Editing Hardware flashing
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
<div style="float:right">[[File:Progskeet wiring to NANDs COK-002-idone-SAM 1765.jpg|200px|thumb|left|Progskeet wired to NANDs of a COK-002 board (photo:idone)]]<br /> | [[Category:Hardware]] | ||
[[File:PS3_Hardware.JPG|200px|thumb|left|Typical NOR flashing requires 16 Data wires, 23 Address wires and 3-4 control wires to the NOR pads (photo:defyboy)]]</div> | <div style="float:right">[[File:Progskeet wiring to NANDs COK-002-idone-SAM 1765.jpg|200px|thumb|left|Progskeet wired to NANDs of a COK-002 board (photo:idone)]]<br />[[File:PS3_Hardware.JPG|200px|thumb|left|Typical NOR flashing requires 16 Data wires, 23 Address wires and 3-4 control wires to the NOR pads (photo:defyboy)]]</div> | ||
Both early launch consoles which feature [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NAND NAND flash] memory (block devices, that interleave their data unlike [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NOR NOR flash]) and later consoles which feature [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NOR NOR flash] memory are able to be flashed. Currently the preferred method of flashing the dual-NAND consoles is by using an infectus modchip or similar (e.g. Progskeet). | |||
Both early launch consoles which feature [ | |||
Marcan has made a NOR flasher / address sniffer for his PS3 slim by re-purposing a FPGA board (Xilinx Spartan3E XC3S500E) made for Wii hacking. noralizer is a git repo that contains the HDL (verilog) and associated host computer tools for flashing/sniffing. There are ~50 signals to solder. | |||
... | |||
Work has been underway to brink a low cost AVR ([http://www.atmel.com/dyn/resources/prod_documents/7593S.pdf Atmel 90USB1286]) based NOR flasher that is capable of reading and writing on all consoles by defyboy. Other people havent been sitting idle either: uf6667 and Icekiller have developed [http://www.progskeet.com/ Progskeet], based on a [http://www.actel.com/documents/PA3_DS.pdf Actel A3P125 MCU] for NAND ánd NOR based consoles (not only PS3, but also useable for Wii and Xbox360) and "no_one" has developed PNM - Project Nor Manager. | |||
== | == NAND Wiring == | ||
Flashers for NAND based consoles (CECHA/COK-001, CECHB/COK-001, CECHC/COK-002, CECHD/unreleased, CECHE/COK-002W, CECHF/unreleased, CECHG/SEM-001) are generaly wired directly to the pins of the NAND, plus ground and Vcc. For NAND pinouts see: [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NAND Flash (Hardware) #NAND] | |||
There are 2 nands interleaved at the 512byte sectors level, giving a 1024 byte "interleaved sector". pages are 2kb on each nand. | |||
= | <div style="float:right">[[File:PS3_DualNand_Retail_ProgSkeet.png|200px|thumb|left|Dual NAND connection to Progskeet diagram, see http://progskeet.com/]]<br />[[File:Infectus-ps3-nand.png|200px|thumb|left|Dual NAND connection to Infectus diagram]]</div> | ||
" | |||
==== | <div style="height:420px; overflow:auto"> | ||
[ | {| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable sortable" style="border:1px solid #999; border-collapse: collapse;" | ||
|- bgcolor="#cccccc" | |||
==== | ! Chip/PIN !! Description !! [http://www.progskeet.com/download.php Progskeet] !! Infectus || Description | ||
|- | |||
!colspan="5" | NAND 0 | |||
|- | |||
=== | | style="color:white; background-color:darkgrey;" | 0/1-6 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection | ||
|- | |||
| 0/7 || R/B || 3 / gp13 || A9 || Read/Busy Output | |||
|- | |||
| | | 0/8 || RE || 98 / gp15 || A15 || Read Enable | ||
|- | |||
| 0/9 || CE || 7 / gp9 || A14 || Chip Enable | |||
|- | |||
| style="color:white; background-color:darkgrey;" | 0/10+11 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection | |||
|- | |||
