|
BoXXDr
|
 |
« on: February 12, 2010, 03:17:09 AM » |
|
So here is what I am about to attempt.
I have 2 motherboards and both are Falcons. The 1st board has been nick-named "F**KED" and second board is named "Banned"
"F**KED" is a Xell Exploitable board (Still has Blades Dashboard) and "Banned" is at 8955 but of course its banned.
I got "F**KED" for $10. A friend of mine (you know who you are) tried to install XBReboot on it and it appears something might have gotten short circuited. It looks to me like the Point DB1F1 shorted to the area around it. Now I can't get this board to run XBReboot (e79 every time) And that’s why the guy I bought it from got rid of it. So I restored it to original firmware and its booting the dash and working fine so here is what I want to do. I am going to swap CPU's and use the jtag hack to reprogram the nands with the corresponding data.
1st off I know what I am doing and have the equipment to do it. I just did GPU re-balling on 6 motherboards in a row with GPU errors and everyone is now fixed.
What worries me is this. The boards are both what is considered Falcons but “Banned” only has 4 Ram chips and “F**CKE” has 8 (4 on both sides) So will that pose any problems for me? I am correct that what I am attempting to do I possible? I am just not 100% sure what chips are interchangeable with what boards and would rather be trying this on two identical motherboards but this is what I have. Also has anyone else seen boards damaged in a way that wont allow XBReboot or Xell to function?
Thanks
|
|
|
|
|
Logged
|
|
|
|
|
le_uberfry
|
 |
« Reply #1 on: February 12, 2010, 03:29:10 AM » |
|
verify jtag wiring
|
|
|
|
|
Logged
|
I had a blast at the party yesterday! Oh wait, what you mean you weren't invited? It was in your mouth and everyone came!
|
|
|
|
Blackaddr
|
 |
« Reply #2 on: February 12, 2010, 09:04:29 AM » |
|
The mobos have different GDDR3 chips, which is only used by the GPU, the CPU should not care I would think.
The problem is the density of the devices has changed and the GDDR3 controller on the GPU must know the physical configuration of the memories and the timing parameters (I don't know much about GDDR but I have designed DDR/DDR2/DDR3 controllers in the past).
Either it is smart enough to sense it automatically or it is told by bootstrapping or firmware. My guess is the latest firmware contains all possible configurations and the GPU selects the appropriate parameters some how.
If the GPU can autodetect and configure correctly, you should be fine (doubtful).
If the GPU is told by firmware, then a donor NAND from a falcon with the same number of chips should work (with appropriate KV/Config insertion). Hell, it's possible the config block contains this information, I really don't know.
If the GPU is told by bootstrap resistors, that information is not currently public and I don't see how you could get it working in that scenario.
- Blackaddr
|
|
|
|
|
Logged
|
360 Info Collection -> http://www.xboxhacker.org/index.php?topic=12940.0Do not take anything I say as gospel, use your own judgement, make your own decisions. Please pay attention to which sub-forums are for Research and Technical discussion. The following are NOT for help with and troubleshooting existing hacks. - Hardware (Technical) - DVD-ROM Drive and Media - Hard Disk - Software (Technical)
|
|
|
|
BoXXDr
|
 |
« Reply #3 on: February 12, 2010, 01:51:32 PM » |
|
verify jtag wiring
I did. I used the alternate point FT1U2 and I checked for continuity. Everything should be right but no one has been able to get this to boot anything but a stock nand flash. Hoping its some kind of motherboard issue and if so my transplant should fix it. The mobos have different GDDR3 chips, which is only used by the GPU, the CPU should not care I would think.
The problem is the density of the devices has changed and the GDDR3 controller on the GPU must know the physical configuration of the memories and the timing parameters (I don't know much about GDDR but I have designed DDR/DDR2/DDR3 controllers in the past).
Either it is smart enough to sense it automatically or it is told by bootstrapping or firmware. My guess is the latest firmware contains all possible configurations and the GPU selects the appropriate parameters some how.
If the GPU can autodetect and configure correctly, you should be fine (doubtful).
If the GPU is told by firmware, then a donor NAND from a falcon with the same number of chips should work (with appropriate KV/Config insertion). Hell, it's possible the config block contains this information, I really don't know.
If the GPU is told by bootstrap resistors, that information is not currently public and I don't see how you could get it working in that scenario.
