Hardware flashing: Difference between revisions

From PS3 Developer wiki
Jump to navigation Jump to search
mNo edit summary
m (Text replacement - "!important!important" to "!important")
 
(356 intermediate revisions by 31 users not shown)
Line 1: Line 1:
[[Category:Hardware]]
<div style="float:right">[[File:Progskeet wiring to NANDs COK-002-idone-SAM 1765.jpg|200px|thumb|left|Progskeet wired to NANDs of a COK-002 board (photo:idone)]]<br />
<div style="float:right">[[File:Progskeet wiring to NANDs COK-002-idone-SAM 1765.jpg|200px|thumb|left|Progskeet wired to NANDs of a COK-002 board (photo:idone)]]<br />[[File:PS3_Hardware.JPG|200px|thumb|left|Typical NOR flashing requires 16 Data wires, 23 Address wires and 3-4 control wires to the NOR pads (photo:defyboy)]]</div>
[[File:PS3_Hardware.JPG|200px|thumb|left|Typical NOR flashing requires 16 Data wires, 23 Address wires and 3-4 control wires to the NOR pads (photo:defyboy)]]</div>
= intro=
Before you think this is going to be easy, let me explain why not:
* 18 SKU´s (15 different: [[CECHAxx]] · [[CECHBxx]] · [[CECHCxx]] · [[CECHExx]] · [[CECHGxx]] · [[CECHHxx]] · [[CECHJxx]] · [[CECHKxx]] · [[CECHLxx]] · [[CECHMxx]] · [[CECHPxx]] · [[CECHQxx]] · [[CECH-20xx]] · [[CECH-21xx]] · [[CECH-25xx]] · [[CECH-30xx]] · [[CECH-40xx]])
** with 13 different motherboards ([[COK-00x|COK-001]] · [[COK-00x|COK-002]] · [[COK-00x|COK-002W]] · [[SEM-00x]] · [[DIA-00x]] · [[VER-00x]] · [[DYN-00x]] · [[SUR-00x]] · [[JTP-00x]] · [[JSD-00x]] · [[KTE-00x]] · [[MSX-00x]])
*** 9 flashtypes (NAND: Samsung [[K9F1G08U0A-PIB0]] · Samsung [[K9F1G08U0B-PIB0]] · Samsung [[K9F2G08U0M]] / NOR: Macronix [[MX29GL128ELT2I-90G]] · [[MX29GL128FLT2I]], Samsung [[K8P2716UZC-QI4D]] · [[K8Q2815UQB-PI4B]], Spansion [[S29GL128N90TFIR2]] · [[S29GL128P90TFIR2]])
* 4 powering options (console powered yes/no, flasher selfpowered yes/no)
* more than 6 hardware flashers ([[Infectus]], [[Noraliser]], NORway' [[Teensy++ 2.0]], [[Progskeet 1.0 / 1.1]] / [[Progskeet 1.2]], [[E3]], [[PNM]], [[PIC32MX]])
but even with that amazing number of possible variations, it all comes down to '''2 seperate diagrams to use: NAND or NOR'''.


Both early launch consoles which feature [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NAND NAND flash] memory (block devices, that interleave their data unlike [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NOR NOR flash]) and later consoles which feature [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NOR NOR flash] memory are able to be flashed. Currently the preferred method of flashing the dual-NAND consoles is by using an infectus modchip or similar (e.g. Progskeet).
== Hardware Flashers ==
Both early launch consoles which feature [[Flash_%28Hardware%29#NAND | NAND flash]] memory (block devices, that interleave their data unlike [[Flash_%28Hardware%29#NOR | NOR flash]]) and later consoles which feature [[Flash_%28Hardware%29#NOR | NOR flash]] memory are able to be flashed.
=== Different Flashers ===


Marcan has made a NOR flasher / address sniffer for his PS3 slim by re-purposing a FPGA board (Xilinx Spartan3E XC3S500E) made for Wii hacking. noralizer is a git repo that contains the HDL (verilog) and associated host computer tools for flashing/sniffing. There are ~50 signals to solder.
==== Infectus ====
...
 
==== Noraliser ====
Marcan has made a [[:File:Marcan-noraliser-asbestos.jpg|NOR flasher / address sniffer]] for his PS3 slim by re-purposing a FPGA board ([http://www.xilinx.com/support/documentation/data_sheets/ds312.pdf Xilinx Spartan3E XC3S500E]) made for Wii hacking. [[Noraliser]] is a git repo that contains the HDL (verilog) and associated host computer tools for flashing/sniffing. There are ~50 signals to solder.
 
==== NORway ====
Work has been underway to brink a low cost AVR ([http://www.atmel.com/dyn/resources/prod_documents/7593S.pdf Atmel 90USB1286]) based NOR flasher that is capable of reading and writing on all consoles by defyboy. This was opensourced and further enhanced, now known as NORway for [[Teensy++ 2.0]] boards.
 
==== Progskeet ====
Other people haven't been sitting idle either: uf6667 and bmx have developed [[Progskeet 1.0 / 1.1]], based on an [http://www.actel.com/documents/PA3_DS.pdf Actel A3P125 FPGA] for NAND and NOR based consoles (not only PS3, but also useable for Wii and Xbox360). Later followed up by [[Progskeet 1.2]], which was anounced to get an open API.
Although highly hyped/marketed as universal flasher, it is not the recommended end user choice: long history of issues, long time between fixes, no clear support path etc.


Work has been underway to brink a low cost AVR ([http://www.atmel.com/dyn/resources/prod_documents/7593S.pdf Atmel 90USB1286]) based NOR flasher that is capable of reading and writing on all consoles by defyboy. Other people havent been sitting idle either: uf6667 and Icekiller have developed [http://www.progskeet.com/ Progskeet], based on a [http://www.actel.com/documents/PA3_DS.pdf Actel A3P125 MCU] for NAND ánd NOR based consoles and "no_one" has developed PNM - Project Nor Manager.
==== PNM ====
"No_One" has developed [[PNM]] - The PS3 NOR Manager is a custom board based on a FPGA ([http://www.altera.com/products/devices/cyclone3/overview/cy3-overview.html Altera Cyclone3 EP3C25]) and 2 flash sockets. PNM is capable to handle the basic features like read/dump/update/copy but also to swap (hot swap or cold swap) the NOR used. It also enbles features to sniff bus activities, emulate NOR flash etc.


== NAND Wiring ==
==== PIC32MX ====
Flashers for NAND based consoles (CECHA/COK-001, CECHB/COK-001, CECHC/COK-002, CECHD/unreleased, CECHE/COK-002W, CECHF/unreleased, CECHG/SEM-001) are generaly wired directly to the pins of the NAND, plus ground and Vcc. For NAND pinouts see: [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NAND Flash (Hardware) #NAND]
[[PIC32MX]] is an opensource PIC based NOR flasher.


There are 2 nands interleaved at the 512byte sectors level, giving a 1024 byte "interleaved sector". pages are 2kb on each nand.
==== E3 ====
The [[E3]] is a China commercial developped PS3 only 'flasher'.<br />
It uses  MCU ARM 32BIT 256K FLASH 144LQFP - STM32F103ZCT6 controller to dump the NOR.


<div style="float:right">[[File:PS3_DualNand_Retail_ProgSkeet.png|200px|thumb|left|Dual NAND connection to Progskeet diagram, see http://progskeet.com/]]<br />[[File:Infectus-ps3-nand.png|200px|thumb|left|Dual NAND connection to Infectus diagram]]</div>
=== Comparison ===
{{ Flash types and models used by PS3}}


<div style="height:420px; overflow:auto">
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"  
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable sortable" style="border:1px solid #999; border-collapse: collapse;"  
|+ PS3 Flashers compatibility
|- bgcolor="#cccccc"
! rowspan="3" | Flasher !! rowspan="13" {{cellcolors|lightgrey}} !! colspan="7" | [[SKU_Models#PS3_Fat|PS3 Fat]] !! rowspan="13" {{cellcolors|lightgrey}} !! colspan="5" | [[SKU_Models#PS3_Slim|PS3 Slim]] !! rowspan="13" {{cellcolors|lightgrey}} !! rowspan="3" | notes
! Chip/PIN !! Description !! [http://www.progskeet.com/download.php Progskeet] !! Infectus || Description
|-
|-
!colspan="5" | NAND 0
! [[CECHAxx|CECHA]]<br />[[CECHBxx|CECHB]] !! [[CECHCxx|CECHC]]<br />[[CECHExx|CECHE]] !! [[CECHExx|CECHE]] !! [[CECHGxx|CECHG]] !! [[CECHHxx|CECHH]] !! [[CECHJxx|CECHJ]]<br />[[CECHKxx|CECHK]] !! [[CECHLxx|CECHL]]<br />[[CECHMxx|CECHM]]<br />[[CECHPxx|CECHP]]<br />[[CECHQxx|CECHQ]] !! [[CECH-20xx|CECH-20xx]] !! [[CECH-21xx|CECH-21xx]] !! [[CECH-25xx|CECH-25xx]] !! [[CECH-25xx|CECH-25xx]] !! [[CECH-30xx|CECH-30xx]]
|-
|-
| style="color:white; background-color:darkgrey;" | 0/1-6 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection
! [[COK-00x#COK-001|COK<br />001]] !! [[COK-00x#COK-002|COK<br />002]] !! [[COK-00x#COK-002W|COK<br />002W]] !! [[SEM-00x|SEM<br />001]] !! [[DIA-00x#DIA-001|DIA<br />001]] !! [[DIA-00x#DIA-002|DIA<br />002]] !! [[VER-00x|VER<br />001]] !! [[DYN-00x|DYN<br />001]] !! [[SUR-00x|SUR<br />001]] !! [[JTP-00x|JTP<br />001]] !! [[JSD-00x|JSD<br />001]] !! [[KTE-00x|KTE<br />001]]
|-
|-
| 0/7 || R/B || 3 / gp13 || A9 || Read/Busy Output
| [[Infectus]] || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || NAND only
|-
|-
| 0/8 || RE || 98 / gp15 || A15 || Read Enable
| [[Progskeet 1.0 / 1.1]] || {{Issues}} || {{Issues}} || {{Issues}} || {{Issues}} || {{Issues}} || {{Issues}} || {{Issues}} || {{Issues}} || {{Issues}} || {{Issues}} || {{Issues}} || {{Issues}} || advertised Universal NAND + NOR + SPI
|-
|-
| 0/9 || CE || 7 / gp9 || A14 || Chip Enable
| [[Progskeet 1.2]] || {{Issues}} || {{Issues}} || {{Issues}} || {{Issues}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || advertised Universal NAND + NOR + SPI
|-
|-
| style="color:white; background-color:darkgrey;" | 0/10+11 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection
| [[Progskeet 1.21]] || {{Issues}} || {{Issues}} || {{Issues}} || {{Issues}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || {{No}} || advertises Universal NAND + NOR + SPI
|-
|-
| 0/12 || style="color:white; background-color:#CC3333;" | Vcc || style="color:white; background-color:#CC3333;" | +3.3 || style="color:white; background-color:darkgrey;" | not used / not connected || style="color:white; background-color:#CC3333;" | Vcc (min 2.7V-max 3.6V / typ 3.3V)
| [[Teensy++ 2.0]]: NANDway / NORway || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || OpenSource / OpenHardware + works for NAND + NOR
|-
|-
| 0/13 || style="color:white; background-color:#333333;" | Vss || style="color:white; background-color:#333333;" | GND || style="color:white; background-color:darkgrey;" | not used / not connected || style="color:white; background-color:#333333;" | VSS - Ground
| [[PNM]] || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || OpenSource / OpenHardware
|-
|-
| style="color:white; background-color:darkgrey;" | 0/14+15 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection
| [[Noraliser]] || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || Not commercially avail.
|-
|-
| 0/16 || CLE || 4 / gp12 || A13 || Command Latch Enable
| [[PIC32MX]] || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || OpenSource / OpenHardware
|-
|-
| 0/17 || ALE || 5 / gp11 || A12 || Address Latch Enable
| [[E3]] || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || {{Yes}} || 1 console only (unless you use the Samsung multi console update)
|-
|-
| 0/18 || WE || 2 / gp14 || A11 || Write Enable
! connection type !! colspan="4" | NAND layout 1 !! colspan="2" | NOR layout 1 !! colspan="1" | NOR layout 2 || colspan="1" | NOR layout 3 !! colspan="4" | NOR layout 4 !!
|-
|-
| 0/19 || WP || 6 / gp10 || A10 || Write Protect
|}
 
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable sortable" style="border:1px solid #999; border-collapse: collapse;"
|+ PS3 Flashers features
! Feature !! [[Infectus]] !! [[PNM]] !! [[Progskeet 1.0 / 1.1]] !! [[Progskeet 1.2]] / [[Progskeet 1.21|1.21]] !! [[Teensy++ 2.0]]<br />NANDway / NORway !! [[PIC32MX]] !! [[E3]] !! Remarks
|-
|-
| style="color:white; background-color:darkgrey;" | 0/20-28 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection
| Use CFI || ? || {{Yes}} || {{Yes}} || {{Yes}} || {{No}} || ? || ? || Common Flash Memory Interface writing strategies (Progkseet can dump CFI, but doesnt use it directly for writestrategy)
|-
|-
| 0/29 || I/O-0 || 90 / dq8 || A0 ||  
| PS3 NAND Support<br /><small>(see above table)</small> || {{Yes}} || {{No}} || {{Yes}} || {{Yes}} || {{Yes}} || {{No}} || {{Yes}} || E3 supports NAND with later 'to be released' edition 
|-
|-
| 0/30 || I/O-1 || 91 / dq9 || A1 ||  
| PS3 NOR Support<br /><small>(see above table)</small> || {{No}} || {{Yes}} || {{Yes}} || {{Issues}} || {{Yes}} || {{Yes}} || {{Yes}} || Users reporting NOR writing problems on Progskeet 1.2 / 1.21
|-
|-
| 0/31 || I/O-2 || 92 / dq10 || A2 ||  
| Solderless || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{No}} || {{No}} || {{Yes}} || Solderless is optional for E3 (but still requires soldering tristate).
NOR/NAND solderless clip for [[Progskeet 1.0 / 1.1]] are already available now.
Announced for PNM near future.
|-
|-
| 0/32 || I/O-3 || 93 / dq11 || A3 ||  
| OpenSource || {{No}} || {{Yes}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{No}} || 
|-
|-
| style="color:white; background-color:darkgrey;" | 0/33-35 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection
| OpenHardware || {{No}} || {{Yes}} || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{No}} || 
|-
|-
| 0/36 || style="color:white; background-color:#333333;" | Vss || style="color:white; background-color:#333333;" | GND || style="color:white; background-color:darkgrey;" | not used / not connected || style="color:white; background-color:#333333;" | VSS - Ground
| Updateable || JTAG || USB || JTAG || JTAG || USB || ISP || microSD || 
|-
|-
| 0/37 || style="color:white; background-color:#CC3333;" | Vcc || style="color:white; background-color:#CC3333;" | +3.3 || style="color:white; background-color:darkgrey;" | not used / not connected || style="color:white; background-color:#CC3333;" | Vcc (min 2.7V-max 3.6V / typ 3.3V)
| Onboard Flash || {{No}} || {{Yes}} || {{No}} || {{No}} || {{No}} || {{No}} || {{Yes}} || Instant-on dual firmware for PNM using a jumper // E3 uses flash on driveboard, not internal
|-
|-
| style="color:white; background-color:darkgrey;" | 0/38-40 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection
| Dual Boot solution || {{No}} || {{Yes}} || {{Yes}} || {{Yes}} || {{No}} || {{No}} || {{Yes}} || Real quick dualboot requires dual flash (and user to swap the harddrive)
|-
|-
| 0/41 || I/O-4 || 94 / dq12 || A4 ||  
| File Transfer Protocol || USB || X-Modem || USB || USB || USB || || ||
|-
|-
| 0/42 || I/O-5 || 95 / dq13 || A5 ||  
| Mass Production || {{No}} || {{No}} || {{Yes}} || {{Yes}} || {{No}} || {{No}} || {{Yes}} || PNM V2 might be mass produced
|-
|-
| 0/43 || I/O-6 || 96 / dq14 || A6 ||  
| X360 NAND Support || {{Yes}} || {{No}} || {{Yes}} || {{Yes}} || {{No}} || {{No}} || {{No}} ||  
|-
|-
| 0/44 || I/O-7 || 97 / dq15 || A7 ||  
| Wii NAND Support || {{Yes}} || {{No}} || {{Yes}} || {{Yes}} || {{No}} || {{No}} || {{No}} ||  
|-
|-
| style="color:white; background-color:darkgrey;" | 0/45-48 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection
|}
 
== Generic Warning ==
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"  
|-
|-
! Chip/PIN !! Description !! [http://www.progskeet.com/download.php Progskeet] !! Infectus || Description
! style="background-color:red!important;" | <span style="background-color:lightred; color:white;">Generic Warning</span>
|-
|-
!colspan="5" | NAND 1
| <span style="white; color:red!important; font-size:180%; ">Make sure you have several proper dumps of your flash before even trying writing to it! Use unpacking tools (e.g. Norunpack, Flowrebuilder, Norpatch etc.) and hexeditors (e.g. HxD) and use [[Flash]] page as reference.
|-
* CRC/MD5 is not a method to check your flash (if it is bad, you are only comparing if the other file is equally bad).
| style="color:white; background-color:darkgrey;" | 1/1-6 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection
* Also make sure you checked the content of the flash, Flowrebuilder, Norunpack only looks for image header and unpacks without warnings and without checking the content.
|-
 
| 1/7 || R/B || 64 / rdy || U || Read/Busy Output
See also: [[Validating flash dumps]]
|-
 
| 1/8 || RE || 69 / oe || M || Read Enable
You cannot recover from bad flash without proper dumps (e.g. bricking the console beyond repair).</span>
|-
| 1/9 || CE || 60 / gp3 || N || Chip Enable
|-
| style="color:white; background-color:darkgrey;" | 1/10+11 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection
|-
| 1/12 || style="color:white; background-color:#CC3333;" | Vcc || style="color:white; background-color:#CC3333;" | +3.3 || style="color:white; background-color:darkgrey;" | not used / not connected || style="color:white; background-color:#CC3333;" | Vcc (min 2.7V-max 3.6V / typ 3.3V)
|-
| 1/13 || style="color:white; background-color:#333333;" | Vss || style="color:white; background-color:#333333;" | GND || style="color:white; background-color:darkgrey;" | not used / not connected || style="color:white; background-color:#333333;" | VSS - Ground
|-
| style="color:white; background-color:darkgrey;" | 1/14+15 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection
|-
| 1/16 || CLE || 63 / gp0 || O || Command Latch Enable
|-
| 1/17 || ALE || 62 / gp1 || P || Address Latch Enable
|-
| 1/18 || WE || 65 / we || Q || Write Enable
|-
| 1/19 || WP || 61 / gp2 || T || Write Protect
|-
| style="color:white; background-color:darkgrey;" | 1/20-28 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection
|-
| 1/29 || I/O-0 || 79 / dq0 || D0 ||
|-
| 1/30 || I/O-1 || 80 / dq1 || D1 ||
|-
| 1/31 || I/O-2 || 81 / dq2 || D2 ||
|-
| 1/32 || I/O-3 || 82 / dq3 || D3 ||
|-
| style="color:white; background-color:darkgrey;" | 1/33-35 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection
|-
| 1/36 || style="color:white; background-color:#333333;" | Vss || style="color:white; background-color:#333333;" | GND || style="color:white; background-color:darkgrey;" | not used / not connected || style="color:white; background-color:#333333;" | VSS - Ground
|-
| 1/37 || style="color:white; background-color:#CC3333;" | Vcc || style="color:white; background-color:#CC3333;" | +3.3 || style="color:white; background-color:darkgrey;" | not used / not connected || style="color:white; background-color:#CC3333;" | Vcc (min 2.7V-max 3.6V / typ 3.3V)
|-
| style="color:white; background-color:darkgrey;" | 1/38-40 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection
|-
| 1/41 || I/O-4 || 83 / dq4 || D4 ||
|-
| 1/42 || I/O-5 || 84 / dq5 || D5 ||
|-
| 1/43 || I/O-6 || 85 / dq6 || D6 ||
|-
| 1/44 || I/O-7 || 86 / dq7 || D7 ||
|-
| style="color:white; background-color:darkgrey;" | 1/45-48 || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | NC || style="color:white; background-color:darkgrey;" | No Connection
|-
!colspan="5" | Board trace
|-
| GND || style="color:white; background-color:#333333;" | Vss || style="color:white; background-color:darkgrey;" | not used / not connected || style="color:white; background-color:#333333;" | GND || style="color:white; background-color:#333333;" | VSS - Ground
|-
| +5V || style="color:white; background-color:#CC3333;" | Vcc || style="color:white; background-color:darkgrey;" | not used / not connected || style="color:white; background-color:#CC3333;" | 5V || style="color:white; background-color:#CC3333;" | Vcc (typ +5VDC) from TH3401
|-
|-
|}
|}
</div>
 
== NAND Wiring ==
Flashers for NAND based consoles (CECHA/COK-001, CECHB/COK-001, CECHC/COK-002, CECHD/unreleased, CECHE/COK-002W, CECHF/unreleased, CECHG/SEM-001) are generaly wired directly to the pins of the NAND ('''you cannot use the testpoints!'''), plus ground and Vcc. For NAND pinouts see: [[Flash (Hardware) #NAND]]
 
There are 2 nands interleaved at the 512byte sectors level, giving a 1024 byte "interleaved sector". pages are 2kb on each nand.
 
