GM 16216588 - Hacking

[quadstar87]

Ordered up a Hakko A1141 hot air tip (not cheap) and 100x PLCC32 SMT sockets (cheap) today to get the Intel chips off the board. Now continuing the waiting game

I really hope I don't end up soldering 100 of these!

[antus]

Ive just updated the descrambler tool near the start of the thread to take in to account the highest bit (using a 1:1 mapping) as I found without it I could not run it twice on one of your images to scramble and get back to the original file. Thats now fixed. Of course even though its a 16 bit CPU, the 17th address bit is still used when addressing the top 64k.

I tried this fixed version on the original scrambled bin in this thread, and now the output passes has differing high bank after descrambling AND the checksum test passes on the output!

I can see that 10000->17FFF just contains 0xFF, not a copy of 0000->7FFFF. That'll keep things simple...

Ive put a new good copy of that bin, here:

[quadstar87]

Just a bunch of dis-assemblin' and XDF creation going on over here. No exciting updates until a soldering party on Friday hopefully.

[quadstar87]

A lot of work happened today!

Got three of the bricked PCM's soldered Thanks to good old friends with weird tools!

The de-solder worked best at 300*C with the Hakko PLCC32 nozzle and we put the sockets on at the max rating in their data sheet....260*C with the straight nozzle down the center. And man does the conformal coating on these suck!!

Now the next hurdle: I got the intel fboot flash utility and my old NIC card to write the scrambled .bin's back onto the chips directly, but upon reading them back, the files don't match. I have no idea why but i'm going to assume I need a correct chip writer to proceed...or the chips were damaged in de-soldering even though they appear to erase/write properly.

[antus]

Awesome work there!

Can you post up a read of a chip from a working pcm, one of your bins your writing, and a read back of what ended up on a non-working chip?

[quadstar87]

Awesome work there!

Can you post up a read of a chip from a working pcm, one of your bins your writing, and a read back of what ended up on a non-working chip?

Edit--> I'm going to clean up all the chip legs again and re-visit this when I have a chance this weekend. I'm thinking some conformal coat crap may still be messing up the process. Two of the chips we de-soldered won't write successfully and the one that does is dumping an invalid file.

It is interesting that the file dump off two of the de-soldered chips has some good data when de-scrambled, but unfortunately they are now at least half-wiped because the cheapo Intel flash utility goes to town on them

Here's two of the stock chip reads that I'm assuming were botched by the Intel utility or some crap on the pins. It's sort of valid because they de-scramble to some extent.

[quadstar87]

I double checked that the chips are clean and still no dice. Looks like the cheapo flash setup isn't going to cut it so I need to borrow or buy a good flasher that'll do these. Stay tuned!

[Tazzi]

Looks like an absolute weapon of a tool your using for desoldering!. Wow!

[quadstar87]

Looks like an absolute weapon of a tool your using for desoldering!. Wow!

Just a off-brand hot air station and the board is sitting atop a 1/4" aluminum plate that has an electric stove-top element controlled by a thermostatic 120v power supply via the thermocouple you see in the plate. It's good to know people that have these things! I supplied the plcc32 de-solder tip which was invaluable for not damaging the board/pads.

And now we know the process to replicate quickly if needed. Could solder new chips directly back on without sockets also if needed to un-brick (once the chip flashing is sorted out)

[ejukated]

Just curious, what temp is the plate and why is it required