PS3 Ps3Xploit Tools v2.0 - Improved Flash Writers & Dumpers (Even easier to install CFW on 4.82 OFW )

UPDATE 04-02-2020
These tools have been superseded by the BG Toolset
** www.** ** www.ps3xploit.net > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com) > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com > Domain no Longer owned by team** (NEW URL = http://ps3toolset.com)/bgtoolset/










UPDATE (OCT. 11 2018) - With the release of OFW 4.83 portions of PS3Xploit have been patched, The team is looking at workarounds, STAY ON 4.82, DO NOT UPDATE TO 4.83 AT THIS TIME:
IMPORTANT UPDATE (MARCH-2019) v3.0.1 was released providing support for 4.84 HFW (a new hybrid firmware that restores PS3Xploit for 4.84 OFW user's (See Link to HFW)

---

dI will start this off with NO you can not jailbreak your PS3 SuperSlim Console's (seems to be a popular question), however that does not mean the Ps3Xploit Team, (bguerville, esc0rtd3w, habib & W), has not been hard at work, with this new release of Ps3Xploit v2.0.. In this release all the tools (IDPS Dumper, Flash Dumper & Flash Writer) have seen significant improvements and now performing the task such as installing a Custom Firmware on your 4.82 OFW PS3 (with flash writer) has been made even easier and very stable thanks to the team's new checks implemented and progression of the exploit. The Flash and IDPS dumper are also much improved. All the details are provided below please read all the spoiler and tabs before asking any questions.
​

-STLcardsWS​

PS3Xploit 2.0 Tools Now LIVE!!​

Ps3Xploit 2.0 Release >> IMPORTANT DETAILS << FLASH DUMPER TOOL FLASH WRITER IDPS DUMPER

• 
  
  Included Tools​
  • 4.XX IDPS DUMPER
  • 4.XX FLASH DUMPER (USB Edition)
  • 4.XX FLASH DUMPER (HDD Edition)
  • 4.82 NOR/NAND WRITER (USB Edition)
  • 4.82 NOR/NAND WRITER (HDD Edition)
  Ps3Xploit Tools Changelogs​
  v2.0
  
  • Freeze issues - Fixed
  • Occasional bad dumps - Fixed
  • No beeps & shutdown. Replaced by a graceful ROP chain exit & return to browser. This gives the opportunity to the user to dump after patching & validate the dump with littlebalup's py checker. As long as the user does not shutdown/restart, it's still possible to recover from bad patching.
  • Support for usb port 0,1,6 + sd/cf/ms cards.
  • Multi firmware support on all dumpers (4.10+) & DEX support on 4.81.
  • HDD editions for all dumpers & flash writer where a picture file placeholder is used for read/write operations.
  • Javascript refactoring for performance & efficiency.
  • **ps3xploit.com >Domain no Longer owned by team** (ps3xploit.me =new) will host the 2.0 update, no need for 3rd party sites.
  
  v1.0 (Thanksgiving 2017 Release)
  
  • Supports Direct OFW to CFW patching for All Phat and 2xxx Slim (minver 3.56 Dec 2010 and lower)
  • the NOR/NAND writer will just copy 3Mb of CoreOS data to both ros0 & ros1 in the flash memory.
  • There is only one version released for 4.82. The same hex patch file can be used on nor & nand.
  • It's as safe as possible, with a check for usb device & patch file making the exploit hang instead of corrupting flash if file is not found.
  • In case of corruption (extremely rare but could always happen), it's only a partial brick because no per console info ever gets erased so a hardware flasher could still be used if ever a recovery reboot was impossible
  
  
• 
  
  
  Frequency Asked Questions​
  
  Will this jailbreak my SuperSlim?
  
  • NO,The Flasher Writer Tool is not Supported on the SuperSlim and a some very late Slim models, Howeever, PS3Xploit has a strong possiablity to eventually evolve into a HEN style exploit (that aspect will take some additional development.)
  
  Which PS3Xploits Tools are Compatible with my PS3 Console?
  
