|
Week of November 29, 2009
XeXLoader v0.12
>> FreeXeX released the first public version of XeXLoader:
[QUOTE]
Introducing the first public and fully functional XEX loader for homebrew-capable Xbox 360 platforms!
Feature list:
* Launch media-patched XEXs from any storage device
* Manage the filesystems of all storage devices
* Rip any inserted game to any storage device (ISO Extraction) (Still requires patching with XexTool(info) to remove media check)
Although it should work on all patched kernels, our releases are only tested with freeBOOT using Cygnos, not with XBRebooter. Sorry for the inconvenience.
A special "fuck you" to CarolinaGamer aka Relapse aka Hawk
Installing the LIVE package:
1) Burned CD/DVD using XeXLoader.iso
Use the file browser to copy (using the "X" button) the directory "C0DE9999" to the 360 HDD at: Hdd1://Content/0000000000000000/
2) Transfer Cable
Use appropriate software to copy the directory "C0DE9999" to 360 HDD at: Partition3\Content\0000000000000000
Start your patched kernel, and run the game demo listed as "XeXLoader"
[/QUOTE]
Official Site: n/a, by FreeXeX (#freexex or #freeboot on EFNet)
Download: n/a (built with XDK)
Discuss this news item on our forums: forums.xbox-scene.com
X360 Library And Source (fatx, Stfs And More)
>> DJ Shepherd released a very robust open-source app and library, extremely relevant for the way it handles all FatX drives and all SFTS packages. You can modify the contents of a LIVE package and resign it for dev, (allowing you to run it on a rebooted retail):
[QUOTE]
So, let's start off wif the library, X360, it's perty much self explanatory (refer to Le Fluffie sawce if you are having troubles wif an aspect), I will go through wif you on how to make your own STFSPackage class though:
For all you developers here, I have made a friendly STFS class to allow you to make ease of your Xbox haxing life. I implemented a basic parse check which checks if the package is valid (you should always put that at the top of your package function, unenclosed so the end user doesn't try to f*** up the package) and to prevent multithreading (if you try to add a file while it's hashing it, good things do not happen >.< ).
Quick list of things:
Proper STFS:
Package Creation
General Package Manipulation
Adding Files
Deleting Files
Renaming Files
Replacing Files
Injecting Files
Folder Adding/Renaming
Proper File Extraction
Proper Hashing
Profile Editing:
Gamertag and General info in the account block
Achievements/Gamerscore haxing
2 Ways to add games (the XBL hack and the proper GPD addition)
Edit your profile info/add new info
FATX:
File Extraction/Delete/Renaming/Replacing/Injection
Folder Adding
Gets STFS Package name (if applicable) or Gamertag (if applicable)
Drive backup/restore
HDD Games:
Payload Extraction
Rehashing
Signing
Music Files:
Song info
WMA Extraction
USER NOTES:
1) Yes, it is open source, you can use the code for whatever you like, and most likely, you won't give a sh*t about Copyright laws. Well, be that as it may, I don't have an edick like those people and if it came down to a job between me and yew, well, look who can actually code >:3 you have fun jerkin your edick to my library, I'm just that gud <3
2) Any bugs should REALLY be reported to me so I can fix them. Simple thing to do, just post in my blog, upload the file you got an error wif, explain what you did and what happened.
3) To save achievement edits, all you have to do is update the title to the profile and hit the Fix button on security to finalize the changes.
Future updates:
* I will implement file streaming from the FATX drive wifout having to extract the files
* STFS does not load the blocks right off the bat like I do, they read the level 2 block (if applicable) then read the level 1 (if applicable) then get the block from that, I just thought it would be handy to read blocks and have access to them but I will implement it the true way later
* Fix up a thing or two in DriveIO
* Any reported bugs of course
Also note wif Le Fluffie, I LOVE to thread the crap outta it, but at that point it causes some error's that randomly happen. Just try and ignore them and restart the application if that happens, usually fixes it.
KNOWN BUG:
* FATX Replace image function takes FOREVER, stupid DriveIO properties v.v, working on better way to implement it (I'd use Xport to replace images until I can figure out a better way)
[/QUOTE]
Official Site: http://skunkiebutt.wordpress.com/ (thx to jester for the news)
Download: here
Discuss this news item on our forums: forums.xbox-scene.com
Small Xbox 360 Motherboard Revision: GPU-revision, RF-Module
>> MODFREAKz posted pictures of an Xbox 360 (MFR Date 2009-09-20) with a somewhat updated motherboard revision. No huge changes, so it's probably still a Jasper.
