Editing Talk:Hardware flashing

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
== Wikify introduction: Purpose of hardware flashing ==
==NAND==
NAND (256MB, old FAT models, needs 32 wires, 15 per NAND + GND + VCC)<br />
2 chips: Samsung K9F1G08U0A-PIB0


This page lacks a section at the very beginning explaining the purpose of "hardware flashing". Such contribution would improve the democratization of preservation. ⚗--[[User:Bowi|Bowi]] ([[User talk:Bowi|talk]])
*http://www.uchobby.com/index.php/2007/05/05/read-embedded-flash-chips/


== NAND flashers speed comparison ==
*[http://www.multiupload.com/KKSLGMGDJR NAND_Dumper_Extractor.rar (1.55 MB)]
Samsung [[K9F1G08U0A]] flasher speeds, full write 1Gb:
* ChipProg‐481 (write+verify) : 23 seconds
* ChipProg‐G41 (write+verify) : 23 seconds
* Flashstream 2800F (write+verify) : 34.7 seconds per NAND
* UP828 (write+verify) : 22.2+11.4 seconds per NAND
* SuperPro 5000 (write+verify) :116.5 seconds per NAND
* UP128 (write+verify) : 78.4+167 seconds per NAND
* BeeHive204AP (write+verify): 122.7 seconds per NAND
* Progskeet 1.0/1.1 (dump, not write) : 158 seconds per NAND
* Teensy++ 2.0 (diffwrite+verify) : 180 seconds per NAND
* ChipProg‐48 (write+verify) : 641 seconds
* ChipProg‐G4 (write+verify) : 641 seconds
* Infectus (dump, not write) : 900 seconds per NAND
* Teensy++ 2.0 (dump, not write) : 918 seconds per NAND
* Teensy++ 2.0 (write+verify) : 2700~3000 seconds per NAND


== NAND Clip problems ==
There are 2 nands interleaved at the 512byte sectors level, giving a 1024 byte "interleaved sector". pages are 2kb on each nand.
<DrkShadow> ___: buy one from vgcrepairs.com, if you don't mind wasting your money, and you, too, shall see that the 360-clip does not have the correct pinout when hooked up with the adapter board in between.


== NOR Clip Modification ==
For Infectus don't use 3.9.9.0, as it removes dual NAND PS3 support :S If your board already came with this version or higher, use this: [http://www.multiupload.com/06EMHFCKN3 prepare_infectus_for_ps3.rar (5.53 MB)] If it is done, it will show up as "2 NAND Programmer" in the bottom left.
<div style="float:right">[[File:X360 NOR clip modification.jpg|200px|thumb|left|NOR clip mod - top]]<br />[[File:Cutting pin46 360clip-nor-TOPVIEW.jpg|200px|thumb|left|NOR clip mod - top]]<br />[[File:Cutting_pin48_and_46_360clip-nor.jpg|200px|thumb|left|NOR clip mod - back]]<br />[[File:Nor-clip_pin_out_front.jpg|200px|thumb|left|NOR clip mod - flatcable header]]</div>
Dual NAND PS3 compatible version: [http://www.multiupload.com/4L1JXGOFOF Infectus_programmer_3.8_Beta_2.zip (4.02 MB)]


<pre>
Power the Infectus, it crashes the PS3 and leaves the NANDs in powered mode. Use the console to power the NANDs: power it up until the PS3 crashes and halts with red flashing LED, press power again to stop the flashing, but keeps the console powered on. The NANDs are not accessed by the PS3 in this way, so it doesn't matter if the NAND content is already messed up. After that, you can read/write the NANDs.
  <domelec> 48 goes to gnd and gp4 on skeet
  <domelec> 46 goes to gnd and gp2 on skeet
  &nbsp;
  <domelec> so really u only need to remove pin 48
  <domelec> ie pin 46 goes to gnd so u could leave it
  <domelec> therefore only needing to remove pin 48 cos thats also sending gp4 to gnd


  <eussNL> 48 on clip 50ZIF = 3 on skeet 50ZIF = wp
[http://www.sendspace.com/file/qhwkm5 FlowRebuilder v.4.1.0.0]
          46 on clip 50ZIF = 5 on skeet 50ZIF = gp2
</pre>
Writing will still fail, but at least it will now not burn out your motherboard or Progskeet (and perhaps can be used for dumping).
 
Soldered connection is still the highly adviced way to go. NOR pads are huge in comparison and easy to solder, plus the connection is stable.


----
----
=== Dump NAND from GameOS ===
[http://7track.org/~glevand/public/dump_flash.pkg dump_flash.pkg]  // backup/mirror: [http://www.multiupload.com/545HXQ4FCD dump-flash+syscon.rar (280.51 KB)]


== Generic Write Strategies ==
=== Difference between hardware dumps and software dumps ===
=== NAND ===
ps3vflasha
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable sortable" style="border:1px solid #999; border-collapse: collapse;"
|- bgcolor="#cccccc"
! Flash !! Type !! Board(s) !! Infectus !! Progskeet
|-
| Samsung K9F1G08U0A-PIB0<br /><br /><br />'NAND UOА' || NAND || COK-001<br />COK-002<br />SEM-001 ||  || <pre>COMMON TAB
Differential Flash: Yes
Verify: Yes
Abort on error: No
16 Bit: No
Swap Bytes: greyed out
Cycle Period (ns): 125
Read Delay (µs): 50
 
NAND TAB
Pages per Block: 64
Block Count: 1024
Big Block: Yes
Raw: Yes</pre>
|-
| Samsung K9F1G08U0B-PIB0<br /><br /><br />'NAND UOB' || NAND || SEM-001 ||  || <pre>COMMON TAB
Differential Flash: Yes
Verify: Yes
Abort on error: No
16 Bit: No
Swap Bytes: greyed out
Cycle Period (ns): 125
Read Delay (µs): 50
 
NAND TAB
Pages per Block: 64
Block Count: 1024
Big Block: Yes
Raw: Yes</pre>
|-
|}
=== NOR ===
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable sortable" style="border:1px solid #999; border-collapse: collapse;"
|- bgcolor="#cccccc"
! Flash !! Type !! Board(s) !! NORway !! Progskeet
|-
| Spansion S29GL128N90TFIR2<br /><br /><br />'Spansion N' || NOR || DIA-001<br />DIA-002<br />VER-001<br />DYN-001 || <small>NORway v0.4 beta 12: 'erasechip' and 'writewordubm'</small> || <pre>COMMON TAB
Differential Flash: Yes
Verify: Yes
Abort on error: No
16 Bit: Yes
Swap Bytes: Yes
Cycle Period (ns): 125
Read Delay (µs): 50
 
NOR TAB
Device Size: 16MiB x 1 (16MiB total)
Erase block regions:
Region 1: 128Kib x 128 (16MiB total)
Options:
Buffered write (fastest, default)
Ready triggered timing (fastest, default)
Max bytes: 32 (or 16)</pre>
|-
| Samsung K8Q2815UQB-PI4B<br /><br /><br />'Samsung Q28' || NOR || VER-001<br />DYN-001<br />SUR-001 || <small>NORway v0.4 beta</small> || <pre>COMMON TAB
Differential Flash: Yes
Verify: Yes
Abort on error: No
16 Bit: Yes
Swap Bytes: Yes
Cycle Period (ns): 125
Read Delay (µs): 50
 