  Spoiler: CLICK TO VIEW COMPATIBILITY

  FAT SLIM SuperSlim

  • 
    
    
    
    Check this sticker on the back of your PS3 to view your PS3 Model.
    ​
    Flash Writer Model Compatibility (PHAT):
    
    • CECH-A01 (NAND)
    • B (NAND)
    • C (NAND)
    • E (NAND)
    • G (NAND)
    • H (NOR)
    • J (NOR)
    • K (NOR)
    • L (NOR)
    • M (NOR)
    • P (NOR)
    • Q (NOR)
    
    
    All DUMPER (FLASH/IDPS) & FLASH WRITER TOOLS are Supported for this model. ​
    
    
  • 
    
    
    Check this sticker on the back of your PS3 to view your PS3 Model.
    
    ***IMPORTANT***
    You must pay very close attention to your PS3 SLIM Models depending on when the PS3 SLIM was manufactured will determine if your console can install CFW (Flasher Writer Compatibility).
    
    For the 25XX series or even if your unsure about any of the models it is reccomnded you run the minverchk PUP >> (DOWNLOAD) & (How to use Minverchk) its a simply utility that show the factory installed firmware on your ps3 and for the CECH-25XX model if the utility shows 3.56 or lower you are compatible but if it shows 3.60 and higher that means your are NOT compatible to use the Flash Writer (CFW enabler for 4.82 CFW)​
    
    
    • Flash Writer Model Compatibility (SLIM):
      • 20XX NOR
      • 21XX NOR
      • 25XX NOR (3.56 minver. and Lower)
    • NOT COMPATIBLE (SLIM):
      • 25XX NOR (3.60 and Higher)
      • 3XXX NOR
    
    
    
    All DUMPER (FLASH/IDPS) TOOLS are Supported for this model. ​
    
    
    
  • 
    
    
    Check this sticker on the back of your PS3 to view your PS3 Model.
    ​
    • FLASH WRITER NOT COMPATIBLE (SUPERSLIM):
      • 4XXXA EMMC
      • 4XXXB NOR
      • 4XXXC NOR
      ​
    All DUMPER (FLASH/IDPS) TOOLS are Supported for this model. ​
    
    
  
  Where can i find official info and details?
  
  • Official Website (Exploit Hosting / Info) @ ** http://www.**ps3xploit.com >Doma...no Longer owned by team** (ps3xploit.me =new)
  • Official Ps3Xploit Forum (Support/News/Info): @ http://www.psx-place.com/forums/PS3Xploit/
  Warning: Known Limitation
  
  • Due to the lack of proper checks after exiting the ROP chain, it is possible in some cases to obtain a success message despite an operation failure. For instance, if you choose a path where no device is plugged in, a dumper page will still display a success message despite the fact the dump save could not work. This limitation has already been addressed, the added operation checks will be part of an update to these PS3Xploit tools which will be released in the coming weeks, that update will be final, no more will come after it
  
  
• 
  
  FLASH Dumper's Help​
  
  
  Spoiler: CLICK HERE >>>>> FLASH DUMPER <<<<< CLICK HERE

  USB EDITION HDD EDITION

  • 
    
    PS3 4.xx NAND/NOR/EMMC FLASH DUMPER v2.0
    ​
    All PS3 models supported
    All 4.10+ CEX CFW/OFW supported
    4.81 DEX CFW/OFW supported
    
    IMPORTANT NOTES:
    
    • It's essential not to flood the browser memory with junk before running the exploit. The reason for this is that due to javascript core memory usage limitations we are scanning several times a small range of browser memory (a few Mb) to find some essential data in RAM, if the memory is flooded then the range to scan becomes much larger & the probabilities that our data is found in the smaller range decrease dramatically....
    • So in short, never use the browser or use a homepage you cancel before running the exploit!
    • It is recommended to set your homepage temporarily to the exploit page you wish to use to ensure there is no memory flooding messing with the exploit initialization stage.
    Steps:
    
    1. Open the browser & browse to the **ps3xploit.com >Domain no Longer owned by team** (ps3xploit.me =new) website, go to the page of the exploit you need. Set the current page as browser homepage. Don't launch the exploit initialization. Close the browser.
    2. Open the browser. The exploit page will load automatically. Choose your dump path option.
    3. Press the exploit initialization button & wait until initialization succeeds. If it fails, follow the refresh/reload instructions on screen.
    4. Trigger the exploit by pressing the dump button.
    5. On success, validate your dump with the py checker tool.
  • 
    
