PS3 Ps3Xploit - Now Install CFW from 4.82 OFW: NOR/NAND Software Flash Writer + NOR Dumper Released

UPDATE (Jan 2017): v2.0 update has been released
IMPORTANT UPDATE (MARCH-2019) v3.0.1 was released providing support for 4.84 HFW (a new hybrid firmware that restores PS3Xploit for 4.84 OFW user's (See Link to HFW))

---

.There has been alot of development going on around the PS3 since the discoveries of the PS3Xploit (webkit exploit) on 4.81 OFW, first we seen the IDPS dumper (4.81/2 OFW) released with some big news & hope to come along with it, like a Flash Writer (downgrader) for OFW, so if you have been reluctant to buy a Hardware Flasher such as the E3 Flasher and bust open your PS3, but have been wanting to get your PS3 FAT(PHAT) Console and your Downgradable PS3 SLIM Models (up to & including 25xx models with minimum installable version <= 3.56) on Custom Firmware, then here is your chance with a 100% SOFTWARE SOLUTION thanks to the work of PS3Xploit Team ( @bguerville, @esc0rtd3w & W) along with contributions from new team member @habib to help expedite this release. Essentially what this Software Solution does is write a patch to the CoreOS (on NOR/NAND Chip) and when the PS3 Console is then rebooted you can install a Custom Firmware directly, So downgrading back to 3.55 is not required in the process, rather "Direct OFW to CFW patching" is done to allow for Custom Firmware Installation. Since this exploit is executed from 4.82 OFW, you can only install to a 4.82 CFW, HOWEVER if you wish to use an earlier firmware such as REBUG 4.81 for example, once on 4.82 CFW you must TOGGLE QA using a toggle tool, which allows CFW user's to freely switch CFW version from past and present. Read more about this in the Frequently Asked Question (FAQ) and more info in the details provided:


UPDATE - View Public Warning (Beware of Imposter's)

Flash Writer Compatible with these PS3 Models:
Supports FAT Models CECHAxx/Bxx/Cxx/Exx/Gxx/Hxx/Jxx/Kxx/Lxx/Mxx/Pxx/Qxx
Supports SLIM Models 2xxx (minver 3.56 or lower ONLY, check with >>> minverchk.pup - SEE FAQ TAB for USAGE )
​

4.82 NAND / NOR WRITER NOR FLASH DUMPER F.A.Q & Additional Notes.

• 
  
  PS3 OFW 4.82 NAND/NOR FLASH WRITER v1.0
  ***** IMPORTANT DETAILS BELOW -- AVOIDING A BRICK *****
  ​
  WARNING: USE THE PROVIDED flsh.hex AS IS. DON'T PATCH IT OR MODIFY IT OR YOU WILL BRICK *****
  
  • Verify flsh.hex file on a flash drive and in the far right USB slot!
    • 4.82 flsh.hex MD5: 8E156C99101BF36EC3EDB832982AE46D
  • DO NOT USE ON CFW (Custom Firmware) (Only Supports OFW)
  • DO NOT USE ON PS3 Models 3xxx/4xxx (aka SuperSlims / Late Slim models) you will brick those console.
  • USE ONLY ON 4.82 OFW
  
  
  PLEASE READ FIRST:
  
  • It's essential not to flood the browser memory with junk before running the exploit. The reason for this is that due to javascript core memory usage limitations we are scanning several times a small range of browser memory (a few Mb) to find some essential data in RAM, if the memory is flooded then the range to scan becomes much larger & the probabilities that our data is found in the smaller range decrease dramatically..
  • So in short, never use the browser or set a homepage you cancel before running the exploit!
  • If you need to, set the homepage to 'blank', close the browser then reopen it to start the flash writer.
  
  v1.0.0 - Initial Release
  
  • Supports Direct OFW to CFW patching for All Phat and 2xxx Slim (minver 3.56 Dec 2010 and lower)
  • the NOR/NAND writer will just copy 3Mb of CoreOS data to both ros0 & ros1 in the flash memory.
  • There is only one version released for 4.82. The same hex patch file can be used on nor & nand.
  • It's as safe as possible, with a check for usb device & patch file making the exploit hang instead of corrupting flash if file is not found.
  • In case of corruption (extremely rare but could always happen), it's only a partial brick because no per console info ever gets erased so a hardware flasher could still be used if ever a recovery reboot was impossible.
  ​
  Usage Tips:
  