It seems to have a new GPU-revision (Kronos1), new RF-module and some small layout changes. CPU, HANA, southbridge, 16mb NAND, RAM are same. No heatsink changes either, MS stopped using the 2nd GPU heatsink/pipe a while ago already.
The DVD drive is a Lite-On DG-16D2S 93450C-2.
The CB/CD are of course JTAG-fixed as with any 360 made since ~mid-June.
KeyVault Modder v1e, Mini XeX Gui v0.2 and UpdateSPY v8955-19
>> Zouzzz released updates for 3 of his Xbox 360 tools.
* KeyVault Modder v1e
A GUI tools to modify/read some of your keyvault data (region, dvd key, dvd info etc).
This new version will now say if your KV is editable or not. Microsoft added protections on more recent KVs making editing impossible for now.
Download: here
* Mini XeX Gui v0.2
This is a small GUI interface for Xorloser's Xextool. The GUI interface will allow you to easily decrypt .xex files, convert debug executables to (homebrew) retail.
This new version adds a 'mass-decryptor', will decrypt all files in a directory.
Download: here
* UpdateSPY v8955-19
This programs allows you to download each Microsoft update and will give detailed information about each kernel/dash update (release date, burns fuses, size, files details, ...)
Download: here
News-Source: gueux-forum.net
Discuss this news item on our forums: forums.xbox-scene.com
Bad Block Remapper for full 16mb ZeroPaired nand image
>> Redline99 released a small tool to remap bad blocks in an XBReboot image to match with your NAND chip, this could solve issues some people had trying to make XBReboot work:
[QUOTE]
This is a small tool that will remap bad blocks in a full 16mb "zeropaired" (xbreboot) nand image. It looks at the original Microsoft backup (that you should have) and figures out from the spare area the remapped bad blocks. You can also enter the block id's into the textbox. It does not modify the original MS image, but it does modify the zeropaired image. Run the app only one time, be sure to make a backup beforhand.
This app has had ZERO testing, If anything comes up I'll try and fix it, but I need some feedback.
This is only for 16mb images, non jasper.
[/QUOTE]
Official Site: By Redline99 on XBH
Download: here (untested)
Discuss this news item on our forums: forums.xbox-scene.com
ZooZen 'Overcase' for Xbox 360
>> MaxConsole released a video of an upcoming product by ZooZen for the Xbox 360. This 'Overcase' will fit around your current case and should cost around 50usd.
Discuss this news item on our forums: forums.xbox-scene.com
Arcade Demo to Full Conversion for Homebrew 360s
>> With freeBOOT v0.02 and XBReboot v0.05 being released opening our retail 360s (with older 2nd bootloader/CB) to run unsigned code, people are starting to experiment stuff.
Surazal on our forums found out the difference between a demo and full Xbox Live Arcade game is only a few hex-edit away:
[QUOTE]
Find a copy of Yaris (this game was chosen as it runs everywhere as full).
Open the pirs file in your favorite hex editor (filename was FB9310B8893A3FD01C443A29AC246493393E399558 )
Copy everything from 0x22C to 0x25F inclusive.
Shown as selected on this image (guess you don't need to find Yaris if you want to just copy the values highlighted).
Open your destination (in my case Castle Crashers filename: F9432A7FE407A3C196C95D0FFD4A540937FD4EEC58)
select 0x22C, and paste (overwrite, not insert). File size should NOT change.
[/QUOTE]
Note that this is (probably) illegal if you didn't actually buy the actual Xbox Live Arcade game. But as running a "homebrew enabled" Xbox 360 is not (and probably will never be) safe to connect to LIVE this is way to make your Arcade games you bought play in full version on your homebrew Xbox 360.
2 tools to help you auto-patch arcade games have been released as well:
* Arcade Demo to Full Converter (adfc) v0.1 (by FreeXeX)
FreeXeX360 :: Arcade Demo to Full Converter v0.1
Usage: freexex360-adfc.exe <LIVE file>
* Yaris-Swap v0.02 (by zouzzz)
Yaris-Swap use your [Surazal's] tips (for LIVE and PIRS files). If someone can test it.
