PS3 PS3DumpChecker & PyPS3tools - Now Supporting PS3 4.81 FW by littlebalup

Developer littlealup is next in line as PS3 developer's rejoice following the 4.81 OFW update, we have seen several CFW options released and some homebrew updates that can seen here. Several useful tools have been updated to support 4.81 PS3DumpChecker and also PyPS3Tool Suite has been updated and that collection contains PyPS3Checker, PyPS3Patcher & PS3 Rebuilder. View additional details about the tools that will dump check patch and rebuild your dumps.​

​

PS3DumpChecker PyPS3tools

• 
  
  PS3DumpChecker
  github.com/Swizzy/PS3DumpChecker/tree/master/Latest%20Compiled%20Version - github
  github.com/Swizzy/PS3DumpChecker/blob/master/Latest%20Compiled%20Version/PS3DumpChecker.exe?raw=true - downloa
  
  
  ​
  
  
  A Windows application to aid in checking/verifying PlayStation 3 NAND/NOR dumps. Please note that applications like these do not guarantee that your NAND/NOR dump is 100%. Use as a guidance.​
  
  
  NEW - Build 489 2016-11-02:
  
  • Changed: The embedded 4.80 patch replaced by a 4.81 patch build from the FERROX 4.81 CEX custom firmware CoreOS.
  • Added: OFW and Patched 4.81 ROS hashs.
• 
  
  PyPS3tools
  Release Thread via psx-place.com
  
  These dump tools that can be run natively on a maximum of systems (including windows). As the wonderfull Judges's NORway & NANDway scripts are written in python 2, I naturally chosen the same language to complete them by creating a suite of tools including a "patcher", a "checker" and a "rebuilder" that can be run into the same environment.
  
  With all of those python scripts, we are able to dump, check, patch, rebuild and flash on all python 2 compatible systems. And a batch/bash script can easily be written to automate all of this (for NOR at least. An "interleaver" still missing for NAND).
  
  Python scripts, detailed readme and changelog are available to my git : https://github.com/littlebalup/PyPS3tools​
  
  
  
  PyPS3checker pyPS3patcher pyPS3rebuilder

  • :
    "PyPS3checker" overview :
    
    ​
    Compatible with any type of PS3 flash memory dump file:
    
    • Regular NOR dump (teensy, progskeet, dumps from homebrew)
    • Revesed NOR dump (E3 flasher)
    • Interleaved NAND dump
    
    
    Customization of checks and hashs can be done by editing the "checklist.xml" and "hashlist.xml" files.
    All initial checks are those from PS3dumpchecker (many thanks to Swizzy), plus a "risklevel" parameter that can be "WARNING" or "DANGER" like on the BwE validators.​
    
    Check log auto-generated as "[mydump].checklog.txt"
    
  • 
    "PyPS3patcher" overview :
    
    ​
    
    
    Compatible with any type of PS3 flash memory dump file:
    
    • Regular NOR dump (teensy, progskeet, dumps from homebrew)
    • Revesed NOR dump (E3 flasher)
    • Interleaved NAND dump
    
    
    Patch FSM, noFSM, RVK (see detailed commands).
    Byte reverse NOR dump (see "swap" command)​
    
    
  • 
    "PyPS3rebuilder" overview :
    
    ​
    
    Compatible with any type of PS3 flash memory dump file:
    
    • Regular NOR dump (teensy, progskeet, dumps from homebrew)
    • Revesed NOR dump (E3 flasher)
    • Interleaved NAND dump
    
    This script copy part or totality of non-PerConsole datas from a donor dump
    file to a corrupted dump file in order to rebuild it. (see detailed commands)​
    
    
    Enjoy your flash
    
  
  
  

Downloads:

• PS3DumpChecker:
• PyPS3Tools (Checker, Patcher, Rebuilder)

Source(s); PSX-Place.com / (2)​

 

@littlebalup thanks again...as usual great job and quick too!

