PS3 Broke PS3 CPU during delid. Is there any way i can replace it?

Ashley Lycan

Ashley Lycan

Member
Hello Everyone!

Today i decided to take apart my old PS3 to tinker with it a little. Wanted to try delliding both the GPU and The CPU, but during the delidding process i cut some traces on the CPU, killing it.
Is there any way i could buy a identical CPU to the one on the board and solder it instead of the broken one?

My PS3 is a CECH-2504A
Motherboard: JSD-001 S/N 1-882-770-31
RSX chip: CXD5300CGB
CPU: couldnt read model number off the headspreades since it was really worn out, but from online searches it may be a CXD2992AGB or CXD2992GB
20210506_004506.jpg

20210506_004558.jpg
20210506_004647.jpg
 
There is no replacement for cpu. The simple explanation is that cpu is tied with this board and few more parts all with some keys.
 
:eek: Oh man, that is worst delid attempt i saw in very long time. CPU looks like you tried cut it in a half, not delid it. Literally all 4 sides are broken to some extend.
 
We have been telling for years that the CELL processor, the SYSCON chip (and some of the the FLASH chip contents) are "married"
In the practise this meant that the SYSCON contains identifyers of each others, and we could not separate them
By following this rule it would mean that to repair your console it would be needed to replace the CELL, SYSCON, and either replace the FLASH chip too or rebuild his contents
But... now that the syscon is hacked this rule is not valid anymore

Now we can "remarry" CELL to SYSCON ---> https://www.psdevwiki.com/ps3/Remarry_Syscon
Basically, the process consists in enabling an special mode inside syscon that is going to "scan" the identifyer of the new CELL and is going to validate it automatically, is an official feature used in sony factories and repair services :)

Your photo of the RSX has been wikifyed btw, there was no mention in wiki about that RSX model before https://www.psdevwiki.com/ps3/CXD5300CGB
 
I'm pretty sure i read somewhere that from the 25xx series onwards, you shouldn't attempt a delid because the IHS is soldered to the CELL die inside, so when you delidded it, it probably damaged the die along with it. But yeah, that system is trashed.

A similar case happened here.
 
The difference is like most 2500 up to 3.55 can be delided, on cpu easy. When you see grey silicone. When you see similar ic type but white silicone is not working, is same as black cpu model so don't bother to delid white, I've tried to but it won't take ihs out after separated silicone from ihs, if unit start in XMB you can judge by temperatures.
Rsx I avoid to delid on board. Its hard and a gamble with all hard epoxy.
At least op can now keep rsx and board is still values something as they begin to become rare.
 
Last edited:
sandungas said:
We have been telling for years that the CELL processor, the SYSCON chip (and some of the the FLASH chip contents) are "married"
In the practise this meant that the SYSCON contains identifyers of each others, and we could not separate them
By following this rule it would mean that to repair your console it would be needed to replace the CELL, SYSCON, and either replace the FLASH chip too or rebuild his contents
But... now that the syscon is hacked this rule is not valid anymore

Now we can "remarry" CELL to SYSCON ---> https://www.psdevwiki.com/ps3/Remarry_Syscon
Basically, the process consists in enabling an special mode inside syscon that is going to "scan" the identifyer of the new CELL and is going to validate it automatically, is an official feature used in sony factories and repair services :)

Your photo of the RSX has been wikifyed btw, there was no mention in wiki about that RSX model before https://www.psdevwiki.com/ps3/CXD5300CGB
Click to expand...
This is something that I've been hunting, this is something that could be in ps4 as well.
Just to be able to port a new apu without any rest of parts.
I should open a thread requesting this test.
 
vyktormvmpay25 said:
This is something that I've been hunting, this is something that could be in ps4 as well.
Just to be able to port a new apu without any rest of parts.
I should open a thread requesting this test.
Click to expand...
I dont know if is posible to do it in PS4, but for PS3 yeah... now we can do it
For people like you is very convenient because you can repair "motherboard A" by taking the CELL from "motherboard B" and SYSCON from "motherboard C"
And the FLASH contents... well... for you probably is easyer and faster to take also the FLASH chip from the "motherboard B" (the same one that was the donor of CELL, because the "bootldr" and "mtldr" are encrypted with a CELL key)... but is not really a requirement to replace the FLASH chip phisically because what is "married" inside the FLASH chip is software, so you can keep the FLASH chip and overwrite his contents

I dont know the details of the whole process... other than i been reading that wiki page several times and i have a partial understanding of the steps :D
Im just posting it to show a proof that is technically posible... and in some way is safe and relliable because we are using an official feaure of syscon firmware

The wiki page is written from the point of view of someone that needs to replace the SYSCON in a motherboard where all the other components are working fine, in that case there are 2 ways to do it, named in the wiki page as:

Case #1: A full dump of the original Syscon SPCR is available
Here we are doing a "copy" of an area of the old syscon... and we are "pasting" it in the new syscon
Obviouslly, that area contains the identifyer of CELL
At the next boot, the PS3 is going to work normally, like if nothing happened

