PS3 [research] SuperSlim 4000 series - hardware flash

Discussion in 'Downgrading' started by littlebalup, Mar 27, 2019.

  1. 1,070
    1,070
    272
    littlebalup

    littlebalup Developer PSX-Place Supporter

    Joined:
    Oct 16, 2014
    Messages:
    1,070
    Likes Received:
    1,070
    Trophy Points:
    272
    Location:
    43°36'16.0"N 1°26'36.1"E
    Hi,

    I'm looking to get both NOR and EMMC superslim PS3 to make some tests to dump / flash them using hardware flasher.

    So I'm searching a bit over the net for some already available informations.


    About the NOR models (CECH-4xxxB/C):

    I found that pinout:
    [​IMG]

    And the Tristate point seems to be:
    [​IMG]

    It needs confirmation but it should be easy.



    About the EMMC models (CECH-4xxxA):

    The only information I find is from the wiki : https://www.psdevwiki.com/ps3/KLMAG2GE4A-A001

    My concern is if it's possible to dump/write EMMC soldered to the board.
    With the console self powered, we should cut the CLK trace, but it's not accessible (the trace is underneath the chip. only a via seems accessible on the opposite side). Maybe with the tristate to GND it's not necessary to cut the CLK, IDK.
    Does it work by powering the EMMC via an external PSU?


    So, I'm opening that topic to get a maximum feedback, if any.

    Thanks

    @playerkp420 @pinky @sandungas
     
    Last edited: Mar 27, 2019
    Kazama, Dyrn3006, armorsnake and 8 others like this.
  2. 338
    128
    97
    Yugonibblit

    Yugonibblit PSX-Place Supporter

    Joined:
    Jan 25, 2017
    Messages:
    338
    Likes Received:
    128
    Trophy Points:
    97
    Gender:
    Male
    Occupation:
    Mechanic
    Location:
    Uranus
    i have unit to f... with have to dig it up sounds like fun powering emmc if or not ill try it when i dig it up think its at friends house hope he is not camping out with unit.
     
    littlebalup likes this.
  3. 4,597
    4,124
    372
    sandungas

    sandungas Moderator Developer

    Joined:
    Dec 31, 2014
    Messages:
    4,597
    Likes Received:
    4,124
    Trophy Points:
    372
    Location:
    Babylon 20xxE series
    Im very lost with that PS3 models, there are many motherboards for the CECH-4xxx series

    The EMMC i dont know how it works, the only thing i remember when i was reading at it is inside it there is a controller + a NAND
    Technically is a NAND (this seems to be the reason why it has the same ID than the first PS3 fat models) but you are accesing the controller
    So the exposed testpads (easy to solder in them) probably are for the controller (not the NAND storage area), they uses them at the last steps of the manufacturing process to write the NAND contents

    Is the same that was happening with PS3 FAT models... it was using 2 NAND but the exposed testpads was for the controller (named starship2)
    The way how the starship2 works was never reverse engineered... this is why is so hard to solder a flasher on PS3 FAT because we cant use that pads
    With the PS3 with EMMC it could be the same story... is needed to reverse the protocol used by the controller

    The aternative is to find the connections that goes directly to the NAND storage area inside the EMMC
     
    Yugonibblit and littlebalup like this.
  4. 1,070
    1,070
    272
    littlebalup

    littlebalup Developer PSX-Place Supporter

    Joined:
    Oct 16, 2014
    Messages:
    1,070
    Likes Received:
    1,070
    Trophy Points:
    272
    Location:
    43°36'16.0"N 1°26'36.1"E
    Yes, the "Starship 2" controler is a kind of NOR emulator from dual NAND. It seems to manage the bus conversion, NANDs ECC, scrambeling...

    And yes, the MN66840 seems to do something similar with the KLMAG2GE4A-A001 eMMC. (Southbridge is the same for NOR and EMMC).

    However, I don't think we can access the eMMC via the MN66840 like a regular NOR (like we can't access the NANDs via the Starship 2).

    We can try to access to the eMMC directly using a "SD" hardmod like on the WiiU.
    The main issue is the CLK (clock). The PS3 clock must not interfer with the SD card reader clock.

    On the WiiU we can cut the trace:
    [​IMG]
    https://gbatemp.net/threads/successfully-dumped-wiiu-emmc-nand-with-hardmod.457165/

    We can't on the PS3.
     
    Last edited: Mar 28, 2019
  5. 1,335
    887
    197
    psykosis

    psykosis Developer Developer

    Joined:
    Dec 7, 2014
    Messages:
    1,335
    Likes Received:
    887
    Trophy Points:
    197
    [​IMG]
    Well...it looks like we already have at least one pin identified of the four it looks like that are needed? :)
    Comparitively and theoretically speaking
     
    ramzidz15 and Yugonibblit like this.
  6. 1,070
    1,070
    272
    littlebalup

    littlebalup Developer PSX-Place Supporter

    Joined:
    Oct 16, 2014
    Messages:
    1,070
    Likes Received:
    1,070
    Trophy Points:
    272
    Location:
    43°36'16.0"N 1°26'36.1"E
    We already have all the pins identified here : https://www.psdevwiki.com/ps3/KLMAG2GE4A-A001#Testpoints_eMMC
    But, can we read/write without desolder the chip? That's the question. May be complicated due to the CLK.

    Once I'll get a console I'll try:
    - Console self powered without setting the SB in sleep mode (tristate). It shouldn't work.
    - Console self powered and setting the SB in sleep mode (tristate to GND). Maybe works if the MN66840 controler sleep too.
    - powering directly the eMMC from an external power supply. Maybe works if nothing else interfer.
    - maybe I'll try to identify CLK on the MN66840 controler side.
     
