R-JTAG BB Jasper no xell

[Antalpromille]

Ok thanks. I'll have give that a shot in the morning then.


Sent from my iPhone using Tapatalk

i usually only uses 0 Ohm setting, but last week i had one that would RROD with secondary error code 0021 if i used anything but 470 Ohm.

 

[Martin C]

Post 1A - RC4_INITIALIZE 
Post 1B - RC4_DECRYPT 
Post 1C - SHA_COMPUTE 
Post 1D - SIG_VERIFY 
Post 1E - BRANCH 
Post 20 - CB entry point reached 
Post 21 - INIT_SECOTP 
Post 22 - INIT_SECENG 
Post 2F - RELOCATE 
Post 2E - HWINIT 
Post 33 - FETCH_CONTENTS_4BL_CD 
Post 34 - HMACSHA_COMPUTE_4BL_CD 
Post 35 - RC4_INITIALIZE_4BL_CD 
Post 36 - RC4_DECRYPT_4BL_CD 
Post 37 - SHA_COMPUTE_4BL_CD 
Post 3A - BRANCH 
Post 40 - Entrypoint of CD reached 
Post 41 - VERIFY_OFFSET 
Post 44 - FETCH_CONTENTS 
Post 45 - HMACSHA_COMPUTE 
Post 46 - RC4_INITIALIZE 
Post 47 - RC4_DECRYPT 
Post 48 - SHA_COMPUTE 
Post 4B - LZX_EXPAND 
Post 4E - FETCH_OFFSET_6BL_CF 
Post 4F - VERIFY_OFFSET_6BL_CF 
Post 50 - LOAD_UPDATE_1 
Post 52 - BRANCH 
Post 58 - INIT_HYPERVISOR 
Post 10 - Payload/1BL started

This is a good boot. Whatever DIP/setting is doing this, keep it set. At this point it should be moving onto POST 11 which eventually should load xell.

Don't use RATER for this. POST monitor (under Tools) is sufficient. As you can see from the output, RATER thinks it's booted.

resolder the AUD_CLAMP wire, but instead of bridging, just solder it to the '1' pad. Your soldering is good BTW

 

[loalge]

Will do Martin. Thanks for the comment about my soldering, it's an honor coming from you. I'll try the AUD_CLAMP wire after work and update post. Any possibility there is something wrong in the nand? It behaves just like it did when attempting RGH. I've tried leaving these settings and not using rater or post monitor and let it attempt to boot for an hour. Same thing happened during the RGH install 2 yrs. ago. I suspected it was the ecc then and now don't know what to think. No bad blocks, just curious.

 

[Martin C]

You're welcome

Interesting that it was doing this with RGH2.

Once it gets past 2E then the R-JTAG part of the exploit has completed and it's then down to the xell image and JTAG wiring.

Is anything else connected to the console?

 

[loalge]

No. Just fan, power and video.


Sent from my iPhone using Tapatalk

 

[Martin C]

Can you try setting the JTAG switch to off and see if it forces either E79, 1033 or a 6F POST halt?

 

[loalge]

With post monitor running? Will try when i get home from work.


Sent from my iPhone using Tapatalk

 

[Martin C]

With post monitor running? Will try when i get home from work.


Sent from my iPhone using Tapatalk

Yeah, please - want to see what it does

 

[[email protected]]

interesting whether Post 58 fail is fixable or not.

I messed around with Zephyr board with Xenon CPU once trying to get CPU key, the farthest it went was Post 58

http://team-xecuter.com/forums/showthread.php?t=138556

then I welded a different cpu which was rgh1 hackable, but the console didn't last long, it died with rrod most likely, even though the gpu was reballed

 

[loalge]

With board off i get the 6f halt.


Sent from my iPhone using Tapatalk

 

[Martin C]

With board off i get the 6f halt.


Sent from my iPhone using Tapatalk

ok, so that's expected. The JTAG wiring is needed to complete the boot.

Can you try setting it back to on, soldering R2P12 (the smaller point on the QSB) and bridging 1&2? Finally load your nanddump1.bin back into J-Runner and select JTAG & R-JTAG only this time, then write this to your NAND? Let me know what happens.

 

[loalge]

I assume i leave the AUD_CLAMP wire disconnected.


Sent from my iPhone using Tapatalk

 

[Martin C]

yeah, remove it for now.

 

[loalge]

ok so this is what i get now.