=== Which NAND is low (NAND 0)/high (NAND 1)? ===
* COK-001 :
** IC3802 LOW (<abbr title="main componentside with SATA connector, CELL BE, RSX etc">main componentside</abbr> next to [[Starship2]])
** IC3803 HIGH (backside next to 60-pin BD ATA connector)
 
* COK-002 + COK-002W :
** [[:File:CECHC NAND-IC3802.JPG|IC3802 LOW]] (<abbr title="main componentside with SATA connector, CELL BE, RSX etc">main componentside</abbr> between SATA connector and [[South Bridge]])
** [[:File:CECHC-NAND-IC3803.JPG|IC3803 HIGH]] (<abbr title="main componentside with SATA connector, CELL BE, RSX etc.">main componentside</abbr> between SATA connector and [[Connectors#CN2401_12P|AV Multi connector]])
 
* SEM-001 :
** IC3802 LOW (backside)
** IC3803 HIGH (main componentside with SATA connector, CELL BE, RSX etc.)
 
=== SMD parts connecting to the NANDs ===
* NAND0:
** R3841 : 2200 {{ohm}} (between SS2_XFRB0 / RB#-pin7 and +3.3_SB_VDDIO/VCC as pullup)
** R3812 : xx (between SS2_XFWP0 and WP#-pin19)
** R3813 : 0 {{ohm}} (between +3.3_SB_VDDIO and WP#-pin19 as always pulled up WP#)
** C3823 : 0.1{{micro}}F B 10V (between GND-pin13 and +3.3_SB_VDDIO/VCC-pin12 for filtering)
** C3824 : 0.1{{micro}}F B 10V (between GND-pin36 and +3.3_SB_VDDIO/VCC-pin37 for filtering)
 
* NAND1:
** R3840 : 2200 {{ohm}} (between SS2_XFRB1 / RB#-pin7 and +3.3_SB_VDDIO/VCC as pullup)
** R3814 : xx (between SS2_XFWP1 and WP#-pin19)
** R3815 : 0 {{ohm}} (between +3.3_SB_VDDIO and WP#-pin19 as always pulled up WP#)
** C3825 : 0.1{{micro}}F B 10V (between GND-pin13 and +3.3_SB_VDDIO/VCC-pin12 for filtering)
** C3826 : 0.1{{micro}}F B 10V (between GND-pin36 and +3.3_SB_VDDIO/VCC-pin37 for filtering)
 
Effect when lost:
* Without RB# pullup parts (pin19) it cannot be read or written with adequate timings (only with a flasher can slow down writing and not by PS3)
* Without WP# pullup parts (pin7) it cannot be written (only with a flasher that pullup WP# and not by PS3)
* Without VCC filter parts (pins 12+37) it cannot be read nor written (only with a flasher that injects VCC and not by PS3)
 
=== Pinout Table ===
{{NAND-Flashertable}}
Remarks:
Remarks:
* Progskeet is feeded from NAND 3.3V
* [[Progskeet 1.0 / 1.1]] is feeded from NAND 3.3V
* Infectus is feeded from +5V board trace.
* Infectus is feeded from +5V board trace.
* NAND's are feeded in both cases by the console itself.
* NAND's are feeded in both cases by the console itself.


Progskeet Note: Some modification is needed for Progskeet to unbrick:
[[Progskeet 1.0 / 1.1]] Note: Some modification is needed for [[Progskeet 1.0 / 1.1]] to unbrick:
* desolder R8 from the Progskeet PCB
* desolder R8 from the [[Progskeet 1.0 / 1.1]] PCB (to disable the connection from pad R8 to left pad R7)
* left pin of switch to left lead of R7, middle pin of switch to right lead of R7
* left pin of [http://www.google.com/search?um=1&hl=nl&safe=off&tbm=isch&sa=1&q=switch+toggle toggle switch] to left lead of R7, middle pin of [http://www.google.com/search?um=1&hl=nl&safe=off&tbm=isch&sa=1&q=switch+toggle toggle switch] to right lead of R7
* Vcc to +3.3 // put switch in "OFF" (right) postion, power on the ps3, put the switch in the "ON"/left position, it will be recognized by the PC, NAND is always on now, do everything as usual''.
* Vcc to +3.3 // put [http://www.google.com/search?um=1&hl=nl&safe=off&tbm=isch&sa=1&q=switch+toggle toggle switch] in "OFF" (right) postion, power on the ps3, put the [http://www.google.com/search?um=1&hl=nl&safe=off&tbm=isch&sa=1&q=switch+toggle toggle switch] in the "ON"/left position, it will be recognized by the PC, NAND is always on now, do everything as usual''.


=== NAND + clips ===
First make sure everything is correct:
* Connect the flasher to the "Y" NAND adapterboard and from there connect the NAND clips to the "Y" NAND adapterboard.
* Install flasher application
* Connect flasher to PC
* Install drivers with zadig.exe (select winusb for latest Winskeet, libusb0 is only for older versions)
* Use the "Check for Shorts" option in the flasherapplication.
Make sure the clips are fitted correctly over the NANDs:
* note the markerdot for pin1 (both on clip and NAND package)
* make sure all pins make contact
* check if it is all the way down to the PCB evenly and no components surrounding the NAND are preventing it from going down proper (might need some filing to make room).
* You can take the topcap off the clip if you need, and can use hotglue ''on the outsides'' to further fixate it.
Preparing console further:
* Replace the thermalcompound (e.g. Arctic Cooling MX-4) for the heatsink : [[CELL BE]] and [[RSX]] and reassemble the heatsink+fan.
* Connect the [[Power Supply]], [[Harddrive]] and the power/resetbutton subboard
* For dumping/reflashing it is not needed to connect the [[Bluray Drive]] or the [[Bluetooth]]+[[Wifi]] board (ofcourse you are going to need them when installing a firmware)
Usage after all is connected:
* First connect flasher to pc
* Use the PS3 to power the NANDs.
[[Progskeet 1.0 / 1.1]] specific:
* On NAND tab, you click NAND 1 and select 'auto'
* On NAND tab, you click NAND 2 and select 'auto'
* If it fails, it means it is not connected correctly


=== Using NAND flashers ===
=== Using NAND flashers ===


==== Progskeet ====
==== [[Progskeet 1.0 / 1.1]] ====
... nothing yet ... please help by adding this :)
Method 1 (with R7 switch and R8 closed):
 
  put switch in "OFF" (R7 is open) position so that [[Progskeet 1.0 / 1.1]] is not powered.
  put switch in "OFF" (R7 is open) position so that progskeet is not powered.
  power on the ps3 and wait for 10-15 seconds (sometimes shorter time is needed),
  power on the ps3 and wait for 20-25 seconds,
  put the switch in the "ON" (R7 closed) position, so [[Progskeet 1.0 / 1.1]] is powered and will be recognized by the PC.
  put the switch in the "ON" (R7 closed) position, so progskeet is powered and will be recognized by the PC.
  NAND is always on now, do everything as usual
  NAND is always on now, do everything as usual
 
&nbsp; 
  select Big Block
  select Big Block
  select Raw
  select Raw
  Pages per block: 64
  Pages per block: 64
  blocks: 1024
  blocks: 1024
That will give you 132MB (138,412,032 bytes) per NAND (dump time ~ 00:02:40 per NAND)
&nbsp; 
That will give you 132MB (138,412,032 bytes) per NAND (dump time ~ 00:02:40 per NAND)
&nbsp; 
For normal console operation (e.g. after you dumped, flashed/downgraded it):
you need switch to "on" (R7 closed) and [[Progskeet 1.0 / 1.1]] USB disconnected.
 
Method 2 (with R7 open / R8 closed):
1. Remove USB cable from your PC
2. Open up [[Progskeet 1.0 / 1.1]] flashing software (use latest) and on Common tab: select the flash you have @ Presets
3. Power on PS3 and wait 10-15 seconds (sometimes shorter time is needed),
4. Plug in the USB cable to your PC
5. [[Progskeet 1.0 / 1.1]] will be recognised and you can now go ahead and dump
For normal console operation (e.g. after you dumped, flashed/downgraded it):
you need to disconnect the USB cable to your PC


===== downloads =====
===== downloads =====
All downloads are available [http://www.progskeet.com/download.php here]
All '''current''' downloads are available [http://www.progskeet.com/download.php here] / all backup/mirror are [http://www.psdevwiki.com/files/flash/Tools/Progskeet/ here]
* diagrams - for PS3: see above, but others are available here: [http://www.progskeet.com/downloads/diagrams_110805.rar diagrams_110805.rar]  (backup/mirror: [http://www.multiupload.com/5XEX630GN5 diagrams_110803.rar (4.76 MB)])
* drivers - [http://www.progskeet.com/downloads/diagrams_110804.rar diagrams_110804.rar]  (mirror: [http://www.multiupload.com/WCWI0XABBU diagrams_110804.rar (9.73 MB)])
* flasher software - [http://www.progskeet.com/downloads/ProgSkeet_110803.rar ProgSkeet_110803.rar] (mirror: [http://www.multiupload.com/N88OW4HAK5 ProgSkeet_110803.rar (28.37 KB)]


==== Infectus ====
==== Infectus ====
Line 180: Line 233:


==== Needed NAND tools ====
==== Needed NAND tools ====
In case the flasher program doesnt understand dual NAND de/interleaving you'll need : [http://www.sendspace.com/file/qhwkm5 FlowRebuilder v.4.1.0.0]
In case the flasher program doesnt understand dual NAND de/interleaving you'll need : [http://psdevwiki.com/files/flash/Tools/Flowrebuilder/ FlowRebuilder]
 
=====Flowrebuilder options=====
*(NAND only) Unscramble then interleave flashes into one unified dump : Makes a single dump.bin from 2 seperate NAND flash dumps.
** In the second step it also extract the content of the unified dump. Make sure it extracts correctly (it will give no warning if it fails!) and all the needed files are there.
*(NAND only) Re-scramble modified dump then de-interleave it into two new flashes : Splits the single dump.bin into 2 seperate NAND flash dumps.
*Byte reverse and extract a NOR  dump file : First byte reverse the single dump.bin then extract NOR content.
*Extract a Byte reversed NOR dump or an interleaved and unscrambled NAND dump : Extract the single dump.bin
 
===== Extracted flash content files =====
<span style="color:red!important;">(make sure they are all there, flowrebuilder will not give warning when it fails!)</span>:
* bootloader_0
* bootloader_1
* cCSD
* cISD
* creserved_0
* cvtrm
* eEID
* trvk_pkg
* trvk_prg
* \asecure_loader\metldr
* \ros\<nowiki>[two seperate folders named to FW version]</nowiki>\[[Boot_Order#CoreOS_PKG_Filelisting|CoreOS files]] (19 up to 25 files, depending the FW version)
 
Notes: if it only extracted bootloader_0 + bootloader_1, check that both NANDs are dumped correct (known error with flashers that has bug with second NAND channel to read),


=== Dump NAND from GameOS ===
=== Dump NAND from GameOS ===
[http://gitbrew.org/~glevand/ps3/pkgs/dump_flash.pkg dump_flash.pkg]   // backup/mirror: [http://www.multiupload.com/545HXQ4FCD dump-flash+syscon.rar (280.51 KB)]<br />
[http://psdevwiki.com/files/flash/Tools/USB%20Flash%20Dump/ USB Flash Dump] // source/mirror:  
[http://gitbrew.org/~glevand/ps3/pkgs/dump_flash.pkg dump_flash.pkg]<br />
Make sure USB stick is FAT32 with enough free space (256MB per dump)
Make sure USB stick is FAT32 with enough free space (256MB per dump)
=== Dumping NAND from Linux ===
dd if=/dev/ps3flash of=NAND.BIN bs=1024
or
dd if=/dev/ps3vflasha of=NAND.BIN bs=1024
(needs unmasking first, see below)


=== Difference between hardware dumps and software dumps ===
=== Difference between hardware dumps and software dumps ===
Line 203: Line 286:
  addi    %r12, %r4, 0x200 # r4 = start sector
  addi    %r12, %r4, 0x200 # r4 = start sector


25MB NAND consoles have a hidden section of size 0x40000 (0x200 * 512 byte sector = 0x40000) hidden by the hv. The hv hides it at address 002786E8  
256MB NAND consoles have a hidden section of size 0x40000 (0x200 * 512 byte sector = 0x40000) hidden by the hv. The hv hides it at address 002786E8  


Original code : 0x39840200f8010090<br />
Original code : 0x39840200f8010090<br />
Change to : 0x39840000f8010090
Change to : 0x39840000f8010090


Too dangerous to patch unless you peek/poke because obviously it messes with all the offsets
===== as seen in unself'ed LV1.self (Hypervisor) =====
<pre>3.15:
    Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
    00098D20                                      39 84 02 00              9„..
    00098D30  F8 01 00 90                                      ø...</pre>
<pre>3.41:
    Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
    000986A0  39 84 02 00 F8 01 00 90                          9„..ø...</pre>


{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"
|-
! style="background-color:red!important;" id="Brick warning" | <span style="background-color:lightred; color:white;">Brick warning - Peek/Poke only</span>
|-
| [[#Brick warning]]<span style="white; color:red!important;">
TCL: http://pastebin.com/Snh4ERQ6 (Don't use, BRICK RISK, see below)<br />
'''Too dangerous to patch unless you peek/poke because obviously it messes with all the offsets'''</span>
|-
|}
===== Guide to unbrick from above situation =====
Here's my guide http://www.mediafire.com/?76bw1vd1m65bkk4 . I haven't tested it yet, but it should work on COK-001


=== 'NOR' Interface Testpoints on NAND consoles ===
=== 'NOR' Interface Testpoints on NAND consoles ===
Simular as on the NOR based consoles testpoints can be found on the back of the PCB. It seems these are from the bus between the [[South Bridge]] and the [[Starship2]]. Attempts have been made to document/trace these. Addresslines 0-17 and Datalines 0-15 as well as some controllines are documented but so far these could not be used to read/flash the console in a NOR fashion.
Simular as on the NOR based consoles testpoints can be found on the back of the PCB. It seems these are from the bus between the [[South Bridge]] and the [[Starship2]]. Attempts have been made to document/trace these. Addresslines 0-17 and Datalines 0-15 as well as some controllines are documented but so far these could not be used to read/flash the console in a NOR fashion.
=== TriState on NAND consoles ===
using [[Starship2]] to [[South Bridge]] BRDY /SS2_BRDY
* CECHA (COK-001): [[EBUS]] jl:9309 (page 20 of servicemanual) / (named BRDY in [[:File:COK-001-NOR_1.jpg]])
* CECHC + CECHE (COK-002): [[EBUS]] jl:9309 (page 20 of servicemanual)
* CECHG (SEM001): [[EBUS]] jl:9309 (page 21 of servicemanual) / (named SB_TRI in [[:File:SEM-001-tristate.jpg]])


== NOR Interface Testpoints ==
== NOR Interface Testpoints ==
Line 218: Line 329:


=== Tristate ===
=== Tristate ===
Tristate, or as it is referred to in the service manuals SB_DISABLE exists solely for the purpose of placing the [[South Bridge]] pins into high-impedance (the third state) so that we can access the flash without the [[South Bridge]] interfering.
Tristate, or as it is referred to in the service manuals SB_DISABLE exists solely for the purpose of placing the [[South Bridge]] pins into high-impedance (aka the [https://en.wikipedia.org/wiki/Three-state_logic third state logic]) so that we can access the flash without the [[South Bridge]] interfering.


Because the tristate pin is not connected to the [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NOR NOR flash] TSOP package, but to the [[South Bridge]] BGA package, this makes tracing the pin quite difficult. One should be able to locate it by having the running you could ground out the unknown pins whilst checking the continuity of a known address or data line against ground. These should enter high-impedance or no-continuity when you ground out SB_DISABLE.
When the southbridge pins are in tristate is like if southbridge (and all peripherals connected to it) where disconnected from the main circuit, the PS3 powers up normally (fans, etc) but it won't boot up to the XMB screen because some components of the motherboard are not found, it just sits there with a black screen
 
Because the tristate pin is not connected to the [[Flash (Hardware) | Flash]] TSOP package, but to the [[South Bridge]] BGA package, this makes tracing the pin quite difficult. One should be able to locate it by having the running you could ground out the unknown pins whilst checking the continuity of a known address or data line against ground. These should enter high-impedance or no-continuity when you ground out SB_DISABLE.


