PS3 4.83 NAND Downgrade With Teensy

Discussion in 'Hardware Mods' started by aaron9003, Jan 30, 2019.

  1. 11
    5
    32
    aaron9003

    aaron9003 Member

    Joined:
    Jan 29, 2019
    Messages:
    11
    Likes Received:
    5
    Trophy Points:
    32
    I recently bought a phat A01 and it came with 4.83. I realize that currently my only option is downgrading with Teensy.
    Can you point me to where I can download the required files to patch 4.83 and downgrade? Everything I’ve found so far is for lower firmwares if I’m not mistaken.

    Thank you!
     
  2. 665
    354
    122
    Louay

    Louay Member

    Joined:
    Jan 23, 2017
    Messages:
    665
    Likes Received:
    354
    Trophy Points:
    122
    Gender:
    Male
    Occupation:
    College student
    Location:
    Tunisie
    Home Page:
    firstly do you own a teensy 2.0++ ? do you have soldering skills? do you own have NAND Clip (if you don't have enough skills for soldering to mobo???
     
    esc0rtd3w and aaron9003 like this.
  3. 1,636
    742
    172
    Cypher_CG89

    Cypher_CG89 Senior Member

    Joined:
    Jul 30, 2018
    Messages:
    1,636
    Likes Received:
    742
    Trophy Points:
    172
    Gender:
    Male
    Occupation:
    Lead Graphic Artist/Dev, VENOM ELITE GAMING
    Location:
    North East, England, UK
    Use this for validating and patching your dumps, uses a 4.83 NoFSM Ferrox based patch to install 4.83 CFW straight after flashing the patched dump to the PS3. No need to downgrade :D unless of course you want to downgrade lol.

    https://github.com/KasperDev/PS3DumpChecker

    Make sure to validate your 1st dump, I would offer a step by step with a hardware flasher but I have never done this with a NAND PS3 and I believe they have 2 chips instead of NORs single one, or used a Teensey. Just NORs and E3 flashers, though if you look in the right places you will find a good guide to doing it.
     
    aaron9003 likes this.
  4. 11
    5
    32
    aaron9003

    aaron9003 Member

    Joined:
    Jan 29, 2019
    Messages:
    11
    Likes Received:
    5
    Trophy Points:
    32
    I do, I have a Teensy and the 3.3v regulator, and all the tools necessary. I don’t have a clip since it’s harder to find but I think I can manage the soldering, I opened up the PS3 and cleaned everything and looked at the places i need to solder to, they are unbelievably tiny but I think I can do it with a little patience.
    I’ve been reading up on this and there is no straight forward tutorial so it’s a bit confusing, like I don’t know what I need to attach to the tristate point for example or what’s it's used for. But I’m mostly worried about the patching side since I wasn’t able to find a 4.83 specific patch...
     
    esc0rtd3w likes this.
  5. 11
    5
    32
    aaron9003

    aaron9003 Member

    Joined:
    Jan 29, 2019
    Messages:
    11
    Likes Received:
    5
    Trophy Points:
    32
    Oh wow! So this validates and patches the dump with 4.83 CFW? I would really appreciate it if you went into more detail on how to do this.
    I know that for NAND I’ll need to get two dumps, one from each NAND and merge them, then validate/verify, patch it or downgrade it, split it back up and then flash the separated patched dumps onto each NAND separately.
    So after I did this, do I just update to 4.83 Ferrox CFW?
    Thank you for your help!
     
    esc0rtd3w likes this.
  6. 1,636
    742
    172
    Cypher_CG89

    Cypher_CG89 Senior Member

    Joined:
    Jul 30, 2018
    Messages:
    1,636
    Likes Received:
    742
    Trophy Points:
    172
    Gender:
    Male
    Occupation:
    Lead Graphic Artist/Dev, VENOM ELITE GAMING
    Location:
    North East, England, UK
    Take a look at the screenshot i just did below:


    But yes after patching the dump (remember to back up your original dumps!!) and flashing it to the PS3 you can install Ferrox 4.83 CFW. After you have done this its a good idea to enable " QA Flags " this will allow you to freely install any CFW that is the minimum FW version of your PS3, eg. your min FW version is 2.70 you can install a 2.70 CFW if you really wanted to (no point going this low though lol), then go back to a later version anytime you wanted.

    Use this to enable QA Flags: Habibs QA Flag Toogler:

    http://store.brewology.com/ahomebrew.php?brewid=313

    As for the rest I am really no use here, I have not used this NAND Flasher, or soldered to the motherboard as my NOR Flasher has a clip. And I have never jailbroken a NAND PS3.