NOR TAB
Device Size: 8MiB x 2 (16MiB total)
Erase block regions:
Region 1: 8Kib x 8 (64KiB total)
Region 2: 64 Kib x 126 (8064 KiB total)
Region 3: 8KiB x 8 (64 KiB total)
Options:
Single word program
Ready triggered timing (fastest, default)
Max bytes: (greyed out by single word program)</pre>
 
<small>WinSkeet 111004: use preset + bank splitting<br />(sectors 0-63 128/128 mode: 0x000000-0x7FFFFF)<br />(sectors 2048-4095 4/4096 mode: 0x800000-0xFFFFFF)</small>
|-
| Spansion S29GL128P90TFIR2<br /><br /><br />'Spansion P' || NOR || VER-001<br />DYN-001<br />SUR-001<br />JTP-001<br />JSD-001<br />KTE-001 || <small>NORway v0.3</small> || <pre>COMMON TAB
Differential Flash: Yes
Verify: Yes
Abort on error: No
16 Bit: Yes
Swap Bytes: Yes
Cycle Period (ns): 125
Read Delay (µs): 50
 
NOR TAB
Device Size: 16MiB x 1 (16MiB total)
Erase block regions:
Region 1: 128Kib x 128 (16MiB total)
Options:
Buffered write (fastest, default)
Ready triggered timing (fastest, default)
Max bytes: 64 (or 32)</pre>
|-
| Samsung K8P2716UZC-QI4D<br /><br /><br />'Samsung P27' || NOR || JTP-001<br />JSD-001<br />KTE-001 || <small>NORway v0.3</small> || <pre>COMMON TAB
Differential Flash: Yes
Verify: Yes
Abort on error: No
16 Bit: Yes
Swap Bytes: Yes
Cycle Period (ns): 125
Read Delay (µs): 50
 
NOR TAB
Device Size: 16MiB x 1 (16MiB total)
Erase block regions:
Region 1: 128Kib x 128 (16MiB total)
Options:
Buffered write (fastest, default)
Ready triggered timing (fastest, default)
Max bytes: 64 (or 32)</pre>
|-
| Macronix MX29GL128ELT2I-90G<br /><br /><br />'Macronix 29GL' || NOR || DYN-001<br />SUR-001<br />KTE-001 || <small>NORway v0.3</small> || <pre>COMMON TAB
Differential Flash: Yes
Verify: Yes
Abort on error: No
16 Bit: Yes
Swap Bytes: Yes
Cycle Period (ns): 125
Read Delay (µs): 50
 
NOR TAB
Device Size: 16MiB x 1 (16MiB total)
Erase block regions:
Region 1: 128Kib x 128 (16MiB total)
Options:
Buffered write (fastest, default)
Ready triggered timing (fastest, default)
Max bytes: 64 (or 32)</pre>
|-
|}
==== Generic slowest safe method ====
===== NAND =====
* Use [Talk:Hardware_flashing#Injecting_3.3V_.28or_5V.2F12V_etc.29_with_external_PSU | external powersupply], as described under [Talk:Progskeet#.5BD.5D_using_ATX_PSU_and_Progskeet_powered_by_USB | method D or E].
* Make sure the [Progskeet#Programming_the_Bitstream | correct bitstream] is on the Actel (lastest, if using clip)
* Use [http://www.psdevwiki.com/files/flash/Tools/Progskeet/Winskeet/ProgSkeet_110819.rar Progskeet 110819] as flasher software.
** run in Compatibility mode for winxp SP2 + as Administrator
** use [http://www.psdevwiki.com/files/flash/Tools/Progskeet/Winskeet/zadig.rar zadig] to change from [http://www.psdevwiki.com/files/flash/Tools/Progskeet/Winskeet/drivers_winusb_111121.zip winUSB] to [http://www.psdevwiki.com/files/flash/Tools/Progskeet/Winskeet/drivers_libusb0_110812.rar libUSB0]
* Make sure the NAND is recognised
<!--// before u start writing, toggle the nand1 check box many times to make sure it's detecting the correct nand id //-->
only select NAND 1, bigblock, raw, differential flash with pages per block 64 and blockcount 1024
 
===== NOR =====
Note: Use [https://www.mirrorcreator.com/files/1RXEMGNG/ProgSkeet_Bitstreams_111106.rar_links bitstream 111106]
 
This will take about 4-6 minutes, depending on flashtype<!--//
Stefano 5min 25 / 5 min 22 (Spansion) //-->
 
<div style="float:right">[[File:Zadig libusb0 selected.jpg|200px|thumb|left|Zadig libusb0 selected with Progskeet]]</div>
 
*Install [http://www.psdevwiki.com/files/flash/Tools/Progskeet/Winskeet/drivers_libusb0_110812.rar Libusb0] [https://www.mirrorcreator.com/files/0HMVSBPD/drivers_libusb0_110812.rar_links] with [http://www.psdevwiki.com/files/flash/Tools/Progskeet/Winskeet/zadig.rar Zadig] [https://www.mirrorcreator.com/files/SM6RZIBD/zadig.rar_links]
 
connect usb cable with Progkeet
open zadig
options : list all devices
- select Progskeet
target : change winusb to Libusb0
after finish you will see message: driver installed
 
*Start [http://www.psdevwiki.com/files/flash/Tools/Progskeet/Winskeet/WinSkeet40000_111004.rar Winskeet 1110004] [https://www.mirrorcreator.com/files/PZU8GU33/WinSkeet40000_111004.rar_links]
*Select '''''your''''' appropriate flash preset on COMMON TAB
* Dump CFI, proceed with dumping procedure if you get a valid CFI
 
<div style="float:right">[[File:Winskeet 1110004 - Common TAB.png|200px|thumb|left|Winskeet 1110004 - Common TAB]]</div>
 
* After that change to 8bit:
COMMON TAB
Differential Flash: Yes
Verify: Yes
Abort on error: No
'''''16 Bit: No'''''
Swap Bytes: Yes
Cycle Period (ns): 125
Read Delay (µs): 50
 
<div style="float:right">[[File:Winskeet 1110004 - NOR TAB.png|200px|thumb|left|Winskeet 1110004 - NOR TAB]]</div>
*Goto NOR tab, select single word program, custom region start: 0 Bytes and enable Synchronous with file:
NOR TAB
Device Size: 16MiB x 1 (16MiB total)
  <span style="text-decoration: underline;">Erase block regions:</span>
  Region 1: 128Kib x 128 (16MiB total)
  <span style="text-decoration: underline;">Custom range:</span>
  '''''Start: 0 bytes'''''
  '''''Synchronous with file: Yes'''''
  <span style="text-decoration: underline;">Options:</span>
  '''''Single word program'''''
  Ready triggered timing (fastest, default)
  Max bytes: (greyed out by single word program)
If that does not work with unified/nonbanked flash then there is a wire/powering/halting problem.
 
If it only works with  '''''Start: 0 bytes''''' and '''''Synchronous with file: Yes''''' then wires are too thin/long, or USB cable bad/bad PC USB-chipset or missing rdy (ánd gp4 for old bitstream).
 