=== Connecting NOR pads to flasher ===
=== Connecting NOR pads to flasher ===
<div style="float:right">[[File:Teensy2.0++.jpg|200px|thumb|left|Teensy 2.0 ++ connection diagram for PS3 NOR pads))]]</div><div style="float:right">[[File:Progskeet.png|200px|thumb|left|Progskeet NAND/NOR flasher board, based on Actel MCU, see http://progskeet.com/)]]</div>
{{NOR-Flashertable}}
<div style="height:420px; overflow:auto">


{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable sortable" style="border:1px solid #999; border-collapse: collapse;"  
==== [[Progskeet 1.0 / 1.1]] notes ====
Some modification is needed for [[Progskeet 1.0 / 1.1]] to unbrick:
* desolder R8 from the [[Progskeet 1.0 / 1.1]] PCB
* left pin of switch to left lead of R7, middle pin of switch to right lead of R7
* Vcc to +3.3 // put switch in "OFF" (right) postion, power on the ps3, put the switch in the "ON"/left position, it will be recognized by the PC, NOR is always on now, do everything as usual''.
 
==== PNM notes ====
* PNM requires a +5V_EVER from the PS3 motherboard in "PS3 mode"
* PNM requires a +5V from a USB port in "standalone mode". It then provides a +3.3V to the embedded NOR.
 
==== Teensy notes ====
* The Teensy requires a 3.3V voltage regulator! 5V trace has to be cut and 3V pads have to be shorted! Please refer to https://www.pjrc.com/teensy/3volt.html <br />
 
==== E3 debricking notes ====
* Requires soldering wire from SBE (solderpad on NOR flatcable) to TRISTATE (NORpoint on PS3 motherboard)
* Make sure you have correct firmware on SD/TF card
* E3 switches set as 1:Flash fun, 2: OFW, 3: Prog, 4: microSD, 5: PS3 Flash, 6: Lock with the console power disconnected.
* Turn on console to restore (progress LEDs will light up one by one and blink if successfully).
* Unplug powercable and set 1:Flash fun down to PS3 Mode and turn on the PS3, if everything went fine, it will now be debricked (remember: in case syscon has 3.56+ hashes, you need prepatched LV1, see downgrader guides).<br />
<!--// [http://www.multiupload.com/3IHN3VZYZG English-E3 FLASHER repair method if console bricked.pdf (424.95 KB)] //-->
<!--// should later link to http://www.psdevwiki.com/index.php?title=E3 itself //-->
 
=== Speed comparison NOR flashers ===
<!--// Tabelised content : Performance Teensy: quoted from NORway documentation: 0:05:11 for a full dump/read (52,68 KB/s), 0:01:35 per sector write or 2:08:19 for a full write (2,12 KB/s). Teensy speed according to other sources: 0:00:45 for a full dump/read (364 KB/s), 0:00:05.351 per sector write or 0:08:19 for a full write (32,83 KB/s). Comparison with [[Progskeet 1.0 / 1.1]]: 0:00:16 for a full dump/read (~1MB/s), 0:00:00.365 per sector write or 0:00:46.811 for a full write (~300-400KB/s). //-->
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"  
|- bgcolor="#cccccc"
|- bgcolor="#cccccc"
! PAD !! [http://www.progskeet.com/download.php Progskeet] !! Teensy2.0++<br />[http://megaupload.com/?d=NGLZWRFA NORway] ||  
! colspan="9" | Speed comparison NOR flashers
|-
|-
| A0 || adr0 || F0 ||  
!  !! colspan="2" | [[Teensy++ 2.0]]<br />(NORway 0.1) !! colspan="2" | [[Teensy++ 2.0]]<br />(NORway 0.3) !! colspan="2" | [[Progskeet 1.0 / 1.1]] !! colspan="2" | [[PNM]]<br />(X-Modem - 460800 baud)
|-
|-
| A1 || adr1 || F1 ||
!  !! &nbsp;time (h:mm:ss)&nbsp; !! &nbsp;speed&nbsp;(KB/sec)&nbsp; !! &nbsp;time (h:mm:ss)&nbsp; !! &nbsp;speed&nbsp;(KB/sec)&nbsp; !! &nbsp;time (h:mm:ss)&nbsp; !! &nbsp;speed&nbsp;(KB/sec)&nbsp; !! &nbsp;time (h:mm:ss)&nbsp; !! &nbsp;speed&nbsp;(KB/sec)&nbsp;
|-
|-
| A2 || adr2 || F2 ||  
| Full dump/read (16 MB) &nbsp; || &nbsp;0:05:11&nbsp; || &nbsp;52,68 KB/s&nbsp; || &nbsp;0:00:45&nbsp; || &nbsp;364,08 KB/s&nbsp; || &nbsp;0:00:16&nbsp; || &nbsp;1024 KB/s&nbsp; || &nbsp;0:45:43&nbsp; || &nbsp;6,1 KB/s&nbsp;
|-
|-
| A3 || adr3 || F3 ||  
| Per sector write(128 KB) &nbsp; || &nbsp;0:01:35&nbsp; || &nbsp;1,35 KB/s&nbsp; || &nbsp;0:00:05.351&nbsp; || &nbsp;23,92 KB/s&nbsp; || &nbsp;0:00:00.365&nbsp; || &nbsp;350,69 KB/s&nbsp; || &nbsp;0:00:16.12&nbsp; || &nbsp;7,90 KB/s&nbsp;
|-
|-
| A4 || adr4 || F4 ||  
| Full dump/write (16 MB) &nbsp; || &nbsp;2:08:19&nbsp; || &nbsp;2,12 KB/s&nbsp; || &nbsp;0:08:19&nbsp; || &nbsp;32,83 KB/s&nbsp; || &nbsp;0:00:46.811&nbsp; || &nbsp;350,00 KB/s&nbsp; || &nbsp;0:34:56&nbsp; || &nbsp;7,90 KB/s&nbsp;
|-
|-
| A5 || adr5 || F5 ||  
| Full CRC32 (16 MB) &nbsp; || || || || || || || &nbsp;0:01:30&nbsp; || &nbsp;182,04 KB/s&nbsp;
|-
|-
| A6 || adr6 || F6 ||
|-
|-
| A7 || adr7 || F7 ||  
| Full copy NOR-NOR (16 MB) &nbsp; || || || || || || || &nbsp;0:04:59&nbsp; || &nbsp;54,61 KB/s&nbsp;
|-
|-
| A8 || adr8 || PA0 ||  
|}
 
=== Using NOR flashers ===
 
==== [[Progskeet 1.0 / 1.1]] ====
Method 1 (with R7 switch and R8 closed):
1. Unplug the PS3 powercable from the back
2. Open up [[Progskeet 1.0 / 1.1]] flashing software (use latest) and on Common tab: select the flash you have @ Presets
3. Set the R7 switch to "off"
4. Plug the PS3 powercable back in and Power on the PS3
5. Wait 10 seconds and set the R7 switch to "on" to power [[Progskeet 1.0 / 1.1]] (sometimes shorter time is needed)
6. [[Progskeet 1.0 / 1.1]] will be recognised and you can now go ahead and dump
For normal console operation (e.g. after you dumped, flashed/downgraded it):
you need switch to "on" (R7 closed) and [[Progskeet 1.0 / 1.1]] USB disconnected.
 
Method 2 (with R7 open / R8 closed):
1. Remove USB cable from your PC
2. Open up [[Progskeet 1.0 / 1.1]] flashing software (use latest) and on Common tab: select the flash you have @ Presets
3. Power on PS3 and wait 10 seconds (sometimes shorter time is needed)
4. Plug in the USB cable to your PC
5. [[Progskeet 1.0 / 1.1]] will be recognised and you can now go ahead and dump
For normal console operation (e.g. after you dumped, flashed/downgraded it):
you need to disconnect the USB cable to your PC
 
==== NORway ====
 
Usage: %s serialport [command] [filename] [address]
   
serialport  Name of serial port to open (eg. COM1, COM2, /dev/ttyACM0, etc)
command    dump      Reads entire NOR to [filename]
            erase      Erases one sector (128KB) at [address]
            write      Flashes (read-erase-modify-write-verify) [filename]
                        at [address] to NOR
            writeimg  Same as write, but prepend a 16-byte length header
                        [address] is required
            program    Flashes (erase-write-verify) [filename]
                        at [address] to NOR
            release    Releases NOR interface, so the PS3 can boot
filename    Filename for [dump|write|writeimg|program]
address    Address for [erase|write|writeimg|program]
            Default is 0x0, address must be aligned (multiple of 0x20000)
 
==== PNM ====
 
serialport  (COM1, COM2, etc) - 460800 baud - 8N1
X-Modem protocol for file transfers
&nbsp;
            copy_memory            Copies entire NOR to another NOR
            read_memory            Reads 0x80 bytes from a specified offset
            dump_memory            Reads entire NOR to a file (byte swap "on the fly")
            update_memory          Flashes entire NOR from a file (byte swap "on the fly")
            display_memory_crc      Displays NOR CRC32
            display_memory_details  Displays NOR details (size, firmware version, etc)
&nbsp;
PNM uses the Common Flash Interface standard (almost all current flash can be dumped/updated)
 
==== Needed NOR tools ====
* norunpack (usage: norunpack dump.b directory) git: http://git.dashhacks.com/ps3free/ps3tools
* [http://www.multiupload.com/BOVOI6OA2V FlowRebuilder v.4.2.0.1.rar (379.34 KB)]
 
If your dump starts like this: http://pastebin.com/sS69Vhvf you'll need to use the option "¨Byte reverse and extract a NOR dump file" of Flowrebuilder, which will output a  inputfile.REV file
 
=== Dump NOR from GameOS ===
[http://gitbrew.org/~glevand/ps3/pkgs/dump_flash.pkg dump_flash.pkg]  // backup/mirror: [http://www.multiupload.com/Y1G1G7E4J4 dump_flash.pkg (70.48 KB)]<br />
Make sure USB stick is FAT32 with enough free space (16MB per dump)
Note: This application takes about 120 minutes to complete the dump, tested on a PS3 80GB CECHL04
 
=== Dumping NOR from Linux ===
dd if=/dev/ps3nflasha of=NOR.BIN bs=1024
 
== Board Revisions ==
For overview of used types, see [[Flash_%28Hardware%29#Retail | flashtypes table]]
 
=== NAND boards - [[COK-00x|COK-001]], [[COK-00x|COK-002]], [[COK-00x|COK-002W]], [[SEM-00x|SEM-001]] ===
These are the earliest revisions of the PS3 motherboards: [[CECHAxx|CECHA]]/[[COK-00x|COK-001]], [[CECHBxx|CECHB]]/[[COK-00x|COK-001]], [[CECHCxx|CECHC]]/[[COK-00x|COK-002]], [[CECHExx|CECHE]]/[[COK-00x|COK-002W]], [[CECHGxx|CECHG]]/[[SEM-00x|SEM-001]] and contain 2x NAND chips for a total of 256MB. These chips are interleaved which is controlled by a proprietary controller chip codenamed "[[Starship2]]" or SS2. This chip handles the interleaving and presents the NAND Chips to the [[South Bridge]] as a single large coherent flash over a proprietary [[EBUS]].<br />
Wiring: direct to NAND flash or using boardtraces to NANDs - '''don't use the testpoints'''.
 
=== NOR layout1 - [[DIA-00x|DIA-001]], [[DIA-00x|DIA-002]] ===
'''[[DIA-00x|DIA-001]]''': These boards were the first to get single NOR flash] memory from the middle revisions of the PS3: [[CECHHxx|CECHH]]/[[DIA-00x|DIA-001]], [[CECHKxx|CECHK]]/[[DIA-00x|DIA-002]]. Only a single 16MB NOR flash chip is used and the [[Starship2]] chip has been completely removed. The 128N is JEDEC CFI compliant and organized as 8,388,608 words or 16,777,216 bytes, addressable as 16-bit words (PS3 modus operandi) and 8-bit / 1 byte when the BYTE# signal is logic zero.
 
'''[[DIA-00x|DIA-002]]''': the pinout is same as [[DIA-00x|DIA-001]], the only difference is that DIA-002 doesnt have a WP# testpoint but since it's connected to VCC it is not needed.
 
=== NOR layout2 - [[VER-00x|VER-001]] ===
Used in the last revisions of the fatter model PS3 ([[CECHLxx|CECHL]], [[CECHMxx|CECHM]], [[CECHPxx|CECHP]], [[CECHQxx|CECHQ]]). Single 16MB NOR.
 
=== NOR layout3 - [[DYN-00x|DYN-001]] ===
Used in [[CECH-20xx|CECH-20xx]]. The [[Progskeet 1.0 / 1.1]] and teensy pinouts match the teensy picture provided on this page even though it states it's the pinout for [[Progskeet 1.0 / 1.1]]. Single 16MB NOR.
 
=== NOR layout4 - [[SUR-00x|SUR-001]], [[JTP-00x|JTP-001]], [[JSD-00x|JSD-001]], [[KTE-00x|KTE-001]] ===
 
'''[[SUR-00x|SUR-001]]''': Used in [[CECH-21xx|CECH-21xx]]. Some difference in components but the testpoints are the same for [[SUR-00x|SUR-001]], [[JTP-00x|JTP-001]], [[JSD-00x|JSD-001]], [[KTE-00x|KTE-001]]
 
'''JTP-001''': Used in [[CECH-25xx|CECH-25xx]]. Some difference in components but the testpoints are the same for [[SUR-00x|SUR-001]], [[JTP-00x|JTP-001]], [[JSD-00x|JSD-001]], [[KTE-00x|KTE-001]]
 
'''JSD-001''': This is the pinout originally supplied by Marcan for a [[CECH-25xx|CECH-2504A]]. Some difference in components but the testpoints are the same for [[SUR-00x|SUR-001]], [[JTP-00x|JTP-001]], [[JSD-00x|JSD-001]], [[KTE-00x|KTE-001]]
 
'''KTE-001''': Used in [[CECH-30xx|CECH-30xx]]. Some difference in components but the testpoints are the same for [[SUR-00x|SUR-001]], [[JTP-00x|JTP-001]], [[JSD-00x|JSD-001]], [[KTE-00x|KTE-001]]
 
=== NOR layout5 - [[MSX-00x|MSX-001]], [[MPX-00x|MPX-001]], [[NPX-00x|NPX-001]], [[PPX-00x|PPX-001]] and [[PQX-00x|PQX-001]] ===
'''[[MSX-00x|MSX-001]] and [[MPX-00x|MPX-001]]''': Used in [[CECH-40xx|CECH-40xx]]. Much difference in components positioning (main hearth of the board is 45 degrees rotated), but it still has testpoints.
 
== Gallery ==
=== Pinout Gallery ===
==== NAND ====
<Gallery>
File:SS2_NOR.JPG|Starship2 '''[[EBUS]]''' Testpoints (NAND board) '''do not use!'''
File:COK-001-NOR.jpg|COK-001 '''[[EBUS]]''' Testpoints (NAND board - only overlay) '''do not use!'''
File:COK-001-NOR_1.jpg|COK-001 '''[[EBUS]]''' Testpoints (NAND board) '''do not use!'''
File:COK-001 NAND traces.jpg|COK-001 boardtraces (NAND board) confirmed
 
File:COK-002 - EBUS points between Southbridge and StarShip2.jpg|COK-002 '''[[EBUS]]''' Testpoints (NAND board) '''do not use!'''
File:COK-002 - NANDs.jpg|COK-002 - NANDs
File:Boardcok002.jpg|COK-002 boardtraces (NAND board) needs Testing/Confirmation ('''incomplete''': 3 points still missing)
File:COK-002 NAND traces.jpg|COK-002 boardtraces (NAND board) confirmed
 
File:SEM-001-NANDs-boardtraces-jestero.jpg|SEM-001 boardtraces (NAND board)
File:SEM-001 NAND traces.jpg|SEM-001 boardtraces (NAND board) confirmed
 
File:Progskeet-Single-NAND-360clip.png|Progskeet - Single NAND - 360clip
File:Nand-360clip-wiiclip-48pin.jpg| NAND TSOP48 360clip (note: no need to connect R/B2 on ps3's)
File:Progskeet-sl nand-adaptorboard-pinout.png|Progskeet SL-NAND adaptorboard
File:1Gbit-NANDclip-Front.jpg|1Gbit NANDclip - Front
File:1Gbit-NANDclip-back.jpg|1Gbit NANDclip - Back
 
File:Universal NAND TSOP clip.jpg|Universal NAND TSOP clip - Note: this will not fit on the [[COK-002]] NAND next to the SATA connector
File:NANDway-SignalBoosterEdition-to-UNI-48-Clip.jpg|[[Teensy++ 2.0]] NANDway SignalBoosterEdition to Universal NAND TSOP clip
File:NANDway-SignalBoosterEdition.jpg|[[Teensy++ 2.0]] NANDway SignalBoosterEdition
 
File:Tristate-COK-001.jpg|[[COK-001]] [[EBUS]] Tristate
File:Tristate-COK-002.jpg|[[COK-002]] [[EBUS]] Tristate
File:Tristate-SEM-001.jpg|[[SEM-001]] [[EBUS]] Tristate
</Gallery>
 
==== NOR ====
<Gallery>
File:DIA-001_NOR.JPG|DIA-001 NOR Testpoints (NOR layout 1)
File:DIA-002_by_DiscoBear.jpg|DIA-002 NOR Testpoints (NOR layout 1)
File:VER-001_NOR-3.3V.JPG|VER-001 NOR Testpoints (NOR layout 2)
File:Ver-001 nor-rev.jpg|VER-001 NOR Testpoints - trisaster.de, '''missing Tristate''' (NOR layout 2)
File:DYN-001_NOR.JPG|DYN-001 NOR Testpoints (NOR layout 3)
File:DYN-001_NOR_-_E3-dual-boot.jpg|DYN-001 NOR Testpoints + dualboot 'AB mod' (NOR layout 3)
File:Dyn 001-progskeet.jpg|DYN-001 NOR Testpoints with progskeet labeling (NOR layout 3)
File:Jtp jsd kte-progskeet.jpg|JSD-001, JTP-001, KTE-001 NOR Testpoints with Progskeet labeling (NOR layout 4)
File:Progskeet-1.2 - JTP001-JSD001-KTE001.jpg|JSD-001, JTP-001, KTE-001 NOR Testpoints with Progskeet 1.2 labeling (NOR layout 4)
File:JSD-001_NOR.JPG|JSD-001 NOR Testpoints (NOR layout 4)
File:JSD-001_NOR_-_nor_testpoints.png|JSD-001 Testpoints - orig. marcan/noraliser (NOR layout 4)
File:JTP-001_-_1-882-481-31.JPG|JTP-001 NOR Testpoints - '''not mapped''' (NOR layout 4)
File:SUR-001_BOTTOM_TESTPOINTS_-NOT_TRACED-.JPG|SUR-001 Nor Testpoints - '''not mapped''' (NOR layout 4)
File:Teensy++ 2.0 NOR testpoints layout 4.png|Teensy++ 2.0 NOR testpoints (NOR layout 4)
File:NOR-PINOUT+ZIF-SolderlessPinout.jpg|NOR Flash general pinout + 50pin ZIF pinout (Progskeet)
File:360-clip-56.png| NOR TSOP56 ZIF 360clip and solderboard (Progskeet)
File:Testpoints - unmapped - as seen on MSX-001.jpg|MSX-001 NOR Testpoints - '''not mapped''' (NOR layout 5)
</Gallery>
 
