JTAG Cant get a good dump no matter what

[Krafter]

This is a continuation from this thread. I decided to create a new one as the title might give confusion on the problem I'm having now as the two don't relate.

OK, so here the story. I have this console in for repair and it's been driving me nuts. It came to me because the owner tried to update his JTAG dash. He used JR to create the update but it didn't do anything but give him a black screen and I of course verified that when I got it. I originally thought I would need a donor as he no longer had the stock NAND dump but with some assistance in the previous thread, I realized I was a dumbass and just need to create a new one with the what I had. All went well and I was able to create a retail NAND using JR and it booted just fine after removing the JTAG. The next step was to build a new JTAG dash but no matter what I did, I kept getting an E79. I then switch the method of JTAG from normal to AUD_CLAMP using the transistor method and the error was the same.... E79. I tried using an older version of JR, 360_Mulit_Builder and AutoGG and still the same error.

Something very strange that I've never ran into before is I cannot get two matching NAND dumps no matter what! As you can see in the log file there are some weird errors that I've never seen before. When comparing NANDs, D20 always comes back as different. And just so it's clear, I've read the NAND many times that's not included in this log and D20 always throws out an error and is always different when comparing. I'm thinking that these errors has to have something to do with my problems and I need some advice. I've tried using NANDHealer (because I'm to lazy to use NANDPRo) to remap D20 and still the same problem. I'm at a total lost here.

===================================================
Monday, June 24, 2013 4:45:21 PM

J-Runner v0.2 Beta (289) Started


WARNING! - Your selected working directory already contains files!
You can view these files by using 'Show Working Folder' Button


Filechecks disabled - No Filechecks carried out
Version: 03
Flash Config: 0x008A3020
CB Version: 6723
Reading Nand to E:\xbox\J-Runner\output\nanddump1.bin
Reading Nand
Error: E00 reading block 11C [COLOR="#0000FF"]<-- What is error E00?[/COLOR]
Error: 218 reading block 3D2 [COLOR="#0000FF"]<-- What is error 218?[/COLOR]
[COLOR="#FF0000"]Error: 21C reading block D20[/COLOR] [COLOR="#0000FF"]<-- What is error 21C?[/COLOR]
Error: 204 reading block D21
Error: 204 reading block D22
Error: 204 reading block D23
Error: 204 reading block D24
Error: 204 reading block D25
Error: 204 reading block D26
Error: 204 reading block D27
Done!
in 8:32 min:sec

Initializing nanddump1.bin..
Reading Nand to E:\xbox\J-Runner\output\nanddump2.bin
Reading Nand
Nand Initialization Finished
Error: 218 reading block 3D2
[COLOR="#FF0000"]Error: 21C reading block D20[/COLOR]
Error: 204 reading block D21
Error: 204 reading block D22
Error: 204 reading block D23
Error: 204 reading block D24
Error: 204 reading block D25
Error: 204 reading block D26
Error: 204 reading block D27
Done!
in 8:33 min:sec

Comparing...Takes a while on big nands
Reading Nand to E:\xbox\J-Runner\output\nanddump3.bin
Bad Block ID @ 0x007A [Offset: 0xFBA000] ,
Reading Nand
Bad Block ID @ 0x007A [Offset: 0xFBA000] 
Error: 210 reading block 3D2
[COLOR="#FF0000"]Error: 21C reading block D20[/COLOR]
Error: 204 reading block D21
Error: 204 reading block D22
Error: 204 reading block D23
Error: 204 reading block D24
Error: 204 reading block D25
Error: 204 reading block D26
Error: 204 reading block D27
Done!
in 8:34 min:sec

