Issues with Xell not loading after CR$ install

MrKronic · July 12, 2015

Hello again. So this time, I've been having an issue with another phat Jasper console that has been installed with a CR4 XL board. The NAND has been flashed with Xell, but so far I've had no luck in actually booting into it. The console starts up normally (no RRODs whatsoever and the power light turns green etc.), but I don't get any display regardless of which display port I use (I've tried the composite and the HDMI).

So far, I've done a POST monitor of the boot-up which seems to indicates that everything seem to be initializing properly and no POST faults, however the code cascade seems to be a bit too long in comparison to the normal POST codes (including the expected Xell code) in Martin C's POST calculator. Also, strangely enough, after the console is switched on the first time, the POST monitor always initializes with a 7F code and stays stuck in it regardless of whether the xbox is switched on or not. This is reset every time I switch off the power box and repeat the process.

===================================================
Monday, July 13, 2015 1:55:18 AM

J-Runner v0.3 Beta (7) Started


WARNING! - Your selected working directory already contains files!
You can view these files by using 'Show Working Folder' Button


Checking Files
Finished Checking Files
Checking Console..
Version: 10
Flash Config: 0x00000000
Can not Continue
Can not continue
Checking Console..
Version: 10
Flash Config: 0x00AA3020
00AA3020
Jasper 512MB
CB Version: 6723
Version: 10
Press Escape to exit
Waiting for POST to change
Post 01
Post 03
Post 04
Post 05
Post 06
Post 07
Post 08
Post 09
Post 0A
Post 0B
Post 0C
Post 0D
Post 0E
Post 0F
Post 10 - Payload/1BL started
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 12 - FSB_CONFIG_RX_STATE
Post 13 - FSB_CONFIG_TX_STATE
Post 14 - FSB_CONFIG_TX_CREDITS
Post 15 - FETCH_OFFSET
Post 16 - FETCH_HEADER
Post 17 - VERIFY_HEADER
Post 18 - FETCH_CONTENTS
Post 19 - HMACSHA_COMPUTE
Post 1A - RC4_INITIALIZE
Post 1B - RC4_DECRYPT
Post 1C - SHA_COMPUTE
Post 1D - SIG_VERIFY
Post 1E - BRANCH
Post 1F
Post 20 - CB entry point reached
Post 21 - INIT_SECOTP
Post 22 - INIT_SECENG
Post 23 - INIT_SYSRAM
Post 24 - VERIFY_OFFSET_3BL_CC
Post 25 - LOCATE_3BL_CC
Post 26 - FETCH_HEADER_3BL_CC
Post 27 - VERIFY_HEADER_3BL_CC
Post 28 - FETCH_CONTENTS_3BL_CC
Post 29 - HMACSHA_COMPUTE_3BL_CC
Post 2A - RC4_INITIALIZE_3BL_CC
Post 2B - RC4_DECRYPT_3BL_CC
Post 2C - SHA_COMPUTE_3BL_CC
Post 2D - SIG_VERIFY_3BL_CC
Post 2E - HWINIT
Post 2F - RELOCATE
Post 30 - VERIFY_OFFSET_4BL_CD
Post 31 - FETCH_HEADER_4BL_CD
Post 32 - VERIFY_HEADER_4BL_CD
Post 33 - FETCH_CONTENTS_4BL_CD
Post 34 - HMACSHA_COMPUTE_4BL_CD
Post 35 - RC4_INITIALIZE_4BL_CD
Post 36 - RC4_DECRYPT_4BL_CD
Post 37 - SHA_COMPUTE_4BL_CD
Post 38 - SIG_VERIFY_4BL_CD
Post 39 - SHA_VERIFY_4BL_CD
Post 3A - BRANCH
Post 3B - PCI_INIT
Post 3C
Post 3D
Post 3E
Post 3F
Post 40 - Entrypoint of CD reached
Post 41 - VERIFY_OFFSET
Post 42 - FETCH_HEADER
Post 43 - VERIFY_HEADER
Post 44 - FETCH_CONTENTS
Post 45 - HMACSHA_COMPUTE
Post 46 - RC4_INITIALIZE
Post 47 - RC4_DECRYPT
Post 48 - SHA_COMPUTE
Post 49 - SHA_VERIFY
Post 4A - LOAD_6BL_CF
Post 4B - LZX_EXPAND
Post 4C - SWEEP_CACHES
Post 4D - DECODE_FUSES
Post 4E - FETCH_OFFSET_6BL_CF
Post 4F - VERIFY_OFFSET_6BL_CF
Post 50 - LOAD_UPDATE_1
Post 51 - LOAD_UPDATE_2
Post 52 - BRANCH
Post 53 - DECRYT_VERIFY_HV_CERT
Post 54
Post 55
Post 56
Post 57
Post 58 - INIT_HYPERVISOR
Post 59 - INIT_SOC_MMIO
Post 5A - INIT_XEX_TRAINING
Post 5B - INIT_KEYRING
Post 5C - INIT_KEYS
Post 5D - INIT_SOC_INT
Post 5E - INIT_SOC_INT_COMPLETE
Post 5F
Post 60 - INIT_KERNEL
Post 61 - INIT_HAL_PHASE_0
Post 62 - INIT_PROCESS_OBJECTS
Post 63 - INIT_KERNEL_DEBUGGER
Post 64 - INIT_MEMORY_MANAGER
Post 65 - INIT_STACKS
Post 66 - INIT_OBJECT_SYSTEM
Post 67 - INIT_PHASE1_THREAD
Post 68 - Started phase 1 Initialization + INIT_PROCESSORS
Post 69 - INIT_KEY_VAULT
Post 6A - INIT_HAL_PHASE_1
Post 6B - INIT_SFC_DRIVER
Post 6C - INIT_SECURITY
Post 6D - INIT_KEY_EX_VAULT
Post 6E - INIT_SETTINGS
Post 6F - INIT_POWER_MODE
Post 70 - INIT_VIDEO_DRIVER
Post 71 - INIT_AUDIO_DRIVER
Post 72 - INIT_BOOT_ANIMATION + XMADecoder & XAudioRender Init
Post 73 - INIT_SATA_DRIVER
Post 74 - INIT_SHADOWBOOT
Post 75 - INIT_DUMP_SYSTEM
Post 76 - INIT_SYSTEM_ROOT
Post 77 - INIT_OTHER_DRIVERS
Post 78 - INIT_STFS_DRIVER
Post 79 - LOAD_XAM
Post 7A
Post 7B
Post 7C
Post 7D
Post 7E
Post 7F
Done!

