RGH Jasper 512 bad block issue

[axelll]

I just tried to RGH an 512 BB Jasper, everything went smooth until writing nandflash.bin, so, the steps were:

1. Dumped 2 x 64 Mb NANDS. Got 6-7 bad blocks at 1D1 to 1D8(not sure since I don't have the log here, but they were not in first 50) in J-Runner. Not in first 50 so I wrote .ecc.

2. Glitch to XELL is instatnt every time

3. Wrote nandflash.bin from USB through RAW Flash, no boot, tried to write from J-Runner, same result

4. Opened NAND in 360 Flash tool - got a bad block at 3A(so in first 50) and one somewhere at 18D smth(not important)

I've updated the console to 14699 prior RGH'ing.

The question is, why J-Runner didn't gave me that bad block at reading?

Should I revert to stock NAND and use Nandpro + Martin C. block repair guide? Or, should I use NAND Healer, never used that software.

 

[Martin C]

1. Please post your nandflash.bin.log from J-Runner.

2. Did you get any write errors when using J-Runner to write it back?

 

[axelll]

Here is the log:

No Updates Found


Checking Files
Finished Checking Files
Jasper 512MB
Reading Nand to X:\J-Runner\output\nanddump1.bin
Cancelled
Jasper 512MB
Reading Nand to X:\J-Runner\output\nanddump1.bin
Arm Version: 3
Flash Config: 0x00AA3020
Reading Nand
Error: 250 reading block 1D0
Error: 210 reading block 1D1
Error: 210 reading block 1D2
Error: 210 reading block 1D3
Error: 210 reading block 1D4
Error: 210 reading block 1D5
Error: 210 reading block 1D6
Error: 210 reading block 1D7
Error: 250 reading block C68
Done!

Reading Nand to X:\J-Runner\output\nanddump2.bin
Initializing Nand..
Arm Version: 3
Flash Config: 0x00AA3020
Reading Nand
Error: 250 reading block 1D0
Error: 210 reading block 1D1
Error: 210 reading block 1D2
Error: 210 reading block 1D3
Error: 210 reading block 1D4
Error: 210 reading block 1D5
Error: 210 reading block 1D6
Error: 210 reading block 1D7
Error: 250 reading block C68
Done!

---------- Post added at 09:45 ---------- Previous post was at 09:44 ----------

No, no error from J-Runner when writing back, I'll post a pic with the errors when trying to write with RAW Flash

 

[axelll]

RAW Flash from XELL attached.

 

[axelll]

Also, I should specifiy that I was the first one to update the console, she was at 2.0.7363. Updated to 14699: LDV = 1. Unfortunately, CB was 6750 so I couldn't JTAG the console.

 

[WalangAlam]

uncheck DashLaunch Patches then write with j-runner
J-runner automatically remap bad blocks

 

[axee44]

RAW Flash from XELL attached.

Might be wrong but 200 blocks for 64MB nand seems bit odd.
I was retrieving dvd key form 256MB jasper last night and rawflash wrote 200blocks as well, but it boots fine (i only needed firs 50 blocks anyway). Maybe try to write your nand using nand-x??

 

[axelll]

Already tried to write with J-Runner through NAND-X and RAW Flash. I don't understand what you mean by "write your nand using nand-x".

 

[axee44]

Oh... selective reading issue lol.
yeah i was thinking to try and write it with with nand-x (j-runner) but you already did that. Sorry, my bad.

 

[axelll]

Martin, any idea? Should I try to glitch the console with NANDPRO + remapping bad blocks?(Fib3R and your tuts?) I think that, dumping the NAND with NANDPRO will show the 3A bad block, right?

Could that problem be a J-Runner flaw?

---------- Post added at 10:42 ---------- Previous post was at 10:38 ----------

uncheck DashLaunch Patches then write with j-runner
J-runner automatically remap bad blocks

I'll try that before doing anything else, thanx !

 

[socalbill]

nothing is wrong with JRunner, 1D0 hex divided by 8 is 3A which is correct...you should make sure your glitched image matches the bad blocks in the orig nand

 

[axelll]

nothing is wrong with JRunner, 1D0 hex divided by 8 is 3A which is correct...you should make sure your glitched image matches the bad blocks in the orig nand

It does, nandflash.bin has the same bad blocks when opened in 360 Flashtool: 3A and 18D

 

[Martin C]

Why haven't you attached your nandflash.bin.log from J-runner?

