FIXED Falcon 0022 error after failed RGH2 attempt

[xylor]

Hello everyone. This is my first post after many month of lurking. Apologies if this post has too much/too little information; this was my first attempt at glitching an Xbox 360.

Tools used:
* Nand-X
* Coolrunner Rev C

Short history of Falcon board:
* Obtained used/broken off Ebay (about a year ago?).
* Fixed board by reballing GPU and Hana (gave to daughter)
* A couple of weeks ago, daughter complained that XBox would not turn on
* Reflowed Hana chip. Tested for a couple of hours, and it worked fine.
* Attempted RGH2 :facepalm:

I had a Coolrunner Rev C that I had bought a few months ago that I wanted to try out on the board while it was open. I realize that R-Jtag is a better solution (I have one coming).

Steps taken during failed RGH2 attempt.
* Checked Dashboard version: 2.0.16202.0
* Installed Nand-X.
* Dumped nand 4x. All dumps gave back the same md5.
* Sanity check that the dump looked good (hexdump showed MS header, etc).
* (!!!) Upgraded Dashboard version via USB thumbdrive: 16537 (I *forgot* to re-dump nand :facepalm
** While writing this post, I believe *this* is my issue. While diagnosing this issue, I had believed that I had dumped the nand AFTER this upgrade. However, looking at the timestamp of the $systemupdate folder on the USB thumbdrive, JR-Runner's Log.txt, and the timestamp on nanddump1.bin, I am 90% sure that this is where I screwed up.
* Updated Coolrunner Rev C for RGH2. File used: falconrgh2.xsvf
* Installed Coolrunner Rev C with RGH2 wiring.
* Used nanddump1.bin to generate ECC: image_00000000.ecc
** Could the use of the wrong dump also be the reason that my glitch attempt failed?
* Wrote ECC to nand.
* Glitch failed. Attempted various Coolrunner Rev C settings, all failed. (Green light turned on/off during attempts)
* Gave up, decided to revert to stock nand (which I now believe I did *not* dump...)
* Wrote back nanddump1.bin.
* Re-dumped nand 4x times to verify write. (All md5 values matched original dump)
* Set Coolrunner Rev C to PRG
* All boot attempts gave 0022 error. (after ~25 seconds)
* Removed all wiring from board.
* Pulled trace on R4B24. :facepalm:
* Repaired R4B24(Repair attempt pictures, below)
* All boot attempts gave 0022 error. (after ~25 seconds)
* Reballed GPU.
* Reflowed Hana.
* GPU/CPU ohm check (looked good)
* All boot attempts still give 0022 error. (after ~25 seconds)


JR-Runner Log file:

View attachment Log.txt


JR-Runner screen shot:


Based on my assumption at the time that the nand re-write was valid, I have run many inspections of the solder points, as well the R4B24 repair:

J1D2 top and bottom:


J1D2 Voltages/Resistances (with PSU plugged in, amber light):
Voltages: (J1D2.1 and J1D2.3 values do not seem consistent? Show 0V with oscilloscope, show various values with Multi-meter)
* 1: Oscilloscope: 0V. Multi-meter: 0.80V, 0.67V, 0V
* 2: 3.29V
* 3: Oscilloscope: 0V. Multi-meter: 0.80V, 0.67V, 0V
* 4: 0V
* 5: 5.11V

Resistances: (Again, J1D2.1 and J1D2.3 values do not seem consistent?)
* 1: 1.17 MegaOhm, 203.0 kOhm
* 2: 6.40 MegaOhm
* 3: 1.11 MegaOhm, 196.5 kOhm
* 4: 40.0 Ohm
* 5: 6.45 MegaOhm

J2B1 top and bottom:


J2B1 Voltages/Resistances (with PSU plugged in, amber light):
Voltages:
* 1: 0V
* 2: 0V
* 3: 0V
* 4: 3.30V
* 5: 3.07V
* 6: 0V
* 7: 3.30V
* 8: 0V
* 9: 3.30V
* 10: 3.30V
* 11: 3.30V
* 12: 0V
* 13: 5.14V

Resistances:
* 1: 10.1 MegaOhm
* 2: 10.1 MegaOhm
* 3: (open loop)
* 4: 6.40 MegaOhm
* 5: 6.41 MegaOhm
* 6: 5.71 kOhm
* 7: 6.41 MegaOhm
* 8: 2.55 kOhm (fluctuates on initial read)
* 9: 6.41 MegaOhm
* 10: 6.41 MegaOhm
* 11: 6.41 MegaOhm
* 12: 0 Ohm
* 13: 6.45 MegaOhm

J8C1 top and bottom:


J8C1 Voltages/Resistances (with PSU plugged in, amber light):
Voltages:
* 1-8: 0V
* 9: 3.30V
* 10: 0V

