PS3 Syscon fan settings (Coordinate Graphs)

[vyktormvmpay25]

still looking around those craps (sorry for oftopic)
cmd>errlog 0
secure loader build: Nov 30 2020 05:19:57 (r10323:release_branches/release_08.03
0) [711MHz]
AGESA: ThebePBDK W5C21
ERROR: DCT[6] is disabled
ERROR: DCT[7] is disabled
i can get this on time when run a command in the same time of power on ,nothing relate on google

 

[sandungas]

still looking around those craps (sorry for oftopic)
cmd>errlog 0
secure loader build: Nov 30 2020 05:19:57 (r10323:release_branches/release_08.03
0) [711MHz]
AGESA: ThebePBDK W5C21
ERROR: DCT[6] is disabled
ERROR: DCT[7] is disabled
i can get this on time when run a command in the same time of power on ,nothing relate on google

Agesa is a feature of AMD BIOS, so i guess is a PS4 but i dont know how it works that

I think is delay for power of at XMB
http://s.go.ro/xjwheire.

When i click in the link i only see a white screen, but without download link or anything
I guess you made a video but i cant watch it, can you upload it somewhere else ?

 

[vyktormvmpay25]

http://s.go.ro/Cok002testdelay
I have moved to his folder, probably it will work. I don't have to much space on other clouds, anyway delay is at the power off unit, is the only time when I see 10 seconds.
Compared with another sur001 last night is faster turning off than cok002 so I assume is that delay, not sure why is there on fan pwm control area. Still unsure about this setup.
For ps4 is like Jaicrab.v2 will work for errlog and version.
Ps4 ucmd commands list from failoverflow don't know yet how to get them working.

 

[vyktormvmpay25]

Nobady told me i get in real time debug with putty
after i was sure everything is connected right ,tested with script i can see script is not updating boot seqvnce in real time so started putty .

Spoiler

[SERV THERM] TZone No:01, MAX TZone No:15
[SERV THERM] RSX Primary  Get Temperature:47.50(0x2f80)
POWER Button pressed
[SERV NOTIF] RING_BUZZER
[SERV NOTIF] CONTROL_LED
POWER Button released
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:00, MAX TZone No:15
[SERV THERM] 1st BE Primary  Get Temperature:62.45(0x3e75)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:01, MAX TZone No:15
[SERV THERM] RSX Primary  Get Temperature:46.50(0x2e80)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:00, MAX TZone No:15
[SERV THERM] 1st BE Primary  Get Temperature:62.20(0x3e35)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:01, MAX TZone No:15
[SERV THERM] RSX Primary  Get Temperature:46.00(0x2e00)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:00, MAX TZone No:15
[SERV THERM] 1st BE Primary  Get Temperature:62.20(0x3e35)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:01, MAX TZone No:15
[SERV THERM] RSX Primary  Get Temperature:46.00(0x2e00)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:00, MAX TZone No:15
[SERV THERM] 1st BE Primary  Get Temperature:62.20(0x3e35)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:01, MAX TZone No:15
[SERV THERM] RSX Primary  Get Temperature:46.00(0x2e00)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:00, MAX TZone No:15
[SERV THERM] 1st BE Primary  Get Temperature:62.45(0x3e75)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:01, MAX TZone No:15
[SERV THERM] RSX Primary  Get Temperature:46.00(0x2e00)
[SERV NOTIF] RING_BUZZER
[SERV THERM] NOTIFY_MODE CMD
[SERV NVS] WRITE CMD
[SERV NVS] READ CMD
[SERV NVS] WRITE CMD
[SERV DEVPM] CONTROL_PCI_BUS_POWER_STATE CMD
[SSM] state: 0400 -> 0500
[POWSEQ] AV Backend Letup
[SSM] ssmCb_AfterBeOn() called.
[SSM] Shutdown mode ... req_wake_src = 000002F4, ctxt=00/00
[SSM] Shutdown mode : syspm_stat=00000000/00000000
[POWSEQ] PowerSeq_Letup called.
[SSM] state: 0500 -> 0000
(PowerOff State)

 

[vyktormvmpay25]

Got it work to instant off.after clear errlog will do more research.
Seems puty work after auth succes in cmd ,once done this stage ,putty can update automaticaly instant debug.
Can not send any command from it.
Nothing special ,changed back initial values.Same on both situations ,writing and turn off completly .
something new that i think is when clear errlog unit will turn off instantly not counting temperatures then call off as before.
So a good point for me is to clear every unit fixed

Spoiler

>$ task
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:00, MAX TZone No:15
[SERV THERM] 1st BE Primary  Get Temperature:64.20(0x4035)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:01, MAX TZone No:15
[SERV THERM] RSX Primary  Get Temperature:50.00(0x3200)
task
TaskName    ID PRI Stat EVT StkStrAddr Size CrntStkPtr Crnt Peak
SSM          1  21  WAI RDQ 0x02001c84 1024 0x02002020   9%  57%
UISW         2  25  WAI DLY 0x02002084  512 0x02002230  16%  71%
UILED        3  26  WAI FLG 0x02002284  512 0x02002420  19%  24%
COMMRECV     4  22  WAI FLG 0x02002484 1024 0x020026d8  41%  66%
CONSOLE      5  24  RDY ... 0x02002884 2560 0x02002d68  51%  74%
FIRMUD       6  27  WAI SLP 0x02003284  512 0x02003408  24%  28%
SB           7   6  WAI FLG 0x02003484  512 0x02003620  19%  53%
POWERSEQ     8  23  WAI RDQ 0x02003684 1024 0x02003a28   8%  73%
SERV_DIAG    9  45  WAI RDQ 0x02003a84  768 0x02003d10  15%  18%
SERV_HDMI   10  45  WAI RDQ 0x02003d84 1024 0x02004110  11%  53%
SERV_SECU   11  45  WAI RDQ 0x02004184 1024 0x02004510  11%  73%
HDMIINTR    12   4  WAI SLP 0x02004584  512 0x02004720  19%  67%
HDMISM0     13  43  WAI FLG 0x02004784  768 0x020049d0  23%  68%
IDLE        14  64  RDY ... 0x02004a84  128 0x02004aa8  71%  87%
SERV_MISC2  15  45  WAI RDQ 0x02004b04 1024 0x02004e98  10%  50%
SERV_THERM  16  45  WAI RDQ 0x02004f04  768 0x02005190  15%  64%
...........  0   0  DMT ... 0x02005204  768 0x00000000   0%   0%
SERV_MISC   18  45  WAI RDQ 0x02005504 1024 0x02005898  10%  81%
WMM0        19  11  WAI FLG 0x02005904  512 0x02005a98  21%  49%
...........  0   0  DMT ... 0x02005b04  768 0x00000000   0%   0%
WMM1        21  30  RDY ... 0x02005e04  768 0x02006098  14%  50%
LOG_ERROR   22  62  WAI RDQ 0x02006104  512 0x02006290  22%  58%
CC_CGMS     23   4  WAI SLP 0x02006304  512 0x020064a0  19%  24%
INTRNOTIF   24   8  WAI RDQ 0x02006504  256 0x020065a8  35%  45%
SIRCS       25   5  WAI RDQ 0x02006604  512 0x02006770  28%  33%
Crnt Idle Rate : 65%[0x0001371f]
Max  Idle Rate : 66%[0x00013920]
Min  Idle Rate : 11%[0x000037e3]
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:00, MAX TZone No:15
[SERV THERM] 1st BE Primary  Get Temperature:64.45(0x4075)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:01, MAX TZone No:15
[SERV THERM] RSX Primary  Get Temperature:50.25(0x3240)
>$

 

[sandungas]

Nobady told me i get in real time debug with putty
after i was sure everything is connected right ,tested with script i can see script is not updating boot seqvnce in real time so started putty .

Nice, i was not aware of it, not sure how much info we can get from it but could be useful
Something interesting i see from it is the thermal control is configured as a service, this is why there are many lines starting with [SERV THERM], seems to be configured to monitor the thermal sensors every X time, so is going to be repeated thousands of times while you are connected to syscon that way
I remember there is a byte somewhere to configure the debug level, not sure if it affects this syscon access mode but it could be handy to disable the debug info related with thermal control to dont disturb
In the other post when you used the "task" command you still had some lines with the [SERV THERM] disturbing you, i guess is because it was still considering it as a "real time debugging" access

 

[vyktormvmpay25]

Yes putty will show on cok002 but not to much with SW, posting some data on faults thread of sur001 board with rsx defect. UART sb pins tested for sur001 with 1202 02 is working on putty. I will try more next coming dyn001 boards.

