PS3 Frankenstein PHAT PS3: CECHA with 40nm RSX

Seems like a ram or connection under ps2 ic.
It seems like ps2 ic isn't tied directly to any pin of syscon on cok001. On cok002 only 2 lines. Now if you don't have issues with ps3 games cpu/rsx are fine.
Cok001 have rams out and won't use from rsx I think. On cok002 think they managed to tie them somehow.
Or it has something to do with PAL/NTSC? Not very sure.
 
Last edited:
I remember asking botakompong about reset and resistor mods, he replied that they simply just compared cok001/002 motherboard changes to the board with 40nm. I am not sure if they actually figured out what exactly is it doing. But I may be wrong, so perhaps he can clarify it more himself.

Just a little correction, PS2 on cok002 is not all emulation, but partial emulation. We still have a GS-chip on board. The difference is that in our case Cell is handling the EE emulation instead of letting a real EE chip handle it.

It would be interesting to try and understand the logic deeper. In a way I'm glad you discovered this glitch, but of course part of me thinks "Just when we thought all was fine and dandy... " Haha. Ah well.

If only somebody could send their cok001 board over to me for experiments, that would be sweet... Too bad we never got those in EU.

Also I've made a few screens just to avoid any doubts.

https://drive.google.com/drive/folders/1IKKroi02cgKySX3uSdvTsFkiLIA2sD4J?usp=sharing
 
Since 2012 think I have opened about maximum 10 cok001. 6 were in UK. There is a big chance to find it on CECHC 01/02 models can't remember. They were very rare things. If this is not a hardware issue then the code inside modchip has to be revised somehow.
Somewhere, somehow if someone would ever find a Sony modified unit to dump that syscon would make the difference between execution.
 
RIP-Felix said:
Quick question. Has anyone found a COK-001 with an official SONY swap? I don't remember if all the ones on here wer COK-002, or if there were COK-001's as well. Did it have CG reset modded?
Click to expand...
As far i did read, the only official RSX frankensteins documented are COK-001 with a 40nm RSX... and COK-002 with a 65nm RSX... and as far i remember both had that resistor in diagonal

RIP-Felix said:
Looking at the Schematic, R2054 is supposed to be a 0K Resistor. Basically it's a jumper, but it gives you a spot to control the logic manually like we're doing here. You can pull voltage high with a 10K resistor like the mod calls for. Or you can tie it low to GND causing an error (pointless). A potential problem with the 10K mod is that It holds CGReset logic high at all times. If that is involved at all in the PS2 HW switch, then this is not going to work. Someone else needs to replicate my results on a COK-001 before we can confirm this. And if the official SONY method involves this too, then perhaps they changed something in the FW to fix it. @sandungas did you ever find other changes to the console besides the thermal config area and chip ID?
Click to expand...
No, in the resume/tutorial i wrote i was following the steps mentioned by @M4j0r where he was mentioning the unknown values that differs (candidates to be the magic that allows the RSX swap)
I cant make that kind of comparison because there are hundreds (maybe thousands?) of setings inside syscon and i dont understand 99% of them... except the thermal configs, some offsets where the regions starts/ends, and some specific settings "here and there"
RIP-Felix said:
Okay, I came across the term "Call Gate." If I understand this correctly (I probably don't. @M4j0r @sandungas please confirm), Call Gate Reset = CGReset?

Based on the wiki, it sounds plausible. Kinda like a gate master, without which the code we want to inject into the process is not granted higher privilege. The proverbial, 'You shall not pass!" The code we want to inject is the RSX ID, to spoof the SYSCON into letting us boot.
I'm guessing it needs to be timed/intercepted, hence the purpose of the modchip. In SONY's case, they modified the SYSCON to specify the RSX ID, so that when it's checked it would match. So I don't really understand why they would need to inject anything at all? Why hold the call gate open, so to speak?

Still learning (AKA spewing ignorance vomit all over the internet hoping someone else will clean the mess!)
Click to expand...
This is over my skills, but the theory and the name sounds good, and as far i understand based in the official name what they are doing is to "nuke" it, like keeping it in reset state permanently, right ?
Maybe is something related with security/timings but was so much problematic for the RSX swap that they decided to hack themselfs disabling that security feature, lol
 
[QUOTE="DeadEnd, post: 303540,

If only somebody could send their cok001 board over to me for experiments, that would be sweet... Too bad we never got those in EU.

