XboxHacker BBS
 
*
Welcome, Guest. Please login or register.
Did you miss your activation email?
February 09, 2010, 06:07:36 AM


Login with username, password and session length


Pages: 1 2 3 4 5 6 7 8 9 10 »
  Print  
Author Topic: Multiple Kernel box using XD memory card - R.I.P. 07/29/09 (E-74 error)  (Read 48453 times)
warpjavier
Hacker
***
Posts: 98


View Profile
« on: May 27, 2007, 12:26:55 AM »

Hi all,
I wanna share what I think would be better than have a dual kernel box.
First, I'll show some pictures, then I'll explain what I've done.


I deactivated the on board nand sending to CE 3.3V and also had to cut the track coming from the south bridge to the nand (you can see in one of the pictures that I cut 2 other tracks and I had to fix them).
I connected the wires from the back to the mainboard to the XD card socket.
I also connected the CE pin from the socket to a 10k resistor then to 3.3V, also the CE have to be connected to the CE wire I soldered to the track coming from the south bridge.
For the process of writing to the XD card, I used an USB card reader that supports RAW reading/writing. The one I used is the Olympus MAUSB-10.
I got all the info on how to read/write to this device thanks to the Alauda project. Its a project that adds support for this card reader/writer to Linux. http://alauda.sourceforge.net/wikka.php?wakka=HomePage
I also used libusb and a little C program to access the device from windows. http://libusb-win32.sourceforge.net/
I removed the R6T3 resistor, as I have Kernel 4532 yet and I will be upgrading to 4552.
This way you can have different kernels in different cards, and I think is easier for test purposes as you don't have to open your console, just remove the HD if you have one, and replace the card.
Well, I'll be posting any news after the upgrade.

warpjavier

PS. I'm willing to help anybody that want to do the same, and I also accept suggestion.

PS2: As of today July 29, 2009 the very first console to have an XD card as NAND has die with E74 error Sad
« Last Edit: July 29, 2009, 07:06:44 PM by warpjavier » Logged

Internet Explorer is only useful to download Firefox.
Surrido
Master Hacker
****
Posts: 230


Wer lesen kann ist klar im Vorteil!


View Profile
« Reply #1 on: May 27, 2007, 04:23:01 AM »

great idea! i wanted to put my kernels via IDE socket connection into the HD case so you can have a "live-HD" and a "linux-HD" with the right kernel automatically...

plug your Linux HD case in you have 4548. plug the other one you have the currently newest one (R6T3 cut of course)

looks like you were faster :-p

I will finish it anyway.

GREAT WORK MAN!
Logged
robinsod
Global Moderator
Xbox Hacker
*****
Posts: 646


Perl packed my shorts during global destruction


View Profile
« Reply #2 on: May 27, 2007, 04:53:37 AM »

Very nice, care to post the sources?
Logged
haute1
Newbie
*
Posts: 6


View Profile
« Reply #3 on: May 27, 2007, 05:19:42 AM »

Hi good work, you can post any basic schematic? It possible to read/write (raw mode) the xc card in win?.
thx
« Last Edit: May 27, 2007, 05:27:25 AM by haute1 » Logged
warpjavier
Hacker
***
Posts: 98


View Profile
« Reply #4 on: May 27, 2007, 10:50:04 AM »

Hi,
First, thank for the feedback.
I can say now that I'm able Upgrade/Downgrade Kernels, I tested it today.

- I'll clean the source code and I'll post it.
- You can Read/Write XD cards in widows using the Olympus MAUSB-10.
- I'll be posting pictures and links of where I found the info/schematics/pinouts.

warpjavier
Logged

Internet Explorer is only useful to download Firefox.
haute1
Newbie
*
Posts: 6


View Profile
« Reply #5 on: May 27, 2007, 11:47:38 AM »

Hi, thx,We are waiting impatient for your info, to make it and test experimentes with kernell without any problem to kill the box.
Another question.

You can test if can be work with other capacity Memory card? 32mb, 128mb 256mb etc.?
 
« Last Edit: May 27, 2007, 11:49:33 AM by haute1 » Logged
warpjavier
Hacker
***
Posts: 98


View Profile
« Reply #6 on: May 27, 2007, 05:27:31 PM »

Here is some info and the source code.