| 0/12 || style="color:white; background-color:#CC3333;" | Vcc || style="color:white; background-color:#CC3333;" | +3.3 || style="color:white; background-color:darkgrey;" | not used / not connected || style="color:white; background-color:#CC3333;" | Vcc (min 2.7V-max 3.6V / typ 3.3V) | |||
|- | |||
| 0/13 || style="color:white; background-color:#333333;" | Vss || style="color:white; background-color:#333333;" | GND || style="color:white; background-color:darkgrey;" | not used / not connected || style="color:white; background-color:#333333;" | VSS - Ground | |||
|- | |||
| style="color:white; background-color:darkgrey;" | 0/14+15 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection | |||
|- | |||
| 0/16 || CLE || 4 / gp12 || A13 || Command Latch Enable | |||
|- | |||
| 0/17 || ALE || 5 / gp11 || A12 || Address Latch Enable | |||
|- | |||
| 0/18 || WE || 2 / gp14 || A11 || Write Enable | |||
|- | |||
| 0/19 || WP || 6 / gp10 || A10 || Write Protect | |||
|- | |||
| style="color:white; background-color:darkgrey;" | 0/20-28 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection | |||
|- | |||
| 0/29 || I/O-0 || 90 / dq8 || A0 || | |||
|- | |||
| 0/30 || I/O-1 || 91 / dq9 || A1 || | |||
|- | |||
| 0/31 || I/O-2 || 92 / dq10 || A2 || | |||
|- | |||
| 0/32 || I/O-3 || 93 / dq11 || A3 || | |||
|- | |||
| style="color:white; background-color:darkgrey;" | 0/33-35 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection | |||
|- | |||
| 0/36 || style="color:white; background-color:#333333;" | Vss || style="color:white; background-color:#333333;" | GND || style="color:white; background-color:darkgrey;" | not used / not connected || style="color:white; background-color:#333333;" | VSS - Ground | |||
|- | |||
| 0/37 || style="color:white; background-color:#CC3333;" | Vcc || style="color:white; background-color:#CC3333;" | +3.3 || style="color:white; background-color:darkgrey;" | not used / not connected || style="color:white; background-color:#CC3333;" | Vcc (min 2.7V-max 3.6V / typ 3.3V) | |||
|- | |||
| style="color:white; background-color:darkgrey;" | 0/38-40 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection | |||
|- | |||
| 0/41 || I/O-4 || 94 / dq12 || A4 || | |||
|- | |||
| 0/42 || I/O-5 || 95 / dq13 || A5 || | |||
|- | |||
| 0/43 || I/O-6 || 96 / dq14 || A6 || | |||
|- | |||
| 0/44 || I/O-7 || 97 / dq15 || A7 || | |||
|- | |||
| style="color:white; background-color:darkgrey;" | 0/45-48 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection | |||
|- | |||
! Chip/PIN !! Description !! [http://www.progskeet.com/download.php Progskeet] !! Infectus || Description | |||
|- | |||
!colspan="5" | NAND 1 | |||
|- | |- | ||
| style="color:white; background-color:darkgrey;" | 1/1-6 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection | |||
|- | |- | ||
| 1/7 || R/B || 64 / rdy || U || Read/Busy Output | |||
|- | |- | ||
| | | 1/8 || RE || 69 / oe || M || Read Enable | ||
|- | |- | ||
| | | 1/9 || CE || 60 / gp3 || N || Chip Enable | ||
|- | |- | ||
| | | style="color:white; background-color:darkgrey;" | 1/10+11 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection | ||
|- | |- | ||
| | | 1/12 || style="color:white; background-color:#CC3333;" | Vcc || style="color:white; background-color:#CC3333;" | +3.3 || style="color:white; background-color:darkgrey;" | not used / not connected || style="color:white; background-color:#CC3333;" | Vcc (min 2.7V-max 3.6V / typ 3.3V) | ||
|- | |- | ||
| | | 1/13 || style="color:white; background-color:#333333;" | Vss || style="color:white; background-color:#333333;" | GND || style="color:white; background-color:darkgrey;" | not used / not connected || style="color:white; background-color:#333333;" | VSS - Ground | ||
|- | |- | ||
| | | style="color:white; background-color:darkgrey;" | 1/14+15 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection | ||
|- | |- | ||
| | | 1/16 || CLE || 63 / gp0 || O || Command Latch Enable | ||
|- | |- | ||
| | | 1/17 || ALE || 62 / gp1 || P || Address Latch Enable | ||
|- | |- | ||
| | | 1/18 || WE || 65 / we || Q || Write Enable | ||
