FIXED Corona v4 4gb, got key - now can't boot stock nand

[daretogo]

Thanks for reading. I'll try to make this as detailed as possible to make it easy for anyone that wants to try to help me.

To clarify up front, the reason I am using the DGX on this Corona V4 is to install an ODE device (****). It is NOT my intention that this become an RGH box - I just need the CPU key in order to setup the ****.

TX products used:

TX Corona 4gb Nand Kit (version 1)
TX Postfix adapter
TX DGX (s)

What I did:

1) Installed the 4gb nand r/w kit and took 4 sets of 4 nand dumps. Labeled each set separately. Compared the first two dumps from each set and they always matched. Used the last of 4 sets in Jrunner.

2) Wrote the DGX ecc to the nand

3) Bridged R2C6 and 7

4) Installed the DGX

5) Tweaked wire length until Xell booted (12cm CPU RST and 60cm POST OUT). No onscreen Xell, but successfully grabbed CPU key via IP. J-runner recognizes this, gives me my DVD key info - everything looks great!

6) Uninstalled the DGX, removed the postfix adapter, "unbridged" R2C6/7 ---> (Messed up and lifted the pad from R2C6)

7) Wrote the first nand dump from the 4th set back to the nand. (stock nand image)

8) Attempted to boot ---> FAILURE.... get nothing onscreen, just a green center LED on the console.


PICTURES:
Picture of lifted R2C6 pad (though I don't think this should matter since it worked open when stock, and a stock box is what I want)
Proof I didn't screw up the CPU RST C5R11 pad
5v, I2C-SCL and I2C_SDA (E,F) are fine too
This image shows how I wired the 4gb r/w v1 kit to the corona v4 (doesn't fit flush) And here is how it's connected to the r/w kit And some extra images to show there is no bridging


So... now I've tried flashing several of the other images/dumps that I had back to the nand and they all seem to write fine, but I always end up with either nothing onscreen, a solid white screen, and very occasionally it will start to boot but then freeze at the xbox swirling logo. I've also ONCE gotten an E71. Powering off and then back on doesn't always give the same results.

Here is my major concern... if I know compare nands from any two different sets of dumps I get differences. Any two dumps from the same set always match, but individual dumps compared from different sets have differences.... that shouldn't be - no changes were made to the xbox at all.


I'm kinda at a loss and fishing for assistance.


JRUNNER LOG:

===================================================
Thursday, January 24, 2013 3:30:28 PM

J-Runner v0.2 Beta (285) Started



Checking Files
Finished Checking Files
N:\
Reading from N:\ to C:\Users\AaronsJet\Desktop\Desktop\Modding Stuff\J-Runner v02 (275) Core Pack\output\nanddump1.bin
Done!
in 0:04 min:sec
N:\
Reading from N:\ to C:\Users\AaronsJet\Desktop\Desktop\Modding Stuff\J-Runner v02 (275) Core Pack\output\nanddump2.bin
Done!
in 0:04 min:sec
N:\
Reading from N:\ to C:\Users\AaronsJet\Desktop\Desktop\Modding Stuff\J-Runner v02 (275) Core Pack\output\nanddump3.bin
Done!
in 0:03 min:sec
N:\
Reading from N:\ to C:\Users\AaronsJet\Desktop\Desktop\Modding Stuff\J-Runner v02 (275) Core Pack\output\nanddump4.bin
Done!
in 0:03 min:sec
Comparing...
Initializing nanddump1.bin..
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
Nand Initialization Finished
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
Nands are the same
Initializing nanddump1.bin..
Nand Initialization Finished
Comparing...
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
Nands are the same
Writing to N:\ from C:\Users\AaronsJet\Desktop\Desktop\Modding Stuff\J-Runner v02 (275) Core Pack\common\DGX\CORONA_4GB_DGX.ecc
Done!
in 0:01:89 min:sec:ms
Tip: Load the nand on source to have quicker results.
Scanning...
No Xbox Detected
Finished
No Xbox Detected
Finished
Getting info from ip 192.168.11.41...
LockDownValue is 1
Initializing nanddump1.bin..
CpuKey is Correct
Added Key to Database
Nand Initialization Finished
Writing to N:\ from C:\Users\AaronsJet\Desktop\chris ****\3rd set of dumps 1-24\nanddump1.bin
Done!
in 0:09:108 min:sec:ms
Using Xell with HDMI support
Load Files Initiliazation Finished
15574
Started Creation of the 15574 xebuild image
KV Info saved to file
---------------------------------------------------------------
xeBuild v1.06.555
---------------------------------------------------------------
building retail image
---------------------------------------------------------------
C:\Users\AaronsJet\Desktop\Desktop\Modding Stuff\J-Runner v02 (275) Core Pack\090324323943\updflash.bin image built, info:
---------------------------------------------------------------
Console : Corona
NAND size : 48MiB MMC (system only)
Build : Retail
Serial : REDACTED
ConsoleId : 540759340849
MoboSerial: 7500929234052395
Mfg Date : 09/24/2012
CPU Key : REDACTED
1BL Key : DD88AD0C9ED669E7B56794FB68563EFA
DVD Key : REDACTED
CF LDV : 1
KV type : type2 (hashed)
---------------------------------------------------------------
xeBuild Finished. Have a nice day.
---------------------------------------------------------------