Initializing nanddump2.bin..
Nand Initialization Finished
Comparing...Takes a while on big nands
Bad Block ID @ 0x007A [Offset: 0xFBA000]
Bad Block ID @ 0x007A [Offset: 0xFBA000]
0x03D2
0x0D20
Initializing nanddump1.bin..
Nand Initialization Finished
Comparing...Takes a while on big nands
Bad Block ID @ 0x007A [Offset: 0xFBA000]
Bad Block ID @ 0x007A [Offset: 0xFBA000]
0x011B
0x011E
0x03D2
0x0D20
Initializing nanddump1.bin..
Nand Initialization Finished
Comparing...Takes a while on big nands
Bad Block ID @ 0x007A [Offset: 0xFBA000]
Bad Block ID @ 0x007A [Offset: 0xFBA000]
0x011B
0x011E
0x0D20

Pics

 

[Martin C]

Have you tried erasing the first 1000 blocks, building a new NAND with 'noremap' and writing using the advanced write option?

You have 3 potential bad block with one possibly being remapped. D20-D27 is 1 block.

 

[Krafter]

Have you tried erasing the first 1000 blocks, building a new NAND with 'noremap' and writing using the advanced write option?

You have 3 potential bad block with one possibly being remapped. D20-D27 is 1 block.

Thanks for the reply Martin. I've been multitasking between this one, a Corona and a couple computers. I'm about to pull my hair out lol.

I just tried what you suggested. I erased the first 1000 blocks, built an AUD_CLAMP image with noremap set to true in options.ini and flashed it via advanced write but I'm still getting an E79.

Edit: before I did any of that, I verified once again that the retail NAND which I created boots. I just don't get why I can't create a good JTAG image.

Tuesday, June 25, 2013 10:51:59 PM

J-Runner v0.2 Beta (289) Started


WARNING! - Your selected working directory already contains files!
You can view these files by using 'Show Working Folder' Button


Filechecks disabled - No Filechecks carried out
Initializing retail.bin..
CpuKey is Correct
Key already Exists
Nand Initialization Finished
Load Files Initiliazation Finished
Clean SMC detected
16203
Started Creation of the 16203 xebuild image
KV Info saved to file
---------------------------------------------------------------
     xeBuild v1.07.561
---------------------------------------------------------------
building jtag image
---------------------------------------------------------------
E:\xbox\J-Runner\002999690307\updflash.bin image built, info:
---------------------------------------------------------------
Console   : Jasper (big block)
NAND size : 64MiB (system only)
Build     : JTAG
Xell      : power on console with console eject button
Serial    : 002999690307
ConsoleId : 003383851821
MoboSerial: 8920961208559027
Mfg Date  : 01/12/2009
CPU Key   : 345CD0DD6F7BD17813CCC522A162A5E9
1BL Key   : DD88AD0C9ED669E7B56794FB68563EFA
DVD Key   : 4AD0C2C013C733CB230B5E339F6290D7
CF LDV    : 1
KV type   : type2 (hashed)
---------------------------------------------------------------
    xeBuild Finished. Have a nice day.
---------------------------------------------------------------
Saved to E:\xbox\J-Runner\002999690307
Image is Ready
Version: 03
Flash Config: 0x008A3020
Writing Nand
updflash.bin
Error: 202 writing block 3D0
Error: 202 writing block D20
Done!
in 8:17 min:sec

Tapatalk misspelled it. Knot me.

 

[Martin C]

E79 is normally due to your JTAG wiring or TMS/TDI being a problem.

Measure the resistance between J2D2.1 and GND, and again with J2D2.2 and GND. Let me know the values.

 

[Krafter]

J2D2.1 = 1.6K
J2D2.2 = 1.6K

E79 is normally due to your JTAG wiring or TMS/TDI being a problem.

Would Xell boot if either were the problem? I can boot into Xell just fine.


Tapatalk misspelled it. Knot me.

 

[Martin C]

They look ok.

Take the jasper_bb_aud_clamp.bin from J-Runner (Common/xell) and write to your console.

Make sure you have the wiring setup for AUD_CLAMP.

Unplug the PSU and after 20 seconds, plug it in again.

See what happens when you try to boot it.