  1) Try using a LAN connection or a solid WiFi connection during exploitation. A weak signal can cause problems.
  2) If the exploit takes more than 5 minutes to work, reload page, browser, or restart console and try again.
  3) If you are using a LAN connection and experience network issues, make sure all cables to router are in working order.​
  ​
  
  Steps:
  
  1. Setup a small Web server on pc or smartphone. A custom miniweb application (from: https://sourceforge.net/projects/miniweb/files/) with small changes to the JaveScript, and supplied to host files if you would like to use it. Don't come to us for explanations about how to run a http server though. Google it.
  
  2. Extract the files from release to your http server root folder.
  

  2a- To use the miniweb.exe server, it is necessary to create a folder: htdocs
  2b- The files *.html and *.js included in the zip files should be copied/moved to htdocs​

  3. Copy the "flsh.hex" file from release folder to root of flash drive.
  
  4. Put a FAT32 USB key in port closest to BD Drive (/dev_usb000).
  
  5. DOUBLE-CHECK your flash drive on XMB to make sure it shows up under Music, Photos, Videos, etc.
  
  6. Open the PS3 browser File Address window, write the IP address of your server (and the port if not 80) & press the Start button.
  
  7. Select the appropriate button for your console and wait for PS3 to power down. DO NOT STOP THE PROCESS ONCE STARTED!!
  
  8. Once PS3 has powered down, reboot console and install CFW matching OFW version. If installing through XMB does not work, boot to recovery and install.​
• 
  
  PS3 4.81/4.82 NAND/NOR Flash Dumper v1.0
  THE CORRECT FIRMWARE VERSION BETWEEN 4.81 and 4.82 IS AUTOMATICALLY SELECTED!
  
  UPDATE - ALSO Ported to earlier Official Firmware >>> Link​
  
  PLEASE READ FIRST:
  
  • It's essential not to flood the browser memory with junk before running the exploit. The reason for this is that due to javascript core memory usage limitations we are scanning several times a small range of browser memory (a few Mb) to find some essential data in RAM, if the memory is flooded then the range to scan becomes much larger & the probabilities that our data is found in the smaller range decrease dramatically....
  • So in short, never use the browser or set a homepage you cancel before running the exploit! If you need to, set the homepage to 'blank', close the browser then reopen it to start the flash writer.
  
  v1.0.0 - Initial Release.
  
  • Supports Dumping NOR on both 4.81 & 4.82.
  • bguerville tried to produce a release that was easy to port & he succeeded. Anyone able to search for offsets in IDA can add support to any firmware version in the dumper in a matter of minutes.
  • For technical reasons, the Full NAND dumper release is postponed. We will now be focusing on self execution & if we succeed there will be no need for the extra ROP work to do the NAND dumper. If we fail, I will finish it in ROP.
  • A lot of time has been invested into making the javascript + UI more efficient, as well as the trigger phase faster & more stable. I hope you enjoy the result.
  Usage Tips:
  
  1) Try using a LAN connection or a solid WiFi connection during exploitation. A weak signal can cause problems.
  2) If the exploit takes more than 5 minutes to work, reload page, browser, or restart console and try again.
  3) If you are using a LAN connection and experience network issues, make sure all cables to router are in working order.​
  
  Steps:
  
  1. Setup a small Web server on pc or smartphone. A custom miniweb application (from: https://sourceforge.net/projects/miniweb/files/) with small changes to the JaveScript, and supplied to host files if you would like to use it. Don't come to us for explanations about how to run a http server though. Google it.
  
  2. Extract the files from release to your http server root folder.
  

  2a- To use the miniweb.exe server, it is necessary to create a folder: htdocs
  2b- The files *.html and *.js included in the zip files should be copied/moved to htdocs​

  3. Put a FAT32 USB key in port closest to BD Drive (/dev_usb000).
  
  4. DOUBLE-CHECK your flash drive on XMB to make sure it shows up under Music, Photos, Videos, etc.
  
  5. Open the PS3 browser File Address window, write the IP address of your server (and the port if not 80) & press the Start button.
  
