R-Jtag: Jasper no boot

wojtech.nettle

Full Member
Mar 4, 2013
56
0
Czech republic
Console Type: Jasper
NAND size: 512
Dashboard version: 2.0.16203
CB version: 6754
Screenshot of NAND details from J-Runner:
nand.jpg
J-Runner log:

Code:
[B][B][B][B][B][B]Checking Files
[/B][/B][/B][/B][/B][/B]Finished Checking Files
Checking Console..
Version: 01
Flash Config: 0x00AA3020
CB Version: 6754

R-Jtag Selected
Checking Console..
Version: 01
Flash Config: 0x00AA3020
CB Version: 6754
Version: 01
Flash Config: 0x00AA3020
CB Version: 6754
Jasper 512MB Manually Selected
Reading Nand to C:\Users\Vojczek\Downloads\J-Runner v03 (1) Core Pack\output\nanddump1.bin
Reading Nand
Error: 250 reading block 7E0
Done!
in 13:18 min:sec


Reading Nand to C:\Users\Vojczek\Downloads\J-Runner v03 (1) Core Pack\output\nanddump2.bin
Initializing nanddump1.bin..
Jasper BB
Nand Initialization Finished
Reading Nand
Error: 250 reading block 7E0
Done!
in 13:18 min:sec


Comparing...Takes a while on big nands
Nands are the same
Initializing nanddump1.bin..
Jasper BB
Nand Initialization Finished
Comparing...Takes a while on big nands


Patching Jasper version 2.3 SMC at offset 0x12BA
XeLL file created Successfully jasper_bb.bin
Version: 01
Flash Config: 0x00AA3020
Writing Nand
jasper_bb.bin
Done!
in 0:18 min:sec


Initializing nanddump1.bin..
CpuKey is Correct
Added Key to Database
Extracting..
Saving SMC_en.bin
Saving SMC_dec.bin
Saving KV_en.bin
Saving KV_dec.bin
Saving smc_config.bin
Finished
Jasper BB
Nand Initialization Finished
Moving All files from output folder to C:\Users\Vojczek\Downloads\J-Runner v03 (1) Core Pack\620444192805
Load Files Initiliazation Finished
Clean SMC detected
Patching Jasper version 2.3 SMC at offset 0x12BA
16203
Started Creation of the 16203 xebuild image
KV Info saved to file
---------------------------------------------------------------
     xeBuild v1.09.639
---------------------------------------------------------------
base path changed to C:\Users\Vojczek\Downloads\J-Runner v03 (1) Core Pack\xeBuild
---- { Image Build Mode } ----
building jtag image






****************  WARNING  *************************
  nanddump.bin has NAND memory unit data, make
  sure you back up any important data off the
  internal MU before flashing a new image!
****************************************************




******* WARNING: could not patch SMC reset limit!


---------------------------------------------------------------
C:\Users\Vojczek\Downloads\J-Runner v03 (1) Core Pack\620444192805\updflash.bin image built, info:
---------------------------------------------------------------
Kernel    : 2.0.16203.0
Console   : Jasper (big block)
NAND size : 64MiB (system only)
Build     : JTAG
Xell      : power on console with console eject button
Serial    : 620444192805
ConsoleId : 019582242856
MoboSerial: 7920939107639285
Mfg Date  : 07/09/2009
CPU Key   : DAB64CD3C062444D2D73D2B3B70C4FB2
1BL Key   : DD88AD0C9ED669E7B56794FB68563EFA
DVD Key   : FE6F1CC1129A466B120A3703AC25035D
CF LDV    : 10
KV type   : type2 (hashed - unchecked, master key not available)
---------------------------------------------------------------
    xeBuild Finished. Have a nice day.
---------------------------------------------------------------
Saved to C:\Users\Vojczek\Downloads\J-Runner v03 (1) Core Pack\620444192805
Image is Ready
Jasper 512MB Manually Selected
Version: 01
Flash Config: 0x00AA3020
Writing Nand
updflash.bin
Done!
[B][B][B][B][B][B]in 14:42 min:sec
[/B][/B][/B][/B][/B][/B]

POST output from J-Runner (either POST_OUT monitor or RATER output):

rater2.jpg

updflash.bin log (if applicable):

