2500+ unlocking effort, strictly directions

[hitechjb1]

You may use the pin layout map in this AMD tech doc:

http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/26237.PDF

Page 55 has the bottom view of the CPU pins. E.g. fill in the resistance value for each pin to VSS.


I think if you want to save time, you may just do the measurement of all pins to VSS only. Since there is a very low impedance path between VSS and VCC, less than 10 ohm depending on the ohm-meter setting.

 

[oc-central.dk]

anyone tried the AQXFA 0334 yet?
Just bought one but dont wanna crank the package open if nescessary--

thx guys! btw awesome thread!!!

 

[brennan77]

334 should be unlocked. It's 340 and newer that's the locked ones.

 

[oc-central.dk]

reading through this thread one on the post´s is showing that this might be locked.....

 

[darkman101010]

Sorry my DMM is dead ... when i measure from B2(vss) to an2 have it 152 Ohm (Resolution 200 Ohm) when i change to 2 KOhm Resolution have it 2,6 kOhm .... this measure was very wrong ... Sorry i must paying a new Multimeter ...

 

[hitechjb1]

The main idea is to see

1. Whether there are some VCC pins, measured from VSS, have large resistance, say, > 100 ohm.

2. Whether there are some NC pins, measured from VSS, have relatively small resistance, say, < 1 M ohm.

3. All resistance measured from VSS is sufficient, at least for the first trial.

4. In principle, ONLY measuring VCC and NC pins from VSS is sufficient. But if one can find someone to help, may well just measure every pins and put the resistance number from VSS in the pin layout map and analyse them after the measurement.

AMD pin layout map, on Page 55
http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/26237.PDF

If suspecting there are some hidden pins (not specified in data sheet) among the
- NC pin group, or
- VCC pin group, or
- VSS pin group,
one can make a resistance map or table of each pin to VSS, and look for difference.

With a probe of a DMM connected to VSS, measure the resistance of each pin to VSS, and make a table. Then compare the resistance table to the pin table. One may want to measure each pin twice with the polarity reversed.

It should not be too difficult to do, especially if one can find a helper to write down the numbers while doing the measurement.

If a pin can be measured in 4 sec, a single pass of 478 pins would take about 32 minutes. Two pass would be about an hour.

If there is/are multiplier controlling pin(s) hidden among these NC, VCC, VSS pins, the resistance of that pin(s) would standout differently from the other regular NC, VCC, VSS pins.
- If a pin is not a VCC pin, and if it goes to the input of logic gates, or FET terminals, even if there is pullup or pulldown impedance, would be >> 10 ohm.
- If a NC pin turned out to be not NC, then the resistance would be much smaller than 10M ohm.


Have to set the DMM resistance to x1 and keep it that way, so that the setting and biasing point from the DMM to the pins remains as constant as possible.

I check a few NC, VSS, VCC pins using a 1800+.
- The resistance from VCC to VSS should be very low, of the order of 10 ohm or less (exact number depending on the DMM) and polarity. It should be similar for locked and unlocked Barton.
- Also the NC pins, if indeed is NC, should have very high impedance (>> 10M ohm).

 

[Hoot]

Sorry my DMM is dead ... when i measure from B2(vss) to an2 have it 152 Ohm (Resolution 200 Ohm) when i change to 2 KOhm Resolution have it 2,6 kOhm .... this measure was very wrong ... Sorry i must paying a new Multimeter ...

That is normal behavior for a DMM. I have on that cost almost $300 and it is not malfunctioning and it does the same thing. It has to do with different impedances at different ohm ranges. Don't get rid of your DMM.

Use the 200 Ohm resolution if you want to have a better chance of gating, or partially gating semiconductors. Use a higher scale if you just want to see the presence of pathes. Don't be surprised by small differences from older Bartons to newer ones. I saw that with the two I compared.

If I was going to do a blind search, I think I'd hang one end of the ohmeter to one of the BP_FID pins and scan around for a dead or close short to it. If you are "wish fishing"...

Hoot

 

[squeakygeek]

Hi Users! I begin measuring with a unlocked Barton 2600+ ... i make 2 List´s ... first VSS to all another ... second VCC to all another ...

The CPU is ... AXDA2600KV4D ... AQXCA 0311XPBW

mfg Darkman

You mean 2500+?

 

[hitechjb1]

I think even finding a pin (if there are) shorted to those 5 BP_FID pins would not be helpful. Since it has been shown that BP_FID voltage alternation from bios setting change and wire trick would not be able to change actual multiplier. It falls into the same category of things we have tried.

Since I don't have a locked Barton, otherwise I would spend an hour or so to explore these potential hidden pins and generate a pin resistance map to VSS. Though chance of finding one is slim, but there may always be surprises. And we have to close this possibility, either positive or negative.

