i work unlocking/repairing gsm phones... some can be unlocked only by data cable and software. others require test point procedure (sony ericsson db2020/db2012 using dreambox, nokia bb5 using bb5box and others, siemens using martech, old sagem using SMTi, etc).
old sagem like use jtag to unlock. nokia bb5 phones uses a more complex way to skip code check procedure... then, when sw sends a wrong code to unlock phone, the test point device send a command saying "the code is right" and the phone unlocks itself.
rap3g nokia bb5 processor uses a lot of crypted procedures call, but the one about unlock code verify isn't crypted.
my question is if we can use ram attack or test point to skip some verifications in ps3 os, like that when it verify if the update file is for retail or debug station.