Hardware PS4 NOR chip repair that displays signs of a BLOD

[FXDX]

I apologize for my English !
An atypical case on PS4 that presents blue light of death (BLOD), is corruption of some sections of NOR chip. I present below a summary of how to solve this problem.
First remove NOR chip from the PS4 motherboard, then wire it up to Teensy++ 2.0 programmed with SPIway.hex and make a dump with SPIWay from NORway-master.
When the NOR dump is validated on BwE validator software - thank to developer BwE (Better Way Electronics) for the tools and tutorial -, it shows the following results:

UNK Dynamic PerConsole Section Filler 2: ✔
UNK Static Section 1: 000000 ✔
UNK Dynamic Section 20 (SKU Byte): 00 [DANGER]
UNK Dynamic Section 21: 0000000000000000000000000000 [DANGER]
UNK Filler 4: ✔
UNK Dynamic Section 22:
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ✔
UNK Filler 5: ✔
UNK Dynamic Section 23:
11008180FFFFFFFF0410FF0000010000AC001F00FFFF401C ✔

The real issue is the UNK Dynamic Section 1 and Section 20 - 22. Hence the DANGER !!
Open the dump in a hex editor and corruption in this dump is from 001CE000 to 001CE1FF (A length of 200).
On an working dump with similar specifications we will see correct data from 001CE000 to 001CE1FF.
The solution is, using a hex editor (HxD), copy this data from 001CE000 to 001CE1FF from the one working NOR dump with similar specifications, into the our corrupted NOR dump !
Ran the patched dump in BwE validator again and the result is a working dump. Ignore the WARNING message.

UNK Dynamic PerConsole Section Filler 2: ✔
UNK Static Section 1: 0007FF ✔
UNK Dynamic Section 20 (SKU Byte): 07 (Retail) ✔
UNK Dynamic Section 21: 0007FF0700030C04000000040000 ✔
UNK Filler 4: ✔
UNK Dynamic Section 22:
B5020000B5020000B70E3500000000007C0100007C01000060684501000000006B0100006F0100003B0077010000000018000000 ✔
UNK Filler 5: ✔
UNK Dynamic Section 23:
11008180FFFFFFFF0410FF0000010000AC001F00FFFF401C ✔

Write this good dump that works back into the NOR chip, mounts back to the PS4 motherboard and BLOD caused by a corrupt NOR it disappeared.

Many thanks to developer BwE (Better Way Electronics), for the tools and hard work:

BwE PS4 NOR Validator
BwE PS4 NOR Statistics
BwE PS4 WiFi/BT Patcher & Extractor
BwE PS4 NOR Comparator

Many thanks to Andrew Paul for the tutorials and help:
Install Teensy++ 2.0 programmer hardware within Windows, start dumping and re-programing the PS4 NOR chip, etc

To do this you will need to download the following:
- PS4 Ac1d Flash Tool:
https://github.com/cfwprpht/PS4_AC1D_...
- Python v2.x:
https://www.python.org/downloads/
- PySerial:
https://pypi.python.org/pypi/pyserial...
- TeensyLoader:
https://www.pjrc.com/teensy/loader.html
- SPIWay
https://github.com/hjudges/NORway

 

[noob404]

Great tut. Thanks. Might come in handy at some point of time. With SysGlitch Tool and others under development with scope for downgrading, maybe it's time to get a Teensy Board.
BTW, can you tell me how to diagnose a corrupt NOR chip as reason for BLOD?

 

[FXDX]

Great tut. Thanks. Might come in handy at some point of time. With SysGlitch Tool and others under development with scope for downgrading, maybe it's time to get a Teensy Board.
BTW, can you tell me how to diagnose a corrupt NOR chip as reason for BLOD?

Unfortunately, it is a very difficult to diagnose exactly, but the BLOD has the following causes.
1) APU
2) Southbridge
3) RAM Memory.
4) Power supply
5) NOR chip
They must be taken by elimination.

 

[MadMaxGR]

Unfortunately, it is a very difficult to diagnose exactly, but the BLOD has the following causes.
1) APU
2) Southbridge
3) RAM Memory.
4) Power supply
5) NOR chip
They must be taken by elimination.

