Post: How to Boot Debug on a Retail PS3 Unit
Options
09-08-2011, 04:08 AM
#1
Stack0verfl0w
Computer engineer
few weeks back we saw a video on You must login or register to view this content.
DEX to CEX Converter By "You know who"
Originally posted by another user
To quote from a (now removed) Tweet of Squarepusher2: "BTW Mathieulh I know you gave durandal that CEX-DEX ZIP, that it wasn't you that bundled that up, and you were not supposed to do so either"
Originally posted by another user
**WARNING** IF THIS TUTOTIAL ISN'T FOLLOWED TO THE LETTER YOU MAY BRICK, THE AUTHOR (THAT WOULD BE ME) DENIES ALL KINDS OF RESPONSABILITY SHOULD YOUR PS3 GET DAMAGED IN ANY WAYS. YOU KNOW THE RISKS **WARNING**
Requirements:
1. A playstation 3 on firmware 3.55 or below
2. A dongle to go to Service mode
3. A usb pendrive
4. A brain
5. The author of this little trick.
6. Have your pc connected directly to the ps3 on ethernet with the ip set to 192.168.0.100 and the hostmask to 255.255.255.0 (make sure no firewall is running, not even windows one, this may prevent your console from connecting to the pc)
Procedure:
** PART 1 **
1. Set your console into service mode with any compatible dongle.
2. Put the content of the converter-console folder at the root of your usb pendrive.
3. Extract ObjectiveSuites-GetData on your PC.
4. Put the usb pendrive on the last usb port on the right of your console.
5. Run ObjectiveSuites.exe from ObjectiveSuites-GetData
6. You now have a few seconds to start your console, start it.
7. Objective Suite should display "PASS" and txt files will be created in the Temp dir. Once done, power off your console.
8. Get ALL these txt files from your temp directory and send them to the author (me) with informations about your playstation 3 model (FAT/SLIM, CECH* model)
** PART 2 **
9. You should recieve from the author (Yeah me again) a file called request_idps.txt
10. Extract ObjectiveSuites-SetIdps on your pc.
11. Put the request_idps.txt in your temp folder (MAKE EXTRA SURE IT'S THERE OR YOU WILL BRICK)
12. Run ObjectiveSuites.exe from the ObjectiveSuites-SetIdps directory.
13. Start the SAME CONSOLE YOU GOT THE TXT FILES FROM (If it's another console you WILL BRICK IT).
14. Wait until Objective suite displays "PASS" Then power off your console, at this point your console should be a Debug one.
** PART 3 **
15. You will now need to do a drive initialisation in order to use the bluray drive on your console. Put your usb pendrive on your pc, delete all the files you previously put in there, Put "Lv2Diag.self" from the "set up" directory at the root of your pendrive along with PS3UPDAT.PUP (that's 3.30 debug firmware)
16. Put the pendrive on the usb port on the most right of your console.
17. Power on the console, The screen will be black and the green led will stay lit, wait until it blinks and the console powers off, once it does the firmware will be installed.
18. Put the pendrive back on pc, delete the files you put in there previously, and copy the content of the "drivefix" folder to the root of the pendrive.
19. Put the pendrive at the usb port most on the right of your console and power it on.
20. The drive initialisation will then occur, wait a couple of seconds, then power off the console (you may have to unplug it from the AC)
21. Put the pendrive back onto the pc, delete the files you previously put in there, then copy the Lv2diag.self from the "finalize" folder.
22. Put the pendrive on the usb port on the most right of your console. Power it on. Your console will power on for a few seconds then power off.
CONGRATULATIONS YOU HAVE NOW COMPLETED ALL THE STEPS AND YOUR CONSOLE IS A FULLY FUNCTIONAL DEBUG BOX. YOU NOW JUST NEED TO POWER IT ON AND COMPLETE THE USUAL FIRST TIME SETUP PROCEDURE.
I ASKED MATH FOR THE .TXT HIS WORDS
You must login or register to view this content.
Download:You must login or register to view this content. PASSWORD pass: ps3scene
mirror: You must login or register to view this content.
You must login or register to view this content.
You must login or register to view this content.
DOWNLOAD 3.70 DEBUG HERE You must login or register to view this content.
source: ps3 news
The following 7 users say thank you to Stack0verfl0w for this useful post:
The following user groaned Stack0verfl0w for this awful post:
09-26-2011, 03:52 PM
#129
sguerrini97
Haxor!
