Following up on his initial release, today PlayStation 3 developer andbey0nd has updated his PS3 C2D.exe CEX to DEX Flash Patcher to version 2 which now includes Region / TargetID changing in the PS3 NOR Flash as outlined below.
Download: PS3 C2D CEX to DEX Flash Patcher v2 / Metldrpwn (Pre-compiled)
To quote from the ReadMe file (via pastie.org/4282714):
c2d.exe (win32 app)
Requires:
OpenSSL 1.0.1 installed in c:\openssl or d:\openssl (
http://slproweb.com/download/Win32OpenS ... 1_0_1c.exe)
EID root key (per_console_key) obtained with metldrpwn
PS3 (NOR) flash dump
Extract c2d.rar in a local folder (c:\c2d or d:\c2d)
Purpose:
Allows changing the Region / TargetID of your PS3 system
Allows "converting" any Retail PS3 into Debug unit (target_id 0x82)
Allows "converting" a Retail PS3 from one region to another (i.e. EUR PS3 -> JAP PS3, USA PS3 -> RUSSIAN PS3)
Changing a Retail PS3 region unlocks playback for region-locked DVD/Blu-ray movies and PS1/PS3 games
WARNING: For best results flash the output NOR file with a tool which rewrites *ONLY the EID0 sector* (one sector / 512 bytes @ sector #376 / 0x178; NOR file offset 0x2f000-0x2f1ff). Flashing the whole 16MB NOR is not needed and can easily brick the PS3.
TIPS:
Use your original NOR flash to create new files for different regions for your PS3 to have them handy later:
For example you can have (each file is 16MB):
my-slim-JAP.EID0.NORBIN
my-slim-EUR.EID0.NORBIN
my-slim-USA.EID0.NORBIN
my-slim-DEX.EID0.NORBIN
* Using a proper tool you can switch regions in one second when needed
PROTIPS:
The latest online debug update of multiMAN 04.04.03 handles writing to NOR in the right fashion (1 sector) from .EID0.NORBIN files.
To dump NOR: mmOS->Select any file->Open in HEX viewer->[SELECT]->[START]->DUMP LV2(NO)->DUMP LV1(NO)->DUMP FLASH(YES)
To write EID0 sector: mmOS->Double-click on a .EID0.NORBIN 16MB full NOR dump file->Follow the on-screen instructions->Reboot.
Usage:
c2d - Changes REGION/TARGET_ID in PS3 NOR flash
Usage: c2d.exe eid_key_file.bin in_flash.bin out_flash.bin [target_id]
Code:
[target_id]: 82..8C
82 (DEX) (default)
83 (JAPAN)
84 (USA/CANADA)
85 (EUROPE)
86 (KOREA)
87 (UK)
88 (MEXICO)
89 (AUSTRALIA)
8A (SE ASIA)
8B (TAIWAN)
8C (RUS/ASIA)
Output:
Code:
c:\c2d> c2d.exe eid_root_key.bin flashCEX.bin flashDEX.bin 82
EID key : 48 bytes (eid_root_key.bin)
Flash size : 16 MB (flashCEX.bin)
Target ID : $85
EID ROOT KEY: 64D20967DEACDA16ACADBE289B0EE2C25EE77331A5040C5DC9DF67B3FE574F6D
EID ROOT IV : 6BD7C324D3B213A647DC31987345595E
EID0 KEY : 9C1C4A93666EF67941F54679A7199D7553C8F0F50F3548C8966D6872FC8CD668
EID0 IV : 2DC374E270F851EB0D524F89790F2563
EID0 SEC KEY: 4C40F3E244EF2BF29A9D48BE26FEEEEB
Target ID : $85 (from decrypted EID0 section)
New TargetID: $82 (for modified flash)
CMAC HASH : F1053CC3818DD6CE2775F0273DFC212E
Writing modified flash with TargetID: $82 (flashDEX.bin)...
Done!
