Manual E3 downgrade v2
E3 dumps are byte reversed, and so must our patches (otherwise we have to reverse, paste the v2 in the REV, reverse back again - using byte reversed patches shortcuts that 'reversing confusion' :P)
Dump the flash with the E3, you will end up with a .bin file (e.g. bkpps3.bin)
Patches to insert for v2 downgrade
Flowrebuilder : E3 autopatcher
http://www.ps3devwiki.com/files/flash/patches/E3%20downgrade/ target area patch no. NOR Offset Paste length Remarks
ROS0 patch1.REV (7 MB) 0x0C0010 0x6FFFE0 version string 3.55
ROS1 patch1.REV (7 MB) 0x7C0010 0x6FFFE0 same as patch1.REV
trvk_prg0 (0x40000)
trvk_prg1 (0x60000)
trvk_pkg0 (0x80000)
trvk_pkg1 (0xA0000) rvk-040000.REV (512 KB) 0x40000 0x80000 one big patch
overlapping several area's
(above patches in a single package + autopatcher file: E3%20downgrade.rar)
Using autopatcher from Flow Rebuilder:
select "PATCH a Byte reversed NOR dump or an interleaved and unscrambled NAND dump."
Select as Input Dump File the unmodified dump (AC 0F FF E0 / AD DE EF BE)
Select as Patch file: E3-downgrader\progskeet_patch.txt
Use the patched file, rename to bkpps3.bin, put on SD and use E3 to flash the ps3. Afterwards, use (prepatched downgrader PUP) - or use the TCL from the talk/discussion page to patch one yourself) and reinstall the firmware in service mode like any V2 downgrade.
Note: If you wish to extract an E3 dump: Flowrebuilder can bytereverse and extract the NOR dump for you.
To flash a manually patched backup put all the switches on the flasher down and press start while in the XMB
E3 debricking
Requires soldering wire from SBE (solderpad on NOR flatcable) to TRISTATE (NORpoint on PS3 motherboard)
Make sure you have correct firmware on SD/TF card
E3 switches set as 1:Flash fun, 2: OFW, 3: Prog, 4: microSD, 5: PS3 Flash, 6: Lock with the console power disconnected.
Turn on console to restore (progress LEDs will light up one by one and blink if successfully).
Unplug powercable and set 1:Flash fun down to PS3 Mode and turn on the PS3, if everything went fine, it will now be debricked (remember: in case syscon has 3.56+ hashes, you need prepatched LV1, see downgrader guides).
English-E3 FLASHER repair method if console bricked.pdf (424.95 KB)
User experiences
From my experience soldering a wire to the nor tristate point did nothing, try this method instead. Manually patch your nor backup. Place the patched backup and the e3_downgrade.bin file onto the SD card then put all the switches on the flasher down and hold start and turn on the console. If the console stays on and the flashing process begins when completed after rebooting the console should boot normally on the firmware you were trying to install, if you see two blue flashing lights and the console just turns off try this.. all switches down except the 6th one (lock/unlock) hold start on the flasher and turn on the console providing that the console stays on once finished flashing DO NOT TURN THE CONSOLE OFF instead put the last switch down and press start again. once finished reboot and hopefully the console should be back to life.
Edit: Soldering SBE to the Nor Tristate is important, so your PS3 will stay "on" in Flash Fun Mode even when bricked