[UNSOLVED] Bricked PS3 help (twice PSXexploit applied)

Enzo1960 said:
Thanks for reply!
You're absolutely right!
I suspect now that all my actual problems can depend from this.
I obtained (I'll write after all story) full checked nands but PS3 give me RLOD when I put them in sockets.
I believe that capacitors leaved in original place could be enough to decouple flash chips, but now I add them also in DIP sockets.
About pull up resistors, I've to study datasheet of NANDs to discover what pins have to be pulled up, and resistors value.
Thank you again, I'll let you know soon results.
Click to expand...
I added four 100nF capacitors at (12,13) and (36,37) pins of each nand to decouple better. Seems (but probably it's my suggestion) that green led remain on a little more before red led goes in RLOD state.
About others pins to fix I doesn't understand what I should do: perhaps I must lock CE/ state?
Obviously in this experiment I want to be sure PS3 can start boot process with fixed OFW nands: after that I think it is better to solder nands again onto boards before to proceed with CFW installation.
 
Enzo1960 said:
I added four 100nF capacitors at (12,13) and (36,37) pins of each nand to decouple better. Seems (but probably it's my suggestion) that green led remain on a little more before red led goes in RLOD state.
About others pins to fix I doesn't understand what I should do: perhaps I must lock CE/ state?
Obviously in this experiment I want to be sure PS3 can start boot process with fixed OFW nands: after that I think it is better to solder nands again onto boards before to proceed with CFW installation.
Click to expand...
That confused me, you are desoldering and soldering again the flashes to the motherboard back and forth in between tests ?
The capacitors and resitors i mentioned are needed only if the flash is inside the socket... in other words separated from the motherboard

For the control pins i cant tell exactly what to do with them, i never did it
In NAND there are a few control pins, take a look at the images in this page:
https://www.psdevwiki.com/ps3/Teensy++_2.0
-CE
-RE
-CLE
-ALE
-WP
-WE
-R/B

Some of them are going to be driven by the flasher (so no worry about them)
The problem are the others, this ones is where is good to add a resistor, but if i where you i would take a look at the datasheet of your flash chip to confirm the pin states you need

I mean... every flash manufacturer could decide to use 0 for enabled... or 1 for enabled (hope you get this example is completly the opposite)

As example... you need the pin "CE" (chip enable) enabled... but we dont know if the pin is going to take a 0 as enable or an 1


-------------------------------------
What you could do as an initial test (just because is way faster and there is no danger in doing this)...
Take a random file (lets say an image.bmp) and crop it with a hexeditor to the same exact size of a NAND
Then put the NAND flash chip in the socket and write the image.bmp in it
Then make a dump of the NAND (lets call it image.dump)
Compare image.bmp with image.dump.... there should be identical

Incase are not identicals there is some problem and is needed to return to step one, check pins, wires, and datasheet, and repeat the tests
 
Last edited:
sandungas said:
That confused me, you are desoldering and soldering again the flashes to the motherboard back and forth in between tests ?
The capacitors and resitors i mentioned are needed only if the flash is inside the socket... in other words separated from the motherboard

For the control pins i cant tell exactly what to do with them, i never did it
In NAND there are a few control pins, take a look at the images in this page:
https://www.psdevwiki.com/ps3/Teensy++_2.0
-CE
-RE
-CLE
-ALE
-WP
-WE
-R/B

Some of them are going to be driven by the flasher (so no worry about them)
The problem are the others, this ones is where is good to add a resistor, but if i where you i would take a look at the datasheet of your flash chip to confirm the pin states you need

I mean... every flash manufacturer could decide to use 0 for enabled... or 1 for enabled (hope you get this example is completly the opposite)

As example... you need the pin "CE" (chip enable) enabled... but we dont know if the pin is going to take a 0 as enable or an 1


-------------------------------------
What you could do as an initial test (just because is way faster and there is no danger in doing this)...
Take a random file (lets say an image.bmp) and crop it with a hexeditor to the same exact size of a NAND
Then put the NAND flash chip in the socket and write the image.bmp in it
Then make a dump of the NAND (lets call it image.dump)
Compare image.bmp with image.dump.... there should be identical