Enjoy!
andbey0nd
Note: TargetID/RegionCode is one and the same. DEX target/region is 82. 0x84 is USA RETAIL PS3, 0x82 is Debug/DEX.
Finally, below are a few additional guides from Sony PlayStation 3 hacker deank as follows:
DeanK's OtherOS with METLDRPWN PUP Installation / Usage Tutorial (via ps3crunch.net/forum/threads/4111-C2D?p=45668#post45668)
Ok, folks... I prepared a 218MB rar package to make things easier. It includes everything you need, except for RedRibbon (you'll have to download it yourself ->
http://sourceforge.net/projects/redribb ... r/download).
PS3_OTHEROS_LINUX_METLDRPWN.rar (218.21MB)
http://www.sendspace.com/file/durszkYou can also use this smaller download if you already have OTHEROS-22GB.PUP downloaded:
PS3_OTHEROS_SETUP_METLDRPWN.rar (48.33MB)
http://www.sendspace.com/file/odyz6zYou can download the OTHEROS PUP separately directly from glevand's repo and save it as \PS3\UPDATE\PS3UPDAT.PUP on your USB:
http://gitbrew.org/~glevand/ps3/cfw/CFW ... +-22GB.PUPDownload and follow the instructions. You need a USB hdd to extract this package to the root folder of the USB and also Red-Ribbon.iso extracted in the root folder of the same USB. The rar contains:
c2d tool / openssl installer
metldrpwn folder with precompiled metldrpwn.ko module for Red Ribbon
multiMAN (for CEX and DEX) (no backups on DEX)
norunpack (+cygwin1.dll)
PS3\UPDATE\PS3UPDAT.PUP (otheros-22GB.PUP)
create_hdd_region.sh
4 packages needed to setup OtherOS from XMB/GameOS + flash image for NORs (dtbImage.ps3.bin)
Instructions
That's all you need.
Code:
NOTE:
These instructions are only for PS3 systems with NOR flash
Following these instructions will result in formatting your internal PS3 HDD. All data will be lost.
Before you continue, make sure that you backup all valuable data, saves, games
USB required with 1GB free space
Extract the contents of this package to the root folder of your USB drive
Download and extract RedRibbon Linux (steps 13, 14) to the root folder of your USB drive
Create a dump of your NOR (use multiMAN to create a .NORBIN file - USB connected as /dev_usb000 required) - To dump NOR: mmOS->Select any file->Open in HEX viewer->[SELECT]->[START]->DUMP LV2(NO)->DUMP LV1(NO)->DUMP FLASH(YES)
Transfer to your PC and unpack it with norunpack.exe or cex2dex to a folder and grab "metldr" from the "asecure_loader" folder
Put "metldr" into the "metldrpwn" folder on your USB
1. Go to "System Update" and Install OTHEROS-22GB.PUP from USB (provided as \PS3\UPDATE\PS3UPDAT.PUP in this package)
2. When installation is finished, reboot in "Recovery Mode" and choose "Restore PS3 System" (not the Backup/Restore in XMB)