Waiting for POST to change
Post 12 - FSB_CONFIG_RX_STATE
Post 88 - Panic - PROGRAM
Post 10 - Payload/1BL started
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 12 - FSB_CONFIG_RX_STATE
Post 13 - FSB_CONFIG_TX_STATE
Post 14 - FSB_CONFIG_TX_CREDITS
Post 15 - FETCH_OFFSET
Post 16 - FETCH_HEADER
Post 17 - VERIFY_HEADER
Post 18 - FETCH_CONTENTS
Post 19 - HMACSHA_COMPUTE
Post 1A - RC4_INITIALIZE
Post 1B - RC4_DECRYPT
Post 1C - SHA_COMPUTE
Post 1D - SIG_VERIFY
Post 1E - BRANCH
Post 20 - CB entry point reached
Post 21 - INIT_SECOTP
Post 22 - INIT_SECENG
Post 2F - RELOCATE
Post 2E - HWINIT
Post 31 - FETCH_HEADER_4BL_CD
Post 33 - FETCH_CONTENTS_4BL_CD
Post 34 - HMACSHA_COMPUTE_4BL_CD
Post 35 - RC4_INITIALIZE_4BL_CD
Post 36 - RC4_DECRYPT_4BL_CD
Post 37 - SHA_COMPUTE_4BL_CD
Post 3A - BRANCH
Post 40 - Entrypoint of CD reached
Post 42 - FETCH_HEADER
Post 44 - FETCH_CONTENTS
Post 45 - HMACSHA_COMPUTE
Post 46 - RC4_INITIALIZE
Post 47 - RC4_DECRYPT
Post 48 - SHA_COMPUTE
Post 4B - LZX_EXPAND
Post 4E - FETCH_OFFSET_6BL_CF
Post 4F - VERIFY_OFFSET_6BL_CF
Post 50 - LOAD_UPDATE_1
Post 52 - BRANCH
Post 58 - INIT_HYPERVISOR
Post 59 - INIT_SOC_MMIO
Post 5A - INIT_XEX_TRAINING
Post 60 - INIT_KERNEL
Post 61 - INIT_HAL_PHASE_0
Post 62 - INIT_PROCESS_OBJECTS
Post 64 - INIT_MEMORY_MANAGER
Post 65 - INIT_STACKS
Post 66 - INIT_OBJECT_SYSTEM
Post 67 - INIT_PHASE1_THREAD
Post 68 - Started phase 1 Initialization + INIT_PROCESSORS
Post 10 - Payload/1BL started
Post 13 - FSB_CONFIG_TX_STATE
Post 10 - Payload/1BL started
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 12 - FSB_CONFIG_RX_STATE
Post 13 - FSB_CONFIG_TX_STATE
Post 14 - FSB_CONFIG_TX_CREDITS
Post 15 - FETCH_OFFSET
Post 16 - FETCH_HEADER
Post 17 - VERIFY_HEADER
Post 18 - FETCH_CONTENTS
Post 19 - HMACSHA_COMPUTE
Post 1A - RC4_INITIALIZE
Post 1B - RC4_DECRYPT
Post 1C - SHA_COMPUTE
Post 1D - SIG_VERIFY
Post 1E - BRANCH
Post 20 - CB entry point reached
Post 21 - INIT_SECOTP
Post 22 - INIT_SECENG
Post 2F - RELOCATE
Post 2E - HWINIT
Post 33 - FETCH_CONTENTS_4BL_CD
Post 34 - HMACSHA_COMPUTE_4BL_CD
Post 35 - RC4_INITIALIZE_4BL_CD
Post 36 - RC4_DECRYPT_4BL_CD
Post 37 - SHA_COMPUTE_4BL_CD
Post 3A - BRANCH
Post 40 - Entrypoint of CD reached
Post 42 - FETCH_HEADER
Post 44 - FETCH_CONTENTS
Post 45 - HMACSHA_COMPUTE
Post 46 - RC4_INITIALIZE
Post 47 - RC4_DECRYPT
Post 48 - SHA_COMPUTE
Post 4B - LZX_EXPAND
Post 4E - FETCH_OFFSET_6BL_CF
Post 4F - VERIFY_OFFSET_6BL_CF
Post 50 - LOAD_UPDATE_1
Post 52 - BRANCH
Post 58 - INIT_HYPERVISOR
Post 59 - INIT_SOC_MMIO
Post 5A - INIT_XEX_TRAINING
Post 60 - INIT_KERNEL
Post 61 - INIT_HAL_PHASE_0
Post 64 - INIT_MEMORY_MANAGER
Post 65 - INIT_STACKS
Post 66 - INIT_OBJECT_SYSTEM
Post 67 - INIT_PHASE1_THREAD
Post 68 - Started phase 1 Initialization + INIT_PROCESSORS
Post 69 - INIT_KEY_VAULT
Post 6A - INIT_HAL_PHASE_1
Post 10 - Payload/1BL started
Post 13 - FSB_CONFIG_TX_STATE
Post 10 - Payload/1BL started
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 12 - FSB_CONFIG_RX_STATE
Post 13 - FSB_CONFIG_TX_STATE
Post 14 - FSB_CONFIG_TX_CREDITS
Post 15 - FETCH_OFFSET
Post 16 - FETCH_HEADER
Post 17 - VERIFY_HEADER
Post 18 - FETCH_CONTENTS
Post 19 - HMACSHA_COMPUTE
Post 1A - RC4_INITIALIZE
Post 1B - RC4_DECRYPT
Post 1C - SHA_COMPUTE
Post 1D - SIG_VERIFY
Post 1E - BRANCH
Post 20 - CB entry point reached
Post 21 - INIT_SECOTP
Post 22 - INIT_SECENG
Post 2F - RELOCATE
Post 2E - HWINIT
Post 31 - FETCH_HEADER_4BL_CD
Post 33 - FETCH_CONTENTS_4BL_CD
Post 34 - HMACSHA_COMPUTE_4BL_CD
Post 35 - RC4_INITIALIZE_4BL_CD
Post 36 - RC4_DECRYPT_4BL_CD
Post 37 - SHA_COMPUTE_4BL_CD
Post 3A - BRANCH
Post 40 - Entrypoint of CD reached
Post 42 - FETCH_HEADER
Post 44 - FETCH_CONTENTS
Post 45 - HMACSHA_COMPUTE
Post 46 - RC4_INITIALIZE
Post 47 - RC4_DECRYPT
Post 48 - SHA_COMPUTE
Post 4B - LZX_EXPAND
Post 4E - FETCH_OFFSET_6BL_CF
Post 4F - VERIFY_OFFSET_6BL_CF
Post 50 - LOAD_UPDATE_1
Post 52 - BRANCH
Post 58 - INIT_HYPERVISOR
Post 59 - INIT_SOC_MMIO
Post 5A - INIT_XEX_TRAINING
Post 60 - INIT_KERNEL
Post 61 - INIT_HAL_PHASE_0
Post 63 - INIT_KERNEL_DEBUGGER
Post 64 - INIT_MEMORY_MANAGER
Post 65 - INIT_STACKS
Post 66 - INIT_OBJECT_SYSTEM
Post 67 - INIT_PHASE1_THREAD
Post 68 - Started phase 1 Initialization + INIT_PROCESSORS
Post 10 - Payload/1BL started