    You could have a look at this page for your flasher though I have not use this tut but the others linked to are good so I would think this is as well as i used the tut on here for NOR with an E3 Flasher.

    https://www.reddit.com/r/ps3homebrew/wiki/flashers/teensy

    Be sure to read everything before you even start and double check everything. And remember once you flash the patched dump to the PS3, dump again and validate it before resetting the PS3 or you could brick your PS3.

    And if you are ever in doubt about something ask.
     
    esc0rtd3w, Algol and aaron9003 like this.
  7. 665
    354
    122
    Louay

    Louay Member

    Joined:
    Jan 23, 2017
    Messages:
    665
    Likes Received:
    354
    Trophy Points:
    122
    Gender:
    Male
    Occupation:
    College student
    Location:
    Tunisie
    Home Page:
    you need to make 3 dumps for each to confirm the flash goodnes to continue to the next steps you must unscramble the to NAND flash into one make the patches needed rescramble the patched flash into two flashes right back each flash to each nand and then install CFW of your choice and have fun :) and if you have any problems o you can send me pm in the scene or in facebook :) see my profile
     
    esc0rtd3w and aaron9003 like this.
  8. 11
    5
    32
    aaron9003

    aaron9003 Member

    Joined:
    Jan 29, 2019
    Messages:
    11
    Likes Received:
    5
    Trophy Points:
    32
    Oh man, thank you so much for explaining, I'm going to try this out and will surely bother you again when I need more help! but first I have a lot of soldering to do ....
     
  9. 11
    5
    32
    aaron9003

    aaron9003 Member

    Joined:
    Jan 29, 2019
    Messages:
    11
    Likes Received:
    5
    Trophy Points:
    32
    I will definitely hit you up! I'm going to start soldering the Teensy now. Thank you SO much!!
     
  10. 1,636
    742
    172
    Cypher_CG89

    Cypher_CG89 Senior Member

    Joined:
    Jul 30, 2018
    Messages:
    1,636
    Likes Received:
    742
    Trophy Points:
    172
    Gender:
    Male
    Occupation:
    Lead Graphic Artist/Dev, VENOM ELITE GAMING
    Location:
    North East, England, UK
    Your welcome.
     
    aaron9003 likes this.
  11. 4,027
    3,603
    372
    sandungas

    sandungas Moderator Developer

    Joined:
    Dec 31, 2014
    Messages:
    4,027
    Likes Received:
    3,603
    Trophy Points:
    372
    Location:
    Babylon 20xxE series
    You look brave enought and it seems you was reading enought about it, im guessing you have some experience at soldering and good hands, but just 2 suggestions that could be critical...

    The solder points that goes in the VIAS (holes of the motherboard) are very hard and a bit risky, if you overheat the motherboard too much the VIA is going to break/burn
    The PS3 motherboard have (if i remember right) 8 layers, you only see the surface layers but there are a lot more "hidden" inside like a sandwich, and the VIAS connects the layers, by breaking a VIA you are "cutting" a trace and because are hidden is very hard to know what was broken and where the trace goes

    So... use low temperature... and incase of using a bit high temperature dont touch the VIA in the motherboard with the solder iron for much time (with a hot solder iron it needs to be made fast... the faster = the safer)

    Also, there are 2 critical things that are going to help you A LOT to make that solders
    One is the "flux" liquid, is a chemical that allows the melted solder to attach better to the copper... think in it as some kind of "alloy fondant"
    The other is the wire type... idealistically you need to use a wire with single core (and with the thickness indicated in wiki), usually this wires are named "wrapping wire" you are going to find a lot of wires announced with that name. In this group of "wsapping wyres" there is a famous brand that is the best named "kynar"
    The kynar wire have the core covered by silver, and the plastic cover can resist up to 200ºC or so (a lot, if you insist the plastic burns but is a lot better than any other plastic)

    With kynar wire + flux the wires are soldered a lot easyer ;)

    -------------------
    For the wires that needs to be soldered to the NAND pins (this ones are tricky too, but no risk of overheatings)... take a look at the link in wiki where is explained a method to solder by "masking" the nearby pins with "kapton" tape
    The kapton tape is another famous brand... this shit is used in satellites and aerospatial industry... it resitst up to 300ºC or 400ºC
    The point is you can use kapton tape to protect the pins at the sides of the pin you want to solder... this way the melted solder will have a "tendence" to attach to the pin you want

    Alternativelly... if you dont want to buy kapton tape... think in the concept of "masking" nearby pins, and use any other stuff for the task
    Instead of kapton tape you can use 2 razor blades to "isolate" the pin... actually you can do the same with wood or plastic or other materials (are going to burn but doesnt matters, the point is they are going to work as "barriers" at the sides)

