What's new

Solved [SOLVED] RGH1.2 - Falcon does boot Xell but not to Dash(e79) (did once though)

TimelessNL

TimelessNL

Enthusiast
Messages
35
Reaction score
1
Points
55
Sin$
7
Hi People,

Question:
Could it be that a corrupt NAND causes e79? but still boots Xell just fine?
Answer:
Yes, after flashing a donor NAND image and unplugging it for 20sec to reset the SMC ram. This Xbox360 came back to life :smile:.
(See post #8 for detailed information)

Full story:
I recently acquired a Falcon motherboard that suffered severe damage by the previous owner, seems like he(or she) attempted all known hardmod methods that ever existed the Xbox360 galaxy. I can see soldering attempts pointing to JTaG and RGH1 and also see some sticky residue on the AV port suggesting that some modchip was present at a given time, it even had some (broken)remains of the Nand-X J2B1 near the H-ANA chip.

Ok, so what is the problem you asked? Glad you asked :smile:, Originally the Xbox gave me a 0022 error (immediately after boot). I successfully re-routed some of the traces (namely PLL_CPU_BYPASS) and some resistors the previous owner burned to death. After which I tried to boot the thing with whatever was left on the NAND by the previous owner. This gave me 0022 again but this time took like 30 sec's and also continuously ramped-up the fans, which by my experience could either mean a reflow(reball) was needed (not worth the effort) or the NAND is corrupt.

After I dumped the NAND it seams clear that it was indeed corrupt:
Code:
Initializing nanddump1.bin..
Comparing...
Header is wrong..
Full updflash creation log: link

Since this was the first time I had to deal with a corrupt NAND, I continued as usual and flashed Xell and installed an ACE360v3 based on RGH1.2. I chose RGH1.2 because I had no idea which dash it had. After turning it on to my surprise it booted straight into Xell (took 4 glitches with the [Click here to view this link] on a cold boot and 1 glitch on warm boot). But my luck did not end there, I wrote the CPU key and created my self a FreeBoot(updflash.bin) image which I flashed with a USB stick in Xell (much faster than J-Runner). The hacked dash also booted just fine presenting me with a "overheat" message which was most likely caused by the previous owner. But since I did not expect it to boot at all I did not have the FAN's installed yet, so I powered the thing off, installed the FAN's and booted it a 2nd time. This time I browsed the menu's a but to see if it was stable which it was :smile:. Unfortunately my luck ends there, I once again turned it down took some pictures of my victory install, removed NAND programming wires and put it all back into its plastic case (without HDD).

Troubles:
once it was fully assembled I turned it on but to my alarm it gave me 1 RRoD with secondary error code (1033) e79 (no display output). But strangely it still boots to Xell every time. Also I see it doing its cold boot 4 glitches (warm boot 1 glitch) then 5 sec's later bam.. e79. So it's not immediately e79 but only after the glitch is successful.

Things I tried:
-Run it without FANs for a while which should most likely temporally solve a broken solder joint but to no avail. Even if it booted after applying the "GPU overheat fix" I would plan to trow it away anyway because of previously given reasons.
-Rebuild dummy NAND based on this tutorial but still no luck, boots Xell but not to Dash. Calculated LDV to be 17 based on fuses.
-Looked around for solder bridges but couldn't find any.
-Flashed NAND though Xell multiple times.

Question:
I also noticed CF and CG from the NAND dump showed 4532, do these numbers represent the dashboard version it came with or it's current version? Because the previous owner attempted a JTaG mod. Maybe that's why the RGH1.2 does not work. Also during the ECC xell boot it had trouble decrypting the KV but after flashing FreeBoot it had no issue and gave my a DVD key, Don't know if the key is valid or not. Since I have not checked the DVD drive yet.

Here are some pictures of the e-fuses and J-Runner stats:
y4mm8L-tIz1FjbSWMU5p6NCHbYjlIDvZczVwK4TqQmv4mpuf2RG-ct-LHUEXKmIhlhkPzfWEQmtXNxvplEv5la5aG6Y3RY1RsrRoFiwFTxiWtpOGGZeQwR_YBXk-ElZMUpbOzw_h0ZlNCiDy425Ar-d8mECB9yUjWbPKtQzY687hTHsrbgTx7vq6sPXgLxmdBD4YanWfGCl5KKTW_NYyEfTng

Initial ECC write:
y4ma5_k1zGymAJ3IaM--tTOKnfCQ3B_zWFePtY9Z_wCVg7o4RP_a2KGu7L2sYFu48np3ukM06aAcnmNm_vwmERvrOl-1-WNKnMhA2j80AMckU_EN4W21u22XnAG0nZh--yLBE2cClRf7D_8H-qFNM4c6MV4GfBMoACTYnoBAnle0_kNg0UYbk195RFGDC0CXfz-ODIt6lxZOjX9_J5C2I6KbA

