Talk:Hardware flashing

Testreport table

Board	Flash	Dumping	Writing	Remarks
COK-001	2x Samsung K9F1G08U0A-PIB0
COK-002	2x Samsung K9F1G08U0A-PIB0
SEM-001	2x Samsung K9F1G08UOB-PIB0
SEM-001	2x Samsung K9F1G08UOB-PIB0	Yes	No	sel99 : CECHG / SEM-001 - 1-875-384-31 - can dump both NANDs fine, have trouble writing. both with Infectus and Progskeet. Boards below CECHG / SEM-001 flash fine.
SEM-001	2x Samsung K9F1G08UOB-PIB0	Yes	No	delsol : SEM-001 - 1-875-384-31 - dump both NANDs fine, still not able to reflash the nands correctly. there are always differences. Tried with Infectus.
DIA-001	1x Spansion S29GL128N90TFIR2
DIA-001	1x Spansion S29GL128N90TFIR2	Yes	No	delsol : flasher still freeze at sector0 (A&B) dumping seems to works (A&B). Same result with and without resistors. Tried on winxp-sp2 and win7. // The best results i got was using the 9k & 100k resistors. the flash is unuseable but ProgSkeet_110819 doesen´t freeze anymore. // I have tried Teensy and NORway0.3: dumping of nor works fine, but everytime when i tried to flash, the pc loose usb-connection to Teensy
DIA-002	1x Spansion S29GL128N90TFIR2
VER-001	1x Spansion S29GL128P90TFIR2	Yes	Yes	kado : Downgrading 3.70 to 3.55 success with progskeet (differ ON, No special trick)
VER-001	1x Samsung K8Q2815UQB-PI4B
VER-001	1x Samsung K8Q2815UQB-PI4B	Yes	Yes	calimba : downgrade successful with progskeet on VER-001 CECHL01 with QT port. if the program 110819 freeze you need flash first the file with the qt port.
VER-001	1x Samsung K8Q2815UQB-PI4B	Yes	Yes	Ir0nmanNB : Used all gnds listed on the diagram. I probe progskeet_rdy with my multimeter - I get 3.3V when writing and 0.9V when frozen. When giving progskeet_rdy direct 3.3v it no longer freezes. Writing succesfull when diffential flash is checked.
VER-001	1x Samsung K8Q2815UQB-PI4B	Yes	Yes	Ryd3R : Starting from NORway v0.4 Beta W/R fully supported ) .
VER-001	1x Spansion S29GL128P90TFIR2	Yes	No	toxie : tried 128k/128 , 4k/4096. writing without alt. all FF, with alt some random patterns with 00 and FF when writing all 00. Trying A/B trick, still at Programming Sector 0
VER-001	1x Spansion S29GL128N90TFIR2	Yes	No	ares : tried 128k/128. With normal method a lot ff and same byte match. With alternate method 00 and ff and some byte match. Without resistor trick programmer freeze programming sector 0. with 100k and 9k resistor i can write but with errors (programmer completes the write, but the dump is all 00 ff, only few byte match, this with alternatemethod). with a/b tick's programmer (version A and B ) it freeze on programming sector 0 (both with or without resistors)
DYN-001	1x Samsung K8Q2815UQB-PI4B
DYN-001	1x Spansion S29GL128P90TFIR2
DYN-001	1x Macronix MX29GL128ELT2I-90G	Yes	Yes	Ryd3R : NORway 0.3 fully support R/W on Macronix MX29GL128ELT2I-90G.
DYN-001	1x Spansion S29GL128P90TFIR2	Yes	Yes	Xb0xGuru : Downgrade successful. 100k/10k resistor trick used, Winskeet 40000 used (10 September 2011, 21:14:56)
DYN-001	1x Macronix MX29GL128ELT2I-90G	Yes	Yes	calimba : Downgrade succesfull, used progskeet.
SUR-001	1x Macronix MX29GL128ELT2I-90G	Yes	Yes	kado : Downgrade succesfull, used newest WT-port, nor pinout same as JSD-001
JTP-001	1x Spansion S29GL128P90TFIR2
JTP-001	1x Spansion S29GL128P90TFIR2	Yes	Yes	drako_ : success downgrading from 3.70 to 3.55 with wiring according to JSD-001 diagram, with 5 grounds and settings 128K/128 (progskeet).
JTP-001	1x Spansion S29GL128P90TFIR2	Yes	Yes	Ryd3R : success downgrading from 3.70 to 3.55 with wiring according to JSD-001 diagram NORway v0.3 .
JSD-001	1x Spansion S29GL128P90TFIR2
JSD-001	1x Samsung K8P2716UZC-QI4D	Yes	Yes	kado : Downgrade succesfull with special trick
JSD-001	1x Samsung K8P2716UZC-QI4D	Yes	Yes	Ryd3R : NORway 0.3 fully support R/W on Samsung K8P2716UZC-QI4D.
JSD-001	1x Spansion S29GL128P90TFIR2	Yes	Yes	kado : Downgrading 3.70 to 3.55 success with progskeet (differ ON, alter ON) NOTE: THIS BOARD HAS different lengt normally (lenght is E990)
KTE-001	1x Spansion S29GL128P90TFIR2
KTE-001	1x Macronix MX29GL128ELT2I-90G
EXA-MPLE	1x dummy	Yes	No	example : Tried 128/128 and 4K/4096, resistor and A/B trick, always freezes on first sector

