NORway - Teensy++ 2.0 Flasher Software

Published on 07-26-2011 08:40 PM

65 Comments

There has been great news recently with a new breed of jailbreak devices being announced and hitting the market. Another entry has been added to current list of uf6667's ProgSkeet, No_One's PNM Project, and Varicela's Infectus-Dual. Today, PSX-SCENE member and developer judges has released NORway v0.1, a flashing program for Teensy++ 2.0 boards that allows for dumping and flashing of the NOR-based consoles, based on "noralizer" by marcan. Included below is the official release statement, along with pictures of how the project was installed inside the PS3 console.

Update 28th July, 2011:

v0.2 released! Documentation updated to include the required 3.3V voltage regulator plus Teensy clock rate changed to 8 MHz!

Download: NORway_v0.2.zip

Initial Release:

Here comes my initial release of a NOR flasher soft for the PS3 called "NORway". I know, there are other "WIP" projects, but I got a little impatient, so I've decided to create my own solution. It's a port of "noralizer" by marcan, a pretty good working NOR flasher implementation for another FPGA board.

Anyway, here's the README.txt, which should explain everything:

NORway v0.1

This project has been ported for the Teensy++ 2.0 from the original NOR flasher tool
("noralizer" by Hector Martin "marcan" <hector@marcansoft.com>) that was used to flash
AsbestOS onto the demo PS3 at 27C3, and for experimentation.

Contents:

\teensy\NORway.avrsln - Source code for the Teensy++ 2.0 (AVR Studio 5.0)
\teensy\default\NORway.hex - Compiled hex-file for the Teensy++ 2.0 (AT90USB1286)
\hwinstall\install-*.jpg - Some pics of how I've mounted the Teensy (CECH-2504A/B)
\hwinstall\nor_testpoints.png - Connection diagram of the NOR testpoints (CECH-2504A/B)
\serial_install.exe - Teensy serial drivers for Windows
\README.txt - this file
\NORway.py - PC Python client

Hardware connections (see "\hwinstall\nor_testpoints.png"):

PS3 Teensy
A0-7 PF0-7
A8-15 PA0-7
A16-22 PB0-7
D0-7 PD0-7
D8-15 PC0-7
CE# PE0
OE# PE1
RESET# PE4
WE# PE5
RY/BY# PE6
TRISTATE# PE7
GND GND

There are no modifications to the Teensy itself required. Don't install any power regulators,
don't cut any traces.

DON'T CONNECT THE VCC SOLDER PADS TO ANYTHING!

Connection diagrams for other boards can be found at:
Hardware flashing - PS3 Development Wiki

Prerequisites for Windows:

Python 2.7.2 (http://www.python.org/ftp/python/2.7.2/python-2.7.2.msi)
pyserial 2.5 (http://pypi.python.org/packages/any/...-2.5.win32.exe)

Usage:

Install Python + pyserial (see "Prerequisites for Windows"). Install drivers. Connect Teensy
to your PC. Flash Teensy with "\teensy\default\NORway.hex" and reset it after completion. Start
Windows' "Device Manager", expand the "Ports (COM & LPT)" node, you should see something like
"USB Serial (Communication Class, Abstract Control Model) (COM4)". This tells you that "COM4"
(or whatever shows up) is the COM port used by Teensy.

At the command prompt enter "NORway.py" to display help.

Procedure to dump your flash:

- PS3 is turned off
- At the command prompt enter:
NORway.py <your com port>
- Turn on your PS3, it shouldn't boot
- At the command prompt enter:
NORway.py <your com port> dump flash.bin
- When dumping is finished enter:
NORway.py <your com port> release
- Power off your PS3 (disconnect Teensy if PS3 doesn't boot when restarted)

Dumping takes about 3 minutes. A file "flash.bin" with a size of exactly 16 MB (16.777.216 bytes)
has been created in your current directory.

Flashing is rather slow. Writing a complete flash with the "write" command takes about 2 hours.
Might be improved in future versions...

IMPORTANT:

Before you flash your PS3 with anything new, make sure that the content of your dump is correct
(e.g. compare ros0/ros1 area of your dump against "CORE_OS_PACKAGE.bin" from an actual PS3UPDAT.PUP
of your current firmware). And keep your original dump in a safe place. You might need it.

It's tested on Win7 x86, but should also work just fine on any x86 Windows >=XP.
Basically it should also work on Linux, but I didn't test. If you're running Linux, you
probably know what to do. ;-) Serial drivers are not required for Linux.

Unfortunately I couldn't manage to make it work on any x64 version of Windows, because of
the Python pyserial module.

Thanks to "marcan" for the original implementation.

-- judges (judges@eEcho.com)

Link: NORway_v0.1.zip

P.S: I've already managed to downgrade my OFW 3.61 to CFW 3.55. There're minor things to rule out, but expect a downgrade tutorial coming soon..
PPS: Thanks to defyboy for the original idea of using a Teensy for flashing!

