sagemono
Member
Hello.
I've recently bought a parts console off eBay for quite cheap. I was expecting a CECHG03 for parts to land at my door. But to my surprise, I was greeted with chrome trim and a label that read "CECHC03". With the sellers failing eyes aside, I plugged it in hoping to be greeted with the XMB.
But no, it sat on a black screen for about 20 seconds before I attempted to switch it off using the front power button. In typical GLOD fashion, I received no response from the power button the eject button worked fine.
With the current diagnosis being GLOD, I took it apart and hooked up some wires to extract the syscon errors:
errlog didn't reveal much as these codes are seen throughout the normal life of most consoles. However the most surprising thing is that the console hasn't been powered up in 9 years, my entry being the last one after I switched it off via the power rocker. It seems like the seller had booted it up and forcibly removed the power hoping to get it to boot. (even more amusing is that the RTC battery is still alive LOL)
Further troubleshooting led me to hooking up to the TX wire of the southbridge to which i was greeted with this:
Browsing through other users' SB UART logs on the forum, I noticed that mine stopped unusually early in the boot process. Halting at "skip 2nd initialization step" just before lv2 took over.
Attempts to get into recovery mode and reset the video output also lead to the same SB UART output.
Taking a closer look I can see the bootloader version is 3.5.5 leading my suspicion that this was a botched CFW attempt.
I do have a Teensy, but my attempts to dump the flash were limited by my soldering skills. I attempted to solder directly to the NAND legs with 30AWG kynar wire but only managed to get two soldered to the first NAND chip before giving up.
With no original flash dumps what are my remaining options?
A NAND clip from AliExpress is on the way in the meantime.
Any ideas?
Video of the boot attempt:
Right, Teensy reading was unsuccessful with the 360 clip. I've gone out and bought a FlashcatUSB XPORT with a TSOP-48 adapter. The flash is probably dead but for the sake of experimentation I'll keep updating this thread since I've never seen SB UART output this kinda thing before. Previous JB attempt by the previous owner screwed up to the point where lv2 fails to load. Thread will be updated with my findings :^)
Update 2:
Looks like this console is gonna become a donor board. I have dumped both NANDs and this is starting to look like an impossible recovery. I can't even merge the two dumps in FlowRebuilder since it complains about missing magic data. Both NAND0 and NAND1 are written with FF from 0x00000000 up until 0x0020000 meaning EID is lost.
o7
I've recently bought a parts console off eBay for quite cheap. I was expecting a CECHG03 for parts to land at my door. But to my surprise, I was greeted with chrome trim and a label that read "CECHC03". With the sellers failing eyes aside, I plugged it in hoping to be greeted with the XMB.
But no, it sat on a black screen for about 20 seconds before I attempted to switch it off using the front power button. In typical GLOD fashion, I received no response from the power button the eject button worked fine.
With the current diagnosis being GLOD, I took it apart and hooked up some wires to extract the syscon errors:
>$ becount
becount
Bringup : 674 times
Shutdown: 590 times
Power-on: 149day 06hour 14min 27sec
becount
Bringup : 674 times
Shutdown: 590 times
Power-on: 149day 06hour 14min 27sec
>$ errlog
errlog
ofst[ 36]:err_code:0xffffffff, clock:0x182fc484 2012/11/09 13:41:24
ofst[ 40]:err_code:0xa0801004, clock:0x1832cced 2012/11/11 20:54:05
ofst[ 44]:err_code:0xa0802022, clock:0x1d919d2f 2015/09/20 16:37:03