Pretesters

Users With NORway (teensy++) who maybe could do pretesting :

Ryd3R

Users with Injectus who maybe could do some pretesting :

ares
damox
delsol

Progskeet QT port

OLDEST: http://www.sendspace.com/file/3bz5s5 USE AT YOUR OWN RISK
OLDER: http://www.sendspace.com/file/ijr2yb USE AT YOUR OWN RISK
OLD: http://static.loping.net/private/ps3/progskeet_nand_test.zip USE AT YOUR OWN RISK

Current: http://static.loping.net/private/ps3/WinSkeet40000.zip <- Qt Port, latest one, BETA STILL

<Ago> damox: ill add import / export soon
<Ago> for now, you can export the registry key
<Ago> HKEY_CURRENT_USER\Software\ProgSkeet\ProgSkeet\presets
<Ago> on linux and osx its file based

Resistor trickery

without pullup:    rdy ---[100kOhm]--- nor_rdy
with pullup:    3.3V---[10kOhm]---rdy---[100kOhm]----nor_rdy
   
<Xb0xGuru> <uf6667> - would the 100k help with flashing past 2048 on Samsung NORs ?
<uf6667> yes :)
<uf6667> you gotta use alternate write method: single word
<uf6667> to be sure
<uf6667> use the NEWEST FLASHER
<uf6667> posted above (Progskeet QT port)

E3 Flasher related

http://imageshack.us/f/221/coverboardfronts.jpg/

Front of E3:

microSD slot
- Start button
- Stop button
- LED: flash fun?
- LED:PS1 mode
- Switch?
- LED: CFW
- LED: OFW
- Switch?
- LED: Backup
- LED: Prog
- Switch?
marking: Backup
- LED: OB Flash
- MicroSD
- Switch?
- LED: ON Flash
- LED: PS3Flash
- Switch?
marking: Prog
- LED: Unlock
- LED: Lock
ESATA Plug
microUSB Plug

See it all here: http://www.youtube.com/watch?v=-FJsuc_uAjc

Maximum harddrive 2.5TB according to E3 website (currently down)

   Dual Boot 3.7OFW and 3.55CFW on same PS3
   Downgrade 3.7 to 3.55 in 5min
   16M NOR FLASH ON board
   3 save MODE, can save data in TF, NOR FLASH on board and PC HD
   1 KEY operation, simple is best
   Upgradable from TF card or PC USB
   Compatiable all device like PS3/WII/XBOX360/MP3/DVD/BD/MP4/Table PC which has NAND or NOR flash memory.
   Integrated lots of interface, perfectly extension, will have more function with future new E3 accessory.
   E3 flasher Limited version includes 8 accessory, suggested retail price $88 USD, total production run only 3000 units!

Problematic Samsung / Spansion N related

Teensy

<jevin> nikitis, want to work tonight on getting samsung support working w/ teesny?
<jevin> ive got a hack to get around the different block sizes throughout the chip: just chip erase the whole thing
<jevin> and that chip erase is actually 2 chip erases, one with a22 low and one with a22 high (internally there are 2 8MB nor dies)
<jevin> then when flashing you cant use the write buffer command (there is no buffer)
<jevin> and have to instead use slower unlocked programming
<jevin> nikitis, ive had my teensy soldered up for nearly a week in the hopefully new, emi-proof location but havent hacked up the mobo shield to make it actually fit. i should try it tonight to see if it works