See also: http://www.psdevwiki.com/files/flash/Tools/Progskeet/UserPresets/
 
===== NOR Tab : Option section explained further =====
In the Option section, the write (buffer) method is chosen, from slow to fast:
{| class="wikitable"
|-
! <abbr title="Speedtype">&nbsp;</abbr> !! Write Options !! max. bytes !! Notes
|-
| {{green}} || Single word program || <abbr title="no buffer, thus 0 bytes">-greyed out-</abbr> || [[K8Q2815UQB-PI4B|Samsung K8Q2815UQB-PI4B]] [[:File:Samsung K8Q2815UQB-PI4B.png|max. specification]]
|-
|  || Double word program || <abbr title="no buffer, thus 0 bytes">-greyed out-</abbr> ||
|-
|  || Buffered write || 1 bytes ||
|-
|  || Buffered write || 2 bytes ||
|-
|  || Buffered write || 4 bytes ||
|-
| {{green}} || Buffered write || 8 bytes || [[:File:WinSkeet40000 111004-Spansion NOR-Buffered write with 8bytes.png|Slowpoke most commonly used]] for Spansion [[S29GL128P90TFIR2|Spansion S29GL128P90TFIR2]] and [[S29GL128N90TFIR2|Spansion S29GL128N90TFIR2]]
|-
|  || Buffered write || 16 bytes ||
|-
| {{orange}} || Buffered write || 32 bytes || [[S29GL128N90TFIR2|Spansion S29GL128N90TFIR2]] max. specification
|-
| {{orange}} || Buffered write (default) || 64 bytes || [[MX29GL128ELT2I-90G|Macronic MX29GL128ELT2I-90G]], [[S29GL128P90TFIR2|Spansion S29GL128P90TFIR2]], [[K8P2716UZC-QI4D|Samsung K8P2716UZC-QI4D]] max. specification
|-
| {{red}} || Buffered write || 128 bytes || out of spec. for [[Flash_%28Hardware%29|common PS3 NOR's]], do not use.
|-
| {{red}} || Buffered write || 256 bytes || out of spec. for [[Flash_%28Hardware%29|common PS3 NOR's]], do not use.
|-
| {{red}} || Buffered write || 512 bytes || out of spec. for [[Flash_%28Hardware%29|common PS3 NOR's]], do not use.
|-
| {{red}} || Buffered write || 1024 bytes (1 KiB) || out of spec. for [[Flash_%28Hardware%29|common PS3 NOR's]], do not use.
|-
|}
 
== Injecting 3.3V (or 5V/12V etc) with external PSU ==
<div style="float:right">[[File:Ext_PSU_on_PS3_2.jpg|200px|thumb|left|Progskeet wired to NANDs of a COK-002 board, inject 3.3V with external PSU (photo:mackarry)]]</div>
<div style="float:right">[[File:SEM-001 ext-ATX-PSU.jpg|200px|thumb|left|SEM-001 board, injection of 3.3V with external PSU ]]</div>
 
* Using/converting an old ATX PSU 3.3V line
** [http://gathering.tweakers.net/forum/list_messages/885613 PC Voeding-tester/gebruik als projectvoeding + pinouts] (Dutch)
** [http://www.wikihow.com/Convert-a-Computer-ATX-Power-Supply-to-a-Lab-Power-Supply How to Convert a Computer ATX Power Supply to a Lab Power Supply] (english)
** [http://reprap.org/wiki/PC-Netzteil Bauen eines erschwinglichen Netzteils] (german)
** [http://www.semageek.com/diy-transformer-une-alimentation-atx-en-alimentation-de-laboratoire/ DIY : Transformer une alimentation ATX en alimentation de laboratoire] (french)
 
<br />
[[File:At-dummyload-tester-v2.gif]]<br />
 
[[File:Atx-dummyload-tester.gif]]<br />
 
[[File:Atx2x-dummyload-tester.gif]]<br />
 
* Note: Injecting 3.3v on a PS3 Slim CECH2503, with Teensy 2.0++. Didn't dump. South Bridge will hold (one of) RESET, CE or OE high until later in the Boot sequence / other hardware is initialized. // subnote: tristate was most likely not used to prevent further booting, nor was lowering power injection trick used as it is impossible for a southbridge that is not powered to pull any lines up.
 
== Progskeet 1.2 - Testreport table==
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable sortable" style="border:1px solid #999; border-collapse: collapse;"
|- bgcolor="#cccccc"
! Flash !! Board !! Dumping !! Writing !! Remarks
|-
| 2x[[K9F1G08U0A-PIB0]] ||  || {{Yes}} || {{Yes}} ||
|-
| 2x[[K9F1G08U0B-PIB0]] || SEM-001  || {{Yes}} || {{Yes}} || Bitstream for reading 0031, flashing: 1223. Other bitstreams always reported errors
|-
| 2x[[K9F1G08U0B-PIB0]] ||  || {{Yes}} || {{Yes}} ||
|-
| 1x[[S29GL128N90TFIR2]] ||  || {{Yes}} || {{No}} ||
|-
| 1x[[K8Q2815UQB-PI4B]] ||  || {{Yes}} || {{No}} ||
|-
| 1x[[S29GL128P90TFIR2]] ||  || {{Yes}} || {{No}} ||
|-
| 1x[[K8P2716UZC-QI4D]] ||  || {{Yes}} || {{yes}} || patch rogero downgrade succes
|-
| 1x[[MX29GL128ELT2I-90G]] ||  || {{Yes}} || {{No}} ||
|-
| 1x[[MX29GL128FLT2I-90G]] ||  || {{Yes}} || {{No}} ||
|-
| EXA-MPLE || ARC-001 || {{Yes}} || {{No}} || <small>''example'' : Tried 128/128 and 4K/4096, resistor and A/B trick, always freezes on first sector</small>
|-
|}
 