Download: n/a (might be illegal under DMCA/EUCD)
Discuss this news item on our forums: forums.xbox-scene.com
XBReboot v0.05 8955_1 for Zephyr, Falcon and Jasper-16 *Updated*
>> XBReboot v0.05 has now also been released for Zephyr, Falcon and Jasper-16mb motherboards.
*Update* They are all available with the latest 8955_1 patch revision now, so each 16mb motherboard can now run XBR v0.05 8955_1! Only support for Jasper 256/512mb motherboards is still missing now.
Don't forget to inject your own KeyVault and Config before flashing ;)
For more info about XBReboot, read our previous news items about the Xenon releases: XBR Xenon 8955_0 and XBR Xenon 8955_1
Official Site: n/a, XBReboot by ?, imgs for new MBs by phonsey and tuxuser on XBH.
Download: n/a (might be illegal under DMCA/EUCD)
Discuss this news item on our forums: forums.xbox-scene.com
360 Flash Dump Tool v0.90
>> MODFREAKz released a new version of 360 Flash Dump Tool(info):
[QUOTE]
Since Robinsod released the source of "360 Flash Dump Tool" and stopped developing a few people decided to continue develop this great app.
This tool will allow you to decrypt/encrypt and extract various parts of a XBOX360 flash dump and much more!!
Note: Jasper dumps are not supported in this version, largeblock is being worked on.
What's new/fixed:
- Bugfix, regarding to CD decryption. If you have a 1920+ CD version it doesn't decrypt CD properly. (by arnezami)
- Bugfix, if a CPU key starts with 00 then the program crashed. (by arnezami)
- Added, separate extract option for all important stuff (Security Data, Extended Key Vault, Console Revocation List, AP25 Challenge Database, Config Blocks)
- Added, console ID generation method (source from xorloser)
- Added, detection and correction of 1 wrong byte in the CPU-Key (by MODFREAKz)
- Added, XValue decryption (by Redline99)
- Added, support when raw extracting a file that it sets the Date/Time stamps as per original in Nand
- Fixed, decryption for "Console Revocation List" (Thanks to xorloser and Redline99)
- Fixed, "Kernels not extracted (CPU Key required, CD Ver == 1920)"
- Changed, full KV.bin extract and patch
- Added new OSIG types and unspoof possibility
- Added/Changed new regions
- 1BL, XEX1 and XEX2 are set as standard
- Improved exception handling
- Added Drag and Drop
- Changed Icon
- Code cleanup
- Fixed a lot of other small bugs
[/QUOTE]
Official Site: n/a, by MODFREAKz on XBH
Download: here
Discuss this news item on our forums: forums.xbox-scene.com
A Memoir, Team HyperX. LiteOn Encryption
>> A overview of the history behind firmware modification & the creation and conclusion of the team formerly 'Team Jungle' and the story of an unsuccessful extortion. All views expressed are documented between several members of Team Jungle,THX and the scene and are not opinions expressed by Xbox-Scene.
A great amount of work has been put into the xtreme, and now current ixtreme firmware. commodore4eva, now simply known as 'c4e' came upon the scene to bring changes to the xbox360's firmware that lead to new innovations and progress to a section within the xbox360 hacking scene.
These changes have been for the most part very positive, and in 2009 I formed a group who became known as 'Team Jungle' who spent 8 months working in unison to crack the first LiteOn drive. It was a very very big achievement, and kudos is deserved all around for each member that did their share. It was a very bleak dismal long process that did not look so promising for many many months. The conclusion of Team Jungle/Team HyperX has arrived, and will be documented in this story. It is also my intention to notify everyone of facts previously withheld from the public, and to clear the air with some people unfairly accused of fraud and elitism/heroism with malcontent :)
With the cat and mouse game of almost all modification scenes, with hackers vs vendors, technologies are constantly updated and secured against new vulnerabilities. As the ixtreme firmware was released for the LiteOn, it was apparent to that specific vendor that they needed to step up their game once their secure platform was defeated. It WAS a very brilliant design, for in the simplicity of basic hardware it becomes difficult to secure a platform without the host being entirely integrated into the overall security. We see the PS3 as a fine example of this: A hardware platform that has proven very secure from top to bottom!
Unfortunately, as the securities increased, known vulnerabilities decreased and new methods needed to be found. Alas, they were :) Some of these vulnerabilities were hardware based, and some software. Some were vendor commands (cdb's) that were intentionally placed within the firmware for diagnostic purposes! A large part of firmware 'hacking' is disassembling the firmware and discovering all of the hidden cdb's for alternative usage (piracy, homebrew, etc).
In order to hack the LiteOn, a team was necessary. c4e's talent was the final step to a very long process. You need experts on the physical/hardware side who are capable of extracting the firmware (since known software methods were locked out). Sometimes several hardware guys are needed for different area's of talent. One might be skilled in decapsulation and extraction methods and the other has xray and microscopes and is excellent at detailing :) The bottom line is 90% of the work was NOT associated with the firmware and the job preformed by c4e. The firmware modification was the easy part! Of the 8 months spent on that project, only 24hrs was needed by c4e to complete his part of the project :)
With every release of xtreme and ixtreme firmware different methods of hacking that particular hardware platform became apparent through documentation (tutorials), software (JF, sending cdb's, etc) or specs/technical information released. Speculation is always a key player whether methodology is apparent, released or not.
When the 83850c hit the shelves, the public quickly figured out that there was a flaw: serial output was not working. So the team found a few 83850c's through our usual channels (distributors), purchased them (despite what you think, we usually buy our materials, most dont ever make it back. donations are very 'final'.) and got them shipped to one of our hardware specialists that is capable of decapsulating and reading eeprom's. It takes a rather talented and unique skillset to decapsulate and dump eeprom's with microfiber :) Infact, the 'micro' is a understatement: Its so small its practically invisible to the human eye! Imagine trying to solder that!
Our hardware genius successfully dumped the firmware. Since our crypto (software) genius already cracked the encryption algorithm of the original drive's firmware (which was one of the most difficult tasks of hacking the drive!!) it was just a matter of having him decrypt it for us. Once decrypted, c4e can start doing his patching routines, aswell as analyze the firmware for security changes. For a month I sat in the dark as c4e and the rest of the group 'worked' on getting the drive to output key/serial data. At the time it was presumed impossible. On the 5th week I was brought full circle and informed that the team had been coordinating decisions outside of my knowledge. Apparently the team came to a decision since there was no way to retrieve the key via software. The only hardware method at the time was full acid decapsulation, with the exception of the pin lift method. I would like to take a moment to explain the following with an analogy:
Sir Alex Ferguson is the manager of the world famous Manchester United football(soccer) club. He does not play soccer (he used to). However, he is essential to the success of the the football team. He uses his managerial experience to bring together players that would not normally play the sport together. When the team starts playing, he uses his decision making skills to combat changes within the field. Without him, the team can still play and successful at that! However, without him the team will eventually die, as they will become stale and not progress or get fresh blood into the roster. I use this analogy for myself. I created Team Jungle, which I renamed to THX due to a fallout between me and one of the developers who I had start the project we now know as 'jungle flasher'. He was not a team player(several incidents), so I removed him from the team. Instead of changing the name of his application to disassociate himself from the team, I decided to change the team name! While I created the team, and organized it and made decisions, the essential process (hacking) can obviously be done without me. The team made that choice when they went outside of my circle to discuss the future of LiteOn in regards to the team.
The decision that the team had come to was to integrate a piece of hardware(a modchip) into the process that would make end users capable of modding the new LiteOn drive without us giving away our only hardware 'dumping' method, the pin-lift method recently disclosed by geremia. We did not want MS and LiteOn/MTK to patch the only known software hole(pin-lift method) as that would defeat our capabilities in the future to dump the firmware. While we can always try to decapsulate, there are methods to combat it, and its a very risky process that destroys the hardware. I am also experienced enough to understand that multiple avenues of hacking must be present in order to secure the *future* of this project! The reason the team did not disclose their decision, or the decision making process to me was simple: Greed. They wanted to bargin with the chinese to get the maximum money possible out of each chip sold, and I was one less pie cut. And hey, im not a hacker right? I dont do any work (other than creating the group and making the ENTIRE process possible!) so why should I get paid? Well, no loss on my end, and only theirs(the groups) because I would have been, and argued very strongly against ANY money-based process.
At that time c4e came to me and told me that they had been meeting behind my back and had come to a decision, however c4e in the 5th week after obtaining the fw found out how the serial key output had changed, with a encrypted key data. He had already contacted foundmy and made the key decryption services a reality. He had already consulted with the other group members who (due to legal risk) said they did not want to be a part of it. Everything was ready to launch by the time I was told about it, and asked whether I wanted to be a part of it.
