PS3 [GUIDE] Unbrick a PS3 after an unfortunate PS3Xploit flash

[1986panzi1986]

That guide is for technicians and advanced users having an hardware flasher. It intended to restore a NOR console under "metldr.2" having been accidentally flashed via PS3Xploit (v1 or v2), causing a perma-brick. So for some CECH-25xxx, the CECH-3xxxx and CECH-4xxxx NOR (for the 12GB CECH-4xxxx equipped with EMMC, no public tools are available yet to unbrick them.)

Note : for consoles under "metldr" (jailbreak compatible) bricked using PS3Xploit flash writer over a CFW, dump and flash your NOR or NAND applying regular NO-FSM jailbreak method.




1- Download the Core OS of the OFW we will use as ROS patch to overwrite wrongly applied PS3Xploit patches:

Download that *.bin file if your console is 4.82 system version: https://www.dropbox.com/s/ph0gvbh8jljgwk2/CosOFW482.BIN?dl=1
MD5: DBCE1CCF7E8A64DC2A6C7019E1C03749

Download that *.bin file if your console is 4.84 system version: https://www.dropbox.com/s/cfn94g0fkpnkgn6/CosOFW484.BIN?dl=1
MD5: E2396DD395E095128BCB69AABA2D1978

Download that *.bin file if your console is 4.85 system version: https://www.dropbox.com/s/e2zw8la8nmn3zsr/CosOFW485.BIN?dl=1
MD5: B833A708108360FC7913986E29C29B3E

Download that *.bin file if your console is 4.86 system version: https://www.dropbox.com/s/nmmrlzyl195tmg6/CosOFW486.BIN?dl=1
MD5: 78A3FBB16D79CC96BD38D62967A85567

Download that *.bin file if your console is 4.87 system version: https://www.dropbox.com/s/2b9m1iiuqk4vx6n/CosOFW487.BIN?dl=1
MD5: 8F4A63DC20F1EB54168478C814DF80C1

4.88 MD5: 36A0D80FB18E9D6FD7635217D59FA726
4.89 MD5: 2C6791BAC0978B921CACAEBB1E827743
4.90 MD5: AB9C9700445CCD1AB9215AF8C28EE0F9
4.91 MD5: AFA10D61A1156CF56A994CA85E3B4777

Download pack with decrypted CoreOS bin files for 4.82 to 4.91 system versions.
https://www.mediafire.com/file/7lk1iig4wj0wfgr/CosOFW.rar/file

2- Dump your NOR with your hardware flasher:

Note : If you previously made and saved a dump file with PS3Xploit NOR Dumper (dump.hex or dump.jpg), you should skip that step and use that dump file for next steps.

I will not describe the dump/flash procedure here. There are a lot of tutorials to use E3 flasher, Teensy or Progskeet for those who don't know yet.
In that guide I assume the dumps have been done correctly.
I highly recommend to use PyPS3checker (https://github.com/littlebalup/PyPS3tools) to check your dump before going further. Your dump should be good exept warnings on ROS's hashes. Ask me if you have any doubt.


3- Overwrite both ROS of your dump file with OFW CoreOS as patch:

Using PS3DumpChecker (https://github.com/Swizzy/PS3DumpChecker) :
- Load your dump. It may be BAD with one or two bad ROS hash, and maybe also the SKU and or semistatic data (PS3DumpChecker is not fully compatible with 3k and 4k dumps). Don't care as long as you are 100% confident your dump has been done correctly and checked with PyPS3checker.
- In the PS3DumpChecker settings (the small wrench icon at the top left) check the options as shown below. Select the custom ROS patch file "CosOFW48x.BIN" you downloaded at step 1 then save.

- Click on "Force Patch" button

- You'll obtain a new patched dump file ready to flash in your NOR.


Or using PyPS3patcher (https://github.com/littlebalup/PyPS3tools/tree/master/PyPS3patcher) :
- Paste the file "CosOFW48x.BIN" you downloaded at step 1 and your dump file in the script folder.
- Rename the "CosOFW48x.BIN" as "patch.bin".
- Run the script with the command: patcher.py cust yourdump

- You'll obtain a new patched dump file ready to flash in your NOR.


4- Flash your NOR with your newly patched dump file, using your hardware flasher:

I will not describe the procedure here. There are a lot of tutorials to use E3 flasher, Teensy or Progskeet for those who don't know yet.

!!WARNING!! If your initial dump file has been made with PS3Xploit Dumper, and if you are using an E3 flasher, you must do a byte swap of your patched dump before to rename it "bkpps3.bin" and to fash it.
For that, you can use either FlowRebuilder (http://www.psx-place.com/resources/flow-rebuilder.524/) with the "Byte reverse a dump" operation, or PyPS3patcher (https://github.com/littlebalup/PyPS3tools/tree/master/PyPS3patcher) with the "swap" command.


End

thank you for 4.91 coreOS i've been looking for this

 

[vyktormvmpay25]

I would like to see some uart log from ppl recover those brick units. I see people believe uart errors as 5fff or 3013 and 1001 think unit is bricked. I tend to believe a brick unit can stand in glod state without tristate. Or I don't remember exactly and need to check one unit.
Anyway for better support people should come with that uart log or sb uart log. With brick units mostly missing sb uart log or half distance load up to cell and errors code.
This would help techs to understand were errors occurred.