00FC0012 “OR” 
2F 53 at 00FC0002 & 2F 53 at 00FC0012 
WARNING IF IT HAS THIS 2F 5B at 00FC0002 & 2F 5B at 00FC0012 OR 
2F FB at 00FC0002 & 2F FB at 00FC0012 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODEL

CECH-25xx (JSD-001 boards) should have this value 
2F 4B at 00FC0002 & 2F 4B at 00FC0012 
WARNING IF IT HAS THIS 2F FB at 00FC0002 & 2F FB at 00FC0012 STOP NOW YOU CANNOT DOWNGRADE THIS PS3 MODEL

CECHHxx (DIA-001 boards) should have the value 
2F 1C at 00FC0002 & 2F 1C at 00FC0012 “OR” 
2E F4 at 00FC0002 & 2E F4 at 00FC0012 “OR” 
2E E3 at 00FC0002 & 2E E3 at 00FC0012

CECHJxx (DIA-002 boards) should have the value
2E F4 at 00FC0002 & 2E F4 at 00FC0012 “OR”
2E E3 at 00FC0002 & 2E E3 at 00FC0012

CECHKxx (DIA-002 boards) should have the value
2E E3 at 00FC0002 & 2E E3 at 00FC0012

CECHLxx (VER-001 boards) should have the value
2E AB at 00FC0002 & 2E AB at 00FC0012 “OR”
2E B3 at 00FC0002 & 2E B3 at 00FC0012 “OR”
2F 13 at 00FC0002 & 2F 13 at 00FC0012

CECHMxx (DIA-001 boards) should have the value
2E E3 at 00FC0002 & 2E E3 at 00FC0012

CECHPxx (VER-001 boards) should have the value
2E AB at 00FC0002 & 2E AB at 00FC0012

If you’re not getting some or none of these then you need to check your wiring and re-dump

Ok now we need to take a look and check there are no malformed headers / file names / region names. This is what we are looking for:-
No code has to be inserted here.
Now find the same positions as shown in blue in the following pictures yours should match



ASECURE LOADER (00000800)



eEID (0002f000)



cISD (0003f000)



cCSD (0003F800)


Look for SCE on the line below the blue in the following pictures



trvk_prg0 (00040010)



trvk_prg1 (00060010)



trvk_pkg0 (00080010)



trvk_pkg1 (000A0010)

Make sure all the words below the blue in the following pictures match yours



ros0 (000C0000)



ros1 (007C0000)

Make sure the following in blue matches



cvtrm (00EC0000)
note you may get this instead in the blue highlight:
00EC0000 53 43 45 49 FF FF FF FF FF FF FF FF FF FF FF FF SCEIÿÿÿÿÿÿÿÿÿÿÿÿ



0FACEOFF DEADFACE (00F00010)



CELL EXTNOR AREA (00F20000)



bootldr (00FC0000)

extracting your dump

go to FlowRebuilder for extracting your dump



Click extract a byte reversed NOR dump or an interleaved and unscrambled NAND dump



click button next to input file



select your nor dump



click execute program



dump extraction complete. It will put the extracted files into a folder called i.e. (dump.ext) in the same folder where you selected the original one



You should now have these files

If any are missing try extracting again. 

now go to the ps3devwiki's validating flash dumps pages and do the full checks there
MAIN VALIDATE PAGE
DISCUSSION PAGE WITH MORE CHECKS

Once it all checks out ok upload your dump NOT the file you just created. to a file share site copy the link and CLICK HERE and follow the instructions on that thread.
Once it comes back ok don’t forget to thank the person or persons who checked it for you.

Flashing the ps3

Flashing the ps3

Turn on ps3 then plug the Progskeet into your pc



Open winskeet & select your NOR 



click the NOR tab and click “Dump CFI” this will insure your nor is set right in winskeet



at the bottom it says “options” under that you have 2 drop down boxes
set yours as shown here (these seem to be the best settings for all NOR types) if you don’t change them you may get freezing issues.



click the “flash” tab & select your patched NOR dump (now called dump.patched)



it will read



erase



flash



verify


Repeat the steps until you get this message

if you get a lot of verify errors when you flash then set these depending on your NOR type

at the bottom it says “options” under that you have 2 drop down boxes
set yours as shown below

PLEASE NOTE. AFTER ALOT OF TRIAL AND ERROR I HAVE FOUND THAT IF THE Spansion "N" VERSION IS REALLY SLOW TO FLASH WITH ANY SETTING THEN CHANGING THE "NOR TYPE" IN THE FIRST SPOILER TO THE Spansion"P" TYPE SOLVES THIS.

