E3

Files @ http://www.ps3devwiki.com/files/flash/Tools/E3/

E3 Flasher

Picture Guide

01- that's all you need from the Limited package
02- Remove the fan screws to detach it from the metal cage
03- cut 2cm from this corner
04- 2cm cut from the corner
05- apply masking tape to protect the CLip Flat cable
06- install the Fan with the bottom metal plate and the heatsink screws
07- don't forget to connect back the FAN plug
08- install everything back into the plastic bottom case
09- now you can access the NOR freely and add manual pressure on the clip while working
10- E3 with clip installed and ready for dumping and flashing
11- E3 board dumping NOR
12- E3 in Action with PS3 idle on XMB

How to

update E3 Flasher

use blank micro SD card and copy this update.bin (Samsung update Multi consoles) on it, then place the micro SD card into the e3 flasher and use the following settings: switches 1 & 2 should be down, switch 3, 4, 5, 6 should be in the up position.(PS3 are "OFF")
while powering PS3 "ON" will begin automatically the process , you will see the light progess on the indicator from 8x OFF to 8x ON blue led. (once finished all 8 blue leds lights)

make a NOR backup

place a blank micro SD card into the e3 flasher and use the following settings: switches 1 & 2 should be down, switch 3 should be in the up position, switches 4, 5 & 6 should also be down.
while in the xmb press the start button on the flasher and backup process will begin, you will see each light progess on the indicator from 0% to 100% percent. (once finished the lights will flash alternatively)

checking the NOR backup for errors

(remove the micro SD card from the flasher and place the card in your pc)

(if you have updated the flasher or recently purchased one you will see three backups on the microSD card bkpps30.bin, bkpps31.bin & bkpps32.bin and the e3flasher text log file)

Bytereverse them with Flowrebuilder and use Validating flash dumps

KEEP THE OTHER BACKUPS SAFE! just incase you do happen to brick your console you might have a chance for recovery..

E3 Nor dump checker

Warning
This tool is known and proven to give false positives on bad dumps that lead to permabricks. Use this method: Validating flash dumps to make sure the dumps are in crisp condition. You cannot recover from bad flash without proper dumps (e.g. bricking the console beyond repair). note: there are 12½ million bits to permabrick a console

E3 Nor Dump Checker V1.0.exe (521.7 KB)
Article: http://www.ps3hax.net/2011/11/released-e3-nor-dump-checker-v1-0-released-tested/

Quick bulletproof test

does not test:

bootldr (corrupted binary not detected)
metldr (corrupted binary not detected)
bootldr size (both under- and oversize not detected)
metldr size (both under- and oversize not detected)
cISD (didn't catch brick-byte error)
cCSD (didn't catch brick-byte error)
trvk_prg0 (didn't catch brick-byte error)
trvk_prg1 (didn't catch brick-byte error)
trvk_pkg0 (didn't catch brick-byte error)
trvk_pkg1 (didn't catch brick-byte error)
eEID (didn't catch brick-byte error)
cvtrm (didn't catch brick-byte error)
CELL_EXTNOR_AREA (didn't catch brick-byte error)

partly test:

ROS0 (but didn't catch brick-byte error)
ROS1 (but didn't catch brick-byte error)

does test:

headerprefix ("00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00")
header ("00 00 00 00 AC 0F FF E0 00 00 00 00 AD DE EF BE")
header ("FI.I")
headersuffix "(FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF")
filetable ("saceru_eoldare.." etc.)

Conclusion : USELESS, brickdumps will still show as 'valid'.

Recommendation: use Flowrebuilder instead and common sense like mentioned on Hardware flashing page.

Added 22 nov 2011

  New E3 flasher update released, it will backup bios 3 times automatically.
  We suggest user verify those bios with E3 Nor dump checker, to assure the backup bios is no erro.

Conclusion: Anyone with a flasher (should) know that you can dump it 1 to 1000's times the same bad. Comparing CRC/MD5/SHA1 is not any secure way to validate flash (as mentioned on Hardware flashing). Letting the dumper do it x times, only gives endusers/customers a false sense of reassurance, always a bad idea.

Downgrade

Normal E3 downgrade Process

1. place the e3_downgrade.bin and the bkpps3.bin you made on a micro SD Card.