After writing FreeBoot (updflash.bin) through Xell:
y4mFf3x_WFemkvky1HrvAGShahzS1m9esXWXt3Gx349bJ6mjAjI8up7BMhaMF8jMlfTGK7QOMrxxucOtkn3k974FCfFmQyKLRgJR9Dze5afHsbvZvmWCrDSp8CiFfK1x0LAylhmGBeObh5IlBlM4_YibjUe3RZDgqO_v8rq2UPNrneaCwgGBiWtbJ-6mAEuaB_8BXv1Kan1eGrCUyYhxS3iOw


Initial state of the PCB below the CPU (before me doing anything):
y4mAdXWnAHveFvKDHFN6lvwzAEqIQXt5Dt3pENVyJPatZw6xmjQxQefUc4ENpDM7OThyebeyInKDl795pLtbmkQN--sNE0s7RuRLhdabkxnFDH-yCKeB1f7gwr1ve9Nmmb_SNzGEsuazRaRA2xtwRgkfBcujCsN8TD_8Pe6nMitBR67GoCL4Qfdu424wlM5Bt9f5c7hDlk5o2FQXaYaCMb6nw

PLL_CPU_BYPASS fix
y4mGXjK3JDhL1wq4qg_waDsjBoC1s1OwQJxiR9Ms1jSLcIqog3uoffbBbP-FoVzsAtrAJ1ECEw_C0q9DkEz5WtvlVgIy_V39z0rkb9W5KWbhoWFzXj66P9v8k5D8K0AP8Dp_P-RmnCcJb1LTUnX0zAA0AwovDdi7ltSfpK6qD_XnVorA0_HhgUIhgCtaftMVOwIX6AZalaLiSu0fmvM5L9ffQ

y4mlIJNAnbwlzaZmfH0krWf32IjIfDnuUReK9JYBT9by66sUK2aEPacnim6anHPqPX6els7f-FU4ZfQZpmt3JSywruKAhRFkcUEPZ6eoxwUqaAWgJZTzIsw0-NgRjMPVJNaWZDjLy10sIGcRriBpUZuhe13nbdBq4vE-ZK_bgpiflcPtR0mDFVC6urTZzgVHZRzNcLdJhsGT9V5mGTHHlIyIA

y4mVFTQty7OsDXvW4rCuzuF2u9sR-i0Y95fMfCkadBan2Yo_3ie8mgWcWYwrGKAJdAfBHA9yCfYQhu4zdFrTh2EKF4oBaCLeU9bJfUOhZun1qJeX8BNqa47Ub4wuuxMiG99vRA2DTmXv6imentwPIjUK5qDhXncTrklMpGE-3SRll3shFvvksV-m_YbtKz1Kt3S3tFGMmqtaMZwilBJMjyh9w

RGH v1.2 wiring:
y4mTeghTvDRUJijVef4YR7GEjs9AzWkekwy-FfrqtRJ3IkY90vLMbDARgWTZzwsVBA8tAq3TbAy72JTCA06URCdpvfhJSmP6UCs7UPg4khAmOyr54jazxwE94YaqkRKrR9pRGzkm_GGBUpEq0MZ4ccidaiGZXCUhvMkBE7h1kIz4D1i9z9Yrmp8vTwow3-uqRC0FuO4VCP7sMTb-N6v0B6Ssg

y4mbJOqRZKlN6mJEM60BEgvi2lFUb92bn4rfUrHnUnrDPXfb8UmOpSjpegPrk1HKAtlYG5VyULVSowukL_nCfPagBtHYvkRefS_ZW6hXS2PITpeSi6KDIu-aZUeylIcGTr2NZCu1pdtDwf9DoEQaWhVRKMyAsk9VoDV2X36FPtWBLaHZQIrespIB6bniAQIZx_JsI5fGvYSGbUvBssyARkAWg

y4mzs5pyl1EfuKaEQ-_jPs93YCtE4GOLNYAR25idQe6OaDci6zeN1A7bDpqgIFsRjuPIIFyfuT6-EmM4NIBCJqITPXGNbQwfLudSuB1QYtNt04ojLJCGxRjLYhJc2kFrOgfQYsD0DBvI586C_ePn5XXKaweZQL4w2iuaDnfKao1YVbLEv_h-Rig_qeDlfLYxNiv71U9_eCIsqpsAQL_q4skYQ

y4mUkvWC4aB1w1U_yoI74AgA6Xu4DRKewCDE6Cc10fnTWeMtN2gFJleBj-aMRIbprWmr1rCoJ_cS5MNpWXTkDFQteWxBFdH4NF_S5SVrWdcS739oUqToIx20r3P6achmuvwni7v0W8KiYitAto5vcLjufDSyYslIegW6duCMWq40ilyj1-VR_MZyWmDKozpxy10r_1idwjWbCvIFyGgDWV_wQ

y4mbe9q6-jx9TNx1myeLzx0nu0NLz93rmLQ-3qhLtIeVtAF39CVPmc67agIWeb3FutEsEQ0n48eAv8KRg8cIDFF3rjDkm2jytlw9iCwd_AVn_MfgJtDTBgU1GMHZ-BsJqc6KWuSCAelJIdN7jiq7pMqVTu7jt2aaTLKWvmLAHIv9mUswtmtRD9QvusCnvtKrKvM-fzXDF23oYmEY7PNfcGOgA
 
Last edited:
S

schitzotm

Member
Messages
2,582
Solutions
6
Reaction score
2,429
Points
420
Sin$
7
So did the last owner use a torch to make the solder connections?
I see resistors with newer solder holding them in like they became unseated or something and someone tried to repair.
Personally I would toss this in the trash. But thats just me boards with what looks like fire damage in my opinion arent worth fixing.
So what you are saying is it functioned out of the case but once in it fails with an error.

But this is not your issue.
The rgh likely will not work for you. The console you have has an early dash which is why it is giving you the failed update error. Likely that console should be running a jtag. And you rewrote the nand with a much later dash. This is why we boot first to see what dash we have. If the console will not boot then we have to guess the dash. Given the old solder point line up to a jtag exploit I would have started there first. Since the previous owner removed it and sold it there is a good chance that console is junk.
 
TimelessNL

TimelessNL

Enthusiast
Messages
35
Reaction score
1
Points
55
Sin$
7
So did the last owner use a torch to make the solder connections?
Probably :biggrin:, I don't even know what the brown/red residue is, First I hoped that is some kind of dried-up flux. but it is more like epoxy but very brittle when you touch it with a soldering iron. That's how I removed some of it in order to solder the appropriate points.
I see resistors with newer solder holding them in like they became unseated or something and someone tried to repair.
I re-soldered those resistors, they did not seem to be firmly attached so I applied some fresh solder to them. Was not able to use my BGA station because of the epoxy like substance, they are stuck in that residue and will not move by surface tension.
Personally I would toss this in the trash. But thats just me boards with what looks like fire damage in my opinion arent worth fixing.
Yeah understandable, I normally would as well. But since I got if for free and recently noticed that the PLL is fixable I figured I could give it a try "from a hobby perspective".
So what you are saying is it functioned out of the case but once in it fails with an error.
This is working:
- Initial ECC xell boot to get CPU key.
- First FreeBoot dash 17511 boot that showed the over temperature warning.
- Second FreeBoot dash 17511 boot where I was able to browse the menu's.
- Every Xell boot ever since.
This is not working:
- FreeBoot Dash 17511 boot after the initial 2.
But this is not your issue.
The rgh likely will not work for you. The console you have has an early dash which is why it is giving you the failed update error.
That's probably what CF and CG supposedly mean right? But there are many e-fuses set to F, which are blown I suppose, shouldn't that mean that there were atleast
But where do you get "failed update" from? Somewhere in the j-runner logs?
It's showing "header incorrect" but that's probably because my supposedly vanilla NAND dump is actually the "ECC + some vanilla remaining contents".
Very odd that I was able to boot 17511 2 times though.

Why does the RGH not working on a lower dash by the way? Is it something the update itself does?
Likely that console should be running a jtag. And you rewrote the nand with a much later dash.
True, but to my knowledge this will not make the JTaG hack impossible, right?
Since flashing the NAND with 17511 will not cause any e-fuses to be blown?
So the JTaG mod should still be possible I guess.

One note, I noticed that there are 17 blown e-fuses in fuseset 07-11, which would imply that this console has been updated atleast 17 times. If this is true, then there would be a slim chance that this Xbox runs a jtag-able dashboard.

