It is about the size of the NAND. If it is big then the FW is inside NAND, if not then FW is on the drive... correct me if I am wrong...
I'm pretty sure that you're right, but if the NAND size smaller than firmware size it's also helpless cuz if NAND size allows keep info about currently installed firmware version means that you can't install older firmware than you already have.
I have three different PS3s. All, yet, retail units.
60GB PAL CECHC04 v3.15, 40GB CECHH12 NTSC-J v3.30 and a 120GB NTSC U/C CECH-2001A v3.15.
On all of them i did a full zero disk format to avoid misleading data to perform hard drive content analysis. Always, when restoring system software, they asked for the lastest firmware they were aware of.
I even tryied another approach, create on the same console, two fully functional disks. One with fw v3.15 and the other with fw v3.30.
After the update to 3.30, the other disk with 3.15 was rejected.
I chose the CECHH12 to this test, bearing in mind that it does not store its full firmware on NAND Flash on motherboard as CECHC04 is *supposed* to do. I said *supposed* to do.
It might sound a silly test to do, but i gave it a clean slate try.
If someone is wondering how to perform a full zero format it could be done
A linux box with root access, an available serial-ata port or one of those usb to sata external enclosures.
Plug-it and see with dmesg which device file your disk to format was bound to.
*Assuming* that your disk is, for example sda, type this:
$ dd if=/dev/zero of=/dev/sda bs=2M
Note: The block size value of 2M should be ok for most cases.
*BIG FAT WARNING*
By executing this command line on the wrong disk with root privileges it will access the raw device thus erasing everything. There is no data recover after this procedure.
So, use it *only* if you really know what is going on.
If you have doubts about dd command usage, i strongly suggest you to read and understand first the dd command man page.
Very good job man! Really interesting foundation! So this mean that actually we can downgrade firmware to specific as it pre ready to be downgraded to first firmware that was flashed in the Sony's Factory to those PS3s that you can see above!
Considering the large PS3 are all the same hardware wise including the debug units why would they be limited like that? I know the debug unit has a pup that allows you to downgrade, pity we can't use it on retail to test this theory.
Word of Warning: Be very careful trying to downgrade especially when trying to install Debug FW/Rewrite the same FW on the console. This caused the wiping of my NAND Flash and so a non-functioning console.
This is not yet a firmware downgrade on retail consoles but it gives you the correct start version.
For those wondering, ahh some day i will be able to downgrade to 1.00 to see what happens...
Things isn't that simple. The earliest version you, perhaps some day, be able to downgrade IS detemined by the hardware you own.
For your information about my consoles:
CECHC04 can go down to v1.00
CECHH12 can go down to v2.30
CECH-2001A can go down to v2.70
Take a look on the attached photos and see for yourself.
Nice find on the retail consoles - on a Debug unit, it is of course easier (it says it right under the 'Software Update' button)
As for downgrading, the problem becomes that the system also stores the FW version elsewhere sadly - makes things a tad difficult :/
taladas - some units are limited for a few reasons - subtle changes mainly. If you support a 256MB flash, then go down to a 16MB one, the old firmware will not know about the new system (tho, I suppose it could be patched)