This translated guide was originally from Lukin here:

After being investigating nand's I found a solution. Let's patch a functional nand OFW 3.55 with our "keys" (bootloader_0, bootloader_1, IED, ISD, and metldr vtrm) console. This will enable USB ports and will begin factory mode.

Attention! If you have not much experience with the welder, start practicing with old motherboards. . I am not responsible for any damage that may occur in your console.

I use two infectus because it failed to detect both nands me. (Just go twice as fast in read / write) xD.


-Tester (recommended)
Welder-15 - 30W.
-Modchip Infectus (v1 or v2.)
-Cable Wrapping.
desoldering braid (optional but surely going to have to use xD)
Double-sided tape or hot melt gun (to fix the cables).
S.O-PC with Windows (better Xp)
-PSGRADE / PSKEY [..] JIG mode.
-Pen (with lv2diag.self [file1] and PS3UPDATE.PUP [waninkoko v2])


Flow Rebuilder 230.
Flow Rebuilder 350. [BETA]
Infectus-USB drivers (v3.1).
-Nand Functional OFW 3.55 (256MB). (Any model 256mb)
Hex-Editor (I used Hex Workshop Editor)
For legal reasons can not distribute the nand OFW 3.55.

1 - Welding infectus. We are going to follow this outline:

Very soothing and helps the soldier we all flux in both nands cables.

Note: With the +5 V, the infectus usb now work correctly, so no need to feed them.

1b-Powering the nands

Items in purple is where you put the nands approximately 1.80V. I've used a solution somewhat "mikey mouse" using 4 diodes to
reduce the +5 V which gives one of the outputs of the source.

2 - Reading the nands:

"I have evidence that there is no need to feed the nands as the flashing red light is sufficient, however I failed to detect without food for another site. Turning on the power-supply source. "We connect the pc infectus.

"We opened PS3NANDProgramer 1.41 (" LOAD DLL "then" connect "and we choose flash0 or flash1). If the welds are correct, we will leave the data nands "Flash info" (otherwise check with tester welding points in the nand). "The process of reading is around 15 minutes approx. "It is advisable to take more than two dump's of nands. (In case you have bad blocks, but infectus say no bad blocks).

Compare nands (flash0 and flash1) with Hex workshop program: TOOLS -> compare (select two of the same nand dumps) and found that they are identical. (Repeat the same with flash1). Guard well the CFW nands Wanin like gold brick. xD

3-Preparation of new Nand's.

First of all we will extract the contents of nand brick, then will patch our "keys" in the new nand.

"We opened FlowRebuilder350 "We selected the two nand CFW extracted in step 2 and select the output file. We would like to "dump" if the order of nands is right we will create a peak of 264 megawatts and a series of folders.

In one of these we find (FDI, CSD, metldr, bootloader_0, bootloader_1, ISD, vtrm) and core_os. (LV0, lv2, lv2_kernel.self .... spu's and others.)

OFW nands 3b-Patching

"We opened FlowRebuilder230 "We selected the two nand's (flash0 and flash1) OFW and choose the output file (interpolate nand's).

"Now we need to patch "We opened the nand nand WFC ofw and brick with hex editor that you like best. "Now we are copying the sectors of our nand to nand functional. (Find and replace). [With Hex workshop 6 you can see what you have checked, bottom right [cursor / caret / sel]

IED (Starts "0000000600001DD000000000000000000000007000000 8") SEL: 10000

ISD (We "000000030000027000000000000000000000004000000 0") SEL: 800

metldr (you seek "metldr" begins with "00 00 0E DA .." SEL: EDE0.

bootloader_1 (You have to look in your nand WFC (has the same header that bootloader_0). SEL: 400000.

bootloader_0 (found in the first offset, sel: 400000).

Vtrm (this look in HexEdit "sceivtrm" and replace them). SEL: 400000.

Once the changes, you keep the new patched nand.

Restoring 4b-ECC.

We open with 230 NandFlowRebuilder selecionamos "Desinterpolate in new Flashes."
-You select flash0 and flash1 (with the same order as in step 3b) and finally your arhiva patched.
The third tab, select the file that previously we had saved.
-Tight "Do Process" (we hope to complete successfully)
XD finish and now having the dumps XXX2.NEW XXXX.NEW and proceed to repair the ECC.
"We opened 1.30 NANDECC select the input file and the output, then click the" do process ". (We do this twice, once for each nand).
The ECC has to be repaired in the order of (450-550) if it is the wrong patched nand.

5-Writing nand's patched.

"We opened PS3NandProgrammer 1.41 and delete [ERASE] on the nand's content. (Repeat the process two or three times removed) "Then write the [WRITE] the two nands. (How the process of writing takes about 45minutes). (We found no bad blocks, if any, check welds).

Factory 6-mode

Now infectus disconnecting the pc, if you turn on the console, the LED should flash orange hd. (If it is not patched review and write nand nand.) (Because you have a bug)

Our console still does not work, however well-lit and read the usb ports. Nand has encrypted a file system (not yours). So let's create the new file system from nand. By having the correct keys on the console so you can enter factory mode and install the 3.55 v2 waninkoko frimware. (Do not probeis OFW factory when they leave you will have a nice brick mode again.)

"Once we introduce written PSGRADE / PSKEY ... etc, JIG mode, turn on the console (power + eject), will shut down to 20sec, then enter the pen with lv2diag.self and waninkoko update v2.

"After 10 minutes the console will turn off and will return to life. Then enter the pen with lv2diag.self [file2] and out of factory mode.

And this xD, the console and is alive! [Desoldering infectus and mount the console]

Update from rms here:

OK, so we all know about how the original Waninkoko firmware broke the older large NAND consoles, that was due to him overwriting some portions of Cell-OS Lv2 and the segment boundaries, god knows about the signature also. He also zeroed out a good section of the kernel, and also breaks some NAND consoles due to that. Now, you want to fix this issue? Well, you have to have:

1) A NAND Dumper
2) CORE_OS_PACKAGE.PKG patched to remove signature checks or Official Core OS/PS3 in Service Mode
3) A NAND Flasher
4) Flow Rebuilder
5) Hex editor
6) PS3 with firmware less than 3.55

OK, so you first have to dump both NAND chips (2 128MB NANDs for a total of 256MB) and interleave them using Flow Rebuilder, then decrypt the CORE_OS package to give you a raw core OS image, then open your combined NAND dump in a hex editor and search for “6F FF E0″ in the search for hex section. Once there, you should see:
00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 6f ff e0  |.............o..|
00000010  00 00 00 01 00 00 00 17  00 00 00 00 00 6f ff e0  |.............o..|
Right after the second “6F FF E0″, remove the next 7,340,000 bytes, then, insert the unpacked Core OS (7,340,000 bytes). Then split the image using Flow Rebuilder (use ECC!) and flash. Hopefully it should work, and then you can just Lv2diag your way out.

Do not overwrite anything else.

This guide should help you fix any NAND console with Core OS fail.