PS3 PS3 Super Slim DECH 4000 QA Flag Token and Signature

[zecoxao]

Sharing here the QA Flag Token and respective Signature of a Super Slim DECH 4000 with Serial 0000001 (the first of its kind)

Credit to user soul on discord for having dumped this.​

​

 

[zecoxao]

Here is the full eeprom nvs dump

 

[RoboKing's Cosmos]

Nice

 

[LuanTeles]

@Evilnat

 

[haxxxen]

what's the point? how does this help anywhere?

 

[LuanTeles]

what's the point? how does this help anywhere?

AFAIK it will lead to real QA flag on 4.xx firmwares

 

[vyktormvmpay25]

Reverse to factory is? 3.60? , didn't check dump with similar one from retail.

 

[Joonie]

AFAIK it will lead to real QA flag on 4.xx firmwares

that sounds like a possibility to OFW to OFW downgrade .. correct me if I'm wrong.

 

[LuanTeles]

that sounds like a possibility to OFW to OFW downgrade .. correct me if I'm wrong.

Exactly

 

[vyktormvmpay25]

Well for what is worth is minimum downgrade is 4.25 downgrade factory

 

[SpaceAgeHero]

Still no chance for full CFW?

 

[zecoxao]

it would work if the leaf wasnt 4.25 minimum. like this it will be only CFW to CFW, due to dex public key being introduced to validate leafs on 4.21

 

[haxxxen]

it does not want to get into my mind, how exactly (please describe method) could this help? you cannot calculate and it is bound to DEX

on the other hand, the case looks different and interesting

 

[zecoxao]

it does not want to get into my mind, how exactly (please describe method) could this help? you cannot calculate and it is bound to DEX

on the other hand, the case looks different and interesting

You can write the token and signature to eeprom and then you can change the idps inside eid0 leaf to that specific one, making it a true qa flagged console. but since it's minver 4.25 (and a 3000 qa flag token would be better, since it does not have the cex2dex check) we can only do this across cfws. not to mention we can only go to 4.25 minimum

 

[zecoxao]

good news is that soul has a lot more sexy consoles where this one has come from, so we'll probably get more tokens

 

[zecoxao]

https://www.psdevwiki.com/ps3/Talk:QA_Flagging#From_Superslim_DEX_with_Serial_1

Structure from our token

 

[haxxxen]

yay, jackpot (....bound to 4.21), thanks
does the target do not interfere? I mean, token is bound to target/idps (already have checked this and improoved qa flagging myself), how could this help with retail?

 

[zecoxao]

yay, jackpot (....bound to 4.21), thanks
does the target do not interfere? I mean, token is bound to target/idps (already have checked this and improoved qa flagging myself), how could this help with retail?

it shouldn't interfere at all. just because it's dex doesn't mean we can't use dex cfw from that. the issue is only the minver. the ideal would be finding a 3000 qa token with 3.60 min ver so we could use qaf options on firmwares between 3.60 and 4.20

 

[haxxxen]

it shouldn't interfere at all. just because it's dex doesn't mean we can't use dex cfw from that. the issue is only the minver. the ideal would be finding a 3000 qa token with 3.60 min ver so we could use qaf options on firmwares between 3.60 and 4.20

ok, I see. if possible, you want to go (the infamous) DEX route on Superslims. fine for me, but probably problem for regular users.

 

[vyktormvmpay25]

What if we find out how to reverse that crap as in Rl78 (ps4) would be a step?