09-26-2011, 04:10 PM
#130
RikuKH3
Save Point
Originally posted by sguerrini97
I can try, but my PS3 was bought with 3.50 and i can downgrade maximum to 3.50 RETAIL, can I install 3.41 DEBUG or not?
I believe you can use 3.50 debug fw for downgrading, the point is you can't use higher FW with lv2diag.self and service mode than your current installed fw.
Just try to downgrade from service mode 3.55 to retail 3.50. If it works then 3.50 debug shouldn't make much difference.
09-26-2011, 06:56 PM
#131
sguerrini97
Haxor!
Originally posted by RikuKH3
I believe you can use 3.50 debug fw for downgrading, the point is you can't use higher FW with lv2diag.self and service mode than your current installed fw.
Just try to downgrade from service mode 3.55 to retail 3.50. If it works then 3.50 debug shouldn't make much difference.
Just try to downgrade from service mode 3.55 to retail 3.50. If it works then 3.50 debug shouldn't make much difference.
Where can I find the 3.50 debug?
And can I boot in linux if my ps3 is bricked?
And the Lv2diag.self for 3.50?
Edit: maybe I understand: the Lv2diag.self for 3.50 is the file that with the 3.50 PUP allow me to downgrade? You say that i can't use firmwares like 3.56,3.60 .. ?
09-26-2011, 09:53 PM
#132
RikuKH3
Save Point
I followed acdcz20 guide. Dumped NOR via 3.41 Linux, patched two bytes and writed it back. (No need to dump IDPS, you can find it in NOR dump easily)
You must login or register to view this content.
You must login or register to view this content.
After patching retail firmware loads just fine. Then I put PS3 in Service Mode and updated it to 3.41 Debug FW using lv2diag.self. Well... after system loads just fine, there's a bunch of debug settings... but half of them doesn't work. It can't update/downgrade debug firmware using System Update menu (Corrupted Data after beginning installation). It can't install/run unsigned PKG's builded with SDK... It can't play BD games (corrupted firmware error). Tried reinstall 3.41 Debug FW using recovery menu, but with no avail.
Here's UPDATER_LOG.TXT
You must login or register to view this content.
You must login or register to view this content.
After patching retail firmware loads just fine. Then I put PS3 in Service Mode and updated it to 3.41 Debug FW using lv2diag.self. Well... after system loads just fine, there's a bunch of debug settings... but half of them doesn't work. It can't update/downgrade debug firmware using System Update menu (Corrupted Data after beginning installation). It can't install/run unsigned PKG's builded with SDK... It can't play BD games (corrupted firmware error). Tried reinstall 3.41 Debug FW using recovery menu, but with no avail.
Here's UPDATER_LOG.TXT
manufacturing updating start
PackageName = /dev_usb000/PS3UPDAT.PUP
settle polling interval success
vflash is enabled...
creating system regions...
create storage region: (region id = 1)
create storage region: (region id = 2)
format partition: (region_id = 2, CELL_FS_UTILITY:HDD0, CELL_FS_UFS)
create storage region: (region id = 3)
format partition: (region_id = 3, CELL_FS_UTILITY:HDD1, CELL_FS_FAT)
creating system regions done.
boot from nor flash...
creating nor flash regions...
create storage region: (region id = 2)
create storage region: (region id = 3)
creating flash regions...
create storage region: (region id = 1)
create storage region: (region id = 2)
format partition: (region_id = 2, CELL_FS_IOS:BUILTIN_FLSH1, CELL_FS_FAT)
create storage region: (region id = 3)
format partition: (region_id = 3, CELL_FS_IOS:BUILTIN_FLSH2, CELL_FS_FAT)
create storage region: (region id = 4)
format partition: (region_id = 4, CELL_FS_IOS:BUILTIN_FLSH3, CELL_FS_FAT)
create storage region: (region id = 5)
create storage region: (region id = 6)
Initializing
taking a while...
