xboxdevwiki - User contributions [en]

User:Akspa

2017-08-26T09:14:26Z

Akspa: Created page with "Been tinkering with Xbox stuff since 2001. Be it hardware, software, or otherwise. Under different usernames, I've been involved in: Xbox Linux dev, halo map modding (and some..."

Been tinkering with Xbox stuff since 2001. Be it hardware, software, or otherwise. Under different usernames, I've been involved in: Xbox Linux dev, halo map modding (and some corresponding GUI tools), softmod updated repacks, and lots of really badly thought-out potential attack points to exploit the xbox security system. I've attempted getting the Xbox Alpha Kit software running under virtualization, going as far as to edit the system xbe's in order to skip over nvidia hardware checks, without knowing anything about opcodes and the like (and likely, xbe/exe signatures, which just dawned on me this moment). I've kept my xbox's alive for the past 14 years, and still have a decent library of Xbox and Xbox 360 discs.

Xbox DVD Movie Playback Kit

2017-08-26T08:59:15Z

Akspa: /* Components */

==Introduction==

The DVD Movie Playback Kit contains 2 parts: A remote and a dongle for the Xbox.

== Remote Control ==

== Dongle ==

The dongle contains a ROM with an XBE which provides some functions for the DVD playback application. However, the XBE is not standalone.

Why would they not just put this little < 512kiB library on the harddisk? Why another ROM which contains the program?
One could think it is to allow them to upgrade the application easily, but the real reason seems to be different: licensing. As the label on the back notes: "Made under license from Dolby Laboratories". By including the software in the DVD Remote kit, they don't have to pay Dolby for every Xbox sold, but just for every DVD Remote kit sold. This allows them to keep the cost of the Xbox down.

Additionally the dongle contains an IR receiver to receive commands from the Remote control.

=== Known versions ===

{| class="wikitable" 
! Part No. !! Manufactured in !! Version !! DVD Region !! ROM Size !! ROM SHA1 !! Notes
|-
| X08-25402 || Indonesia || 1.1 || 2 || 229790 Bytes || <code>70d4b5f8e073b05610fba9e9617d7356196b61ff</code> ||
|-
| X08-25402-002 || Indonesia || || || || ||
|-
| X08-25387 || Indonesia || || || || ||
|-
| X08-25387-002 || Indonesia || 1.1 || 1 || 229790 Bytes || <code>73814aa736d83d636380f5c6b1c291441b35354d</code> || Sticker: "2341P" on PCB
|}

=== USB Protocol ===

{{FIXME|reason=Partially documented in JayFoxRox/xbox-tools on github}}

=== Components ===

Different versions of the dongle seem to use different hardware internally.

==== X08-25387-002 (PCB: "X01469-100") ====

* U1 ATMEL AT43USB352M-AC{{FIXME|reason=Can't find datasheet.. only for AT43USB351M-AC and AT43USB353M-AC; both of which have various differences}}
* U2 TSOP-1556
* U3 X393121C{{FIXME|reason=What is this? a ROM? how large?}}

==== X08-25387 (PCB: "IR DONGLE REV B") ====
[[File:X08-25387-Sticker.jpeg|thumb|200px|X08-25387 Rev B Sticker]]
[[File:IR_DONGLEREVB-FRNT.jpeg|thumb|200px|Front PCB of X08-25387]]

* U3 MX23C4000TC-10

{{FIXME|reason=Didn't get rear components photographed yet}}

==== Unknown version (PCB: "REV C.") ====

[[File:Xbox-linux-dvd-dongle-front.jpg|thumb|200px|Frontside]]
[[File:Xbox-linux-dvd-dongle-back.jpg|thumb|200px|Backside]]

* U1 92163 [https://web.archive.org/web/20100617020513/http://www.st.com/ STMicroelectronics] <[https://web.archive.org/web/20100617020513/http://www.st.com/stonline/books/pdf/docs/5521.pdf Datasheet]>
: This big square IC on the backside is the microcontroller. STMicroelectronics describes it as "8/16-BIT FULL SPEED USB MCU FOR COMPOSITE DEVICES WITH 16 ENDPOINTS, 20K ROM, 2K RAM, I 2 C, SCI, & MFT". Since the program resides inside in its ROM, it is almost impossible to extract the program from inside.

* U2 TSOP-1556 [https://web.archive.org/web/20100617020513/http://www.vishay.com/ Vishay Telefunken] <[https://web.archive.org/web/20100617020513/http://www.vishay.com/docs/82029/82029.pdf Datasheet]>
: This black box on the middle of the frontside is an integrated IR receiver. It filters the received infrared pulses and demodulates them. Its filter frequency is 56kHz, while 38kHz is standard for most remote controls. Therefore, chances are few other remotes will work with the Xbox receiver.