Version: 10
Press Escape to exit
Waiting for POST to change
Post 7F
Done!


===================================================
Monday, July 13, 2015 1:57:30 AM

J-Runner v0.3 Beta (7) Started


WARNING! - Your selected working directory already contains files!
You can view these files by using 'Show Working Folder' Button


Checking Files
Finished Checking Files
Version: 10
Press Escape to exit
Waiting for POST to change
Post 7F

===================================================
Monday, July 13, 2015 2:03:12 AM

J-Runner v0.3 Beta (7) Started


WARNING! - Your selected working directory already contains files!
You can view these files by using 'Show Working Folder' Button


Checking Files
Finished Checking Files
Version: 10
Press Escape to exit
Waiting for POST to change
Post 7F
Done!

Version: 10
Press Escape to exit
Waiting for POST to change
Post 7F
Done!

Version: 10
Press Escape to exit
Waiting for POST to change
Post 7F

===================================================

What could be causing this issue????? :/ I know there is no issue with the soldering because i've triple checked every single point with a multimeter for faults. Could there be something wrong with the Xell image or something? ?? Thank you in advance

gavin_darkglider · July 13, 2015

Is this r-jtag+ or rgh2+? R-jtag+ has been known to have issues with jasper consoles. It could also be a problem with the image, did you get any bad blocks within the first 50 blocks? if so try writing xell with the fusion/demon write option in j-runner, which will remap the blocks for you.

MrKronic · July 13, 2015

It is in RJTAG+ mode. Regarding the image, there were no bad blocks reported within the first 50 blocks (although there were two invalid blocks but they were beyond that region) and they were both similar.

Regarding Xell, normally if I use the 67mb flash to create the Xell image J-Runner does it without hitches, but if I try to use one of the complete dumps (I made about 3 just to be sure), J-Runner crashes with an Unhandled Exception error. I've also extracted the Xell image that i flashed into the drive, and noticed that the Xell image which is created is that of a 256mb bb (the box is 512mb flash).

If it is R-JTAG+ that's causing the issue, are there any fixes other than RGH2 mode?? I am trying to keep it to RJTAG so that I can swap with an R-JTAG board I have lying around later, but if there isn't any workaround it doesn't matter. Or could it be the Xell image that's causing the issue??

gavin_darkglider · July 13, 2015

It could be either issue. R-Jtag and R-Jtag+ work differently, essentially they do the same thing, but the CPU slow down is different. I havnt ever tried R-JTAG+ on a jasper, but have read alot of reports that it has issues, while I have never had any issues with RJtag with a jasper. It really depends on the console. As far as the xell image, a BB nand is a BB nand. and according to your post log, it booted. Now the nice thing about old R-JTAG, is you get full post, which is more dependable then fake post, so it might be smart to wire up the old r-jtag chip, and see what you get.

MrKronic · July 13, 2015

I would've obviously....Infact, I did set up the console for r-jtag, but the solder pad for E is missing (one of my very first installs so i screwed up the board pretty bad ) so I have to resort to straight up soldering to the IC :/ That has proved to be very difficult so im probably gonna have it done by a professional. Unless ,of course, there is a more accessible alternative.

