https://xboxdevwiki.net/api.php?action=feedcontributions&user=Redherring32&feedformat=atomxboxdevwiki - User contributions [en]2024-03-29T11:47:42ZUser contributionsMediaWiki 1.28.0https://xboxdevwiki.net/index.php?title=NV2A&diff=6894NV2A2020-11-21T06:15:52Z<p>Redherring32: Added details and images regarding XGPU revisions</p>
<hr />
<div>The NV2A is the northbridge of the chipset, as well as the GPU. <br />
[[File:XGPU.JPG|thumb|200px|XGPU (1.0)]]<br />
[[File:XGPU-S.JPG|thumb|200px|XGPU S (1.1-1.4)]]<br />
[[File:XGPU-B.JPG|thumb|200px|XGPU-B (1.6)]]<br />
<br />
== GPU ==<br />
<br />
The GPU is part of the NV20 family (Kelvin)[https://nouveau.freedesktop.org/wiki/CodeNames/]:<br />
<br />
{| class="wikitable"<br />
! Code name !! Official Name<br />
|-<br />
|NV20 || GeForce3 (Ti)<br>Quadro DCC<br />
|-<br />
|NV25 || GeForce4 Ti 4200, Ti 4400, Ti 4600<br>Quadro4 700 XGL, 750 XGL, 900 XGL<br />
|-<br />
|NV28 || GeForce4 Ti 4200-8X, Ti 4800 (SE), 4200 Go<br>Quadro4 780 XGL, 980 XGL<br />
|-<br />
|NV2A || Xbox GPU <br />
|}<br />
<br />
== Known Revisions==<br />
<br />
There are 3 known revisions of the Xbox GPU (XGPU), and they are as follows.<br />
<br />
XGPU - Found on boards of revision 1.0<br>XGPU S - Found on boards of revision 1.1-1.4<br>XGPU-B - Found on boards of revision 1.6<br />
<br />
There is very little known about the difference between the revisions, or why there had to be consecutive revisions.<br>It is unknown if they are pin compatible with each other.<br />
<br />
== Notes ==<br />
<br />
* [https://web.archive.org/web/20031004105935/http://developer.nvidia.com:80/object/nv30_emulation.html NV30 information and emulator]<br />
* [https://developer.download.nvidia.com/opengl/specs/nv30specs.pdf List of implemented GL extensions for NV10-NV30: "NVIDIA OpenGL Extension Specifications for the CineFX Architecture (NV3x)", 13 Nov. 2006]<br />
<br />
[[Category:NV2A]]</div>Redherring32https://xboxdevwiki.net/index.php?title=File:XGPU-B.JPG&diff=6893File:XGPU-B.JPG2020-11-21T05:53:34Z<p>Redherring32: </p>
<hr />
<div></div>Redherring32https://xboxdevwiki.net/index.php?title=File:XGPU-S.JPG&diff=6892File:XGPU-S.JPG2020-11-21T05:50:59Z<p>Redherring32: </p>
<hr />
<div></div>Redherring32https://xboxdevwiki.net/index.php?title=File:XGPU.JPG&diff=6891File:XGPU.JPG2020-11-21T05:48:07Z<p>Redherring32: </p>
<hr />
<div></div>Redherring32https://xboxdevwiki.net/index.php?title=Memory&diff=6862Memory2020-05-21T06:18:47Z<p>Redherring32: </p>
<hr />
<div>The Xbox has 64MB Memory. This could be expanded to 128MB of memory on boards of revision 1.0-1.4 (Boards of revision 1.0-1.4 have empty spots for the extra memory, but they were later removed on 1.6 boards) but no games took advantage of it. The debug Xbox and the Chihiro both contained 128MB Memory.<br />
<br />
The memory was shared between the CPU and GPU. On the retail Xbox, the [[Flash ROM]] and [[MCPX ROM]] are also mapped to memory at the top 16 MiB and the top 512 Bytes respectively. However on Debug Xboxes and Chihiro, only the Flash is mapped as they don't contain an MCPX ROM.<br />
<br />
{| class="wikitable" style="text-align: center;"<br />
! Memory Type<br />
! Retail Xbox Range<br />
! Debug/Chihiro Range<br />
|-<br />
|Main Memory<br />
|0x00000000 - 0x03FFFFFF<br />
|0x00000000 - 0x07FFFFFF<br />
|-<br />
|[[GPU|GPU (NV2A) Registers]]<br />
|colspan="2"|0xFD000000 - 0xFDFFFFFF<br />
|-<br />
|[[APU|APU Registers]]<br />
|colspan="2"|0xFE800000 - 0xFE87FFFF<br />
|-<br />
|ACI (AC97) Registers<br />
|colspan="2"|0xFEC00000 - 0xFEC00FFF<br />
|-<br />
|USB 0 Registers<br />
|colspan="2"|0xFED00000 - 0xFED00FFF<br />
|-<br />
|USB 1 Registers<br />
|colspan="2"|0xFED08000 - 0xFED08FFF<br />
|-<br />
|NIC (NVNet) Registers<br />
|colspan="2"|0xFEF00000 - 0xFEF003FF<br />
|-<br />
|[[Flash ROM]]<br />
|colspan="2"|0xFF000000 - 0xFFFFFFFF<br />
|-<br />
|[[MCPX ROM]]<br />
|0xFFFFFE00 - 0xFFFFFFFF<br />
|N/A<br />
|}<br />
<br />
Code for emulating the memory might consist of:<br />
<br />
<pre><br />
#ifdef DEBUG || CHIHIRO<br />
#define MEMORY_SIZE 128 * 1024 * 1024<br />
int mcpx_active = 0;<br />
#else<br />
#define MEMORY_SIZE 64 * 1024 * 1024<br />
int mcpx_active = 1;<br />
#endif<br />
<br />
#define FLASH_SIZE 256 * 1024<br />
#define FLASH_MAP_SIZE 16 * 1024 * 1024<br />
#define FLASH_MAP_ADDRESS (0xFFFFFFFF - FLASH_MAP_SIZE + 1)<br />
<br />
#define MCPX_SIZE 0x200<br />
#define MCPX_MAP_ADDRESS (0xFFFFFFFF - MCPX_MAP_SIZE + 1)<br />
<br />
uint8_t memory[MEMORY_SIZE] = {0};<br />
uint8_t flash[FLASH_SIZE] = {0};<br />
uint8_t mcpx[MCPX_SIZE] = {0};<br />
<br />
uint8_t get_memory_byte(uint32_t location) {<br />
if (location < MEMORY_SIZE) {<br />
return memory[location];<br />
}<br />
<br />
if (mcpx_active && location >= MCPX_MAP_ADDRESS) {<br />
return mcpx[location - MCPX_MAP_ADDRESS];<br />
}<br />
<br />
if (location >= FLASH_MAP_ADDRESS) {<br />
return flash[(location - FLASH_MAP_ADDRESS) % FLASH_SIZE];<br />
}<br />
<br />
printf("Memory in unspecified range: %08X\n", location);<br />
return 0;<br />
}<br />
<br />
uint16_t get_memory_word(uint32_t location) {<br />
return get_memory_byte(location + 1) << 8 | get_memory_byte(location);<br />
}<br />
<br />
uint32_t get_memory_dword(uint32_t location) {<br />
return get_memory_word(location + 2) << 16 | get_memory_word(location);<br />
}<br />
<br />
void deactivate_mcpx() {<br />
mcpx_active = 0;<br />
}<br />
</pre></div>Redherring32https://xboxdevwiki.net/index.php?title=Memory&diff=6861Memory2020-05-21T06:18:17Z<p>Redherring32: Editors to clarify that memory can only be upgrades on pre-1.6 boards.</p>
<hr />
<div>The Xbox has 64MB Memory. This could be expanded to 128MB of memory on boards of revision 1.0-1.4 (Boards of revision 1.0-1.4 have empty spots for the extra memory, but they were later on 1.6 boards) but no games took advantage of it. The debug Xbox and the Chihiro both contained 128MB Memory.<br />
<br />
The memory was shared between the CPU and GPU. On the retail Xbox, the [[Flash ROM]] and [[MCPX ROM]] are also mapped to memory at the top 16 MiB and the top 512 Bytes respectively. However on Debug Xboxes and Chihiro, only the Flash is mapped as they don't contain an MCPX ROM.<br />
<br />
{| class="wikitable" style="text-align: center;"<br />
! Memory Type<br />
! Retail Xbox Range<br />
! Debug/Chihiro Range<br />
|-<br />
|Main Memory<br />
|0x00000000 - 0x03FFFFFF<br />
|0x00000000 - 0x07FFFFFF<br />
|-<br />
|[[GPU|GPU (NV2A) Registers]]<br />
|colspan="2"|0xFD000000 - 0xFDFFFFFF<br />
|-<br />
|[[APU|APU Registers]]<br />
|colspan="2"|0xFE800000 - 0xFE87FFFF<br />
|-<br />
|ACI (AC97) Registers<br />
|colspan="2"|0xFEC00000 - 0xFEC00FFF<br />
|-<br />
|USB 0 Registers<br />
|colspan="2"|0xFED00000 - 0xFED00FFF<br />
|-<br />
|USB 1 Registers<br />
|colspan="2"|0xFED08000 - 0xFED08FFF<br />
|-<br />
|NIC (NVNet) Registers<br />
|colspan="2"|0xFEF00000 - 0xFEF003FF<br />
|-<br />
|[[Flash ROM]]<br />
|colspan="2"|0xFF000000 - 0xFFFFFFFF<br />
|-<br />
|[[MCPX ROM]]<br />
|0xFFFFFE00 - 0xFFFFFFFF<br />
|N/A<br />
|}<br />
<br />
Code for emulating the memory might consist of:<br />
<br />
<pre><br />
#ifdef DEBUG || CHIHIRO<br />
#define MEMORY_SIZE 128 * 1024 * 1024<br />
int mcpx_active = 0;<br />
#else<br />
#define MEMORY_SIZE 64 * 1024 * 1024<br />
int mcpx_active = 1;<br />
#endif<br />
<br />
#define FLASH_SIZE 256 * 1024<br />
#define FLASH_MAP_SIZE 16 * 1024 * 1024<br />
#define FLASH_MAP_ADDRESS (0xFFFFFFFF - FLASH_MAP_SIZE + 1)<br />
<br />
#define MCPX_SIZE 0x200<br />
#define MCPX_MAP_ADDRESS (0xFFFFFFFF - MCPX_MAP_SIZE + 1)<br />
<br />
uint8_t memory[MEMORY_SIZE] = {0};<br />
uint8_t flash[FLASH_SIZE] = {0};<br />
uint8_t mcpx[MCPX_SIZE] = {0};<br />
<br />
uint8_t get_memory_byte(uint32_t location) {<br />
if (location < MEMORY_SIZE) {<br />
return memory[location];<br />
}<br />
<br />
if (mcpx_active && location >= MCPX_MAP_ADDRESS) {<br />
return mcpx[location - MCPX_MAP_ADDRESS];<br />
}<br />
<br />
if (location >= FLASH_MAP_ADDRESS) {<br />
return flash[(location - FLASH_MAP_ADDRESS) % FLASH_SIZE];<br />
}<br />
<br />
printf("Memory in unspecified range: %08X\n", location);<br />
return 0;<br />
}<br />
<br />
uint16_t get_memory_word(uint32_t location) {<br />
return get_memory_byte(location + 1) << 8 | get_memory_byte(location);<br />
}<br />
<br />
uint32_t get_memory_dword(uint32_t location) {<br />
return get_memory_word(location + 2) << 16 | get_memory_word(location);<br />
}<br />
<br />
void deactivate_mcpx() {<br />
mcpx_active = 0;<br />
}<br />
</pre></div>Redherring32https://xboxdevwiki.net/index.php?title=Exploits&diff=6832Exploits2020-02-07T20:40:25Z<p>Redherring32: /* TEA attack (MCPX 1.1 only) */</p>
<hr />
<div>== MCPX ==<br />
<br />
=== LDT (Hypertransport) bus tap ===<br />
<br />
See [http://www.xenatera.com/bunnie/proj/anatak/xboxmod.html#ldt bunnie's adventures hacking the Xbox].<br />
<br />
=== Visor hack ===<br />
<br />
Exploits incorrect rollover of memory address.<br />
<br />
=== MIST hack ===<br />
<br />
Exploits error in xcode interpreter security check.<br />
There are at least 2 variations of this hack.<br />
<br />
=== A20M# hack ===<br />
<br />
[[File:Haxar-a20m.jpg|thumb|200px|A jumper wire hack to enable A20]]<br />
<br />
Uses a legacy x86 feature.<br />
<br />
=== RC4 attack (MCPX 1.0 only) ===<br />
<br />
Microsoft uses the last bytes of the decrypted 2BL to check the integrity of the 2BL.<br />
However, RC4 does not have any feedback which means changes in the 2BL will not reflect in the last couple of bytes which are checked.<br />
As such, the 2BL can be freely modified, as long as the last couple of bytes still match what the MCPX ROM expects.<br />
<br />
This can be used to take over the 2BL entry point.<br />
<br />
When the attack happens, the MCPX ROM is still visible, making this a very powerful attack.<br />
<br />
''This attack is described by Michael Steil in his Google talk.''<br />
<br />
=== TEA attack (MCPX 1.1 only) ===<br />
<br />
TEA, which is only used in MCPX 1.1, can not be used as a hash in Davies-Meyer mode [http://www.tayloredge.com/reference/Mathematics/VRAndem.pdf][https://www.schneier.com/academic/paperfiles/paper-key-schedule.pdf]. And yet, Microsoft used it that way.<br />
<br />
The original attack uses the 5 bytes at 0xffffd400 (FBL entry point) which are <code>E9 83 01 00 00</code>.<br />
This is <code>jmp 0xffffd588</code> (which is a jump within the flash region).<br />
<br />
When flipping the highest bit of the operand DWORD (at 0xffffd400, mind your endianess) this will become: <code>E9 83 01 80 00</code>.<br />
This is <code>jmp 0x7fd588</code> (which is a jump into the RAM region).<br />
For the attack to be successful, the highest bit in the DWORD at 0xffffd404 also has to be flipped.<br />
<br />
The RAM can be controlled using the x-code command to write to RAM.<br />