* U3 MX23C4000TC-10 [https://web.archive.org/web/20100617020513/http://www.macronix.com/ Macronix] <[https://web.archive.org/web/20100617020513/http://www.macronix.com/QuickPlace/hq/PageLibrary48256D9D002BA613.nsf/h_6057FA6682A90C3948256DCE0052D2D3/67DCB124F1BE4E7D48256DC50039AC31/$File/MX23C4000-4.2.pdf/?OpenElement Datasheet]>
: This wide TSOP IC on the frontside could be the most interesting of all. It is a 4MBit mask ROM.

* U4 HC574 [https://web.archive.org/web/20100617020513/http://www.ti.com/ Texas Instruments] <[https://web.archive.org/web/20100617020513/http://focus.ti.com/lit/ds/symlink/sn74hc574.pdf Datasheet]>
: This 20-pin standard logic IC is an octal D-flipflop, which splits the databus from the 92163 to 8 adress bits. This technique is very well known from the 8051 and other microcontrollers.

=== Hacking ===

As the dashboard presumably downloads the code from the ROM into the memory of the Xbox, this could be a hardware hack requiring no hardware modifications. The XBE loader for the DVD image is different from the usual XBE loader. However, the XBE is still signed and checked for security.

== References ==

* [https://ibb.co/album/cmr5rF Pictures of X08-25387-002 including internals]
* [https://github.com/JayFoxRox/xbox-tools/tree/master/dump-dvd-kit Tool to dump DVD Dongle ROM]
* [https://web.archive.org/web/20100617020513/http://www.xbox-linux.org/wiki/DVD-IR_Internals DVD-IR Internals]

Xbox DVD Movie Playback Kit

2017-08-26T08:53:24Z

Akspa: /* X08-25387 (PCB: "IR DONGLE REV B") - Sticker */

==Introduction==

The DVD Movie Playback Kit contains 2 parts: A remote and a dongle for the Xbox.

== Remote Control ==

== Dongle ==

The dongle contains a ROM with an XBE which provides some functions for the DVD playback application. However, the XBE is not standalone.

Why would they not just put this little < 512kiB library on the harddisk? Why another ROM which contains the program?
One could think it is to allow them to upgrade the application easily, but the real reason seems to be different: licensing. As the label on the back notes: "Made under license from Dolby Laboratories". By including the software in the DVD Remote kit, they don't have to pay Dolby for every Xbox sold, but just for every DVD Remote kit sold. This allows them to keep the cost of the Xbox down.

Additionally the dongle contains an IR receiver to receive commands from the Remote control.

=== Known versions ===

{| class="wikitable" 
! Part No. !! Manufactured in !! Version !! DVD Region !! ROM Size !! ROM SHA1 !! Notes
|-
| X08-25402 || Indonesia || 1.1 || 2 || 229790 Bytes || <code>70d4b5f8e073b05610fba9e9617d7356196b61ff</code> ||
|-
| X08-25402-002 || Indonesia || || || || ||
|-
| X08-25387 || Indonesia || || || || ||
|-
| X08-25387-002 || Indonesia || 1.1 || 1 || 229790 Bytes || <code>73814aa736d83d636380f5c6b1c291441b35354d</code> || Sticker: "2341P" on PCB
|}

=== USB Protocol ===

{{FIXME|reason=Partially documented in JayFoxRox/xbox-tools on github}}

=== Components ===

Different versions of the dongle seem to use different hardware internally.

==== X08-25387-002 (PCB: "X01469-100") ====

* U1 ATMEL AT43USB352M-AC{{FIXME|reason=Can't find datasheet.. only for AT43USB351M-AC and AT43USB353M-AC; both of which have various differences}}
* U2 TSOP-1556
* U3 X393121C{{FIXME|reason=What is this? a ROM? how large?}}

==== X08-25387 (PCB: "IR DONGLE REV B") ====
[[File:X08-25387-Sticker.jpeg|thumb|200px|IR Dongle Rev B Sticker]]

* U3 MX23C4000TC-10
[[File:IR_DONGLEREVB-FRNT.jpeg|thumb|200px|Front PCB of "IR DONGLE REV B"]]

==== Unknown version (PCB: "REV C.") ====

[[File:Xbox-linux-dvd-dongle-front.jpg|thumb|200px|Frontside]]
[[File:Xbox-linux-dvd-dongle-back.jpg|thumb|200px|Backside]]

* U1 92163 [https://web.archive.org/web/20100617020513/http://www.st.com/ STMicroelectronics] <[https://web.archive.org/web/20100617020513/http://www.st.com/stonline/books/pdf/docs/5521.pdf Datasheet]>
: This big square IC on the backside is the microcontroller. STMicroelectronics describes it as "8/16-BIT FULL SPEED USB MCU FOR COMPOSITE DEVICES WITH 16 ENDPOINTS, 20K ROM, 2K RAM, I 2 C, SCI, & MFT". Since the program resides inside in its ROM, it is almost impossible to extract the program from inside.