|- | |- | ||
| 1/19 || WP || 61 / gp2 || T || Write Protect | |||
|- | |- | ||
| | | style="color:white; background-color:darkgrey;" | 1/20-28 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection | ||
| | |||
|- | |- | ||
| | | 1/29 || I/O-0 || 79 / dq0 || D0 || | ||
|- | |- | ||
| | | 1/30 || I/O-1 || 80 / dq1 || D1 || | ||
|- | |- | ||
| | | 1/31 || I/O-2 || 81 / dq2 || D2 || | ||
|- | |- | ||
| | | 1/32 || I/O-3 || 82 / dq3 || D3 || | ||
|- | |- | ||
| | | style="color:white; background-color:darkgrey;" | 1/33-35 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection | ||
|- | |- | ||
| | | 1/36 || style="color:white; background-color:#333333;" | Vss || style="color:white; background-color:#333333;" | GND || style="color:white; background-color:darkgrey;" | not used / not connected || style="color:white; background-color:#333333;" | VSS - Ground | ||
|- | |- | ||
| | | 1/37 || style="color:white; background-color:#CC3333;" | Vcc || style="color:white; background-color:#CC3333;" | +3.3 || style="color:white; background-color:darkgrey;" | not used / not connected || style="color:white; background-color:#CC3333;" | Vcc (min 2.7V-max 3.6V / typ 3.3V) | ||
|- | |- | ||
| | | style="color:white; background-color:darkgrey;" | 1/38-40 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection | ||
|- | |- | ||
| | | 1/41 || I/O-4 || 83 / dq4 || D4 || | ||
|- | |- | ||
| | | 1/42 || I/O-5 || 84 / dq5 || D5 || | ||
|- | |- | ||
| | | 1/43 || I/O-6 || 85 / dq6 || D6 || | ||
|- | |- | ||
| | | 1/44 || I/O-7 || 86 / dq7 || D7 || | ||
|- | |- | ||
| | | style="color:white; background-color:darkgrey;" | 1/45-48 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection | ||
|- | |- | ||
!colspan="5" | Board trace | |||
|- | |- | ||
| GND || style="color:white; background-color:#333333;" | Vss || style="color:white; background-color:darkgrey;" | not used / not connected || style="color:white; background-color:#333333;" | GND || style="color:white; background-color:#333333;" | VSS - Ground | |||
|- | |- | ||
| | | +5VDC || style="color:white; background-color:#CC3333;" | Vcc || style="color:white; background-color:darkgrey;" | not used / not connected || style="color:white; background-color:#CC3333;" | 5V || style="color:white; background-color:#CC3333;" | Vcc from TH3401 (CECHA+CECHB/COK-001)<br />Vcc from TH3401 (CECHC+CECHE/COK-002)<br />Vcc from TH3280 (CECHG/SEM-001) | ||
|- | |- | ||
|} | |} | ||
</div> | |||
Remarks: | Remarks: | ||
* | * Progskeet is feeded from NAND 3.3V | ||
* Infectus is feeded from +5V board trace. | * Infectus is feeded from +5V board trace. | ||
* NAND's are feeded in both cases by the console itself. | * NAND's are feeded in both cases by the console itself. | ||
Progskeet Note: Some modification is needed for Progskeet to unbrick: | |||
* desolder R8 from the | * desolder R8 from the Progskeet PCB (to disable the connection from pad R8 to left pad R7) | ||
* left pin of [http://www.google.com/search?um=1&hl=nl&safe=off&tbm=isch&sa=1&q=switch+toggle toggle switch] to left lead of R7, middle pin of [http://www.google.com/search?um=1&hl=nl&safe=off&tbm=isch&sa=1&q=switch+toggle toggle switch] to right lead of R7 | * left pin of [http://www.google.com/search?um=1&hl=nl&safe=off&tbm=isch&sa=1&q=switch+toggle toggle switch] to left lead of R7, middle pin of [http://www.google.com/search?um=1&hl=nl&safe=off&tbm=isch&sa=1&q=switch+toggle toggle switch] to right lead of R7 | ||
* Vcc to +3.3 // put [http://www.google.com/search?um=1&hl=nl&safe=off&tbm=isch&sa=1&q=switch+toggle toggle switch] in "OFF" (right) postion, power on the ps3, put the [http://www.google.com/search?um=1&hl=nl&safe=off&tbm=isch&sa=1&q=switch+toggle toggle switch] in the "ON"/left position, it will be recognized by the PC, NAND is always on now, do everything as usual''. | * Vcc to +3.3 // put [http://www.google.com/search?um=1&hl=nl&safe=off&tbm=isch&sa=1&q=switch+toggle toggle switch] in "OFF" (right) postion, power on the ps3, put the [http://www.google.com/search?um=1&hl=nl&safe=off&tbm=isch&sa=1&q=switch+toggle toggle switch] in the "ON"/left position, it will be recognized by the PC, NAND is always on now, do everything as usual''. | ||