How do I make sure based on the (partly corrupt) nand dump that this console is jtag-able? Since I can write a jtag updflash.bin to it using Xell but if it does not boot afterwards I have to resolder the NAND wires again which I would like to avoid.
This is why we boot first to see what dash we have. If the console will not boot then we have to guess the dash.
That is indeed what I normally do, but since the NAND was not stock(vanilla) anymore. I had no way of normally booting this Xbox 360.
Given the old solder point line up to a jtag exploit I would have started there first. Since the previous owner removed it and sold it there is a good chance that console is junk.
Nah, I got it for free. But can't reach the person anymore, so I have no history trail. I still think the Xbox was working before the modding attempt though. The mod job itself was very bad and since some tracks where destroyed in the process it couldn't have booted vanilla anyway and the person was unable to restore the broken pieces to original so the attempt was dropped.
 
Last edited:
S

schitzotm

Member
Messages
2,582
Solutions
6
Reaction score
2,429
Points
420
Sin$
7
The update is the dash. Incorrect dash to what it is expecting. Throws the error.
Anyway to tell if you are able to jtag check here https://www.se7ensins.com/forums/threads/how-to-check-if-your-console-is-jtag-able.271521/

If you are booting then there is a good chance it will boot again.
Can you flash a stock nand back to it? Maybe see if it will boot normally? You are fighting an uphill battle with a console that wont boot and attempting to mod it and boot.
 
TimelessNL

TimelessNL

Enthusiast
Messages
35
Reaction score
1
Points
55
Sin$
7
The update is the dash. Incorrect dash to what it is expecting. Throws the error.
Anyway to tell if you are able to jtag check here https://www.se7ensins.com/forums/threads/how-to-check-if-your-console-is-jtag-able.271521/
Yeah but how am I supposed to know what dash this Xbox is on, if it did not come with an original nand image. The information on the NAND was already altered.
If you are booting then there is a good chance it will boot again.
Can you flash a stock nand back to it?
Maybe see if it will boot normally?
Not that I want to be rude, but did you read my entire story? I know it's quite allot haha :smile:. But like I said, I don't have the original dump. The image I dumped from the NAND seems already been tempered with by the previous owner.
You are fighting an uphill battle with a console that wont boot and attempting to mod it and boot.
I know but that's part of the fun. I got it to boot Xell which is quite an achievement given the state this board was in when I started working on it. And I seem close to victory here, I only need to fix the NAND image somehow.

Since I wanted to know if this system was stable (or not) I tried to run Free60 (Ubuntu 10.10) from a USB stick. Xell supports booting vmlinux from a fat32 USB stick. It runs very stable, I used it for 20min while browsing the web. I even visited this topic :smile:

Here are some pictures:

Ring of Light (when Free60 boots)
y4mha7ww-1i9HoHg3uRXUU5H0ST-WkA8nijwJa1RCdBFwi-_W_C1s-gArGbRb_iUVe2AvCa6I8tcphPPCdvCMHMquV0nrOvBQ0lBICO6eMKUvf-I_dVAI4XqYi1nKiVq4Kv6OLkyICacLdKq4VDH0Tv_AJo7uWZimfnx-ewWIJBD9eAJXbWhnN30f4G93LHCXilNhuuVf4np4Vl-JoLHHkxkw

y4mhjB9Vcvk09G-48k_jNjUAFC4s-aS18f9r4WA43Zftk7hLNnR6FehG2lj-pPEvpcKmX8yek7yjF_sA2W0XbCTjpLVYPlINRhN7E5WiEv3D9QUUj2snQTWdpJP2SDP4AAKCFYhRtFvvbWOKpOy4qo0n3q8Qy1QjSHsoaEFdOH0CmdzGm4F0ZJ4pxMhSV9J1GVD6ZQW2pYrgbnoRd-WcFK9Tw

y4mSMZ0KsaEQtrleu6TJ8HrPaTGhY6QXizTPel0ANoNeKhMLWFXMQLvFbjV8sbnhK6HBW5DFm_R54FbrXyZLqtq79pYrd7oX11tN3Ktu9Uuef_fEW_4MR-leaDmG6gynd30jKXPvvdYYyXmUYYv7Ts50mSeijl9ksT8lwktCNasgt-1DoCz1OS18HVQGEIOm1RqKRMqF6Z1CLz0kPxOqCMH8g
 
S

schitzotm

Member
Messages
2,582
Solutions
6
Reaction score
2,429
Points
420
Sin$
7
TimelessNL

TimelessNL

Enthusiast
Messages
35
Reaction score
1
Points
55
Sin$
7
Did you use the old nand image to make the new image? If not did you save the old image?
Yes, I dumped the nand before I started doing anything to this console.

I'm starting to believe that the data in the NAND does not even belong to this console :S, the CB of the NAND gives 5770 but the contents of "fuseset 02" calculates to "12" which should mean a minimal CB of 5772 according to J-Runner.