I need to see what XeBuild is doing with your image.

 

[axelll]

Why haven't you attached your nandflash.bin.log from J-runner?

I need to see what XeBuild is doing with your image.

What I posted before, is the only thing saved in J-Runner log, I'll follow the steps again a little later and post the results.
Sorry, noob of me...I'll attach that when I get home.

---------- Post added at 11:49 ---------- Previous post was at 11:42 ----------

log attached:

 

[Martin C]

ok -

bad block at 0x3a (raw offset 0x77a000), block ignored
bad block at 0x18d (raw offset 0x332d000), block ignored
block 0x18d was remapped to block 0x1fe at remap instance 1
block 0x3a was remapped to block 0x1ff at remap instance 0
done!
cleaning up stray remaps
done!
--remap summary--
0: source: 0x003a dest: 0x01ff
1: source: 0x018d dest: 0x01fe

I think the 0x3a is a red herring. Build the image with remapping disabled and flash to your console.

 

[axelll]

ok -

bad block at 0x3a (raw offset 0x77a000), block ignored
bad block at 0x18d (raw offset 0x332d000), block ignored
block 0x18d was remapped to block 0x1fe at remap instance 1
block 0x3a was remapped to block 0x1ff at remap instance 0
done!
cleaning up stray remaps
done!
--remap summary--
0: source: 0x003a dest: 0x01ff
1: source: 0x018d dest: 0x01fe

I think the 0x3a is a red herring. Build the image with remapping disabled and flash to your console.

OK, thanx, I'll try and let you Know the result.
And I should do that with nandpro, right? Thanx

---------- Post added at 12:50 ---------- Previous post was at 12:41 ----------

Got it, I just must set the option below to true in options.ini.

; this will skip applying any bad block remapping to the final image (true/false)
noremap = false

 

[axelll]

I tried to set noremap to true but, J-runner, sets the option back to false automatically. What else should I modify in options.ini?

 

[axelll]

Managed to disable remap with 360 Multibuilder, still the same. Log below:


---------------------------------------------------------------
xeBuild v1.01.421
---------------------------------------------------------------
building glitch image
per build directory overridden from command line to 'my360'
data directory overridden from command line to '14719'
Using PATCHSMC option
file name overridden from command line to 'updflash.bin'

------ parsing user ini at '.\my360\options.ini' ------
loading file...done!
pre-parsing and sanitizing
done!
User options.ini loaded, 0x14e bytes in memory
loading cpukey.txt from .\my360\cpukey.txt
CPU Key set to: 0x8770DCD8CBA5402E09758B6FCFEC416A
setting 1blkey from ini: 0xDD88AD0C9ED669E7B56794FB68563EFA
1BL Key set to: 0xDD88AD0C9ED669E7B56794FB68563EFA sum: 0x983 (expects: 0x983)
xex Key set to: 0x20B185A59D28FDC340583FBB0896BF91 sum: 0x800 (expects: 0x800)
Using noremap option (ini file)
Using noecdremap option (ini file)

------ parsing ini at '.\14719\_glitch.ini' ------
ini version 14699

ini: label [jasperbl] found
found (1) 'cb_6750.bin' crc: 0xf7afa8cc
found (2) 'none' crc: 0x00000000
found (3) 'cd_8453.bin' crc: 0x25e0acd0
found (4) 'ce_1888.bin' crc: 0xff9b60df
found (5) 'cf_14699.bin' crc: 0x6fb4d90e
found (6) 'cg_14699.bin' crc: 0xbccc9fe1