=== Using NAND flashers === | === Using NAND flashers === | ||
==== | ==== Progskeet ==== | ||
... nothing yet ... please help by adding this :) | |||
put switch in "OFF" (R7 is open) position so that | |||
power on the ps3 and wait for | put switch in "OFF" (R7 is open) position so that progskeet is not powered. | ||
put the switch in the "ON" (R7 closed) position, so | power on the ps3 and wait for 20-25 seconds, | ||
put the switch in the "ON" (R7 closed) position, so progskeet is powered and will be recognized by the PC. | |||
NAND is always on now, do everything as usual | NAND is always on now, do everything as usual | ||
select Big Block | select Big Block | ||
select Raw | select Raw | ||
Pages per block: 64 | Pages per block: 64 | ||
blocks: 1024 | blocks: 1024 | ||
That will give you 132MB (138,412,032 bytes) per NAND (dump time ~ 00:02:40 per NAND) | |||
===== downloads ===== | ===== downloads ===== | ||
All '''current''' downloads are available [http://www.progskeet.com/download.php here] / | All '''current''' downloads are available [http://www.progskeet.com/download.php here] | ||
* diagrams - for PS3: see above, but others are available here: [http://www.progskeet.com/downloads/diagrams_110805.rar diagrams_110805.rar] (backup/mirror: [http://www.multiupload.com/NYI9621BF5 diagrams_110805.rar (10.4 MB)]) | |||
* drivers - [http://www.progskeet.com/downloads/drivers_110812.rar drivers_110812.rar] (backup/mirror: [http://www.multiupload.com/H8GVGR9ITL drivers_110812.rar (264.07 KB)]) | |||
* flasher software - [http://www.progskeet.com/downloads/ProgSkeet_110819.rar ProgSkeet_110819.rar] (backup/mirror: [http://www.multiupload.com/ZH5WHAIWOZ ProgSkeet_110819.rar (32.27 KB)] | |||
==== Infectus ==== | ==== Infectus ==== | ||
Line 233: | Line 180: | ||
==== Needed NAND tools ==== | ==== Needed NAND tools ==== | ||
In case the flasher program doesnt understand dual NAND de/interleaving you'll need | In case the flasher program doesnt understand dual NAND de/interleaving you'll need : [http://www.sendspace.com/file/qhwkm5 FlowRebuilder v.4.1.0.0] / [http://www.multiupload.com/L9QPX7DIY5 FlowRebuilder v.4.1.3.2.exe (459.95 KB)] | ||
=== Dump NAND from GameOS === | === Dump NAND from GameOS === | ||
[http:// | [http://gitbrew.org/~glevand/ps3/pkgs/dump_flash.pkg dump_flash.pkg] // backup/mirror: [http://www.multiupload.com/545HXQ4FCD dump-flash+syscon.rar (280.51 KB)]<br /> | ||
[http:// | |||
Make sure USB stick is FAT32 with enough free space (256MB per dump) | Make sure USB stick is FAT32 with enough free space (256MB per dump) | ||
Line 286: | Line 209: | ||
addi %r12, %r4, 0x200 # r4 = start sector | addi %r12, %r4, 0x200 # r4 = start sector | ||
25MB NAND consoles have a hidden section of size 0x40000 (0x200 * 512 byte sector = 0x40000) hidden by the hv. The hv hides it at address 002786E8 | |||
Original code : 0x39840200f8010090<br /> | Original code : 0x39840200f8010090<br /> | ||
Change to : 0x39840000f8010090 | Change to : 0x39840000f8010090 | ||
Too dangerous to patch unless you peek/poke because obviously it messes with all the offsets | |||
=== 'NOR' Interface Testpoints on NAND consoles === | === 'NOR' Interface Testpoints on NAND consoles === | ||
Simular as on the NOR based consoles testpoints can be found on the back of the PCB. It seems these are from the bus between the [[South Bridge]] and the [[Starship2]]. Attempts have been made to document/trace these. Addresslines 0-17 and Datalines 0-15 as well as some controllines are documented but so far these could not be used to read/flash the console in a NOR fashion. | Simular as on the NOR based consoles testpoints can be found on the back of the PCB. It seems these are from the bus between the [[South Bridge]] and the [[Starship2]]. Attempts have been made to document/trace these. Addresslines 0-17 and Datalines 0-15 as well as some controllines are documented but so far these could not be used to read/flash the console in a NOR fashion. | ||
== NOR Interface Testpoints == | == NOR Interface Testpoints == | ||
Line 329: | Line 224: | ||
=== Tristate === | === Tristate === | ||
Tristate, or as it is referred to in the service manuals SB_DISABLE exists solely for the purpose of placing the [[South Bridge]] pins into high-impedance ( | Tristate, or as it is referred to in the service manuals SB_DISABLE exists solely for the purpose of placing the [[South Bridge]] pins into high-impedance (the third state) so that we can access the flash without the [[South Bridge]] interfering. | ||
Because the tristate pin is not connected to the [ | Because the tristate pin is not connected to the [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NOR NOR flash] TSOP package, but to the [[South Bridge]] BGA package, this makes tracing the pin quite difficult. One should be able to locate it by having the running you could ground out the unknown pins whilst checking the continuity of a known address or data line against ground. These should enter high-impedance or no-continuity when you ground out SB_DISABLE. | ||
=== Connecting NOR pads to flasher === | === Connecting NOR pads to flasher === | ||
<div style="float:right">[[File:Teensy2.0++.jpg|200px|thumb|left|Teensy 2.0 ++ connection diagram for PS3 NOR pads))]]</div><div style="float:right">[[File:Progskeet.png|200px|thumb|left|Progskeet NAND/NOR flasher board, based on Actel MCU, see http://progskeet.com/)]]</div> | |||
<div style="height:420px; overflow:auto"> | |||
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable sortable" style="border:1px solid #999; border-collapse: collapse;" | |||
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;" | |||
|- bgcolor="#cccccc" | |- bgcolor="#cccccc" | ||
! | ! PAD !! [http://www.progskeet.com/download.php Progskeet] !! Teensy2.0++<br />[http://git.dashhacks.com/norway NORway] || Remark | ||
|- | |- | ||
| A0 || adr0 || F0 || | |||
|- | |- | ||
| A1 || adr1 || F1 || | |||
|- | |- | ||
| | | A2 || adr2 || F2 || | ||
|- | |- | ||
| | | A3 || adr3 || F3 || | ||
|- | |- | ||
| | | A4 || adr4 || F4 || | ||
|- | |- | ||
| | | A5 || adr5 || F5 || | ||
|- | |- | ||
| A6 || adr6 || F6 || | |||
|- | |- | ||
| | | A7 || adr7 || F7 || | ||
|- | |- | ||
| | | A8 || adr8 || PA0 || | ||
|- | |- | ||
| A9 || adr9 || PA1 || | |||
|- | |- | ||
| A10 || adr10 || PA2 || | |||
|- | |- | ||
| | | A11 || adr11 || PA3 || | ||
|- | |- | ||
| | | A12 || adr12 || PA4 || | ||
|- | |- | ||
| | | A13 || adr13 || PA5 || | ||
|- | |- | ||
| | | A14 || adr14 || PA6 || | ||
|- | |- | ||
| | | A15 || adr15 || PA7 || | ||
|- | |- | ||
| | | A16 || adr16 || B0 || | ||
|- | |- | ||
| | | A17 || adr17 || B1 || | ||
|- | |- | ||
| | | A18 || adr18 || B2 || | ||
|- | |- | ||
| | | A19 || adr19 || B3 || | ||
|- | |- | ||
| | | A20 || adr20 || B4 || | ||
|- | |- | ||
| | | A21 || adr21 || B5 || | ||
|- | |- | ||
| | | A22 || adr22 || B6 || | ||
|- | |- | ||
| | | DQ0 || dq0 || D0 || | ||
|- | |- | ||
| | | DQ1 || dq1 || D1 || | ||
|- | |- | ||
| | | DQ2 || dq2 || D2 || | ||
|- | |- | ||
| | | DQ3 || dq3 || D3 || | ||
|- | |- | ||
| | | DQ4 || dq4 || D4 || | ||
|- | |- | ||
| | | DQ5 || dq5 || D5 || | ||
|- | |- | ||
| | | DQ6 || dq6 || D6 || | ||
|- | |- | ||
| | | DQ7 || dq7 || D7 || | ||
|- | |- | ||
| | | DQ8 || dq8 || C0 || | ||
|- | |- | ||
| | | DQ9 || dq9 || C1 || | ||
|- | |- | ||
| | | DQ10 || dq10 || C2 || | ||
|- | |- | ||
| | | DQ11 || dq11 || C3 || | ||
|- | |- | ||
| | | DQ12 || dq12 || C4 || | ||
|- | |- | ||
| | | DQ13 || dq13 || C5 || | ||
|- | |- | ||
| | | DQ14 || dq14 || C6 || | ||
|- | |- | ||
