R-JTAG not resetting?

[Taijigamer2]

Hi everyone, so i've decided to bite the bullet and ask for help. I've done a few Jtags a few years ago back when there was still a few exploitable consoles about but have decided to try to R-JTAG a box. I'm new to the reset approach to exploits and dont know how to decipher Rater codes. So here we go....

Console Type: Jasper
NAND size: 16
Dashboard version: 2.0.15574
CB version: 6754
Screenshot of NAND details from J-Runner:

J-Runner log:
POST output from J-Runner (either POST_OUT monitor or RATER output):


updflash.bin log (if applicable):

Image of R-JTAG board:
Images of close-up soldering to motherboard:



Description of problem:

Just looking for some advice to see if im at least heading in the right direction. Im assuming that the POST QSB is ok because im getting a Rater output? Also, im using Martin C's alt Cpu_rst point so the wires a little long, i dont know if that has an effct at this stage. also im not sure if the point at the end of the v3 qsb is supposed to be soldered to the resistor there? The R-JTAG board red led is always on but no green flash?? Any help is greatly appreciated.

Was the console working before you started: Y

 

[BL4K3Y]

Your POST output is wrong.

Apply some flux and a little bit more solder to each POST pad on the QSB and run RATER again - the soldering on the v3 QSB could also be improved.

Am I correct in assuming that you have written XeLL to the console's NAND?

Also, make sure that dip switches 7 and 8 are ON and then try each of the remaining dip switches - one at a time.

 

[Taijigamer2]

Thankyou for the quick reply, this is exactly the sort of imput i was looking for. Lol, i know my soldering isnt the tidiest but i use flux and have observed wicking between the qsb and the pads using 3.5x loops. I will go back and apply more flux + solder. Sorry, i didnt include nand logs because that part im comfortable with, i have written jasper_aud_clamp.bin to nand, no errors on read or write. Dip 7+8 are on and i have tried dips 4 + 5 so far but i wanted to know where i was with reagards to Rater before i started groping around in the dark. Is the cpu_rst wire ok or should i try the underside point and shorten it? I will probably come back to it in the morning now as i should get some sleep at some point this week Thanks again.

 

[BL4K3Y]

Try and get a good POST output first.

Do as I suggested in my previous post with the POST QSB and post your new RATER log please.

 

[Taijigamer2]

Will do.

 

[DreamZ]

It is defo the post qsb. Im sure I can see 3 at least not making a good connection.

Once all post points are soldered properly you will see a big change in rater

 

[briggs01]

some of those solder points look like they are no where near touching

i would say the point on the aud clamp under jtag isnt conected either

 

[Taijigamer2]

some of those solder points look like they are no where near touching

i would say the point on the aud clamp under jtag isnt conected either

Thanks for the imput, i know it looks like it from above but there is clear connection as far as i can see with my 3.5x loops but i will look over the qsb again ( i much prefer a couple of diodes and a jumper but the qsb does have adjustable values

Im using aud clamp option so i didnt think that point neede to be connected, i will go back and join him up.

 

[Taijigamer2]

*update*

Ok after taking the advice i touched up the points on the POST qsb and reflashed to stock just to make sure everything was ok. then reflashed xell

Checking Console..
Version: 10
Flash Config: 0x00023010
CB Version: 6754
Initializing jasper_hack_aud_clamp.bin..
Header is wrong..
Nand Initialization Finished
Initializing nanddump1.bin..
Nand Initialization Finished
Patching Jasper version 2.3 SMC at offset 0x12BA
XeLL file created Successfully jasper_hack_aud_clamp.bin
Version: 10
Flash Config: 0x00023010
Writing Nand
jasper_hack_aud_clamp.bin
Done!
in 0:18 min:sec

