Zephyr CR4 E79

gavin_darkglide · Jan 8, 2015

OK, so I have tried alot, as I am no noob, the multimeter checks check out, but i keep getting 1033 rrod after it glitches, with nothing on screen. if I write back stock, it boots fine, so I know the install is good. I have tried the rol jtag, and aud clamp, this box has me stumped. As for the glitch timing, I havnt started tuning, as I am trying to get cpu key.

Here is j-runner log, and rater log. I would post pictures, but I dont have a camera.

Images

https://www.dropbox.com/s/xz4edcog3yje6cu/100_2109.JPG?dl=0
https://www.dropbox.com/s/q1w7zstrfkue1s8/100_2105.JPG?dl=0
https://www.dropbox.com/s/2ve5aotvjjshpui/100_2106.JPG?dl=0
https://www.dropbox.com/s/xaal303mon7o06p/100_2107.JPG?dl=0
https://www.dropbox.com/s/xup6b6k4i0fj3t2/100_2108.JPG?dl=0
https://www.dropbox.com/s/xz4edcog3yje6cu/100_2109.JPG?dl=0

Code:

CR4 Selected
Version: 10
Power Up
Waiting for POST to change
Post 01 - . 
Post 03 - ... 
Post 04 - BOOT SEQUENCE STARTING 
Post 05 - ... 
Post 06 - .... 
Post 07 - ..... 
Post 08 - ...... 
Post 09 - ....... 
Post 0A - ........ 
Post 0B - ......... 
Post 0C - .......... 
Post 0D - GLITCH CHECK COMMENCE 
Post 0E - CB_B ENTRY REACHED 
Post 0F - GLITCH SUCCESSFUL 
Post 10 - ...... 
Post 01 - . 
Post 03 - ... 
Post 04 - BOOT SEQUENCE STARTING 
Post 05 - ... 
Post 06 - .... 
Post 07 - ..... 
Post 08 - ...... 
Post 09 - ....... 
Post 0A - ........ 
Post 0B - ......... 
Post 0C - .......... 
Post 0D - GLITCH CHECK COMMENCE 
Post 0E - CB_B ENTRY REACHED 
Post 0F - GLITCH SUCCESSFUL 
Post 10 - ...... 
Post 01 - . 
Post 03 - ... 
Post 04 - BOOT SEQUENCE STARTING 
Post 05 - ... 
Post 06 - .... 
Post 07 - ..... 
Post 08 - ...... 
Post 09 - ....... 
Post 0A - ........ 
Post 0B - ......... 
Post 0C - .......... 
Post 0D - GLITCH CHECK COMMENCE 
Post 0E - CB_B ENTRY REACHED 
Post 0F - GLITCH SUCCESSFUL 
Post 10 - ...... 
Post 01 - . 
Post 03 - ... 
Post 04 - BOOT SEQUENCE STARTING 
Post 05 - ... 
Post 06 - .... 
Post 07 - ..... 
Post 08 - ...... 
Post 09 - ....... 
Post 0A - ........ 
Post 0B - ......... 
Post 0C - .......... 
Post 0D - GLITCH CHECK COMMENCE 
Post 0E - CB_B ENTRY REACHED 
Post 0F - GLITCH SUCCESSFUL 
Post 10 - ...... 
Post 01 - . 
Post 03 - ... 
Post 04 - BOOT SEQUENCE STARTING 
Post 05 - ... 
Post 06 - .... 
Post 07 - ..... 
Post 08 - ...... 
Post 09 - ....... 
Post 0A - ........ 
Post 0B - ......... 
Post 0C - .......... 
Post 0D - GLITCH CHECK COMMENCE 
Post 0E - CB_B ENTRY REACHED 
Post 0F - GLITCH SUCCESSFUL 
Post 10 - ...... 
Post 01 - . 
Post 03 - ... 
Post 04 - BOOT SEQUENCE STARTING 
Post 05 - ... 
Post 06 - .... 
Post 08 - ...... 
Post 09 - ....... 
Post 0A - ........ 
Post 0B - ......... 
Post 0C - .......... 
Post 0D - GLITCH CHECK COMMENCE 
Post 0E - CB_B ENTRY REACHED 
Post 0F - GLITCH SUCCESSFUL 
Post 10 - ...... 
Post 01 - . 
Post 03 - ... 
Post 04 - BOOT SEQUENCE STARTING 
Post 05 - ... 
Post 06 - .... 
Post 07 - ..... 
Post 08 - ...... 
Post 09 - ....... 
Post 0A - ........ 
Post 0B - ......... 
Post 0C - .......... 
Post 0D - GLITCH CHECK COMMENCE 
Post 0E - CB_B ENTRY REACHED 
Post 0F - GLITCH SUCCESSFUL 
Post 10 - ...... 
Post 01 - . 
Post 03 - ... 
Post 04 - BOOT SEQUENCE STARTING 
