CurtPalme.com Home Theater Forum

CIR Engineering · Posted: Tue Oct 05, 2010 5:42 pm Post subject:

CIR Engineering · Posted: Tue Oct 05, 2010 5:52 pm Post subject:

RogueChili · Joined: 31 Mar 2008 Posts: 162 Location: Westfield, MA

HaydnG90 · Joined: 22 May 2006 Posts: 1356

[quote="CIR Engineering"]

skittletop · Joined: 24 Nov 2007 Posts: 19

At this year's 27C3 hacker festival, there was a very informative presentation on reverse engineering of the MOS 6502 CPU. Dwarfed only by, ironically, the Sony PS3 security fail0verflow scandal.

http://www.youtube.com/watch?v=HW9AWBFH1sA
http://www.youtube.com/watch?v=bBE4KHKzhKc
http://www.youtube.com/watch?v=tRBo7O_blVo
http://www.youtube.com/watch?v=H_15RtVbqGU
http://www.youtube.com/watch?v=N9DYmlprCKA
http://www.youtube.com/watch?v=eZOUuqc4pk8

Skip to part 3 (7:00) for relevance to this thread - Lack of good tech spec docs of the 6502, leads to high rez photograpy of the silicon (exposing it looks quite tricky though Smile

), running image recognition software to determine circuit patterns, and creating an identical simulator. Then potentially, baking the results back to an FPGA. Awesome!

Not sure if this is entirely relevant here, but still, it's an interesting talk Smile

HaydnG90 · Joined: 22 May 2006 Posts: 1356

Just read Tim's interesting post on AVS

"While the chip is no longer available from Sony, a friend of mine managed to get a replacement from http://www.cleverworldnet.com/jp/?m=...el=CXD305-127R

Although the site is not in English, he was somehow able to communicate with them. There are also probably some Sony repair shops that probably still have some, but since I no longer do any work I really haven't checked. I certainly wouldn't consider the projector "dead forever" though.

The extra numbers are the run and date codes, which should make no difference."

Can anyone confirm this chip works. Would some G90 specific coding have to be downloaded onto the chip?

Nashou66 · Joined: 12 Jan 2007 Posts: 16171 Location: West Seneca NY

here is that sites E-Mail

dealer@cleverworldnet.com

Athanasios

CIR Engineering · Posted: Mon Jun 06, 2011 7:16 am Post subject:

Where is this discussion on AVS? Where are you guys getting this info?

craigr

dochlywd · Posted: Mon Jun 06, 2011 12:00 pm Post subject:

Here you go:

http://www.avsforum.com/avs-vb/showthread.php?p=20526558#post20526558

Now put this damn chip issue to rest once and for all!!!!

Doc

draganm · Joined: 08 Mar 2006 Posts: 8990 Location: Colorado

CIR Engineering · Posted: Mon Jun 06, 2011 4:16 pm Post subject:

richardc · Joined: 13 Feb 2008 Posts: 32 Location: Australia

Craig
Did you get a response from cleverworld on that chip, I flicked them an e-mail and got no response.
Richard

CIR Engineering · Posted: Sun Jun 19, 2011 11:51 am Post subject:

no

**Curt Palme** · Posted: Sun Jun 19, 2011 2:13 pm Post subject:

Me neither.

macgyver655 · Joined: 22 Aug 2007 Posts: 8508

I think some of you guys are hoping that there is some electronics supply place somewhere that has a box of these chips sitting on a shelf collecting dust. and don't know their value.

It's nice to have wishful thinking.... Laughing

I exhausted my search a year or 2 ago. As some of you know, I can usually find or cross almost any part you need. I'd give it @ a 99% rate. The 1% is dedicated to this chip or a cross for it.

"Sony is a DICK"

macgyver655 · Joined: 22 Aug 2007 Posts: 8508

Just thought I would also post this here in case the other thread got lost. Just to keep this thread updated.

Over the years and after many various tests I have a theory as to what is going on with ic421. It’s only theory because final testing and conclusion has not been done because I have lost interest in finding a solution and I also don’t think a solution is even needed at this point. But I thought I would post my findings and theory in case someone else may want to take it further.

First to look at the background testing. When you look at the image you see it jumping around along with changes in brightness and no apparent control. Now this is 1 clue but I’ll get into why later on when putting the clues together.

Now we know the problem is definitely in the chip itself since changing just the chip resolves the problem.

So to start testing I first removed power to the chip. This stops all shaking and brightness changes but as such also no control. This tells you the chip is still powering up and acknowledging but not properly.

Returning power back to chip and then removing data memory feeds HWR and LWR shaking again stops. This concludes that the chip is acknowledging data inputs and reacting to them but just not properly.

Removing chip enable also stops shaking which again indicates the chip is trying to function.

My next thought was the clock signal. Now we know the clock signal itself is good since changing the chip fixes it. But maybe the chip changes some how and doesn’t like the original clock frequency. So I experimented with supplying a different 20mhz signal source and then also changing the frequency going both up and down at various frequencies and this yielded “NO CHANGE”. So it’s not a clock issue.

Now testing the outputs would yield no information since we know the outputs ARE functioning since we are seeing changes on screen.

So what can we conclude at this point? We can conclude that the chip itself is not bad. A bad chip will, 1) pull supply power down, or 2) run extremely hot, or 3) not function at all. We know it’s turning on, we know its acknowledging incoming data and we know it is outputting data. It’s just not doing it properly.

So my next round of testing was to see if I could successfully read and/or write to the chip via its JTAG port. So I connected it to a PC and used an external power supply and tried various JTAGing software. After a few different software tries I hit one that gave me a read. However the data did not look correct. So I read it again and got a different read. My first thoughts were that I may be getting a phantom read so I remove power to the chip and did a read again, this time getting all F’s, which would mean a blank read. Powering the chip again gave me a different read again. This is another clue which I will also address later when putting the clues together. I then attempted to write to the chip but was a no go. So every read after that gave me a different code, every time.

So now we go back to the image itself. If you pull up a menu and watch the image you see that the image is not really shaking but rather the geometry, convergence and G2 is constantly changing. If you watch further you can see the changes are consistent and even more so, a cycle. You can pick any starting point and it will eventually return to that point and continue again and again to that point.

Keeping this in mind and the various jtag reads brings me to my conclusion.

The chip is LOOPED.

Some of you Sat guys from 10-15 years ago just went AH HA!

The chip is functioning but in a loop cycle. Which would also explain the different data reads.

Now a loop error is caused by an error in the chips firmware which can be triggered in different ways. And it would make since that it would happen early on in its life. Those that are still working of this serial code probably haven’t been triggered yet.

So why don’t the newer serial number chips have this problem. My guess is that Sony found out about this firmware glitch and rewrote the firmware for the newer chips. We know the chip is the same since it carries the same part number. If there were a change in the manufacture of the chip it would carry a different ending part number.

So can anything be done for the chips that don’t function properly? Well if you look back at those Sat days there was a device that could be connected to the looped chip, called an unlooper. It was also connected to a PC and special software was used to send various signals at the chip to try to get it to pause in its looping cycle just long enough to write a line of code that would stop the loop. The chip would then just be idle and a new code could be written to it and returning it to normal function.

So my next testing would have been to connect an unlooper and try some various software’s to see if the loop cycle could be broken and then just write all F’s to it. This would make it a blank chip. I would then try to make a minor change to the F code and write it to the chip and see if it would accept the write.

If this was successful then now it would just be a matter of getting a good read off a newer chip, which would be a simple 1,2,3 step. And then write this new code to the old chip.

Well that’s my theory but as I said I have no desire to continue. But if anyone else wants to delve into it I would gladly give my input along the way.

Well hope you enjoyed the read.

https://www.curtpalme.com/forum_archived/viewtopic.php@t=32362.html

_________________

HaydnG90 · Joined: 22 May 2006 Posts: 1356

Wow, this thread brings back some unpleasant memories. Glad this is all behind me.

mc86 · Posted: Fri Oct 26, 2012 11:26 am Post subject:

Mac, that was a cool window into how you troubleshoot. I always find it neat to listen and try to appreciate experts in just about any field. matt

cmjohnson · Joined: 03 Apr 2006 Posts: 5180 Location: Buried under G90s

Since I just got a G90 I figure that I should read through it and bookmark it for future reference.

I haven't yet powered up my G90 because first order of business was to replace a broken tube, so I don't even know if my G90 has
any IC421 issues or not yet.

But, going back to the most recent theories advanced, Macgyver, or anyone else who might know, would it be possible to read out
the program in a "good" 421 chip and reprogram a "bad" one with the good data? Or aree these write once PROMs?

HaydnG90 · Joined: 22 May 2006 Posts: 1356

Chips are proprietary to Sony and cannot be read and the files rewritten to a 'good' chip. The only realistic fix is to replace the YA board or if you have the equipment, replace the chip (no easy task).

If your set has over 2K hours you should be OK even if you have a chip with the SN that has the defect.