xboxdevwiki - User contributions [en]

Engine List

2017-12-02T06:10:29Z

CakeLancelot: Add known Torque Game Engine games

There might also be games which were released for Xbox 360 but not the original Xbox. I forgot to respect that with grep, so I'll remove them manually...

= GoldSrc =

{| class="wikitable sortable" font-size:90%;"
! Title
|-
| [[Counter-Strike]]
|}

= id Tech 3 =

{| class="wikitable sortable" font-size:90%;"
! Title
|-
| [[Return to Castle Wolfenstein: Tides of War]]
|-
| [[Soldier of Fortune II: Double Helix]]
|-
| [[Star Wars: Jedi Knight II: Jedi Outcast]]
|-
| [[Star Wars: Jedi Knight: Jedi Academy]]
|-
| [[007: Everything or Nothing]]
|-
| [[007: Agent Under Fire]]
|}

= id Tech 4 =

id Tech 4 was scaled down for Xbox{{citation needed}}.

{| class="wikitable sortable" font-size:90%;"
! Title
|-
| [[Doom 3]]
|-
| [[Doom 3: Resurrection of Evil]]
|}

= Source Engine =

{| class="wikitable sortable" font-size:90%;"
! Title
|-
| [[Half-Life 2]]
|}

= CryEngine 1 =

{| class="wikitable sortable" font-size:90%;"
! Title
|-
| [[Far Cry Instincts]]
|-
| [[Far Cry Instincts: Evolution]]
|}

= Torque Game Engine =

{| class="wikitable sortable" font-size:90%;"
! Title
|-
| [[Marble Blast Gold]]
|-
| [[ThinkTanks]]
|}

= Renderware =

{| class="wikitable sortable" font-size:90%;"
!Title
|-
|[[AFL Live 2003]]
|-
|[[AFL Live 2004]]
|-
|[[AFL Live Premiership Edition]]
|-
|[[Battlefield 2: Modern Combat]]
|-
|[[Black]]
|-
|[[Blitz: The League]]
|-
|[[Broken Sword: The Sleeping Dragon]]
|-
|[[Burnout]]
|-
|[[Burnout 2: Point of Impact]]
|-
|[[Burnout 3: Takedown]]
|-
|[[Burnout Revenge]]
|-
|[[Call of Duty: Finest Hour]]
|-
|[[Cold Fear]]
|-
|[[Commandos: Strike Force]]
|-
|[[Darkwatch]]
|-
|[[Dead to Rights II]]
|-
|[[Evil Dead: Regeneration]]
|-
|[[Gauntlet: Seven Sorrows]]
|-
|[[Grand Theft Auto III]]
|-
|[[Grand Theft Auto: Vice City]]
|-
|[[Grand Theft Auto: San Andreas]]
|-
|[[Harry Potter and the Prisoner of Azkaban]]
|-
|[[Harry Potter and the Goblet of Fire]]
|-
|[[Headhunter Redemption]]
|-
|[[Hello Kitty: Roller Rescue]]
|-
|[[Kill Switch]]
|-
|[[Madagascar]]
|-
|[[Manhunt]]
|-
|[[Max Payne 2: The Fall of Max Payne]]
|-
|[[Major League Baseball 2K5]]
|-
|[[Mortal Kombat: Armageddon]]
|-
|[[Mortal Kombat: Deadly Alliance]]
|-
|[[Mortal Kombat: Deception]]
|-
|[[NBA Ballers]]
|-
|[[NFL Blitz 2003]]
|-
|[[Rugby League]]
|-
|[[ObsCure]]
|-
|[[Outlaw Golf 2]]
|-
|[[Puyo Pop: Fever]]
|-
|[[RoboCop]]
|-
|[[Rolling]]
|-
|[[Alfa Romeo Racing Italiano]]
|-
|[[Secret Weapons Over Normandy]]
|-
|[[Shadow the Hedgehog]]
|-
|[[Sonic Heroes]]
|-
|[[SpongeBob SquarePants: Battle for Bikini Bottom]]
|-
|[[Tech Deck Dude Bare Knuckle Grind]]
|-
|[[Teenage Mutant Ninja Turtles: Mutant Melee]]
|-
|[[The Incredibles: Rise of the Underminer]]
|-
|[[The Incredibles]]
|-
|[[The SpongeBob SquarePants Movie Game]]
|-
|[[The Warriors]]
|-
|[[Tony Hawk's Pro Skater 3]]
|-
|[[Tony Hawk's Pro Skater 4]]
|-
|[[Total Overdose: A Gunslinger's Tale in Mexico]]
|-
|[[Toxic Grind]]
|-
|[[Without Warning]]
|-
|[[Yourself!Fitness]]
|}

= Unreal Engine 1 =

{| class="wikitable sortable" font-size:90%;"
!Title
!Engine Version
|-
|[[New Legends]]
|UT Build 613
|}

= Unreal Engine 2 =

{| class="wikitable sortable" font-size:90%;"
!Title
!Engine Version
|-
|-
|[[Advent Rising]]
|UE2 Build 2226
|-
|[[America's Army: Rise of a Soldier]]
|UT2003 Build 928
|-
|[[Brothers in Arms: Earned in Blood]]
|UE2 Build 2226
|-
|[[Brothers in Arms: Road to Hill 30]]
|UE2 Build 2226
|-
|[[Combat: Task Force 121]]
|UE2 Build 2110
|-
|[[Dead Man's Hand]]
|UE2 Build 2110
|-
|[[Deus Ex: Invisible War]]
|Warfare Build 777
|-
|[[Land of the Dead: Road to Fiddler's Green]]
|UE2 BUild 2226
|-
|[[Magic the Gathering: Battlegrounds]]
|Warfare Build 926
|-
|[[Men of Valor]]
|Warfare Build 926
|-
|[[Open Season]]
|Warfare Build 927
|-
|[[Pariah]]
|UT2003 Build 928 with some UE2.5 code
|-
|[[Shadow Ops: Red Mercury]]
|UE2 Build 2110
|-
|[[Star Wars: Republic Commando]]
|UE2 Build 2226
|-
|[[Thief: Deadly Shadows]]
|Warfare Build 777
|-
|[[Tom Clancy's Ghost Recon: Advanced Warfighter]]
|Warfare Build 927
|-
|[[Tom Clancy's Rainbow Six 3]]
|Warfare Build 927
|-
|[[Tom Clancy's Rainbow Six 3: Black Arrow]]
|Warfare Build 927
|-
|[[Tom Clancy's Splinter Cell]]
|Warfare Build 829
|-
|[[Tom Clancy's Splinter Cell: Chaos Theory]]
|Warfare Build 829 - Singleplayer & Co-op mode
UE2 Build 2110 - Versus mode
|-
|[[Tom Clancy's Splinter Cell: Double Agent]]
|Warfare Build 829 - Offline mode UE2 Build 2110 - Online mode
|-
|[[Tom Clancy's Splinter Cell: Pandora Tomorrow]]
|Warfare Build 829 - Singleplayer mode UE2 Build 2110 - Multiplayer mode
|-
|[[Unreal II: The Awakening]]
|Warfare Build 829 - Retail box UE2 Build 2001 - Patch v1403
|-
|[[Unreal Championship]]
|UT2003 Build 928
|-
|[[Unreal Championship 2: The Liandri Conflict]]
|UE2 build 2227 with some UE2.5 code (UE2X)
|-
|[[Warpath]]
|UT2003 Build 928 with some UE2.5 code
|-
|[[World War II Combat: Road to Berlin]]
|UE2 Build 2110
|-
|[[World War II Combat: Iwo Jima]]
|UE2 Build 2110
|-
|[[XIII]]
|Warfare Build 829
|}

*Contains information from [https://en.wikipedia.org/wiki/List_of_CryEngine_games here], [https://en.wikipedia.org/wiki/List_of_Unreal_Engine_games here], [https://en.wikipedia.org/wiki/Id_Tech_3 here], and [https://en.wikipedia.org/wiki/List_of_RenderWare_games here].

