I have a switch with RCM vulnerability. It has a strange problem.
That is, after the system is upgraded to 13.2.1 or above, it will not be able to boot.
Press the power button directly, the machine has no display at all, and it is not in RCM mode (cannot be injected). You must press and hold the power button to shut down, and then enter RCM mode.
Use RCM to inject hekate, and then start the stock, the system will start normally, everything works normally, and the machine is not banned.
I found the problem: using Hekate to check the number of fuse blown, it stopped at 15. Whether using the official upgrade, or offline upgrade to 13.2.1, 14.1.2, 15.0.1, the fuse will not become 16 or 17!
Therefore, the fuse check of the official system will make the machine unable to start.
But this machine can be used completely normally if autorcm is turned on. It’s just that after upgrading to a higher version system, it cannot be turned on in the normal way. It can also boot normally after downgrading.
I tried re-flashing the full system, it didn’t work. I even bought a new EMMC, used the computer to rebuild all partitions, restored the biskey and flashed the complete emmc data. Still doesn’t work.
I personally don’t think it will be a problem with emmc and the data in it. I’m guessing it might be a cpu manufacturing defect.
Has anyone encountered such a problem? Is there any workaround? thanks.
Hey,
Yeah I’ve seen this problem before but take what I’m about to say with a pinch of salt as this was a long time ago and I could well be confusing two cases or just simply be misremembering certain info.
So afair remember my case was a board which had a memory related issue, one of the ram modules was faulty, I pulled some off a donor and reballed them and stuck them on the patient, I found it would now boot via Hekate (bypassing the fuses) but refused to book stock standard without. As like in your case the fuses refused to blow during update. The difference between my case and yours is I’m pretty sure my board/SoC was a patched unit and I had to do this whole rigmarole with the SX modchip. I later observed that the original memory on my patient was a Hynix brand and I had swapped it for Samsung… further investigation showed that Hekate was reporting the stats of my Memory in one case correctly and in a second case incorrectly, so either it’s getting one part of it’s info from the SoC based on fuses or from the EMMC and the other piece of info from the Ram directly… basically speaking it seems the SoC is tied to the specific brand of manufacturer of memory for timing related reasons / memory training etc…
So my assumption at the time was this was this issue. For whatever reason the SKHynix variant Ram seems to be far rarer and not a single other donor of mine had one so a friend sent me some from his donor board and I reballed yet again… unfortunately…My SX modchip decided to die inbetween all this (for unrelated reasons) so I was never able to get this unit back into Hekate (and inturn the OS) to update the system to the correct fuse count and i don’t believe i can do it “offline” using Choi as the OS version was too high.
So the conclusion is, I suspect the Ram was the issue in my case, so it might be worth seeing if you can see any signs of Ram rework and also looking at the Hekate stats page (sorry i foget which page specifically) and see if there is a mismatch of info, for example it’s reporting Samsung in one section or Hynix (or whatever brand) in another. It’s also completely possible there is other ext IC’s which are also fused which could potentially be at fault preventing the update fuses from burning and also somewhat likely too is a line tto/from the SoC or Ram is open or on a deeper level just plain at fault internally within the IC/s
Thanks a lot for your detailed explanation!
On my machine, I use hekate to view ram information and it has always been completely normal. And operations including playing games are completely normal.
So I gave up researching this machine. After all, it’s enough to use autorcm~ hahaha
Ditto. Same here.
Fuses @ 16 (3.2.1 to 4.1.2) so only those OFW will boot wo RCM. System update from there installs latest OFW (18.0.0 as of now) and won’t boot wo RCM and doesn’t burn the fuses.
Just fixed this. Reflowed SOC + DRAM. OFM booted up without RCM, eFuse count matches OFM (18.0.0)
Blowing eFuse probably require higher voltage/current somewhere in SOC to work (An EE probably can better explain). I guess this old V1 bad some cracked SOC balls.
If someone has the Erista pinout, I’m curious if multiple balls (more current) are used to suppose eFuse burning…
For example, most logic chips that draws reasonable power has tons of voltage rail and ground balls to supply the necessary current and distribute voltage evenly to all corners of the die.
One note for future reflow attempts on switch SOC. This is a big SOC relative to the board size and thickness. Do NOT try to melt all the SOC balls and gentle bump the SOC without good experience and a pre-heater. Likely very easy to warp the board in relation to the SOC BGA balls It won’t be visible to the eye but will create more problems with some balls likely not making good contact due to microscopic bend.
I have a pro quality hot air station but was too lazy to setup the pre-heater. While I fixed the efuse issue, I created 2 other issues (frequent random hang, flaky dock TV HDMI connection)
For those without high experience, its actually better to put the board in a toaster oven and bake @ 400F for 6-7min. I did this to repair the problems I created with hot air w/o pre-heater. This is actually 2nd time I’ve baked this logic board. First time was also reflow repair of either SOC or WiFi a few years back. Note if you use toaster oven, I ball up aluminum foil as stands… you’d want to be careful where to put the stands (not much room on this board) to avoid pulling/push off tiny components as board heats up.
I realize the pros would advise against toaster oven but it is better than inexperienced at using hot air station on relatively large BGAs on a thin and small logic board.
True, but the use of a toaster oven also has it’s issues, some which you won’t see immediately. Back in the day of PS3 and 360 YLOD and RROD a whole industry sprung up where these guys would bake the hell out of the boards either in an oven or like in your case a toaster oven, little did they know they were simply alleviating the issue but not actually solving the root cause, especially given half these guys weren’t even bringing the boards up to a reflow state. That coupled with the fact they weren’t using proper reflow profiles and a whole host of other problems meant the boards died once again in a short period of time, and often irreparable after the fact as a result.
In your case, given your setting your oven to only 400F (204C) and even if we take into account a swing of 10C due to thermostat inaccuracies, you’d still barely be at a true reflow temp of lead free solder which can be upwards of 235C, with a true profile after initial ramp, you’d wanna go a fair bit over this for a short period of time before ramping down 
unless of course you’d reballed prior with leaded solder, in which case 400F would be about right
So, just to say, I’d advise no one to do this 
practice your hot air skills I have faith in you. If I can do it with a crappy 18 quid fan in handle hot air station and no preheater then you can do it 
Indeed. Actually completely agreed with everything you said. Heat profiles etc. I actually turned up to 425 for 2min before the end haha. Poor man’s heating profile.
And yes past attempts on 2015 era tv main boards that’s runs big BGAs super hot doesn’t last. But for some reason last bake on this switch board lasted a few years. I think a lot to do with board size / bga size. And actually still working except blowing efuses on an update. Perhaps my hot air reflow followed by oven bake ( which probably unwarped the bga / board plane) will last (ideally don’t want to apply so much heat to a board of course) Don’t know but was just surprised so limited application of likely not as even hot air heat created 2x additional problems on this board.
But yeah. Nothing is better than good hot air skills. And leaded reball capability is the most robust fix if have that skill / equipment.
Impressive you can do it with cheap hot air and no pre heater