PS3 (CFW) Unable to downgrade w/ QA on.

dbrown1986

dbrown1986

Member
I've been seeing other threads with this issue, so I'm not 100% sure what is going on, the last thread was posted just this last Wedneday, by nolemretaW.

I have a CECH2001A.
It was on REBUG D-REX 4.84.2 for a long time.
Someone would like it, but they want it on 3.55 OFW so they can go to whatever FW they want from there with a clean slate.

  1. I started off by swapping the kernel and LV1 back to CEX in Rebug Toolset, and then flashed Rebug 4.84.2 CEX to be sure all was reset to CEX.
  2. Went back into Rebug Toolbox and enabled QA flags and rebooted.
  3. Attempted to downgrade from USB, "No applicable update data found."
  4. Reboot into Recovery, still asks for 4.84 instead of minimum.
  5. Downloaded and installed Habib QA and Rebug QA, no beeps, no reboots. Rebug QA even errored with a statement similar to "failed to initialize..." or something of the sort.
  6. Decided to try a different CFW, flashed to Evilnat 4.88.2
  7. Evilnat says QA and Syscall 8 are enabled.
  8. USB update still says no applicable update data found.
  9. Enabled Update Debug in Debug Settings
  10. Placed Rogero and 3.55 OFW in hdd:/updater/01 etc etc.
  11. Updates show in XMB under Update from System Storage but produce the same error that nolemretaW was experiencing (this update data is not supported on this system).
I've done a downgrade on this console at least twice and even on 4.84.2 Rebug CEX and DEX did not experience these issues until I turned the PS3 on this week. I do have a NOR backup dump of this console from before I ever installed ANY CFW on it, but am not sure how to restore that without actual hardware devices.

So across two CFW's that I hash verified, I am experiencing this issue. All the video tutorials point to using the same method, a method that doesn't appear to work for me; and a few others.

Any insight would be profoundly helpful. If I wasn't bald, I'd be pulling hairs right about now.
 
That's the Rebug QA toggler, it was the first one that I used after the toolbox, no beeps or reboots. It did not work.

While I was still on 4.84, I even tried 4.84 OFW to use the BGToolset from scratch on a completely unmodded system, here's the PyCheck Log from that. Should ROS1 still say Rebug under CoreOS?

******* Getting flash type *******
Flash type : NOR
Reversed : NO

******* Getting SKU identification datas *******
idps = 0x09
metldr0 = 0xE890
metldr1 = 0x0E85
metldrkey = [Removed by OP]
bootldr0 = 0x2F13
bootldr1 = 0x2F13
bootldrsize = 0x2F170
Matching SKU : OK
CECH-20xxx (DYN-001)
Minimum version 2.70

******* Getting SDK versions *******
ROS0 : 484.000
ROS1 : 484.000

******* Checking first_region_header *******
001.01 First Region Header 0x00 Filled Area 0 : OK
001.02 First Region Header Magic : OK
001.03 First Region Header 0x00 Filled Area 1 : OK

******* Checking flash_format *******
002.01 Flash Format String : OK
002.02 Flash Format Version : OK
002.03 Flash Format 0xFF Filled Area : OK

******* Checking flash_region_table *******
003.01 Flash Region Table Header : OK
003.02 asecure_loader Offset - Length : OK
003.03 asecure_loader Name : OK
003.04 eEID Offset - Length : OK
003.05 eEID Name : OK
003.06 cISD Offset - Length : OK
003.07 cISD Name : OK
003.08 cCSD Offset - Length : OK
003.09 cCSD Name : OK
003.10 trvk_prg0 Offset - Length : OK
003.11 trvk_prg0 Name : OK
003.12 trvk_prg1 Offset - Length : OK
003.13 trvk_prg1 Name : OK
003.14 trvk_pkg0 Offset - Length : OK
003.15 trvk_pkg0 Name : OK
003.16 trvk_pkg1 Offset - Length : OK
003.17 trvk_pkg1 Name : OK
003.18 ros0 Offset - Length : OK
003.19 ros0 Name : OK
003.20 ros1 Offset - Length : OK
003.21 ros1 Name : OK
003.22 cvtrm Offset - Length : OK
003.23 cvtrm Name : OK
003.24 Flash Region Table 0x00 Filled Area : OK