License: https://en.wikipedia.org/wiki/Wikipedia:Text_of_Creative_Commons_Attribution-ShareAlike_3.0_Unported_License

Xbox Game Disc

2017-09-21T03:19:55Z

CakeLancelot: /* Dumping */ Finalize H353A Kreon FW and D163A Original FW. Previous edits are related to this, sorry for not putting a summary.

Xbox games are shipped on DVDs. They are commonly referred to as Xbox Game Discs (XGD).

== Visible information on ring ==

'''The DVD inner ring usually contains:'''

(The examples are from a German [[FIFA Soccer 2003]] disc)

An outer portion with labels:
* Outer ring Layer 1
** Code 39 Barcode of the the Mastering Code (*EA02302E L1*)
** Text for Mastering code ("EA02302E L1 02 0MM", where "02" is a smaller font and slightly higher than the previous baseline, followed by "0MM" on the original baseline)
** Mastering SID Code ("IFPI L126")
* Inner ring for Layer 0
** Code 39 Barcode of the the Mastering Code (*EA02302E L0*)
** Text for Mastering code ("EA02302E L0 06", where "06" is a smaller font and slightly higher than the previous baseline)
** Mastering SID Code ("IFPI L126")

An inner porition with Xbox logo:
* 3 times "XBOX" text with "X Logo" in the background on each side
* 1 time "XBOX" text with blank background
* 3 times "XBOX" text with "X Logo" in the background on each side
* Another tiny pattern segmented into 7 portions in alternating position,(opposite of the "XBOX" text without logo)
** 4 times a Xbox logo
** 2 times the word "genuine"
** and in the middle the word ASPnnnn where n is a number{{citation needed}}

''' ASP code '''
[[File:Asp demodisk.jpg|thumb|right|Detail of the DVD hologram, reflecting the ASP5080 by the flash of the camera. found on a demodisk (IM00113E-IM)]]
The following table lists known ASPnnnn numbers found on Xbox dvd disks, they are also on 360 disks but we dont list those in this wiki.
The games listed are examples, its known for sure more disks can have these numbers and further research can be done, to determine the meaning.
It is rumoured it might be a version string of some sorts slowly raising in xbox years old. {{citation needed}}
{| class="wikitable"
|-
! ASP number
! found on
! game serial
|-
| ASP0180
| Xbox Hardware Refresh Disc
| XB01101W
|-
| ASP0380
| Tom Clancy's Splinter Cell Exclusive Playable Demo
| US01251E
|-
| ASP0980
| Tom Clancy's Rainbow Six 3 DEMO DISC
| US03152E-US
|-
| ASP5080
| The official xbox 50 best games (Demo disk)
| IM00113E-IM
|-
| ASP5180
| Rayman 3 hoodlum havoc
|
|-
| ASP5280
| Xbox Music Mixer
| MS09005A-MS
|}

== Dumps ==

=== Files ===

==== Disc Manufacturing Information (DMI.bin) ====

READ DVD STRUCTURE with format 0x04

DMI (2048 Bytes):

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|0 || u32? || Unknown || Always 1?
|-
|4 || u32? || Unknown || Always zero?
|-
|8 || ascii_char[8] || Mastering Code || Example: EA02302E Also see [[Xbe#Title_ID]]
|-
|16 || u64 || || Some timestamp?
|-
|24 || u32? || Unknown || Always 2?
|}

==== Physical Format Information (PFI.bin) ====

READ DVD STRUCTURE with format 0x00

Read from the Lead-In.

PFI (2048 Bytes):

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|0 || u8 || <code>booktype << 4 <nowiki>|</nowiki> part_version</code> || 4 bit each
|-
|1 || u8 || <code>disc_size << 4 <nowiki>|</nowiki> maximum_rate</code> || 4 bit each
|-
|2 || u8 || <code>number_of_layers << 5 <nowiki>|</nowiki> track_path << 4 <nowiki>|</nowiki> layer_type</code> || 1 bit padding, 2 bit, 1 bit, 4 bit
|-
|3 || u8 || <code>linear_density << 4 <nowiki>|</nowiki> track_density</code> || 4 bit each
|-
|4 || u8 || || Always zero
|-
|5 || u24 || Starting Physical Sector Number of Data Area ||
|-
|8 || u8 || || Always zero
|-
|9 || u24 || End Physical Sector Number of Data Area ||
|-
|12 || u8 || || Always zero
|-
|13 || u24 || End Sector Number in Layer 0 || Always 0x2033AF for original Xbox discs
|}

From [ftp://ftp.avc-pioneer.com/Mtfuji_5/Proposal/Jan01/RDVDSTRC.pdf] (page 4)

==== Security Sectors (SS.bin) ====

Challenge entry (11 Bytes):

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|0 || u8 || Valid || Always 1 if the challenge is valid, else the challenge is ignored
|-
|1 || u8 || Challenge id ||
|-
|2 || u32 || Challenge value ||
|-
|6 || u8 || Response modifier || multimedia.cx says this might be a Response id. However, it's always 0 anyway?!
|-
|7 || u32 || Response value ||
|}

Security sector range (9 Bytes)

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|3 || u24 || Start PSN ||
|-
|6 || u24 || End PSN ||
|}

Unknown1 (44 Bytes)

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|0 || u64 || || Yet another timestamp?! (Similar to 1183 in complete format)
|-
|8 || u32 || || Unknown
|-
|27 || u8 || || Unknown
|-
|28 || u8[16] || || Unknown
|}

Complete format (2048 Bytes):

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|0 || PFI || Physical Format Information || PFI for the actual data, unknown size
|-
|720 || u32 || Unknown ||
|-
|768 || u8 || Version of challenge table || Always 1
|-
|769 || u8 || Number of challenge entries || Always 23
|-
|770 || Challenge entry[] || Encrypted challenge entries ||
|-
|1055 || u64 || || Some large number timestamp?
|-
|1083 || u8[16] || || Unknown
|-
|1183 || Unknown1 || || Unknown, this structure is SHA-1 hashed, to generate a RC4 key to decrypt challenge entries
|-
|1227 || u8[20] || SHA-1 hash A || Hash until here (of the complete format)
|-
|1247 || u8[256] || Signature A || For hash in previous field
|-
|1503 || Unknown1 || || Unknown
|-
|1547 || u8[20] || SHA-1 hash B || Hash until here (of the complete format)
|-
|1567 || u8[64] || Signature B || For hash in previous field (note that this is somewhat shorter than the other signature?!)
|-
! colspan="4" | End of data readable by a stock Xbox drive (1632 Bytes)
|-
|1632 || u8 || Number of security sector ranges || Always 23
|-
|1633 || Security sector range[] || Security sector ranges || Only 16 of which are used.
|-
|1840 || Security sector range[] || Security sector ranges || Only 16 of which are used. ''(Copy from Offset 1633)''
|}

All other fields are assumed to be zero!

