xboxdevwiki - User contributions [en]

MCPX

2021-06-28T11:22:10Z

Codeasm: Added Dolby news

The MCPX is the southbridge chip of the Xbox chipset made by Nvidia. It contains the sound processors ([[APU]] and [[ACI]]) as well as the USB, PCI, IDE, etc, controllers [https://web.archive.org/web/20010418214256/http://www.ga-hardware.com:80/preview.cfm?id=NVIDIAMCP], [https://web.archive.org/web/20010410003338/http://www.nvnews.net/previews/mcpx/mcpx.shtml].

Dolby Laboratories anounced in April 2001, The xbox will feature a new "Dolby Interactive Content Encoder" of which the Xbox is the first console to get this.[https://web.archive.org/web/20010419091049/http://www.codejunkies.com:80/Xbox/news.asp?id=9422][https://www.ign.com/articles/2001/04/16/xbox-to-feature-dolby-digital-51-surround-sound-in-games]
== ROM ==

The MCPX is home to the secret [[MCPX ROM]].

== Pin L21: PC Speaker ==

The MCPX has a PC Speaker pin which can be controlled using [https://wiki.osdev.org/PC_Speaker the standard PC Speaker interface].
However, no actual speaker is connected to the pin, so while the signal exists, there will be no audible sound on a stock Xbox.

A speaker can be soldered to this pin in order to make the signal audible [https://www.youtube.com/watch?v=Te4MSskbBEE][https://github.com/0DaveX/beep/]

The original Microsoft code does not drive the PC Speaker at all, so this otherwise unused pin can also be used for inaudible forms of unidirectional communication.

<gallery mode="slideshow">
Image:XboxWithPcSpkr.jpg|'' ''
Image:XboxPcSpkrTrace.jpg|'' ''
Image:XboxPcSpkrSolderPoints.jpg|'' ''
</gallery>

== See Also ==
* [[NForce]]
* [http://siliconpr0n.org/archive/doku.php?id=azonenberg:nvidia:mcpx Die Inspection]

Hardware Revisions

2021-06-28T11:04:32Z

Codeasm: /* THOMSON TGM600 */ Capitals

There were several different retail Xbox hardware revisions, which include the following:

* Xbox 1.0
** USB controller is on a separate [[Motherboard#USB_Daughterboard|PCB]]
** GPU has a fan on the heat sink
* Xbox 1.1
** USB controller moved onto the motherboard
** Fan removed from the GPU heat sink
* Xbox 1.2
** TSOP Size now 256k (Initial Size 1024k)
** Updated Board Layout
** Switched to ATX Power connector
* Xbox 1.3
** Removed LFrame signal from LPC Port
* Xbox 1.4
** Updated Board Layout
** Switched to the "Focus" Video Encoder
* Xbox 1.5
** 3.3v and GND removed from LPC
* Xbox 1.6
** New Board Layout with additional RAM Pads removed
** Removed data and power lines from LPC port
** Xyclops chip (includes ROM instead of flash = BIOS no longer flashable)
** Switched to the "XCalibur" Video Encoder
** Microsoft later switched to lower quality Hynix RAM. These Xboxes with non-Samsung RAM are sometimes referred to as 1.6b by the modding community.

You can find more information about the hardware used in each revision below.

== History of Xbox 1.5 ==

There has been no conclusive evidence pointing to their existence, and all 1.5 sightings to date have turned out to be 1.4 boards.
They possibly never existed{{citation needed}}, but will otherwise be very rare. Production was halted and 1.4 was produced again{{citation needed|reason=Sooo.. do these exist or not?!}}.

== Identifying ==

While not definitive, here are some ways to help identify the revision of your Xbox.

=== Manufacturing Details ===

{| class="wikitable"
! scope="col" | Date Range
! scope="col" | Revision
! scope="col" | Location
|-
| 01/2001–07/2002 || 1.0 || Hungary, Mexico
|-
| 08/2002-01/2003 || 1.1 || China, Mexico
|-
| 01/2003-03/2003 || 1.2 || China
|-
| 04/2003-07/2003 || 1.3 || China
|-
| 09/2003-03/2004 || 1.4,1.5 || China
|-
| 04/2004-09/2004 || 1.6 || China, Taiwan
|-
| 09/2004-08/2005 || 1.6b || China, Taiwan
|}

=== Serial Number ===

The serial number looks like this:

LNNNNNN YWWFF

* L is the production line
* NNNNNN is the number produced that week
* Y is the last digit of the production year
* WW is the number of the week
* FF is the factory code

Note, this table contradicts the previous table.

{| class="wikitable"
! scope="col" | Factory
! scope="col" | Location
! scope="col" | Revision
|-
| 02 || Mexico || 1.0 or 1.1
|-
| 03 || Hungary || 1.0
|-
| 05 || China || 1.1 or later
|-
| 06 || Taiwan || 1.2 or later
|}

{| class="wikitable"
! scope="col" | Serial Number
! scope="col" | Revision
|-
| LNNNNNN 20WFF || 1.0
|-
| LNNNNNN 21WFF || 1.0
|-
| LNNNNNN 23WFF || 1.0 or 1.1
|-
| LNNNNNN 24WFF || 1.1
|-
| LNNNNNN 25WFF || 1.1
|-
| LNNNNNN 30WFF || 1.2
|-
| LNNNNNN 31WFF || 1.3
|-
| LNNNNNN 32WFF || 1.3
|-
| LNNNNNN 33WFF || 1.4 or 1.5
|-
| LNNNNNN 42WFF || 1.6
|-
| LNNNNNN 43WFF || 1.6b
|}

=== DVD Drive ===

There are four retail drives known to be used by Microsoft in the retail version of the console.
Any Xbox DVD drive can be used in any retail Xbox.

List of Xbox DVD Drive manufacturers
* Thomson (Xbox 1.0, 1.1)
* Philips (Xbox 1.1 and above)
* Samsung (Any)
* Hitachi-LG (8050L)(mainly 1.6?)

[[File:Xbox_drivedetermination.png|Xbox DVD Drive determination]]

==== THOMSON TGM600 ====

The first manufacture is sadly also the worst of all Dvdrom drives manufactured for the original Xbox.
It has a Cirrus Logic CL-CR3710-60EC-F as its main controller and a 8/3062 HD 64F3062F25 16bit H8/300H secondary samller MPU,at 25Mhz
Unkown sofar if there is external flash or if its inside the Cirrus Logic IC.

A news article officially announcing Thomson to be producing the DVD drive for the original Xbox back in 20 Juli of 2000[https://web.archive.org/web/20000829085016/http://www.codejunkies.com:80/archive/thomson_supplier_for_xbox.htm]

==== SAMSUNG SDG605 ====

The Samsung drive is a very popular DVDrom drive for its compatibility for most media types and better quality laser. There are 2 mayor revisions found for this manufacturer
* X00603-005 Plays CDR
* X00603-006 Wont play CDR

The DVDrom drive is using the MT1358E (MT1359E is the 360 Sata version) from Mediatek, and has a 39SF020A flashrom.
If the firmware from this drive is applied to a SAMSUNG 616T or 616F PC dvd drive it will behave as a Xbox one, modified hardware will allow for tray state and eject to work.

Commodore4Eva released a hacked firmware for this drive which enables modified backups to work. There is also a "0800" firmware for this drive which allows to dump the entire SS. The firmwares are not linked here for legal reasons.

[https://web.archive.org/web/20060707104502/http://www.samsungodd.com:80/UploadFiles/FW/FWDOWNLOAD/ENG/200212101112342331_SD-616F_F105.ZIP Original firmware for the similar PC drive SD-616F (F105)].

==== PHILIPS VAD6035/21 ====

Also named: VAD6011/21 appears to have no brand or part number on its large main controller, might be Cirrus Logic based on its size and use of a Philips secondary smaller MCU. flash might be a 39SF020A from SST. The laser ribbon cable connector is different for its various revisions, a detail one must take into account when swapping controller boards.

There should be a tutorial on how to convert a PC DVD-ROM drive Pioneer 500M with the Philips firmware to be an Xbox DVD-ROM drive.

==== HITACHI-LG GDR-8050L ====

This DVD-rom drive, most commonly found in Xbox 1.6 and 1.6b is capable of reading DVD-+R, DVD-RW and CDRW media, but fails to boot most CD-R discs source: [http://www.xbox-hq.com/html/article1535.html xbox-hq.com Hitachi-LG GDR-8050L DVD Drive In Xbox].

The latest manufacture for the DVDrom drive probably used a Panasonic MN103S89FDA for its main controler, appears to have no external flashrom.
with this firmware and modified hardware for Eject and traystate, a LG GDR-8163B or LG DRD-8160B might act as a drop in replacement after altering either case.

On 30 January 2006 TheSpecialist posted at xboxhacker.net that he successfully flashed a Hitachi drive to boot a copied game on an unmodded xbox: [https://web.archive.org/web/20080316154615/http://www.xboxhacker.net/index.php?option=com_smf&Itemid=33&topic=285.0 breakthrough: XBOX 1 firmware hacked !]

There is also [https://gist.github.com/JayFoxRox/2d51a8fabe0531897a4bf2903ee14335 an IDC Script and information about the firmware] which was recovered from xboxhacker.net / old forum posts.

=== Hard Drive ===

{| class="wikitable
|-
! Revision
! Drive Manufacturer
! Drive Model Number
! Capacity
|-
| 1.0
| Seagate
| ST310211A
| 10G
|-
| 1.0 (XB:2001-10-26 FF=02)
| Western Digital
| WD80EB-00CGH0
| 8G
|-
| 1.1 (XB:2001-10-29 FF=03)
| Western Digital
| WD80EB-28CGH1
| 8G
|-
| 1.2
| Western Digital
| WD80EB-28DFH2
| 8G
|-
| 1.3+
| Seagate
| ST10014ACE
| 10G
|}

=== Video encoder ===

{| class="wikitable"
! scope="col" | Video Chip
! scope="col" | Revision
|-
| Conexant || 1.0, 1.1, 1.2, 1.3
|-
| Focus || 1.4, 1.5
|-
| Xcalibur || 1.6
|}

=== EEPROM ===

{| class="wikitable"
! Xbox Model
! Manufacturer
! Model
|-
| 1.4 (Others?)
| Catalyst
| CAT24WC02J
|}

=== MCPX Version ===

{| class="wikitable"
! scope="col" | MCPX Version
! scope="col" | Revision
|-
| 1.0 || 1.0
|-
| 1.1 || 1.1 - 1.6
|}

=== BIOS Version ===

{| class="wikitable"
! scope="col" | Kernel Version
! scope="col" | Revision
|-
| 3944, 4034, 4036, 4627 || 1.0
|-
| 4817, 4972 || 1.1
|-
| 5101, 5713 || 1.2 - 1.5
|-
| 5838 || 1.6
|}

== References ==

* [http://www.informit.com/articles/article.aspx?p=367210&seqNum=2 InformIT Methods of Identification]
* [http://www.informit.com/articles/article.aspx?p=367210 InformIT Identifying your Xbox Revision]

Hardware Revisions

2021-06-28T11:03:22Z

Codeasm: /* THOMSON TGM600 */ Xbox news article

There were several different retail Xbox hardware revisions, which include the following:

* Xbox 1.0
** USB controller is on a separate [[Motherboard#USB_Daughterboard|PCB]]
** GPU has a fan on the heat sink
* Xbox 1.1
** USB controller moved onto the motherboard
** Fan removed from the GPU heat sink
* Xbox 1.2
** TSOP Size now 256k (Initial Size 1024k)
** Updated Board Layout
** Switched to ATX Power connector
* Xbox 1.3
** Removed LFrame signal from LPC Port
* Xbox 1.4
** Updated Board Layout
** Switched to the "Focus" Video Encoder
* Xbox 1.5
** 3.3v and GND removed from LPC
* Xbox 1.6
** New Board Layout with additional RAM Pads removed
** Removed data and power lines from LPC port
** Xyclops chip (includes ROM instead of flash = BIOS no longer flashable)
** Switched to the "XCalibur" Video Encoder
** Microsoft later switched to lower quality Hynix RAM. These Xboxes with non-Samsung RAM are sometimes referred to as 1.6b by the modding community.