2. switches 1, 2, 3, 4, 5 should be down and switch 6 (lock/unlock) should be in the up position. while in the xmb press start on the flasher and the programming process will begin you will see each light progess on the indicator from 0% to 100% percent. (once finished the lights will flash alternatively)

3. reboot the console and you should see the connect controller using a USB cable screen (if the console just booted back into the xmb you need to manually patch the backup See. Manual E3 downgrade below)

4. assuming the process was sucessful and you see the connect controller screen switch off the console from the back of the playstation using the switch provided with the e3 kit and place your USB downgrade jig in the port closest to the flasher.

5. switch the console back on using the switch provided then quickly press the power and eject button if sucessful the console should power off automatically. (if not repeat the process)

6. copy the Lv2diag.self (File1) & PS3UPDAT.PUP (Rogero CFW V3.1) from step 1 downgrade files onto a usb and place the usb in the same port you used for the downgrade jig (closest to the flasher) turn on the console and the downgrade process should begin. once finnished the console will turn off automatically

7. next copy the Lv2diag.self (File2) onto the usb and place the usb in the same port you used in the last process switch on the console and it should switch off automatically after a few seconds.

8. power the console back on and you should see the connect the controller screen follow the onscreen instructions.

Flash Fun downgrade Process

NO SOLDERING NEEDED !!!

1. place the (patched) bkpps3.bin you made on a micro SD Card.

2. switches 2, 3, 4, 5, 6 should be down and switch 1 (Flash Fun) should be in the up position. (100000) There will be a blackscreen when you start your system, dont worry it is normal. Press start on the flasher and the programming process will begin you will see each light progress on the indicator from 0% to 100% percent. (once finished the lights will flash alternatively)

3. switch off the console from the back of the playstation using the switch provided with the e3 kit and place your USB downgrade jig in the port closest to the flasher.

4. switch the console back on using the switch provided then quickly press the power and eject button if sucessfull the console should power off automatically. (if not repeat the process)

5. copy the Lv2diag.self (File1) & PS3UPDAT.PUP (Rogero CFW V3.1) from step 1 downgrade files onto a usb and place the usb in the same port you used for the downgrade jig (closest to the flasher) turn on the console and the downgrade process should begin. once finnished the console will turn off automatically

6. next copy the Lv2diag.self (File2) onto the usb and place the usb in the same port you used in the last process switch on the console and it should switch off automatically after a few seconds.

7. power the console back on and you should see the connect the controller screen follow the onscreen instructions.

Manual E3 downgrade v2

E3 dumps are byte reversed, and so must our patches (otherwise we have to reverse, paste the v2 in the REV, reverse back again - using byte reversed patches shortcuts that 'reversing confusion' :P)

Dump the flash with the E3, you will end up with a .bin file (e.g. bkpps3.bin)

Patches to insert for v2 downgrade

Flowrebuilder : E3 autopatcher

http://www.ps3devwiki.com/files/flash/patches/E3%20downgrade/

target area	patch no.	NOR Offset	Paste length	Remarks
ROS0	patch1.REV (7 MB)	0x0C0010	0x6FFFE0	version string 3.55
ROS1	patch1.REV (7 MB)	0x7C0010	0x6FFFE0	same as patch1.REV
trvk_prg0 (0x40000) trvk_prg1 (0x60000) trvk_pkg0 (0x80000) trvk_pkg1 (0xA0000)	rvk-040000.REV (512 KB)	0x40000	0x80000	one big patch overlapping several area's

(above patches in a single package + autopatcher file: E3%20downgrade.rar)

Using autopatcher from Flow Rebuilder:

select "PATCH a Byte reversed NOR dump or an interleaved and unscrambled NAND dump."
Select as Input Dump File the unmodified dump (AC 0F FF E0 / AD DE EF BE)
Select as Patch file: E3-downgrader\progskeet_patch.txt

Use the patched file to flash the ps3. Afterwards, use RogeroV3.1, or any prepatched PUP that has the lv1/hypervisor syscon hashchecks patched out - or use the TCL from the talk/discussion page to patch one yourself) and reinstall the firmware in service mode like any V2 downgrade.

Note: If you wish to extract an E3 dump: Flowrebuilder can bytereverse and extract the NOR dump for you.