===== Decryption of challenge entries =====

Starting at offset 1183, a 44 byte SHA-1 hash is generated.
The first 7 byte of the resulting hash are used as the key in RC4 decryption. The 253 Bytes of the challenge entries (Offset 770) will be decrypted.

There'll only be a handful of valid entries in the challenge entries.
However there'll be at least 2.

=== Dumping ===

To dump Xbox Game Discs you need one of the following drives / firmwares:

{| class="wikitable"
!Drive
!Standard
!Original Firmware download
!Name of modified Firmware for dumping
|-
|{{citation needed}}
|
|
|0800
|-
|Toshiba SD-M2012C
|IDE
|
|Kreon{{citation needed}}
|-
|Samsung SH-D162C
|IDE
|
|SB00 Kreon 0.60 (July 30th 2006) SB00 Kreon 0.80 (September 9th 2006) SB01 Kreon 1.00 (October 9th 2007)
|-
|Toshiba TS-H352C
|IDE
|
|Kreon{{citation needed}} {{FIXME|reason=Same as SH-D162C?}}
|-
|Samsung SH-D162D
|IDE
|[https://web.archive.org/web/20090601193905/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200706281644411972_SH-D162D_SB00.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB00] [https://web.archive.org/web/20090916202345/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200811051941150901_SH-D162D_SB01.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01] SB02{{citation needed}}[http://www.firmwarehq.com/download_995-file_SH-D162D_SB02.exe.html unknown if safe or legit] [https://web.archive.org/web/20090402052613/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191825218171_SH-D162D_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] [https://web.archive.org/web/20120123040117/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200909281412336931_SH-D162D_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]
|SB00 Kreon 1.00 (November 18th 2007)
|-
|Toshiba TS-H352D
|IDE
|
|Kreon{{citation needed}} {{FIXME|reason=Same as SH-D162D?}}
|-
|Samsung SH-D163A
|SATA
|[http://web.archive.org/web/20090601191704/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200701031704489471_SH-D163A_SB01.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01]
|Kreon 0.80 (October 17th 2006) SB01 Kreon 1.00 (October 9th 2007)
|-
|Toshiba TS-H353A
|SATA
|
|Kreon 0.80 (October 17th 2006) SB01 Kreon 1.00 (October 9th 2007)
|-
|Samsung SH-D163B
|SATA
|
|Kreon 1.00 (November 18th 2007)
|-
|Toshiba TS-H353B
|SATA
|
|{{citation needed}} {{FIXME|reason=Same as SH-D163B?}}
|}

Please note that the modified firmwares are based on copyrighted material and can therefore not be legally shared here.
Patch files to patch original firmwares into dumping-firmwares would be appreciated.

Flashing software:

* TSDNMAC for MacOS
* [http://web.archive.org/web/20070301000000/http://www.samsungodd.com/KorLib/File/sfdnwin.exe SFDNWIN] for Microsoft Windows 2000 and XP
* TSDNWIN for Microsoft Windows Vista and 7
* Dell SFDNDOS and the newer TSDNDOS for Microsoft DOS

For current dumping instructions see [http://forum.redump.org/topic/6073/xbox-1-360-dumping-instructions/ the Dumping Guide by the Redump Project].

=== Xbox related commands ===

==== Enable Unlock 1 (xtreme) state ====

Supported by: Kreon 1.00
<pre>FF 08 01 01</pre>

Enable Unlock 1 (xtreme) state' as we already know it from the 360 xtreme modded drives.
This command is supported for legacy reasons only. Custom applications should use the new 'Set Lock State' instead.

==== Set Lock State ====

Supported by: Kreon 1.00
<pre>FF 08 01 11 xx</pre>

* <code>xx=00</code> - Drive locked (no unlock state)
* <code>xx=01</code> - Unlock State 1 (xtreme) enabled
* <code>xx=02</code> - Unlock state 2 (wxripper) enabled

==== SS extract command ====

Supported by: Kreon 1.00
<pre>AD 00 FF 02 FD FF FE 00 08 00 xx C0</pre>

This is the well known from the xtreme firmware.

==== Get Feature List ====

Supported by: Kreon 1.00
<pre>FF 08 01 10</pre>

This command will return a list of the additional features supported by the drive.
All values returned are 16 bit values, and the list is terminated with null (<code>0x0000</code>).
The two first words of the returned list always reads as <code>0xA55A 0X5AA5</code> in order to guarantee that a reply from a drive not supporting this command correctly isn't mistaken for a feature list.

An example feature list could be: <code>0xA55A, 0x5AA5, 0x0100, 0xF000, 0xF001, 0x0000</code>

This list would indicate that the drive supports XBOX360 Unlock 1, Lock and Error Skip, as it can be seen from the values defined below:

XBOX 360 related features:

* <code>0x0100</code> : The drive supports the unlock 1 state (xtreme)
* <code>0x0101</code> : The drive supports the unlock 2 state (wxripper)
* <code>0x0120</code> : The drive can read and decrypt the SS
* <code>0x0121</code> : The drive has full challenge response functionality

XBOX related features:

* <code>0x0200</code> : The drive supports the unlock 1 state (xtreme)
* <code>0x0201</code> : The drive supports the unlock 2 state (wxripper)
* <code>0x0220</code> : The drive can read and decrypt the SS
* <code>0x0221</code> : The drive has full challenge response functionality

General drive features:

* <code>0xF000</code> : The drive supports the lock (cancel any unlock state) command
* <code>0xF001</code> : The drive supports error skipping

This is the complete list of defined features at the moment. If you're working on a custom application you might want to contact me in order to get the latest list.

== References and links ==
* [https://web.archive.org/web/20150616131202/http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf]
* [https://multimedia.cx/eggs/xbox-sphinx-protocol/ Overview of the challenge/response security protocol]
* [http://redump.org/discs/system/xbox/ Xbox Game Discs preserved by the Redump Project]
* [http://wiki.redump.org/index.php?title=Discs_not_yet_dumped#Microsoft_Xbox Missing Xbox Game Disc dumps at Redump Project]

Xbox Game Disc

2017-09-20T22:36:50Z

CakeLancelot:

Xbox games are shipped on DVDs. They are commonly referred to as Xbox Game Discs (XGD).