Hoot,
Since you have a locked Barton and experience with these kind of measurement. Could you take a look of my last post and do something if you think it makes sense about the resistance map of every pin to VSS.

 

[CustomCooledPC]

You mean 2500+?

No, that is the stepping for a Barton 2600+. See the 4 right before the D? That means 512KB of L2 Cache witch means it is a Barton.

reference:
http://www.amdboard.com/barton2600.html
http://www.amdboard.com/amdid.html

 

[DAMIAN666]

hey, someone noticed potential bridges on the bottom of the CPU within a lower level of packaging on the last page. Is it possible that the fake layer is just a bypass??? BY the way what PINS are responsible for SMP mode....


DAMIAN

 

[Vaguerant]

Just read about this in another thread and thought it might be of interest to you guys. Here's the link....



http://forum.oc-forums.com/vb/showthread.php?s=&threadid=246672

 

[emboss]

I can't say that I can see any fake bridges or indentations on the bottom of the CPU, either with a microscope or without. However, with the microscope I *did* notice that AMD has looped a wire out of the package and back in again, which means that they might have to add another layer to the PCB sometime

 

[hitechjb1]

http://forum.oc-forums.com/vb/showthread.php?s=&threadid=246672

It has been reported in earlier posts that there are direct connections from each BP_FID pins to the dots of the L1 and L3 bridges on the top layer of the PCB. This means the five L1 bridges on the top layer are connected. That is, the resistance from the two dots of L1/L3 on the top layer to the corresponding BP_FID pin is less than 1 ohm measured.

Assuming if there is a whole new layer of L1/L3 bridges under the top layer and not connected to the old L1/L3 bridges, and they would not be connected to the BP_FID pins.

Would they not be conencted at all to any CPU pins, or some yet to be found NC pins, so they cannot be controlled by existing the motherboard or known wire trick, except hard code or cut or connect at the new bridges itself. This is still a possibility.

 

[k1114]

http://www.xtremesystems.org/forums/showthread.php?threadid=22786

 

[emboss]

Hmm, interesting ... except I'm almost certain those big things on the top of the chip are capacitors, not resistors. They're there to help reduce interference on the power lines into the chip, and to help improve stability at higher speeds. Them changing either means that there's been a change on the die or PCB, or that AMD has figured out a better combination of capacitors that help the chip run at higher speeds.

 

[emboss]

If someone is willing to sacrifice a 2600, stuffing one of the L3 bridges with conductive ink (to lower the multiplier back to 11x) would confirm 100% whether the chip is die-locked or not.

If there are real bridges beneath the fake ones "not talking about the dots on the surface here) then the multiplier should go back down to 11x, and there is hope yet. If it stays at 11.5x then it's almost certainly die-locked.

I'm going to have another close look at the cuts under a microscope (100x or 200x) and see if I can spot any additional bridges that were cut.

 

[hitechjb1]

Repost here for easier access for ideas, ....

Possible explanation how a new Barton was locked

A follow up on this suggested possibility how the internal multiplier of a locked CPU can be locked.

In the old unlocked Tbred/Barton, the multiplier information is stored as five bits of information in the L3 bridge of the CPU package. Each of the five L3 bridge is either "close" or "open", corresponding to logic 0 or logic 1 to tell the internal multiplier circuit to generate the multiplier, which determines the CPU frequency by multiplying the FSB.

Further, those 5 L3 bridges can be programmed equivalently, either
- by the bios setting via the five BP_FID pins, OR
- by wire trick via the five BP_FID pins, OR
- by altering the physical L3 bridges by cutting (closed ones) or connecting (open ones).

These structures are still there intact as various attempts have shown, except that the altered bridge signals cannot get into the CPU internal.

There have been some suggestions that there are two set of L1/L3 bridges, one real set and one fake set in the package. I don't think this is the case, since these L1/L3 are big, it is not a good design to do that.

In order for a CPU to be programmed internally with a multiplier, (either permanently or not), I think it can be done like this:

The existing L1, L3, BP_FID pins are used to set up the internal multiplier sometime during/after packaging, testing/sorting. The die potential "quality" and speed were then known. Those multiplier bits information were stored somewhere permanently. After that the connections from the L1, L3, BP_FID to the multiplier decoding circuit/CPU internal were disabled by some means, e.g
- permanent electronic fuses, or
- not permanently, in the case, there are some chances that the multiplier change can be reactivated by some hidden control pins,
hence no further alternation of multiplier can be done (using the conventional way described earlier).

If it is the latter case that the multiplier alternation could be enabled/disabled by some hidden control pins (e.g. some NC pins or even some supposed to be VSS or VCC pins), there is a possibility that there are some hidden pins which are discussed in the following two posts few days ago. It is still a remote possibility like this, since it has not been tried it out (AFAIK). Further, if it is indeed the case that there are hidden control pins for the multiplier, existing motherboard would not be able to program them via bios without changes.

