Jasper 512MB slow to glitch, fails at A0 & RATER counts cycles incorrectly

[jant90]

Console Type: Jasper
NAND size: 512
Dashboard version: 2.0.16203
CB version: e.g 6754
Screenshot of NAND details from J-Runner:

J-Runner log:

===================================================
zaterdag 17 augustus 2013 15:41:31


J-Runner v0.2 Beta (289) Started






Checking Files
Finished Checking Files
Version: 01
Flash Config: 0x00AA3020
CB Version: 6754
Version: 01
Flash Config: 0x00AA3020
CB Version: 6754
Reading Nand to C:\Documents and Settings\J-Runner\output\nanddump1.bin
Reading Nand
Done!
in 13:57 min:sec


Reading Nand to C:\Documents and Settings\J-Runner\output\nanddump2.bin
Initializing nanddump1.bin..
Reading Nand
Nand Initialization Finished
Done!
in 13:57 min:sec


Comparing...Takes a while on big nands
Nands are the same
Patching Jasper version 2.3 SMC at offset 0x12BA
XeLL file created Successfully jasper_hack_bigblock_aud_clamp.bin
Version: 01
Flash Config: 0x00AA3020
Writing Nand
jasper_hack_bigblock_aud_clamp.bin
Done!
in 0:17 min:sec

POST output from J-Runner (RATER output), this is pretty much the same for each DIP / voltage setting:

Version: 10
Power Up
Waiting for POST to change
Post 41 - VERIFY_OFFSET 
Post 40 - Entrypoint of CD reached 
Post 41 - VERIFY_OFFSET 
Post 40 - Entrypoint of CD reached 
Post 41 - VERIFY_OFFSET 
Post 40 - Entrypoint of CD reached 
Post 41 - VERIFY_OFFSET 
Post 40 - Entrypoint of CD reached 
Post 41 - VERIFY_OFFSET 
Post 40 - Entrypoint of CD reached 
Post 41 - VERIFY_OFFSET 
Post 40 - Entrypoint of CD reached 
Post 41 - VERIFY_OFFSET 
Post 40 - Entrypoint of CD reached 
Post 41 - VERIFY_OFFSET 
Post 40 - Entrypoint of CD reached 
Post 41 - VERIFY_OFFSET 
Post 40 - Entrypoint of CD reached 
Post 41 - VERIFY_OFFSET 
Post 40 - Entrypoint of CD reached 
Post 41 - VERIFY_OFFSET 
Post 40 - Entrypoint of CD reached 
Post 1B - RC4_DECRYPT 
Post 1C - SHA_COMPUTE 
Post 1D - SIG_VERIFY 
Post 1E - BRANCH 
Post 20 - CB entry point reached 
Post 21 - INIT_SECOTP 
Post A0 - Panic - VERIFY_SECOTP_6 
Post 10 - Payload/1BL started 
Post 11 - FSB_CONFIG_PHY_CONTROL 
Post 12 - FSB_CONFIG_RX_STATE 
Post 13 - FSB_CONFIG_TX_STATE 
Post 14 - FSB_CONFIG_TX_CREDITS 
Post 15 - FETCH_OFFSET 
Post 16 - FETCH_HEADER 
Post 17 - VERIFY_HEADER 
Post 18 - FETCH_CONTENTS 
Post 19 - HMACSHA_COMPUTE 
Post 1A - RC4_INITIALIZE 
Post 1B - RC4_DECRYPT 
Post 1C - SHA_COMPUTE 
Post 1D - SIG_VERIFY 
Post 1E - BRANCH 
Post 20 - CB entry point reached 
Post 21 - INIT_SECOTP 
Post A0 - Panic - VERIFY_SECOTP_6 
Post 10 - Payload/1BL started 
Post 11 - FSB_CONFIG_PHY_CONTROL 
Post 12 - FSB_CONFIG_RX_STATE 
Post 13 - FSB_CONFIG_TX_STATE 
Post 14 - FSB_CONFIG_TX_CREDITS 
Post 15 - FETCH_OFFSET 
Post 16 - FETCH_HEADER 
Post 17 - VERIFY_HEADER 
Post 18 - FETCH_CONTENTS 
Post 19 - HMACSHA_COMPUTE 
Post 1A - RC4_INITIALIZE 
Post 1B - RC4_DECRYPT 
Post 1C - SHA_COMPUTE 
Post 1D - SIG_VERIFY 
Post 1E - BRANCH 
Post 20 - CB entry point reached 
Post 21 - INIT_SECOTP 
Post A0 - Panic - VERIFY_SECOTP_6 
Most Fails(cumulative): 0xA0
Shutdown

Image of R-JTAG board:

Images of close-up soldering to motherboard:

Was the console working before you started: yes

Description of problem:
Glitching on this 512MB Jasper only works with 1.2V and dip 3 on (and of course 7 & 8 on) but is very slow (average around 9 to 10 glitch cycles). I tried al 18 combo's with at 1.2V, default V and 1.8V and all DIP settings.

Is there anything I can do to improve the glitch time or should I leave it like this?

Another issue (that I also had with my previous R-JTAG install) is that shutting down via RATER doesn't work. Booting works fine though but without shutting down RATER can't work automatically. I have to manually press the shut down button. Did I do something with the KIOSK wrong or could this be related to my issue with the JRP v2 described here: http://team-xecuter.com/forums/show...ve-and-can-I-perform-the-R-JTAG-with-the-JRP1?

Also, RATER counts the amount of glitch cycles incorrectly, I manually counted the cycles by looking at the green LED a few time and came to this: 11, 2, 8, 10. RATER however counted this: 3, 1, 3, 3. The POST log from this moment is this: http://pastebin.com/FS8iY6Uz. And a screenshot here:

 

[AllyNerd]

Have you tried the original cpu_rst point?

edit also read this http://team-xecuter.com/forums/show...-Turning-Console-Off?highlight=Rater+shutdown

seems your missing your nand wire

 

[jant90]

Thanks, it was the NAND cable indeed, stupid me! As for boot times, the original CPU_RST did not make a difference. What did make a difference was whether the console boots cold or not. When it's cold it always boots within 30 seconds (so 5-6 glitches I guess), and almost half of the time within 6 seconds (so 1 glitch I guess), I don't have exact results because I tested this without RATER when the console was put back together.

 

[AllyNerd]

Ok so is it working now or you still have problems

 

[jant90]

Yeah, it's working now, thanks . Also I found better results with the orig CPU_RST point as opposed to Martin_C's alt point. But I started with that because the guide said it solved a lot of RRoD problems. Will try the default point from now first.