* U2 TSOP-1556 [https://web.archive.org/web/20100617020513/http://www.vishay.com/ Vishay Telefunken] <[https://web.archive.org/web/20100617020513/http://www.vishay.com/docs/82029/82029.pdf Datasheet]>
: This black box on the middle of the frontside is an integrated IR receiver. It filters the received infrared pulses and demodulates them. Its filter frequency is 56kHz, while 38kHz is standard for most remote controls. Therefore, chances are few other remotes will work with the Xbox receiver.

* U3 MX23C4000TC-10 [https://web.archive.org/web/20100617020513/http://www.macronix.com/ Macronix] <[https://web.archive.org/web/20100617020513/http://www.macronix.com/QuickPlace/hq/PageLibrary48256D9D002BA613.nsf/h_6057FA6682A90C3948256DCE0052D2D3/67DCB124F1BE4E7D48256DC50039AC31/$File/MX23C4000-4.2.pdf/?OpenElement Datasheet]>
: This wide TSOP IC on the frontside could be the most interesting of all. It is a 4MBit mask ROM.

* U4 HC574 [https://web.archive.org/web/20100617020513/http://www.ti.com/ Texas Instruments] <[https://web.archive.org/web/20100617020513/http://focus.ti.com/lit/ds/symlink/sn74hc574.pdf Datasheet]>
: This 20-pin standard logic IC is an octal D-flipflop, which splits the databus from the 92163 to 8 adress bits. This technique is very well known from the 8051 and other microcontrollers.

=== Hacking ===

As the dashboard presumably downloads the code from the ROM into the memory of the Xbox, this could be a hardware hack requiring no hardware modifications. The XBE loader for the DVD image is different from the usual XBE loader. However, the XBE is still signed and checked for security.

== References ==

* [https://ibb.co/album/cmr5rF Pictures of X08-25387-002 including internals]
* [https://github.com/JayFoxRox/xbox-tools/tree/master/dump-dvd-kit Tool to dump DVD Dongle ROM]
* [https://web.archive.org/web/20100617020513/http://www.xbox-linux.org/wiki/DVD-IR_Internals DVD-IR Internals]

File:X08-25387-Sticker.jpeg

2017-08-26T08:52:37Z

Akspa:

Xbox DVD Movie Playback Kit

2017-08-26T08:50:05Z

Akspa: /* X08-25387 (PCB: "IR DONGLE REV B") */

==Introduction==

The DVD Movie Playback Kit contains 2 parts: A remote and a dongle for the Xbox.

== Remote Control ==

== Dongle ==

The dongle contains a ROM with an XBE which provides some functions for the DVD playback application. However, the XBE is not standalone.

Why would they not just put this little < 512kiB library on the harddisk? Why another ROM which contains the program?
One could think it is to allow them to upgrade the application easily, but the real reason seems to be different: licensing. As the label on the back notes: "Made under license from Dolby Laboratories". By including the software in the DVD Remote kit, they don't have to pay Dolby for every Xbox sold, but just for every DVD Remote kit sold. This allows them to keep the cost of the Xbox down.

Additionally the dongle contains an IR receiver to receive commands from the Remote control.

=== Known versions ===

{| class="wikitable" 
! Part No. !! Manufactured in !! Version !! DVD Region !! ROM Size !! ROM SHA1 !! Notes
|-
| X08-25402 || Indonesia || 1.1 || 2 || 229790 Bytes || <code>70d4b5f8e073b05610fba9e9617d7356196b61ff</code> ||
|-
| X08-25402-002 || Indonesia || || || || ||
|-
| X08-25387 || Indonesia || || || || ||
|-
| X08-25387-002 || Indonesia || 1.1 || 1 || 229790 Bytes || <code>73814aa736d83d636380f5c6b1c291441b35354d</code> || Sticker: "2341P" on PCB
|}

=== USB Protocol ===

{{FIXME|reason=Partially documented in JayFoxRox/xbox-tools on github}}

=== Components ===

Different versions of the dongle seem to use different hardware internally.

==== X08-25387-002 (PCB: "X01469-100") ====

* U1 ATMEL AT43USB352M-AC{{FIXME|reason=Can't find datasheet.. only for AT43USB351M-AC and AT43USB353M-AC; both of which have various differences}}
* U2 TSOP-1556
* U3 X393121C{{FIXME|reason=What is this? a ROM? how large?}}

==== X08-25387 (PCB: "IR DONGLE REV B") ====

* U3 MX23C4000TC-10
[[File:IR_DONGLEREVB-FRNT.jpeg|thumb|200px|Front PCB of "IR DONGLE REV B"]]

==== Unknown version (PCB: "REV C.") ====

[[File:Xbox-linux-dvd-dongle-front.jpg|thumb|200px|Frontside]]
[[File:Xbox-linux-dvd-dongle-back.jpg|thumb|200px|Backside]]

* U1 92163 [https://web.archive.org/web/20100617020513/http://www.st.com/ STMicroelectronics] <[https://web.archive.org/web/20100617020513/http://www.st.com/stonline/books/pdf/docs/5521.pdf Datasheet]>
: This big square IC on the backside is the microcontroller. STMicroelectronics describes it as "8/16-BIT FULL SPEED USB MCU FOR COMPOSITE DEVICES WITH 16 ENDPOINTS, 20K ROM, 2K RAM, I 2 C, SCI, & MFT". Since the program resides inside in its ROM, it is almost impossible to extract the program from inside.