ini: label [flashfs] found
found (1) 'aac.xexp' crc: 0x36790e61
found (2) 'bootanim.xex' crc: 0x187ede71
found (3) 'createprofile.xex' crc: 0x81d7a946
found (4) 'dash.xex' crc: 0x3957764c
found (5) 'deviceselector.xex' crc: 0x6246b4c0
found (6) 'gamerprofile.xex' crc: 0xb7add96a
found (7) 'hud.xex' crc: 0x202eb5c8
found (8) 'huduiskin.xex' crc: 0x4c80fbe9
found (9) 'mfgbootlauncher.xex' crc: 0x254ad664
found (10) 'minimediaplayer.xex' crc: 0xd8d21cfc
found (11) 'nomni.xexp' crc: 0xbf36fdf7
found (12) 'nomnifwk.xexp' crc: 0xa837ae53
found (13) 'nomnifwm.xexp' crc: 0x93246a8a
found (14) 'SegoeXbox-Light.xtt' crc: 0x086eb344
found (15) 'signin.xex' crc: 0xecd9cab1
found (16) 'updater.xex' crc: 0x125cdb94
found (17) 'vk.xex' crc: 0x9c744d4c
found (18) 'xam.xex' crc: 0x0b764b88
found (19) 'xenonclatin.xtt' crc: 0xd5d17ff5
found (20) 'xenonclatin.xttp' crc: 0x7a507ad1
found (21) 'xenonjklatin.xtt' crc: 0xdde4a14c
found (22) 'xenonjklatin.xttp' crc: 0x945b7092
found (23) 'ximecore.xex' crc: 0x8d45ea14
found (24) 'ximedic.xex' crc: 0x1d992bfb
found (25) 'ximedic.xexp' crc: 0xc90a651a
found (26) 'launch.xex' crc: 0x19cece0a
found (27) 'lhelper.xex' crc: 0xeb581eb5
found (28) 'launch.ini' crc: 0x00000000

ini: label [security] found
found (1) 'crl.bin' crc: 0x00000000
found (2) 'dae.bin' crc: 0x00000000
found (3) 'extended.bin' crc: 0x00000000
found (4) 'secdata.bin' crc: 0x00000000
------ ini parsing completed ------

output name overridden to: updflash.bin


------ Checking .\my360\nanddump.bin ------
Loading NAND dump (0x28ee70 bytes)...done!
Detecting NAND controller type from dump data...
NAND dump is from a big block machine
NAND dump uses big block controller
parsing dump into user and spare...


**************** WARNING *************************
nanddump.bin has NAND memory unit data, make
sure you back up any important data off the
internal MU before flashing a new image!
****************************************************

bad block at 0x3a (raw offset 0x77a000), block ignored
bad block at 0x18d (raw offset 0x332d000), block ignored
block 0x18d was remapped to block 0x1fe at remap instance 1
block 0x3a was remapped to block 0x1ff at remap instance 0
done!
Discarding remap data as NOREMAP was specified!
decrypting KeyVault at address 0x4000 of size 0x4000
keyvault decrypted OK, will use if no kv.bin is provided
decrypting SMC at address 0x1000 of size 0x3000
SMC decrypted OK, will use if no external smc.bin is provided
seeking smc config in dump...found at offset 0x3be0000! Using if no smc config is provided.
CF slot 0 decrypted ok LDV 0x01 Pairing: 0xcb7e80
setting LDV from image to 1
setting pairing data from image to 0xcb7e80
MobileB.dat found at page 0x1c30c, size 2048 (0x800) bytes
MobileC.dat found at page 0x1c300, size 512 (0x200) bytes
MobileD.dat found at page 0x1c304, size 2048 (0x800) bytes
MobileE.dat found at page 0x1c308, size 1536 (0x600) bytes
seeking security files...fsroot found at page 0x1c560 raw offset 0x65f1600
crl.bin found in sector 0x32f size 0x9e0...verified! Will use if external file not found.
extended.bin found in sector 0x34a size 0x4000...verified! Will use if external file not found.
secdata.bin found in sector 0x348 size 0x400...verified! Will use if external file not found.
Writing initial header to flash image

