Downgrading with Hardware flasher

NAND flasher downgrader steps

NOR flasher downgrader steps

Downgrading installation steps

Dehashing

Goal: To be able to install unpatched firmwares (or 4.2x/4.3x MFW later on) on consoles that where previously on 3.56+ (highly recomended)

You can use either or both QA/reFSM way:

reFSM dehashing

1. Patch as normal downgrader (ROS 0/1 + RVK prg/pkg)
2. install prepatched firmware in service mode

Above is already done if you just downgraded

Dump the flash first, in case you brick on dehashing, you can easily flash this one back to debrick

1. Put console in service mode with JIG (in case you left service mode and ran the prepatched firmware in normal mode)
2. Use normal lv2diag.self and unpatched official firmware (e.g. 3.55) on USB Mass Storage device in root and let the system reinstall that in factory service mode (FSM).
3. After installation is finished console will turn off. Check UPDATER_LOG.TXT in root of USB Mass Storage device (it should have "manufacturing updating SUCCESS(0x8002f000)" in end section).
4. If everything is OK, then reinsert USB Mass Storage device and let it install again.
5. After installation is finished console will turn off. Check UPDATER_LOG.TXT in root of USB Mass Storage device (it should have "manufacturing updating SUCCESS(0x8002f000)" in end section).
6. If everything is OK, then console should now be dehashed and no longer brick with any unpatched firmwares.
7. Replace lv2diag.self for he one getting out of service mode and put in root.
8. Power on console, it should turn off and not boot XMB.
9. Remove USB Mass Storage device and boot console normally. If all went well it should load to XMB now. Congrats, you now finished downgrading and dehashing. Console runs 3.55 and any firmware of choice can be installed, no longer needing to be patched for downgrader.

Remarks

• FSM gets you a installer LOG (QA does not)
• FSM does not delete ACT.DAT (QA does)
• FSM can be done without a BD drive with noBD patched firmware (QA needs the BD drive present)
• FSM can be done without seeing XMB or Recovery (QA needs Recovery and XMB for the QA-flagging package)

Both ways require installing nonpatched firmware to dehash syscon bank. QA-flag can be removed/reset (but it is better to keep it flagged) after succesfull dehash, without bricking.

 <domelec> dehash procedure: fsm install ofw
           after console turns off take out usb stick and look at log file, 
           if log is ok then reinsert usb stick and turn on console,
           ofw will then reinstall, after console turns off again 
           take out usb stick and check log, if ok then exit fsm 

 <eussNL> do double FSM OFW, then get out of service mode.
 <eussNL> check everything is working
 <eussNL> THEN and only THEN, you can install whatever you want, in recovery.
 <eussNL> there is no need for factory mode after dehashing complete
 <eussNL> in fact, if everything works on OFW 3.55 after dehashing, 
 <eussNL> you can install Rogero V3.2 in recovery and QA-extra flag it  
 <eussNL> if OFW 3.55 works then you proven that you dehashed
 <eussNL> so after that you can install whatever MFW 3.55 you want

 <eussNL> If for some reason you cannot dehash because of BD or BT errors
          then you can use PS3MFW Builder and the broken Blueray / broken Bluetooth
          tasks. Do not select downgrader patches, or you will not dehash!

 <eussNL> BD error can be persistant if flasher is still attached, 
          see: http://www.ps3devwiki.com/wiki/Talk:Hardware_flashing#BD_drive_not_found_problem
 <eussNL> 3 options: 1. open R7/R8  /  2. remove flasher control lines / 3. remove all flasher wiring

 <playonlcd> i  think you can update on wiki "dehashing with jaicrab is not recommended
             and will not dehash as needed and thus semibrick by syscon hash panic