Also the serial number found in the NAND does not match the serial number on the metal shell, but the case may as well be switched. I don't see any sticker on the motherboard itself representing the serial number. So I have no idea if this NAND matches this console at all :/
No I used "falcon opus.rar" found in this tutorial. But the result should be the same.
I used to love the challenge of getting one working that was non functional but anymore I just want it to work.
Guess that is what happens when life gets in the way of fun.
I understand, but I'm still in that "challenge period" haha, And since I came this far it would be a shame to stop now.

EDIT:
Yesterday when I tried to boot this box into its DASH a couple of times(which failed with e79) it suddenly started to run the fans at max speed after power-on (every time).
I found this article that both mentions the "fan full speed" and "e79" errors which seem to be caused by a incorrect SMC.
If I reflash updflash.bin the fan's return back to normal but still "e79" is present. Since I also doubt that the current NAND contents belong to this console, is it possible to a corrupt SMC causes a e79?
 
Last edited:
TimelessNL

TimelessNL

Enthusiast
Messages
35
Reaction score
1
Points
55
Sin$
7
UPDATE:
Got some good news :smile:, the Xbox360 is working again!
I re-flashed it with an donor NAND image which brought it back to life.

Procedure:
  1. Create RETAIL donor image (including KV, SMC and CPU key from donor board)
  2. Flash RETAIL image to NAND.
  3. Create ECC out of this RETAIL image. (use random LV)
  4. Flash ECC to the console.
  5. Unplug power for at-least 20sec.
  6. Boot Xell, to see if that still works.
  7. Create new RETAIL image (including KV, SMC from donor board) but this time with the CPU key from my repaired console.
  8. Create XeBuild image, use LV calculated form e-fuses. 17 in my case.
  9. Flash XeBuild (Freeboot) to console.
  10. Unplug power for at-least 20sec.
  11. Be amazed that this console boots into dash.
(steps 1 to 6 where probable not needed in my case, but did them anyway for completeness)

After this I have no exact reason why it seems to have worked this time.
It may be any of these reasons:
  • Flashing a RETAIL image to start clean.
  • Remove power after flash to reset SMC, which forces re-download from NAND.
  • Remove old J-Runner install and started fresh.
  • Booting Xell with RETAIL image but with ECC.
  • Actually doing steps that I may have missed during previous donor NAND attempt :tongue:
I personally think resetting the SMC may be the most viable reason. I didn't do this when I tried a donor NAND last time, so if the SMC config in RAM was indeed corrupt the console would have never booted even if the NAND had valid data.
This may also be why it successfully booted to the dash 2 times, I did not unplug the power either so if the SMC config was correct in RAM it may have been corrupted when I unplugged the console to put it back together.

So either way, it is fixed now and I hope this information may help other people.

Some pictures:
(see serial number being from a donor NAND seen here)
y4mq4DVz2UDPRz5_Wgv0nPnyfg2uiViBF3D0CEazk_9qyVB5xyFq9PikMlGp3r-4iGHmLOQhsksFI-3qWIhRDkCtFY-gMK7OfEqIpG5Ebiy38b-nfSzf_NcANOlZ8AOlksKxVm8R6a7DY48JXFzzPCfox2c0xg5p26D5Jxe8eLvLHM_PBiaL8HqLBc9oqI1gEYVVIv0L8N8lWZmy6RMFKpAvw

y4mpZ8MLwFU3yGS77coTJXrCUoauMhthL08BzdAa3WhayE1VQ7nZlNEb5rcEW_aVU9PrgzSGy0wJsy_ezOA47Ks0ZOVznP77igJovObBSg4iclvJx1T7OSEbg700Q_0PXmKb7YGqERS2W2zwSCHUhBW7NG8ojuPf9CldUmz33zd22ckom4Qls-swTjDzOCv_3kJhEY2e-UsyORIj1nKqkMkmA

y4m5K5O6fHUGRL0m7QsVtone9Joh81tkQ4CWQ6lMFq1hNah1MABTpj0RcPHIZVgeIdRgZRJcH0yIlXN2RXitw9oRMeiblM3x-2ogqE-vloy2jrImlZoD-HvDNxFwhsJgjcVqF6tggk4GbibXUMVxNUxfPyitU-MQ5kr9XZJFaxBGmzkR1lJe-MD4VpHzuzEumaGyBWbntrLxWYx_aDF8zEsNg
 
Last edited:
Nate501777

Nate501777

Newbie
Messages
6
Reaction score
0
Points
10
Sin$
0
Hi, hope this works for me, been up all night trying everything, I'm curious if the dashboard has to match the original Nand and also if the CB version needs to be anything specific? Thanks in advance!
 
Top Bottom
Login
Register