Case #1: A full dump of the original Syscon SPCR is available
Here we dont have the data that needs to be "pasted" in the new SYSCON... lets say because the old syscon is damaged... or because the syscon is working fine but contains an identifyer of a damaged CELL
So is needed to "blank" an area with 0xFF's (where the identifyer of the old CELL was stored), then we need to write a chunk of 0x30 bytes
That 0x30 bytes are simply the value 1 (encrypted several times like there is no tomorrow)

In the nex boot the syscon firmware is going to read the value "1" and initiates an official procedure that does the CELL remarry
Obviouslly, this procedure needs to "scan" the new CELL (to find his identifyer), and stores it in the area we filled with 0xFF's
 
Last edited:
sandungas said:
We have been telling for years that the CELL processor, the SYSCON chip (and some of the the FLASH chip contents) are "married"
In the practise this meant that the SYSCON contains identifyers of each others, and we could not separate them
By following this rule it would mean that to repair your console it would be needed to replace the CELL, SYSCON, and either replace the FLASH chip too or rebuild his contents
But... now that the syscon is hacked this rule is not valid anymore

Now we can "remarry" CELL to SYSCON ---> https://www.psdevwiki.com/ps3/Remarry_Syscon
Basically, the process consists in enabling an special mode inside syscon that is going to "scan" the identifyer of the new CELL and is going to validate it automatically, is an official feature used in sony factories and repair services :)

Your photo of the RSX has been wikifyed btw, there was no mention in wiki about that RSX model before https://www.psdevwiki.com/ps3/CXD5300CGB
Click to expand...

That's great news.
I wanted to talk to someone that does repairs on PS3s about the CPU swap, so i will mention this to them if i go through with it. On the other hand, if that doesn't work out, how exactly do i go about modifying the code for the SYSCON? Im not vrey familiar with these parts, and i really dont want to screw it up further :)
Also, since its almost impossible to read the model number of the CELL ,is there any other way to find what CPU this is?

As for the Wiki, I have taken a few better close-up pictures for that, since the one i posted wasnt the nicest.
RSX2.png

RSX1.JPG
 
Ashley Lycan said:
That's great news.
I wanted to talk to someone that does repairs on PS3s about the CPU swap, so i will mention this to them if i go through with it. On the other hand, if that doesn't work out, how exactly do i go about modifying the code for the SYSCON? Im not vrey familiar with these parts, and i really dont want to screw it up further :)
Click to expand...
The syscon remarry is something new, i dont think there is much people that knows how to do it, i mentioned it mostly to popularize it a bit because there is people in this forum experienced in electronics and repairs that probably are interested in it
One of the requirements is to buy one of the "USB to UART TTL" adapters mentioned in this thread, this allows to "talk" directly to syscon
And as far i understood from the wiki is also needed to use one of the "PS3 service mode USB dongles", this makes the PS3 to boot in a special mode
Are cheap, probably you can find both for 3$ or so each... but thats only the start, learning how to do all the steps of the process could take weeks, i dont want to give you false hopes, this is the kind of thing that you start but you are not sure how is going to end

Ashley Lycan said:
Also, since its almost impossible to read the model number of the CELL ,is there any other way to find what CPU this is?
Click to expand...
Hmmm, you could try to place it under the bulblight of a lamp, then try to make the ray lights to reflect in the surface and move your head around to try to see if you appreciate the small remaining marks of the texts in the surface
Also, other thing i would do is to wet the surface a bit with a drop of water, maybe this helps

It should be one of these https://www.psdevwiki.com/ps3/CELL_BE#Serial_Numbers_.40_SKU
CXD2992xxx... we dont know what means the suffix with the "xxx" but doesnt makes any difference for compatibility purposes

Ashley Lycan said:
As for the Wiki, I have taken a few better close-up pictures for that, since the one i posted wasnt the nicest.
RSX2.png

RSX1.JPG
Click to expand...
The first photo was fine, thx, i uploaded it to wiki mostly as a proof that this RSX model with the suffix "CGB" exists
 
sandungas said:
The syscon remarry is something new, i dont think there is much people that knows how to do it, i mentioned it mostly to popularize it a bit because there is people in this forum experienced in electronics and repairs that probably are interested in it
One of the requirements is to buy one of the "USB to UART TTL" adapters mentioned in this thread, this allows to "talk" directly to syscon
And as far i understood from the wiki is also needed to use one of the "PS3 service mode USB dongles", this makes the PS3 to boot in a special mode
Are cheap, probably you can find both for 3$ or so each... but thats only the start, learning how to do all the steps of the process could take weeks, i dont want to give you false hopes, this is the kind of thing that you start but you are not sure how is going to end


Hmmm, you could try to place it under the bulblight of a lamp, then try to make the ray lights to reflect in the surface and move your head around to try to see if you appreciate the small remaining marks of the texts in the surface
Also, other thing i would do is to wet the surface a bit with a drop of water, maybe this helps

