Discovery on locked barton. How to Exploit ???

Printable View

11-17-2003, 04:19 PM
YoupY

Discovery on locked barton. How to Exploit ???

Hey guys,

I've just got an locked barton and made a discovery on it. Something is different than the unlocked ones.

I'm not sure if the thingies on top of the proc are resistors or elco's but there is a difference in them. I always thought they were elco's but since I can measure them in Ohm I'm not sure anymore.

On a unlocked barton I measure 9.3 Ohms through those resistors. This value is the same for all the resistors except the one circeled in red. That one has no resistance at all.

Then I took a locked barton and measured this again. And I saw an maybe important differance. The value of all the resistors is 23.2 Ohm, except for the one in red. This one also has nog resistance, but the one in yellow is different. On the unlocked proc this one has a value of 9.3 Ohm. On the locked proc I can't measure a value anymore.

http://members.home.nl/youpy/amdbarton.jpg

Please dont mind the pcb in the pic. This is still one from an old proc and still has a resistor / capacitator on the left side of the core, but imagine it isn't there :cool:

Now the big question is: is there any way to exploit this!!!
11-17-2003, 05:58 PM
Vlad Draculea

i am too dense tonight but it seems i am just going to remain dense forever
11-17-2003, 09:24 PM
k1114

My first reaction would be that we should pencil in the bridge until it gets down to 9.3 or lower
11-18-2003, 03:13 AM
Vlad Draculea

i have slept a bit so now i can continue being dense as hydralgirium.
11-18-2003, 06:59 AM
YoupY

Then the question is, which one should I pencil in? All of them?? I think not, because in comparison to the unlocked barton only one thing is realy different, (except for the other values) and that is the resistor? / capacitator? circled in yellow.

This morning I took a quick look at the traces on the proc en it seemed like they go from the one circeled in yellow to the L1 bridges. However to be sure I'll have to take a closer and longer lo look, since I was rushing to work this morning.

But if it is true, then the L1 bridges are not closed, since there isn't a resistance mearurable on the resistor circeled in yellow. A way to unlock the proc again could be as simple as pencilling that resistor to a value of 23 ohms (like the other ones on the proc) except if the values of the other resistors drop, due the pencilling
11-18-2003, 07:34 AM
Vlad Draculea

dont ask me questions i told you all that i am too dense. AND A SPAMMER
11-18-2003, 07:45 AM
celemine1Gig

You better try that on a locked Duron Applebred instead of a Barton, because if you screw up, your loss will be only one third in comparison to the barton.:2cents: :toast:
11-18-2003, 11:45 AM
YoupY

I just took a closer look at the traces that are on the proc near the resistor, but I'm not sure if they really go to the L1 bridges. Since I don't have a magnifiyng glass I'm not sure if the traces go there. It would be nice if someone could post a realy high res pic of a barton.

Before I will try to pencil the thingie I would be nice if I know what that thingie is meant to do. For now I still believe that the resistor circeled in yellow is a clue to unlocking the barton. Probally pencilling it will work, but before I'll give it a try, I will study the 104 page datasheet of the Barton, so that I know what I'm doing, so I wont kill more hardware this year. I have allready killed a lot this year :(

If anyone wants to go Xtreme and give it a try, I wish you luck, because pencilling may do the trick, since it's one of few differences that exist between a locked en unlocked proc, but don't hold me responsible if you blow up a proc.

EDIT::
Never mind the idea. I measured through the proc again, but I just saw completly different values than yesterday. Even on both the places I circeled there I a resistance now :(

So the thingies must be capacitators after all. I just held the multimeter on one of those for five minutes and I saw dropping the restistance very slowly. However I find it strange that I couldn't measure a value yesterday and I can now. What was happening :confused:, sorry guys

But there is still one difference. By measuring the proc I can conclude there are other capacitators on it, because I'm still reading different values on a locked and unlocked proc. Looking at the proc confirms this, since some of them have other colors.
11-18-2003, 12:49 PM
Vlad Draculea

i have been measuring in an old duron 750 and i can tell you that i dont feel like telling you anything, and i dont like my paint made duron pics so you shouldnt.
11-18-2003, 12:57 PM
YoupY

Today I still measure 20.7 ohm while I did 23.2 yesterday. When I had my multimeter on it for 5 minutes I saw drop the value from 20.7 to 20.5 ohm.

The resistance is the same on all the thingies.