POST seems to be working now as im getting a coherent output

Version: 10
Power Up
Waiting for POST to change
Post 99 
Post 91 - Panic - THERMAL_MANAGEMENT 
Post 93 - Panic - TOO_MANY_CORES 
Post 1F 
Post E0 
Post 10 - Payload/1BL started 
Post 11 - FSB_CONFIG_PHY_CONTROL 
Post 12 - FSB_CONFIG_RX_STATE 
Post 13 - FSB_CONFIG_TX_STATE 
Post 14 - FSB_CONFIG_TX_CREDITS 
Post 15 - FETCH_OFFSET 
Post 16 - FETCH_HEADER 
Post 17 - VERIFY_HEADER 
Post 18 - FETCH_CONTENTS 
Post 19 - HMACSHA_COMPUTE 
Post 1A - RC4_INITIALIZE 
Post 1B - RC4_DECRYPT 
Post 1C - SHA_COMPUTE 
Post 1D - SIG_VERIFY 
Post 1E - BRANCH 
Post 20 - CB entry point reached 
Post 21 - INIT_SECOTP 
Post A0 - Panic - VERIFY_SECOTP_6 
Post 01 
Post 10 - Payload/1BL started 
Post 11 - FSB_CONFIG_PHY_CONTROL 
Post 12 - FSB_CONFIG_RX_STATE 
Post 13 - FSB_CONFIG_TX_STATE 
Post 14 - FSB_CONFIG_TX_CREDITS 
Post 15 - FETCH_OFFSET 
Post 16 - FETCH_HEADER 
Post 17 - VERIFY_HEADER 
Post 18 - FETCH_CONTENTS 
Post 19 - HMACSHA_COMPUTE 
Post 1A - RC4_INITIALIZE 
Post 1B - RC4_DECRYPT 
Post 1C - SHA_COMPUTE 
Post 1D - SIG_VERIFY 
Post 1E - BRANCH 
Post 20 - CB entry point reached 
Post 21 - INIT_SECOTP 
Post A0 - Panic - VERIFY_SECOTP_6 
Post 10 - Payload/1BL started 
Post 11 - FSB_CONFIG_PHY_CONTROL 
Post 12 - FSB_CONFIG_RX_STATE 
Post 13 - FSB_CONFIG_TX_STATE 
Post 15 - FETCH_OFFSET 
Post 16 - FETCH_HEADER 
Post 17 - VERIFY_HEADER 
Post 18 - FETCH_CONTENTS 
Post 19 - HMACSHA_COMPUTE 
Post 1A - RC4_INITIALIZE 
Post 1B - RC4_DECRYPT 
Post 1C - SHA_COMPUTE 
Post 1D - SIG_VERIFY 
Post 1E - BRANCH 
Post 20 - CB entry point reached 
Post 21 - INIT_SECOTP 
Post A0 - Panic - VERIFY_SECOTP_6 
Post 1B - RC4_DECRYPT 
Post 10 - Payload/1BL started 
Post 11 - FSB_CONFIG_PHY_CONTROL 
Post 12 - FSB_CONFIG_RX_STATE 
Post 13 - FSB_CONFIG_TX_STATE 
Post 14 - FSB_CONFIG_TX_CREDITS 
Post 15 - FETCH_OFFSET 
Post 16 - FETCH_HEADER 
Post 17 - VERIFY_HEADER 
Post 18 - FETCH_CONTENTS 
Post 19 - HMACSHA_COMPUTE 
Post 1A - RC4_INITIALIZE 
Post 1B - RC4_DECRYPT 
Post 1C - SHA_COMPUTE 
Post 1D - SIG_VERIFY 
Post 1E - BRANCH 
Post 20 - CB entry point reached 
Post 21 - INIT_SECOTP 
Post A0 - Panic - VERIFY_SECOTP_6 
Post 30 - VERIFY_OFFSET_4BL_CD 
Post 10 - Payload/1BL started 
Post 11 - FSB_CONFIG_PHY_CONTROL 
Post 12 - FSB_CONFIG_RX_STATE 
Post 13 - FSB_CONFIG_TX_STATE 
Post 14 - FSB_CONFIG_TX_CREDITS 
Post 15 - FETCH_OFFSET 
Post 16 - FETCH_HEADER 
Post 17 - VERIFY_HEADER 
Post 18 - FETCH_CONTENTS 
Post 19 - HMACSHA_COMPUTE 
Post 1A - RC4_INITIALIZE 
Post 1B - RC4_DECRYPT 
Post 1C - SHA_COMPUTE 
Post 1D - SIG_VERIFY 