Spansion S29GL128N90TFIR2

'Spansion N' 
Buffered write (fastest, default)
Ready triggered timing (fastest, default)
Max bytes: 32 (or 16)

Samsung K8Q2815UQB-PI4B

'Samsung Q28'
Single word program
Ready triggered timing (fastest, default)
Max bytes: (greyed out by single word program)

Spansion S29GL128P90TFIR2

'Spansion P'
Buffered write (fastest, default)
Ready triggered timing (fastest, default)
Max bytes: 64 (or 32)

Samsung K8P2716UZC-QI4D

'Samsung P27' 
Buffered write (fastest, default)
Ready triggered timing (fastest, default)
Max bytes: 64 (or 32)

Macronix MX29GL128ELT2I-90G

'Macronix 29GL' 
Buffered write (fastest, default)
Ready triggered timing (fastest, default)
Max bytes: 64 (or 32)

if you have some address that simply wont verify then simply change the bottom box to [USB transfer timing (avoid)] (yes i know it says avoid) it takes about 3 min to write each 128kb address but let it. once it has finnished you shouldnt get any verify errors

other settings if you still have difficulty flashing

(if you have a spansion p chip then you may get (verification error's) if you do then try (Ready Triggered Timing) as this seems to work on this NOR chip. (thanks to MHMProSoft (ps3hax) for informing me about this)


 Originally Posted by 3absiso 
@Sarah1331 


Hi;
Will i really do not know if you tried that but; i have done a lot of Spansion P chip and they are a pain:
For sure if you have verification errors: it is one of two things or both combined :-):
1- check your wires again and again and make sure they are not touching anything else but since you are doing RGH and you are good in wiring we can roll this out. (but double check). Reading Good Dumb does not mean your wiring is perfect since i had this issue with two Ps3 and get good read but bad write so i did re-wired every thing.

2- the second issue which is the common one and it solved 90% of the problem is:
- Use WinSkeet40000_111004 instead of the newest one
- connect the Progskeet as libusb Via zadig
- write the dumb at 8bit.
- use X86 windows 7 or XP
this done it for all my Spansion

if you still has issues try bridge the (gp4 on progskeet) with (rdy on progskeet) with small wire and wire the (RY/BY# on PS3) to (rdy on progskeet) alone as usual.

this is the links for the Programs:
http://www.ps3devwiki.com/wiki/Hardware_flashing


Now turn off the ps3, unplug the Progskeet from pc, disconnect the Progskeet from the ps3 you need to de-solder the Progskeet

Follow these steps if you patched for 3.55

Finishing the down grade in service mode

re-insert the hdd then connect the ps3 to a TV the usual way



turn on your ps3 and you should have this on screen. you may also get a blank screen. acting like the tristate is still set to ground. (more common with phat ps3's but can on occasion happen with slim's) this isnt a problem.

Turn the ps3 back off insert your dev usb board (programmed with the correct files) into the right usb slot.

a full list of boards are listed at the start of the main post in the second tab down called 
"Wrong you need these tools before you even think about following a guide"
inside that tab you will see the second tab down called "A development board" in there is lists of the different dev boards.


Unplug the ps3 from the mains. Wait 10 - 15 seconds then plug it back in.
(the wiki says its to discharge the capacitors but as the ps3 is not turned on the capacitors will take many months to discharge.)

Turn the ps3 back on then immediately press eject within ~200ms. Your console will turn on and if your dev usb has led's then the dongle will light up the red LED followed by the green LED and turn back off. 
if you had the black screen above and the fsm (dev board) has led's and they dont light up then see if you have hdd led activity. if you do then keep trying these steps as youe timing may not be quite right. if still nothing then reply to this thread for help.