I can be I measured some different values yesterday, because the proc came straight out of a running system, so maybe those inductors were still charged.
11-18-2003, 05:29 PM
xDUCK

I would say that it is no coincidence that there are 12 sets of bridges and 12 of these resistors... I will try to get my hands on a locked chip so I can experiment myself. VERY GOOD DISCOVERY! Could be the breakthrough we need! :toast: :thumbsup: :worship:
11-18-2003, 08:35 PM
tennvols_69

just to let you know .2 ohms isnt all that big of a deal general rule of thumd for electronics are 10% if the resistance is within 10% of original then its still good. im willing to bet these are caps and yuor reading a resistance somewhere else in the circuit. only true way to tell is to remove them from the circuit. however they might of changed the value of the cap causing the rc time consant to either lenthen or shorten to lock the processor. i might need to but me a locked chip to play with.
11-18-2003, 10:08 PM
tennvols_69

well i used an dead tbred to verify that those lil brown thinggys are indeed capacitors. i measured it it measured 26 ohms then i removed it from the circuit and measured it it read open then started to charge then it discharged so it is a cap. it you measure it you will see resistance decrease then increase back to open. however it might bee something on that circuit that is open causing that so if we could figure out what it is then set it back to defult then we could probally unlock these things.
11-19-2003, 02:35 AM
Vlad Draculea

i talked to the store, and they told me they are very busy and havent sent it, so i will have to wait at least some days to get the giant human killing robot.
11-19-2003, 05:38 AM
saaya

very interesting! good work guys! :toast:
11-19-2003, 07:15 PM
tennvols_69

im gonna look at amd's tech sheets and see if i can find this circuit and see whats all invloved in it. if it doesnt go to the die of the chip and is only a packageing lock you could build something to run away from the chip and set the correct values kinda like the GF device did with the slot A. ill have to researce this more but i think we found the circuit that is responsible for the lock just have to figure whats exactly differant so we can change it back to how its supposed to be.
11-19-2003, 07:19 PM
saaya

i dont think you will find too much about it in the data sheets, i dont think they wrote the details about their multiplier lock there. would be way top easy for somebody who wants to remark and resell fake amd cpus to find it there...
11-20-2003, 02:06 PM
tennvols_69

any one know where i might be able to get a dead locked thorton or barton so i can slowly sand down the layers to find where they might be locked at? ill be willing to put in the time if someone has a dead chip.
11-20-2003, 02:21 PM
saaya

buy a dead ship on ebay... or ask newegg if they can send you a dead cpu :)
11-20-2003, 02:30 PM
Vlad Draculea

the robot is made from metal, and kill humans very well, i am quite satisfied with it overall.
11-20-2003, 03:08 PM
YoupY

Is there someone here that knows what the thingies circeled in yellow are?

http://members.home.nl/youpy/bartonnetje.jpg

On the locked barton the 2 circeled, are orientated differently. (the marking 102 is upside down) On them I also measure different resistance values, but since I don't know what they are I don't know if this could be meaning anything.

X-Ray pics should be really cool. That could make some things a lot more transparent

Edit:

I just checked with a m8 of me, and he has looked at 5 other procs, but it seems that they are placed random
11-20-2003, 05:23 PM
Vlad Draculea

they are flux capacitors packs, wait for a thunderstorm and go to run with it to the higest place possible.
11-20-2003, 05:35 PM
Popcicle

This is a very good Thread and deals with what
you guys are attempting to do.

http://forum.oc-forums.com/vb/showth...hreadid=245742

Check page 4..... even lifted the die-core off a
locked Barton trying to figure this locking mess out.
11-20-2003, 06:42 PM
tennvols_69

VLAD i would love to have some xrays of the chip. i think it might provide us with alot of useful knowledge like where runs go. please post the xrays when you get them or send me a copy of it.
11-20-2003, 07:01 PM
xDUCK

You know what we need? An AMD-employed deep throat.:D :smileysex
11-20-2003, 07:09 PM
eclypse

Quote:

Originally posted by xDUCK
You know what we need? An AMD-employed deep throat.:D :smileysex

Yeah i cant believe that has'nt already happended.. I guess they must pay them well enough so there happy!
11-20-2003, 07:13 PM
xDUCK

*concocts kidnapping ploy*
11-20-2003, 07:20 PM
Jeff

Someone... somewhere is plotting the leak. You know it. We are all human and we as a species just can't sit on a secret... it's just not possible. Yeah, you may be able to do it for a day, or a week, or heaven forbid a month... but eventually someone is going to crack(unless we find out first).
:lol: :lol: :lol:
11-20-2003, 07:28 PM
xDUCK

I hereby pledge $1000.00 USD to any AMD employee who emails me at xtremedesign@shaw.ca with the reasons for the lock, details on how the week 39+ lock has been done, AND detailed, thorough, and complete instructions on how to unlock these chips.

