Post: The only way to downgrade from 3.65/3.61/3.60/3.56
06-07-2011, 02:54 PM #1
deroad
Little One
(adsbygoogle = window.adsbygoogle || []).push({}); Ok guys. as you can see, there are a lots of threads that talks about how to downgrade a ps3 with a fw 3.56+.
now all these threads are fake!
You CAN'T downgrade with an eternet cable.
You CAN'T downgrade with a usb, just because sony has patched the old downgrade method.
You CAN'T downgrade with a usb dongle with some "codes", because your ps3 only accept the master key to enable factory mode (once you are in this mode you can't return to normal mode)

the only way to downgrade is through an external dumper/flasher.
now this is an old video, but it show how to use an external flasher.



Now to downgrade you also need a backup of a previous firmware, made with a nor/nand dumper (in that video they used the same flasher to backup their nand).

another way (for NOR flashing) is this:

Originally posted by defyboy View Post
I built a flasher: You must login or register to view this content.

You can downgrade via this method but it involves patching out firmware hash checks in LV1


Before i was talking about why you can't downgrade with an ethernet cable or a usb dongle.
i will explain in details why:
(download this to follow my explanation *.PDF --> You must login or register to view this content. )
VirusTotal Scan:
Antivirus Version Last update Result

AhnLab-V3 2011.06.07.04 2011.06.07 -

AntiVir 7.11.9.87 2011.06.07 -

Antiy-AVL 2.0.3.7 2011.06.07 -

Avast 4.8.1351.0 2011.06.07 -

Avast5 5.0.677.0 2011.06.07 -

AVG 10.0.0.1190 2011.06.07 -

BitDefender 7.2 2011.06.07 -

CAT-QuickHeal 11.00 2011.06.07 -

ClamAV 0.97.0.0 2011.06.07 -

Commtouch 5.3.2.6 2011.06.07 -

Comodo 8983 2011.06.07 -

DrWeb 5.0.2.03300 2011.06.07 -

eSafe 7.0.17.0 2011.06.06 -

eTrust-Vet 36.1.8371 2011.06.07 -

F-Prot 4.6.2.117 2011.06.06 -

F-Secure 9.0.16440.0 2011.06.07 -

Fortinet 4.2.257.0 2011.06.07 -

GData 22 2011.06.07 -

Ikarus T3.1.1.104.0 2011.06.07 -

Jiangmin 13.0.900 2011.06.07 -

K7AntiVirus 9.105.4776 2011.06.06 -

Kaspersky 9.0.0.837 2011.06.07 -

McAfee 5.400.0.1158 2011.06.07 -

McAfee-GW-Edition 2010.1D 2011.06.07 -

Microsoft 1.6903 2011.06.07 -

NOD32 6187 2011.06.07 -

Norman 6.07.07 2011.06.07 -

nProtect 2011-06-07.01 2011.06.07 -

Panda 10.0.3.5 2011.06.07 -

PCTools 7.0.3.5 2011.06.06 -

Prevx 3.0 2011.06.07 -

Rising 23.61.01.03 2011.06.07 -

Sophos 4.66.0 2011.06.07 -

SUPERAntiSpyware 4.40.0.1006 2011.06.07 -

Symantec 20111.1.0.186 2011.06.07 -

TheHacker 6.7.0.1.223 2011.06.07 -

TrendMicro 9.200.0.1012 2011.06.07 -

TrendMicro-HouseCall 9.200.0.1012 2011.06.07 -

VBA32 3.12.16.0 2011.06.07 -

VIPRE 9512 2011.06.07 -

ViRobot 2011.6.7.4498 2011.06.07 -

VirusBuster 14.0.70.0 2011.06.06 -

MD5: 508b6d6de96b849bd43c9453a978fa8c

SHA1: 5b1e1965421ab2cf263557700d1da80ddd5df93a

SHA256: e928f9bdd7807fdad2ab5c70c3354ab91a57718ca1c06f0c22 fb69d8b583ba6d

File size: 181959 bytes

Scan date: 2011-06-07 14:09:42 (UTC)



now you don't need to read all and you don't need to know everything in the pdf.
Now look the pdf while you are reading this:
The PS3 Turns on.
your ps3 starts to do some thing, like execute the SysCon --> CellBE --> .. things.. --> lvl2ldr.
The lvl2ldr in the old FW, with the old jailbreak/downgrade method, executed an external code from a USB that sent the GameOS in test/factory mode.
when sony has patched this, they blocked the execution of an external code different than the factory mode code.
Now look at the bottom of the page (ON THE PDF) you can see that the filesystem is loaded after the lvl0ldr (Top of the PDF, after CellBE).
the network board is available for the ps3 just when the filesystem is loaded.
In some threads they talks about using an ethernet to dump things, but this is impossible, because the CellBE (i.e. CPU) starts reading the NAND/NOR, not the network board.

if i wrong something or something is incomprehensible tell me and i will re-write it again.
(adsbygoogle = window.adsbygoogle || []).push({});

The following 12 users say thank you to deroad for this useful post:

Brentdevent, Classy., dafuze1, djhazardous, HIvkid, KINGMANI, MajorPSP156, Skyl1n3, Swade, ZeroOo, ZoneHD

The following user groaned deroad for this awful post:

Mr__Shalemari
06-07-2011, 05:56 PM #11
IIRC, infectus only work for ps3s firmware that is below 3.15. If that is right, this won't work.
06-07-2011, 06:10 PM #12
deroad
Little One
no. i told that this video was old.
i choose this video only to show you how a nand flasher works and which kind of work you need to do to downgrade.
06-07-2011, 07:00 PM #13
defyboy
Save Point
I built a flasher: You must login or register to view this content.

You can downgrade via this method but it involves patching out firmware hash checks in LV1

The following user thanked defyboy for this useful post:

06-07-2011, 07:03 PM #14
djhazardous
Bounty hunter
Sticky this!!!

Edit:

What about NOR Flasher? Isn't that capable of the same result?
06-07-2011, 07:17 PM #15
deroad
Little One
the nor flasher is similar.. if you search on internet you can find fail0verflow flasher (on a slim model)
06-07-2011, 07:22 PM #16
OMG To Complicated For Me! :p Quite Cool Though! Awesome face
06-07-2011, 10:19 PM #17
Norman
NORMAN
Originally posted by djhazardous View Post
Sticky this!!!

Edit:

What about NOR Flasher? Isn't that capable of the same result?


pretty sure this is the same thing. but i could be wrong as infectus could only be programmed for the nand chip, and not the nor chip.
06-07-2011, 10:51 PM #18
-O-Z-Z-A-8-8-
At least I can fight
Originally posted by deroad View Post
Ok guys. as you can see, there are a lots of threads that talks about how to downgrade a ps3 with a fw 3.56+.
now all these threads are fake!
You CAN'T downgrade with an eternet cable.
You CAN'T downgrade with a usb, just because sony has patched the old downgrade method.
You CAN'T downgrade with a usb dongle with some "codes", because your ps3 only accept the master key to enable factory mode (once you are in this mode you can't return to normal mode)

the only way to downgrade is through an external dumper/flasher.
now this is an old video, but it show how to use an external flasher.



Now to downgrade you also need a backup of a previous firmware, made with a nor/nand dumper (in that video they used the same flasher to backup their nand).

another way is this:



Before i was talking about why you can't downgrade with an ethernet cable or a usb dongle.
i will explain in details why:
(download this to follow my explanation *.PDF --> You must login or register to view this content. )
VirusTotal Scan:
Antivirus Version Last update Result