    And last suggestion... if you have some problem and the solder doesnt attach to the VIA/PIN... dont insist and "bruteforce" it. Stop, go to sleep, take your time to think in the problems you found and how to solve them, and try it another day :)
     
    Last edited: Jan 31, 2019
    esc0rtd3w and aaron9003 like this.
  12. 11
    5
    32
    aaron9003

    aaron9003 Member

    Joined:
    Jan 29, 2019
    Messages:
    11
    Likes Received:
    5
    Trophy Points:
    32
    Thank you so much for taking the time to type this up. This is really helpful!
    I started working on it last night and as you guessed I had trouble with the VIAs. I used 30awg stranded core hook-up wire with a flux pen and the sharpest soldering tip I had, I could not for the life of me get the wire and the solder to attach to the VIA. It really doesn’t look like there is any exposed copper for the solder to grab on to. So I thought it would be easier if I attached it to the the NAND pin, I didn’t know about the masking technique and almost immediately shorted two pins with solder and spend the next half hour cleaning it up with a solder sucker and solder wick... so yeah it didn’t go as planned :beguiled:

    Can you tell me how low the low temperature should be? I have a Hakko and can set it to any temperature but I don’t have a point of reference as to what the the safe temperature range for a ps3 motherboard is.

    I’m going to get some kynar, kapton tape and better flux paste and try my luck again.
    In the meantime I’m gonna read more into the masking technique as well.

    Again, really appreciate the help!!
     
  13. 4,027
    3,603
    372
    sandungas

    sandungas Moderator Developer

    Joined:
    Dec 31, 2014
    Messages:
    4,027
    Likes Received:
    3,603
    Trophy Points:
    372
    Location:
    Babylon 20xxE series
    In the VIAs start with 175ºC or so, and if is not enought increase it and try again, but try to dont exceed 250ºC or so
    Incase of using high temperature try to do the solders fast (in less than 5 seconds)

    Also, remember you have the same VIAs at the other side of the motherboard, so if at some point the VIAs of a side starts looking bad then try at the other side

    And yeah... soldering in the NAND pins is safer, the tin will attach to the pin easilly
    Is harder because (for sure) you are going to short some pins at some point... and this sucks because you will need to remove the wires, cleanup the pins with the solder wick and start again (and so on, and so on, several times)
    But as said, is safer, if you repeat it 10 or 20 times there is no problem of overheatings... the only problem is will take lot of time

    The trick of "masking" the pins is nice, is better made with kapton tape, but as said you can use any other stuff... even if that stuff is going to burn (as normal duct tape)... the tape needs 3 or 4 seconds to melt/burn and this is time enought for the wire to attach to the pin
    So the "guetto technique" is to solder the wire and later clean the burned shit all around (with wooden toothpicks and/or cotton earsticks) and alcohol

    The "pro" masking is explained here, is a very good read
    http://ultrakeet.com.au/write-ups/kaptonMasking
    You need to prepare the pins like this:
    [​IMG]
    Think in what i said... the kapton tape resists up to 300ºC or 400ºC (more than the solder iron tip), so is not going to move from that position... if you mask very well the other nearby pins is imposible for the wire to attach to an incorrect pin
     
    Last edited: Feb 1, 2019
    esc0rtd3w and aaron9003 like this.
  14. 11
    5
    32
    aaron9003

    aaron9003 Member

    Joined:
    Jan 29, 2019
    Messages:
    11
    Likes Received:
    5
    Trophy Points:
    32
    Thank you for all the tips!
    I finally managed to solder all the wires to NAND0 and connect the Teensy. I'm drawing power from a bench power supply (3.3v) which is attached to the teensy, both the Tristate point and CE are connected to GND on the teensy as well.
    I followed the NANDway Signal Booster Edition from this image.

    When I do a "check connection" on PS3 Downgrade tool I get this:

    Pinging Teensy...
    Available memory: 3760 bytes

    Press any key to continue . . .
    So i'm assuming the connection is working...

    But when I do a "Read Nand" I get this error:

    Pinging Teensy...
    Available memory: 3760 bytes

    NAND0 information:
    Raw ID data: 0x5d 0x4d 0x4d 0x4d 0x6d

    Only 8-bit NANDs are supported! Exiting...