So the idea is to copy a program from Flash to RAM using x-codes.<br />
Then the FBL / 2BL is modified to jump into said RAM region by flipping a bit of a jump operand (as described above).<br />
The 2 bit flips will not change the hash of FBL / 2BL as TEA is broken.<br />
<br />
As such, the FBL verification will succeed, the MCPX ROM will hand control to the FBL which will then jump into the attacker controlled RAM.<br />
<br />
When the attack happens, the MCPX ROM is still visible, making this a very powerful attack.<br />
<br />
''The TEA algorithm and exploit are also described in more detail in Bunnie's book (Page 109 and Page 142).''<br />
<br />
== Dashboard ==<br />
<br />
=== Audio hacks ===<br />
=== Font hacks ===<br />
<br />
[http://archiv.sega-dc.de/phoenix.maxconsole.net/docs/berternie.inc.htm Analysis of "Bert & Ernie" font-exploit].<br />
<br />
==== Easter-egg exploit ====<br />
<br />
== Savegames ==<br />
Savedgames can be used as an exploit method, but care must be taken for most games are verifying digital signatures of savedgames {{citation needed}} [http://bunniefoo.com/nostarch/HackingTheXbox_Free.pdf]<br />
=== [[007: Agent Under Fire]] ===<br />
<br />
[https://web.archive.org/web/20031003093240/http://xbox-linux.sourceforge.net:80/docs/007analysis.html Analysis of this savegame-exploit].<br />
<br />
=== [[Frogger Beyond]] ===<br />
Not much is known why this game was in the list, [https://events.ccc.de/congress/2005/fahrplan/attachments/674-slides_xbox.pdf 22C3, page 85]<br />
The game isnt shown in the final presentation at 22C3 (neither are Mechassault nor SplinterCell).<br />
<br />
=== [[MechAssault]] ===<br />
=== [[Tom Clancy's Splinter Cell]] ===<br />
=== [[Tony Hawk's Pro Skater 4]] ===<br />
Grimdoomer discovered a savegame exploit in THPS4, shared it on Discord and was later included with the Rocky5 softmod installer.<br />
[https://drive.google.com/file/d/0B9WVULxHOmNkQVBCMHMtVGhqVVU/view a video demonstrating the game trigger (custom skatepark)]<br />
<br />
''10-4-2017 it's just shell code I injected into the game save/ granted this save is slightly more complicated than the others and requires a small "loader" that is just a memcpy basically it's literally as simple as a buffer overflow...I just looked for null terminated strings and fuzzed them then when I got a crash I looked in teh xbe to figure out what was going on. yeah it's literally just a stack overflow'' - grimdoomer<br />
<br />
another website talking about his exploit.<br />
[https://www.xbmc4xbox.org.uk/forum/viewtopic.php?t=7310 xbmc4xbox.org.uk]<br />
<br />
== Attack ideas ==<br />
<br />
{| class="wikitable"<br />
! Purpose || Author || Description || Status<br />
|-<br />
|Xbox DVD Movie Playback Kit Dongle ROM manipulation || Xbox-Linux wiki<br />
|As the dashboard presumably downloads the code from the ROM into the memory of the Xbox, this could be a hardware hack requiring no hardware modifications. The XBE loader for the DVD image is different from the usual XBE loader. However, the XBE is still signed and checked for security.<br />
| XBE loader seems to be secured, although no full analysis has been done.<br />
|-<br />
| Preserving memory across boot || JayFoxRox<br />
| Confirm behaviour described in the coldboot paper (https://jhalderm.com/pub/papers/coldboot-cacm09.pdf). This can be used to transfer code / setups for other exploits across a boot (such as preparing memory for A20 attack).<br />
| Success: We have marked memory and rebooted the Xbox (through SMC warm and cold, and manual reboot using power switch). At room temperature, and the Xbox pre-heated, hundreds of markers can still be found after 10 seconds. Within the first 5 seconds, no loss of data was measured at all (although not many bits have been marked to begin with). We have confirmed the memory persistence not only for the main RAM, but also MCPX APU DSP memory banks. Other memory or register banks were not tested yet.<br />
|-<br />
| Early boot control || JayFoxRox<br />
| Xcodes allow writing PCI config space. This can be used to set PCI BARs to random page-aligned addresses. Some devices like the NV2A or MCPX APU contain large register banks which can be read and written like RAM. So effectively we can probably overlay the flash memory or MCPX ROM with a temporary PCI mapping. To fill the memory, the PCI device can be mapped to a lower region, and be filled through Xcode memory writes.<br />
This can be used to take control over code contained in RAM (FBL / 2BL), flash or possibly even the MCPX ROM during boot. This attack could be used to avoid unmapping the MCPX ROM and is therefore quite powerful. However, it requires knowledge of the Xcodes.<br />
| This has not been tested during real-mode or early boot yet, but is assumed to work. It was tested from protected mode by mapping USB1 over the Flash and MCPX ROM region (main RAM has not been tested yet). Mapping the overlay pages without caching resulted in crashes. However, the PD was not reviewed at the time and might have been broken (through unconventional use of MmMapIoSpace).<br />
|-<br />
| Dumping the MCPX ROM || JayFoxRox<br />
| Trying to find problems with the SMC reset chain:<br />
* Map PCI devices over the MCPX ROM region<br />
* Schedule a reset<br />
* Keep reading MCPX ROM memory with CPU to persistent page<br />
* If we are lucky, the CPU would now copies the MCPX ROM to RAM in it's last cycles with a broken LDT (this depends on how LDTs work and if they can recover)<br />
| Failed: I've tried reading MCPX ROM memory for as long as possible using the CPU. I've tried resets using PM26 (assumed PWRBTN), SMC Soft (0x01) and SMC Hard (0x40).<br />
Memory was read based on observing value changes (in PCI regions, signalling reset), and timing alone (X cycles after starting reset).<br />
The MCPX ROM region access always crashed. Shadowing the MCPX ROM with a PCI device does not help: The CPU never observed the PCI devices being remapped / lost.<br />
As MCPX and CPU are both reset by the SMC directly, this is not surprising.<br />
|-<br />
| Dumping the MCPX ROM || JayFoxRox<br />
| Trying to find problems with the SMC reset chain:<br />
* Map PCI devices over the MCPX ROM region<br />
* Check if NV2A can access the mapped PCI device<br />
* Configure NV2A to continously stream from MCPX ROM region to RAM - Reset system using SMC (idea: this resets the PCI device mappings in the MCPX and should re-enable the MCPX ROM)<br />
* If we are lucky, the NV2A would now stream the MCPX ROM to RAM in it's last cycles with a broken LDT (this depends on how LDTs work and if they can recover)<br />
| Concept only: No interest in experimenting with NV2A DMA.<br />
|-<br />
| Dumping the MCPX ROM || JayFoxRox<br />
| Trying to find problems with the SMC reset chain: On a warm boot, the x86 might do a bad boot (the following is a theory, someone please measure pins). Theroy: PWRGD is provided, but CPURST is still high from the previous run; CPURST might only go low once NV2A reboots:<br />
* Map device in NV2A to MCPX ROM region (note: mapping MCPX device would not work, because that gets reset with PWRGD)<br />
* Warm reset using SMC<br />
* Code in NV2A device should now jump to lower memory and unmap the MCPX ROM region (by moving itself for example)<br />
* Delay by X cycles [probably in the range from 1ns to idk.. 500ms] to avoid reading the MCPX ROM before MCPX reset<br />
* Code in lower region should copy MCPX ROM region to persisting pages<br />
| Concept only: Someone should measure the pins and possibly look into the memory signals. This is too time consuming for me.<br />
|-<br />
| Unknown || JayFoxRox<br />
| Partial system reset using 0xCF9 I/O register<br />
| Resetting through 0xCF9 lands us on a black screen and the LED flashes as if the DVD tray was being opened. It's currently assumed that 0xCF9 only resets peripherals and NV2A / CPU, but it does not seem to reset the MCPX itself (hence issues booting and PCI activity which causes LED to flash). This has not been tested yet. An idea to confirm this, might be to map a device at 0xFFFFFFF0 which places an x86 jump to a good memory page. If the MCPX really isn't reset, then the CPU would boot from the MMIO / known page.<br />
|-<br />
| Dumping the MCPX ROM || JayFoxRox<br />
| Trying to find problems with the SMC reset chain. The SMC takes a couple of milliseconds to reset the system. Parts of the peripherals might stay alive for long enough. So chances (extremly unlikely) are, the peripherals could be programmed to do DMA where the DMA is only executed after the reboot.<br />
| Failed: An attempt was made to use the APU GP DSP DMA to continuously store x86 code where 2BL would unpack. The system was then reset using the SMC. It booted normally. It is assumed that the DMA is probably long dead by the time that the 2BL is being unpacked / ran.<br />
|-<br />
| Unknown || JayFoxRox<br />
| Resetting from wrong address. The errata for the CPU states that a warm-reset might occur from the wrong address.<br />
| Concept only: Needs more research<br />
|-<br />
| Dumping the MCPX ROM || JayFoxRox<br />
| Trying to access MCPX ROM through peripherals in the southbridge. If the address logic is broken, parts like the OHCI, APU or AC97 might be able to access it still.<br />
|<br />
* AC97: Lots of crashes / hangs. Sometimes crackling noise. Sometimes does not crash. Also can access some non-existing memory regions without any crashes. Data read from invalid addresses seemed to be 300 Hz square wave. While crashing the hardware output will have exponential falloff (measured on PCM line-out).<br />
* APU: Mapping GP DSP Scratch memory from 0x00000000 to 0x7FFFFFFF reveals mirrors of physical RAM. Setting the highest bit (addresses over 0x80000000) will result in a crash of the Xbox.<br />
* OHCI: Untested<br />
* Others: Untested<br />
|-<br />
| Dumping Kernel INIT || JayFoxRox<br />
| INIT is free'd right before passing execution to the first XBE. Depending on what the XBE allocates, the INIT section might still be in memory when a dumper is run.<br />
| Probably doesn't work. Would need the dumper to directly run after cold-boot. Softmods unfortunately reboot the Xbox and during this warm-boot the INIT section is (in at least most cases) lost.<br />
|-<br />
| Dumping Kernel INIT || DaveX || An extension to JayFoxRox dumping idea. Instead of running a dumper-XBE through a softmod, the softmod itself could do the dumping. This means creation of a custom softmod, just for dumping. This depends on the used softmod entry-point (font-exploit (signed target xbe), audio-exploit, ..) to gain execution as early as possible. This strategy might be slightly risky as harddisk contents have to be modified for the temporary softmod.<br />
| WIP as of 2018-09-12<br />
|-<br />
| rowspan="13" | Homebrew entry point || rowspan="13" | Community<br />