* U2 TSOP-1556 [https://web.archive.org/web/20100617020513/http://www.vishay.com/ Vishay Telefunken] <[https://web.archive.org/web/20100617020513/http://www.vishay.com/docs/82029/82029.pdf Datasheet]>
: This black box on the middle of the frontside is an integrated IR receiver. It filters the received infrared pulses and demodulates them. Its filter frequency is 56kHz, while 38kHz is standard for most remote controls. Therefore, chances are few other remotes will work with the Xbox receiver.

* U3 MX23C4000TC-10 [https://web.archive.org/web/20100617020513/http://www.macronix.com/ Macronix] <[https://web.archive.org/web/20100617020513/http://www.macronix.com/QuickPlace/hq/PageLibrary48256D9D002BA613.nsf/h_6057FA6682A90C3948256DCE0052D2D3/67DCB124F1BE4E7D48256DC50039AC31/$File/MX23C4000-4.2.pdf/?OpenElement Datasheet]>
: This wide TSOP IC on the frontside could be the most interesting of all. It is a 4MBit mask ROM.

* U4 HC574 [https://web.archive.org/web/20100617020513/http://www.ti.com/ Texas Instruments] <[https://web.archive.org/web/20100617020513/http://focus.ti.com/lit/ds/symlink/sn74hc574.pdf Datasheet]>
: This 20-pin standard logic IC is an octal D-flipflop, which splits the databus from the 92163 to 8 adress bits. This technique is very well known from the 8051 and other microcontrollers.

=== Hacking ===

As the dashboard presumably downloads the code from the ROM into the memory of the Xbox, this could be a hardware hack requiring no hardware modifications. The XBE loader for the DVD image is different from the usual XBE loader. However, the XBE is still signed and checked for security.

== References ==

* [https://ibb.co/album/cmr5rF Pictures of X08-25387-002 including internals]
* [https://github.com/JayFoxRox/xbox-tools/tree/master/dump-dvd-kit Tool to dump DVD Dongle ROM]
* [https://web.archive.org/web/20100617020513/http://www.xbox-linux.org/wiki/DVD-IR_Internals DVD-IR Internals]

Xbox DVD Movie Playback Kit

2017-08-26T08:48:36Z

Akspa: /* X08-25387 (PCB: "IR DONGLE REV B") */

==Introduction==

The DVD Movie Playback Kit contains 2 parts: A remote and a dongle for the Xbox.

== Remote Control ==

== Dongle ==

The dongle contains a ROM with an XBE which provides some functions for the DVD playback application. However, the XBE is not standalone.

Why would they not just put this little < 512kiB library on the harddisk? Why another ROM which contains the program?
One could think it is to allow them to upgrade the application easily, but the real reason seems to be different: licensing. As the label on the back notes: "Made under license from Dolby Laboratories". By including the software in the DVD Remote kit, they don't have to pay Dolby for every Xbox sold, but just for every DVD Remote kit sold. This allows them to keep the cost of the Xbox down.

Additionally the dongle contains an IR receiver to receive commands from the Remote control.

=== Known versions ===

{| class="wikitable" 
! Part No. !! Manufactured in !! Version !! DVD Region !! ROM Size !! ROM SHA1 !! Notes
|-
| X08-25402 || Indonesia || 1.1 || 2 || 229790 Bytes || <code>70d4b5f8e073b05610fba9e9617d7356196b61ff</code> ||
|-
| X08-25402-002 || Indonesia || || || || ||
|-
| X08-25387 || Indonesia || || || || ||
|-
| X08-25387-002 || Indonesia || 1.1 || 1 || 229790 Bytes || <code>73814aa736d83d636380f5c6b1c291441b35354d</code> || Sticker: "2341P" on PCB
|}

=== USB Protocol ===

{{FIXME|reason=Partially documented in JayFoxRox/xbox-tools on github}}

=== Components ===

Different versions of the dongle seem to use different hardware internally.