  6. The dumper will detect the firmware version of your console automatically & setup the code appropriately so there is only one version for both 4.81 & 4.82. Run until ps3 beeps & shutdown. The flash dump should be a 16MB file on your USB drive as dump.hex.​
• 
  
  Frequently Asked Questions & Additional Notes​
  
  
  Any Noob Friendly Guides for OFW to CFW? APRROVED BY TEAM PS3Xploit
  
  • TEXT Tutorial: -- PS3 developer @aldostools, has written a very simple and easy to understand TuT, you can view via this link >>>> http://www.psx-place.com/threads/ps...-aldostools-a-simple-rebug-cfw-install.15610/
  • VIDEO Tutorial - A very nice Video Tutorial by MrMario2011
    
    ​
  
  Will this jailbreak my SuperSlim?
  
  • NO, (PS3Xploit has strong possibility to eventually evolve into a HEN style exploit (that aspect will take some additional development and time, at this time PS3Xploit exploit has not evolved enough)
  
  
  Is my Model Compatible & Which Writer does my console need (NOR or NAND)?
  
  • 
  
  Can I install a CFW before 4.82, such as Rebug 4.81 or an earlier CFW?
  
  • Yes, however you must Toggle QA Flag. Once the Token is activated you have the ability to then freely jump CFW versions. (see below for details)
  
  How do I Toggle QA Flag?
  
  • When on a CFW download & install >>> QA TOGGLER (Standalone), (Note: Will just show a black screen then reboot the PS3 and returns to xmb. A Restart is Required. After toggling QA, cfw syscalls will be disabled (meaning your CFW patches will be disabled until the next boot, so a reboot is required after the Toggler exits back to the XMB.) Additional Info about Q/A flag can be seen here ( & also @ PS3Devwiki)
  
  Should i use the "999 Downgrader" vs "Toggle QA" to install a different CFW?
  
  • No, installing the "999 downgrader" PUP can cause various issues like on a 3.56 minver console, it will brick the console, simply just Toggle the Q/A Flag and play it safe and is so simple to move from CFW versions (up and down from version to version).
  
  How do i know for sure if my PS3 Model is compatible ?
  
  • You must have a PS3 Console that has a Factory Firmware of 3.56 and below.
    
  • To check, its easy with this simple tool for OFW, Download minverchk.rar
  • Then place the .pup file on a FAT32 USB Flash Drive in a PS3/UPDATE folder (create path if needed)
  • Now on the PS3 XMB goto Setting ->> System Update >>> Update via Media Storage
  • Once shown on the list select the PUP and install, shortly after there will be a message showing the factory firmware the console was shipped,
    
  • For this we want 3.56 and below.
    
  • ANYTHING HIGHER THEN 3.56 IS NOT ABLE INSTALL A CFW. Sorry this will not work for your console, but there could be a HEN (Homebrew Enabler) possible for running homebrew, but additional research and time is needed for achievement, additional details can be read here.
  
  What is the basic purpose of the Writer & Dumper Tools Release?
  
  • The dumper is to get a backup of the nor chip
  • The writer is to jailbreak your console. (Adding a patch to OFW to allow CFW installation)
  
  Do I have to setup my own web server or can (has) someone host this?
  
  • For best results and security it's advised/recommended to setup a local web-server to execute the webkit exploit, The best Unofficial Host we have found is from developer RED and his page: http://redthetrainer.com/ps3/
  
  How to go from Ferrox 4.82 to Rebug 4.81?
  
  • .Question Raised Here , OR alternatively you can uses this UNOFFICIAL modified version of REBUG 4.81.2, that will install on 4.82 (without QA FLAG as it contains an edit to the syscon version) >>>> (View Tweet & Download Link)
  
  Where can i find the latest 4.82 CFW?
  
  • This thread in the psx-place.com forums.
  
  Where can i find PS3 Homebrew?
  
  • PSX-Place.com
    
  • Brewology.com
  
  New to PS3 CFW Community (Have CFW now installed and want to know a bit more)?
  
  • Here is a thread being started in the forums, An Intro to CFW & PS3 Homebrew . Covers various basic of firmware types and some essential apps. The thread is a WIP so expect additional items to be added.
  