******* Checking asure_loader_region *******
004.01 asecure_loader Header : OK
004.02 metldr Offset : OK
004.03 metldr Length : OK
004.04 metldr Name : OK
004.05 metldr RevKey : OK
004.06 metldr Binary Size : OK
004.07 metldr Statistics : OK
004.08 asecure_loader 0x00 Filled Area : OK

******* Checking eEID_region *******
005.01 eEID Header : OK
005.02 EID0 Offset - Length : OK
005.03 EID1 Offset - Length : OK
005.04 EID2 Offset - Length : OK
005.05 EID3 Offset - Length : OK
005.06 EID4 Offset - Length : OK
005.07 EID5 Offset - Length : OK
005.08 EID0 IDPS0 : OK
005.09 EID0 IDPS1 : OK
005.10 EID0 Static : OK
005.11 EID2 BlockSize/Padding : OK
005.12 EID3 Static0 : OK
005.13 EID3 Static1 : OK
005.14 EID3 Static2 : OK
005.15 EID5 IDPS0 : OK
005.16 EID5 IDPS1 : OK
005.17 EID5 Static : OK
005.18 eEID Region 0xFF Filled Area : OK
005.19 eEID Statistics0 : OK
005.20 eEID Statistics1 : OK

******* Checking cISD_region *******
006.01 cISD Header : OK
006.02 cISD0 Offset - Length : OK
006.03 cISD1 Offset - Length : OK
006.04 cISD2 Offset - Length : OK
006.05 cISD0 0xFF Filled Area : OK
006.06 cISD1 IDLog Header : OK
006.07 cISD1 Semistatic 1 : OK
006.08 cISD1 Semistatic 2 : OK
006.09 cISD1 0xFF Filled Area 0 : OK
006.10 cISD1 Static : OK
006.11 cISD1 Semistatic 3 : OK
006.12 cISD1 0xFF Filled Area 1 : OK
006.13 cISD1 Statistics : OK
006.14 cISD2 : OK
006.15 cISD 0xFF Filled Area : OK

******* Checking cCSD_region *******
007.01 cCSD Header : OK
007.02 cCSD Entry Table : OK
007.03 cCSD 0xFF Filled Area : OK

******* Checking Revokation_region *******
008.01 trvk_prg0 SCE : OK
008.02 trvk_prg0 Hash : OK
Size = 0x2E0
MD5 = 78629D24BD721488F3A1E846938F87DF
Version = 3.55 (from PUP)
008.02 trvk_prg0 0xFF filled area : OK
008.03 trvk_prg1 SCE : OK
008.04 trvk_prg1 Hash : OK
Size = 0x2E0
MD5 = E537DE954DCF25D4DE961DF44549BAF7
Version = 3.50 (from PUP)
008.04 trvk_prg1 0xFF filled area : OK
008.05 trvk_pkg0 SCE : OK
008.06 trvk_pkg0 0xFF filled area : OK
008.07 trvk_pkg1 SCE : OK
008.08 trvk_pkg1 0xFF filled area : OK

******* Checking CoreOS_region *******
009.01 ROS0 Header : OK
009.02 ROS0 Hash : OK
Size = 0x6FFFE0
MD5 = E2396DD395E095128BCB69AABA2D1978
Version = 4.84 CEX/SEX OFW/HFW
009.03 ROS0 unused 0xFF Filled Area : OK
009.04 ROS1 Header : OK
009.05 ROS1 Hash : OK
Size = 0x6FFFE0
MD5 = A504EF7CDD53E3FE4E8CA5428AD0BDF2
Version = 4.84.1 REBUG REX
009.06 ROS1 unused 0xFF Filled Area : OK