start Updating Proccess
Initialize elapsed time = 107 msec
check UPL
Check UPL elapsed time = 79 msec
check Package Size
get package size elapsed time = 16 msec
start Updating Package
Update packages num = 27
Update packages total size = 147097842
Update Package Revoke list
read package revoke list package (576 bytes) elapsed = 22 msec
update package revoke list elapsed = 3015 msec
Update Package Revoke list done(0x8002f000)
Update Core OS Package
read core os package (5228918 bytes) elapsed = 1457 msec
update core os package elapsed = 63679 msec
Update Core OS Package done(0x8002f000)
Update VSH Package
sys_memory_container_create() success(id = 0xc0effffe)
Update VSH's package : 1/19
read vsh package (1696 bytes) elapsed = 33 msec
decrypt and verify vsh package elapsed = 43 msec
write vsh package elapsed = 102 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 26 msec
Update VSH's package : 2/19
read vsh package (5616387 bytes) elapsed = 1575 msec
decrypt and verify vsh package elapsed = 363 msec
write vsh package elapsed = 286 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 350 msec
Update VSH's package : 3/19
read vsh package (3357775 bytes) elapsed = 955 msec
decrypt and verify vsh package elapsed = 248 msec
write vsh package elapsed = 643 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 287 msec
Update VSH's package : 4/19
read vsh package (5240116 bytes) elapsed = 1471 msec
decrypt and verify vsh package elapsed = 333 msec
write vsh package elapsed = 575 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 334 msec
Update VSH's package : 5/19
read vsh package (24839 bytes) elapsed = 39 msec
decrypt and verify vsh package elapsed = 44 msec
write vsh package elapsed = 69 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 34 msec
Update VSH's package : 6/19
read vsh package (9852384 bytes) elapsed = 2741 msec
decrypt and verify vsh package elapsed = 313 msec
write vsh package elapsed = 2273 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 430 msec
Update VSH's package : 7/19
read vsh package (10268746 bytes) elapsed = 2852 msec
decrypt and verify vsh package elapsed = 303 msec
write vsh package elapsed = 2440 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 465 msec
Update VSH's package : 8/19
read vsh package (6873237 bytes) elapsed = 1921 msec
decrypt and verify vsh package elapsed = 377 msec
write vsh package elapsed = 1382 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 430 msec
Update VSH's package : 9/19
read vsh package (8625010 bytes) elapsed = 2402 msec
decrypt and verify vsh package elapsed = 239 msec
write vsh package elapsed = 991 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 339 msec
Update VSH's package : 10/19
read vsh package (10422267 bytes) elapsed = 2897 msec
decrypt and verify vsh package elapsed = 280 msec
write vsh package elapsed = 1068 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 418 msec
Update VSH's package : 11/19
read vsh package (9235868 bytes) elapsed = 2570 msec
decrypt and verify vsh package elapsed = 261 msec
write vsh package elapsed = 1793 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 444 msec
Update VSH's package : 12/19
read vsh package (10385441 bytes) elapsed = 2888 msec
decrypt and verify vsh package elapsed = 279 msec
write vsh package elapsed = 1271 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 425 msec
Update VSH's package : 13/19
read vsh package (8982580 bytes) elapsed = 2501 msec
decrypt and verify vsh package elapsed = 241 msec
write vsh package elapsed = 646 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 399 msec
Update VSH's package : 14/19
read vsh package (9450420 bytes) elapsed = 2630 msec
decrypt and verify vsh package elapsed = 386 msec
write vsh package elapsed = 1452 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 456 msec
Update VSH's package : 15/19
read vsh package (9296157 bytes) elapsed = 2587 msec
decrypt and verify vsh package elapsed = 375 msec
write vsh package elapsed = 1504 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 455 msec
Update VSH's package : 16/19
read vsh package (9011000 bytes) elapsed = 2509 msec
decrypt and verify vsh package elapsed = 416 msec
write vsh package elapsed = 3490 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 568 msec
Update VSH's package : 17/19
read vsh package (6671544 bytes) elapsed = 1865 msec
decrypt and verify vsh package elapsed = 341 msec
write vsh package elapsed = 4199 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 703 msec
Update VSH's package : 18/19
read vsh package (8693374 bytes) elapsed = 2422 msec
