USB Bitbanger with AVR, Good for NOR flash programming etc.

[joohan]

Hi folks

Just sketched up a simple board with an AT90USB128X/64X that has enough I/O for programming the NOR flash on the PS3 Slim.

Have not written the software yet, but if someone would find it useful then here you are

Usage:
1. Make the board
2. Solder it on to the NOR testpoints according to git.fail0verflow.com Git - noralizer.git/summary

EDIT: the failoverflowgit is now offline, so I added the flasher files.

3. Write the software
4. ...

BTW, a Teensy ++ 2.0 would probably work aswell.

The software should be only a few hours work, will probably get to it in the next few days. The excellent lufa-lib should be a good startpoint for the USB part, and the flash programming routine is quite straightforward.

The flash memory is either S29GL128P or K8Q2815UQB ( and perhaps more versions exists ).

The Board is only one layer so manufacturing should be quite straghtforward.
Made with Eagle Freeware (CadSoft Online: EAGLE Layout Editor)

Thanks goes to Hector Martin

EDIT:

Now with the actual files..

[Ben Jeremy]

Nice... good job so far!

[Denbo44]

How do you plan on operating the S29GL128P or K8Q2815UQB control lines as in Output enable, Read write . and Clip enable?

[joohan]

How do you plan on operating the S29GL128P or K8Q2815UQB control lines as in Output enable, Read write . and Clip enable?

PORTE has 7 i/o that is not "reserved" for adress and data, so that should be enough.
It is also required to control NOR_TRISTATE, RESET and RY/BY (and CE, OE, WE)

[KtheC]

It would be great if this could work for a Teensy++ 2.0.

I have a PS3 that was shut off during a firmware update and now it doesn't turn on, so would like to know if its a flash problem before exploring other options.

[Mistawes]

^^ +1

I was just thinking, would it be in any way possible to use an AVR board with an SD socket or any extra storage and use that to write onto the NAND/NOR after a payload has been loaded to give us access.. A brick is a brick though, so directly wiring onto the Nand would be required I suppose. No Jtag points floating around PS3 mobo's by any chance..?

Or maybe write an app like Flash360 for Jtag 360's (although re-writing Dev_Flash in CG's filemanager works fine). I'm trying to find time to start learning C, then hopefully I can look into it in more detail.

[joohan]

It would be great if this could work for a Teensy++ 2.0.

Teensy++ 2.0 should definitely work, You just have to mod it for 3.3V (instructions are on the teensy website)

^^ +1

I was just thinking, would it be in any way possible to use an AVR board with an SD socket or any extra storage and use that to write onto the NAND/NOR after a payload has been loaded to give us access.. A brick is a brick though, so directly wiring onto the Nand would be required I suppose. No Jtag points floating around PS3 mobo's by any chance..?

Or maybe write an app like Flash360 for Jtag 360's (although re-writing Dev_Flash in CG's filemanager works fine). I'm trying to find time to start learning C, then hopefully I can look into it in more detail.

I think this is a separate issue.
The only way to safely play with the content of the flash is to be able to write it offline.

And I updated the first post with the files from the failoverflow git since they removed it from the web

[turboaleks]

Thx for the information. I will try to solder the connections but have some questions.
What about the clock? The AT90USBKEY uses 8Mhz ext. frequency and could be changed to max 16Mhz.
But team fail0verflow used a ftdi with 60Mhz.
They had a reason to use such a fast usb connction, but i would appreciate if it was possible with the mentioned dongle.
Im not sure about the soldering points, because the are some ??? Haven´t checked all the pins yet.
The hardware part is not so difficult, but what about the fpga code?

[andyt12]

Thx for the information. I will try to solder the connections but have some questions.
What about the clock? The AT90USBKEY uses 8Mhz ext. frequency and could be changed to max 16Mhz.
But team fail0verflow used a ftdi with 60Mhz.
They had a reason to use such a fast usb connction, but i would appreciate if it was possible with the mentioned dongle.
Im not sure about the soldering points, because the are some ??? Haven´t checked all the pins yet.
The hardware part is not so difficult, but what about the fpga code?

The design in the first post doesn't use a fpga so it doesn't come into it. All this is is an in circuit eprom programmer. Speed also doesn't matter, the flash rom can only be written so fast, more than likely there the mcu will have to wait for the flash.


Im making my own with pogo pins, so it will be like a jig board that lines up with the pins for flashing. I will be using a pic32 chip though as all my library code is for the pic. I already have a flasher made for a 29f032 chip, will just need small modifaction to the code for PS3's flash.

[joohan]

Im making my own with pogo pins, so it will be like a jig board that lines up with the pins for flashing. I will be using a pic32 chip though as all my library code is for the pic. I already have a flasher made for a 29f032 chip, will just need small modifaction to the code for PS3's flash.

I was first looking into makeing a pogo pin version, but I realized that the pins would add more cost to the board than all the other components combined.
But for unbricking consoles I guess that it would be a good idea.

Do you have any good & simple pc side program to use?
I was thinking of makeing something like nandpro ( for the x360 ) with a simple serial protocol.
And if we could share some code it would probably make life simpler for both.
I am going to implement a "virtual serialport" using the lufa-lib.
Are you using a serial connection or something else?

Example protocol:

erase page: (page 0xff means all pages)
ERASEPAGE[page]
reply: "d" / "e[errno]"

write page:
WRITEPAGE[page]+ binary data
reply: "d" / "e[errno]"

read page:
R[page]
reply: d+binary data / e[errno]

read range:
r[start_addr(3byte)][end_addr(3byte)]

probe flash:
P
reply: d+binary data (manufacturer code etc) / e[errno]