== Visible information on ring ==

'''The DVD inner ring usually contains:'''

(The examples are from a German [[FIFA Soccer 2003]] disc)

An outer portion with labels:
* Outer ring Layer 1
** Code 39 Barcode of the the Mastering Code (*EA02302E L1*)
** Text for Mastering code ("EA02302E L1 02 0MM", where "02" is a smaller font and slightly higher than the previous baseline, followed by "0MM" on the original baseline)
** Mastering SID Code ("IFPI L126")
* Inner ring for Layer 0
** Code 39 Barcode of the the Mastering Code (*EA02302E L0*)
** Text for Mastering code ("EA02302E L0 06", where "06" is a smaller font and slightly higher than the previous baseline)
** Mastering SID Code ("IFPI L126")

An inner porition with Xbox logo:
* 3 times "XBOX" text with "X Logo" in the background on each side
* 1 time "XBOX" text with blank background
* 3 times "XBOX" text with "X Logo" in the background on each side
* Another tiny pattern segmented into 7 portions in alternating position,(opposite of the "XBOX" text without logo)
** 4 times a Xbox logo
** 2 times the word "genuine"
** and in the middle the word ASPnnnn where n is a number{{citation needed}}

''' ASP code '''
[[File:Asp demodisk.jpg|thumb|right|Detail of the DVD hologram, reflecting the ASP5080 by the flash of the camera. found on a demodisk (IM00113E-IM)]]
The following table lists known ASPnnnn numbers found on Xbox dvd disks, they are also on 360 disks but we dont list those in this wiki.
The games listed are examples, its known for sure more disks can have these numbers and further research can be done, to determine the meaning.
It is rumoured it might be a version string of some sorts slowly raising in xbox years old. {{citation needed}}
{| class="wikitable"
|-
! ASP number
! found on
! game serial
|-
| ASP0180
| Xbox Hardware Refresh Disc
| XB01101W
|-
| ASP0380
| Tom Clancy's Splinter Cell Exclusive Playable Demo
| US01251E
|-
| ASP0980
| Tom Clancy's Rainbow Six 3 DEMO DISC
| US03152E-US
|-
| ASP5080
| The official xbox 50 best games (Demo disk)
| IM00113E-IM
|-
| ASP5180
| Rayman 3 hoodlum havoc
|
|-
| ASP5280
| Xbox Music Mixer
| MS09005A-MS
|}

== Dumps ==

=== Files ===

==== Disc Manufacturing Information (DMI.bin) ====

READ DVD STRUCTURE with format 0x04

DMI (2048 Bytes):

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|0 || u32? || Unknown || Always 1?
|-
|4 || u32? || Unknown || Always zero?
|-
|8 || ascii_char[8] || Mastering Code || Example: EA02302E Also see [[Xbe#Title_ID]]
|-
|16 || u64 || || Some timestamp?
|-
|24 || u32? || Unknown || Always 2?
|}

==== Physical Format Information (PFI.bin) ====

READ DVD STRUCTURE with format 0x00

Read from the Lead-In.

PFI (2048 Bytes):

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|0 || u8 || <code>booktype << 4 <nowiki>|</nowiki> part_version</code> || 4 bit each
|-
|1 || u8 || <code>disc_size << 4 <nowiki>|</nowiki> maximum_rate</code> || 4 bit each
|-
|2 || u8 || <code>number_of_layers << 5 <nowiki>|</nowiki> track_path << 4 <nowiki>|</nowiki> layer_type</code> || 1 bit padding, 2 bit, 1 bit, 4 bit
|-
|3 || u8 || <code>linear_density << 4 <nowiki>|</nowiki> track_density</code> || 4 bit each
|-
|4 || u8 || || Always zero
|-
|5 || u24 || Starting Physical Sector Number of Data Area ||
|-
|8 || u8 || || Always zero
|-
|9 || u24 || End Physical Sector Number of Data Area ||
|-
|12 || u8 || || Always zero
|-
|13 || u24 || End Sector Number in Layer 0 || Always 0x2033AF for original Xbox discs
|}

From [ftp://ftp.avc-pioneer.com/Mtfuji_5/Proposal/Jan01/RDVDSTRC.pdf] (page 4)

==== Security Sectors (SS.bin) ====

Challenge entry (11 Bytes):

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|0 || u8 || Valid || Always 1 if the challenge is valid, else the challenge is ignored
|-
|1 || u8 || Challenge id ||
|-
|2 || u32 || Challenge value ||
|-
|6 || u8 || Response modifier || multimedia.cx says this might be a Response id. However, it's always 0 anyway?!
|-
|7 || u32 || Response value ||
|}

Security sector range (9 Bytes)

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|3 || u24 || Start PSN ||
|-
|6 || u24 || End PSN ||
|}

Unknown1 (44 Bytes)

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|0 || u64 || || Yet another timestamp?! (Similar to 1183 in complete format)
|-
|8 || u32 || || Unknown
|-
|27 || u8 || || Unknown
|-
|28 || u8[16] || || Unknown
|}

Complete format (2048 Bytes):

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|0 || PFI || Physical Format Information || PFI for the actual data, unknown size
|-
|720 || u32 || Unknown ||
|-
|768 || u8 || Version of challenge table || Always 1
|-
|769 || u8 || Number of challenge entries || Always 23
|-
|770 || Challenge entry[] || Encrypted challenge entries ||
|-
|1055 || u64 || || Some large number timestamp?
|-
|1083 || u8[16] || || Unknown
|-
|1183 || Unknown1 || || Unknown, this structure is SHA-1 hashed, to generate a RC4 key to decrypt challenge entries
|-
|1227 || u8[20] || SHA-1 hash A || Hash until here (of the complete format)
|-
|1247 || u8[256] || Signature A || For hash in previous field
|-
|1503 || Unknown1 || || Unknown
|-
|1547 || u8[20] || SHA-1 hash B || Hash until here (of the complete format)
|-
|1567 || u8[64] || Signature B || For hash in previous field (note that this is somewhat shorter than the other signature?!)
|-
! colspan="4" | End of data readable by a stock Xbox drive (1632 Bytes)
|-
|1632 || u8 || Number of security sector ranges || Always 23
|-
|1633 || Security sector range[] || Security sector ranges || Only 16 of which are used.
|-
|1840 || Security sector range[] || Security sector ranges || Only 16 of which are used. ''(Copy from Offset 1633)''
|}

All other fields are assumed to be zero!

===== Decryption of challenge entries =====

Starting at offset 1183, a 44 byte SHA-1 hash is generated.
The first 7 byte of the resulting hash are used as the key in RC4 decryption. The 253 Bytes of the challenge entries (Offset 770) will be decrypted.

There'll only be a handful of valid entries in the challenge entries.
However there'll be at least 2.

=== Dumping ===

To dump Xbox Game Discs you need one of the following drives / firmwares:

{| class="wikitable"
!Drive
!Standard
!Original Firmware download
!Name of modified Firmware for dumping
|-
|{{citation needed}}
|
|
|0800
|-
|Toshiba SD-M2012C
|IDE
|
|Kreon{{citation needed}}
|-
|Samsung SH-D162C
|IDE
|
|SB00 Kreon 0.60 (July 30th 2006) SB00 Kreon 0.80 (September 9th 2006) SB01 Kreon 1.00 (October 9th 2007)
|-
|Toshiba TS-H352C
|IDE
|
|Kreon{{citation needed}} {{FIXME|reason=Same as SH-D162C?}}
|-
|Samsung SH-D162D
|IDE
|[https://web.archive.org/web/20090601193905/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200706281644411972_SH-D162D_SB00.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB00] [https://web.archive.org/web/20090916202345/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200811051941150901_SH-D162D_SB01.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01] SB02{{citation needed}}[http://www.firmwarehq.com/download_995-file_SH-D162D_SB02.exe.html unknown if safe or legit] [https://web.archive.org/web/20090402052613/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191825218171_SH-D162D_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] [https://web.archive.org/web/20120123040117/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200909281412336931_SH-D162D_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]
|SB00 Kreon 1.00 (November 18th 2007)
|-
|Toshiba TS-H352D
|IDE
|
|Kreon{{citation needed}} {{FIXME|reason=Same as SH-D162D?}}
|-
|Samsung SH-D163A
|SATA
|[http://web.archive.org/web/20090601191704/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200701031704489471_SH-D163A_SB01.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01]
|Kreon 0.80 (October 17th 2006) SB01 Kreon 1.00 (October 9th 2007)
|-
|Toshiba TS-H353A
|SATA
|
|Kreon 0.80 (October 17th 2006) Kreon 1.00 (November 18th 2007)
|-
|Samsung SH-D163B
|SATA
|
|Kreon 1.00 (November 18th 2007)
|-
|Toshiba TS-H353B
|SATA
|
|{{citation needed}} {{FIXME|reason=Same as SH-D163B?}}
|}

Please note that the modified firmwares are based on copyrighted material and can therefore not be legally shared here.
Patch files to patch original firmwares into dumping-firmwares would be appreciated.

