Downgrade BluRay Playback Issue: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
mNo edit summary
m (Text replacement - "http://web.archive.org/web→‎/http://ps3devwiki.com/files" to "https://web.archive.org/web/: http://ps3devwiki.com/files")
 
(6 intermediate revisions by 2 users not shown)
Line 5: Line 5:
First, check [[Downgrade BluRay Playback Issue#FIX - " playback of bds is prohibited on this system. "|FIX - " playback of bds is prohibited on this system. "]] for easier methods to correct the issue.
First, check [[Downgrade BluRay Playback Issue#FIX - " playback of bds is prohibited on this system. "|FIX - " playback of bds is prohibited on this system. "]] for easier methods to correct the issue.


Linux methods: If those fail, try Glevands method in Linux to check for mismatches.  If it's not a mismatch then check the original but drastic method by nikitis using [[Downgrade BluRay Playback Issue#The nikitis method|The nikitis method]] for Full Factory Reset via Linux.
Linux methods: If those fail, try Glevands method in Linux [[Fixing DRL and CRL Hashes]] to check for mismatches.  If it's not a mismatch then check the original but drastic method by nikitis using [[Downgrade BluRay Playback Issue#The nikitis method|The nikitis method]] for Full Factory Reset via Linux.




Line 18: Line 18:


Reason 1:
Reason 1:
There was a foul up with the implementation of the Sony blu-ray CSS copy protection system and some incorrect values got stored onto your blu-ray drive that was a mismatch of what your drive is aware of, so it fails to play assuming you might have tampered with your drive.  To prevent possibly hacking attempts to copy movies from the disc to a digital medium it was designed to prevent playback.
There was a foul up with the implementation of the Sony blu-ray CSS copy protection system and some incorrect values got stored onto your blu-ray drive that was a mismatch of what your drive is aware of, so if it fails to play, it may be assuming you might have tampered with your drive.  To prevent possible hacking attempts to copy movies from the disc to a digital medium it was designed to prevent playback.


Reason 2:
Reason 2:
It was intentional by Sony as a security mechanism to add your console id to CRL/DRL list when an MKB.ini file is read from a blu-ray disc.  Sony's system of updating blu-ray drives with known compromised drives/consoles is done by obtaining the console id somehow (using hacked system on PSN for example), they copy your console id and add it to the next version of the CRL/DRL.  You go to the store, and buy said movie containing updated mkb.ini file, insert it into your blu-ray drive with nice warm popcorn in hand, girlfriend (or boyfriend, we don't discriminate here) is sitting next to you ready to relaxe and get the error.  Movie night is ruined :(  Your console id actually matches what is on the CRL/DRL and is blocked.  What's worse is Sony will ask you to send the console in to be fixed, charge you $150, and will send you a new system instead without any of your saved games / data.  
It was intentional by Sony as a security mechanism to add your console id to CRL/DRL list when an MKB.ini file is read from a blu-ray disc.  Sony's system of updating blu-ray drives with known compromised drives/consoles is done by obtaining the console id somehow (using hacked system on PSN for example), they copy your console id and add it to the next version of the CRL/DRL.  You go to the store, and buy said movie containing updated mkb.ini file, insert it into your blu-ray drive with nice warm popcorn in hand, girlfriend (or boyfriend, we don't discriminate here) is sitting next to you ready to relax and get the error.  Movie night is ruined :(  Your console id actually matches what is on the CRL/DRL and is blocked.  What's worse is Sony will ask you to send the console in to be fixed, charge you $150, and will send you a new system instead without any of your saved games / data.  


