Unlocked Venice 3000+

[KoHaN69]

he needs to look in the retail box to see if there was a golden ticket in it

[Ref]

No offense, but Pirs experience is ancedotal, not scientific. There are too many factors in there and I think it was unlocked when he got it whether he realized it or not.

Your statements to the contrary are pretty firm considering you have absolutely no proof either of your theory.

My statements are based on conversation with Pirs.
Of course everything's possible and there's no proof about anything ... but you know you wouldn't think that unlocked venice is possible
I asked him about that again and you can read part of our conversation.

(conversation was translated to English by me - sorry for my English )
-------------------------------------------------
Ref (08:51 PM) :
Are you absolutely sure that your CPU wasn't unlocked from the beginning?
Pirs (08:51 PM) :
I'm not 100% sure, however i think i would have noticed that, because I never keep multiplier on "auto", but I "force" it
Ref (08:51 PM) :
so you haven't noticed that before and after you used it again you noticed that immeidately right?
Pirs (08:52 PM) :
I never thought about something like that before, only after I put my Venice in again I had to change the multi .... and I saw it goes up to 25x :-)
Ref (08:52 PM) :
and have you changed the multi when it was supposed to be locked, was there anything more than 9x?
Pirs (08:53 PM) :
yes, it was locked...I always give the highest multi, e.g. 9x
Pirs (08:54 PM) :
I think I would have noticed it in the beginning, but I noticed it only after I swapped my SD
-------------------------------------------------

[Pegaso]

Sorry longsiew, I know the thread is long to read so ill save you some time, ATM as far as we know the A64 doesnt have bridges BUT we have better, a JTAG port!!! Finding the right protocol to use it will allow us, we beleive, to modify everything in the cpu down to its id string!

On another note, i have good news!
Phase 1 of the website is ready!

Were now able to accept donations for the project!
Everyone get their arses over there. Every amount accepted. The money will be used to buy whatever hardware we need to succeed and the rest of the ammount will be given away as a prize to whoever succeeds in unlocking the a64.

Now if someone slahdots this site it might not survive the day so b4 doing so please msg me first ill do my best to get things ready.

UPDATE:
I removed the URL as XtremeSytems' moderators asked me to contact the Admin to get approval b4 posting it.

Im sory but i didn´t understood, you are going to continue this investigation ( with other members) in a new bewsite, of yours ?

[ls7corvete]

Sorry longsiew, I know the thread is long to read so ill save you some time, ATM as far as we know the A64 doesnt have bridges BUT we have better, a JTAG port!!! Finding the right protocol to use it will allow us, we beleive, to modify everything in the cpu down to its id string!

On another note, i have good news!
Phase 1 of the website is ready!

Were now able to accept donations for the project!
Everyone get their arses over there. Every amount accepted. The money will be used to buy whatever hardware we need to succeed and the rest of the ammount will be given away as a prize to whoever succeeds in unlocking the a64.

Now if someone slahdots this site it might not survive the day so b4 doing so please msg me first ill do my best to get things ready.

UPDATE:
I removed the URL as XtremeSytems' moderators asked me to contact the Admin to get approval b4 posting it.

Who is "we", I would donate to the cause but not to someone with 4 posts to this site.

Why anouther site for this?

And, why you for handling money and not someone who has been posting and trying to solve this earlier on in the thread?

[Ugly n Grey]

A previous thread discussing money and donations was deleted as no one had bothered to ask permission from the owners for posting it. If you want to keep this thread here and alive, I suggest you not go to that topic. I'm sorry if that upsets you, but it is forum policy. I have already edited posts here discussing the sale of this CPU (also against the forum rules) in order to keep this thread alive.

@Ref, your English is quite good, I do get your point however I simply think there's a good chance it may be a dead end. I applaud your efforts and have followed the thread avidly, so don't mistake skepticism for a lack of appreciation of the effort or thought put into this. By all means continue investigating, that's truly the only way to know.

Regards
UnG

[Thorry]

Grey, I've read your post about something being laser locked because JTAG programming could go wrong:

JTAG programming is a very easy thing to do, it's just like flashing a EEPROM, in the extremly small chance it were to completely screw up you could simply try again. Lasercutting is expensive and extremly complex, you can't lasercut inside a core there would be visible traces.

Also, it is very very very easy they have one pin connected directly to one of the JTAG leads, all it takes is a simple flow of current say 25 amps @ 1.5 volt across that one circuit to render it useless on the outside. They could even have another pin that connects to the unburned end to fix broken CPUs if for some reason the CPU needs reprogramming. You could never ever find that pin because it isn't connected to anything on the outside (could even be one of the ground pins).

This is the way Intel has been locking their chips for years, a high current low voltage surge lockes the CPU by disconnecting the programmable part from the outside world.

Could somebody confirm their JTAG interface is doing anything at all?