    PS3 4.xx NAND/NOR/EMMC FLASH DUMPER - HDD EDITION v2.0​
    
    All PS3 models supported
    All 4.10+ CEX CFW/OFW supported
    4.81 DEX CFW/OFW supported
    
    IMPORTANT NOTES:
    
    • It's essential not to flood the browser memory with junk before running the exploit. The reason for this is that due to javascript core memory usage limitations we are scanning several times a small range of browser memory (a few Mb) to find some essential data in RAM, if the memory is flooded then the range to scan becomes much larger & the probabilities that our data is found in the smaller range decrease dramatically....
    • So in short, never use the browser or use a homepage you cancel before running the exploit!
    • It is recommended to set your homepage temporarily to the exploit page you wish to use to ensure there is no memory flooding messing with the exploit initialization stage.
    Steps:
    
    1. Open the browser & browse to the **ps3xploit.com >Domain no Longer owned by team** (ps3xploit.me =new) website, go to the page of the exploit you need. Set the current page as browser homepage. Don't launch the exploit initialization. Close the browser.
    2. Open the browser. The exploit page will load automatically. Download the dump.jpg placeholder file to your PS3 System Storage using the provided link as instructed on screen.
    3. Press the exploit initialization button & wait until initialization succeeds. If it fails, follow the refresh/reload instructions on screen.
    4. Trigger the exploit by pressing the dump button.
    5. On success, retrieve the dump file from the PS3 XMB Photo section, rename it appropriately to dump.hex or whatever & validate your dump with the py checker tool.
  
  
  Usage Tips:
  
  • Try using a LAN connection or a solid WiFi connection during exploitation. A weak signal can cause problems.
  • If the exploit takes more than 5 minutes to work, reload page, browser, or restart console and try again.
  • ]If you are using a LAN connection and experience network issues, make sure all cables to router are in working order.
  
  
• 
  
  
  Spoiler: CLICK HERE >>>> FLASH WRITER <<<< CLICK HERE

  USB EDITION HDD EDITION

  • 
    
    PS3 OFW 4.82 NAND/NOR FLASH WRITER v2.0
    ***** IMPORTANT DETAILS BELOW -- AVOIDING A BRICK *****
    ​
    WARNING: USE ONLY THE PROVIDED flash_482.hex AS IS. DON'T PATCH IT OR MODIFY IT OR YOU WILL BRICK *****
    
    • Verify flash_482.hex file on a flash drive and in the selected USB slot!
      • flash_482.hex MD5: d05be52f8d21700052fbd1fc0174acae
    • DO NOT USE ON CFW (Custom Firmware) (Only Supports OFW)
    • DO NOT USE ON PS3 Models 3xxx/4xxx (aka late Slim or Superslim models), you would brick those consoles.
    • ON SLIM 2xxx Consoles, always use MinVerChck PUP to ensure that the minimum installable firmware version is < 3.60, if ever the minimum version is >3.56, using the flash writer would partially brick your console!
    • USE ONLY ON 4.82 OFW
    
    IMPORTANT NOTES:
    
    • It's essential not to flood the browser memory with junk before running the exploit. The reason for this is that due to ps3 javascript core memory usage limitations we are scanning several times a small range of browser memory (a few Mb) to find some essential data in RAM, if the memory is flooded due to previous browsing then the range to scan becomes much larger & the probabilities that our data is found in the smaller range decrease dramatically..
    • So in short, never use the browser or use a homepage you cancel before running the exploit!
    • It is recommended to set your homepage temporarily to the exploit page you wish to use to ensure there is no memory flooding messing with the exploit initialization stage.
    
    Steps:
    
    For best results with flash writer, here are the recommended steps.
    