| rowspan="13" | Some movie DVDs contain default XBEs signed to run on original Xbox from DVD-R{{FIXME|reason=Add region / product codes and other DVDs you know of}}. If we can find an exploit in one of them (loaded files), we could possibly take over the entire system and run homebrew from DVD-R.<br />
|-<br />
|'''Star Wars: Clone Wars - Volume Two'''<br />
[[Battlefront II]]<br />
<br />
Untested<br />
|-<br />
|'''Star Wars: Episode III - Revenge of the Sith (Widescreen Edition)'''<br />
[[Battlefront II]]<br />
<br />
Untested<br />
|-<br />
|'''Star Wars Trilogy (Widescreen Edition with Bonus Disc)'''<br />
[[Battlefront]]<br />
<br />
Untested<br />
|-<br />
|'''Star Wars Trilogy DVD with Demo'''<br />
[[Lego Star Wars 2]]<br />
<br />
Untested<br />
|-<br />
|'''Star Wars: Clone Wars - Volume One'''<br />
[[Battlefront]]<br />
<br />
Untested<br />
|-<br />
|'''The Chronicles of Riddick (Widescreen Unrated Director's Cut)'''<br />
[[Chronicles of Riddick]]<br />
<br />
Untested<br />
|-<br />
|'''Doom (Unrated Widescreen Edition)'''<br />
[[Doom 3]]<br />
<br />
Untested<br />
|-<br />
|'''Hulk (Special Edition)'''<br />
[[Hulk]]<br />
<br />
Untested<br />
|-<br />
|'''King Arthur - The Director's Cut (Widescreen Edition)'''<br />
[[King Arthur]]<br />
<br />
Untested<br />
|-<br />
|'''Robots (Widescreen Edition)'''<br />
[[Robots]]<br />
<br />
Untested<br />
|-<br />
|'''Van Helsing (Widescreen Edition)'''<br />
[[Van Helsing]]<br />
<br />
Untested<br />
|-<br />
|'''Clone Wars Volume 1'''<br />
[[Republic Commando]]<br />
<br />
Untested<br />
|}<br />
<br />
== Notes ==<br />
<br />
* [https://events.ccc.de/congress/2005/fahrplan/attachments/591-paper_xbox.pdf 17 Mistakes Microsoft Made in the Xbox Security System]<br />
* [http://toogam.bespin.org/xboxmod/site/xbehacks.htm A list of some exploit implementations]</div>Redherring32https://xboxdevwiki.net/index.php?title=Development_Kits&diff=6805Development Kits2019-12-15T21:48:15Z<p>Redherring32: </p>
<hr />
<div>There are a few hardware differences and software differences between development kits, but generally the following hardware is known to be exist:<br />
* Alpha I and II kits<br />
* DVT3 Development Kits<br />
* DVT4 Development Kits<br />
* Debug kits<br />
<br />
Further more there are differences internally from different MCPX revisions, and GPU revisions, to different board layouts. Sega Chihiro boards seem to be based on DVT4 Development/Debug kits. either using overproduction or on purpose produced MCPX-X2 as found in the development kits and debugkits.<br />
<br />
Some rare boards are found with different MCPX chips that also have a special port near the CPU, and a extra USB port on the backside of the board (connected to the MCPX to unknown port) its been rumored that the blocked USB port (unblocked on DVT3) on the back of Development kits where either a leftover of these extra usb port or used for JVS development and/or testing. <br />
<br />
== Alpha ==<br />
{{FIXME| needs checking with real ALpha 1 and 2}}<br />
Contructed using "off the shelf" hardware, probably before retail release from Intel. <br />
The alpha hardware allowed kernel debugging to be done over one of the rs232 ports and standard WinDBG software can make these messages and control work.<br />
This allows of careful debugging of the running kernel to diagnose occuring faults or errors. <br />
At early boot of the recovery software, a network IP address is attempted, probably to setup for another way of diagnosing and remote control using the available software like later XDK software.<br />
<br />
The Alpha is built with the following parts or software:<br />
=== Alpha I ===<br />
* Intel VC820, running a pre-release BIOS<br />
* 128Mb RDRAM with an terminator<br />
* 600Mhz CPU<br />
* Nvidia Geforce 2 GTS 64MB<br />
* A xircom PCPGI2(OPTI 82C861) 2 USB port PCI card <br />
* Intel 82559(ic) Network card {{FIXME}}<br />
* Hard drive is a WD205AA (20.5 Gb) or fujitsu MPF3204AT (20.4 Gb)<br />
* ATNG 250w or a 300w powersupply<br />
<br />
These were then programmed by use of a recovery disk that "recovered" the system.<br />
The case is a customized globalwin ycc-802. (color silver and an added jewel)<br />
<br />
=== Alpha II ===<br />
The Alpha II was an upgrade kit or constructed the same as a Alpha I with the following upgrades:<br />
* 733MHz CPU SL3XN<br />
* Nvidia Geforce3 NV20 (64MB ram) with a Pre-retail firmware (180-p0050-0000-a09)<br />
<br />
A supplied Recovery made the necessary firmware upgrades{{citation needed}} and updated the dashboard.<br />
<br />
=== Franken Alpha ===<br />
This is a listing of notes on how to make a Alpha I or II yourself, also known as a FrankenAlpha.<br />
<br />
Same hardware as a Alpha I/II, but you dont seem to need the pre-retail firmwares or BIOSes.<br />
Also, any Geforce3 is rumoured to work, as long as the GPU is of the NV20 series. The AV out sub-board isn't necessary, as VGA seems to work fine. color or different kinds of fans, cooling blocks or OEM vendor names doesnt seem to matter.<br />
The Opti usb board can be green, yellow or black. as long as the IC sports the 82C861 wording.<br />
if the VC820 sports any USB or Sound, it will not be used, the listed hardware boards are used instead, regardless of other hardware. (drivers arent in the kernel).<br />
<br />
==== Posible solutions on fixing a (franken) alpha(2) ====<br />
While fixing a frankenalpha, the following kernel errors occured while intentionally incorrectly installing or configuring the computer.<br />
These results may vary with official parts, configs, BIOS or firmware. Or due to differences in hardware.<br />
These are results from recovery 3521 as earlier ones did not work on the Alpha under test.<br />
<br />
;IDEX hard disk not configured (status=51).<br />
:HDD too small<br />
;IDEX hard disk not configured (status=ff).<br />
:HDD on the wrong bus, put on primary channel.(maybe wrong place on the cable itself) maybe add a jumper for master select?<br />
;IDEX hard disk not found (status=7f).<br />
:HDD not connected (or dead)<br />
;MP No video output because you are using an older video card.<br />
:Well, insert a Geforce3 card (NV20 based)<br />
;WRN[XNET] EnetInitialize failed 0x801f0001<br />
:Logo loads, with a halt when the sparkly bit is on the B of Xbox. The network card is missing, insert a GD82559 based intel network card FCC: EJMNPDALBANY (worked for me)<br />
;[XNET] NicExecuteActionCmdAndWait failed!WRN[XNET] EnetInitialize failed 0x801f0001<br />
:Network on wrong pci lane or no screen connected (VGA or S-video)<br />
* Tested Slot 1 as good (real close to the GPU, would not recommend)<br />
* Tested Slot 2 as not good<br />
* Tested Slot 3 as not good (*** Assertion failed: hwres.ResourceData.Address[0].Type == CmResourceTypeMemory<br />
* Tested Slot 4 as good<br />
* Tested Slot 5 as not good<br />
<br />
These might be wrong for official alphas, or only for the particular motherboard that was being tested.<br />
<br />
== Debug ==<br />
Shaped and main parts consist of retail hardware with the following differences:<br />
* 128MB ram instead of default 64MB ram<br />
* MCPX revision X2, thus capable of running only Debug signed code{{FIXME|reason= can it still run retail code?}}<br />
* Hardisks loaded with retail and Debug shell files<br />
<br />
== DVT3/DVT4 ==<br />
Harddisk is said to be locked by default with a 16size byte 0x00 key, but allowing to run with an unlocked harddrive of any size(larger then 20GB{{citation needed}} for minimal OS).DVT3 seems to have the back USB port to be uncovered and a slightly more glossy or shinier jewel on the top of the case. According to some sources, the DVT3 cannot be updated to further kernels/dashboards than 3911, the lowest/oldest being 3823.1(Borman said this?){{citation needed}}<br />
<br />
Has all the functions of a debug, with the addition of:<br />
* [[DVD_Emulator | DVD emulation]]<br />
* [[Kernel Debugging | Kernel_Debug]] over a dedicated [[Super_I/O | IO board ]]</div>Redherring32https://xboxdevwiki.net/index.php?title=Development_Kits&diff=6804Development Kits2019-12-15T21:46:16Z<p>Redherring32: /* Posible solutions on fixing a (franken) alpha(2) */</p>
<hr />
<div>There are a few hardware differences and software differences between development kits, but generally the following hardware is known to be exist:<br />
* Alpha I and II kits<br />
* DVT3 Development Kits<br />
* DVT4 Development Kits<br />
* Debug kits<br />
<br />
Further more are differences internally from diferent MCP revisions, GPU revisions and board layouts. Sega Chihiro boards seem to be based on DVT4 Development/Debug kits. either using overproduction or on purpose produced MCPX-X2 as found in the development kits and debugkits.<br />
<br />
Some rare boards are found with different MCPX chips that also have a special port near the CPU, and a extra USB port on the backside of the board (connected to the MCPX to unknown port) its been rumored that the blocked USB port (unblocked on DVT3) on the back of Development kits where either a leftover of these extra usb port or used for JVS development and/or testing. <br />
<br />
== Alpha ==<br />
{{FIXME| needs checking with real ALpha 1 and 2}}<br />
Contructed using "off the shelf" hardware, probably before retail release from Intel. <br />
The alpha hardware allowed kernel debugging to be done over one of the rs232 ports and standard WinDBG software can make these messages and control work.<br />
This allows of careful debugging of the running kernel to diagnose occuring faults or errors. <br />
At early boot of the recovery software, a network IP address is attempted, probably to setup for another way of diagnosing and remote control using the available software like later XDK software.<br />
<br />
The Alpha is built with the following parts or software:<br />
=== Alpha I ===<br />
* Intel VC820, running a pre-release BIOS<br />
* 128Mb RDRAM with an terminator<br />
* 600Mhz CPU<br />
* Nvidia Geforce 2 GTS 64MB<br />
* A xircom PCPGI2(OPTI 82C861) 2 USB port PCI card <br />
* Intel 82559(ic) Network card {{FIXME}}<br />
* Hard drive is a WD205AA (20.5 Gb) or fujitsu MPF3204AT (20.4 Gb)<br />
* ATNG 250w or a 300w powersupply<br />
<br />
These were then programmed by use of a recovery disk that "recovered" the system.<br />
The case is a customized globalwin ycc-802. (color silver and an added jewel)<br />
<br />
=== Alpha II ===<br />
The Alpha II was an upgrade kit or constructed the same as a Alpha I with the following upgrades:<br />
* 733MHz CPU SL3XN<br />
* Nvidia Geforce3 NV20 (64MB ram) with a Pre-retail firmware (180-p0050-0000-a09)<br />
<br />
A supplied Recovery made the necessary firmware upgrades{{citation needed}} and updated the dashboard.<br />
<br />
=== Franken Alpha ===<br />
This is a listing of notes on how to make a Alpha I or II yourself, also known as a FrankenAlpha.<br />
<br />
Same hardware as a Alpha I/II, but you dont seem to need the pre-retail firmwares or BIOSes.<br />
Also, any Geforce3 is rumoured to work, as long as the GPU is of the NV20 series. The AV out sub-board isn't necessary, as VGA seems to work fine. color or different kinds of fans, cooling blocks or OEM vendor names doesnt seem to matter.<br />
The Opti usb board can be green, yellow or black. as long as the IC sports the 82C861 wording.<br />
if the VC820 sports any USB or Sound, it will not be used, the listed hardware boards are used instead, regardless of other hardware. (drivers arent in the kernel).<br />
<br />
==== Posible solutions on fixing a (franken) alpha(2) ====<br />
While fixing a frankenalpha, the following kernel errors occured while intentionally incorrectly installing or configuring the computer.<br />
These results may vary with official parts, configs, BIOS or firmware. Or due to differences in hardware.<br />
These are results from recovery 3521 as earlier ones did not work on the Alpha under test.<br />
<br />
;IDEX hard disk not configured (status=51).<br />
:HDD too small<br />
;IDEX hard disk not configured (status=ff).<br />
:HDD on the wrong bus, put on primary channel.(maybe wrong place on the cable itself) maybe add a jumper for master select?<br />
;IDEX hard disk not found (status=7f).<br />
:HDD not connected (or dead)<br />
;MP No video output because you are using an older video card.<br />
:Well, insert a Geforce3 card (NV20 based)<br />
;WRN[XNET] EnetInitialize failed 0x801f0001<br />
:Logo loads, with a halt when the sparkly bit is on the B of Xbox. The network card is missing, insert a GD82559 based intel network card FCC: EJMNPDALBANY (worked for me)<br />
;[XNET] NicExecuteActionCmdAndWait failed!WRN[XNET] EnetInitialize failed 0x801f0001<br />
:Network on wrong pci lane or no screen connected (VGA or S-video)<br />
* Tested Slot 1 as good (real close to the GPU, would not recommend)<br />
* Tested Slot 2 as not good<br />
* Tested Slot 3 as not good (*** Assertion failed: hwres.ResourceData.Address[0].Type == CmResourceTypeMemory<br />
* Tested Slot 4 as good<br />
* Tested Slot 5 as not good<br />
<br />
These might be wrong for official alphas, or only for the particular motherboard that was being tested.<br />
<br />
== Debug ==<br />
Shaped and main parts consist of retail hardware with the following differences:<br />
* 128MB ram instead of default 64MB ram<br />
* MCPX revision X2, thus capable of running only Debug signed code{{FIXME|reason= can it still run retail code?}}<br />
* Hardisks loaded with retail and Debug shell files<br />
<br />
== DVT3/DVT4 ==<br />
Harddisk is said to be locked by default with a 16size byte 0x00 key, but allowing to run with an unlocked harddrive of any size(larger then 20GB{{citation needed}} for minimal OS).DVT3 seems to have the back USB port to be uncovered and a slightly more glossy or shinier jewel on the top of the case. According to some sources, the DVT3 cannot be updated to further kernels/dashboards than 3911, the lowest/oldest being 3823.1(Borman said this?){{citation needed}}<br />
<br />
Has all the functions of a debug, with the addition of:<br />
* [[DVD_Emulator | DVD emulation]]<br />
* [[Kernel Debugging | Kernel_Debug]] over a dedicated [[Super_I/O | IO board ]]</div>Redherring32https://xboxdevwiki.net/index.php?title=Development_Kits&diff=6803Development Kits2019-12-15T21:45:10Z<p>Redherring32: /* DVT3/DVT4 */</p>
<hr />
<div>There are a few hardware differences and software differences between development kits, but generally the following hardware is known to be exist:<br />
* Alpha I and II kits<br />
* DVT3 Development Kits<br />
* DVT4 Development Kits<br />
* Debug kits<br />
<br />
Further more are differences internally from diferent MCP revisions, GPU revisions and board layouts. Sega Chihiro boards seem to be based on DVT4 Development/Debug kits. either using overproduction or on purpose produced MCPX-X2 as found in the development kits and debugkits.<br />
<br />
Some rare boards are found with different MCPX chips that also have a special port near the CPU, and a extra USB port on the backside of the board (connected to the MCPX to unknown port) its been rumored that the blocked USB port (unblocked on DVT3) on the back of Development kits where either a leftover of these extra usb port or used for JVS development and/or testing. <br />
<br />
== Alpha ==<br />
{{FIXME| needs checking with real ALpha 1 and 2}}<br />
Contructed using "off the shelf" hardware, probably before retail release from Intel. <br />
The alpha hardware allowed kernel debugging to be done over one of the rs232 ports and standard WinDBG software can make these messages and control work.<br />
This allows of careful debugging of the running kernel to diagnose occuring faults or errors. <br />
At early boot of the recovery software, a network IP address is attempted, probably to setup for another way of diagnosing and remote control using the available software like later XDK software.<br />
<br />
The Alpha is built with the following parts or software:<br />
=== Alpha I ===<br />
* Intel VC820, running a pre-release BIOS<br />
* 128Mb RDRAM with an terminator<br />
* 600Mhz CPU<br />
* Nvidia Geforce 2 GTS 64MB<br />
* A xircom PCPGI2(OPTI 82C861) 2 USB port PCI card <br />
* Intel 82559(ic) Network card {{FIXME}}<br />
* Hard drive is a WD205AA (20.5 Gb) or fujitsu MPF3204AT (20.4 Gb)<br />
* ATNG 250w or a 300w powersupply<br />
<br />
These were then programmed by use of a recovery disk that "recovered" the system.<br />
The case is a customized globalwin ycc-802. (color silver and an added jewel)<br />
<br />
=== Alpha II ===<br />
The Alpha II was an upgrade kit or constructed the same as a Alpha I with the following upgrades:<br />
* 733MHz CPU SL3XN<br />
* Nvidia Geforce3 NV20 (64MB ram) with a Pre-retail firmware (180-p0050-0000-a09)<br />
<br />
A supplied Recovery made the necessary firmware upgrades{{citation needed}} and updated the dashboard.<br />
<br />
=== Franken Alpha ===<br />
This is a listing of notes on how to make a Alpha I or II yourself, also known as a FrankenAlpha.<br />
<br />
Same hardware as a Alpha I/II, but you dont seem to need the pre-retail firmwares or BIOSes.<br />
Also, any Geforce3 is rumoured to work, as long as the GPU is of the NV20 series. The AV out sub-board isn't necessary, as VGA seems to work fine. color or different kinds of fans, cooling blocks or OEM vendor names doesnt seem to matter.<br />
The Opti usb board can be green, yellow or black. as long as the IC sports the 82C861 wording.<br />
if the VC820 sports any USB or Sound, it will not be used, the listed hardware boards are used instead, regardless of other hardware. (drivers arent in the kernel).<br />
<br />
==== Posible solutions on fixing a (franken) alpha(2) ====<br />
While fixing a frankenalpha, the following kernel errors occured while intentionally incorrectly installing or configuring the computer.<br />
These results may vary with official parts, configs, BIOS or firmware. Or due to differences in hardware.<br />
These are results from recovery 3521 as earlier ones did not work on the Alpha under test.<br />
<br />
;IDEX hard disk not configured (status=51).<br />
:HDD too small<br />
;IDEX hard disk not configured (status=ff).<br />
:HDD on the wrong bus, put on primary channel.(maybe wrong place on the cable itself) maybe add a jumper for master select?<br />
;IDEX hard disk not found (status=7f).<br />
:HDD not connected (or dead)<br />
;MP No video output because you are using an older video card.<br />
:Well, insert a Geforce3 card (NV20 based)<br />
;WRN[XNET] EnetInitialize failed 0x801f0001<br />
:Logo loads, with a halt when the sparkly bit is on the B of Xbox. The network card is missing, insert a GD82559 based intel network card FCC: EJMNPDALBANY (worked for me)<br />
;[XNET] NicExecuteActionCmdAndWait failed!WRN[XNET] EnetInitialize failed 0x801f0001<br />
:Network on wrong pci lane or no screen connected (VGA or S-video)<br />
* Tested Slot 1 as good (real close to the GPU, would not recommend)<br />
* Tested Slot 2 as not good<br />
* Tested Slot 3 as not good (*** Assertion failed: hwres.ResourceData.Address[0].Type == CmResourceTypeMemory<br />
* Tested Slot 4 as good<br />
* Tested Slot 5 as not good<br />
<br />
These might be wrong for official alphas or only for the particular motherboard that was being tested.<br />
<br />
== Debug ==<br />
Shaped and main parts consist of retail hardware with the following differences:<br />
* 128MB ram instead of default 64MB ram<br />
* MCPX revision X2, thus capable of running only Debug signed code{{FIXME|reason= can it still run retail code?}}<br />
* Hardisks loaded with retail and Debug shell files<br />
<br />
== DVT3/DVT4 ==<br />
Harddisk is said to be locked by default with a 16size byte 0x00 key, but allowing to run with an unlocked harddrive of any size(larger then 20GB{{citation needed}} for minimal OS).DVT3 seems to have the back USB port to be uncovered and a slightly more glossy or shinier jewel on the top of the case. According to some sources, the DVT3 cannot be updated to further kernels/dashboards than 3911, the lowest/oldest being 3823.1(Borman said this?){{citation needed}}<br />
<br />
Has all the functions of a debug, with the addition of:<br />
* [[DVD_Emulator | DVD emulation]]<br />
* [[Kernel Debugging | Kernel_Debug]] over a dedicated [[Super_I/O | IO board ]]</div>Redherring32https://xboxdevwiki.net/index.php?title=Development_Kits&diff=6802Development Kits2019-12-15T21:44:00Z<p>Redherring32: Fixed various types, and adjusted some sentences to read easier/better.</p>
<hr />
<div>There are a few hardware differences and software differences between development kits, but generally the following hardware is known to be exist:<br />
* Alpha I and II kits<br />
* DVT3 Development Kits<br />
* DVT4 Development Kits<br />
* Debug kits<br />
<br />
Further more are differences internally from diferent MCP revisions, GPU revisions and board layouts. Sega Chihiro boards seem to be based on DVT4 Development/Debug kits. either using overproduction or on purpose produced MCPX-X2 as found in the development kits and debugkits.<br />
<br />
Some rare boards are found with different MCPX chips that also have a special port near the CPU, and a extra USB port on the backside of the board (connected to the MCPX to unknown port) its been rumored that the blocked USB port (unblocked on DVT3) on the back of Development kits where either a leftover of these extra usb port or used for JVS development and/or testing. <br />
<br />
== Alpha ==<br />
{{FIXME| needs checking with real ALpha 1 and 2}}<br />
Contructed using "off the shelf" hardware, probably before retail release from Intel. <br />