=== Other Gallery ===
<Gallery>
File:360Clip NAND rework.jpg| 360Clip NAND rework
File:360Clip_NAND_SMD_why_rework.jpg|360Clip NAND SMD why rework
File:360Clip_NOR_cant_used_for_VER-001_no_space.jpg|360Clip NOR can't be used for VER-001: no space
File:48-nonok.jpg|360Clip modification pin 48
File:CLIP comparison.jpg|CLIP comparison
File:CLIP styles.jpg|CLIP styles
File:COK-002_Nand1_SMD_components_Clip_rework.jpg|COK-002 Nand1 SMD components Clip rework
File:Cutting_pin46_360clip-nor-TOPVIEW.jpg|Cutting pin46 360clip-nor - TOPVIEW
File:Cutting_pin48_and_46_360clip-nor.jpg|Cutting pin48 and 46 360clip-nor
File:Ext_PSU_on_PS3_2.jpg|Ext PSU on PS3
File:Progskeet - NAND-Adaptor PCB (red).png|Progskeet - NAND-Adaptor PCB (red)
File:Progskeet - NAND-Adaptor PCB.png|Progskeet - NAND-Adaptor PCB
File:Nor_damage.jpg|Damaged NOR. The pins are bent to the shape of the opposing pins on the E3 clip.
File:Nor damage 2.jpg|Above view of damaged NOR.
</Gallery>
 
=== [[Progskeet 1.0 / 1.1]] NAND Picture Guide ===
Full guide is here: [[Progskeet 1.0 / 1.1]]
<Gallery>
File:Progskeet Setup - Before.jpg|Before
File:Progskeet Setup - After.jpg|After (R7/R8 + R9/R11 closed)
File:Connect NAND clips - connect 50pin flatcable.jpg|connect 50pin flatcable
File:Connect NAND clips - connect Y-subboard.jpg|connect Y-subboard
File:Connect NAND clips - connect NAND flatcable to Y-subboard.jpg|connect NAND flatcable to Y-subboard
File:Connect NAND clips - connect clip to NAND flatcable.jpg|connect clip to NAND flatcable
File:Connect NAND clips - clip + NAND board.jpg|clip + NAND board
File:Connect NAND clips - NAND board.jpg|NAND board
File:Connect NAND clips - connect to PC.jpg|connect to PC
</Gallery>
 
== Generic reference ==
 
=== Torx / Security Bits ===
* http://microcenter.com/product/208022/33-Piece_Security_Bit_Set
* or if you don't have those, use a smaller flat screwdriver, or just remove the center pin.
 
=== Soldering Guide(s) ===
* http://www.circuitrework.com/guides/7-1-1.shtml
* http://store.curiousinventor.com/guides/Surface_Mount_Soldering/101
* http://en.wikipedia.org/wiki/Desoldering
** http://en.wikipedia.org/wiki/Field%27s_metal
* http://www.youtube.com/watch?v=E3OmchO_mDc
* http://www.youtube.com/watch?v=SSJGnDHKFQ8
 
=== Soldering Irons/Stations ===
*Soldering Iron
**http://www.amazon.com/Weller-WM120-120v-Pencil-Soldering/dp/B0000WT586/ (good quality/brand)
**http://www.amazon.com/Coopertools-SP12-Mini-Lightweight-Solder/dp/B00002N7S9/ (low budget variant)
*Classic Station
**http://www.amazon.com/Weller-WES51-Analog-Soldering-Station/dp/B000BRC2XU (good quality/brand)
**http://www.amazon.com/Stahl-Tools-Variable-Temperature-Soldering/dp/B0029N70WM/ (lowest budget variant)
*Hot Air Station
**http://www.amazon.com/Soldering-Station-Iron-Rework-Solder/dp/B004IQLUFG
**http://www.amazon.com/REWORK-SOLDERING-IRON-STATION-852D/dp/B004ZB9D4O
 
=== Stereo Microscopes ===
Things to look for:
* Good solid mounting
* More overhang to reach large boards
* Ring macrolight
* optional: T2 or otherwise adaptor for cameras
<GALLERY>
File:Stereo Microscope example1.jpg|Stereo Microscope - example 1
File:Stereo Microscope example2.jpg|Stereo Microscope - example 2
File:Stereo Microscope example3.jpg|Stereo Microscope - example 3
File:Stereo Microscope example4.jpg|Stereo Microscope - example 4
</GALLERY>
'''Tip:''' also available used
 
 
=== Soldering tips ===
* Don't use >40W iron (we are not soldering copper pipes!)
* Don't use leadfree solder (232'C @ SnSb)
* Don't use silverbased solder
* Don't use high tin alloy (e.g. 90/10: 300'C @ 97Sn 3Pb and 250'C @ 65Sn 35Pb)
* Use 60/40 (374'F / 190'C) or 63/37 (364'F / 183'C) both have nice low melting point for PCBs
<br />
large list of solder alloys and meltingpoints: http://alasir.com/reference/solder_alloys/
 
=== Wire reference ===
'''TLDR'''&nbsp;&nbsp;:&nbsp;&nbsp;NOR: use AWG26  /  NAND: use AWG28
 
For wiring, use 20-28 AWG. 18 can be too stiff while 30 is too fragile. 24-26 AWG works fine in most cases. The Grounds and VCC wires may ofcourse be thicker than the signal wires. Keep wires short, up to ~20cm max (longer gives errors). The shorter the better : 15cm and shorter mostly works fine with AWG26 on NOR.
 
For NOR wiring the solderarea (the NORpoints) is 10x larger than the solderarea used with NAND (pitch 0.5mm, just as NOR chips btw), so for NOR you have much more headroom (and also need!) to use thicker wires (for NAND you most likely want to use 28 AWG and cannot use much thicker)
 
Use caliper to measure unknown/unmarked wires and compare with table/listing.
 
==== Table: AWG (inch) / Euro (mm) ====
{| class="wikitable"
|-
! American<br />Wire<br />Gauge !! Diameter !! Cross<br /> Sectional<br /> Area !! Diameter !! Cross<br /> Sectional<br /> Area !! rowspan="2" | Notes
|-
! (AWG) !! d (inch) !! A (inch<sup>2</sup>) !! d (mm) !! A (mm<sup>2</sup>)
|-
|0000 (-3) || 0,4600 || 0,1662 || 11,6839 || 107,2172 ||
|-
|000 (-2) || 0,4096 || 0,1318 || 10,4048 || 85,0279 ||
|-
|00 (-1) || 0,3648 || 0,1045 || 9,2658 || 67,4308 ||
|-
|0 || 0,3249 || 0,0829 || 8,2515 || 53,4756 ||  
|-
|-
| A9 || adr9 || PA1 ||  
|1 || 0,2893 || 0,0657 || 7,3482 || 42,4085 ||  
|-
|-
| A10 || adr10 || PA2 ||  
|2 || 0,2576 || 0,0521 || 6,5438 || 33,6318 ||  
|-
|-
| A11 || adr11 || PA3 ||  
|3 || 0,2294 || 0,0413 || 5,8275 || 26,6715 ||  
|-
|-
| A12 || adr12 || PA4 ||  
|4 || 0,2043 || 0,0328 || 5,1895 || 21,1516 ||  
|-
|-
| A13 || adr13 || PA5 ||  
|5 || 0,1819 || 0,0260 || 4,6214 || 16,7742 ||  
|-
|-
| A14 || adr14 || PA6 ||  
|6 || 0,1620 || 0,0206 || 4,1155 || 13,3027 ||  
|-
|-
| A15 || adr15 || PA7 ||  
|7 || 0,1443 || 0,0164 || 3,6650 || 10,5496 ||  
|-
|-
| A16 || adr16 || B0 ||  
|8 || 0,1285 || 0,0130 || 3,2638 || 8,3663 ||  
|-
|-
| A17 || adr17 || B1 ||  
|9 || 0,1144 || 0,0103 || 2,9065 || 6,6348 ||  
|-
|-
| A18 || adr18 || B2 ||  
|10 || 0,1019 || 0,0082 || 2,5883 || 5,2617 ||  
|-
|-
| A19 || adr19 || B3 ||  
|11 || 0,0907 || 0,0065 || 2,3050 || 4,1728 ||  
|-
|-
| A20 || adr20 || B4 ||  
|12 || 0,0808 || 0,0051 || 2,0527 || 3,3092 ||  
|-
|-
| A21 || adr21 || B5 ||  
|13 || 0,0720 || 0,0041 || 1,8279 || 2,6243 ||  
|-
|-
| A22 || adr22 || B6 ||  
|14 || 0,0641 || 0,0032 || 1,6278 || 2,0812 ||  
|-
|-
| DQ0 || dq0 || D0 ||  
|15 || 0,0571 || 0,0026 || 1,4496 || 1,6505 ||  
|-
|-
| DQ1 || dq1 || D1 ||  
|16 || 0,0508 || 0,0020 || 1,2910 || 1,3089 ||  
|-
|-
| DQ2 || dq2 || D2 ||  
|17 || 0,0453 || 0,0016 || 1,1496 || 1,0380 ||  
|-
|-
| DQ3 || dq3 || D3 ||  
|18 || 0,0403 || 0,0013 || 1,0238 || 0,8232 ||  
|-
|-
| DQ4 || dq4 || D4 ||  
|19 || 0,0359 || 0,0010 || 0,9117 || 0,6528 ||  
|-
|-
| DQ5 || dq5 || D5 ||  
|20 || 0,0320 || 0,0008 || 0,8119 || 0,5177 ||  
|-
|-
| DQ6 || dq6 || D6 ||  
|21 || 0,0285 || 0,0006 || 0,7230 || 0,4106 ||  
|-
|-
| DQ7 || dq7 || D7 ||  
|22 || 0,0253 || 0,0005 || 0,6439 || 0,3256 ||  
|-
|-
| DQ8 || dq8 || C0 ||  
|23 || 0,0226 || 0,0004 || 0,5734 || 0,2582 ||  
|-
|-
| DQ9 || dq9 || C1 ||  
|24 || 0,0201 || 0,0003 || 0,5106 || 0,2048 ||  
|-
|-
| DQ10 || dq10 || C2 ||  
|25 || 0,0179 || 0,0003 || 0,4547 || 0,1624 ||  
|-
|-
| DQ11 || dq11 || C3 ||  
|26 || 0,0159 || 0,0002 || 0,4049 || 0,1288 || '''Best used for NOR consoles'''
|-
|-
| DQ12 || dq12 || C4 ||  
|27 || 0,0142 || 0,0002 || 0,3606 || 0,1021 ||  
|-
|-
| DQ13 || dq13 || C5 ||  
|28 || 0,0126 || 0,0001 || 0,3211 || 0,0810 || '''Best used for NAND consoles'''
|-
|-
| DQ14 || dq14 || C6 ||  
| 29 || 0.0113 || || 0.286 || 0.064 ||  
|-
|-
| DQ15 || dq15 || C7 ||  
| 30 || 0.0100 || || 0.255 || 0.051 ||  
|-
|-
| #WE || we || E5 ||  
| 31 || 0.00893 || || 0.227 || 0.040 ||  
|-
|-
| CE# || gp0 || E0 ||  
| 32 || 0.00795 || || 0.202 || 0.032 ||  
|-
|-
| RESET || gp1 || E4 ||  
| 33 || 0.00708 || || 0.180 || 0.025 ||  
|-
|-
| TRISTATE || gp2 || E7 ||  
| 34 || 0.00631 || || 0.160 || 0.020 ||  
|-
|-
| WP# || gp3 || ?tied to Vcc? ||  
| 35 || 0.00562 || || 0.143 || 0.016 ||  
|-
|-
| OE# || oe || E1 ||  
| 36 || 0.00500 || || 0.127 || 0.013 ||  
|-
|-
| RY/BY# || rdy || E6 ||  
| 37 || 0.00445 || || 0.113 || 0.010 ||  
|-
|-
| VSS || GND || GND ||  
| 38 || 0.00397 || || 0.101 || 0.008 ||
|-
| 39 || 0.00353 ||  || 0.0897 || 0.006 ||
|-
| 40 || 0.00314 ||  || 0.0799 || 0.005 ||  
|-
|-
|}
|}
</div>Progskeet Note: Some modification is needed for Progskeet to unbrick:
* desolder R8 from the Progskeet PCB
* left pin of switch to left lead of R7, middle pin of switch to right lead of R7
* Vcc to +3.3 // put switch in "OFF" (right) postion, power on the ps3, put the switch in the "ON"/left position, it will be recognized by the PC, NOR is always on now, do everything as usual''.


'''Notes:''' ''The Teensy requires a 3.3V voltage regulator! 5V trace has to be cut and 3V pads have to be shorted! Please refer to https://www.pjrc.com/teensy/3volt.html''<br />
==== Alternative/cable comparison ====
Also note that Teensy can be '''very''' slow: 0:05:11 for a full dump/read (52,68 KB/s), 0:01:35 per sector write or 2:08:19 for a full write (2,12 KB/s) // Comparison with Progskeet: 0:00:16 for a full dump/read (~1MB/s), 0:00:00.365 per sector write or 0:00:46.811 for a full write (~300-400KB/s).
    PATA/floppy 40-conductor cable - AWG28 (0.0126" / 0.321mm) with 0.0333" pitch +/- 0.002"
    PATA/floppy 40-conductor cable - AWG30 (0.0100" / 0.255mm) with 0.0333" pitch +/- 0.002"
&nbsp;
    PATA 80-conductor cable - AWG30 (0.0100" / 0.255mm) with 0.025" pitch +/- 0.0016"
    PATA 80-conductor cable - AWG30 (0.0100" / 0.255mm) with 0.025" pitch +/- 0.002"
    PATA 80-conductor cable - AWG31 (0.00893" / 0.227mm) with 0.025" pitch +/- 0.002"
    PATA 80-conductor cable - AWG32 (0.00795" / 0.202mm) with 0.025" pitch +/- 0.002"
&nbsp;
    Category 6 (ANSI/TIA-568-B.2-1) network cable: 4 twisted pairs of 22AWG (0.0253" / 0.644mm)
    Category 6 (ANSI/TIA-568-B.2-1) network cable: 4 twisted pairs of 23AWG (0.0226" / 0.573mm)
    Category 6 (ANSI/TIA-568-B.2-1) network cable: 4 twisted pairs of 24AWG (0.0201" / 0.511mm)
&nbsp;
    Category 5/5e (TIA/EIA 568-5-A) network cable: 4 twisted pairs of 24AWG (0.0201" / 0.511mm)
&nbsp;
    Category 5e patch (TIA/EIA 568-5-A) network cable: 4 twisted pairs of 26AWG (0.0159" / 0.405mm)
&nbsp;
    SATA : solid 26 AWG - 0.0159" / 0.405mm
    SATA : solid 28 AWG - 0.0126" / 0.321mm
    SATA : solid 30 AWG - 0.0100" / 0.255mm
 
=== Resistor codes ===
* http://wiki.xtronics.com/index.php/Resistor_Codes
* http://www.hobby-hour.com/electronics/3-digit-smd-resistors.php
 
=== Tapes ===
*Polyamide heat resistant tape http://dx.com/en/s/high+temperature+tape
 
Used to isolate hardware parts that will be installed permanently internally (is the same tape used in pc laptops to isolate wifi/bt cards and ram modules). This tape resist up to 300º without deformation or burning, and is made of 100% non-conductive materials... the tape is cheap but be aware because there are lot of fakes, always reads the comments of other buyers or buy in a reputable shop
 
== Generic unresolved issues ==
There is a table made on the talk page to chart dump/flashing issues (and sucesses). See: [[Talk:Hardware_flashing#Testreport_table | Testreport_table]]
 
== [[Progskeet 1.0 / 1.1]] QA/problem solving ==
 
=== Generic advice ===
 
==== Updating [[Progskeet 1.0 / 1.1]] with Injectus ====
# connect injectus to [[Progskeet 1.0 / 1.1]]with very short wires (see [[:File:Injectus_jtag_pinout.jpg]] [[:File:Injectus-jtag-bottompads.png]])
# power injectus with usb
# power [[Progskeet 1.0 / 1.1]] with its own usb too (do NOT power the [[Progskeet 1.0 / 1.1]] with the injectus!)
# run injectus programmer software
## click tools
## open infectus (at bottom of pulldown)
## load dat file
## click program
See also [[Progskeet#Programming_the_Bitstream|Programming the Bitstream]]
 
==== R7 / R8 explaination ====
R7 / R8 explaination in a sketch: [[:File:Progskeet-R7-R8 explaination-sketch4.jpg]]
 
==== Be up to date ====
Always make sure you used the latest diagrams, drivers and flasher software from [http://progskeet.com/download.php progskeet.com]
 
===== Archive of old versions =====
Main folder: on [http://www.psdevwiki.com/files/flash/Tools/Progskeet/ psdevwiki/files]
 
====== Diagrams ======
* <span style="text-decoration: line-through;">[http://www.multiupload.com/5XEX630GN5 diagrams_110803.rar (4.76 MB)])</span>
* <span style="text-decoration: line-through;">[http://www.multiupload.com/WCWI0XABBU diagrams_110804.rar (9.73 MB)])</span>
* [http://www.psdevwiki.com/files/flash/Tools/Progskeet/Diagrams/diagrams_110805.rar diagrams_110805.rar (10.4 MB)])
 
====== Driver ======
WinSkeet 111004 and older : use libusb0    Winskeet 111120 and newer: use WinUSB
zadig can be used as driver selector for both, make sure you select the right one.
* <span style="text-decoration: line-through;">[http://www.multiupload.com/MIGAUSZL16 drivers_110726.rar (235.62 KB)]</span>
* [http://www.psdevwiki.com/files/flash/Tools/Progskeet/Winskeet/drivers_110812.rar drivers_110812.rar (264.07 KB)])
* <span style="text-decoration: line-through;">[http://www.multiupload.com/67L14ZWUDH drivers_a110812.rar (267.61 KB)]</span>
* [http://www.psdevwiki.com/files/flash/Tools/Progskeet/Winskeet/zadig.rar zadig.rar (4,9MB)]
 
