Cex 2 Dex Flash Patcher Update from andbey0nd

Published on 07-19-2012 04:30 PM

43 Comments

PS3 dev andbey0nd has dropped an update to Cex 2 Dex file patcher. The latest update gives users the ability to change the region/ID for your PS3. You can imagine exactly what you can do with those region locked DVD/Blu-Ray movies. Keep reading to see the changelog as well as some additional information from andbey0nd.

c2d.exe (win32 app)

===================

Requires:

OpenSSL 1.0.1 installed in c:\openssl or d:\openssl (http://slproweb.com/download/Win32OpenS ... 1_0_1c.exe)
EID root key (per_console_key) obtained with metldrpwn
PS3 (NOR) flash dump
Extract c2d.rar in a local folder (c:\c2d or d:\c2d)

Purpose:

Allows changing the Region / TargetID of your PS3 system
Allows "converting" any Retail PS3 into Debug unit (target_id 0x82)
Allows "converting" a Retail PS3 from one region to another (i.e. EUR PS3 -> JAP PS3, USA PS3 -> RUSSIAN PS3)

Changing a Retail PS3 region unlocks playback for region-locked DVD/Blu-ray movies and PS1/PS3 games

WARNING:

For best results flash the output NOR file with a tool which rewrites *ONLY the EID0 sector*

(one sector / 512 bytes @ sector #376 / 0x178; NOR file offset 0x2f000-0x2f1ff).

Flashing the whole 16MB NOR is not needed and can easily brick the PS3.

TIPS:

Use your original NOR flash to create new files for different regions for your PS3 to have them handy later:

For example you can have (each file is 16MB):

my-slim-JAP.EID0.NORBIN

my-slim-EUR.EID0.NORBIN

my-slim-USA.EID0.NORBIN

my-slim-DEX.EID0.NORBIN

Using a proper tool you can switch regions in one second when needed

PROTIPS:

The latest online debug update of multiMAN 04.04.03 handles writing to NOR in the right fashion (1 sector) from .EID0.NORBIN files.
To dump NOR: mmOS->Select any file->Open in HEX viewer->[SELECT]->[START]->DUMP LV2(NO)->DUMP LV1(NO)->DUMP FLASH(YES)
To write EID0 sector: mmOS->Double-click on a .EID0.NORBIN 16MB full NOR dump file->Follow the on-screen instructions->Reboot.

Usage:

c2d - Changes REGION/TARGET_ID in PS3 NOR flash

Usage: c2d.exe eid_key_file.bin in_flash.bin out_flash.bin [target_id]

[target_id]: 82..8C

82 (DEX) (default)

83 (JAPAN)

84 (USA/CANADA)

85 (EUROPE)

86 (KOREA)

87 (UK)

88 (MEXICO)

89 (AUSTRALIA)

8A (SE ASIA)

8B (TAIWAN)

8C (RUS/ASIA)

Output:

c:\c2d> c2d.exe eid_root_key.bin flashCEX.bin flashDEX.bin 82

EID key : 48 bytes (eid_root_key.bin)

Flash size : 16 MB (flashCEX.bin)

Target ID : $85

EID ROOT KEY: 64D20967DEACDA16ACADBE289B0EE2C25EE77331A5040C5DC9 DF67B3FE574F6D

EID ROOT IV : 6BD7C324D3B213A647DC31987345595E

EID0 KEY : 9C1C4A93666EF67941F54679A7199D7553C8F0F50F3548C896 6D6872FC8CD668

EID0 IV : 2DC374E270F851EB0D524F89790F2563

EID0 SEC KEY: 4C40F3E244EF2BF29A9D48BE26FEEEEB

Target ID : $85 (from decrypted EID0 section)

New TargetID: $82 (for modified flash)

CMAC HASH : F1053CC3818DD6CE2775F0273DFC212E

Writing modified flash with TargetID: $82 (flashDEX.bin)...

Done!

Enjoy!

andbey0nd

Source and Download

Share
- Share this post on
- Digg
- Del.icio.us
- Technorati
- Twitter

SkyNet, mossopinc, gDrive and 1 others like this.

_{Tags :

andbey0nd,

cex 2 dex,

cex2dex flash patcher,

ps3}

43 Comments

aldostools - 07-19-2012, 04:54 PM
- Reply
Awesome release! I dumped the flash of my PS3 (16MB) in only 5 seconds with the latest mmCM!!!!