Progskeet

<kado> i confirm PROGSKEET HARDWARE is STABLE than other programer (teensy,etc)
<kado> the only problem is from flasher
<kado> especially for Spansion 'N' & SAMSUNG
<kado> i tested the winskeet but still not working well for those
<eussNL> ok, did it use A22 virtual chip #CE correct in your observations kado ?
<kado> actually no euss
<eussNL> shame
<kado> all flasher should be focus on SB_tristae, reset
<eussNL> so it was low all the time (virtual chip select 1) ?
<kado> and for spansion should be focus on those + #WP
<kado> and i am sure it could be emulated by flasher it self ;)
<eussNL> sure, not a problem to change the way controllines are used
<eussNL> just need a good preset that also sets the correct writing strategy
<kado> yes
<kado> thats right
<eussNL> which reminds me, that was one thing left out in winskeet (the samsung setting needs manual setting after selecting the preset)
<kado> the secreet for spansion N is only need 0v for (tristate & reset)
<kado> and do not ever modified the RDY
<kado> RY/BY NOR is controlled by SB
<kado> hope you can make this clear eusss, and explaint to all people

Read CFI data

<Ago> guys, we need people to supply us with nor cfi data
<Ago> we're most interested in samsung
<Ago> i'm currently uploading a test version that dumps cfi
<Ago> http://static.loping.net/private/ps3/WinSkeet40000_CFI_Test3.zip
<Ago> select preset and press dump cfi on nor tab
<Ago> then send the resulting file
      
<Oliveira> CFI is a section of the PS3 flash image ?
<Oliveira> or is it the chip ID stuff ?
<Ago> no, its information about hte flash chip itself
<Ago> like how it wants to be written, erased and how big it is
<Ago> we currently do not use it at all
<Ago> but we think the samsung problems and maybe the spansion n problems are because of that
 
<kanter> Ago : http://www.fileserve.com/file/Y2FcKHJ/cfi.bin (Samsung K8Q2815UQB-PI4B)
<MrGBNC> http://www.megaupload.com/?d=JAWVVDRW <---S29GL128N90TFIR20 CFI
<Oliveira> http://pastebin.com/LBDZc1pJ (MX)
<Ir0nmanNB> http://dl.dropbox.com/u/33509087/ir0nman_CFI.rar (Samsung K8Q2815UQB-PI4B)
<marlboro1> this my cfi: NOR SAMSUNG K8Q2815UQB-PI4B / mobo DYN-001 : http://dl.free.fr/v57NSPFX6

Offboard flashing / Replacement NOR talk

<Rogero> eussNL: about flashing a nand/NOR externally, 
         once removed from the board and into a socket, 
         will this work for sure ?
<Rogero> i mean could be done, no problems if the nand is standalone
<eussNL> this will work for sure for board originated problems.
<eussNL> that still leaves us the Samsung dualbanked issue
<eussNL> e.g. VER-001 are most likely to benefit from offboard solution
<eussNL> perpaps it is a solution to exchange the banked Samsung for the uniform one, 
         or a Spansion/Macronix - someone tried that on a VER,
         but ran into board related issues afaik
<eussNL> because reading isnt the problem, writing is - 
         so read a banked Samsung offboard, 
         and flash patched in a nonbanked/uniform one offboard and resolder
<eussNL> offboard also means no need for messing with resistor trickery
         (pullup/down´s) on control-lines (RY/BY)
<nice69> read and write externally, then re-solder the chip
   
<Xb0xGuru> right, so it's the board layout which is the problem?
<eussNL> 2 fold
<eussNL> 1) Samsung banked 2) VER-001 board
   
<Xb0xGuru> what about the DYN-001 board? Would a Spansion work on there as a replacement?
<eussNL> and if board modification is on order, it would be most likely a controlline, 
         like RY/BY, which was the target of the resistor trickery
<eussNL> DYN-001 works fine with Macronic Xb0xGuru 
<eussNL> see http://www.ps3devwiki.com/index.php?title=Talk:Hardware_flashing#Testreport_table
         for the patterns of problems
   
<eussNL> you can use others flash too, 
         the one I list there is just the one Sony used on a different version of the board.
         See http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NOR 
         for all the current NORs used
         (and stay away from dualbanked and perhaps ¨N¨ serie spansion too)
<eussNL> anyhow Samsung K8P2716UZC-QI4D = uniform/nonbanked and is fastest. 
         The Macronix and Spansion are 90ns
<eussNL> Replacements for NOR have to be 
         =>128Mbit x8, 
         VCC 3V (2.7V~3.6V), 
         <=90ns, 
         56-TSOP1, pincompatible, 
        uniform/nonbanked, non OTP, non encrypted.
     	