Saved to C:\Users\AaronsJet\Desktop\Desktop\Modding Stuff\J-Runner v02 (275) Core Pack\090324323943
Image is Ready
Writing to N:\ from C:\Users\AaronsJet\Desktop\Desktop\Modding Stuff\J-Runner v02 (275) Core Pack\090324323943\updflash.bin
Done!
in 0:06:329 min:sec:ms
Writing to N:\ from C:\Users\AaronsJet\Desktop\Desktop\Modding Stuff\J-Runner v02 (275) Core Pack\090324323943\nanddump1.bin
Done!
in 0:06:239 min:sec:ms
Comparing...
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
Nands are the same
Writing to N:\ from C:\Users\AaronsJet\Desktop\Desktop\Modding Stuff\J-Runner v02 (275) Core Pack\090324323943\nanddump2.bin
Done!
in 0:06:328 min:sec:ms
Writing to N:\ from C:\Users\AaronsJet\Desktop\Desktop\Modding Stuff\J-Runner v02 (275) Core Pack\090324323943\nanddump3.bin
Done!
in 0:06:444 min:sec:ms
Writing to N:\ from C:\Users\AaronsJet\Desktop\Desktop\Modding Stuff\J-Runner v02 (275) Core Pack\090324323943\nanddump1.bin
Done!
in 0:06:222 min:sec:ms
Writing to N:\ from C:\Users\AaronsJet\Desktop\chris ****\nanddump1_1st.bin
Done!
in 0:06:240 min:sec:ms
N:\
Reading from N:\ to C:\Users\AaronsJet\Desktop\Desktop\Modding Stuff\J-Runner v02 (275) Core Pack\output\nanddump1.bin
Done!
in 0:03 min:sec
Initializing nanddump1.bin..
CpuKey is Correct
Key already Exists
Nand Initialization Finished
Initializing nanddump1_1st.bin..
CpuKey is Correct
Key already Exists
Nand Initialization Finished
Comparing...
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
0x0394
0x0395
0x0396
0x0397
0x0398
0x0399
0x039A
0x0B9D
0x0B9E
Initializing nanddump1_1st.bin..
CpuKey is Correct
Key already Exists
Nand Initialization Finished
Comparing...
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
Nands are the same
Comparing...
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
Nands are the same
Comparing...
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
0x0394
0x0395
0x0396
0x0397
0x0398
0x0399
0x039A
0x039B
0x039C
0x039D
0x039E
0x039F
0x03A0
0x03A1
0x03A2
0x03A3
0x03A4
0x03A5
0x03A6
0x03A7
0x03A8
0x03A9
0x03AA
0x03AB
0x0B9D
0x0B9E
0x0BA1
Writing to N:\ from C:\Users\AaronsJet\Desktop\chris ****\2nd set of dumps 1-24\nanddump1.bin
Done!
in 0:06:284 min:sec:ms
Writing to N:\ from C:\Users\AaronsJet\Desktop\Desktop\Modding Stuff\J-Runner v02 (275) Core Pack\090324323943\New folder\nanddump1.bin
Done!
in 0:06:313 min:sec:ms

 

[Martin C]

Before we begin, there was never a need to unbridge R2C6 / R2C7. You just created work for yourself.

Secondly, you have differences which, provided you dumped all 4 NAND images at the same time and without powering on the console, should never happen. You should have stopped as you didn't have a matching pair. You only ever need 2 dumps and you only ever need to write back the data used by the DGX ECC (again, just to avoid mishaps).

I'm confused about this:

Writing to N:\ from C:\Users\AaronsJet\Desktop\Desktop\Modding Stuff\J-Runner v02 (275) Core Pack\090324323943\updflash.bin
Done!
in 0:06:329 min:sec:ms
Writing to N:\ from C:\Users\AaronsJet\Desktop\Desktop\Modding Stuff\J-Runner v02 (275) Core Pack\090324323943\nanddump1.bin
Done!
in 0:06:239 min:sec:ms
Comparing...
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
Nands are the same

What were you comparing here?

Write any one of the NANDs you read from the console and without powering on the console, read it back. Compare what you read to what you wrote. They should match. If not, the root cause of your problems is the inability to read and write properly.

 

[daretogo]

Before we begin, there was never a need to unbridge R2C6 / R2C7. You just created work for yourself.

Secondly, you have differences which, provided you dumped all 4 NAND images at the same time and without powering on the console, should never happen. You should have stopped as you didn't have a matching pair. You only ever need 2 dumps and you only ever need to write back the data used by the DGX ECC (again, just to avoid mishaps).

I actually took 4 sets of 4 dumps. I have 16 total dumps of this nand before I ever wrote the DGX ecc. From any ONE set all the dumps match, but when I compare dump 1 set 1 to dump 1 set 2 I get differences.