Flashing only 1 sector of 512 bytes to convert CEX-to-DEX or TargetID/Region-to-Another is a great security mesure against bricks... It's much safer than flash the whole 16MB... And the region change is a super plus!!!

THANKS andbey0nd!!!

Now all we need is an easy method to dump the metldr to get the eid root key

BahumatLord - 07-19-2012, 05:00 PM
- Reply
could somebody point me to the lates MM debug update? The only one I found was 4.01.00.

aldostools - 07-19-2012, 06:33 PM
- Reply
@BahumatLord
AFAIK the multiMAN ver 04.01.00 DEX UPD MOD (20120204) is the latest build released to the public. It was a "MOD", so don't expect regular updates unless the mmCM team change their mind

aldostools - 07-20-2012, 08:53 AM
- Reply
Clarification:
"The latest online debug update of multiMAN 04.04.03" means that you start multiMAN with L2+R2 to get into multiMAN's debug mode, so it let you download the latest update that has the *flash functions*, but it still have the same version 4.04.03.

multiMAN's debug update has nothing to do with multiMAN 4.01.00DEX.

aldostools - 07-20-2012, 08:22 PM
- Reply
@BahumatLord,

POST UPDATED WITH HOT NEWS and NEW LINKS for multiMAN 04.04.03 CEX DEX (20120722)!!!

Good news... multiMAN ver 04.04.03 BASE DEX (20120722).pkg with the flash functions and peek&poke on DEX is available in a new package (46.67MB ) released by deank @ ps3crunch, with an ultra simple step-by-step tutorial to convert a CEX-to-DEX (ALL models are now supported - NAND & NOR) and how to convert it back to CEX whenever you need it.

Among the tools included in the aforementioned package, you will find also multiMAN 04.04.03 BASE CEX (20120722) (mentioned above in the c2d's readme), the metldrpwn, the NOR-unpack, c2d, some pkg files to install OtherOS++ and a nice & easy-to-follow tutorial with a lot of information for noobs and pros!!!

Downloads:

PS3_OTHEROS_LINUX_METLDRPWN.rar (217.49MB) - includes: OtherOS++ 22GB PUP
http://www.sendspace.com/file/ly22vs

PS3_OTHEROS_SETUP_METLDRPWN.rar (46.67MB) - same as above but without OtherOS++ 22GB PUP
http://www.sendspace.com/file/n238uk

A new update of multiMAN ver 04.04.03 BASE DEX (20120722).pkg is included in the packages above; it can be used on DEX 3.55-4.11. The best feature of this new release is that it can load backups!!!! on 3.55DEX with peek&poke.

Download: multiMAN ver 04.04.03 BASE CEX DEX (20120722) pack (33.55MB)

Tutorial:

Spoiler

NOTE:

* These instructions are for PS3 systems with NOR and NAND flash
* Following these instructions will result in formatting your internal PS3 HDD. All data will be lost.
* Before you continue, make sure that you backup all valuable data, saves, games
* If you have a hardware flasher - make a proper backup of your NOR/NAND flash
* If you don't have a flasher - make a backup of your NOR/NAND with software tools like memdump, dump_flash, preloader_advance, linux
* "Install multiMAN" in this tutorial should be read as "Install Regular or DEX version from multiMAN folder provided in this package"
* All tools must be used ONLY with NAND/NOR dumps created by multiMAN
* All firmware updates/installs MUST be performed from XMB->System Update and NOT FROM RECOVERY MENU!

REQUIREMENTS / PREPARATIONS:

* USB HDD/flash FAT32 formatted with 1GB free space
* Contents of this package extracted to the root folder of your USB drive
IMPORTANT:
* If your PS3 has NAND flash, remove "dtbImage.ps3.bin" from your USB
and rename "NAND-dtbImage.ps3.bin" to "dtbImage.ps3.bin"

* Red Ribbon Linux (steps 13, 14) extracted to the root folder of your USB drive

* Create a dump of your NOR/NAND (use multiMAN to create a .NORBIN/.NANDBIN file - USB connected as /dev_usb000 required)
- To dump flash: mmOS->Select any file->Open in HEX viewer->[SELECT]->[START]->DUMP LV2(NO)->DUMP LV1(NO)->DUMP FLASH(YES)
* Plug the USB to your PC and unpack the dump with norunpack.exe or cex2dex to a folder and grab "metldr" from the "asecure_loader" folder
* Put "metldr" into the "metldrpwn" folder on your USB