 

[Krafter]

Will do latter this evening. I'm off to my real job now.


Tapatalk misspelled it. Knot me.

 

[Krafter]

I just did as you suggested and it booted Xell just fine.

 

[Krafter]

I've been doing some reading and I'm convincing myself more and more it has something to do with my NAND build. I've seen a few post on other sites that said one cause of an E79 is a problem with the SMC and according to the Q and As in this article that does seem to be a "possible" cause of my problem.

Q: "I get E79"
A: This means that, congratulations, your console is still booting into a kernel, and just cannot go further (which was to be exepcted, given that
there is no filesystem anymore). You're almost there, but for some reasons, the DMA attack didn't run. This can be either that you didn't used a patched SMC, or that the target address wasn't inserted properly.

Source
http://team-xecuter.com/forums/showthread.php/54052-How-JTAG-Works-(Technical)

Every time I use JR to build an image, it barks at me saying that a SMC exists and says that unless I put it there delete it. Should I be doing that? I have been.

Edit: now that I think about it, it can't have anything to do with the SMC since Xell is loading.

Tapatalk misspelled it. Knot me.

 

[Martin C]

I just did as you suggested and it booted Xell just fine.

Therefore leave everything as is and build a new AUD_CLAMP JTAG image from a retail NAND. Do NOT use a JTAG NAND as the SMC will stay the same.

 

[Krafter]

Therefore leave everything as is and build a new AUD_CLAMP JTAG image from a retail NAND. Do NOT use a JTAG NAND as the SMC will stay the same.

That's what I have been doing. It boots Xell just fine with the eject button but gives E79 when trying to boot into the dash.


Tapatalk misspelled it. Knot me.

 

[Krafter]

I don't know if its relevant or not but the first three quadrants on the ROL light up green as if its going to boot but then gives the error.


Tapatalk misspelled it. Knot me.

 

[Martin C]

ok - go to custom NAND/CR functions and choose write/256 and select the jasper_bb_aud_clamp.bin file, start block 0 and length 1.

Let me know what happens after this.

 

[Krafter]

ok - go to custom NAND/CR functions and choose write/256 and select the jasper_bb_aud_clamp.bin file, start block 0 and length 1.

Let me know what happens after this.

Will do when I get home. I'm curious though, what are you looking for here? Are you just trying to pinpoint where it's failing? I'm a coder myself (nothing that applies to this kind of stuff) and often use small steps like this to debug.


Tapatalk misspelled it. Knot me.

 

[Martin C]

The SMC which lives in block 0 determines the behaviour of your console and in the terms of JTAG, also holds the location to config changes.

Since we know the jasper_bb_aud_clamp.bin file works, we're writing the SMC from this to your console. This 100% eliminates your SMC you created.

 

[Krafter]

I understand. We're writing the SMC from the AUD_CLAMP file to the NAND. We know that SMC is good.


Tapatalk misspelled it. Knot me.

 

[Martin C]

I understand. We're writing the SMC from the AUD_CLAMP file to the NAND. We know that SMC is good.


Tapatalk misspelled it. Knot me.

Exactly!

 

[Krafter]

I'm pulling my hair out on this and I'm already bald headed lol. I did what you suggested and I got an E10 aka 0022. I also tried JTAG Tool just for the hell of it and got a very slight improvement. I got four LEDs to light green before E79 as opposed to three LEDs with JR. Any other ideas? I'm running out.


Tapatalk misspelled it. Knot me.

 

[Martin C]

Can you build a clean NAND (using extracted files), erase your entire NAND (write the stock NAND back to access internal MU if you need to back anything up) and write back using the Advanced write option for DemoN / Fusion.

Paste the write log if it still fails.

 

[Krafter]

I'll give it a try when I get home.

PS
Apologies for posting in the wrong section. I could have sworn I posted this in the JTAG section and just realized I didn't. Feel free to move it.


Tapatalk misspelled it. Knot me.