3. Now 22GB are reserved for OtherOS
4. Install and run setup_flash_for_otheros.pkg
5. Reboot (It's important to shut down and turn on your PS3)
6. Install and run install_otheros.pkg (Try different USB ports if you don't get any beeps.)
7. Install and run boot_otheros.pkg
8. Install and run reboot.pkg (use the package, do NOT reboot manually)
9. You should be in Petitboot now.
10. Quit to Shell and execute create_hdd_region.sh from your USB:
/tmp/petitboot/mnt/sda1/create_hdd_region.sh
or /tmp/petitboot/mnt/sdb1/create_hdd_region.sh
or /var/tmp/petitboot/mnt/sda1/create_hdd_region.sh
or /var/tmp/petitboot/mnt/sdb1/create_hdd_region.sh
11. Reboot your PS3
12. From GameOS run "Reboot" to get into Petitboot again (if not already in Petitboot)
13. Download Red Ribbon:
http://sourceforge.net/projects/redribb ... r/download14. Extract the rar and extract the ISO in the root of your USB stick/or burn the image to a DVD
15. Plug in your USB/Insert the disc in your PS3 and you should see 2 different boot options in Petitboot
16. Boot the one that says "otheros" (not asbestos or failsafe)
17. From the desktop icon "Install Red Ribbon" - double-click to install it on the HDD. Use default username/password during installation: ps3/ps3
PROTIP:
During partitioning you can resize the default /dev/ps3dd1 partition from 21GB to just 4GB (4096MB)
It will speed up installation/formatting (all will take less than 5 mins)
18. Restart the PS3 after installation is complete (use "Reboot" package from GameOS if reboot doesn't bring you to Petitboot)
19. Select "Red-Ribbon" from petitboot (not the live/asbestos/failsafe)
20. Login with ps3/ps3
21. Use FileManager to copy your "metldrpwn" folder from the USB to your linux home folder (/home/ps3)
22. Start TERMINAL
23. Type:
Code:
cd metldrpwn
sudo chmod +x ./run.sh
sudo sh ./run.sh
24. You may have to repeat the last command (sudo sh ./run.sh) if exploit fails
25. You will find your EID dump (256KB) if everything went well in your home folder (/home/ps3/dump_eid0.bin)
26. Transfer it to your USB drive
27. On your PC use "c2d.exe" to convert your CEX NOR dump to DEX (use command prompt) (you may have to install openssl from c2d folder):
Code:
c2d.exe dump_eid0.bin my-original-cex.NORBIN my-DEX-flash.EID0.NORBIN 82
If the dump-eid0.bin doesn't have the proper keys at the begining (0x00-0x2f) you will have to search for the keys. Mark the first 16 bytes (0x00-0x0F) and search for them in the dump. You'll find them at another location. Save the 48 bytes following from the location you found the keys to a new file (eid_root_keys.bin) and use the file with "c2d"
28. Rename your DEX flash to my-DEX-flash.EID0.NORBIN and copy it to USB
29. Install multiMAN on your PS3 and from mmOS double-click the my-DEX-flash.EID0.NORBIN from your USB
30. Quit multiMAN and REBOOT your PS3
31. Install DEX 3.55 firmware or higher from XMB->System Update->Storage Media.
32. To get back to CEX/CFW from DEX:
Install 3.55DEX_downgrader firmware:
http://www.ps3devwiki.com/files/firmwar ... 3UPDAT.PUP Use your original NOR dump (my-original-cex.NORBIN) and rename it to (my-original-cex.EID0.NORBIN)
Double click on your CEX NOR file in mmOS (i.e. /dev_usb000/my-original-cex.EID0.NORBIN)
Quit multiMAN, Reboot your PS3 and install OFW/CFW 3.55 from XMB
EASIEST WAY: When you boot your PS3 in PETITBOOT you can see the paths to the kernels. Two of these (first two lines) will show the correct path to your USB HDD (look for /......../petitboot/.....).
If you see ...../sda1.... or ...../sdb1.... <--- this is your USB HDD so use the path with cd and then launch create_hdd_region.sh
You can either use:
Code:
/tmp/petitboot/mnt/sda1/create_hdd_region.sh
or
Code:
cd /tmp/petitboot/mnt/sda1
./create_hdd_region.sh
You can easily find your USB HDD by trying the folders:
try to type these:
Code:
cd /
cd var
cd tmp
cd petitboot
cd mnt
here you can type
Code:
ls -al
and find your usb (sda* / sdb* / sdc*) (sda1 means Storage Device "A", partition 1, sdb1 means Storage Device "B", partition 1, etc) and then you can
Code:
cd sda1
./create_hdd_region.sh
(change "cd sda1" appropriately - if you use USB HDD, 1st partition is sda1, second is sda2, etc... If you use USB STICK/FLASH then sdb1/sdb2..)
Read more:
http://www.ps3news.com/forums/ps3-hacks ... z21Ewfcirg 