* While I was converting my PS3 from CEX to DEX and then back from DEX to CEX I NEVER used the POWER BUTTON to turn-off/restart the PS3. The only time I had to do that is at the beginning when you have to enter the Recovery Menu after OTHEROS PUP is installed. All other firmware updates are performed from XMB (not from recovery menu) and all restarts/turn-offs are performed with {PS}->Turn Off in GameOS, or reboot/shutdown/restart/boot-to-game-os while in petitboot or linux.

* The PS3 I used for my tests is SLIM, which came with 2.70, never downgraded and no need for special firmwares with checks-disabled, etc. If your console is downgraded from 3.56+, following this tutorial may brick it.

TIP:
* If you already obtained your keys you may skip to step 27

STEPS:

1. Go to "System Update" and Install OTHEROS-22GB.PUP from USB (provided as \PS3\UPDATE\PS3UPDAT.PUP in this package)
* If you tried other tutorials or tools and if you find yourself in Petitboot - select "Boot OtherOS". Going into Recovery Mode will be tricky later.

2. When installation is finished, reboot in "Recovery Mode" and choose "Restore PS3 System" (not the Backup/Restore in XMB)
* To go to "Recovery Menu" turn-off the PS3, press and hold the power button, you will hear ONE beep, then 2 beeps - release the button.

3. Now 22GB are reserved for OtherOS

4. Install and run setup_flash_for_otheros.pkg

5. Reboot (It's important to shut down and turn on your PS3)

6. Install and run install_otheros.pkg (Try different USB ports if you don't get any beeps.)
7. Install and run boot_otheros.pkg
8. Install and run reboot.pkg (use the package, do NOT reboot manually)

9. You should be in Petitboot now.

10. Quit to Shell and execute create_hdd_region.sh from your USB:
/tmp/petitboot/mnt/sda1/create_hdd_region.sh
or /tmp/petitboot/mnt/sdb1/create_hdd_region.sh
or /tmp/petitboot/mnt/sda/create_hdd_region.sh
or /tmp/petitboot/mnt/sdb/create_hdd_region.sh

or mount
and look for your USB hdd device in the list and then execute the script (create_hdd_region.sh) from the proper path

11. Reboot your PS3
12. From GameOS run "Reboot" to get into Petitboot again (if not already in Petitboot)

13. Download Red Ribbon: http://sourceforge.net/projects/redr...5.rar/download
14. Extract the rar and extract the ISO in the root of your USB stick/or burn the image to a DVD

15. Plug in your USB in your PS3 and you should see 2 more boot options in Petitboot
16. Boot the one that says "live-otheros" (not asbestos or failsafe)

17. From the desktop icon "Install Red Ribbon" - double-click to install it on the HDD
Use default username/password during installation: ps3/ps3

PROTIP:
* During partitioning you can resize the default /dev/ps3dd1 partition from 21GB to just 4GB (4096MB)
* It will speed up installation/formatting (all will take less than 5 mins)

18. Restart the PS3 after installation is complete (use "Reboot" package from GameOS if reboot doesn't bring you to Petitboot)

19. Select "Red-Ribbon" from petitboot (not the live/asbestos/failsafe)
20. Login with ps3/ps3
21. Use FileManager to copy your "metldrpwn" folder from the USB to your linux home folder (/home/ps3)
22. Close all opened windows/file-manager and Start TERMINAL

23. Type:
cd metldrpwn
sudo chmod +x ./run.sh
sudo insmod ./metldrpwn.ko
sudo sh ./run.sh

24. You may have to repeat the last command (sudo sh ./run.sh) if exploit fails. Close all windows but the TERMINAL window and retry.
25. You will find your EID dump (256KB) if everything went well in your home folder (/home/ps3/dump_eid0.bin)
26. Transfer it to your USB drive

27. On your PC use "c2d.exe" to convert your CEX NOR/NAND dump to DEX (use command prompt) (you may have to install openssl from c2d folder):
c2d.exe dump_eid0.bin my-original-cex.NORBIN my-DEX-flash.EID0.NORBIN 82
or
c2d.exe dump_eid0.bin my-original-cex.NANDBIN my-DEX-flash.EID0.NANDBIN 82

