PS3 SYSCON Firmware key is now public (release by zecoxao) - What does it mean?

Developer @zecoxao has recently released something that the dev has been working on obtaining for 10 years now and that obstacle that has now been cleared is the SYSCON Firmware Key and zecoxao has now released it to the public. First off we must erase some misconceptions as this is not going to directly lead us to a CFW on nonCFW PS3's anytime soon. As the dev stated on twitter "needless and pointless to say that the confusion being created around these keys that they will be useful for cfw on ps3 3k and superslim is a very farfetched idea. unless we have access to the TSOP 78K0R models, we will not be able to obtain anything else" and then when @kozarovv provided a follow-up question about 3k models here the developer responded with "don't expect miracles, is all i'm saying ". Now the question (which was asked by @DeViL303) "So what can we do with this as of now, what is possible with just this key alone and current knowledge? Then @zecoxao provides an explanation seen in this post (and also seen below). So this is a great feat that has been made, but its still being investigated and something that will need to be explored in the weeks to come to fully understand what we can be uncovered,. .

1200px-SYSCON_GEN1.JPG​
Release

  • i got the syscon firmware key, a dream i've been pursuing for the past 10 years. now that i have it i feel like i've acomplished my goal. the rest will follow naturally.
    - https://twitter.com/notzecoxao/status/1168954036541935616​

    What can developer's do with this key?
    DeViL303 said:
    So what can we do with this as of now, what is possible with just this key alone and current knowledge? Custom fan speed profiles? Multiple boot sequences depending on flags or something, or does everything need more work?
    Click to expand...

    via @zecoxao : With this key the following has happened:

    14 syscon firmwares for the BGA models (CXR) were decrypted.
    from them, keys for PATCHES and FULL FW signing and encryption, as well as decryption and validation were found. we can now sign our own patches and fws for the following models:

    • TMU-510
    • COK-001
    • COK-002
    • SEM-001
    • DIA-001
    • DIA-002 or DEB-001 (same soft id)

    Additionally we found the initialization key for eid1 as well as the process of initializing it from factory
    We also found 7 extra keys (we still don't know what they do)
    Finally, we found out there is a secret keyslot function that generates keys for
    • SNVS
    • AUTH1/AUTH2
    • Regions of EEPROM
    • PATCH keys xoring (to generate the final keys)
    • Relationship with the other 7 Keys

    What still has to be done:
    • Hack the 78K0R chips (the TSOP ones found in later models)
    • Dump the firmware of those chips
    • Get the DYN-001 patch keys
    • Find an exploit on arm firmware that works in 78k0r firmware

    Edit: and yes, you can do all that fun kinky shit of fan boosting at max speeds, led disco panic attack, and star wars theme ON A DECR-1000! THIS is a devkit, so THIS is the ONLY device that supports FULL FUCKING FIRMWARES! DO NOT CONFUSE IT with a DECR-1400, that is a HALF devkit!


Release Source: twitter.com/notzecoxao
Discussion: psx-place.com

Thanks to @NathanHale for the news alert ​
 
Last edited:
Click to expand...
vyktormvmpay25
Fair enough not to be release any method to dump internal flash memory
I have understand how it works . Glitch an microcontroller with mask of rom may corrupt data lose/corruption if we want to achieve OCD (on_chip_debugging) without correct id/keys.
Hardware setup won't be difficult, but software side could result in permanent brick for end users.
I personally will leave it aside. I will do only simple/quick fix from now.
I am still interested in ps4 blu-ray microcontroller as I have done in past past years few tests and I have seen something strange. Once unit updated to 7.55, took another blu-ray dougtherboard from another unit with 4.73 and attached to unit 7.55. Removing hdd from unit and trying to install update unit was asking for 4.73 even if it was updated to 7.55. It was not possible to upgrade due to not original bdp board.
Once I connected original bdp will ask for 7.55. Repeated process back for 4.73 and same will ask 4.73 but not possible.
Can someone explain why unit will ask for lower firmware?
 