After triggering Factory Service Mode, go to the folder called “service mode files” & in there is a folder called “service mode 3.55 downgrade files” put the contents of that folder into your usb stick and plug it in the PS3's right most USB port (remove the dev usb & put your usb memory stick in its place) REPLACE YOUR HDD (the files are rogero3.55cfw v3.2 and the normal Lv2diag.self (365.5 KB) 3.55 get in FSM )

Turn PS3 on, it will install the firmware you had put there (even though you have no screen output, you can see it is busy by looking at the activity led of the hard drive and of your USB Mass Storage Device). 

if you get the flashing green power light then this is due to the firmware not installing. first check your hdd is plugged in properly. this is usually what I forget to do. if it still flashes remove your usb stick put it in your pc and you will see “UPDATER_LOG” as a notepad file upload this file to the thread. 


PS3 will turn itself back off when it has finished installing the f/w.



Now remove your usb stick put it in your pc and you will see “UPDATER_LOG” as a notepad file open it & look through it to see if it contains errors (if it does upload the log to your file share account and ask for help online on IRC) (it should say at the bottom “0x83manufacturing updating SUCCESS(0x8002f000)”)

Now you need to get the ps3 out of service mode.



Open the folder “service mode files” and inside you will see a folder called “get out of service mode” copy the file inside to your usb stick. Put the usb stick back into your ps3 it will boot then the hdd light will flash then turn off. Remove the usb stick. (the file is Lv2diag.self (201.42 KB) get out FSM)

after that re-build your ps3 



turn on your ps3 and it should now boot to this screen follow the on screen instructions
nb the firmware you now have is rogero3.55 spoofed to 4.11 (for whoever decides not to follow my instructions and decides to go looking at system infomation) 

De-hashing

Now to DeHash the console so it is brick protected when / if you decide to upgrade the firmware

THIS IS THE RECOMENDED WAY

QA flag method

what is QA de-hash

Install and run QA-toggle and make sure it beeps 
if you just get a blank screen and nothing happens then you have a faulty bdvd and you cannot do this step. try re-marry bdvd found in the main post then try this step again.

to check you are QA flagged Set your cursor on Network Settings and press the key combo (all at the same time):L1 + L2 + L3 (press left stick) + R1 + R2 + dpad_down
if you are QA flagged a new option will show up right below network settings

Power off console 
Put unpatched official firmware (e.g. 3.55) on USB Mass Storage device as /PS3/UPDATE/PS3UPDAT.PUP and insert in PS3 

Boot into Recovery Menu:
press and hold power button you get 1 beep then a wait then a second beep then the ps3 turns off 
press and hold power button again you get 1 beep then 2 beeps let go of power button 
select "6. System Update" to reinstall firmware. 
If installation finishes without error (there will be no logs you can check!) and boots XMB OK, then dehashing was successful. 
Congrats, you now finished downgrading and dehashing. Console runs 3.55 and any firmware of choice can be installed, no longer needing to be patched for downgrader.


DO NOT DO THE SERVICE MODE WAY AS I AND OTHERS GET RLOD EVERYTIME IT IS DONE


Now you should be on 3.55ofw 

You can now install the 3.55cfw of your choice

9. Follow these steps if you patched for going direct to the latest cfw

re-insert the hdd then connect the ps3 to a TV the usual way
turn on your ps3 and it should boot into the xmb as normal

If you were on a lower firmware than the patch 
Ie
You were on 4.41 and you used 4.46 patches

Then when you turn the console back on your going to get either a black screen or it will shut off after 5 seconds
It's normal
You simply enter recovery
Hold power beep - dubble beep turns off
Hold power beep - dubble beep let go of power
Select option 6.

open the cfw folder
select the CFW version that you want
then copy the containing "PS3" folder to a fat32 formatted Mass Storage Device

plug in the Mass Storage Device into usb 0 (closest to drive / furthest right)
install the update from xmb under "update" "install fron Mass Storage Device" insure you have no disc in the blueray drive.

once done and the ps3 has booted back to xmb.
turn off the ps3 and enter "recovery menu" hold power button. ps3 turns on & beeps......keep holding power button.......short wait......beeps again & turns off.
release and re-press & hold power button. ps3 turns on & beeps.....keep holding power button.....short wait......ps3 double beeps...let go of power button.

select option 6

once done it will re-boot to xmb.