==== X08-25387-002 (PCB: "X01469-100") ====

* U1 ATMEL AT43USB352M-AC{{FIXME|reason=Can't find datasheet.. only for AT43USB351M-AC and AT43USB353M-AC; both of which have various differences}}
* U2 TSOP-1556
* U3 X393121C{{FIXME|reason=What is this? a ROM? how large?}}

==== X08-25387 (PCB: "IR DONGLE REV B") ====

[[File:IR_DONGLEREVB-FRNT.jpeg|thumb|200px|FrontPCB]]

* U3 MX23C4000TC-10

==== Unknown version (PCB: "REV C.") ====

[[File:Xbox-linux-dvd-dongle-front.jpg|thumb|200px|Frontside]]
[[File:Xbox-linux-dvd-dongle-back.jpg|thumb|200px|Backside]]

* U1 92163 [https://web.archive.org/web/20100617020513/http://www.st.com/ STMicroelectronics] <[https://web.archive.org/web/20100617020513/http://www.st.com/stonline/books/pdf/docs/5521.pdf Datasheet]>
: This big square IC on the backside is the microcontroller. STMicroelectronics describes it as "8/16-BIT FULL SPEED USB MCU FOR COMPOSITE DEVICES WITH 16 ENDPOINTS, 20K ROM, 2K RAM, I 2 C, SCI, & MFT". Since the program resides inside in its ROM, it is almost impossible to extract the program from inside.

* U2 TSOP-1556 [https://web.archive.org/web/20100617020513/http://www.vishay.com/ Vishay Telefunken] <[https://web.archive.org/web/20100617020513/http://www.vishay.com/docs/82029/82029.pdf Datasheet]>
: This black box on the middle of the frontside is an integrated IR receiver. It filters the received infrared pulses and demodulates them. Its filter frequency is 56kHz, while 38kHz is standard for most remote controls. Therefore, chances are few other remotes will work with the Xbox receiver.

* U3 MX23C4000TC-10 [https://web.archive.org/web/20100617020513/http://www.macronix.com/ Macronix] <[https://web.archive.org/web/20100617020513/http://www.macronix.com/QuickPlace/hq/PageLibrary48256D9D002BA613.nsf/h_6057FA6682A90C3948256DCE0052D2D3/67DCB124F1BE4E7D48256DC50039AC31/$File/MX23C4000-4.2.pdf/?OpenElement Datasheet]>
: This wide TSOP IC on the frontside could be the most interesting of all. It is a 4MBit mask ROM.

* U4 HC574 [https://web.archive.org/web/20100617020513/http://www.ti.com/ Texas Instruments] <[https://web.archive.org/web/20100617020513/http://focus.ti.com/lit/ds/symlink/sn74hc574.pdf Datasheet]>
: This 20-pin standard logic IC is an octal D-flipflop, which splits the databus from the 92163 to 8 adress bits. This technique is very well known from the 8051 and other microcontrollers.

=== Hacking ===

As the dashboard presumably downloads the code from the ROM into the memory of the Xbox, this could be a hardware hack requiring no hardware modifications. The XBE loader for the DVD image is different from the usual XBE loader. However, the XBE is still signed and checked for security.

== References ==

* [https://ibb.co/album/cmr5rF Pictures of X08-25387-002 including internals]
* [https://github.com/JayFoxRox/xbox-tools/tree/master/dump-dvd-kit Tool to dump DVD Dongle ROM]
* [https://web.archive.org/web/20100617020513/http://www.xbox-linux.org/wiki/DVD-IR_Internals DVD-IR Internals]

Xbox DVD Movie Playback Kit

2017-08-26T08:46:35Z

Akspa: /* X08-25387 (PCB: "IR DONGLE REV B") - reduced to a single image with part numbers */

==Introduction==

The DVD Movie Playback Kit contains 2 parts: A remote and a dongle for the Xbox.

== Remote Control ==

== Dongle ==

The dongle contains a ROM with an XBE which provides some functions for the DVD playback application. However, the XBE is not standalone.

Why would they not just put this little < 512kiB library on the harddisk? Why another ROM which contains the program?
One could think it is to allow them to upgrade the application easily, but the real reason seems to be different: licensing. As the label on the back notes: "Made under license from Dolby Laboratories". By including the software in the DVD Remote kit, they don't have to pay Dolby for every Xbox sold, but just for every DVD Remote kit sold. This allows them to keep the cost of the Xbox down.

Additionally the dongle contains an IR receiver to receive commands from the Remote control.

=== Known versions ===

{| class="wikitable" 
! Part No. !! Manufactured in !! Version !! DVD Region !! ROM Size !! ROM SHA1 !! Notes
|-
| X08-25402 || Indonesia || 1.1 || 2 || 229790 Bytes || <code>70d4b5f8e073b05610fba9e9617d7356196b61ff</code> ||
|-
| X08-25402-002 || Indonesia || || || || ||
|-
| X08-25387 || Indonesia || || || || ||
|-
| X08-25387-002 || Indonesia || 1.1 || 1 || 229790 Bytes || <code>73814aa736d83d636380f5c6b1c291441b35354d</code> || Sticker: "2341P" on PCB
|}

=== USB Protocol ===

{{FIXME|reason=Partially documented in JayFoxRox/xbox-tools on github}}

=== Components ===

Different versions of the dongle seem to use different hardware internally.

