PS3 Uart Guide V2
PS3 Uart Guide V2
Disclaimer:
I can not be held responsible for any damage made to you ps3
motherboard or issues that occur when following this guide! - At
owners own risk!
Why do this?
• Diagnose YLOD issues commonly found on these old PS3 boards
• Adjust default fan speed policies
• Understand the workings of this machine
• Many other good reasons..
PS3 Motherboards
SYSCON Tutorial
Required equipment
• 1x USB to TTL v3.3 Serial Converter Cable
• 4x AWG 30 single core wire (keep length short)
• Soldering iron and solder
• Wire cutters
• Electrical tape (for insulation afterwards)
These jumper leads will need to be cut and stripped on one end to solder onto the motherboards
points.
This guide will be using an Ubuntu OS to action the commands – Any OS can be used as it just
requires Python 2 or 3 and the supplied ‘Linux/ps3_syscon_uart_script.py’ and serial terminal
program to work.
This help will show you the options. So to explain each option:
<serial port> = “/dev/ttyUSB0” - serial device to use to connect to
<sc type> = The SYSCON mode to use:
CXR (57600 baud rate) will be External command mode
CXRF (15200 baud rate) will be Internal command mode – activated by shorting the DIAG
jumper cable to the GND pin and clearing offset 0x3961 01 to 00 from FF
The following tables will show you what commands are available for each mode:
If the commands dont work they most likely need a patch to make them work!
External commands
Internal commands
Now that the commands are established lets start getting the PS3 into the correct mode:
Note: Not all boards have external mode, the default mode is internal mode but patched to
prevent access from sony.
Without grounding the DIAG lead the default mode is ‘external mode’
1. Before switching on the PS3, make sure the USB TTL lead is connected – Rxd, Txd and
GND
2. Turn on the PS3, and open up a terminal shell
3. Execute the python script - ‘./ps3_syscon_uart_script.py /dev/ttyUSB0 CXR’
4. Some commands can be used with requiring the higher privilege mode (auth) and a patched
syscon based on your model of board!
An error on the terminal ‘F000005’ will show saying that you have not authenticated
(decrypted master key and signed in).
5. To sign in you need to ‘auth’, then run those higher privilege commands, for example:
> AUTH
> Auth successful
If you get ‘Auth1 response invalid’, swap the RX and TX
wires!, if same check wiring and connection.
Make sure to exit script, switch off PS3 and back on again,
then load the script again!
6. Now you can run high level commands – EEP SET
Now that the diag pin is grounded we can turn the PS3 on.
PLEASE NOTE: The standby led will flash red repeatly and will not
turn on – This is normal as now we need to check the eeprom
checksum and fix it
As you can see from this table F and E is misaligned (02) and
needs to be corrected to fix the checksum.
Now we set the correct checksum using the write command (w)
(byte):
> w 39FE 38 00
Remember we are doing the swap as its an endian byte swap.
> eepcsum
eepcsum
Addr:0x000032fe should be 0x528c
Addr:0x000034fe should be 0x7115
Addr:0x000039fe should be 0x0038
Addr:0x00003dfe should be 0x00ff
Addr:0x00003ffe should be 0x00ff
As you can see the sum value is missing meaning that the table is
correct
sum:0x0100
r 3900 100
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
-----------------------------------------------
FF BF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
31 40 11 FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF 00 FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
02 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF 38
Note: if the value has an extended ffff, then just ignore that and
use the last 4 digit values – remember to swap them as endian.
eepcsum
Addr:0x000032fe should be 0x1596
sum:0xf812
Addr:0x000034fe should be 0xffff3aee
Addr:0x000039fe should be 0x7360
Addr:0x00003dfe should be 0x00ff
Addr:0x00003ffe should be 0x00ff
errlog – Show full error log (this example shows issues with the
RSX chip)
ofst[ 48]:err_code:0xffffffff, clock:0x211a31c0 2017/08/06
20:00:00
ofst[ 52]:err_code:0xa0404412, clock:0x211ba360 2017/08/07
22:17:04
ofst[ 56]:err_code:0xa0403034, clock:0x211ba361 2017/08/07
22:17:05
ofst[ 60]:err_code:0xa0404412, clock:0x211f92e6 2017/08/10
21:55:50
ofst[ 64]:err_code:0xa0403034, clock:0x211f92e6 2017/08/10
21:55:50
ofst[ 68]:err_code:0xa0404412, clock:0x24da1cd0 2019/08/04
22:46:40
ofst[ 72]:err_code:0xa0403034, clock:0x24da1cd0 2019/08/04
22:46:40
ofst[ 76]:err_code:0xa0404412, clock:0x24da1cda 2019/08/04
22:46:50
ofst[ 80]:err_code:0xa0403034, clock:0x24da1cda 2019/08/04
22:46:50
ofst[ 84]:err_code:0xa0404412, clock:0x24f32fd9 2019/08/23
23:14:33
ofst[ 88]:err_code:0xa0403034, clock:0x24f32fd9 2019/08/23
23:14:33
ofst[ 92]:err_code:0xa0404412, clock:0x24f33013 2019/08/23
23:15:31
ofst[ 96]:err_code:0xa0403034, clock:0x24f33013 2019/08/23
w – Write to eeprom
w 34fe d5 e5
w complete!
There are many more commands, but the examples are the most useful