Read the entire story here
XBReboot Xenon v0.05 8955_1
>> A new version of XBReboot has been released already with a new patch (PIRS support) and fixed XeLL.
XBReboot is an image you can flash on your onboard NAND that will allow you to 'reboot' a JTAG-exploitable 360 in a patched 8955 kernel which makes homebrew XDK possible (unsigned XEXs etc).
The released image is just for Xenon motherboards, but the readme states it could easily be made for other 16mb-nand motherboards, so I guess we'll see support for those soon.
It comes with a readme this time, so we now get some official details:
[QUOTE]
* XBReboot Block Layout:
Ox00 - 0x2F 4548 boot FW
0x30 - 0x3F Backup Xell
0x40 - 0x4F XBRfw.bin Rebooter core
0x50 - 0xBF Patch.bin Kernel and patches
0xC0 - 0x?? Flash file system
* Version: XBRfw 0.5beta Initial
The fw version need not change for any given Patch.bin
Patch.bin is what needs to change for any new patch
* The following are Patch.bin versions
+8955_0: Initial
Don't need xextool:
automatically detect correct key for dev or retail xex.
Drag and drop any xex to cdr.
No specific secdata.bin or crl.bin requirements.
+8955_1:
Add support for PIRS
Fixed Backup Xell
* HowTo:
1) Extract KV and Config blocks from orig.bin
nandpro orig.bin: -r16 rawkv.bin 1 1
nandpro orig.bin: -r16 rawconfig.bin 3de 2
2) Inject those blocks into XBR.bin
nandpro XBR.bin: -w16 rawkv.bin 1 1
nandpro XBR.bin: -w16 rawconfig.bin 3de 2
3) Flash result
nandpro lpt: -w16 XBR.bin
* Notes:
There is no need to unpack and repack pirs files! This is a limitation of freeboot. Not XBR. Aside from that major difference, all functionality is the same.
Individual sections can be updated or extracted separately using nandpro.
The image can be made to work for all 16M consoles.
The standard method of using build.py can be used to change the 4548 boot FW portion of the flash to the console type.
Generally:
Create the image as described above.
The command to rebuild it might look like this:
build.py XBR.bin CB CD update.bin xell-1f.bin XBRfw.bin smcp.bin
Then the .ecc file result from build.py would be "flashed" back into the XBR
nandpro XBR.bin: -w16 image_00000000.ecc
[/QUOTE]
Official Site: n/a, by ?
Download: n/a (might be illegal under DMCA/EUCD)
News-Source: consoletech.net
Discuss this news item on our forums: forums.xbox-scene.com
iXtreme v1.6 for Liteon 83V2 and 93450 - Better Dumping Method
>> carranzafp/Maximus released a modified version of the Lite-On iXtreme v1.6 to work with the 83850-v2 and 93450 drives:
[QUOTE]
Just finished hexediting and testing
Here are templates for Ixtreme 1.6 for 83V2 and 93450 liteon firmwares
what you need to do is place your keys/serials on it and flash
use Jungleflasher or Hexedit, whatever, keep you original stored for future upgrades
Dont ask why you got banned if you play Online with this firmware, its 1.6, also I just tested with 2 consoles so its your call
the fws are based on the 83v1 ixtreme 1.6 I could have do it based on the 74 but Its the first I saw, dont think based on the 74 would make them safer anyway
[/QUOTE]
Download: n/a (might be illegal under DMCA/EUCD)
News-Source: carranzafp on XBH
In related news, MRA released a new and better method to dump/read those Lite-On 83850-v2 and 93450 drives:
[QUOTE]
No pin lifting or epoxy removing needed anymore! Just solder anything on the back according to this picture.
Also if you got status 0x52 instead of 0x72 with the "1,8V-method" this should do it. I already dumped 4 drives with this method without any issues.
-switch in pos 1
-power drive
-start Dosflash --> SPI should get recognized with status 0x72
-put switch in pos 2
-click "read"
unsolder anything and reconnect the lines that have been cut.
[/QUOTE]
News-Source: MRA on XBH
Discuss this news item on our forums: forums.xbox-scene.com
FindSecData v0.61
>> boby2pc released a new version of FindSecData, a tool to help you uncripple the HDD features on a banned Xbox 360 console.
FindSecData will extract secdata.bin and filetable of NAND dump. It uses patch-latest secdata.bin method (not delete method).