Code:
base path changed to C:\Users\Vojczek\Downloads\J-Runner v03 (1) Core Pack\xeBuild---- { Image Build Mode } ----
building jtag image
<enter> key on completion suppressed
data directory overridden from command line to '16203\'
per build directory overridden from command line to 'data\'
file name overridden from command line to 'C:\Users\Vojczek\Downloads\J-Runner v03 (1) Core Pack\620444192805\updflash.bin'


------ parsing user ini at 'data\options.ini' ------
loading file...done!
pre-parsing and sanitizing
done!
User options.ini loaded, 0x1b0 bytes in memory
loading cpukey.txt from data\cpukey.txt
CPU Key set to: 0xDAB64CD3C062444D2D73D2B3B70C4FB2 (weight:0x35 valid; ecd: valid)
setting 1blkey from ini: 0xDD88AD0C9ED669E7B56794FB68563EFA
1BL Key set to  : 0xDD88AD0C9ED669E7B56794FB68563EFA sum: 0x983 (expects: 0x983)
xex Key set to  : 0x20B185A59D28FDC340583FBB0896BF91 sum: 0x800 (expects: 0x800)
Using patchsmc option (ini file)


------ parsing ini at '16203\_jtag.ini' ------
ini version 16203


ini: label [jasperbl] found
found (1) 'cb_6723.bin' crc: 0xe9292b90
found (2) 'cd_6723.bin' crc: 0x0fcff305
found (3) 'ce_1888.bin' crc: 0xff9b60df
found (4) 'cf_4532.bin' crc: 0xd28ef722
found (5) 'cg_4532.bin' crc: 0x2530f8ce
found (6) 'cb_6750.bin' crc: 0xf7afa8cc
found (7) 'cd_8453.bin' crc: 0x25e0acd0
found (8) 'cf_16203.bin' crc: 0xc4c27121
found (9) 'cg_16203.bin' crc: 0xcbb44eac


ini: label [flashfs] found
found (1) 'aac.xexp' crc: 0x62924e10
found (2) 'bootanim.xex' crc: 0xc8b660b2
found (3) 'createprofile.xex' crc: 0x9f6efee2
found (4) 'dash.xex' crc: 0x18ea6c7e
found (5) 'deviceselector.xex' crc: 0x75c32b5b
found (6) 'gamerprofile.xex' crc: 0xec9746f7
found (7) 'hud.xex' crc: 0xabf19107
found (8) 'huduiskin.xex' crc: 0xf3563a5c
found (9) 'mfgbootlauncher.xex' crc: 0x763c73fe
found (10) 'minimediaplayer.xex' crc: 0xda1d0a4a
found (11) 'nomni.xexp' crc: 0xaae9ad36
found (12) 'nomnifwk.xexp' crc: 0xb3c2c31b
found (13) 'nomnifwm.xexp' crc: 0xf69cf9fc
found (14) 'SegoeXbox-Light.xtt' crc: 0xe0ee6049
found (15) 'signin.xex' crc: 0xc1d7185d
found (16) 'updater.xex' crc: 0x19286110
found (17) 'vk.xex' crc: 0xefcbab82
found (18) 'xam.xex' crc: 0xf8db3557
found (19) 'xenonclatin.xtt' crc: 0xd5d17ff5
found (20) 'xenonclatin.xttp' crc: 0x7a507ad1
found (21) 'xenonjklatin.xtt' crc: 0xdde4a14c
found (22) 'xenonjklatin.xttp' crc: 0xe2adddfb
found (23) 'ximecore.xex' crc: 0xe85e813b
found (24) 'ximedic.xex' crc: 0x1d992bfb
found (25) 'ximedic.xexp' crc: 0xfb2bb58c


ini: label [security] found
found (1) 'crl.bin' crc: 0x00000000
found (2) 'dae.bin' crc: 0x00000000
found (3) 'extended.bin' crc: 0x00000000
found (4) 'secdata.bin' crc: 0x00000000
------ ini parsing completed ------


output name overridden to: C:\Users\Vojczek\Downloads\J-Runner v03 (1) Core Pack\620444192805\updflash.bin


1BL RSA pub key file is not available, signature checks will not be performed
PIRS RSA pub key file is not available, signature checks will not be performed
MASTER RSA pub key file is not available, signature checks will not be performed


------ Checking data\nanddump.bin ------
data\nanddump.bin file size: 0x4200000
nanddump header checks passed OK!
Loading NAND dump (0x4200000 bytes)...done!
Detecting NAND controller type from dump data...
    NAND dump is from a big block machine
    NAND dump uses big block controller
parsing dump into user and spare...