== Old Progskeet 1.0 Testreport table==
keep in mind that this table is very old
it was used for bugfixing/tracing errors in OLD progskeet versions and old NORway
modern NORway and Progskeet should be capable of doing all flash now.
it is kept here for historic/reference / do not delete/remove
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable sortable" style="border:1px solid #999; border-collapse: collapse;"
|- bgcolor="#cccccc"
! Board !! Flash !! Dumping !! Writing !! Remarks
|-
| COK-001 || 2x Samsung K9F1G08UOА-PIB0 || {{Yes}} || {{Yes}} || <small>''bluemimmo'' : CECHA / COK-001 read\write NAND fine. used progskeet and 110819 software and dual NAND settings, but after patching ros using dospiedras method manually, cannot downgrade, ps3 bricked, wrote original dump, ps3 alive again. </small>
|-
| COK-001 || 2x Samsung K9F1G08UOА-PIB0 || {{Yes}} || {{Yes}} || <small>''Abkarino'' : CECHA / COK-001 read\write NAND fine. used a professional flash programmer and successfully downgraded from 4.00 OFW to Rogero 3.55 CFW using NAND downgrade patch. </small>
|-
| COK-001 || 2x Samsung K9F1G08UOА-PIB0 || {{Yes}} || {{Yes}} || <small>''ps3oon'' : CECHA / COK-001 read\write NAND fine. used progskeet+winskeet no trik editing with hex</small>
|-
| COK-002 || 2x Samsung K9F1G08U0A-PIB0 ||  {{Yes}} || {{Yes}} || <small>''avati'' : COK-002 and COK-002W: read\write NAND fine. used progskeet+winskeet 111120</small>
|-
| SEM-001 || 2x Samsung K9F1G08UOА-PIB0 || {{Yes}} || {{Yes}} || <small>''dodther'' : CECHG / SEM-001 read\write NAND fine. used progskeet and 110819 software and dual NAND boardtraces by jestero </small>
|-
| SEM-001 || 2x Samsung K9F1G08UOB-PIB0 ||  ||  ||
|-
| SEM-001 || 2x Samsung K9F1G08UOB-PIB0 || {{Yes}} || {{Yes}} || <small>''Strike Venom'' : CECHG04 / SEM-001 read\write NAND with Infectus 2 without tricks </small>
|-
| SEM-001 || 2x Samsung K9F1G08UOB-PIB0 || {{Yes}} || {{No}} || <small>''sel99'' : CECHG / SEM-001 - 1-875-384-31 - can dump both NANDs fine, have trouble writing. both with Infectus and Progskeet. Boards below CECHG / SEM-001 flash fine.</small>
|-
| SEM-001 || 2x Samsung K9F1G08UOB-PIB0 || {{Yes}} || {{No}} || <small>''delsol'' : SEM-001 - 1-875-384-31 - dump both NANDs fine, still not able to reflash the nands correctly. there are always differences. Tried with Infectus.</small>
|-
| DIA-001 || 1x Spansion S29GL128N90TFIR2 ||  ||  ||
|-|-
| DIA-001 || 1x Spansion S29GL128N90TFIR2 || {{Yes}} || {{Yes}} || <small>''mrdrifta'' : Teensy++ /NORway v0.3 Reads perfectly, but no write - NORway v0.4 beta 12 write successful - needed to run erasechip first, then run writewordubm flash.bin to write to console.</small>
|-
| DIA-001 || 1x Spansion S29GL128N90TFIR2 || {{Yes}} || {{No}} || <small>''delsol'' : flasher still freeze at sector0 (A&B) dumping seems to works (A&B). Same result with and without resistors. Tried on winxp-sp2 and win7. // The best results i got was using the 9k & 100k resistors. the flash is unuseable but ProgSkeet_110819 doesen´t freeze anymore. // I have tried Teensy and NORway0.3: dumping of nor works fine, but everytime when i tried to flash, the pc loose usb-connection to Teensy</small>
|-
| DIA-001 || 1x Spansion S29GL128N90TFIR2 || {{Yes}} || {{Yes}} || <small>''Keeper'' : downgrade successfuly with Winskeet4000_111002_2 without any resistors</small>
|-
| DIA-001 || 1x Spansion S29GL128N90TFIR2 || {{Yes}} || {{Yes}} || <small>''Abkarino'' :  successfully downgraded from 3.56 using WinSkeet 111004</small>
|-
| DIA-001 || 1x Spansion S29GL128N90TFIR2 || {{Yes}} || {{Yes}} || <small>''ps3oon'' :  successfully downgraded from 3.56 using WinSkeet 4000 Rev 111002 with some trick</small>
|-
| DIA-002 || 1x Spansion S29GL128N90TFIR2 || {{Yes}} || {{Yes}} || <small>''AdReNaLiN_TR'' :  successfully downgraded from 10K/100K trick using </small>
|-
| VER-001 || 1x Spansion S29GL128P90TFIR2 || {{Yes}} || {{Yes}} || <small>''kado'' : Downgrading 3.70 to 3.55 success with progskeet (differ ON, No special trick) </small>
|-
| VER-001 || 1x Samsung K8Q2815UQB-PI4B ||  ||  ||
|-
| VER-001 || 1x Samsung K8Q2815UQB-PI4B || {{Yes}} || {{Yes}} || <small>''calimba'' :  downgrade successful with progskeet on VER-001 CECHL01 with QT port. if the program 110819 freeze you need flash first the file with the qt port.</small>
|-
| VER-001 || 1x Samsung K8Q2815UQB-PI4B || {{Yes}} || {{Yes}} || <small>''Ir0nmanNB'' :  Used all gnds listed on the diagram. Used 3.3V pull-up, also had R7 with switch AND R8 bridged. Disconnect USB from PC and with R7 open turn PS3 on, count to 20 and close R7 then plug in USB to PC. Then open up WinSkeet4000 and write.  Use 110819 for the early sectors if they fail to write, using 4/4096, differential, alternate, verify, and byteswap.  Then try again with Winskeet4000, using Samsung preset then go to NOR tab and change it to 128/128.</small>
|-
| VER-001 || 1x Samsung K8Q2815UQB-PI4B || {{Yes}} || {{Yes}} || <small>''Ryd3R'' : Starting from NORway v0.4 Beta W/R fully supported).</small>
|-
| VER-001 || 1x Samsung K8Q2815UQB-PI4B || {{Yes}} || {{Yes}} || <small>''blakcat'' : succeed downgrade with my method. See [http://www.progskeet.com/forum/viewtopic.php?f=3&t=373 Tutorial] </small>
|-
| VER-001 || 1x Spansion S29GL128P90TFIR2 || {{Yes}} || {{No}} || <small>''toxie'' : tried 128k/128 , 4k/4096. writing without alt. all FF, with alt some random patterns with 00 and FF when writing all 00. Trying A/B trick, still at Programming Sector 0</small>
|-
| VER-001 || 1x Spansion S29GL128N90TFIR2 || {{Yes}} || {{Yes}} || <small>''marlboro12'' : downgrade successfuly with Winskeet4000_111002_2 (by Ago). Pullup 10Kohms btw R8 closed and rdy, and a 100Kohms resistor btw rdy_progskeet and rdy_nor. Rogero_CFW_V2 works fine on the ps3.</small>
|-
| VER-001 || 1x Spansion S29GL128N90TFIR2 || {{Yes}} || {{Yes}} || <small>''bluemimmo'' : Used older winskeet and progskeet flashing stuck at sector 2 but used latest winskeet and sucessfully downgraded. Downgrade successfuly with Winskeet4000_111004.  Rogero_CFW_V2 works fine on the ps3.</small>
|-
| VER-001 || 1x Spansion S29GL128N90TFIR2 || {{Yes}} || {{Yes}} || <small>''Jhax78'' : Downgrade successfuly with Winskeet4000_111004.  Rogero_CFW_V2 works fine on the ps3. Some sectors needed Max byte write 16 to finish on 2 consoles </small>
|-
| VER-001 || 1x Spansion S29GL128P90TFIR2 || {{Yes}} || {{Yes}} || <small>''Abkarino'' : Downgraded from 3.70 successfully using WinSkeet 111004 build</small>
|-
| VER-001 || 1x Spansion S29GL128N90TFIR2 || {{Yes}} || {{No}} || <small>''ares'' : tried 128k/128. With normal method a lot ff and same byte match. With alternate method 00 and ff and some byte match. Without resistor trick programmer freeze programming sector 0. with 100k and 9k resistor i can write but with errors (programmer completes the write, but the dump is all 00 ff, only few byte match, this with alternatemethod). with a/b tick's programmer (version A and B ) it freeze on programming sector 0 (both with or without resistors)</small>
|-
| VER-001 || 1x Spansion S29GL128N90TFIR2 || {{Yes}} || {{Yes}} || <small>''gokuhs'' : With 'erasechip' and 'writewordubm' method without resistors and work fine. NORway 0.4 BETA9+. I used the jestero's diagram for VER-001 motherboard without VCC pin solder</small>
|-
| DYN-001 || 1x Samsung K8Q2815UQB-PI4B || {{Yes}} || {{Yes}} || <small>''relax79'' : I use Winskeet111205 and Progskeet v1.1 ,without a22 trick .Normal dump and patched v2 then flash succes but downgrade usb failure.Solution is Progskeet usb not connect r8 switch "off" r7 switch "on" entire downgrade process.Succesfully downgrade 4.11 to 3.55 CECH-2006A</small>
