The response from the syscon was
00000000
# +0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
# -----------------------------------------------
# 15 92 15 44 01 F9 61 0C
PS3 Fault finding YLOD with the SYSCON - First steps and Error reporting
00000000
# +0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
# -----------------------------------------------
# 15 92 15 44 01 F9 61 0C
RIP-Felix
Senior Member
@sandungas @M4j0r @zecoxao @db260179
I just made an unfortunate SYSCON discovery that I will not mention in fear that doing so will unleash pandora. But publicly I would like to ask if it was possible to write to SYSCON eeprom before @zecoxao released the syscon FW keys? By using linux or Homebrew? Or was eeprom write access forbidden until authorization was possible?
We should have this discussion in DM as I think it would be wise to add a banned command dictionary to the python script to prevent abuse of what I found. I was about to add the beneficial use to the SYSCON tutorial, until I realized it could be used for evil. So until we fix this, I'm zipping it!
OTHO, if it was possible to write to eeprom all this time by other means, then the cat is probably already out.
I just made an unfortunate SYSCON discovery that I will not mention in fear that doing so will unleash pandora. But publicly I would like to ask if it was possible to write to SYSCON eeprom before @zecoxao released the syscon FW keys? By using linux or Homebrew? Or was eeprom write access forbidden until authorization was possible?
We should have this discussion in DM as I think it would be wise to add a banned command dictionary to the python script to prevent abuse of what I found. I was about to add the beneficial use to the SYSCON tutorial, until I realized it could be used for evil. So until we fix this, I'm zipping it!
OTHO, if it was possible to write to eeprom all this time by other means, then the cat is probably already out.
zecoxao
Developer
we could always write to NVS on cfw models . SNVS is possible on BGA SYSCON units, not possible on Sherwood units
Tomatarto
Member
M4j0r
Developer
Yes, the first eeprom access to the non encrypted regions can be traced backed to even 2007.
RIP-Felix
Senior Member
Well, that changes things for me a bit. Oh well.
RIP-Felix
Senior Member
@bguerville could you please autohide the IDPS and PSID from the system management tab as the default setting? As it is you have to manually click it to hide it and people don't know you can do that when they post pictures online, inadvertanly giving cheaters the means to steal their console id.
I got your pm already, I just haven't had time to check this out so far, but I will and when I do I will reply to you...
RIP-Felix
Senior Member
IFAIK there's no way to see if the recipient read it, unless they respond. THX for confirming.
Np. [emoji6]
I will try to look into it as soon as I can.
I knocked off a cap on dia-002 it was in
Front of the big diode on the right of syscon there 4 component in line cap then 2 resistor than a cap I knocked it off and can't find it is this board ruined now can I get that cap of msx-001 board if anyone has a dia-002 kindly check @vyktormvmpay25 @RIP-Felix @sandungas
Front of the big diode on the right of syscon there 4 component in line cap then 2 resistor than a cap I knocked it off and can't find it is this board ruined now can I get that cap of msx-001 board if anyone has a dia-002 kindly check @vyktormvmpay25 @RIP-Felix @sandungas
vyktormvmpay25
Senior Member
I'm not home until 24 August.
I have tracked the pin and it is label t5 extal clk can to a Crystal oscillator I am missing the connection here that cap was supposed to make.does anyone has a capacitance tester and a dia board kindly check the rating I track it out of any board corresponding to rating
Tomatarto
Member
I don't have the tools to check that unfortunately
OK so apparently the syscon circuit was same in sem-001 and dia-002 so what I am looking at is a 15uf 50v smd ceramic cap that's missing any ideas where would that be on a superslim anyone I don't suppose the syscon circuit is same for both mullion and Sherwood but they still use the same patten cap-resistor-resistor-cap in parral to crystal oscillator gonna be poke the superslim to see if resistor value still the same mean while if can check on the motherboard due tell
Does anyone has a picture of Sherwood syscon bonding pads on the motherboard with syscon desoldered need to see traces underneath syscon.
Last edited:
Jose Denilson Nog F
Forum Noob
Not sure if this is the right place to ask for help, but I came here through a RIP Felix video on Youtube on reading the Syscon. I bought a FT232 serial to usb adapter, which can be set to 3.3v(and I did set it), and connected 2 PS3s that I have(DYN001 and SUR001) to it, and I cant get past the Auth1 response invalid error, already reversed the cables, soldered new cables, and I still cant get past it, with both consoles. Is there a problem with my adapter maybe? Maybe some drivers? I noticed in his video that there are two devices on his device manager, one says just USB Serial Port and the other has the name of his adapter(and is the one he uses). Mine just shows up as the USB Serial Port. There should be another COM port there?
