PS3 KTE-001 NoLOD (5FFF after lv2(2) boot)

pstreecco

pstreecco

Forum Noob
Hello, this is my first post on the forum.

I got this non-booting CECH-3000 from a friend (who doesn't know the first thing about console modding, so I don't suspect this to be a failed install or anything) and recently managed to get a flash dump (ported norway to the pico 2 for it, anyone interested?) and enable debug logging to the southbridge UART.

The console appears to have a NoLOD, after pressing the power button the light turns green, then off and the fan spins down.
The error is consistently A0805FFF (with all F timestamp, which seems odd since the RTC battery is at ~2.9V), so the POST is ok but the error doesn't seem to be well known.
This is the boot log I get from the syscon, ignore the 3001 error from turning the console on without the 12v blades connected.

Code: 
# [SSM] Bringup Start.
# [SSM] PS0 ok.
# [SSM] PS1 ok.
# [SSM] PS2 ok.
# [SSM] PS3 ok.
# [SSM] PS4 ok.
# (PowerOn State)
OK 00000000
#!
#!Boot Loader SE Version 4.1.0
#!(Build ID: 4688,48851,
#!Build Date: 2012-02-01_23:00:06)
#!
#!Copyright(C) 2012 Sony Computer Entertainment Inc.All Rights Reserved.
#!
#![INFO]: query_system_power_up_cause returns successfully.
#![INFO]: requested_os_context: 0x00
#![INFO]: current_os_context  : 0x00
#![INFO]: requested_gr_context: 0x00
#![INFO]: current_gr_context  : 0x00
#![INFO]: last_shutdown_cause : 0x00
#![INFO]: wake_source         : 0x00000004
#![INFO]: b_str: bool(0)
#![INFO]: CBE process technology id: 0x0000000c
#![INFO]: CBE design level: 0x00000002
#![INFO]: XDR Link successfully initilized.
#![INFO] get_boot_memory_type type 273
#!PX::EBCADMATCH0 1f000008
#!PX::EBCACCTRL0 00000401
#!PX::EBCADBS0 1f000000
#![INFO]: flash format 2
#![INFO]: flash format 2
#![INFO]: flash format 2
#![INFO]: flash format 2
#![INFO]: flash format 2
#![INFO]: Connecting to Debug Device (SB UART)
[omitted various #!]
# [SSM] Cond/Fatal received, msg=2649.
# [SSM] Fataldown Start.
# [SSM] Fataldown ok.
# CODE     CLOCK
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0003001 FFFFFFFF
# A0003001 FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF
# A0805FFF FFFFFFFF

And this is what I see on the southbridge's serial out

Code: 
Boot Loader SE Version 4.8.9 (Build ID: 5366,50740, Build Date: 2022-02-04_12:51:26)
SDK Version: 489.000
Copyright(C) 2022 Sony Computer Entertainment Inc.All Rights Reserved.
[INFO]: === eXtreme Data Rate Memory Subsystem ===
[INFO]: (Configured Memory Size per single XIO channel: 128 MBytes.)
[INFO]: XIO channel[0] is available.
[INFO]: XIO channel[1] is available.
[INFO]: ---> Total 256 MBytes are now in use.
[INFO]: SPU enable [0, 1, 2, 5, 6, 7] 11101111
[INFO]: BE:12S DD2.0, SB:ZX1.1
Cell OS SDK4.8.9 000 (release build: r50740 2022_02_04_120000)
Copyright 2022 Sony Computer Entertainment Inc.
revision: 50739
date:     Fri Feb  4 12:53:01 JST 2022
lv2(0): total memory size: 249MB+640KB
lv2(0): kern memory size:   12MB+640KB (heap:3492KB  page pool:4736KB)
lv2(0): user memory size:  237MB
lv2(2):
lv2(2): Cell OS Lv-2 32 bit version 4.8.9
lv2(2): Copyright 2011 Sony Computer Entertainment Inc.
lv2(2): All Rights Reserved.
lv2(2):
lv2(2): revision: 50740
lv2(2): build date: 2022/02/04 12:56:52
lv2(2): processor: Broadband Engine  Ver 0x0000  Rev 0x2100
lv2(2): PPU:0, Thread:0 is enabled.
lv2(2): PPU:0, Thread:1 is enabled.
sysmgr : altering lv0 or lv1 is detected.
lv2(2): rsx:      rsx40 a01 500/650 vpe:ff shd:3f  [NAA858-25:0:4:19:2:11:6:0:1][23:0:a:0:1:0:1][1:1:0]