|-
| DYN-001 || 1x Samsung K8Q2815UQB-PI4B || {{Yes}} || {{Yes}} || <small>''blakcat'' : succeed downgrade with my method. See [http://www.progskeet.com/forum/viewtopic.php?f=3&t=373 Tutorial] </small>
|-
| DYN-001 || 1x Samsung K8Q2815UQB-PI4B || {{Yes}} || {{Yes}} || <small>''marlboro12'' : succeed downgrade with blackcat scheme. flasher 110819, 4/4096 all option checked. divide .bin in two equals files. first flash sector 0->2047 with any modification and without power cycle, just unplug usb and reload 110819, flash second file with resistor 10K btw a22_NOR and 3.3V.</small>
|-
| DYN-001 || 1x Samsung K8Q2815UQB-PI4B || {{Yes}} || {{Yes}} || <small>''maitre kanter'' : Downgrade succesfull. See [http://www.xavboxps3.com/fr/downgrade-ps3-3.70.php] </small>
|-
| DYN-001 || 1x Samsung K8Q2815UQB-PI4B || {{Yes}} || {{No}} || <small>''yrr'' : tried 128k/128 , 4k/4096, WinSkeet40000,ProgSkeet_110819. It writes ok till sector 64(128k/128) or 08004D0xH in the dump file. From that point on no changes. No write no erase. Tried also the 10k/100k resistor trick. All the same result.</small>
|-
| DYN-001 || 1x Spansion S29GL128P90TFIR2 ||  ||  ||
|-
| DYN-001 || 1x Samsung K8Q2815UQB-PI4B || {{Yes}} || {{Yes}} || <small>''bluemimmo'' : Splitted the patched known good dump into 2 parts : 000000-7FFFFF and 800000-FFFFFF. Flashed part1 with winskeet in 128/128 mode from sector 0-6 with A22 low. Then flashed part2 with progskeet_110819 select mode 4/4096 and custom sector start from 2048-4095 with A22 high. Byte swap, alternate write method, verify, differential flashing. See [http://www.progskeet.com/forum/viewtopic.php?f=3&t=382 progskeettopic]</small>
|-
| DYN-001 || 1x Macronix MX29GL128ELT2I-90G || {{Yes}} || {{Yes}} || <small>''Ryd3R'' : NORway 0.3 fully support R/W on Macronix MX29GL128ELT2I-90G.</small>
|-
| DYN-001 || 1x Macronix MX29GL128ELT2I-90G || {{Yes}} || {{Yes}} || <small>''Abkarino'' : successfully downgraded from 3.70 using WinSkeet 111004 and ProgSkeet V1.0</small>
|-
| DYN-001 || 1x Samsung K8Q2815UQB-PI4B || {{Yes}} || {{Yes}} || <small>''AdReNaLiN_TR'' : Downgrade Succesful. Thank you_BLACKCAT_
|-
| DYN-001 || 1x Spansion S29GL128P90TFIR2 || {{Yes}} || {{Yes}} || <small>''Xb0xGuru'' : Downgrade successful. 100k/10k resistor trick used, Winskeet 40000 used (10 September 2011, 21:14:56)</small>
|-
| DYN-001 || 1x Macronix MX29GL128ELT2I-90G || {{Yes}} || {{Yes}} || <small>''calimba'' : Downgrade succesfull, used progskeet.</small>
|-
| DYN-001 || 1x Samsung K8Q2815UQB-PI4B || {{Yes}} || {{Yes}} || <small>''oracle_dfx'' : Downgrade successful using winskeet exclusively (Pre configured). R8 closed. R7 Open. 3.3v Detached. Dump NOR using default schematics. Applied necessary patch. Flashed first 8 MB of data. Unplugged progskeet from USB. Set A22 high. Plugged progskeet via USB. Flashed 2nd 8MB of data. Unplugged progskeet. Returned NOR A22 to Progskeet. Dump Full Flash. Power off. Reboot. Connect PS controller screen, Unplugged PS3. Proceed with usual downgrade procedure. 4.0 to Rogero CFW v2. Success!</small>
|-
| SUR-001 || 1x Macronix MX29GL128ELT2I-90G || {{Yes}} || {{Yes}} || <small>''kado'' : Downgrade succesfull, used newest WT-port, nor pinout same as JSD-001</small>
|-
| SUR-001 || 1x Spansion S29GL128P90TFIR2 || {{Yes}} || {{Yes}} || <small>''Abkarino'' : successful downgrade from 3.66 to 3.55 using ProgSkeet V1.0 and WinSkeet Build 111004 - used JTP-001 norpoint listing
|-
| JTP-001 || 1x Spansion S29GL128P90TFIR2 ||  ||  ||
|-
| JTP-001 || 1x Spansion S29GL128P90TFIR2 || {{Yes}} || {{Yes}} || <small>''drako_'' : success downgrading from 3.70 to 3.55 with wiring according to JSD-001 diagram, with 5 grounds and settings 128K/128 (progskeet).</small>
|-
| JTP-001 || 1x Spansion S29GL128P90TFIR2 || {{Yes}} || {{Yes}} || <small>''blakcat'' : success downgrading from 3.56 to 3.55 (JSD-001 diagram), with 2 grounds and settings:128K/128,winskeet,dif.Board out of ps3 with r8 and r7 closed</small>
|-
| JTP-001 || 1x Spansion S29GL128P90TFIR2 || {{Yes}} || {{Yes}} || <small>''Ryd3R'' : success downgrading from 3.70 to 3.55 with wiring according to JSD-001 diagram NORway v0.3 .</small>
|-
| JTP-001 || 1x Samsung K8P2716UZC-QI4D || {{Yes}} || NOT YET TRIED || <small>''TooTHPiCK'' : NORway and Teensy++ </small>
|-
| JTP-001 || 1x Samsung K8P2716UZC-QI4D || {{Yes}} || {{Yes}} || <small>''Rogero'' : Downgrade succesfull, used Progskeet, flash 128/128, Dump with progskeet_110819, Patch with winskeet, Flash with progskeet_110819(differential flash/verify) using Win7(with winXP SP3 compatibility Mode/Run as Administrator) Rogero CFW V2 No_BD, Blu-Ray drive not attached  </small>
|-
| JTP-001 || 1x Spansion S29GL128P90TFIR2 || {{Yes}} || {{Yes}} || <small>''yrr'' : success downgrading from 3.70 to 3.55 with wiring JSD-001 diagram, 2 grounds, 128K/128 (progskeet/110819).</small>
|-
| JSD-001 || 1x Spansion S29GL128P90TFIR2 || {{Yes}} || {{Yes}} || <small>''dodther'' : Downgrade succesfull. used progskeet and winskeet40000</small>
|-
| JSD-001 || 1x Spansion S29GL128P90TFIR2 || {{Yes}} || {{Yes}} || <small>''yrr'' : Downgrade succesfull. used progskeet and winskeet40000</small>
|-
| JSD-001 || 1x Samsung K8P2716UZC-QI4D || {{Yes}} || {{Yes}} || <small>''kado'' : Downgrade succesfull with special trick</small>
|-
| JSD-001 || 1x Samsung K8P2716UZC-QI4D || {{Yes}} || {{Yes}} || <small>''petrm79'' :  factory 3.56, 320gb, cech-250.b, console code 1a, standart solder without resistors etc. nor samsung (flash 128/128). using latest qt port. check alt. meth., downgrade using dospiedra v2 (manual paste), rogero.pup</small>
|-
| JSD-001 || 1x Samsung K8P2716UZC-QI4D || {{Yes}} || {{Yes}} || <small>''bluemimmo'' :  factory 3.56, 320gb, cech-2504.b, console datecode 1a, dump with progskeet_110819, patch with winskeet, flash with progskeet</small>
|-
| JSD-001 || 1x Samsung K8P2716UZC-QI4D || {{Yes}} || {{Yes}} || <small>''Ryd3R'' : NORway 0.3 fully support R/W on Samsung K8P2716UZC-QI4D.</small>
|-
| JSD-001 || 1x Spansion S29GL128P90TFIR2 || {{Yes}} || {{Yes}} ||
<small>''kado'' : Downgrading 3.70 to 3.55 success with progskeet (differ ON, alter ON) ''NOTE: THIS BOARD HAS different lengt normally (length is E990)''</small>
|-
| JSD-001 || 1x Spansion S29GL128P90TFIR2 || {{Yes}} || {{Yes}} ||
<small>''Hikage'' : Downgrading 3.72 to 3.55 success with teensy++ and NORway 0.3, dump work with norway 0.4 beta10 but partial work on write. Norway 0.4 beta12 work fine on read and write.</small>
|-
| KTE-001 || 1x Spansion S29GL128P90TFIR2 ||{{Yes}} || {{Yes}} || <small>''AdReNaLiN_TR'' : Nor dumping/wrıtıng for downgrade do not wrıte.ps3 unbrick refresh dump progskeet.</small>
|-
| KTE-001 || 1x Samsung K8P2716UZC-QI4D || {{Yes}} || {{Yes}} || <small>''AdReNaLiN_TR'' :Nor Dumping/Writing downgradable no metldr2 refresh dump progskeet
|-
| KTE-001 || 1x Macronix MX29GL128ELT2I-90G || {{Yes}} ||{{No}}  ||  <small>''NO GO!'' : Tried default Macronix settings in WinSkeet40000 v111004, ProgSkeet v1.1. soldered (360 clip 56 or ZIF 50 cable and post header pcb have shorts).  Verification errors always persist when attempting to flash. Erase also gets errors.</small> 
|-
| EXA-MPLE || 1x dummy || {{Yes}} || {{No}} || <small>''example'' : Tried 128/128 and 4K/4096, resistor and A/B trick, always freezes on first sector</small>
|-
|}
 