The alpha hardware allowed kernel debugging to be done over one of the rs232 ports and standard WinDBG software can make these messages and control work.<br />
This allows of careful debugging of the running kernel to diagnose occuring faults or errors. <br />
At early boot of the recovery software, a network IP address is attempted, probably to setup for another way of diagnosing and remote control using the available software like later XDK software.<br />
<br />
The Alpha is built with the following parts or software:<br />
=== Alpha I ===<br />
* Intel VC820, running a pre-release BIOS<br />
* 128Mb RDRAM with an terminator<br />
* 600Mhz CPU<br />
* Nvidia Geforce 2 GTS 64MB<br />
* A xircom PCPGI2(OPTI 82C861) 2 USB port PCI card <br />
* Intel 82559(ic) Network card {{FIXME}}<br />
* Hard drive is a WD205AA (20.5 Gb) or fujitsu MPF3204AT (20.4 Gb)<br />
* ATNG 250w or a 300w powersupply<br />
<br />
These were then programmed by use of a recovery disk that "recovered" the system.<br />
The case is a customized globalwin ycc-802. (color silver and an added jewel)<br />
<br />
=== Alpha II ===<br />
The Alpha II was an upgrade kit or constructed the same as a Alpha I with the following upgrades:<br />
* 733MHz CPU SL3XN<br />
* Nvidia Geforce3 NV20 (64MB ram) with a Pre-retail firmware (180-p0050-0000-a09)<br />
<br />
A supplied Recovery made the necessary firmware upgrades{{citation needed}} and updated the dashboard.<br />
<br />
=== Franken Alpha ===<br />
This is a listing of notes on how to make a Alpha I or II yourself, also known as a FrankenAlpha.<br />
<br />
Same hardware as a Alpha I/II, but you dont seem to need the pre-retail firmwares or BIOSes.<br />
Also, any Geforce3 is rumoured to work, as long as the GPU is of the NV20 series. The AV out sub-board isn't necessary, as VGA seems to work fine. color or different kinds of fans, cooling blocks or OEM vendor names doesnt seem to matter.<br />
The Opti usb board can be green, yellow or black. as long as the IC sports the 82C861 wording.<br />
if the VC820 sports any USB or Sound, it will not be used, the listed hardware boards are used instead, regardless of other hardware. (drivers arent in the kernel).<br />
<br />
==== Posible solutions on fixing a (franken) alpha(2) ====<br />
While fixing a frankenalpha, the following kernel errors occured while intentionally incorrectly installing or configuring the computer.<br />
These results may vary with official parts, configs, BIOS or firmware. Or due to differences in hardware.<br />
These are results from recovery 3521 as earlier ones did not work on the Alpha under test.<br />
<br />
;IDEX hard disk not configured (status=51).<br />
:HDD too small<br />
;IDEX hard disk not configured (status=ff).<br />
:HDD on the wrong bus, put on primary channel.(maybe wrong place on the cable itself) maybe add a jumper for master select?<br />
;IDEX hard disk not found (status=7f).<br />
:HDD not connected (or dead)<br />
;MP No video output because you are using an older video card.<br />
:Well, insert a Geforce3 card (NV20 based)<br />
;WRN[XNET] EnetInitialize failed 0x801f0001<br />
:Logo loads, with a halt when the sparkly bit is on the B of Xbox. The network card is missing, insert a GD82559 based intel network card FCC: EJMNPDALBANY (worked for me)<br />
;[XNET] NicExecuteActionCmdAndWait failed!WRN[XNET] EnetInitialize failed 0x801f0001<br />
:Network on wrong pci lane or no screen connected (VGA or S-video)<br />
* Tested Slot 1 as good (real close to the GPU, would not recommend)<br />
* Tested Slot 2 as not good<br />
* Tested Slot 3 as not good (*** Assertion failed: hwres.ResourceData.Address[0].Type == CmResourceTypeMemory<br />
* Tested Slot 4 as good<br />
* Tested Slot 5 as not good<br />
<br />
These might be wrong for official alphas or only for the particular motherboard that was being tested.<br />
<br />
== Debug ==<br />
Shaped and main parts consist of retail hardware with the following differences:<br />
* 128MB ram instead of default 64MB ram<br />
* MCPX revision X2, thus capable of running only Debug signed code{{FIXME|reason= can it still run retail code?}}<br />
* Hardisks loaded with retail and Debug shell files<br />
<br />
== DVT3/DVT4 ==<br />
Harddisk is said to be locked by default with a 16size byte 0x00 key, but allowing to run with an unlocked harddrive of any size(larger then 20GB{{citation needed}} for minimal OS).DVT3 seems to have the back USB port to be uncovered and a slightly more glossy or shinier jewel on the top of the case. According to some sources, the DVT3 cannot be updated to further kernels/dashboards than 3911, the lowest/oldest being 3823.1(Borman said this?){{citation needed}}<br />
<br />
All functions a debug with the addition of:<br />
* [[DVD_Emulator | DVD emulation]]<br />
* [[Kernel Debugging | Kernel_Debug]] over a dedicated [[Super_I/O | IO board ]]</div>Redherring32https://xboxdevwiki.net/index.php?title=Hardware_Revisions&diff=6774Hardware Revisions2019-09-28T00:52:46Z<p>Redherring32: /* History of Xbox 1.5 */</p>
<hr />
<div>There were several different retail Xbox hardware revisions, which include the following:<br />
<br />
* Xbox 1.0<br />
** USB controller is on a separate PCB<br />
** GPU has a fan on the heat sink<br />
* Xbox 1.1<br />
** USB controller moved onto the motherboard<br />
** Fan removed from the GPU heat sink<br />
* Xbox 1.2<br />
** TSOP Size now 256k (Initial Size 1024k)<br />
** Updated Board Layout<br />
** Switched to ATX Power connector<br />
* Xbox 1.3<br />
** Removed LFrame signal from LPC Port<br />
* Xbox 1.4<br />
** Updated Board Layout<br />
** Switched to the "Focus" Video Encoder<br />
* Xbox 1.5 <br />
** 3.3v and GND removed from LPC<br />
* Xbox 1.6<br />
** New Board Layout with additional RAM Pads removed<br />
** Removed data and power lines from LPC port<br />
** Xyclops chip (includes ROM instead of flash = BIOS no longer flashable)<br />
** Switched to the "XCalibur" Video Encoder<br />
** Microsoft later switched to lower quality Hynix RAM. These Xboxes with non-Samsung RAM are sometimes referred to as 1.6b by the modding community.<br />
<br />
You can find more information about the hardware used in each revision below.<br />
<br />
== History of Xbox 1.5 ==<br />
<br />
There has been no conclusive evidence pointing to their existence, and all 1.5 sightings to date have turned out to be 1.4 boards.<br />
They possibly never existed{{citation needed}}, but will otherwise be very rare. Production was halted and 1.4 was produced again{{citation needed|reason=Sooo.. do these exist or not?!}}.<br />
<br />
== Identifying ==<br />
<br />
While not definitive, here are some ways to help identify the revision of your Xbox.<br />
<br />
=== Manufacturing Details ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Date Range<br />
! scope="col" | Revision<br />
! scope="col" | Location<br />
|-<br />
| 01/2001–07/2002 || 1.0 || Hungary, Mexico<br />
|-<br />
| 08/2002-01/2003 || 1.1 || China, Mexico<br />
|-<br />
| 01/2003-03/2003 || 1.2 || China<br />
|-<br />
| 04/2003-07/2003 || 1.3 || China<br />
|- <br />
| 09/2003-03/2004 || 1.4,1.5 || China<br />
|-<br />
| 04/2004-09/2004 || 1.6 || China, Taiwan<br />
|- <br />
| 09/2004-08/2005 || 1.6b || China, Taiwan<br />
|}<br />
<br />
=== Serial Number ===<br />
<br />
The serial number looks like this:<br />
<br />
LNNNNNN YWWFF<br />
<br />
* L is the production line<br />
* NNNNNN is the number produced that week<br />
* Y is the last digit of the production year<br />
* WW is the number of the week<br />
* FF is the factory code<br />
<br />
Note, this table contradicts the previous table.<br />
<br />
{| class="wikitable"<br />
! scope="col" | Factory<br />
! scope="col" | Location<br />
! scope="col" | Revision<br />
|-<br />
| 02 || Mexico || 1.0 or 1.1<br />
|-<br />
| 03 || Hungary || 1.0<br />
|-<br />
| 05 || China || 1.1 or later<br />
|-<br />
| 06 || Taiwan || 1.2 or later<br />
|}<br />
<br />
{| class="wikitable"<br />
! scope="col" | Serial Number<br />
! scope="col" | Revision<br />
|-<br />
| LNNNNNN 20WFF || 1.0<br />
|-<br />
| LNNNNNN 21WFF || 1.0<br />
|-<br />
| LNNNNNN 23WFF || 1.0 or 1.1<br />
|-<br />
| LNNNNNN 24WFF || 1.1<br />
|-<br />
| LNNNNNN 25WFF || 1.1<br />
|-<br />
| LNNNNNN 30WFF || 1.2<br />
|-<br />
| LNNNNNN 31WFF || 1.3<br />
|-<br />
| LNNNNNN 32WFF || 1.3<br />
|-<br />
| LNNNNNN 33WFF || 1.4 or 1.5<br />
|-<br />
| LNNNNNN 42WFF || 1.6<br />
|-<br />
| LNNNNNN 43WFF || 1.6b<br />
|}<br />
<br />
=== DVD Drive ===<br />
<br />
There are four retail drives known to be used by Microsoft in the retail version of the console.<br />
Any Xbox DVD drive can be used in any retail Xbox.<br />
<br />
List of Xbox DVD Drive manufacturers<br />
* Thomson (Xbox 1.0, 1.1)<br />
* Philips (Xbox 1.1 and above)<br />
* Samsung (Any)<br />
* Hitachi-LG (8050L)(mainly 1.6?)<br />
<br />
[[File:Xbox_drivedetermination.png|Xbox DVD Drive determination]]<br />
<br />
==== THOMSON TGM600 ====<br />
<br />
The first manufacture is sadly also the worst of all Dvdrom drives manufactured for the original xbox.<br />
It has a Cirrus Logic CL-CR3710-60EC-F as its main controller and a 8/3062 HD 64F3062F25 16bit H8/300H secondary samller MPU,at 25Mhz <br />
Unkown sofar if there is external flash or if its inside the Cirrus Logic IC.<br />
<br />
==== SAMSUNG SDG605 ====<br />
<br />
The Samsung drive is a very popular DVDrom drive for its compatibility for most media types and better quality laser. There are 2 mayor revisions found for this manufacturer<br />
* X00603-005 Plays CDR <br />
* X00603-006 Wont play CDR<br />
<br />
The DVDrom drive is using the MT1358E (MT1359E is the 360 Sata version) from Mediatek, and has a 39SF020A flashrom.<br />
If the firmware from this drive is applied to a SAMSUNG 616T or 616F PC dvd drive it will behave as a Xbox one, modified hardware will allow for tray state and eject to work.<br />
<br />
==== PHILLIPS VAD6053 ====<br />
<br />
Also named: VAD6011/21 apear to have no brand or partnumber on its large main controller,might be Cirrus Logic based on its size and use of a Philips secondary smaller mcu. flash might be a 39SF020A from SST. The laser ribbon cable connector is different for its various revisions, a detail one must take into account when swapping controller boards.<br />
<br />
There should be a tutorial on how to convert a PC dvdrom drive Pioneer 500M with the Philips firmware to be a Xbox dvdrom drive.<br />
<br />
==== HITACHI GDR-8050L ====<br />
<br />
The latest manufacture for the DVDrom drive probably used a Panasonic MN103S89FDA for its main controler, appears to have no external flashrom.<br />
with this firmware and modified hardware for Eject and traystate, a LG GDR-8163B or LG DRD-8160B might act as a drop in replacement after altering either case.<br />
<br />
===Hitachi-LG GDR-8050L ===<br />