The southbridge is married to the APU on all PS4 models. Right?

Sent from my MI MAX 2 using Tapatalk

 

[FXDX]

The southbridge is married to the APU on all PS4 models. Right?

Sent from my MI MAX 2 using Tapatalk

Nop

 

[MadMaxGR]

Nop

Andrew Paul mentioned something like that on one of his vids. So this is not true. We can replace any model's Southbridge IC chip without any further ic to be replaced. Please confirm...

Sent from my MI MAX 2 using Tapatalk

 

[FXDX]

Andrew Paul mentioned something like that on one of his vids. So this is not true. We can replace any model's Southbridge IC chip without any further ic to be replaced. Please confirm...

Sent from my MI MAX 2 using Tapatalk

Replace Southbridge IC chip, only with the same version you removed.

 

[ed1973]

Hello,

I consider myself as a rework specialist and have fixed lots of ps3 with YLOD's and ps4 with BLOD's.
With the SAA and SAB motherboard, it was for 99% sure, related to broken solder connections, under the APU, RAM chips, SB and SB mem. However, because Sony improved their soldering from SAC boards (1216) it was most of the times, something different.

Now I started to focus on NOR corruption and please correct me when I am wrong, when I do see DANGER's from BwE NOR Validator and the console does have BLOD symptoms (20s 55s BBLOD etc), then the NOR is corrupt and needs to be repaired (if possible).

I worked with HxD a lot and do know how to check the differences, but that is on byte to byte compare.

Can somebody explain me, how do I exactly make the links between the DANGER output, and the parts that need to be put over from good dump to the bad dump ?

@FXDX :

You show me this :

UNK Dynamic PerConsole Section Filler 2: ✔
UNK Static Section 1: 000000 ✔
UNK Dynamic Section 20 (SKU Byte): 00 [DANGER]
UNK Dynamic Section 21: 0000000000000000000000000000 [DANGER]
UNK Filler 4: ✔
UNK Dynamic Section 22:
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ✔
UNK Filler 5: ✔
UNK Dynamic Section 23:
11008180FFFFFFFF0410FF0000010000AC001F00FFFF401C ✔

Then suddenly you say :

corruption in this dump is from 001CE000 to 001CE1FF (A length of 200).

How do you know that ?
How did you find that ? 001CE000 to 001CE1FF ?
Can you please tell me the steps, you made ?

Hopefully you do want to clarify this.

Kind regards,

Ed

 

[FXDX]

Search on instagram or other social media on developer BwE (Better Way Electronics). He is the one who deduced where the problem sectors are. The method is developed by him. I just followed his instructions.

 

[darknesmonk]

Hi friends!
I read error via UART (after flash patching via BWE NOR VALIDATOR) on my PS4 SLIM SAF-003

secure loader build: Mar 19 2019 05:31:18 (r9884:release_branches/release_06.510) [711MHz]
AGESA: KG&CN.BDK W8C24
ERROR: sceSblSlLoadSelfWithVerifiedHeader(171) sceSblCfVeriLoadSegment -36
ERROR: loadBios(2174) sceSblSlLoadSelf -8
ERROR: main(4065) loadBios -8

I can't understand what the problem is....
replaced GDDR5, reballing APU, Bridge and DDR3 no results

 

[eduardonavia]