Last edited:
zecoxao
as promissed (i've said i'd release the full dump when it was dumped completely)
here is the complete vertigo binary, which includes root key, flash and syscon dump:
https://www.sendspace.com/file/on9847
Note that the flash is from a never hacked console while the rom from the syscon chip is from same console but updated to @Evilnat 's 4.87.1 Cobra FW (i am assuming that the core os hashes are the same for 4.87.2 so you can just grab them from there)

Happy New Year to the people at PSX-Place as well as to my friend Greg over at PlaystationHax!
 
sandungas
zecoxao said:
as promissed (i've said i'd release the full dump when it was dumped completely)
here is the complete vertigo binary, which includes root key, flash and syscon dump:
https://www.sendspace.com/file/on9847
Note that the flash is from a never hacked console while the rom from the syscon chip is from same console but updated to @Evilnat 's 4.87.1 Cobra FW (i am assuming that the core os hashes are the same for 4.87.2 so you can just grab them from there)

Happy New Year to the people at PSX-Place as well as to my friend Greg over at PlaystationHax!
Click to expand...
This dump you are calling VERTIGO are you refering to the non-retail motherboard (where the name VERTIGO is "printed" in it literally) or to the retail derivates (named VER-001) ?
Im asking to nkow if that dump belongs to a retail motherboard

Btw... im taking a fast look at the SW-301.bin file you uploaded and it seems the layout of the thermal config area have changed ?. The first difference that called my attention is there is no checksum in the last 2 bytes of it
Code: 
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00060250  33 44 00 00 00 39 45 00 39 00 3B 46 00 39 80 3E  3D...9E.9.;F.9€>
00060260  47 00 3A 00 40 48 00 3A 80 43 4C 00 40 00 45 50  G.:.@H.:€[email protected]
00060270  00 44 00 48 51 00 44 80 4A 52 00 45 00 50 53 00  .D.HQ.D€JR.E.PS.
00060280  45 80 55 54 00 46 00 5A 55 00 46 80 66 56 00 47  E€UT.F.ZU.F€fV.G
00060290  00 80 57 00 48 00 99 58 00 4F 80 FF 5B 00 50 00  .€W.H.™X.O€ÿ[.P.
000602A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000602B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000602C0  33 50 00 00 00 39 51 00 45 00 3B 52 00 45 80 3E  3P...9Q.E.;R.E€>
000602D0  53 00 46 00 40 54 00 46 80 43 55 00 47 00 45 56  [email protected]€CU.G.EV
000602E0  00 47 80 48 57 00 48 00 4A 58 00 48 80 50 59 00  .G€HW.H.JX.H€PY.
000602F0  49 00 55 5A 00 49 80 5A 5B 00 4A 00 66 5C 00 4A  I.UZ.I€Z[.J.f\.J
00060300  80 80 5D 00 4B 00 99 5E 00 51 80 FF 61 00 52 00  €€].K.™^.Q€ÿa.R.
00060310  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060320  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060330  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060340  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060350  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060360  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060370  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060380  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060390  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000603A0  FF FF 00 00 4D 14 FF FF FF FF FF 81 88 81 88 FF  ÿÿ..M.ÿÿÿÿÿ.ˆ.ˆÿ
000603B0  5A 00 5B 00 02 00 60 00 61 00 02 00 7D 00 7D 00  Z.[...`.a...}.}.
000603C0  02 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ..ÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000603D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000603E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000603F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060400  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060410  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060420  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060430  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060440  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

*The forum is breaking the pasted code, everytime appears an @ replaces it by [email protected]
 
zecoxao
sandungas said:
This dump you are calling VERTIGO are you refering to the non-retail motherboard (where the name VERTIGO is "printed" in it literally) or to the retail derivates (named VER-001) ?
Im asking to nkow if that dump belongs to a retail motherboard