------ Loading bootloaders and required security files ------
reading .\my360\smc.bin failed, using smc.bin from nand dump
reset smc load address to 0x1000 size 0x3000
reading .\my360\kv.bin failed, using kv.bin from nand dump
reading .\14719\cb_6750.bin (0x9a40 bytes)
reading .\14719\cd_8453.bin (0x5780 bytes)
reading .\14719\ce_1888.bin (0x5606a b pad 0x56070 b)
reading .\my360\xell-gggggg.bin (0x40000 bytes)
reading .\14719\cf_14699.bin (0x4450 bytes)
reading .\14719\cg_14699.bin (0x67168 b pad 0x67170 b)
reading .\14719\bin\patches_fat.bin (0x6f0 bytes)
reading .\my360\smc_config.bin failed, using smc_config.bin from nand dump
-------------------
checking smc_config
-------------------
extracting config
------------------
SMC config info:
------------------
Target temps: Cpu: 80řC Gpu: 75řC Edram: 77řC
Max temps : Cpu: 95řC Gpu: 90řC Edram: 92řC
Cpu Fan : (auto)
Gpu Fan : (auto)
MAC Address : 00:22:48:d4:d3:e3
AVRegion : 0x00000300 (PAL50)
GameRegion : 0x02fe (PAL/EU)
DVDRegion : 2
resetKey : UAUL
---------------------
Checking for smc config data patches
smc config was not patched
---------------------
done!

------ Patching BLs and modifying patches ------
Patching patches...
Patching patches to use 0xd0010 as patch offset in flash
Patching patches for alt power reason
Patches patched!
Patching BLs...Done!

------ Encrypting and finalizing bootloaders ------
encoding smc.bin size 0x3000
SMC checksum: 5b3aed00
known clean SMC found, type: Jasper v4.1(2.03)
patching smc at offset: 0x12ba
SMC hacked successfully
encoding kv.bin size 0x4000
decrypted keyvault has been set for reference
encoding cb_6750.bin size 0x9a40
CB 6750 seq 0x01070050 type: 0x01 cseq: 0x07 allow: 0x0050
expected fuses:
fuseset 00: C0FFFFFFFFFFFFFF
fuseset 01: 0F0F0F0F0F0F0FF0
fuseset 02: 000000F000000000 (sequence)
fuseset 02: 0000F00000000000 (allow cseq 5)
fuseset 02: 000000F000000000 (allow cseq 7)
encoding cd_8453.bin size 0x5a60
encoding ce_1888.bin size 0x56070
encoding xell-gggggg.bin size 0x40000
encoding cf_14699.bin size 0x4450
encoding cg_14699.bin size 0x67170
encoding patches_fat.bin size 0x3e0
done!

------ Adding bootloaders to flash image ------
adding smc.bin at raw offset 0x00001000 len 0x3000 (end 0x4000)
adding kv.bin at raw offset 0x00004000 len 0x4000 (end 0x8000)
adding cb_6750.bin at raw offset 0x00008000 len 0x9a40 (end 0x11a40)
adding cd_8453.bin at raw offset 0x00011a40 len 0x5a60 (end 0x174a0)
adding ce_1888.bin at raw offset 0x000174a0 len 0x56070 (end 0x6d510)
adding xell-gggggg.bin at raw offset 0x00070000 len 0x40000 (end 0xb0000)
adding cf_14699.bin at raw offset 0x000b0000 len 0x4450 (end 0xb4450)
adding cg_14699.bin at raw offset 0x000b4450 len 0x67170 (end 0xd0000, rest in fs)
adding patches_fat.bin at raw offset 0x000d0010 len 0x3e0 (end 0xd03f0)
Writing CG patch slot overflow data to sysupdate.xexp1 at raw offset 0x2b80000...done!