must add this one in English in the channel above (marlboro1) :
    Résumé:
    - PS3 slim CECH-2004A (DYN-001 et Samsung NOR)
    - OFW 3.70
    - Progskeet (dernier pilote)
    - Flasher 110819 et Winskeet4000 (dernière version)
   
    Installation du progskeet avec les documentations trouvées sur psdevwiki.
    Dump réussi sans problème.
    Lors du flash, avec la première version de transplante, j'ai eu un échec.
    Ensuite impossible de réécrire avec le dump original.
    Impossible de flasher la NOR avec le dump modifié par la deuxième version du patch de dospierda.
    Ir0nman m'a conseillé de ponter R8 et de mettre en place une résistance de 10Kohms entre le 3.3V et RDY et une de 100Kohms entre le RDY du progskeet et celui de la NOR. Cela a semblé fonctionner mieux.
    Ensuite Ir0nman m'a conseillé de mettre directement la résistance de 10Kohms entre R8, qui est ponté, et RDY du progskeet. Cela m'a permis de réécrire le dump original et récupérer ma PS3 en OFW 3.70.
    Lorsque j'ai fait un dump, il est identique à celui d'origine.
    http://i1180.photobucket.com/albums/x413/Ir0nman11/IMAG0119.jpg (switch R7, R8 removed and bridged, using resistor pullup RY/BY)
 
== Pretesters ==
 
Users With NORway (teensy++) who maybe could do pretesting :
Ryd3R
 
Users with Injectus who maybe could do some pretesting :
ares
damox
delsol
 
 
 
== Progskeet QT port ==
OLDEST: http://www.sendspace.com/file/3bz5s5  USE AT YOUR OWN RISK <br />
OLDER: http://www.sendspace.com/file/ijr2yb  USE AT YOUR OWN RISK <br />
 
Current: http://static.loping.net/private/ps3/WinSkeet40000.zip  <- Qt Port, latest one, BETA STILL
 
<Ago> damox: ill add import / export soon
<Ago> for now, you can export the registry key
<Ago> HKEY_CURRENT_USER\Software\ProgSkeet\ProgSkeet\presets
<Ago> on linux and osx its file based
 
== Resistor trickery ==
without pullup:    rdy ---[100kOhm]--- nor_rdy
with pullup:    3.3V---[10kOhm]---rdy---[100kOhm]----nor_rdy
 
== Progskeet manual testing version ==
<Ago> for anyone wanting to diagnose wiring problems, i have a build that allows you to set the data and address lines by hand
<Ago> http://static.loping.net/private/ps3/WinSkeet40000_manual_test.zip
<Ago> 13:16 <Ago> there is a new tools tab
<Ago> 13:16 <Ago> there you will find address and data entry boxes
<Ago> 13:16 <Ago> you can prefix with 0x for hexadecimal input
<Ago> 13:16 <Ago> or with b for binary input
<Ago> also, this build will decode the cfi as text when dumping
<Ago> i will also add a semi-automated testing mode
<Ago> where it will set only one line to high and prompt you to check it
<Ago> then checks the next one
 
<No Go> Progskeet "Crystal Blue" v1.1 has a 50 pin ZIF connector which is a solderless connection.
<No Go> 360 Clip manufactures a solderless clip for a 56 pin NOR and 50 wire flat cable which does not work as shorts are created.
<No Go< As of Dec. 2011 there is no working solderless connection to a PS3 NOR
 
== BD drive not found problem ==
Progskeet/Teensy related:
<Ryd3R_> faild to downgrade just like the prev test
<Ryd3R_> with the BD drive error
<Ryd3R_> tried jaicarb lv2diag - CFW with no BDCheck - reconnecting the BR drive
<Ryd3R_> all of them failed
     
<Ryd3R_> i found what is causing the problem
<Ryd3R_> the programmer (progskeet/NORway)  while its hooked to the mobo it somehow cause the BR drive not found problem
<Ryd3R_> what i did is desoldering the control lines and updated without any problem
<Ryd3R_> the mobo is VER-001
 
Other reason/solution:
<Rogero> eussNL: nice69 tested a No_BD CFW i gave him and it worked
          for his 5 consoles that he was having problems updating
<Rogero> he tried normal lv2diag.self but didn't work for him
<Rogero> then we noticed that his consoles are refurbished...
          these are the only consoles he had problem downgrading
          (where the normal PUP failed to complete)
<Rogero> http://www.rogero.tortuga-cove.com/Rogero_CFW_V2_Kmeaw_LV1_Patched_3.72_spoof_Privacy_Patch_NoBD_Update.PUP
<Rogero> in case anyone needs it too ;)
 