This DVD-rom drive, most commonly found in Xbox 1.6 and 1.6b is capable of reading DVD-+R, DVD-RW and CDRW media, but fails to boot most CD-R discs source: [http://www.xbox-hq.com/html/article1535.html xbox-hq.com Hitachi-LG GDR-8050L DVD Drive In Xbox].<br />
<br />
on 30 January 2006 TheSpecialist posted at Xboxhacker.net that he successfully flashed a Hitachi drive to boot a copied game on an unmodded xbox: [https://web.archive.org/web/20080316154615/http://www.xboxhacker.net/index.php?option=com_smf&Itemid=33&topic=285.0 breakthrough: XBOX 1 firmware hacked !]<br />
<br />
=== Hard Drive ===<br />
<br />
{| class="wikitable<br />
|-<br />
! Revision<br />
! Drive Manufacturer<br />
! Drive Model Number<br />
! Capacity<br />
|-<br />
| 1.0<br />
| Seagate<br />
| ST310211A<br />
| 10G<br />
|-<br />
| 1.0 (XB:2001-10-26 FF=02)<br />
| Western Digital<br />
| WD80EB-00CGH0<br />
| 8G<br />
|-<br />
| 1.1 (XB:2001-10-29 FF=03)<br />
| Western Digital<br />
| WD80EB-28CGH1<br />
| 8G<br />
|-<br />
| 1.2<br />
| Western Digital<br />
| WD80EB-28DFH2<br />
| 8G<br />
|-<br />
| 1.3+<br />
| Seagate<br />
| ST10014ACE<br />
| 10G<br />
|}<br />
<br />
=== Video encoder ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Video Chip<br />
! scope="col" | Revision<br />
|-<br />
| Conexant || 1.0, 1.1, 1.2, 1.3<br />
|-<br />
| Focus || 1.4, 1.5<br />
|-<br />
| Xcalibur || 1.6<br />
|}<br />
<br />
=== EEPROM ===<br />
<br />
{| class="wikitable"<br />
! Xbox Model<br />
! Manufacturer<br />
! Model<br />
|-<br />
| 1.4 (Others?)<br />
| Catalyst<br />
| CAT24WC02J<br />
|}<br />
<br />
=== MCPX Version ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | MCPX Version<br />
! scope="col" | Revision<br />
|-<br />
| 1.0 || 1.0<br />
|-<br />
| 1.1 || 1.1 - 1.6<br />
|}<br />
<br />
=== BIOS Version ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Kernel Version<br />
! scope="col" | Revision<br />
|-<br />
| 3944, 4034, 4036, 4627 || 1.0<br />
|-<br />
| 4817, 4972 || 1.1<br />
|-<br />
| 5101, 5713 || 1.2 - 1.5<br />
|-<br />
| 5838 || 1.6<br />
|}<br />
<br />
== References ==<br />
<br />
* [http://www.informit.com/articles/article.aspx?p=367210&seqNum=2 InformIT Methods of Identification]<br />
* [http://www.informit.com/articles/article.aspx?p=367210 InformIT Identifying your Xbox Revision]</div>Redherring32https://xboxdevwiki.net/index.php?title=Memory&diff=6752Memory2019-07-16T18:03:14Z<p>Redherring32: </p>
<hr />
<div>The Xbox has 64MB Memory. This could be expanded to 128MB of memory (and the motherboard has empty spots where these could have been) but no games took advantage of it. The debug Xbox and the Chihiro both contained 128MB Memory.<br />
<br />
The memory was shared between the CPU and GPU. On the retail Xbox, the [[Flash ROM]] and [[MCPX ROM]] are also mapped to memory at the top 16 MiB and the top 512 Bytes respectively. However on Debug Xboxes and Chihiro, only the Flash is mapped as they don't contain an MCPX ROM.<br />
<br />
{| class="wikitable" style="text-align: center;"<br />
! Memory Type<br />
! Retail Xbox Range<br />
! Debug/Chihiro Range<br />
|-<br />
|Main Memory<br />
|0x00000000 - 0x03FFFFFF<br />
|0x00000000 - 0x07FFFFFF<br />
|-<br />
|[[GPU|GPU (NV2A) Registers]]<br />
|colspan="2"|0xFD000000 - 0xFDFFFFFF<br />
|-<br />
|[[APU|APU Registers]]<br />
|colspan="2"|0xFE800000 - 0xFE87FFFF<br />
|-<br />
|ACI (AC97) Registers<br />
|colspan="2"|0xFEC00000 - 0xFEC00FFF<br />
|-<br />
|USB 0 Registers<br />
|colspan="2"|0xFED00000 - 0xFED00FFF<br />
|-<br />
|USB 1 Registers<br />
|colspan="2"|0xFED08000 - 0xFED08FFF<br />
|-<br />
|NIC (NVNet) Registers<br />
|colspan="2"|0xFEF00000 - 0xFEF003FF<br />
|-<br />
|[[Flash ROM]]<br />
|colspan="2"|0xFF000000 - 0xFFFFFFFF<br />
|-<br />
|[[MCPX ROM]]<br />
|0xFFFFFE00 - 0xFFFFFFFF<br />
|N/A<br />
|}<br />
<br />
Code for emulating the memory might consist of:<br />
<br />
<pre><br />
#ifdef DEBUG || CHIHIRO<br />
#define MEMORY_SIZE 128 * 1024 * 1024<br />
int mcpx_active = 0;<br />
#else<br />
#define MEMORY_SIZE 64 * 1024 * 1024<br />
int mcpx_active = 1;<br />
#endif<br />
<br />
#define FLASH_SIZE 256 * 1024<br />
#define FLASH_MAP_SIZE 16 * 1024 * 1024<br />
#define FLASH_MAP_ADDRESS (0xFFFFFFFF - FLASH_MAP_SIZE + 1)<br />
<br />
#define MCPX_SIZE 0x200<br />
#define MCPX_MAP_ADDRESS (0xFFFFFFFF - MCPX_MAP_SIZE + 1)<br />
<br />
uint8_t memory[MEMORY_SIZE] = {0};<br />
uint8_t flash[FLASH_SIZE] = {0};<br />
uint8_t mcpx[MCPX_SIZE] = {0};<br />
<br />
uint8_t get_memory_byte(uint32_t location) {<br />
if (location < MEMORY_SIZE) {<br />
return memory[location];<br />
}<br />
<br />
if (mcpx_active && location >= MCPX_MAP_ADDRESS) {<br />
return mcpx[location - MCPX_MAP_ADDRESS];<br />
}<br />
<br />
if (location >= FLASH_MAP_ADDRESS) {<br />
return flash[(location - FLASH_MAP_ADDRESS) % FLASH_SIZE];<br />
}<br />
<br />
printf("Memory in unspecified range: %08X\n", location);<br />
return 0;<br />
}<br />
<br />
uint16_t get_memory_word(uint32_t location) {<br />
return get_memory_byte(location + 1) << 8 | get_memory_byte(location);<br />
}<br />
<br />
uint32_t get_memory_dword(uint32_t location) {<br />
return get_memory_word(location + 2) << 16 | get_memory_word(location);<br />
}<br />
<br />
void deactivate_mcpx() {<br />
mcpx_active = 0;<br />
}<br />
</pre></div>Redherring32https://xboxdevwiki.net/index.php?title=NV2A&diff=6751NV2A2019-07-16T18:01:38Z<p>Redherring32: </p>
<hr />
<div>The NV2A is the northbridge of the chipset, as well as the GPU. <br />
<br />
== GPU ==<br />
<br />
The GPU is part of the NV20 family (Kelvin)[https://nouveau.freedesktop.org/wiki/CodeNames/]:<br />
<br />
{| class="wikitable"<br />
! Code name !! Official Name<br />
|-<br />
|NV20 || GeForce3 (Ti)<br>Quadro DCC<br />
|-<br />
|NV25 || GeForce4 Ti 4200, Ti 4400, Ti 4600<br>Quadro4 700 XGL, 750 XGL, 900 XGL<br />
|-<br />
|NV28 || GeForce4 Ti 4200-8X, Ti 4800 (SE), 4200 Go<br>Quadro4 780 XGL, 980 XGL<br />
|-<br />
|NV2A || Xbox GPU <br />
|}<br />
<br />
== Notes ==<br />
<br />
* [https://web.archive.org/web/20031004105935/http://developer.nvidia.com:80/object/nv30_emulation.html NV30 information and emulator]<br />
* [https://developer.download.nvidia.com/opengl/specs/nv30specs.pdf List of implemented GL extensions for NV10-NV30: "NVIDIA OpenGL Extension Specifications for the CineFX Architecture (NV3x)", 13 Nov. 2006]<br />
<br />
[[Category:NV2A]]</div>Redherring32https://xboxdevwiki.net/index.php?title=CPU&diff=6750CPU2019-07-16T17:59:05Z<p>Redherring32: </p>
<hr />
<div>The CPU in the Xbox was a custom Pentium III running at 733MHz. The 'custom' part of this was that the Pentium III in the Xbox only had a 128KB L2 cache instead of the usual 256KB. This allowed Microsoft to buy them at a bit of a discount and Intel to shift a few more CPUs{{citation needed}}.<br />
<br />
== References ==<br />
<br />
* [http://www.intel.com/content/dam/support/us/en/documents/processors/mobile/celeron/sb/28365403.pdf Mobile Intel® Celeron® Processor (0.18μ) in BGA2 and Micro-PGA2 Packages] This datasheet is for the mobile version Coppermine with 256kB L2 cache. It does not contain the Xbox Coppermine-128 with 128kB L2 cache at 733MHz (S-Spec SL5SN). No such datasheet exists. Both differences are pin compatible.<br />
* [https://www.intel.com/content/dam/support/us/en/documents/processors/mobile/celeron/sb/24542154.pdf Mobile Intel® Celeron® Processor (0.18μ and 0.13μ) Specification Update] This document should contain the errata for the Xbox CPU.<br />
* [https://www.google.com/patents/US20050282621 CPU upgrading adapter for a Microsoft XboxTM game machine] US Patent Application 20050282621 by Friendtech, filed 2003-08-21.</div>Redherring32https://xboxdevwiki.net/index.php?title=Motherboard&diff=6749Motherboard2019-07-16T17:55:53Z<p>Redherring32: /* Xbox 1.0 */</p>
<hr />
<div>For a list of differences between these mainboards, also see [[Hardware Revisions]].<br />
<br />
== Xbox 1.0 ==<br />
<br />
[[File:Xbox-Motherboard-BR.jpg|400px|thumb|right|Xbox Version 1.0 Motherboard]]<br />
<br />
The following table is based on an Xbox 1.0{{citation needed}} retail board.<br />
<br />
{| class="wikitable"<br />
!| Device<br />
! Loc.<br />
! Part Number<br />
! Manufacture<br />
! Description<br />
|- <br />
| U2D1 <br />
| D-2<br />
| Pentium III (Coppermine)<br />
| Intel <br />
| 733MHz CPU 133MHz FSB 16Kb L1 cache 128Kb L2 cache<br />
|- <br />
| U2T1<br />
| T-2 <br />
| SC1186<br />
| Semtech<br />
| Programmable Synchronous DC/DC Converter<br />
|-<br />
| U3B1<br />
| B-3<br />
| LM358D<br />
| Phillips<br />
| Dual Operational Amplifier<br />
|-<br />
| U3B2<br />
| B-4<br />
| XGPU<br />
| nVidia<br />
| Graphics Processing Unit<br />
|-<br />
| U3R1<br />
| R-3<br />
| CY23S05<br />
| Cypress<br />
| Low-Cost 3.3V Spread Aware Zero Delay Buffer<br />
|-<br />
| U3T1<br />
| T-3<br />
| K4D263238M<br />
| Samsung<br />
| 1Mx32Bitx4 DDR Synchronous RAM<br />
|-<br />
| U4B1<br />
| B-4<br />
| CX25871<br />
| Conexant<br />
| Digital Video Encoder (same pinout as Bt868/869)<br />
|-<br />
| U4G1<br />
| G-5<br />
| SC1110CS<br />
| Semtech<br />
| Sink and Source DC/DC Controller for Termination Power Supply<br />
|-<br />
| U5F1<br />
| F-5<br />
| K4D263238M<br />
| Samsung<br />
| 1Mx32Bitx4 DDR Synchronous RAM<br />
|-<br />
| U6A1<br />
| A-6<br />
| LF353<br />
| Texas Instruments<br />
| Dual General-Purpose JFET-input Operational Amplifier<br />
|-<br />
| U6B1<br />
| B-6<br />
| WM9709<br />
| Wolfson Micro<br />
| High-quality stereo audio DAC (Digital to Analog converter)<br />
|-<br />
| U6D1<br />
| D-6<br />
| K4D263238M<br />
| Samsung<br />
| 1Mx32Bitx4 DDR Synchronous RAM<br />
|-<br />
| U6E1<br />
| E-6<br />
| MCPX<br />
| nVidia<br />
| Media and Communications Processor<br />
|-<br />
| U6F1<br />
| F-6<br />
| ADM1032<br />
| Analog Devices<br />
| +-1°C Remote and Local System Temperature Monitor<br />
|-<br />
| U6N1 <br />
| N-6<br />
| K4D263238M<br />
| Samsung<br />
| 1Mx32Bitx4 DDR Synchronous RAM<br />
|-<br />
| U7B1<br />
| B-7<br />
| 1893AF<br />
| Integrated Circuit Systems<br />
| 3.3V 10Base-T/100Base-TX Integrated PHYceiver<br />
|-<br />
| U7B2<br />
| B-7<br />
| PIC16LC63A-04/S0 <br />
| Microchip<br />
| Low voltage 8bit CMOS microcontroller with A/D converter<br />
|-<br />
| U7C1<br />
| C-7<br />
| 388R<br />
| Integrated Circuit Systems<br />
| Quad PLL Quick Turn Clock Synthesizer<br />
|-<br />
| U7C2 <br />
| C-7<br />
| BR24C02<br />
| Rohm<br />
| I2C BUS compatible Serial EEPROM<br />
|-<br />
| U7C3<br />
| C-7<br />
| 331M<br />
| Integrated Circuit Systems<br />
| Single Output Clock<br />
|-<br />
| U7D1<br />
| D-7<br />
| M29F080A<br />
| ST Microelectronics<br />
| 8 MBit (1MB X8, Uniform block) single supply flash memory<br />
|-<br />
| U7P1<br />
| P-7 <br />
| <empty><br />
| <n/a> <br />