------ adding 28 firmware files ------
reading .\14719\aac.xexp (0x14000 bytes) (crc32: 0x36790e61 ini: 0x36790e61)
adding as aac.xexp1 at raw offset 0x2bcb5c0 len 0x00014000 (end 0x02bdf5c0)
reading .\14719\bootanim.xex (0x61000 bytes) (crc32: 0x187ede71 ini: 0x187ede71)
adding as bootanim.xex at raw offset 0x2be0000 len 0x00061000 (end 0x02c41000)
reading .\14719\createprofile.xex (0xc000 bytes) (crc32: 0x81d7a946 ini: 0x81d7a946)
adding as createprofile.xex at raw offset 0x2c41000 len 0x0000c000 (end 0x02c4d000)
reading .\14719\dash.xex (0x63a000 bytes) (crc32: 0x3957764c ini: 0x3957764c)
adding as dash.xex at raw offset 0x2c50000 len 0x0063a000 (end 0x0328a000)
reading .\14719\deviceselector.xex (0x9000 bytes) (crc32: 0x6246b4c0 ini: 0x6246b4c0)
adding as deviceselector.xex at raw offset 0x328a000 len 0x00009000 (end 0x03293000)
reading .\14719\gamerprofile.xex (0x1b000 bytes) (crc32: 0xb7add96a ini: 0xb7add96a)
adding as gamerprofile.xex at raw offset 0x3295000 len 0x0001b000 (end 0x032b0000)
reading .\14719\hud.xex (0x1e000 bytes) (crc32: 0x202eb5c8 ini: 0x202eb5c8)
adding as hud.xex at raw offset 0x32b3000 len 0x0001e000 (end 0x032d1000)
reading .\14719\huduiskin.xex (0x13000 bytes) (crc32: 0x4c80fbe9 ini: 0x4c80fbe9)
adding as huduiskin.xex at raw offset 0x32d2000 len 0x00013000 (end 0x032e5000)
reading .\14719\mfgbootlauncher.xex (0x8000 bytes) (crc32: 0x254ad664 ini: 0x254ad664)
adding as mfgbootlauncher.xex at raw offset 0x32e7000 len 0x00008000 (end 0x032ef000)
reading .\14719\minimediaplayer.xex (0xc000 bytes) (crc32: 0xd8d21cfc ini: 0xd8d21cfc)
adding as minimediaplayer.xex at raw offset 0x32f0000 len 0x0000c000 (end 0x032fc000)
reading .\14719\nomni.xexp (0xe000 bytes) (crc32: 0xbf36fdf7 ini: 0xbf36fdf7)
adding as nomni.xexp1 at raw offset 0x32fc000 len 0x0000e000 (end 0x0330a000)
reading .\14719\nomnifwk.xexp (0x2000 bytes) (crc32: 0xa837ae53 ini: 0xa837ae53)
adding as nomnifwk.xexp1 at raw offset 0x330a000 len 0x00002000 (end 0x0330c000)
reading .\14719\nomnifwm.xexp (0x5000 bytes) (crc32: 0x93246a8a ini: 0x93246a8a)
adding as nomnifwm.xexp1 at raw offset 0x330e000 len 0x00005000 (end 0x03313000)
reading .\14719\SegoeXbox-Light.xtt (0x6000 bytes) (crc32: 0x086eb344 ini: 0x086eb344)
adding as SegoeXbox-Light.xtt at raw offset 0x3315000 len 0x00006000 (end 0x0331b000)
reading .\14719\signin.xex (0x16000 bytes) (crc32: 0xecd9cab1 ini: 0xecd9cab1)
adding as signin.xex at raw offset 0x331e000 len 0x00016000 (end 0x03334000)
reading .\14719\updater.xex (0x7000 bytes) (crc32: 0x125cdb94 ini: 0x125cdb94)
adding as updater.xex at raw offset 0x3336000 len 0x00007000 (end 0x0333d000)
reading .\14719\vk.xex (0x9000 bytes) (crc32: 0x9c744d4c ini: 0x9c744d4c)
adding as vk.xex at raw offset 0x333f000 len 0x00009000 (end 0x03348000)
reading .\14719\xam.xex (0x236000 bytes) (crc32: 0x0b764b88 ini: 0x0b764b88)
adding as xam.xex at raw offset 0x3349000 len 0x00236000 (end 0x0357f000)
reading .\14719\xenonclatin.xtt (0x11b000 bytes) (crc32: 0xd5d17ff5 ini: 0xd5d17ff5)
adding as xenonclatin.xtt at raw offset 0x3582000 len 0x0011b000 (end 0x0369d000)
reading .\14719\xenonclatin.xttp (0x18000 bytes) (crc32: 0x7a507ad1 ini: 0x7a507ad1)
adding as xenonclatin.xttp1 at raw offset 0x369f000 len 0x00018000 (end 0x036b7000)
reading .\14719\xenonjklatin.xtt (0x1a8000 bytes) (crc32: 0xdde4a14c ini: 0xdde4a14c)
adding as xenonjklatin.xtt at raw offset 0x36b8000 len 0x001a8000 (end 0x03860000)
reading .\14719\xenonjklatin.xttp (0x7000 bytes) (crc32: 0x945b7092 ini: 0x945b7092)
adding as xenonjklatin.xttp1 at raw offset 0x3860000 len 0x00007000 (end 0x03867000)
reading .\14719\ximecore.xex (0x15000 bytes) (crc32: 0x8d45ea14 ini: 0x8d45ea14)
adding as ximecore.xex at raw offset 0x3867000 len 0x00015000 (end 0x0387c000)
reading .\14719\ximedic.xex (0x90000 bytes) (crc32: 0x1d992bfb ini: 0x1d992bfb)
adding as ximedic.xex at raw offset 0x387d000 len 0x00090000 (end 0x0390d000)
reading .\14719\ximedic.xexp (0x2800 bytes) (crc32: 0xc90a651a ini: 0xc90a651a)
adding as ximedic.xexp1 at raw offset 0x3910000 len 0x00002800 (end 0x03912800)
reading .\14719\launch.xex (0xb000 bytes) (crc32: 0x19cece0a ini: 0x19cece0a)
adding as launch.xex at raw offset 0x3912800 len 0x0000b000 (end 0x0391d800)
reading .\14719\lhelper.xex (0x6000 bytes) (crc32: 0xeb581eb5 ini: 0xeb581eb5)
adding as lhelper.xex at raw offset 0x391f000 len 0x00006000 (end 0x03925000)
reading .\14719\launch.ini (0x294 bytes)
adding as launch.ini at raw offset 0x3926000 len 0x00000294 (end 0x03926294)

