PS3 Downgrading to OFW

P

ps3gaming231402376

Forum Noob
Hi, I have no background knowledge on PS3 modding so I would appreciate it if someone could give me some pointers. :)

I have a hardware modded PS3 on REBUG 4.80 CFW. I want to play online and get the same functionality as a stock PS3 without risking a ban. What's the best way to go about reverting back to OFW?
 
Thanks for your suggestion! Upon trying both methods I get the error 80029CCA (The data is corrupted.) I've tried using multiple USB drives and have verified that my folder structure on them is correct (root/PS3/UPDATE/PS3UPDAT.PUP). When I try to install through the recovery menu it simply tells me that there's no applicable update data. Any idea why this is happening?
 
Question, are you trying to install OFW 4.88, or are you trying to downgrade to a lower OFW version than 4.80? Downgrading (going to a lower firmware) requires you to enable QA flags, which you can do with Rebug Toolbox (you need a reboot for it to work).

Now, you also mentioned having a "hardware modded" PS3. What do you mean by this? Are you using an ODE, or is it an unrelated hardware mod (a fan, different disc drive, etc)?
 
I'm trying to install the latest OFW (4.88) from the official Sony website. To clarify on the mod situation I'm actually not entirely sure, sorry. I received this PS3 a while back and could be confusing it with something else. I can open up the console if you'd like to provide some more info, but I hope that whatever could be installed in there will not conflict with what I'm trying to do.
 
When following the reddit instructions, "Toggle QA" was already enabled, "dump eid_root_key" when selected does nothing. Obviously I can't select "rewrite target ID in flash" either. However I could do the swap LV2 kernel option and it says I switched to CEX so I imagine the previous steps have already been completed? After rebooting my console I attempted all 3 update methods (USB (XMB), USB (in safe mode) and debug update). I got the same error messages for each of them, but to note while trying the safe mode update it seemed to check the USB for longer than usual. Not sure what is happening :/. Thanks for your persistence
 
ps3gaming231402376 said:
When following the reddit instructions, "Toggle QA" was already enabled, "dump eid_root_key" when selected does nothing. Obviously I can't select "rewrite target ID in flash" either. However I could do the swap LV2 kernel option and it says I switched to CEX so I imagine the previous steps have already been completed? After rebooting my console I attempted all 3 update methods (USB (XMB), USB (in safe mode) and debug update). I got the same error messages for each of them, but to note while trying the safe mode update it seemed to check the USB for longer than usual. Not sure what is happening :/. Thanks for your persistence
Click to expand...
1. You don't need QA to update the firmware, only to downgrade, if your console is currently on 4.80, downgrading means installing a lower firmware version ie < 4.80.
2. In the Rebug Toolbox first column there is a "system info" option, it will tell you what kernel mode you are are using.
3. If the kernel is DEX, to convert back to CEX, you must use the Rebug Toolbox "Rewrite TargetID" feature, that's it, nothing else, the console will reboot in CEX mode.
The eid_root_key is the internal hdd UFS2 partition encryption key, it's needed by the cex/dex conversion process. If the key has already been dumped before on the hdd, the conversion process will find it but if it cannot be found on the hdd, you will need to dump it before you can convert.
4. If at some point you spoofed the firmware version with a spoofer (like the feature in SEN Enabler) in order to connect to PSN, you should remove the spoof before installing a PUP.
 
Last edited:
bguerville said:
1. You don't need QA to update the firmware, only to downgrade, if your console is currently on 4.80, downgrading means installing a lower firmware version ie < 4.80.
2. In the Rebug Toolbox first column there is a "system info" option, it will tell you what kernel mode you are are using.
3. If the kernel is DEX, to convert back to CEX, you must use the Rebug Toolbox "Rewrite TargetID" feature, that's it, nothing else, the console will reboot in CEX mode.
The eid_root_key is the internal hdd UFS2 partition encryption key, it's needed by the cex/dex conversion process. If the key has already been dumped before on the hdd, the conversion process will find it but if it cannot be found on the hdd, you will need to dump it before you can convert.
4. If at some point you spoofed the firmware version with a spoofer (like the feature in SEN Enabler) in order to connect to PSN, you should remove the spoof before installing a PUP.
Click to expand...

