Nand/Nor flasher downgrade (QA trick) & FSM Dance

[bitsbubba]

QA trick

Ok, for anyone wanting to downgrade their PS3 to use Cobra or TB firmware, I can 100% confirm it's possible. I don't have a TB to test with, but i do have a Cobra and it is working on my console that was just on OFW 4.00.
Steps I took were:
1. Downgrade the usual way from 3.56+ with a flasher of some sort (I use a progskeet) to Rogero CFW v2
2. Once you have successfully downgraded, grab the rebug toggle QA pkg. Read here: Codename: REBUG
3. QA flag your console. Once done that, turn on System Update Debug. (Press L1+L2+L3+R1+R2+DOWN[D-PAD] while on Network Settings to get Debug Settings)
4. Boot your console into recovery mode, go to system update and update to 3.55 OFW. My ps3 asked for 4.00 or above, but it will still install 3.55 OFW.
5. Now you're on 3.55 OFW, put your kmeaw or Cobra or TB CFW on your usb and update through xmb.

Now one thing i found interesting, after doing this, I can't just flash 4.00 OFW back, the console bricks (RLOD). I have to update through xmb to get back to 4.00. I assume because the syscon doesn't match and wants 3.55 firmware.

Anyway, try this at your own risk, don't blame me if you brick your PS3.WARNING TURNING OFF QA FLAG WILL BRICK YOUR CONSOLE

FSM Dance

now for the most interesting part about how Kado patches are actually resetting the syscon:

he used 3 sets of patches and 3 steps to accomplish this :

Step1:
------
Flash the NOR with: Patch1 with empty ROS0 + Patch2 with empty ROS1 + Patch3 overlapping 4 revoke area's
Enter Factory Service Mode and reinstall nonpatched firmware (e.g. OFW)

Step2:
------
Flash the NOR with: Patch1 with filled ROS0 + Patch2 with empty ROS1 + Patch3 overlapping 4 revoke area's
Enter Factory Service Mode and reinstall nonpatched firmware (e.g. OFW)

Step3:
------
Flash the NOR with: Patch1 with empty ROS0 + Patch2 with filled ROS1 + Patch3 overlapping 4 revoke area's
Enter Factory Service Mode and reinstall nonpatched firmware (e.g. OFW)

after the 3 steps are completed, the syscon banks should be now reset and no more need to patch LV1 in the OFW/CFW to be used.

[15:22] <@Rogero> something here gets flagged about syscon/checks
[15:22] <@uf6667> so how do you know it does something to syscon??
[15:22] <@Rogero> because after step 3, syscon seems to be RESET
[15:22] <@eussNL> and in step 2 syscon sees occupied ros0, and switch to backup mode
[15:22] <@eussNL> but then you swap those and it again RLODs
[15:22] <@eussNL> and thus resets the backup bank too
[15:23] <@Rogero> niceeee
[15:23] <@uf6667> ahhhh I see
[15:23] <@uf6667> well good idea
[15:23] <@uf6667> go for it

more details about the patches offsets can be found on the Ps3DevWiki by following this link ---> The_FSM_Dance

N.B: Please note that the method mentioned above is still experimental and under testing and I take no responsibility whatsoever in case of anything goes wrong, please try it at your own responsibility until further testing can confirm those pacthes are safe enough for generic use.

Credits to Kado for releasing this new method that allows to reset the syscon instead of bypassing the checks.
Credits to eussNL for cleaning up the initial patches and making the simplified form of the patches.
Credits to #ps3downgrade and all beta testers in the channel.

Cheers

[Rogero]

nice find Bitsbubba, i guess updating to OFW3.55 with QA flag set will bypass the syscon check and maybe overwrites it with 3.55 data.

That's great for those who downgraded and have a Cobra or TB dongle to use

[RazorX]

hey bitsbubba do you have a solderless progskeet and if so what exactly do you need to buy to have a fully working solderless progskeet crystal blue for downgrading and dual boot and do you know of any installation guide thats kicking around for the solderless setup

[bitsbubba]

hey bitsbubba do you have a solderless progskeet and if so what exactly do you need to buy to have a fully working solderless progskeet crystal blue for downgrading and dual boot and do you know of any installation guide thats kicking around for the solderless setup

no I wish (my Wanky brick awaits it) here's some helpful links;
Re: Cobra downgrade
Progskeet: products
Progskeet - PS3DevWiki

[RazorX]

i think i read somewere when you install a progskeet you need to remove or seperate something that requires you to replace the thermal paste on something is that correct or not

[SwordOfWar]

I'm not sure, but as long as you don't rub off the paste already there, it should be fine. ProgSkeet's solderless accessory shouldn't cause any need to add more paste than what is already there, unless it sits on top of the CPU/GPU (this is where the paste is).

The only parts with thermal paste is on the CPU/GPU chips, so unless you need to attach something new to those areas, there shouldn't be any reason to need additional paste in my opinion.

[bitsbubba]

Updated and moved