You can find more information about the hardware used in each revision below.

== History of Xbox 1.5 ==

There has been no conclusive evidence pointing to their existence, and all 1.5 sightings to date have turned out to be 1.4 boards.
They possibly never existed{{citation needed}}, but will otherwise be very rare. Production was halted and 1.4 was produced again{{citation needed|reason=Sooo.. do these exist or not?!}}.

== Identifying ==

While not definitive, here are some ways to help identify the revision of your Xbox.

=== Manufacturing Details ===

{| class="wikitable"
! scope="col" | Date Range
! scope="col" | Revision
! scope="col" | Location
|-
| 01/2001–07/2002 || 1.0 || Hungary, Mexico
|-
| 08/2002-01/2003 || 1.1 || China, Mexico
|-
| 01/2003-03/2003 || 1.2 || China
|-
| 04/2003-07/2003 || 1.3 || China
|-
| 09/2003-03/2004 || 1.4,1.5 || China
|-
| 04/2004-09/2004 || 1.6 || China, Taiwan
|-
| 09/2004-08/2005 || 1.6b || China, Taiwan
|}

=== Serial Number ===

The serial number looks like this:

LNNNNNN YWWFF

* L is the production line
* NNNNNN is the number produced that week
* Y is the last digit of the production year
* WW is the number of the week
* FF is the factory code

Note, this table contradicts the previous table.

{| class="wikitable"
! scope="col" | Factory
! scope="col" | Location
! scope="col" | Revision
|-
| 02 || Mexico || 1.0 or 1.1
|-
| 03 || Hungary || 1.0
|-
| 05 || China || 1.1 or later
|-
| 06 || Taiwan || 1.2 or later
|}

{| class="wikitable"
! scope="col" | Serial Number
! scope="col" | Revision
|-
| LNNNNNN 20WFF || 1.0
|-
| LNNNNNN 21WFF || 1.0
|-
| LNNNNNN 23WFF || 1.0 or 1.1
|-
| LNNNNNN 24WFF || 1.1
|-
| LNNNNNN 25WFF || 1.1
|-
| LNNNNNN 30WFF || 1.2
|-
| LNNNNNN 31WFF || 1.3
|-
| LNNNNNN 32WFF || 1.3
|-
| LNNNNNN 33WFF || 1.4 or 1.5
|-
| LNNNNNN 42WFF || 1.6
|-
| LNNNNNN 43WFF || 1.6b
|}

=== DVD Drive ===

There are four retail drives known to be used by Microsoft in the retail version of the console.
Any Xbox DVD drive can be used in any retail Xbox.

List of Xbox DVD Drive manufacturers
* Thomson (Xbox 1.0, 1.1)
* Philips (Xbox 1.1 and above)
* Samsung (Any)
* Hitachi-LG (8050L)(mainly 1.6?)

[[File:Xbox_drivedetermination.png|Xbox DVD Drive determination]]

==== THOMSON TGM600 ====

The first manufacture is sadly also the worst of all Dvdrom drives manufactured for the original xbox.
It has a Cirrus Logic CL-CR3710-60EC-F as its main controller and a 8/3062 HD 64F3062F25 16bit H8/300H secondary samller MPU,at 25Mhz
Unkown sofar if there is external flash or if its inside the Cirrus Logic IC.

a news article officially anouncing thomson to be producing the DVD drive for the original xbox back in 20 Juli of 2000[https://web.archive.org/web/20000829085016/http://www.codejunkies.com:80/archive/thomson_supplier_for_xbox.htm]

==== SAMSUNG SDG605 ====

The Samsung drive is a very popular DVDrom drive for its compatibility for most media types and better quality laser. There are 2 mayor revisions found for this manufacturer
* X00603-005 Plays CDR
* X00603-006 Wont play CDR

The DVDrom drive is using the MT1358E (MT1359E is the 360 Sata version) from Mediatek, and has a 39SF020A flashrom.
If the firmware from this drive is applied to a SAMSUNG 616T or 616F PC dvd drive it will behave as a Xbox one, modified hardware will allow for tray state and eject to work.

Commodore4Eva released a hacked firmware for this drive which enables modified backups to work. There is also a "0800" firmware for this drive which allows to dump the entire SS. The firmwares are not linked here for legal reasons.

[https://web.archive.org/web/20060707104502/http://www.samsungodd.com:80/UploadFiles/FW/FWDOWNLOAD/ENG/200212101112342331_SD-616F_F105.ZIP Original firmware for the similar PC drive SD-616F (F105)].

==== PHILIPS VAD6035/21 ====

Also named: VAD6011/21 appears to have no brand or part number on its large main controller, might be Cirrus Logic based on its size and use of a Philips secondary smaller MCU. flash might be a 39SF020A from SST. The laser ribbon cable connector is different for its various revisions, a detail one must take into account when swapping controller boards.

There should be a tutorial on how to convert a PC DVD-ROM drive Pioneer 500M with the Philips firmware to be an Xbox DVD-ROM drive.

==== HITACHI-LG GDR-8050L ====

This DVD-rom drive, most commonly found in Xbox 1.6 and 1.6b is capable of reading DVD-+R, DVD-RW and CDRW media, but fails to boot most CD-R discs source: [http://www.xbox-hq.com/html/article1535.html xbox-hq.com Hitachi-LG GDR-8050L DVD Drive In Xbox].

The latest manufacture for the DVDrom drive probably used a Panasonic MN103S89FDA for its main controler, appears to have no external flashrom.
with this firmware and modified hardware for Eject and traystate, a LG GDR-8163B or LG DRD-8160B might act as a drop in replacement after altering either case.

On 30 January 2006 TheSpecialist posted at xboxhacker.net that he successfully flashed a Hitachi drive to boot a copied game on an unmodded xbox: [https://web.archive.org/web/20080316154615/http://www.xboxhacker.net/index.php?option=com_smf&Itemid=33&topic=285.0 breakthrough: XBOX 1 firmware hacked !]

There is also [https://gist.github.com/JayFoxRox/2d51a8fabe0531897a4bf2903ee14335 an IDC Script and information about the firmware] which was recovered from xboxhacker.net / old forum posts.

=== Hard Drive ===

{| class="wikitable
|-
! Revision
! Drive Manufacturer
! Drive Model Number
! Capacity
|-
| 1.0
| Seagate
| ST310211A
| 10G
|-
| 1.0 (XB:2001-10-26 FF=02)
| Western Digital
| WD80EB-00CGH0
| 8G
|-
| 1.1 (XB:2001-10-29 FF=03)
| Western Digital
| WD80EB-28CGH1
| 8G
|-
| 1.2
| Western Digital
| WD80EB-28DFH2
| 8G
|-
| 1.3+
| Seagate
| ST10014ACE
| 10G
|}

=== Video encoder ===

{| class="wikitable"
! scope="col" | Video Chip
! scope="col" | Revision
|-
| Conexant || 1.0, 1.1, 1.2, 1.3
|-
| Focus || 1.4, 1.5
|-
| Xcalibur || 1.6
|}

=== EEPROM ===

{| class="wikitable"
! Xbox Model
! Manufacturer
! Model
|-
| 1.4 (Others?)
| Catalyst
| CAT24WC02J
|}

=== MCPX Version ===

{| class="wikitable"
! scope="col" | MCPX Version
! scope="col" | Revision
|-
| 1.0 || 1.0
|-
| 1.1 || 1.1 - 1.6
|}

=== BIOS Version ===

{| class="wikitable"
! scope="col" | Kernel Version
! scope="col" | Revision
|-
| 3944, 4034, 4036, 4627 || 1.0
|-
| 4817, 4972 || 1.1
|-
| 5101, 5713 || 1.2 - 1.5
|-
| 5838 || 1.6
|}

== References ==

* [http://www.informit.com/articles/article.aspx?p=367210&seqNum=2 InformIT Methods of Identification]
* [http://www.informit.com/articles/article.aspx?p=367210 InformIT Identifying your Xbox Revision]

DVD Emulator

2021-06-28T10:51:47Z

Codeasm: added the manufacturer of the emulator board

The DVD emulator is a feature of [[Development Kits]].
It enables a developer to create and test for DVD remastering.
This means deciding which files to store on the DVD and where on the disk to store them (layout).{{citation needed}}
this is then tested using the DVD emulator software, and hardware for loading speeds and possibly potential faults that could occur.

Its been developed by AMC, Applied Microsystems Corporation for microsoft
[https://web.archive.org/web/20000829084821/http://www.codejunkies.com:80/archive/microsystems_develop_xbox_dvd.htm]
[https://web.archive.org/web/20000815073611/http://www.amc.com/news/press/2000/7-21.html]

The Hardware required for this was a Developement kit, (with the DVD emulation board) some sort of scsi cable, and an XDK-Raptor card.{{citation needed}}
The complete kit, a Raptor PCI Scsi card and Hardisk was numbered: 940-75004 Rev.01
two or more versions of the PCI scsi card are known:
* 700-75307 Rev.01
* 700-75307 Rev 03 [https://assemblergames.com/threads/sealed-xbox-raptor-card-for-xdk-dvd-emu.41763/ Assemblergames](posibly same as rev1?)

The software was bundled with the official xdk software and a (40GB ?{{citation needed}})Hardisk was connected to the Raptorcard where the DVD mastering image was stored on.
This wasn't the fastest way to get an executable to the Xbox for development, and is useless for Homebrew.{{citation needed}}
{{FIXME|reason=Describe the purpose in more detail}}

Picture: [[File:https://i.imgur.com/VNFxuya.jpg]]
Next to serial debugging board: [[File:https://i.imgur.com/OZqxKyH.jpg]]

Super I/O

2021-06-26T22:25:05Z

Codeasm: Finnaly added that image, a Super I/O board from a DVT4

The Super I/O board is a feature of some [[Development Kits]]. The board is build around a SMSC LPC47M157 chip ([https://drive.google.com/uc?export=download&id=0BxOesalXbGtOanoxenlqQUh6Y0k Datasheet]) and interfaces with the Xbox via a ribbon cable connected to the [[LPC Debug Port]].

[[File:SerialIOBoard.jpeg|400px|thumb|right|Super I/O board from a DVT4]]

The board provides the following ports:
* RS232 (used for [[Kernel Debug | Kernel debugging]], not to be confused with [[Xbox Debug Monitor]])

unpopulated ports or functions are:
* PS/2 Mouse port{{citation needed}}
* PS/2 Keyboard port{{citation needed}}
* something MCPX (SMBus?){{citation needed}}
* Temp something (SMBus?){{citation needed}}
* Post code (SMBus?){{citation needed}}
* Flash-ROM / BIOS (like modchips, replaces onboard kernel?){{citation needed}}

== Schematic ==
Its a four layer board, layers 2 and 3 are filled on the entire board, probably ground and power planes.
north, or up in the next tables is up as written the layer numbers and silkscreen common direction.
The folowing main parts are populated on the board:
{| class="wikitable"
!| total
! Labels
! Description
|-
|1
| U1
| SMSC LPC47M157-NC (1996 )
|-
| 0
| U2
| unpopulated DIP24 MCU(?)
|-
|1
| U3
| MAX223EAI (0104, first week 2004?)
|-
|1
|Y2
|CMX-309FB B (14.3181Mhz standard Clock Oscillator )
|-
|1
|J7
|AMP rs232 Male connector
|-
|1
|J9
|16 pins male header (LPC bus)
|-
|5
|R1,R7,R10,R11,R12
|10Kohm smd resistor
|-
|7
|C10,C12,C13,C16,C17,C36,C37
|Bigger, probably NOT all the same caps
|-
|17
|C1,C2,C9,C15,C1?(8?),C21,C22,C23,C24,C25,C26,C28,C31,C32,C33,C34,C35
|Smaller, also, asuming not all the same
|}

The connections in the following tables are checked with the continuity test on a VOM(Multimeter).
but for now here are the listings of wich pin goes where:

=== U3 MAX223EAI [https://datasheets.maximintegrated.com/en/ds/MAX220-MAX249.pdf] ===

{| class="wikitable"
!| Pin
! Name
! Type
! Description
! Termination(s)
! Notes
|-
| 1
| T3OUT
|
|
|
|
|-
| 2
| T1OUT
|
|
|
|
|-
| 3
| T2OUT
|
|
|
|
|-
| 4
| R2IN
|
|
|
|
|-
| 5
| R2OUT
|
|
|
|
|-
| 6
| T2IN
|
|
|
|
|-
| 7
| T1IN
|
|
|
|
|-
| 8
| R1OUT
|
|
|
|
|-
| 9
| R1IN
|
|
|
|
|-
| 10
| GND
|
|
|
|
|-
| 11
| VCC
| Power
| 5V supply voltage
| J9 6
|
|-
| 12
| C1+
|
|
|
|
|-
| 13
| V+
|
|
|
|
|-
| 14
| C1-
|
|
|
|
|-
| 15
| T4OUT
|
|
|
|
|-
| 16
| R3IN
|
|
|
|
|-
| 17
| R3OUT
|
|
|
|
|-
| 18
| SHDN
|
|
|
|
|-
| 19
| EN
|
|
|
|
|-
| 20
| R4IN
|
|
|
|
|-
| 21
| R4OUT
|
|
|
|
|-
| 22
| T4IN
|
|
|
|
|-
| 23
| T3IN
|
|
|
|
|-
| 24
| R5OUT
|
|
|
|
|-
| 25
| R5IN
|
|
|
|
|-
| 26
| V-
|
|
|
|
|-
| 27
| C2-
|
|
|
|
|-
| 28
| C2+
|
|
|
|
|}

=== U1 SMsC LPC ic ===

Still lots to fill out here, but all connections required for kernel debugging via null-modem cable tied to TX/RX/GND have been accounted for.

{| class="wikitable"
!| Pin
! Name
! Type
! Description
! Termination(s)
! Notes
|-
| 6
| CLKI32
| Input
| 32.768kHz trickle clock input
| GND (C17)
| Disabled via GND
|-
| 7
| VSS
| Power
| Ground
| GND (C17)
|
|-
| 18
| VTR
| Power
| 3.3V standby voltage
| C17 bypass to 3.3V
| Connected to VCC because no wakeup functionality is required
|-
| 19
| CLOCKI
| Input
| 14.318MHz clock input
| Y2 3
|
|-
| 20
| LAD0
| I/O
| LPC address/data bus
| J9 11
| Multiplexed command, address and data bus.
|-
| 21
| LAD1
| I/O
| LPC address/data bus
| J9 10
| Multiplexed command, address and data bus.
|-
| 22
| LAD2
| I/O
| LPC address/data bus
| J9 8
| Multiplexed command, address and data bus.
|-
| 23
| LAD3
| I/O
| LPC address/data bus
| J9 7
| Multiplexed command, address and data bus.
|-
| 24
| LFRAME#
| Input
| Frame signal
| J9 3
| Indicates start of a new cycle and termination of broken cycle.
|-
| 26
| PCI_RESET#
| Input
| PCI reset
| J9 5
| Used as LPC interface reset.
|-
| 27
| LPCPD#
| Input
| Power down signal
| R7 (10k) pull-up to 3.3V
| Indicates that it should prepare for power to be shut down on the LPC interface. Tied high relying on PCI_RESET to do its job.
|-
| 29
| PCI_CLK
| Input
| PCI clock
| J9 1
|
|-
| 30
| SER_IRQ
| Output
| Serial interrupt requests
| J9 16
| Provides a serial interrupt request line for mouse/keyboard implementations of the IO board.
|-
| 31
| VSS
| Power
| Ground
| GND
|
|-
| 32
| GP10/J1B1
|
|
| Trace open?
|
|-
| 33
| GP11/J1B2
|
|
| Trace open?
|
|-
| 34
| GP12/J2B1
|
|
| Trace open?
|
|-
| 37
| GP15/J1Y
|
|
| Trace open?
|
|-
| 38
| GP16/J2X
|
|
| Trace open?
|
|-
| 39
| GP17/J2Y
|
|
| Trace open?
|
|-
| 40
| AVSS
| Power
| Analog ground
| GND
|
|-
| 42
| GP21/P16/nDS1
|
|
| Trace open?
|
|-
| 44
| VREF
| Power
| 3.3V reference voltage
| C2 bypass to 3.3V
| 5V or 3.3V used for the game port logic
|-
| 45
| GP24/SYSOPT
|
|
| R1 (10k) pull-down to GND
| Set the configuration base I/O address of 0x2E (R2 would be a pullup to 3.3V with a different configuration address)
|-
| 47
| GP26/MIDI_OUT
|
|
| Trace open?
|
|-
| 49
| GP61/LED2
|
|
| Trace open?
|
|-
| 51
| GP30/FAN_TACH2
|
|
| Trace open?
|
|-
| 53
| VCC
| Power
| 3.3V supply voltage
| C1 bypass to 3.3V
|
|-
| 55
| P33/FAN1
|
|
| Trace open?
|
|-
| 57
| KCLK
|
|
| Trace open?
|
|-
| 59
| MCLK
|
|
| Trace open?
|
|-
| 60
| VSS
| Power
| Ground
| GND
|
|-
| 61
| IRRX2/GP34
|
|
| Trace open?
|
|-
| 65
| VCC
| Power
| 3.3V supply voltage
| C9 bypass to 3.3V
|
|-
| 76
| VSS
| Power
| Ground
| GND (C10)
|
|-
| 84
| RXD1
| Input
|
| U3 8
U2 18
|
|-
| 85
| TXD1
| Output
|
| U3 6
U2 17
|
|-
| 86
| nDSR1
| Input
| Data set ready
| U3 ?
| Optional flow control
|-
| 87
| nRTS1
| Output
| Request to send
| U3 ?
| Optional flow control
|-
| 93
| VCC
| Power
|
| C21 bypass to 3.3V
|
|-
| 95
| RXD2
| Input
|
| Trace open?
|
|-
| 96
| TXD2
| Output
|
| Trace hidden under IC?
|
|-
| 97
| nDSR2
| Input
| Data set ready
| Trace open?
| Optional flow control
|-
| 98
| nRTS2
| Output
| Request to send
| Trace hidden under IC?
| Optional flow control
|-
| 101
| HVSS
| Power
|
| GND
|
|-
| 102
| HVCC
| Power
|
| C24 bypass to 3.3V
|
|-
| 103
| SDA
| I/O
|
| J9 14
|
|-
| 104
| SCLK
| I/O
|
| J9 13
|
|-
| 105
| A0/RESET#
|
|
| R10 (10k) pull-up to 3.3V
|
|-
| 111
| HVCC
| Power
|
| C32 bypass to 3.3V
|
|-
| 112
| HVSS
| Power
|
| GND
|
|-
| 121
| HVCC
| Power
|
| C33 bypass to 3.3V
|
|-
| 122
| HVCC
| Power
|
| C34 bypass to 3.3V
|
|-
| 125
| HVSS
| Power
|
| GND
|
|-
| 126
| HVSS
| Power
|
| GND
|
|-
| 127
| HVSS
| Power
|
| GND
|
|-
| 128
| HVSS
| Power
|
| GND
|
|}

=== J9 LPC header===

NOTE: version 1.3+ motherboards are missing the LFRAME signal which will need to be generated by an external CPLD [https://www.reddit.com/r/originalxbox/comments/7uo3lq/got_an_xbox_for_free_dvd_tray_wont_stop_ejecting/dtmqmn3/]

NOTE: version 1.5 motherboards are missing pins 2 (GND) and 9 (VCC3), and pins 12 (GND) and 15 (VCC3) haven't been confirmed to work correctly{{citation needed}}

{| class="wikitable"
!| Pin
! Name
! Type
! Description
! Termination(s)
! Notes
|-
| 1
| LCLK
| Output
| PCI clock
| U1 29
|
|-
| 2
| VSS
| Power
| System ground
| (see other parts)
|
|-
| 3
| LFRAME#
| Output
| Frame signal
| U1 24
| Indicates start of a new cycle and termination of broken cycle.
|-
| 4
| ---
| ---
| ---
| ---
| Voided to ensure correct ribbon cable alignment.
|-
| 5
| LRST#
| Output
| PCI reset
| U1 26
| Used as LPC interface reset.
|-
| 6
| VCC5
| Power
| 5V power supply
| (see other parts)
| C12(e), C13(S), C15(S), U3 11
|-
| 7
| LAD3
| I/O
| LPC address/data bus
| U1 23
| Multiplexed command, address and data bus.
|-
| 8
| LAD2
| I/O
| LPC address/data bus
| U1 22
| Multiplexed command, address and data bus.
|-
| 9
| VCC3
| Power
| 3.3V power supply
| (see other parts)
|
|-
| 10
| LAD1
| I/O
| LPC address/data bus
| U1 21
| Multiplexed command, address and data bus.
|-
| 11
| LAD0
| I/O
| LPC address/data bus
| U1 20
| Multiplexed command, address and data bus.
|-
| 12
| VSS
| Power
| System ground
| (see other parts)
|
|-
| 13
| SCL
| I/O
| SMBus clock signal
| U1 104
|
|-
| 14
| SDA
| I/O
| SMBus data signal
| U1 103
|
|-
| 15
| VCC3
| Power
| 3.3V power supply
| (see other parts)
| Intended to be used for external IO board
|-
| 16
| L_SER_IRQ
| Input
| Serial interrupt requests
| U1 30
| Provides a serial interrupt request line for mouse/keyboard implementations of the IO board.
|}

== Related links ==

* [https://github.com/espes/xqemu/blob/xbox/hw/xbox/lpc47m157.c Super I/O emulation in XQEMU]
(SMBus?)
* [https://imgur.com/a/ROMYa Images (CC0 License) by Codeasm with detailed shots of the SuperIO board]

File:SerialIOBoard.jpeg

2021-06-26T22:19:24Z

Codeasm: The Super I/O board of a DVT4

The Super I/O board of a DVT4

Exploits

2019-12-11T14:25:36Z

Codeasm: /* Frogger Beyond */ added source for Frogger (disappointingly not much)

== MCPX ==

=== LDT (Hypertransport) bus tap ===

See [http://www.xenatera.com/bunnie/proj/anatak/xboxmod.html#ldt bunnie's adventures hacking the Xbox].

=== Visor hack ===

Exploits incorrect rollover of memory address.

=== MIST hack ===

Exploits error in xcode interpreter security check.
There are at least 2 variations of this hack.

=== A20M# hack ===

[[File:Haxar-a20m.jpg|thumb|200px|A jumper wire hack to enable A20]]

Uses a legacy x86 feature.

=== RC4 attack (MCPX 1.0 only) ===

Microsoft uses the last bytes of the decrypted 2BL to check the integrity of the 2BL.
However, RC4 does not have any feedback which means changes in the 2BL will not reflect in the last couple of bytes which are checked.
As such, the 2BL can be freely modified, as long as the last couple of bytes still match what the MCPX ROM expects.

This can be used to take over the 2BL entry point.

When the attack happens, the MCPX ROM is still visible, making this a very powerful attack.

''This attack is described by Michael Steil in his Google talk.''

=== TEA attack (MCPX 1.1 only) ===

TEA, which is only used in MCPX 1.1, can not be used as a hash in Davies-Meyer mode [http://www.tayloredge.com/reference/Mathematics/VRAndem.pdf][https://www.schneier.com/academic/paperfiles/paper-key-schedule.pdf]. And yet, Microsoft used it that way.

The original attack uses the 5 bytes at 0xffffd400 (FBL entry point) which are <code>E9 83 01 00 00</code>.
This is <code>jmp 0xffffd588</code> (which is a jump within the flash region).

When flipping the highest bit of the operand DWORD (at 0xffffd400, mind your endianess) this will become: <code>E9 83 01 80 00</code>.
This is <code>jmp 0x7fd588</code> (which is a jump into the RAM region).
For the attack to be successful, the highest bit in the DWORD at 0xffffd404 also has to be flipped.

The RAM can be controlled using the x-code command to write to RAM.
So the idea is to copy a program from Flash to RAM using x-codes.
Then the FBL / 2BL is modified to jump into said RAM region by flipping a bit of a jump operand (as described above).
The 2 bit flips will not change the hash of FBL / 2BL as TEA is broken.

As such, the FBL verification will succeed, the MCPX ROM will hand control to the FBL which will then jump into the attacker controlled RAM.

When the attack happens, the MCPX ROM is still visible, making this a very powerful attack.

''The TEA algorithm and exploit are also described in more detail in Bunnnies book (Page 109 and Page 142).''

== Dashboard ==

=== Audio hacks ===
=== Font hacks ===

[http://archiv.sega-dc.de/phoenix.maxconsole.net/docs/berternie.inc.htm Analysis of "Bert & Ernie" font-exploit].

==== Easter-egg exploit ====

== Savegames ==
Savedgames can be used as an exploit method, but care must be taken for most games are verifying digital signatures of savedgames {{citation needed}} [http://bunniefoo.com/nostarch/HackingTheXbox_Free.pdf]
=== [[007: Agent Under Fire]] ===
=== [[Frogger Beyond]] ===
Not much is known why this game was in the list, [https://events.ccc.de/congress/2005/fahrplan/attachments/674-slides_xbox.pdf 22C3, page 85]
The game isnt shown in the final presentation at 22C3 (neither are Mechassault nor SplinterCell).

=== [[MechAssault]] ===
=== [[Tom Clancy's Splinter Cell]] ===
=== [[Tony Hawk's Pro Skater 4]] ===
Grimdoomer discovered a savegame exploit in THPS4, shared it on Discord and was later included with the Rocky5 softmod installer.
[https://drive.google.com/file/d/0B9WVULxHOmNkQVBCMHMtVGhqVVU/view a video demonstrating the game trigger (custom skatepark)]

''10-4-2017 it's just shell code I injected into the game save/ granted this save is slightly more complicated than the others and requires a small "loader" that is just a memcpy basically it's literally as simple as a buffer overflow...I just looked for null terminated strings and fuzzed them then when I got a crash I looked in teh xbe to figure out what was going on. yeah it's literally just a stack overflow'' - grimdoomer

another website talking about his exploit.
[https://www.xbmc4xbox.org.uk/forum/viewtopic.php?t=7310 xbmc4xbox.org.uk]

== Attack ideas ==

{| class="wikitable"
! Purpose || Author || Description || Status
|-
|Xbox DVD Movie Playback Kit Dongle ROM manipulation || Xbox-Linux wiki
|As the dashboard presumably downloads the code from the ROM into the memory of the Xbox, this could be a hardware hack requiring no hardware modifications. The XBE loader for the DVD image is different from the usual XBE loader. However, the XBE is still signed and checked for security.
| XBE loader seems to be secured, although no full analysis has been done.
|-
| Preserving memory across boot || JayFoxRox
| Confirm behaviour described in the coldboot paper (https://jhalderm.com/pub/papers/coldboot-cacm09.pdf). This can be used to transfer code / setups for other exploits across a boot (such as preparing memory for A20 attack).
| Success: We have marked memory and rebooted the Xbox (through SMC warm and cold, and manual reboot using power switch). At room temperature, and the Xbox pre-heated, hundreds of markers can still be found after 10 seconds. Within the first 5 seconds, no loss of data was measured at all (although not many bits have been marked to begin with). We have confirmed the memory persistence not only for the main RAM, but also MCPX APU DSP memory banks. Other memory or register banks were not tested yet.
|-
| Early boot control || JayFoxRox
| Xcodes allow writing PCI config space. This can be used to set PCI BARs to random page-aligned addresses. Some devices like the NV2A or MCPX APU contain large register banks which can be read and written like RAM. So effectively we can probably overlay the flash memory or MCPX ROM with a temporary PCI mapping. To fill the memory, the PCI device can be mapped to a lower region, and be filled through Xcode memory writes.
This can be used to take control over code contained in RAM (FBL / 2BL), flash or possibly even the MCPX ROM during boot. This attack could be used to avoid unmapping the MCPX ROM and is therefore quite powerful. However, it requires knowledge of the Xcodes.
| This has not been tested during real-mode or early boot yet, but is assumed to work. It was tested from protected mode by mapping USB1 over the Flash and MCPX ROM region (main RAM has not been tested yet). Mapping the overlay pages without caching resulted in crashes. However, the PD was not reviewed at the time and might have been broken (through unconventional use of MmMapIoSpace).
|-
| Dumping the MCPX ROM || JayFoxRox
| Trying to find problems with the SMC reset chain:
* Map PCI devices over the MCPX ROM region
* Schedule a reset
* Keep reading MCPX ROM memory with CPU to persistent page
* If we are lucky, the CPU would now copies the MCPX ROM to RAM in it's last cycles with a broken LDT (this depends on how LDTs work and if they can recover)
| Failed: I've tried reading MCPX ROM memory for as long as possible using the CPU. I've tried resets using PM26 (assumed PWRBTN), SMC Soft (0x01) and SMC Hard (0x40).
Memory was read based on observing value changes (in PCI regions, signalling reset), and timing alone (X cycles after starting reset).
The MCPX ROM region access always crashed. Shadowing the MCPX ROM with a PCI device does not help: The CPU never observed the PCI devices being remapped / lost.
As MCPX and CPU are both reset by the SMC directly, this is not surprising.
|-
| Dumping the MCPX ROM || JayFoxRox
| Trying to find problems with the SMC reset chain:
* Map PCI devices over the MCPX ROM region
* Check if NV2A can access the mapped PCI device
* Configure NV2A to continously stream from MCPX ROM region to RAM - Reset system using SMC (idea: this resets the PCI device mappings in the MCPX and should re-enable the MCPX ROM)
* If we are lucky, the NV2A would now stream the MCPX ROM to RAM in it's last cycles with a broken LDT (this depends on how LDTs work and if they can recover)
| Concept only: No interest in experimenting with NV2A DMA.
|-
| Dumping the MCPX ROM || JayFoxRox
| Trying to find problems with the SMC reset chain: On a warm boot, the x86 might do a bad boot (the following is a theory, someone please measure pins). Theroy: PWRGD is provided, but CPURST is still high from the previous run; CPURST might only go low once NV2A reboots:
* Map device in NV2A to MCPX ROM region (note: mapping MCPX device would not work, because that gets reset with PWRGD)
* Warm reset using SMC
* Code in NV2A device should now jump to lower memory and unmap the MCPX ROM region (by moving itself for example)
* Delay by X cycles [probably in the range from 1ns to idk.. 500ms] to avoid reading the MCPX ROM before MCPX reset
* Code in lower region should copy MCPX ROM region to persisting pages
| Concept only: Someone should measure the pins and possibly look into the memory signals. This is too time consuming for me.
|-
| Unknown || JayFoxRox
| Partial system reset using 0xCF9 I/O register
| Resetting through 0xCF9 lands us on a black screen and the LED flashes as if the DVD tray was being opened. It's currently assumed that 0xCF9 only resets peripherals and NV2A / CPU, but it does not seem to reset the MCPX itself (hence issues booting and PCI activity which causes LED to flash). This has not been tested yet. An idea to confirm this, might be to map a device at 0xFFFFFFF0 which places an x86 jump to a good memory page. If the MCPX really isn't reset, then the CPU would boot from the MMIO / known page.
|-
| Dumping the MCPX ROM || JayFoxRox
| Trying to find problems with the SMC reset chain. The SMC takes a couple of milliseconds to reset the system. Parts of the peripherals might stay alive for long enough. So chances (extremly unlikely) are, the peripherals could be programmed to do DMA where the DMA is only executed after the reboot.
| Failed: An attempt was made to use the APU GP DSP DMA to continuously store x86 code where 2BL would unpack. The system was then reset using the SMC. It booted normally. It is assumed that the DMA is probably long dead by the time that the 2BL is being unpacked / ran.
|-
| Unknown || JayFoxRox
| Resetting from wrong address. The errata for the CPU states that a warm-reset might occur from the wrong address.
| Concept only: Needs more research
|-
| Dumping the MCPX ROM || JayFoxRox
| Trying to access MCPX ROM through peripherals in the southbridge. If the address logic is broken, parts like the OHCI, APU or AC97 might be able to access it still.
|
* AC97: Lots of crashes / hangs. Sometimes crackling noise. Sometimes does not crash. Also can access some non-existing memory regions without any crashes. Data read from invalid addresses seemed to be 300 Hz square wave. While crashing the hardware output will have exponential falloff (measured on PCM line-out).
* APU: Mapping GP DSP Scratch memory from 0x00000000 to 0x7FFFFFFF reveals mirrors of physical RAM. Setting the highest bit (addresses over 0x80000000) will result in a crash of the Xbox.
* OHCI: Untested
* Others: Untested
|-
| Dumping Kernel INIT || JayFoxRox
| INIT is free'd right before passing execution to the first XBE. Depending on what the XBE allocates, the INIT section might still be in memory when a dumper is run.
| Probably doesn't work. Would need the dumper to directly run after cold-boot. Softmods unfortunately reboot the Xbox and during this warm-boot the INIT section is (in at least most cases) lost.
|-
| Dumping Kernel INIT || DaveX || An extension to JayFoxRox dumping idea. Instead of running a dumper-XBE through a softmod, the softmod itself could do the dumping. This means creation of a custom softmod, just for dumping. This depends on the used softmod entry-point (font-exploit (signed target xbe), audio-exploit, ..) to gain execution as early as possible. This strategy might be slightly risky as harddisk contents have to be modified for the temporary softmod.
| WIP as of 2018-09-12
|-
| rowspan="13" | Homebrew entry point || rowspan="13" | Community
| rowspan="13" | Some movie DVDs contain default XBEs signed to run on original Xbox from DVD-R{{FIXME|reason=Add region / product codes and other DVDs you know of}}. If we can find an exploit in one of them (loaded files), we could possibly take over the entire system and run homebrew from DVD-R.
|-
|'''Star Wars: Clone Wars - Volume Two'''
[[Battlefront II]]

Untested
|-
|'''Star Wars: Episode III - Revenge of the Sith (Widescreen Edition)'''
[[Battlefront II]]

Untested
|-
|'''Star Wars Trilogy (Widescreen Edition with Bonus Disc)'''
[[Battlefront]]

Untested
|-
|'''Star Wars Trilogy DVD with Demo'''
[[Lego Star Wars 2]]

Untested
|-
|'''Star Wars: Clone Wars - Volume One'''
[[Battlefront]]

Untested
|-
|'''The Chronicles of Riddick (Widescreen Unrated Director's Cut)'''
[[Chronicles of Riddick]]

Untested
|-
|'''Doom (Unrated Widescreen Edition)'''
[[Doom 3]]

Untested
|-
|'''Hulk (Special Edition)'''
[[Hulk]]

Untested
|-
|'''King Arthur - The Director's Cut (Widescreen Edition)'''
[[King Arthur]]

Untested
|-
|'''Robots (Widescreen Edition)'''
[[Robots]]

Untested
|-
|'''Van Helsing (Widescreen Edition)'''
[[Van Helsing]]

Untested
|-
|'''Clone Wars Volume 1'''
[[Republic Commando]]

Untested
|}

== Notes ==

* [https://events.ccc.de/congress/2005/fahrplan/attachments/591-paper_xbox.pdf 17 Mistakes Microsoft Made in the Xbox Security System]
* [http://toogam.bespin.org/xboxmod/site/xbehacks.htm A list of some exploit implementations]

Hardware Revisions

2019-07-31T15:03:40Z

Codeasm: /* DVD Drive */ added controller information

There were several different retail Xbox hardware revisions, which include the following:

* Xbox 1.0
** USB controller is on a separate PCB
** GPU has a fan on the heat sink
* Xbox 1.1
** USB controller moved onto the motherboard
** Fan removed from the GPU heat sink
* Xbox 1.2
** TSOP Size now 256k (Initial Size 1024k)
** Updated Board Layout
** Switched to ATX Power connector
* Xbox 1.3
** Removed LFrame signal from LPC Port
* Xbox 1.4
** Updated Board Layout
** Switched to the "Focus" Video Encoder
* Xbox 1.5
** 3.3v and GND removed from LPC
* Xbox 1.6
** New Board Layout with additional RAM Pads removed
** Removed data and power lines from LPC port
** Xyclops chip (includes ROM instead of flash = BIOS no longer flashable)
** Switched to the "XCalibur" Video Encoder
** Microsoft later switched to lower quality Hynix RAM. These Xboxes with non-Samsung RAM are sometimes referred to as 1.6b by the modding community.

You can find more information about the hardware used in each revision below.

== History of Xbox 1.5 ==

Possibly never existed{{citation needed}}, but will otherwise be very rare. Production was halted and 1.4 was produced again{{citation needed|reason=Sooo.. do these exist or not?!}}.

== Identifying ==

While not definitive, here are some ways to help identify the revision of your Xbox.

=== Manufacturing Details ===

{| class="wikitable"
! scope="col" | Date Range
! scope="col" | Revision
! scope="col" | Location
|-
| 01/2001–07/2002 || 1.0 || Hungary, Mexico
|-
| 08/2002-01/2003 || 1.1 || China, Mexico
|-
| 01/2003-03/2003 || 1.2 || China
|-
| 04/2003-07/2003 || 1.3 || China
|-
| 09/2003-03/2004 || 1.4,1.5 || China
|-
| 04/2004-09/2004 || 1.6 || China, Taiwan
|-
| 09/2004-08/2005 || 1.6b || China, Taiwan
|}

=== Serial Number ===

The serial number looks like this:

LNNNNNN YWWFF

* L is the production line
* NNNNNN is the number produced that week
* Y is the last digit of the production year
* WW is the number of the week
* FF is the factory code

Note, this table contradicts the previous table.

{| class="wikitable"
! scope="col" | Factory
! scope="col" | Location
! scope="col" | Revision
|-
| 02 || Mexico || 1.0 or 1.1
|-
| 03 || Hungary || 1.0
|-
| 05 || China || 1.1 or later
|-
| 06 || Taiwan || 1.2 or later
|}

{| class="wikitable"
! scope="col" | Serial Number
! scope="col" | Revision
|-
| LNNNNNN 20WFF || 1.0
|-
| LNNNNNN 21WFF || 1.0
|-
| LNNNNNN 23WFF || 1.0 or 1.1
|-
| LNNNNNN 24WFF || 1.1
|-
| LNNNNNN 25WFF || 1.1
|-
| LNNNNNN 30WFF || 1.2
|-
| LNNNNNN 31WFF || 1.3
|-
| LNNNNNN 32WFF || 1.3
|-
| LNNNNNN 33WFF || 1.4 or 1.5
|-
| LNNNNNN 42WFF || 1.6
|-
| LNNNNNN 43WFF || 1.6b
|}

=== DVD Drive ===

There are four retail drives known to be used by Microsoft in the retail version of the console.
Any Xbox DVD drive can be used in any retail Xbox.

List of Xbox DVD Drive manufacturers
* Thomson (Xbox 1.0, 1.1)
* Philips (Xbox 1.1 and above)
* Samsung (Any)
* Hitachi-LG (8050L)(mainly 1.6?)

[[File:Xbox_drivedetermination.png|Xbox DVD Drive determination]]

==== THOMPSON TGM600 ====

The first manufacture is sadly also the worst of all Dvdrom drives manufactured for the original xbox.
It has a Cirrus Logic CL-CR3710-60EC-F as its main controller and a 8/3062 HD 64F3062F25 16bit H8/300H secondary samller MPU,at 25Mhz
Unkown sofar if there is external flash or if its inside the Cirrus Logic IC.

==== SAMSUNG SDG605 ====

The Samsung drive is a very popular DVDrom drive for its compatibility for most media types and better quality laser. There are 2 mayor revisions found for this manufacturer
* X00603-005 Plays CDR
* X00603-006 Wont play CDR

The DVDrom drive is using the MT1358E (MT1359E is the 360 Sata version) from Mediatek, and has a 39SF020A flashrom.
If the firmware from this drive is applied to a SAMSUNG 616T or 616F PC dvd drive it will behave as a Xbox one, modified hardware will allow for tray state and eject to work.

==== PHILLIPS VAD6053 ====

Also named: VAD6011/21 apear to have no brand or partnumber on its large main controller,might be Cirrus Logic based on its size and use of a Philips secondary smaller mcu. flash might be a 39SF020A from SST. The laser ribbon cable connector is different for its various revisions, a detail one must take into account when swapping controller boards.

There should be a tutorial on how to convert a PC dvdrom drive Pioneer 500M with the Philips firmware to be a Xbox dvdrom drive.

==== HITACHI GDR-8050L ====

The latest manufacture for the DVDrom drive probably used a Panasonic MN103S89FDA for its main controler, appears to have no external flashrom.
with this firmware and modified hardware for Eject and traystate, a LG GDR-8163B or LG DRD-8160B might act as a drop in replacement after altering either case.

===Hitachi-LG GDR-8050L ===
This DVD-rom drive, most commonly found in Xbox 1.6 and 1.6b is capable of reading DVD-+R, DVD-RW and CDRW media, but fails to boot most CD-R discs source: [http://www.xbox-hq.com/html/article1535.html xbox-hq.com Hitachi-LG GDR-8050L DVD Drive In Xbox].

on 30 January 2006 TheSpecialist posted at Xboxhacker.net that he successfully flashed a Hitachi drive to boot a copied game on an unmodded xbox: [https://web.archive.org/web/20080316154615/http://www.xboxhacker.net/index.php?option=com_smf&Itemid=33&topic=285.0 breakthrough: XBOX 1 firmware hacked !]

=== Hard Drive ===

{| class="wikitable
|-
! Revision
! Drive Manufacturer
! Drive Model Number
! Capacity
|-
| 1.0
| Seagate
| ST310211A
| 10G
|-
| 1.0 (XB:2001-10-26 FF=02)
| Western Digital
| WD80EB-00CGH0
| 8G
|-
| 1.1 (XB:2001-10-29 FF=03)
| Western Digital
| WD80EB-28CGH1
| 8G
|-
| 1.2
| Western Digital
| WD80EB-28DFH2
| 8G
|-
| 1.3+
| Seagate
| ST10014ACE
| 10G
|}

=== Video encoder ===

{| class="wikitable"
! scope="col" | Video Chip
! scope="col" | Revision
|-
| Conexant || 1.0, 1.1, 1.2, 1.3
|-
| Focus || 1.4, 1.5
|-
| Xcalibur || 1.6
|}

=== EEPROM ===

{| class="wikitable"
! Xbox Model
! Manufacturer
! Model
|-
| 1.4 (Others?)
| Catalyst
| CAT24WC02J
|}

=== MCPX Version ===

{| class="wikitable"
! scope="col" | MCPX Version
! scope="col" | Revision
|-
| 1.0 || 1.0
|-
| 1.1 || 1.1 - 1.6
|}

=== BIOS Version ===

{| class="wikitable"
! scope="col" | Kernel Version
! scope="col" | Revision
|-
| 3944, 4034, 4036, 4627 || 1.0
|-
| 4817, 4972 || 1.1
|-
| 5101, 5713 || 1.2 - 1.5
|-
| 5838 || 1.6
|}

== References ==

* [http://www.informit.com/articles/article.aspx?p=367210&seqNum=2 InformIT Methods of Identification]
* [http://www.informit.com/articles/article.aspx?p=367210 InformIT Identifying your Xbox Revision]

Video Encoder

2019-07-18T16:03:08Z

Codeasm: /* Xcalibur */ the rom is on the LPC bus

The '''video encoder''' is a chip that converts a digital pixel data stream (coming from the nVidia NV2A graphics processor) into analog video signal, just like a [http://en.wikipedia.org/wiki/RAMDAC RAMDAC] would. An ordinary RAMDAC, however, can only output VGA-style RGB signal. The video encoder used in the Xbox is more flexible, and can generate several different types of signals that adhere to various video standards and color formats. These include, but are not necessarily limited to:

* VGA-style >31 kHz RGB, though only with Sync-on-Green sync signals. (If needed, separate HSYNC and VSYNC signals can be obtained from the motherboard, or by building a special video cable with active electronics for stripping and separating the Sync-on-Green sync signal. In any case, separate HSYNC and VSYNC are not available directly through the AV connector.)
* TV-compatible 15 kHz RGB (with composite sync) – suitable for European-style SCART RGB output (are progressive 625/50 signals supported?)
* Component (Y'PbPr) signal, both in SDTV and HDTV resolutions; suitable for American-style "component" output
* PAL color signal with typical PAL timings (including PAL60), in both composite (CVBS) and s-video (Y/C) formats
* SECAM color signal with typical SECAM timings, in both composite (CVBS) and s-video (Y/C) formats
* NTSC color signal with typical NTSC timings, in both composite (CVBS) and s-video (Y/C) formats
* Black and white composite video signal without a color carrier

The video encoder is also capable of PALplus style Line 23 Wide Screen Signalling (WSS), and the Xbox PIC is rigged with the capability of controlling Scart pin 8 (the ''function switching pin'', which is used as an alternative method of Wide Screen Signalling) and pin 16 (the ''fast switching pin''.)

The make and model of the video encoder has varied through the years – three different video encoders have been used thus far. All three are very similar in their features; they support various modes and are flexible enough to be able to output a VGA compatible signal (which is not supported by the Xbox kernel). They are, however, not register-compatible.

Two of the video encoders (Conexant CX25871 and Focus FS454) also have extensive scaling and filtering functionality, which allows for [http://scanline.ca/overscan/ overscan compensation] in desktop-style "TV out" usage. This means that the GPU can output ordinary VGA resolutions with VGA timings and the video encoder can convert them to SDTV resolutions with TV-style timings on the fly, adding borders around the image so that a projection of the VGA framebuffer image falls within the "safe area" of the video signal. The capabilities of the Xcalibur chip, however, remain a mystery in this regard: it is not known whether it has a scaler.