Incase are not identicals there is some problem and is needed to return to step one, check pins, wires, and datasheet, and repeat the tests
Click to expand...
Sorry, I was misunderstood. I put both nands in external dip48 sockects, and nands are in other tsop48->dip48 converters.
So I can remove it from sockets and put them (they still have dip48 male pinout, because of converters), and program in a external universal programmer.
I'm using an RT809H programmer. I used all 3 algorithms available to write nand (hard copy (ignore bad block), skip bad block and data realign, skip bad block and rebuild BBT) but results are the same.
I tried several times to re-read nand programmed and to rebuild with flowrebuilder unified interleaved nand, to check if there are differences in data during all process, but resulting file is exactly as in origin.
In my first tries (first post of this thread) my errors was:
1) I exchanged initially nand0 with nand1 in flowrebuild so I obtained errors.
2) Old versions of check tools (PS3 dump checker) doesn't supported 4.82 and later firmware, so give me unreal errors.
Nowadays my dumps passed all checks.
I patched it with both my original software dumps (when I used software flasher), and with OFW 4.82, OFW4.84, only yesterday ps3, instead to istantly go in RLOD, stay on for about 5-10 seconds, after that fan runs fast and ps3 goes off in RLOD.
What's happening? Perhaps external socketed nands cannot be used?
 
Hello! After other tries, I observed that, adding additional capacitors in socketed nand, as suggested by Sandungas, eliminate initial RLOD and PS3 starts, but no video, and after several minutes (when initially cold) goes in RLOD.
So I think that perhaps lenght of wires and other factors connected with external socketing could influence regular start.
So I decided to remove all wires and to resolder again nands directly on board.
But, before to do that, I ask: what's in your opinion best firmware to flash in nands before soldering?
OFW4.82?
OFW4.84?
Or one of this pre-patched with PS3DumpChecker with embedded ROS patch noFSM 4.84 (Ferrox based)?
(I only founded to download OFW4.82 and OFW4.84 as .bin files to patch my dump)
Thanks a lot!
 
I think you should install the same version you had (before the PS3 stopped working). This way it should work normally in the next boot
Otherway, you could use the dowgrade patches (ros0 and ros1) that was intended to install 3.55. In this case the PS3 should not boot normally but should allow you to install 3.55 OFW

But dont take my sugestions literally though, im not used to all the different scenarios, maybe littlebalup have a better idea of whats the best thing to do, he is used to all that patches because some of them was included in his ps3dumpchecker and pyps3checker tools
 
sandungas said:
I think you should install the same version you had (before the PS3 stopped working). This way it should work normally in the next boot
Otherway, you could use the dowgrade patches (ros0 and ros1) that was intended to install 3.55. In this case the PS3 should not boot normally but should allow you to install 3.55 OFW

But dont take my sugestions literally though, im not used to all the different scenarios, maybe littlebalup have a better idea of whats the best thing to do, he is used to all that patches because some of them was included in his ps3dumpchecker and pyps3checker tools
Click to expand...
I flashed NANDs with OFW4.82
I hope that resoldering it PS3 can turn on again. If any troubles on start this could be a real RLOD problem: first PS3 goes off immediately when I pressed power button, because probably don't passed internal checksum on flash contents, this time turn it on and goes off after 10-30 seconds depending of warming of chips.
In next days I proceed with work.
If all goes right, I can repeat again all process to software mod it, having full backup too!
 
Enzo1960 said:
I flashed NANDs with OFW4.82
I hope that resoldering it PS3 can turn on again. If any troubles on start this could be a real RLOD problem: first PS3 goes off immediately when I pressed power button, because probably don't passed internal checksum on flash contents, this time turn it on and goes off after 10-30 seconds depending of warming of chips.
In next days I proceed with work.
If all goes right, I can repeat again all process to software mod it, having full backup too!
Click to expand...
I desoldered flying wires with sockets and soldered again nands in their places. I remounted PS3, but it istantly goes in RLOD.
Because nands was validated with no errors I believe this is a problem in solders of BGA chips.
To avoid myself further tries I bring this PS3 in my basement, together other broken consoles.
Hoping that in next years BGA reballing became affordable for home users!
 
You must log in or register to reply here.

Similar threads

Back
Top