====== Bitstream ======
* [http://www.psdevwiki.com/files/flash/Tools/Progskeet/Bitstreams/ProgSkeet_Bitstreams_111106.rar ProgSkeet_Bitstreams_111106.rar (1.63 MB)] (NOR solderless and NOR+NAND soldered) [http://www.mediafire.com/?o66ls0yo8o1ybr8 Mirror]
* [http://www.psdevwiki.com/files/flash/Tools/Progskeet/Bitstreams/ProgSkeet_Bitstreams_111126.rar ProgSkeet_Bitstreams_111126.rar (1.63 MB)] (NAND solderless only) [http://www.mediafire.com/?h3dc7ohc2b2xon8 Mirror]
 
====== Flasher ======
* [http://www.psdevwiki.com/files/flash/Tools/Progskeet/Winskeet/ProgSkeet_110803.rar ProgSkeet_110803.rar (28.37 KB)]
* [http://www.psdevwiki.com/files/flash/Tools/Progskeet/Winskeet/ProgSkeet_110807.rar ProgSkeet_110807.rar (29.24 KB)]
* [http://www.psdevwiki.com/files/flash/Tools/Progskeet/Winskeet/ProgSkeet_110811-A.rar ProgSkeet_110811-A.rar (30.02 KB)]
* [http://www.psdevwiki.com/files/flash/Tools/Progskeet/Winskeet/ProgSkeet_110811-B.rar ProgSkeet_110811-B.rar (29.8 KB)]
* [http://www.psdevwiki.com/files/flash/Tools/Progskeet/Winskeet/ProgSkeet_110812-A.rar ProgSkeet_110812-A.rar (30KB)]
* [http://www.psdevwiki.com/files/flash/Tools/Progskeet/Winskeet/ProgSkeet_110816.rar ProgSkeet_110816.rar (32KB)]
* [http://www.psdevwiki.com/files/flash/Tools/Progskeet/Winskeet/ProgSkeet_110819.rar ProgSkeet_110819.rar (32.27 KB)]
*111004/8:
**[http://www.psdevwiki.com/files/flash/Tools/Progskeet/Winskeet/WinSkeet40000_111004.rar WinSkeet40000_111004.zip (5.1 MB)] (libusb)
**[http://www.psdevwiki.com/files/flash/Tools/Progskeet/YASkeet/YASkeet_20111008.tar.gz YASkeet_20111008.tar.gz (226.95 KB)]
**[http://www.psdevwiki.com/files/flash/Tools/Progskeet/iSkeet/iSkeet_20111008.zip iSkeet_20111008.zip (497.83 KB)]
*111120:
**[http://www.psdevwiki.com/files/flash/Tools/Progskeet/Winskeet/Winskeet111120.rar Winskeet111120.rar (9.07 MB)] (WinUSB)
**[http://www.psdevwiki.com/files/flash/Tools/Progskeet/YASkeet/YASkeet_20111120.tar.gz YASkeet_20111120.tar.gz (229.72 KB)]
**[http://www.psdevwiki.com/files/flash/Tools/Progskeet/iSkeet/iSkeet_20111120.zip iSkeet_20111120.zip (11.87 MB)]
*111205:
**[http://www.psdevwiki.com/files/flash/Tools/Progskeet/Winskeet/Winskeet111205.rar Winskeet111205.rar (4.18 MB)] (WinUSB)
 
==== No shorts ====
Before doing anything, make 100% sure you wired up everything correct (no address/data IO lines mixed? all controllines hooked up? power/ground in order? etc.) and no shorts are made where there should not.
 
=== Error : libusb0.dll or libusb0.sys not found ===
The libusb-win32 Kernel Driver needed for the the flasher to get access to the USB port was not installed. Make sure you unpacked the drivers_xxxxxx file and installed the Progskeet driver (VendorID:1988 / ProductID:0001 in case you need it).
 
If problems with installing the driver, use manual mode from Device Manager and select the folder with ProgSkeet.inf ("ProgSkeet Install Disk") : http://windows.microsoft.com/en-US/windows-vista/Update-a-driver-for-hardware-that-isnt-working-properly


=== Error : side-by-side configuration is incorrect ===
In case of "the application has failed to start because its side-by-side configuration is incorrect" make sure [http://www.microsoft.com/download/en/details.aspx?id=5582 Microsoft Visual C 9.0 runtime] is installed and "Windows Installer" is not disabled (set to manual or automatic) in Services.msc


=== Using NOR flashers ===
=== Error : incorrect parameter ===
Make sure you selected the correct values for your NOR/NAND device. If there is a preset, use it
* on Common tab: select the flash you have @ Presets


==== Progskeet ====
If not, e.g. :
take the cable out the back
* NOR
plug it back in
** Spansion S29GL128N90TFIR2 : 128KB sector, 128 sectors
put the switch on "off"
** Spansion S29GL128P90TFIR2 : 128KB sector, 128 sectors
power on
** Samsung K8Q2815UQB-PI4B : 4KB sector, 4096 sectors
wait 10 seconds
** Samsung K8P2716UZC-QI4D : 128KB sector, 128 sectors
put the switch on "on"
** Macronix MX29GL128ELT2I-90G : 128KB sector, 128 sectors
dump
128kB sector, 128 sectors


==== Needed NOR tools ====
* NAND: select Big Block, select Raw, Pages per block: 64, blocks: 1024
* norunpack (usage: norunpack dump.b directory) git: http://git.dashhacks.com/ps3free/ps3tools


== Board Revisions ==
=== The application failed to initalize properly (0xc0000135) ===
You are missing either of these:
* http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=29
* http://www.microsoft.com/download/en/details.aspx?id=5582


=== Error/crash on Windows 7 (and halting on 0x0) ===
* Disable Aero (known to crash on Win7 Ultimate)
** set display color to 256 colors will enforce Aero to disable too
* Make sure you have enough (admin) rights
* Consider disabling UAC (or re-educate it proper)
* Try "Compatibility Mode" (e.g. Windows 2000 or Windows XP SP2)


=== COK-001, COK-002, SEM-001 ===
Conclusion: 32bit mostly seem to work fine. 64-bit seems tricky/hairy to get working sometimes. Try on good ol' Windows XP 32bit or Linux/OSX to rule out 64bit/chipset responsible for problems.
These are the earliest revisions of the PS3 motherboard (CECHA, CECHB, CECHC, CECHE, CECHG) and contain 2 x Samsung K9F1G08U0A-PIB0 128MB [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NAND NAND Chips] for a total of 256MB. These chips are interleaved which is controlled by a proprietary controller chip codenamed "[[Starship2]]" or SS2. This chip handles the interleaving and presents the [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NAND NAND Chips] to the [[South Bridge]] as a single large coherent NOR Chip.


=== DIA-001, DIA-002 ===
=== Timing switching trick ===
These boards were the first to get the [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NOR NOR flash] memory from the middle revisions of the PS3 (CECHH, CECHJ, CECHK). Only a single Spansion S29GL128N90TFIR2 16MB [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NOR NOR flash] chip is used and the [[Starship2]] chip has been completely removed. The 128N is JEDEC CFI compliant and organized as 8,388,608 words or 16,777,216 bytes, addressable as 16-bit words (PS3 modus operandi) and 8-bit / 1 byte when the BYTE# signal is logic zero.
Finally, after many struggles, the way to flash any NOR chip is discovered. Now, here's the method:
*First of all note that when R7 is short - [[Progskeet 1.0 / 1.1]] takes supply from console itself, and when R8 is short - it is powered from USB. So then, whatever you'll do - make sure both R7 and R8 never shorted while console is powered on - this results in damaging mobo as well as console itself.  
Preparations are the following: [[Progskeet 1.0 / 1.1]] soldered up correctly, no shorts or testpoints missing; Both R7 and R8 opened. (From now on, just forget about R8)
Open Winskeet (Yaskeet, whatever else you got there), set up NOR type and switch to NOR menu. Connect [[Progskeet 1.0 / 1.1]] to PC, power up console. Wait at least 10 seconds then short R7 - [[Progskeet 1.0 / 1.1]] gets recognized by PC. Set up the following options - Single word programming, '''Static Timing'''. Now you're ready.
Dump NOR several times, check it closely just to be sure it's correct. Prepare patched one then go ahead and write it back to NOR. Though it takes a little longer with mentioned settings, you'll be able to flash it almost correctly. At this point, look out for verification errors - there will be some with almost every NOR I've deal with. The key is that before flashing [[Progskeet 1.0 / 1.1]] reads the NOR and flash only those blocks that differs from desired file. Now, here's the trick itself - after flash process performed with several verification errors, flash back the same file again and again (up to 16 times in a row in several cases), untill number of errors reduces to minimum (three or four). At this point, writing the flash under these settings won't make any changes - this last "hard blocks" will always fail for verification, so just switch to '''USB Transfer Timing''' and flash it again. It will take your time around 2 minutes to flash every single block, but since their number were heavily reduced with previous actions, it won't take long in the end. Notice that no verification errors are occured. Now you're done, congratulations)


=== A/B Trick ===
The A/B trick is a solution found by DiGiTaLAnGeL to write his Macronix NOR (but can be tried on other NORs as well <small><span style="color:red!important;">1</span></small>). <br />
Some Sectors of his flash were "slow to write" and using the normal flashing procedure was resulting in a fail or in a freeze of the [[Progskeet 1.0 / 1.1]] Flasher.


=== VER-001 ===
'''Needed tools:'''
Used in the last revisions of the fatter model PS3 (CECHL, CECHM, CECHP, CECHQ), again with the single Spansion S29GL128N90TFIR2 16MB [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NOR NOR flash] with the exception of the CECHL which used a Samsung K8Q2815UQB-P14B 16MB [http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NOR NOR flash].
* Download [http://www.progskeet.com/downloads/ProgSkeet_110811-A.rar Progskeet Flasher v110811-A] // backup/mirror: [http://www.multiupload.com/VXYTEGEIJP ProgSkeet_110811-A.rar (30.02 KB)]
* Download [http://www.progskeet.com/downloads/ProgSkeet_110811-B.rar Progskeet Flasher v110811-B] // backup/mirror: [http://www.multiupload.com/RVFR64XPWL ProgSkeet_110811-B.rar (29.79 KB)]


'''Step by step guide:'''
* Shut Down your PS3 if not and be sure that the [[Progskeet 1.0 / 1.1]] USB Cable is not plugged in.
* Put your R7 Switch in OFF Position.
* Power on your PS3.
* Wait 20 seconds.
* Put your R7 Switch in ON Position (now Proskeet is recognized by Windows).
* Open Flasher "A" and flash your file (remember to set up the NOR size/sectors!)
* When it reaches 100% , check C:\Proskeet.log, if you found some sectors failed to write... continue to the next step.
* Without powering off your PS3, unplug [[Progskeet 1.0 / 1.1]] USB Cable and Close Flasher "A"
* Open Flasher "B" and replug your USB Cable.
* Flash your file (remember to set up the NOR size/sectors!)
* The Flasher will freeze on those "slow" sectors, just wait!
* If after 1 minute your flasher is still stuck on that sector close the flasher.
* Check again your log for sectors failed to write.


=== JSD-001 ===
If you still have sectors that have failed to write, start again until they successfully write (Rember to check the Progskeet.log because reaching 100% doesn't mean that the sectors have successfully been written)
This is the pinout originally supplied by Marcan for a CECH-2504A, Points match those taken from a CECH-2504B slim console. Most slims may carry this arrangement.


:<small>note: <span style="color:red!important;">1)</span></small><br />
::<small>&lt;DiGiAnGeL&gt; if you successfully write at least one of the sectors you are having problem with, this trick work for you!<br />&lt;DiGiAnGeL&gt; (some sectors require even 5 minutes of trying before successfully writing them)</small><br />


== Pinout Gallery ==
=== Irregular device disappering when reading/writing ===
<Gallery>
<MrGBNC> I've had good dumps but sometimes when I click read [[Progskeet 1.0 / 1.1]] disappears from the Device Manager
File:SS2_NOR.JPG|Starship2 NOR/EBUS Testpoints (NAND board)
<eussNL> hmm, sounds like voltage drop or usb connection fail
File:COK-001-NOR.jpg|COK-001 NOR Testpoints (NAND board - only overlay)
<MrGBNC> and last week was [[Progskeet 1.0 / 1.1]] no longer recognized by windows
File:COK-001-NOR_1.jpg|COK-001 NOR Testpoints (NAND board)
<MrGBNC> unknown device
File:DIA-001_NOR.JPG|DIA-001 NOR Testpoints
<Abkarino> you may have gnd problem
File:VER-001_NOR-3.3V.JPG|VER-001 NOR Testpoints
<eussNL> did you try manual removing the driver in safemode?
File:DYN-001_NOR.JPG|DYN-001 NOR Testpoints
<Abkarino> try to remove r4 then try again
File:JSD-001_NOR.JPG|JSD-001 NOR Testpoints
<Abkarino> i had the same problem before
File:JSD-001_NOR_-_nor_testpoints.png|JSD-001 Testpoints (orig. marcan/noraliser)
<Abkarino> but uf6667 and ago told me to remove r4 and try again
File:JTP-001_-_1-882-481-21-testpoints.jpg|JTP-001 NOR Testpoints (not mapped)
<Abkarino> now [[Progskeet 1.0 / 1.1]] work fine every time i plug it to my PC
</Gallery>
<MrGBNC> I've also talked to Ago, he said that the resistance between GND and VCC is too small for my [[Progskeet 1.0 / 1.1]]
<Ago> well, you had voltage drops
<Ago> and a cap might be bad
<MrGBNC> that is why I try to exchange/warranty. I also couldn´t read a socket´ed NAND, only 30 in dump ;)


'''Missing / requested''' :
* COK-002 (NAND)
* COK-002W (NAND)
* SEM-001 (NAND)
* DIA-002 (NOR)
* SUR-001 (NOR)
* ''JTP-001 (NOR) seems visually the same as JSD-001, but need tracing+confirmation''
* KTE-001 (NOR)


== Generic wire reference ==
{{Hardware Flashers}}<noinclude>[[Category:Main]]</noinclude>
Wire thickness AWG/mm :
    18 AWG - .0403" / 1.024mm
    20 AWG - .0320" / 0.812mm
    22 AWG - .0253" / 0.644mm
    24 AWG - .0201" / 0.511mm
    26 AWG - .0159" / 0.405mm
    28 AWG - .0126" / 0.321mm
    30 AWG - .0100" / 0.255mm
For wiring, use 20-26 AWG. 18 can be too stiff while 28 is too fragile. 24 AWG works fine in most cases. The Ground and VCC wires may ofcourse be thicker than the signal wires.

Latest revision as of 05:18, 1 July 2023

Progskeet wired to NANDs of a COK-002 board (photo:idone)

Typical NOR flashing requires 16 Data wires, 23 Address wires and 3-4 control wires to the NOR pads (photo:defyboy)

intro[edit | edit source]

Before you think this is going to be easy, let me explain why not:

but even with that amazing number of possible variations, it all comes down to 2 seperate diagrams to use: NAND or NOR.

Hardware Flashers[edit | edit source]

Both early launch consoles which feature NAND flash memory (block devices, that interleave their data unlike NOR flash) and later consoles which feature NOR flash memory are able to be flashed.

Different Flashers[edit | edit source]

Infectus[edit | edit source]

...

Noraliser[edit | edit source]

Marcan has made a NOR flasher / address sniffer for his PS3 slim by re-purposing a FPGA board (Xilinx Spartan3E XC3S500E) made for Wii hacking. Noraliser is a git repo that contains the HDL (verilog) and associated host computer tools for flashing/sniffing. There are ~50 signals to solder.

NORway[edit | edit source]

Work has been underway to brink a low cost AVR (Atmel 90USB1286) based NOR flasher that is capable of reading and writing on all consoles by defyboy. This was opensourced and further enhanced, now known as NORway for Teensy++ 2.0 boards.

Progskeet[edit | edit source]

Other people haven't been sitting idle either: uf6667 and bmx have developed Progskeet 1.0 / 1.1, based on an Actel A3P125 FPGA for NAND and NOR based consoles (not only PS3, but also useable for Wii and Xbox360). Later followed up by Progskeet 1.2, which was anounced to get an open API. Although highly hyped/marketed as universal flasher, it is not the recommended end user choice: long history of issues, long time between fixes, no clear support path etc.

PNM[edit | edit source]

"No_One" has developed PNM - The PS3 NOR Manager is a custom board based on a FPGA (Altera Cyclone3 EP3C25) and 2 flash sockets. PNM is capable to handle the basic features like read/dump/update/copy but also to swap (hot swap or cold swap) the NOR used. It also enbles features to sniff bus activities, emulate NOR flash etc.

PIC32MX[edit | edit source]

PIC32MX is an opensource PIC based NOR flasher.

E3[edit | edit source]

The E3 is a China commercial developped PS3 only 'flasher'.
It uses MCU ARM 32BIT 256K FLASH 144LQFP - STM32F103ZCT6 controller to dump the NOR.

Comparison[edit | edit source]

Flash types and models used by PS3
[edit]
Flash Type / Model PS3 Fat PS3 Slim PS3 SuperSlim notes
CECHA
CECHB		 CECHC
CECHE		 CECHE CECHG CECHH
CECHM
CECHQ		 CECHJ
CECHK		 CECHL
CECHP
 CECH-20xx CECH-21xx CECH-25xx CECH-25xx CECH-30xx CECH-40xxB/C CECH-40xxB/C CECH-40xxA
'12GB' noHDD
COK
001		 COK
002		 COK
002W		 SEM
001		 DIA
001		 DIA
002		 VER
001		 DYN
001		 SUR
001		 JTP
001		 JSD
001		 KTE
001		 MSX
001		 MPX
001		 MPX
001
NAND 2x Samsung K9F1G08U0A-PIB0 Yes Yes Yes - No No No No No No No No No No No
2x Samsung K9F1G08U0B-PIB0 - - - Yes No No No No No No No No No No No
NOR 1x Spansion S29GL128N90TFIR2 No No No No Yes Yes Yes Yes - - - - - - No
1x Samsung K8Q2815UQB-PI4B No No No No - - Yes Yes Yes - - - - - No
1x Spansion S29GL128P90TFIR2 No No No No - - Yes Yes Yes Yes Yes Yes Yes Yes No
1x Macronix MX29GL128ELT2I-90G No No No No - - - Yes Yes Yes yes ? Yes No
1x Samsung K8P2716UZC-QI4D No No No No Yes - - - - Yes Yes Yes No
1x Macronix MX29GL128FLT2I-90G No No No No - - - - - - - - Yes Yes No
eMMC 1x Panasonic MN66840 +
1x Samsung KLMAG2GE4A-A001		 No No No No No No No No No No No No No No Yes
connection type NAND layout 1 NOR layout 1 NOR layout 2 NOR layout 3 NOR layout 4 NOR layout 5 eMMC layout


PS3 Flashers compatibility
Flasher PS3 Fat PS3 Slim notes
CECHA
CECHB		 CECHC
CECHE		 CECHE CECHG CECHH CECHJ
CECHK		 CECHL
CECHM
CECHP
CECHQ		 CECH-20xx CECH-21xx CECH-25xx CECH-25xx CECH-30xx
COK
001		 COK
002		 COK
002W		 SEM
001		 DIA
001		 DIA
002		 VER
001		 DYN
001		 SUR
001		 JTP
001		 JSD
001		 KTE
001
Infectus Yes Yes Yes Yes No No No No No No No No NAND only
Progskeet 1.0 / 1.1 Issues Issues Issues Issues Issues Issues Issues Issues Issues Issues Issues Issues advertised Universal NAND + NOR + SPI
Progskeet 1.2 Issues Issues Issues Issues No No No No No No No No advertised Universal NAND + NOR + SPI
Progskeet 1.21 Issues Issues Issues Issues No No No No No No No No advertises Universal NAND + NOR + SPI
Teensy++ 2.0: NANDway / NORway Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes OpenSource / OpenHardware + works for NAND + NOR
PNM No No No No Yes Yes Yes Yes Yes Yes Yes Yes OpenSource / OpenHardware
Noraliser No No No No Yes Yes Yes Yes Yes Yes Yes Yes Not commercially avail.
PIC32MX No No No No Yes Yes Yes Yes Yes Yes Yes Yes OpenSource / OpenHardware
E3 No No No No Yes Yes Yes Yes Yes Yes Yes Yes 1 console only (unless you use the Samsung multi console update)
connection type NAND layout 1 NOR layout 1 NOR layout 2 NOR layout 3 NOR layout 4
PS3 Flashers features
Feature Infectus PNM Progskeet 1.0 / 1.1 Progskeet 1.2 / 1.21 Teensy++ 2.0
NANDway / NORway		 PIC32MX E3 Remarks
Use CFI ? Yes Yes Yes No ? ? Common Flash Memory Interface writing strategies (Progkseet can dump CFI, but doesnt use it directly for writestrategy)
PS3 NAND Support
(see above table)		 Yes No Yes Yes Yes No Yes E3 supports NAND with later 'to be released' edition
PS3 NOR Support
(see above table)		 No Yes Yes Issues Yes Yes Yes Users reporting NOR writing problems on Progskeet 1.2 / 1.21
Solderless No No Yes Yes No No Yes Solderless is optional for E3 (but still requires soldering tristate).