<Xb0xGuru> I successfully transplanted a Spansion P NOR onto my DYN-001 board that had a Samsung NOR on there previously.
<kado> r u sure??
<Xb0xGuru> yes - all done
<Xb0xGuru> downgraded to 3.55 CFW.
<kado> wow thats good to know
<Xb0xGuru> flashed it initially with the original 3.70 dump and it fired up nicely too
<Xb0xGuru> Spansion P came from another DYN-001 board, if that matters

Heavily edited log. Interesting read IMO

RSOD related

<kado> i want to confirm about RSOD
<kado> my english is bad, but i want you can tell to evryone
<kado> there is 2 types of RSOD
<kado> 1.come from CFW 2.from OFW
<kado> if coused by CFW we should patch the cVTRM
<kado> and if coused by OFW we should patch the core_OS. and use the last official Core_OS
<kado> btw, i have fix this 2pcs off RSOD today
   
<kado> guys here i upload 3.55 board ver-001 (including here are OFW,CFW, service Mode dump)
<kado> its all for studying RSOD
<kado> http://www.sendspace.com/file/ywvmox
<kado> you can compare with them, if you have RSOD come from ofw 3.55

Comparison

Feature	Infectus	PNM	progskeet	Teensy2.0++ NORway	PIC32	E3	Remarks
Use CFI	?	Yes	No	No	?	?	Common Flash Memory Interface writing strategies
NAND Support
NOR Support
-
-
-
-
-
-

Old reference

(don't remove, not all is on mainpage)

NAND

NAND (256MB, old FAT models, needs 32 wires, 15 per NAND + GND + VCC)
2 chips: Samsung K9F1G08U0A-PIB0

http://www.uchobby.com/index.php/2007/05/05/read-embedded-flash-chips/

NAND_Dumper_Extractor.rar (1.55 MB)

FlowRebuilder v.4.1.0.0

NOR

NOR 16MB, newer FAT models + Slims
needs 44 I/O wires: 23 address lines:A0-A22 + 16 Data lines:D0-D15 + 5 control lines: CE#,OE#,WE#,RESET#,TRISTATE (optional:#RY-BY) + GND + VCC
(NB: RY/BY is optional only for Teensy, Progskeet NEED ALL controllines!)

1 chip: Spansion S29GL128N90TFIR2 or Samsung K8Q2815UQB-P14B

NOR uses 1024 byte sector, just as NAND.

noralizer.rar (9.95 MB) incl. 2 different FAT models (CECHL04-jestero + CECH?-Phiren) pads labeled

joohan USBbitbanger on AVR for NOR flashing.rar (1.17 MB) (original topic @psx-scene)

spansion programmer (PIC based)

pic32mx-nor-flasher-pic32mx-nor-flasher-master.tar.gz (751.65 KB)

(Note : PIC32 flasher for Spansion is very slow: dumping 16MB = ~15min / writing full dump = 4 hours)

NORway for Teensy++ 2.0
- NORway Teensy / NORway_v0.1.zip

http://git-hacks.com/atnorflash/atnorflash

http://hotfile.com/dl/118618929/f6914e0/ps3flasher.tgz.html (note: older version)

Alternatives for Infectus2 and Teensy 2.0++:

Progskeet (UF6667) : http://twitpic.com/5pk6dz // http://fronttowardsgamer.com/2011/07/15/exclusive-hacker-talks-progskeet-geohot-and-why-he-doesnt-give-a-sht-about-sony/
- quad NAND with Progskeet: http://subirimg.com/images/img2065.jpg

Atmel AT90USB1286 datasheet

Talk:Hardware flashing

Contents

Testreport table

Pretesters

Progskeet QT port

Resistor trickery

E3 Flasher related

Problematic Samsung / Spansion N related

Teensy

Progskeet

Read CFI data

Offboard flashing / Replacement NOR talk

RSOD related

Comparison

Old reference

NAND

NOR

Navigation menu

Talk:Hardware flashing

Testreport table

Pretesters

Progskeet QT port

Resistor trickery

E3 Flasher related

Problematic Samsung / Spansion N related

Teensy

Progskeet

Read CFI data

Offboard flashing / Replacement NOR talk

RSOD related

Comparison

Old reference

NAND

NOR

Navigation menu

Search