Btw... im taking a fast look at the SW-301.bin file you uploaded and it seems the layout of the thermal config area have changed ?. The first difference that called my attention is there is no checksum in the last 2 bytes of it
Code: 
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00060250  33 44 00 00 00 39 45 00 39 00 3B 46 00 39 80 3E  3D...9E.9.;F.9€>
00060260  47 00 3A 00 40 48 00 3A 80 43 4C 00 40 00 45 50  G.:.@H.:€[email protected]
00060270  00 44 00 48 51 00 44 80 4A 52 00 45 00 50 53 00  .D.HQ.D€JR.E.PS.
00060280  45 80 55 54 00 46 00 5A 55 00 46 80 66 56 00 47  E€UT.F.ZU.F€fV.G
00060290  00 80 57 00 48 00 99 58 00 4F 80 FF 5B 00 50 00  .€W.H.™X.O€ÿ[.P.
000602A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000602B0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000602C0  33 50 00 00 00 39 51 00 45 00 3B 52 00 45 80 3E  3P...9Q.E.;R.E€>
000602D0  53 00 46 00 40 54 00 46 80 43 55 00 47 00 45 56  [email protected]€CU.G.EV
000602E0  00 47 80 48 57 00 48 00 4A 58 00 48 80 50 59 00  .G€HW.H.JX.H€PY.
000602F0  49 00 55 5A 00 49 80 5A 5B 00 4A 00 66 5C 00 4A  I.UZ.I€Z[.J.f\.J
00060300  80 80 5D 00 4B 00 99 5E 00 51 80 FF 61 00 52 00  €€].K.™^.Q€ÿa.R.
00060310  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060320  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060330  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060340  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060350  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060360  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060370  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060380  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060390  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000603A0  FF FF 00 00 4D 14 FF FF FF FF FF 81 88 81 88 FF  ÿÿ..M.ÿÿÿÿÿ.ˆ.ˆÿ
000603B0  5A 00 5B 00 02 00 60 00 61 00 02 00 7D 00 7D 00  Z.[...`.a...}.}.
000603C0  02 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ..ÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000603D0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000603E0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000603F0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060400  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060410  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060420  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060430  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
00060440  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

*The forum is breaking the pasted code, everytime appears an @ replaces it by [email protected]
Click to expand...
For now @M4j0r is concentrating on getting AUTH for everyone with a ps3. THEN you can check whatever temps you want with EEP command yourself :)
 
M4j0r
sandungas said:
Btw... im taking a fast look at the SW-301.bin file you uploaded and it seems the layout of the thermal config area have changed ?. The first difference that called my attention is there is no checksum in the last 2 bytes of it
Click to expand...

There's only one checksum for the complete eeprom and it's saved in two different spots.
The eeprom is also non linear in hardware, the syscon uses a table to construct it, I included the virtual offsets for the NVS region here: https://www.psdevwiki.com/ps3/SC_EE..._Block_Offset_Mapping_Table_.28NVS_Service.29 .
 
sandungas
zecoxao said:
@sandungas here is proper dump of nvs (you can only obtain this with working chip and EEP command), check if temperature table is there!
Click to expand...
It is, but there are some values that seems to be msising (replaced by zeroes), displaced, flipped, or whatever, i dont understand it well, im guessing is a consequence of the rebuilding process you was doing to "map" the data from the new structure using "virtual offsets"
But yeah, in the new eeprom.bin file you uploaded the "thermal config" is the area starting at 0x250

Btw, another difference is now it seems every table is 0x70 size (previous versions was 0x80 each)
 
sandungas
Ohh, i think i just got one of the differences that was confusing me, i guess some of you already realized about it but im going to mention it just incase it helps or someone is curious about it
I realized about it while comparing the data with the coordinate graph for DIA-001

The thermal config area starts like this (is the CELL fantable):
Code: 
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000250  33 44 00 00 00 39 45 00 39 00 3B 46 00 39 80 3E  3D...9E.9.;F.9€>
00000260  47 00 3A 00 40 48 00 3A 80 43 4C 00 40 00 45 50  G.:.@H.:€[email protected]
00000270  00 44 00 48 51 00 44 80 4A 52 00 45 00 50 53 00  .D.HQ.D€JR.E.PS.
00000280  45 80 55 54 00 46 00 5A 55 00 46 80 66 56 00 47  E€UT.F.ZU.F€fV.G
00000290  00 80 57 00 48 00 99 58 00 4F 80 FF 5B 00 50 00  .€W.H.™X.O€ÿ[.P.
000002A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000002B0  FF FF FF FF 33 FF 01 00 FF FF FF FF FF FF FF FF  ÿÿÿÿ3ÿ..ÿÿÿÿÿÿÿÿ

33 = P0 duty
4400 = P0 TempU
0000 = P0 TempD
39 = P1 duty
4500 = P1 TempU
3900 = P1 TempD
3B = P2 duty
4600 = P2 TempU
3980 = P2 TempD

And so on... up to...