Post 05 - ... 
Post 06 - .... 
Post 07 - ..... 
Post 08 - ...... 
Post 09 - ....... 
Post 0A - ........ 
Post 0B - ......... 
Post 0C - .......... 
Post 0D - GLITCH CHECK COMMENCE 
Post 0E - CB_B ENTRY REACHED 
Post 0F - GLITCH SUCCESSFUL 
Post 10 - ...... 
Post 01 - . 
Post 03 - ... 
Post 04 - BOOT SEQUENCE STARTING 
Post 05 - ... 
Post 06 - .... 
Post 07 - ..... 
Post 08 - ...... 
Post 09 - ....... 
Post 0A - ........ 
Post 0B - ......... 
Post 0C - .......... 
Post 0D - GLITCH CHECK COMMENCE 
Post 0E - CB_B ENTRY REACHED 
Post 0F - GLITCH SUCCESSFUL 
Post 10 - ...... 
Post 01 - . 
Post 03 - ... 
Post 04 - BOOT SEQUENCE STARTING 
Post 05 - ... 
Post 06 - .... 
Post 07 - ..... 
Post 08 - ...... 
Post 09 - ....... 
Post 0A - ........ 
Post 0B - ......... 
Post 0C - .......... 
Post 0D - GLITCH CHECK COMMENCE 
Post 0E - CB_B ENTRY REACHED 
Post 0F - GLITCH SUCCESSFUL 
Post 10 - ...... 
Post 01 - . 
Post 03 - ... 
Post 04 - BOOT SEQUENCE STARTING 
Post 05 - ... 
Post 06 - .... 
Post 07 - ..... 
Post 08 - ...... 
Post 09 - ....... 
Post 0A - ........ 
Post 0B - ......... 
Post 0C - .......... 
Post 0D - GLITCH CHECK COMMENCE 
Post 0E - CB_B ENTRY REACHED 
Post 0F - GLITCH SUCCESSFUL 
Post 10 - ...... 
Shutdown
CR4 Selected
Version: 10
Power Up
Waiting for POST to change
Post 01 - . 
Post 03 - ... 
Post 04 - BOOT SEQUENCE STARTING 
Post 05 - ... 
Post 06 - .... 
Post 07 - ..... 
Post 08 - ...... 
Post 09 - ....... 
Post 0A - ........ 
Post 0B - ......... 
Post 0C - .......... 
Post 0D - GLITCH CHECK COMMENCE 
Post 0E - CB_B ENTRY REACHED 
Post 0F - GLITCH SUCCESSFUL 
Post 10 - ...... 
Post 01 - . 
Post 03 - ... 
Post 04 - BOOT SEQUENCE STARTING 
Post 05 - ... 
Post 06 - .... 
Post 07 - ..... 
Post 08 - ...... 
Post 09 - ....... 
Post 0A - ........ 
Post 0B - ......... 
Post 0C - .......... 
Post 0D - GLITCH CHECK COMMENCE 
Post 0E - CB_B ENTRY REACHED 
Post 0F - GLITCH SUCCESSFUL 
Post 10 - ...... 
Post 01 - . 
Post 03 - ... 
Post 04 - BOOT SEQUENCE STARTING 
Post 05 - ... 
Post 06 - .... 
Post 07 - ..... 
Post 08 - ...... 
Post 09 - ....... 
Post 0A - ........ 
Post 0B - ......... 
Post 0C - .......... 
Post 0D - GLITCH CHECK COMMENCE 
Post 0E - CB_B ENTRY REACHED 
Post 0F - GLITCH SUCCESSFUL 
Post 10 - ...... 
Post 01 - . 
Post 03 - ... 
Post 04 - BOOT SEQUENCE STARTING 
Post 05 - ... 
Post 06 - .... 
Post 07 - ..... 
Post 08 - ...... 
Post 09 - ....... 
Post 0A - ........ 
Post 0B - ......... 
Post 0C - .......... 
Post 0D - GLITCH CHECK COMMENCE 
Post 0E - CB_B ENTRY REACHED 
Post 0F - GLITCH SUCCESSFUL 
Post 10 - ...... 
Post 11 - ....... 
Post 12 - ........ 
Post 15 - CONTINUING 
Post 16 - . 
Post 17 - .. 
Post 18 - ... 
Post 19 - .... 
Post 1A - ..... 
Post 1C - ....... 
Post 1E - . 
Post 1F - .. 
Post 20 - ... 
Post 21 - .... 
Post 22 - . 
Post 23 - .. 
Post 24 - Entrypoint reached 
Post 25 - ... 
Post 26 - .... 
Post 28 - ...... 
Post 29 - ....... 
Post 2A - ........ 
Post 2B - ......... 
Post 2C - ........... 
Post 2D - ............ 
Post 2E - LOAD XAM 
Post 2F - ............. 
Post 30 - .............. 
Post 31 - INIT KERNEL 
Post 32 
Post 33 
Post 34 
Post 35 
Post 36 
Post 37 
Post 38 
Post 39 
Post 3B 
Post 3C 
Post 3D 
Post 3F 
Shutdown