    1. Install OFW 4.82 twice on the console you wish to flash to avoid the potential corruption error during CFW installation.
    2. Open the browser & browse to the **ps3xploit.com >Domain no Longer owned by team** (ps3xploit.me =new) website, go to the page of the exploit you need. Set the current page as browser homepage. Don't launch the exploit initialization. Close the browser.
    3. Open the browser. The exploit page will load automatically. Choose your path option.
    4. Press the exploit initialization button & wait until initialization succeeds. If it fails, follow the refresh/reload instructions on screen.
    5. Trigger the exploit by pressing the patch button.
    6. On success, load the **ps3xploit.com >Domain no Longer owned by team** (ps3xploit.me =new) flash dumper, dump the flash memory & validate it with py checker tool. Do NOT restart the console if ever the validation tool gives you errors/warnings on both ros0 & ros1 or you risk to partially brick your console. Report your problem instead.
    7. When you are satisfied with the dump validation, restart your console & install a 4.82 CFW.
  • 
    
    
    PS3 OFW 4.82 NAND/NOR FLASH WRITER - HDD EDITION v2.0
    ***** IMPORTANT DETAILS BELOW -- AVOIDING A BRICK *****
    ​
    WARNING: USE ONLY THE PROVIDED flash_482.jpg AS IS. DON'T PATCH IT OR MODIFY IT OR WILL BRICK *****
    
    • YOU
    • Download flash_482.jpg file to PS3 System Storage!
      • flash_482.jpg MD5: d05be52f8d21700052fbd1fc0174acae
    • DO NOT USE ON CFW (Custom Firmware) (Only Supports OFW)
    • DO NOT USE ON PS3 Models 3xxx/4xxx (aka SuperSlims / Late Slim models), you would brick those consoles.
    • ON SLIM 2xxx Consoles, always use MinVerChck PUP to ensure that the minimum installable firmware version is < 3.60, if ever the minimum version is >3.56, using the flash writer would partially brick your console!
    • USE ONLY ON 4.82 OFW
    
    IMPORTANT NOTES:
    
    • It's essential not to flood the browser memory with junk before running the exploit. The reason for this is that due to ps3 javascript core memory usage limitations we are scanning several times a small range of browser memory (a few Mb) to find some essential data in RAM, if the memory is flooded due to previous browsing then the range to scan becomes much larger & the probabilities that our data is found in the smaller range decrease dramatically..
    • So in short, never use the browser or use a homepage you cancel before running the exploit!
    • It is recommended to set your homepage temporarily to the exploit page you wish to use to ensure there is no memory flooding messing with the exploit initialization stage.
    Steps:
    
    For best results with flash writer, here are the recommended steps.
    

    1. Install OFW 4.82 twice on the console you wish to flash to avoid the potential corruption error during CFW installation.
    2. Open the browser & browse to the **ps3xploit.com >Domain no Longer owned by team** (ps3xploit.me =new) website, go to the page of the exploit you need. Set the current page as browser homepage. Don't launch the exploit initialization. Close the browser.
    3. Open the browser. The exploit page will load automatically. Download the patch file flash_482.jpg to your PS3 System Storage using the provided link on screen.
    4. Press the exploit initialization button & wait until initialization succeeds. If it fails, follow the refresh/reload instructions on screen.
    5. Trigger the exploit by pressing the patch button.
    6. On success, load the **ps3xploit.com >Domain no Longer owned by team** (ps3xploit.me =new) flash dumper, dump the flash memory & validate it with py checker tool. Do NOT restart the console if ever the validation tool gives you errors/warnings on both ros0 & ros1 or you risk to partially brick your console. Report your problem instead.
    7. When you are satisfied with the dump validation, restart your console & install a 4.82 CFW.
  
  Usage Tips:
  
  • Try using a LAN connection or a solid WiFi connection during exploitation. A weak signal can cause problems.
  • If the exploit takes more than 5 minutes to work, reload page, browser, or restart console and try again.
  • ]If you are using a LAN connection and experience network issues, make sure all cables to router are in working order.
• 
  
  PS3 4.xx IDPS DUMPER v2.0​
  
  
  All PS3 models supported
  All 4.10+ CEX CFW/OFW supported
  4.81 DEX CFW/OFW supported​
  
  IMPORTANT NOTES:
  
  • It's essential not to flood the browser memory with junk before running the exploit. The reason for this is that due to javascript core memory usage limitations we are scanning several times a small range of browser memory (a few Mb) to find some essential data in RAM, if the memory is flooded then the range to scan becomes much larger & the probabilities that our data is found in the smaller range decrease dramatically....
  • So in short, never use the browser or use a homepage you cancel before running the exploit!
  • It is recommended to set your homepage temporarily to the exploit page you wish to use to ensure there is no memory flooding messing with the exploit initialization stage.
  Steps:
  
  1. Open the browser & browse to the **ps3xploit.com >Domain no Longer owned by team** (ps3xploit.me =new) website, go to the page of the exploit you need. Set the current page as browser homepage. Don't launch the exploit initialization. Close the browser.
  2. Open the browser. The exploit page will load automatically. Choose your dump path option.
  3. Press the exploit initialization button & wait until initialization succeeds. If it fails, follow the refresh/reload instructions on screen.
  4. Trigger the exploit by pressing the dump button.
  5. On success, check your idps dump with an hex editor.