****************  WARNING  *************************
  nanddump.bin has NAND memory unit data, make
  sure you back up any important data off the
  internal MU before flashing a new image!
****************************************************


bad block at 0xfc (raw offset 0x207c000), block ignored
copying nanddump data from block 0x1ff to block 0xfc for file extraction integrity
block 0xfc was remapped to block 0x1ff at remap instance 0
done!
cleaning up stray remaps
done!
--remap summary--
0: source: 0x00fc dest: 0x01ff
-----------------
decrypting KeyVault at address 0x4000 of size 0x4000
keyvault decrypted OK, will use if no kv.bin is provided
decrypting SMC at address 0x1000 of size 0x3000
SMC decrypted OK, will use if no external smc.bin is provided
seeking smc config in dump...found at offset 0x3be0000! Using if no smc config is provided.
CF slot 0 decrypted ok LDV 0x09 Pairing: 0x4df15a
CF slot 1 decrypted ok LDV 0x0a Pairing: 0x4df15a
setting LDV from image to 10
setting pairing data from image to 0x4df15a
pairing set to: 4d f1 5a
MobileB.dat found at page 0x1880c, size 2048 (0x800) bytes
MobileC.dat found at page 0x18800, size 512 (0x200) bytes
MobileD.dat found at page 0x18804, size 2048 (0x800) bytes
MobileE.dat found at page 0x18808, size 2048 (0x800) bytes
Statistics.settings found at page 0xef000, size 4096 (0x1000) bytes
seeking FSRoot...fsroot found at page 0x18c80 raw offset 0x5e9c800
seeking security files...
crl.bin found in sector 0x180 size 0xa00...verified! Will use if external file not found.
dae.bin found in sector 0x182 size 0xde60...verified! Will use if external file not found.
extended.bin found in sector 0x2c size 0x4000...verified! Will use if external file not found.
secdata.bin found in sector 0x183 size 0x400...verified! Will use if external file not found.
done!
Writing initial header to flash image


------ loading system update container ------
16203\su20076000_00000000 found, loading...done!
    Read 0xb31000 bytes to memory
checking integrity...
header seems valid, version 2.0.16203.0
header hash is OK, checking content hashes...
content hashes seem OK, everything looks good!
extracted SUPD\xboxupd.bin (0x79a60 bytes)
decrypting SUPD\xboxupd.bin\CF_16203.bin (0x4560 bytes)...done!
decrypting SUPD\xboxupd.bin\CG_16203.bin (0x754f2 bytes)...done!


------ Loading bootloaders and required security files ------
could not read 16203\bin\payload.bin, using built in payload (0x200 bytes)
reading data\SMC.bin (0x3000 bytes)
reset smc load address to 0x1000 size 0x3000
reading data\kv.bin failed, using kv.bin from nand dump
reading .\common\cb_6723.bin (0x9550 bytes)
loaded cb_6723.bin, could not check signature rsa key not present!
reading .\common\cd_6723.bin (0x56f0 bytes)
reading .\common\ce_1888.bin (0x5606a b pad 0x56070 b)
reading .\common\cf_4532.bin (0x44c0 bytes)
reading .\common\cg_4532.bin (0x2ef40 bytes)
extracted SUPD\xboxupd.bin\CF_16203.bin (0x4560 bytes)
extracted SUPD\xboxupd.bin\CG_16203.bin (0x754f2 bytes)
could not read 16203\bin\freeboot.bin, using built in core (0xd40 bytes)
reading 16203\bin\patches_jasper.bin (0x9d4 bytes)
reading data\xell-2f.bin (0x40000 bytes)
reading .\common\cb_6750.bin (0x9a40 bytes)
loaded cb_6750.bin, could not check signature rsa key not present!
reading .\common\cd_8453.bin (0x5780 bytes)
reading data\smc_config.bin failed, using smc_config.bin from nand dump
-------------------
checking smc_config
-------------------
extracting config
------------------
SMC config info:
------------------
Target temps: Cpu:  80řC Gpu:  71řC Edram:  73řC
Max temps   : Cpu:  95řC Gpu:  90řC Edram:  92řC
Cpu Fan     : (auto)
Gpu Fan     : (auto)
MAC Address : 00:22:48:b8:21:9d
AVRegion    : 0x00000300 (PAL50)
GameRegion  : 0x02fe (PAL/EU)
DVDRegion   : 2
resetKey    : XXUD
---------------------
Checking for smc config data patches
smc config was not patched
---------------------
could not check signature of cb_6723.bin, 1BL RSA key not present!
could not check signature of cb_6750.bin, 1BL RSA key not present!
done!