Code:

===================================================
Thursday, January 08, 2015 2:57:29 PM

J-Runner v0.3 Beta (7) Started


WARNING! - Your selected working directory already contains files!
You can view these files by using 'Show Working Folder' Button

Connection Error
Checking Files
Connection Error
Initializing nanddump1.bin..
Zephyr
Jtag Selected
Nand Initialization Finished
Version: 00
Wrong Version.
Version: 10
Flash Config: 0x01198010
Writing Nand
nanddump1.bin
Done!
in 3:55 min:sec

R-Jtag Selected
Patching Jasper version 2.3 SMC at offset 0x12BA
XeLL file created Successfully zephyr.bin
Version: 10
Flash Config: 0x01198010
Writing Nand
zephyr.bin
Done!
in 0:18 min:sec

Sorry about the mess of wires, I was planning on doing something with them once I got it to glitch.

BL4K3Y · Jan 8, 2015

Keep the AUD_CLAMP wiring and write a Zephyr R-JTAG AUD_CLAMP XeLL image to the console's NAND.

What resistance reading are you getting from J2D2.1 and J2D2.2 to ground?

By the way, you should find or borrow a camera and upload photos.

I'm not being funny, but everyone else has been asked to provide photos of their install(s).

Antalpromille · Jan 8, 2015

and the pictures?

Edit: sorry, missed the part about the camera. please post the values BL4K3Y asked for, and measure and make sure your jtag QSB is soldered correct and that there are no issues with your QSB.

gavin_darkglide · Jan 9, 2015

the values are j2d2.1 1.57kohm j2d2.2 1.59 kohm. it looks right, but i also tested continuity through the jtag qsb from j2d2.1 to aud_clamp, and j2d2.2 to smc debug, and they both have continiuity. though I was getting 1022 on stock with the 3 way switch set to anything but off, but then it stopped doing that all of a sudden. Stock still boots, the demon install is solid. I dont know if the gpu needs reflowed, or replaced.

Edit, now I am back to having the 0020 error on stock with the jtag 3way switch set. hold on, let me see if I can find a camera, it stopped doing this, then started again, I think the problem lies there.

Edit again: images added to op. Any Ideas, I tried smc_debug and the tiny point also on the jtag portion.

Taijigamer2 · Jan 9, 2015

GPU reflow?

gavin_darkglide · Jan 9, 2015

Thats what I was thinking, I am also thinking it might be the southbridge, as the demon is not resetting sbr propperly. I am going to get this other box done, and then i will come back to this one.

I think the soldering looked good. too bad rgh2+ doesnt work on zephyrs.

jsinger47 · Jan 9, 2015

Try a falcon nand

GeekHeat · Jan 9, 2015

gavin_darkglide said:
Thats what I was thinking, I am also thinking it might be the southbridge, as the demon is not resetting sbr propperly. I am going to get this other box done, and then i will come back to this one. I think the soldering looked good. too bad rgh2+ doesnt work on zephyrs.

A demon and a cr4 in a zephyr. Wouldn't be my choice of motherboard. I'm guessing its for a customer.

gavin_darkglide · Jan 9, 2015

jsinger47 said:
Try a falcon nand

I cant even get it to boot the ecc, it always get stuck at e79, and the glitch timing is kinda crappy. I was going to tune it after I got the cpu key, but the best I managed with the glitch timing was 11 cycles, but as I said, that was after trying 1 dip, as I was trying to get the cpu_key.

GeekHeat said:
A demon and a cr4 in a zephyr. Wouldn't be my choice of motherboard. I'm guessing its for a customer.

Yeah, it is for a customer, I told them it was a bad idea, because zephyrs are crap boards. they insisted. Even after I couldnt get it to boot they still insisted I installed the demon. Apparently they know someone with a rework setup, as I dont have the tools for that. As long as I get paid for my work, which is pretty good, I will be happy, then if they get it reballed, I will finish setting it up.