Flashing software:

* TSDNMAC for MacOS
* [http://web.archive.org/web/20070301000000/http://www.samsungodd.com/KorLib/File/sfdnwin.exe SFDNWIN] for Microsoft Windows 2000 and XP
* TSDNWIN for Microsoft Windows Vista and 7
* Dell SFDNDOS and the newer TSDNDOS for Microsoft DOS

For current dumping instructions see [http://forum.redump.org/topic/6073/xbox-1-360-dumping-instructions/ the Dumping Guide by the Redump Project].

=== Xbox related commands ===

==== Enable Unlock 1 (xtreme) state ====

Supported by: Kreon 1.00
<pre>FF 08 01 01</pre>

Enable Unlock 1 (xtreme) state' as we already know it from the 360 xtreme modded drives.
This command is supported for legacy reasons only. Custom applications should use the new 'Set Lock State' instead.

==== Set Lock State ====

Supported by: Kreon 1.00
<pre>FF 08 01 11 xx</pre>

* <code>xx=00</code> - Drive locked (no unlock state)
* <code>xx=01</code> - Unlock State 1 (xtreme) enabled
* <code>xx=02</code> - Unlock state 2 (wxripper) enabled

==== SS extract command ====

Supported by: Kreon 1.00
<pre>AD 00 FF 02 FD FF FE 00 08 00 xx C0</pre>

This is the well known from the xtreme firmware.

==== Get Feature List ====

Supported by: Kreon 1.00
<pre>FF 08 01 10</pre>

This command will return a list of the additional features supported by the drive.
All values returned are 16 bit values, and the list is terminated with null (<code>0x0000</code>).
The two first words of the returned list always reads as <code>0xA55A 0X5AA5</code> in order to guarantee that a reply from a drive not supporting this command correctly isn't mistaken for a feature list.

An example feature list could be: <code>0xA55A, 0x5AA5, 0x0100, 0xF000, 0xF001, 0x0000</code>

This list would indicate that the drive supports XBOX360 Unlock 1, Lock and Error Skip, as it can be seen from the values defined below:

XBOX 360 related features:

* <code>0x0100</code> : The drive supports the unlock 1 state (xtreme)
* <code>0x0101</code> : The drive supports the unlock 2 state (wxripper)
* <code>0x0120</code> : The drive can read and decrypt the SS
* <code>0x0121</code> : The drive has full challenge response functionality

XBOX related features:

* <code>0x0200</code> : The drive supports the unlock 1 state (xtreme)
* <code>0x0201</code> : The drive supports the unlock 2 state (wxripper)
* <code>0x0220</code> : The drive can read and decrypt the SS
* <code>0x0221</code> : The drive has full challenge response functionality

General drive features:

* <code>0xF000</code> : The drive supports the lock (cancel any unlock state) command
* <code>0xF001</code> : The drive supports error skipping

This is the complete list of defined features at the moment. If you're working on a custom application you might want to contact me in order to get the latest list.

== References and links ==
* [https://web.archive.org/web/20150616131202/http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf]
* [https://multimedia.cx/eggs/xbox-sphinx-protocol/ Overview of the challenge/response security protocol]
* [http://redump.org/discs/system/xbox/ Xbox Game Discs preserved by the Redump Project]
* [http://wiki.redump.org/index.php?title=Discs_not_yet_dumped#Microsoft_Xbox Missing Xbox Game Disc dumps at Redump Project]

Xbox Game Disc

2017-09-20T22:33:27Z

CakeLancelot:

Xbox games are shipped on DVDs. They are commonly referred to as Xbox Game Discs (XGD).

== Visible information on ring ==

'''The DVD inner ring usually contains:'''

(The examples are from a German [[FIFA Soccer 2003]] disc)

An outer portion with labels:
* Outer ring Layer 1
** Code 39 Barcode of the the Mastering Code (*EA02302E L1*)
** Text for Mastering code ("EA02302E L1 02 0MM", where "02" is a smaller font and slightly higher than the previous baseline, followed by "0MM" on the original baseline)
** Mastering SID Code ("IFPI L126")
* Inner ring for Layer 0
** Code 39 Barcode of the the Mastering Code (*EA02302E L0*)
** Text for Mastering code ("EA02302E L0 06", where "06" is a smaller font and slightly higher than the previous baseline)
** Mastering SID Code ("IFPI L126")

An inner porition with Xbox logo:
* 3 times "XBOX" text with "X Logo" in the background on each side
* 1 time "XBOX" text with blank background
* 3 times "XBOX" text with "X Logo" in the background on each side
* Another tiny pattern segmented into 7 portions in alternating position,(opposite of the "XBOX" text without logo)
** 4 times a Xbox logo
** 2 times the word "genuine"
** and in the middle the word ASPnnnn where n is a number{{citation needed}}

''' ASP code '''
[[File:Asp demodisk.jpg|thumb|right|Detail of the DVD hologram, reflecting the ASP5080 by the flash of the camera. found on a demodisk (IM00113E-IM)]]
The following table lists known ASPnnnn numbers found on Xbox dvd disks, they are also on 360 disks but we dont list those in this wiki.
The games listed are examples, its known for sure more disks can have these numbers and further research can be done, to determine the meaning.
It is rumoured it might be a version string of some sorts slowly raising in xbox years old. {{citation needed}}
{| class="wikitable"
|-
! ASP number
! found on
! game serial
|-
| ASP0180
| Xbox Hardware Refresh Disc
| XB01101W
|-
| ASP0380
| Tom Clancy's Splinter Cell Exclusive Playable Demo
| US01251E
|-
| ASP0980
| Tom Clancy's Rainbow Six 3 DEMO DISC
| US03152E-US
|-
| ASP5080
| The official xbox 50 best games (Demo disk)
| IM00113E-IM
|-
| ASP5180
| Rayman 3 hoodlum havoc
|
|-
| ASP5280
| Xbox Music Mixer
| MS09005A-MS
|}

== Dumps ==

=== Files ===

==== Disc Manufacturing Information (DMI.bin) ====

READ DVD STRUCTURE with format 0x04

DMI (2048 Bytes):

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|0 || u32? || Unknown || Always 1?
|-
|4 || u32? || Unknown || Always zero?
|-
|8 || ascii_char[8] || Mastering Code || Example: EA02302E Also see [[Xbe#Title_ID]]
|-
|16 || u64 || || Some timestamp?
|-
|24 || u32? || Unknown || Always 2?
|}

==== Physical Format Information (PFI.bin) ====

READ DVD STRUCTURE with format 0x00

Read from the Lead-In.