All video encoders are connected to (and controlled via) the [[SMBus]].

=== Conexant CX25871 ===

The [http://www.alldatasheet.com/datasheet-pdf/pdf/153349/CONEXANT/CX25871.html Conexant CX25871] is a close relative of the Brooktree BT868/BT869. There is also a sister model (CX25870) without the Macrovision capability. This chip was used in Xbox versions 1.0 through 1.3.

=== Focus FS454 ===

The [https://www.manualslib.com/products/Focus-Fs454-211664.html Focus FS454] was used in v1.4 (and possibly v1.5) Xboxes. There is also a sister model (FS453) without the Macrovision capability.

=== Xcalibur ===

The Xcalibur video encoder is a custom chip manufactured for Microsoft. It was first used in Xbox hardware revision 1.6. Unfortunately, there is no official programming documentation available for this chip. It seems the only way to find out more is through reverse-engineering techniques.

Xboxes that contain the Xcalibur encoder have the firmware ROM and the PIC physically integrated into another custom chip, named Xyclops.
the ROM is put on the LPC bus [[https://web.archive.org/web/20180401042955/http://www.eurasia.nu/wiki/index.php/XboxXyclopsEventLog]]

DVD Emulator

2018-09-03T17:26:39Z

Codeasm: /* Resources */ changed to working link.

The DVD emulator is a feature of [[Development Kits]].
It enables a developer to create and test for DVD remastering.
This means deciding witch files to store on the DVD and where on the disk to store them (layout).{{citation needed}}
this is then tested using the DVD emulator software, and hardware for loading speeds and posibly potencial faults that could occur.

The Hardware required for this where a Developement kit (with the DVD emulation board) a sort of scsi cable and a XDK-Raptor card.{{citation needed}}
The complete kit, a Raptor PCI Scsi card and Hardisk was numbered: 940-75004 Rev.01
two or more versions of the PCI scsi card are known:
* 700-75307 Rev.01
* 700-75307 Rev 03 [https://assemblergames.com/threads/sealed-xbox-raptor-card-for-xdk-dvd-emu.41763/ Assemblergames](posibly same as rev1?)

The software was bundled with the official xdk software and a (40GB ?{{citation needed}})Hardisk was connected to the Raptorcard where the DVD mastering image was stored on.
For development it wasnt the fastest way to get an executable to the xbox, and for homebrew its pretty useless.{{citation needed}}
{{FIXME|reason=Describe the purpose in more detail}}

[http://codeasm.com/xbox/images/dvt4/SL734877.JPG Picture]{{FIXME|reason=Contact codeasm about more pics / without watermarks}}

== Resources ==
* [https://imgur.com/a/ROMYa Images (CC0 License) by Codeasm with detailed shots of the DVD emulation board and serial board]

Development Kits

2018-07-04T20:07:02Z

Codeasm: Added details that people suggested based on undisclosed sources

There are a few hardware diferences and software diferences between development kits, but generaly the following hardware is known to be exist:
* Alpha I and II kits
* DVT3 Development Kits
* DVT4 Development Kits
* Debug kits

Further more are diferences internaly from diferent MCP revisions, GPU revisions and board layouts. Sega Chihiro boards seem to be based on DVT4 Development/Debug kits. either using overproduction or on purpose produced MCPX-X2 as found in the developement kits and debugkits.

Some rare boards are found with diferent MCPX chips that also have a special port near the CPU, and a extra USB port on the backside of the board (connected to the MCPX to unkown port) its been rumoured that the blocked USB port (unblocked on DVT3) on the back of Developement kits where either a leftover of these extra usb port or used for JVS development and/or testing.

== Alpha ==
{{FIXME| needs checking with real ALpha 1 and 2}}
Contructed using "off the shelf" hardware, probably before retail release from Intel.
The alpha hardware allowed kernel debuging to be done over one of the rs232 ports and standard WinDBG software can make these messages and control work.
This allows of carefull debugging of the running kernel and diagnose occuring faults or errors. At early boot of the recovery software an network ip adress is attempted to setup probbaly for another way of diagnosing and remote control using the availeble software like later xdk software.

The Alpha is build with the following parts or software:
=== Alpha I ===
* Intel VC820, running a prerelease Bios
* 128Mb RDRAM with an terminator
* 600Mhz CPU
* Nvidia Geforce 2 GTS 64MB
* An xircom PCPGI2(OPTI 82C861) 2 USB port PCI card
* Intel 82559(ic) Network card {{FIXME}}
* Hard drive is a WD205AA (20.5 Gb) or fujitsu MPF3204AT (20.4 Gb)
* ATNG 250w or a 300w powersupply

These where then programmed by use of a recovery disk that "recovered" the system.
The case is a customized globalwin ycc-802. (color silver and an added jewel)

=== Apha II ===
The Alpha II was a upgrade kit or constructed the same as a Alpha I with the following upgrades:
* 733MHz CPU SL3XN
* Nvidia Geforce3 NV20 (64MB ram) with a Preretail firmware (180-p0050-0000-a09)

An supplied Recovery made the nececairy firmware upgrades{{citation needed}} and updated the dashboard.

=== Franken Alpha ===
This is a listing of notes on how to make a Alpha I or II yourself, also known as a FrankenAlpha/

Same hardware as a Alpha I/II, but you dont seem to need the preretail firmwares or bioses.
Also, any Geforce3 is rumoured to work, as long as the GPU is of the NV20 series. The AV out suboard isnt nececairy, as VGA seems to work fine. color or diferent kinds of fans, cooling blocks or OEM vendor names doesnt seem to matter.
The Opti usb board can be green, yellow or black. as long as the IC sports the 82C861 wording.
if the VC820 sports any USB or Sound, it will not be used, the listed hardware boards are used instead, regardless of other hardware. (drivers arent in the kernel).

==== Posible solutions on fixing a (franken) alpha(2) ====
While fixing a frankenalpha, the following kernel errors occured while on purpose incorrectly installed or configured the computer.
These results may vary with official parts, configs, bios or firmware. Or due to diferences in hardware.
these are results from recovery 3521 as earlier ones did not work on the Alpha under test.

;IDEX hard disk not configured (status=51).
:HDD too small
;IDEX hard disk not configured (status=ff).
:HDD on the wrong bus, put on primairy channel.(maybe wrong place on the cable itself) maybe add a jumper for master select?
;IDEX hard disk not found (status=7f).
:HDD not connected (or dead)
;MP No video output because you are using an older video card.
:Well, insert a Geforce3 card (NV20 based)
;WRN[XNET] EnetInitialize failed 0x801f0001
:Logo loads, with a halt when the sparkly bit is on the B of Xbox. The network card is missing, insert a GD82559 based intel network card FCC: EJMNPDALBANY (worked for me)
;[XNET] NicExecuteActionCmdAndWait failed!WRN[XNET] EnetInitialize failed 0x801f0001
:Network on wrong pci lane or no screen connected (VGA or S-video)
* Tested Slot 1 as good (real close to the GPU, would not recommend)
* Tested Slot 2 as not good
* Tested Slot 3 as not good (*** Assertion failed: hwres.ResourceData.Address[0].Type == CmResourceTypeMemory
* Tested Slot 4 as good
* Tested Slot 5 as not good

These might be wrong for official alphas or only for the particular motherboard that was under test.

== Debug ==
Shaped and main parts consist of retail hardware with the following differences:
* 128MB ram instead of default 64MB ram
* MCPX revision X2, thus capable of running only Debug signed code{{FIXME|reason= can it still run retail code?}}
* Hardisks loaded with retail and Debug shell files

== DVT3/DVT4 ==
Harddisk is said to be locked by default with a 16size byte 0x00 key, but allowing to run with an unlocked harddrive of any size(larger then 20GB{{citation needed}} for minimal OS).DVT3 seems to have the back USB port to be uncovered and a slightly more glossy or shinier jewel on the top of the case. According to some sources, the DVT3 cannot be updated to further kernels/dashboards than 3911, the lowest/oldest being 3823.1(Borman said this?){{citation needed}}

All functions a debug with the addition of:
* [[DVD_Emulator | DVD emulation]]
* [[Kernel Debugging | Kernel_Debug]] over a dedicated [[Super_I/O | IO board ]]

Network

2018-05-03T19:39:55Z

Codeasm: /* References and links */ fcc entry for Xbox MN-740 Wireless Adapter

The Xbox contains an Ethernet module and one RJ45 connector. Additionally, separate modem and wireless accessories were considered when developing the console. Eventualy an official wireless adapter was released based of a "D-Link 108AG Gaming Adapter" in the end of 2003.

The Xbox has a TCP/IP protocol stack complete with a DNS PPTP, DHCP clients.

Port 3074 UDP/TCP is reserved for Xbox communications.

== Hardware ==

Integrated in the Nvidia Southbridge MCPX chip which is similar to the nForce chips. The Xbox Linux team used the binary drivers from Nvidia.

=== Wireless adapter ===

based on the "D-Link 108AG Gaming Adapter", the Xbox MN-740 Wireless Bridge bundled with a Xbox install disk (wich would update the dashboard if nececairy).

==== hardware ====

* AR5312 CPU (MIPS 4Kc core?{{citation needed}})
* AR5212 RoC (Radio on Chip){{citation needed}} for 2.4 Ghz 802.11b/g{{citation needed}}.
* KS8721B physical layer transciever
* some Eeprom wich hold the MAC adress (based of FCC pictures and Firmware analysis){{citation needed}}
* IC42S16400 8Mb ram
* SST39LF0?0A (1 or 2 Mb) (the FCC picture is unclear on the size part due to writing) {{citation needed}}

The onboard 3 leds are: Power, Wireless and Xbox(called Ethernet on the PCB).
The board seems to have Jtag and what apears to be Serial testpins exposed.

==== Firmware ====
The shipped firmware does not support WPA or WPA2.
A "firmware" hack based on the D-Link firmware adds WPA support, rendering Dashboard support unfunctional and changing settings require connecting to the LAN port using a PC (or webbrowser capable application).
This wireless bridge runs a closed source version of the"ThreadX JADE/Green Hills Version G4.0.4.0" RTOS.
The firmware contains a copyright string of: "Copyright (c) Microsoft Corporation All Rights Reserved Device is Xbox Compatible"

latest firmware is seperated by a boot and runtime firmware {{citation needed}} :
* MN740_01.03.00.0005_BOOT.bin, "Xbox Wireless Adapter (MN-740) boot firmware"
* MN740_01.00.02.0022_RUNTIME.bin, "Xbox Wireless Adapter (MN-740) runtime firmware"

== System Link ==

{| class="wikitable"
|+XNet* Functions
|-
! function
! description
|-
|XNetCreateKey(&xnkid, &xnkey)
|
|-
|XNetRegisterKey(&xnkid, &xnkey)
|Register the session key
|-
|XNetXnAddrToInAddr( pxnaddr, pxnkid, &pseudoIP )
|Convert the address to a winsock usable format
|-
|XNetUnregisterKey( &xbc.SessionID )
|
|-
|XNetGetTitleXnAddr( &hostAddr )
|Gets your XNADDR. Used by syslink, and lots of other people.
|-
|XNetGetEthernetLinkStatus()
|
|-
|
|
|-
|
|
|-
|
|
|-
|
|
|-
|
|
|-
|
|
|-
|
|
|}

== Xbox Live ==
Xbox Live is an online multiplayer gaming and digital media delivery service created and operated by Microsoft. It was first made available to the Xbox system in November 2002. ([https://en.wikipedia.org/wiki/Xbox_Live Wikipedia]) Xbox Live support for the original Xbox ended in April 15, 2010.

