PS3 Frankenstein PHAT PS3: CECHA with 40nm RSX

Well, for those of you who happen to have Arduino and are not afraid of desoldering syscon off the board, the code works. So bus pirate isn't the only way to dump/write to syscon. But you must change the pins in the code according to the guide. Also you actually have to use brackets for entering commands and specify length for the firmware in bytes (was quite confusing at first). You must enter "<r,0,32768>" including the brackets. I've taken syscon off the board entirely and soldered the wires to it.
 
Last edited:
Welp, I decided to plow ahead and found a COK-001 in my junk pile with a dead GPU, but I can't be certain that there is nothing else wrong with it. And I had a preheater malfunction when pulling the 65nm GPU, so I'm not 100% positive it's perfect anymore, but... F%$# it. I'll get another K on the way to sit on a shelf again for next time. Anyway...

Got my EEPROM dump, I'll toss it up here in case any of the experts want to take a whack at fixing it for me so I know it's done as right as possible. I'm done for the night, but after I finish real work tomorrow, I'll get the 65nm RSX and matching syscon on the board and try to figure out all the EEPROM changes myself.

I expect we may need to tweak it several times as we find new errors / problems. Unfortunately, most of the pads needed are N/C on the board. I'm not a "hold wires in place under a BGA package with my bare hands to make a connection" kind of guy, so I'll wire in some kind of breakout connector to make writing back easier. This may take quite awhile, so it might be another day before I finish and get back to the meat of it.

EEPROM dump: https://pastebin.com/xCcvuXP4
 
squeept said:
I'll get the 65nm RSX and matching syscon on the board and try to figure out all the EEPROM changes myself.
EEPROM dump: https://pastebin.com/xCcvuXP4
Click to expand...

Just as a reminder ;)

EEPROM changes for "syscon upgrade":
  • 0x7000-0x8000 needs to be moved to 0x4000-0x5000: Required if you change the syscon from firmware < 0D52 to >= 0D52.
  • Overwrite the patch with 0xFF (0x2800-0x2C00 and 0x4400-0x5000 or 0x7400 to 0x8000): Always required

For RSX change:

Unrelated? optional? changes (only observed on 0B8E to 0F38 change):
  • Set 0x3230-0x3290 to 0xFF ... (XDR init config): Only blank on refurbished syscon
  • Set 0x2E33 to 0xFE (not referenced): Not used on any "non refurbished" syscon
  • Set 0x3FA2 to 0x03 0x61 0x82 0x80 0x01 0x91 (not referenced): Not used on any "non refurbished" syscon

Also remember to fix the checksums: https://www.psx-place.com/threads/s...o-what-does-it-mean.26148/page-12#post-236929
 
I got a little bit more I need to finish for the day before I play around with this all. What's the easiest way to write back to this EEPROM from a file?

The sendspace link to the SYSCON flasher on psdevwiki is dead, the Bus Pirate GUI is half functional abandonware, and I don't see any built in functionality in the scatterbrained Bus Pirate help pages.
 
squeept said:
I got a little bit more I need to finish for the day before I play around with this all. What's the easiest way to write back to this EEPROM from a file?

The sendspace link to the SYSCON flasher on psdevwiki is dead, the Bus Pirate GUI is half functional abandonware, and I don't see any built in functionality in the scatterbrained Bus Pirate help pages.
Click to expand...

I'm using a BusPirate v3.6 running https://github.com/mikebdp2/Bus_Pirate/tree/master/package_latest/BPv3 and this patched version of the GUI: https://workupload.com/file/JBs3dsBt4gf .
 
Good lord, what a mess their documentation / forum / support / firmware is...I've been working on getting the new firmware installed since the minute I got a notification you replied, and I just now got it all working right with the GUI tool. Had to read like 100 pages of forum posts from people that got all the error messages that I got all along the way.

It's like they purposely want to punish you for using Windows.

I'm gonna sweep up all the hair I pulled out then if I have any nerves left, I'll fire up a hex editor later for the first time in 10 years.
 
I just came across this post while re-reading the YLOD thread. I wanted to post here to remind me to take a closer look at it later. Maybe it's unrelated, but I'll forget if I don't make note of it now.
Moltiplier said:
After looking at the closer at the MOSFETs used in the power circuit and remembering other people commenting on shorting, I realized something very important. The MOSFETs are depletion mode meaning they will always short to ground when they aren't powered. The datasheet linked below confirms it with the symbols used, and my PS3 measures about 4 ohms.

Power chip: https://media.digikey.com/pdf/Data Sheets/Infineon PDFs/IP2003APbF.pdf...
Click to expand...
 