thats 3 cycles. i had to shut it off at post 10 because i just hang there. No xell but looks closer.

 

[Antalpromille]

have you tried 0 Ohm, 330 Ohm and 470 Ohm on the jtag QSB?

 

[loalge]

Yes. At 0 i got to post 11 before it just sat there.


Sent from my iPhone using Tapatalk

 

[Martin C]

ok - so there's no difference between R2P12 or Q2N1 being used. Change back to AUD_CLAMP for now.

Try this: Run the console again, but don't have any fan connected. Don't run RATER as you want the console to stay on. You can run Tools/monitor POST for the output.

Boot it and it will 'stop' at the same point. Leave it on for about 5 mins. Wait until the CPU/GPU get hot to the touch and then turn off/turn on. See if there's any difference.

 

[loalge]

I trust you Martin because you obviously know what you're doing so i'll try this after work. I gotta be honest though, you're scarin me now bud.


Sent from my iPhone using Tapatalk

 

[Martin C]

I'm trying to ascertain if you have a GPU issue with TMS/TDI which is preventing the boot from carrying on past POST 10.

 

[loalge]

I figured it was something like that. Was meant more as a joke than anything. I'll do this as soon as home from work. Everything seems to be pointing to hardware which just seems odd considering this was purchased new and never played. Just an attempted RGH and then closeted after it reacted the same way as it is now.


Sent from my iPhone using Tapatalk