Update: There was a slight issue in the install. It seems I've had the connection for points C and M swapped with each other :wallbash: (didn't get decent sleep these past few days; couldn't focus). However I rewired them now and the POST read is going haywire. No change in the green light and display though. Also the green led on the cr4 is flashing intermittently, and not on a regular pattern as expected.

===================================================
Tuesday, July 14, 2015 3:57:55 AM

J-Runner v0.3 Beta (7) Started


WARNING! - Your selected working directory already contains files!
You can view these files by using 'Show Working Folder' Button


Checking Files
Finished Checking Files
Checking Console..
Version: 10
Flash Config: 0x00AA3020
00AA3020
Jasper 512MB
CB Version: 6723
Version: 10
Press Escape to exit
Waiting for POST to change
Post 7F
Post 6B - INIT_SFC_DRIVER
Post 01
Post 03
Post 07
Post 08
Post 09
Post 0A
Post 0B
Post 0C
Post 0D
Post 0E
Post 0F
Post 10 - Payload/1BL started
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 12 - FSB_CONFIG_RX_STATE
Post 13 - FSB_CONFIG_TX_STATE
Post 17 - VERIFY_HEADER
Post 18 - FETCH_CONTENTS
Post 19 - HMACSHA_COMPUTE
Post 1A - RC4_INITIALIZE
Post 1B - RC4_DECRYPT
Post 1F
Post 20 - CB entry point reached
Post 23 - INIT_SYSRAM
Post 27 - VERIFY_HEADER_3BL_CC
Post 29 - HMACSHA_COMPUTE_3BL_CC
Post 2A - RC4_INITIALIZE_3BL_CC
Post 2B - RC4_DECRYPT_3BL_CC
Post 2C - SHA_COMPUTE_3BL_CC
Post 2D - SIG_VERIFY_3BL_CC
Post 25 - LOCATE_3BL_CC
Post 26 - FETCH_HEADER_3BL_CC
Post 27 - VERIFY_HEADER_3BL_CC
Post 28 - FETCH_CONTENTS_3BL_CC
Post 29 - HMACSHA_COMPUTE_3BL_CC
Post 2A - RC4_INITIALIZE_3BL_CC
Post 2B - RC4_DECRYPT_3BL_CC
Post 2C - SHA_COMPUTE_3BL_CC
Post 2D - SIG_VERIFY_3BL_CC
Post 2E - HWINIT
Post 2F - RELOCATE
Post 30 - VERIFY_OFFSET_4BL_CD
Post 31 - FETCH_HEADER_4BL_CD
Post 32 - VERIFY_HEADER_4BL_CD
Post 33 - FETCH_CONTENTS_4BL_CD
Post 37 - SHA_COMPUTE_4BL_CD
Post 38 - SIG_VERIFY_4BL_CD
Post 39 - SHA_VERIFY_4BL_CD
Post 3A - BRANCH
Post 3B - PCI_INIT
Post 3C
Post 3D
Post 3E
Post 3F
Post 40 - Entrypoint of CD reached
Post 41 - VERIFY_OFFSET
Post 42 - FETCH_HEADER
Post 43 - VERIFY_HEADER
Post 44 - FETCH_CONTENTS
Post 47 - RC4_DECRYPT
Post 48 - SHA_COMPUTE
Post 4F - VERIFY_OFFSET_6BL_CF
Post 50 - LOAD_UPDATE_1
Post 51 - LOAD_UPDATE_2
Post 53 - DECRYT_VERIFY_HV_CERT
Post 54
Post 55
Post 57
Post 58 - INIT_HYPERVISOR
Post 59 - INIT_SOC_MMIO
Post 5A - INIT_XEX_TRAINING
Post 5C - INIT_KEYS
Post 5D - INIT_SOC_INT
Post 5E - INIT_SOC_INT_COMPLETE
Post 4F - VERIFY_OFFSET_6BL_CF
Post 5B - INIT_KEYRING
Post 5F
Post 4B - LZX_EXPAND
Post 4C - SWEEP_CACHES
Post 4D - DECODE_FUSES
Post 4E - FETCH_OFFSET_6BL_CF
Post 4F - VERIFY_OFFSET_6BL_CF
Post 50 - LOAD_UPDATE_1
Post 51 - LOAD_UPDATE_2
Post 56
Post 61 - INIT_HAL_PHASE_0
Post 62 - INIT_PROCESS_OBJECTS
Post 63 - INIT_KERNEL_DEBUGGER
Post 65 - INIT_STACKS
Post 6A - INIT_HAL_PHASE_1
Post 6B - INIT_SFC_DRIVER
Post 6C - INIT_SECURITY
Post 6D - INIT_KEY_EX_VAULT
Post 6E - INIT_SETTINGS
Post 6F - INIT_POWER_MODE
Post 7B
Post 7F
Done!

Version: 10
Press Escape to exit
Waiting for POST to change
Post 7F
Post 6B - INIT_SFC_DRIVER
Post 01
Post 03
Post 07
Post 03
Post 05
Post 06
Post 07
Post 08
Post 09
Post 0A
Post 0B
Post 0D
Post 0E
Post 10 - Payload/1BL started
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 17 - VERIFY_HEADER
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 16 - FETCH_HEADER
Post 17 - VERIFY_HEADER
Post 13 - FSB_CONFIG_TX_STATE
Post 17 - VERIFY_HEADER
Post 13 - FSB_CONFIG_TX_STATE
Post 17 - VERIFY_HEADER
Post 18 - FETCH_CONTENTS
Post 1F
Post 0B
Post 0D
Post 0E
Post 0F
Post 10 - Payload/1BL started
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 12 - FSB_CONFIG_RX_STATE
Post 13 - FSB_CONFIG_TX_STATE
Post 14 - FSB_CONFIG_TX_CREDITS
Post 15 - FETCH_OFFSET
Post 16 - FETCH_HEADER
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1A - RC4_INITIALIZE
Post 0E
Post 03
Post 04
Post 05
Post 06
Post 07
Post 03
Post 07
Post 03
Post 07
Post 03
Post 04
Post 05
Post 06
Post 07
Post 0B
Post 0C
Post 0D
Post 0E
Post 0F
Post 10 - Payload/1BL started
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 12 - FSB_CONFIG_RX_STATE
Post 14 - FSB_CONFIG_TX_CREDITS
Post 15 - FETCH_OFFSET
Post 16 - FETCH_HEADER
Post 17 - VERIFY_HEADER
Post 13 - FSB_CONFIG_TX_STATE
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1A - RC4_INITIALIZE
Post 1E - BRANCH
Post 1F
Post 18 - FETCH_CONTENTS
Post 19 - HMACSHA_COMPUTE
Post 1A - RC4_INITIALIZE
Post 1B - RC4_DECRYPT
Post 1F
Post 21 - INIT_SECOTP
Post 22 - INIT_SECENG
Post 23 - INIT_SYSRAM
Post 27 - VERIFY_HEADER_3BL_CC
Post 28 - FETCH_CONTENTS_3BL_CC
Post 29 - HMACSHA_COMPUTE_3BL_CC
Post 2F - RELOCATE
Post 3B - PCI_INIT
Post 3D
Post 3E
Post 3F
Post 40 - Entrypoint of CD reached
Done!

Version: 10
Press Escape to exit
Waiting for POST to change
Post 43 - VERIFY_HEADER
Post 44 - FETCH_CONTENTS
Post 45 - HMACSHA_COMPUTE
Post 46 - RC4_INITIALIZE
Post 47 - RC4_DECRYPT
Post 48 - SHA_COMPUTE
Post 49 - SHA_VERIFY
Post 4A - LOAD_6BL_CF
Post 4B - LZX_EXPAND
Post 4F - VERIFY_OFFSET_6BL_CF
Post 50 - LOAD_UPDATE_1
Post 51 - LOAD_UPDATE_2
Post 52 - BRANCH
Post 5A - INIT_XEX_TRAINING
Post 5B - INIT_KEYRING
Post 5C - INIT_KEYS
Post 5D - INIT_SOC_INT
Post 5E - INIT_SOC_INT_COMPLETE
Post 64 - INIT_MEMORY_MANAGER
Post 65 - INIT_STACKS
Post 66 - INIT_OBJECT_SYSTEM
Post 67 - INIT_PHASE1_THREAD
Post 63 - INIT_KERNEL_DEBUGGER
Post 64 - INIT_MEMORY_MANAGER
Post 65 - INIT_STACKS
Post 73 - INIT_SATA_DRIVER
Post 77 - INIT_OTHER_DRIVERS
Post 78 - INIT_STFS_DRIVER
Post 79 - LOAD_XAM
Post 7A
Post 7B
Post 7F
Done!