 

[sandungas]

UART sb pins tested for sur001 with 1202 02 is working on putty

Im not sure where you found that info about writing value 02 at address 1202 to enable the SouthBridge debugging for sherwoods, but is correct, i guess m4j0r mentioned it somewhere and i missed it
It surprises me a bit because is something i realized a couple of days ago while taking another looks at your syscon dumps, and is not well explained in wiki

What we have at relative offset 0x1200 in sherwoods is the region named NVS2 from this table
The problem is that table in wiki is showing the offsets for mullion (where the NVS2 region starts at offset 0x48C00), but the flags are ordered in the same way
-First byte (0x48C00 in sherwoods or 0x1200 in mullions) is the boot flag
-Second byte (0x48C01 in sherwoods or 0x1201 in mullions) is the sys.dbgcard.hostpc
-Third byte (0x48C02 in sherwoods or 0x1202 in mullions) is the Network Device Mode
-Etc...

You enabled the Network Device Mode with value 0x02 (for SouthBridge), thats fine
But you cant interact with SouthBridge, the only thing we can do in retail PS3 models is to listen

Im mentioning this because you can enable other flags from that list, another interesting one is the bootrom trace level (0x48C11 in sherwoods or 0x1211 in mullions) that can be configured with values:
0x00: fatal errors
0x01: errors
0x02: information messages
0x03: debug messages

Some of them looks risky, be careful, i suggest you to dont make more experiments with the modchipped COK-001 (is working and have a nice RSX, so is better to sell it or keep it for you but dont damage it)... better use other of your scrap boards

------------
Bw, i imagined another way to remove the annoying lines generated by the [SERV THERM] from the debugging log
The point is... the command fanconpolicy set 2 (or something like that, i never used it) allows to change the fan control to "manual"
And the duty set 60 command allows to configure an static fan speed (in suggesting 60 fan speed to keep it spinning high all the time)

Spoiler

Note im using "set" (instead of setini) because i only want to change the values in RAM, valid only for the curent session

I guess after that the annoying lines with the [SERV THERM] should not appear in the debug output

-----------
Btw @M4j0r take a look at this comparison, taken from the dumps shared by vyktor, im going to copy all them here because i have all them opened in the hexeditor right now, im going to mark in bold the bytes that calls my attention
All this data chunks are located at relative offset 0x1200 in sherwood dumps (in other words, is the NVS2 region)

DYN-001 / SW-301

01 FF 05 FF FF FF FF FF FF FF 00 FF FF FF FF FF
FF FF FF FE FF FF FF FF 00 00 00 12 00 00 00 00

SUR-001 / SW-302

01 FF 05 FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FE FF FF FF FF 00 00 00 04 00 00 00 00

JTP-001 / SW2-303

01 FF 05 FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FE FF FF FF FF 00 00 00 01 00 00 00 00

KTE-001 / SW3-301

01 FF 05 FF FF FF FF FF FF FF FF FF FF FF DA FF
FF FF FF FE FF FF FF FF 00 00 00 12 00 00 00 00

MPX-001 eMMC / SW3-302

01 FF 05 FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FD FF FF FF FF 00 00 00 12 00 00 00 00

MSX-001 NOR / SW3-302

01 FF 05 FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FE FF FF FF FF 00 00 00 12 00 00 00 00

NPX-001 NOR / SW3-302

01 FF 05 FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FE FF FF FF FF 00 00 00 12 00 00 00 00

PQX-001 NOR / SW3-304

01 FF 05 FF FF FF FF FF FF FF FF FF FF FF F5 FF
FF FF FF FE FF FF FF FF 00 00 00 12 00 00 00 00

REX-001 eMMC / SW3-304

01 FF 05 FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FD FF FF FF FF 00 00 00 13 00 00 00 00

The QA Flag exist flag (byte 0x0A) in the DYN-001 means that the previous owner enabled the QA flag, right ?... so value 0x00 means that there is a "QA token" in other area of the syscon EEPROM ?
And the QA token is located at relative offset 0x133E, length 0x50 ?

The XDR_Link_Init failure flag (byte 0x0E) have value 0xDA in KTE-001, and value 0xF5 in the PQX-001
This is an indication that there is a critical problem in the main system RAM, right ?. Im not sure how this works but i guess to return to normality (after a successful repair) this flag should return to the default value 0xFF (in other words, not flagged)... im wondering what could happen if we force it to default by overwriting it

The most interesting is the flash ext flag (byte 0x13)... it seems all the motherboards with NOR flash have the value 0xFE... and the motherboards with eMMC flash value 0xFD
Not sure if someone realized about this before, but it seems we can enable/disable the eMMC here

The Safe Mode System Language (byte 0x1B) follows the standard language codes ? and should be converted this way ?
01 = English USA
04 = German
12 = English UK
13 = Turkish

 

[vyktormvmpay25]

I will keep those 2 boards for further experiments cok002 with modchip and sur001 with dead rsx (glod).
I was intending to get a full syscon dump from sur001 but not sure how.
Yes that sur board had 05 on 1202 before, it didn't show nothing on putty without changing on 02.

 

[M4j0r]

Im not sure where you found that info about writing value 02 at address 1202 to enable the SouthBridge debugging for sherwoods, but is correct, i guess m4j0r mentioned it somewhere and i missed it
It surprises me a bit because is something i realized a couple of days ago while taking another looks at your syscon dumps, and is not well explained in wiki

You just have to use this table: https://www.psdevwiki.com/ps3/SC_EE..._Block_Offset_Mapping_Table_.28NVS_Service.29 .

The QA Flag exist flag (byte 0x0A) in the DYN-001 means that the previous owner enabled the QA flag, right ?... so value 0x00 means that there is a "QA token" in other area of the syscon EEPROM ?
And the QA token is located at relative offset 0x133E, length 0x50 ?

Yes, or that at least at some point the qa token was stored there.

The XDR_Link_Init failure flag (byte 0x0E) have value 0xDA in KTE-001, and value 0xF5 in the PQX-001
This is an indication that there is a critical problem in the main system RAM, right ?. Im not sure how this works but i guess to return to normality (after a successful repair) this flag should return to the default value 0xFF (in other words, not flagged)... im wondering what could happen if we force it to default by overwriting it

Yes, lv0ldr uses it store the XDR link init error.

The most interesting is the flash ext flag (byte 0x13)... it seems all the motherboards with NOR flash have the value 0xFE... and the motherboards with eMMC flash value 0xFD
Not sure if someone realized about this before, but it seems we can enable/disable the eMMC here

Yes, it's related to the flash storage configuration.

 

[vyktormvmpay25]

Accidentally think I've sorted the 10 seconds settings. I think it's about cell temperature.
If initial temperature will grow in less than 10 seconds there will be no SB debugging init on syscon uart or not show on SB uart. Been struggling to get message with SB debugging on syscon uart, then to see on second SB uart port message with bootloader(set 1202 02, many logs, on/off etc) . Nothing.I'm using two separate adaptors.
This board is dyn001 that someone tried to flash and it was reversed. Though is a flash issue but is same thing with normal flash.
This does not have any reball/reflow or delid.
Only errlog 1200 and 2130 (nothing more than 2 errors.)
After went cool starting from syscon and running tmp 0 many times, in less than 10 seconds I got from 37 ° to 50°. And after another 20 seconds got 75, and on about 30 seconds sound of overheat.
Now I did not delid, if it matters I will wait suggestions.
Got a lot of 4 junk boards that someone tried to "fix ". Well at least for 30 dollars I got what I've paid.

 

[sandungas]

I was intending to get a full syscon dump from sur001 but not sure how.

