PS3 What is the right way to use my E3 Flasher for unbricking my Ps3 Slim? (failed PS3Xploit NOR patch)

A

AmpereFX

Forum Noob
Hello everyone,

the last days I've read a ton of threads on this forum but I seem to not understand the topic of PS3 Jailbreaking and NOR flashing enough so I didn't manage to find the right information I need. For this reason I thought I would post my struggles on here so maybe one of the more experienced of you could help me. I really appreciate any kind of help.

I have a PS3 Slim (CECH-2004A, PCB: DYN-001, OFW 4.88) which I wanted to jailbreak. I followed a tutorial on YouTube that explained how to use the PS3Xploit website to install a CFW to my system. Everything worked till I came to the point where I guess the NOR chip had to get patched. Fortunately I successfully dumped the NOR image of the previously working console to an USB right when the exploit initiated. So I have a complete dump of my NOR and have also verified it on my computer before I moved on.

I know it's stupid and I even knew that during the process when it happened what makes it even more embarrassing but I exited out of the browser when the NOR patch was at 0% for a time. After a few seconds in the XMB my console froze and bricked. When powering on the console the green power LED turned on for a short moment and went red so that the console would just beep if I remember correctly. So the console is bricked since that.

After reading about this topic I ordered an E3 flasher that seems to be needed for flashing the dumped file that has to be restored. I connected the tristate to ground on my board and my console stayed turned on so I could use the E3 flasher. With all switched turned down on the E3 I then tried to flash the original dump called dump.hex (I read there could be differences, .hex or .bin, byte reversed? sorry I don't understand these things) by just renaming it to bkpps3.bin and putting it on the microSD. The flasher then even wrote the file to the NOR and left a log file telling me that the file has successfully written to the NOR. Unfortunately that didn't seem to solve the problem. Now the console doesn't turn off with the LED turning red but rather stays on not giving any video output. If I try to get into recovery mode (holding power etc.) it would just turn off since I held the button for to long.

Does anybody have an idea what I could do to get my system to start again? I saw a guide where I would have to patch my dump with a file (CoreOS ROS patch) but I didn't find any patch file for firmware 4.88. There was only coverage for 4.87 and below that.

I would really appreciate if someone could help me find the right solutions. :)
 
Update:
I finally managed to get my console to show video output again. The problem was that I had to byte-reverse the dump because it was created by the BG toolset on the PS3Xploit page.
Now I am finally able to get into the recovery mode. My NOR has my dump patched with NoFSM 4.88 (Evilnat based) installed.
My console though doesn't seem to accept any of the PS3UPDAT files through the recovery. Any ideas? Would be grateful. :)
 
I just noticed that regardless of a USB plugged in or not my console just keeps checking for update files and is stuck there. After I noticed I flashed the original pre-jailbreakattempt dump to the NOR and still the same infinite checking screen after pressing start and select. That's not normal I guess?
 