lv2(2): Available physical SPUs: 6/7

The "sysmgr : altering lv0 or lv1 is detected." suggests corruption in the flash, but:
- both PyPS3checker and Swizzy's dump checker pass all checks with the NOR dump I got.
- switching the active ROS bank to ROS0 by writing FF to syscon offset 48C24 gives me roughly the same output, just on version 488 instead of 489

Looking this error up on the forum yields a couple of results, one of which is solved by a system update in safe mode, however I can't get to that since the console shuts down before it can do the double beep thing.
I don't fully understand the (admittedly convoluted) PS3 boot process, and haven't seen mentions of this sysmgr thing or any backwards validation of lv0 and lv1.

I wanted to ask if this looks like something that could be fixed in some way, maybe with a donor flash dump or by setting syscon eeprom to boot in safe mode?
Alternatively, since the console seems to get to lv2, could the new BadWDSD modchips be used to skip the check lv2 is doing on the previous stages? I have a Pi Pico at hand and could try.
 
Thank you for the reply @aomsin2526
I have built a hardware flasher and have a good dump (as far as i know), is there a patcher or do I just dd Stagex.bin into the flash dump at 0x31000?
Also, the prebuilt assets (stagex, cfw zip, uf2) seem to have gone missing from your github releases, I will post an update after I get an RP2040-Zero board and install it.
 
pstreecco said:
Thank you for the reply @aomsin2526
I have built a hardware flasher and have a good dump (as far as i know), is there a patcher or do I just dd Stagex.bin into the flash dump at 0x31000?
Also, the prebuilt assets (stagex, cfw zip, uf2) seem to have gone missing from your github releases, I will post an update after I get an RP2040-Zero board and install it.
Click to expand...

I will write a guide how to patch the dump later.

I currently remove the files because of some reports as a precaution.
 
Last edited:
@pstreecco : vous utilisez quelle marque comme flasheur matériel s'il vous plait ?
Je possède un "E3 Flasher" mais, quand je veux l'installer sur ma carte mère KTE-001 cela m'est impossible car les deux condensateurs chimiques proche de la NOR ne me le permette pas, la limande doit passer par dessus l'un d'eux.
De même, est-il possible de flasher une NOR (par matériel) de console Super Slim (modèle CECH-4004C et CECH-4204C) ?

En Italien via G-Trad :
@pstreecco: Che marca di flasher hardware usi, per favore ?
Ho un "E3 Flasher", ma quando provo a installarlo sulla mia scheda madre KTE-001, è impossibile perché i due condensatori elettrolitici vicino al blocco del flasher NOR lo impediscono; il filo del flasher deve passare sopra uno di essi.
Allo stesso modo, è possibile flashare un flasher NOR (utilizzando l'hardware) su una console Super Slim (modelli CECH-4004C e CECH-4204C) ?

In English via G-Trad :
@pstreecco: What brand of hardware flasher do you use, please ?
I have an "E3 Flasher," but when I try to install it on my KTE-001 motherboard, it's impossible because the two electrolytic capacitors near the NOR flasher block prevent it; the flasher wire has to pass over one of them.
Similarly, is it possible to flash a NOR flasher (using hardware) on a Super Slim console (models CECH-4004C and CECH-4204C) ?
 
aomsin2526 said:
Guide is out at https://www.psx-place.com/threads/badwdsd-qcfw-hw-flasher-nobt-thread.49625/

Please report result, I'm looking for tester for hw flasher use case.

I got report that NoBT is working. but he didn't use hw flasher.

Thanks
Click to expand...

I just installed the modchip, the console now boots to an error screen with error 8002F2F0.
I'm going to try the firmware update tomorrow, i take it i should install HFW 4.92?