NOR/NAND solderless clip for Progskeet 1.0 / 1.1 are already available now. Announced for PNM near future.

OpenSource No Yes No No Yes Yes No
OpenHardware No Yes No No Yes Yes No
Updateable JTAG USB JTAG JTAG USB ISP microSD
Onboard Flash No Yes No No No No Yes Instant-on dual firmware for PNM using a jumper // E3 uses flash on driveboard, not internal
Dual Boot solution No Yes Yes Yes No No Yes Real quick dualboot requires dual flash (and user to swap the harddrive)
File Transfer Protocol USB X-Modem USB USB USB
Mass Production No No Yes Yes No No Yes PNM V2 might be mass produced
X360 NAND Support Yes No Yes Yes No No No
Wii NAND Support Yes No Yes Yes No No No

Generic Warning[edit | edit source]

Generic Warning
Make sure you have several proper dumps of your flash before even trying writing to it! Use unpacking tools (e.g. Norunpack, Flowrebuilder, Norpatch etc.) and hexeditors (e.g. HxD) and use Flash page as reference.
  • CRC/MD5 is not a method to check your flash (if it is bad, you are only comparing if the other file is equally bad).
  • Also make sure you checked the content of the flash, Flowrebuilder, Norunpack only looks for image header and unpacks without warnings and without checking the content.

See also: Validating flash dumps

You cannot recover from bad flash without proper dumps (e.g. bricking the console beyond repair).

NAND Wiring[edit | edit source]

Flashers for NAND based consoles (CECHA/COK-001, CECHB/COK-001, CECHC/COK-002, CECHD/unreleased, CECHE/COK-002W, CECHF/unreleased, CECHG/SEM-001) are generaly wired directly to the pins of the NAND (you cannot use the testpoints!), plus ground and Vcc. For NAND pinouts see: Flash (Hardware) #NAND

There are 2 nands interleaved at the 512byte sectors level, giving a 1024 byte "interleaved sector". pages are 2kb on each nand.

Which NAND is low (NAND 0)/high (NAND 1)?[edit | edit source]

  • COK-001 :
    • IC3802 LOW (main componentside next to Starship2)
    • IC3803 HIGH (backside next to 60-pin BD ATA connector)
  • SEM-001 :
    • IC3802 LOW (backside)
    • IC3803 HIGH (main componentside with SATA connector, CELL BE, RSX etc.)

SMD parts connecting to the NANDs[edit | edit source]

  • NAND0:
    • R3841 : 2200 Ω (between SS2_XFRB0 / RB#-pin7 and +3.3_SB_VDDIO/VCC as pullup)
    • R3812 : xx (between SS2_XFWP0 and WP#-pin19)
    • R3813 : 0 Ω (between +3.3_SB_VDDIO and WP#-pin19 as always pulled up WP#)
    • C3823 : 0.1μF B 10V (between GND-pin13 and +3.3_SB_VDDIO/VCC-pin12 for filtering)
    • C3824 : 0.1μF B 10V (between GND-pin36 and +3.3_SB_VDDIO/VCC-pin37 for filtering)
  • NAND1:
    • R3840 : 2200 Ω (between SS2_XFRB1 / RB#-pin7 and +3.3_SB_VDDIO/VCC as pullup)
    • R3814 : xx (between SS2_XFWP1 and WP#-pin19)
    • R3815 : 0 Ω (between +3.3_SB_VDDIO and WP#-pin19 as always pulled up WP#)
    • C3825 : 0.1μF B 10V (between GND-pin13 and +3.3_SB_VDDIO/VCC-pin12 for filtering)
    • C3826 : 0.1μF B 10V (between GND-pin36 and +3.3_SB_VDDIO/VCC-pin37 for filtering)

Effect when lost:

  • Without RB# pullup parts (pin19) it cannot be read or written with adequate timings (only with a flasher can slow down writing and not by PS3)
  • Without WP# pullup parts (pin7) it cannot be written (only with a flasher that pullup WP# and not by PS3)
  • Without VCC filter parts (pins 12+37) it cannot be read nor written (only with a flasher that injects VCC and not by PS3)

Pinout Table[edit | edit source]

Dual NAND connection to Teensy++ 2.0 (NANDway) diagram

Dual NAND connection to Progskeet diagram

Dual NAND connection to Infectus diagram

NAND 360Clip pinout

Progskeet - Single-NAND - 360clip

Progskeet 1.2 - back
Chip/PIN Description NANDway Progskeet 1.0 / 1.1 S-NAND Progskeet 1.0 / 1.1 SL-NAND Progskeet 1.2 / 1.21 Infectus 360clip Description
NAND 0
0/1-6 NC NC NC NC NC NC NC No Connection
0/7 R/B PB6 64 / rdy gp5 P02 U FRB1 Read/Busy Output
0/8 RE PB1 69 / oe gp1 P06 M RE Read Enable
0/9 CE PB0 60 / gp3 gp2 P05(p) CE_A / P03(s) CE_B N FCE1 Chip Enable
1/10+11 NC NC NC NC NC NC NC No Connection
0/12 Vcc +3.3 +3.3 +3.3 NC Vcc Vcc (min 2.7V-max 3.6V / typ 3.3V)
0/13 Vss GND GND GND NC GND VSS - Ground
1/14+15 NC NC NC NC NC NC NC No Connection
0/16 CLE PB2 63 / gp0 we P09 O CLE Command Latch Enable
0/17 ALE PB3 62 / gp1 rdy P08 P ALE Address Latch Enable
0/18 WE PB5 65 / we gp0 P07 Q WE Write Enable
0/19 WP PB4 61 / gp2 gp3 P04 T WP Write Protect
1/20-28 NC NC NC NC NC NC NC No Connection
0/29 I/O-0 PF0 79 / dq0 79 / dq0 P34 D0 I/O0
0/30 I/O-1 PF1 80 / dq1 80 / dq1 P35 D1 I/O1
0/31 I/O-2 PF2 81 / dq2 81 / dq2 P36 D2 I/O2
0/32 I/O-3 PF3 82 / dq3 82 / dq3 P37 D3 I/O3
0/33-35 NC NC NC NC NC NC NC No Connection
0/36 Vss GND GND GND NC GND VSS - Ground
0/37 Vcc +3.3 +3.3 +3.3 NC Vcc Vcc (min 2.7V-max 3.6V / typ 3.3V)
0/38-40 NC NC NC NC NC NC NC No Connection
0/41 I/O-4 PF4 83 / dq4 83 / dq4 P38 D4 I/O4
0/42 I/O-5 PF5 84 / dq5 84 / dq5 P39 D5 I/O5
0/43 I/O-6 PF6 85 / dq6 85 / dq6 P40 D6 I/O6
0/44 I/O-7 PF7 86 / dq7 86 / dq7 P41 D7 I/O7
0/45-48 NC NC NC NC NC NC NC No Connection
0/- NC NC NC NC NC NC PRE Not used
0/10 NC NC NC NC NC NC FCE2 Not used
0/6 NC NC NC NC NC NC FRB2 Not used
0/- NC NC NC NC NC NC RST Not used
NAND 1
1/1-6 NC NC NC NC NC NC NC No Connection
1/7 R/B PD6 3 / gp13 a15 P26 A9 FRB1 Read/Busy Output
1/8 RE PD1 98 / gp15 a19 P30 A15 RE Read Enable
1/9 CE PD0 7 / gp9 a18 P29(p) CE_A / P27(s) CE_B A14 FCE1 Chip Enable
1/10+11 NC NC NC NC NC NC NC No Connection
1/12 Vcc +3.3 +3.3 +3.3 NC Vcc Vcc (min 2.7V-max 3.6V / typ 3.3V)
1/13 Vss GND GND GND NC GND VSS - Ground
1/14+15 NC NC NC NC NC NC NC No Connection
1/16 CLE PD2 4 / gp12 a22 P33 A13 CLE Command Latch Enable
1/17 ALE PD3 5 / gp11 a21 P32 A12 ALE Address Latch Enable
1/18 WE PD5 2 / gp14 a20 P31 A11 WE Write Enable
1/19 WP PD4 6 / gp10 a17 P28 A10 WP Write Protect
1/20-28 NC NC NC NC NC NC NC No Connection
1/- NC NC NC NC NC NC PRE Not used
1/10 NC NC NC NC NC NC FCE2 Not used
1/6 NC NC NC NC NC NC FRB2 Not used
1/- NC NC NC NC NC NC RST Not used
1/29 I/O-0 PC0 90 / dq8 90 / dq8 P42 A0 I/O0
1/30 I/O-1 PC1 91 / dq9 91 / dq9 P43 A1 I/O1
1/31 I/O-2 PC2 92 / dq10 92 / dq10 P44 A2 I/O2
1/32 I/O-3 PC3 93 / dq11 93 / dq11 P45 A3 I/O3
1/33-35 NC NC NC NC NC NC NC No Connection
1/36 Vss GND GND GND NC GND VSS - Ground
1/37 Vcc +3.3 +3.3 +3.3 NC Vcc Vcc (min 2.7V-max 3.6V / typ 3.3V)
1/38-40 NC NC NC NC NC NC NC No Connection
1/41 I/O-4 PC4 94 / dq12 94 / dq12 P46 A4 I/O4
1/42 I/O-5 PC5 95 / dq13 95 / dq13 P47 A5 I/O5
1/43 I/O-6 PC6 96 / dq14 96 / dq14 P48 A6 I/O6
1/44 I/O-7 PC7 97 / dq15 97 / dq15 P49 A7 I/O7
1/45-48 NC NC NC NC NC NC NC No Connection
Board trace / Other
GND Vss NC NC NC NC GND NC VSS - Ground
+5VDC Vcc NC NC NC NC 5V NC Vcc from TH3401 (CECHA+CECHB/COK-001)
Vcc from TH3401 (CECHC+CECHE/COK-002)
Vcc from TH3280 (CECHG/SEM-001)
TRISTATE tri PB7 / PD7 NC NC NC NC NC Tristate pad on EBUS Testpoints
Chip/PIN Description NANDway Progskeet 1.0 / 1.1 S-NAND Progskeet 1.0 / 1.1 SL-NAND Progskeet 1.2 Infectus 360clip Description

Remarks:

  • Progskeet 1.0 / 1.1 is feeded from NAND 3.3V
  • Infectus is feeded from +5V board trace.
  • NAND's are feeded in both cases by the console itself.

Progskeet 1.0 / 1.1 Note: Some modification is needed for Progskeet 1.0 / 1.1 to unbrick:

  • desolder R8 from the Progskeet 1.0 / 1.1 PCB (to disable the connection from pad R8 to left pad R7)
  • left pin of toggle switch to left lead of R7, middle pin of toggle switch to right lead of R7
  • Vcc to +3.3 // put toggle switch in "OFF" (right) postion, power on the ps3, put the toggle switch in the "ON"/left position, it will be recognized by the PC, NAND is always on now, do everything as usual.

NAND + clips[edit | edit source]

First make sure everything is correct:

  • Connect the flasher to the "Y" NAND adapterboard and from there connect the NAND clips to the "Y" NAND adapterboard.
  • Install flasher application
  • Connect flasher to PC
  • Install drivers with zadig.exe (select winusb for latest Winskeet, libusb0 is only for older versions)
  • Use the "Check for Shorts" option in the flasherapplication.

Make sure the clips are fitted correctly over the NANDs:

  • note the markerdot for pin1 (both on clip and NAND package)
  • make sure all pins make contact
  • check if it is all the way down to the PCB evenly and no components surrounding the NAND are preventing it from going down proper (might need some filing to make room).
  • You can take the topcap off the clip if you need, and can use hotglue on the outsides to further fixate it.

Preparing console further:

  • Replace the thermalcompound (e.g. Arctic Cooling MX-4) for the heatsink : CELL BE and RSX and reassemble the heatsink+fan.
  • Connect the Power Supply, Harddrive and the power/resetbutton subboard
  • For dumping/reflashing it is not needed to connect the Bluray Drive or the Bluetooth+Wifi board (ofcourse you are going to need them when installing a firmware)

Usage after all is connected:

  • First connect flasher to pc
  • Use the PS3 to power the NANDs.

Progskeet 1.0 / 1.1 specific:

  • On NAND tab, you click NAND 1 and select 'auto'
  • On NAND tab, you click NAND 2 and select 'auto'
  • If it fails, it means it is not connected correctly

Using NAND flashers[edit | edit source]

Progskeet 1.0 / 1.1[edit | edit source]

Method 1 (with R7 switch and R8 closed): 

put switch in "OFF" (R7 is open) position so that Progskeet 1.0 / 1.1 is not powered.
power on the ps3 and wait for 10-15 seconds (sometimes shorter time is needed),
put the switch in the "ON" (R7 closed) position, so Progskeet 1.0 / 1.1 is powered and will be recognized by the PC.
NAND is always on now, do everything as usual
    
select Big Block
select Raw
Pages per block: 64
blocks: 1024
    
That will give you 132MB (138,412,032 bytes) per NAND (dump time ~ 00:02:40 per NAND)
   
For normal console operation (e.g. after you dumped, flashed/downgraded it):
you need switch to "on" (R7 closed) and Progskeet 1.0 / 1.1 USB disconnected.

Method 2 (with R7 open / R8 closed): 

1. Remove USB cable from your PC
2. Open up Progskeet 1.0 / 1.1 flashing software (use latest) and on Common tab: select the flash you have @ Presets
3. Power on PS3 and wait 10-15 seconds (sometimes shorter time is needed),
4. Plug in the USB cable to your PC
5. Progskeet 1.0 / 1.1 will be recognised and you can now go ahead and dump
For normal console operation (e.g. after you dumped, flashed/downgraded it):
you need to disconnect the USB cable to your PC
downloads[edit | edit source]

All current downloads are available here / all backup/mirror are here

Infectus[edit | edit source]

For Infectus don't use 3.9.9.0, as it removes dual NAND PS3 support :S If your board already came with this version or higher, use this: prepare_infectus_for_ps3.rar (5.53 MB) If it is done, it will show up as "2 NAND Programmer" in the bottom left. Dual NAND PS3 compatible version: Infectus_programmer_3.8_Beta_2.zip (4.02 MB)

Power the Infectus, it crashes the PS3 and leaves the NANDs in powered mode. Use the console to power the NANDs: power it up until the PS3 crashes and halts with red flashing LED, press power again to stop the flashing, but keeps the console powered on. The NANDs are not accessed by the PS3 in this way, so it doesn't matter if the NAND content is already messed up. After that, you can read/write the NANDs.

Dumping of single NAND should take about 15 minutes, 30 minutes for both.

Needed NAND tools[edit | edit source]

In case the flasher program doesnt understand dual NAND de/interleaving you'll need  : FlowRebuilder

Flowrebuilder options[edit | edit source]
  • (NAND only) Unscramble then interleave flashes into one unified dump : Makes a single dump.bin from 2 seperate NAND flash dumps.
    • In the second step it also extract the content of the unified dump. Make sure it extracts correctly (it will give no warning if it fails!) and all the needed files are there.
  • (NAND only) Re-scramble modified dump then de-interleave it into two new flashes : Splits the single dump.bin into 2 seperate NAND flash dumps.
  • Byte reverse and extract a NOR dump file : First byte reverse the single dump.bin then extract NOR content.
  • Extract a Byte reversed NOR dump or an interleaved and unscrambled NAND dump : Extract the single dump.bin
Extracted flash content files[edit | edit source]

(make sure they are all there, flowrebuilder will not give warning when it fails!):

  • bootloader_0
  • bootloader_1
  • cCSD
  • cISD
  • creserved_0
  • cvtrm
  • eEID
  • trvk_pkg
  • trvk_prg
  • \asecure_loader\metldr
  • \ros\[two seperate folders named to FW version]\CoreOS files (19 up to 25 files, depending the FW version)

Notes: if it only extracted bootloader_0 + bootloader_1, check that both NANDs are dumped correct (known error with flashers that has bug with second NAND channel to read),

Dump NAND from GameOS[edit | edit source]

USB Flash Dump // source/mirror: dump_flash.pkg
Make sure USB stick is FAT32 with enough free space (256MB per dump)

Dumping NAND from Linux[edit | edit source]

dd if=/dev/ps3flash of=NAND.BIN bs=1024

or 

dd if=/dev/ps3vflasha of=NAND.BIN bs=1024

(needs unmasking first, see below)

Difference between hardware dumps and software dumps[edit | edit source]

ps3vflasha

hardware dumps[edit | edit source]

256 MB (268,435,456 bytes) bootldr is at 0x000000 on NAND (0xFC0000 on NOR)

software dumps[edit | edit source]

dump size = 239 MB (251,396,096 bytes)
bootldr not at 0x000000 on NAND : 

00000000   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00000010   00 00 00 00 0F AC E0 FF  00 00 00 00 DE AD BE EF   .....¬à ÿ....Þ­¾ï

reason: 

addi    %r12, %r4, 0x200 # r4 = start sector

256MB NAND consoles have a hidden section of size 0x40000 (0x200 * 512 byte sector = 0x40000) hidden by the hv. The hv hides it at address 002786E8

Original code : 0x39840200f8010090
Change to : 0x39840000f8010090

as seen in unself'ed LV1.self (Hypervisor)[edit | edit source]
3.15:
    Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
    00098D20                                      39 84 02 00              9„..
    00098D30  F8 01 00 90                                      ø...
3.41:
    Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
    000986A0  39 84 02 00 F8 01 00 90                          9„..ø...
Brick warning - Peek/Poke only
#Brick warning

TCL: http://pastebin.com/Snh4ERQ6 (Don't use, BRICK RISK, see below)

Too dangerous to patch unless you peek/poke because obviously it messes with all the offsets

Guide to unbrick from above situation[edit | edit source]

Here's my guide http://www.mediafire.com/?76bw1vd1m65bkk4 . I haven't tested it yet, but it should work on COK-001

'NOR' Interface Testpoints on NAND consoles[edit | edit source]

Simular as on the NOR based consoles testpoints can be found on the back of the PCB. It seems these are from the bus between the South Bridge and the Starship2. Attempts have been made to document/trace these. Addresslines 0-17 and Datalines 0-15 as well as some controllines are documented but so far these could not be used to read/flash the console in a NOR fashion.

TriState on NAND consoles[edit | edit source]

using Starship2 to South Bridge BRDY /SS2_BRDY

NOR Interface Testpoints[edit | edit source]

Probably to aid in factory programming, Sony provides NOR testpoints on the bottomside of the motherboard. There are 16 data lines (Word access) and generally 23 Address lines. You will also need to control Chip Enable (#CE), Write Enable (#WE), Tristate (SB_DISABLE) and for some boards Write Protect (#WP)

Tristate[edit | edit source]

Tristate, or as it is referred to in the service manuals SB_DISABLE exists solely for the purpose of placing the South Bridge pins into high-impedance (aka the third state logic) so that we can access the flash without the South Bridge interfering.

When the southbridge pins are in tristate is like if southbridge (and all peripherals connected to it) where disconnected from the main circuit, the PS3 powers up normally (fans, etc) but it won't boot up to the XMB screen because some components of the motherboard are not found, it just sits there with a black screen

Because the tristate pin is not connected to the Flash TSOP package, but to the South Bridge BGA package, this makes tracing the pin quite difficult. One should be able to locate it by having the running you could ground out the unknown pins whilst checking the continuity of a known address or data line against ground. These should enter high-impedance or no-continuity when you ground out SB_DISABLE.

Connecting NOR pads to flasher[edit | edit source]

Teensy++ 2.0 connection diagram for PS3 NOR pads

Progskeet NAND/NOR flasher board, based on Actel MCU

Progskeet 1.1 NAND/NOR flasher board, with ZIF and dual voltage)

Progskeet 1.2 - back

PNM, based on Altera FPGA and 2x NOR sockets

NOR TSOP56 ZIF 360clip and solderboard

E3 Linker pads

Progskeet wired to NANDs of a COK-002 board, injecting 3.3V with external PSU (photo:mackarry)
NORpin PAD Progskeet 1.0 / 1.1 Progskeet 1.2 Teensy++ 2.0
NORway		 PNM E3 / E3 Linker NOR56 360clip Remark
31 A0 adr0 P11 F0 A0 A0 FA0
26 A1 adr1 P12 F1 A1 A1 FA1
25 A2 adr2 P13 F2 A2 A2 FA2
24 A3 adr3 P14 F3 A3 A3 FA3
23 A4 adr4 P15 F4 A4 A4 FA4
22 A5 adr5 P16 F5 A5 A5 FA5
21 A6 adr6 P17 F6 A6 A6 FA6
20 A7 adr7 P18 F7 A7 A7 FA7
10 A8 adr8 P19 PA0 A8 A8 FA8
9 A9 adr9 P20 PA1 A9 A9 FA9
8 A10 adr10 P21 PA2 A10 A10 FA10
7 A11 adr11 P22 PA3 A11 A11 FA11
6 A12 adr12 P23 PA4 A12 A12 FA12
5 A13 adr13 P24 PA5 A13 A13 FA13
4 A14 adr14 P25 PA6 A14 A14 FA14
3 A15 adr15 P26 PA7 A15 A15 FA15
54 A16 adr16 P27 B0 A16 A16 FA16
19 A17 adr17 P28 B1 A17 A17 FA17
18 A18 adr18 P29 B2 A18 A18 FA18
11 A19 adr19 P30 B3 A19 A19 FA19
12 A20 adr20 P31 B4 A20 A20 FA20
15 A21 adr21 P32 B5 A21 A21 FA21
1 A23 Not Used Not Used Not Used Not Used Not Used FA23 pin unused for 128mbit and below
56 A24 Not Used Not Used Not Used Not Used Not Used FA24 pin unused for 256mbit and below
2 A22 adr22 P33 B6 A22 A22 FA22
35 DQ0 dq0 P34 D0 DQ0 D0 AD0
37 DQ1 dq1 P35 D1 DQ1 D1 AD1
39 DQ2 dq2 P36 D2 DQ2 D2 AD2
41 DQ3 dq3 P37 D3 DQ3 D3 AD3
44 DQ4 dq4 P38 D4 DQ4 D4 AD4
46 DQ5 dq5 P39 D5 DQ5 D5 AD5
48 DQ6 dq6 P40 D6 DQ6 D6 AD6
50 DQ7 dq7 P41 D7 DQ7 D7 AD7
36 DQ8 dq8 P42 C0 DQ8 D8 AD8
38 DQ9 dq9 P43 C1 DQ9 D9 AD9
40 DQ10 dq10 P44 C2 DQ10 D10 AD10
42 DQ11 dq11 P45 C3 DQ11 D11 AD11
45 DQ12 dq12 P46 C4 DQ12 D12 AD12
47 DQ13 dq13 P47 C5 DQ13 D13 AD13
49 DQ14 dq14 P48 C6 DQ14 D14 AD14
51 DQ15 dq15 P49 C7 DQ15 D15 AD15
13 #WE we P09 E5 NWE NWE WE
32 CE# gp0 P07(p) CE_A / P02(s) CE_B E0 NCE CE to NOR
(SBCE from South Bridge)		 CE#
14 RESET gp1 P06 E4 NRESET RESET RESET
N/A TRISTATE gp2 P05 E7 GPIO0 SBE N/A
16 WP# gp3 P04 Not Used NWPACC Not used WP# Is tied to Vcc by mobo
53 BYTE# Not Used Not used Not used Not used BVCC ? Is tied to Vcc by mobo
34 OE# oe P10 E1 NOE NOE OE
17 RY/BY# rdy (ánd gp4 for old bitstream) P08 E6 RYNBY NWAIT RDY JTAG updated progskeet can do without the progskeet:gp4 to progskeet:rdy bridge and use the PS3:RY/BY# to progskeet:rdy alone.
33, 52 VSS GND GND GND GND GND
29, 43 VCC Not Used Not used Not used VCC ?
27, 28, 30, 55 NC Not Used Not Used Not Used Not Used Not Used Not Used pins unused / Not Connected

Progskeet 1.0 / 1.1 notes[edit | edit source]

Some modification is needed for Progskeet 1.0 / 1.1 to unbrick:

  • desolder R8 from the Progskeet 1.0 / 1.1 PCB
  • left pin of switch to left lead of R7, middle pin of switch to right lead of R7
  • Vcc to +3.3 // put switch in "OFF" (right) postion, power on the ps3, put the switch in the "ON"/left position, it will be recognized by the PC, NOR is always on now, do everything as usual.

PNM notes[edit | edit source]

  • PNM requires a +5V_EVER from the PS3 motherboard in "PS3 mode"
  • PNM requires a +5V from a USB port in "standalone mode". It then provides a +3.3V to the embedded NOR.

Teensy notes[edit | edit source]

E3 debricking notes[edit | edit source]

  • Requires soldering wire from SBE (solderpad on NOR flatcable) to TRISTATE (NORpoint on PS3 motherboard)
  • Make sure you have correct firmware on SD/TF card
  • E3 switches set as 1:Flash fun, 2: OFW, 3: Prog, 4: microSD, 5: PS3 Flash, 6: Lock with the console power disconnected.
  • Turn on console to restore (progress LEDs will light up one by one and blink if successfully).
  • Unplug powercable and set 1:Flash fun down to PS3 Mode and turn on the PS3, if everything went fine, it will now be debricked (remember: in case syscon has 3.56+ hashes, you need prepatched LV1, see downgrader guides).

Speed comparison NOR flashers[edit | edit source]

Speed comparison NOR flashers
Teensy++ 2.0
(NORway 0.1)		 Teensy++ 2.0
(NORway 0.3)		 Progskeet 1.0 / 1.1 PNM
(X-Modem - 460800 baud)
 time (h:mm:ss)   speed (KB/sec)   time (h:mm:ss)   speed (KB/sec)   time (h:mm:ss)   speed (KB/sec)   time (h:mm:ss)   speed (KB/sec) 
Full dump/read (16 MB)    0:05:11   52,68 KB/s   0:00:45   364,08 KB/s   0:00:16   1024 KB/s   0:45:43   6,1 KB/s 
Per sector write(128 KB)    0:01:35   1,35 KB/s   0:00:05.351   23,92 KB/s   0:00:00.365   350,69 KB/s   0:00:16.12   7,90 KB/s 
Full dump/write (16 MB)    2:08:19   2,12 KB/s   0:08:19   32,83 KB/s   0:00:46.811   350,00 KB/s   0:34:56   7,90 KB/s 
Full CRC32 (16 MB)    0:01:30   182,04 KB/s 
Full copy NOR-NOR (16 MB)    0:04:59   54,61 KB/s 

Using NOR flashers[edit | edit source]

Progskeet 1.0 / 1.1[edit | edit source]

Method 1 (with R7 switch and R8 closed): 

1. Unplug the PS3 powercable from the back
2. Open up Progskeet 1.0 / 1.1 flashing software (use latest) and on Common tab: select the flash you have @ Presets
3. Set the R7 switch to "off"
4. Plug the PS3 powercable back in and Power on the PS3
5. Wait 10 seconds and set the R7 switch to "on" to power Progskeet 1.0 / 1.1 (sometimes shorter time is needed)
6. Progskeet 1.0 / 1.1 will be recognised and you can now go ahead and dump
For normal console operation (e.g. after you dumped, flashed/downgraded it):
you need switch to "on" (R7 closed) and Progskeet 1.0 / 1.1 USB disconnected.

Method 2 (with R7 open / R8 closed): 

1. Remove USB cable from your PC
2. Open up Progskeet 1.0 / 1.1 flashing software (use latest) and on Common tab: select the flash you have @ Presets
3. Power on PS3 and wait 10 seconds (sometimes shorter time is needed)
4. Plug in the USB cable to your PC
5. Progskeet 1.0 / 1.1 will be recognised and you can now go ahead and dump
For normal console operation (e.g. after you dumped, flashed/downgraded it):
you need to disconnect the USB cable to your PC

NORway[edit | edit source]

Usage: %s serialport [command] [filename] [address]
    
serialport  Name of serial port to open (eg. COM1, COM2, /dev/ttyACM0, etc)
command     dump       Reads entire NOR to [filename]
            erase      Erases one sector (128KB) at [address]
            write      Flashes (read-erase-modify-write-verify) [filename]
                       at [address] to NOR
            writeimg   Same as write, but prepend a 16-byte length header
                       [address] is required
            program    Flashes (erase-write-verify) [filename]
                       at [address] to NOR
            release    Releases NOR interface, so the PS3 can boot
filename    Filename for [dump|write|writeimg|program]
address     Address for [erase|write|writeimg|program]
            Default is 0x0, address must be aligned (multiple of 0x20000)

PNM[edit | edit source]

serialport  (COM1, COM2, etc) - 460800 baud - 8N1
X-Modem protocol for file transfers
 
            copy_memory             Copies entire NOR to another NOR
            read_memory             Reads 0x80 bytes from a specified offset
            dump_memory             Reads entire NOR to a file (byte swap "on the fly")
            update_memory           Flashes entire NOR from a file (byte swap "on the fly")
            display_memory_crc      Displays NOR CRC32
            display_memory_details  Displays NOR details (size, firmware version, etc) 
 
PNM uses the Common Flash Interface standard (almost all current flash can be dumped/updated)

Needed NOR tools[edit | edit source]

If your dump starts like this: http://pastebin.com/sS69Vhvf you'll need to use the option "¨Byte reverse and extract a NOR dump file" of Flowrebuilder, which will output a inputfile.REV file

Dump NOR from GameOS[edit | edit source]

dump_flash.pkg // backup/mirror: dump_flash.pkg (70.48 KB)
Make sure USB stick is FAT32 with enough free space (16MB per dump) Note: This application takes about 120 minutes to complete the dump, tested on a PS3 80GB CECHL04

Dumping NOR from Linux[edit | edit source]

dd if=/dev/ps3nflasha of=NOR.BIN bs=1024

Board Revisions[edit | edit source]

For overview of used types, see flashtypes table

NAND boards - COK-001, COK-002, COK-002W, SEM-001[edit | edit source]

These are the earliest revisions of the PS3 motherboards: CECHA/COK-001, CECHB/COK-001, CECHC/COK-002, CECHE/COK-002W, CECHG/SEM-001 and contain 2x NAND chips for a total of 256MB. These chips are interleaved which is controlled by a proprietary controller chip codenamed "Starship2" or SS2. This chip handles the interleaving and presents the NAND Chips to the South Bridge as a single large coherent flash over a proprietary EBUS.
Wiring: direct to NAND flash or using boardtraces to NANDs - don't use the testpoints.

NOR layout1 - DIA-001, DIA-002[edit | edit source]

DIA-001: These boards were the first to get single NOR flash] memory from the middle revisions of the PS3: CECHH/DIA-001, CECHK/DIA-002. Only a single 16MB NOR flash chip is used and the Starship2 chip has been completely removed. The 128N is JEDEC CFI compliant and organized as 8,388,608 words or 16,777,216 bytes, addressable as 16-bit words (PS3 modus operandi) and 8-bit / 1 byte when the BYTE# signal is logic zero.

DIA-002: the pinout is same as DIA-001, the only difference is that DIA-002 doesnt have a WP# testpoint but since it's connected to VCC it is not needed.

NOR layout2 - VER-001[edit | edit source]

Used in the last revisions of the fatter model PS3 (CECHL, CECHM, CECHP, CECHQ). Single 16MB NOR.

NOR layout3 - DYN-001[edit | edit source]

Used in CECH-20xx. The Progskeet 1.0 / 1.1 and teensy pinouts match the teensy picture provided on this page even though it states it's the pinout for Progskeet 1.0 / 1.1. Single 16MB NOR.

NOR layout4 - SUR-001, JTP-001, JSD-001, KTE-001[edit | edit source]

SUR-001: Used in CECH-21xx. Some difference in components but the testpoints are the same for SUR-001, JTP-001, JSD-001, KTE-001

JTP-001: Used in CECH-25xx. Some difference in components but the testpoints are the same for SUR-001, JTP-001, JSD-001, KTE-001

JSD-001: This is the pinout originally supplied by Marcan for a CECH-2504A. Some difference in components but the testpoints are the same for SUR-001, JTP-001, JSD-001, KTE-001

KTE-001: Used in CECH-30xx. Some difference in components but the testpoints are the same for SUR-001, JTP-001, JSD-001, KTE-001

NOR layout5 - MSX-001, MPX-001, NPX-001, PPX-001 and PQX-001[edit | edit source]

MSX-001 and MPX-001: Used in CECH-40xx. Much difference in components positioning (main hearth of the board is 45 degrees rotated), but it still has testpoints.

Gallery[edit | edit source]

Pinout Gallery[edit | edit source]

NAND[edit | edit source]

  • Starship2 EBUS Testpoints (NAND board) do not use!

    Starship2 EBUS Testpoints (NAND board) do not use!

  • COK-001 EBUS Testpoints (NAND board - only overlay) do not use!

    COK-001 EBUS Testpoints (NAND board - only overlay) do not use!

  • COK-001 EBUS Testpoints (NAND board) do not use!

    COK-001 EBUS Testpoints (NAND board) do not use!

  • COK-001 boardtraces (NAND board) confirmed

    COK-001 boardtraces (NAND board) confirmed

  • COK-002 EBUS Testpoints (NAND board) do not use!

    COK-002 EBUS Testpoints (NAND board) do not use!