    DeViL303 likes this.
  7. 304
    302
    97
    baileyscream

    baileyscream Member

    Joined:
    May 5, 2015
    Messages:
    304
    Likes Received:
    302
    Trophy Points:
    97
    Yes you can dump it
    I did have a thread on ps3hax but everything has vanished from over there
    You just use the sd card soldered to do it

    Sent from my G3121 using Tapatalk
     
    Sdw100, littlebalup and Yugonibblit like this.
  8. 8,702
    8,457
    1,047
    STLcardsWS

    STLcardsWS Administrator

    Joined:
    Sep 18, 2014
    Messages:
    8,702
    Likes Received:
    8,457
    Trophy Points:
    1,047
    baileyscream likes this.
  9. 1,070
    1,070
    272
    littlebalup

    littlebalup Developer PSX-Place Supporter

    Joined:
    Oct 16, 2014
    Messages:
    1,070
    Likes Received:
    1,070
    Trophy Points:
    272
    Location:
    43°36'16.0"N 1°26'36.1"E
    baileyscream likes this.
  10. 304
    302
    97
    baileyscream

    baileyscream Member

    Joined:
    May 5, 2015
    Messages:
    304
    Likes Received:
    302
    Trophy Points:
    97
    That could be it
    I did do the dump I think it's in that thread somewhere or I might have opened a new one
    Euss did point me to the right wiki pages I think in that thread also.

    Sent from my G3121 using Tapatalk
     
  11. 304
    302
    97
    baileyscream

    baileyscream Member

    Joined:
    May 5, 2015
    Messages:
    304
    Likes Received:
    302
    Trophy Points:
    97
    Sorry not being much help I'm half asleep but wanted to point you in the right direction

    Sent from my G3121 using Tapatalk
     
    littlebalup likes this.
  12. 1,335
    887
    197
    psykosis

    psykosis Developer Developer

    Joined:
    Dec 7, 2014
    Messages:
    1,335
    Likes Received:
    887
    Trophy Points:
    197
    Props for your guide. It helped me (quite a while back) when I was modding my first few consoles :)
     
  13. 1,023
    624
    222
    Louay

    Louay Senior Member

    Joined:
    Jan 23, 2017
    Messages:
    1,023
    Likes Received:
    624
    Trophy Points:
    222
    Gender:
    Male
    Occupation:
    College student
    Location:
    Tunisie
    Home Page:
    it will be magnificent if we could dump/write to eMMC PS3 and fix those who brick theirs using the ps3 exploit
     
  14. 1,070
    1,070
    272
    littlebalup

    littlebalup Developer PSX-Place Supporter

    Joined:
    Oct 16, 2014
    Messages:
    1,070
    Likes Received:
    1,070
    Trophy Points:
    272
    Location:
    43°36'16.0"N 1°26'36.1"E
    Waiting material for deeper tests, I started to draft the tool:

    [​IMG]

    [​IMG]

    I don't have a 4k emmc board yet (hope soon). So I'm making my first tests on a 32GB SD card. Search, dump and write fonctions are working.
    So, it should work.

    P.S.: feel free to comment if you have some commands ideas.
     
    Last edited: Apr 3, 2019
    sandungas, armorsnake, Louay and 3 others like this.
  15. 1,070
    1,070
    272
    littlebalup

    littlebalup Developer PSX-Place Supporter

    Joined:
    Oct 16, 2014
    Messages:
    1,070
    Likes Received:
    1,070
    Trophy Points:
    272
    Location:
    43°36'16.0"N 1°26'36.1"E
    sandungas likes this.
  16. 21
    7
    32
    levihacks19

    levihacks19 Member

    Joined:
    Feb 26, 2015
    Messages:
    21
    Likes Received:
    7
    Trophy Points:
    32
    WhatsApp Image 2018-11-17 at 12.17.30.jpeg hello people i have me diagram make for for ps3 4k here its me aport
     
    sandungas and littlebalup like this.
  17. 1,023
    624
    222
    Louay

    Louay Senior Member

    Joined:
    Jan 23, 2017
    Messages:
    1,023
    Likes Received:
    624
    Trophy Points:
    222
    Gender:
    Male
    Occupation:
    College student
    Location:
    Tunisie
    Home Page:
  18. 1,070
    1,070
    272
    littlebalup

    littlebalup Developer PSX-Place Supporter

    Joined:
    Oct 16, 2014
    Messages:
    1,070
    Likes Received:
    1,070
    Trophy Points:
    272
    Location:
    43°36'16.0"N 1°26'36.1"E
    Nice! thx.
    Precision for the others. That's Teensy++2.0 pin numbers.
     
  19. 1,070
    1,070
    272
    littlebalup

    littlebalup Developer PSX-Place Supporter

    Joined:
    Oct 16, 2014
    Messages:
    1,070
    Likes Received:
    1,070
    Trophy Points:
    272
    Location:
    43°36'16.0"N 1°26'36.1"E
    That's one of the intent. In add to learn and better document than what we have today.
     
  20. 1,023
    624
    222
    Louay

    Louay Senior Member

    Joined:
    Jan 23, 2017
    Messages:
    1,023
    Likes Received:
    624
    Trophy Points:
    222
    Gender:
    Male
    Occupation:
    College student
    Location:
    Tunisie
    Home Page:
    Hope it will comes to the world so if it possible we will have 2 reading method using SD Card Adapter mod and Teensy 2.0++ ?!
     

Share This Page