Algol said:
@pstreecco : vous utilisez quelle marque comme flasheur matériel s'il vous plait ?
Je possède un "E3 Flasher" mais, quand je veux l'installer sur ma carte mère KTE-001 cela m'est impossible car les deux condensateurs chimiques proche de la NOR ne me le permette pas, la limande doit passer par dessus l'un d'eux.
De même, est-il possible de flasher une NOR (par matériel) de console Super Slim (modèle CECH-4004C et CECH-4204C) ?

En Italien via G-Trad :
@pstreecco: Che marca di flasher hardware usi, per favore ?
Ho un "E3 Flasher", ma quando provo a installarlo sulla mia scheda madre KTE-001, è impossibile perché i due condensatori elettrolitici vicino al blocco del flasher NOR lo impediscono; il filo del flasher deve passare sopra uno di essi.
Allo stesso modo, è possibile flashare un flasher NOR (utilizzando l'hardware) su una console Super Slim (modelli CECH-4004C e CECH-4204C) ?

In English via G-Trad :
@pstreecco: What brand of hardware flasher do you use, please ?
I have an "E3 Flasher," but when I try to install it on my KTE-001 motherboard, it's impossible because the two electrolytic capacitors near the NOR flasher block prevent it; the flasher wire has to pass over one of them.
Similarly, is it possible to flash a NOR flasher (using hardware) on a Super Slim console (models CECH-4004C and CECH-4204C) ?
Click to expand...

Sorry for the late reply, I have built my own flasher based on NORway (teensy) code and an RP2350B deve board, you can find it at https://github.com/techmccat/norpie but it needs testing.
You need to solder around 45 wires to your console (which you can also do with the E3), the pinout can be found on the wiki at https://www.psdevwiki.com/ps3/Hardware_flashing
KTE-001 is layout 4, super slims should be 5

@aomsin2526
The console boots to safe mode and I can format the hard drive, however the system update menu either freezes (first two attempts) or throws the same error as the normal boot (0x8002F2F0).

Southbridge log shows it's because of a missing file in /dev_flash, which makes sense because the drive is blank, but I don't think I can populate it without installing an update.

This is the southbridge boot log:

Code: 
Boot Loader SE Version 4.9.2 (Build ID: 5378,50763, Build Date: 2025-02-18_20:02:02)
SDK Version: 492.000
Copyright(C) 2025 Sony Computer Entertainment Inc.All Rights Reserved.
[INFO]: === eXtreme Data Rate Memory Subsystem ===
[INFO]: (Configured Memory Size per single XIO channel: 128 MBytes.)
[INFO]: XIO channel[0] is available.
[INFO]: XIO channel[1] is available.
[INFO]: ---> Total 256 MBytes are now in use.
[INFO]: SPU enable [0, 1, 2, 5, 6, 7] 11101111
[INFO]: BE:12S DD2.0, SB:ZX1.1
Cell OS SDK4.9.2 000 (release build: r50763 2025_02_18_182000)
Copyright 2025 Sony Computer Entertainment Inc.
revision: 50758
date:     Tue Feb 18 20:03:39 JST 2025
lv2(0): total memory size: 249MB+640KB
lv2(0): kern memory size:   12MB+640KB (heap:3492KB  page pool:4736KB)
lv2(0): user memory size:  237MB
lv2(2):
lv2(2): Cell OS Lv-2 32 bit version 4.9.2
lv2(2): Copyright(C) 2025 Evilnat [Akatsuki]. 03/05/2025.
lv2(2): Happy CFW moments.
lv2(2):
lv2(2): revision: 50763
lv2(2): build date: 2025/02/18 20:07:48
lv2(2): processor: Broadband Engine  Ver 0x0000  Rev 0x2100
lv2(2): PPU:0, Thread:0 is enabled.
lv2(2): PPU:0, Thread:1 is enabled.
lv2(2): rsx:      rsx40 a01 500/650 vpe:ff shd:3f  [NAA858-25:0:4:19:2:11:6:0:1][23:0:a:0:1:0:1][1:1:0]

lv2(2): Available physical SPUs: 6/7
lv2(2): mounting the flash file system : OK
lv2(2): creating the initial system process : Failed (path:/dev_flash/sys/internal/sys_init_osd.self)
lv2(2): - The system process image file does not exist (error code:0x80010006).
lv2(2):
lv2(2):
lv2(2): ###
lv2(2): ### Vflash recovery mode
lv2(2): ###
lv2(2):
lv2(2): creating the vflash recover process (emergency program) : OK
lv2(2): is factory mode ret[f]
lv2(2): ErrorPage[6] Code[-2147290384]