hola amigos este foro es interesante aprender cada dia ..
conozco lo que hablan aqui ***.del autraliano BwE y su programas ..excelente ayuda ..
es una gran ayuda para comprender mas ,
el validator BwE version 1.6.0- parcha automaticamente el BT y WIFI,si instalas parches .--C0020001-- son 21 ahora...el australiano BwE, dice el programa esta a dispoccion de reparadores .espera aportes de nor flash,con BwE validator con danger .. funcionen los envie y asi el corregir o mejoras BwE validator ..ofrece libre para usar.
mi experiencia en ps4 super slim
pruebas.
placa A------placa B--ejemplo
mismo modelo cuh2215B.. Placa :A--daño prende y apaga ( no pudimos encontra el daño )
placa A--trabajo
1-reballing APU
2-fuente cambio
3-cambio SB (cxd90046)
4-chekeo reguladores voltajes varios
5-dump NOR-revisa BwE validator ..(1 danger -2 warning)
6- reviso si habia corto diferentes puntos ...(muchos )
7-no funciono igual
*****placa B
-daño, prende , luz azul de la muerte BLOD.permanente no se apaga.
trabajo-
1-reballing APU
2-cambio SB ( cxd90046)
3-memorias (apu) y (sb)
4-dump NOR BwE validator (1 danger 1 warning)
5-revisamos reguladores varios
6-igual no funciona
=hicimos el donante- entre las dos placas para definir daño y arreglar talvez alguna
cambiamos (APU-NOR) ic (A04-COL2) llamamos syscon-y el MEDIATEK (ic mt1965a)
estos 4 ic estan encriptados deben ir los 4 juntos principalmente (apu-sb-syscom) el mediatek lector BR identifica el dvd BR
***los 4 ic de la placa A, los instalamos en la placa B y funciono, imagen todo full ,recuerde (placa B era BLOD)
resumen-la placa A tiene un problema en memorias o reguladores (SB no se cambio )
la placa B -uno de los 3 integrados (apu-nor-syscom) esta malo . ( nor se reviso con BwE validator) y el mediatek solo afecta reconocimiento de dvd BR ....espero este rollo sirva ..y seguimos investigando --gracias por su tiempo ..siempre aprendiendo

 

[Oldhats640]

Hi there, how everybody doing? and I have a situation I'm stuck on.

Doing a special repair on corrupt NOR 1.61 of the CUH-1001A SAA-001 board. Would stop at error during system software re-installation and boot loop back to re-installation request then ends with same error, over and over again. I have already un-soldered the flash chip hooked it up to teensy board, dumped it and extracted. Now but I'm stuck without intact NOR firmware to copy good sections from then paste over the sections of corrupted NOR for this PS4 under repair.

Questions:

Where or how do I obtain the intact NOR firmware 1.61 dump for SAA-001 motherboard, model: CUH-1001A?

Or could use different version of firmware NOR from another PS4 SAA-001 with unknown firmware version that I have at work? Must I use same version 1.61?

Thank you, English is not my first language in fact, deaf and use sign language. My primary job is cellphone and game console repair btw.

Cheers,

 

[FXDX]

Hi friends!
I read error via UART (after flash patching via BWE NOR VALIDATOR) on my PS4 SLIM SAF-003

secure loader build: Mar 19 2019 05:31:18 (r9884:release_branches/release_06.510) [711MHz]
AGESA: KG&CN.BDK W8C24
ERROR: sceSblSlLoadSelfWithVerifiedHeader(171) sceSblCfVeriLoadSegment -36
ERROR: loadBios(2174) sceSblSlLoadSelf -8
ERROR: main(4065) loadBios -8

I can't understand what the problem is....
replaced GDDR5, reballing APU, Bridge and DDR3 no results

Possibly dead APU.....

--------------------- MERGED ---------------------------

Hi there, how everybody doing? and I have a situation I'm stuck on.

Doing a special repair on corrupt NOR 1.61 of the CUH-1001A SAA-001 board. Would stop at error during system software re-installation and boot loop back to re-installation request then ends with same error, over and over again. I have already un-soldered the flash chip hooked it up to teensy board, dumped it and extracted. Now but I'm stuck without intact NOR firmware to copy good sections from then paste over the sections of corrupted NOR for this PS4 under repair.

Questions:

Where or how do I obtain the intact NOR firmware 1.61 dump for SAA-001 motherboard, model: CUH-1001A?

Or could use different version of firmware NOR from another PS4 SAA-001 with unknown firmware version that I have at work? Must I use same version 1.61?

Thank you, English is not my first language in fact, deaf and use sign language. My primary job is cellphone and game console repair btw.

Cheers,

You need a dump fw just like yours.