Solution:
Solution:
Line 325: Line 325:


==== DRL Tools ====
==== DRL Tools ====
[http://www.ps3devwiki.com/files/devtools/DRLtools/DRLtools_0.90.rar DRLtools_0.90.rar]
[https://web.archive.org/web/*/http://ps3devwiki.com/files/devtools/DRLtools/DRLtools_0.90.rar DRLtools_0.90.rar]


The tools in the suite are:
The tools in the suite are:
* [http://www.ps3devwiki.com/files/devtools/DRLtools/DRLtools_0.90/DRLbackup_PS3_0.90.pkg DRLbackup_PS3_0.90.pkg] (used to backup DRL1 / DRL2 files to a USB drive)
* [https://web.archive.org/web/*/http://ps3devwiki.com/files/devtools/DRLtools/DRLtools_0.90/DRLbackup_PS3_0.90.pkg DRLbackup_PS3_0.90.pkg] (used to backup DRL1 / DRL2 files to a USB drive)
* [http://www.ps3devwiki.com/files/devtools/DRLtools/DRLtools_0.90/DRLgen_WIN_setup_0.90.exe DRLgen_WIN_setup_0.90.exe] (Windows .net 2.0 application to derive DRL1 / DRL2 files from an MKB_RO.inf file)
* [https://web.archive.org/web/*/http://ps3devwiki.com/files/devtools/DRLtools/DRLtools_0.90/DRLgen_WIN_setup_0.90.exe DRLgen_WIN_setup_0.90.exe] (Windows .net 2.0 application to derive DRL1 / DRL2 files from an MKB_RO.inf file)
* [http://www.ps3devwiki.com/files/devtools/DRLtools/DRLtools_0.90/DRLcopy_PS3_0.90.pkg DRLcopy_PS3_0.90.pkg] (to restore previously backed-up DRL1 / DRL2 files or to copy derived DRL1 / DRL2 files from DRLgen)
* [https://web.archive.org/web/*/http://ps3devwiki.com/files/devtools/DRLtools/DRLtools_0.90/DRLcopy_PS3_0.90.pkg DRLcopy_PS3_0.90.pkg] (to restore previously backed-up DRL1 / DRL2 files or to copy derived DRL1 / DRL2 files from DRLgen)


DRLGen Source: <span style="text-decoration: line-through;">[http://www.multiupload.com/QX8EDV4NTC DRLGen.rar (4.53 MB)]</span>
DRLGen Source: <span style="text-decoration: line-through;">[http://www.multiupload.com/QX8EDV4NTC DRLGen.rar (4.53 MB)]</span>

Latest revision as of 06:09, 17 April 2023

This page was created originally by nikitis with other contributors with other fixes and have been included in the correct order one should try to fix the issue.

There was some confusion on methods to fix and reasons why the issue occurred. It's been 11 years since last edit, and we have a little more clarity on the issue and why it occurs, see Overview for an update on findings.

First, check FIX - " playback of bds is prohibited on this system. " for easier methods to correct the issue.

Linux methods: If those fail, try Glevands method in Linux Fixing DRL and CRL Hashes to check for mismatches. If it's not a mismatch then check the original but drastic method by nikitis using The nikitis method for Full Factory Reset via Linux.


  • Updated on 01-31-2023

PS3 BLU-RAY PLAYBACK PROHIBITED ROOT CAUSE ANALYSIS[edit | edit source]

Introduction[edit | edit source]

Many users have experienced the loss of blu-ray playback on the PS3 after performing a system firmware downgrade to a previous version. Little was known about the cause of this prohibition early on, but this document will outline the causes and effects.

Overview[edit | edit source]

By the end of this document you will know the issue, the causes, and what is affected. The reason this occurs is for 1 of 2 reasons.

Reason 1: There was a foul up with the implementation of the Sony blu-ray CSS copy protection system and some incorrect values got stored onto your blu-ray drive that was a mismatch of what your drive is aware of, so if it fails to play, it may be assuming you might have tampered with your drive. To prevent possible hacking attempts to copy movies from the disc to a digital medium it was designed to prevent playback.

Reason 2: It was intentional by Sony as a security mechanism to add your console id to CRL/DRL list when an MKB.ini file is read from a blu-ray disc. Sony's system of updating blu-ray drives with known compromised drives/consoles is done by obtaining the console id somehow (using hacked system on PSN for example), they copy your console id and add it to the next version of the CRL/DRL. You go to the store, and buy said movie containing updated mkb.ini file, insert it into your blu-ray drive with nice warm popcorn in hand, girlfriend (or boyfriend, we don't discriminate here) is sitting next to you ready to relax and get the error. Movie night is ruined :( Your console id actually matches what is on the CRL/DRL and is blocked. What's worse is Sony will ask you to send the console in to be fixed, charge you $150, and will send you a new system instead without any of your saved games / data.