Resistances:
* 1: 55.1 kOhm
* 2: 6.61 kOhm
* 3: 203.0 Ohm
* 4: 480 kOhm
* 5: 0 Ohm
* 6: 480 kOhm
* 7: 480 kOhm
* 8: 480 kOhm
* 9: 400 kOhm
* 10: 480 kOhm

FT6U7:


R4B24 repair:


R4B24 waveforms (with PSU plugged in, amber light):

C4N27 on bottom of board:

Replacement resistor, right lead:


FT2R2 on bottom of board:

Replacement resistor, left lead:


C4N27 <-> FT2R2 Resistance: 32.8 Ohm

GPU Reball:


GPU Ohm Test:
* C5D5: 1.4 Ohm

CPU Ohm Test:
* C7E5: 3.2 Ohm


As mentioned previous, while writing this post I now believe the issue is in the lost nand after the 16537 update. What are my options at this point? I am guessing I need to succeed in a glitch in order to retrieve the CPU key, and use that to create a replacement image? Is the ECC image I generated from the 16202 nand dump usable?

Any help on this issue would be greatly appreciated!

 

[Martin C]

Yes - you'll need your CPU key and xell. Read my LDV sticky.

 

[xylor]

Thanks for the response, Martin . I am currently in the process of wiring up the Coolrunner Rev C again.

Yes - you'll need your CPU key and xell. Read my LDV sticky.

I have seen you give this response many times . Being new, I can only assume when you say 'Read my LDV sticky' you mean read the link that says "Why is LDV important?" in your signature. I have been unable to find a 'List of Martin's awesome stickies' page. (That would be useful, heh)

Assuming you mean the 'Why is LDV important?' thread (which I have read), what is unclear to me is whether or not using the ECC built from the older (16202) nanddump1.bin file will suffice for my purposes. The LDV thread makes this assumption:

"Once you have the CPU key, this value can be directly entered into J-Runner to build a new image"

So, I guess my current question is: Do you believe my failed RGH2 attempt was due to bad ECC generation from an older (16202) dump, or should I go ahead and attempt the RGH2 with said ECC?

 

[Martin C]

You've not posted any of your Coolrunner wiring/soldering. The ECC wasn't the cause of the failure. TBH, you'd be better off wiring up R-JTAG as stated in my RGH Roadmap. RGH2 on Falcons is unpredictable at best.

 

[xlghost]

After 14719 dash ECC's aren't "generated" anymore... they use prebuilt bootloaders targeted to each motherboard revision to get around M$'s xor hack fix. The ecc you have from 16203 should work indefinitely... CF/CG LDV does not matter while glitching (although it might be why your stock NAND is throwing 0022)

 

[Martin C]

After 14719 dash ECC's aren't "generated" anymore... they use prebuilt bootloaders targeted to each motherboard revision to get around M$'s xor hack fix. The ecc you have from 16203 should work indefinitely... CF/CG LDV does not matter while glitching (although it might be why your stock NAND is throwing 0022)

If he updated to 16537 and then wrote back a previous dump, it's exactly why he's getting 0022

 

[xylor]

Ok, RGH2 glitch successful. I ended up using timing 'B', and a 560pF || 5kOhm trimmer on CPU_RESET to adjust it to a point that it booted into Xell. Initial boot times are about 45-90 seconds. Trimmer currently at ~1.5kOhm

Fusesets:
fuseset 00: c0ffffffffffffff
fuseset 01: 0f0f0f0f0f0f0ff0
fuseset 02: 000f00f0000f0000
... (cpu key) ...
fuseset 07: fffffffffff00000
fuseset 08: 0000000000000000
fuseset 09: 0000000000000000
fuseset 10: 0000000000000000
fuseset 11: 0000000000000000

I believe this translates to:

fuseset 7/8: CF/CG LDV 11
fuseset 2: cseq: 12
Falcon cseq 12 Highest Dashboard: 16203 (16537 should work?)

I will attempt to read through some other threads and see if I can rebuild a retail nand with this information.

 

[Martin C]

Your CB didn't change as you were on 16202 previously.

You can clearly see your 16202 image was on LDV 10, so make a retail NAND with LDV 11 (anything from 15572 onwards) and your console should work fine as retail.

 

[xylor]

That is exactly what I ended up trying. Success!

For anyone else that may be curious:

JR-Runner:
* Entered CPU key
* Loaded Source set to my old 16202 nand dump
* Advanced | Change Lock Down Value: 11 (based on my fusesets)
* XeBuild: 16537, Falcon, Retail
* Create XeBuild Image
* Write Nand

It now boots up again! (Coolrunner set to PRG)

Thanks for the help, Martin and xlghost!

 

[xylor]

(silly noob question: How do I modify this post title to have the colored red '[FIXED]' prefix?)

 

[Martin C]

Done