It should be one of these https://www.psdevwiki.com/ps3/CELL_BE#Serial_Numbers_.40_SKU
CXD2992xxx... we dont know what means the suffix with the "xxx" but doesnt makes any difference for compatibility purposes


The first photo was fine, thx, i uploaded it to wiki mostly as a proof that this RSX model with the suffix "CGB" exists
Click to expand...
Ok. I have those tools as uarts, E3 jig for 3.55 factory service mode. So if I get any board like 3000/4000 with dead cpu I would be able to put those units in service mode after cpu is exchanged , modify that address and get out from service mode with usb files for out from fsm . Wouldn't this brick units over 3.55?
Atm I did not even finished with an mullion via buspirate /arduino dump . It was few hours test and I probably skipped something , always an empty or something that doesn't seem as right dump.
Now thinking as I may not be able to do this if I can not do an glitch test on a 2000 series at least.
For experimental purpose I will have to do it.
Have like 5 board 3000 with good cpu, no rsx on them(keep in good condition not scrap).
Now is necessary to dump syscon full, but not revealed?So what I don't understand?
That address in nvs can be accessed in service mode?
I can try on some 2000 where someone tried to flash nor, bought them for parts quite cheap because he told me he tried reflow and flashing. I did not had time to look but are good enough for experimental purpose.
 
Last edited:
vyktormvmpay25 said:
Ok. I have those tools as uarts, E3 jig for 3.55 factory service mode. So if I get any board like 3000/4000 with dead cpu I would be able to put those units in service mode after cpu is exchanged , modify that address and get out from service mode with usb files for out from fsm . Wouldn't this brick units over 3.55?
Atm I did not even finished with an mullion via buspirate /arduino dump . It was few hours test and I probably skipped something , always an empty or something that doesn't seem as right dump.
Now thinking as I may not be able to do this if I can not do an glitch test on a 2000 series at least.
For experimental purpose I will have to do it.
Have like 5 board 3000 with good cpu, no rsx on them(keep in good condition not scrap).
Now is necessary to dump syscon full, but not revealed?So what I don't understand?
That address in nvs can be accessed in service mode?
I can try on some 2000 where someone tried to flash nor, bought them for parts quite cheap because he told me he tried reflow and flashing. I did not had time to look but are good enough for experimental purpose.
Click to expand...

If you find anything out about 2000 boards, please let me know :3
 
I assume we should have to reach first side of flash rom (nvs side of 64k at least if I remember correctly) , it will take me time to find out how, even if I understand how, this will be shared to advanced technicians via pm because is something that new starters will not understand and is better to keep those at minimal risk.
 
@vyktormvmpay25 my biggest doubt of the wiki explanation is the section named "syscon prerequisites"
In order to remarry the Syscon you have to have raw access to the corresponding EEPROM regions.
The SPCR on Mullion (CXR) models is saved at 0x0000-0x2800 while it's at 0x3000-0x5800 on Sherwood (SW) models.
Click to expand...

I dont know if is needed to apply a syscon "patch" to unlock the access to that regions... and incase of applying a patch (as far i understood) the console should be able to boot normally to install a CFW
I dont know if there are other alternatives... i was wondering if is posible to access that areas by SPI, but i dont know, im still learning how syscon works
 
Me to, is still hard not knowing what address are related for what, but without starting I will never understand.
So I will push myself to do it.
 
vyktormvmpay25 said:
I assume we should have to reach first side of flash rom (nvs side of 64k at least if I remember correctly) , it will take me time to find out how, even if I understand how, this will be shared to advanced technicians via pm because is something that new starters will not understand and is better to keep those at minimal risk.
Click to expand...
vyktormvmpay25 said:
Ok. I have those tools as uarts, E3 jig for 3.55 factory service mode. So if I get any board like 3000/4000 with dead cpu I would be able to put those units in service mode after cpu is exchanged , modify that address and get out from service mode with usb files for out from fsm . Wouldn't this brick units over 3.55?
Atm I did not even finished with an mullion via buspirate /arduino dump . It was few hours test and I probably skipped something , always an empty or something that doesn't seem as right dump.
Now thinking as I may not be able to do this if I can not do an glitch test on a 2000 series at least.
For experimental purpose I will have to do it.
Have like 5 board 3000 with good cpu, no rsx on them(keep in good condition not scrap).
Now is necessary to dump syscon full, but not revealed?So what I don't understand?
That address in nvs can be accessed in service mode?
I can try on some 2000 where someone tried to flash nor, bought them for parts quite cheap because he told me he tried reflow and flashing. I did not had time to look but are good enough for experimental purpose.
Click to expand...

This was supposed to be a dm, but i cant send those yet, so sorry for posting this here.

It just occurred to me that we're both from Romania :) I'm from Bucharest btw.
That being so, would there be any way i could send you my board for an repair attempt? and if so, how much would it cost?

if you want to talk more about this, please dm me.
 
You must log in or register to reply here.

Similar threads

Back
Top