18-pin Flash Card
Pin
NameDescription
18GNDGround (+Presence detect)
17R/-BReady/-Busy (Open-drain)
16-RERead Enable
15-CECard Enable
14CLECommand Latch Enable
13ALEAddress Latch Enable
12-WEWrite Enable
11-WPWrite Protect
10GNDGround
9D0Data0
8D1Data1
7D2Data2
6D3Data3
5D4Data4
4D5Data5
3D6Data6
2D7Data7
1VccPower

Here is the source:
Code: (card_tools.h)
/*
 * Card_tools for raw access XD/Smartmedia cards using Olympus MAUSB-10
 * author: warpjavier
 * email: warpjavier@hotmail.com
 * date: 27 May 2007
 * platform: linux + windows
 *
 */

#ifndef CARD_TOOLS_H_INCLUDED
#define CARD_TOOLS_H_INCLUDED

#include <usb.h>

/* the device's vendor and product id for Olympus MAUSB-10*/
#define MY_VID 0x07B4
#define MY_PID 0x010A

/* the device's endpoints */
#define EP_IN 0x82
#define EP_OUT 0x03

#define PBA_LO(pba) ((pba & 0xF) << 5)
#define PBA_HI(pba) (pba >> 3)

#define BUF_SIZE 576 //576 instead of 528 as the device return 48 extra bytes

/*
 * Bulk command identity (byte 0)
 */
#define CARD_TOOLS_BULK_CMD 0x40

/*
 * Bulk opcodes (byte 1)
 */
#define CARD_TOOLS_BULK_READ_BLOCK 0x94
#define CARD_TOOLS_BULK_ERASE_BLOCK 0xa3
#define CARD_TOOLS_BULK_WRITE_BLOCK 0xb4
#define CARD_TOOLS_BULK_RESET_MEDIA 0xe0

/*
 * Port to operate on (byte 8)
 */
#define CARD_TOOLS_PORT_XD 0x00
#define CARD_TOOLS_PORT_SM 0x01

/*
 * Error Codes
 */
#define CARD_TOOLS_OK       0x00
#define CARD_TOOLS_ERROR    0x01

/*
 * Functions
 */
usb_dev_handle *open_dev(void);
int reset_media(void);
int dump_card(char *filename);
int write_to_card(char *filename);
int erase_card();
int read_block(unsigned short block);
int erase_block(unsigned short block);
int write_block(unsigned short block);
#endif // CARD_TOOLS_H_INCLUDED

Code: (card_tools.c)
/*
 * Card_tools for raw access XD/Smartmedia cards using Olympus MAUSB-10
 * author: warpjavier
 * email: warpjavier@hotmail.com
 * date: 27 May 2007
 * platform: linux + windows
 *
 */
#include <stdio.h>
#include "card_tools.h"

//Some Globals
usb_dev_handle *dev = NULL; // the device handle
char buffer[BUF_SIZE*32];
int port = CARD_TOOLS_PORT_XD; //you can change it if you use Smartmedia cards

usb_dev_handle *open_dev(void)
{
    struct usb_bus *bus;
    struct usb_device *dev;
    for (bus = usb_get_busses(); bus; bus = bus->next)
    {
        for (dev = bus->devices; dev; dev = dev->next)
        {
            if (dev->descriptor.idVendor == MY_VID
                    && dev->descriptor.idProduct == MY_PID)
            {
                return usb_open(dev);
            }
        }
    }
    return NULL;
}

/*
 * Resets the media status
 */
int reset_media(void)
{
unsigned char command[9];

memset(command, 0, 9);
command[0] = CARD_TOOLS_BULK_CMD;
command[1] = CARD_TOOLS_BULK_RESET_MEDIA;
command[8] = port;

    if (usb_bulk_write(dev, EP_OUT, command, 9, 5000) != 9)
    {
        printf("Error: cannot reset media\n");
        return CARD_TOOLS_ERROR;
    }

return CARD_TOOLS_OK;
}

int main(int argc, char *argv[])
{
int option,status;
char* filename;

if (argc < 2) {
    printf("Card Tools 0.1 - by warpjavier\n");
printf("Usage: %s [OPTION] filename\n", argv[0]);
printf("Options are as follows:\n");
printf("-d - Dump card\n");
printf("-w - Write to card\n");
printf("-e - Erase card\n");
exit(0);
}