------ Patching boot reasons and options into flash header ------
    Patching header for xell power reason


------ Encrypting and finalizing bootloaders ------
Fuse CPU Key set to: 0xDAB64CD3C062444D2D73D2B3B70C4FB2
Fuse CF LDV set to : 0xFFFFFFFFFF0000000000000000000000
encoding payload.bin size 0x200 (JTAG)
patching payload.bin to load size 0xd40 (0x350 reps)
encoding SMC.bin size 0x3000 (JTAG)
SMC checksum: 45e7930b
unknown SMC found, type: Jasper v4.1(2.03)
jtag hack found in smc.bin!


******* WARNING: could not patch SMC reset limit!


encoding kv.bin size 0x4000 (JTAG)
decrypted keyvault has been set for reference
Master RSA pub not available, not checking hash
encoding cb_6723.bin size 0x9550 (JTAG)
CB 6723 seq 0x01050010 type: 0x01 cseq: 0x05 allow: 0x0010
    expected fuses:
    fuseset 00: C0FFFFFFFFFFFFFF
    fuseset 01: 0F0F0F0F0F0F0FF0
    fuseset 02: 0000F00000000000 (sequence)
    fuseset 02: 0000F00000000000 (allow cseq 5)
encoding cd_6723.bin size 0x56f0 (JTAG)
encoding ce_1888.bin size 0x56070 (JTAG)
encoding cf_4532.bin size 0x44c0 (JTAG)
encoding cg_4532.bin size 0x2ef40 (JTAG)
encoding cf_16203.bin size 0x4560 (JTAG)
encoding cg_16203.bin size 0x75500 (JTAG)
encoding freeboot.bin size 0xd40 (JTAG)
patching freeboot.bin with with kernel version string '16203'
Boot options set:
    - console DVD eject button is being used to start xell 
    - alternate xell button disabled
encoding patches_jasper.bin size 0x9d8 (JTAG)
encoding fuses.bin size 0x60 (JTAG)
encoding xell-2f.bin size 0x40000 (JTAG)
encoding cb_6750.bin size 0x9a40 (JTAG)
CB 6750 seq 0x01070050 type: 0x01 cseq: 0x07 allow: 0x0050
    expected fuses:
    fuseset 00: C0FFFFFFFFFFFFFF
    fuseset 01: 0F0F0F0F0F0F0FF0
    fuseset 02: 000000F000000000 (sequence)
    fuseset 02: 0000F00000000000 (allow cseq 5)
    fuseset 02: 000000F000000000 (allow cseq 7)
CBENC pairing set to: 4d f1 5a
encoding cd_8453.bin size 0x5780 (JTAG)


Virtual Fuses set to:
    fuseset 00: C0FFFFFFFFFFFFFF
    fuseset 01: 0F0F0F0F0F0F0FF0
    fuseset 02: 000000F000000000
    fuseset 03: DAB64CD3C062444D
    fuseset 04: DAB64CD3C062444D
    fuseset 05: 2D73D2B3B70C4FB2
    fuseset 06: 2D73D2B3B70C4FB2
    fuseset 07: FFFFFFFFFF000000
    fuseset 08: 0000000000000000
    fuseset 09: 0000000000000000
    fuseset 10: 0000000000000000
    fuseset 11: 0000000000000000
done!


