What's new

Solved Warning: can't patch this Trinity type SMC, is this Bad SMC Flash/Corrupt NAND?

R

rynax

Enthusiast
Messages
178
Reaction score
12
Hi,

Got a not working Trinity , it has problems, am trying to study it see if I could repair it.

The console has been attempted to do RGH2 long time ago by the previous owner but gave up half way.
A quick test shows the R3B15 resistor has blown out so there's no boot at all.
Looks like the RGH2 points has not been touched yet (POST, CPU_RST FT4R2,CLK FT3N2 or R3B15 point, yes R3B15 has blown out but there's no soldering mark at all ).

Repaired the R3B15 resistor with a 48 ohm one (I've no 33 ohm on hand), here's the R3B15 repair:


Now the console can boot up, but no video output at all.
The PSU turns green, fans running fine, however no video output at all from either HDMI or AV port, wired controller doesn't get power on, no activity from net port.
Console sync button has reaction but can not sync with wireless controller.
Open/Close disc tray works.
Wired controller could power the console on but no sync.

I suspect the nand has corrupted?

Dumped the current nand and here's the info:

9188/9188/9452 this looks like a glitch nand not a retail nand at all?
I remember the Trinity retail nand should have 9231/9231/9231.

So will the problem be the owner has flashed a wrong glitch nand to the chip which caused no video out, no proper boot?
The owner would not have obtained the cpu key yet because there's no soldering mark for RGH2 points, so the glitch nand on the chip is invalid.

If I create the ecc image using this invalid nand, will I able to get the cpu key by glitching it?
Anyway, creating ECC image in J-Runner 0.4/0.5 does give some warnings:

Code:
===================================================
Wednesday, June 20, 2018 12:21:56 AM

J-Runner v0.5 Started


WARNING! - Your selected working directory already contains files!
You can view these files by using 'Show Working Folder' Button

Initializing nanddump1.bin..
Trinity
Glitch2 Selected
Nand Initialization Finished
Comparing...
Bad Block ID  0034 Found @ 0x03FF [Offset: 0x107BE00]
Bad Block ID  013B Found @ 0x03FE [Offset: 0x1077C00]
Block ID 03FF [Offset: 0x107BE00] remapped to Block ID 0034 [Offset: 0xD6800]
Block ID 03FE [Offset: 0x1077C00] remapped to Block ID 013B [Offset: 0x513600]
Bad Blocks Remapped
Bad Block ID  0034 Found @ 0x03FF [Offset: 0x107BE00]
Bad Block ID  013B Found @ 0x03FE [Offset: 0x1077C00]
Block ID 03FF [Offset: 0x107BE00] remapped to Block ID 0034 [Offset: 0xD6800]
Block ID 03FE [Offset: 0x1077C00] remapped to Block ID 013B [Offset: 0x513600]
Bad Blocks Remapped
Nands are the same
CR4 Selected
* unpacking flash image, ....
Spare Data found, will remove.
Removed
* found decrypted CD
* found XeLL binary, must be linked to 0x1c000000
 * we found the following parts:
SMC: 3.1
CB_A: 9188
CB_B: 9188
CD (image): 9452
CD (decrypted): 8453
 * this image will be valid *only* for: trinity (slim)
 * patching SMC...
 ! Warning: can't patch this Trinity type SMC!
 * patching CB_B...
patchset for 9188 found, 4 patch(es)
 * constructing new image...
 * base size: 70000
 * No separate recovery Xell available!
 * Flash Layout:
0x0..0x1FF (0x200 bytes) Header
0x200..0xFFF (0xE00 bytes) Padding
0x1000..0x3FFF (0x3000 bytes) SMC
0x4000..0x7FFF (0x4000 bytes) Keyvault
0x8000..0x9ABF (0x1AC0 bytes) CB_A 9188
0x9AC0..0x112BF (0x7800 bytes) CB_B 9188
0x112C0..0x172BF (0x6000 bytes) CD 8453
0x172C0..0xBFFFF (0xA8D40 bytes) Padding
0xC0000..0xFFFFF (0x40000 bytes) Xell (backup)
0x100000..0x13FFFF (0x40000 bytes) Xell (main)
 * Encoding ECC...Done!
------------- Written into output\image_00000000.ecc
Will this ECC work for the console?

Update #1:
Not bad SMC flashed, bad smc would give no boot at all and the nand chip could not be detected by programmer.
Reference
https://www.se7ensins.com/forums/threads/bad-smc-flash-recovery-for-rgh-slims.822398/
 
Last edited:
N

Newsk

Getting There
Messages
2,497
Reaction score
329
You could try writting 15432s ecc image to it from srgh pack(s) using custom nand functions. It's doubtful they got any further than creating and writing ecc. Install ace , Then after getting cpu key create nand without a nand dump method. I woukd backup the nand outside of jrunner how it sits currently tho first
 
Last edited:
R

rynax

Enthusiast
Messages
178
Reaction score
12
Thanks, I haven't got the ordered Ace v3 yet so cant try the S-RGH for now.
But I do have a Coolrunner Rev C.

I guess I can also use the pre-made ecc images in JRunner/common/ecc directory, like
TRINITY.ecc for RGH2
and TRINITY_CR4.ecc for CR4 Muffin?

Flash that ecc image and grab the cpu key if it glitches and boots fine?
 
R

rynax

Enthusiast
Messages
178
Reaction score
12
Well, have flashed the CR4 Muffin premade ecc image to the nand, and tried CR4 Muffin install, debug led has short/long pattern which is very similar to success glitch install. But it does not boot xell.
Trinity with CR4 Muffin and 7-1 timing file should boot very easily.

One question here is the console's nand does have two bad blocks, one is at
Bad Block ID 0034 Found @ 0x03FF [Offset: 0x107BE00]
Does this bad block fall into the xell's range which is 0 to 004F?
If yes, I would need to do the bad block remapping manually if I want to use the pre-made ecc image right?

Also is the ecc image I made using J-Runner above a correct/valid one?
Usually J-Runner making ecc image instant without much processing, but this one does give a lot of logs and it does say
! Warning: can't patch this Trinity type SMC!

So now I'm wondering if the Xell not booting problem is a result of bad block or motherboard hardware problem.

Or maybe I shall use 33 Ohm resistor for the CLK repair to make it exactly the same as the original. Tough I read 30 ~ 100 Ohm replacement is ok.
 
Top Bottom