    if((option = getopt(argc, argv, "d:w:e"))==-1)
        return 0;
switch (option)
{
        case 'd':
            if(argv[2] == NULL)
            {
                printf("Please, specify a filename\n");
                status = CARD_TOOLS_ERROR;
                break;
            }
            filename = argv[2];
            if(init_all()!=CARD_TOOLS_OK)
                return 0;
            printf("Dump card contents to %s file\n", filename);
            status = dump_card(filename);
            break;
        case 'w':
            if(argv[2] == NULL)
            {
                printf("Please, specify a filename\n");
                status = CARD_TOOLS_ERROR;
                break;
            }
            filename = argv[2];
            if(init_all()!=CARD_TOOLS_OK)
                return 0;
            printf("Write to card contents from %s file\n", filename);
            printf("The card must be empty before write\n");
            status = write_to_card(filename);
            break;
        case 'e':
            if(init_all()!=CARD_TOOLS_OK)
                return 0;
            printf("Erase card contents\n");
            printf("Do you want to erase the card? (y/n)");
if (getchar() == 'y')
{
                status = erase_card();
}
else
{
    printf("Operation Cancelled\n");
    status = CARD_TOOLS_ERROR;
}
            break;
        default:
            status = CARD_TOOLS_ERROR;
    }
    usb_release_interface(dev, 0);
    usb_close(dev);
    if(status != CARD_TOOLS_OK)
    {
        printf("Error!");
        return 0;
    }
    printf("Operation Succefully Complete");
    return 0;
}

int init_all()
{
    usb_init(); // initialize the library
    usb_find_busses(); // find all busses
    usb_find_devices(); // find all connected devices

    if (!(dev = open_dev()))
    {
        printf("Error: device not found!\n");
        return CARD_TOOLS_ERROR;
    }

    if (usb_set_configuration(dev, 1) < 0)
    {
        printf("Error: setting config 1 failed\n");
        usb_close(dev);
        return CARD_TOOLS_ERROR;
    }

    if (usb_claim_interface(dev, 0) < 0)
    {
        printf("Error: claiming interface 0 failed\n");
        usb_close(dev);
        return CARD_TOOLS_ERROR;
    }

    if(reset_media() != CARD_TOOLS_OK)
    {
        usb_close(dev);
        return CARD_TOOLS_ERROR;
    }
    return CARD_TOOLS_OK;
}

int dump_card(char *filename)
{
    FILE *fd;
    if((fd = fopen(filename,"w+b"))==NULL)
    {
        printf("Error creating %s\n",filename);
        return CARD_TOOLS_ERROR;
    }
    unsigned short block;
    for (block=0;block<1024;block++)
    {
        if(read_block(block)!=CARD_TOOLS_OK)
        {
            fclose(fd);
            return CARD_TOOLS_ERROR;
        }
        fwrite(buffer,528*32,1,fd);
    }
    fclose(fd);
    return CARD_TOOLS_OK;
}

int write_to_card(char *filename)
{
    FILE *fd;
    if((fd = fopen(filename,"r+b"))==NULL)
    {
        printf("Error opening file %s\n",filename);
        return CARD_TOOLS_ERROR;
    }
    unsigned short block,x;
    char tmp[528]; //528 is the page size plus the 16 extra bytes
    for (block=0;block<1024;block++)
    {
        // Add 48 extra bytes to each page
        for (x=0;x<32;x++)
        {
            fread(tmp,528,1,fd);
            memcpy(buffer+(x*576),tmp,528);
        }
        if(write_block(block)!=CARD_TOOLS_OK)
        {
            fclose(fd);
            return CARD_TOOLS_ERROR;
        }
    }
    fclose(fd);
    return CARD_TOOLS_OK;
}

int erase_card()
{
    unsigned short block;
    for (block=0;block<1024;block++)
    {
        if(erase_block(block)!=CARD_TOOLS_OK)
            return CARD_TOOLS_ERROR;
    }
    return CARD_TOOLS_OK;
}

int read_block(unsigned short block)
{
    int p;
    unsigned char command[9];
    command[0] = CARD_TOOLS_BULK_CMD;
    command[1] = CARD_TOOLS_BULK_READ_BLOCK;
    command[2] = PBA_HI(block);
    command[3] = 0x00; //Zone is always 0 for 16Mb cards
    command[4] = 0x00;
    command[5] = PBA_LO(block);
    command[6] = 0x20; //We read 32 pages at a time as is the block size.
    command[7] = 0x00;
    command[8] = port;

    if (usb_bulk_write(dev, EP_OUT, command, 9, 5000) != 9)
    {
        printf("Error sending Read Block command\n");
        return CARD_TOOLS_ERROR;
    }
    if (usb_bulk_read(dev, EP_IN, buffer, (BUF_SIZE*32), 5000) != (BUF_SIZE*32))
    {
        printf("Error reading Block\n");
        return CARD_TOOLS_ERROR;
    }
    else
    {
        printf("Reading block %d\n",block);
        //remove the extra 48 bytes
        for(p=0;p<32;p++)
        {
            int dest_offset = p * 528;
            int src_offset = p * (512 + 64);
            memmove(buffer + dest_offset, buffer + src_offset, 528);
        }
    }
    return CARD_TOOLS_OK;
}