Solution: You can unbrick with methods below, and it's intense, however you will only be able to play movies with a lower MKB.ini version because any newer movie with an updated MKB.ini version will contain your console id if it was bricked for Reason 2. You'll know this is the case if you do the fix, and enter an early blu-ray movie and it plays fine, but insert your latest movie, and it bricks again. If it doesn't brick again, then it was Reason 1, and you should have no further issue playing movies in the future unless the same "technical glitch" happens again down the road, but likely will not.

Reproducing Issue[edit | edit source]

To reproduce the issue a few pre-requisites must be met:


Pre-requisites for Issue[edit | edit source]

  1. Service JIG device
    1. PSGrade
  2. Lv2diag.self (stage 1)
    1. DGF.rar archive "File 1"
  3. Lv2diag.self (stage 2)
    1. DGF.rar archive "File 2"
  4. PS3UPDAT.PUP
    1. 3.15 version is best
    2. 3.41 modified version in the DGF.rar is not recommended but is not at issue
  5. PS3 with large NAND (fat models CECHA-CECHG)
    1. Keep in mind there are CECHG systems with small NOR non-volatile memory that rely on HDD volatile memory for dev_flash3 and are unaffected
  6. USB flash device
    1. Any freshly-formatted (BLANK) usb-based flash drive can be utilized


Steps to Reproduce Issue[edit | edit source]

Steps required to reproduce the issue is the same methodology used to downgrade.

  1. Insert service jig
    1. Use the right-most port closest to the blu-ray drive
  2. jailbreak power sequence
    1. Power then eject within 200 milliseconds
  3. power off via XMB
    1. System will boot and toggle service-mode
    2. Shutdown properly
  4. remove service jig
  5. insert flash drive
    1. Be sure the flash drive has only these 2 files
      1. Lv2diag.self
      2. PS3UPDAT.PUP
  6. power on PS3 normally
    1. No need for the jailbreak sequence
  7. once shutdown remove flash drive
    1. PS3 will load the Lv2diag.self
      1. Create non-volatile memory storage regions (partitions)
      2. Format non-volatile memory partitions
      3. Install update_files from PS3UPDAT.PUP
      4. Update blu-ray revoke list
      5. Write DRL1 and DRL2
      6. Adjust blu-ray drive firmware
      7. UPDATE_LOG.TXT is left behind outlining what was done
  8. insert flash drive with stage 2 Lv2diag.self
    1. PS3 will load the Lv2diag.self
      1. Lv2diag.self will toggle off service mode
  9. power on ps3 normally
    1. unknown additional settings in this reboot
  10. will shutdown automatically
    1. downgrade is now completed
  11. remove flash drive
  12. power on ps3 normally
    1. no jailbreak sequence or dongles
  13. setup ps3, verify firmware version
    1. As a result of the non-volatile memory being created anew, all system settings stored in flash are wiped out
  14. power off ps3 via XMB, then remove power completely
  15. insert jailbreak device
  16. power on ps3
  17. verify DRL1/DRL2
    1. Use DRLinfo (releasing for PS3 soon)


Analyzing UPDATE_LOG.TXT[edit | edit source]

An analysis of the UPDATE_LOG.TXT follows:

manufacturing updating start
PackageName = /dev_usb000/PS3UPDAT.PUP
settle polling interval success
vflash is disabled...
boot from nand flash...

The PS3UPDAT.PUP file was found on the usb-based device, and "vflash" (virtual flash) is disabled because the device uses real "flash".

creating flash regions...
create storage region: (region id = 2)
format partition: (region_id = 2, CELL_FS_IOS:BUILTIN_FLSH1, CELL_FS_FAT)
create storage region: (region id = 3)
format partition: (region_id = 3, CELL_FS_IOS:BUILTIN_FLSH2, CELL_FS_FAT)
create storage region: (region id = 4)
format partition: (region_id = 4, CELL_FS_IOS:BUILTIN_FLSH3, CELL_FS_FAT)
create storage region: (region id = 5)
create storage region: (region id = 6)

All non-volatile memory regions have been created, if they had previously existed with data that data is gone.