I personally do not have a locked Barton, otherwise I would have done it to close this possibility.

There have been a few efforts as detailed in this link
2500+ unlocking effort, strictly directions
to see what have happened to the locked Barton and why the cut/connect of the L3 bridge and wire trick have not been working.

From my interpretation of the results, it showed that actually the L1, L3 bridge and pins, and BP_FID pins that were used to change multiplier of old Barton are still intact, but these voltage/signal are not passed into the CPU internal for real, actual multiplier change.

I think there is one more thing that we can try, though finding a solution is not likely, but still worth trying and closing this possibility.

It is to see whether there are some NC pins or VCC or VSS pins that might potentially be some hidden pins that can be used to control multiplier.

Since I do not have a locked Barton, otherwise I would have spent an hour or so doing that.

If you have a locked Barton, and have a digital multi-meter, and would like to spend an hour or so to do some measurements and test, it may help to close this possibility, either positively or negatively.

The next post details what I think needed to be done. If you have some questions and/or comments about it, or if you need more details about the measurement, pls post.

If you have a locked Barton, and have a digital multi-meter, and would like to spend an hour or so to do some measurements and test, it may help to close this possibility, either positively or negatively.

Are there any hidden multiplier pins from the NC, VCC, VSS pins?

The main idea is to see

1. Whether there are some VCC or VSS pins, measured from VSS, have large resistance, say, > 100 ohm. Normal VCC to VSS should be much smaller, and of course normal VSS to VSS should be zero.

2. Whether there are some NC pins, measured from VSS, have relatively small resistance, say, < 10 M ohm.

3. All resistance measured from VSS is sufficient, at least for the first trial.

4. In principle, ONLY measuring VCC, VSS and NC pins from VSS is sufficient. But if one can find someone to help, may well just measuring every pins and put the resistance number from VSS in the pin layout map and analyse them after the measurement.

AMD pin layout map, on Page 55
http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/26237.PDF


If suspecting there are some hidden pins (not specified in data sheet) among the
- NC pin group, or
- VCC pin group, or
- VSS pin group,
one can make a resistance map or table of each pin to VSS, and look for difference.

With a probe of a DMM connected to VSS, measure the resistance of each pin to VSS, and make a table. Then compare the resistance table to the pin table. One may want to measure each pin twice with the polarity reversed.

It should not be too difficult to do, especially if one can find a helper to write down the numbers while doing the measurement.

If a pin can be measured in 4 sec, a single pass of 478 pins would take about 32 minutes. Two pass would be about an hour.

If there is/are multiplier controlling pin(s) hidden among these NC, VCC, VSS pins, the resistance of that pin(s) would standout differently from the other regular NC, VCC, VSS pins.
- If a pin is not a VCC pin or a VSS pin, and if it goes to the input of logic gates, or FET terminals, even if there is pullup or pulldown impedance, would be >> 10 ohm.
- If a NC pin turned out to be not NC, then the resistance would be much smaller than 10M ohm.


Have to set the DMM resistance to x1 or the lowest setting, and keep it that way, so that the setting and biasing point from the DMM to the pins remains as constant as possible.

I check a few NC, VSS, VCC pins using a 1800+.
- The resistance from VCC to VSS should be very low, of the order of 10 ohm or less (exact number depending on the DMM) and polarity. It should be similar for locked and unlocked Barton.
- Also the NC pins, if indeed is NC, should have very high impedance (>> 10M ohm).

 

[hitechjb1]

If someone is willing to sacrifice a 2600, stuffing one of the L3 bridges with conductive ink (to lower the multiplier back to 11x) would confirm 100% whether the chip is die-locked or not.

If there are real bridges beneath the fake ones "not talking about the dots on the surface here) then the multiplier should go back down to 11x, and there is hope yet. If it stays at 11.5x then it's almost certainly die-locked.

I'm going to have another close look at the cuts under a microscope (100x or 200x) and see if I can spot any additional bridges that were cut.

Do you mean using a new locked 2600+ to try.

I though people has tried cutting/closing the L3 bridge of the locked ones without success.

And the top level L3 bridge voltages/signals are not taken by the CPU internal circuit for multiplier setting.

 

[emboss]

I know people have tried cutting the L3 bridges on the locked 2500's but I'm unaware of any attempts to close an L3 bridge, which requires a locked 2600 or 2800 (please correct me if I have missed it). Since the PCB has quite a few layers, one possibility would be that the new-real L3 is actually on another layer below the previously-real L3. When cutting the L3 bridges, I was careful to only cut until the lop-level connection was broken, since I don't know what's below it and I don't want to cut through the wrong trace. It's grasping at straws, but it's one of the only possibilities left if there's to be any hope of unlocking the chips (if it's internal, it's probably a PROM which is impossible to unlock).