I wanted to add some more info for this exact usage of E3 Flasher (unbricking a PS3 bricked by an unsuccessful PS3Xploit/BGToolset flash) - the information available on the internet for this is not very structured and is confusing to new people, like me. Anyway, here's my experience using E3 Flasher to unbrick a PS3 in 2025:
  • Console: Slim PS3 CECH-2004B, mobo DYN-001, OFW 4.82
  • Problem: I messed up on reconstructing a broken fan socket - I did it by routing wires to the socket from the pads on the other side of the mobo, I did it wrong and the wires got under the heatsink - the console overheated and shut itself off during the NOR flashing process. The result was YLOD
  • I had a valid NOR backup made using BGToolset - this is very important to have and when you have this file, you don't have to do any of the CoreOS/ROS stuff described in this thread: https://www.psx-place.com/threads/guide-unbrick-a-ps3-after-an-unfortunate-ps3xploit-flash.21750/
  • The only things you need to do with your backup file is byte-reverse it (BGToolset creates non-byte reversed backups, while E3 Flasher expects the reversed files) and rename it to bkpps3.bin. Place this file in the root of your memory card.
  • I recommend using PyPS3Tools/PyPS3checker to validate your final file directly from the memory card, also generate a SHA256 checksum of this final file and keep it somewhere
  • Now for the hardware side. I have not found conclusive answer whether it's even needed to solder the wire on PS3 mobo (from TRISTATE point to ground). Some people on the internet claimed, that the switch configuration of the E3 flasher already does that. I didn't verify it and simply soldered the wire to be done with it. For my mobo, the test points are shown here:
  • The E3 flasher does not need any external power for flashing the NOR. It takes the power directly from the chip when your console is on. It also does not need to be connected to the SATA slot
  • Remember to make sure the small components on any side of the NOR chip don't interfere with the clip. If they do, you need to shave a bit of plastic from the clip (there are videos on this)
  • When you're attaching the ribbon cable, first make sure that the pins inside are not bent and that none are touching each other. DO NOT SKIP THIS STEP - after I already straightened all pins on mine, I managed to bend to of them anyway when installing and this caused invalid NOR writes and reads (the flasher reported that all went OK, but the data was garbage). Use a magnifying glass and a small flat screwdriver to fix the pins - they should go mostly straight up
  • After your cable is taken care of, put it on the chip (cable orientation for my mobo is in the video above). Make sure it's nice and flat, it won't necessarily make any clicks, I guess it depends on how much the cable was used. Then put something on it for even force distribution (I used a coin wrapped in insulating tape) and tighten it using F-clamp tool. Don't even try getting this to work without the clamp, you will just waste a couple of hours of your life like I did. I tried holding it down with my fingers, putting heavy stuff on top, nothing worked until I used the clamp. It's a very cheap tool and it makes no sense attempting flashing without it. Also make sure to put some padding on the other side of the clamp tool (the part that touched the mobo on the other side of the chip). I used a piece of cardboard + a thick piece of packing foam
  • Place some stuff under the mobo to compensate for the F-clamp presence there (you don't want the weight of the whole thing to just press on the clamp). Also, don't over-tighten the clamp. Use a reasonable amount of force and remember, that if the flasher gives you the ribbon cable error (in my case it was mostly 10001100) you can always unplug the console, tighten it a little bit more and try again. Don't crack your motherboard guys
  • When assembling your console for the flashing process, remember that you NEED to have the heatsink installed and tightened using the two metal plates. Place a piece of fairly thick cardboard under the plates, so they don't crack anything on the board. Do not attempt flashing with the full metal shield, you just need the part when the fan is mounted and the two small metal brackets. Remember, the writing process is 8 minutes and with the TRISTATE point grounded, your console is forced to continue working, If you do this part wrong you can overheat and kill it.
  • Now, with everything in place turn the console on, the E3 flasher should light up on its own. The flashing switch config is the first swithch from the left UP and the rest DOWN. Wait for around 30 seconds after turning the console on and then click start on the flasher. If you did everything right, the blue lights will slowly start lighting up from left to right, and when the process is finished, they will start alternating the same way, like before you clicked start.
  • NOW VERY IMPORTANT: Unplug the console and take out the SD card from your flasher, go to your computer, remove the .bin file and the log (you can check it before). Now go back, insert the card and do the process again, but this time, also pull up the third switch from the left. Doing so, you will read memory from the chip (takes 2-3 mins) and you will be able to check, whether the writing was successful. Myself, I had a write reported as "successful", but the console had the Green Light of Death anyway - the ribbon cable had two of the pins bent a little.
  • With the NOR read done, unplug the console again and generate a checksum of the newly created file on your memory card. It should be an exact match with the file you were flashing, if it's not, then you need to repeat the whole process again, until you have a match. Also won't hurt to check the generated file in PyPS3Checker
  • When you have a checksum match, congratulations, you successfully managed to unbrick your console. You can now unsolder the TRISTATE wire and connect HDMI to check if it's alive - you don't need to connect HDD, blu ray or the two antennas to check this.
  • I got some damage on the NOR chip as a result of all the clamping. The console works without issues so I assume the damage is just cosmetic - but it's visible on the black plastic of the chip.
  • I'm not sure if there are any other PS3 NOR programmers that require minimal soldering, but the E3 flasher is a finicky piece of shit and I really can't recommend using it. I wasted a lot of time fighting with either the ribbon cable or the SD card slot, I wouldn't buy it again.
Also, the link to good documentation, you will 100% need to read this whole article in addition to my post: https://consolemods.org/wiki/PS3:E3_Flasher
 
Last edited:
You must log in or register to reply here.

Similar threads

Back
Top