==== X08-25387-002 (PCB: "X01469-100") ====

* U1 ATMEL AT43USB352M-AC{{FIXME|reason=Can't find datasheet.. only for AT43USB351M-AC and AT43USB353M-AC; both of which have various differences}}
* U2 TSOP-1556
* U3 X393121C{{FIXME|reason=What is this? a ROM? how large?}}

==== X08-25387 (PCB: "IR DONGLE REV B") ====

[[File:IR_DONGLEREVB-FRNT.jpeg|thumb|200px|FrontPCB]]

==== Unknown version (PCB: "REV C.") ====

[[File:Xbox-linux-dvd-dongle-front.jpg|thumb|200px|Frontside]]
[[File:Xbox-linux-dvd-dongle-back.jpg|thumb|200px|Backside]]

* U1 92163 [https://web.archive.org/web/20100617020513/http://www.st.com/ STMicroelectronics] <[https://web.archive.org/web/20100617020513/http://www.st.com/stonline/books/pdf/docs/5521.pdf Datasheet]>
: This big square IC on the backside is the microcontroller. STMicroelectronics describes it as "8/16-BIT FULL SPEED USB MCU FOR COMPOSITE DEVICES WITH 16 ENDPOINTS, 20K ROM, 2K RAM, I 2 C, SCI, & MFT". Since the program resides inside in its ROM, it is almost impossible to extract the program from inside.

* U2 TSOP-1556 [https://web.archive.org/web/20100617020513/http://www.vishay.com/ Vishay Telefunken] <[https://web.archive.org/web/20100617020513/http://www.vishay.com/docs/82029/82029.pdf Datasheet]>
: This black box on the middle of the frontside is an integrated IR receiver. It filters the received infrared pulses and demodulates them. Its filter frequency is 56kHz, while 38kHz is standard for most remote controls. Therefore, chances are few other remotes will work with the Xbox receiver.

* U3 MX23C4000TC-10 [https://web.archive.org/web/20100617020513/http://www.macronix.com/ Macronix] <[https://web.archive.org/web/20100617020513/http://www.macronix.com/QuickPlace/hq/PageLibrary48256D9D002BA613.nsf/h_6057FA6682A90C3948256DCE0052D2D3/67DCB124F1BE4E7D48256DC50039AC31/$File/MX23C4000-4.2.pdf/?OpenElement Datasheet]>
: This wide TSOP IC on the frontside could be the most interesting of all. It is a 4MBit mask ROM.

* U4 HC574 [https://web.archive.org/web/20100617020513/http://www.ti.com/ Texas Instruments] <[https://web.archive.org/web/20100617020513/http://focus.ti.com/lit/ds/symlink/sn74hc574.pdf Datasheet]>
: This 20-pin standard logic IC is an octal D-flipflop, which splits the databus from the 92163 to 8 adress bits. This technique is very well known from the 8051 and other microcontrollers.

=== Hacking ===

As the dashboard presumably downloads the code from the ROM into the memory of the Xbox, this could be a hardware hack requiring no hardware modifications. The XBE loader for the DVD image is different from the usual XBE loader. However, the XBE is still signed and checked for security.

== References ==

* [https://ibb.co/album/cmr5rF Pictures of X08-25387-002 including internals]
* [https://github.com/JayFoxRox/xbox-tools/tree/master/dump-dvd-kit Tool to dump DVD Dongle ROM]
* [https://web.archive.org/web/20100617020513/http://www.xbox-linux.org/wiki/DVD-IR_Internals DVD-IR Internals]

File:IR DONGLEREVB-FRNT.jpeg

2017-08-26T08:45:33Z

Akspa: Front of PCB with TSOP part numbers visible

Front of PCB with TSOP part numbers visible

File:IR DONGLE REV B.jpeg

2017-08-26T08:45:29Z

Akspa: Image of front of pcb

Image of front of pcb

Xbox DVD Movie Playback Kit

2017-08-26T08:45:17Z

Akspa: /* X08-25387 (PCB: "IR DONGLE REV B") - added images of frontside PCB */

==Introduction==

The DVD Movie Playback Kit contains 2 parts: A remote and a dongle for the Xbox.

== Remote Control ==

== Dongle ==

The dongle contains a ROM with an XBE which provides some functions for the DVD playback application. However, the XBE is not standalone.

Why would they not just put this little < 512kiB library on the harddisk? Why another ROM which contains the program?
One could think it is to allow them to upgrade the application easily, but the real reason seems to be different: licensing. As the label on the back notes: "Made under license from Dolby Laboratories". By including the software in the DVD Remote kit, they don't have to pay Dolby for every Xbox sold, but just for every DVD Remote kit sold. This allows them to keep the cost of the Xbox down.

Additionally the dongle contains an IR receiver to receive commands from the Remote control.