 

@littlebalup
I have a problem with a dump of a ps3 cech 2504A datacode 0C min ver 3.40.

Ps3 Dump checker buil 488 reports a bad dump.

in:

CELL_EXTRA_NOR AREA 0x00 FILLED AREA 3

Result of the check: False
The data between offset: 0xF60060 and 0xF69400 should be: 00

The byte @ offset: 0xF60060
has the value: 0xD1
Please check the data further down the line manually...

HEX DUMP E3 FLASHER :

0xF60000     00 10 0C 00 04 00 03 10 00 00 3E 00 00 20 5C 00
0xF60010     00 00 05 00 00 00 05 00 E7 03 00 00 00 00 01 00
0xF60020     EF 55 00 00 00 80 01 00 13 05 0F 27 00 20 01 00
0xF60030     CF 07 0F 27 00 80 01 00 95 00 26 FF 00 00 01 00
0xF60040     4D 56 9B 7F 99 E2 1F CF 4D 8C 80 A6 45 25 7B 47
0xF60050     A2 CA 34 4D 9E 65 B3 A7 E4 D1 23 4A 31 58 22 5B
0xF60060     D1 63 86 D0 76 69 FF AA 00 00 00 00 00 00 00 00           (is Possible  bad  or not)

CELL_EXTRA_NOR AREA 0x00 FILLED AREA 6

Result of the check: False
The data between offset: 0xFA0060 and 0xFA9400 should be: 00

The byte @ offset: 0xFA0060
has the value: 0xD1
Please check the data further down the line manually...

HEX DUMP E3 FLASHER :

0xFA0000     00 10 0C 00 04 00 03 10 00 00 3E 00 00 20 5C 00
0xFA0010     00 00 05 00 00 00 05 00 E7 03 00 00 00 00 01 00
0xFA0020     EF 55 00 00 00 80 01 00 13 05 0F 27 00 20 01 00
0xFA0030     CF 07 0F 27 00 80 01 00 95 00 26 FF 00 00 01 00
0xFA0040     4D 56 9B 7F 99 E2 1F CF 4D 8C 80 A6 45 25 7B 47
0xFA0050     A2 CA 34 4D 9E 65 B3 A7 E4 D1 23 4A 31 58 22 5B
0xFA0060     D1 63 86 D0 76 69 FF AA 00 00 00 00 00 00 00 00           (is Possible  bad  or not)

The dump in all the other parts is correct, what must I do to be able to activate the patch nor dump?

What did you have this anomaly?

Thank you

 

@littlebalup
I have a problem with a dump of a ps3 cech 2504A datacode 0C min ver 3.40.

Ps3 Dump checker buil 488 reports a bad dump.

in:

CELL_EXTRA_NOR AREA 0x00 FILLED AREA 3

Result of the check: False
The data between offset: 0xF60060 and 0xF69400 should be: 00

The byte @ offset: 0xF60060
has the value: 0xD1
Please check the data further down the line manually...

HEX DUMP E3 FLASHER :

0xF60000     00 10 0C 00 04 00 03 10 00 00 3E 00 00 20 5C 00
0xF60010     00 00 05 00 00 00 05 00 E7 03 00 00 00 00 01 00
0xF60020     EF 55 00 00 00 80 01 00 13 05 0F 27 00 20 01 00
0xF60030     CF 07 0F 27 00 80 01 00 95 00 26 FF 00 00 01 00
0xF60040     4D 56 9B 7F 99 E2 1F CF 4D 8C 80 A6 45 25 7B 47
0xF60050     A2 CA 34 4D 9E 65 B3 A7 E4 D1 23 4A 31 58 22 5B
0xF60060     D1 63 86 D0 76 69 FF AA 00 00 00 00 00 00 00 00           (is Possible  bad  or not)

CELL_EXTRA_NOR AREA 0x00 FILLED AREA 6

Result of the check: False
The data between offset: 0xFA0060 and 0xFA9400 should be: 00

The byte @ offset: 0xFA0060
has the value: 0xD1
Please check the data further down the line manually...