------ Adding bootloaders to flash image ------
adding payload.bin at raw offset 0x00000200 len 0x200 (end 0x400)
adding SMC.bin at raw offset 0x00001000 len 0x3000 (end 0x4000)
adding kv.bin at raw offset 0x00004000 len 0x4000 (end 0x8000)
adding cb_6723.bin at raw offset 0x00008000 len 0x9550 (end 0x11550)
adding cd_6723.bin at raw offset 0x00011550 len 0x56f0 (end 0x16c40)
adding ce_1888.bin at raw offset 0x00016c40 len 0x56070 (end 0x6ccb0)
adding cf_4532.bin at raw offset 0x00070000 len 0x44c0 (end 0x744c0)
adding cg_4532.bin at raw offset 0x000744c0 len 0x2ef40 (end 0x80000, rest in fs)
adding cf_16203.bin at raw offset 0x00080000 len 0x4560 (end 0x84560)
adding cg_16203.bin at raw offset 0x00084560 len 0x75500 (end 0x90000, rest in fs)
adding freeboot.bin at raw offset 0x00090000 len 0xd40 (end 0x90d40)
adding patches_jasper.bin at raw offset 0x00091000 len 0x9d8 (end 0x919d8)
adding fuses.bin at raw offset 0x00095000 len 0x60 (end 0x95060)
adding xell-2f.bin at raw offset 0x00095060 len 0x40000 (end 0xd5060)
adding cb_6750.bin at raw offset 0x000d5060 len 0x9a40 (end 0xdeaa0)
adding cd_8453.bin at raw offset 0x000deaa0 len 0x5780 (end 0xe4220)
Writing zeropair CG patch slot overflow data to sysupdate.xexp1
    at raw offset 0x2b80000 len 0x00023400 (end: 0x02ba3400)...done!
Writing target CG patch slot overflow data to sysupdate.xexp2
    at raw offset 0x2b80000 len 0x00069a60 (end: 0x02be9a60)...done!


