DUAL NAND PS3 DOWNGRADE TO FW 3.55 To proceed we’re going to need the following: - a ProgSkeet - A 40Go or 60Go PS3 with a FW newer than 3.55 - A JailBreak Key (no matter the model or manifacturer, could also be a DIY one, I used the Blemmi) - The 3.55 FW Package properly customized for the downgrading process. (I personally advice to use Rogero 3.1 or newer to keep Bluray Player Features.) or another CFW with NOCheck enabled : CLICK - Downgrading Package: CLICK - LvDiag.self file to enter FSM (Service Mode) : CLICK - LvDiag.self file to exit FSM: CLICK - Winskeet Tool: CLICK - HxD Program or another Hexadecimal Editing Tool of your choice: CLICK - a USB Key with a minimum size of 256 MBytes, FAT32 formatted. - 2 Resistors with values between 2.2 and 10KOhm (I used 3.3K Ohm) - A ME1117st33 Voltage Stabilizer to PullUp the R\B point. - FlowRebuilder 4.1.3.2 o newer: CLICCA - It is advisable to take 2 Micro Switches to set ProgSkeet’s R7 and R8. - Flux, Tin Coil and min. AWG30 Wire. - Tons of Patience and Very Good Soldering Skills. It’s better to play a recent BluRay movie BEFORE starting this procedure. This way, DRLs recovery will be easier after downgrade. I must remind you that this procedure is very complex in its nature, that it needs really good soldering skills and knowledge in the use of electronic programmers. If anything goes wrong there will be good chances that the console will be unrecoverable. WE DO NOT TAKE ANY RESPONSIBILITIES FOR ANY DAMAGE THAT COULD RESULT FROM YOUR USE OF ANY INFORMATION HERE DEPICTED. First, we need to make sure that we own a Downgradable Console. Please remember that only consoles with a NATIVE FIRMWARE UP TO 3.55 CAN BE DOWNGRADED. To know that, please look at the following table (or: CLICK HERE): We could also use MinVersCheck Tool (CLICK): rename the file “PS3UPDAT.PUP”. Copy renamed file in our USB Key FAT32 formatted, following this path: PS3\UPDATE\ (If you don’t have it, create it): Power Up your console and go to Settings\System Update. Launch the Tool as it was an official update. After some seconds you’ll be returned with the minimum Downgrade FW applicable to your console. Now, if 3.55 is applicable, we can go on. SETTING UP PROGSKEET v1.0 and 1.1 Progskeet 1.0 and 1.1 are pretty similar, in 1.1 some PADs have been added to allow different voltages (but we’re not going to use them) and the presence of a 56PIN socket useful to add flats for NAND and NOR CLIPS) Here are some Chips Snapshots: It could be of use to point out some things about setting up the Progskeet v1.0. ProgSkeet can be set up to power the NANDs itself. This mode relies upon the state of R7 and R8. Here is how to set them up: - Stand Alone Mode: R7 and R8 are CLOSED - Standard Mode: R7 is CLOSED while R8 is OPEN. Now we have to set Progskeet up to our console. Here’s a generic schematic of the NAND Pinout. You can follow the installation diagram below (Click on the image to Zoom In) It’s better to work on ONE NAND at a time, to avoid issues. Maybe the process will take more time, but it’ll be safer. If you need the alternate points, they’re reachable via Ps3 DevWiki WebSite: CLICK As it can be seen from the schematics, it’s suggested to use an external power source and GND, to make the read and write process as stable as possible. Another way through could be to use the NAND with an external ZIF Socket for TSOP 48 (as reported here: CLICK), that is DESOLDERING THE NANDS, but avoid this if you aren’t an expert and if you don’t own a proper hardware. If we own a Progskeet 1.0 we firstly CLOSE UP R7 and R8, then we follow the schematics. (Owners of Progskeet v1.1 don’t need to do anything as those points are already CLOSED) Now we can proceed to downgrade! SETTING UP PROGSKEET v1.2 Progskeet 1.2 has been through several revisions and improvements, and now includes all the known fixes to make the NAND/NOR writing process as stable as it can be. Now we have to set Progskeet up to our console. Here’s a generic schematic of the NAND Pinout. You can follow the installation diagram below (Click on the image to Zoom In) It’s better to work on ONE NAND at a time, to avoid issues. Maybe the process will take more time, but it’ll be safer. If you need the alternate points, they’re reachable via Ps3 DevWiki WebSite: CLICK As it can be seen from the schematics, it’s suggested to use an external power source and GND, to make the read and write process as stable as possible. Now we can proceed to downgrade! CONSOLE DOWNGRADE