Initializing
taking a while...
start Updating Proccess
Initialize elapsed time = 58 msec
check UPL
Check UPL elapsed time = 51 msec
check Package Size
get package size elapsed time = 8 msec
start Updating Package
Update packages num = 30
Update packages total size = 162260220

30 packages included for updating in the update_files.tar archive in the PS3UPDAT.PUP

Update Package Revoke list
read package revoke list package (576 bytes) elapsed = 22 msec
update package revoke list elapsed = 107 msec
Update Package Revoke list done(0x8002f000)

Package revoke list has been updated

Update Core OS Package
read core os package (5182047 bytes) elapsed = 305 msec
update core os package elapsed = 1806 msec
Update Core OS Package done(0x8002f000)

Core OS package has been installed and compared

Update VSH Package
sys_memory_container_create() success(id = 0xc0effffe)
Update VSH's package : 1/22
read vsh package (1847 bytes) elapsed = 9 msec
decrypt and verify vsh package elapsed = 26 msec
write vsh package elapsed = 8953 msec
compare vsh package elapsed = 0 msec
...
Update VSH's package : 22/22
read vsh package (5315230 bytes) elapsed = 329 msec
decrypt and verify vsh package elapsed = 223 msec
write vsh package elapsed = 1955 msec
compare vsh package elapsed = 381 msec
Update VSH Package done(0x8002f000)

VSH packages have been installed and compared

Bul-ray Disc Player Revoke
read bdp revoke package (1905 bytes) elapsed = 24 msec
decrypt and verify bdp revoke package elapsed = 33 msec
write bdp revoke package elapsed = 2747 msec
compare bdprevoke package elapsed = 58 msec
Bul-ray Disc Player Revoke done(0x8002f000)

Bul-ray (sic) disc player revoke package installed and compared

Update Program Revoke list
read program revoke list package (736 bytes) elapsed = 23 msec
update program revoke list elapsed = 317 msec
Update Program Revoke list done(0x8002f000)

Program revoke list updated

move_2block_status_into_the_region(): region id = 3

??? unknown

rewrite_region() region id = 0x3, start_lba = 0x0, end_lba = 0x4000
rewrite region done (ret = 0x8002f000)
rewrite region elapsed time = 1103 msec

DRL1 has been written

touch_1st_sector_in_block() region id = 0x3, start_lba = 0x0, end_lba = 0x4000
touch_1st_sector() done (ret = 0x8002f000)
touch_1st_sector() elapsed time = 1422 msec

??? unknown, perhaps verification of write

rewrite_region() region id = 0x3, start_lba = 0x0, end_lba = 0x4000
rewrite region done (ret = 0x8002f000)
rewrite region elapsed time = 1103 msec

DRL2 has been written

Update BD firmware
read BD firmware package (1966992 bytes) elapsed = 120 msec
update BD firmware elapsed = 186 msec
...
read BD firmware package (1639296 bytes) elapsed = 102 msec
update BD firmware elapsed = 153 msec
Update BD firmware done(0x8002f000)

Drive firmware has been updated

Update Multi-Card controller firmware
read MCC package (28636 bytes) elapsed = 24 msec
update MCC elapsed = 28 msec
Update Multi-Card controller firmware done(0x8002f000)

MC firmware has been updated

Update BlueTooth firmware
read BT package (644322 bytes) elapsed = 44 msec
update BT elapsed = 59 msec
Update BlueTooth firmware done(0x8002f000)

BT firmware has been updated

Update System controller firmware
read SC patch package (4864 bytes) elapsed = 23 msec
read SC patch package (4864 bytes) elapsed = 22 msec
read SC patch package (4864 bytes) elapsed = 22 msec
Update System controller firmware done(0x8002f000)

SC firmware has been updated

update package elapsed time = 262119 msec
post processiong...
post processiong done
cleanup update status (ret = 0)

Post processing and cleanup

os version = 03.4100
build_version = 45039,20100721
region of core os package = 0x40000000
build_target = CEX-ww
build target id = 0x83
manufacturing updating SUCCESS(0x8002f000)
set product mode (ret = 0)
Total Elapsed time = 264647 msec