To flash a manually patched backup put all the switches on the flasher down and press start while in the XMB

E3 debricking

Requires soldering wire from SBE (solderpad on NOR flatcable) to TRISTATE (NORpoint on PS3 motherboard)
Make sure you have correct firmware on SD/TF card
E3 switches set as 1:Flash fun, 2: OFW, 3: Prog, 4: microSD, 5: PS3 Flash, 6: Lock with the console power disconnected.
Turn on console to restore (progress LEDs will light up one by one and blink if successfully).
Unplug powercable and set 1:Flash fun down to PS3 Mode and turn on the PS3, if everything went fine, it will now be debricked (remember: in case syscon has 3.56+ hashes, you need prepatched LV1, see downgrader guides).

English-E3 FLASHER repair method if console bricked.pdf (424.95 KB)

User experiences

From my experience soldering a wire to the nor tristate point did nothing, try this method instead. Manually patch your nor backup. Place the patced backup and the e3_downgrade.bin file onto the SD card then put all the switches on the flasher down and hold start and turn on the console. If the console stays on and the flashing process begins when completed after rebooting the console should boot normally on the firmware you were trying to install, if you see two blue flashing lights and the console just turns off try this.. all switches down except the 6th one (lock/unlock) hold start on the flasher and turn on the console providing that the console stays on once finished flashing DO NOT TURN THE CONSOLE OFF instead put the last switch down and press start again. once finished reboot and hopefully the console should be back to life.

Edit: Soldering SBE to the Nor Tristate is important, so your PS3 will stay "on" in Flash Fun Mode even when bricked

Error Codes

E3 Flasher Frontpanel

LED Error

number 1 stands for LED Blinking
number 0 stands for LED OFF

Error Codes	Meaning	Remarks
10000100	Failed to initialize NOR in E3	Check pads / clip at E3 board check may not be properly seated
10000101	Failed to read NOR in E3	Check pads / clip at E3 board check may not be properly seated
10000110	Failed to erase NOR in E3	Check pads / clip at E3 board check may not be properly seated
10000111	Failed to write NOR in E3	Check pads / clip at E3 board check may not be properly seated
10001100	Failed to initialize PS3 BIOS	Check pads / clip at PS3 board check may not be properly seated
10001101	Failed to read PS3 BIOS	Check pads / clip at PS3 board check may not be properly seated
10001110	Failed to erase PS3 BIOS	Check pads / clip at PS3 board check may not be properly seated
10001111	Failed to write PS3 BIOS	Check pads / clip at PS3 board check may not be properly seated
01000000	Failed to initialize TF card	SD card not seated properly
01001000	Failed to open TF card	SD card not seated properly
01000100	Failed to read files in TF card	SD card not seated properly
01001100	Failed to write files to TF card	SD card not seated properly
11000000	Wrong settings of switches	Check toggle switch - wrong setting
11001000	Wrong PS3 version, not supported at present	Metldr.2 model undowngradable
11000100	Not the right PS3 for this backup	Already used e3flasher on 1 console
11001100	Wrong function settings	Check toggle switch - wrong setting
11000010	PS3 is operating NOR, E3 Flasher cannot operate at the same time	Check toggle switch - wrong setting

Problem state 1

10000100 - E3 can not initialize PS3 Nor Chip
10001100 - Error initializing the PS3 BIOS
10001101 - Error while reading PS3 BIOS
10001111 - Error writing PS3 BIOS

Problem: bad solder points / E3 Nor Clip does not work right with Ps3 Nor

solution:

check solder points (resolder)
Fat PS3 only: refit the Nor Clip by smoothing it down with a little screwdriver / sandpaper
clean contacts on Nor and E3 Clip with Isopropylalkohol 70% -
use pads or cardboard to press down Nor clip

Notes:

dont use to much pressure on the Nor because you will destroy the solder balls of your southbridge and damage your system ..
dont glue the inside of the clip to the nor chip

Problem state 2

10000101 - Reading error (E3 Nor)
10000111 - Error writing E3 Nor
10000110 - Error deleting data on E3 Nor
10001110 - Error erasing PS3 BIOS

Problem: faulty solder points / E3 Nor Clip does not work right with Ps3 Nor / E3 Nor bricked

solution:

check solder points
clean contacts on Nor and E3 Clip with Isopropylalkohol 70%
use pads or cardboard to press down Nor Clip
reset E3 flasher while system is running (little red button on the upper side of the flasher / NOT little red button on front panel under Esata !!)