In other news, I think the problem might be a combination of the GPU, and the southbridge, the demon isnt proppely resetting it. I have to do the falcon turn it on with demon nand, and then hit the nand switch button before the smc resets with the stock smc. If I dont do this I get rrod 0022, or 0020, depending on how it feels. it was throwing up both. lol.

jsinger47 · Jan 9, 2015

gavin_darkglide said:
I cant even get it to boot the ecc, it always get stuck at e79, and the glitch timing is kinda crappy. I was going to tune it after I got the cpu key, but the best I managed with the glitch timing was 11 cycles, but as I said, that was after trying 1 dip, as I was trying to get the cpu_key.

And how does that prevent you from being able to use a falcon NAND?

joshypoo · Jan 9, 2015

Just a little info from my experience on Zephyrs

First off they fail just as much as a xenon, and run just as hot. they are basically a xenon with HDMI and ANA chip replaced with a Hana chip. i always adjust target temps on them ( not 12v fan mod. i think its a ghetto solution but some run it with no issues)

With RGH1 it was all or none. Either it glitched like it should or nothing at all.

RGH2 oh my gosh what a head ache. i did over 20 zephyrs and was only able to get 1 to glitch 1 time which took over 5 mins to boot and never did it again. i was stoked at first but disappointed in the end

only solid exploit that worked good on zephyrs was the R-JTAG and half required a Falcon nand IMG

I am sure you are already educated on this so i guess its to backup the thought of not using those boards

Customer will be bummed when and if it takes a crap with the demon installed on it

So try the falcon Nand its def worth the try. unless you got it sorted out

gavin_darkglide · Jan 9, 2015

joshypoo said:
Just a little info from my experience on Zephyrs

First off they fail just as much as a xenon, and run just as hot. they are basically a xenon with HDMI and ANA chip replaced with a Hana chip. i always adjust target temps on them ( not 12v fan mod. i think its a ghetto solution but some run it with no issues)

With RGH1 it was all or none. Either it glitched like it should or nothing at all.

RGH2 oh my gosh what a head ache. i did over 20 zephyrs and was only able to get 1 to glitch 1 time which took over 5 mins to boot and never did it again. i was stoked at first but disappointed in the end

only solid exploit that worked good on zephyrs was the R-JTAG and half required a Falcon nand IMG

I am sure you are already educated on this so i guess its to backup the thought of not using those boards

Customer will be bummed when and if it takes a crap with the demon installed on it

So try the falcon Nand its def worth the try. unless you got it sorted out

I told the customer when he dropped off the box, it probably wouldnt work, before I installed the demon, I knew it had e79 issues. When I called the customer, and told them it at the very least needs reballed, they said install the demon anyway. I didnt have the heart to tell him that when it gets reballed it will probably be removed anyway. lol. at this point, I am going to disconnect the 5v from the cr4, and write a copy of stock to the demon, so at least they can play on live until they get the gpu/southbridge reballed/replaced. I should also mention this box was already repaired by microsoft back in 2009.

In my personal oppinion I would never even bye a zephyr.

joshypoo · Jan 9, 2015

I agree with you. if i come across a working zephyr with no issues i practically give it away.

gavin_darkglide · Jan 9, 2015

So taking another look at this console, I am getting .7 on j2d2.7 with the meter set to 20k, I need the correct value, because every thing else on the header is testing about 1.5. I am thinking this might be the problem with this system.

gavin_darkglide · Jan 9, 2015

jsinger47 said:
And how does that prevent you from being able to use a falcon NAND?

I thought this was after the ecc boots. I just saw this. I guess I will give it a try.

gavin_darkglide · Jan 9, 2015

The falcon nand image worked. Who would have thought that would fix the e79 problem. Thank you.

Oggy · Jan 9, 2015

Joe ?

jsinger47 · Jan 9, 2015

Oggy said:
Joe ?

Hey, even a blind squirrel like me occasionally finds a nut.

But in all seriousness, there is a reason that the zephyr tutorial says to use falcon images from the start.

For some reason, RJTAG brings us back to the olden days when JTAG was actually still buggy.

Way back then, putting a falcon NAND on a zephyr would often fix random E79.

So, in short, Zephyrs suck.

Search

Search

Zephyr CR4 E79

gavin_darkglide

BL4K3Y

Antalpromille

gavin_darkglide

Taijigamer2

gavin_darkglide

jsinger47

GeekHeat

gavin_darkglide

jsinger47

joshypoo

gavin_darkglide

joshypoo

gavin_darkglide

gavin_darkglide

gavin_darkglide

Oggy

jsinger47