Details of the system downgraded


Restoring Service[edit | edit source]

There are two different methods of restoring service as it was from backup, real backup, and derived backup. The two methods only differ in the origination of the backup files to be utilized, both methods ultimately will utilize the same files.
Backup
Playback is easily restored by copying a current backup (current in this case means no new MKB has been loaded by the drive since the backup was created) of DRL1 and DRL2 to /dev_flash3/data-revoke/drl directory.
Derived backup
When a current backup (current in this case means no new MKB has been loaded by the drive since the backup was created) is not available it is possible to derive the DRL1 and DRL2 files from the AACS protected title that was used by the system to create the DRL1 and DRL2 files.
This method requires precise knowledge of the following:
  • all blu-ray titles the drive has loaded
  • the order they were loaded
  • MKB versions of each disc loaded
If the above conditions have been met, deriving the DRL1 and DRL2 files only requires the MKB, which is stored as /AACS/MKB_RO.inf on the AACS protected blu-ray disc.
Link to DRLgen instructions here.


Fixing[edit | edit source]

With the root cause of the issue understood, potential methods of fixing the issue can be brain stormed and the original source of the issue can be outright blamed.

The following fixes have been postulated:

  1. Fix the Lv2diag.self
    1. The Lv2diag.self (stage 1) file in the DGF.rar is a manufacturing service tool, and assumes the non-volatile memory either does not exist or has been corrupted beyond repair. Of the first steps it performs is the creation and formatting of all storage regions, dev_flash, dev_flash2, and dev_flash3.
  2. Patch the blu-ray player to not perform the HRL <--> DRL sanity check
    1. Before the AACS drive-host authentication begins (reading the MKB version to determine if it is newer) the player performs a sanity check to determine if the DRL and HRL are a matched set.
    2. If the DRL and HRL are not a matched set playback is prohibited
    3. If the "drl" directory (and therefore DRL1 and DRL2) or DRL1 or DRL2 are not found the error message (8002???) indicates playback is not possible
  3. Reset the HRL on the drive to match the DRL1 and DRL2 files
    1. This third Lv2diag.self should have been included in the DGF.rar package by the original creators to prevent this whole issue.
  4. Having a BluRay Movie Title next to you
    1. Enter Factory Service Mode and insert the BluRay Movie Title. It should now get recognized and you can leave FSM again.

DRL Tools[edit | edit source]

DRLtools_0.90.rar

The tools in the suite are:

DRLGen Source: DRLGen.rar (4.53 MB)

How it works[edit | edit source]

Each Blu-Ray movie contains a Media Key Block (MKB) as part of its copy protection scheme. Newer movies feature higher MKBs; the latest one is MKB v20. Addtionally, each BD movie has a unique encrypted title key. Both are stored inside the AACS/MKB_RO.inf file of each disc. Fixing BD playback requires exact knowledge of which was the first instance of the highest MKB played so far. DRLgen can be used to identify the Blu-Ray movie with the highest MKB, and then create replacement DRL1/2 files for your PS3 which then restore BD playback.

Requirements[edit | edit source]
  1. A means to access Blu-Ray title discs to gather the AACS/MKB_RO.inf file, a Blu-Ray drive in a Mac / Windows PC makes the process easiest. Alternatively, SAK v1.0 can be installed as an OtherOS on the PS3 with firmware 3.15 or lower to accomplish this task.
  2. Explicit knowledge of EVERY blu-ray title the blu-ray drive has played and the MKB versions of those discs. WARNING: While you can safely check every BD's MKB with DRLgen, you should limit the number of attempts of installing DRLs on the PS3, as the full details of the AACS "traitor tracking system" are not well known.
  3. A FAT32 USB storage device to store and retrieve MKB_RO.inf and DRL files.
Detailed instructions[edit | edit source]

Full instructions are(sic: was?) available on the Project #PS3bluray wiki http://ps3bluray.info/?title=DRLtools

About the tools[edit | edit source]
DRLgen[edit | edit source]

DRLgen is a new and SAFER utility that uses the MKB_RO.inf from a Blu-Ray disc to derive correctly formatted DRL1 and DRL2 files easily every time. No difficult hex editing or byte-counting is involved. It is important to note that DRLgen uses the AACS' specification for the MKB format and does not simply assume DRL records start at a specific position and are of a specific length. The previously leaked information makes all these assumptions and is flat out INCORRECT in many situations today, and is NOT future proof and could lead to permanently broken playback.