What's new/fixed (since v0.4):
* added bypassing FF version records in filesystem (v0.41)
* more accurate timestamp - used for visual purposes only (v0.41)
* added parameter to show time part of timestamp in filetables (v0.42)
* added support for large blocks (v0.5)
* block rellocation support (v0.6)
* now for 256MB and 512MB Jaspers is only needed dump of 0x600 blocks:
nandpro lpt: -r256 raw.bin AE0 600
or nandpro lpt: -r512 raw.bin AE0 600
so only about 1h dumping (v0.6)
* protection to use large block controller with small 24MB dump (v0.61)
Official Site: n/a, by boby2pc on XBH
Download: here
Discuss this news item on our forums: forums.xbox-scene.com
Microsoft's Gates Subpoenaed in RROD Suit
>> From gamepolitics.com:
[QUOTE]
The latest "celebrity" to be subpoenaed by Erik Estavillo? None other than Microsoft Chief Bill Gates.
Estavillo sent us a copy of the subpoena, dated November 30 and filed in the U.S. District Court for the Northern District of California.
The subpoena instructs Gates to bring "documents pertaining to the true and relative number of actual Xbox 360 units that have been fixed by Microsoft over the past 3 years." Estavillo is also seeking statistical data showing the true number of Xbox 360s that experienced the RROD (or other break-downs) and data on the actual number of people banned from Xbox Live for "piracy" over the period of 11/28/2008 through 11/28/2009.
[/QUOTE]
Full Story: gamepolitics.com
Discuss this news item on our forums: forums.xbox-scene.com
Microsoft's Greenberg: Xbox 360 Sales Double In U.S. During Thanksgiving Week
>> From gamasutra.com:
[QUOTE]
"Great #BlackFriday results just in, biggest sales week of the year for #Xbox360, more than 2xs previous week sales," Greenberg stated via his Twitter account.
He stopped short of offering solid numbers, but in the U.S. through October 2009, Xbox 360 has averaged around 65,000 to 70,000 consoles sold per week, according to NPD Group figures.
Microsoft rivals Sony and Nintendo did provide numbers for Black Friday. Sony said Monday that its PlayStation 3 sold over 440,000 units for the week ended November 29.
Nintendo said for the week ended November 28 that American consumers bought more than half a million Wii consoles.
[/QUOTE]
Full Story: gamasutra.com
Discuss this news item on our forums: forums.xbox-scene.com
XBReboot v0.05 - OnBoard NAND XDK Homebrew Solution
>> More early xmas presents with XBReboot v0.05! Like freeBOOT v0.02 it will reboot into a patched 8955 kernel. However, this one can be flashed directly in your onboard NAND flash, no need for a 2-nand solution. Before flashing it on your system, you will have to dump your console specific KeyVault (kv.bin) from your dumped Xbox 360 NAND image and put it inside the hacked image with nandpro:
nandpro 7371.bin: -r16 kv.bin 1 1
nandpro xbr.bin: -w16 kv.bin 1 1
Afaik, this initial version of XBReboot will only work on Xenon (v1) motherboards, but it's probably only a matter of time before it's made for other motherboard revisions.
Again, this hack relies on the JTAG hack to boot into XeLL from where it will do the reboot to the patched 8955 with virtual fuses, so will only work with 360s that don't have the new bootloader.
The hack contains no readme/nfo so for now that's all the info we can confirm, but I assume it has the same patches as freeBOOT v0.02.
Official Site: n/a, by ?
Download: n/a (contains MS code)
News-Source: xboxhacker.net (tech discussion ONLY)
Discuss this news item on our forums: forums.xbox-scene.com
freeBOOT v0.02 - runs unsigned XEX and more! Homebrew XDK!
>> Ikari360 released a new version of freeBOOT. This new version of the 'rebooter' will launch right into a patched version the latest MS dash (8955) and will now also work on Zephyr and Jasper-16mb motherboards (next to the original support for Xenon and Falcon).
But the even bigger news in this v0.02 is that the kernel is patched! No more XEX signature checks, LIVE/PIRS signature checks and Harddisk authentication ... which basically makes homebrew XDK possible on retail Xbox 360! And this should also allow you to patch existing signed XEXs with any (region, media etc) flags you want.
freeBOOT must be installed on a 2nd 'NAND' ... but next to Cygnos360 v2 support, it will now also work with Cygnos360 v1 and the (homebrew) xD-card mod!