FF = P15 duty
5B00 = P15 TempU
5000 = P15 TempD


The way how this values are ordered is very different than previous motherboards, are like "interleaved"
I have not tryed to "crop and convert" all the values from the thermal config area entirelly, but looks fine :encouragement:
 
Last edited:
zecoxao
sandungas said:
Ohh, i think i just got one of the differences that was confusing me, i guess some of you already realized about it but im going to mention it just incase it helps or someone is curious about it
I realized about it while comparing the data with the coordinate graph for DIA-001

The thermal config area starts like this:
Code: 
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000250  33 44 00 00 00 39 45 00 39 00 3B 46 00 39 80 3E  3D...9E.9.;F.9€>
00000260  47 00 3A 00 40 48 00 3A 80 43 4C 00 40 00 45 50  G.:.@H.:€[email protected]
00000270  00 44 00 48 51 00 44 80 4A 52 00 45 00 50 53 00  .D.HQ.D€JR.E.PS.
00000280  45 80 55 54 00 46 00 5A 55 00 46 80 66 56 00 47  E€UT.F.ZU.F€fV.G
00000290  00 80 57 00 48 00 99 58 00 4F 80 FF 5B 00 50 00  .€W.H.™X.O€ÿ[.P.
000002A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000002B0  FF FF FF FF 33 FF 01 00 FF FF FF FF FF FF FF FF  ÿÿÿÿ3ÿ..ÿÿÿÿÿÿÿÿ

33 = P0 duty
4400 = P0 TempU
0000 = P0 TempD
39 = P1 duty
4500 = P1 TempU
3900 = P1 TempD
3B = P2 duty
4600 = P2 TempU
3980 = P2 TempD
And so on...

The way how this values are ordered is very different than previous motherboards, are like "interleaved"
I have not tryed to "crop and convert" all the values from the thermal config area entirelly, but looks fine :encouragement:
Click to expand...

You were probably the first one to find hehe. We literally got the last chunk about 5 hours ago. So now everyone can contribute.
 
M4j0r
sandungas said:
It is, but there are some values that seems to be msising (replaced by zeroes), displaced, flipped, or whatever, i dont understand it well, im guessing is a consequence of the rebuilding process you was doing to "map" the data from the new structure using "virtual offsets"
But yeah, in the new eeprom.bin file you uploaded the "thermal config" is the area starting at 0x250
Click to expand...
It's just a new way of storing it, I recovered it from a running system, the values are all valid.
 
sandungas
M4j0r said:
It's just a new way of storing it, I recovered it from a running system, the values are all valid.
Click to expand...
Sorry for doubting, is because in my first post i was trying to compare CELL values with RSX (following the old structures we was using) and it was looking too much weird

Now after i realized of that "interleaving" of the values it makes lot of sense... actually the values are very similar than DIA-001 and DIA-002
Just as a sample, this is fan speed 100%, TempU = 91ºC and TempD = 80ºC (same thermal limits than DIA-001 and DIA-002)