int erase_block(unsigned short block)
{
    unsigned char stat_buf[2];
    unsigned char command[9];
    command[0] = CARD_TOOLS_BULK_CMD;
    command[1] = CARD_TOOLS_BULK_ERASE_BLOCK;
    command[2] = PBA_HI(block);
    command[3] = 0x00; //Zone is always 0 for 16Mb cards
    command[4] = 0x00;
    command[5] = PBA_LO(block);
    command[6] = 0x02;
    command[7] = 0x00;
    command[8] = port;

    if (usb_bulk_write(dev, EP_OUT, command, 9, 5000) != 9)
    {
        printf("Error sending Erase command\n");
        return CARD_TOOLS_ERROR;
    }
    if (usb_bulk_read(dev, EP_IN, stat_buf, 2, 5000)!=2)
    {
        printf("error: Erasing Block\n");
    }
    else
    {
        printf("Erasing Block %d\n",block);
    }
    return CARD_TOOLS_OK;
}

int write_block(unsigned short block)
{
    unsigned char command[9];
    command[0] = CARD_TOOLS_BULK_CMD;
    command[1] = CARD_TOOLS_BULK_WRITE_BLOCK;
    command[2] = PBA_HI(block);
    command[3] = 0x00; //Zone is always 0 for 16Mb cards
    command[4] = 0x00;
    command[5] = PBA_LO(block);
    command[6] = 0x20; //We write 32 pages at a time as is the block size.
    command[7] = 0x00;
    command[8] = port;

    if (usb_bulk_write(dev, EP_OUT, command, 9, 5000) != 9)
    {
        printf("Error sending Write Block command\n");
        return CARD_TOOLS_ERROR;
    }
    if (usb_bulk_read(dev, 0x01, buffer, (BUF_SIZE*32), 5000) != (BUF_SIZE*32))
    {
        printf("Error Writing Block\n");
        return CARD_TOOLS_ERROR;
    }
    else
    {
        printf("Writing block %d\n",block);
    }
    return CARD_TOOLS_OK;
}

The code is not optimized and is not perfect, its just an example of how to communicate to the  device. I do not guarantee that this code will work for you. I'm not responsible for any damage caused to your device/console. Use at your own risk
You need libusb for win32 http://libusb-win32.sourceforge.net/ to compile it for windows platform.
For linux users, you will have to unload usb-storage module using modprobe. If not, the program wont work as the device is busy.

Sources:
- AlaudaProject http://alauda.sourceforge.net/wikka.php?wakka=HomePage
- This forum
- libusb for win32 http://libusb-win32.sourceforge.net/
- pinouts.ru http://pinouts.ru
- google

warpjavier
Logged

Internet Explorer is only useful to download Firefox.
haute1
Newbie
*
Posts: 6


View Profile
« Reply #7 on: May 28, 2007, 11:09:32 AM »

Hi Warpjavier, thnkx for the info. I go to make it. But need know any questions.
Your test other card readers to see if they could read/write in way raw? or single it can make it the MAUSB-10?.

In the picture of the board i cant view with detail the cable go CE to +3.3v to disable the nand original.
Can  you post any more detail of the pic or a simple schema?
Logged
e5frog
Member
**
Posts: 39



View Profile
« Reply #8 on: May 28, 2007, 02:32:53 PM »

To bad I only have SD-cards...  But maybe that'll work as well somehow.
Logged
warpjavier
Hacker
***
Posts: 98


View Profile
« Reply #9 on: May 28, 2007, 02:40:47 PM »



This is a crappy diagram, but should clarify the CE connection.
- You have to cut that track comming from the XSB (south bridge) to the on board nand. This way the on board nand will be deactivated as will get 3.3V to CE.
- solder a 4k7 resistor to the big capacitor at the left of the picture.
- connect the track you cut from the XSB to the 4k7 resistor you just solder and also to the CE in your XD socket.

Be very careful when cutting the track, in the picture seems easy, but once you look at the mainboard, its very small.

The other way to eliminate the track cut, is to desolder the on board nand.

cheers

warpjavier
« Last Edit: May 28, 2007, 02:42:19 PM by warpjavier » Logged

Internet Explorer is only useful to download Firefox.
e5frog
Member
**
Posts: 39



View Profile
« Reply #10 on: May 28, 2007, 02:52:19 PM »

There seems to be a little more space closer to the solder pads, perhaps that's a better place to cut the trace?
Logged
warpjavier
Hacker
***
Posts: 98


View Profile
« Reply #11 on: May 28, 2007, 02:54:54 PM »

That picture is taken with the nand removed from the mainboard, those traces are under the chip if you don't remove it.
Logged

Internet Explorer is only useful to download Firefox.
Surrido
Master Hacker
****
Posts: 230


Wer lesen kann ist klar im Vorteil!