| | | DQ15 || dq15 || C7 || | ||
|- | |- | ||
| | | #WE || we || E5 || | ||
|- | |- | ||
| | | CE# || gp0 || E0 || | ||
|- | |- | ||
| | | RESET || gp1 || E4 || | ||
|- | |- | ||
| | | TRISTATE || gp2 || E7 || | ||
|- | |- | ||
| | | WP# || gp3 || Not Used || Is tied to Vcc by mobo already | ||
|- | |- | ||
| | | BYTE# || Not Used || Not used || Is tied to Vcc by mobo already | ||
|- | |- | ||
| | | OE# || oe || E1 || | ||
|- | |- | ||
| | | RY/BY# || rdy || E6 || | ||
|- | |- | ||
| | | VSS || GND || GND || | ||
|- | |- | ||
| | |} | ||
</div>Progskeet Note: Some modification is needed for Progskeet to unbrick: | |||
* desolder R8 from the Progskeet PCB | |||
* left pin of switch to left lead of R7, middle pin of switch to right lead of R7 | |||
* Vcc to +3.3 // put switch in "OFF" (right) postion, power on the ps3, put the switch in the "ON"/left position, it will be recognized by the PC, NOR is always on now, do everything as usual''. | |||
'''Notes:''' ''The Teensy requires a 3.3V voltage regulator! 5V trace has to be cut and 3V pads have to be shorted! Please refer to https://www.pjrc.com/teensy/3volt.html''<br /> | |||
=== Speed comparison NOR flashers === | |||
<!--// Tabelised content : Performance Teensy: quoted from NORway documentation: 0:05:11 for a full dump/read (52,68 KB/s), 0:01:35 per sector write or 2:08:19 for a full write (2,12 KB/s). Teensy speed according to other sources: 0:00:45 for a full dump/read (364 KB/s), 0:00:05.351 per sector write or 0:08:19 for a full write (32,83 KB/s). Comparison with Progskeet: 0:00:16 for a full dump/read (~1MB/s), 0:00:00.365 per sector write or 0:00:46.811 for a full write (~300-400KB/s). //--> | |||
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;" | |||
|- bgcolor="#cccccc" | |||
! colspan="7" | Speed comparison NOR flashers | |||
|- | |- | ||
! !! colspan="2" | Teensy<br />(NORway 0.1) !! colspan="2" | Teensy<br />(NORway 0.3) !! colspan="2" | Progskeet | |||
|- | |- | ||
! !! time (h:mm:ss) !! speed (KB/sec) !! time (h:mm:ss) !! speed (KB/sec) !! time (h:mm:ss) !! speed (KB/sec) | |||
|- | |- | ||
| | | Full dump/read (16 MB) || 0:05:11 || 52,68 KB/s || 0:00:45 || 364,08 KB/s || 0:00:16 || 1024 KB/s | ||
|- | |- | ||
| | | Per sector write(128 KB) || 0:01:35 || 1,35 KB/s || 0:00:05.351 || 23,92 KB/s || 0:00:00.365 || 350,69 KB/s | ||
|- | |- | ||
| | | Full dump/write (16 MB) || 2:08:19 || 2,12 KB/s || 0:08:19 || 32,83 KB/s || 0:00:46.811 || 350,00 KB/s | ||
|- | |- | ||
|} | |} | ||
==== | === Using NOR flashers === | ||
==== Progskeet ==== | |||
1. Unplug the PS3 powercable from the back | |||
2. Set the R7 switch to "off" | |||
3. Plug the PS3 powercable back in and Power on the PS3 | |||
5. Wait 10 seconds and set the R7 switch to "on" to power progskeet | |||
| |||
dump: | |||
- Spansion NOR: 128KB sector, 128 sectors | |||
- Samsung NOR: 4KB sector, 4096 sectors | |||
- Macronix NOR: 128KB sector, 128 sectors | |||
==== Needed NOR tools ==== | |||
* norunpack (usage: norunpack dump.b directory) git: http://git.dashhacks.com/ps3free/ps3tools | |||
If your dump starts like this: http://pastebin.com/sS69Vhvf you'll need to use the option "¨Byte reverse and extract a NOR dump file" of Flowrebuilder, which will output a inputfile.REV file | |||
=== Dump NOR from GameOS === | |||
[http://gitbrew.org/~glevand/ps3/pkgs/dump_flash.pkg dump_flash.pkg] // backup/mirror: [http://www.multiupload.com/545HXQ4FCD dump-flash+syscon.rar (280.51 KB)]<br /> | |||
Make sure USB stick is FAT32 with enough free space (16MB per dump) | |||
=== Dumping NOR from Linux === | |||
dd if=/dev/ps3nflasha of=NOR.BIN bs=1024 | |||
== Board Revisions == | |||
=== COK-001, COK-002, SEM-001 === | |||