DRLbackup[edit | edit source]

DRLbackup previously released, has been updated to work in cooperation with the other two tools. As a best practice, a backup of the DRL1 / DRL2 files should be made prior to any system downgrade. Use in conjunction with DRLcopy for a completely recreatable process to downgrade your Large NAND PS3 and restore Blu-Ray playback in the future. Note: The location of saved files has changed, users of the older version of the tool should place their saved DRL files into a 'PS3bluray' folder in the root of the USB storage device for compatability with the new DRLcopy tool.

DRLcopy[edit | edit source]

DRLcopy is a new PS3 tool that uses the output of the new version of DRLbackup (or properly located DRL backups from the previous version) and/or the derived DRL files from DRLgen to restore your blu-ray functionality after a firmware downgrade.


Fix your DRL/CRL issues on GameOS with PS3 Linux[edit | edit source]

If you have Linux installed or want to do a Linux install with OtherOS++, and you hope the issue is Reason 1 as mentioned in the Overview: see: Fixing DRL and CRL Hashes This method sets the CRL/DRL to match fixing the issue, if a mismatch is the cause of the issue.

If it's reason 2, Skip to the "nikitis" method using linux to zero out the CRL/DRL, and HRL on flash and then recreating cvtrm using Linux. This is essentially a factory reset. (Please note that this method will work for reason 1 and 2, but if reason 2, you will only be able to play older movies than the one that bricked your console in the first place. If you enter in a newer disc it will brick again because your console id matches the DRL on the disc and newer discs.)

rewrite DRL/CRL hashes with multiMAN[edit | edit source]

since multiMAN ver 04.11.11:

  • Added option in “Settings” – Fix Broken Blu-ray Movie Playback

The function will rewrite DRL/CRL hashes if there is a mismatch and will fix “Playback Prohibited” error on 3.41/3.55/4.21/4.30 firmwares.

The nikitis method[edit | edit source]

Warning
WARNING: Do not try this method until you've done the DRL/CRL matching using a linux distro above using the "fix your DRL/CRL issues on GameOS with PS3 Linux" or tried the MultiMan blu-ray fix method. (Non-Linux method to correct matching. Assumes it is a matching error and not a buggered cvtrm.)

This method will fix your PS3 if you follow the steps, it is in depth, and it will essentially factory reset your blu-ray drive and cvtrm. If like me, you have tried all of the above and still receive a "Prohibited Error" this is one last very drastic measure you may take. This requires a flasher as you are going to purposely RSOD your PS3.

Overview: This method is done via an OtherOS++ Install using ps3dm tools for Linux. It zeros out CRL / DRL / and HRL locations. If all 3 are not cleared, i.e. only 2 of 3 are cleared, this method will fail. Clear all 3 and then reset cvtrm using ps3dm tools, and it will work again with all movies if the issue was Reason 1 for the fail in the main overview. If this error occurred as a result of your console being in the actual DRL, then you'll only be able to play older movies than the one inserted to brick your drive the first time. (has to be an older mkb.ini) Any newer mkb.ini will contain your console id and WILL cause the error again. I'm sorry :(

Requirements:

  • A Linux Distro installed, or at least a petitboot which can boot Red Ribbon OS.
  • Red Ribbon Live Disc.
  • Make sure your PS3 is has petitboot setup in such a way you can cold boot into petitboot. If you cannot do all of these items, then this method will fail you.
  • 3.55 CFW installed. Preferably my 3.55 NOTHEROS++RSOD CFW. WARNING: METHOD WILL NOT WORK WITH 4.xx+ Must downgrade to fix.

First extract your NOR / NAND Data. Search twice for both entries of OCRL and delete them with a Hex editor. (HxD will work.) Mine was located at 0xF69400 & 0xFA9400. And zero the OCRL0200 line and data lines just below until there is nothing but 00's.