== Problematic Samsung / Spansion N related ==


=== Teensy ===
== hardware dumps ==
<jevin> nikitis, want to work tonight on getting samsung support working w/ teesny?
256 MB (268,435,456 bytes)
<jevin> ive got a hack to get around the different block sizes throughout the chip: just chip erase the whole thing
bootldr is at 0x000000 on NAND (0xFC0000 on NOR)
<jevin> and that chip erase is actually 2 chip erases, one with a22 low and one with a22 high (internally there are 2 8MB nor dies)
<jevin> then when flashing you cant use the write buffer command (there is no buffer)
<jevin> and have to instead use slower unlocked programming
<jevin> nikitis, ive had my teensy soldered up for nearly a week in the hopefully new, emi-proof location but havent hacked up the mobo shield to make it actually fit. i should try it tonight to see if it works


===Progskeet===
== software dumps ==
<kado> i confirm PROGSKEET HARDWARE is STABLE than other programer (teensy,etc)
dump size = 239 MB (251,396,096 bytes)<br />
<kado> the only problem is from flasher
bootldr not at 0x000000 on NAND :
<kado> especially for Spansion 'N' & SAMSUNG
<kado> i tested the winskeet but still not working well for those
<eussNL> ok, did it use A22 virtual chip #CE correct in your observations kado ?
<kado> actually no euss
<eussNL> shame
<kado> all flasher should be focus on SB_tristae, reset
<eussNL> so it was low all the time (virtual chip select 1) ?
<kado> and for spansion should be focus on those + #WP
<kado> and i am sure it could be emulated by flasher it self ;)
<eussNL> sure, not a problem to change the way controllines are used
<eussNL> just need a good preset that also sets the correct writing strategy
<kado> yes
<kado> thats right
<eussNL> which reminds me, that was one thing left out in winskeet (the samsung setting needs manual setting after selecting the preset)
<kado> the secreet for spansion N is only need 0v for (tristate & reset)
<kado> and do not ever modified the RDY
<kado> RY/BY NOR is controlled by SB
<kado> hope you can make this clear eusss, and explaint to all people


  <kado> next secreet for Samsung "Q" (edit: K8Q2815UQB-PI4B), pls make note :
  00000000  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
<kado> check your #WE shold be 'L'
  00000010  00 00 00 00 0F AC E0 FF 00 00 00 00 DE AD BE EF  .....¬àÿ....Þ­¾ï
<kado> and RESET should be 'H'
<eussNL> isnt that default kado? because Samsung Q (edit:K8P2716UZC-QI4D) already works fine afaik
<kado> once again no RESISTOR trick
<kado> i always use 110819
<kado> for write
<kado> and check those point
  <kado> with all option checked
  <kado> eus: the flasher could not emulated that point
  <eussNL> kado, the QT port is the current one, the other is ment to be no longer maintained if I got it right


edit: NOTE that we both ment different Samsung! kado:K8Q2815UQB-PI4B // eussNL: K8P2716UZC-QI4D (reason: both have Q in their partnumber)
reason:
addi    %r12, %r4, 0x200 # r4 = start sector


25MB NAND consoles have a hidden section of size 0x40000 (0x200 * 512 byte sector = 0x40000) hidden by the hv. The hv hides it at address 002786E8


== manual A22 virtual chip select ==
Original code : 0x39840200f8010090<br />
For dualbanked chips with A22 Virtual Chip Select pin (e.g. Samsung K8Q2815UQB-PI4B)
Change to : 0x39840000f8010090
  128Kx128 settings to flash.
                       
  resistor 10k:
    a22 point on board (NOR) ----- 10k ----- 3,3v direct
  a22 point of prgoskeet is not connected to anything while flashing second bank
     
first flash first virtual chip with A22 low : 0-63 first bank      (000000-7FFFFF)
then flash second virtual chip with A22 high : 64-128 second bank  (800000-FFFFFF)
See also : http://www.progskeet.com/forum/viewtopic.php?f=3&t=373


<bluemimmo> :
Too dangerous to patch unless you peek/poke because obviously it messes with all the offsets
- Dump the NOR as many times as we like and check them they are identical.
- Use norunpack to unpack the nor dump, so if nordump extracts without any errors, then we are quite sure that nor dump is valid.
- Now make downgrade.bin from downgrade v2 patch. FYI you can have dump from any version and any mode like FSM too.
- After downgrade.bin is prepared, divide it into two parts. First part = offset:000000 - 7FFFFF and Second part = offset:800000 - FFFFFF
- Flash the part1 with winskeet in 128/128 mode from sector 0 - 63
- Now dump your full nor again and divide it into two halves as mentioned above. Now compare the first half dumped just now with the downgrade.bin part1, if both are identical then you are ok to go.
- close the winskeet and open Progskeet_110819 and switch the a22 pin to high.
- In progskeet_110819 select mode 4/4096 and custom sector start from 2048 - 4095
- Select byte swap, alternate write method, verify, differential flashing, and flash the downgrade.part2.bin
- After flashing complete and verified ok, switch the a22 pin to normal position and dump you flash again.
- Compare the recently dumped flash to downgrade.bin, if both are identical, yours is downgraded.
See also : http://www.progskeet.com/forum/viewtopic.php?f=3&t=382


<winskeet latest>
No need to pull a22 line high manually, winskeet will do automatically. Tested and works fine.


== Read CFI data ==
==NOR==
<Ago> guys, we need people to supply us with nor cfi data
<Ago> we're most interested in samsung
<Ago> i'm currently uploading a test version that dumps cfi
<Ago> http://static.loping.net/private/ps3/WinSkeet40000_CFI_Test3.zip
<Ago> select preset and press dump cfi on nor tab
<Ago> then send the resulting file
     
<Oliveira> CFI is a section of the PS3 flash image ?
<Oliveira> or is it the chip ID stuff ?
<Ago> no, its information about hte flash chip itself
<Ago> like how it wants to be written, erased and how big it is
<Ago> we currently do not use it at all
<Ago> but we think the samsung problems and maybe the spansion n problems are because of that
 
http://static.loping.net/private/ps3/cfi/Spansion%20S29GL128N90TFIR2.cfi
http://static.loping.net/private/ps3/cfi/Spansion%20S29GL128P90TFIR2.cfi
http://static.loping.net/private/ps3/cfi/Samsung%20K8Q2815UQB-PI4B.cfi
http://static.loping.net/private/ps3/cfi/Macronix%20MX29GL128ELT2I-90G.cfi
 
== Offboard flashing / Replacement NOR talk ==
 
<Rogero> eussNL: about flashing a nand/NOR externally,
          once removed from the board and into a socket,
          will this work for sure ?
<Rogero> i mean could be done, no problems if the nand is standalone
<eussNL> this will work for sure for board originated problems.
<eussNL> that still leaves us the Samsung dualbanked issue
<eussNL> e.g. VER-001 are most likely to benefit from offboard solution
<eussNL> perpaps it is a solution to exchange the banked Samsung for the uniform one,
          or a Spansion/Macronix - someone tried that on a VER,
          but ran into board related issues afaik
<eussNL> because reading isnt the problem, writing is -
          so read a banked Samsung offboard,
          and flash patched in a nonbanked/uniform one offboard and resolder
<eussNL> offboard also means no need for messing with resistor trickery
          (pullup/down´s) on control-lines (RY/BY)
<nice69> read and write externally, then re-solder the chip
   