=== Known versions ===

{| class="wikitable" 
! Part No. !! Manufactured in !! Version !! DVD Region !! ROM Size !! ROM SHA1 !! Notes
|-
| X08-25402 || Indonesia || 1.1 || 2 || 229790 Bytes || <code>70d4b5f8e073b05610fba9e9617d7356196b61ff</code> ||
|-
| X08-25402-002 || Indonesia || || || || ||
|-
| X08-25387 || Indonesia || || || || ||
|-
| X08-25387-002 || Indonesia || 1.1 || 1 || 229790 Bytes || <code>73814aa736d83d636380f5c6b1c291441b35354d</code> || Sticker: "2341P" on PCB
|}

=== USB Protocol ===

{{FIXME|reason=Partially documented in JayFoxRox/xbox-tools on github}}

=== Components ===

Different versions of the dongle seem to use different hardware internally.

==== X08-25387-002 (PCB: "X01469-100") ====

* U1 ATMEL AT43USB352M-AC{{FIXME|reason=Can't find datasheet.. only for AT43USB351M-AC and AT43USB353M-AC; both of which have various differences}}
* U2 TSOP-1556
* U3 X393121C{{FIXME|reason=What is this? a ROM? how large?}}

==== X08-25387 (PCB: "IR DONGLE REV B") ====

{{FIXME|reason=See http://wiki.tolabaki.gr/mediawiki/images/d/db/Xbox_rc_vanilla.jpg . Needs more pics}}
[[File:IR_DONGLE_REV_B.jpeg|thumb|200px|Frontside(Initial)]]
[[File:IR_DONGLEREVB-FRNT.jpeg|thumb|200px|TSOP]]

==== Unknown version (PCB: "REV C.") ====

[[File:Xbox-linux-dvd-dongle-front.jpg|thumb|200px|Frontside]]
[[File:Xbox-linux-dvd-dongle-back.jpg|thumb|200px|Backside]]

* U1 92163 [https://web.archive.org/web/20100617020513/http://www.st.com/ STMicroelectronics] <[https://web.archive.org/web/20100617020513/http://www.st.com/stonline/books/pdf/docs/5521.pdf Datasheet]>
: This big square IC on the backside is the microcontroller. STMicroelectronics describes it as "8/16-BIT FULL SPEED USB MCU FOR COMPOSITE DEVICES WITH 16 ENDPOINTS, 20K ROM, 2K RAM, I 2 C, SCI, & MFT". Since the program resides inside in its ROM, it is almost impossible to extract the program from inside.

* U2 TSOP-1556 [https://web.archive.org/web/20100617020513/http://www.vishay.com/ Vishay Telefunken] <[https://web.archive.org/web/20100617020513/http://www.vishay.com/docs/82029/82029.pdf Datasheet]>
: This black box on the middle of the frontside is an integrated IR receiver. It filters the received infrared pulses and demodulates them. Its filter frequency is 56kHz, while 38kHz is standard for most remote controls. Therefore, chances are few other remotes will work with the Xbox receiver.

* U3 MX23C4000TC-10 [https://web.archive.org/web/20100617020513/http://www.macronix.com/ Macronix] <[https://web.archive.org/web/20100617020513/http://www.macronix.com/QuickPlace/hq/PageLibrary48256D9D002BA613.nsf/h_6057FA6682A90C3948256DCE0052D2D3/67DCB124F1BE4E7D48256DC50039AC31/$File/MX23C4000-4.2.pdf/?OpenElement Datasheet]>
: This wide TSOP IC on the frontside could be the most interesting of all. It is a 4MBit mask ROM.

* U4 HC574 [https://web.archive.org/web/20100617020513/http://www.ti.com/ Texas Instruments] <[https://web.archive.org/web/20100617020513/http://focus.ti.com/lit/ds/symlink/sn74hc574.pdf Datasheet]>
: This 20-pin standard logic IC is an octal D-flipflop, which splits the databus from the 92163 to 8 adress bits. This technique is very well known from the 8051 and other microcontrollers.

=== Hacking ===

As the dashboard presumably downloads the code from the ROM into the memory of the Xbox, this could be a hardware hack requiring no hardware modifications. The XBE loader for the DVD image is different from the usual XBE loader. However, the XBE is still signed and checked for security.

== References ==

* [https://ibb.co/album/cmr5rF Pictures of X08-25387-002 including internals]
* [https://github.com/JayFoxRox/xbox-tools/tree/master/dump-dvd-kit Tool to dump DVD Dongle ROM]
* [https://web.archive.org/web/20100617020513/http://www.xbox-linux.org/wiki/DVD-IR_Internals DVD-IR Internals]

Xbox DVD Movie Playback Kit

2017-08-26T08:42:24Z

Akspa: /* X08-25387 (PCB: "IR DONGLE REV B") */

==Introduction==

The DVD Movie Playback Kit contains 2 parts: A remote and a dongle for the Xbox.

== Remote Control ==

== Dongle ==

The dongle contains a ROM with an XBE which provides some functions for the DVD playback application. However, the XBE is not standalone.