Secondly, look for the HRL line somewhere on your Dump. (Should be located at F60000 and FA0000 on NOR's, find equivalent on NAND.) and 00 out the 3-5 lines there until it's all 00's. DO NOT DELETE IT, OVERWRITE WITH 00's at both spots.

0xF60000   10 00 00 0C 00 04 10 03 00 00 00 01 20 00 00 34 --
0xF60010   00 00 00 00 00 00 00 00 5B 3F 73 B4 9A 86 C7 B2   | Zero Lines out (Sometimes there are 5 lines and possibly longer
0xF60020   A0 D1 1E AF A7 9B 97 E2 7A CB 05 2B 4D 61 26 AE   |                  as HRL grows.)
0xF60030   13 CA 29 84 19 93 15 E1 4A DB 2C B7 7C 00 E4 EB --
...
&
...
0xFA0000   10 00 00 0C 00 04 10 03 00 00 00 01 20 00 00 34 --
0xFA0010   00 00 00 00 00 00 00 00 5B 3F 73 B4 9A 86 C7 B2   | Zero Lines out (Sometimes there are 5 lines and possibly longer
0xFA0020   A0 D1 1E AF A7 9B 97 E2 7A CB 05 2B 4D 61 26 AE   |                  as HRL grows.)
0xFA0030   13 CA 29 84 19 93 15 E1 4A DB 2C B7 7C 00 E4 EB --

Third, Go to Address's on NOR: 0xEC52B0 and 0xEE52B0. Here you may see 1 to several, 6 line entries above this address. You need to Zero all of that data above these lines. Example:

0xEC5260   00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 12 --
0xEC5270   10 70 00 00 02 00 00 01 10 70 00 00 03 00 00 02   |
0xEC5280   DA 52 64 4B F1 BA A4 C8 2A 99 4F C6 70 BC 9A D6   |
0xEC5290   86 EE 8C B6 70 10 47 40 80 18 06 1A 8C 92 51 52   | Zero Lines (And above if there are more entries until you reach the void of 00's)
0xEC52A0   CC 51 94 80 54 D^ 4D 9E 91 A8 66 3E 93 A5 C7 84   |
0xEC52B0   22 BB 99 63 09 E4 63 CF 56 F3 39 6C B6 D8 75 93 --
...
0xEC52C0   00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF --  Do not touch this line.
...
&
...
0xEC5260   00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 12 --
0xEC5270   10 70 00 00 02 00 00 01 10 70 00 00 03 00 00 02   |
0xEC5280   DA 52 64 4B F1 BA A4 C8 2A 99 4F C6 70 BC 9A D6   |
0xEC5290   86 EE 8C B6 70 10 47 40 80 18 06 1A 8C 92 51 52   | Zero Lines (And above if there are more entries until you reach the void of 00's)
0xEC52A0   CC 51 94 80 54 D^ 4D 9E 91 A8 66 3E 93 A5 C7 84   |
0xEC52B0   22 BB 99 63 09 E4 63 CF 56 F3 39 6C B6 D8 75 93 --
...
0xEE52C0   00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF --  Do not touch this line

The cleaning part is done. Flash this back to your PS3, the HRL is blank, and so is the data in CVTRM area. This WILL RSOD your PS3.

Now the reason for having a linux distibution installed or petitboot access. After flashing it back, power off your PS3, turn on and you will get a RSOD.

Power off, then use the cold boot method to boot directly into petitboot, and load Red Ribbon Live Disc. Grab the information on how to re-initialize CVTRM using the linux method (RSOD Linux Fix). Once fixed and re-initialized, reboot into GameOS, and your blu-ray player should be able to play blu-rays again!

Alternative Method: If you have 3.55 installed, you may go into Factory Service Mode using eclips3 usb key etc and run the RSOD lv2diag.self and it will re-initialize as well. See also: RSOD Fix

Final Notes: If this last ditch effort does not work, then you either did something wrong, forgot to do the CRL/DRL Matching method via linux as stated above first, or your drive has a hardware issue, it has been tried and tested on many consoles and worked on pretty much all of them.