------ adding 25 firmware files ------
extracted SUPD\aac.xexp (0x14000 bytes) (crc32: 0x62924e10 ini: 0x62924e10)
    adding as aac.xexp2 at raw offset 0x2c0da60 len 0x00014000 (end 0x02c21a60)
extracted SUPD\bootanim.xex (0x61000 bytes) (crc32: 0xc8b660b2 ini: 0xc8b660b2)
    adding as bootanim.xex at raw offset 0x2c24000 len 0x00061000 (end 0x02c85000)
extracted SUPD\createprofile.xex (0xc000 bytes) (crc32: 0x9f6efee2 ini: 0x9f6efee2)
    adding as createprofile.xex at raw offset 0x2c85000 len 0x0000c000 (end 0x02c91000)
extracted SUPD\dash.xex (0x59c000 bytes) (crc32: 0x18ea6c7e ini: 0x18ea6c7e)
    adding as dash.xex at raw offset 0x2c94000 len 0x0059c000 (end 0x03230000)
extracted SUPD\deviceselector.xex (0xa000 bytes) (crc32: 0x75c32b5b ini: 0x75c32b5b)
    adding as deviceselector.xex at raw offset 0x3230000 len 0x0000a000 (end 0x0323a000)
extracted SUPD\gamerprofile.xex (0x1b000 bytes) (crc32: 0xec9746f7 ini: 0xec9746f7)
    adding as gamerprofile.xex at raw offset 0x323a000 len 0x0001b000 (end 0x03255000)
extracted SUPD\hud.xex (0x1d000 bytes) (crc32: 0xabf19107 ini: 0xabf19107)
    adding as hud.xex at raw offset 0x3257000 len 0x0001d000 (end 0x03274000)
extracted SUPD\huduiskin.xex (0x14000 bytes) (crc32: 0xf3563a5c ini: 0xf3563a5c)
    adding as huduiskin.xex at raw offset 0x3275000 len 0x00014000 (end 0x03289000)
extracted SUPD\mfgbootlauncher.xex (0x8000 bytes) (crc32: 0x763c73fe ini: 0x763c73fe)
    adding as mfgbootlauncher.xex at raw offset 0x328c000 len 0x00008000 (end 0x03294000)
extracted SUPD\minimediaplayer.xex (0xb000 bytes) (crc32: 0xda1d0a4a ini: 0xda1d0a4a)
    adding as minimediaplayer.xex at raw offset 0x3294000 len 0x0000b000 (end 0x0329f000)
extracted SUPD\nomni.xexp (0xe000 bytes) (crc32: 0xaae9ad36 ini: 0xaae9ad36)
    adding as nomni.xexp2 at raw offset 0x329f000 len 0x0000e000 (end 0x032ad000)
extracted SUPD\nomnifwk.xexp (0x2000 bytes) (crc32: 0xb3c2c31b ini: 0xb3c2c31b)
    adding as nomnifwk.xexp2 at raw offset 0x32ae000 len 0x00002000 (end 0x032b0000)
extracted SUPD\nomnifwm.xexp (0x5000 bytes) (crc32: 0xf69cf9fc ini: 0xf69cf9fc)
    adding as nomnifwm.xexp2 at raw offset 0x32b2000 len 0x00005000 (end 0x032b7000)
extracted SUPD\SegoeXbox-Light.xtt (0x6000 bytes) (crc32: 0xe0ee6049 ini: 0xe0ee6049)
    adding as SegoeXbox-Light.xtt at raw offset 0x32b9000 len 0x00006000 (end 0x032bf000)
extracted SUPD\signin.xex (0x16000 bytes) (crc32: 0xc1d7185d ini: 0xc1d7185d)
    adding as signin.xex at raw offset 0x32c2000 len 0x00016000 (end 0x032d8000)
extracted SUPD\updater.xex (0x7000 bytes) (crc32: 0x19286110 ini: 0x19286110)
    adding as updater.xex at raw offset 0x32da000 len 0x00007000 (end 0x032e1000)
extracted SUPD\vk.xex (0xb000 bytes) (crc32: 0xefcbab82 ini: 0xefcbab82)
    adding as vk.xex at raw offset 0x32e3000 len 0x0000b000 (end 0x032ee000)
extracted SUPD\xam.xex (0x24f000 bytes) (crc32: 0xf8db3557 ini: 0xf8db3557)
    adding as xam.xex at raw offset 0x32ef000 len 0x0024f000 (end 0x0353e000)
extracted nanddump\xenonclatin.xtt (0x11b000 bytes) (crc32: 0xd5d17ff5 ini: 0xd5d17ff5)
    adding as xenonclatin.xtt at raw offset 0x353f000 len 0x0011b000 (end 0x0365a000)
extracted SUPD\xenonclatin.xttp (0x18000 bytes) (crc32: 0x7a507ad1 ini: 0x7a507ad1)
    adding as xenonclatin.xttp2 at raw offset 0x365b000 len 0x00018000 (end 0x03673000)
extracted nanddump\xenonjklatin.xtt (0x1a8000 bytes) (crc32: 0xdde4a14c ini: 0xdde4a14c)
    adding as xenonjklatin.xtt at raw offset 0x3674000 len 0x001a8000 (end 0x0381c000)
extracted SUPD\xenonjklatin.xttp (0x7000 bytes) (crc32: 0xe2adddfb ini: 0xe2adddfb)
    adding as xenonjklatin.xttp2 at raw offset 0x381c000 len 0x00007000 (end 0x03823000)
extracted SUPD\ximecore.xex (0x17000 bytes) (crc32: 0xe85e813b ini: 0xe85e813b)
    adding as ximecore.xex at raw offset 0x3823000 len 0x00017000 (end 0x0383a000)
extracted nanddump\ximedic.xex (0x90000 bytes) (crc32: 0x1d992bfb ini: 0x1d992bfb)
    adding as ximedic.xex at raw offset 0x383b000 len 0x00090000 (end 0x038cb000)
extracted SUPD\ximedic.xexp (0x2800 bytes) (crc32: 0xfb2bb58c ini: 0xfb2bb58c)
    adding as ximedic.xexp2 at raw offset 0x38cc000 len 0x00002800 (end 0x038ce800)


------ adding 4 security files ------
<- Processing crl.bin ->
reading data\crl.bin (0xa00 bytes)
crl appears crypted, attempting to decrypt with CPU key...failed! Trying alternate key...success!
    adding as crl.bin at raw offset 0x38d0000 len 0x00000a00 (end 0x038d0a00)


<- Processing dae.bin ->
reading data\dae.bin (0xad30 bytes)
dae appears encrypted, attempting to decrypt with CPU key...failed! Attempting to decrypt with alternate key...
success!
    adding as dae.bin at raw offset 0x38d4000 len 0x0000ad30 (end 0x038ded30)


<- Processing extended.bin ->
reading data\extended.bin (0x4000 bytes)
    adding as extended.bin at raw offset 0x38e0000 len 0x00004000 (end 0x038e4000)


<- Processing secdata.bin ->
reading data\secdata.bin (0x400 bytes)
    adding as secdata.bin at raw offset 0x38e4000 len 0x00000400 (end 0x038e4400)