I can't dump my eid_root_key currently, upon selecting the option in the REBUG toolbox it does nothing. Also, how can I tell if my firmware version is spoofed? SEN enabler was installed on this PS3 previously, but I wiped the HDD before attempting an update.

Thanks again.
 
ps3gaming231402376 said:
I can't dump my eid_root_key currently, upon selecting the option in the REBUG toolbox it does nothing. Also, how can I tell if my firmware version is spoofed? SEN enabler was installed on this PS3 previously, but I wiped the HDD before attempting an update.

Thanks again.
Click to expand...
Have you checked whether your kernel is DEX & needs converted in the first place?

Have you checked whether the eid_root_key file was created at dev_hdd0/game/RBGTLBOX2/USRDIR/eid_root_key?

I don't recall how the erk dumper was set up in the Rebug Toolbox back in the 4.80 days, that was a while back.
For the feature to work in 4.80 DEX I think you need to have this file:
/dev_hdd0/game/RBGTLBOX2/USRDIR/root_key_480d.self
That's the erk dumper self for 4.80 DEX.
For 4.80 CEX, it should be
/dev_hdd0/game/RBGTLBOX2/USRDIR/root_key_480.self

You should maybe update the Rebug Toolbox, download the latest pkg & install it.
Alternatively you can use the separate erk dumper self directly, without the Rebug Toolbox.

Wiping the hdd does not automatically remove all patches.
On NOR consoles, any patch applied to CoreOS files would remain on the Flash memory.
On NAND, any patch applied to CoreOS files or to /dev_flash files (that includes the entire XMB) would remain on the Flash memory.
 
In the system information setting in toolbox it lists:
PS3 System: Firmware 4.80 DEX
LV2 Kernel: DEX
Target Type: DEX

The eid_root_key file is not present.

I'm on the latest version of Rebug Toolbox, and in its directory there's root_key_475 and root_key_481d.self. Where can I find the proper dumpers for 4.80? Also, I'll try reinstalling SEN enabler to reset any spoofs that may have been done
 
Maybe try using the version of the Toolbox that came bundled with the CFW by default, or a version a bit higher (I believe it's version 2.02.10, maybe try 2.02.11? You can get it here: https://archive.midnightchannel.net/SonyPS/Firmware/?cat=ps3pkg).

You can also try dumping eid_root_key with Zar's ManaGunZ or IDPSET (Zar mentions dumping root key dumper being firmware independent since IDPSET v0.87: https://www.psx-place.com/threads/i...ort-cfw-support-of-eid_root_key-dumper.20450/)

Edit: It is v2.02.10: https://web.archive.org/web/2019032...ug-4-80-1-cobra-7-3-toolbox-2-02-10-may-2016/
 
ps3gaming231402376 said:
In the system information setting in toolbox it lists:
PS3 System: Firmware 4.80 DEX
LV2 Kernel: DEX
Target Type: DEX

The eid_root_key file is not present.

I'm on the latest version of Rebug Toolbox, and in its directory there's root_key_475 and root_key_481d.self. Where can I find the proper dumpers for 4.80? Also, I'll try reinstalling SEN enabler to reset any spoofs that may have been done
Click to expand...
Your Rebug Toolbox installation appears to be incomplete, here is the snippet of the Toolbox source code dealing with the erk self launch:
Code: 
if(c_firmware==4.80f && dex_mode) strcpy(version, "480d"); 
... 
else	return;
...
char rkdumper[64];
sprintf(rkdumper, "/dev_hdd0/game/RBGTLBOX2/USRDIR/root_key_%s.self", version);
if(!exist((char*)rkdumper)) return;
...
launch_self2((char*)rkdumper);
If the root_key_480d.self file is missing & you don't already have eid_root_key in the Toolbox USRDIR directory, it makes sense for both the erk dump & the cex-dex conversion process to fail.

Delete your current installation & try installing another Rebug Toolbox pkg.
You could use the pkg coming with your CFW by default or any of the 8 versions available as pkg at https://store.brewology.com/ahomebrew.php?brewid=308, they should all do fine on 4.80 dex for which support was added just before v02.02.11.
 
Last edited:
You must log in or register to reply here.

Similar threads

Back
Top