Take another read at the RSX frankenstein thread, in the first 10 (or 15) pages there is a conversation in between @lcferrum and @M4j0r about how to make a full syscon dump
Use your web browser to search for his nicks (CTRL+F keys) and read his posts

The resume of the story is... you need to install a custom syscon patch that replaces some of the syscon HDMI functions by an exploit. After that, you need to boot the PS3 without an HDMI cable connected to trigger the exploit and the syscon is going to start printing in the terminal screen a lot of bytes
And when syscon stops printing you need to copypaste everything to a .TXT and use notepad++ (or other decent editor) to cleanup the .TXT (by using the notepad++ "find and replace" feature to remove spaces, etc..) and convert evrything into a single line of bytes... then copy that single line of bytes into a "new file" in a hexeditor and save it as .BIN

This custom patch can be installed by using some of the UART commands, right now im not sure which commands, but there is something to force a syscon patch installation... the problem in this specific DYN-001 motherboard is that you cant install the custom syscon patch because you already have an official sycon patch installed, reported in the "more system information" screen as:
0832 @ 00010002083E0832

So.. the first step is to remove the official syscon patch, basically we need to fill with 0xFF's 2 regions in the EEPROM named "patch1" and "patch2", and as far i understood there are 2 ways to do it in a working PS3 with CFW, either by creating a PUP with a dummy syscon patch inside and installing it, or by using a PS3 program (but im not sure if this program exists)
It seems in the frankenstein thread they did it by installing a PUP

So you need to install a PUP (to remove the official syscon patch), then you need to install the custom patch by UART, and finally boot the PS3 without HDMI and cleanup all the data syscon is going to puke

You depend of @M4j0r for both patches, ask him gently if he wants to provide the requires files
That DYN-001 dump is interesting (with a SW2-301 syscon), as you can see in this list is marked in red as "not dumped yet"

Accidentally think I've sorted the 10 seconds settings. I think it's about cell temperature.
If initial temperature will grow in less than 10 seconds there will be no SB debugging init on syscon uart or not show on SB uart. Been struggling to get message with SB debugging on syscon uart, then to see on second SB uart port message with bootloader(set 1202 02, many logs, on/off etc) . Nothing.I'm using two separate adaptors.
This board is dyn001 that someone tried to flash and it was reversed. Though is a flash issue but is same thing with normal flash.
This does not have any reball/reflow or delid.
Only errlog 1200 and 2130 (nothing more than 2 errors.)
After went cool starting from syscon and running tmp 0 many times, in less than 10 seconds I got from 37 ° to 50°. And after another 20 seconds got 75, and on about 30 seconds sound of overheat.
Now I did not delid, if it matters I will wait suggestions.
Got a lot of 4 junk boards that someone tried to "fix ". Well at least for 30 dollars I got what I've paid.

Well, the error 1200 is the natural consequence of an overheating, but thats not the cause of the problem
And the error 2130 is pointing fingers to this component, is located very close to CELL
https://www.psdevwiki.com/ps3/File:Texas_Instrument_Remote_Junction_Temperature_Sensor_TMP411A.jpg
There is an introduction about this components here:
https://www.psdevwiki.com/ps3/Thermal
Another long story short... are named "remote" temperature monitors because the connection in between them and the syscon happens in a I2C data bus (only 2 wires)
Is a bit like in a USB cable that only have 2 data wires, and you can connect many USB devices to the same 2 wires, and every device is given an identifyer

The thermal monitors works that way too, are connected in cascade, if one of them is working it means the data bus is fine... and the other... dunno
I dont know any way to fail check them, but in this PS3 model are identical (only differs in his ID, as far i remember one have ID=0 and the other ID=1, and this ID's are given at factory... actually is printed in them as part as his model/serial)
So... you could meassure his internal resistivity or other tricks like that... in theory both should give you the same values
There are datasheets availables for them if you want to go technical

Anyway, after some basic checks i suggest to replace it from another scrap motherboard (remember it needs to be the one next to CELL just because his ID is like hardcoded in it) and see what happens
I never heard anyone reporting your exact problem, this is the kind of component that either works fine or doesnt works at all... but working partially is very unusual

--------
Btw @M4j0r the other day i was reading the datasheet of one of this remote thermal monitors and there is a feature that called my attention (i need to check it again at some point, i didnt dedicated it much time)
It seems they allows to be "configured", lets say... when the device boots (in this case the PS3) there is another component (in this case the syscon) that is able to send some kind of configuration to them (i guess to make some kind of calibration)

And as you can imagine at this point of the brainstorming im thinking in the 5*2 bytes of the "unk_2" and "unk_3" areas of ther thermal config region

 

[vyktormvmpay25]

Had suggested that ic exchange for a cok002 for someone in faults thread,he recovered that unit, he reported some kind of TIC gd 900 to be better for this unit, I'm not thinking to exchange until I do an delid on both. If after delid they don't give stability of temperature I will exchange it for cpu. If not I will do full reball. Even if its working I have to desolder both. I have not got în last 4 years an unit refurbished returned from costumers because all were fully reballed. Only case got 2 units, one a superslim that was only thermal exchange, was tested 2~3 days fine and returned after 2 weeks with simptoms of overheat rsx 40nm (some bad contacts under ic, probably costumer dropped unit can't say did not see any visible damage) second unit was dyn001 with artefacts on screen after 2 months, was fully reballed, exchanged rsx same results so I assume board is failing, didn't get any more complex details, was in 2018, think I still have it on shelf. Anyway thank you for your help, I will look into full dump with time, interested in this because I may get at one point in a case where cfw unit getting cpu dead and I may recover it with cpu from 3000 kte001 series (have about 6 boards with good cpu, rsx ported to different boards).

 

[sandungas]

Well, you reported over 75ºC in less than 1 minute, and im assuming the heatsink and thermal paste over IHS are fine because you are used to it so in my oppinion the most probable cause of the problem is the thermal monitor chip
If you are confident with delidding do it first, but the only way i see for the thermal paste under the IHS to give that horrible temperatures is if at some point the IHS was displaced

I mean... maybe the IHS was sticked hard to the heatsink and when pulling from the heatsink the IHS unsticked from the DIE. The thermal paste under the IHS was dry and was "broken" in small pieces and some pieces of the thermal paste was moved and created a "bump" under the IHS... so the heat is not able to be transfered correctly from the DIE ---> to the IHS
Thats the only way i see to have that horrible temperature (if we consider the values given by the thermal monitor chip is correct)

What you can do as a test is to try to move (or rotate) the CELL IHS with your hands... if it moves thats a very bad signal (or in other words... is a great signal because you found the problem !)

And im not so sure if a BGA defect (the line that connects the external thermal monitor chip with the thermal sensor inside CELL) could cause high temperature values but i would not put the motherboard into stress yet, better do a delidding and the replacement of the thermal monitor chip... if the motherboard is not fixed after that this is going to be a bit unusual

 

[vyktormvmpay25]

Just started, will see after rsx delid.

 

[M4j0r]

The resume of the story is... you need to install a custom syscon patch that replaces some of the syscon HDMI functions by an exploit. After that, you need to boot the PS3 without an HDMI cable connected to trigger the exploit and the syscon is going to start printing in the terminal screen a lot of bytes

That's the Mullion method, Sherwood works different.

So.. the first step is to remove the official syscon patch, basically we need to fill with 0xFF's 2 regions in the EEPROM named "patch1" and "patch2", and as far i understood there are 2 ways to do it in a working PS3 with CFW, either by creating a PUP with a dummy syscon patch inside and installing it, or by using a PS3 program (but im not sure if this program exists)
It seems in the frankenstein thread they did it by installing a PUP

On Mullion either using the EEPROM interface, UART commands (Sony patch removed), PUP file or Linux.
On Sherwood only using a PUP file or Linux.

So you need to install a PUP (to remove the official syscon patch), then you need to install the custom patch by UART, and finally boot the PS3 without HDMI and cleanup all the data syscon is going to puke

You depend of @M4j0r for both patches, ask him gently if he wants to provide the requires files
That DYN-001 dump is interesting (with a SW2-301 syscon), as you can see in this list is marked in red as "not dumped yet"

I think you meant SUR-001 with SW2-302. The SW2-301 is dumped.
You can already see the dump patch for Sherwood in the SW2 dump I released, it works differently. After you install it the PS3 doesn't soft brick, instead Syscon gets a new UART command which is used to dump the fimware. You don't even have to remove the patch because it's not removing/changing any code, only adding the UART command. I can create some PUP for the SUR-001 later this week, but that only makes sense if the console is working .

And when syscon stops printing you need to copypaste everything to a .TXT and use notepad++ (or other decent editor) to cleanup the .TXT (by using the notepad++ "find and replace" feature to remove spaces, etc..) and convert evrything into a single line of bytes... then copy that single line of bytes into a "new file" in a hexeditor and save it as .BIN

You can just use the binary file save option of putty/teraterm etc. , that's easier.

@M4j0r the other day i was reading the datasheet of one of this remote thermal monitors and there is a feature that called my attention (i need to check it again at some point, i didnt dedicated it much time)
It seems they allows to be "configured", lets say... when the device boots (in this case the PS3) there is another component (in this case the syscon) that is able to send some kind of configuration to them (i guess to make some kind of calibration)

And as you can imagine at this point of the brainstorming im thinking in the 5*2 bytes of the "unk_2" and "unk_3" areas of ther thermal config region

Yes, that makes sense. Actually I was thinking about that when I saw the Cytology rsx thermal configuration section.
It seems like the RSX and thermal sensors do get some configuration data.