PFI (2048 Bytes):

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|0 || u8 || <code>booktype << 4 <nowiki>|</nowiki> part_version</code> || 4 bit each
|-
|1 || u8 || <code>disc_size << 4 <nowiki>|</nowiki> maximum_rate</code> || 4 bit each
|-
|2 || u8 || <code>number_of_layers << 5 <nowiki>|</nowiki> track_path << 4 <nowiki>|</nowiki> layer_type</code> || 1 bit padding, 2 bit, 1 bit, 4 bit
|-
|3 || u8 || <code>linear_density << 4 <nowiki>|</nowiki> track_density</code> || 4 bit each
|-
|4 || u8 || || Always zero
|-
|5 || u24 || Starting Physical Sector Number of Data Area ||
|-
|8 || u8 || || Always zero
|-
|9 || u24 || End Physical Sector Number of Data Area ||
|-
|12 || u8 || || Always zero
|-
|13 || u24 || End Sector Number in Layer 0 || Always 0x2033AF for original Xbox discs
|}

From [ftp://ftp.avc-pioneer.com/Mtfuji_5/Proposal/Jan01/RDVDSTRC.pdf] (page 4)

==== Security Sectors (SS.bin) ====

Challenge entry (11 Bytes):

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|0 || u8 || Valid || Always 1 if the challenge is valid, else the challenge is ignored
|-
|1 || u8 || Challenge id ||
|-
|2 || u32 || Challenge value ||
|-
|6 || u8 || Response modifier || multimedia.cx says this might be a Response id. However, it's always 0 anyway?!
|-
|7 || u32 || Response value ||
|}

Security sector range (9 Bytes)

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|3 || u24 || Start PSN ||
|-
|6 || u24 || End PSN ||
|}

Unknown1 (44 Bytes)

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|0 || u64 || || Yet another timestamp?! (Similar to 1183 in complete format)
|-
|8 || u32 || || Unknown
|-
|27 || u8 || || Unknown
|-
|28 || u8[16] || || Unknown
|}

Complete format (2048 Bytes):

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|0 || PFI || Physical Format Information || PFI for the actual data, unknown size
|-
|720 || u32 || Unknown ||
|-
|768 || u8 || Version of challenge table || Always 1
|-
|769 || u8 || Number of challenge entries || Always 23
|-
|770 || Challenge entry[] || Encrypted challenge entries ||
|-
|1055 || u64 || || Some large number timestamp?
|-
|1083 || u8[16] || || Unknown
|-
|1183 || Unknown1 || || Unknown, this structure is SHA-1 hashed, to generate a RC4 key to decrypt challenge entries
|-
|1227 || u8[20] || SHA-1 hash A || Hash until here (of the complete format)
|-
|1247 || u8[256] || Signature A || For hash in previous field
|-
|1503 || Unknown1 || || Unknown
|-
|1547 || u8[20] || SHA-1 hash B || Hash until here (of the complete format)
|-
|1567 || u8[64] || Signature B || For hash in previous field (note that this is somewhat shorter than the other signature?!)
|-
! colspan="4" | End of data readable by a stock Xbox drive (1632 Bytes)
|-
|1632 || u8 || Number of security sector ranges || Always 23
|-
|1633 || Security sector range[] || Security sector ranges || Only 16 of which are used.
|-
|1840 || Security sector range[] || Security sector ranges || Only 16 of which are used. ''(Copy from Offset 1633)''
|}

All other fields are assumed to be zero!

===== Decryption of challenge entries =====

Starting at offset 1183, a 44 byte SHA-1 hash is generated.
The first 7 byte of the resulting hash are used as the key in RC4 decryption. The 253 Bytes of the challenge entries (Offset 770) will be decrypted.

There'll only be a handful of valid entries in the challenge entries.
However there'll be at least 2.

=== Dumping ===

To dump Xbox Game Discs you need one of the following drives / firmwares:

{| class="wikitable"
!Drive
!Standard
!Original Firmware download
!Name of modified Firmware for dumping
|-
|{{citation needed}}
|
|
|0800
|-
|Toshiba SD-M2012C
|IDE
|
|Kreon{{citation needed}}
|-
|Samsung SH-D162C
|IDE
|
|SB00 Kreon 0.60 (July 30th 2006) SB00 Kreon 0.80 (September 9th 2006) SB01 Kreon 1.00 (October 9th 2007)
|-
|Toshiba TS-H352C
|IDE
|
|Kreon{{citation needed}} {{FIXME|reason=Same as SH-D162C?}}
|-
|Samsung SH-D162D
|IDE
|[https://web.archive.org/web/20090601193905/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200706281644411972_SH-D162D_SB00.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB00] [https://web.archive.org/web/20090916202345/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200811051941150901_SH-D162D_SB01.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01] SB02{{citation needed}}[http://www.firmwarehq.com/download_995-file_SH-D162D_SB02.exe.html unknown if safe or legit] [https://web.archive.org/web/20090402052613/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191825218171_SH-D162D_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] [https://web.archive.org/web/20120123040117/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200909281412336931_SH-D162D_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]
|SB00 Kreon 1.00 (November 18th 2007)
|-
|Toshiba TS-H352D
|IDE
|
|Kreon{{citation needed}} {{FIXME|reason=Same as SH-D162D?}}
|-
|Samsung SH-D163A
|SATA
|
|Kreon 0.80 (October 17th 2006) SB01 Kreon 1.00 (October 9th 2007)
|-
|Toshiba TS-H353A
|SATA
|[http://web.archive.org/web/20090601191704/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200701031704489471_SH-D163A_SB01.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01]
|Kreon 0.80 (October 17th 2006) Kreon 1.00 (November 18th 2007)
|-
|Samsung SH-D163B
|SATA
|
|Kreon 1.00 (November 18th 2007)
|-
|Toshiba TS-H353B
|SATA
|
|{{citation needed}} {{FIXME|reason=Same as SH-D163B?}}
|}

Please note that the modified firmwares are based on copyrighted material and can therefore not be legally shared here.
Patch files to patch original firmwares into dumping-firmwares would be appreciated.

Flashing software:

* TSDNMAC for MacOS
* [http://web.archive.org/web/20070301000000/http://www.samsungodd.com/KorLib/File/sfdnwin.exe SFDNWIN] for Microsoft Windows 2000 and XP
* TSDNWIN for Microsoft Windows Vista and 7
* Dell SFDNDOS and the newer TSDNDOS for Microsoft DOS

For current dumping instructions see [http://forum.redump.org/topic/6073/xbox-1-360-dumping-instructions/ the Dumping Guide by the Redump Project].

=== Xbox related commands ===

==== Enable Unlock 1 (xtreme) state ====

Supported by: Kreon 1.00
<pre>FF 08 01 01</pre>

Enable Unlock 1 (xtreme) state' as we already know it from the 360 xtreme modded drives.
This command is supported for legacy reasons only. Custom applications should use the new 'Set Lock State' instead.

==== Set Lock State ====

Supported by: Kreon 1.00
<pre>FF 08 01 11 xx</pre>

* <code>xx=00</code> - Drive locked (no unlock state)
* <code>xx=01</code> - Unlock State 1 (xtreme) enabled
* <code>xx=02</code> - Unlock state 2 (wxripper) enabled

==== SS extract command ====

Supported by: Kreon 1.00
<pre>AD 00 FF 02 FD FF FE 00 08 00 xx C0</pre>

This is the well known from the xtreme firmware.