Turning in for the night. Got all the changes sorted out except the checksums. I just can't get any of the checksum methods in my hex editor to give me the "sanity check" results I have in the unmodified dump checksums. I'll get back at it again tomorrow. I'm feeling it, tomorrow is the day!
 
So, if I can't figure out how to calculate the checksums in my hex editor... there's no reason I can't just UART in after writing the otherwise fixed eeprom, then use the syscon commands to fix the checksums, right? Then I'm ready to roll?
 
Last edited:
squeept said:
So, if I can't figure out how to calculate the checksums in my hex editor... there's no reason I can't just UART in after writing the otherwise fixed eeprom, then use the syscon commands to fix the checksums, right? Then I'm ready to roll?
Click to expand...

Yes, you can use the builtin checksum command.
 
Just wiling to test with Arduino Uno on one dead cpu mobo cok002 . This command should read full dump <r, 0,32768>? If all comes good then I will try to modify an untouched mobo cok002.
 
The perils of pulling a board from your scrap pile: I just noticed a little bit of delamination on the underside of the board (it's been reworked at least 4 times at this point with one more pending for the syscon). It appears to just be a ground plane, and matching the images from the service manual, I don't see any obvious blind/buried vias there that I would have snapped. I'm cooking some solder mask on right now to hold my breakout wires in place, then I just gotta put the syscon on the board and write the modified EEPROM.

I'm not overly optimistic with this set of hardware at this point, but I need the practice and proof of concept on a few things that will make sure I don't make any mistakes when I've got some hardware with better odds in front of me. I already ordered another CHECHK with a dead drive to hold on to, and I have about 10 CECHA on the way right now.

Anyway, I cleared my day just to play with this. The only thing that's going to stand in the way is people day drinking on my patio since the weather is decent. I'll update as I finish things today, but expect it to be sporadic, and don't get your hopes up too much for this one.
 
Last edited:
Many years thinking about a possible socket on rsx. Only viable option would be teflon board. Now expensive parts would be like pogo pins for 0.6mm. 100 pcs 400$ last time check on China. If this would be possible to quick test mobo up to image on screen I will create for all types of rsx a board as jig test. Think further for ps4 and rest.
0b240933646a09f2bb939932611cd3fe.jpg
 
No dice. Can't say what the culprit was due to too many unknowns. Delam, preheater malfunction, me dumb, etc.

I only got one bad checksum that needed fixed.... that doesn't seem right?

I now have error A0902120, A0403034, and A0404001 at once.

@M4j0r is there any useful information I can grab for you from this board with the caveat that there are likely other issues?

Definitely needed to do this, though. I know the little breakout wiring is easy enough and works, I got the Bus Pirate working right, and I feel comfortable with a hex editor again. I'll give it one more try on damaged hardware to make sure I feel confident, and then I'll do it on all known working hardware.

I'll grab the current EEPROM dump in a little bit so y'all can see if I screwed anything up too obviously. I need to get a normal CECHA01 repair in the jig and baking tonight before I pass out.

edit:
original: www.squeept.com/junk/original.bin
fixed: www.squeept.com/junk/fixed.bin
 
Last edited:
This socket will be a long shot. Not necessarily will starting to work especially for it. Took me 2 years to get done that copy footprint without to much hassle, was done by one friend pasionate by cnc machine.
 
How much more does it cost to socket a motherboard and use PGA chips? Why isn't that industry standard? Locked hardware = planed obsolescence + security?

Seems to me if they socked them it'd give the pins some slack for thermal warping of the chip substrate. That and it'd separate the heat source from the socket's BGA connection (I assume the socket is BGA to the MB). I've never had problem with my socked PC motherboards. If the CPU dies, I just get another one. SONY would probably rather you went and bought another console, huh?
 
A bottle with solder balls will be 30 let's say for 100 units, an replace socket could cost 30 is the first fact. There may be some issues with high speed data transfer. Why you should fix something and we are not going to sell anymore when we invest in our company huge amount of money etc.
The point with test socket come on the time I've had difficulties on repair old fat models. At least rsx problem. So now looking for an certain method to turn on motherboards for first screen not more. Not an permanent solution, just as test. This can reduce half of work for nothing.
 
I don't care if it adds cost to my purchase price, if it can prevent BGA fatigue fractures it would be worth it. I think the electronics industry (not just automotive or military) should ban BGA chips that exceed 50C and require active cooling. It's an anti-consumer practice and purely done for profit.
 
You must log in or register to reply here.

Similar threads

Back
Top