 

[vyktormvmpay25]

Not sure if this is going to help us much , it's something to understand where updates are going ,you guys probably know all this , I didn't
evilnat nobdrom cfw487

Spoiler

Boot Loader SE Version 4.8.6 (Build ID: 5353,50715, Build Date: 2020-01-30_11:23:58)
SDK Version: 486.000
Copyright(C) 2020 Sony Computer Entertainment Inc.All Rights Reserved.
[INFO]: === eXtreme Data Rate Memory Subsystem ===
[INFO]: (Configured Memory Size per single XIO channel: 128 MBytes.)
[INFO]: XIO channel[0] is available.
[INFO]: XIO channel[1] is available.
[INFO]: ---> Total 256 MBytes are now in use.
[INFO]: SPU enable [0, 1, 2, 5, 6, 7] 11101111
[INFO]: BE:12S DD2.0, SB:ZX1.1
Cell OS SDK4.8.6 000 (release build: r50715 2020_01_30_110000)
Copyright 2020 Sony Computer Entertainment Inc.
revision: 50702
date:     Thu Jan 30 11:25:44 JST 2020
storage: ACL check will be skipped for device id ffffffffffffffff
storage: ACL check will be skipped for device id 0
storage: ACL check will be skipped for device id 1
storage: ACL check will be skipped for device id 2
storage: ACL check will be skipped for device id 3
lv2(0): total memory size: 249MB+640KB
lv2(0): kern memory size:   12MB+640KB (heap:3492KB  page pool:4736KB)
lv2(0): user memory size:  237MB
lv2(2):
lv2(2): Cell OS Lv-2 32 bit version 4.8.6
lv2(2): Copyright 2011 Sony Computer Entertainment Inc.
lv2(2): All Rights Reserved.
lv2(2):
lv2(2): revision: 50715
lv2(2): build date: 2020/01/30 11:30:24
lv2(2): processor: Broadband Engine  Ver 0x0000  Rev 0x2100
lv2(2): PPU:0, Thread:0 is enabled.
lv2(2): PPU:0, Thread:1 is enabled.
lv2(2): rsx:      rsx65 a06 500/650 vpe:ff shd:6f  [AP0011604:1:1:8:e:b:2:5:2][3d:0:3:0:1:2:0][2:1:0]
lv2(2): Available physical SPUs: 6/7
lv2(2): mounting the flash file system : ........... Failed (error code:0x8001002b)
lv2(2):
lv2(2): ###
lv2(2): ### Vflash recovery mode
lv2(2): ###
lv2(2):
lv2(2): creating the vflash recover process (emergency program) : OK
lv2(2): probe hdd
lv2(2): (v)HDD found.
lv2(2): probe hdd done
lv2(2): vflash is enabled. search system region.
lv2(2): search system region
lv2(2): device_id = 0x101000000000007, system_region_id = 0x1
lv2(2): sys_storage_get_region_acl() failure = 0x6
lv2(2): system region not found(mode = 0).
lv2(2): search system region done.
lv2(2): search flash regions
lv2(2): /dev_flash is broken. need format(ret = 0x8001002b)
lv2(2): sys_storage_get_device_info() failure = 0x80010002
lv2(2): system region size is invalid
lv2(2): not found flash regions.
lv2(2): vflash region is broken. force to create system region.
lv2(2): search normal region
lv2(2): storage region not found.
lv2(2): normal region 1 not found.
lv2(2): search normal region done.
lv2(2): search normal region
lv2(2): storage region not found.
lv2(2): normal region 2 not found.
lv2(2): search normal region done.
lv2(2): search update package
lv2(2): seach update package in GAME disc
HERE I DIN'T HAD BDROM ATTACHED!

Boot Loader SE Version 4.8.6 (Build ID: 5353,50715, Build Date: 2020-01-30_11:23:58)
SDK Version: 486.000
Copyright(C) 2020 Sony Computer Entertainment Inc.All Rights Reserved.
[INFO]: === eXtreme Data Rate Memory Subsystem ===
[INFO]: (Configured Memory Size per single XIO channel: 128 MBytes.)
[INFO]: XIO channel[0] is available.
[INFO]: XIO channel[1] is available.
[INFO]: ---> Total 256 MBytes are now in use.
[INFO]: SPU enable [0, 1, 2, 5, 6, 7] 11101111
[INFO]: BE:12S DD2.0, SB:ZX1.1
Cell OS SDK4.8.6 000 (release build: r50715 2020_01_30_110000)
Copyright 2020 Sony Computer Entertainment Inc.
revision: 50702
date:     Thu Jan 30 11:25:44 JST 2020
storage: ACL check will be skipped for device id ffffffffffffffff
storage: ACL check will be skipped for device id 0
storage: ACL check will be skipped for device id 1
storage: ACL check will be skipped for device id 2
storage: ACL check will be skipped for device id 3
storage: ACL check will be skipped for device id 4
lv2(0): total memory size: 249MB+640KB
lv2(0): kern memory size:   12MB+640KB (heap:3492KB  page pool:4736KB)
lv2(0): user memory size:  237MB
lv2(2):
lv2(2): Cell OS Lv-2 32 bit version 4.8.6
lv2(2): Copyright 2011 Sony Computer Entertainment Inc.
lv2(2): All Rights Reserved.
lv2(2):
lv2(2): revision: 50715
lv2(2): build date: 2020/01/30 11:30:24
lv2(2): processor: Broadband Engine  Ver 0x0000  Rev 0x2100
lv2(2): PPU:0, Thread:0 is enabled.
lv2(2): PPU:0, Thread:1 is enabled.
lv2(2): rsx:      rsx65 a06 500/650 vpe:ff shd:6f  [AP0011604:1:1:8:e:b:2:5:2][3d:0:3:0:1:2:0][2:1:0]
lv2(2): Available physical SPUs: 6/7
lv2(2): mounting the flash file system : ........... Failed (error code:0x8001002b)
lv2(2):
lv2(2): ###
lv2(2): ### Vflash recovery mode
lv2(2): ###
lv2(2):
lv2(2): creating the vflash recover process (emergency program) : OK
lv2(2): probe hdd
lv2(2): (v)HDD found.
lv2(2): probe hdd done
lv2(2): vflash is enabled. search system region.
lv2(2): search system region
lv2(2): device_id = 0x101000000000007, system_region_id = 0x1
lv2(2): sys_storage_get_region_acl() failure = 0x6
lv2(2): system region not found(mode = 0).
lv2(2): search system region done.
lv2(2): search flash regions
lv2(2): /dev_flash is broken. need format(ret = 0x8001002b)
lv2(2): sys_storage_get_device_info() failure = 0x80010002
lv2(2): system region size is invalid
lv2(2): not found flash regions.
lv2(2): vflash region is broken. force to create system region.
lv2(2): search normal region
lv2(2): storage region not found.
lv2(2): normal region 1 not found.
lv2(2): search normal region done.
lv2(2): search normal region
lv2(2): storage region not found.
lv2(2): normal region 2 not found.
lv2(2): search normal region done.
lv2(2): search update package
lv2(2): seach update package in GAME disc
lv2(2): set drive policy failure = 0x989680
lv2(2): get_profile() failure
lv2(2): USB storage: id = 0x10300000000000a
lv2(2):         lun = 0x0
lv2(2):         info.vendor_id = 0x0
lv2(2):         info.device_id = 0x0
lv2(2):         info.sector_size = 0x200
lv2(2):         info.media_count = 0x1
lv2(2):         info.capacity = 0x1cd7000
lv2(2): lun = 0x0, dev_index = 0xa
lv2(2): index = 0x0, pkg_index = 0x2
lv2(2): mount USB storage 0
lv2(2): mp_name = /dev_usb000
lv2(2): umount /dev_usb000 failure = 0x80010002
lv2(2): mount USB storage 0(LUN=0x0)
lv2(2): dev_name = CELL_FS_IOS:USB_MASS_STORAGE000, mp_name = /dev_usb000
lv2(2): mount /dev_usb000 success
lv2(2): /dev_usb000/PS3/UPDATE/PS3UPDAT.PUP found
lv2(2): verify /dev_usb000/PS3/UPDATE/PS3UPDAT.PUP
lv2(2): Initializing
lv2(2): taking a while...
lv2(2): start Updating Proccess
lv2(2): Initialize elapsed time = 181 msec
lv2(2): check UPL
lv2(2): Check UPL elapsed time = 67 msec
lv2(2): check Package Size
lv2(2): get package size elapsed time = 20 msec
lv2(2): start Verifying Package only
lv2(2): update package elapsed time = 13456 msec
lv2(2): post processiong...
lv2(2): post processiong done
lv2(2): search update package done
lv2(2): search update package
lv2(2): seach update package in GAME disc
lv2(2): set drive policy failure = 0x989680
lv2(2): get_profile() failure
lv2(2): USB storage: id = 0x10300000000000a
lv2(2):         lun = 0x0
lv2(2):         info.vendor_id = 0x0
lv2(2):         info.device_id = 0x0
lv2(2):         info.sector_size = 0x200
lv2(2):         info.media_count = 0x1
lv2(2):         info.capacity = 0x1cd7000
lv2(2): lun = 0x0, dev_index = 0xa
lv2(2): index = 0x0, pkg_index = 0x2
lv2(2): mount USB storage 0
lv2(2): mp_name = /dev_usb000
lv2(2): umount /dev_usb000 success
lv2(2): mount USB storage 0(LUN=0x0)
lv2(2): dev_name = CELL_FS_IOS:USB_MASS_STORAGE000, mp_name = /dev_usb000
lv2(2): mount /dev_usb000 success
lv2(2): /dev_usb000/PS3/UPDATE/PS3UPDAT.PUP found
lv2(2): verify /dev_usb000/PS3/UPDATE/PS3UPDAT.PUP
lv2(2): Initializing
lv2(2): taking a while...
lv2(2): start Updating Proccess
lv2(2): Initialize elapsed time = 179 msec
lv2(2): check UPL
lv2(2): Check UPL elapsed time = 66 msec
lv2(2): check Package Size
lv2(2): get package size elapsed time = 21 msec
lv2(2): start Verifying Package only
lv2(2): update package elapsed time = 13444 msec
lv2(2): post processiong...
lv2(2): post processiong done
lv2(2): search update package done
lv2(2): probe hdd
lv2(2): (v)HDD found.
lv2(2): probe hdd done
lv2(2): vflash is enabled. search system region.
lv2(2): search system region
lv2(2): device_id = 0x101000000000007, system_region_id = 0x1
lv2(2): sys_storage_get_region_acl() failure = 0x6
lv2(2): system region not found(mode = 0).
lv2(2): search system region done.
lv2(2): search flash regions
lv2(2): /dev_flash is broken. need format(ret = 0x8001002b)
lv2(2): sys_storage_get_device_info() failure = 0x80010002
lv2(2): system region size is invalid
lv2(2): not found flash regions.
lv2(2): vflash region is broken. force to create system region.
lv2(2): search normal region
lv2(2): storage region not found.
lv2(2): normal region 1 not found.
lv2(2): search normal region done.
lv2(2): search normal region
lv2(2): storage region not found.
lv2(2): normal region 2 not found.
lv2(2): search normal region done.
lv2(2): not to be skipped formatting system region.
lv2(2): creating storage regions for (v)HDD...
lv2(2): create storage region: (region id = 1)
storage: ACL check will be skipped for device id 5
lv2(2): create storage region: (region id = 2)
lv2(2): format partition: (region_id = 2, CELL_FS_UTILITY:HDD0, CELL_FS_UFS)
lv2(2): create storage region: (region id = 3)
lv2(2): format partition: (region_id = 3, CELL_FS_UTILITY:HDD1, CELL_FS_FAT)
lv2(2): creating storage regions for (v)HDD done.
lv2(2): deleting old flash regions...
lv2(2): creating flash regions...
lv2(2): create storage region: (region id = 1)
lv2(2): create storage region: (region id = 2)
lv2(2): format partition: (region_id = 2, CELL_FS_IOS:BUILTIN_FLSH1, CELL_FS_FAT)
lv2(2): create storage region: (region id = 3)
lv2(2): format partition: (region_id = 3, CELL_FS_IOS:BUILTIN_FLSH2, CELL_FS_FAT)
lv2(2): create storage region: (region id = 4)
lv2(2): format partition: (region_id = 4, CELL_FS_IOS:BUILTIN_FLSH3, CELL_FS_FAT)
lv2(2): create storage region: (region id = 5)
lv2(2): create storage region: (region id = 6)
lv2(2): creating flash regions done.
lv2(2): setup environment for ps3updater
lv2(2): mount game cache
lv2(2): mount game cache success
lv2(2): mkdir /dev_hdd1/PS3UPDATE success
lv2(2): mkdir /dev_hdd1/PS3UPDATE/vsh success
lv2(2): mkdir /dev_hdd1/PS3UPDATE/vsh/etc success
lv2(2): mkdir /dev_hdd1/PS3UPDATE/data success
lv2(2): mkdir /dev_hdd1/PS3UPDATE/data/font success
lv2(2): verify /dev_usb000/PS3/UPDATE/PS3UPDAT.PUP
lv2(2): Initializing
lv2(2): taking a while...
lv2(2): start Updating Proccess
lv2(2): Initialize elapsed time = 215 msec
lv2(2): check UPL
lv2(2): Check UPL elapsed time = 67 msec
lv2(2): check Package Size
lv2(2): get package size elapsed time = 22 msec
lv2(2): start Verifying Package only
lv2(2): update package elapsed time = 15173 msec
lv2(2): post processiong...
lv2(2): post processiong done
lv2(2): copy /dev_usb000/PS3/UPDATE/PS3UPDAT.PUP to /dev_hdd1/PS3UPDATE/PS3UPDAT.PUP
lv2(2): copy id = 0x100, dst = /dev_hdd1/PS3UPDATE/ps3version.txt
lv2(2): copy id = 0x601, dst = /dev_hdd1/PS3UPDATE/ps3swu.self
lv2(2): extarct id = 0x201, dst = /dev_hdd1/PS3UPDATE
lv2(2): segment = 0x300, offset = 0x5b645c, size = 0xbc98000
lv2(2): file_num = 50
lv2(2): required patch_name : /BDIT_FIRMWARE_PACKAGE.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc24e65c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_301R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc24ec5c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_302R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc24f25c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_303R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc24f85c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_304R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc24fe5c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_306R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25045c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_308R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc250a5c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_310R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25105c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_312R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25165c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_314R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc251c5c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_316R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25225c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_318R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25285c, size = 0x280
lv2(2): required patch_name : /BLUETOOTH_FIRMWARE.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc252e5c, size = 0x280
lv2(2): required patch_name : /CORE_OS_PACKAGE.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25345c, size = 0x280
lv2(2): required patch_name : /dev_flash3_023.tar.aa.2020_07_22_154132.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc253a5c, size = 0x280
lv2(2): required patch_name : /dev_flash_000.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25405c, size = 0x280
lv2(2): required patch_name : /dev_flash_001.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25465c, size = 0x280
lv2(2): dir_num = 1
lv2(2): dirname = /dev_flash/data/font/
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/
lv2(2): file_num = 20
lv2(2): filename = /dev_flash/data/font/SCE-PS3-RD-R-LATIN2.TTF, offset = 0400, size = 0xd67c
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-RD-R-LATIN2.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-RD-R-LATIN.TTF, offset = 0de00, size = 0x95f4
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-RD-R-LATIN.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-VR-R-LATIN2.TTF, offset = 017600, size = 0x218b0
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-VR-R-LATIN2.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-SR-R-LATIN2.TTF, offset = 039200, size = 0x12ee8
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-SR-R-LATIN2.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-MT-B-LATIN.TTF, offset = 04c400, size = 0x12184
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-MT-B-LATIN.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-RD-L-LATIN.TTF, offset = 05e800, size = 0x9714
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-RD-L-LATIN.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-YG-R-KOR.TTF, offset = 068200, size = 0x79728