    Closing serial device...
    Done.
    NANDway v0.64 - Teensy++ 2.0 NAND Flasher for PS3/Xbox/Wii
    (Orignal NORway.py by judges <[email protected]>)
    (Orignal noralizer.py by Hector Martin "marcan" <[email protected]>)

    Pinging Teensy...
    Available memory: 3760 bytes​

    Do you know what causes this?
    i checked my wiring at it seems fine, no shorts either.
    one thing i might be missing is the VCC and GND ponts on the NAND from this picture, do they need to be connected to the Teensy?

    btw, I cut the 5v trace on the teensy, soldered the two 3.3v traces and removed the 3.3v regulator since I am drawing power from my bench power supply. is that correct?
     
    esc0rtd3w likes this.
  15. 4,027
    3,603
    372
    sandungas

    sandungas Moderator Developer

    Joined:
    Dec 31, 2014
    Messages:
    4,027
    Likes Received:
    3,603
    Trophy Points:
    372
    Location:
    Babylon 20xxE series
    The GND in the teensy, and GND in the motherboard should be connected (both devices needs to use a shared ground)... you can do it with one wire, and you can choose many GND points in the motherboard

    For the V is a bit tricky because there are several different ways to power the NAND... but the point is you need to have 3.3v at the NAND vcc pin... with 5v also works (and the PS3 is not damaged as far i could read from reports) but feeding NAND with 5v is considered risky
    If the motherboard is turned ON while dumping (with the heatsink and fan in place to avoid overheat) then the motherboard feeds the NAND with 3.3v. For this method is also needed to connect the "trsitate" point to ground (to prevent the southbridge to access NAND while you are accesing it too with teensy, this creates interferences)

    ------------------------
    By now it seems you are in the good road, but you need to check the wires again, there is something wrong
    You can see the message "teensy NANDWAY made by judges", etc..., etc...) it means the teensy is well programmed and is working, that sentence is part of the teensy firmware
    Also is showing the "Available memory: 3760 bytes" that means that NAND is working too (at least partially)
    After that it needs to show you the NAND manufacturer and the NAND model (something like samsung KFT12PTIT23)
     
    esc0rtd3w and aaron9003 like this.
  16. 11
    5
    32
    aaron9003

    aaron9003 Member

    Joined:
    Jan 29, 2019
    Messages:
    11
    Likes Received:
    5
    Trophy Points:
    32

    Hi again!

    I finally managed to get the dumps from both NANDs and merge them into a "merged.bin"...
    I then wanted to validate the merged dump using the program that you linked but i get these errors:


    2019-02-06 22_50_42-PS3 Dump Checker v1.0 (Build_ 494) Type_ NAND File_ merged.bin.png 2019-02-06 22_50_58-PS3 Dump Checker v1.0 (Build_ 494) Type_ NAND File_ merged.bin.png


    Do you know what's going on?
     
  17. 11
    5
    32
    aaron9003

    aaron9003 Member

    Joined:
    Jan 29, 2019
    Messages:
    11
    Likes Received:
    5
    Trophy Points:
    32
    I can't thank you enough for your help! as you can see in my previous comment i did manage to get the dumps but i got an error trying to verify it. do you know what could cause that error? do I have bad dumps?
     
    sandungas likes this.
  18. 533
    219
    72
    kadorna2

    kadorna2 Member

    Joined:
    May 19, 2015
    Messages:
    533
    Likes Received:
    219
    Trophy Points:
    72
    Have you descrambled the nands prior to merging? Try flowrebuilder
     
    aaron9003 likes this.
  19. 4,027
    3,603
    372
    sandungas

    sandungas Moderator Developer

    Joined:
    Dec 31, 2014
    Messages:
    4,027
    Likes Received:
    3,603
    Trophy Points:
    372
    Location:
    Babylon 20xxE series
    Good work :encouragement:
    For the errors is better to ask @littlebalup

    I think the "filled areas" (either filled with zeroes or F's) doesnt have importance because are like "paddings" (or better said, are "unused" areas)
    The SKU identity data is a bit more weird, this should not happen

    Wait a bit to get a better answer of why is hapening that (in other words, dont write in flash yet)
    But keep that dumps at safe, it seems to contain all the critical data as valid (eEID, EID, cCSD, bootloader, metldr)
     
    esc0rtd3w and aaron9003 like this.
  20. 1,028
    1,007
    272
    littlebalup

    littlebalup Developer PSX-Place Supporter

    Joined:
    Oct 16, 2014
    Messages:
    1,028
    Likes Received:
    1,007
    Trophy Points:
    272
    Location:
    43°36'16.0"N 1°26'36.1"E
    About 0xEF byte that should be 0xFF, it append sometime. It has no influence as long as you are sure you made proper dumps and you'll write using differential files to minimize risks to corrupt perconsole data.

    SKU id error may be due to refurbished console.
    Please read this: https://github.com/littlebalup/PyPS3tools/issues/17
     
    nCadeRegal, esc0rtd3w and aaron9003 like this.

Share This Page