Post 1E - BRANCH 
Post 20 - CB entry point reached 
Post 21 - INIT_SECOTP 
Post A0 - Panic - VERIFY_SECOTP_6 
Post 10 - Payload/1BL started 
Post 11 - FSB_CONFIG_PHY_CONTROL 
Post 12 - FSB_CONFIG_RX_STATE 
Post 13 - FSB_CONFIG_TX_STATE 
Post 15 - FETCH_OFFSET 
Post 16 - FETCH_HEADER 
Post 17 - VERIFY_HEADER 
Post 18 - FETCH_CONTENTS 
Post 19 - HMACSHA_COMPUTE 
Post 1A - RC4_INITIALIZE 
Post 1B - RC4_DECRYPT 
Post 1C - SHA_COMPUTE 
Post 1D - SIG_VERIFY 
Post 1E - BRANCH 
Post 20 - CB entry point reached 
Post 21 - INIT_SECOTP 
Post A0 - Panic - VERIFY_SECOTP_6 
Post E0 
Post 10 - Payload/1BL started 
Post 11 - FSB_CONFIG_PHY_CONTROL 
Post 12 - FSB_CONFIG_RX_STATE 
Post 13 - FSB_CONFIG_TX_STATE 
Post 14 - FSB_CONFIG_TX_CREDITS 
Post 15 - FETCH_OFFSET 
Post 16 - FETCH_HEADER 
Post 17 - VERIFY_HEADER 
Post 18 - FETCH_CONTENTS 
Post 19 - HMACSHA_COMPUTE 
Post 1A - RC4_INITIALIZE 
Post 1B - RC4_DECRYPT 
Post 1C - SHA_COMPUTE 
Post 1D - SIG_VERIFY 
Post 1E - BRANCH 
Post 20 - CB entry point reached 
Post 21 - INIT_SECOTP 
Post A0 - Panic - VERIFY_SECOTP_6 
Post 01 
Post 10 - Payload/1BL started 
Post 11 - FSB_CONFIG_PHY_CONTROL 
Post 12 - FSB_CONFIG_RX_STATE 
Post 13 - FSB_CONFIG_TX_STATE 
Post 14 - FSB_CONFIG_TX_CREDITS 
Post 15 - FETCH_OFFSET 
Post 16 - FETCH_HEADER 
Post 17 - VERIFY_HEADER 
Post 18 - FETCH_CONTENTS 
Post 19 - HMACSHA_COMPUTE 
Post 1A - RC4_INITIALIZE 
Post 1B - RC4_DECRYPT 
Post 1C - SHA_COMPUTE 
Post 1D - SIG_VERIFY 
Post 1E - BRANCH 
Post 20 - CB entry point reached 
Post 21 - INIT_SECOTP 
Post A0 - Panic - VERIFY_SECOTP_6 
Post 10 - Payload/1BL started 
Post 11 - FSB_CONFIG_PHY_CONTROL 
Post 12 - FSB_CONFIG_RX_STATE 
Post 13 - FSB_CONFIG_TX_STATE 
Post 14 - FSB_CONFIG_TX_CREDITS 
Post 15 - FETCH_OFFSET 
Post 16 - FETCH_HEADER 
Post 17 - VERIFY_HEADER 
Post 18 - FETCH_CONTENTS 
Post 19 - HMACSHA_COMPUTE 
Post 1A - RC4_INITIALIZE 
Post 1B - RC4_DECRYPT 
Post 1C - SHA_COMPUTE 
Post 1D - SIG_VERIFY 
Post 1E - BRANCH 
Post 20 - CB entry point reached 
Post 21 - INIT_SECOTP 
Post A0 - Panic - VERIFY_SECOTP_6 
Post 80 
Post 10 - Payload/1BL started 
Post 11 - FSB_CONFIG_PHY_CONTROL 
Post 12 - FSB_CONFIG_RX_STATE 
Post 13 - FSB_CONFIG_TX_STATE 
Post 14 - FSB_CONFIG_TX_CREDITS 
Post 15 - FETCH_OFFSET 
Post 16 - FETCH_HEADER 
Post 17 - VERIFY_HEADER 
Post 18 - FETCH_CONTENTS 
Post 19 - HMACSHA_COMPUTE 
Post 1A - RC4_INITIALIZE 
Post 1B - RC4_DECRYPT 
Post 1C - SHA_COMPUTE 
Post 1D - SIG_VERIFY 
Post 1E - BRANCH 
Post 20 - CB entry point reached 
Post 21 - INIT_SECOTP 
Post A0 - Panic - VERIFY_SECOTP_6 
Most Fails(cumulative): 0xA0
Shutdown