AhnLab-V3 2011.06.07.04 2011.06.07 -

AntiVir 7.11.9.87 2011.06.07 -

Antiy-AVL 2.0.3.7 2011.06.07 -

Avast 4.8.1351.0 2011.06.07 -

Avast5 5.0.677.0 2011.06.07 -

AVG 10.0.0.1190 2011.06.07 -

BitDefender 7.2 2011.06.07 -

CAT-QuickHeal 11.00 2011.06.07 -

ClamAV 0.97.0.0 2011.06.07 -

Commtouch 5.3.2.6 2011.06.07 -

Comodo 8983 2011.06.07 -

DrWeb 5.0.2.03300 2011.06.07 -

eSafe 7.0.17.0 2011.06.06 -

eTrust-Vet 36.1.8371 2011.06.07 -

F-Prot 4.6.2.117 2011.06.06 -

F-Secure 9.0.16440.0 2011.06.07 -

Fortinet 4.2.257.0 2011.06.07 -

GData 22 2011.06.07 -

Ikarus T3.1.1.104.0 2011.06.07 -

Jiangmin 13.0.900 2011.06.07 -

K7AntiVirus 9.105.4776 2011.06.06 -

Kaspersky 9.0.0.837 2011.06.07 -

McAfee 5.400.0.1158 2011.06.07 -

McAfee-GW-Edition 2010.1D 2011.06.07 -

Microsoft 1.6903 2011.06.07 -

NOD32 6187 2011.06.07 -

Norman 6.07.07 2011.06.07 -

nProtect 2011-06-07.01 2011.06.07 -

Panda 10.0.3.5 2011.06.07 -

PCTools 7.0.3.5 2011.06.06 -

Prevx 3.0 2011.06.07 -

Rising 23.61.01.03 2011.06.07 -

Sophos 4.66.0 2011.06.07 -

SUPERAntiSpyware 4.40.0.1006 2011.06.07 -

Symantec 20111.1.0.186 2011.06.07 -

TheHacker 6.7.0.1.223 2011.06.07 -

TrendMicro 9.200.0.1012 2011.06.07 -

TrendMicro-HouseCall 9.200.0.1012 2011.06.07 -

VBA32 3.12.16.0 2011.06.07 -

VIPRE 9512 2011.06.07 -

ViRobot 2011.6.7.4498 2011.06.07 -

VirusBuster 14.0.70.0 2011.06.06 -

MD5: 508b6d6de96b849bd43c9453a978fa8c

SHA1: 5b1e1965421ab2cf263557700d1da80ddd5df93a

SHA256: e928f9bdd7807fdad2ab5c70c3354ab91a57718ca1c06f0c22 fb69d8b583ba6d

File size: 181959 bytes

Scan date: 2011-06-07 14:09:42 (UTC)



now you don't need to read all and you don't need to know everything in the pdf.
Now look the pdf while you are reading this:
The PS3 Turns on.
your ps3 starts to do some thing, like execute the SysCon --> CellBE --> .. things.. --> lvl2ldr.
The lvl2ldr in the old FW, with the old jailbreak/downgrade method, executed an external code from a USB that sent the GameOS in test/factory mode.
when sony has patched this, they blocked the execution of an external code different than the factory mode code.
Now look at the bottom of the page (ON THE PDF) you can see that the filesystem is loaded after the lvl0ldr (Top of the PDF, after CellBE).
the network board is available for the ps3 just when the filesystem is loaded.
In some threads they talks about using an ethernet to dump things, but this is impossible, because the CellBE (i.e. CPU) starts reading the NAND/NOR, not the network board.

if i wrong something or something is incomprehensible tell me and i will re-write it again.


in other words its the "infectus modchip"

tbh i would rather go out and buy a new/preowned console than **** about with wires and flashers/dumpers

just to get to a lower firmware
06-08-2011, 04:30 AM #19
defyboy
Save Point
Originally posted by Norman View Post
pretty sure this is the same thing. but i could be wrong as infectus could only be programmed for the nand chip, and not the nor chip.


Correct. Infectus is designed as a NAND flasher, It's just a general purpose I/O development board, If you are willing to write your own firmware, you can get these much cheaper. I don't believe it has enough I/O to write to NOR flash, this requires 46 I/O pins.

I built my flasher out of a Teensy++ 2.0, it cost me $24 online.

Copyright © 2026, NextGenUpdate.
All Rights Reserved.

Gray NextGenUpdate Logo