Hardware flashing: Difference between revisions
(Created page with "Marcan has made a NOR flasher / address sniffer for his PS3 slim by re-purposing a FPGA board made for Wii hacking. noralizer is a git repo that contains the HDL (verilog) and as...") |
No edit summary |
||
| Line 1: | Line 1: | ||
Both early launch consoles which feature NAND flash memory and later consoles which feature NOR flash memory are able to be flashed. Currently the preferred method of flashing the dual-NAND consoles is by using an infectus modchip or similar. | |||
Marcan has made a NOR flasher / address sniffer for his PS3 slim by re-purposing a FPGA board made for Wii hacking. noralizer is a git repo that contains the HDL (verilog) and associated host computer tools for flashing/sniffing. There are ~50 signals to solder. Some PS3s contain two NAND flashes (block devices, unlike NOR flash) that interleave their data. [citation needed] | Marcan has made a NOR flasher / address sniffer for his PS3 slim by re-purposing a FPGA board made for Wii hacking. noralizer is a git repo that contains the HDL (verilog) and associated host computer tools for flashing/sniffing. There are ~50 signals to solder. Some PS3s contain two NAND flashes (block devices, unlike NOR flash) that interleave their data. [citation needed] | ||
Work is currently underway to brink a low cost AVR based NOR flasher that is capable of reading and writing on all consoles by defyboy. | |||
== COK-001, COK-002, SEM-001 == | |||
[[File:SS2_NOR.JPG|thumbnail|SS2 NOR Testpoints]] | |||
These are the earliest revisions of the PS3 motherboard (CECHA, CECHB, CECHC, CECHE, CECHG) and contain 2 x Samsung K9F1G08U0A-PIB0 128MB NAND Chips for a total of 256MB. These chips are interleaved which is controlled by a proprietary controller chip codenamed "Starship 2" or SS2. This chip handles the interleaving and presents the NANDS to the southbridge as a single large coherent NOR Chip. | |||
Probably to aid in factory programming, Sony provides NOR testpoints on the bottomside of the motherboard. There are 16 data lines (Word access) but only 18 address lines, Which would not be sufficient to address all 256MB of memory with word access. One would assume that some kind of paging or bank switching is involved here. | |||
== DIA-001, DIA-002 == | |||
[[File:DIA-001_NOR.JPG|thumbnail|DIA-001 NOR Testpoints]] | |||
These boards were the first to get the NOR flash memory from the middle revisions of the PS3 (CECHH, CECHJ, CECHK). Only a single Spansion S29GL128N90TFIR2 16MB NOR flash chip is used and the Starship 2 chip has been completely removed. | |||
Again, Sony has provided NOR testpoints on the bottomside of the motherboard. There are 16 data lines (Word Access), 23 Address lines, And several control signals provided direct from the NOR flash itself. In addition to these are testpoints to provide +3.3v, GND and "Tristate" (To disable the southbridge) | |||
== VER-001 == | |||
[[File:VER-001_NOR.JPG|thumbnail|VER-001 NOR Testpoints]] | |||
Used in the last revisions of the fatter model PS3 (CECHL, CECHM, CECHP, CECHQ), again with the single Spansion S29GL128N90TFIR2 16MB NOR flash with the exception of the CECHL which used a Samsung K8Q2815UQB-P14B 16MB NOR flash. | |||
Of course, A NOR interface was provided on the bottomside of the board, in yet another different layout. | |||
Revision as of 11:35, 12 March 2011
Both early launch consoles which feature NAND flash memory and later consoles which feature NOR flash memory are able to be flashed. Currently the preferred method of flashing the dual-NAND consoles is by using an infectus modchip or similar.
Marcan has made a NOR flasher / address sniffer for his PS3 slim by re-purposing a FPGA board made for Wii hacking. noralizer is a git repo that contains the HDL (verilog) and associated host computer tools for flashing/sniffing. There are ~50 signals to solder. Some PS3s contain two NAND flashes (block devices, unlike NOR flash) that interleave their data. [citation needed]
Work is currently underway to brink a low cost AVR based NOR flasher that is capable of reading and writing on all consoles by defyboy.
COK-001, COK-002, SEM-001
These are the earliest revisions of the PS3 motherboard (CECHA, CECHB, CECHC, CECHE, CECHG) and contain 2 x Samsung K9F1G08U0A-PIB0 128MB NAND Chips for a total of 256MB. These chips are interleaved which is controlled by a proprietary controller chip codenamed "Starship 2" or SS2. This chip handles the interleaving and presents the NANDS to the southbridge as a single large coherent NOR Chip.
Probably to aid in factory programming, Sony provides NOR testpoints on the bottomside of the motherboard. There are 16 data lines (Word access) but only 18 address lines, Which would not be sufficient to address all 256MB of memory with word access. One would assume that some kind of paging or bank switching is involved here.
DIA-001, DIA-002
These boards were the first to get the NOR flash memory from the middle revisions of the PS3 (CECHH, CECHJ, CECHK). Only a single Spansion S29GL128N90TFIR2 16MB NOR flash chip is used and the Starship 2 chip has been completely removed.
Again, Sony has provided NOR testpoints on the bottomside of the motherboard. There are 16 data lines (Word Access), 23 Address lines, And several control signals provided direct from the NOR flash itself. In addition to these are testpoints to provide +3.3v, GND and "Tristate" (To disable the southbridge)
VER-001
Used in the last revisions of the fatter model PS3 (CECHL, CECHM, CECHP, CECHQ), again with the single Spansion S29GL128N90TFIR2 16MB NOR flash with the exception of the CECHL which used a Samsung K8Q2815UQB-P14B 16MB NOR flash.
Of course, A NOR interface was provided on the bottomside of the board, in yet another different layout.