sorry for long POST output

Any suggestions would be greatly appreciated. This was using AUD clamp 470ohm dip 5,7,8 and R8c2 point for cpu_rst. Is it just a case of checking all combinations or is there something im missing. Thanks.

 

[DreamZ]

Now try diffrent dips.

78 and 4 then 78 6 etc. Try em all. Leave jtag qsb as it is for the moment

 

[Antalpromille]

The jtag QSB isnt involved at all at this stage. Untill you tried every dip systematicly at every voltage setting and both CPU_RST points, theres no need for more support.

 

[Taijigamer2]

Cheers man, just needed steering in the right direction. Like i said, old skool j-tag is what im used to. This is a whole new ball game. Will post back with results.

 

[Antalpromille]

Cheers man, just needed steering in the right direction. Like i said, old skool j-tag is what im used to. This is a whole new ball game. Will post back with results.

Np, just folllow the tutorial and you will probably be fine

 

[Taijigamer2]

Success! You guys rock.

Tried different dip settings and it turns out dip 3 was the sweet spot for this jasper. managed to successfully boot and was greated by an old friend. Retrieved cpu key and flashed R-Jtag nand via j-runner. Then the jr-programmer started to play up, turns out the firmware had spontaneously corrupted. Kept getting random CB?

Version: 10
Flash Config: 0x00023010
CB Version: 6911
Reading Nand to C:\Users\Sean\Downloads\J-Runner v02 Beta (283) Core Pack\J-Runner v02 Beta (283) Core Pack\output\nanddump1.bin
Cancelled
Version: 10
Flash Config: 0x00023010
CB Version: 6911
Reading Nand to C:\Users\Sean\Downloads\J-Runner v02 Beta (283) Core Pack\J-Runner v02 Beta (283) Core Pack\output\nanddump1.bin
Reading Nand
Done!
in 3:31 min:secInitializing nanddump1.bin..
Header is wrong..
Wrong CpuKey
System.NullReferenceException


Erasing Flash ...
Writing Flash: .............................................................................................................
Done!
Verifying Flash: .............................................................................................................
 Write Verified!
Restarting Device ...
Finished!
Bootloader Removed.
Bootloader Attached
Bootloader Version: 1.0.5
Bootloader Removed.
Checking Console..
Version: 10
Flash Config: 0x00023010
CB Version: 6723
Initializing nanddump1.bin..
CpuKey is Correct
Key already Exists
Nand Initialization Finished
Version: 10
Flash Config: 0x00023010
Writing Nand
nanddump1.bin
Done!
in 3:37 min:sec

So reflashed fw to jr-p. Back on track. But cant seem to get a better Rater score than 4.00 with boots within 12 cycles at best, tried all dips and voltage/jumper settings. keeps failing at 0x21 or sometimes 02E??

I couldnt get on with the v3 qsb so have reverted to a wires install on the top board. Keeping the bottom qsbs as they make life so much easier.

Going to go back and check wiring again tomorrow, not sure if its F or E or the Cpu_rst wire.

 

[Taijigamer2]

Ok, time to put this thread to bed. I've been a little slow on this project as have been juggling a few other projects and finding time for the family. So I applied some more flux and touched up points E,F and Cpu_rst which improved Rater score somewhat to around 5.0 trying dips 3 & 4 all jumper settings (all other dips yielded no boots at all). Got a good few insta-boots off dip 3, 1.2v jumper. The post did stop a few times at 02E but its a jasper so i'm not worried about RROD too much. Decided to move cpu_rst to original point on underside to pursue a better score. Now dip 4 is giving better results. Finally got a score of 5.47, with dip4, 1.2v. As you can see there are a few instaboots in there.



I've accepted this as a final setting as i have spent enough time resoldering wires and sooner or later im going to damage a point. Time to crack on and enjoy the homebrew goodness. Gave it a final tidy up and clean with isopropyl alcohol before reassembly. once it was reassembled and up and running, i'm getting a majority of insta-boots with the occasional 4-5 cycle boot.

A big thanks to Team Xecuter for this wonderful product and for bringing back the days of J-tag. Maybe i will chase that perfecto score on another install one day, but for now its time to just enjoy the results. :smile: