Editing Talk:Hardware flashing

== Testreport table==

{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable sortable" style="border:1px solid #999; border-collapse: collapse;" 
|- bgcolor="#cccccc"
! Board !! Flash !! Dumping !! Writing !! Remarks
|-
| COK-001 || 2x Samsung K9F1G08U0A-PIB0 ||  ||  || 
|-
| COK-002 || 2x Samsung K9F1G08U0A-PIB0 ||  ||  || 
|-
| SEM-001 || 2x Samsung K9F1G08UOB-PIB0 ||  ||  || 
|-
| SEM-001 || 2x Samsung K9F1G08UOB-PIB0 || {{Yes}} || {{No}} || <small>''sel99'' : CECHG / SEM-001 - 1-875-384-31 - can dump both NANDs fine, have trouble writing. both with Infectus and Progskeet. Boards below CECHG / SEM-001 flash fine.</small>
|-
| SEM-001 || 2x Samsung K9F1G08UOB-PIB0 || {{Yes}} || {{No}} || <small>''delsol'' : SEM-001 - 1-875-384-31 - dump both NANDs fine, still not able to reflash the nands correctly. there are always differences. Tried with Infectus.</small>
|-
| DIA-001 || 1x Spansion S29GL128N90TFIR2 ||  ||  || 
|-
| DIA-001 || 1x Spansion S29GL128N90TFIR2 || {{Yes}} || {{No}} || <small>''delsol'' : flasher still freeze at sector0 (A&B) dumping seems to works (A&B). Same result with and without resistors. Tried on winxp-sp2 and win7. // The best results i got was using the 9k & 100k resistors. the flash is unuseable but ProgSkeet_110819 doesen´t freeze anymore. // I have tried Teensy and NORway0.3: dumping of nor works fine, but everytime when i tried to flash, the pc loose usb-connection to Teensy</small>
|-
| DIA-002 || 1x Spansion S29GL128N90TFIR2 ||  ||  || 
|-
| VER-001 || 1x Spansion S29GL128P90TFIR2 || {{Yes}} || {{Yes}} || <small>''kado'' : Downgrading 3.70 to 3.55 success with progskeet (differ ON, No special trick) </small>
|-
| VER-001 || 1x Samsung K8Q2815UQB-PI4B ||  ||  || 
|-
| VER-001 || 1x Samsung K8Q2815UQB-PI4B || {{Yes}} || {{Yes}} || <small>''calimba'' :  downgrade successful with progskeet on VER-001 CECHL01 with QT port. if the program 110819 freeze you need flash first the file with the qt port.</small>
|-
| VER-001 || 1x Samsung K8Q2815UQB-PI4B || {{Yes}} || {{Yes}} || <small>''Ir0nmanNB'' :  Used all gnds listed on the diagram. I probe progskeet_rdy with my multimeter - I get 3.3V when writing and 0.9V when frozen. When giving progskeet_rdy direct 3.3v it no longer freezes. Writing succesfull when diffential flash is checked.</small>
|-
| VER-001 || 1x Samsung K8Q2815UQB-PI4B || {{Yes}} || {{No}} || <small>''Ryd3R'' : I'm currently working on editing NORWay script to make it support writing using (4k/4096) .</small>
|-
| VER-001 || 1x Spansion S29GL128P90TFIR2 || {{Yes}} || {{No}} || <small>''toxie'' : tried 128k/128 , 4k/4096. writing without alt. all FF, with alt some random patterns with 00 and FF when writing all 00. Trying A/B trick, still at Programming Sector 0</small>
|-
| VER-001 || 1x Spansion S29GL128N90TFIR2 || {{Yes}} || {{No}} || <small>''ares'' : tried 128k/128. With normal method a lot ff and same byte match. With alternate method 00 and ff and some byte match. Without resistor trick programmer freeze programming sector 0. with 100k and 9k resistor i can write but with errors (programmer completes the write, but the dump is all 00 ff, only few byte match, this with alternatemethod). with a/b tick's programmer (version A and B ) it freeze on programming sector 0 (both with or without resistors)</small>
|-
| DYN-001 || 1x Samsung K8Q2815UQB-PI4B ||  ||  || 
|-
| DYN-001 || 1x Macronix MX29GL128ELT2I-90G || {{Yes}} || {{Yes}} || <small>''Ryd3R'' : NORway 0.3 fully support R/W on Macronix MX29GL128ELT2I-90G.</small>
|-
| DYN-001 || 1x Macronix MX29GL128ELT2I-90G || {{Yes}} || {{Yes}} || <small>''calimba'' : Downgrade succesfull, used progskeet.</small>
|-
| SUR-001 || 1x Macronix MX29GL128ELT2I-90G || {{Yes}} || {{Yes}} || <small>''kado'' : Downgrade succesfull, used newest WT-port, nor pinout same as JSD-001</small>
|-
| JTP-001 || 1x Spansion S29GL128P90TFIR2 ||  ||  || 
|-
| JTP-001 || 1x Spansion S29GL128P90TFIR2 || {{Yes}} || {{Yes}} || <small>''drako_'' : success downgrading from 3.70 to 3.55 with wiring according to JSD-001 diagram, with 5 grounds and settings 128K/128 (progskeet).</small>
|-
| JTP-001 || 1x Spansion S29GL128P90TFIR2 || {{Yes}} || {{Yes}} || <small>''Ryd3R'' : success downgrading from 3.70 to 3.55 with wiring according to JSD-001 diagram NORway v0.3 .</small>
|-
| JSD-001 ||1x Spansion S29GL128P90TFIR2  ||  ||  || 
|-
| JSD-001 ||1x Samsung K8P2716UZC-QI4D  ||  ||  || 
|-
| JSD-001 ||1x Samsung K8P2716UZC-QI4D  || {{Yes}} || {{Yes}} || <small>''Ryd3R'' : NORway 0.3 fully support R/W on Samsung K8P2716UZC-QI4D.</small>
|-
| JSD-001 ||1x Spansion S29GL128P90TFIR2  || {{Yes}} || {{Yes}} || 
<small>''kado'' : Downgrading 3.70 to 3.55 success with progskeet (differ ON, alter ON) ''NOTE: THIS BOARD HAS different lengt normally (lenght is E990)''</small>
|-
| KTE-001 || 1x Spansion S29GL128P90TFIR2 ||  ||  || 
|-
| KTE-001 || 1x Macronix MX29GL128ELT2I-90G ||  ||  || 
|-

| EXA-MPLE || 1x dummy || {{Yes}} || {{No}} || <small>''example'' : Tried 128/128 and 4K/4096, resistor and A/B trick, always freezes on first sector</small>
|-
|}

== Pretesters ==

Users With NORway (teensy++) who maybe could do pretesting :
 Ryd3R

Users with Injectus who maybe could do some pretesting : 
 ares
 damox
 delsol



== Progskeet QT port ==
OLDEST: http://www.sendspace.com/file/3bz5s5  USE AT YOUR OWN RISK <br />
OLDER: http://www.sendspace.com/file/ijr2yb  USE AT YOUR OWN RISK <br />
OLD: http://static.loping.net/private/ps3/progskeet_nand_test.zip  USE AT YOUR OWN RISK <br />

Current: http://static.loping.net/private/ps3/WinSkeet40000.zip  <- Qt Port, latest one, BETA STILL

 <Ago> damox: ill add import / export soon
 <Ago> for now, you can export the registry key
 <Ago> HKEY_CURRENT_USER\Software\ProgSkeet\ProgSkeet\presets
 <Ago> on linux and osx its file based

== Resistor trickery ==
 without pullup:    rdy ---[100kOhm]--- nor_rdy
 with pullup:    3.3V---[10kOhm]---rdy---[100kOhm]----nor_rdy
    