| <n/a><br />
|}<br />
<br />
=== USB Daughterboard ===<br />
<br />
{| class="wikitable"<br />
!| Device<br />
! Part Number<br />
! Manufacture<br />
! Description<br />
|- <br />
| U2 <br />
| TUSB2046B<br />
| Texas Instruments<br />
| 4-Port Hub for USB w/Optional Serial EEPROM Interface<br />
|}<br />
<br />
== Xbox 1.1 ==<br />
<br />
{{FIXME}}<br />
<br />
== Xbox 1.2 ==<br />
<br />
{{FIXME}}<br />
<br />
== Xbox 1.3 ==<br />
<br />
{{FIXME}}<br />
<br />
== Xbox 1.4 ==<br />
<br />
{{FIXME}}<br />
<br />
== Xbox 1.5 ==<br />
<br />
{{FIXME}}<br />
<br />
== Xbox 1.6 ==<br />
<br />
{{FIXME}}<br />
<br />
== References ==<br />
* [https://web.archive.org/web/20040826151041/http://console-dev.com:80/IC.htm http://console-dev.com:80/IC.htm Documentation by PiXEL8]</div>Redherring32https://xboxdevwiki.net/index.php?title=Flash_ROM&diff=6748Flash ROM2019-07-16T17:55:11Z<p>Redherring32: </p>
<hr />
<div>The Flash is a 256 kiB or 1 MiB [[Wikipedia:Flash_memory|non-volatile <abbr title="Thin Small Outline Package">TSOP</abbr> ROM chip]] and connected to the [[MCPX]] via the [[Wikipedia:Low Pin Count|<abbr title="Low Pin Count">LPC</abbr>]] bus.<br />
<br />
The Flash ROM is mapped at 0xFFF00000 (if the ROM is 1 MiB; 0xFFFC0000, if the ROM is 256 kiB) in the Xbox kernel. <br />
<br />
For the content of the Microsoft flash images see [[BIOS]].</div>Redherring32https://xboxdevwiki.net/index.php?title=Hardware_Revisions&diff=6747Hardware Revisions2019-07-16T05:49:24Z<p>Redherring32: </p>
<hr />
<div>There were several different retail Xbox hardware revisions, which include the following:<br />
<br />
* Xbox 1.0<br />
** USB controller is on a separate PCB<br />
** GPU has a fan on the heat sink<br />
* Xbox 1.1<br />
** USB controller moved onto the motherboard<br />
** Fan removed from the GPU heat sink<br />
* Xbox 1.2<br />
** Switched to ATX Power connector<br />
* Xbox 1.3<br />
** Removed LFrame signal from LPC Port<br />
* Xbox 1.4<br />
* Xbox 1.5 <br />
** 3.3v and GND removed from LPC<br />
* Xbox 1.6<br />
** Removed data and power lines from LPC port<br />
** Xyclops chip (includes ROM instead of flash = BIOS no longer flashable)<br />
** Microsoft later switched to lower quality Hynix RAM. These Xboxes with non-Samsung RAM are sometimes referred to as 1.6b by the modding community.<br />
<br />
You can find more information about the hardware used in each revision below.<br />
<br />
== History of Xbox 1.5 ==<br />
<br />
Possibly never existed{{citation needed}}, but will otherwise be very rare. Production was halted and 1.4 was produced again{{citation needed|reason=Sooo.. do these exist or not?!}}.<br />
<br />
<br />
== Identifying ==<br />
<br />
While not definitive, here are some ways to help identify the revision of your Xbox.<br />
<br />
=== Manufacturing Details ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Date Range<br />
! scope="col" | Revision<br />
! scope="col" | Location<br />
|-<br />
| 01/2001–07/2002 || 1.0 || Hungary, Mexico<br />
|-<br />
| 08/2002-01/2003 || 1.1 || China, Mexico<br />
|-<br />
| 01/2003-03/2003 || 1.2 || China<br />
|-<br />
| 04/2003-07/2003 || 1.3 || China<br />
|- <br />
| 09/2003-03/2004 || 1.4,1.5 || China<br />
|-<br />
| 04/2004-09/2004 || 1.6 || China, Taiwan<br />
|- <br />
| 09/2004-08/2005 || 1.6b || China, Taiwan<br />
|}<br />
<br />
=== Serial Number ===<br />
<br />
The serial number looks like this:<br />
<br />
LNNNNNN YWWFF<br />
<br />
* L is the production line<br />
* NNNNNN is the number produced that week<br />
* Y is the last digit of the production year<br />
* WW is the number of the week<br />
* FF is the factory code<br />
<br />
Note, this table contradicts the previous table.<br />
<br />
{| class="wikitable"<br />
! scope="col" | Factory<br />
! scope="col" | Location<br />
! scope="col" | Revision<br />
|-<br />
| 02 || Mexico || 1.0 or 1.1<br />
|-<br />
| 03 || Hungary || 1.0<br />
|-<br />
| 05 || China || 1.1 or later<br />
|-<br />
| 06 || Taiwan || 1.2 or later<br />
|}<br />
<br />
{| class="wikitable"<br />
! scope="col" | Serial Number<br />
! scope="col" | Revision<br />
|-<br />
| LNNNNNN 20WFF || 1.0<br />
|-<br />
| LNNNNNN 21WFF || 1.0<br />
|-<br />
| LNNNNNN 23WFF || 1.0 or 1.1<br />
|-<br />
| LNNNNNN 24WFF || 1.1<br />
|-<br />
| LNNNNNN 25WFF || 1.1<br />
|-<br />
| LNNNNNN 30WFF || 1.2<br />
|-<br />
| LNNNNNN 31WFF || 1.3<br />
|-<br />
| LNNNNNN 32WFF || 1.3<br />
|-<br />
| LNNNNNN 33WFF || 1.4 or 1.5<br />
|-<br />
| LNNNNNN 42WFF || 1.6<br />
|-<br />
| LNNNNNN 43WFF || 1.6b<br />
|}<br />
<br />
=== DVD Drive ===<br />
<br />
There are four retail drives known to be used by Microsoft in the retail version of the console.<br />
Any Xbox DVD drive can be used in any retail Xbox.<br />
<br />
List of Xbox DVD Drive manufacturers<br />
* Thomson (Xbox 1.0, 1.1)<br />
* Philips (Xbox 1.1 and above)<br />
* Samsung (Any)<br />
* Hitachi-LG (8050L)(mainly 1.6?)<br />
<br />
[[File:Xbox_drivedetermination.png|Xbox DVD Drive determination]]<br />
<br />
===Hitachi-LG GDR-8050L ===<br />
This DVD-rom drive, most commonly found in Xbox 1.6 and 1.6b is capable of reading DVD-+R, DVD-RW and CDRW media, but fails to boot most CD-R discs source: [http://www.xbox-hq.com/html/article1535.html xbox-hq.com Hitachi-LG GDR-8050L DVD Drive In Xbox].<br />
<br />
on 30 January 2006 TheSpecialist posted at Xboxhacker.net that he successfully flashed a Hitachi drive to boot a copied game on an unmodded xbox: [https://web.archive.org/web/20080316154615/http://www.xboxhacker.net/index.php?option=com_smf&Itemid=33&topic=285.0 breakthrough: XBOX 1 firmware hacked !]<br />
<br />
=== Hard Drive ===<br />
<br />
{| class="wikitable<br />
|-<br />
! Revision<br />
! Drive Manufacturer<br />
! Drive Model Number<br />
! Capacity<br />
|-<br />
| 1.0<br />
| Seagate<br />
| ST310211A<br />
| 10G<br />
|-<br />
| 1.0 (XB:2001-10-26 FF=02)<br />
| Western Digital<br />
| WD80EB-00CGH0<br />
| 8G<br />
|-<br />
| 1.1 (XB:2001-10-29 FF=03)<br />
| Western Digital<br />
| WD80EB-28CGH1<br />
| 8G<br />
|-<br />
| 1.2<br />
| Western Digital<br />
| WD80EB-28DFH2<br />
| 8G<br />
|-<br />
| 1.3+<br />
| Seagate<br />
| ST10014ACE<br />
| 10G<br />
|}<br />
<br />
=== Video encoder ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Video Chip<br />
! scope="col" | Revision<br />
|-<br />
| Conexant || 1.0, 1.1, 1.2, 1.3<br />
|-<br />
| Focus || 1.4, 1.5<br />
|-<br />
| Xcalibur || 1.6<br />
|}<br />
<br />
=== EEPROM ===<br />
<br />
{| class="wikitable"<br />
! Xbox Model<br />
! Manufacturer<br />
! Model<br />
|-<br />
| 1.4 (Others?)<br />
| Catalyst<br />
| CAT24WC02J<br />
|}<br />
<br />
=== MCPX Version ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | MCPX Version<br />
! scope="col" | Revision<br />
|-<br />
| 1.0 || 1.0<br />
|-<br />
| 1.1 || 1.1 - 1.6<br />
|}<br />
<br />
=== BIOS Version ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Kernel Version<br />
! scope="col" | Revision<br />
|-<br />
| 3944, 4034, 4036, 4627 || 1.0<br />
|-<br />
| 4817, 4972 || 1.1<br />
|-<br />
| 5101, 5713 || 1.2 - 1.5<br />
|-<br />
| 5838 || 1.6<br />
|}<br />
<br />
== References ==<br />
<br />
* [http://www.informit.com/articles/article.aspx?p=367210&seqNum=2 InformIT Methods of Identification]<br />
* [http://www.informit.com/articles/article.aspx?p=367210 InformIT Identifying your Xbox Revision]</div>Redherring32https://xboxdevwiki.net/index.php?title=MCPX&diff=6746MCPX2019-07-16T05:46:10Z<p>Redherring32: </p>
<hr />
<div>The MCPX is the southbridge chip of the Xbox chipset made by Nvidia. It contains the sound processors ([[APU]] and [[ACI]]) as well as the USB, PCI, IDE, etc, controllers [https://web.archive.org/web/20010418214256/http://www.ga-hardware.com:80/preview.cfm?id=NVIDIAMCP], [https://web.archive.org/web/20010410003338/http://www.nvnews.net/previews/mcpx/mcpx.shtml].<br />
<br />
== ROM ==<br />
<br />
The MCPX is home to the secret [[MCPX ROM]].<br />
<br />
== Pin L21: PC Speaker ==<br />
<br />
The MCPX has a PC Speaker pin which can be controlled using [https://wiki.osdev.org/PC_Speaker the standard PC Speaker interface].<br />
However, no actual speaker is connected to the pin, so while the signal exists, there will be no audible sound on a stock Xbox.<br />
<br />
A speaker can be soldered to this pin in order to make the signal audible [https://www.youtube.com/watch?v=Te4MSskbBEE][https://github.com/0DaveX/beep/]<br />
<br />
The original Microsoft code does not drive the PC Speaker at all, so this otherwise unused pin can also be used for inaudible forms of unidirectional communication.<br />
<br />
<br />
<br />
<gallery mode="slideshow"><br />
Image:XboxWithPcSpkr.jpg|'' ''<br />
Image:XboxPcSpkrTrace.jpg|'' ''<br />
Image:XboxPcSpkrSolderPoints.jpg|'' ''<br />
</gallery><br />
<br />
== See Also ==<br />
* [[NForce]]<br />
* [http://siliconpr0n.org/archive/doku.php?id=azonenberg:nvidia:mcpx Die Inspection]</div>Redherring32https://xboxdevwiki.net/index.php?title=MCPX&diff=6745MCPX2019-07-16T05:39:43Z<p>Redherring32: /* Pin L21: PC Speaker */</p>
<hr />
<div>The MCPX is the southbridge chip of the Xbox chipset by Nvidia. It contains the sound processors ([[APU]] and [[ACI]]) and also the USB, PCI, IDE, etc, controllers [https://web.archive.org/web/20010418214256/http://www.ga-hardware.com:80/preview.cfm?id=NVIDIAMCP], [https://web.archive.org/web/20010410003338/http://www.nvnews.net/previews/mcpx/mcpx.shtml].<br />
<br />
== ROM ==<br />
<br />
The MCPX is home to the secret [[MCPX ROM]].<br />
<br />
== Pin L21: PC Speaker ==<br />
<br />
The MCPX has a PC Speaker pin which can be controlled using [https://wiki.osdev.org/PC_Speaker the standard PC Speaker interface].<br />
However, no actual speaker is connected to the pin, so while the signal exists, there will be no audible sound on a stock Xbox.<br />
<br />
A speaker can be soldered to this pin in order to make the signal audible [https://www.youtube.com/watch?v=Te4MSskbBEE][https://github.com/0DaveX/beep/]<br />
<br />
The original Microsoft code does not drive the PC Speaker at all, so this otherwise unused pin can also be used for inaudible forms of unidirectional communication.<br />
<br />
<br />
<br />
<gallery mode="slideshow"><br />
Image:XboxWithPcSpkr.jpg|'' ''<br />
Image:XboxPcSpkrTrace.jpg|'' ''<br />
Image:XboxPcSpkrSolderPoints.jpg|'' ''<br />
</gallery><br />
<br />
== See Also ==<br />
* [[NForce]]<br />
* [http://siliconpr0n.org/archive/doku.php?id=azonenberg:nvidia:mcpx Die Inspection]</div>Redherring32https://xboxdevwiki.net/index.php?title=DVD_Emulator&diff=6734DVD Emulator2019-06-23T18:18:26Z<p>Redherring32: </p>
<hr />
<div>The DVD emulator is a feature of [[Development Kits]].<br />
It enables a developer to create and test for DVD remastering.<br />
This means deciding which files to store on the DVD and where on the disk to store them (layout).{{citation needed}}<br />