------ checking for Mobile*.dat ------
MobileB.dat found, adding from previous parse
    adding MobileB.dat as type 0x31 at raw offset 0x3900000 len 0x800 (end 0x3900800)
MobileC.dat found, adding from previous parse
    adding MobileC.dat as type 0x32 at raw offset 0x3900800 len 0x200 (end 0x3900a00)
MobileD.dat found, adding from previous parse
    adding MobileD.dat as type 0x33 at raw offset 0x3901000 len 0x800 (end 0x3901800)
MobileE.dat found, adding from previous parse
    adding MobileE.dat as type 0x34 at raw offset 0x3901800 len 0x800 (end 0x3902000)
Statistics.settings found, adding from previous parse
    adding Statistics.settings at raw offset 0x3bc0000 len 0x1000 (end 0x3bc1000)


------ adding smc_config.bin ------
adding smc config to offset 0x03be0000, len 0x400


------ finalizing image ------
Fixing up empty FS block entries...done!
Writing FS table to image offset 0x3920000 len 0x4000 (end 0x3924000)...done!
fixing up big block LBA numbers in spare...done!
calculating ECD bytes and assembling raw image...done!
remapping 1 blocks
    copying 0x21000 bytes of LBA 0xfc to block 0x1ff...zero fill origin...
        dest block is empty, fixing up LBA and ECD...done!
done remapping!


------ writing image to disk ------
writing file 'C:\Users\Vojczek\Downloads\J-Runner v03 (1) Core Pack\620444192805\updflash.bin' to disk...done!
---------------------------------------------------------------
C:\Users\Vojczek\Downloads\J-Runner v03 (1) Core Pack\620444192805\updflash.bin image built, info:
---------------------------------------------------------------
Kernel    : 2.0.16203.0
Console   : Jasper (big block)
NAND size : 64MiB (system only)
Build     : JTAG
Xell      : power on console with console eject button
Serial    : 620444192805
ConsoleId : 019582242856
MoboSerial: 7920939107639285
Mfg Date  : 07/09/2009
CPU Key   : DAB64CD3C062444D2D73D2B3B70C4FB2
1BL Key   : DD88AD0C9ED669E7B56794FB68563EFA
DVD Key   : FE6F1CC1129A466B120A3703AC25035D
CF LDV    : 10
KV type   : type2 (hashed - unchecked, master key not available)
---------------------------------------------------------------
    xeBuild Finished. Have a nice day.
---------------------------------------------------------------


Image of R-JTAG board:

DSCN0228.JPG

Images of close-up soldering to motherboard:

DSCN0229.JPGDSCN0235.JPGDSCN0236.JPGDSCN0237.JPGDSCN0238.JPG

Description of problem:

Jasper does not want to boot. I read the NAND, create Xell, write Xell and console boot. Then I create xebuild image and write nand. The console will not boot. I have patches DIP 7 and 8 on. I'm trying to gradually DIP 1 to 6 I tried also switch aud_clamp. When I turn on the xbox and R-JTAG about 4 flashes and then the panel D2, D1, D3 flashes red. I tried several times, but i dont know where is error :(

Was the console working before you started: Y
 
Last edited by a moderator:

chronic1553

VIP Member
Jun 5, 2010
258
33
USA
You might want to clean up the postout qsb points a little bit. see if that helps, if not you can try the alt cpu_rst point.

also use the rater and post the rater log.
 

XtregaGames

Full Member
Sep 26, 2013
61
0
What if you try booting to xell by starting console with eject button?

You have aud_clamp wire soldered, but have normal jtag selected with 1-2-3 jumper. Maybe put the jumper on 1-3 and try with aud_clamp. It gave better results on mine.
Also change the resistor value to 470, you have it on 330. 470 also gave better results on mine.

If you change jtag jumper to 1-3 you will now have aud_clamp selected, so you will have to build a new image in jrunner by selecting r-jtag and aud_clamp options. Flash it to console and try it now with different switch settings. Wait at least 10 tries with each switch setting.
 
Last edited:

Martin C

VIP Member
Jan 10, 2004
35,981
0
Scotland, UK
www.team-xecuter.com
When I wrote Xell, konzole boot normally and boot xell. I wrote CPU key and give it to J-runner.
Right, so after this why are you messing around with DIPs etc. It booted Xell. You can't be a million miles from a sweet spot.

Write your xell.bin again.
 

wojtech.nettle

Full Member
Mar 4, 2013
56
0
Czech republic
Martin: I forgot to write that my console once booted into NXE. So I think that the cpu key is fine. Then, when i was turn on - flashing three red LEDs (tried DIPS etc.). It can be RROD? I tried to write the original NAND and console functions normally.