Source Code & Downloads:
NOR/NAND/EMMC/IDPS 4.xx Dumpers v2.0 Update
NOR/NAND 4.82 Flash Writer v2.0 Update
flash_482.hex (already included in the Flash Writer 2.0 archive) MD5: d05be52f8d21700052fbd1fc0174acae
MinVerChck PUP

IMPORTANT UPDATE (MARCH-2019) v3.0.1 was released providing support for 4.84 HFW (a new hybrid firmware that restores PS3Xploit for 4.84 OFW user's (See Link to HFW)

Exploits now hosted @ **ps3xploit.com >Domain no Longer owned by team** (ps3xploit.me =new)
Official Support Forum: psx-place.com/forums/PS3Xploit/​

 

if patch is ok but check dump bad do you proceed with flash cfw or repeat patch?

Are you using littlebalup's python checker tool to validate your dump as instructed in OP & website?
https://github.com/littlebalup/PyPS3tools

 

Are you using littlebalup's python checker tool to validate your dump as instructed in OP & website?

tried to use softwarer in url but it does not work then used other software and give bad dump.Please explain to me how to use softwarer maybe I'm wrong?

 

tried to use softwarer in url but it does not work then used other software and give bad dump.Please explain to me how to use softwarer maybe I'm wrong?

In the github repo, there is a ReadMe telling you about the requirements & how to use the python tool.

Download & install Python 2.7.x from python.org.
Download the py ps3tools zip file from littlebalup's github repo, extract it, read the Readme.

 

Done this
Seen how to use on youtube videos
i Installed two software on Windows 7 but nothing happens when I drag dum.hex files to the checker.py file

 

Done this
Seen how to use on youtube videos
i Installed two software on Windows 7 but nothing happens when I drag dum.hex files to the checker.py file

Sorry but you will need to speak to littlebalup about this.
I don't have time to investigate whatever could be the problem in your setup,

 

I jailbreaked some ps3 consoles that were on 3,55 (the easy way)
Now I want to jailbreak my current ps3 with this méthode.
I readed the first tutorial of this.
Does anything changes in v2?
Do I have to use the dumper?
Or can I just run the adres of the flash writer in the ps3 browser, wait & boot to update with cfw? Because when I click the download link to the flasher with my laptop nothing happens?

you really should just read dude. you cannot jailbreak metldr2 consoles right now. you can use the dumper tools.

It freezes in this step every time
Sendt fra min SM-G900F med Tapatalk

are you sure you have NOR? what model?

tried to use softwarer in url but it does not work then used other software and give bad dump.Please explain to me how to use softwarer maybe I'm wrong?

@unseen has the right idea. same thing i do. just make sure you install python and then open CMD in checker directory.

 

I am using a Phat PS3 (CECHA) with Rebug 4.81.2, I can trigger the xploit ok, but it will not dump the IDPS or NAND FLASH to USB.

 

are you choosing DEX option, i assume you have on Rebug?

if on CEX, then make sure VSH ELF is renamed in dev_rebug/modules

there is some bug in Rebug Toolbox that uses the DEX VSH on CEX and not rename it correctly or something

 

I am using a Phat PS3 (CECHA) with Rebug 4.81.2, I can trigger the xploit ok, but it will not dump the IDPS or NAND FLASH to USB.