I've noticed the missing file is present in the qcfw package, would it be possible to load them from USB? Or since you've mentioned disabling disk encryption, writing them directly to disk?

@Algol These are the probe points, the photo is from the wiki and is not a KTE-001, but the syscon pinout is the same and any ground on the board will do fine for negative.
Take care not to touch the adjacent pins, there's ground to the right and an oscillator pin to the left.
sherwood-regc.jpeg
 
Last edited by a moderator:
Okay, I saw it, and that's indeed the pin I tested. The value after replacing the battery is 1.85V, so half the value of the new battery, which is 3.65V. I figured the small round dot is pin 1 of the circuit (top left). The motherboard is completely disassembled.

Ok, l'ho visto, ed è proprio il pin che ho testato. Il valore dopo la sostituzione della batteria è 1,85 V, quindi metà del valore della batteria nuova, che è 3,65 V. Ho capito che il piccolo punto rotondo è il pin 1 del circuito (in alto a sinistra). La scheda madre è completamente smontata.
 
The error 800f2f0 has to do with your syscon. I acquire a cech 200x model some time ago after disassemble it I found out that some pin on the syscon are broken after swapping the syscon the game booted with this error 800f2f0 I think then that the game needs a remarry syson process somehow
 
Confirmed over in the qCFW thread it's a syscon issue, the console now boots fine to XMB but can't set the time via internet or run games that need trophies.
(Edit: it also fails at dumping EEPROM region 48c00 after 7 bytes read, and that's the remarry status byte if i'm not wrong)

It would need either a syscon remarry or some kind of noSC patch that hooks lv2/secure rtc manager to cancel out secure rtc errors and set secure tick to/from user tick, plus any other issues that pop up once that's solved (i'm assuming both ssl handshakes and trophy setting fail because of missing secure rtc).

It's pretty hard to find information about syscon remarry, other than that the required executables have been obtained from the 4.40 testbench fw (which was hosted on a file sharing site that let their domain expire), but I doubt i could just flash it and do the remarry like that.
 
Last edited:
pstreecco said:
Sorry for the late reply, I have built my own flasher based on NORway (teensy) code and an RP2350B deve board, you can find it at https://github.com/techmccat/norpie but it needs testing.
You need to solder around 45 wires to your console (which you can also do with the E3), the pinout can be found on the wiki at https://www.psdevwiki.com/ps3/Hardware_flashing
KTE-001 is layout 4, super slims should be 5
Click to expand...
wow so does that mean i won't need a rare pokemon like teensy to dump/build/reflash nor chips just a 2350 coreboard that is some damn innovation
about high time people are investing time in ps3 first badwsd now pi-based nor flasher and even superslim board schematics are arriving soon what a time to be alive
 
pstreecco said:
Made it specifically because I didn't want to hunt down a Teensy 2
Click to expand...
you are the man bro seriously i was fussing over whether i should even get into repair consoles especially because teensy being expensive in my country also is it like compadible with ps4 and other consoles or just ps3
are you like a ps3 repairing technician or just embedded hobbyist
 
Just a hobbyist that came across a couple broken PS3s from friends.
It won't work as is on a PS4 because those use SPI flash (serial like the x360, not parallel like the ps3), but there's plenty of tools around for dumping those.
 
pstreecco said:
Just a hobbyist that came across a couple broken PS3s from friends.
It won't work as is on a PS4 because those use SPI flash (serial like the x360, not parallel like the ps3), but there's plenty of tools around for dumping those.
Click to expand...
wouldn't happen to have a superslim 4200 model for reballing cpu
 
You must log in or register to reply here.

Similar threads

Back
Top