These are the earliest revisions of the PS3 motherboard (CECHA, CECHB, CECHC, CECHE, CECHG) and contain 2 x Samsung K9F1G08U0A-PIB0 128MB [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NAND NAND Chips] for a total of 256MB. These chips are interleaved which is controlled by a proprietary controller chip codenamed "[[Starship2]]" or SS2. This chip handles the interleaving and presents the [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NAND NAND Chips] to the [[South Bridge]] as a single large coherent NOR Chip. | |||
=== DIA-001, DIA-002 === | |||
These boards were the first to get the [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NOR NOR flash] memory from the middle revisions of the PS3 (CECHH, CECHJ, CECHK). Only a single Spansion S29GL128N90TFIR2 16MB [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NOR NOR flash] chip is used and the [[Starship2]] chip has been completely removed. The 128N is JEDEC CFI compliant and organized as 8,388,608 words or 16,777,216 bytes, addressable as 16-bit words (PS3 modus operandi) and 8-bit / 1 byte when the BYTE# signal is logic zero. | |||
=== VER-001 === | |||
Used in the last revisions of the fatter model PS3 (CECHL, CECHM, CECHP, CECHQ), again with the single Spansion S29GL128N90TFIR2 16MB [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NOR NOR flash] with the exception of some CECHL which used a Samsung K8Q2815UQB-P14B 16MB [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NOR NOR flash]. | |||
=== JTP-001 === | |||
Used in CECH-210., This pinout works with the documented one from JSD-001. Most slims carry this norpad arrangement. | |||
=== JSD-001 === | |||
This is the pinout originally supplied by Marcan for a CECH-2504A, Points match those taken from a CECH-2504B slim console. Most slims carry this norpad arrangement. | |||
== Pinout Gallery == | |||
<Gallery> | |||
File:SS2_NOR.JPG|Starship2 NOR/EBUS Testpoints (NAND board) | |||
File:COK-001-NOR.jpg|COK-001 NOR Testpoints (NAND board - only overlay) | |||
File:COK-001-NOR_1.jpg|COK-001 NOR Testpoints (NAND board) | |||
File:SEM-001-NANDs-boardtraces-jestero.jpg|SEM-001 boardtraces (NAND board) | |||
File:DIA-001_NOR.JPG|DIA-001 NOR Testpoints | |||
File:VER-001_NOR-3.3V.JPG|VER-001 NOR Testpoints | |||
File:DYN-001_NOR.JPG|DYN-001 NOR Testpoints | |||
File:JSD-001_NOR.JPG|JSD-001 NOR Testpoints | |||
File:JSD-001_NOR_-_nor_testpoints.png|JSD-001 Testpoints (orig. marcan/noraliser) | |||
File:JTP-001_-_1-882-481-21-testpoints.jpg|JTP-001 NOR Testpoints (not mapped) | |||
File:SUR-001_BOTTOM_TESTPOINTS_-NOT_TRACED-.JPG|SUR-001 Nor Testpoints (not mapped yet) | |||
[[File:Example.jpg]] | |||
File:NOR-PINOUT+ZIF-SolderlessPinout.jpg|NOR Flash general pinout + 50pin ZIF pinout (Progskeet)) | |||
File:Ver-001 nor-rev.jpg|VER-001 NOR Testpoints (trisaster.de, missing TRISTATE) | |||
</Gallery> | |||
'''Missing / requested''' : | |||
* COK-002 (NAND) | |||
* COK-002W (NAND) | |||
* DIA-002 (NOR) | |||
* ''SUR-001 (NOR) some difference in components of JSD-001 but the testpoints are the same as JSD-001'' | |||
* ''JTP-001 (NOR) visually the same as JSD-001, confirmed working with JSD-001 layout'' | |||
* KTE-001 (NOR) | |||
== Generic reference == | |||
=== Soldering Guide(s) === | |||
* http://www.circuitrework.com/guides/7-1-1.shtml | |||
* http://store.curiousinventor.com/guides/Surface_Mount_Soldering/101 | |||
==== Soldering tips ==== | |||
* Don't use >40W iron (we are not soldering copper pipes!) | |||
* Don't use leadfree solder | |||
* Don't use silverbased solder | |||
* Don't use high tin alloy (e.g. 90/10: 300'C @ 97Sn 3Pb and 250'C @ 65Sn 35Pb) | |||
* Use 60/40 (374'F / 190'C) or 63/37 (364'F / 183'C) both have nice low melting point for PCBs | |||
=== Wire reference === | |||
Wire thickness AWG/mm : | |||
18 AWG - 0.0403" / 1.024mm | |||
19 AWG - 0.0359" / 0.912mm | |||
20 AWG - 0.0320" / 0.812mm | |||
21 AWG - 0.0285" / 0.723mm | |||
22 AWG - 0.0253" / 0.644mm | |||
23 AWG - 0.0226" / 0.573mm | |||
24 AWG - 0.0201" / 0.511mm | |||
25 AWG - 0.0179" / 0.455mm | |||
26 AWG - 0.0159" / 0.405mm | |||
27 AWG - 0.0142" / 0.361mm | |||
28 AWG - 0.0126" / 0.321mm | |||