* If the dump-eid0.bin doesn't have the proper keys at the begining (0x00-0x2f) you will have to search for the keys.
Mark the first 16 bytes (0x00-0x0f) and search for them in the dump. You'll find them at another location.
Save the 48 bytes following from the location you found the keys to a NEW file (eid_root_keys.bin) and use the file with "c2d"

28. Rename your DEX flash to my-DEX-flash.EID0.NORBIN (or my-DEX-flash.EID0.NANDBIN if your PS3 has NAND flash) and copy it to USB
29. Install multiMAN (REGULAR) on your PS3 and from mmOS double-click the file from step 28) from your USB, follow the instructions.
30. Quit multiMAN and from XMB press+hold {PS} button -> Turn-off the system, then start it again
31. Download 3.55 DEX firmware (or Rogero's 3.55DEX - link in the next step) and save to USB as \PS3\UPDATE\PS3UPDAT.PUP (overwrite the otheros pup)
* Install DEX 3.55 firmware from XMB->System Update->Storage Media.
* If you install DEX 3.56-4.11 firmware you will need multiMAN DEX version, otherwise use multiMAN (regular/cex).

32. To get back to CEX/CFW from DEX:
* If you're on 3.56 or higher DEX install 3.55DEX_downgrader firmware: http://www.ps3devwiki.com/files/firm...r/PS3UPDAT.PUP
* You can also use Rogero's 3.55DEX_DOWNGRADER_PEEK_POKE firmware (not tested): http://www.mediafire.com/?99pl32srjl1342o
* Install multiMAN regular (for CEX/CFW) (otherwise you will get "Error accessing device! Install proper firmware!" error
* Use your original NOR dump (my-original-cex.NORBIN) and rename it to (my-original-cex.EID0.NORBIN)
or in case of NAND: Use your original NAND dump (my-original-cex.NANDBIN) and rename it to (my-original-cex.EID0.NANDBIN)
* Double click on your CEX flash file in mmOS (i.e. /dev_usb000/my-original-cex.EID0.NORBIN or /dev_usb000/my-original-cex.EID0.NANDBIN)
* Quit multiMAN and from XMB press+hold {PS} button -> Turn-off the system, then start it again
* Install OFW/CFW 3.55 from XMB.

Now there are no excuses to no convert our PS3 CEX (NOR & NAND models) into a DEX, return back to CEX, change regions/target ids, etc.

Some additional files that you will need are:
- OtherOS++ PUP
- Red Ribbon RC5 iso
- 4.11 OFW DEX PUP

Also:
- 3.55-downgrader DEX PUP (to return a DEX to CEX)
- 3.55 CFW (Kmeaw, Rebug, Rogero, Cobra, TB, etc.)
- An external HDD with enough free space to backup your important stuff.
- A pen drive or external HDD with at least 1GB of free space (can be the same device that you used to backup your files).
- An USB cable to connect controller to the PS3 and a USB keyboard & mouse. For PS3 slim users, a USB hub is suggested.

- The metldr, EID dump (256kb) & .EID0.NORBIN (or .EID0.NANDBIN) files of your PS3.

And this video that explains how to access the Recovery Menu can be handy too.

BahumatLord - 07-20-2012, 08:43 PM
- Reply
@aldostools - thanks for the heads up. That really is a nice compilation instead of having to track everything down. I'll agree that there's no excuses as to why it can't be done, but still I don't think it's going to be for everyone. Some people panic when using a hex viewer/editor for example. And sad to say, but some people don't know the basics like installing pkg files, PUPs or even extracting the RAR to start with.

As long as people take the time and follow step-by-step and stop if they don't understand something, then they won't have any problems. People still need to be cautious with it

BahumatLord - 07-20-2012, 08:51 PM
- Reply
And people should remember that installing Linux/OtherOS++ will cause you to lose the contents of your internal drive. There's a workaround to where you can install Linux to a USB drive, but for slim owners that only have 2 usb ports you would need a working USB hub so you can plug in the USB drive with Linux and also your keyboard/mouse and a second USB FAT32 drive so you can pull the files you need

aldostools - 07-20-2012, 08:57 PM
- Reply
Right! There is always a risk of brick when you mess with your flash (even installing OFW).