Pictures of the Project:

Download: NORway_v0.2.zip

Older Downloads:
NORway_v0.1.zip Mirror: NORway_v0.1.zip
PS3_NOR_Testpoints.rar

Source: PSX-SCENE

Share
- Share this post on
- Digg
- Del.icio.us
- Technorati
- Twitter

Categories:

_{Tags :

dump,

flash,

hacker,

norway,

teensy++ 2.0}

65 Comments

adrianc - 07-26-2011, 11:44 PM
- Reply
double post

-adrianc

kiwto1 - 07-26-2011, 11:58 PM
- Reply
damn how the hell are we sopose to do with all those wire like one is enought damnn

mushbert - 07-27-2011, 12:15 AM
- Reply
lol. not that it would help, but we could ask the webmasters to add another box beside the "Difficulty" rating... for EVERY news post... [CFW: NO!]

themuse - 07-27-2011, 12:18 AM
- Reply
in response to people saying that there wont be a 3.66 cfw or that it is not possible for there to be a new cfw over 3.60 ,
but it should still be posible for users that are still on 3.55 or below right? just not over where the private key signing was fixed by $ony right?which version did sony fix the bug in? so anyone who has updated pats that version will have rely on a perconsole key to get cfe fow 3.56+ and have to compile it themselves with their own individual per console key , unless somone comes up with some noob friendly app to do it ,one app for ps3 to get yur pkc and another one for your pc to compile it into a pup ,or would an app like that not even work in windows if it could even be written?this method looks much harder ,the wires are soldered all over the place on the mobo , atleast the other ones the wires are mostly just soldered right to the nand or nor , with the other hw dg methods there is atleas hope someone will make a clip on for the nand chip to keep the soldering to a minum

JudasRein - 07-27-2011, 12:18 AM
- Reply
I think the number one question on my mind is: do we have to format the hard drive when we downgrade? I want to be able to go to 3.66, grab the stuff that I legally purchased from PSN, then go back to 3.55. Once I have confirmation that I can do this, my Teensy will be in my PS3 that day.

alonehacker - 07-27-2011, 12:29 AM
- Reply
Originally Posted by kiwto1

damn how the hell are we sopose to do with all those wire like one is enought damnn

Take a look at the pictures. The test points are the size of golf balls - anyone could solder the wires onto these boards. It's really not that hard.

What I'm interested about is if there's a way to somehow toggle WE to be in "high speed" mode to allow faster write access. The test points seem to be there for some sort of bed of nails ISP..but that's just a guess.

adrianc - 07-27-2011, 12:33 AM
- Reply
Originally Posted by themuse

in response to people saying that there wont be a 3.66 cfw or that it is not possible for there to be a new cfw over 3.60 ,
but it should still be posible for users that are still on 3.55 or below right? just not over where the private key signing was fixed by $ony right?which version did sony fix the bug in? so anyone who has updated pats that version will have rely on a perconsole key to get cfe fow 3.56+ and have to compile it themselves with their own individual per console key , unless somone comes up with some noob friendly app to do it ,one app for ps3 to get yur pkc and another one for your pc to compile it into a pup ,or would an app like that not even work in windows if it could even be written?this method looks much harder ,the wires are soldered all over the place on the mobo , atleast the other ones the wires are mostly just soldered right to the nand or nor , with the other hw dg methods there is atleas hope someone will make a clip on for the nand chip to keep the soldering to a minum

There is no possible way to softmod a ps3 updated past 3.55 even with the rootkeys.

-adrianc

themuse - 07-27-2011, 12:42 AM
- Reply
that is what i said isnt it?,that a 3.60+ cfw should be possble for people that are not updatded over which ever version that the bug was patched in ,so if your on 3.55 or below, then a cfw over 3.60 should be possible for those consoles, but not for ones that have been updated, unless you use a per console key exploit like gary said right?you could get a cfw for those if you can somehow get your pck?or no? or a cfw made without your per console key can work on 3.55 and below , but even a per console key wont be able to get a new 3.56+ working cfw for consoles over 3.55 you mean?

adrianc - 07-27-2011, 12:48 AM
- Reply
Originally Posted by themuse

that is what i said isnt it?,that a 3.60+ cfw should be possble for people that are not updatded over which ever version that the bug was patched in ,so if your on 3.55 or below, then a cfw over 3.60 should be possible for those consoles, but not for ones that have been updated, unless you use a per console key exploit like gary said right?you could get a cfw for those if you can somehow get your pck?or no? or a cfw made without your per console key can work on 3.55 and below , but even a per console key wont be able to get a new 3.56+ working cfw for consoles over 3.55 you mean?

No, you cannot create a cfw that will install on 3.56+ consoles. The per console key is used for encrypting/decrypting metldr and bootldr. For the absolute last time, to softmod a ps3 you would need to craft a lv2 exploit and go from there. The per console root key does not enable this,

-adrianc

adrianc - 07-27-2011, 12:48 AM
- Reply
Originally Posted by themuse

that is what i said isnt it?,that a 3.60+ cfw should be possble for people that are not updatded over which ever version that the bug was patched in ,so if your on 3.55 or below, then a cfw over 3.60 should be possible for those consoles, but not for ones that have been updated, unless you use a per console key exploit like gary said right?you could get a cfw for those if you can somehow get your pck?or no? or a cfw made without your per console key can work on 3.55 and below , but even a per console key wont be able to get a new 3.56+ working cfw for consoles over 3.55 you mean?