==== Get Feature List ====

Supported by: Kreon 1.00
<pre>FF 08 01 10</pre>

This command will return a list of the additional features supported by the drive.
All values returned are 16 bit values, and the list is terminated with null (<code>0x0000</code>).
The two first words of the returned list always reads as <code>0xA55A 0X5AA5</code> in order to guarantee that a reply from a drive not supporting this command correctly isn't mistaken for a feature list.

An example feature list could be: <code>0xA55A, 0x5AA5, 0x0100, 0xF000, 0xF001, 0x0000</code>

This list would indicate that the drive supports XBOX360 Unlock 1, Lock and Error Skip, as it can be seen from the values defined below:

XBOX 360 related features:

* <code>0x0100</code> : The drive supports the unlock 1 state (xtreme)
* <code>0x0101</code> : The drive supports the unlock 2 state (wxripper)
* <code>0x0120</code> : The drive can read and decrypt the SS
* <code>0x0121</code> : The drive has full challenge response functionality

XBOX related features:

* <code>0x0200</code> : The drive supports the unlock 1 state (xtreme)
* <code>0x0201</code> : The drive supports the unlock 2 state (wxripper)
* <code>0x0220</code> : The drive can read and decrypt the SS
* <code>0x0221</code> : The drive has full challenge response functionality

General drive features:

* <code>0xF000</code> : The drive supports the lock (cancel any unlock state) command
* <code>0xF001</code> : The drive supports error skipping

This is the complete list of defined features at the moment. If you're working on a custom application you might want to contact me in order to get the latest list.

== References and links ==
* [https://web.archive.org/web/20150616131202/http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf]
* [https://multimedia.cx/eggs/xbox-sphinx-protocol/ Overview of the challenge/response security protocol]
* [http://redump.org/discs/system/xbox/ Xbox Game Discs preserved by the Redump Project]
* [http://wiki.redump.org/index.php?title=Discs_not_yet_dumped#Microsoft_Xbox Missing Xbox Game Disc dumps at Redump Project]

Xbox Game Disc

2017-09-20T22:27:03Z

CakeLancelot:

Xbox games are shipped on DVDs. They are commonly referred to as Xbox Game Discs (XGD).

== Visible information on ring ==

'''The DVD inner ring usually contains:'''

(The examples are from a German [[FIFA Soccer 2003]] disc)

An outer portion with labels:
* Outer ring Layer 1
** Code 39 Barcode of the the Mastering Code (*EA02302E L1*)
** Text for Mastering code ("EA02302E L1 02 0MM", where "02" is a smaller font and slightly higher than the previous baseline, followed by "0MM" on the original baseline)
** Mastering SID Code ("IFPI L126")
* Inner ring for Layer 0
** Code 39 Barcode of the the Mastering Code (*EA02302E L0*)
** Text for Mastering code ("EA02302E L0 06", where "06" is a smaller font and slightly higher than the previous baseline)
** Mastering SID Code ("IFPI L126")

An inner porition with Xbox logo:
* 3 times "XBOX" text with "X Logo" in the background on each side
* 1 time "XBOX" text with blank background
* 3 times "XBOX" text with "X Logo" in the background on each side
* Another tiny pattern segmented into 7 portions in alternating position,(opposite of the "XBOX" text without logo)
** 4 times a Xbox logo
** 2 times the word "genuine"
** and in the middle the word ASPnnnn where n is a number{{citation needed}}

''' ASP code '''
[[File:Asp demodisk.jpg|thumb|right|Detail of the DVD hologram, reflecting the ASP5080 by the flash of the camera. found on a demodisk (IM00113E-IM)]]
The following table lists known ASPnnnn numbers found on Xbox dvd disks, they are also on 360 disks but we dont list those in this wiki.
The games listed are examples, its known for sure more disks can have these numbers and further research can be done, to determine the meaning.
It is rumoured it might be a version string of some sorts slowly raising in xbox years old. {{citation needed}}
{| class="wikitable"
|-
! ASP number
! found on
! game serial
|-
| ASP0180
| Xbox Hardware Refresh Disc
| XB01101W
|-
| ASP0380
| Tom Clancy's Splinter Cell Exclusive Playable Demo
| US01251E
|-
| ASP0980
| Tom Clancy's Rainbow Six 3 DEMO DISC
| US03152E-US
|-
| ASP5080
| The official xbox 50 best games (Demo disk)
| IM00113E-IM
|-
| ASP5180
| Rayman 3 hoodlum havoc
|
|-
| ASP5280
| Xbox Music Mixer
| MS09005A-MS
|}

== Dumps ==

=== Files ===

==== Disc Manufacturing Information (DMI.bin) ====

READ DVD STRUCTURE with format 0x04

DMI (2048 Bytes):

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|0 || u32? || Unknown || Always 1?
|-
|4 || u32? || Unknown || Always zero?
|-
|8 || ascii_char[8] || Mastering Code || Example: EA02302E Also see [[Xbe#Title_ID]]
|-
|16 || u64 || || Some timestamp?
|-
|24 || u32? || Unknown || Always 2?
|}

==== Physical Format Information (PFI.bin) ====

READ DVD STRUCTURE with format 0x00

Read from the Lead-In.

PFI (2048 Bytes):

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|0 || u8 || <code>booktype << 4 <nowiki>|</nowiki> part_version</code> || 4 bit each
|-
|1 || u8 || <code>disc_size << 4 <nowiki>|</nowiki> maximum_rate</code> || 4 bit each
|-
|2 || u8 || <code>number_of_layers << 5 <nowiki>|</nowiki> track_path << 4 <nowiki>|</nowiki> layer_type</code> || 1 bit padding, 2 bit, 1 bit, 4 bit
|-
|3 || u8 || <code>linear_density << 4 <nowiki>|</nowiki> track_density</code> || 4 bit each
|-
|4 || u8 || || Always zero
|-
|5 || u24 || Starting Physical Sector Number of Data Area ||
|-
|8 || u8 || || Always zero
|-
|9 || u24 || End Physical Sector Number of Data Area ||
|-
|12 || u8 || || Always zero
|-
|13 || u24 || End Sector Number in Layer 0 || Always 0x2033AF for original Xbox discs
|}

From [ftp://ftp.avc-pioneer.com/Mtfuji_5/Proposal/Jan01/RDVDSTRC.pdf] (page 4)

==== Security Sectors (SS.bin) ====

Challenge entry (11 Bytes):

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|0 || u8 || Valid || Always 1 if the challenge is valid, else the challenge is ignored
|-
|1 || u8 || Challenge id ||
|-
|2 || u32 || Challenge value ||
|-
|6 || u8 || Response modifier || multimedia.cx says this might be a Response id. However, it's always 0 anyway?!
|-
|7 || u32 || Response value ||
|}

Security sector range (9 Bytes)

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|3 || u24 || Start PSN ||
|-
|6 || u24 || End PSN ||
|}

Unknown1 (44 Bytes)

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|0 || u64 || || Yet another timestamp?! (Similar to 1183 in complete format)
|-
|8 || u32 || || Unknown
|-
|27 || u8 || || Unknown
|-
|28 || u8[16] || || Unknown
|}

Complete format (2048 Bytes):