HEX DUMP E3 FLASHER :

0xFA0000     00 10 0C 00 04 00 03 10 00 00 3E 00 00 20 5C 00
0xFA0010     00 00 05 00 00 00 05 00 E7 03 00 00 00 00 01 00
0xFA0020     EF 55 00 00 00 80 01 00 13 05 0F 27 00 20 01 00
0xFA0030     CF 07 0F 27 00 80 01 00 95 00 26 FF 00 00 01 00
0xFA0040     4D 56 9B 7F 99 E2 1F CF 4D 8C 80 A6 45 25 7B 47
0xFA0050     A2 CA 34 4D 9E 65 B3 A7 E4 D1 23 4A 31 58 22 5B
0xFA0060     D1 63 86 D0 76 69 FF AA 00 00 00 00 00 00 00 00           (is Possible  bad  or not)

The dump in all the other parts is correct, what must I do to be able to activate the patch nor dump?

What did you have this anomaly?

Thank you

I'll have a look when I'll get a moment. You can use the "Force patch" option to bypass the error.

 

I'll have a look when I'll get a moment. You can use the "Force patch" option to bypass the error.

I solved this way:

Offset:
0xF60060  D1 63 86 D0 76 69 FF AA 00 00 00 00 00 00 00 00

0xFA0060  D1 63 86 D0 76 69 FF AA 00 00 00 00 00 00 00 00
Replace With:
0xF60060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

0xFA0060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Check OK - you can apply the patch.

Only thing is that I lost start of bluray movies.
It is possible that the offset 0xF60000 to 0xFA0000 of Nor, is stored a CRC or Hash that verifies the integrity of the keys to decode bluray?

Thank you

 

I solved this way:

Offset:
0xF60060  D1 63 86 D0 76 69 FF AA 00 00 00 00 00 00 00 00

0xFA0060  D1 63 86 D0 76 69 FF AA 00 00 00 00 00 00 00 00
Replace With:
0xF60060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

0xFA0060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Check OK - you can apply the patch.

Only thing is that I lost initiation of bluray movies.
It is possible that the offset 0xF60000 to 0xFA0000 of Nor, is stored a CRC or Hash that verifies the integrity of the keys to decode bluray?

Thank you

You are used darknet cfw? There is known problem with BD movies.

 

You are used darknet cfw? There is known problem with BD movies.

I used to firmware 4.80 Ferrox standards and then I switched to 4.80 Rebug REX Cobra 7.3

 

I used to firmware 4.80 Ferrox standards and then I switched to 4.80 Rebug REX Cobra 7.3

So is possible that 00'ing is the reason. This region is related to BD movies playback. Until you have working dum you can try to rewrite one with "bad" sectors. This is probably DRL and CRL hashes related part of that dump. You have nothing to lose if you have good dump.

http://www.psdevwiki.com/ps3/Flash:CELL_EXTNOR_AREA#F60000
http://www.psdevwiki.com/ps3/Fixing_DRL_and_CRL_Hashes (just fyi, dump restoring way look faster..)

 

I solved this way:

Offset:
0xF60060  D1 63 86 D0 76 69 FF AA 00 00 00 00 00 00 00 00

0xFA0060  D1 63 86 D0 76 69 FF AA 00 00 00 00 00 00 00 00
Replace With:
0xF60060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

0xFA0060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Check OK - you can apply the patch.

Only thing is that I lost start of bluray movies.
It is possible that the offset 0xF60000 to 0xFA0000 of Nor, is stored a CRC or Hash that verifies the integrity of the keys to decode bluray?

Thank you

You modified your drl sh1 checksum... that's why you broke bluray.
You have to restore it as it was.
Problem is PS3DumpChecker check. Not your dump. It's a false bad.