decrypt and verify vsh package elapsed = 234 msec
write vsh package elapsed = 555 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 387 msec
Update VSH's package : 19/19
read vsh package (7212053 bytes) elapsed = 2016 msec
decrypt and verify vsh package elapsed = 380 msec
write vsh package elapsed = 3005 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare vsh package elapsed = 557 msec
Update VSH Package done(0x8002f000)
Bul-ray Disc Player Revoke
read bdp revoke package (1904 bytes) elapsed = 33 msec
decrypt and verify bdp revoke package elapsed = 49 msec
write bdp revoke package elapsed = 64 msec
flush_cache(0x100000000000001)
flush_cache() SUCCESS
compare bdprevoke package elapsed = 59 msec
Bul-ray Disc Player Revoke done(0x8002f000)
Update Program Revoke list
read program revoke list package (736 bytes) elapsed = 33 msec
update program revoke list elapsed = 2994 msec
Update Program Revoke list done(0x8002f000)
Update BD firmware
read BD firmware package (1966992 bytes) elapsed = 564 msec
update BD firmware elapsed = 304 msec
read BD firmware package (951040 bytes) elapsed = 294 msec
update BD firmware elapsed = 260 msec
read BD firmware package (951040 bytes) elapsed = 285 msec
update BD firmware elapsed = 249 msec
read BD firmware package (951040 bytes) elapsed = 285 msec
update BD firmware elapsed = 251 msec
read BD firmware package (1639296 bytes) elapsed = 473 msec
update BD firmware elapsed = 38792 msec
Update BD firmware done(0x8002f000)
Update Multi-Card controller firmware
read MCC package (28636 bytes) elapsed = 31 msec
update MCC elapsed = 44 msec
Update Multi-Card controller firmware done(0x8002f000)
Update BlueTooth firmware
read BT package (644322 bytes) elapsed = 200 msec
update BT elapsed = 75 msec
Update BlueTooth firmware done(0x8002f000)
Update System controller firmware
read SC patch package (4864 bytes) elapsed = 25 msec
read SC patch package (4864 bytes) elapsed = 25 msec
read SC patch package (4864 bytes) elapsed = 25 msec
read SC patch package (4864 bytes) elapsed = 25 msec
read SC patch package (4864 bytes) elapsed = 25 msec
read SC patch package (4864 bytes) elapsed = 25 msec
read SC patch package (4864 bytes) elapsed = 25 msec
read SC patch package (4864 bytes) elapsed = 25 msec
Update System controller firmware done(0x8002f000)
update package elapsed time = 203886 msec
post processiong...
post processiong done
cleanup update status (ret = 0)
os version = 03.4100
build_version = 45038,20100721
region of core os package = 0xa0000000
build_target = DEX-ww
build target id = 0x82
manufacturing updating SUCCESS(0x8002f000)
set product mode (ret = 0)
Total Elapsed time = 220812 msec
09-26-2011, 10:34 PM
#133
wookieboy76
Little One
09-26-2011, 10:55 PM
#135
RikuKH3
Save Point
Originally posted by acdcz20
Never said it was going to be perfect, just get dex up and running like this forum suggests..
Well, you stated "9. Finally, flash that as if you were downgrading, and you are now on a full debug firmware[/B]..."
Originally posted by acdcz20
also the bd drive is disabled in debug firmware....
Not true, Debug units can't play BD movies, but games from discs should work just fine.
As I thought, theres more checks than just Target ID byte in IDPS. I still believe it's possible to find them and patch to make it REAL Debug machine.
09-27-2011, 12:45 PM
#136
sguerrini97
Haxor!
Originally posted by RikuKH3
Well, you stated "9. Finally, flash that as if you were downgrading, and you are now on a full debug firmware[/B]..."
Not true, Debug units can't play BD movies, but games from discs should work just fine.
As I thought, theres more checks than just Target ID byte in IDPS. I still believe it's possible to find them and patch to make it REAL Debug machine.
Not true, Debug units can't play BD movies, but games from discs should work just fine.
As I thought, theres more checks than just Target ID byte in IDPS. I still believe it's possible to find them and patch to make it REAL Debug machine.
I've installed the 3.50 debug.
I think that we have to use the cex to dex kit, the Lv2diag.self in the folder "drivefix" should fix the bluray drive. I'm going to test it.
Edit: the PS3 find the bluray game but the game don't boot.
Edit 2: i can't install multiMAN (I think the pkg isn't signed), i've installed "limbo_demo.pkg" but same error of the bluray game: balck screen and back to the XMB with alert "Game Quit. No request event.".
Can we install newer debug firmwares? Can we downgrade with debug?
Edit 3: i return to 3.55 CFW.. I wait updates.
Copyright © 2026, NextGenUpdate.
All Rights Reserved.