ofst[ 48]:err_code:0xa0801001, clock:0x1d919dac 2015/09/20 16:39:08
ofst[ 52]:err_code:0xa0802022, clock:0x1d919db3 2015/09/20 16:39:15
ofst[ 56]:err_code:0xa0801004, clock:0x1d91a09c 2015/09/20 16:51:40
ofst[ 60]:err_code:0xa0802022, clock:0x1d91a0a4 2015/09/20 16:51:48
ofst[ 64]:err_code:0xa0801004, clock:0x1d91a0b6 2015/09/20 16:52:06
ofst[ 68]:err_code:0xa0802022, clock:0x1d91a0be 2015/09/20 16:52:14
ofst[ 72]:err_code:0xa0801004, clock:0x1d942d96 2015/09/22 15:17:42
ofst[ 76]:err_code:0xa0802022, clock:0x1d94594c 2015/09/22 18:24:12
ofst[ 80]:err_code:0xa0802022, clock:0x1d945f1c 2015/09/22 18:49:00
ofst[ 84]:err_code:0xa0802022, clock:0x1d945ff9 2015/09/22 18:52:41
ofst[ 88]:err_code:0xa0802022, clock:0x1d94605a 2015/09/22 18:54:18
ofst[ 92]:err_code:0xa0802022, clock:0x1d946087 2015/09/22 18:55:03
ofst[ 96]:err_code:0xa0802022, clock:0x1d9461ec 2015/09/22 19:01:00
ofst[100]:err_code:0xa0802022, clock:0x1d9463d5 2015/09/22 19:09:09
ofst[104]:err_code:0xa0802022, clock:0x1d9470d5 2015/09/22 20:04:37
ofst[108]:err_code:0xa0802022, clock:0x1d94716d 2015/09/22 20:07:09
ofst[112]:err_code:0xa0801004, clock:0x1d947226 2015/09/22 20:10:14
ofst[116]:err_code:0xa0802022, clock:0x1d949b85 2015/09/22 23:06:45
ofst[120]:err_code:0xa0801004, clock:0x1d94a0a5 2015/09/22 23:28:37
ofst[124]:err_code:0xa0801004, clock:0x1d94a136 2015/09/22 23:31:02
ofst[ 0]:err_code:0xa0801004, clock:0x1d94a68f 2015/09/22 23:53:51
ofst[ 4]:err_code:0xa0801004, clock:0x1d94ac3f 2015/09/23 00:18:07
ofst[ 8]:err_code:0xa0801001, clock:0x2f16c510 2025/01/12 18:23:12
ofst[ 12]:err_code:0xa0801004, clock:0x2f16c78a 2025/01/12 18:33:46
ofst[ 16]:err_code:0xa0801004, clock:0x2f16c871 2025/01/12 18:37:37
ofst[ 20]:err_code:0xa0801004, clock:0x2f16ca8a 2025/01/12 18:46:34
ofst[ 24]:err_code:0xa0801004, clock:0x2f16cb4e 2025/01/12 18:49:50
ofst[ 28]:err_code:0xa0801004, clock:0x2f16cbac 2025/01/12 18:51:24
ofst[ 32]:err_code:0xa0801001, clock:0x3012843e 2025/07/22 17:17:50
errlog
ofst[ 36]:err_code:0xffffffff, clock:0x182fc484 2012/11/09 13:41:24
ofst[ 40]:err_code:0xa0801004, clock:0x1832cced 2012/11/11 20:54:05
ofst[ 44]:err_code:0xa0802022, clock:0x1d919d2f 2015/09/20 16:37:03
ofst[ 48]:err_code:0xa0801001, clock:0x1d919dac 2015/09/20 16:39:08
ofst[ 52]:err_code:0xa0802022, clock:0x1d919db3 2015/09/20 16:39:15
ofst[ 56]:err_code:0xa0801004, clock:0x1d91a09c 2015/09/20 16:51:40
ofst[ 60]:err_code:0xa0802022, clock:0x1d91a0a4 2015/09/20 16:51:48
ofst[ 64]:err_code:0xa0801004, clock:0x1d91a0b6 2015/09/20 16:52:06
ofst[ 68]:err_code:0xa0802022, clock:0x1d91a0be 2015/09/20 16:52:14
ofst[ 72]:err_code:0xa0801004, clock:0x1d942d96 2015/09/22 15:17:42
ofst[ 76]:err_code:0xa0802022, clock:0x1d94594c 2015/09/22 18:24:12
ofst[ 80]:err_code:0xa0802022, clock:0x1d945f1c 2015/09/22 18:49:00
ofst[ 84]:err_code:0xa0802022, clock:0x1d945ff9 2015/09/22 18:52:41
ofst[ 88]:err_code:0xa0802022, clock:0x1d94605a 2015/09/22 18:54:18
ofst[ 92]:err_code:0xa0802022, clock:0x1d946087 2015/09/22 18:55:03
ofst[ 96]:err_code:0xa0802022, clock:0x1d9461ec 2015/09/22 19:01:00
ofst[100]:err_code:0xa0802022, clock:0x1d9463d5 2015/09/22 19:09:09
ofst[104]:err_code:0xa0802022, clock:0x1d9470d5 2015/09/22 20:04:37
ofst[108]:err_code:0xa0802022, clock:0x1d94716d 2015/09/22 20:07:09
ofst[112]:err_code:0xa0801004, clock:0x1d947226 2015/09/22 20:10:14
ofst[116]:err_code:0xa0802022, clock:0x1d949b85 2015/09/22 23:06:45
ofst[120]:err_code:0xa0801004, clock:0x1d94a0a5 2015/09/22 23:28:37
ofst[124]:err_code:0xa0801004, clock:0x1d94a136 2015/09/22 23:31:02
ofst[ 0]:err_code:0xa0801004, clock:0x1d94a68f 2015/09/22 23:53:51
ofst[ 4]:err_code:0xa0801004, clock:0x1d94ac3f 2015/09/23 00:18:07
ofst[ 8]:err_code:0xa0801001, clock:0x2f16c510 2025/01/12 18:23:12
ofst[ 12]:err_code:0xa0801004, clock:0x2f16c78a 2025/01/12 18:33:46