Version: 10
Press Escape to exit
Waiting for POST to change
Post 7F
Post 01
Post 03
Post 05
Post 06
Post 07
Post 03
Post 07
Post 08
Post 09
Post 0A
Post 0B
Post 0F
Post 1B - RC4_DECRYPT
Post 1C - SHA_COMPUTE
Post 1D - SIG_VERIFY
Post 1E - BRANCH
Post 1F
Post 20 - CB entry point reached
Post 21 - INIT_SECOTP
Post 23 - INIT_SYSRAM
Post 27 - VERIFY_HEADER_3BL_CC
Post 23 - INIT_SYSRAM
Post 27 - VERIFY_HEADER_3BL_CC
Post 24 - VERIFY_OFFSET_3BL_CC
Post 25 - LOCATE_3BL_CC
Post 26 - FETCH_HEADER_3BL_CC
Post 27 - VERIFY_HEADER_3BL_CC
Post 29 - HMACSHA_COMPUTE_3BL_CC
Post 2B - RC4_DECRYPT_3BL_CC
Post 2C - SHA_COMPUTE_3BL_CC
Post 2E - HWINIT
Post 2F - RELOCATE
Post 3B - PCI_INIT
Post 3C
Post 4B - LZX_EXPAND
Post 4C - SWEEP_CACHES
Post 4D - DECODE_FUSES
Post 47 - RC4_DECRYPT
Post 48 - SHA_COMPUTE
Post 49 - SHA_VERIFY
Post 4A - LOAD_6BL_CF
Post 4B - LZX_EXPAND
Post 4F - VERIFY_OFFSET_6BL_CF
Post 5B - INIT_KEYRING
Post 5C - INIT_KEYS
Post 5D - INIT_SOC_INT
Post 7F
Done!

Version: 10
Press Escape to exit
Waiting for POST to change
Post 7F
Post 01
Post 03
Post 04
Post 05
Post 06
Post 07
Post 08
Post 09
Post 0A
Post 0B
Post 0F
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 12 - FSB_CONFIG_RX_STATE
Post 16 - FETCH_HEADER
Post 17 - VERIFY_HEADER
Post 13 - FSB_CONFIG_TX_STATE
Post 17 - VERIFY_HEADER
Post 13 - FSB_CONFIG_TX_STATE
Post 17 - VERIFY_HEADER
Post 13 - FSB_CONFIG_TX_STATE
Post 17 - VERIFY_HEADER
Post 18 - FETCH_CONTENTS
Post 19 - HMACSHA_COMPUTE
Post 1A - RC4_INITIALIZE
Post 1B - RC4_DECRYPT
Post 1F
Post 0B
Post 0C
Post 0E
Post 0F
Post 1B - RC4_DECRYPT
Post 1C - SHA_COMPUTE
Post 1D - SIG_VERIFY
Post 1E - BRANCH
Post 1F
Post 21 - INIT_SECOTP
Post 22 - INIT_SECENG
Post 23 - INIT_SYSRAM
Post 27 - VERIFY_HEADER_3BL_CC
Post 23 - INIT_SYSRAM
Post 27 - VERIFY_HEADER_3BL_CC
Post 2B - RC4_DECRYPT_3BL_CC
Post 2F - RELOCATE
Post 3B - PCI_INIT
Post 45 - HMACSHA_COMPUTE
Post 46 - RC4_INITIALIZE
Post 47 - RC4_DECRYPT
Post 48 - SHA_COMPUTE
Post 49 - SHA_VERIFY
Post 4A - LOAD_6BL_CF
Post 4B - LZX_EXPAND
Post 4F - VERIFY_OFFSET_6BL_CF
Post 5B - INIT_KEYRING
Post 5F
Post 61 - INIT_HAL_PHASE_0
Post 62 - INIT_PROCESS_OBJECTS
Post 64 - INIT_MEMORY_MANAGER
Post 65 - INIT_STACKS
Post 66 - INIT_OBJECT_SYSTEM
Post 67 - INIT_PHASE1_THREAD
Post 68 - Started phase 1 Initialization + INIT_PROCESSORS
Post 69 - INIT_KEY_VAULT
Post 6A - INIT_HAL_PHASE_1
Post 6B - INIT_SFC_DRIVER
Post 6F - INIT_POWER_MODE
Post 7B
Post 7F
Done!

I also forgot to mention that I am using the alt cpu_rst point on topside for the glitch. Is it any relevant to the issue?

gavin_darkglider · July 14, 2015

The only alternative to the E point I know of would be directly soldering to the trace. as that trace goes either to the hana, or the southbridge, which are extreemly hard to solder wires to, with the BGA and all. as for the top side cpu_rst point, are you soldering to the resistor, or the old coolrunner point? the resistor makes a difference.

MrKronic · July 14, 2015

Oh, I was talking about the E point on the R-JTag chip. Like I mentioned before, the console itself is fresh. The alternative for this is soldering directly on to the 16th leg of the R-jtag IC,but the pins are so small that I can't stick a small wire without a loose joint or cross connection.

As for the CPU_RST point, I'm using the resistor point in accordance to the original R-JTAg guide. If that is the problem, what is the exact issue with that point itself? Also is that what's causing the POST reads to go haywire this time?

