After being investigating nand's I found a solution. Let's patch a functional nand OFW 3.55 with our "keys" (bootloader_0, bootloader_1, IED, ISD, and metldr vtrm) console. This will enable USB ports and will begin factory mode.



Attention! If you have not much experience with the welder, start practicing with old motherboards. You must login or register to view this content.. I am not responsible for any damage that may occur in your console.

You must login or register to view this content.


I use two infectus because it failed to detect both nands me. (Just go twice as fast in read / write) xD.


Materials:

-Tester (recommended)
Welder-15 - 30W.
-Modchip Infectus (v1 or v2.)
-Cable Wrapping.
-Tin.
-Flux
-Stripper.
desoldering braid (optional but surely going to have to use xD)
Double-sided tape or hot melt gun (to fix the cables).
S.O-PC with Windows (better Xp)
-PSGRADE / PSKEY [..] JIG mode.
-Pen (with lv2diag.self [file1] and PS3UPDATE.PUP [waninkoko v2])


Programs:

-PS3NANDProgrammer1_41
Flow Rebuilder 230.
Flow Rebuilder 350. [BETA]
-NANDECC 130.
Infectus-USB drivers (v3.1).
-Nand Functional OFW 3.55 (256MB). (Any model 256mb)
Hex-Editor (I used Hex Workshop Editor)
For legal reasons can not distribute the nand OFW 3.55.

1 - Welding infectus. We are going to follow this outline:

You must login or register to view this content.

Very soothing and helps the soldier we all flux in both nands cables.

You must login or register to view this content.

Note: With the +5 V, the infectus usb now work correctly, so no need to feed them.

1b-Powering the nands

Items in purple is where you put the nands approximately 1.80V.
I've used a solution somewhat "mikey mouse" using 4 diodes to
reduce the +5 V which gives one of the outputs of the source.

You must login or register to view this content.

2 - Reading the nands:

"I have evidence that there is no need to feed the nands as the flashing red light is sufficient, however I failed to detect without food for another site.
Turning on the power-supply source.
"We connect the pc infectus.

"We opened PS3NANDProgramer 1.41 (" LOAD DLL "then" connect "and we choose flash0 or flash1).
If the welds are correct, we will leave the data nands "Flash info" (otherwise check with tester welding points in the nand).
"The process of reading is around 15 minutes approx.
"It is advisable to take more than two dump's of nands. (In case you have bad blocks, but infectus say no bad blocks).
Compare nands (flash0 and flash1) with Hex workshop program: TOOLS -> compare (select two of the same nand dumps) and found that they are identical. (Repeat the same with flash1).
Guard well the CFW nands Wanin like gold brick. xD

You must login or register to view this content.

3-Preparation of new Nand's.

First of all we will extract the contents of nand brick, then will patch our "keys" in the new nand.

"We opened FlowRebuilder350
"We selected the two nand CFW extracted in step 2 and select the output file. We would like to "dump" if the order of nands is right we will create a peak of 264 megawatts and a series of folders.
In one of these we find (FDI, CSD, metldr, bootloader_0, bootloader_1, ISD, vtrm) and core_os. (LV0, lv2, lv2_kernel.self .... spu's and others.)

OFW nands 3b-Patching

"We opened FlowRebuilder230
"We selected the two nand's (flash0 and flash1) OFW and choose the output file (interpolate nand's).

"Now we need to patch
"We opened the nand nand WFC ofw and brick with hex editor that you like best.
"Now we are copying the sectors of our nand to nand functional. (Find and replace).
[With Hex workshop 6 you can see what you have checked, bottom right [cursor / caret / sel]

IED( Empieza "0000000600001DD0000000000000000000000070000008") SEL: 10000

You must login or register to view this content.

ISD (Buscamos "0000000300000270000000000000000000000040000000") SEL: 800

You must login or register to view this content.

metldr (buscais "metldr" empieza con "00 00 0E DA.." SEL: EDE0.

You must login or register to view this content.

bootloader_1 (Teneis que buscarlo en vuestra nand cwf (tiene el mismo encabezado que el bootloader_0). SEL: 400000.

You must login or register to view this content.

bootloader_0 (se encuentra en el primer offset, sel: 400000).

You must login or register to view this content.

Vtrm (este buscamos en HexEdit "sceivtrm" y remplazamos). SEL: 400000.

You must login or register to view this content.


Once the changes, you keep the new patched nand.

Restoring 4b-ECC.

We open with 230 NandFlowRebuilder selecionamos "Desinterpolate in new Flashes."
-You select flash0 and flash1 (with the same order as in step 3b) and finally your arhiva patched.
The third tab, select the file that previously we had saved.
-Tight "Do Process" (we hope to complete successfully)
XD finish and now having the dumps XXX2.NEW XXXX.NEW and proceed to repair the ECC.
"We opened 1.30 NANDECC select the input file and the output, then click the" do process ". (We do this twice, once for each nand).
The ECC has to be repaired in the order of (450-550) if it is the wrong patched nand.

5-Writing nand's patched.

"We opened PS3NandProgrammer 1.41 and delete [ERASE] on the nand's content. (Repeat the process two or three times removed)
"Then write the [WRITE] the two nands. (How the process of writing takes about 45minutes). (We found no bad blocks, if any, check welds).

6-Factory mode

Now infectus disconnecting the pc, if you turn on the console, the LED should flash orange hd. (If it is not patched review and write nand nand.) (Because you have a bug)

Our console still does not work, however well-lit and read the usb ports. Nand has encrypted a file system (not yours). So let's create the new file system from nand. By having the correct keys on the console so you can enter factory mode and install the 3.55 v2 waninkoko frimware. (Do not probeis OFW factory when they leave you will have a nice brick mode again.)

"Once we introduce written PSGRADE / PSKEY ... etc, JIG mode, turn on the console (power + eject), will shut down to 20sec, then enter the pen with lv2diag.self and waninkoko update v2.

"After 10 minutes the console will turn off and will return to life. Then enter the pen with lv2diag.self [file2] and out of factory mode.

And this xD, the console and is alive! [Desoldering infectus and mount the console]

Greetings

Lukin.