This is my CECHA00
Code:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Syscon>python C:\Syscon\PS3_Syscon_(Mullion_Sherwood)_script.py COM4 CXR
> AUTH
Auth successful
> ERRLOG GET 00
00000000 A0003001 0B4A327C
> EPP GET 3961 01
F0000003
> EEP GET 3961 01
00000000 FF
> EEP SET 3961 01 00
00000000
> EEP GET 3961 01
00000000 00
> EXIT
C:\Syscon>python C:\Syscon\PS3_Syscon_(Mullion_Sherwood)_script.py COM4 CXRF
> AUTH
Auth successful
> eepcsum
eepcsum
Addr:0x000032fe should be 0x52b7
Addr:0x000034fe should be 0x7115
sum:0x0100
Addr:0x000039fe should be 0x0f38
Addr:0x00003dfe should be 0x00ff
Addr:0x00003ffe should be 0x00ff
> w 39fe 38 0f
w 39fe 38 0f
w complete!
[mullion]$
> eepcsum
eepcsum
Addr:0x000032fe should be 0x52b7
Addr:0x000034fe should be 0x7115
Addr:0x000039fe should be 0x0f38
Addr:0x00003dfe should be 0x00ff
Addr:0x00003ffe should be 0x00ff
> EXIT
C:\Syscon>python C:\Syscon\PS3_Syscon_(Mullion_Sherwood)_script.py COM4 CXRF
> AUTH
scopen response invalid
> AUTH
Auth successful
> becount
becount
Bringup : 570 times
Shutdown: 454 times
Power-on: 41day 09hour 16min 56sec
[mullion]$
> bringup
bringup
[SSM] state: 0000 -> 0101
Bringup Mode #0 (0xFF)
[SSM] ssmCb_OnStartingBePowOn() called.
[SSM] First Boot.
[SSM] Bringup mode : syspm_stat=00000000/00000000
[POWSEQ] PowerSeq_Setup called.
[SSM] state: 0101 -> 0201
[POWSEQ] AV Backend Setup
[SSM] state: 0201 -> 0102
[SSM] state: 0102 -> 0202
[SSM] state: 0202 -> 0103
[SSM] state: 0103 -> 0203
[SSM] ssmCb_BeforeBeOn() called.
[SSM] state: 0203 -> 0104
Psbd_SbTransMode_Half:0x20e2
> shutdown
[SSM] state: 0104 -> 0204
[SSM] state: 0204 -> 0105
[SSM] state: 0105 -> 0400
(PowerOn State)
[SERV NVS] READ CMD
Boot Loader SE Version 0.9.5 (Build ID: 1634,16289, Build Data: 2006-09-21_19:11
:09)
Copyright(C) 2006 Sony Computer Entertainment Inc.All Rights Reserved.
[SERV SETCFG] XDR (CH0,CH1) ASSERT
[SERV SETCFG] XDR (CH0,CH1) DEASSERT
[INFO]: Connecting to Debug Device (SB UART)
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV THERM] NOTIFY_MODE CMD
[SERV NOTIF] CONTROL_LED
[SERV NOTIF] RING_BUZZER
[SERV NOTIF] CONTROL_LED
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV THERM] SET_FANCTRL CMD
[SERV THERM] FanconNo:0, policy01: Auto Table, duty:00
[SERV NOTIF] CONTROL_LED
[SERV THERM] GET_FANCTRL CMD
[SERV THERM] FanconNo:0, policy01: Auto Table, mode01: Auto Table, duty:33
[SERV THERM] SET_FANCTRL CMD
[SERV THERM] FanconNo:0, policy02: Manual, duty:3F
[SERV THERM] EVAL_TZONE CMD
[SERV THERM] TZone No:FF, MAX TZone No:15
[SERV THERM] TZone broadcast FF
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:00, MAX TZone No:15
[SERV THERM] 1st BE Primary Get Temperature:29.45(0x1d77)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:01, MAX TZone No:15
[SERV THERM] RSX Primary Get Temperature:23.75(0x17c0)
[SERV THERM] SET_FANCTRL CMD
[SERV THERM] FanconNo:0, policy02: Manual, duty:3F
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV NOTIF] CONTROL_LED
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:00, MAX TZone No:15
[SERV THERM] 1st BE Primary Get Temperature:30.45(0x1e77)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:01, MAX TZone No:15
[SERV THERM] RSX Primary Get Temperature:24.25(0x1840)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:00, MAX TZone No:15
[SERV THERM] 1st BE Primary Get Temperature:31.45(0x1f77)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:01, MAX TZone No:15
[SERV THERM] RSX Primary Get Temperature:24.75(0x18c0)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:00, MAX TZone No:15
[SERV THERM] 1st BE Primary Get Temperature:31.95(0x1ff7)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:01, MAX TZone No:15
[SERV THERM] RSX Primary Get Temperature:25.25(0x1940)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:00, MAX TZone No:15
[SERV THERM] 1st BE Primary Get Temperature:32.70(0x20b7)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:01, MAX TZone No:15