  PSX-Place Member @lord3490 provided some extra FAQs, to which the PS3Xploit team also added information.
  ​
  Q: my console just froze and nothing's happening for over 10 minutes
  
  • A: turn off console, the exploit failed.
    • 1. Make sure you got the correct file on USB thumb drive and it's formatted to fat32.
    • 2. Use an ethernet cable connection instead of WiFi.
    • 3. Double check your local Web server configuration & logs to see if it is not simply failing to send files to the ps3. A http server could fail for many reasons, bad configuration, bad permissions, Windows firewall options, AV software, router settings etc....
    • 4. Clean browser cache
    • 5. Set ps3 browser homepage to about:blank (or to your exploit Web page)
    • 6. Restart Browser
    • 7. Try again
  
  Q: the console shut down and beeped when using the exploit, however I'm getting an error when trying to install cfw?
  
  • A: there are a couple of possible reasons for that:
    • 1. Did you make sure you flashed the correct file (nand/nor)? See q/a above
    • 2. Try different 4.82 CFWs and make sure the md5 is correct after copying to fat32 thumb drive.
    • 3. Try a different USB thumb drive or reformat it.
    • 4. Install OFW 4.82 two times in a row then apply the patch using the PS3Xploit flash writer & finally install a 4.82 CFW. That should always solve the issue.
    • 5. As a last resort, make a backup and format internal HDD (I just read that solved the problem for one user).
  
  Q: when will there be a CFW or a HEN type of hack for newer ps3 models?
  
  • CFW (Custom Firmware): Not Possible
  • HEN (Homebrew Enabler): you may be able to use homebrew (even backup managers) later on. The devs are working on it and they won't be faster or release it earlier because you ask. The PS Vita / PlayStation TV use a HEN exploit (HENkaku) to give you a idea on what a HEN is for those of you who have followed the Vita Scene.
    
  • Keep dropping by this forum and you won't miss it once it's there. You will here it first from psx-place.com the official home of the PS3Xploit Team
  
  Q: okay, I got a cfw installed. What do I do now?
  
  • A: Read. There is a lot of information on this forum. Use search function for specific topics and check out this thread >> An Intro to CFW & PS3 Homebrew to get started.
  
  Q: where can I download games?
  
  • A: From PSN, for anything else you may want to read the forums rules! psx-place.com
  --------------------------------------------------------​
  ​

Downloads:

• NOR Dumper for 4.81/4.82
• NAND/NOR Writer for 4.82

---

dIMPORTANT UPDATE (MARCH-2019) v3.0.1 was released providing support for 4.84 HFW (a new hybrid firmware that restores PS3Xploit for 4.84 OFW user's (See Link to HFW)

---

d
Courtesy of Team PS3Xploit:
W (Javascript, Research & Testing)
[COLOR=#003366]@esc0rtd3w[/COLOR] (Debugging, Research & Testing)
[COLOR=#003366]@habib[/COLOR] (ROP & Debugging)
[COLOR=#003366]@bguerville[/COLOR] (ROP/Javascript & Debugging)​

 

yeah its the exploit that is the problem. i cant get to the CFW cause i cant get the flash to work. i left my ps3 on after i made that last post just in case, its been a full hour now and nothing. i installed the 4.82 update with the 1st usb and it worked fine, so its not like there is something wrong with it.

after 3 attempts, i tried switching just incase but still no luck for the next 2. not sure i wanna give it another "1000 million tries" lol i've been playing PC games for the past 2 years, and lost out on the last 11 hours trying to research this and get it done.

wish i just spent it gaming



I tried using the guide as well as the simplified 4.82 guide in another post, and i made 3 NOR dumps before i started.

been doing all the right things, just not getting anywhere.

I lost all one afternoon doing this. After 5 hours trying, y use minibew, and 30 seconds i heard the beep un turn off. Just give it a try in case you are using a website.

 

i installed the 4.82 update with the 1st usb and it worked fine, so its not like there is something wrong with it.