29 AWG - 0.0113" / 0.286mm | |||
30 AWG - 0.0100" / 0.255mm | |||
31 AWG - 0.00893" / 0.227mm | |||
32 AWG - 0.00795" / 0.202mm | |||
33 AWG - 0.00708" / 0.180mm | |||
34 AWG - 0.00631" / 0.160mm | |||
35 AWG - 0.00562" / 0.143mm | |||
36 AWG - 0.00500" / 0.127mm | |||
37 AWG - 0.00445" / 0.113mm | |||
38 AWG - 0.00397" / 0.101mm7 | |||
39 AWG - 0.00353" / 0.0897mm | |||
40 AWG - 0.00314" / 0.0799mm | |||
| |||
PATA/floppy 40-conductor cable - AWG28 (0.0126" / 0.321mm) with 0.0333" pitch +/- 0.002" | PATA/floppy 40-conductor cable - AWG28 (0.0126" / 0.321mm) with 0.0333" pitch +/- 0.002" | ||
PATA/floppy 40-conductor cable - AWG30 (0.0100" / 0.255mm) with 0.0333" pitch +/- 0.002" | PATA/floppy 40-conductor cable - AWG30 (0.0100" / 0.255mm) with 0.0333" pitch +/- 0.002" | ||
Line 738: | Line 483: | ||
| | ||
Category 5e patch (TIA/EIA 568-5-A) network cable: 4 twisted pairs of 26AWG (0.0159" / 0.405mm) | Category 5e patch (TIA/EIA 568-5-A) network cable: 4 twisted pairs of 26AWG (0.0159" / 0.405mm) | ||
For wiring, use 20-26 AWG. 18 can be too stiff while 28 is too fragile. 24 AWG works fine in most cases. The Ground and VCC wires may ofcourse be thicker than the signal wires. Keep wires short (~20cm). | |||
== Generic unresolved issues == | |||
# (user:sel99) : CECHG / SEM-001 - 1-875-384-31 - can dump both NANDs fine, have trouble writing - both with Infectus and Progskeet. Boards below CECHG / SEM-001 flash fine. Others having the same issues? | |||
== | == Progskeet QA/problem solving == | ||
=== Generic advice === | === Generic advice === | ||
==== Be up to date ==== | ==== Be up to date ==== | ||
Always make sure you used the latest diagrams, drivers and flasher software from [http://progskeet.com/download.php progskeet.com] | Always make sure you used the latest diagrams, drivers and flasher software from [http://progskeet.com/download.php progskeet.com] | ||
==== No shorts ==== | ==== No shorts ==== | ||
Line 820: | Line 503: | ||
=== Error : libusb0.dll or libusb0.sys not found === | === Error : libusb0.dll or libusb0.sys not found === | ||
The libusb-win32 Kernel Driver needed for the the flasher to get access to the USB port was not installed. Make sure you unpacked the drivers_xxxxxx file and installed the Progskeet driver (VendorID:1988 / ProductID:0001 in case you need it). | The libusb-win32 Kernel Driver needed for the the flasher to get access to the USB port was not installed. Make sure you unpacked the drivers_xxxxxx file and installed the Progskeet driver (VendorID:1988 / ProductID:0001 in case you need it). | ||
=== Error : side-by-side configuration is incorrect === | === Error : side-by-side configuration is incorrect === | ||
Line 827: | Line 508: | ||
=== Error : incorrect parameter === | === Error : incorrect parameter === | ||
Make sure you selected the correct values for your NOR/NAND device. | Make sure you selected the correct values for your NOR/NAND device. | ||
E.g. : | |||
* NOR | * NOR | ||
** Spansion | ** Spansion NOR: 128KB sector, 128 sectors | ||
** Samsung NOR: 4KB sector, 4096 sectors | |||
** Samsung | |||
* NAND: select Big Block, select Raw, Pages per block: 64, blocks: 1024 | * NAND: select Big Block, select Raw, Pages per block: 64, blocks: 1024 | ||
Line 845: | Line 520: | ||
* http://www.microsoft.com/download/en/details.aspx?id=5582 | * http://www.microsoft.com/download/en/details.aspx?id=5582 | ||
=== Error/crash on Windows 7 | === Error/crash on Windows 7 === | ||
* Disable Aero (known to crash on Win7 Ultimate) | * Disable Aero (known to crash on Win7 Ultimate) | ||
** set display color to 256 colors will enforce Aero to disable too | ** set display color to 256 colors will enforce Aero to disable too | ||
Line 852: | Line 527: | ||
* Try "Compatibility Mode" (e.g. Windows 2000 or Windows XP SP2) | * Try "Compatibility Mode" (e.g. Windows 2000 or Windows XP SP2) | ||
=== A/B trick === | |||
{insert here} | |||
=== | |||
{ |