Maybe it helps or not i donno but i want to share.
1 ) Dump your NOR/NAND on 3.55 -> outfile:dump355noqa
2 ) Update your system to 3.56+
3 ) Dump your NOR/NAND again for 3.56+ -> outfile:dump365noqa
4 ) Use your 3.55 dump and return back to 3.55
5 ) QA Flag your system this time and update to same firmware 3.56+
6 ) According to math "the flag stays even after updating". So Dump your NOR/NAND again -> outfile:dump365qa
7 ) Compare the files, "dump365noqa" and "dump365qa". Diff will spot the encrypted flagged data on nor/nand.
When you copy this diff data to another ps3 with same offset, it must qa flag your 3.56+.