------ adding 4 security files ------
<- Processing crl.bin ->
reading .\my360\crl.bin (0xa00 bytes)
crl appears crypted, attempting to decrypt with CPU key...failed! Trying alternate key...success!
adding as crl.bin at raw offset 0x392c000 len 0x00000a00 (end 0x0392ca00)

<- Processing dae.bin ->
reading .\my360\dae.bin (0xad30 bytes)
dae appears encrypted, attempting to decrypt with CPU key...failed! Attempting to decrypt with alternate key...
success!
adding as dae.bin at raw offset 0x3930000 len 0x0000ad30 (end 0x0393ad30)

<- Processing extended.bin ->
reading .\my360\extended.bin (0x4000 bytes)
adding as extended.bin at raw offset 0x393c000 len 0x00004000 (end 0x03940000)

<- Processing secdata.bin ->
reading .\my360\secdata.bin (0x400 bytes)
adding as secdata.bin at raw offset 0x3940000 len 0x00000400 (end 0x03940400)

------ checking for Mobile*.dat ------
MobileB.dat found, adding from nanddump.bin
adding MobileB.dat as type 0x31 at raw offset 0x3960000 len 0x800 (end 0x3960800)
MobileC.dat found, adding from nanddump.bin
adding MobileC.dat as type 0x32 at raw offset 0x3960800 len 0x200 (end 0x3960a00)
MobileD.dat found, adding from nanddump.bin
adding MobileD.dat as type 0x33 at raw offset 0x3961000 len 0x800 (end 0x3961800)
MobileE.dat found, adding from nanddump.bin
adding MobileE.dat as type 0x34 at raw offset 0x3961800 len 0x600 (end 0x3961e00)

------ adding smc_config.bin ------
adding smc config to offset 0x03be0000, len 0x400

------ finalizing image ------
Fixing up empty FS block entries...done!
Writing FS table to image...done!
fixing up big block LBA numbers in spare...done!
calculating ECD bytes and assembling raw image...done!
writing file 'updflash.bin' to disk...done!
updflash.bin written OK

---------------------------------------------------------------
updflash.bin image built, info:
---------------------------------------------------------------
Console : Jasper (big block)
NAND size: 64MiB + NAND MU area
Build : Glitch
Xell : power on console with console eject button
CPU Key : 8770DCD8CBA5402E09758B6FCFEC416A
1BL Key : DD88AD0C9ED669E7B56794FB68563EFA
DVD Key : 0397CDAFE11DB233533F5B9CAC626D47
CF LDV : 1
KV type : type2 (hashed)
---------------------------------------------------------------
xeBuild Finished. Have a nice day.
---------------------------------------------------------------

 

[Martin C]

Can you make sure your console still boots from the stock NAND?

 

[axelll]

I'm just writing the stock NAND back, I'll let you know.