FF = P15 duty
5B00 = P15 TempU
5000 = P15 TempD
 
Last edited:
aldostools
:
upload_2021-1-1_19-25-53.png


Fan Speed (Hex)TempUTempDFan Speed(Dec)Fan%TempUTempD
3344 0000 00 5120%68°C00°C
3945 0039 00 5722%69°C57°C
3B46 0039 80 5923%70°C57°C
3E47 003A 00 6224%71°C58°C
4048 003A 80 6425%72°C58°C
434C 0040 00 6726%76°C64°C
4550 0044 00 6927%80°C68°C
4851 0044 80 7228%81°C68°C
4A52 0045 00 7429%82°C69°C
5053 0045 80 8031%83°C69°C
5554 0046 00 8533%84°C70°C
5A55 0046 80 9035%85°C70°C
6656 0047 0010240%86°C71°C
8057 0048 0012850%87°C72°C
9958 004F 8015360%88°C79°C
FF5B 0050 00255100%91°C80°C
Code: 
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000250  33 44 00 00 00 39 45 00 39 00 3B 46 00 39 80 3E  3D...9E.9.;F.9€>
00000260  47 00 3A 00 40 48 00 3A 80 43 4C 00 40 00 45 50  G.:.@H.:€[email protected]
00000270  00 44 00 48 51 00 44 80 4A 52 00 45 00 50 53 00  .D.HQ.D€JR.E.PS.
00000280  45 80 55 54 00 46 00 5A 55 00 46 80 66 56 00 47  E€UT.F.ZU.F€fV.G
00000290  00 80 57 00 48 00 99 58 00 4F 80 FF 5B 00 50 00  .€W.H.™X.O€ÿ[.P.
000002A0  FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
000002B0  FF FF FF FF 33 FF 01 00 FF FF FF FF FF FF FF FF  ÿÿÿÿ3ÿ..ÿÿÿÿÿÿÿÿ

This is the custom table implemented in webMAN MOD's Auto#2 (same used in Cobra/Mamba 8.3)
The fan speed is set directly proportional to the temperature.
upload_2021-1-1_19-39-30.png
 
Last edited:
sandungas
aldostools said:
Fan Speed (Hex)TempUTempDFan Speed(Dec)Fan%TempUTempD
3344 0000 00 5120%68°C00°C
3945 0039 00 5722%69°C57°C
3B46 0039 80 5923%70°C57°C
3E47 003A 00 6224%71°C58°C
4048 003A 80 6425%72°C58°C
434C 0040 00 6726%76°C64°C
4550 0044 00 6927%80°C68°C
4851 0044 80 7228%81°C68°C
4A52 0045 00 7429%82°C69°C
5053 0045 80 8031%83°C69°C
5554 0046 00 8533%84°C70°C
5A55 0046 80 9035%85°C70°C
6656 0047 0010240%86°C71°C
8057 0048 0012850%87°C72°C
9958 004F 8015360%88°C79°C
FF5B 0050 00255100%91°C80°C
Click to expand...
Cool, yeah, the values looks fine, btw, now we have the data required to make a test related with the problem and the theory i was mentioning here
https://www.psx-place.com/threads/cfw-4-87-2-evilnat-cobra-cex.32057/page-10#post-270130

The problem seems to happen when we return control to syscon, it seems at that point syscon is not able to recover the normal control of the fan
One of the solutions we could try is to do it this way
1) Use the syscall to change the fan speed to one of the "duty" values that appears inside syscon
2) Use the syscall again to return back the control to syscon
3) Unload webman
4) ... then the PS3 completes the shutsdown sequence

The idea is to configure syscon (in step 1) with one of the "duty" speeds he "knows" because this way we are cheating him and he is not going to realize what happened (like if nothing happened)
 
zecoxao
sandungas said:
Cool, yeah, the values looks fine, btw, now we have the data required to make a test related with the problem and the theory i was mentioning here
https://www.psx-place.com/threads/cfw-4-87-2-evilnat-cobra-cex.32057/page-10#post-270130

The problem seems to happen when we return control to syscon, it seems at that point syscon is not able to recover the normal control of the fan
One of the solutions we could try is to do it this way
1) Use the syscall to change the fan speed to one of the "duty" values that appears inside syscon
2) Use the syscall again to return back the control to syscon
3) Unload webman
4) ... then the PS3 completes the shutsdown sequence

The idea is to configure syscon (in step 1) with one of the "duty" speeds he "knows" because this way we are cheating him and he is not going to realize what happened (like if nothing happened)
Click to expand...
don't forget i also shared nvs from a ps3 2000 syscon chip as well as a superslim syscon chip! you just need to do interleaving!
 
You must log in or register to reply here.

Similar threads

Featured content

Trending content

Latest posts

Back
Top