Notes:

dont use to much pressure on the Nor because you will destroy the solder balls of your southbridge and damage your system ..
dont glue the inside of the clip to the nor chip

Problem state 3

01000000 - Error initializing TF /SD card
01001000 - Error opening data from SD/TF card
01001100 - Error writing data from SD/TF card

solution:

check if TF/SD Card is sitting accurate
Format your SD/TF Card to FAT 32
Rename your backup bkpps3 for writing to PS3 NOR / bkpe3 for writing to E3 NOR

Problem state 4

11000000 - Wrong position of switches (the action you selected is not possible)
11001100 - Wrong position of switches (the action you selected is not possible)
11000010 - PS3 is using NOR / you cant use E3 Flasher at the same time

solution:

change position of switches

Problem state 5

11001000 - Wrong PS3 Version / Not supported PS3 Version (Nand / Metldr2)

Solution:

Buy a progskeet for nand :)

Problem state 6

11000100 - corrupt backup of PS3 data

Solution:

check backup for errors (flowrebuilder etc) / make a new clean dump

Problem other frequent problems and solutions

HDD in Esata Station cant be found

restrip contacts on the backside of the E3 Flasher (they must not touch the metal casing)
they have to be isolated very good .. they are very sensitive and cause a lot of errors
check Esata cable ..

Blackscreen with no hdd activity and only hard reset possible (no brick)

resolder SBCE -> A / cut A/B properly
restrip contacts on the backside of the E3 Flasher (they must not touch the metal casing) they have to be isolated very good .. they are very sensitive and cause a lot of errors
3.55 ONLY: use the rsod/brickfix lv2diag in Service Mode (helped my system a lot .. it booted to blackscreen 8/10 times; after using lv2diag 2/10 times)
if using TBv2 please note, that instead of proper security they used loops to protect their product; try reinstalling the FW via recovery mode
also dont use custom boot logos with TBv2 !!
if you have no success with the methods from above solder Tri/SBE and reflash a valid backup via flash fun mode (100000)

ylod behavior (3 beeps and turns off)

There are two possible solutions .. Always try a) first then b)

a) Dualboot only:

Wrong HDD in Esata Station

After downgrading your PS3 you have to install the SAME firmware on BOTH hdds then upgrade one HDD to OFW .. the error will be gone than ..

Example: downgrade to 3.55 kmeaw .. put 3.55 kmeaw on BOTH hdds via Recovery Mode .. then update your OFW HDD to 4.11 OFW ..

b)Brickfix:

well done .. you bricked your PS3 :)

Solder SBE to Tristate .. use Flash Fun Mode (10000000) to reflash the valid back up of the firmware revision you bricked on ..

TrueBlue Dongle not working with dualboot (only red light)

After downgrading your PS3 you have to install the SAME firmware on BOTH hdds then upgrade one HDD to OFW .. the error will be gone then ..

Example: downgrade to 3.55 TBv2 no check .. install 3.55 TBv2 no check on BOTH hdds via Recovery Mode .. then update your OFW HDD to 4.11 OFW ..

No Blue Leds (only red power led)

The Nor Clip is installed the wrong way .. you have to turn it 180° and reinstall it to the NOR ..

The E3 flat cable has to lead away from the flasher NOT in the direction of the flasher ..

Dualboot error: CFW HDD corrupted

After updating your OFW HDD to a higher firmware your CFW HDD gets an error message and needs to be updated too

Solution

Resolder SBCE - A again;
Make sure the cut between A/B is deep enough
First solder then cut the connection between A/B !

solder points (SBE / SBCE) torn off E3 ribbon cable

Solution

use alternate points on backside of E3 flasher

IFI0 Tag missing at offset 200

E3 finishes back up process without error, but Nor Patcher and Flowrebuilder finish with errors (bootloader 0kb/ IFI0 Tag missing at offset 200)

Solution

Format SD Card again (Fat32)
Reinstall and clean the contacts of the nor clip (not pressure issue but contact issue / dust etc.)
clean linker to flatcable on E3 flasher