I bought a broken switch on ebay which can boot to RCM, I have tried to inject several payload to see what is wrong with it and here is what I found:
Hekate 5.6.5 and 4.0 just shows a black screen (with or without SD). Hekate 3.0 launches (I guess it is because there is no data required in the SD) and when I try to get the SD info I get the following error: [FATFS] no FAT/FAT32/exFAT found. If I remove the SD card, it simply displays “no FAT32 found”. Before jumping to the conclusion that my SD is badly formatted, I have tested the SD and the SD card reader on another switch and they are fine and the SD contains the latest version of hekate.
Memloaderv3 reads the .ini files inside the SD but when I try to read any memory (SD, EMMC, BOOT0 or BOOT1) it gets stuck on “read 192 bytes from ‘ums_sd.ini’, parsing…”
Biskeydumpv9 shows: SBK & TSEC keys NOT VALID!
Is there a way to investigate further what is causing this issue (RAM, SD, SoC)? Thank you in advance
I’d suggest your next port of call is to check your RAM. Reflow first - RAM, then CPU and then replace RAM if that doesn’t work. You need to know what you are doing as repeated CPU reflow using home tools will damage the epoxy around the die.
Using the latest version of TegraRcmGUI I get a different error when trying to launch memloaderv3 for reading whatever memory. I get the error: Error during lzma decompression, got 0 instead of 4294967295 bytes out!
Unfortunately not. I did have a conversation with the developer of Hekate about developing a memory stresser, however he was too occupied on other projects to have the capacity to do it.
The RAM is striped rather than one chip doing lower RAM and the other doing upper RAM. This is typical for a memory controller as they can push higher bandwidth by controlling both chips in parallel.
Depending on where the memory failure is (in most cases it’s damaged balls, not a damaged chip) will drive the failure mode. Nintendo’s Horizon OS has a pretty aggressive memory trainer that triggers a BSOD if it finds any discrepancy at all. If you have an unpatched unit, payloads can help give you a bit more of a clue. I’ve had black-screen on RCM boot, corrupted text on the text mode portion, graphical corruption in the graphical Hekate UI and then some cases where I’m unable to launch OFW/CFW - black screen after the logo. Remember when you are using the RCM utilities, you are actually running on the boot processor, so memory management is pretty basic and much more tolerant of problem RAM. That’s why you can quite often get into Hekate but can’t get further with a memory issue.
Bit of a long answer, but hopefully useful context.
Anyone with the skills to write a RAM trainer that could output results to the screen?
If the unit is unpatched, one way to narrow the specific Ram IC is to load up the Biskeydump payload, you’ll likely see screen artifcacts, if yes, if you apply slight pressure to each ram IC and see which one resolves or alters the graphical artifacts then you’ll have your culprit… that all being said, if one is bad then the other is likely going to follow suit at some point in time so it’s best to reflow/reball both.
I do not see any artifacts in Biskeydump. I guess the data in the SD is copied into memory, that is why Hekate 5.6.5 and all the Hekate versions which need SD files do not launch. I do not think it is the reading of the SD card itself since memloaderv3 can access its content. However, It is weird that Hekate 3.0 recognizes the SD card but cannot read its format. But, I am not sure if that is related to the FW version though. I will let you know once I do the reflow. Thank you for your help, it is really appreciated.
I see, it might be worthwhile applying pressure and seeing if doing so causes artifacts while the Biskeydump payload is loaded and/or trying out the other Hekate versions with the files on the SD, I’ve had cases where the smaller versions will load on boards like this with GUI
You could also try putting very light pressure on the SoC and see if the SD related issues resolve while doings so
Though given the symptoms this is making me lean more towards a potential SoC/joint issue, for sure I would attempt a ram reflow first before anything else
I missed this but this part concerns me, is it possible somebody has swapped another consoles EMMC onto this board? If the text only mode of Hekate works do the EMMC partitions show up?
After printing the info it just freezes and I have to reboot. Regarding the reading of the SD I managed to run Hekate 5.1.0 without SD and eMMC and if I plug the sd in after it launched and I print the SD info I get this.
I tried applying pressure on the first RAM (the one closer to the USB) when injecting Hekate 5.2, and I noticed that when I press it Hekate does not launch. So I guess that is the faulty RAM bank. For the reflow I normally use an preheater at 220C and a hot air station slowly increasing the temperature until I can lightly push the IC with my tweezers. I then push from all the corners of the IC. Is that the right way to do a reflow?
It could be, or an additional fault ontop of another, the SD issues, possible EMMC issues are pointing more towards SoC though I would start with reflowing Ram to start with just in case
Preheater isn’t really needed on these lower mass boards, if you really want to use it then I would set the preeater to only 100C, I would reflow both Ram ICs as a matter of course. you don’t need to touch all four corners, just add flux around the edges bring up to reflow, tap one corner when you see it move give it an additional 5/10 secs of heat from your hot air
I have done the reflow but did not get any improvement. Like before, some versions of hekate run, others do not. The only weird case is the Hekate version 5.6.3 that runs without SD but after I press a key, it shows the menu for 1/2 seconds and then turns off.
I have check the 1.8v and 3.3v when the sd is connected and I do not have any of them when the SD is connected and lockpick_rcm is running. I have tested on another switch and I have both of them. These 2 rails for the SD are generated by P13USB right?
though I would start with reflowing Ram to start with just in case