Edit: Changed the cpu_rst to the bottom side one. Still no change in the POST reads or boot-up

MrKronic · July 15, 2015

Update: Fixed up the R-JTAG board and installed it now. Seems to be glitching OK but now the POST code fails after POST 0x20. The E point seems to be a bit ropey but I've managed to get a solid conection. This is the end post result:

Post 10 - Payload/1BL started 
Post 12 - FSB_CONFIG_RX_STATE 
Post 14 - FSB_CONFIG_TX_CREDITS 
Post 16 - FETCH_HEADER 
Post 18 - FETCH_CONTENTS 
Post 1A - RC4_INITIALIZE 
Post 1C - SHA_COMPUTE 
Post 1E - BRANCH 
Post 20 - CB entry point reached 
Post A0 - Panic - VERIFY_SECOTP_6

gavin_darkglider · July 15, 2015

Post A0 means full fail, try a different dip.

Swizzy · July 15, 2015

Update: Fixed up the R-JTAG board and installed it now. Seems to be glitching OK but now the POST code fails after POST 0x20. The E point seems to be a bit ropey but I've managed to get a solid conection. This is the end post result:
Post 10 - Payload/1BL started 
Post 12 - FSB_CONFIG_RX_STATE 
Post 14 - FSB_CONFIG_TX_CREDITS 
Post 16 - FETCH_HEADER 
Post 18 - FETCH_CONTENTS 
Post 1A - RC4_INITIALIZE 
Post 1C - SHA_COMPUTE 
Post 1E - BRANCH 
Post 20 - CB entry point reached 
Post A0 - Panic - VERIFY_SECOTP_6 

Try different timing settings...

MrKronic · July 16, 2015

Tried all of them, at 330 and 470ohms and also at 1.2v and 1.6v for each setting.Its always ends up with two different POST Code errors:

===================================================
Wednesday, July 15, 2015 6:08:43 AM

J-Runner v0.3 Beta (7) Started


WARNING! - Your selected working directory already contains files!
You can view these files by using 'Show Working Folder' Button


Checking Files
Finished Checking Files
Checking Console..
Version: 10
Flash Config: 0x00000000
Can not Continue
Can not continue
Checking Console..
Version: 10
Flash Config: 0x00000000
Can not Continue
Can not continue
Checking Console..
Version: 10
Flash Config: 0x00AA3020
00AA3020
Jasper 512MB
CB Version: 6723
Checking Console..
Version: 10
Flash Config: 0x00AA3020
00AA3020
Jasper 512MB
CB Version: 6723
Checking Console..
Device Not Found.
Can not continue
Checking Console..
Device Not Found.
Can not continue
Checking Console..
Version: 10
Flash Config: 0x00AA3020
00AA3020
Jasper 512MB
CB Version: 6723
Version: 10
Press Escape to exit
Waiting for POST to change
Post 01
Post 1D - SIG_VERIFY
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post A1 - Panic - VERIFY_SECOTP_7
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post A1 - Panic - VERIFY_SECOTP_7
Post 01
Post C1 - LZX_EXPAND_1
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post A1 - Panic - VERIFY_SECOTP_7
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post A1 - Panic - VERIFY_SECOTP_7
Post 01
Post 03
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post A1 - Panic - VERIFY_SECOTP_7
Post 01
Post 81 - Panic - MACHINE_CHECK
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post A1 - Panic - VERIFY_SECOTP_7
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post A1 - Panic - VERIFY_SECOTP_7
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post A1 - Panic - VERIFY_SECOTP_7
Post 01
Post 41 - VERIFY_OFFSET
Post 01
Post 41 - VERIFY_OFFSET
Post 01
Post 41 - VERIFY_OFFSET
Post 01
Post 41 - VERIFY_OFFSET
Post 01
Post 41 - VERIFY_OFFSET
Post 01
Post 41 - VERIFY_OFFSET
Post 01
Post 41 - VERIFY_OFFSET
Post 01
Post 41 - VERIFY_OFFSET
Post 01
Post 41 - VERIFY_OFFSET
Post 01
Post 41 - VERIFY_OFFSET
Post 01
Post 41 - VERIFY_OFFSET
Post 01
Post 41 - VERIFY_OFFSET
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post A1 - Panic - VERIFY_SECOTP_7
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post A1 - Panic - VERIFY_SECOTP_7
Done!

Version: 10
Press Escape to exit
Waiting for POST to change
Post 01
Post 05
Post 51 - LOAD_UPDATE_2
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post A1 - Panic - VERIFY_SECOTP_7
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post A1 - Panic - VERIFY_SECOTP_7
Post 01
Post 07
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post A1 - Panic - VERIFY_SECOTP_7
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post A1 - Panic - VERIFY_SECOTP_7
Post 01
Post 61 - INIT_HAL_PHASE_0
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post A1 - Panic - VERIFY_SECOTP_7
Post 01
Post 25 - LOCATE_3BL_CC
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post A1 - Panic - VERIFY_SECOTP_7
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post A1 - Panic - VERIFY_SECOTP_7
Post 01
Done!