I agree that the tutorial is not for everyone, but it is so well explained that almost anyone with enough background can do it.

BahumatLord - 07-20-2012, 11:00 PM
- Reply
I'm rocking the DEX!!! I panicked a little bit at first. When I went to install the 4.11 update and it rebooted it kicked me to the petitboot screen. I didn't plan on using this drive, so I turned it off, plugged in my regular internal drive and turned it on. When I tried to do the update it said a serious error has occured. contact tech support. I tried the 3.55 dex and it said the same thing. I popped my linux drive back in and turned it on. It kicked me to the petitboot screen again. I hit return to GameOS and it started the update process.

Pimpin 4.11 DEX people!!! Get off your butts and make a move if you're going to do it

BahumatLord - 07-20-2012, 11:17 PM
- Reply
after installing 4.11 DEX on the linux drive that I did the flash, I was able to put my original drive back in and install 4.11 dex on that one. All is good over here

BahumatLord - 07-20-2012, 11:20 PM
- Reply
I had to do the video reset after installing on my original drive. Turn off your PS3 and hold the power button until it beeps for the second time

BahumatLord - 07-20-2012, 11:57 PM
- Reply
@aldostools - before I do something stupid could you explain that downgrader PUP for me. Do I need to reflash my original dump first or does this just put you back on 3.55 DEX, then you flash, then you install a 3.55 CEX firmware?

aldostools - 07-21-2012, 12:07 AM
- Reply
Originally Posted by BahumatLord

@aldostools - before I do something stupid could you explain that downgrader PUP for me. Do I need to reflash my original dump first or does this just put you back on 3.55 DEX, then you flash, then you install a 3.55 CEX firmware?

From the deank's tutorial:

32. To get back to CEX/CFW from DEX:
* Install 3.55DEX_downgrader firmware: http://www.ps3devwiki.com/files/firm...r/PS3UPDAT.PUP
* Use your original NOR dump (my-original-cex.NORBIN) and rename it to (my-original-cex.EID0.NORBIN)
or in case of NAND: Use your original NAND dump (my-original-cex.NANDBIN) and rename it to (my-original-cex.EID0.NANDBIN)
* Double click on your CEX flash file in mmOS (i.e. /dev_usb000/my-original-cex.EID0.NORBIN or /dev_usb000/my-original-cex.EID0.NANDBIN)
* Quit multiMAN and from XMB press+hold {PS} button -> Turn-off the system, then start it again
* Install OFW/CFW 3.55 from XMB

atreyu187 - 07-21-2012, 12:19 AM
- Reply
SO what are the benefits other then out of region video and PS1/2 games? We can load anything CFW 3.55 users can and we can run legit disc up to FW 4.11 but did I read it is possible to install newer games as well?

BahumatLord - 07-21-2012, 12:40 AM

@aldostools - thanks. I guess I overlooked that. One last question if you don't mind. What was the purpose of dumping the keys. It wasn't in the first 3 lines for me so I ended up using Cex2Dex instead of C2D as listed in this guide. I didn't get any errors doing the conversion. Is it just something for C2D to run right or would it have enabled backups using the DEX multiMAN?

I've still got the original files so I can redo it if I have to.

@atreyu187 - you can run original discs and you can make what I guess you'd call a developer's USB hard drive. It will allow you to make 4 partitions on it. 1 game per partition and you can boot 3.6+ games backed up on to this drive. Here's a guide that's easy to follow.

Code:

ps3gen.zip
psn_package_npdrm.rar
PS3 Game Updater 1.41.rar
PkgView_1.3.rar

Preparing the usb hdd:

0. Connect an external usb disc
1. Go to debug settings on your dex
2. BD Access select "BD Emulator (USB)"
3. transfer rate option select "HDD Native"
4. "Format BD Emulator HDD"

Preparing the update:

1. First use PS3 Game Updater to get the newest Update pkg for the game
2. Then fire up Pkg View and extract the BCUS98295 dir into any dir -lets just call it targetdir.
3. Extract psn_package_npdrm.exe into this dir
4. Create a .txt into this dir and fill it with:

Content-ID = EP0001-BCUS98295_00-0000111122223333
K_licensee = 0x00000000000000000000000000000000
DRM_Type = Free
Content_Type = GameData
PackageType = DiscGamePatch
PackageVersion = 01.21