The Xbox Live architecture consists of authentication servers, matchmaking servers, and game servers.

=== Matchmaking servers ===

=== Game servers ===

=== Authentication servers ===

Authentication and access to Xbox Live services is controlled using the Kerberos protocol with a few proprietary customizations for the Xbox.

Kerberos Authentication Server: macs.xboxlive.com

{| class="wikitable"
|+Xbox PA-DATA
|-
! padata-type
! description
|-
|131
| ?
|-
|204
| ?
|-
|206
| Information about Xbox Version, Title, and Title version
|}

=== Xbox Live Functions ===

{| class="wikitable"
|+XOnline* Functions
|-
! function
! description
|-
|XOnlineGetUsers(XONLINE_USER* XBLAccountusers, DWORD* numOfXBLiveAccounts)
|The XOnlineGetUsers function will enumerate both the hard disk and any attached memory units looking for user accounts
|-
|XOnlineTaskClose(XONLINETASK_HANDLE logonHandle)
|Called to abort the authentication process.
|-
|XOnlineStartup( XONLINE_STARTUP_PARAMS* )
|
|-
|XOnlineLogon(XONLINE_USER* XBLLoggedOnUsers, DWORD* XBLservices, DWORD SERVICE_COUNT, NULL, XONLINETASK_HANDLE &logonHandle)
|When a title calls XOnlineLogon to sign in, instead of blocking until the authentication completes, an asynchronous task handle is returned. As part of the authentication process a title must specify which services it will be using (XBLservices, SERVICE_COUNT).
|-
|XOnlineTaskContinue(XONLINETASK_HANDLE logonHandle)
|Called to check the status of XOnlineLogon.
|-
|XOnlineLogonTaskGetResults(XONLINETASK_HANDLE logonHandle)
|
|-
|XOnlineGetLogonUsers()
|This returns a pointer to an array of XONLINE USER structures. This array is similar the XONLINE USER array we populated and passed into XOnlineLogon, but is updated with error status and permission flags for each user.
|-
|XOnlineSetUserGuestNumber(dwUserFlags , 1)
|
|-
|XOnlineTitleUpdate(DWORD)
|The XOnlineTitleUpdate function will boot into an updater application, which performs the actual update
|-
|XOnlineGetServiceInfo(Service, ?)
|XOnlineGetServiceInfo returns the connection status for a service
|-
|XOnlineNotificationSetState
|
|-
|
|
|-
|
|
|-
|
|
|-
|
|
|-
|
|
|-
|
|
|-
|
|
|}

== Heartbeat ==

Ethernet II, Src: Microsof_f2:00:00 (00:50:f2:f2:00:00), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
MS Network Load Balancing
Signature: Unknown (0x584f4258)
Version: 1.1
Unique Host ID: 3118682055
Cluster IP: 167.102.81.132 (167.102.81.132)
Host IP: 4.89.169.109 (4.89.169.109)
Signature Data - Unknown (1481589336)

== References and links ==
* [https://xboxlivehacking.blogspot.de/ https://xboxlivehacking.blogspot.de/]
* [https://github.com/grayj/Jedi-Academy/blob/master/codemp/xbox/XBLive.cpp https://github.com/grayj/Jedi-Academy/blob/master/codemp/xbox/XBLive.cpp]
* [http://discerning.com/pdfbox/test/input/authentication.pdf http://discerning.com/pdfbox/test/input/authentication.pdf]
* [https://www.google.com/patents/US20040009815 Patent: Managing access to content]
* [https://www.google.com/patents/US20030093669 Patent: Network architecture for secure communications between two console-based gaming systems]
* [https://www.google.com/patents/US20030093668 Patent: Architecture for manufacturing authenticatable gaming systems ]
* [https://www.google.com/patents/US7803052 Patent: Discovery and distribution of game session information ]
* [https://www.google.com/patents/US20030229779 Patent: Security gateway for online console-based gaming ]
* [https://www.google.com/patents/US20030233537 Patent: Presence and notification system for maintaining and communicating information ]
* [https://www.google.com/patents/US7218739 Patent: Multiple user authentication for online console-based gaming ]
* [https://web.archive.org/web/20040831091347/http://www.xbox.com:80/assets/en-us/HardwareManuals/Xnewt.pdf: Xbox Wireless adapter manual]
* [https://www.hanselman.com/blog/FlashingTheFirmwareOfAnXboxMN740WirelessAdapterToADLink108AGToSupportWPASecurity.aspx: Flashing the Firmware of an Xbox MN-740 Wireless Adapter to a D-Link 108AG to support WPA Security ]
* [https://fccid.io/C3KMN740/Internal-Photos/Internal-Photos-360373.iframe FCC entry of Xbox MN-740 Wireless Adapter (with IC writing intact) ]

2018-02-25T12:05:55Z

Codeasm: Unkown if comercialy released. usb webcam

== Notes ==

* http://euc.jp/periphs/xbox-controller.en.html
* [[Videochat - Xbox webcam]http://www.eurogamer.net/articles/ss_videochat_x]

Super I/O

2018-02-06T20:22:42Z

Codeasm: Added U2 detail, not much, only serial pins

2018-01-10T17:35:47Z

Codeasm: /* TSOP programmed in system or from manufactoring? */

== TSOP programmed in system or from manufactoring? ==

Someone pointed me to the following letter: [http://www.ogxbox.com/archive/xboxsecurity.html 17 Mistakes Microsoft Made in the Xbox Security System]
under section: Modchips its being said that ''the ﬂash chip gets programmed in-system, the ﬁrst time they are turned on, using an external LPC ROM chip.''

If Michael Steil is right, our wiki page should be altered accordingly, unless this was a asumption based on the observation they made of a potencial leftover from earlier revisions of the MCPX? we should try to know if Steil got this info from an MS or factory source or someone who should know this

--[[User:Codeasm|Codeasm]] ([[User talk:Codeasm|talk]]) 08:17, 10 January 2018 (PST)
http://www.ogxbox.com/forums/index.php?/topic/335-tsop-flashing-at-wich-factory-and-onboard/&tab=comments#comment-1524
So certain modchips or even kernels would allow writing TSOP from modchip booted xboxes,
its not a technical limitation then, just... who is right or are earlier xboxes preflashed and later ones onboard or the other way arround?

--[[User:Codeasm|Codeasm]] ([[User talk:Codeasm|talk]]) 09:35, 10 January 2018 (PST)

Talk:Manufacturing Process

2018-01-10T16:25:43Z

Codeasm: /* TSOP programmed in system or from manufactoring? */

Talk:Manufacturing Process

2018-01-10T16:17:59Z

Codeasm: /* TSOP programmed in system or from manufactoring? */ new section

Hardware Revisions

2017-11-01T11:35:06Z

Codeasm: /* DVD Drive */ Added Hitachi details and hack

There are different retail Xbox hardware revisions:

* Xbox 1.0
** USB controller is on a separate PCB
** GPU has a fan on the heat sink
* Xbox 1.1
** USB controller moved onto the motherboard
** Fan removed from the GPU heat sink
* Xbox 1.2
* Xbox 1.3
* Xbox 1.4
* Xbox 1.5
* Xbox 1.6
** Removed data and power lines from LPC port
** Xyclops chip (includes ROM instead of flash = BIOS no longer flashable)
** Microsoft later switched to lower quality Hynix RAM. These Xboxes with non-Samsung RAM are sometimes referred to as 1.6b by the modding community.

You can find more information about the hardware used in each revision below.

== History of Xbox 1.5 ==

Possibly never existed{{citation needed}}, but will otherwise be very rare. Production was halted and 1.4 was produced again{{citation needed|reason=Sooo.. do these exist or not?!}}.

== Identifying ==

While not definitive, here are some ways to help identify the revision of your Xbox.

=== Manufacturing Details ===

{| class="wikitable"
! scope="col" | Date Range
! scope="col" | Revision
! scope="col" | Location
|-
| 01/2001-10/2002 || 1.0 || Hungary
|-
| 11/2002-04/2003 || 1.1 || Hungary, Mexico
|-
| 05/2003-03/2004 || 1.2 || China
|-
| 04/2004 Onward || 1.6 || China, Taiwan
|}

=== Serial Number ===

The serial number looks like this:

LNNNNNN YWWFF

* L is the production line
* NNNNNN is the number produced that week
* Y is the last digit of the production year
* WW is the number of the week
* FF is the factory code

Note, this table contradicts the previous table.

{| class="wikitable"
! scope="col" | Factory
! scope="col" | Location
! scope="col" | Revision
|-
| 02 || Mexico || 1.0 or 1.1
|-
| 03 || Hungary || 1.0
|-
| 05 || China || 1.2 or later
|-
| 06 || Taiwan || 1.2 or later
|}

{| class="wikitable"
! scope="col" | Serial Number
! scope="col" | Revision
|-
| LNNNNNN 20WFF || 1.0
|-
| LNNNNNN 21WFF || 1.0
|-
| LNNNNNN 23WFF || 1.0 or 1.1
|-
| LNNNNNN 24WFF || 1.1
|-
| LNNNNNN 25WFF || 1.1
|-
| LNNNNNN 30WFF || 1.2
|-
| LNNNNNN 31WFF || 1.3
|-
| LNNNNNN 32WFF || 1.3
|-
| LNNNNNN 33WFF || 1.4 or 1.5
|-
| LNNNNNN 42WFF || 1.6
|}

=== DVD Drive ===

There are four retail drives known to be used by Microsoft in the retail version of the console.
any Xbox DVD drive can be used in any retail xbox.

List of Xbox DVD Drive manufacturers
* Thomson (Xbox 1.0)
* Philips (Xbox 1.2)
* Samsung (Xbox 1.3)
* Hitachi-LG (8050L)(mainly 1.6?)

[[File:Xbox_drivedetermination.png|Xbox DVD Drive determination]]

===Hitachi-LG GDR-8050L ===
This DVD-rom drive, most commonly found in Xbox 1.6 and 1.6b is reading DVD-+R, DVD-RW and CDRW media, but fails to boot most CD-R discs source: [http://www.xbox-hq.com/html/article1535.html xbox-hq.com Hitachi-LG GDR-8050L DVD Drive In Xbox].

on 30 January 2006 TheSpecialist posted at Xboxhacker.net that he succesfully flashed a Hitachi drive to boot a copied game on a unmodded xbox: [https://web.archive.org/web/20080316154615/http://www.xboxhacker.net/index.php?option=com_smf&Itemid=33&topic=285.0 breakthrough: XBOX 1 firmware hacked !]