[SERV THERM] RSX Primary Get Temperature:25.50(0x1980)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:00, MAX TZone No:15
[SERV THERM] 1st BE Primary Get Temperature:33.45(0x2177)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:01, MAX TZone No:15
[SERV THERM] RSX Primary Get Temperature:25.75(0x19c0)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:00, MAX TZone No:15
[SERV THERM] 1st BE Primary Get Temperature:33.95(0x21f7)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:01, MAX TZone No:15
[SERV THERM] RSX Primary Get Temperature:26.25(0x1a40)
[SERV NVS] READ CMD
[SERV NVS] READ CMD
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:00, MAX TZone No:15
[SERV THERM] 1st BE Primary Get Temperature:34.95(0x22f7)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:01, MAX TZone No:15
[SERV THERM] RSX Primary Get Temperature:26.75(0x1ac0)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:00, MAX TZone No:15
[SERV THERM] 1st BE Primary Get Temperature:35.45(0x2377)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:01, MAX
> errlog
TZone No:15
[SERV THERM] RSX Primary Get Temperature:27.25(0x1b40)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:00, MAX TZone No:15
[SERV THERM] 1st BE Primary Get Temperature:36.20(0x2437)
[SERV THERM] GET_TMP CMD
[SERV THERM] TZone No:01, MAX TZone No:15
[SERV THERM] RSX Primary Get Temperature:28.50(0x1c80)
[
errlog
ofst[ 36]:err_code:0xffffffff, clock:0x0b48d9f9 2005/12/31 05:56:09
ofst[ 40]:err_code:0xa0003001, clock:0x0b48d9f9 2005/12/31 05:56:09
ofst[ 44]:err_code:0xa0003001, clock:0x0b48da19 2005/12/31 05:56:41
ofst[ 48]:err_code:0xa0003001, clock:0x0b48da19 2005/12/31 05:56:41
ofst[ 52]:err_code:0xa0003001, clock:0x0b48da29 2005/12/31 05:56:57
ofst[ 56]:err_code:0xa0003001, clock:0x0b48da29 2005/12/31 05:56:57
ofst[ 60]:err_code:0xa0003001, clock:0x0b49f893 2006/01/01 02:18:59
ofst[ 64]:err_code:0xa0003001, clock:0x0b49f893 2006/01/01 02:18:59
ofst[ 68]:err_code:0xa0003001, clock:0x0b4a267d 2006/01/01 05:34:53
ofst[ 72]:err_code:0xa0003001, clock:0x0b4a267d 2006/01/01 05:34:53
ofst[ 76]:err_code:0xa0003001, clock:0x0b4a26a2 2006/01/01 05:35:30
ofst[ 80]:err_code:0xa0003001, clock:0x0b4a26a3 2006/01/01 05:35:31
ofst[ 84]:err_code:0xa0003001, clock:0x0b4a26b7 2006/01/01 05:35:51
ofst[ 88]:err_code:0xa0003001, clock:0x0b4a26b7 2006/01/01 05:35:51
ofst[ 92]:err_code:0xa0003001, clock:0x0b4a26cc 2006/01/01 05:36:12
ofst[ 96]:err_code:0xa0003001, clock:0x0b4a26cd 2006/01/01 05:36:13
ofst[100]:err_code:0xa0003001, clock:0x0b4a2e56 2006/01/01 06:08:22
ofst[104]:err_code:0xa0003001, clock:0x0b4a2e56 2006/01/01 06:08:22
ofst[108]:err_code:0xa0003001, clock:0x0b4a2e72 2006/01/01 06:08:50
ofst[112]:err_code:0xa0003001, clock:0x0b4a2e72 2006/01/01 06:08:50
ofst[116]:err_code:0xa0003001, clock:0x0b4a2eb6 2006/01/01 06:09:58
ofst[120]:err_code:0xa0003001, clock:0x0b4a2eb6 2006/01/01 06:09:58
ofst[124]:err_code:0xa0003001, clock:0x0b4a2ec0 2006/01/01 06:10:08
ofst[ 0]:err_code:0xa0003001, clock:0x0b4a2ec0 2006/01/01 06:10:08
ofst[ 4]:err_code:0xa0003001, clock:0x0b4a2ec3 2006/01/01 06:10:11
ofst[ 8]:err_code:0xa0003001, clock:0x0b4a2ec3 2006/01/01 06:10:11
ofst[ 12]:err_code:0xa0003001, clock:0x0b4a2ec5 2006/01/01 06:10:13
ofst[ 16]:err_code:0xa0003001, clock:0x0b4a2ec6 2006/01/01 06:10:14
ofst[ 20]:err_code:0xa0003001, clock:0x0b4a2ec8 2006/01/01 06:10:16
ofst[ 24]:err_code:0xa0003001, clock:0x0b4a2ec8 2006/01/01 06:10:16
ofst[ 28]:err_code:0xa0003001, clock:0x0b4a327c 2006/01/01 06:26:04
ofst[ 32]:err_code:0xa0003001, clock:0x0b4a327c 2006/01/01 06:26:04
[mullion]$
> exit
C:\Syscon>You have either a bad of power supply or a short in 12v rail check of fuses first and since you have a cecha there schematics available so you used reference that will the 12v power rail.
Similar threads
-
-
PS3 CECHA00 with several SYSCON errors (3004, 1001,1002, 2120,3011)
- Started by LSL
- Replies: 7
-
PS3 Interesting PS3 Errors (1802, 1701, 1601) and Capacitor Replacement- Started by Cheshire UK
- Replies: 2
-