Rename the .txt file "package.conf".
Where BCUS98295 is the Title ID of your game and Packageversion has to be the Number of the Patch you downloaded

5. run it via cmd with psn_package_npdrm.exe package.conf BCUS98295
-> this will create a new update pkg for your game -> put on usb stick an install on DEX 3.55 ( don't know if you can also install it later )

Preparing the BD Emu Disc:

0. connect external usb with your pc
1. Fire up psgen.exe
2. fill in the title id: bcus.. put disc version to 00.00, copyright holder = sce, producer name = sce, tick trophy, click setup game
3. file -> import -> load up the param.sfo, click tab content information files and drag and drop the files from ps_game without the directories -&gt
; remove files that get a grey background -> click ok
4. click tab directory and file the structure with your backed up files
5. click build
6. click for bd emulator hdd tab and select the partition u want to use

aldostools - 07-21-2012, 01:41 AM
- Reply
Originally Posted by BahumatLord

@aldostools - thanks. I guess I overlooked that. One last question if you don't mind. What was the purpose of dumping the keys. It wasn't in the first 3 lines for me so I ended up using Cex2Dex instead of C2D as listed in this guide. I didn't get any errors doing the conversion. Is it just something for C2D to run right or would it have enabled backups using the DEX multiMAN?

I've still got the original files so I can redo it if I have to.

C2D needs the keys to decrypt/encrypt the EID0. C2D accepts EID key file of 256KB or 48 bytes.

Regaring to the last statement: "if ain't broke don't fix it"

BahumatLord - 07-21-2012, 02:13 AM
- Reply
Can't argue with that. It looks like Cex2Dex is the "for dummies" version. I went back and pulled the right keys, but like you said - if it ain't broke.... Speaking of broke, I broke my hdmi cable when I was swapping out my hard drive. I got lazy and just tipped it up so I could pull the drive out. I can get it to work sometimes, but I don't want to deal with the hassle. Just going to have to get a new one when I'm in town next week.

I did try that guide for psgen and creating a bootable hard drive for 3.6+ games. It does work and is really easy to follow. I take it the reason that you have to rebuild the pkg files is because you can't install retail pkg files on DEX. Could you use MFW builder and add that feature or is that too much to hope for?

edit: when I say you, I mean the end-user

aldostools - 07-21-2012, 08:33 AM
- Reply
UPDATE: The developer deank @ ps3crunch have updated his tutorial and the packages of all required tools to add support to NAND models. Now all PS3 models can be converted CEX-to-DEX, return to CEX and change region/target id, using his walkthrough tutorial & package of tools.

The new package includes an updated version of C2D, the newest builds of multiMAN ver 04.04.03 BASE (20120721) for both CEX & DEX and the updated tutorial.

deank added this important note:

NOTE: While I was converting my PS3 from CEX to DEX and then back from DEX to CEX I NEVER used the POWER BUTTON to turn-off/restart the PS3. The only time I had to do that is at the beginning when you have to enter the Recovery Menu after OTHEROS PUP is installed. All other firmware updates are performed from XMB (not from recovery menu) and all restarts/turn-offs are performed with {PS}->Turn Off in GameOS, or shutdown/restart/boot-to-game-os while in petitboot or linux.

I have updated my posts above with the updated links & the new tutorial.

Source: C2D.EXE v2 (PS3 Flash Patcher) - Now Allows Users to Modify Region/TargetID Settings - Page 13

aldostools - 07-21-2012, 03:18 PM
- Reply
NEW UPDATE: The latest multiMAN ver 04.04.03 BASE DEX (20120721).pkg now works on 3.55DEX+peek/poke again!!

I updated my post above with the latest tutorial and new links from deank!!

BahumatLord - 07-21-2012, 05:47 PM
- Reply
Originally Posted by aldostools

NEW UPDATE: The latest multiMAN ver 04.04.03 BASE DEX (20120721).pkg now works on 3.55DEX+peek/poke again!!

I updated my post above with the latest tutorial and new links from deank!!

Working great on my end. I do have a question about the file manager. I'm not able to copy/rename/etc anything on the internal drive. I have normal access on external FAT32. Is that normal or do I have a setting wrong somewhere?