=== Hard Drive ===

{| class="wikitable
|-
! Revision
! Drive Manufacturer
! Drive Model Number
! Capacity
|-
| 1.0
| Seagate
| ST310211A
| 10G ?
|-
| 1.0 (XB:2001-10-26 FF=02)
| Western Digital
| WD80EB-00CGH0
| 8G
|-
| 1.1 (XB:2001-10-29 FF=03)
| Western Digital
| WD80EB-28CGH1
| 8G
|-
| 1.2
| Western Digital
| WD80EB-28DFH2
| 8G
|-
| 1.3+
| Seagate
| ST10014ACE
| 10G
|}

=== Video encoder ===

{| class="wikitable"
! scope="col" | Video Chip
! scope="col" | Revision
|-
| Conexant || 1.0, 1.1, 1.2, 1.3
|-
| Focus || 1.4, 1.5
|-
| Xcalibur || 1.6
|}

=== EEPROM ===

{| class="wikitable"
! Xbox Model
! Manufacturer
! Model
|-
| 1.4 (Others?)
| Catalyst
| CAT24WC02J
|}

=== MCPX Version ===

{| class="wikitable"
! scope="col" | MCPX Version
! scope="col" | Revision
|-
| 1.0 || 1.0
|-
| 1.1 || 1.1 - 1.6
|}

=== BIOS Version ===

{| class="wikitable"
! scope="col" | Kernel Version
! scope="col" | Revision
|-
| 3944, 4034, 4036, 4627 || 1.0
|-
| 4817, 4972 || 1.1
|-
| 5101, 5713 || 1.2 - 1.5
|-
| 5838 || 1.6
|}

== References ==

* [http://www.informit.com/articles/article.aspx?p=367210&seqNum=2 InformIT Methods of Identification]
* [http://www.informit.com/articles/article.aspx?p=367210 InformIT Identifying your Xbox Revision]

Hardware Revisions

2017-11-01T11:16:55Z

Codeasm: /* DVD Drive */ specific model number found

There are different retail Xbox hardware revisions:

* Xbox 1.0
** USB controller is on a separate PCB
** GPU has a fan on the heat sink
* Xbox 1.1
** USB controller moved onto the motherboard
** Fan removed from the GPU heat sink
* Xbox 1.2
* Xbox 1.3
* Xbox 1.4
* Xbox 1.5
* Xbox 1.6
** Removed data and power lines from LPC port
** Xyclops chip (includes ROM instead of flash = BIOS no longer flashable)
** Microsoft later switched to lower quality Hynix RAM. These Xboxes with non-Samsung RAM are sometimes referred to as 1.6b by the modding community.

You can find more information about the hardware used in each revision below.

== History of Xbox 1.5 ==

Possibly never existed{{citation needed}}, but will otherwise be very rare. Production was halted and 1.4 was produced again{{citation needed|reason=Sooo.. do these exist or not?!}}.

== Identifying ==

While not definitive, here are some ways to help identify the revision of your Xbox.

=== Manufacturing Details ===

{| class="wikitable"
! scope="col" | Date Range
! scope="col" | Revision
! scope="col" | Location
|-
| 01/2001-10/2002 || 1.0 || Hungary
|-
| 11/2002-04/2003 || 1.1 || Hungary, Mexico
|-
| 05/2003-03/2004 || 1.2 || China
|-
| 04/2004 Onward || 1.6 || China, Taiwan
|}

=== Serial Number ===

The serial number looks like this:

LNNNNNN YWWFF

* L is the production line
* NNNNNN is the number produced that week
* Y is the last digit of the production year
* WW is the number of the week
* FF is the factory code

Note, this table contradicts the previous table.

{| class="wikitable"
! scope="col" | Factory
! scope="col" | Location
! scope="col" | Revision
|-
| 02 || Mexico || 1.0 or 1.1
|-
| 03 || Hungary || 1.0
|-
| 05 || China || 1.2 or later
|-
| 06 || Taiwan || 1.2 or later
|}

{| class="wikitable"
! scope="col" | Serial Number
! scope="col" | Revision
|-
| LNNNNNN 20WFF || 1.0
|-
| LNNNNNN 21WFF || 1.0
|-
| LNNNNNN 23WFF || 1.0 or 1.1
|-
| LNNNNNN 24WFF || 1.1
|-
| LNNNNNN 25WFF || 1.1
|-
| LNNNNNN 30WFF || 1.2
|-
| LNNNNNN 31WFF || 1.3
|-
| LNNNNNN 32WFF || 1.3
|-
| LNNNNNN 33WFF || 1.4 or 1.5
|-
| LNNNNNN 42WFF || 1.6
|}

=== DVD Drive ===

There are four retail drives known to be used by Microsoft in the retail version of the console.
any Xbox DVD drive can be used in any retail xbox.

List of Xbox DVD Drive manufacturers
* Thomson (Xbox 1.0)
* Philips (Xbox 1.2)
* Samsung (Xbox 1.3)
* Hitachi-LG (8050L)(mainly 1.6?)

[[File:Xbox_drivedetermination.png|Xbox DVD Drive determination]]

=== Hard Drive ===

{| class="wikitable
|-
! Revision
! Drive Manufacturer
! Drive Model Number
! Capacity
|-
| 1.0
| Seagate
| ST310211A
| 10G ?
|-
| 1.0 (XB:2001-10-26 FF=02)
| Western Digital
| WD80EB-00CGH0
| 8G
|-
| 1.1 (XB:2001-10-29 FF=03)
| Western Digital
| WD80EB-28CGH1
| 8G
|-
| 1.2
| Western Digital
| WD80EB-28DFH2
| 8G
|-
| 1.3+
| Seagate
| ST10014ACE
| 10G
|}

=== Video encoder ===

{| class="wikitable"
! scope="col" | Video Chip
! scope="col" | Revision
|-
| Conexant || 1.0, 1.1, 1.2, 1.3
|-
| Focus || 1.4, 1.5
|-
| Xcalibur || 1.6
|}

=== EEPROM ===

{| class="wikitable"
! Xbox Model
! Manufacturer
! Model
|-
| 1.4 (Others?)
| Catalyst
| CAT24WC02J
|}

=== MCPX Version ===

{| class="wikitable"
! scope="col" | MCPX Version
! scope="col" | Revision
|-
| 1.0 || 1.0
|-
| 1.1 || 1.1 - 1.6
|}

=== BIOS Version ===

{| class="wikitable"
! scope="col" | Kernel Version
! scope="col" | Revision
|-
| 3944, 4034, 4036, 4627 || 1.0
|-
| 4817, 4972 || 1.1
|-
| 5101, 5713 || 1.2 - 1.5
|-
| 5838 || 1.6
|}

== References ==

* [http://www.informit.com/articles/article.aspx?p=367210&seqNum=2 InformIT Methods of Identification]
* [http://www.informit.com/articles/article.aspx?p=367210 InformIT Identifying your Xbox Revision]

2017-08-31T12:20:59Z

Codeasm: My dongle gave an error, but the 002 one worked. did someone messed the table up?

[[File:Xbox-Remote-and-Receiver.jpg|thumb|200px|Remote and Receiver]]
==Introduction==

The DVD Movie Playback Kit contains 2 parts: A remote and a dongle for the Xbox.

== Remote Control ==

== Dongle ==

The dongle contains a ROM with an XBE which provides some functions for the DVD playback application. However, the XBE is not standalone.

Why would they not just put this little < 512kiB library on the harddisk? Why another ROM which contains the program?
One could think it is to allow them to upgrade the application easily, but the real reason seems to be different: licensing. As the label on the back notes: "Made under license from Dolby Laboratories". By including the software in the DVD Remote kit, they don't have to pay Dolby for every Xbox sold, but just for every DVD Remote kit sold. This allows them to keep the cost of the Xbox down.

Additionally the dongle contains an IR receiver to receive commands from the Remote control.

=== Known versions ===

{| class="wikitable" 
! Part No. !! Manufactured in !! Version !! DVD Region !! ROM Size !! ROM SHA1 !! Notes
|-
| X08-25402 || Indonesia || 1.1 || 2 || 229790 Bytes || <code>70d4b5f8e073b05610fba9e9617d7356196b61ff</code> || CodeAsm got an error with this dongle
|-
| X08-25402-002 || Indonesia || 1.1 ||2 || 229790 || <code>70d4b5f8e073b05610fba9e9617d7356196b61ff</code> || CodeAsm got this one
|-
| X08-25387 || Indonesia || || || || ||
|-
| X08-25387-002 || Indonesia || 1.1 || 1 || 229790 Bytes || <code>73814aa736d83d636380f5c6b1c291441b35354d</code> || Sticker: "2341P" on PCB
|}

=== USB Protocol ===

{{FIXME|reason=Partially documented in JayFoxRox/xbox-tools on github}}

=== Components ===

Different versions of the dongle seem to use different hardware internally.

==== X08-25387-002 (PCB: "X01469-100") ====

* U1 ATMEL AT43USB352M-AC{{FIXME|reason=Can't find datasheet.. only for AT43USB351M-AC and AT43USB353M-AC; both of which have various differences}}
* U2 TSOP-1556
* U3 X393121C{{FIXME|reason=What is this? a ROM? how large?}}

==== X08-25387 (PCB: "IR DONGLE REV B") ====
[[File:X08-25387-Sticker.jpeg|thumb|200px|X08-25387 Rev B Sticker]]
[[File:IR_DONGLEREVB-FRNT.jpeg|thumb|200px|Front PCB of X08-25387]]

* U3 MX23C4000TC-10

{{FIXME|reason=Didn't get rear components photographed yet}}73814aa736d83d636380f5c6b1c291441b35354d

==== Unknown version (PCB: "REV C.") ====

[[File:Xbox-linux-dvd-dongle-front.jpg|thumb|200px|Frontside]]
[[File:Xbox-linux-dvd-dongle-back.jpg|thumb|200px|Backside]]

* U1 92163 [https://web.archive.org/web/20100617020513/http://www.st.com/ STMicroelectronics] <[https://web.archive.org/web/20100617020513/http://www.st.com/stonline/books/pdf/docs/5521.pdf Datasheet]>
: This big square IC on the backside is the microcontroller. STMicroelectronics describes it as "8/16-BIT FULL SPEED USB MCU FOR COMPOSITE DEVICES WITH 16 ENDPOINTS, 20K ROM, 2K RAM, I 2 C, SCI, & MFT". Since the program resides inside in its ROM, it is almost impossible to extract the program from inside.

* U2 TSOP-1556 [https://web.archive.org/web/20100617020513/http://www.vishay.com/ Vishay Telefunken] <[https://web.archive.org/web/20100617020513/http://www.vishay.com/docs/82029/82029.pdf Datasheet]>
: This black box on the middle of the frontside is an integrated IR receiver. It filters the received infrared pulses and demodulates them. Its filter frequency is 56kHz, while 38kHz is standard for most remote controls. Therefore, chances are few other remotes will work with the Xbox receiver.

* U3 MX23C4000TC-10 [https://web.archive.org/web/20100617020513/http://www.macronix.com/ Macronix] <[https://web.archive.org/web/20100617020513/http://www.macronix.com/QuickPlace/hq/PageLibrary48256D9D002BA613.nsf/h_6057FA6682A90C3948256DCE0052D2D3/67DCB124F1BE4E7D48256DC50039AC31/$File/MX23C4000-4.2.pdf/?OpenElement Datasheet]>
: This wide TSOP IC on the frontside could be the most interesting of all. It is a 4MBit mask ROM.

* U4 HC574 [https://web.archive.org/web/20100617020513/http://www.ti.com/ Texas Instruments] <[https://web.archive.org/web/20100617020513/http://focus.ti.com/lit/ds/symlink/sn74hc574.pdf Datasheet]>
: This 20-pin standard logic IC is an octal D-flipflop, which splits the databus from the 92163 to 8 adress bits. This technique is very well known from the 8051 and other microcontrollers.

=== Hacking ===

As the dashboard presumably downloads the code from the ROM into the memory of the Xbox, this could be a hardware hack requiring no hardware modifications. The XBE loader for the DVD image is different from the usual XBE loader. However, the XBE is still signed and checked for security.

== References ==

* [https://ibb.co/album/cmr5rF Pictures of X08-25387-002 including internals]
* [https://github.com/JayFoxRox/xbox-tools/tree/master/dump-dvd-kit Tool to dump DVD Dongle ROM]
* [https://web.archive.org/web/20100617020513/http://www.xbox-linux.org/wiki/DVD-IR_Internals DVD-IR Internals]