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-YG-R-KOR.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-RD-I-LATIN.TTF, offset = 0e1c00, size = 0x9ea4
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-RD-I-LATIN.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-RD-BI-LATIN.TTF, offset = 0ebe00, size = 0x9c80
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-RD-BI-LATIN.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-RD-LI-LATIN.TTF, offset = 0f5e00, size = 0xa038
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-RD-LI-LATIN.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-NR-L-JPN.TTF, offset = 0100200, size = 0x2f0eb4
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-NR-L-JPN.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-CP-R-KANA.TTF, offset = 03f1400, size = 0xf27c
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-CP-R-KANA.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-MT-BI-LATIN.TTF, offset = 0400a00, size = 0x13128
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-MT-BI-LATIN.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-MT-I-LATIN.TTF, offset = 0413e00, size = 0x133d8
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-MT-I-LATIN.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-SR-R-EXT.TTF, offset = 0427400, size = 0x43450
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-SR-R-EXT.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-RD-L-LATIN2.TTF, offset = 046ac00, size = 0xd7fc
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-RD-L-LATIN2.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-SR-R-LATIN.TTF, offset = 0478600, size = 0xd1b0
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-SR-R-LATIN.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-NR-R-JPN.TTF, offset = 0485a00, size = 0x2f5c38
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-NR-R-JPN.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-YG-B-KOR.TTF, offset = 077ba00, size = 0x78ec8
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-YG-B-KOR.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-NR-R-EXT.TTF, offset = 07f4c00, size = 0x443b8
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-NR-R-EXT.TTF
lv2(2): required patch_name : /dev_flash_002.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc254c5c, size = 0x280
lv2(2): dir_num = 0
lv2(2): file_num = 3
lv2(2): filename = /dev_flash/data/font/SCE-PS3-SR-R-JPN.TTF, offset = 0200, size = 0x47380c
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-SR-R-JPN.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-NR-B-JPN.TTF, offset = 0473e00, size = 0x2d9724
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-NR-B-JPN.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-MT-R-LATIN.TTF, offset = 074d800, size = 0x1202c
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-MT-R-LATIN.TTF
lv2(2): required patch_name : /dev_flash_003.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25525c, size = 0x280
lv2(2): dir_num = 1
lv2(2): dirname = /dev_flash/data/font/SONY-CC/
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SONY-CC/
lv2(2): file_num = 12
lv2(2): filename = /dev_flash/data/font/SCE-PS3-DH-R-CGB.TTF, offset = 0200, size = 0x7d8884
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-DH-R-CGB.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-RD-B-LATIN2.TTF, offset = 07d8e00, size = 0xd328
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-RD-B-LATIN2.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-YG-L-KOR.TTF, offset = 07e6400, size = 0x78f68
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-YG-L-KOR.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-RD-B-LATIN.TTF, offset = 085f600, size = 0x9430
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-RD-B-LATIN.TTF
lv2(2): filename = /dev_flash/data/font/SCE-PS3-VR-R-LATIN.TTF, offset = 0868e00, size = 0x10344
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SCE-PS3-VR-R-LATIN.TTF
lv2(2): filename = /dev_flash/data/font/SONY-CC/k006004ds.ttf, offset = 0879600, size = 0xeb94
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SONY-CC/k006004ds.ttf
lv2(2): filename = /dev_flash/data/font/SONY-CC/e046323ts.ttf, offset = 0888400, size = 0xd960
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SONY-CC/e046323ts.ttf
lv2(2): filename = /dev_flash/data/font/SONY-CC/c041056ts.ttf, offset = 0896000, size = 0x116dc
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SONY-CC/c041056ts.ttf
lv2(2): filename = /dev_flash/data/font/SONY-CC/n023055ms.ttf, offset = 08a7a00, size = 0xb38c
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SONY-CC/n023055ms.ttf
lv2(2): filename = /dev_flash/data/font/SONY-CC/e046323ms.ttf, offset = 08b3000, size = 0xc25c
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SONY-CC/e046323ms.ttf
lv2(2): filename = /dev_flash/data/font/SONY-CC/n023055ts.ttf, offset = 08bf600, size = 0xc9c0
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SONY-CC/n023055ts.ttf
lv2(2): filename = /dev_flash/data/font/SONY-CC/d013013ds.ttf, offset = 08cc200, size = 0x11174
lv2(2): dstname = /dev_hdd1/PS3UPDATE/data/font/SONY-CC/d013013ds.ttf
lv2(2): required patch_name : /dev_flash_004.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25585c, size = 0x280
lv2(2): dir_num = 2
lv2(2): dirname = /dev_flash/vsh/etc/
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/
lv2(2): dirname = /dev_flash/vsh/etc/print/
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/print/
lv2(2): file_num = 11
lv2(2): filename = /dev_flash/vsh/etc/layout_factor_table_720.txt, offset = 0400, size = 0x1ff
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/layout_factor_table_720.txt
lv2(2): filename = /dev_flash/vsh/etc/layout_grid_table_720.txt, offset = 0800, size = 0x3fd5
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/layout_grid_table_720.txt
lv2(2): filename = /dev_flash/vsh/etc/layout_grid_table_1080.txt, offset = 04a00, size = 0x41f6
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/layout_grid_table_1080.txt
lv2(2): filename = /dev_flash/vsh/etc/index.dat, offset = 08e00, size = 0x530
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/index.dat
lv2(2): filename = /dev_flash/vsh/etc/layout_factor_table_272.txt, offset = 09600, size = 0x1dd
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/layout_factor_table_272.txt
lv2(2): filename = /dev_flash/vsh/etc/version.txt, offset = 09a00, size = 0x502
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/version.txt
lv2(2): filename = /dev_flash/vsh/etc/layout_grid_table_480.txt, offset = 0a200, size = 0x3dc9
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/layout_grid_table_480.txt
lv2(2): filename = /dev_flash/vsh/etc/print/epson.pmd, offset = 0e400, size = 0x7154
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/print/epson.pmd
lv2(2): filename = /dev_flash/vsh/etc/layout_grid_table_272.txt, offset = 015800, size = 0x3df7
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/layout_grid_table_272.txt
lv2(2): filename = /dev_flash/vsh/etc/layout_factor_table_480.txt, offset = 019800, size = 0x1dc
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/layout_factor_table_480.txt
lv2(2): filename = /dev_flash/vsh/etc/layout_factor_table_1080.txt, offset = 019c00, size = 0x1f2
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/layout_factor_table_1080.txt
lv2(2): required patch_name : /dev_flash_005.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc255e5c, size = 0x280
lv2(2): required patch_name : /dev_flash_006.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25645c, size = 0x280
lv2(2): required patch_name : /dev_flash_007.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc256a5c, size = 0x280
lv2(2): required patch_name : /dev_flash_008.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25705c, size = 0x280
lv2(2): required patch_name : /dev_flash_009.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25765c, size = 0x280
lv2(2): required patch_name : /dev_flash_010.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc257c5c, size = 0x280
lv2(2): required patch_name : /dev_flash_011.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25825c, size = 0x280
lv2(2): required patch_name : /dev_flash_012.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25885c, size = 0x280
lv2(2): required patch_name : /dev_flash_013.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc258e5c, size = 0x280
lv2(2): required patch_name : /dev_flash_014.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25945c, size = 0x280
lv2(2): required patch_name : /dev_flash_015.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc259a5c, size = 0x280
lv2(2): required patch_name : /dev_flash_016.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25a05c, size = 0x280
lv2(2): required patch_name : /dev_flash_017.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25a65c, size = 0x280
lv2(2): required patch_name : /dev_flash_018.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25ac5c, size = 0x280
lv2(2): required patch_name : /dev_flash_019.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25b25c, size = 0x280
lv2(2): required patch_name : /dev_flash_020.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25b85c, size = 0x280
lv2(2): required patch_name : /dev_flash_021.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25be5c, size = 0x280
lv2(2): required patch_name : /dev_flash_022.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25c45c, size = 0x280
lv2(2): required patch_name : /MULTI_CARD_FIRMWARE.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25ca5c, size = 0x280
lv2(2): required patch_name : /RL_FOR_PACKAGE.img.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch for /RL_FOR_PACKAGE.img not found. skipped
lv2(2): required patch_name : /RL_FOR_PROGRAM.img.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch for /RL_FOR_PROGRAM.img not found. skipped
lv2(2): required patch_name : /SYS_CON_FIRMWARE_01000006.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25d05c, size = 0x280
lv2(2): required patch_name : /SYS_CON_FIRMWARE_01010303.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25d65c, size = 0x280
lv2(2): required patch_name : /SYS_CON_FIRMWARE_01020302.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25dc5c, size = 0x280
lv2(2): required patch_name : /SYS_CON_FIRMWARE_01030302.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25e25c, size = 0x280
lv2(2): required patch_name : /SYS_CON_FIRMWARE_01040402.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25e85c, size = 0x280
lv2(2): required patch_name : /SYS_CON_FIRMWARE_01050002.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25ee5c, size = 0x280
lv2(2): required patch_name : /SYS_CON_FIRMWARE_01050101.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25f45c, size = 0x280
lv2(2): required patch_name : /SYS_CON_FIRMWARE_S1_00010002083E0832.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25fa5c, size = 0x280
lv2(2): required patch_name : /UPL.xml.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc26005c, size = 0x280
lv2(2): segment = 0x300, offset = 0x5b645c, size = 0xbc98000
lv2(2): file_num = 50
