PS3 Dumps from PS3 DECH-2100 QA Flagged Proto

Some notes about this system:
The syscon firmware was never dumped before. it's also a prototype firmware.
The QA Token is the very first ever dumped token of a ps3 console. it is NOT a forced rebug token.
Lv0ldr is also unique and it should be dumped soon as well
 
More System Information:
photo_2023-01-20_13-46-05.jpg
 
GuilloteTesla said:
Should we update the PS3 Wiki here?, or maybe this data depends on the model variant?.
Click to expand...
No, 3.10 != 3.10.
Sony always has special firmware builds for prototypes which of course have support for the newer hardware, but the retail firmware will lack the support.
One example are the CECHL prototypes. The prototypes do come with different mininal versions, the earliest is 2.20. A retail PS3 will report 2.45 even though the real minimal version is 2.40. If you install the retail 2.20 firmware on a CECHL it'll brick.
It also depends on the current firmware since lv1 decides what the minimal version is: https://www.psdevwiki.com/ps3/Minimum_Firmware_Version .
For prototypes lv1 has no idea and will of course report the lowest retail firmware as defined by Sony.
The real minimal version for this DEH-HH2000 unit would be (3.10, 37333, 20091116), not (3.10, 37234, 20091113).
 
For a bit context since this is across several threads and twitter.

@zecoxao posted here
https://www.psx-place.com/threads/cfw-4-89-evilnat-cobra-8-3-cex.37294/page-30#post-352829
I have another request for my friend @Evilnat : Eeprom dumper.
disregard the name of the file. it works for all firmwares from 4.75 to 4.89. It dumps NVS from the following locations:
0x2F00
0x3000
0x48000
0x48800
0x48C00
0x48D00

which means it could be potentially useful for dumping never dumped qa tokens, flags, and other rarities in the ps3 test or retail protos.

Edit: if possible i'd like it done into separate files instead of a unique log file. 0x2F00.bin, 0x3000.bin, etc
Click to expand...

The feature was implemented into Evilnat 4.89.3 BETA
https://twitter.com/notzecoxao/status/1616867962337611777
This is what's cool about talking with developers that actually listen to what you have to say and implement the stuff you want, no questions asked. Thanks to @xXEvilnatXx for giving me the chance to implement a feature i've been waiting to have since the first days of ps3 cfw
FnBElnUWQAEgd1G.png FnBElnTWIAU3d_s.jpg
Click to expand...
via
there are hackable ps3 prototypes that are qa flagged. thanks to this functionality, for the first time ever, an actual ps3 qa flag token was dumped on one of these models
Click to expand...

Then dumps provided in this thread from @zecoxao
https://www.psx-place.com/threads/dumps-from-ps3-dech-2100-qa-flagged-proto.39202/

Update:
via @zecoxao "you can also thank mysis. he made the app originally"
 
Last edited:
M4j0r said:
No, 3.10 != 3.10.
Sony always has special firmware builds for prototypes which of course have support for the newer hardware, but the retail firmware will lack the support.
One example are the CECHL prototypes. The prototypes do come with different mininal versions, the earliest is 2.20. A retail PS3 will report 2.45 even though the real minimal version is 2.40. If you install the retail 2.20 firmware on a CECHL it'll brick.
It also depends on the current firmware since lv1 decides what the minimal version is: https://www.psdevwiki.com/ps3/Minimum_Firmware_Version .
For prototypes lv1 has no idea and will of course report the lowest retail firmware as defined by Sony.
The real minimal version for this DEH-HH2000 unit would be (3.10, 37333, 20091116), not (3.10, 37234, 20091113).
Click to expand...

Where are the 'drivers" located in the firmware?

CoreOS? dev_flash/sys?

Can we build an old firmware with support for newer hardware revisions ?
 
LuanTeles said:
Where are the 'drivers" located in the firmware?

CoreOS? dev_flash/sys?

Can we build an old firmware with support for newer hardware revisions ?
Click to expand...
Some drivers are part of lv1 (e.g. SYSCON), some are part of lv2 (e.g. USB), some are part of the userland (like DECI) and some are split (rsx - lv1/lv2).
Patching an older firmware to be compatible with newer hardware would be very time consuming and doesn't really bring any benefit (only if you would go really low).
 
M4j0r said:
Some drivers are part of lv1 (e.g. SYSCON), some are part of lv2 (e.g. USB), some are part of the userland (like DECI) and some are split (rsx - lv1/lv2).
Patching an older firmware to be compatible with newer hardware would be very time consuming and doesn't really bring any benefit (only if you would go really low).
Click to expand...

oh got it, I really want to make some tests on 0.85-1.02 and firmwares up to 3.00

Unfortunately my mim ver is 3.60 and rcps3 doesn't run firmwares bellow 3.00
 
This does indeed look very impressive and amazing, something never thought about before, but it makes me wonder:

What could we possibly gain, having those dumps and the ability to dump those regions?
Apologies for my lack of knowledge in this matter, but we already have QA flags access and ability to toggle them or on off.

The best idea that comes up to my mind with this new discovery, is perhaps the possibility to convert compatible retail PS3s into Devkits or Testkits, or have I missed the actual point of this matter and it's about something different? Perhaps the ability to launch sub 1.00 OFW?

Thanks a lot to You and the legendary Evilnat for making this a reality, I just wanted to learn more about this.
 
olokos said:
This does indeed look very impressive and amazing, something never thought about before, but it makes me wonder:

What could we possibly gain, having those dumps and the ability to dump those regions?
Apologies for my lack of knowledge in this matter, but we already have QA flags access and ability to toggle them or on off.

The best idea that comes up to my mind with this new discovery, is perhaps the possibility to convert compatible retail PS3s into Devkits or Testkits, or have I missed the actual point of this matter and it's about something different? Perhaps the ability to launch sub 1.00 OFW?

Thanks a lot to You and the legendary Evilnat for making this a reality, I just wanted to learn more about this.
Click to expand...

If we have the prototype syscon firmware we can decrypt prototype eid1 and see what's there (we haven't be able to, but decrypting retail eid1 is possible)

If we have a qa token AND signature from an unhackable system, we can convert any hackable console into a fully qa flagged permanent console (without any ugly patches)
 
Thank You very very much, that really explains a lot!

zecoxao said:
can convert any hackable console into a fully qa flagged permanent console (without any ugly patches)
Click to expand...

Does that mean, that this gives us a glimpse of hope for a true CFW (albeit QA flag based) on non-CFW models like the super slim? (no ugly patches - meaning HEN I guess? which would only be used here for QA flag change?)
 
You must log in or register to reply here.

Similar threads

Back
Top