- Blackaddr
Well i sure hope i am not doing this for nothing. Now if motherboards were exactly the same then this would work for sure i would think. I am hoping to have time today to try this out. I will update with the results.
|
|
|
|
|
Logged
|
|
|
|
firebuddie
Member
 
Posts: 36
Hardcore...you know the score
|
 |
« Reply #4 on: February 12, 2010, 04:33:40 PM » |
|
good luck bud...you may be the pioneer of a new and relatively cheap way to make the unexpolitables the exploitables!
|
|
|
|
|
Logged
|
WTFDIKRUK4S
|
|
|
|
BoXXDr
|
 |
« Reply #5 on: February 13, 2010, 03:02:35 AM » |
|
Well congrats are in order.
The procedure worked!
After swapping the CPU i tried to power it up to see what it would do. Nand had not been reflashed yet but i just wanted to see what error i would get. I got 3ROL - 0022 (error you would get if you flashed xell on JTAG fixed box)
So i flashed the original nand data to it and this time I got 3ROL - 0111 (nand error?)
At this point i figured this was a waste of time but I Created a XBReboot file for it and flashed it, installed the 3 wires + 2 diodes and it booted! I got my CPU key and so far it's working great. I have only ran it for a few minutes but i have booted it 6 times and it has worked everytime.
So it is possible to swap cpu from a Falcon v1 (8 ram chips) to a Falcon v2 (4 ram chips) and get xbreboot to run.
Now does anyone have any idea why the original nand would not boot? It might be worth mentioning that the original nand had 1 bad block and the new boards nad had no bad blocks so when i made the XBReboot file i did not use Bad Block Remapper because that seemed pointless. Maybe if i wanted to get original nand running i need Good Block Remapper, lol
I might have to try this procedure again a few more times.
|
|
|
|
|
Logged
|
|
|
|
|
dak
|
 |
« Reply #6 on: February 13, 2010, 04:30:29 AM » |
|
You'd have to copy the bad block from its remapped position to where it should be, since the new nand isnt looking at the remapped position (degraded: block_a found @ block_b, then copy block_b to block_a). But in order to make it clear if it didnt boot was because of the bad block, youd have to try it. Would be nice if you try it... Anyway, well done.
|
|
|
|
« Last Edit: February 13, 2010, 06:42:12 AM by dak »
|
Logged
|
|
|
|
holyjewsus
Newbie

Posts: 8
|
 |
« Reply #7 on: February 13, 2010, 01:15:36 PM » |
|
wow, interesting, good work, now, how much would you charge is the real question.
|
|
|
|
|
Logged
|
|
|
|
|
BoXXDr
|
 |
« Reply #8 on: February 13, 2010, 01:17:08 PM » |
|
You'd have to copy the bad block from its remapped position to where it should be, since the new nand isnt looking at the remapped position (degraded: block_a found @ block_b, then copy block_b to block_a). But in order to make it clear if it didnt boot was because of the bad block, youd have to try it. Would be nice if you try it... Anyway, well done.
Actually I am not sure that is the problem. Here is why. I forget to mention that when I was desperately trying to get Xell to enable on "F**CKED" that I started to think it had something to do with the bad block on the nand. I think it was block 7. I had tried bad block remapper with no luck. So I changed the nand to one without any bad blocks and still could not get Xell / XBReboot to work. I then flashed back the original nand image with the remapped bad block to the nand with no bad blocks and it still booted fine. What would be really helpful is a complete schematic of the 3 lines used to enable Xell. I am going to go over the board and trace everything back.
|
|
|
|
|
Logged
|
|
|
|
|
ReverseAffect
|
 |
« Reply #9 on: February 13, 2010, 02:55:57 PM » |
|
congrads...  make sure you post it on 360reball to... anyways...i don't think memory would of been a issue being kinda like piggy backed ...meaning the traces of them chips are setup like the top balled memory chips same memory........top 4 chips = same memory paths/calls like the other mobo with 8 chips.....or it will error... anyway glad you found that out...as to trading off stuff here and there.....i only see a debate with jaspers(some) you'll see  what do you mean by this? complete schematic of the 3 lines used to enable Xellthis looks like your asking for the source code....  there are some main programs that wont be release because imitators will be flawed with altercations  remember the south bridge holds 0.45mm balls  easy to do to no-pre-heat on the bottom....memory and Hana to......i stick with my heat station with them there items as for the bad block $#!t....i ran into 360 nands that you have no choice but to remap them, even 2 errors causes some nands to corrupt and not boot(or code shifted)... some nands are so corrupted from either user malfunction (and i say that in a nice way)...lol or a update from m$ gone bad which i think is due to a packet broken problem along the way...(but thats nether here or there) not many do i see.... enjoy that re-balling. watch the heat and make sure you let a board sit to room temp before you apply mega heat or your going to get what is called a popcorn affect  450f i pull cpus on a 4-5 min heat cut off bottom heater after 2 mins..... 450f top heat for smaller stuff with a heat station about 300f within a 5 min re-flow with a heat station circling the chip outers after appling some good no wipe flux.. sorry not hijacking your thread...just catching you up 
|
|
|
|
« Last Edit: February 13, 2010, 02:59:23 PM by ReverseAffect »
|
Logged
|
sick like a mofo..not reballing for a while...