 

You modified your drl sh1 checksum... that's why you broke bluray.
You have to restore it as it was.
Problem is PS3DumpChecker check. Not your dump. It's a false bad.

So is possible that 00'ing is the reason. This region is related to BD movies playback. Until you have working dum you can try to rewrite one with "bad" sectors. This is probably DRL and CRL hashes related part of that dump. You have nothing to lose if you have good dump.

http://www.psdevwiki.com/ps3/Flash:CELL_EXTNOR_AREA#F60000
http://www.psdevwiki.com/ps3/Fixing_DRL_and_CRL_Hashes (just fyi, dump restoring way look faster..)

So I have to restore Offset 0xF60000 and 0xF60000 With the data of the originals of the NOR dump

So what is reported in ps3wiki discussion is not correct.

ps3wiki

NOR: 0x0F60000 - 0x0F60040 when OCRL present

Offset(h)    00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00F60000  10 00 00 0C 00 04 10 03 00 00 00 11 20 00 00 3C  ............ ..<
00F60010  00 00 00 01 00 00 00 01 03 E7 00 00 00 00 00 01  .........ç......
00F60020  16 87 B9 B2 3C 0F 78 27 08 E1 C8 57 23 34 22 D7  .‡¹²<.x'.áÈW#4"×
00F60030  2A 90 DE 44 3F 33 DA 07 93 0E DD 7C DD 0F AF 54  *.ÞD?3Ú.".Ý|Ý.¯T
00F60040  0B 4E 8F BC B1 B3 16 78 00 00 00 00 00 00 00 00  .N.¼±³.x........

00 filled

00F60040  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[...]                                                                all 00's
00F69BF0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

I can make the flash nor from CFW, without reassembling the E3 flasher?

 

So I have to restore Offset 0xF60000 and 0xF60000 With the data of the originals of the NOR dump

Yes.

So what is reported in ps3wiki discussion is not correct.

It was, but there are still some rare cases when dump is different

I can make the flash nor from CFW, without reassembling the E3 flasher?

Imo yes (remember about byte reversing by E3), but wait for someone more knowledgeable to answer.

 

I can make the flash nor from CFW, without reassembling the E3 flasher?

I don't know if it's possible. Multiman, rebug toolbox, IDPset... can write eid region. We can write ROS's with a simple system update. But for the others like CELL_EXTNOR_AREA ...

The best and safer way for you is your E3 flasher.

In fact multiman should be able but it's not very safe in my opinion. let me know if you want to try, i'll guide you.

 

I don't know if it's possible. Multiman, rebug toolbox, IDPset... can write eid region. We can write ROS's with a simple system update. But for the others like CELL_EXTNOR_AREA ...

The best and safer way for you is your E3 flasher.

In fact multiman should be able but it's not very safe in my opinion. let me know if you want to try, i'll guide you.

Write a procedure pre nor with Multiman !!!

I will assess whether to use Multiman or remount e3 flasher.

 

I don't know if it's possible. Multiman, rebug toolbox, IDPset... can write eid region. We can write ROS's with a simple system update. But for the others like CELL_EXTNOR_AREA ...

The best and safer way for you is your E3 flasher.

In fact multiman should be able but it's not very safe in my opinion

Write a procedure pre nor with Multiman !!!

I will assess whether to use Multiman or remount e3 flasher.

ok, so:

1- dump your flash with multiman or rebug toolbox (there is a lot of tutorial availble on the web)
then you'll have your nor dump on your usb stick as "xxxxx.NORBIN"