 <Xb0xGuru> <uf6667> - would the 100k help with flashing past 2048 on Samsung NORs ?
 <uf6667> yes :)
 <uf6667> you gotta use alternate write method: single word
 <uf6667> to be sure
 <uf6667> use the NEWEST FLASHER
 <uf6667> posted above (Progskeet QT port)



== E3 Flasher related ==

http://imageshack.us/f/221/coverboardfronts.jpg/

Front of E3:
* microSD slot
** Start button
** Stop button
** LED: flash fun?
** LED:PS1 mode
** Switch?
** LED: CFW
** LED: OFW
** Switch?
** LED: Backup
** LED: Prog
** Switch?
* marking: Backup
** LED: OB Flash
** MicroSD
** Switch?
** LED: ON Flash
** LED: PS3Flash
** Switch?
* marking: Prog
** LED: Unlock
** LED: Lock
* ESATA Plug
* microUSB Plug

See it all here: http://www.youtube.com/watch?v=-FJsuc_uAjc

Maximum harddrive 2.5TB according to E3 website (currently down)

    Dual Boot 3.7OFW and 3.55CFW on same PS3
    Downgrade 3.7 to 3.55 in 5min
    16M NOR FLASH ON board
    3 save MODE, can save data in TF, NOR FLASH on board and PC HD
    1 KEY operation, simple is best
    Upgradable from TF card or PC USB
    Compatiable all device like PS3/WII/XBOX360/MP3/DVD/BD/MP4/Table PC which has NAND or NOR flash memory.
    Integrated lots of interface, perfectly extension, will have more function with future new E3 accessory.
    E3 flasher Limited version includes 8 accessory, suggested retail price $88 USD, total production run only 3000 units!



== Problematic Samsung related ==

 <jevin> nikitis, want to work tonight on getting samsung support working w/ teesny?
 <jevin> ive got a hack to get around the different block sizes throughout the chip: just chip erase the whole thing
 <jevin> and that chip erase is actually 2 chip erases, one with a22 low and one with a22 high (internally there are 2 8MB nor dies)
 <jevin> then when flashing you cant use the write buffer command (there is no buffer)
 <jevin> and have to instead use slower unlocked programming
 <jevin> nikitis, ive had my teensy soldered up for nearly a week in the hopefully new, emi-proof location but havent hacked up the mobo shield to make it actually fit. i should try it tonight to see if it works



== Offboard flashing / Replacement NOR talk ==

 <Rogero> eussNL: about flashing a nand/NOR externally, 
          once removed from the board and into a socket, 
          will this work for sure ?
 <Rogero> i mean could be done, no problems if the nand is standalone
 <eussNL> this will work for sure for board originated problems.
 <eussNL> that still leaves us the Samsung dualbanked issue
 <eussNL> e.g. VER-001 are most likely to benefit from offboard solution
 <eussNL> perpaps it is a solution to exchange the banked Samsung for the uniform one, 
          or a Spansion/Macronix - someone tried that on a VER,
          but ran into board related issues afaik
 <eussNL> because reading isnt the problem, writing is - 
          so read a banked Samsung offboard, 
          and flash patched in a nonbanked/uniform one offboard and resolder
 <eussNL> offboard also means no need for messing with resistor trickery
          (pullup/down´s) on control-lines (RY/BY)
 <nice69> read and write externally, then re-solder the chip
    
 <Xb0xGuru> right, so it's the board layout which is the problem?
 <eussNL> 2 fold
 <eussNL> 1) Samsung banked 2) VER-001 board
    
 <Xb0xGuru> what about the DYN-001 board? Would a Spansion work on there as a replacement?
 <eussNL> and if board modification is on order, it would be most likely a controlline, 
          like RY/BY, which was the target of the resistor trickery
 <eussNL> DYN-001 works fine with Macronic Xb0xGuru 
 <eussNL> see http://www.ps3devwiki.com/index.php?title=Talk:Hardware_flashing#Testreport_table
          for the patterns of problems
    