Thats a very good thing indeed to test if your USB stick is good to use with the PS3

Actually, i was thinking in mentioning this before as a good trick before starting with the exploit
For the people that is actually in 4.82... you should know the PS3 allows to install an official firmware on top of the same official firmware (two official firmwares of the same version)
So everybody can do it... as a paranoid security meassure to be 100% sure the USB stick is compatible with the PS3
The point is the way im suggesting you are going to do this test with an official .PUP file and this gives a bit of security
The only contra is if you are on 4.82 already... installing 4.82 over it adds an unnecesary flash write... but i think if it was me i would do it

For you case i suggest at this point to format the USB stick again and place the flsh.hex and a PS3UPDAT.PUP from a CFW on it
This way you dont need to mess around more with the USB stick until all process has been completed

 

I lost all one afternoon doing this. After 5 hours trying, y use minibew, and 30 seconds i heard the beep un turn off. Just give it a try in case you are using a website.

no actually it seems miniweb was my problem. i didnt get it to work til i tried red the trainers online server. when i did that it worked first try.

Thats a very good thing indeed to test if your USB stick is good to use with the PS3

Actually, i was thinking in mentioning this before as a good trick before starting with the exploit
For the people that is actually in 4.82... you should know the PS3 allows to install an official firmware on top of the same official firmware (two official firmwares of the same version)
So everybody can do it... as a paranoid security meassure to be 100% sure the USB stick is compatible with the PS3
The point is the way im suggesting you are going to do this test with an official .PUP file and this gives a bit of security
The only contra is if you are on 4.82 already... installing 4.82 over it adds an unnecesary flash write... but i think if it was me i would do it

For you case i suggest at this point to format the USB stick again and place the flsh.hex and a PS3UPDAT.PUP from a CFW on it
This way you dont need to mess around more with the USB stick until all process has been completed

I already got it going finally, but thank you for the suggestion.

 

yeah its the exploit that is the problem. i cant get to the CFW cause i cant get the flash to work. i left my ps3 on after i made that last post just in case, its been a full hour now and nothing. i installed the 4.82 update with the 1st usb and it worked fine, so its not like there is something wrong with it.

after 3 attempts, i tried switching just incase but still no luck for the next 2. not sure i wanna give it another "1000 million tries" lol i've been playing PC games for the past 2 years, and lost out on the last 11 hours trying to research this and get it done.

wish i just spent it gaming



I tried using the guide as well as the simplified 4.82 guide in another post, and i made 3 NOR dumps before i started.

been doing all the right things, just not getting anywhere.

You are blaming the exploit for problems linked to your setup.
You may think you are doing all the right things but you are obviously not !

I read things like the dumper took 20mn to write 16 Mb to usb... That's NOT normal. It should be done much faster than this.
You have an issue with USB somehow, on my 2 slim consoles I dump 16Mb in a minute maybe 2!

Btw the exploit code is all system code rearranged by us, we did not write it, s#NY & BSD did! The logic of code arrangement is 100% sound so in all cases, any problem you may have is external to the exploit itself.

 

Bought a 10 dollar ylod cecha01 broke the bd clip): well I fixed the ylod and like 9 days later you release this and it worked flawless.. another launch model back in action.. Thank you!!!!!!!!!!!!!!

 

@ranjith
at the moment there is not

just dump and idps (but check out the tutorial if you have the right console)

 

Jb for super-slim release date

From what I've gathered reading the information above it seems as super slims might not be jail broken rather it will get a hen enabler.. I'd assume it would be ofw/cfw mashed together? If even made possible..

 

Is it possible to use an adrino usb with this eploit loading the hex like how the jailbreak for 3.41 worked. I mean in any form or fasion. I dont have a usb drive and cant afford one right now to much xmas shopping to do so i was curios if the hex could be loaded to use websploit

 

Is it possible to use an adrino usb with this eploit loading the hex like how the jailbreak for 3.41 worked. I mean in any form or fasion. I dont have a usb drive and cant afford one right now to much xmas shopping to do so i was curios if the hex could be loaded to use websploit

The only way to use it is to have a device connected as USB Mass Storage or if you have an old PHAT on SD/CF/MMS cards.
The exploit requires the FAT32 device to be mounted automatically by the system.
So in theory, if you can hook up anything that the system recognises as USB mass storage then as long as we have the mounted point you could use the exploit.
In practice, such things have not been tested.

 

The only way to use it is to have a device connected as USB Mass Storage or if you have an old PHAT on SD/CF/MMS cards.
The exploit requires the FAT32 device to be mounted automatically by the system.
So in theory, if you can hook up anything that the system recognises as USB mass storage then as long as we have the mounted point you could use the exploit.
In practice, such things have not been tested.

