[PS3-Tutorial] Конвертация Retail консоли в Debug (CEX to DEX) v2.1

c2d.exe (win32 app) ===================

Requires:

* OpenSSL 1.0.1 installed in c:\openssl or d:\openssl (http://slproweb.com/download/Win32OpenSSL_Light-1_0_1c.exe) * EID root key (per_console_key) obtained with metldrpwn (48 bytes or full 256KB) * PS3 (16MB NOR or 256MB NAND) flash dump * Extract c2d.rar in a local folder (c:\c2d or d:\c2d)

Purpose:

* Allows changing the Region / TargetID of your PS3 system * Allows "converting" any Retail PS3 into Debug unit (target_id 0x82) * Allows "converting" a Retail PS3 from one region to another (i.e. EUR PS3 -> JAP PS3, USA PS3 -> RUSSIAN PS3) Changing a Retail PS3 region unlocks playback for region-locked DVD/Blu-ray movies and PS1/PS3 games

* WARNING: For best results flash the output NOR file with a tool which rewrites *ONLY the EID0 sector* (NOR : one sector / 512 bytes @ sector #376 / 0x178; NOR file offset 0x2f000-0x2f1ff). (NAND: one sector / 512 bytes @ sector #516 / 0x204; NAND file offset 0x40800-0x409ff). Flashing the whole 16MB NOR / 256MB NAND is not needed and can easily brick the PS3.

TIPS:

* Use your original NOR flash to create new files for different regions for your PS3 to have them handy later: For example you can have (each file is 16MB): my-slim-JAP.EID0.NORBIN my-slim-EUR.EID0.NORBIN my-slim-USA.EID0.NORBIN my-slim-DEX.EID0.NORBIN

For NAND PS3 you will have similar files using your original NAND flash (each file is 240MB / 251 396 096 bytes): my-fat-JAP.EID0.NANDBIN my-fat-EUR.EID0.NANDBIN my-fat-USA.EID0.NANDBIN my-fat-DEX.EID0.NANDBIN

* Using a proper tool you can switch regions in one second when needed

PROTIPS:

* The latest online update of multiMAN handles writing to: - NOR in the right fashion (1 sector) from .EID0.NORBIN files. - NAND in the right fashion (1 sector) from .EID0.NANDBIN files.

* To dump NAND/NOR: mmOS->Select any file->Open in HEX viewer->[SELECT]->[START]->DUMP LV2(NO)->DUMP LV1(NO)->DUMP FLASH(YES) * To write NOR EID0 sector: mmOS->Double-click on a .EID0.NORBIN 16MB full NOR dump file->Follow the on-screen instructions->Reboot. * To write NAND EID0 sector: mmOS->Double-click on a .EID0.NANDBIN 240MB full NAND dump file->Follow the on-screen instructions->Reboot.

Usage:

c2d - Changes REGION/TARGET_ID in PS3 NOR/NAND flash Usage: c2d.exe eid_key_file.bin in_flash.bin out_flash.bin [target_id] [target_id]: 82..8E 82 (DEX/DEBUG) (default) 83 (JAPAN) 84 (USA/CANADA) 85 (EUROPE) 86 (KOREA) 87 (UK) 88 (MEXICO) 89 (AUSTRALIA/NZ) 8A (SE ASIA) 8B (TAIWAN) 8C (RUSIA/ASIA) 8D (CHINA) 8E (HONG KONG)

Output:

c:\c2d> c2d.exe eid_root_key.bin flashCEX.bin flashDEX.bin 82

EID key : 48 bytes (eid_root_key.bin) Flash size : 16 MB (flashCEX.bin) Target ID : $85

EID ROOT KEY: 64D20967DEACDA16ACADBE289B0EE2C25EE77331A5040C5DC9DF67B3FE574F6D EID ROOT IV : 6BD7C324D3B213A647DC31987345595E

EID0 KEY : 9C1C4A93666EF67941F54679A7199D7553C8F0F50F3548C8966D6872FC8CD668 EID0 IV : 2DC374E270F851EB0D524F89790F2563

EID0 SEC KEY: 4C40F3E244EF2BF29A9D48BE26FEEEEB

Target ID : $85 (from decrypted EID0 section) New TargetID: $82 (for modified flash)

CMAC HASH : F1053CC3818DD6CE2775F0273DFC212E

Writing modified flash with TargetID: $82 (flashDEX.bin)... Done!

Enjoy! andbey0nd