NOTE: Only attempt if you feel your PS3 is worthless without a working blu-ray drive. And I am not responsible for any damages you may inflict upon your PS3 or yourself using this method if it does not work for you.

Good Luck!


Thoughts on why this works:

I had RSOD my system and re-initialized CVTRM without success of fixing the blu-ray player, so my thoughts are that data that is zero'd is related to CRL/DRL somehow in CVTRM. I had even zero'd out HRL and OCRL lines and used RSOD Fix with no success, It wasn't until I zero'd out all 3 areas that it worked for me. I had tried for many months to come up with a fix for this with much trial and error. I think without blanking out those areas it reinitializes CVTRM with the bad data and your blu-ray still will fail. But once blanking it out and then doing a RSOD fix, it reinitializes it based on what is currently on your blu-ray drive which are zeros and is like a fresh factory drive. That is my theory anyway. There could be a simpler way to fix this and I challenge someone to figure out the relationships so we can better understand this process.

FIX - " playback of bds is prohibited on this system. "[edit | edit source]

NOTE FROM 2022: the below methods are from 2014, I found methods 2 and especially 3 to be very outdated and convoluted, referencing files that are no longer very easy to find online. I was able to resolve the issue using a guide for setting up a new Blu Ray drive as if the drive in the system was a freshly installed one, the exact guide I followed was "My adverture of Remarry BluRay Drive on 4.86" by tryingbe on but if you need to find another one searching google for "Remarry Bluray Drive" should bring up some results.

I. METHOD 1[edit | edit source]

  1. Via Multiman , select the " Broken BR " option, it will align values ​​DRL1 and 2 with values ​​in the area VTRM dump .
  2. Put a BR . If that does not work and tells you the message " Playback of bds is prohibited on this system . Contact technical support for assistance " , go to the following .

II . METHOD 2[edit | edit source]

  1. Download the app and take a DRLgen BR disc randomly .
  2. Under Multiman will take MKB_RO.inf file the same disk, then use it to generate both DRL1 and 2 from the soft DRLgen .
  3. Copy these two files to a key, then replace the console via Multiman . These are in DEVFLASH3/data-revoke/drl
  4. Once replaced , rerun the " Broken BR " option , you should have a message that the settings are restored.
  5. Put a BR . If that does not work and tells you the message " Playback of bds is prohibited on this system . Contact technical support for assistance " , go to the following

III . METHOD 3[edit | edit source]

  1. After method 2 , you still have the same problem. This is due to the VTRM area completely " upside down " , we are going to restore order .
  2. RECOVERY MODE downgrade in the console CFW 3.55 CFW if you are 4.xx
  3. Install in RECOVERY MODE CFW 3.55 - NOTHEROS - RSOD.PUP ( MD5: f237eb38bcd9d2e02337e9b5d2979a88 )
  4. Install and run the file rsodfix.gnpdrm.pkg ( MD5: cbb08c8bca7022da050c0647c6ab69f6 )
    o You should hear a beep, it has restored order in parts of VTRM
    o At this point if you always put the same disc BR you will have another error message. (This is because your console id was added to the official Sony DRL/CRL list and was located on the blu-ray disc you used to brick it the first time, I'm sorry but you can only play older movies safely, any new movies will continue to brick your blu-ray drive. - nikitis)
  5. Install now still RECOVERY MODE the 3.55 OFW then turn off the console.
  6. Unplug the console wallsocket ​​for 5 to 10s.
  7. Spend the console FSM ( Factory Service Mode)
  8. Run the FactoryServiceMode_Lv2diag_RSOD.self file ( MD5: 4c2848d2687fafdf77aaf1244b9e6c07 ) to do this just put the file renamed as lv2diag.self in the root of FAT32 USB drive. You should hear one beep, it means that the job was done.
    o At this stage VTRM structure your own ;)
  9. Install now in RECOVERY MODE V1.01 CFW 4.50 ROGERO then put your BR disk first, it should work. (Assuming there was just a mixup in the CRL/DRL, if your console id is truly on the disc, then it won't work for that disc and newer, only older -nikitis).