this is then tested using the DVD emulator software, and hardware for loading speeds and possibly potential faults that could occur.<br />
<br />
The Hardware required for this was a Developement kit, (with the DVD emulation board) some sort of scsi cable, and an XDK-Raptor card.{{citation needed}}<br />
The complete kit, a Raptor PCI Scsi card and Hardisk was numbered: 940-75004 Rev.01<br />
two or more versions of the PCI scsi card are known:<br />
* 700-75307 Rev.01<br />
* 700-75307 Rev 03 [https://assemblergames.com/threads/sealed-xbox-raptor-card-for-xdk-dvd-emu.41763/ Assemblergames](posibly same as rev1?)<br />
<br />
The software was bundled with the official xdk software and a (40GB ?{{citation needed}})Hardisk was connected to the Raptorcard where the DVD mastering image was stored on.<br />
This wasn't the fastest way to get an executable to the Xbox for development, and is useless for Homebrew.{{citation needed}}<br />
{{FIXME|reason=Describe the purpose in more detail}}<br />
<br />
<br />
[http://codeasm.com/xbox/images/dvt4/SL734877.JPG Picture]{{FIXME|reason=Contact codeasm about more pics / without watermarks}}<br />
<br />
== Resources ==<br />
* [https://imgur.com/a/ROMYa Images (CC0 License) by Codeasm with detailed shots of the DVD emulation board and serial board]</div>Redherring32https://xboxdevwiki.net/index.php?title=AV_Cables&diff=6733AV Cables2019-06-23T18:06:51Z<p>Redherring32: /* Connector */</p>
<hr />
<div>Microsoft has released a handful of '''Audio Video Cables''' for the [[Xbox]], which they refer to internally as '''AV Packs'''. They are connected to the port labelled "Audio Video Input/Output" on the backside of the console.<br />
<br />
== Connector ==<br />
<br />
{{FIXME|reason=Describe the connector here - is it a standard part? add an image, add the pinout graphics (didn't copy from elsewhere because clearly microsoft copyright)}}<br />
<br />
=== Pinout ===<br />
The following table gives the pinout in the way it is arranged on the '''XBOX AVIP''' cables, or '''AV Packs'''. The other end is reversed and on the console.<br />
<br />
{| class="wikitable"<br />
!Description<br />
|Audio Right <br />
|Audio Right GND <br />
|SPDIF Digital Audio <br />
|V-Sync (VGA Mode) <br />
|Mode GND <br />
|Mode GND <br />
|Mode GND <br />
|GND<br />
|Variable<br />
|9 GND<br />
|Variable<br />
|11 GND<br />
|-<br />
!Pin<br />
!1<br />
!2<br />
!3<br />
!4<br />
!5<br />
!6<br />
!7<br />
!8<br />
!9<br />
!10<br />
!11<br />
!12<br />
|-<br />
!Pin<br />
!13<br />
!14<br />
!15<br />
!16<br />
!17<br />
!18<br />
!19<br />
!20<br />
!21<br />
!22<br />
!23<br />
!24<br />
|-<br />
!Description<br />
|Vcc<br />
|Audio Left<br />
|Audio Left GND<br />
|H Sync (VGA Mode)<br />
|Mode Select 1<br />
|Mode Select 2<br />
|Mode Select 3<br />
|(+12V)<br />
|22 GND<br />
|Variable<br />
|24 GND<br />
|Variable<br />
|}<br />
<br />
== Supported signals / AV cables ==<br />
<br />
Below is a table which lists all known officially '''AV cables''' released by Microsoft and their respective signal.<br />
The constants used in the av-prefixed Kernel-functions are also listed.<br />
<br />
{| class="wikitable"<br />
! Pin 19 || Pin 18 || Pin 17 || SMC Constant || Region || Official Microsoft product name<br />
! Signal || Pin 24 || Pin 22 || Pin 11 || Pin 9 || Kernel av-Constant<br />
|-<br />
| 0 || 0 || 0 || 0 || PAL || [https://web.archive.org/web/20040216131316/http://www.xbox.com:80/en-gb/hardware/scartcable.htm Advanced SCART Cable]<br />
| SCART (15 kHz RGB) Stereo || V || R || G || B || AV_PACK_SCART = 3<br />
|-<br />
| 0 || 0 || 1 || 1 || NTSC || [https://web.archive.org/web/20040210040422/http://www.xbox.com:80/en-US/hardware/highdefinitionavpack.htm High Definition AV Pack]<br />
| Component SPDIF || - || Pr || Y || Pb || AV_PACK_HDTV = 4<br />
|-<br />
| 0 || 1 || 0 || 2 || - || ''Not officially available / supported''<br />
| VGA (31 kHz RGB) Stereo || - || R || G || B || AV_PACK_VGA = 5<br />
|-<br />
| 0 || 1 || 1 || 3 || NTSC / PAL || [https://web.archive.org/web/20040319001330/http://www.xbox.com:80/en-us/hardware/rfadapter.htm RF Adapter]<br />
| RF Mono || V || C || Y || - || AV_PACK_RFU = 2<br />
|-<br />
| 1 || 0 || 0 || 4 || NTSC || [https://web.archive.org/web/20040319001247/http://www.xbox.com:80/en-us/hardware/advancedavpack.htm Advanced AV Pack]<br />
| S-Video Stereo || V || C || Y || - || AV_PACK_SVIDEO = 6<br />
|-<br />
| 1 || 0 || 1 || 5 || - || ''Not officially available / supported''<br />
| Unknown Mono || V || C || Y || - || AV_PACK_NONE = 0<br />
|-<br />
| 1 || 1 || 0 || 6 || PAL || [https://web.archive.org/web/20040216130745/http://www.xbox.com:80/en-gb/hardware/avcable.htm Standard AV Cable]<br />
| Composite Stereo || V || C || Y || - || AV_PACK_STANDARD = 1<br />
|-<br />
| 1 || 1 || 1 || 7 || - || ''No cable connected''<br />
| - || - || - || - || - || AV_PACK_NONE = 0<br />
|}<br />
<br />
A signal value of 0 means connection to ground (Pins 7, 6, 5), whereas a value of 1 means an open-connection{{citation needed|reason=Are these still connected to Vcc maybe?}}<br />
<br />
The region only identifies which territory the cable was originally available / intended for. The kernel still might support other video-standards (NTSC / PAL / SECAM) using the same cable.<br />
<br />
{{FIXME|reason=Add a list of AV cables with pictures and their supported video modes using the official kernel}}<br />
<br />
== Related links ==<br />
<br />
* [http://www.gamesx.com/avpinouts/xbox.htm GamesX List of signals and pinout]<br />
* [https://assemblergames.com/attachments/xboxavippinouttr0-png.13081/ ASSEMBLERgames XBOX AV pinout]<br />
* [http://ucon64.sourceforge.net/ucon64misc/conn.html uCON64 Connectors]</div>Redherring32https://xboxdevwiki.net/index.php?title=Patents&diff=6712Patents2019-04-08T03:31:31Z<p>Redherring32: </p>
<hr />
<div>Here a list of patents that might be related to the original Xbox:<br />
<br />
* Filed 1997-11-25 by Nvidia: https://www.google.com/patents/US6697063 "Rendering pipeline"<br />
* Filed 1998-12-23 by Microsoft: https://www.google.com/patents/US6417858 "Processor for geometry transformations and lighting calculations"<br />
* Filed 1999-12-06 by Nvidia: https://www.google.com/patents/US6198488 "Transform, lighting and rasterization system embodied on a single semiconductor platform"<br />
* Filed 1999-12-06 by Nvidia: https://www.google.com/patents/US6573900 "Method, apparatus and article of manufacture for a sequencer in a transform/lighting module capable of processing multiple independent execution threads"<br />
* Filed 1999-12-06 by Nvidia: https://www.google.com/patents/US6765575 "Clip-less rasterization using line equation-based traversal"<br />
* Filed 1999-12-06 by Nvidia: https://www.google.com/patents/US6650325 "Method, apparatus and article of manufacture for boustrophedonic rasterization"<br />
* Filed 2000-12-05 by Nvidia: https://www.google.com/patents/US6690372 "System, method and article of manufacture for shadow mapping"<br />
* Filed 2001-01-11 by Microsoft: https://www.google.com/patents/USD452282 "Portion of an electronic housing"<br />
* Filed 2001-01-11 by Microsoft: https://www.google.com/patents/USD452534 "Portion of an electronic housing" (not a dupe, its the top X shape in detail)<br />
* Filed 2001-01-11 by Microsoft: https://www.google.com/patents/USD451513 "Computer input device" (describes the original Xbox controller, a.k.a. : "the Duke")<br />
* Filed 2003-05-09 by Microsoft: https://www.google.com/patents/US8493326 "Controller with removably attachable text input device" (an early keypad, later revered to by the 360 keypad patent)<br />
* Filed 0023-05-09 by Micorsoft: https://www.google.com/patents/US7116311 "Embedded text input " (reffered to by the 360 chatpad)<br />
* Filed 2006-07-03 by Micorsoft: https://www.google.com/patents/US7804484 "Embedded text input " (probably a corrected version of US7116311, reffered to by the 360 chatpad, a picture of the "Baretta" chatpad, https://assemblergames.com/threads/xbox-chatpad-unreleased.54523/<br />
* Filed 2001-06-19 by Nvidia: https://www.google.com/patents/US6870540 "System, method and computer program product for a programmable pixel processing model with instruction set"<br />
* Filed 2002-06-07 by Microsoft: https://www.google.com/patents/US6907522 "Use of hashing in a secure boot loader" (mentions "NV2A")<br />
* Filed 2003-08-21 by Friendtech: https://www.google.com/patents/US20050282621 "CPU upgrading adapter for a Microsoft XboxTM game machine"<br />
* Filed 2005-01-04 by Nvidia: https://www.google.com/patents/US7916149 "Block linear memory ordering of texture data"<br />
* Filed 2005-01-07 by Microsoft: https://www.google.com/patents/US7676840 "Use of hashing in a secure boot loader" (a continuation of patent US6907522)<br />
* Filed 2005-05-17 by Nvidia: https://www.google.com/patents/US7793029 "Translation device apparatus for configuring printed circuit board connectors " (describes coupling two PCI Express connectors, possibly for the secondary Chihiro board, mentions "Xbox")<br />
* Filed 2001-04-30 by Microsoft: https://www.google.com/patents/US20020160654 "Breakaway cable connector" (filed by Microsofts attorneys)<br />
* Filed 2004-22-02 by Microsoft: https://patents.google.com/patent/US7303476 "Method and apparatus for creating and playing soundtracks in a gaming system"<br />
* Filed 2002-05-16 by Microsoft: https://patents.google.com/patent/US6935959 "Use of multiple player real-time voice communications on a gaming device"<br />
* Filed 2001-03-09 by Microsoft: https://patents.google.com/patent/US7218739B2 "Multiple user authentication for online console-based gaming"<br />
* Filed 2005-03-09 by Microsoft: https://patents.google.com/patent/US7811174B2 "Method and apparatus for managing data in a gaming system"<br />
<br />
Possibly unrelated :<br />
* Filed 1989-12-29 by Dolby Laboratories: https://www.google.com/patents/US5109417 "Low bit rate transform coder, decoder, and encoder/decoder for high-quality audio"<br />
* Filed 2008-01-15 by Microsoft: https://www.google.com/patents/US8607324 "Untrusted gaming system access to online gaming service" (describes part of Xbox online)<br />
* Filed 2011-06-17 by Microsoft: https://www.google.com/patents/US8641525 "Controller for video game console" (one of the 51 patents comprising the Xbox One controller)<br />
* Filed 2011-09-07 by Microsoft: https://www.google.com/patents/US8597125 "System and method for configuring game data about players"<br />
* Filed 2012-01-13 by Microsoft: https://www.google.com/patents/US8602897 "Extended and editable gamer profile"<br />
* Filed 2007-12-07 by Microsoft: https://www.google.com/patents/US8487876 "Ergonomic hand-held text input device " (The xbox 360 chatpad, wich mentions the OG textpad US8493326 and US7116311 ;) )</div>Redherring32