All emails will be kept completely confidential. Any takers? Come on, this is XS, I know there is an AMD employee or two reading this. :)

:toast:
11-20-2003, 08:14 PM
tennvols_69

xduck i wish i was lucky enough to work at amd i would give out alotta secrets. esp for the XS. maybe after i get out of the navy i will try to work for them:)
11-20-2003, 08:50 PM
xDUCK

Quote:

Originally posted by tennvols_69
xduck i wish i was lucky enough to work at amd i would give out alotta secrets. esp for the XS. maybe after i get out of the navy i will try to work for them:)

I'm sure they'll hire you if they ever read that message. :rolleyes: ;) :D

Interview:
"So, why do you want to work at AMD?"
"Well..."
"The challenge? The teamwork? Pushing the envelope?"
"Well, basically, I just want to be a mole. You know, leaking company and trade secrets, that sort of thing"
11-21-2003, 12:31 AM
tennvols_69

lmao, not like many of us in here could ever start building processors.
11-21-2003, 02:45 AM
Vlad Draculea

of course once i have the pics it will never post them here.
11-21-2003, 04:12 PM
YoupY

I'm keeping on looking for differences on the bartons I maybe this is another discovery, but I don't know how to put them to use. But that's why I'll keep on posting in this thread, so maybe someone can make something of all this:

Next:

fist the pic for clarification
http://members.home.nl/youpy/bartonnetje.jpg

Now some numbers. I just completed measuring the resistancepack. From top to bottom in the pic:

Pack 1 -- Top
Unlocked______Locked
1002_________998
996__________1001
905__________977
904__________980

Pack 2 -- Middle
unlocked______Locked
902__________955
898__________956
903__________951
1003_________1003

Pack 3 -- Bottom
unlocked______Locked
900__________958
905__________963
918__________976
900__________973

All these values are in ohms. I know the resistorpacks are somehow related to the bridges. Maybe the lower values result in a logic 0 and the higher values to a logic 1, which are interpreted by an mp chip.
Where I'm also really interessted in, is what the values of the Thorton are for the for the bottom resistor pack, since also the extra cache mod seems to be locked by AMD, and those values should be differenct as a result.

EDIT:

Is there any way to create nice looking tables on this forum ???
11-21-2003, 05:31 PM
Vlad Draculea

* is Vcc(Vcore) and red very strange.
11-21-2003, 05:42 PM
Marci

Quote:

Is there any way to create nice looking tables on this forum ???

Yep... do it on yer rig and screenshot it... even if HTML Tables were enabled it tends to go a bit to pot with heights and centering etc on boards based on this system IME...
11-21-2003, 05:54 PM
EQuito

Quote:

Originally posted by YoupY
Where I'm also really interessted in, is what the values of the Thorton are for the for the bottom resistor pack, since also the extra cache mod seems to be locked by AMD, and those values should be differenct as a result.

I was able to unlock the cache of my multi locked Thorton but I'm having weird results with 3 different boards... :confused:
Maybe my experience can help you on your quest for a solution the the locking problem.

Cheers!

http://forum.abit-usa.com/showthread...&postid=200507

Quote:

Well, thanks but you should hear about what's going on first cause I'm going insane here...

I sold the KV7 so I put the Thorton on it to test it before shipping, that's the screenie you see above so I ship the board, put the Thorton on my NF7-S and I'm totally locked out of CPU settings.
It won't even let me change FSB nor do I have access to default speeds. I can only boot @1500GHz (100x15) and it get the infamous "cpu unworkable yada yada"

Then, I put the chip on an AT7-MAX and I can change anything I want in bios. I can change multis and FSB in bios or boot @ max default speed of 1800+ (133x13+) but when I get to the desktop and open WCPUID or CPU-Z the FSB is the same as in bios but the multi is always at default 15 and I cannot boot at anything above 166MHz on the AT7.

What's going on here? why it doesn't work on the NF7 but works (kind of) on the AT7 and/or KV7... :confused:

Any ideas or suggestions before they put me away... :D
11-21-2003, 06:28 PM
Soulburner

Wouldn't that be great if AMD is sitting back watching this, laughing their asses off saying "they'll never get it". :D

I'm sure someone will though. When there's a will there's a way.
11-22-2003, 06:27 AM
Vlad Draculea

please someone registered in oc-forums tell them that
F8, H6, H8, H10, K8
are used to control the minds of the pityfull humans.
11-22-2003, 11:04 AM
eclypse

Quote:

Originally posted by Vlad Draculea
please someone registered in oc-forums tell them that
F8, H6, H8, H10, K8
are used to control the vcore http://www.ocinside.de/go_e.html?/ht...md_pinmod.html
i cant register because they have banned all hotmail acounts and i dont have time to register in another mail.

Done.. I've informed the proper people there.