i bought a cecha00 from japan it arrived last friday the void sticker is in place so nobody tamper with it i was exited:chuncky: i power on it past initial configuration and at the time i was on xmb for the first time after configuration it shut off and red light blinking that is overheat. i open the console not entirly but enough to reach the fan and yup the fan is busted, i take a fan from my working cechg model and place it to cecha when i power up i hear the fan spin but it greeds me with ylod:blue: it always ylod at 2-3 seconds i was pissed sure a cecha will fall to ylod but this console wait me to happen damm. now that we have finaly the method to read the errors ther is no excuse to guessing what problem might be and do "repairs" where ther is no need for one. i bought a usbtottl according @RIP-Felix syscon tautorial and follow it to the latter and heres my errlogs
>$ ERRLOG GET 00
00000000 A0403034 FFFFFFFF
>$ ERRLOG GET 01
00000000 A0403034 FFFFFFFF
>$ ERRLOG GET 02
00000000 A0403034 FFFFFFFF
>$ ERRLOG GET 03
00000000 A0403034 FFFFFFFF
>$ ERRLOG GET 04
00000000 A0403034 FFFFFFFF
>$ ERRLOG GET 05
00000000 A0403034 FFFFFFFF
>$ ERRLOG GET 06
00000000 A0403034 FFFFFFFF
>$ ERRLOG GET 07
00000000 A0403034 FFFFFFFF
>$ ERRLOG GET 08
00000000 A0403034 FFFFFFFF
>$ ERRLOG GET 09
00000000 A0403034 FFFFFFFF
>$ ERRLOG GET 10
00000000 A0403034 FFFFFFFF
>$ ERRLOG GET 11
00000000 A0403034 FFFFFFFF
>$ ERRLOG GET 12
00000000 A0403034 FFFFFFFF
>$ ERRLOG GET 13
00000000 A0801601 2881B6B6
>$ ERRLOG GET 14
00000000 A0801701 2881B6B6
>$ ERRLOG GET 15
00000000 A0801004 2849CAB4
>$ ERRLOG GET 16
00000000 A0801004 21E20759
>$ ERRLOG GET 17
00000000 A0801004 1C159592
>$ ERRLOG GET 18
00000000 A0801001 1B7EDB7C
>$ ERRLOG GET 19
00000000 A0801001 1AC62431

its full 3034 only so this console need propably rsx reballing and why not the frankestein mod?

im located in greece @DeadEnd i can give it to you for the repair and the tests that you need. just how much it will cost?
 
Last edited:
truemaster said:
take a fan from my working cechg model and place it to cecha when i power up i hear the fan spin but it greeds me with ylod
Click to expand...
Actually this doesn't really work as intended. The fan from G model is not the same as the old models.

If you want to adapt it, you could edit the fan curves and actually it might work just fine.
But otherwise it's working at different levels... The G fan will stay slow even if the machine is telling it to spin fast because the voltages are slightly different. So to compensate, the syscon should tell the fan to spin at higher % for similar RPM as the old ones.

That being said, just running hot one day shouldn't be enough to break the machine. You just got unlucky, it should have survived anyway.
 
i install the fan back to cechg. as for this model i bought a 19 blade fan when i fix it i will install it along with evilnat cfw and set fan speed manual. sure one overheat isnt capable of break the solder or fry the bga. but what if this was the final blow?
 
truemaster said:
i install the fan back to cechg. as for this model i bought a 19 blade fan when i fix it i will install it along with evilnat cfw and set fan speed manual. sure one overheat isnt capable of break the solder or fry the bga. but what if this was the final blow?
Click to expand...
Well, actually I'm not saying the fan from G model is bad or anything.
As a matter of fact it may as well be better than the oldest 19blade one. Just need to be configured accordingly.

Yesterday I created thread guide as to how to do these modifications. Maybe this would be interesting talk to have there. I happen to have one of those fans too.

And yeah... Final blow? Maybe, but just temperatures are one part of the recipe, even without fan it should be protected by SYSCON. And even in the worst case, the CPU Will reach thermal shutdown way sooner than the RSX, so even then the RSX probably didn't get time to get hot at all.
Also just opening and closing it etc is enough to fatigue these things. They can be incredibly precarious, pretty much waiting to break.
Not hard to get "unlucky" really.
 
Not long ago I actually ended up with a handful of COK 001 boards in Europe too.
But they all came from previous repair so none are very beautiful.

Even then, 1 of them is in working condition now and probably a couple of them could perhaps be saved with an RSX job.
Other came without RSX at all and... no less than 35 missing pads. Believe it or not I may still give it some attention.
I could talk more about these boards, some may be interesting.

Before that, I also ordered a couple modchips but unfortunately I'm still waiting. Maybe got lost in the post or whatever. New strict postal law got introduced during this time so maybe got stuck there too, or returned who knows.

Anyway things are slow. Also seems like situation is not great there in Indonesia with pandemics either. Hopefully our friends are doing OK.
 
my cecha was sealed no sighns of previous attempt to repair. and i will not practice bga reball or reflow to this precious motherboard. i would sent it to someone from this forum. im located in greece so a member that can do this repair that locates in eu would do me fine and ofcource we can rule out if this frankensten 40 nm rsx is breaking ps2 compatibility since @RIP-Felix has problems with ps2 titles
 
@Pacorretaco do you find any cok001 board for me? I may need one with cpu untouched for reflow/reball and at least 2.2 ohms.
Rsx can be or not, at least pads ok. I can handle 2~5 pads maximum if they missing. More than that will be a PITA.
If is working it will be sent back, you may solder only modchip. Just curious about how this issue with ps2 games. We need multiple tests to get get to the point.
 