No, you cannot create a cfw that will install on 3.56+ consoles. The per console key is used for encrypting/decrypting metldr and bootldr. For the absolute last time, to softmod a ps3 you would need to craft a lv2 exploit and go from there. The per console root key does not enable this,

-adrianc

RazorX - 07-27-2011, 02:39 AM
- Reply
i think what he was saying is it should be possible for ppl with consoles that havnt updated past 3.55 but i may be wrong.

failanx - 07-27-2011, 03:48 AM
- Reply
Can we try not acting like dicks today? It's amazing how quickly ten-year-olds are getting computer science/analysis degrees these days...

shadywillie - 07-27-2011, 05:03 AM
- Reply
After soldering the teensy, will you remove it form the console or leave it inside? Because i can see a spot been created for the teensy.

Tranced - 07-27-2011, 08:02 AM
- Reply
Does anyone know what board is in the X3Max dongle?

JudasRein - 07-27-2011, 09:10 AM
- Reply
Originally Posted by alonehacker

Take a look at the pictures. The test points are the size of golf balls - anyone could solder the wires onto these boards. It's really not that hard.

What I'm interested about is if there's a way to somehow toggle WE to be in "high speed" mode to allow faster write access. The test points seem to be there for some sort of bed of nails ISP..but that's just a guess.

I was under the impression that the software is what causes the slow write speeds. That's why he said he might work on that in the future. Well, it's probably the software combined with the fact that the Teensy++ is a pretty cheap board. All in all, I don't really care. I mean, how often will you be flashing the firmware? You don't want to do it too often or your just raising the risk that something goes wrong.

JudasRein - 07-27-2011, 09:16 AM
- Reply
Originally Posted by Tranced

Does anyone know what board is in the X3Max dongle?

Not 100% sure, but it's definitely not a Teensy++. It's definitely possible to do this with almost any dongle, somebody just has to figure out how to wire it up and then write the software. You'll most likely never see it for all but the most popular boards like the Teensy though. I would either find a Teensy or grab an Infectus or something.

Tranced - 07-27-2011, 09:24 AM
- Reply
Originally Posted by JudasRein

Not 100% sure, but it's definitely not a Teensy++. It's definitely possible to do this with almost any dongle, somebody just has to figure out how to wire it up and then write the software. You'll most likely never see it for all but the most popular boards like the Teensy though. I would either find a Teensy or grab an Infectus or something.

Thanks for the reply. I bought the X3Max and then my FW3.15 FAT PS3 died on me just before I got it. Just wanting to find a use for the dongle. And LOL at all the double posts. Maybe it has to do with the page not auto refreshing when clicking the Submit Reply button on the quick reply section which nobody listens to me about. *\cough Webmaster cough/* Which results in people clicking the button repeatedly until giving up and manually refreshing.

Simon66 - 07-27-2011, 09:40 AM

Ok so hold on. Will this work on every PS3?

Code:

   PS3 Fat: 
    CECHA = 256MB 
    CECHB = 256MB 
    CECHC = 256MB 
    CECHE = 256MB 
    CECHG = 256MB 
    CECHH = 16MB 
    CECHJ = 16MB 
    CECHK = 16MB 
    CECHL = 16MB 
    CECHM = 16MB 
    CECHP = 16MB 
    CECHQ = 16MB 
     
    PS3 Slim: 
    CECH-20..A = 16MB 
    CECH-20..B = 16MB 
    CECH-21..A = 16MB 
    CECH-21..B = 16MB 
    CECH-250.A = 16MB 
    CECH-250.B = 16MB 
    CECH-250.A = 16MB 
    CECH-250.B = 16MB 
    CECH-251.A = 16MB 
    CECH-251.B = 16MB

ahou - 07-27-2011, 09:51 AM

Originally Posted by Simon66

Ok so hold on. Will this work on every PS3?

Code:

   PS3 Fat: 
    CECHA = 256MB 
    CECHB = 256MB 
    CECHC = 256MB 
    CECHE = 256MB 
    CECHG = 256MB 
    CECHH = 16MB 
    CECHJ = 16MB 
    CECHK = 16MB 
    CECHL = 16MB 
    CECHM = 16MB 
    CECHP = 16MB 
    CECHQ = 16MB 
     
    PS3 Slim: 
    CECH-20..A = 16MB 
    CECH-20..B = 16MB 
    CECH-21..A = 16MB 
    CECH-21..B = 16MB 
    CECH-250.A = 16MB 
    CECH-250.B = 16MB 
    CECH-250.A = 16MB 
    CECH-250.B = 16MB 
    CECH-251.A = 16MB 
    CECH-251.B = 16MB

Except the CECH A-G, which has a nand, so you'd use infectus for those.