Even if the JTAG interface were to be working you would still have to have the right protocolls to flash it (as I explained before)

JTAG is designed to be simple, however it is only an interface, you need to know the specs of whatever is connected to it to make it work.

In simple terms:
It's like having a RS232 datasheet and trying to get a serial mouse to work. There is a big gap between those two.

I have a 754 A64 here on my desk in front of me, I'll measure the JTAG pins to see if those are indeed connected.

Edit:

Since VID is unique per CPU core type, that could be hardwired. (Not relevant, just a remark)

[goodcooper]

i don't understand why we couldn't just compare a 3700+ to an FX to get the same results

what i mean is, comparing this mistake to a normal 3000+ will get us just as far, won't it?

[Thorry]

After measuring I've found the TRST_L pin not connected to the CPU.

This pin is vital to activate the JTAG interface, normally after power-up this needs to be low for between 5-10 cycles on TCK in order to activate the JTAG interface. If this is the pin they burned (and internally linked to VSS via a pull-down resistor)

If the TRST_L pin on the JTAG interface is pulled down all JTAG activity is disabled.

Normally when this pin is connected you could pull it up for operation latching it down to enable JTAG operations.

IF my theory is correct reprogramming the CPU without the knowledge of a hidden TRST_L pin (if exists) is simply impossible.

Could somebody please confirm that the TRST_L pin is not connected?

However IEEE 1149.1 standard specifies that TRST_L pin is optional, but why does AMD specify it on their datasheet if it is not used?

Also the TCK pin seems to be connected directly to ground which is something I haven't seen before.

I hope the TRST_L pin isn't connected because it is not used. But still the TCK pin being connected to ground is very strange.

Also: I would like to point this out to anybody who is doing anything that has something remotely related to this:

There is NO reason whatsover to think the JTAG connector has anything to do with the multiplier. AMD has been putting JTAG connectors on their chips (not only cpus) forever. Also Intel has been putting JTAG connectors onto their chips forever and that has never proven to lead to multiplier settings.

AMD has 1000 different ways of programming chips with settings and CPU strings, it can be done via any combination of pins we don't know about. Also it can be done with any protocol and at any voltage. Also there are a lot of ways they could disconnect whatever is needed to program the chips from the outside world (even with very simple and cheap methods, it could even be part of the programming cycle).

So the chance of this working is about 0.000001%, but still it's fun to experiment.

I would ask everybody to not post here unless you have a really brilliant idea or some test results / new specs. It is turning into wild speculations and theories which can be proven incorrect within seconds.

I myself do not believe the JTAG connector has anything to do with the multiplier settings.

[Thorry]

thecrazy, I propose you are to be banned. Setting up a website for this research is just great (except pretty useless since we only need one capable person of testing it and saying if there was any response from the JTAG interface)

Asking for money however is a very different thing, you do realise that actually unlocking the CPUs would be a bad thing for AMD and that by asking people for money to do this is actually asking people to give money to hurt AMD...

Also somebody with 5 posts and not having all the knowledge about the subject sound to me like somebody trying to get a bit of easy money from the overclockers here at this forum. You have no proof that the money is actually going to research into unlocking the CPUs or what kind of research this is.

I personally think this is a dead end, but still worth exploring. However there is no money needed to experiment with JTAG, you can solder a cable for 2 dollars and the software is GPL.

Also I asked to not further waste this thread with pointless discussions which is exactly what you seem to intend to do.

Also: I don't know the laws where you come from or where the server is located, but I think you can be sued for collecting money to hurt AMD.

Besides until you have permission from the admin you shouldn't be discussing you're idea. That kinda defeats the purpose of asking for permission.

You seem to think that the JTAG port 'discovery' is something great, however as stated before JTAG ports have been around for years.

[nn_step]

So... if we dont see you around for a while we can assume it didnt work?

nope it was my last winchester 3200+ chip..
now all I have left is a couple venice, a 3000+ winne and my X2

[Thorry]

In the mean time, Cheers to you

Ahw don't take it too hard, just think long and hard about what you intend to do and how it will affect not only people that want to unlock these CPUs but also the rest of the world.

In the mean time: to you too.

[HiJon89]

Allright Thorry I do get your point so this will be my last post in here but before I mute myself I want ppl to see what i have to say about this. Did you miss the part were i say i dont mind if someone else collects the money? I must admit im new here but thats no reason to say such things to someone who is very enthousiast about what is happening in here and wants to help things get organized. The moderators showed some respect, i dont feel that from you. At least give me the benefit of the doubt and if you dont like my ideas well im not closed minded everything is open for change, all I want is to see some results.
To think I sleep only 4 hrs last night to work on this... what was i thinking

You saying that i should be banned really hurts me, I had good intentions. I only hope ill have the chance to prove you wrong.