ofst[ 16]:err_code:0xa0801004, clock:0x2f16c871 2025/01/12 18:37:37
ofst[ 20]:err_code:0xa0801004, clock:0x2f16ca8a 2025/01/12 18:46:34
ofst[ 24]:err_code:0xa0801004, clock:0x2f16cb4e 2025/01/12 18:49:50
ofst[ 28]:err_code:0xa0801004, clock:0x2f16cbac 2025/01/12 18:51:24
ofst[ 32]:err_code:0xa0801001, clock:0x3012843e 2025/07/22 17:17:50
errlog didn't reveal much as these codes are seen throughout the normal life of most consoles. However the most surprising thing is that the console hasn't been powered up in 9 years, my entry being the last one after I switched it off via the power rocker. It seems like the seller had booted it up and forcibly removed the power hoping to get it to boot. (even more amusing is that the RTC battery is still alive LOL)
Further troubleshooting led me to hooking up to the TX wire of the southbridge to which i was greeted with this:
Boot Loader SE Version 3.5.5 (Build ID: 4072,46573, Build Date: 2010-11-26_20:55:10)
SDK Version: 355.000
Copyright(C) 2010 Sony Computer Entertainment Inc.All Rights Reserved.
[INFO]: === eXtreme Data Rate Memory Subsystem ===
[INFO]: (Configured Memory Size per single XIO channel: 128 MBytes.)
[INFO]: XIO channel[0] is available.
[INFO]: XIO channel[1] is available.
[INFO]: ---> Total 256 MBytes are now in use.
[INFO]: SPU enable [0, 1, 2, 5, 6, 7] 11101111
[INFO]: BE:3.1, SB:PX1.1
Device: PATAC0:Cable Not Connect
Cell OS SDK3.5.5 000 (release build: r46573 2010_11_26_200000)
Copyright 2010 Sony Computer Entertainment Inc.
revision: 46300
date: Fri Nov 26 20:57:52 JST 2010
skip 2nd initialization step
SDK Version: 355.000
Copyright(C) 2010 Sony Computer Entertainment Inc.All Rights Reserved.
[INFO]: === eXtreme Data Rate Memory Subsystem ===
[INFO]: (Configured Memory Size per single XIO channel: 128 MBytes.)
[INFO]: XIO channel[0] is available.
[INFO]: XIO channel[1] is available.
[INFO]: ---> Total 256 MBytes are now in use.
[INFO]: SPU enable [0, 1, 2, 5, 6, 7] 11101111
[INFO]: BE:3.1, SB:PX1.1
Device: PATAC0:Cable Not Connect
Cell OS SDK3.5.5 000 (release build: r46573 2010_11_26_200000)
Copyright 2010 Sony Computer Entertainment Inc.
revision: 46300
date: Fri Nov 26 20:57:52 JST 2010
skip 2nd initialization step
Browsing through other users' SB UART logs on the forum, I noticed that mine stopped unusually early in the boot process. Halting at "skip 2nd initialization step" just before lv2 took over.
Attempts to get into recovery mode and reset the video output also lead to the same SB UART output.
Taking a closer look I can see the bootloader version is 3.5.5 leading my suspicion that this was a botched CFW attempt.
I do have a Teensy, but my attempts to dump the flash were limited by my soldering skills. I attempted to solder directly to the NAND legs with 30AWG kynar wire but only managed to get two soldered to the first NAND chip before giving up.
With no original flash dumps what are my remaining options?
A NAND clip from AliExpress is on the way in the meantime.
Any ideas?
Video of the boot attempt:
Right, Teensy reading was unsuccessful with the 360 clip. I've gone out and bought a FlashcatUSB XPORT with a TSOP-48 adapter. The flash is probably dead but for the sake of experimentation I'll keep updating this thread since I've never seen SB UART output this kinda thing before. Previous JB attempt by the previous owner screwed up to the point where lv2 fails to load. Thread will be updated with my findings :^)
Update 2:
Looks like this console is gonna become a donor board. I have dumped both NANDs and this is starting to look like an impossible recovery. I can't even merge the two dumps in FlowRebuilder since it complains about missing magic data. Both NAND0 and NAND1 are written with FF from 0x00000000 up until 0x0020000 meaning EID is lost.
o7
Last edited by a moderator: