McPX Pictures

[codeasm]

here is a list of all (rare) MCPX ic I know off:

• MCP X-mode 2
• MCP X2 (DVT3)
• MCPX X2 (found in DVT4 and Sega Chihiro)
• MCPX X3
• MCPX X3P (not sure, but my latest notes state I found some info on this

N64freak picture, repairing a Sega Chihiro (google this if you think "sega?")

N64 Freak in this thread on Assemblergames has also did some amazing soldering things :https://assemblergames.com/threads/what-is-the-diference-between-the-mcpx-chips-big-images.41069/#post-952246

[EDIT} from N64freak I now understand the SMC might not need to be swapped, so you can ignore the rest of this post below.
From various sources I know that if you would replace a X3 with a X2, you should swap the SMC ic to a matching set aswell (so just ordering X2 from china doesnt work?) I dont know if an MCP X2 is requireing its own SMC against X2. Those are even more rare, All retail have some kind of X3, but revisions where made. altho MS did a big fix and forced Nvidia to scap alott of mcpx, Nvidia disliked Microsoft verymuch after that. so MS couldnt that easely make newer Silicon designs after the 1.6 design.
 

Edited December 29, 2017 by codeasm
New information from N64Freak

[neighbor]

hey bud, do you still have the images which disappeared from this deleted thread?
https://web.archive.org/web/20141109112845/https://assemblergames.com/forums/showthread.php?7221-Prototype-XBOX-Motherboard-HD-Combo

 

Quote

There are other differences that you can see and others that you cannot (like CPU and GPU clock speeds)

this particular string looks captivating.

Edited March 10, 2019 by neighbor

[codeasm]

On 3/10/2019 at 6:45 AM, neighbor said:

hey bud, do you still have the images which disappeared from this deleted thread?
https://web.archive.org/web/20141109112845/https://assemblergames.com/forums/showthread.php?7221-Prototype-XBOX-Motherboard-HD-Combo

 

this particular string looks captivating.

I think this is the only picture I have currently. it might be from the new owner but I dont see a battery, so it might have been a diferent revision then the one in said topic.

[neighbor]

24 minutes ago, codeasm said:

I think this is the only picture I have currently

thank you for the pic, looks like there is a tiny connector near the Etherner port, if I'm not wrong. What can that be?

[codeasm]

On 7/1/2019 at 10:56 PM, neighbor said:

thank you for the pic, looks like there is a tiny connector near the Etherner port, if I'm not wrong. What can that be?

The 5th USB port from the MCPX, its no longer routed out from the mcpx on later revisions of the board. I cant find the pictures the new owner took for us to verify they truly go to (or the 2 datalines that is) to the mcpx. a leaked datasheet confirmed a 5th pair of datalines on the pinout.

FOund 3 images fromthis thread from when the last 4 where lost. check em. first was the full shot, the behind (Jtag port in the red box) and 3th was the closeup of the battery. I dont seem to have the later 4 here. grabbed a backup disk for other backup purposes and went looking anyway.
Jtag confirmed too btw, we traced the underside to the cpu, on retail the bga pin on the cpu is directly tied to ground, disableing jtag and only if you desolder the cpu, youd be able to "unground" the "disable" jtag pin. the other jtag pins are routed out to this connector. My personal believe is that each signal is paired with a ground pin. maybe some other debugging pins are there aswell, but could see that in those pictures. maybe they where shared on discord.
 

[neighbor]

17 hours ago, codeasm said:

Jtag confirmed too btw, we traced the underside to the cpu, on retail the bga pin on the cpu is directly tied to ground, disableing jtag and only if you desolder the cpu, youd be able to "unground" the "disable" jtag pin.

This is sick, I think I can play with that for scientific purposes, is there any profit the JTAG port gives? Is there a pinout available?

[codeasm]

On 7/6/2019 at 9:57 AM, neighbor said:

This is sick, I think I can play with that for scientific purposes, is there any profit the JTAG port gives? Is there a pinout available?

I love the entusiasm. Go check Bunnie Huangs old blogpost about Jtag: http://www.xenatera.com/bunnie/proj/anatak/xboxmod.html
come back to us when you enabled the jtag machine. (dont think you will, N64freak might make a breakoutboard someday to do it, but only because we are curious)

basicly you have to read: https://en.wikipedia.org/wiki/JTAG 

And thus, yeah sure, with it enabled you can start, stop, read all parts on the bus. IF you have the right bitstream to send (commands) on the jtag bus. for the CPU it might be posible to figure out how to do so, but the MCPX is Nvidia/AMD stuff and we dont know alott about it, im not even sure if its on the Jtag bus. you could theoreticly power the xbox, but keep everything in reset and then start the mcpx, poke it with some commands to expose the internal rom and download it that way. (both mcpx 1.0 and 1,1 are already dumped in diferent ways).
You can debug on a lower hardware level your xbox (yay, so much fun to poke at CPU registers, undocumented Video encoder registers and reset the SMC and be sad.)

Jtag is a awesome bus for hardware and maybe software debugging. for software it might be too slow tho. MS used it for their CPU I think, when done, they ofcourse added a serial port (check Devkit behind pictures) for Kernel debugging and they ofcourse have XBDM that will help with normal software debugging over the network. faster and less noisy for whoever got to debug something.

Im not saying its imposible, but its harder, you need the right Jtag adapter (as in, interface for your PC to talk Jtag) the pinout is easy, most pins where ground, and 5 or 6 pins for the protocol. BUT

You kinda need to know or learn wich IC is where on the bus, how to talk to them and make sense of the busses reply. without official configs, it will be hours, if not days of work. for what?
There are plenty of ways to dump required files (kernel, mcpx rom, eeprom, harddisk stuff, secret keys in ram) and all are far easier, as you dont need to desolder the CPU to fix that Permanent reset line and solder the cpu back.

Now if you where to redesign the motherboard, design your own and repurpose some components, then sure, go ahead. But even I, with 3 jtag programmers, jtag programmed and debuged a router and a RISCV board. (still a noob tho), I dont see why I need a working jtag on my xbox. Im sure I can get whatever I need in a way simpler way. Mcpx rom I would love to caputure myself, I rather look at one of those 2BL exploits and add a tsop mod or modchip than to fix jtag.
Waay too much text for anyone to read, but I would like to inform you, I love jtag, I hate jtag. Its an awesome debugging bus. But if a company disabled it in someway. consider your plan of attack. Nothing is impossible, everything can break.

for the curious, image is taken from bunnies blog.

Edited August 2, 2019 by codeasm
Added image

[neighbor]

this doesn't look complicated to perform, the problem is - I will not at home for a long time. When I'll be back, will perform this.

Edited August 2, 2019 by neighbor

[neighbor]

3 hours ago, codeasm said:

Im not saying its imposible, but its harder, you need the right Jtag adapter (as in, interface for your PC to talk Jtag) the pinout is easy, most pins where ground, and 5 or 6 pins for the protocol.

I remember trying to cut the theoretical Firewire lines from ground on PS2 Slim 70000, but they all were tied to the GND, even on IOP chip itself.

[codeasm]

If you can do hotair, remove the CPU, cut the ground line, maybe add a wire somehow to get that reset line out there if required and somehow solder back the CPU, you might have enabled the JTAG interface.

Please share the Jtag config files if your in luck.