 <eussNL> you can use others flash too, 
          the one I list there is just the one Sony used on a different version of the board.
          See http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NOR 
          for all the current NORs used
          (and stay away from dualbanked and perhaps ¨N¨ serie spansion too)
 <eussNL> anyhow Samsung K8P2716UZC-QI4D = uniform/nonbanked and is fastest. 
          The Macronix and Spansion are 90ns
 <eussNL> Replacements for NOR have to be 
          =>128Mbit x8, 
          VCC 3V (2.7V~3.6V), 
          <=90ns, 
          56-TSOP1, pincompatible, 
          uniform/nonbanked, non OTP, non encrypted.

(heavily edited log, interesting read imo)

== RSOD related ==

 <kado> i want to confirm about RSOD
 <kado> my english is bad, but i want you can tell to evryone
 <kado> there is 2 types of RSOD
 <kado> 1.come from CFW 2.from OFW
 <kado> if coused by CFW we should patch the cVTRM
 <kado> and if coused by OFW we should patch the core_OS. and use the last official Core_OS
 <kado> btw, i have fix this 2pcs off RSOD today 



== Old reference ==
(don't remove, not all is on mainpage)


===NAND===
NAND (256MB, old FAT models, needs 32 wires, 15 per NAND + GND + VCC)<br />
2 chips: Samsung K9F1G08U0A-PIB0

*http://www.uchobby.com/index.php/2007/05/05/read-embedded-flash-chips/

*[http://www.multiupload.com/KKSLGMGDJR NAND_Dumper_Extractor.rar (1.55 MB)]

[http://www.sendspace.com/file/qhwkm5 FlowRebuilder v.4.1.0.0]


===NOR===
NOR 16MB, newer FAT models + Slims<br />
needs 44 I/O wires: 23 address lines:A0-A22 + 16 Data lines:D0-D15 + 5 control lines:
CE#,OE#,WE#,RESET#,TRISTATE (''optional'':#RY-BY) + GND + VCC<br /> ''(NB: RY/BY is optional only for Teensy, Progskeet NEED ALL controllines!)''

1 chip: Spansion S29GL128N90TFIR2 or Samsung K8Q2815UQB-P14B

NOR uses 1024 byte sector, just as NAND.

*[http://www.multiupload.com/HDMHOVRICU noralizer.rar (9.95 MB)] incl. 2 different FAT models (CECHL04-jestero + CECH?-Phiren) pads labeled

*[http://www.multiupload.com/LHVNPTLY4P  joohan USBbitbanger on AVR for NOR flashing.rar (1.17 MB)] ([http://psx-scene.com/forums/f149/usb-bitbanger-avr-good-nor-flash-programming-etc-75245/ original topic @psx-scene])

*[http://code.google.com/p/spansion-nand-programmer/ spansion programmer (PIC based)]

*[http://git.dashhacks.com/norway NORway for Teensy++ 2.0]
** [http://rootedsystem.com/2011/07/norway-allows-flashing-the-ps3-nor-using-the-teensy-2-0/ NORway Teensy] / [http://www.mediafire.com/?ir89sxupwspp3j4 NORway_v0.1.zip]
----

*http://git-hacks.com/atnorflash/atnorflash

*http://hotfile.com/dl/118618929/f6914e0/ps3flasher.tgz.html (note: older version)


----

Alternatives for Infectus2 and Teensy 2.0++:

* Progskeet ([http://twitter.com/#!/uf6667 UF6667]) : http://twitpic.com/5pk6dz // http://fronttowardsgamer.com/2011/07/15/exclusive-hacker-talks-progskeet-geohot-and-why-he-doesnt-give-a-sht-about-sony/
** quad NAND with Progskeet: http://subirimg.com/images/img2065.jpg

----
[http://www.atmel.com/dyn/resources/prod_documents/7593S.pdf Atmel AT90USB1286 datasheet]