******* Checking cvtrm_region *******
010.01 Pre cvtrm 0xFF Filled Area : OK
010.02 cvtrm0 Header : OK
010.03 cvtrm0 0xFF Filled Area : OK
010.04 vtrm0 Magic : OK
010.05 vtrm0 Reserved Entries : OK
010.07 cvtrm1 Header : OK
010.08 cvtrm1 0xFF Filled Area : OK
010.09 vtrm1 Magic : OK
010.10 vtrm1 Reserved Entries : OK

******* Checking Second_Region_Header *******
011.01 Second Region Header 0x00 Filled Area 0 : OK
011.02 Second Region Header Magic : OK
011.03 Second Region Header Count : OK
011.04 Second Region Header 0x00 Filled Area 1 : OK
011.05 Second Region Unknown Block 0 : OK
011.06 Second Region Header 0x00 Filled Area 2 : OK
011.07 Second Region Unknown Block 1 : OK
011.08 Second Region Header 0x00 Filled Area 3 : OK

******* Checking Unreferenced_Area *******
012.01 unreferenced area 0xFF Filled : OK

******* Checking CELL_EXTNOR_AREA_Region *******
013.01 CELL_EXTNOR_AREA Header : OK
013.02 CELL_EXTNOR_AREA 0x00 Filled Area 0 : OK
013.03 CELL_EXTNOR_AREA 0x00 Filled Area 1 : OK
013.04 CELL_EXTNOR_AREA 0x00 Filled Area 2 : OK
013.05 CELL_EXTNOR_AREA 0x00 Filled Area 3 : OK
013.06 CELL_EXTNOR_AREA 0xFF Filled Area 0 : OK
013.07 CELL_EXTNOR_AREA 0x00 Filled Area 5 : OK
013.08 CELL_EXTNOR_AREA 0x00 Filled Area 6 : OK
013.09 CELL_EXTNOR_AREA 0xFF Filled Area 1 : OK

******* Checking bootldr_region *******
014.01 bootldr0 : OK
014.02 bootldr1 : OK
014.03 bootldr Rev key : OK
014.04 bootldr Statistics : OK
014.05 bootldr 0xFF Filled Area : OK

******* Checking datamatches *******
bootldr size : OK
per console nonce : OK
CELL_EXTNOR_AREA Hash1 : OK
CELL_EXTNOR_AREA Hash2 : OK
metldr size : OK
vtrm0 : OK
vtrm1 : OK

******* Checking repetitions *******
Header Magic0 Repetitions : OK
asecure_loader Repetitions : OK
eEID Repetitions : OK
cISD Repetitions : OK
cCSD Repetitions : OK
trvk_prg0 Repetitions : OK
trvk_prg1 Repetitions : OK
trvk_pkg0 Repetitions : OK
trvk_pkg1 Repetitions : OK
ros0 Repetitions : OK
ros1 Repetitions : OK
cvtrm Repetitions : OK

******* Additional information *******
HDD : ST1000LX015-1U7172 ZKP03133
MAC address : [Removed by OP]
CID : [Removed by OP]
eCID : [Removed by OP]
board_id (part of console S/N) : 27453354
kiban_id (board barcode) : 401336145587

******* Checks completed *******
Total number of checks = 155
Number of dangers = 0
Number of warnings = 0
All checks done in 3.10 seconds.
 
Last edited:
dbrown1986 said:
That's the Rebug QA toggler, it was the first one that I used after the toolbox, no beeps or reboots. It did not work.

While I was still on 4.84, I even tried 4.84 OFW to use the BGToolset from scratch on a completely unmodded system, here's the PyCheck Log from that. Should ROS1 still say Rebug under CoreOS?