{| class="wikitable"
! Offset !! Type !! Field !! Notes
|-
|0 || PFI || Physical Format Information || PFI for the actual data, unknown size
|-
|720 || u32 || Unknown ||
|-
|768 || u8 || Version of challenge table || Always 1
|-
|769 || u8 || Number of challenge entries || Always 23
|-
|770 || Challenge entry[] || Encrypted challenge entries ||
|-
|1055 || u64 || || Some large number timestamp?
|-
|1083 || u8[16] || || Unknown
|-
|1183 || Unknown1 || || Unknown, this structure is SHA-1 hashed, to generate a RC4 key to decrypt challenge entries
|-
|1227 || u8[20] || SHA-1 hash A || Hash until here (of the complete format)
|-
|1247 || u8[256] || Signature A || For hash in previous field
|-
|1503 || Unknown1 || || Unknown
|-
|1547 || u8[20] || SHA-1 hash B || Hash until here (of the complete format)
|-
|1567 || u8[64] || Signature B || For hash in previous field (note that this is somewhat shorter than the other signature?!)
|-
! colspan="4" | End of data readable by a stock Xbox drive (1632 Bytes)
|-
|1632 || u8 || Number of security sector ranges || Always 23
|-
|1633 || Security sector range[] || Security sector ranges || Only 16 of which are used.
|-
|1840 || Security sector range[] || Security sector ranges || Only 16 of which are used. ''(Copy from Offset 1633)''
|}

All other fields are assumed to be zero!

===== Decryption of challenge entries =====

Starting at offset 1183, a 44 byte SHA-1 hash is generated.
The first 7 byte of the resulting hash are used as the key in RC4 decryption. The 253 Bytes of the challenge entries (Offset 770) will be decrypted.

There'll only be a handful of valid entries in the challenge entries.
However there'll be at least 2.

=== Dumping ===

To dump Xbox Game Discs you need one of the following drives / firmwares:

{| class="wikitable"
!Drive
!Standard
!Original Firmware download
!Name of modified Firmware for dumping
|-
|{{citation needed}}
|
|
|0800
|-
|Toshiba SD-M2012C
|IDE
|
|Kreon{{citation needed}}
|-
|Samsung SH-D162C
|IDE
|
|SB00 Kreon 0.60 (July 30th 2006) SB00 Kreon 0.80 (September 9th 2006) SB01 Kreon 1.00 (October 9th 2007)
|-
|Toshiba TS-H352C
|IDE
|
|Kreon{{citation needed}} {{FIXME|reason=Same as SH-D162C?}}
|-
|Samsung SH-D162D
|IDE
|[https://web.archive.org/web/20090601193905/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200706281644411972_SH-D162D_SB00.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB00] [https://web.archive.org/web/20090916202345/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200811051941150901_SH-D162D_SB01.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01] SB02{{citation needed}}[http://www.firmwarehq.com/download_995-file_SH-D162D_SB02.exe.html unknown if safe or legit] [https://web.archive.org/web/20090402052613/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191825218171_SH-D162D_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] [https://web.archive.org/web/20120123040117/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200909281412336931_SH-D162D_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]
|SB00 Kreon 1.00 (November 18th 2007)
|-
|Toshiba TS-H352D
|IDE
|
|Kreon{{citation needed}} {{FIXME|reason=Same as SH-D162D?}}
|-
|Samsung SH-D163A
|SATA
|
|Kreon 0.80 (October 17th 2006) SB01 Kreon 1.00 (October 9th 2007)
|-
|Toshiba TS-H353A
|SATA
|[http://web.archive.org/web/20090601191704/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200701031704489471_SH-D163A_SB01.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01]
|Kreon 1.00 (November 18th 2007)
|-
|Samsung SH-D163B
|SATA
|
|Kreon 1.00 (November 18th 2007)
|-
|Toshiba TS-H353B
|SATA
|
|{{citation needed}} {{FIXME|reason=Same as SH-D163B?}}
|}

Please note that the modified firmwares are based on copyrighted material and can therefore not be legally shared here.
Patch files to patch original firmwares into dumping-firmwares would be appreciated.

Flashing software:

* TSDNMAC for MacOS
* [http://web.archive.org/web/20070301000000/http://www.samsungodd.com/KorLib/File/sfdnwin.exe SFDNWIN] for Microsoft Windows 2000 and XP
* TSDNWIN for Microsoft Windows Vista and 7
* Dell SFDNDOS and the newer TSDNDOS for Microsoft DOS

For current dumping instructions see [http://forum.redump.org/topic/6073/xbox-1-360-dumping-instructions/ the Dumping Guide by the Redump Project].

=== Xbox related commands ===

==== Enable Unlock 1 (xtreme) state ====

Supported by: Kreon 1.00
<pre>FF 08 01 01</pre>

Enable Unlock 1 (xtreme) state' as we already know it from the 360 xtreme modded drives.
This command is supported for legacy reasons only. Custom applications should use the new 'Set Lock State' instead.

==== Set Lock State ====

Supported by: Kreon 1.00
<pre>FF 08 01 11 xx</pre>

* <code>xx=00</code> - Drive locked (no unlock state)
* <code>xx=01</code> - Unlock State 1 (xtreme) enabled
* <code>xx=02</code> - Unlock state 2 (wxripper) enabled

==== SS extract command ====

Supported by: Kreon 1.00
<pre>AD 00 FF 02 FD FF FE 00 08 00 xx C0</pre>

This is the well known from the xtreme firmware.

==== Get Feature List ====

Supported by: Kreon 1.00
<pre>FF 08 01 10</pre>

This command will return a list of the additional features supported by the drive.
All values returned are 16 bit values, and the list is terminated with null (<code>0x0000</code>).
The two first words of the returned list always reads as <code>0xA55A 0X5AA5</code> in order to guarantee that a reply from a drive not supporting this command correctly isn't mistaken for a feature list.

An example feature list could be: <code>0xA55A, 0x5AA5, 0x0100, 0xF000, 0xF001, 0x0000</code>

This list would indicate that the drive supports XBOX360 Unlock 1, Lock and Error Skip, as it can be seen from the values defined below:

XBOX 360 related features:

* <code>0x0100</code> : The drive supports the unlock 1 state (xtreme)
* <code>0x0101</code> : The drive supports the unlock 2 state (wxripper)
* <code>0x0120</code> : The drive can read and decrypt the SS
* <code>0x0121</code> : The drive has full challenge response functionality

XBOX related features:

* <code>0x0200</code> : The drive supports the unlock 1 state (xtreme)
* <code>0x0201</code> : The drive supports the unlock 2 state (wxripper)
* <code>0x0220</code> : The drive can read and decrypt the SS
* <code>0x0221</code> : The drive has full challenge response functionality

General drive features:

* <code>0xF000</code> : The drive supports the lock (cancel any unlock state) command
* <code>0xF001</code> : The drive supports error skipping

This is the complete list of defined features at the moment. If you're working on a custom application you might want to contact me in order to get the latest list.

== References and links ==
* [https://web.archive.org/web/20150616131202/http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf]
* [https://multimedia.cx/eggs/xbox-sphinx-protocol/ Overview of the challenge/response security protocol]
* [http://redump.org/discs/system/xbox/ Xbox Game Discs preserved by the Redump Project]
* [http://wiki.redump.org/index.php?title=Discs_not_yet_dumped#Microsoft_Xbox Missing Xbox Game Disc dumps at Redump Project]