  • COK-002 - NANDs

    COK-002 - NANDs

  • COK-002 boardtraces (NAND board) needs Testing/Confirmation (incomplete: 3 points still missing)

    COK-002 boardtraces (NAND board) needs Testing/Confirmation (incomplete: 3 points still missing)

  • COK-002 boardtraces (NAND board) confirmed

    COK-002 boardtraces (NAND board) confirmed

  • SEM-001 boardtraces (NAND board)

    SEM-001 boardtraces (NAND board)

  • SEM-001 boardtraces (NAND board) confirmed

    SEM-001 boardtraces (NAND board) confirmed

  • Progskeet - Single NAND - 360clip

    Progskeet - Single NAND - 360clip

  • NAND TSOP48 360clip (note: no need to connect R/B2 on ps3's)

    NAND TSOP48 360clip (note: no need to connect R/B2 on ps3's)

  • Progskeet SL-NAND adaptorboard

    Progskeet SL-NAND adaptorboard

  • 1Gbit NANDclip - Front

    1Gbit NANDclip - Front

  • 1Gbit NANDclip - Back

    1Gbit NANDclip - Back

  • Universal NAND TSOP clip - Note: this will not fit on the COK-002 NAND next to the SATA connector

    Universal NAND TSOP clip - Note: this will not fit on the COK-002 NAND next to the SATA connector

  • Teensy++ 2.0 NANDway SignalBoosterEdition to Universal NAND TSOP clip

    Teensy++ 2.0 NANDway SignalBoosterEdition to Universal NAND TSOP clip

  • Teensy++ 2.0 NANDway SignalBoosterEdition

    Teensy++ 2.0 NANDway SignalBoosterEdition

  • COK-001 EBUS Tristate

    COK-001 EBUS Tristate

  • COK-002 EBUS Tristate

    COK-002 EBUS Tristate

  • SEM-001 EBUS Tristate

    SEM-001 EBUS Tristate

NOR[edit | edit source]

  • DIA-001 NOR Testpoints (NOR layout 1)

    DIA-001 NOR Testpoints (NOR layout 1)

  • DIA-002 NOR Testpoints (NOR layout 1)

    DIA-002 NOR Testpoints (NOR layout 1)

  • VER-001 NOR Testpoints (NOR layout 2)

    VER-001 NOR Testpoints (NOR layout 2)

  • VER-001 NOR Testpoints - trisaster.de, missing Tristate (NOR layout 2)

    VER-001 NOR Testpoints - trisaster.de, missing Tristate (NOR layout 2)

  • DYN-001 NOR Testpoints (NOR layout 3)

    DYN-001 NOR Testpoints (NOR layout 3)

  • DYN-001 NOR Testpoints + dualboot 'AB mod' (NOR layout 3)

    DYN-001 NOR Testpoints + dualboot 'AB mod' (NOR layout 3)

  • DYN-001 NOR Testpoints with progskeet labeling (NOR layout 3)

    DYN-001 NOR Testpoints with progskeet labeling (NOR layout 3)

  • JSD-001, JTP-001, KTE-001 NOR Testpoints with Progskeet labeling (NOR layout 4)

    JSD-001, JTP-001, KTE-001 NOR Testpoints with Progskeet labeling (NOR layout 4)

  • JSD-001, JTP-001, KTE-001 NOR Testpoints with Progskeet 1.2 labeling (NOR layout 4)

    JSD-001, JTP-001, KTE-001 NOR Testpoints with Progskeet 1.2 labeling (NOR layout 4)

  • JSD-001 NOR Testpoints (NOR layout 4)

    JSD-001 NOR Testpoints (NOR layout 4)

  • JSD-001 Testpoints - orig. marcan/noraliser (NOR layout 4)

    JSD-001 Testpoints - orig. marcan/noraliser (NOR layout 4)

  • JTP-001 NOR Testpoints - not mapped (NOR layout 4)

    JTP-001 NOR Testpoints - not mapped (NOR layout 4)

  • SUR-001 Nor Testpoints - not mapped (NOR layout 4)

    SUR-001 Nor Testpoints - not mapped (NOR layout 4)

  • Teensy++ 2.0 NOR testpoints layout 4.png

    Teensy++ 2.0 NOR testpoints (NOR layout 4)

  • NOR Flash general pinout + 50pin ZIF pinout (Progskeet)

    NOR Flash general pinout + 50pin ZIF pinout (Progskeet)

  • NOR TSOP56 ZIF 360clip and solderboard (Progskeet)

    NOR TSOP56 ZIF 360clip and solderboard (Progskeet)

  • MSX-001 NOR Testpoints - not mapped (NOR layout 5)

    MSX-001 NOR Testpoints - not mapped (NOR layout 5)

Other Gallery[edit | edit source]

  • 360Clip NAND rework

    360Clip NAND rework

  • 360Clip NAND SMD why rework

    360Clip NAND SMD why rework

  • 360Clip NOR can't be used for VER-001: no space

    360Clip NOR can't be used for VER-001: no space

  • 360Clip modification pin 48

    360Clip modification pin 48

  • CLIP comparison

    CLIP comparison

  • CLIP styles

    CLIP styles

  • COK-002 Nand1 SMD components Clip rework

    COK-002 Nand1 SMD components Clip rework

  • Cutting pin46 360clip-nor - TOPVIEW

    Cutting pin46 360clip-nor - TOPVIEW

  • Cutting pin48 and 46 360clip-nor

    Cutting pin48 and 46 360clip-nor

  • Ext PSU on PS3

    Ext PSU on PS3

  • Progskeet - NAND-Adaptor PCB (red)

    Progskeet - NAND-Adaptor PCB (red)

  • Progskeet - NAND-Adaptor PCB

    Progskeet - NAND-Adaptor PCB

  • Damaged NOR. The pins are bent to the shape of the opposing pins on the E3 clip.

    Damaged NOR. The pins are bent to the shape of the opposing pins on the E3 clip.

  • Above view of damaged NOR.

    Above view of damaged NOR.

Progskeet 1.0 / 1.1 NAND Picture Guide[edit | edit source]

Full guide is here: Progskeet 1.0 / 1.1

  • Before

    Before

  • After (R7/R8 + R9/R11 closed)

    After (R7/R8 + R9/R11 closed)

  • connect 50pin flatcable

    connect 50pin flatcable

  • connect Y-subboard

    connect Y-subboard

  • connect NAND flatcable to Y-subboard

    connect NAND flatcable to Y-subboard

  • connect clip to NAND flatcable

    connect clip to NAND flatcable

  • clip + NAND board

    clip + NAND board

  • NAND board

    NAND board

  • connect to PC

    connect to PC

Generic reference[edit | edit source]

Torx / Security Bits[edit | edit source]

Soldering Guide(s)[edit | edit source]

Soldering Irons/Stations[edit | edit source]

Stereo Microscopes[edit | edit source]

Things to look for:

  • Good solid mounting
  • More overhang to reach large boards
  • Ring macrolight
  • optional: T2 or otherwise adaptor for cameras
  • Stereo Microscope - example 1

    Stereo Microscope - example 1

  • Stereo Microscope - example 2

    Stereo Microscope - example 2

  • Stereo Microscope - example 3

    Stereo Microscope - example 3

  • Stereo Microscope - example 4

    Stereo Microscope - example 4

Tip: also available used


Soldering tips[edit | edit source]

  • Don't use >40W iron (we are not soldering copper pipes!)
  • Don't use leadfree solder (232'C @ SnSb)
  • Don't use silverbased solder
  • Don't use high tin alloy (e.g. 90/10: 300'C @ 97Sn 3Pb and 250'C @ 65Sn 35Pb)
  • Use 60/40 (374'F / 190'C) or 63/37 (364'F / 183'C) both have nice low melting point for PCBs


large list of solder alloys and meltingpoints: http://alasir.com/reference/solder_alloys/

Wire reference[edit | edit source]

TLDR  :  NOR: use AWG26 / NAND: use AWG28

For wiring, use 20-28 AWG. 18 can be too stiff while 30 is too fragile. 24-26 AWG works fine in most cases. The Grounds and VCC wires may ofcourse be thicker than the signal wires. Keep wires short, up to ~20cm max (longer gives errors). The shorter the better : 15cm and shorter mostly works fine with AWG26 on NOR.

For NOR wiring the solderarea (the NORpoints) is 10x larger than the solderarea used with NAND (pitch 0.5mm, just as NOR chips btw), so for NOR you have much more headroom (and also need!) to use thicker wires (for NAND you most likely want to use 28 AWG and cannot use much thicker)

Use caliper to measure unknown/unmarked wires and compare with table/listing.

Table: AWG (inch) / Euro (mm)[edit | edit source]

American
Wire
Gauge		 Diameter Cross
Sectional
Area		 Diameter Cross
Sectional
Area		 Notes
(AWG) d (inch) A (inch2) d (mm) A (mm2)
0000 (-3) 0,4600 0,1662 11,6839 107,2172
000 (-2) 0,4096 0,1318 10,4048 85,0279
00 (-1) 0,3648 0,1045 9,2658 67,4308
0 0,3249 0,0829 8,2515 53,4756
1 0,2893 0,0657 7,3482 42,4085
2 0,2576 0,0521 6,5438 33,6318
3 0,2294 0,0413 5,8275 26,6715
4 0,2043 0,0328 5,1895 21,1516
5 0,1819 0,0260 4,6214 16,7742
6 0,1620 0,0206 4,1155 13,3027
7 0,1443 0,0164 3,6650 10,5496
8 0,1285 0,0130 3,2638 8,3663
9 0,1144 0,0103 2,9065 6,6348
10 0,1019 0,0082 2,5883 5,2617
11 0,0907 0,0065 2,3050 4,1728
12 0,0808 0,0051 2,0527 3,3092
13 0,0720 0,0041 1,8279 2,6243
14 0,0641 0,0032 1,6278 2,0812
15 0,0571 0,0026 1,4496 1,6505
16 0,0508 0,0020 1,2910 1,3089
17 0,0453 0,0016 1,1496 1,0380
18 0,0403 0,0013 1,0238 0,8232
19 0,0359 0,0010 0,9117 0,6528
20 0,0320 0,0008 0,8119 0,5177
21 0,0285 0,0006 0,7230 0,4106
22 0,0253 0,0005 0,6439 0,3256
23 0,0226 0,0004 0,5734 0,2582
24 0,0201 0,0003 0,5106 0,2048
25 0,0179 0,0003 0,4547 0,1624
26 0,0159 0,0002 0,4049 0,1288 Best used for NOR consoles
27 0,0142 0,0002 0,3606 0,1021
28 0,0126 0,0001 0,3211 0,0810 Best used for NAND consoles
29 0.0113 0.286 0.064
30 0.0100 0.255 0.051
31 0.00893 0.227 0.040
32 0.00795 0.202 0.032
33 0.00708 0.180 0.025
34 0.00631 0.160 0.020
35 0.00562 0.143 0.016
36 0.00500 0.127 0.013
37 0.00445 0.113 0.010
38 0.00397 0.101 0.008
39 0.00353 0.0897 0.006
40 0.00314 0.0799 0.005

Alternative/cable comparison[edit | edit source]

   PATA/floppy 40-conductor cable - AWG28 (0.0126" / 0.321mm) with 0.0333" pitch +/- 0.002"
   PATA/floppy 40-conductor cable - AWG30 (0.0100" / 0.255mm) with 0.0333" pitch +/- 0.002"
  
   PATA 80-conductor cable - AWG30 (0.0100" / 0.255mm) with 0.025" pitch +/- 0.0016"
   PATA 80-conductor cable - AWG30 (0.0100" / 0.255mm) with 0.025" pitch +/- 0.002"
   PATA 80-conductor cable - AWG31 (0.00893" / 0.227mm) with 0.025" pitch +/- 0.002"
   PATA 80-conductor cable - AWG32 (0.00795" / 0.202mm) with 0.025" pitch +/- 0.002"
  
   Category 6 (ANSI/TIA-568-B.2-1) network cable: 4 twisted pairs of 22AWG (0.0253" / 0.644mm)
   Category 6 (ANSI/TIA-568-B.2-1) network cable: 4 twisted pairs of 23AWG (0.0226" / 0.573mm)
   Category 6 (ANSI/TIA-568-B.2-1) network cable: 4 twisted pairs of 24AWG (0.0201" / 0.511mm)
  
   Category 5/5e (TIA/EIA 568-5-A) network cable: 4 twisted pairs of 24AWG (0.0201" / 0.511mm)
  
   Category 5e patch (TIA/EIA 568-5-A) network cable: 4 twisted pairs of 26AWG (0.0159" / 0.405mm)
  
   SATA : solid 26 AWG - 0.0159" / 0.405mm
   SATA : solid 28 AWG - 0.0126" / 0.321mm
   SATA : solid 30 AWG - 0.0100" / 0.255mm

Resistor codes[edit | edit source]

Tapes[edit | edit source]

Used to isolate hardware parts that will be installed permanently internally (is the same tape used in pc laptops to isolate wifi/bt cards and ram modules). This tape resist up to 300º without deformation or burning, and is made of 100% non-conductive materials... the tape is cheap but be aware because there are lot of fakes, always reads the comments of other buyers or buy in a reputable shop

Generic unresolved issues[edit | edit source]

There is a table made on the talk page to chart dump/flashing issues (and sucesses). See: Testreport_table

Progskeet 1.0 / 1.1 QA/problem solving[edit | edit source]

Generic advice[edit | edit source]

Updating Progskeet 1.0 / 1.1 with Injectus[edit | edit source]

  1. connect injectus to Progskeet 1.0 / 1.1with very short wires (see File:Injectus_jtag_pinout.jpg File:Injectus-jtag-bottompads.png)
  2. power injectus with usb
  3. power Progskeet 1.0 / 1.1 with its own usb too (do NOT power the Progskeet 1.0 / 1.1 with the injectus!)
  4. run injectus programmer software
    1. click tools
    2. open infectus (at bottom of pulldown)
    3. load dat file
    4. click program

See also Programming the Bitstream

R7 / R8 explaination[edit | edit source]

R7 / R8 explaination in a sketch: File:Progskeet-R7-R8 explaination-sketch4.jpg

Be up to date[edit | edit source]

Always make sure you used the latest diagrams, drivers and flasher software from progskeet.com

Archive of old versions[edit | edit source]

Main folder: on psdevwiki/files

Diagrams[edit | edit source]
Driver[edit | edit source]
WinSkeet 111004 and older : use libusb0    Winskeet 111120 and newer: use WinUSB
zadig can be used as driver selector for both, make sure you select the right one.
Bitstream[edit | edit source]
Flasher[edit | edit source]

No shorts[edit | edit source]

Before doing anything, make 100% sure you wired up everything correct (no address/data IO lines mixed? all controllines hooked up? power/ground in order? etc.) and no shorts are made where there should not.

Error : libusb0.dll or libusb0.sys not found[edit | edit source]

The libusb-win32 Kernel Driver needed for the the flasher to get access to the USB port was not installed. Make sure you unpacked the drivers_xxxxxx file and installed the Progskeet driver (VendorID:1988 / ProductID:0001 in case you need it).

If problems with installing the driver, use manual mode from Device Manager and select the folder with ProgSkeet.inf ("ProgSkeet Install Disk") : http://windows.microsoft.com/en-US/windows-vista/Update-a-driver-for-hardware-that-isnt-working-properly

Error : side-by-side configuration is incorrect[edit | edit source]

In case of "the application has failed to start because its side-by-side configuration is incorrect" make sure Microsoft Visual C 9.0 runtime is installed and "Windows Installer" is not disabled (set to manual or automatic) in Services.msc

Error : incorrect parameter[edit | edit source]

Make sure you selected the correct values for your NOR/NAND device. If there is a preset, use it

  • on Common tab: select the flash you have @ Presets

If not, e.g. :

  • NOR
    • Spansion S29GL128N90TFIR2 : 128KB sector, 128 sectors
    • Spansion S29GL128P90TFIR2 : 128KB sector, 128 sectors
    • Samsung K8Q2815UQB-PI4B : 4KB sector, 4096 sectors
    • Samsung K8P2716UZC-QI4D : 128KB sector, 128 sectors
    • Macronix MX29GL128ELT2I-90G : 128KB sector, 128 sectors
  • NAND: select Big Block, select Raw, Pages per block: 64, blocks: 1024

The application failed to initalize properly (0xc0000135)[edit | edit source]

You are missing either of these:

Error/crash on Windows 7 (and halting on 0x0)[edit | edit source]

  • Disable Aero (known to crash on Win7 Ultimate)
    • set display color to 256 colors will enforce Aero to disable too
  • Make sure you have enough (admin) rights
  • Consider disabling UAC (or re-educate it proper)
  • Try "Compatibility Mode" (e.g. Windows 2000 or Windows XP SP2)

Conclusion: 32bit mostly seem to work fine. 64-bit seems tricky/hairy to get working sometimes. Try on good ol' Windows XP 32bit or Linux/OSX to rule out 64bit/chipset responsible for problems.

Timing switching trick[edit | edit source]

Finally, after many struggles, the way to flash any NOR chip is discovered. Now, here's the method:

  • First of all note that when R7 is short - Progskeet 1.0 / 1.1 takes supply from console itself, and when R8 is short - it is powered from USB. So then, whatever you'll do - make sure both R7 and R8 never shorted while console is powered on - this results in damaging mobo as well as console itself.

Preparations are the following: Progskeet 1.0 / 1.1 soldered up correctly, no shorts or testpoints missing; Both R7 and R8 opened. (From now on, just forget about R8) Open Winskeet (Yaskeet, whatever else you got there), set up NOR type and switch to NOR menu. Connect Progskeet 1.0 / 1.1 to PC, power up console. Wait at least 10 seconds then short R7 - Progskeet 1.0 / 1.1 gets recognized by PC. Set up the following options - Single word programming, Static Timing. Now you're ready. Dump NOR several times, check it closely just to be sure it's correct. Prepare patched one then go ahead and write it back to NOR. Though it takes a little longer with mentioned settings, you'll be able to flash it almost correctly. At this point, look out for verification errors - there will be some with almost every NOR I've deal with. The key is that before flashing Progskeet 1.0 / 1.1 reads the NOR and flash only those blocks that differs from desired file. Now, here's the trick itself - after flash process performed with several verification errors, flash back the same file again and again (up to 16 times in a row in several cases), untill number of errors reduces to minimum (three or four). At this point, writing the flash under these settings won't make any changes - this last "hard blocks" will always fail for verification, so just switch to USB Transfer Timing and flash it again. It will take your time around 2 minutes to flash every single block, but since their number were heavily reduced with previous actions, it won't take long in the end. Notice that no verification errors are occured. Now you're done, congratulations)

A/B Trick[edit | edit source]

The A/B trick is a solution found by DiGiTaLAnGeL to write his Macronix NOR (but can be tried on other NORs as well 1).
Some Sectors of his flash were "slow to write" and using the normal flashing procedure was resulting in a fail or in a freeze of the Progskeet 1.0 / 1.1 Flasher.

Needed tools:

Step by step guide:

  • Shut Down your PS3 if not and be sure that the Progskeet 1.0 / 1.1 USB Cable is not plugged in.
  • Put your R7 Switch in OFF Position.
  • Power on your PS3.
  • Wait 20 seconds.
  • Put your R7 Switch in ON Position (now Proskeet is recognized by Windows).
  • Open Flasher "A" and flash your file (remember to set up the NOR size/sectors!)
  • When it reaches 100% , check C:\Proskeet.log, if you found some sectors failed to write... continue to the next step.
  • Without powering off your PS3, unplug Progskeet 1.0 / 1.1 USB Cable and Close Flasher "A"
  • Open Flasher "B" and replug your USB Cable.
  • Flash your file (remember to set up the NOR size/sectors!)
  • The Flasher will freeze on those "slow" sectors, just wait!
  • If after 1 minute your flasher is still stuck on that sector close the flasher.
  • Check again your log for sectors failed to write.

If you still have sectors that have failed to write, start again until they successfully write (Rember to check the Progskeet.log because reaching 100% doesn't mean that the sectors have successfully been written)

note: 1)
<DiGiAnGeL> if you successfully write at least one of the sectors you are having problem with, this trick work for you!
<DiGiAnGeL> (some sectors require even 5 minutes of trying before successfully writing them)

Irregular device disappering when reading/writing[edit | edit source]

<MrGBNC> I've had good dumps but sometimes when I click read Progskeet 1.0 / 1.1 disappears from the Device Manager
<eussNL> hmm, sounds like voltage drop or usb connection fail
<MrGBNC> and last week was Progskeet 1.0 / 1.1 no longer recognized by windows
<MrGBNC> unknown device
<Abkarino> you may have gnd problem
<eussNL> did you try manual removing the driver in safemode?
<Abkarino> try to remove r4 then try again
<Abkarino> i had the same problem before
<Abkarino> but uf6667 and ago told me to remove r4 and try again
<Abkarino> now Progskeet 1.0 / 1.1 work fine every time i plug it to my PC
<MrGBNC> I've also talked to Ago, he said that the resistance between GND and VCC is too small for my Progskeet 1.0 / 1.1
<Ago> well, you had voltage drops
<Ago> and a cap might be bad
<MrGBNC> that is why I try to exchange/warranty. I also couldn´t read a socket´ed NAND, only 30 in dump ;)


Prerequisition
Hardware flashing
Pin/pad layouts
Downgrading
Old reference
Retrieved from "http://www.psdevwiki.com/ps3/index.php?title=Hardware_flashing&oldid=72674"