In the mean time, Cheers to you

I think this post shows wisdom and maturity beyond his post count, my hat's off to you good sir

[i found nemo]

Ahw don't take it too hard, just think long and hard about what you intend to do and how it will affect not only people that want to unlock these CPUs but also the rest of the world.

In the mean time: to you too.

did you miss the part where he said it'll be his last post so rude

[Ugly n Grey]

thecrazy is not banned, thorry is not banned, no one is banned but the conversation has taken a turn for the worst. I will politely ask you gentleman to return to topic. Those who choose can post in the thread, but please be aware you should read backwards a while before posting or your fellow members may scorn you. In fact if you have posted OT in the past 24 hours, why not delete your stuff and make this thread look clean?

Thanks for your response Thorry, I understand what JTAG programming is. In fact I have reverse engineered several programs from popular automotive products. I did not have to discover an unknown protocol first however.

Whether or not there are hardlocks in place is unknown, I am simply commenting that the most simple explanation is usually more valid than the most complex. Were I AMD, I would hardlock my chips but I'm not and any theory other than mine is valid.

UnG

[Thorry]

Very true, however I do not think lasercutting has anything to do with it since there are easier ways to hardlock it.

Also there is still no proof that the JTAG interface has anything to do with the multiplier, but on the very small chance that there is a connection we should explore this option.

I don't know what kind of chip you had te reverse engineer but a chip like a CPU is a bit more complex. The JTAG interface is used in debugging and testing (this is actually it's main function). All the circuits inside the chip are connected to the JTAG interface and you need to know the exact shift register data in order to be able to talk to one specific chip.

Also you can use the JTAG to read and write in the memory via the memory controller, if you end up reading from there you will get a lot of data which isn't usefull. The JTAG interface can also be used as a (re)programming interface. I use it myself to recover PDAs with broken firmware. Via the JTAG interface I can flash it.

However as said, I have the shift-register data for a lot of PDAs and therefor I can program them. If I haven't got those I can't really do anything at all with them. The same is true for the Athlon 64 chips. A PDA can be reverse engineered because they are mostly made up of standard components and manufacturers tend to use the same for similar series of PDAs.

A CPU however is very complex, like I said it's like trying to get a serial mouse to work with only a RS232 datasheet. Not impossible but really hard and a high-luck factor.

Is there anybody who has gotten anything out of the JTAG interface yet? Also since TCK seems to be connected directly to GND (VSS) does the CPU short-circuit when a clock is connected?

[fantoibed]

Is the JTAG way the last chance or there are other options? Pinmodding is unusefull?
Another question about JTAG (very OT): with a jtag interface is it possible to upload a modded firmware in a PSP (Playstation Portable) ?

[Thorry]

It seems like the JTAG way is indeed the only chance, pinmodding does not do anything.

If a PSP has a JTAG interface the chance is very big that it could be flashed that way.

[fantoibed]

Thanks, Thorry! Now we have only to cross fingers that Athlon64s were not hardlocked...

[IvanAndreevich]

Ttt :d

[Daved+]

Ttt :d

Again

[Clocker]

Umm. This is freaking WEIRD. When I got home today, my computer was dead. I left it on when I left for work and it was dead and would not power up when I got home.

Since the system would not even turn over, I got a new PSU. It didn't fix the problem. I got an identical replacement board from Microcenter (AOpen NF4 Ultra) and that solved my problem. System would start again! But when I would exit the BIOS and restart, it would just freeze. I would have to reset the CCMOS just to get back into the BIOS again.

When I went into the BIOS it had some weird letters by the CPU multiplier. So I tried to reload the BIOS from EEPROM. Finally the system was working and rebooting OK and I could boot into Windows.

BUT.....NOW MY VENICE 3200+ 0531 IS UNLOCKED! It was not unlocked before...

[Vapor]

What's the max multi? Got any screen shots?

[Flanker]

Umm. This is freaking WEIRD. When I got home today, my computer was dead. I left it on when I left for work and it was dead and would not power up when I got home.

Since the system would not even turn over, I got a new PSU. It didn't fix the problem. I got an identical replacement board from Microcenter (AOpen NF4 Ultra) and that solved my problem. System would start again! But when I would exit the BIOS and restart, it would just freeze. I would have to reset the CCMOS just to get back into the BIOS again.

When I went into the BIOS it had some weird letters by the CPU multiplier. So I tried to reload the BIOS from EEPROM. Finally the system was working and rebooting OK and I could boot into Windows.

BUT.....NOW MY VENICE 3200+ 0531 IS UNLOCKED![/q] It was not unlocked before as far as I know....

Additional system info?

[Clocker]

THe max shown to me by ClockGen is 25x. Weird thing is that it also shows me a -1x multiplier after that. Screen shots coming in about 30 minutes. This is a fresh install and I need to reinstall PS and figure out what my webspace password is again. :-P

[Vapor]

You can host your SSs at www.imageshack.us if you like. And Paint can be used to resize.