View Profile
« Reply #12 on: May 29, 2007, 01:58:04 AM »

you dont have to cut that track. you can simply give VCC to CE to disable the nand...

correct me if i am wrong. but i think its constantly been pulled low and you just give VCC to the CE.

(or do you want to avoid that SB sends VCC "as well"...)
Logged
revolt
Master Hacker
****
Posts: 305


revolt_360


View Profile
« Reply #13 on: May 30, 2007, 03:05:57 AM »

Offtopic maby but does anyone know if it would be possible to get a raw dump from within linux ? i want to do this but i dont want to buy myself an infectus chip to get this dump.

Revolt

p.s. for people like me a 100% noob tutorial to do this would be nice to  Tongue
Logged

Quote
if i wanted flaming i would have asked how to let my 360 use a 250gb hardisk with build in coffee machine.
Surrido
Master Hacker
****
Posts: 230


Wer lesen kann ist klar im Vorteil!


View Profile
« Reply #14 on: May 30, 2007, 03:10:13 AM »

do some searching. there is code floating around to dump the NAND from within linux.

Quote
p.s. for people like me a 100% noob tutorial to do this would be nice to 

dont be lazy, convert yourself into a non-noob...
Logged
revolt
Master Hacker
****
Posts: 305


revolt_360


View Profile
« Reply #15 on: May 30, 2007, 03:18:54 AM »

do some searching. there is code floating around to dump the NAND from within linux.

yeah but the codes that are floating around here are not for a raw dump...

revolt.
Logged

Quote
if i wanted flaming i would have asked how to let my 360 use a 250gb hardisk with build in coffee machine.
warpjavier
Hacker
***
Posts: 98


View Profile
« Reply #16 on: May 30, 2007, 05:53:38 PM »

Quote from: surrido
you dont have to cut that track. you can simply give VCC to CE to disable the nand...

correct me if i am wrong. but i think its constantly been pulled low and you just give VCC to the CE.

(or do you want to avoid that SB sends VCC "as well"...)

I did that test and the system didn't start at all, but you can try it.

Quote from: surrido
there is code floating around to dump the NAND from within linux.

Revolt is right in this one, the dump you get from linux is not raw.
I believe we can get a raw dump from linux but not dumping the memory, instead accessing the SB via a program and send the right commands to read the NAND. But this would require some of the Guru's from here to reverse the read/write code.

@revolt
I got my raw dump using the Olympus USB card reader. I soldered the pins from the reader board to my mainboard. It cost me a lot as the method of connecting the power cord like infectus didn't work. If you are really interested in getting a raw dump with this device, I'll explain how I managed to get it.

warpjavier

Logged

Internet Explorer is only useful to download Firefox.
lokixxx
Member
**
Posts: 28


View Profile
« Reply #17 on: May 30, 2007, 09:22:00 PM »

Will this work with XD cards larger than 16MB?
« Last Edit: May 30, 2007, 09:59:31 PM by lokixxx » Logged
zillionare
Master Hacker
****
Posts: 376

Global Modifier


View Profile
« Reply #18 on: May 30, 2007, 11:35:52 PM »

hey warpjavier, congrats on the mod.....

I have 2 ?'s 4 ya.

1) what size is the memcard your using? I'm assuming 16m. I see alot of 1g and 2g's around.

and 2) Have you tried a dump of 4532 and 4548 to compair and made the leap to 4554 yet? with fuses disabled ofcource! Grin

also could you do a dd(linux) of the 4532 chip to another blank chip then upgrade the clone chip to 4554. then you have both kernels to switch back and forth on there own chip. or was that your intention by doing this?

snuck in that 3rd ?

peace,
zil

Logged

Why buy one, when you can buy two for twice the price.
Surrido
Master Hacker
****
Posts: 230


Wer lesen kann ist klar im Vorteil!


View Profile
« Reply #19 on: May 31, 2007, 07:58:32 AM »

read the dual kernel thread :-)

http://www.xboxhacker.net/index.php?topic=7080.80

Logged
Pages: 1 2 3 4 5 6 7 8 9 10 »
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.11 | SMF © 2006-2009, Simple Machines LLC

Valid XHTML 1.0! Valid CSS! Dilber MC Theme by HarzeM