2- open your *.NORBIN dump file with hex editor and go to offset 0xF60000
then paste (replace) with those values:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00F60000  10 00 00 0C 00 04 10 03 00 00 00 3E 20 00 00 5C  ...........> ..\
00F60010  00 00 00 05 00 00 00 05 03 E7 00 00 00 00 00 01  .........ç......
00F60020  55 EF 00 00 80 00 00 01 05 13 27 0F 20 00 00 01  Uï..€.....'. ...
00F60030  07 CF 27 0F 80 00 00 01 00 95 FF 26 00 00 00 01  .Ï'.€....•ÿ&....
00F60040  56 4D 7F 9B E2 99 CF 1F 8C 4D A6 80 25 45 47 7B  VM.›â™Ï.ŒM¦€%EG{
00F60050  CA A2 4D 34 65 9E A7 B3 D1 E4 4A 23 58 31 5B 22  Ê¢M4ež§³ÑäJ#X1["
00F60060  63 D1 D0 86 69 76 AA FF 00 00 00 00 00 00 00 00  cÑІivªÿ........

That are your byte swapped original values. Do not use the values from your E3 flasher raw dump unless you byte-swapped them.

Repeat the operation at offset 0xFA0000 with the same values:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00FA0000  10 00 00 0C 00 04 10 03 00 00 00 3E 20 00 00 5C  ...........> ..\
00FA0010  00 00 00 05 00 00 00 05 03 E7 00 00 00 00 00 01  .........ç......
00FA0020  55 EF 00 00 80 00 00 01 05 13 27 0F 20 00 00 01  Uï..€.....'. ...
00FA0030  07 CF 27 0F 80 00 00 01 00 95 FF 26 00 00 00 01  .Ï'.€....•ÿ&....
00FA0040  56 4D 7F 9B E2 99 CF 1F 8C 4D A6 80 25 45 47 7B  VM.›â™Ï.ŒM¦€%EG{
00FA0050  CA A2 4D 34 65 9E A7 B3 D1 E4 4A 23 58 31 5B 22  Ê¢M4ež§³ÑäJ#X1["
00FA0060  63 D1 D0 86 69 76 AA FF 00 00 00 00 00 00 00 00  cÑІivªÿ........

3- Save changes. Ensure your dump file remains 16777216 Bytes in size exactly. And is named as *.NORBIN

4- copy your modified dump to your USB-stick.

5- plug your usb stick to the rightmost usb port of your console.

6- open multiman file manager, browse and open your *.NORBIN dump.
Multiman should ask if you want to write the flash. then proceed.

 

I think I found a way to know drl1 and drl2 hash size (depend of 0xF6000E / 0xFA000E respectively, length 0x2).

So fixed the checks in a new build 490:

Build 490 2016-11-12:
- Fixed: CELL_EXTNOR_AREA 0x00 Filled Area 3 and 6 checks. Now area start offset dynamicaly calculated per drl hash size.

 

@littlebalup
Multiman has disabled writing Nor, does not allow to rewrite the NOR, so I have to use E3 Flasher.
With the latest version of Ps3DumpChecker build 4.90 how can I make the patch to fw 4.80 and not at 4.81 firmware. Because I have the fimware Rebug 4.80.1 CEX

 

@littlebalup
Multiman has disabled writing Nor, does not allow to rewrite the NOR, so I have to use E3 Flasher.
With the latest version of Ps3DumpChecker build 4.90 how can I make the patch to fw 4.80 and not at 4.81 firmware. Because I have the fimware Rebug 4.80.1 CEX

Download previous patch from git here: https://github.com/Swizzy/PS3DumpCh...20a67388/src/PS3DumpChecker/Patches/patch.bin
Rename it as patch_480.bin or similar to avoid any confusion.
Then use the custom patch option:

 

I think I found a way to know drl1 and drl2 hash size (depend of 0xF6000E / 0xFA000E respectively, length 0x2).

So fixed the checks in a new build 490:

Updated PyPS3checker as well.