I'm confused about this:

Writing to N:\ from C:\Users\AaronsJet\Desktop\Desktop\Modding Stuff\J-Runner v02 (275) Core Pack\090324323943\updflash.bin
Done!
in 0:06:329 min:sec:ms
Writing to N:\ from C:\Users\AaronsJet\Desktop\Desktop\Modding Stuff\J-Runner v02 (275) Core Pack\090324323943\nanddump1.bin
Done!
in 0:06:239 min:sec:ms
Comparing...
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
Nands are the same

What were you comparing here?

I used Jrunner's "create image" function with Retail selected to attempt to generate a good nand image, that's what the updflash.bin is, not sure what I was comparing to the nanddump1 in that section of the log.

Write any one of the NANDs you read from the console and without powering on the console, read it back. Compare what you read to what you wrote. They should match. If not, the root cause of your problems is the inability to read and write properly.

Excellent test.

With the xbox connected to power without interruption I was able to write the first dump of the last set of dumps I took (nanddump1.bin) and then read it back (READBACK.BIN) and they compare to be the same.


Writing to N:\ from C:\Users\AaronsJet\Desktop\Desktop\Modding Stuff\J-Runner v02 (275) Core Pack\090324323943\New folder\nanddump1.bin
Done!
in 0:06:476 min:sec:ms
N:\
Reading from N:\ to C:\Users\AaronsJet\Desktop\READBACK.BIN
Done!
in 0:07 min:sec
Comparing...
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
Nands are the same

HOWEVER

I then disconnected the xbox from power, let it sit for 15 seconds, reconnected and then attempted to boot normally (with the 4gb kit switch in the X360 position) and got nothing but a red dot.

I disconnected power again, flipped the switch back to R/W, reconnected power again and took another dump (READBACK2.BIN) and compared that to the first READBACK.BIN and got:

Comparing...
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
0x03AB
0x03AC
0x03AD
0x0B9D
0x0BA1

I then compared the READBACK2.BIN to the image I had originally written (nanddump1.bin) and get the same:

Comparing...
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
Can't check for bad blocks. No Spare data. Possibly Corona 4GB
0x03AB
0x03AC
0x03AD
0x0B9D
0x0BA1



So..... somehow the content of the Nand is changing once I disconnect power and attempt a boot?

Edit:

Questions I guess:

Can I try writing back one of my stock dumps and then WITHOUT disconnecting power go straight into trying to boot? (provided of course I remove the sd from the reader and flip the switch to x360)

I'm thinking perhaps the better solution attempt might be to get ahold of a correct latest version 4gb r/w kit that will fit and mount flush and the board and try writing with that, but since I only have dumps from the current setup rebuilding the nand (from donor?) might be needed? I have the CPU key, so that should be doable?

 

[modguru]

this is my opinion and do not take it personaly ... i see that you have coldsoder in that photo http://i.imgur.com/egrS7jW.jpg the yelow wire is not very good solder ... my opinion is to try to build your retail image with jrunner or a donor if that is possible .and do not try to fix any pad or anything elese is fine and without this . next time DO NOT use kynar wire for that use awg 26 - 28 multicore cables .

 

[daretogo]

Okay, now this is just freaking weird.

I just used the "create image" option in Jrunner to create a retail 16202 image, and then wrote it to the console.

First boot = Red dot.
disconnect power, wait ten seconds reconnect power.
Second boot = E71
disconnect power, wait ten seconds reconnect power.
Third boot = frozen at swirling xbox logo
disconnect power, wait ten seconds reconnect power.
Fourth boot = Full dashboard, functional and working!!!!
disconnect power, wait ten seconds reconnect power.
Fifth boot = green dot, no display at all
disconnect power, wait ten seconds reconnect power.
Sixth boot = frozen at xbox swirling logo
disconnect power, wait ten seconds reconnect power.
Seventh boot = full dashboard working and all
disconnect power, wait ten seconds reconnect power.
Eighth boot = full dashboard working and all
disconnect power, wait ten seconds reconnect power.
Ninth boot = green dot, no onscreen display
disconnect power, wait ten seconds reconnect power.
tenth boot = full working dashboard.


WTF!!?!?!?!

 

[daretogo]

Resolved I guess.

After the intermittent ability to get to the dash using the Jrunner created 16202 image I went ahead and removed the 4gb r/w kit and cleaned up the nand solder pads and wouldn't ya know it, freaking thing is booting to the dash every time now.

Must have been some small bridging messing with the nand?

Hell if I know, but lesson learned bigtime: Buy more new version 4gb r/w kits so I can use them how they're intended.

(also to leave R2C6 / R2C7 bridged in the future, thanks Martin)

 

[BL4K3Y]

I went ahead and removed the 4gb r/w kit and cleaned up the nand solder pads and wouldn't ya know it, freaking thing is booting to the dash every time now.

Must have been some small bridging messing with the nand?

If the R/W QSB is installed correctly and you have the switch set to R/W, the console will not turn on - this is normal.

You must set the switch back to the X360 position after reading/writing your NAND image.

 

[Martin C]

I would say you were right about interference with the points being used. If these points are active while you try to boot, they'll stop the NAND from being read cleanly by the Southbridge.