lv2(2): required patch_name : /BDIT_FIRMWARE_PACKAGE.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc24e65c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_301R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc24ec5c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_302R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc24f25c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_303R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc24f85c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_304R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc24fe5c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_306R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25045c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_308R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc250a5c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_310R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25105c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_312R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25165c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_314R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc251c5c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_316R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25225c, size = 0x280
lv2(2): required patch_name : /BDPT_FIRMWARE_PACKAGE_318R.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25285c, size = 0x280
lv2(2): required patch_name : /BLUETOOTH_FIRMWARE.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc252e5c, size = 0x280
lv2(2): required patch_name : /CORE_OS_PACKAGE.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25345c, size = 0x280
lv2(2): required patch_name : /dev_flash3_023.tar.aa.2020_07_22_154132.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc253a5c, size = 0x280
lv2(2): required patch_name : /dev_flash_000.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25405c, size = 0x280
lv2(2): required patch_name : /dev_flash_001.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25465c, size = 0x280
lv2(2): required patch_name : /dev_flash_002.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc254c5c, size = 0x280
lv2(2): required patch_name : /dev_flash_003.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25525c, size = 0x280
lv2(2): required patch_name : /dev_flash_004.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25585c, size = 0x280
lv2(2): dir_num = 2
lv2(2): dirname = /dev_flash/vsh/etc/
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/
lv2(2): dirname = /dev_flash/vsh/etc/print/
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/print/
lv2(2): file_num = 11
lv2(2): filename = /dev_flash/vsh/etc/layout_factor_table_720.txt, offset = 0400, size = 0x1ff
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/layout_factor_table_720.txt
lv2(2): filename = /dev_flash/vsh/etc/layout_grid_table_720.txt, offset = 0800, size = 0x3fd5
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/layout_grid_table_720.txt
lv2(2): filename = /dev_flash/vsh/etc/layout_grid_table_1080.txt, offset = 04a00, size = 0x41f6
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/layout_grid_table_1080.txt
lv2(2): filename = /dev_flash/vsh/etc/index.dat, offset = 08e00, size = 0x530
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/index.dat
lv2(2): filename = /dev_flash/vsh/etc/layout_factor_table_272.txt, offset = 09600, size = 0x1dd
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/layout_factor_table_272.txt
lv2(2): filename = /dev_flash/vsh/etc/version.txt, offset = 09a00, size = 0x502
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/version.txt
lv2(2): filename = /dev_flash/vsh/etc/layout_grid_table_480.txt, offset = 0a200, size = 0x3dc9
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/layout_grid_table_480.txt
lv2(2): filename = /dev_flash/vsh/etc/print/epson.pmd, offset = 0e400, size = 0x7154
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/print/epson.pmd
lv2(2): filename = /dev_flash/vsh/etc/layout_grid_table_272.txt, offset = 015800, size = 0x3df7
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/layout_grid_table_272.txt
lv2(2): filename = /dev_flash/vsh/etc/layout_factor_table_480.txt, offset = 019800, size = 0x1dc
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/layout_factor_table_480.txt
lv2(2): filename = /dev_flash/vsh/etc/layout_factor_table_1080.txt, offset = 019c00, size = 0x1f2
lv2(2): dstname = /dev_hdd1/PS3UPDATE/vsh/etc/layout_factor_table_1080.txt
lv2(2): required patch_name : /dev_flash_005.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc255e5c, size = 0x280
lv2(2): required patch_name : /dev_flash_006.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25645c, size = 0x280
lv2(2): required patch_name : /dev_flash_007.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc256a5c, size = 0x280
lv2(2): required patch_name : /dev_flash_008.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25705c, size = 0x280
lv2(2): required patch_name : /dev_flash_009.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25765c, size = 0x280
lv2(2): required patch_name : /dev_flash_010.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc257c5c, size = 0x280
lv2(2): required patch_name : /dev_flash_011.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25825c, size = 0x280
lv2(2): required patch_name : /dev_flash_012.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25885c, size = 0x280
lv2(2): required patch_name : /dev_flash_013.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc258e5c, size = 0x280
lv2(2): required patch_name : /dev_flash_014.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25945c, size = 0x280
lv2(2): required patch_name : /dev_flash_015.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc259a5c, size = 0x280
lv2(2): required patch_name : /dev_flash_016.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25a05c, size = 0x280
lv2(2): required patch_name : /dev_flash_017.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25a65c, size = 0x280
lv2(2): required patch_name : /dev_flash_018.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25ac5c, size = 0x280
lv2(2): required patch_name : /dev_flash_019.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25b25c, size = 0x280
lv2(2): required patch_name : /dev_flash_020.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25b85c, size = 0x280
lv2(2): required patch_name : /dev_flash_021.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25be5c, size = 0x280
lv2(2): required patch_name : /dev_flash_022.tar.aa.2020_07_22_154105.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25c45c, size = 0x280
lv2(2): required patch_name : /MULTI_CARD_FIRMWARE.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25ca5c, size = 0x280
lv2(2): required patch_name : /RL_FOR_PACKAGE.img.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch for /RL_FOR_PACKAGE.img not found. skipped
lv2(2): required patch_name : /RL_FOR_PROGRAM.img.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch for /RL_FOR_PROGRAM.img not found. skipped
lv2(2): required patch_name : /SYS_CON_FIRMWARE_01000006.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25d05c, size = 0x280
lv2(2): required patch_name : /SYS_CON_FIRMWARE_01010303.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25d65c, size = 0x280
lv2(2): required patch_name : /SYS_CON_FIRMWARE_01020302.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25dc5c, size = 0x280
lv2(2): required patch_name : /SYS_CON_FIRMWARE_01030302.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25e25c, size = 0x280
lv2(2): required patch_name : /SYS_CON_FIRMWARE_01040402.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25e85c, size = 0x280
lv2(2): required patch_name : /SYS_CON_FIRMWARE_01050002.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25ee5c, size = 0x280
lv2(2): required patch_name : /SYS_CON_FIRMWARE_01050101.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25f45c, size = 0x280
lv2(2): required patch_name : /SYS_CON_FIRMWARE_S1_00010002083E0832.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc25fa5c, size = 0x280
lv2(2): required patch_name : /UPL.xml.pkg.spkg_hdr.1
lv2(2): segment = 0x501, offset = 0xc24e45c, size = 0x12400
lv2(2): file_num = 48
lv2(2): patch found: offset = 0xc26005c, size = 0x280
lv2(2): setup environment for ps3updater done.
lv2(2): umount game cache
lv2(2): umount game cache success
lv2(2):
lv2(2): Prepare to shutdown ....
lv2(2): Going to shutdown.
reset bd drive failed
system event id=0xe1, rtc=206559824, size=24 [0x453000c000000 0x0 0xcf00ffbe 0x0]
Boot Loader SE Version 4.8.6 (Build ID: 5353,50715, Build Date: 2020-01-30_11:23:58)
SDK Version: 486.000
Copyright(C) 2020 Sony Computer Entertainment Inc.All Rights Reserved.
[INFO]: === eXtreme Data Rate Memory Subsystem ===
[INFO]: (Configured Memory Size per single XIO channel: 128 MBytes.)
[INFO]: XIO channel[0] is available.
[INFO]: XIO channel[1] is available.
[INFO]: ---> Total 256 MBytes are now in use.
[INFO]: SPU enable [0, 1, 2, 5, 6, 7] 11101111
[INFO]: BE:12S DD2.0, SB:ZX1.1
Cell OS SDK4.8.6 000 (release build: r50715 2020_01_30_110000)
Copyright 2020 Sony Computer Entertainment Inc.
revision: 50702
date:     Thu Jan 30 11:25:44 JST 2020
storage: ACL check will be skipped for device id ffffffffffffffff
storage: ACL check will be skipped for device id 0
storage: ACL check will be skipped for device id 1
storage: ACL check will be skipped for device id 2
storage: ACL check will be skipped for device id 3
storage: ACL check will be skipped for device id 4
lv2(0): total memory size: 249MB+640KB
lv2(0): kern memory size:   12MB+640KB (heap:3492KB  page pool:4736KB)
lv2(0): user memory size:  237MB
lv2(2):
lv2(2): Cell OS Lv-2 32 bit version 4.8.6
lv2(2): Copyright 2011 Sony Computer Entertainment Inc.
lv2(2): All Rights Reserved.
lv2(2):
lv2(2): revision: 50715
lv2(2): build date: 2020/01/30 11:30:24
lv2(2): processor: Broadband Engine  Ver 0x0000  Rev 0x2100
lv2(2): PPU:0, Thread:0 is enabled.
lv2(2): PPU:0, Thread:1 is enabled.
lv2(2): rsx:      rsx65 a06 500/650 vpe:ff shd:6f  [AP0011604:1:1:8:e:b:2:5:2][3d:0:3:0:1:2:0][2:1:0]
lv2(2): Available physical SPUs: 6/7
lv2(2): mounting the flash file system : OK
lv2(2):
lv2(2): ###
lv2(2): ### Software update mode
lv2(2): ###
lv2(2):
lv2(2): mounting the builtin HDD1 : OK
lv2(2): creating the initial system process : OK
lv2(2):
lv2(2): Prepare to shutdown ....
lv2(2): Going to shutdown.
reset bd drive failed
Boot Loader SE Version 4.8.7 (Build ID: 5357,50723, Build Date: 2020-07-22_11:35:47)
SDK Version: 487.000
Copyright(C) 2020 Evilnat [Akatsuki]. Enjoy your CFW CEX!. 12/10/2020.
[INFO]: === eXtreme Data Rate Memory Subsystem ===
[INFO]: (Configured Memory Size per single XIO channel: 128 MBytes.)
[INFO]: XIO channel[0] is available.
[INFO]: XIO channel[1] is available.
[INFO]: ---> Total 256 MBytes are now in use.
[INFO]: SPU enable [0, 1, 2, 5, 6, 7] 11101111
[INFO]: BE:12S DD2.0, SB:ZX1.1
Cell OS SDK4.8.7 000 (release build: r50723 2020_07_22_110000)
Copyright 2020 Sony Computer Entertainment Inc.
revision: 50719
date:     Wed Jul 22 11:37:22 JST 2020
lv2(0): total memory size: 249MB+640KB
lv2(0): kern memory size:   12MB+640KB (heap:3492KB  page pool:4736KB)
lv2(0): user memory size:  237MB
lv2(2):
lv2(2): Cell OS Lv-2 32 bit version 4.8.7
lv2(2): Copyright 2011 Sony Computer Entertainment Inc.
lv2(2): All Rights Reserved.
lv2(2):
lv2(2): revision: 50723
lv2(2): build date: 2020/07/22 11:41:39
lv2(2): processor: Broadband Engine  Ver 0x0000  Rev 0x2100
lv2(2): PPU:0, Thread:0 is enabled.
lv2(2): PPU:0, Thread:1 is enabled.
lv2(2): rsx:      rsx65 a06 500/650 vpe:ff shd:6f  [AP0011604:1:1:8:e:b:2:5:2][3d:0:3:0:1:2:0][2:1:0]
lv2(2): Available physical SPUs: 6/7
lv2(2): mounting the flash file system : OK
lv2(2): creating the initial system process : OK
lv2(2): entering stand-alone mode.
lv2(2): system software: PS3 console mode (game memsize=200MB)
lv2(2): creating the system software process : OK
lv2(2): sys_init: system software process set-up done.
lv2(2): initial system process done.

