RGH Corona V1 or V3? Doesn't glitch

digiservice

Junior Member
Feb 5, 2012
13
0
Hungary
Hi!

I have a Corona motherboard with ST flash.
I can read nand, can make ecc, and i can write it back to nand.
But after power ON, on CR only the power led light, reset led is blank.
I was think, that is post_out missing problem, but i removed
CPU heatshink and i saw that post_out is wired to the soldering point.
Now i have no more idea, what can I do.
Please some help!

TX Product(s) used: NAND-X programmer, CR rev C with 48Mhz Quatrz
Console Type: Corona
NAND size: 16MB
Dashboard version: 14719
CB version: 13180

===================================================
2012. december 25. 20:01:11

J-Runner v0.2 Beta (284) Started

Version: 03
Flash Config: 0x00043000
CB Version: 13180
Corona
Reading Nand to d:\rghmy\JRUNNER\output\nanddump1.bin
Reading Nand
Done!
in 2:25 min:sec

Reading Nand to d:\rghmy\JRUNNER\output\nanddump2.bin
Initializing nanddump1.bin..
Nand Initialization Finished
Reading Nand
Done!
in 2:25 min:sec

Comparing...
Nands are the same
* unpacking flash image, ....
Spare Data found, will remove.
Removed
* found decrypted CD
* found XeLL binary, must be linked to 0x1c000000
* we found the following parts:
SMC: 2.5
CB_A: 13180
CB_B: 13180
CD (image): 13180
CD (decrypted): 9452
* checking required versions...
ok
* patching SMC...
Patching Corona version 2.5 SMC at offset 0x13B4
* Replacing CD...

* XOR HACK NEEDED FOR CB 13180
* patching CB_B...
patchset for 13121 found, 5 patch(es)
* Applying XOR Hack to CB_B 13180
*** Re-encrypting CB_B with xor keystream
*** Fixing entrypoint
* Replacing CB_A 13180 with 13121
* encrypting CB...
* constructing new image...
* base size: 70000
* No separate recovery Xell available!
* Flash Layout:
0x0..0x1FF (0x200 bytes) Header
0x200..0x7FF (0x600 bytes) Padding
0x800..0x3FFF (0x3800 bytes) SMC
0x4000..0x7FFF (0x4000 bytes) Keyvault
0x8000..0x9AEF (0x1AF0 bytes) CB_A 13121
0x9AF0..0x118DF (0x7DF0 bytes) CB_B 13121
0x118E0..0x178DF (0x6000 bytes) CD 9452
0x178E0..0xBFFFF (0xA8720 bytes) Padding
0xC0000..0xFFFFF (0x40000 bytes) Xell (backup)
0x100000..0x13FFFF (0x40000 bytes) Xell (main)
* Encoding ECC...Done!
------------- Written into output\image_00000000.ecc

Version: 03
Flash Config: 0x00043000
Writing Nand
image_00000000.ecc
Done!
in 0:11 min:sec

MFR: 2012-07-06

Thanx!

Peter

At morning I start everything from the beginning.
I wrote orig nand to flash, box is working.
resoldered all wires, and cr rev c.
In last picture 48Mhz Quartz is not soldered yet, but all other wires are in the place that wright tutorial.
As i saw, I2C bus wires in the pcb not the same as in tutors, is this maybe make any problem?
Postout, as You can see is wired to the soldering point, I measured it, and it really wired from MCU's pin4 to point.
 
Last edited:

digiservice

Junior Member
Feb 5, 2012
13
0
Hungary
Thank You, but that not give any solution.
Reset glitch led still blank.
I don't have more idea. Please help with other possibel solutions.

Thank You!!!

Edit:
Glicth led now blinking, but no boot xell.
I tried 14-55cm cpu_reset wire, w/o success.
I tried all cpld timers too, w/o success too... :)

Edit 2:
glitching started. quartz was dead...
Glitch led blink is stopping now when power led blink once.
As i know that means xell is loaded.
But i can't find cpu key via LAN. Is there another solution to get CPU key?
Thanx!
 
Last edited:

digiservice

Junior Member
Feb 5, 2012
13
0
Hungary
I got this with Monitor Com:
What does it mean? And what is the solution?
(Console does'nt get IP, glitch led blank, power led blank once)

Please help ! Thanx!

XeLL - First stage
* Attempting to wakeup all CPUs...
CPUs online: 03..
CPUs online: 3f..
* success.
* Decompressing stage 2...
* Loading ELF file...
0x00000000 0x00035900, Loading .text...done
0x00035900 0x000005cc, Loading .elfldr...done
0x00035ed0 0x000064f8, Loading .data...done
0x0003c3c8 0x00000214, Loading .got2...done
0x0003c5e0 0x0000006c, Loading .sdata...done
0x0003c650 0x00008a38, Loading .rodata...done
0x00045088 0x0000002c, Loading .eh_frame_hdr...done
0x000450b4 0x0000011c, Loading .eh_frame...done
0x000451e0 0x00722d04, Clearing .bss...done
0x00767ee4 0x00000084, Clearing .sbss...done
* GO (entrypoint: 0000000000009800)
Xenos GPU ID=5841
unknown SMC bulk msg
DVD cover state: 62
AVPACK detected: 57
. ana disable
. ana enable
........................................................................................................................................................................................................................................................................................................................................................................................................................