What if you try booting to xell by starting console with eject button?

You have aud_clamp wire soldered, but have normal jtag selected with 1-2-3 jumper. Maybe put the jumper on 1-3 and try with aud_clamp. It gave better results on mine.
Also change the resistor value to 470, you have it on 330. 470 also gave better results on mine.

If you change jtag jumper to 1-3 you will now have aud_clamp selected, so you will have to build a new image in jrunner by selecting r-jtag and aud_clamp options. Flash it to console and try it now with different switch settings. Wait at least 10 tries with each switch setting.
OK I will try it.
 

morinzo

VIP Member
Oct 28, 2005
729
0
you need to have 1-3 selected for aud_clamp and in your pic you have 1-2

code tags on the logs would be nice too :cool2:
 
Last edited:

Dark_Riku

VIP Member
Mar 2, 2012
356
0
I fail to see why people are soldering to the STBY_CLK, it's not listed like that in the guide....
 

wojtech.nettle

Full Member
Mar 4, 2013
56
0
Czech republic
So I tried the following:

On motherboard: desolder Aud_clamp (only green cable) JTAG QSB and set it off.

In J-runner: I took stock NAND (with CPU key), selected - R-JTAG, Aud_clamp NO selected and I created and wrote xebuild Image updflash bin.

I tried all 18 combinations on R-JTAG motherboard (Dips 7 and 8 still power on and I tried with combinations 1-6). And I tried combinations with 1,2 V / 1,8 V / empty.

Console no boot - still flashing red LEDs after a while.

Then I tried:

On motherboard: I soldered wire for green Aud_clamp back and soldered points 1 to 3 QSB JTAG set it ON and 470.

In J-runner: I took stock NAND (with CPU key), selected - R-JTAG Aud_clamp selected too and I created and wrote xebuild Image updflash bin.

I tried again all 18 combinations. Console did not boot. But instead of flashing 3 red LED lights up in green and all console still boots. Only one was successful boot console (DIP 4,7,8 ON, 1.2V, Aud_clamp 470) When I tried it, then I still got the red LED on the panel. Sometimes the panel lights all green lights and the console boots still on.

Much I do not know what to do
 

Dark_Riku

VIP Member
Mar 2, 2012
356
0
So I tried the following:

On motherboard: desolder Aud_clamp (only green cable) JTAG QSB and set it off.

In J-runner: I took stock NAND (with CPU key), selected - R-JTAG, Aud_clamp NO selected and I created and wrote xebuild Image updflash bin.

I tried all 18 combinations on R-JTAG motherboard (Dips 7 and 8 still power on and I tried with combinations 1-6). And I tried combinations with 1,2 V / 1,8 V / empty.

Console no boot - still flashing red LEDs after a while.

Then I tried:

On motherboard: I soldered wire for green Aud_clamp back and soldered points 1 to 3 QSB JTAG set it ON and 470.

In J-runner: I took stock NAND (with CPU key), selected - R-JTAG Aud_clamp selected too and I created and wrote xebuild Image updflash bin.

I tried again all 18 combinations. Console did not boot. But instead of flashing 3 red LED lights up in green and all console still boots. Only one was successful boot console (DIP 4,7,8 ON, 1.2V, Aud_clamp 470) When I tried it, then I still got the red LED on the panel. Sometimes the panel lights all green lights and the console boots still on.

Much I do not know what to do
So have you tried the alternate CPU_RST on the topside of the board? I done a customer's Jasper last night that wouldn't boot the the life of me.

I then trimmed the CPU_RST (As short as possible as stated by the guide)

In the end, my console would only boot with 1.2V bridged, 4, 7 and 8 and 5, 7 and 8 with AUD_Clamp. I also edited the power mode to 8180. Increased my boot times to instant-2 cycles
 

wojtech.nettle

Full Member
Mar 4, 2013
56
0
Czech republic
Yes I tried. So I gave back CPU_RST to normal point (by the guide) and now console boot. Setting: 1.2V 4,7,8 with Aud_clamp. But glitch times are terrible. Can you help me shorten the blue wire as much as possible?

And is it normal that cooling fans running almost full when the console glitch?

And one more question. How can I edit the power mode? I have no experience with this.