 

ok, so:

1- dump your flash with multiman or rebug toolbox (there is a lot of tutorial availble on the web)
then you'll have your nor dump on your usb stick as "xxxxx.NORBIN"

2- open your *.NORBIN dump file with hex editor and go to offset 0xF60000
then paste (replace) with those values:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00F60000  10 00 00 0C 00 04 10 03 00 00 00 3E 20 00 00 5C  ...........> ..\
00F60010  00 00 00 05 00 00 00 05 03 E7 00 00 00 00 00 01  .........ç......
00F60020  55 EF 00 00 80 00 00 01 05 13 27 0F 20 00 00 01  Uï..€.....'. ...
00F60030  07 CF 27 0F 80 00 00 01 00 95 FF 26 00 00 00 01  .Ï'.€....•ÿ&....
00F60040  56 4D 7F 9B E2 99 CF 1F 8C 4D A6 80 25 45 47 7B  VM.›â™Ï.ŒM¦€%EG{
00F60050  CA A2 4D 34 65 9E A7 B3 D1 E4 4A 23 58 31 5B 22  Ê¢M4ež§³ÑäJ#X1["
00F60060  63 D1 D0 86 69 76 AA FF 00 00 00 00 00 00 00 00  cÑІivªÿ........

That are your byte swapped original values. Do not use the values from your E3 flasher raw dump unless you byte-swapped them.

Repeat the operation at offset 0xFA0000 with the same values:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00FA0000  10 00 00 0C 00 04 10 03 00 00 00 3E 20 00 00 5C  ...........> ..\
00FA0010  00 00 00 05 00 00 00 05 03 E7 00 00 00 00 00 01  .........ç......
00FA0020  55 EF 00 00 80 00 00 01 05 13 27 0F 20 00 00 01  Uï..€.....'. ...
00FA0030  07 CF 27 0F 80 00 00 01 00 95 FF 26 00 00 00 01  .Ï'.€....•ÿ&....
00FA0040  56 4D 7F 9B E2 99 CF 1F 8C 4D A6 80 25 45 47 7B  VM.›â™Ï.ŒM¦€%EG{
00FA0050  CA A2 4D 34 65 9E A7 B3 D1 E4 4A 23 58 31 5B 22  Ê¢M4ež§³ÑäJ#X1["
00FA0060  63 D1 D0 86 69 76 AA FF 00 00 00 00 00 00 00 00  cÑІivªÿ........

3- Save changes. Ensure your dump file remains 16777216 Bytes in size exactly. And is named as *.NORBIN

4- copy your modified dump to your USB-stick.

5- plug your usb stick to the rightmost usb port of your console.

6- open multiman file manager, browse and open your *.NORBIN dump.
Multiman should ask if you want to write the flash. then proceed.

Download previous patch from git here: https://github.com/Swizzy/PS3DumpCh...20a67388/src/PS3DumpChecker/Patches/patch.bin
Rename it as patch_480.bin or similar to avoid any confusion.
Then use the custom patch option:

Updated PyPS3checker as well.

I made the Flash NOR with E3 Flash, with the original dump, making the patch with Ps3DumpChecker 4.90 with patch.bin 4.80.

Check the correct dump, it is patched correctly.

So Putting in place the following offset NOR FLASH:

0xF60060 offset 0xF60067
0xFA0060 offset 0xFA0067

not swapped e3 dump
0xF60060 D1 63 86 D0 76 69 FF AA 00 00 00 00 00 00 00 00
0xFA0060 D1 63 86 D0 76 69 FF AA 00 00 00 00 00 00 00 00

Now the Film Blueray work properly.

I can not understand because of PS3 which has not been made any patch of NOR flash, starting from original 3.55, the following offsets

offset by 0xF60040 to 0xF60067 are 00

offset by 0xFA0040 to 0xFA0067 are 00

But Blueray Film work properly, Although in dec_Flash3 \ data_revoke \ Drl

DRL1 and DRL2 different from NOR.

 

HELP!!! I keep getting a bad dump on numerous flashes with the same ps3, "CECH-L01". Binary check for 006.08 cISD1 Semistatic 2 Started... Result: FAILED! Offset: 0x3F0A4. Is this a reseat issue?