|
|
|
|
dak
|
 |
« Reply #10 on: February 14, 2010, 08:51:23 AM » |
|
I think it was block 7. I had tried bad block remapper with no luck. Honestly i dont realy get what you did or not, maybe because im not native english, maybe because of writing style... anyway: The nand from the working cpu had bad blocks (block 7)? Then id first build a nand image that has the remapped blocks where they should be: nandpro backup.bin: -r16 block7.bin 3ff 1 (if 3ff is the block it got remapped, look in degraded) nandpro backup.bin: -w16 block7.bin 7 1 The new nand has bad blocks too ? Then you have to remap those too. Dont use badblockremapper for this, do it manually.
|
|
|
|
« Last Edit: February 14, 2010, 01:38:02 PM by dak »
|
Logged
|
|
|
|
|
Joka Macer
|
 |
« Reply #11 on: February 14, 2010, 11:03:27 AM » |
|
well,
do you think in do swap CPU od a Jasper with a dash 8955 works like this ?
thanks
|
|
|
|
|
Logged
|
|
|
|
|
ReverseAffect
|
 |
« Reply #12 on: February 14, 2010, 01:46:28 PM » |
|
going from cpus with a dash of 8955 to dash 8955 along with the nand change-out too and if the southbridges are ok(match) yes,but worthless..
but if the cpu is bad and with a 8955 dash ...it would make more sense if your going that far, to search for a cpu/nand that can be jtagable...
one that you can read the nand to see if it is even jtagable ..so if it rrod you know it's worth it to apply to the above.
|
|
|
|
|
Logged
|
sick like a mofo..not reballing for a while...
|
|
|
|
q36
|
 |
« Reply #13 on: February 14, 2010, 08:16:23 PM » |
|
0111 is Memory Data error.
|
|
|
|
|
Logged
|
|
|
|
firebuddie
Member
 
Posts: 36
Hardcore...you know the score
|
 |
« Reply #14 on: February 24, 2010, 05:26:34 AM » |
|
BoXXDr...You the man!!! Just confirming my understanding - 'Banned' box previously unexploitable having been infected with killer 8955 dash update is NOW disinfected following extensive CPU surgery and back to full health running XBR with no relaspes  Patient receiving regular inspection by the 'Dr'  Sorry about all the Dr puns...seemed appropriate though
|
|
|
|
« Last Edit: February 24, 2010, 05:56:14 AM by firebuddie »
|
Logged
|
WTFDIKRUK4S
|
|
|
|
bonzo pl
|
 |
« Reply #15 on: February 24, 2010, 05:59:56 AM » |
|
Falkon chip memory 4 chassis, the chassis chip memory 8 reballing GPU chip is bad after a period of 1 min artifacts / Rebaling 100% ok GPU 26 szt Pb falkon 8 chip memory
|
|
|
|
« Last Edit: February 24, 2010, 06:04:08 AM by bonzo pl »
|
Logged
|
|
|
|
|
damox
|
 |
« Reply #16 on: February 24, 2010, 06:13:35 AM » |
|
I love the bonzo posts.
They always seem like spam, but they are always in the right place.
|
|
|
|
|
Logged
|
|
|
|
|
bonzo pl
|
 |
« Reply #17 on: February 24, 2010, 06:21:51 AM » |
|
I love the bonzo posts.
They always seem like spam, but they are always in the right place.
Unless capacity NAND chip enclosure KB or GB, X-box 360  ??
|
|
|
|
|
Logged
|
|
|
|
|
Pacote-san
|
 |
« Reply #18 on: February 24, 2010, 09:22:51 AM » |
|
Nice to see that this worked, great work m8!
I have a 8955 zephyr working just fine, will try to find a 3rl zephyr not updates with cpu fuses unburned and pay a friend to reball it for me
|
|
|
|
|
Logged
|
|
|
|
|