Editing Remarry Syscon

Replacing the Syscon requires you to remarry it to [[CELL_BE|CELL]].

== Introduction ==
The [[Syscon Hardware|System Controller]] does have different <i>EEPROM</i> regions of which two are the NVS (non-volatile storage) and the SNVS (secure NVS).<br>
If CELL wants to access the SNVS it has to be married to the Syscon. The SNVS holds for example the secure [[Boot_modes#JIG_.2F_Factory_Service_Mode_.2F_manufacturer|product mode]] information, the [[lv0]]/[[Lv1.self|lv1]] hash and the [[Flash:cvtrm|SRK/SRH]].<br>
This guide will only cover the perconsole section which holds the pairing information and the SNVS section, not the NVS nor the internal (only by Syscon plain accessible) regions.<br>
For easier reading the complete area will be called <b>SPCR</b> - Syscon Per Console Region.

== Basic Syscon Prerequisites ==
In order to remarry the Syscon you have to have raw access to the corresponding EEPROM regions.<br>
The SPCR on Mullion (CXR) models is saved at 0x0000-0x2800 while it's at 0x3000-0x5800 on Sherwood (SW) models.<br>
For the NVS regions (and internal regions) please refer to the [[SC EEPROM|EEPROM]] page, this guide will only provide the offsets used by [[Update_Manager|UM]].

== Case #1: A full dump of the original Syscon SPCR is available ==
If this is the case and you're not switching from Mullion to Sherwood or the other way around you can just copy the SPCR.

== Case #2: The original Syscon SPCR is not available ==
<b>The PS3 needs to run a factory (JIG) firmware in order to remarry the Syscon!</b><br>
First blank the complete SPCR with hex <i>FF</i>.
Then for the first 0x30 bytes write this:
<pre>
5E B4 F7 C9 50 62 F1 B2 EC F7 EE 1A 3C E3 D8 D0
C5 C2 73 4B A4 13 3D 2C 9E EE 88 ED 0C A8 15 C7
8F 59 DC E4 35 A8 11 BD 8B EC 4E 95 09 F1 E7 38
</pre>
And set offset 0x48C07 of the NVS to <i>00</i>.<br>
If you start the PS3 you should see this on PS3s with a Mullion Syscon (as part of the bootlog obtainable from the [[South_Bridge|SB]] UART):
<pre>
[INFO]: sc_init START
[INFO]: 1...o
[INFO]: 2 skip
[INFO]: 3...o
[INFO]: 4.0.1...o    4.0.2...o    4.0.3...o    4.0.4...o
[INFO]: 4.1.1...o    4.1.2...o    4.1.3...o    4.1.4...o
[INFO]: 4.2.1...o    4.2.2...o    4.2.3...o    4.2.4...o
[INFO]: 4.3.1...o    4.3.2...o    4.3.3...o    4.3.4...o
[INFO]: 4.4.1...o    4.4.2...o    4.4.3...o    4.4.4...o
[INFO]: 4.5.1...o    4.5.2...o    4.5.3...o    4.5.4...o
[INFO]: 4.6.1...o    4.6.2...o    4.6.3...o    4.6.4...o
[INFO]: 4.7.1...o    4.7.2...o    4.7.3...o    4.7.4...o
[INFO]: pre5...o
[INFO]: skip 5, 6, 7, 8 (0x31)
[INFO]: sc_init SUCCESS
</pre>
and this on Sherwood models:
<pre>
[INFO]: sc_init START
[INFO]: 1...o
[INFO]: 2 skip
[INFO]: 3...o
[INFO]: 4.0.1...o    4.0.2...o    4.0.3...o    4.0.4...o
[INFO]: 4.1.1...o    4.1.2...o    4.1.3...o    4.1.4...o
[INFO]: pre5...o
[INFO]: skip 5, 6, 7, 8 (0x31)
[INFO]: sc_init SUCCESS
</pre>
After shutting the console down power it up again which causes the Syscon to be remarried a "2nd" time.<br>
It'll produce the same output except that the third line changes from "<i>[INFO]: 2 skip</i>" to "<i>[INFO]: 2...o</i>".<br>
The console will be now in product mode.<br><br>
To complete the remarrying proceduce please install any firmware using the manufacturing updater (launched by <i>lv2diag</i>) and set offset 0x48C07 of the NVS back to <i>FF</i>.
<br><br>

{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>