Checking Console..
Device Not Found.
Can not continue
Checking Console..
Version: 10
Flash Config: 0x00AA3020
00AA3020
Jasper 512MB
CB Version: 6723
Initializing nanddump1.bin..
Jasper 512MB
Jtag Selected
Nand Initialization Finished
Comparing...Takes a while on big nands
Nands are the same
Aud_Clamp Selected
R-Jtag Selected
Patching Jasper version 2.3 SMC at offset 0x12BA
XeLL file created Successfully jasper_hack_bigblock_aud_clamp.bin
Version: 10
Flash Config: 0x00AA3020
Writing Nand
jasper_hack_bigblock_aud_clamp.bin
Done!
in 0:18 min:sec

Checking Console..
Version: 00
Wrong Version.
Can not continue
Checking Console..
Version: 10
Flash Config: 0x00AA3020
00AA3020
Jasper 512MB
CB Version: 6723
Checking Console..
Version: 10
Flash Config: 0x00000000
Can not Continue
Can not continue
Checking Console..
Version: 10
Flash Config: 0x00AA3020
00AA3020
Jasper 512MB
CB Version: 6723
Version: 10
Press Escape to exit
Waiting for POST to change
Done!

Version: 10
Press Escape to exit
Waiting for POST to change
Post 04
Post 10 - Payload/1BL started
Post 12 - FSB_CONFIG_RX_STATE
Post 14 - FSB_CONFIG_TX_CREDITS
Post 16 - FETCH_HEADER
Post 18 - FETCH_CONTENTS
Post 1A - RC4_INITIALIZE
Post 1C - SHA_COMPUTE
Post 1E - BRANCH
Post 20 - CB entry point reached
Post A0 - Panic - VERIFY_SECOTP_6
Post 10 - Payload/1BL started
Post 12 - FSB_CONFIG_RX_STATE
Post 14 - FSB_CONFIG_TX_CREDITS
Post 16 - FETCH_HEADER
Post 18 - FETCH_CONTENTS
Post 1A - RC4_INITIALIZE
Post 1C - SHA_COMPUTE
Post 1E - BRANCH
Post 20 - CB entry point reached
Post A0 - Panic - VERIFY_SECOTP_6
Post 10 - Payload/1BL started
Post 12 - FSB_CONFIG_RX_STATE
Post 14 - FSB_CONFIG_TX_CREDITS
Post 16 - FETCH_HEADER
Post 18 - FETCH_CONTENTS
Post 1A - RC4_INITIALIZE
Post 1C - SHA_COMPUTE
Post 1E - BRANCH
Post 20 - CB entry point reached
Post A0 - Panic - VERIFY_SECOTP_6
Post 10 - Payload/1BL started
Post 12 - FSB_CONFIG_RX_STATE
Post 14 - FSB_CONFIG_TX_CREDITS
Post 16 - FETCH_HEADER
Post 18 - FETCH_CONTENTS
Post 1A - RC4_INITIALIZE
Post 1C - SHA_COMPUTE
Post 1E - BRANCH
Post 20 - CB entry point reached
Post A0 - Panic - VERIFY_SECOTP_6
Done!

===================================================
Wednesday, July 15, 2015 7:30:59 AM

J-Runner v0.3 Beta (7) Started


WARNING! - Your selected working directory already contains files!
You can view these files by using 'Show Working Folder' Button


Checking Files
Finished Checking Files
Checking Console..
Version: 10
Flash Config: 0x00AA3020
00AA3020
Jasper 512MB
CB Version: 6723
Checking Console..
Version: 10
Flash Config: 0x00000000
Can not Continue
Can not continue
Checking Console..
Version: 10
Flash Config: 0x00AA3020
00AA3020
Jasper 512MB
CB Version: 6723
Version: 10
Press Escape to exit
Waiting for POST to change
Done!

Version: 10
Press Escape to exit
Waiting for POST to change
Post 01
Post 41 - VERIFY_OFFSET
Post 01
Post E1
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post A1 - Panic - VERIFY_SECOTP_7
Post 01
Post 11 - FSB_CONFIG_PHY_CONTROL
Post 13 - FSB_CONFIG_TX_STATE
Post 15 - FETCH_OFFSET
Post 17 - VERIFY_HEADER
Post 19 - HMACSHA_COMPUTE
Post 1B - RC4_DECRYPT
Post 1D - SIG_VERIFY
Post 1F
Post 21 - INIT_SECOTP
Post A1 - Panic - VERIFY_SECOTP_7
Post 01

I have included some pictures of the install. I have doubts regarding the soldering of E, but the rest of the points are solid including the POST and I've checked them with a multimeter before final install. ALso I reflashed a clean Xell image that I built from a complete dump.

Swizzy · July 16, 2015

The settings on the QSB doesn't matter, the settings on the chip does (try different timings, there are alternatives on CR4 also afaik)

MrKronic · July 17, 2015

But I am not using the CR4 anymore. I replaced it with the spare R-JTAG chip with the fixed E poin t(hence the picture). And if I remember correctly, I can't write timing files into the R-JTAG chip can I?