Why would they not just put this little < 512kiB library on the harddisk? Why another ROM which contains the program?
One could think it is to allow them to upgrade the application easily, but the real reason seems to be different: licensing. As the label on the back notes: "Made under license from Dolby Laboratories". By including the software in the DVD Remote kit, they don't have to pay Dolby for every Xbox sold, but just for every DVD Remote kit sold. This allows them to keep the cost of the Xbox down.

Additionally the dongle contains an IR receiver to receive commands from the Remote control.

=== Known versions ===

{| class="wikitable" 
! Part No. !! Manufactured in !! Version !! DVD Region !! ROM Size !! ROM SHA1 !! Notes
|-
| X08-25402 || Indonesia || 1.1 || 2 || 229790 Bytes || <code>70d4b5f8e073b05610fba9e9617d7356196b61ff</code> ||
|-
| X08-25402-002 || Indonesia || || || || ||
|-
| X08-25387 || Indonesia || || || || ||
|-
| X08-25387-002 || Indonesia || 1.1 || 1 || 229790 Bytes || <code>73814aa736d83d636380f5c6b1c291441b35354d</code> || Sticker: "2341P" on PCB
|}

=== USB Protocol ===

{{FIXME|reason=Partially documented in JayFoxRox/xbox-tools on github}}

=== Components ===

Different versions of the dongle seem to use different hardware internally.

==== X08-25387-002 (PCB: "X01469-100") ====

* U1 ATMEL AT43USB352M-AC{{FIXME|reason=Can't find datasheet.. only for AT43USB351M-AC and AT43USB353M-AC; both of which have various differences}}
* U2 TSOP-1556
* U3 X393121C{{FIXME|reason=What is this? a ROM? how large?}}

==== X08-25387 (PCB: "IR DONGLE REV B") ====

{{FIXME|reason=See http://wiki.tolabaki.gr/mediawiki/images/d/db/Xbox_rc_vanilla.jpg . Needs more pics}}

==== Unknown version (PCB: "REV C.") ====

[[File:Xbox-linux-dvd-dongle-front.jpg|thumb|200px|Frontside]]
[[File:Xbox-linux-dvd-dongle-back.jpg|thumb|200px|Backside]]

* U1 92163 [https://web.archive.org/web/20100617020513/http://www.st.com/ STMicroelectronics] <[https://web.archive.org/web/20100617020513/http://www.st.com/stonline/books/pdf/docs/5521.pdf Datasheet]>
: This big square IC on the backside is the microcontroller. STMicroelectronics describes it as "8/16-BIT FULL SPEED USB MCU FOR COMPOSITE DEVICES WITH 16 ENDPOINTS, 20K ROM, 2K RAM, I 2 C, SCI, & MFT". Since the program resides inside in its ROM, it is almost impossible to extract the program from inside.

* U2 TSOP-1556 [https://web.archive.org/web/20100617020513/http://www.vishay.com/ Vishay Telefunken] <[https://web.archive.org/web/20100617020513/http://www.vishay.com/docs/82029/82029.pdf Datasheet]>
: This black box on the middle of the frontside is an integrated IR receiver. It filters the received infrared pulses and demodulates them. Its filter frequency is 56kHz, while 38kHz is standard for most remote controls. Therefore, chances are few other remotes will work with the Xbox receiver.

* U3 MX23C4000TC-10 [https://web.archive.org/web/20100617020513/http://www.macronix.com/ Macronix] <[https://web.archive.org/web/20100617020513/http://www.macronix.com/QuickPlace/hq/PageLibrary48256D9D002BA613.nsf/h_6057FA6682A90C3948256DCE0052D2D3/67DCB124F1BE4E7D48256DC50039AC31/$File/MX23C4000-4.2.pdf/?OpenElement Datasheet]>
: This wide TSOP IC on the frontside could be the most interesting of all. It is a 4MBit mask ROM.

* U4 HC574 [https://web.archive.org/web/20100617020513/http://www.ti.com/ Texas Instruments] <[https://web.archive.org/web/20100617020513/http://focus.ti.com/lit/ds/symlink/sn74hc574.pdf Datasheet]>
: This 20-pin standard logic IC is an octal D-flipflop, which splits the databus from the 92163 to 8 adress bits. This technique is very well known from the 8051 and other microcontrollers.

=== Hacking ===

As the dashboard presumably downloads the code from the ROM into the memory of the Xbox, this could be a hardware hack requiring no hardware modifications. The XBE loader for the DVD image is different from the usual XBE loader. However, the XBE is still signed and checked for security.

== References ==

* [https://ibb.co/album/cmr5rF Pictures of X08-25387-002 including internals]
* [https://github.com/JayFoxRox/xbox-tools/tree/master/dump-dvd-kit Tool to dump DVD Dongle ROM]
* [https://web.archive.org/web/20100617020513/http://www.xbox-linux.org/wiki/DVD-IR_Internals DVD-IR Internals]