******* Getting flash type *******
Flash type : NOR
Reversed : NO

******* Getting SKU identification datas *******
idps = 0x09
metldr0 = 0xE890
metldr1 = 0x0E85
metldrkey = [Removed by OP]
bootldr0 = 0x2F13
bootldr1 = 0x2F13
bootldrsize = 0x2F170
Matching SKU : OK
CECH-20xxx (DYN-001)
Minimum version 2.70

******* Getting SDK versions *******
ROS0 : 484.000
ROS1 : 484.000

******* Checking first_region_header *******
001.01 First Region Header 0x00 Filled Area 0 : OK
001.02 First Region Header Magic : OK
001.03 First Region Header 0x00 Filled Area 1 : OK

******* Checking flash_format *******
002.01 Flash Format String : OK
002.02 Flash Format Version : OK
002.03 Flash Format 0xFF Filled Area : OK

******* Checking flash_region_table *******
003.01 Flash Region Table Header : OK
003.02 asecure_loader Offset - Length : OK
003.03 asecure_loader Name : OK
003.04 eEID Offset - Length : OK
003.05 eEID Name : OK
003.06 cISD Offset - Length : OK
003.07 cISD Name : OK
003.08 cCSD Offset - Length : OK
003.09 cCSD Name : OK
003.10 trvk_prg0 Offset - Length : OK
003.11 trvk_prg0 Name : OK
003.12 trvk_prg1 Offset - Length : OK
003.13 trvk_prg1 Name : OK
003.14 trvk_pkg0 Offset - Length : OK
003.15 trvk_pkg0 Name : OK
003.16 trvk_pkg1 Offset - Length : OK
003.17 trvk_pkg1 Name : OK
003.18 ros0 Offset - Length : OK
003.19 ros0 Name : OK
003.20 ros1 Offset - Length : OK
003.21 ros1 Name : OK
003.22 cvtrm Offset - Length : OK
003.23 cvtrm Name : OK
003.24 Flash Region Table 0x00 Filled Area : OK

******* Checking asure_loader_region *******
004.01 asecure_loader Header : OK
004.02 metldr Offset : OK
004.03 metldr Length : OK
004.04 metldr Name : OK
004.05 metldr RevKey : OK
004.06 metldr Binary Size : OK
004.07 metldr Statistics : OK
004.08 asecure_loader 0x00 Filled Area : OK

******* Checking eEID_region *******
005.01 eEID Header : OK
005.02 EID0 Offset - Length : OK
005.03 EID1 Offset - Length : OK
005.04 EID2 Offset - Length : OK
005.05 EID3 Offset - Length : OK
005.06 EID4 Offset - Length : OK
005.07 EID5 Offset - Length : OK
005.08 EID0 IDPS0 : OK
005.09 EID0 IDPS1 : OK
005.10 EID0 Static : OK
005.11 EID2 BlockSize/Padding : OK
005.12 EID3 Static0 : OK
005.13 EID3 Static1 : OK
005.14 EID3 Static2 : OK
005.15 EID5 IDPS0 : OK
005.16 EID5 IDPS1 : OK
005.17 EID5 Static : OK
005.18 eEID Region 0xFF Filled Area : OK
005.19 eEID Statistics0 : OK
005.20 eEID Statistics1 : OK

******* Checking cISD_region *******
006.01 cISD Header : OK
006.02 cISD0 Offset - Length : OK
006.03 cISD1 Offset - Length : OK
006.04 cISD2 Offset - Length : OK
006.05 cISD0 0xFF Filled Area : OK
006.06 cISD1 IDLog Header : OK
006.07 cISD1 Semistatic 1 : OK
006.08 cISD1 Semistatic 2 : OK
006.09 cISD1 0xFF Filled Area 0 : OK
006.10 cISD1 Static : OK
006.11 cISD1 Semistatic 3 : OK
006.12 cISD1 0xFF Filled Area 1 : OK
006.13 cISD1 Statistics : OK
006.14 cISD2 : OK
006.15 cISD 0xFF Filled Area : OK

******* Checking cCSD_region *******
007.01 cCSD Header : OK
007.02 cCSD Entry Table : OK
007.03 cCSD 0xFF Filled Area : OK

******* Checking Revokation_region *******
008.01 trvk_prg0 SCE : OK
008.02 trvk_prg0 Hash : OK
Size = 0x2E0
MD5 = 78629D24BD721488F3A1E846938F87DF
Version = 3.55 (from PUP)
008.02 trvk_prg0 0xFF filled area : OK
008.03 trvk_prg1 SCE : OK
008.04 trvk_prg1 Hash : OK
Size = 0x2E0
MD5 = E537DE954DCF25D4DE961DF44549BAF7
Version = 3.50 (from PUP)
008.04 trvk_prg1 0xFF filled area : OK
008.05 trvk_pkg0 SCE : OK
008.06 trvk_pkg0 0xFF filled area : OK
008.07 trvk_pkg1 SCE : OK
008.08 trvk_pkg1 0xFF filled area : OK

******* Checking CoreOS_region *******
009.01 ROS0 Header : OK
009.02 ROS0 Hash : OK
Size = 0x6FFFE0
MD5 = E2396DD395E095128BCB69AABA2D1978
Version = 4.84 CEX/SEX OFW/HFW
009.03 ROS0 unused 0xFF Filled Area : OK
009.04 ROS1 Header : OK
009.05 ROS1 Hash : OK
Size = 0x6FFFE0
MD5 = A504EF7CDD53E3FE4E8CA5428AD0BDF2
Version = 4.84.1 REBUG REX
009.06 ROS1 unused 0xFF Filled Area : OK

******* Checking cvtrm_region *******
010.01 Pre cvtrm 0xFF Filled Area : OK
010.02 cvtrm0 Header : OK
010.03 cvtrm0 0xFF Filled Area : OK
010.04 vtrm0 Magic : OK
010.05 vtrm0 Reserved Entries : OK
010.07 cvtrm1 Header : OK
010.08 cvtrm1 0xFF Filled Area : OK
010.09 vtrm1 Magic : OK
010.10 vtrm1 Reserved Entries : OK

******* Checking Second_Region_Header *******
011.01 Second Region Header 0x00 Filled Area 0 : OK
011.02 Second Region Header Magic : OK
011.03 Second Region Header Count : OK
011.04 Second Region Header 0x00 Filled Area 1 : OK
011.05 Second Region Unknown Block 0 : OK
011.06 Second Region Header 0x00 Filled Area 2 : OK
011.07 Second Region Unknown Block 1 : OK
011.08 Second Region Header 0x00 Filled Area 3 : OK

******* Checking Unreferenced_Area *******
012.01 unreferenced area 0xFF Filled : OK

******* Checking CELL_EXTNOR_AREA_Region *******
013.01 CELL_EXTNOR_AREA Header : OK
013.02 CELL_EXTNOR_AREA 0x00 Filled Area 0 : OK
013.03 CELL_EXTNOR_AREA 0x00 Filled Area 1 : OK
013.04 CELL_EXTNOR_AREA 0x00 Filled Area 2 : OK
013.05 CELL_EXTNOR_AREA 0x00 Filled Area 3 : OK
013.06 CELL_EXTNOR_AREA 0xFF Filled Area 0 : OK
013.07 CELL_EXTNOR_AREA 0x00 Filled Area 5 : OK
013.08 CELL_EXTNOR_AREA 0x00 Filled Area 6 : OK
013.09 CELL_EXTNOR_AREA 0xFF Filled Area 1 : OK

******* Checking bootldr_region *******
014.01 bootldr0 : OK
014.02 bootldr1 : OK
014.03 bootldr Rev key : OK
014.04 bootldr Statistics : OK
014.05 bootldr 0xFF Filled Area : OK

******* Checking datamatches *******
bootldr size : OK
per console nonce : OK
CELL_EXTNOR_AREA Hash1 : OK
CELL_EXTNOR_AREA Hash2 : OK
metldr size : OK
vtrm0 : OK
vtrm1 : OK

******* Checking repetitions *******
Header Magic0 Repetitions : OK
asecure_loader Repetitions : OK
eEID Repetitions : OK
cISD Repetitions : OK
cCSD Repetitions : OK
trvk_prg0 Repetitions : OK
trvk_prg1 Repetitions : OK
trvk_pkg0 Repetitions : OK
trvk_pkg1 Repetitions : OK
ros0 Repetitions : OK
ros1 Repetitions : OK
cvtrm Repetitions : OK

******* Additional information *******
HDD : ST1000LX015-1U7172 ZKP03133
MAC address : [Removed by OP]
CID : [Removed by OP]
eCID : [Removed by OP]
board_id (part of console S/N) : 27453354
kiban_id (board barcode) : 401336145587

******* Checks completed *******
Total number of checks = 155
Number of dangers = 0
Number of warnings = 0
All checks done in 3.10 seconds.
Click to expand...
Try this one, I have a couple of them. These are for use without rebug toolbox.
 

Attachments

You could use the QA button combo to confirm if it's enabled properly. If that works then you can move onto checking other things.

upload_2022-5-31_12-39-33.png


dbrown1986 said:
Reboot into Recovery, still asks for 4.84 instead of minimum.
Click to expand...

This is normal when you are using a CEX kernel, It will only show the minimum possible version when you are converted to DEX.

dbrown1986 said:
Should ROS1 still say Rebug under CoreOS?
Click to expand...
Yes, that is normal. Alternate ROS area is used each time you install firmware, if you want reset both ROS areas just install OFW twice. It will make no real difference in this situation though.
 
Last edited:
use recovery mode to install. do not use a usb hub or splitter. remember to use the right hand usb port.

here is a new thing to try...just after starting the search for update, unplug your controller and leave it unplugged untill it is done searching. it does not always work but is worth trying. good luck :)
 
Coro said:
use recovery mode to install. do not use a usb hub or splitter. remember to use the right hand usb port.

here is a new thing to try...just after starting the search for update, unplug your controller and leave it unplugged untill it is done searching. it does not always work but is worth trying. good luck :)
Click to expand...

I did try recovery mode and it said the fw was not compatible.

I'm brainstorming here, but I think I might have better luck going back to dex and then converting it to cex lv1 again and updating straight from the dex fw w/ cex lv1 to Rogero, then 3.55 OFW.
 
i remember having the same problem when trying to downgrade from my rebug 4.82 in cex mode, it would fail everytime i tried, i ended up having to downgrade in stages, first i had to downgrade to STARBUCKS 4.81 firmware (for some reason this downgrade went fine but going to past rebug firmware's didn't, so DONT try going to old rebug firmware's, try the starbucks one first) then went to a older firmware (can't remember which exactly sorry) then used the downgrader firmware to get back to 3.55
 
I suggest to remove all USB devices, pendrives, SD cards, CD/DVD/BD disc, etc.

If you're still in DEX mode, reinstall Rebug 4.84 D-REX.
If you're in CEX mode, then install Rebug 4.84 REX.
Or switch to CEX mode, then install Rebug 4.84 REX.

If that doesn't work, try installing any OFW CEX between 4.80 and 4.88.
*** Make sure you're on CEX before do it ***

Then use ** www.** ** www.ps3xploit.net > D... (NEW URL = http://ps3toolset.com)/bgtoolset/ to allow FW installation.
After patch your console, install Evilnat 4.88.2, enable QA and install OFW 3.55.

DO NOT install 4.89 or you'll have to wait until bgtoolset is updated.
 
aldostools said:
I suggest to remove all USB devices, pendrives, SD cards, CD/DVD/BD disc, etc.

If you're still in DEX mode, reinstall Rebug 4.84 D-REX.
If you're in CEX mode, then install Rebug 4.84 REX.
Or switch to CEX mode, then install Rebug 4.84 REX.

If that doesn't work, try installing any OFW between 4.80 and 4.88.
Then use ** www.** ** www.ps3xploit.net > D... (NEW URL = http://ps3toolset.com)/bgtoolset/ to allow FW installation.
After patch your console, install Evilnat 4.88.2, enable QA and install OFW 3.55.

DO NOT install 4.89 or you'll have to wait until bgtoolset is updated.
Click to expand...

I am currently on evilnat 4.88.2 (coming from 4.84 OFW) as of my original post and it will not allow downgrade to 3.55 w/ QA on. I'll try to see if 4.84 will work.
 
You must log in or register to reply here.

Similar threads

Back
Top