<Xb0xGuru> right, so it's the board layout which is the problem?
<eussNL> 2 fold
<eussNL> 1) Samsung banked 2) VER-001 board
   
<Xb0xGuru> what about the DYN-001 board? Would a Spansion work on there as a replacement?
<eussNL> and if board modification is on order, it would be most likely a controlline,
          like RY/BY, which was the target of the resistor trickery
<eussNL> DYN-001 works fine with Macronic Xb0xGuru
<eussNL> see http://www.psdevwiki.com/index.php?title=Talk:Hardware_flashing#Testreport_table
          for the patterns of problems
   
<eussNL> you can use others flash too,
          the one I list there is just the one Sony used on a different version of the board.
          See http://www.psdevwiki.com/index.php?title=Flash_%28Hardware%29#NOR
          for all the current NORs used
          (and stay away from dualbanked and perhaps ¨N¨ serie spansion too)
<eussNL> anyhow Samsung K8P2716UZC-QI4D = uniform/nonbanked and is fastest.
          The Macronix and Spansion are 90ns
<eussNL> Replacements for NOR have to be
          =>128Mbit x8,
          VCC 3V (2.7V~3.6V),
          <=90ns,
          56-TSOP1, pincompatible,
        uniform/nonbanked, non OTP, non encrypted.
     
<Xb0xGuru> I successfully transplanted a Spansion P NOR onto my DYN-001 board that had a Samsung NOR on there previously.
<kado> r u sure??
<Xb0xGuru> yes - all done
<Xb0xGuru> downgraded to 3.55 CFW.
<kado> wow thats good to know
<Xb0xGuru> flashed it initially with the original 3.70 dump and it fired up nicely too
<Xb0xGuru> Spansion P came from another DYN-001 board, if that matters
 
Heavily edited log. Interesting read IMO
 
== NAND clips ==
<Gallery>
Progskeet with NAND socket SA247-TSOP48-D48 by playonlcd.jpg|NAND socket SA247-TSOP48-D48
CLIP_styles.jpg|different Clips for NAND and NOR
</Gallery>
 
http://img15.imageshack.us/img15/611/progskeet360clip.png
 
== NOR clips ==
 
== Old reference ==
(don't remove, not all is on mainpage)
 
 
===NAND===
NAND (256MB, old FAT models, needs 32 wires, 15 per NAND : 8x I/O + 7x Control (R/B, WE, WP, ALE, CLE, RE, CE) + GND + VCC<br />
2 chips: Samsung K9F1G08U0A-PIB0
 
bitbanger for RPI: https://www.raspberrypi.org/forums/viewtopic.php?f=44&t=16775
 
===NOR===
NOR 16MB, newer FAT models + Slims<br />
NOR 16MB, newer FAT models + Slims<br />
needs 44 I/O wires: 23 address lines:A0-A22 + 16 Data lines:D0-D15 + 5 control lines:
needs 44 I/O wires: 23 address lines:A0-A22 + 16 Data lines:D0-D15 + 5 control lines:
CE#,OE#,WE#,RESET#,TRISTATE (''optional'':#RY-BY) + GND + VCC<br /> ''(NB: RY/BY is optional only for Teensy, Progskeet NEED ALL controllines!)''
CE#,OE#,WE#,RESET#,TRISTATE (optional:#RY-BY) + GND + VCC<br />
 
1 chip: Spansion S29GL128N90TFIR2 or Samsung K8Q2815UQB-P14B
1 chip: Spansion S29GL128N90TFIR2 or Samsung K8Q2815UQB-P14B


Line 728: Line 58:


*[http://code.google.com/p/spansion-nand-programmer/ spansion programmer (PIC based)]
*[http://code.google.com/p/spansion-nand-programmer/ spansion programmer (PIC based)]
* http://git.dashhacks.com/pic32mx-nor-flasher / [http://www.multiupload.com/7Q0GND1IVR pic32mx-nor-flasher-pic32mx-nor-flasher-master.tar.gz (751.65 KB)]
(Note : PIC32 flasher for Spansion is very slow: dumping 16MB = ~15min / writing full dump = 4 hours)
*[https://github.com/hjudges/NORway NORway for Teensy++ 2.0]
** [http://rootedsystem.com/2011/07/norway-allows-flashing-the-ps3-nor-using-the-teensy-2-0/ NORway Teensy] / [http://www.mediafire.com/?ir89sxupwspp3j4 NORway_v0.1.zip]


===PCCard/Compact Flash, SRAM, PSRAM, NOR and NAND===
ARM32 flasher: http://www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/DATASHEET/CD00191185.pdf


----
----
Line 748: Line 69:
----
----


Alternatives for Infectus2 and Teensy 2.0++:
Simple dumping NOR from Linux:
 
dd if=/dev/ps3nflasha of=NOR.BIN bs=1024
* Progskeet ([http://twitter.com/#!/uf6667 UF6667]) : http://twitpic.com/5pk6dz // http://fronttowardsgamer.com/2011/07/15/exclusive-hacker-talks-progskeet-geohot-and-why-he-doesnt-give-a-sht-about-sony/
** quad NAND with Progskeet: http://subirimg.com/images/img2065.jpg


----
----
[http://www.atmel.com/dyn/resources/prod_documents/7593S.pdf Atmel AT90USB1286 datasheet]
Alternatives for Infectus2 and Teensy 2.0++:
 
== NORway / Teensy experimental Samsung support ==
 
'''THIS IS UNTESTED CODE! DO NOT TRY THIS UNLESS YOU HAVE A VERIFIED GOOD DUMP OF YOUR FLASH AND ARE WILLING TO WORK OUT ANY BUGS IN FLASH WRITING!!!'''
 
This modification of NORway.py attempts to support samsung dualbanked flash chips (e.g. K8Q2815UQB-PI4B). It performs a chip erase (with a22 low then high) then programs the entire flash using unlocked, single-word programming. Programming ranges is not supported because partial erasing is not implemented. Programming will be '''slow''' because it waits for RY after programming every single word. The author's teensy install has EMI issues so they were '''not able to test this code'''! The file works with NORway's original Teensy firmware.
 
[http://pastie.org/2527251]
 
== link for improper NOR dump start ==
...is dead. i mean this one: "If your dump starts like this: http://pastebin.com/sS69Vhvf[...]" - anyone has the proper link?


== WES-51 alternatives ==
* Progskeet: http://twitpic.com/5pk6dz // http://fronttowardsgamer.com/2011/07/15/exclusive-hacker-talks-progskeet-geohot-and-why-he-doesnt-give-a-sht-about-sony/
Weller WS51 analoog  Best.-Nr.: 811808 - 62  conrad.de<br />
http://www.produktinfo.conrad.com/datenblaetter/800000-824999/811808-an-01-de-Loetstation_WS51.pdf<br />
German shops:
* http://www.ciao.de/Weller_Lotstation_WS_51__1068590
* http://www.funk-shop.de/07_loetstationen/07_ws51.htm
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps3/Talk:Hardware_flashing"