Ok thank you i have a newer cell phone with the multi partitions but they arent fat32 ill see if i can find a cheap flaah card

 

just wondering will a nobd firmware be released?
I have a console with bad bd drive cant marry drive
not able to get root eid.
thanx in advance.

 

just wondering will a nobd firmware be released?
I have a console with bad bd drive cant marry drive
not able to get root eid.
thanx in advance.

Already is http://www.psx-place.com/threads/4-82-overflow-cfw-collection.15450/

 

just wondering will a nobd firmware be released?
I have a console with bad bd drive cant marry drive
not able to get root eid.
thanx in advance.

you can make your own with mfw. iirc, it's just a upl edit.

 

Ok thank you i have a newer cell phone with the multi partitions but they arent fat32 ill see if i can find a cheap flaah card

Keep in mind that this is theory. There could be many reasons for attempts to fail, consider for example that updating the fw from other devices than a USB stick is likely to fail, even many external hdds are problematic. It's actually mentioned in the support section of the official ps3 website.

With that in mind you are welcome to try, there should be no brick risk in testing it but in any case you should test with the idps dumper first, no risk at all involved there. If it can write to the device, it can definitely read Q

 

You are blaming the exploit for problems linked to your setup.
You may think you are doing all the right things but you are obviously not !

I read things like the dumper took 20mn to write 16 Mb to usb... That's NOT normal. It should be done much faster than this.
You have an issue with USB somehow, on my 2 slim consoles I dump 16Mb in a minute maybe 2!

Btw the exploit code is all system code rearranged by us, we did not write it, s#NY & BSD did! The logic of code arrangement is 100% sound so in all cases, any problem you may have is external to the exploit itself.

sorry @bguerville, you seem offended.

i was just feeling hopeless at the time. im totally new at this ps3 hack stuff. i literally know nothing about it or what i can even do with it, aside from pretty much what i found out so far today. that being said, i guess my ps3 is just slow. all 3 of my dumps did take about 20 minutes each. sorry if i seemed like i was blaming anyone. i spent 11 hours researching and trying this and was just frustrated and overwhelmed.

apparently the reason why my exploit wouldnt take must have had something to do with my miniweb. all my attempts failed til i went to red the trainers website for one last try using his server.

anyway, thanks for all you do. good luck.

 

sorry @bguerville, you seem offended.

i was just feeling hopeless at the time. im totally new at this ps3 hack stuff. i literally know nothing about it or what i can even do with it, aside from pretty much what i found out so far today. that being said, i guess my ps3 is just slow. all 3 of my dumps did take about 20 minutes each. sorry if i seemed like i was blaming anyone. i spent 11 hours researching and trying this and was just frustrated and overwhelmed.

apparently the reason why my exploit wouldnt take must have had something to do with my miniweb. all my attempts failed til i went to red the trainers website for one last try using his server.

anyway, thanks for all you do. good luck.

Not offended at all, it's not the point.
What am saying serves to clarify the situation to readers who will go through these posts searching for answers not to elicit from you some excuses you do not owe.

And btw I am glad you finally got it to work...

 

After running the exploit (with success) I want to go from ferrox 4.82 to rebug I've downloaded rebug 4.81.2 rex md5 checks out did the qa enable (button combinations worked) so now all I have to do is plug my USB into the right USB slot and update using the ps3 built-in updater? Yes I have read most of this thread but still a little confused just want to double check if I am doing it correctly. Thanks you in advance.

 

I have run the exploit on my CECHC04, it beeped three times and shutdown. Whenever I try to install CFW I get the error message that the file is corrupted.
I have tried all the steps in the FAQ, but I still get the error.
Any ideas how to get it to work?

 

After running the exploit (with success) I want to go from ferrox 4.82 to rebug I've downloaded rebug 4.81.2 rex md5 checks out did the qa enable (button combinations worked) so now all I have to do is plug my USB into the right USB slot and update using the ps3 built-in updater? Yes I have read most of this thread but still a little confused just want to double check if I am doing it correctly. Thanks you in advance.

Yes you're good to go .... to rebug 4.81.2

 

I have run the exploit on my CECHC04, it beeped three times and shutdown. Whenever I try to install CFW I get the error message that the file is corrupted.
I have tried all the steps in the FAQ, but I still get the error.
Any ideas how to get it to work?

Did you run the NAND files, the exploit didn't work try again?