Let WINSKEET run and set up the program this way: - Select Dual Nand Samsung choice from Default Settings (1) - Set up Read Delay to 200 (2) - unckeck “Verify” (anyway this is left to your choice, to speed up the process. You can leave it checked to be 100% sure dump is good.) Now we navigate on the NAND Tab: - Check the System Settings. - Click on "AUTO" to check if the NAND is being detected. (if it shouldn’t, check the wiring.) - If it’s detected, double check the Settings. - Uncheck the 2nd NAND. - Click on “Dump” to start the process. You will be asked where to save the file: Then wait for the dump to finish: When the 1st NAND Dumping process has ended, go on with the 2nd... When both of them end up, two files will have been created: Now we verify if we have good dumps. Open HxD and select the dump : Go to Analysis/Statistics and check the maximux values detected on 00 and FF: If our values fall within the ones in the table below, we have good dumps. Now open up FlowRebuider: - Select Unscramble then interleave flashers into one unified dump - On Flash 0 select the Path for the First NAND (generally located at the side of the Motherboard with CPU and CPU) - On flash 1 select the Path for the Second NAND (generally located at the side of the Motherboard WITHOUT CPU and CPU) - Select the path where to save the merged NAND. - Click on “Execute Operation” to start the Merging Process. If anything went fine, we’ll end up having an .EXT folder with some files as in the image below: If you should end up with only bootloader_0 e bootloader_1 files (both 0Kb in size) it means you reversed the two files in FlowRebuilder. Now we must patch the NAND... Copy in the Merged Nand Folder the Downgrade Package, Open WinSkeet, Navigate the Patcher TAB and select: - our Merged NAND - .txt patch file And start the process! When the process ends up, we’ll have our PATCHED NAND. Go back to FlowRebuilder... Select “Re-Scramble dump then de-interleave it into two flashers...” - On Flash 0 select the Path for the First NAND - On flash 1 select the Path for the Second NAND - As INPUT NAND select the PATCHED NAND: Start WINSKEET again and set the program this way: - Select Dual Nand Samsung choice from Default Settings (1) - Set up Read Delay to 200 (2) - unckeck “Verify” (anyway this is left to your choice, to speed up the process. You can leave it checked to be 100% sure dump is good.) Now we navigate on the NAND Tab: - Check the System Settings. - Click on "AUTO" to check if the NAND is being detected. (if it shouldn’t, check the wiring.) - If it’s detected, double check the Settings. - Uncheck the 2nd NAND. - Click on “Flash” to start the process. When the 1st NAND Dumping process has ended, go on with the 2nd... When flashing is completed, it’s suggested to dump the NANDS again and compare the resulting dumps with the downgrading file we created before. If comparing matches we can go on. Take LvDiag.self file to enter FSM (Service Mode) and the PS3UPDAT.PUP file (from the CFW Package) and copy them in your USB Key. Then, follow this steps scrupulously: - Power off the console and insert the Jailbreak key in the leftmost USB port of the console if horizontally or the lowest if vertically. - Power on the console by pressing POWER and PRESS EJECT WITHIN 2 SECONDS. - Console will power on, then the Jailbreak key will do its job and then the console will self power off again. - Insert the USB Key we prepared earlier with downgrade files in the rightmost USB port of the console, without touching everything else. - Take off the Jailbreak Key. - Power on the console again... The new firmware will start loading (It’ll take some time) - When loading ends, the console will power off itself. - Now, insert the BluRay disc and let the movie play (you are required to actually start the playing, being in the Movie Menu isn’t enough)... When the movie starts, we can exit from the FSM (Service Mode) to go back to Retail. - Power off the console. So, erase the USB Key contents and then copy LvDiag.self file to exit FSM inside of it. - While console is powered off, insert the USB Key in the rightmost USB port of the console. - Power on the console by pressing POWER and PRESS EJECT WITHIN 2 SECONDS - A loading process will start, then - The console will power off itself again. - When we boot it up again, we’ll must reset video and lan settings (as it was a first booting) Well, you’re done. Your console is now downgraded with the Custom Firmware 3.55. Have Fun.