 

[Oldhats640]

--------------------- MERGED ---------------------------


You need a dump fw just like yours.[/QUOTE]

Thank you for replying, What I meant do I have to use same version or any version of this firmware from any SAA-001 is suitable? I was away on vacation for nearly more than a week.

Thank you and cheers, Oldhats

 

[Oldhats640]

Deadline is this Monday August 9th imposed by my boss, the PS4 with corrupt NOR is sitting for nearly 3 weeks because of lack of answers and very little information.

The tutorial leaves lot of questions unanswered.
in particular: NOR version: Must be same one or any?
This answers is not clear as this were not addressed, please answer to each questions:

Must I find exact match of dump?
Note: This means I cannot know which version I need from another PS4 CUH-1001A SAA-001 as I don't have bunch of dumps from another many CUH-1001A PS4 consoles.
My comment: I wish people leaves a bunch of dumps for us to download to help us to repair by patching corrupt NOR, this would had helped me to finish this long before, but no.

Can I use another PS4's CUH-1001A SAA-001 with any version of NOR dump to use for patching the corrupt NOR?
That is only option I have since I have a unknown version firmware of PS4 with correct SAA-001 motherboard. If yes, This I can use but I have to dump it tomorrow and use it to patch this to repair it. I meant it, yes or no?

Finally, do I have to re-encrypt NOR then write back to the flash eeprom? Tutorial videos and articles leaves little about this.

Thank you and cheers, Jason

 

[Oldhats640]

Once again, do anyone have good 1.61 NOR firmware dump based on version according to the AC1D? PS4 was boot looping over every time system software was attempted. Need this so I can repair the corrupted NOR.

I do not have dumps from consoles nor have resources or time to harvest dumps from even customer's nor in the future, hence need your help to contribute to this.

Thank you and Cheers, Oldhats640

 

[darknesmonk]

Hi friends! I want to share my experience,
I want to fix loadbios-8! PS4 PRO 7008 (46 bridge) (this is not a hardware problem) .
I switched the active bios slot, but bricked the syscon (software version 0xffffffff)

I patched the 0x201000 partition with FF values (16 bytes). Don't use it, brick!

UART LOG BEFORE PATCHING:
secure loader build: Mar 19 2019 05:32:35 (r9884:release_branches/release_06.510) [800MHz]
AGESA: GL&MO.BDK W8A12
ERROR: sceSblSlLoadSelfWithVerifiedHeader(171) sceSblCfVeriLoadSegment -36
ERROR: loadBios(2174) sceSblSlLoadSelf -8
ERROR: main(4065) loadBios -8

After Filing (FF) offset 0x201000 size: 16 (ULTRA MEGA BRICK SYSCON )

secure loader build: Mar 1 2019 05:32:38 (r9861:release_branches/release_06.500) [800MHz]
AGESA: GL&MO.BDK W8A12
standby 06510000
ERROR: main(3682) checkUpdVersion 0xffffffff != 0x6508000

The partitions are switched back, but the error is the same:

secure loader build: Mar 19 2019 05:32:35 (r9884:release_branches/release_06.510) [800MHz]
AGESA: GL&MO.BDK W8A12
ERROR: main(3682) checkUpdVersion 0xffffffff != 0x6510000

rewrite flash not result, syscon damaged. BwE NOR validator: No errors and warnings

 

[darknesmonk]

Hello, friends!
I switched the active slot (9.50 ->9.03) and downgraded the firmware without a dump 9.03! But we need a new chip R5F100LLAB 0.50mm pitch.
my is R5F100LLAA 0.65mm pitch.
this method will fix the bios error loadbios -8 and checkUpdVersion
I attach my syscon for example and analysis (all logs and extra records are deleted)


nor patch: Filing (FF) offset 0x201000 size: 16 (ULTRA MEGA BRICK SYSCON , USE ONLY NEW SYSCON)




Individual correction and clear syscon , find the right software version in the logs
(need find correct version A5 08 00 FF XX - A5 0B 00 XX )





fix loadbios-8 error && downgrade!

 

[iTech_Console]

Thank you

 

[tpcomservice]

Mr darknesmonk what device do you use to write and erase R5F100LL can you tell me the method and circuit? Thanks..