I will do this type of research on SW3 models with first chance.

 

[sandungas]

That's the Mullion method, Sherwood works different.

There is somewhere i can read about how it works that dumping process in sherwoods ?

I think you meant SUR-001 with SW2-302. The SW2-301 is dumped.

Ops, yes, my mistake, i was confused while jumping around in between different wiki pages but now i see better, the DYN-001 is fully studied

You can already see the dump patch for Sherwood in the SW2 dump I released, it works differently. After you install it the PS3 doesn't soft brick, instead Syscon gets a new UART command which is used to dump the fimware. You don't even have to remove the patch because it's not removing/changing any code, only adding the UART command.

For sherwoods the patch is a single contiguos chunk of data, or is splitted in several parts at different offsets ?
I think i have the file you shared but can you tell me the offset and length of the patch/s applyed in it ?

On Mullion either using the EEPROM interface, UART commands (Sony patch removed), PUP file or Linux.
On Sherwood only using a PUP file or Linux.

I can create some PUP for the SUR-001 later this week, but that only makes sense if the console is working

The PUP needs to be crafted specifically for every motherboard/syscon model ?
I been thinking all this time at some point we could create a "SC_downgrader.PUP" containing 8 dummy patches (to overwrite the 8 official patches that exists)... based in littlebalup's DB firmware (only for CFW compatible PS3 models) or based in HFW (for all PS3 models)

You can just use the binary file save option of putty/teraterm etc. , that's easier.

Well, after knowing the exact steps and timings where we need to start "capturing" data is better that way
I just suggested to use copypaste to notepad++ because this way we have a chance to cleanup the posible disturbing text lines that could appear before or after syscon is "printing" the file

Yes, that makes sense. Actually I was thinking about that when I saw the Cytology rsx thermal configuration section.
It seems like the RSX and thermal sensors do get some configuration data.

In your struct from cytology it called my attention 6 consecutive values you named as "rsx_thermal_limit_unk_" [0-9].. and the other 6 at the end "unknown_" [4-9)
The fact that are 6 matches (retail mulion have 5... but in citology you should have 6)
And the fact that appears in 2 groups of 6 consecutive values each group matches with retail too

Just started, will see after rsx delid.

How it goes the repair of the DYN-001 ?, the last i know about it is you delidded CELL and RSX, but the PS3 was still reporting high CELL temperatures
And what happened after that ? did you try to replace the CELL thermal monitor chip ?

Btw, can you tell me the exact model/serial of both thermal monitor chips of the DYN-001 ?, in a previous post i said that are identical to the ones from JSD-001 (texas instruments TMP411A for CELL and TMP411B for RSX) but im not sure about it
I think we need to make an accurate list of them for all the PS3 motherboard models, if we are lucky this could help to identify the unknown bytes from the retail thermal configs

-------------------
Aaaaand btw, i had an idea for a test that you should try to fix the DYN-001, the goal is to try to see if there is a problem in between the thermal monitor chip (outside of CELL) and the thermal sensor (inside CELL)
Basically... you need to disconnect the pin that goes to the thermal sensor (this way syscon is not going to read the thermal sensor inside CELL)... and connect a custom thermal sensor in it of this type:

You know... is a probe with only 2 wires (pins D+ and D- in the thermal monitor chip)
And you need to place the probe next to the CELL (at his border).. or at the bottom of the motherboard, inserting the probe in the "hole" that have the motherboard under CELL

If the temperature value is aceptable i guess this is a proof that the thermal sensor inside CELL have some problem.. so is a valid repair (yeah a bit ghetto, but if it works it just works)

Also, keep in mind if our theory is correct about that "unk_2" and "unk_3" values from the thermal config region used to calibrate the sensor... you are going to be able to adjust his sensitivity and with a bit of work the temperatures meassured by the custom probe could be 100% valid (in theory you need to increase the sensistivity of the CELL thermal monitor because the custom probe is going to be located out of CELL)

 

[vyktormvmpay25]

I didn't work after exchange, 1200 is out, only 2130 error but now with 3 beeps. Probably cpu curved in middle and losing connection when I've heat to exchange. It will work after reball. If same error I will test exterior thermocouple as you say. I thinked for that, but first I want to see reball test to be more confident. Now I have left it aside, got another for reball with no errors or putty sb debugging, can hear recovery beeps.
Yes about TMP411A for CELL and TMP411B for Rsx you are right.

 

[M4j0r]

There is somewhere i can read about how it works that dumping process in sherwoods ?

Not really, since it doesn't involve anything special.
You install the patch and then you can use the 'extend' UART command to dump the firmware (@ 115200 baud).
Doesn't effect the console at all.

The PUP needs to be crafted specifically for every motherboard/syscon model ?
I been thinking all this time at some point we could create a "SC_downgrader.PUP" containing 8 dummy patches (to overwrite the 8 official patches that exists)... based in littlebalup's DB firmware (only for CFW compatible PS3 models) or based in HFW (for all PS3 models)

Yes, I have that on my list but I'll only do it one time (and we're still missing at least 1 soft id).

For sherwoods the patch is a single contiguos chunk of data, or is splitted in several parts at different offsets ?
I think i have the file you shared but can you tell me the offset and length of the patch/s applyed in it ?

It's in one part at 0x2000 (https://www.psdevwiki.com/ps3/System_Controller_Firmware#Sherwood_Patch_structure).