But of course, this still requires the JTAG hack, so it's only possible on (pre ~June 2009) Xbox360 consoles where the onboard NAND has never been updated (via any normal MS procedure) to 849x (July 09) or newer. If you updated to anything over 7371, your 2BL (bootloader) has been updated (which won't allow a non paired image to boot into 4548) and CB-fuse inside the CPU burned, so the JTAG hack won't work anymore and there's no way to downgrade for now.
However if you're still on 7371 (or anything lower), you can now 'reboot' that console into a patched 8955. Your onboard NAND stays untouched on 7371 and freeBOOT/XeLL/patched-8955 are located on the 2nd NAND. The fuses are no problem either as freeBOOT will use 'virtual fuses' to launch 8955.
For new systems and refurbs things can be a bit more complicated, some still have 7363/7371 or lower but already have the new bootloader that fixed the JTAG hack, I dont think there's a way to know for sure without first dumping your NAND and check your CB-version. For new systems, certainly try to get one produced before June 2009.
It's called a 'rebooter' because it uses the JTAG hack to boot your console into XeLL and from there it 'reboots' your console into the patched 8955 kernel.
From the readme:
[QUOTE]
freeBOOT is a rebooter for the Microsoft Xbox 360. This version of freeBOOT allows you to reboot into kernel 2.0.8955 on all Xenon, Zephyr, Falcon, and Jasper consoles with 16MB flashes, which are vulnerable to the JTAG hack.
Support for Opus and Jasper consoles with larger flashes will follow soon.
As freeBOOT needs a second flash memory to store kernel 2.0.8955 and associated data, either a Cygnos360 or an xD card mod is required at the moment.
Bug Fixes
* Harddisk installation and save game/profile issues have been fixed
New Features
* updated to kernel 8955
* additional support for Zephyr and Jasper consoles with 16MB flashes
* support for xD card mod and Cygnos360 V1 added
* Harddisk authentication disabled
The Xbox 360 will now accept any SATA harddisk.
* removed XEX signature checks
Execution of unsigned devkit and retail XEXes is now possible. Encrypted devkit XEXes must be decrypted with XexTool(info)(info)(info) prior to use.
* removed LIVE/PIRS signature checks
The dashboard will now run applications from unsigned LIVE/PIRS containers.
* extendable patch system
Researchers/hackers can now try new patches easily. Please refer to "src\patches_kernel_8955.S" for more information.
What's Next
* support for Opus consoles and Jasper consoles with large flashes
* further removal of security system restrictions
* easier build process
Credits
My gratitude goes to all those who helped me get this new release done.
[/QUOTE]
Xoxide posted a video of freeBOOT v0.02, his Xbox360 'rebooting' into a patched 8955 kernel and booting up MAME360 (which was written and leaked long time ago, but could only run on devkits until now) and a homebrew Launcher:
Official Site: n/a, by ikari360
Download: n/a, might be illegal under DMCA/EUCD.
Full nfo/readme: xbins.org
Discuss this news item on our forums: forums.xbox-scene.com
Liteon 83850-v2 and Liteon 93450 DVD Key Can Now Be Dumped?
>> From team-xecuter.com:
[QUOTE]
There have been several news reports on Xboxhacker.net of users having success in dumping the keys of the newest un-moddable Liteon DVD drives. The methods posted so far are not for the beginner so do so at your own risk. The method seem crude at the moment, no doubt some easier methods will surface shortly. Remember with that DVD key you can install any flash-able DVD drive to that once un-moddable Xbox 360. Good job to all involved !
-Lift pin 101 and 122 (The MT Chip)
-solder a cable to pin 100, pin 101 and one to 3,3V
-use a 2-way switch which either connects 101 to 3,3V or to 100
-put the switch into the position so that it connects 100 to 101
-power drive
-start Dosflash, it will recognise the SPI with Status x72
-if you read it out now, it will just give you a .bin full of FFFFFFFF, but thats OK, this is how we tricked the Flash Controller to think the SPI is empty
-put the switch in the other position (so that 101 is connected to 3,3V)
-now read the flash
[/QUOTE]
News-Source: team-xecuter.com | xboxhacker.net
Discuss this news item on our forums: forums.xbox-scene.com
|
|
|
|
|
|
Add X-Scene on:
|