Remember that the mode (cex or dex) is not the only thing to worry about on Rebug.
When using Rebug mode (in the Toolbox) Rebug relies on a hybrid setup with a DEX vsh.self. If it's the case you have 2 options
1. Change the menu settings to CEX & the Rebug Mode to normal, reboot then using ps3xploit in CEX mode.
2. Use the DEX checkbox in ps3xploit

 

are you choosing DEX option, i assume you have on Rebug?

if on CEX, then make sure VSH ELF is renamed in dev_rebug/modules

there is some bug in Rebug Toolbox that uses the DEX VSH on CEX and not rename it correctly or something

Using CEX, rebug in normal mode and cobra disabled, debug menu set to CEX QA.

I presume you mean dev_rebug/vsh/modules but I do not have a vsh.elf in there.

 

Using CEX, rebug in normal mode and cobra disabled, debug menu set to CEX QA.

I presume you mean dev_rebug/vsh/modules but I do not have a vsh.elf in there.

There are 3 vsh files there!
One vsh.self & 2 others with swap extensions.
2 are the same size.
1 is a little smaller.
Is the one named vsh.self the smallest of the 3?

And anyway does the exploit freeze?
If it does not, the problem is elsewhere.

 

There are 3 vsh files there!
One vsh.self & 2 others with swap extensions.
2 are the same size.
1 is a little smaller.
Is the one named vsh.self the smallest of the 3?

And anyway does the exploit freeze?
If it does not, the problem is elsewhere.

Yes vsh.self is the same size as vsh.self.cexsp.

It does not freeze but after an hour nothing is written to USB.

 

I have set rebug to rebug mode and used the xploit in dex mode and I can see USB activity, so it looks like it's working, thanks for your help.

Can confirm dump.hex is growing in size as this is being posted.

Will try IDPS dump after flash dump.

 

Yes vsh.self is the same size as vsh.self.cexsp.

It does not freeze but after an hour nothing is written to USB.

No point waiting that long, the dump should be instantaneous given its small size.
Do you get a success message?
You said you had vsh.self & vsh.cexsp, what is the name of the 3rd vsh file?

 

No point waiting that long, the dump should be instantaneous given its small size.
Do you get a success message?
You said you had vsh.self & vsh.cexsp, what is the name of the 3rd vsh file?

3rd vsh was vsh.self.nrm

Sorry should have been more clear, the waiting for an hour was for nand dump.

Anyway using Rebug in Rebug mode and setting xploit to DEX, I have been able to dump nand flash and IDPS.

 

3rd vsh was vsh.self.nrm

Sorry should have been more clear, the waiting for an hour was for nand dump.

Anyway using Rebug in Rebug mode and setting xploit to DEX, I have been able to dump nand flash and IDPS.

It's like I told you.
vsh.self.cexsp is the retail cex vsh, you were not in Normal mode but in Rebug Mode!
The retail vsh is 44kb smaller than the 2 others which are dex.

 

It's like I told you.
vsh.self.cexsp is the retail cex vsh, you were not in Normal mode but in Rebug Mode!
The retail vsh is 44kb smaller than the 2 others which are dex.

I was in normal mode according to Rebug Toolbox and as far as I understood, but I did not know what it was checking for and how I could know for sure, but thanks to your help my problem is resolved, plus I learnt something, so all is good, thank you.

It does appear something is not quite right with the rebug toolbox.

 

I was in normal mode according to Rebug Toolbox and as far as I understood, but I did not know what it was checking for and how I could know for sure, but thanks to your help my problem is resolved, plus I learnt something, so all is good, thank you.

It does appear something is not quite right with the rebug toolbox.

2 things about the Toolbox.
1. Any changes must be followed by a reboot to be applied.
2. In Selector column there are 3 entries for cex/dex options. When you toggle the Rebug Mode one of the option disappear without getting updated afaik, it's safer to change the 2 other options first & Rebug mode last.

 

2 things about the Toolbox.
1. Any changes must be followed by a reboot to be applied.
2. In Selector column there are 3 entries for cex/dex options. When you toggle the Rebug Mode one of the option disappear without getting updated afaik, it's safer to change the 2 other options first & Rebug mode last.

Thanks for the tips, I'll remember for the future.

 

Just as a side note, I have managed to get my PS3 into real CEX (normal) mode by renaming the 3 files vsh.self, software_update_plugin.sprx and sysconf_plugin.sprx to the correct CEX files and I can dump the nand flash and IDPS in none dex mode, so I can confirm all issues are to do with Rebug Toolbox not switching correctly.