And yes, tried different dip settings, resistances and voltages again.....still the same result

Swizzy · July 17, 2015

But I am not using the CR4 anymore. I replaced it with the spare R-JTAG chip with the fixed E poin t(hence the picture). And if I remember correctly, I can't write timing files into the R-JTAG chip can I?

And yes, tried different dip settings, resistances and voltages again.....still the same result

R-JTAG also have dip-switches with different timings... but no, CR4 and/or R-JTAG comes pre-programmed for ALL boards...

MrKronic · July 19, 2015

R-JTAG also have dip-switches with different timings... but no, CR4 and/or R-JTAG comes pre-programmed for ALL boards...

Tried everything again....still no dice Even using the other cpu_rst point isn't doing much good. Any other solutions?

MrKronic · July 24, 2015

Issue solved It seems the issue was a cold solder joint at the post points .I had to redo the soldering even though it gave a perfect continuity read from the topside point :/

However there is a new problem. After doing a rater test to find the perfect glitch point I settled for the dip config 8-7-2/no volt jumper/470ohm based on the number of 1 cycle boots. However even then the setting seems to be very unstable, as the POST is failing quite regularly and it boots after 2-3 restarts. What could be the cause of this?

Swizzy · July 24, 2015

What does "2-3 restarts" mean by your standards?

MrKronic · July 24, 2015

Sorry, I meant power cycling the console 2-3 times manually. The console rrods with 0022 after exactly 5 glitch attempts, after which I restart the console again

Swizzy · July 24, 2015

That means that you don't have the glitch patch in your SMC... what did you use to build the image?

R-JTAG is basically just a JTAG image with the glitch patch applied to the SMC... (which disables the limit for the restarts)

MrKronic · July 24, 2015

I tried using Xebuild extension of J-Runner first, but it always ended with a warning about smc not being patched because of reset limit. So I switched to the Xebuild GUI. Didn't get any warnings or errors there, so I used that.

Btw I also had to set the build settings to JTAG manually. The GUI suggested using rgh for some reason...

Swizzy · July 24, 2015

I tried using Xebuild extension of J-Runner first, but it always ended with a warning about smc not being patched because of reset limit. So I switched to the Xebuild GUI. Didn't get any warnings or errors there, so I used that.

Btw I also had to set the build settings to JTAG manually. The GUI suggested using rgh for some reason...

Yeah, JTAG is meant for old CB versions...

You need to manually add "-o patchsmc" to the commandline when doing R-JTAG, enable advanced mode and check the box to open commandline/argument editor

MrKronic · July 24, 2015

Got it. Will work on it a bit later

Btw could this also be the reason for the inconsistent boot times that I've been having?

Swizzy · July 24, 2015

Got it. Will work on it a bit later

Btw could this also be the reason for the inconsistent boot times that I've been having?

Not really, it's a glitch hack... it's not going to be instantly working every time... however, the RROD you get is due to this...

MrKronic · July 25, 2015

Yeah, JTAG is meant for old CB versions...

You need to manually add "-o patchsmc" to the commandline when doing R-JTAG, enable advanced mode and check the box to open commandline/argument editor

not working. Still RROD after 5 glitch attempts. Should I erase the nand again and start from flashing Xell?

Swizzy · July 25, 2015

not working. Still RROD after 5 glitch attempts. Should I erase the nand again and start from flashing Xell?

Send me your NAND + Cpukey and i'll fix it for ya

Sign In

Issues with Xell not loading after CR$ install

Recommended Posts

MrKronic 7

Share this post

Link to post

Share on other sites

gavin_darkglider 1562

Share this post

Link to post

Share on other sites

MrKronic 7

Share this post

Link to post

Share on other sites

gavin_darkglider 1562

Share this post

Link to post

Share on other sites

MrKronic 7

Share this post

Link to post

Share on other sites

gavin_darkglider 1562

Share this post

Link to post

Share on other sites

MrKronic 7

Share this post

Link to post

Share on other sites

MrKronic 7

Share this post

Link to post

Share on other sites

gavin_darkglider 1562

Share this post

Link to post

Share on other sites

Swizzy 2084

Share this post

Link to post

Share on other sites

MrKronic 7

Share this post

Link to post

Share on other sites

Swizzy 2084

Share this post

Link to post

Share on other sites

MrKronic 7

Share this post

Link to post

Share on other sites

Swizzy 2084

Share this post

Link to post

Share on other sites

MrKronic 7

Share this post

Link to post

Share on other sites

MrKronic 7

Share this post

Link to post

Share on other sites

Swizzy 2084

Share this post

Link to post

Share on other sites

MrKronic 7

Share this post

Link to post

Share on other sites

Swizzy 2084

Share this post

Link to post

Share on other sites

MrKronic 7