Thread: PS3 CXD4302GB Chip Test Points
07-26-2010 #11enohand Guest
well now that in the US jailbreaking & rooting is LEGAL!!!!
im sure some really good reverse engineers will be starting to attack this thing....my buddy is part of the military (AF) & he & his group have a ps3 cluster running, so im sure those guys are going to dig into the system now, & crack it since its no longer illegal
07-26-2010 #12shummyr Guest
God Speed for you buddy on Breaking This Baby OPEN
07-26-2010 #13TUHTA Guest
Actually i assembled programmer,and dumped information from that chip, its like 256 mb of data on it, so it's encryted!
Need some tools to decrypt, i'm working on it...
07-27-2010 #14sapperlott Guest
Try byte swapping it (0xaabbccdd to 0xbbaaddcc). After that you should be able to see stuff like the flash tables (search for metldr or creserved_0).
Could you please post how you wired the programmer to the test points?
07-27-2010 #15TUHTA Guest
So actually i'm using PIC programmer , just wired wires to TEST points and got it!And just flashed programmer that it read and write!
Still cant unveil it , but if i get something useful i will share all information with community!
07-28-2010 #16sapperlott Guest
Well - there is no way to be sure that your dump is correct. So I wouldn't try to decrypt something that most likely isn't encrypted at all.
If you connected the address or data lines in the wrong order for example, you will still read the correct amount of data but it will be useless garbage.
Since the NAND controller is attached to the SB the same way as the later 16 MiB NOR flash, the file you read from it should look the same as a 16 MiB NOR dump regarding file structure.
If somebody has a disassembled PS3 with a 16 MiB flash handy, it would be interesting to see if the same test points are still there. In this case you could just use a multimeter to map out the connections from the test points to the 16 MiB NOR pins. That should match the correct pin assignment for the NAND controller.
Hrm ... something doesn't add up with the description of the test points. To address 256 MiB with word access you'd need A0..27. With A0..17 you could only address 512 KiB
07-29-2010 #17jayjo Guest
2^18 = 262144 (a0...a17)
262144 / 1024 = 256
means 256kb could be adressed...
07-29-2010 #18sapperlott Guest
If you ignore the fact that those address lines address 16bit words instead of 8bit bytes then yes
07-29-2010 #19DemonHades Guest
Dont is the same nandflash and devflash,devflash store the firmware modules and resources...nandflash loaders,hyper and the engine init system kernel(core_os).
07-29-2010 #20sapperlott Guest
If that were the case, why did the size of the flash change on the newer consoles? If what you believe is true, moving the dev_flash to HDD would only have eliminated the CXD4302GB chip, not shrunk the size of the "other" flash.