@squeept is investigating this too. So sooner, rather than later, we'll have another COK-001 to compare with. I'm all out of mod chips myself and I just looked up Indonesia's COVID-19 statistics. It's really bad there! They are at the height of their biggest surge in cases. I'm actually pretty worried for @botakompong. It definitely explains the mod chip dry-up and why he hasn't been active on the forum for a hot minute!

We, just like them, have to wait it out. Or make do with the limited supply of chips floating around.
 
vyktormvmpay25 said:
@Pacorretaco do you find any cok001 board for me? I may need one with cpu untouched for reflow/reball and at least 2.2 ohms.
Rsx can be or not, at least pads ok. I can handle 2~5 pads maximum if they missing. More than that will be a PITA.
If is working it will be sent back, you may solder only modchip. Just curious about how this issue with ps2 games. We need multiple tests to get get to the point.
Click to expand...
Haha, I thought you hated fat boards?
Unfortunately my boards probably deserve the hate.
Only 2 of them have over 2 ohms CPU and those are actually the difficult ones.
Maybe one of those actually needs CPU swap because the syscon itself may be bad.

About the one with missing RSX and pads... Yeah way more than 5 hehehe, and CPU 1.8 ohms.
Good news is I think I actually took care of most of the pads already.
And the board that actually is working fine is 1.6ohm CPU ha.

One of the ones that I mentioned could probably be saved after all with RSX is the one I mentioned here some time ago, with 2+v RSX and 23 1002. So yeah not even that one is exactly the best candidate.
But things can change in the future, As you can guess I do these things for fun.
 

Attachments

  • IMG_20210718_154635.jpg
    IMG_20210718_154635.jpg
    1.3 MB · Views: 83
@Pacorretaco is that 1,6 cpu mobo with caps exchanged? I know can work well with lower resistance. Found few with time and reballed those, even slims. When I see its so low I say could be 50 /50 but always working. This is nothing from board, is ic itself and couldn't explain myself why. Or could be a lower cap on those group of caps on ic but I never tested if desolder those it will increase resistance of ic.
 
vyktormvmpay25 said:
@Pacorretaco is that 1,6 cpu mobo with caps exchanged? I know can work well with lower resistance. Found few with time and reballed those, even slims. When I see its so low I say could be 50 /50 but always working. This is nothing from board, is ic itself and couldn't explain myself why. Or could be a lower cap on those group of caps on ic but I never tested if desolder those it will increase resistance of ic.
Click to expand...
The working board with 1.6ohm CPU still has all nec tokin intact, so yeah it maybe they are making the resistance a bit lower.
But in the end I never really understood the ohms thing myself. And because I didn't understand it I never paid too much attention either. Way too complex stuff. The chips are somehow deciding how much power to get, not just based on ohms. Low ohms can be low power too. And these ohms can change one day to the other.
But of course I wouldn't know. I agree 1.6 is kinda low. Especially CPU I've mostly seen 2.4 even over 3 is common
 
Ok RIP-Felix not to much luck about testing cok001, only thing is to finish another cok002 with 65nm. Not sure if help to much.
Still focusing more on rsx ram decap and need to adapt bga jig to cnc.
421643f4b96aca69829a5f45d5004539.jpg
The point of ram decap would be if you get 2 rsx with ram bleeding, at least one with high resistance on core side would be saved if manage to get memorys cut off another and decent decap to be soldered back to first without ram.
 
Last edited:
RIP-Felix said:
Okay, I came across the term "Call Gate." If I understand this correctly (I probably don't. @M4j0r @sandungas please confirm), Call Gate Reset = CGReset?

Based on the wiki, it sounds plausible. Kinda like a gate master, without which the code we want to inject into the process is not granted higher privilege. The proverbial, 'You shall not pass!" The code we want to inject is the RSX ID, to spoof the SYSCON into letting us boot.
I'm guessing it needs to be timed/intercepted, hence the purpose of the modchip. In SONY's case, they modified the SYSCON to specify the RSX ID, so that when it's checked it would match. So I don't really understand why they would need to inject anything at all? Why hold the call gate open, so to speak?

Still learning (AKA spewing ignorance vomit all over the internet hoping someone else will clean the mess!)
Click to expand...

I guess CGReset = Clock Gen Reset.
You can see that it's tied in with the RSX_RESET. Earlier chips revisions probably needed the Clock gen reset while newer ones just auto sync that.
The RSX doesn't have different hardware access levels.
 
vyktormvmpay25 said:
@M4j0r what is your opinion? Is a modchip issue or different way about ps2 are executed by ps2 hardware? Can't understand ps3 games are fine, ps2 glitch.
Click to expand...
The theory of operation for the two boards is:
COK-001: CELL <-> SB <-> CXD9208GP <-> EE/GS -> RSX -> MultiAV/HDMI
COK-002: CELL <-> RSX -> GS -> MultiAV/HDMI

So on the COK-001 it's possible that either the bridge chip (CXD9208GP) or the EE/GS doesn't work properly.
On the COK-002 the GS has to work else you won't see any output.
 
You must log in or register to reply here.

Similar threads

Back
Top