xboxdevwiki - User contributions [en]

Boot Process

2017-05-29T09:03:37Z

Eighthpence: /* Kernel decryption */

== Overview ==

== MCPX ==

Certain things are still missing, for example, getting the CPU to 32 bit protected mode and enabling caching.{{FIXME}}

=== Xcodes ===

The xcode interpreter is common through both versions of the MCPX ROM. The high level interpretation of the MCPX ROM might look like this:

<pre>
void xcode_interpreter() {
int run_xcodes = 1;
uint32_t eip = 0xff000080; // Not really EIP. This is just a pointer to the next xcode
uint32_t result, scratch = 0;
while (run_xcodes) {
opcode = get_memory_byte(eip);
operand_1 = get_memory_dword(eip+1);
operand_2 = get_memory_dword(eip+5);

if (opcode == 0x07) {
opcode = operand_1;
operand_1 = operand_2;
operand_2 = result;
}

switch (opcode) {
case 0x02:
result = get_memory_dword(operand_1 & 0x0fffffff);
break;
case 0x03:
set_memory_dword(operand_1) = operand_2;
break;
case 0x06:
result = (result & operand_1) | operand_2;
break;
case 0x04:
if (operand_1 == 0x80000880) {
operand_2 &= 0xfffffffd;
}
outl(operand_1, 0xcf8);
outl(operand_2, 0xcfc);
break;
case 0x05:
outl(operand_1, 0xcf8);
result = inl(0xcfc);
break;
case 0x08:
if (result != operand_1) {
eip += operand_2;
}
break;
case 0x09:
eip += operand_2;
break;
case 0x10:
scratch = (scratch & operand_1) | operand_2;
result = scratch;
break;
case 0x11:
outb(operand_2, operand_1);
break;
case 0x12:
result = inb(operand_1);
break;
case 0xee:
run_xcodes = 0;
default:
break;
}

eip += 9;
}
}
</pre>

=== RC4 Decryption of the 2BL ===

Decryption of the 2BL seems to happen in 4 stages.

==== Stage 1 ====

Initialising the working space. The MCPX ROM seems to just write 1, 2, 3, 4.... 253, 254, 255 in memory addresses 0x8f000 to 0x850FF. This might look something like:

<pre>
void init_rc4() {
uint32_t stack_pointer = 0x8f000;

for (int iterator = 0; iterator <= 255; iterator++) {
set_memory_byte(stack_pointer + iterator, iterator);
}
}
</pre>

==== Stage 2 ====

Preparing for decryption. This gets the key from memory location 0xFFFFFFA5 and starts preparing and environment for decryption of the 2BL.

<pre>
void load_key() {
uint32_t key_location = 0xffffffa5;
uint32_t stack_pointer = 0x8f000;
uint8_t i, j = 0;

for (int iterator = 0; iterator <= 255; iterator++) {
i = get_memory_byte(iterator + stack_pointer);
j += i + get_memory_byte(key_location + (iterator % 16));
set_memory_byte(iterator+stack_pointer, get_memory_byte(j+stack_pointer));
set_memory_byte(j+stack_pointer, i);
}
}
</pre>

==== Stage 3 ====

Perform the decryption. The MCPX reads the 2BL from 0xFFFF9E00 and decrypts it to 0x00090000. It is 24KiB in size.

<pre>
void decrypt() {
uint32_t stack_pointer = 0x0008F000;
uint32_t encrypted = 0xFFFF9E00;
uint32_t decrypted = 0x00090000;

uint8_t a, b, j, i = 0;

i = get_memory_byte(stack_pointer + 0x100); // 0
j = get_memory_byte(stack_pointer + 0x101); // 0

for (int edi = 0; edi <= 0x6000; ++edi) {
++i;

a = get_memory_byte(stack_pointer + i);
j += a;
b = get_memory_byte(stack_pointer + j);
set_memory_byte(stack_pointer + i, b);
set_memory_byte(stack_pointer + j, a);
a += b;
b = get_memory_byte(edi + encrypted);
a = get_memory_byte(stack_pointer + a);
b ^= a;
set_memory_byte(edi + decrypted, b);
}
}
</pre>

==== Stage 4 ====

Verification. Finally the MCPX reads a string from the un-encrypted 2BL and compares it to a magic number. If it matches, all was successful, and we jump to the start of the 2BL to start decrypting the kernel.

<pre>
void verify() {
if (get_memory_dword(0x95FE4) == MAGIC_NUMBER) {
eip = 0x900000;
} else {
// Else, things have gone wrong
eip = 0xFFFFFF94;
}
}
</pre>

=== Notes ===

The RC4 algorithm was included as part of MCPX 1.0 and seems to work fine with BIOS versions 3944, 4034, and 4134.

== 2BL ==

Certain parts are still missing

=== MTRR Setup ===

First, the cache is disabled.{{FIXME}}
Then, the MTRR (Memory Type Range Register) will be setup (using <code>wrmsr</code>) in the following way:

{| class="wikitable"
! MTRR (ecx) !! High value (edx) !! Low value (eax) !! Notes
|-
|0x200 || 0x00000000 || 0x00000006 ||
|-
| rowspan = "2" | 0x201 || rowspan = "2" | 0x0000000F || 0xFC000800 || ''(For 64 MiB RAM BIOS)''
|-
|0xF8000800 || (''For 128 MiB RAM BIOS'')
|-
|0x202 || 0x00000000 || 0xFFF80005 ||
|-
|0x203 || 0x0000000F || 0xFFF80800 ||
|-
|0x204 || 0x00000000 || 0x00000000 || rowspan="3" | Clear all unused MTRR
|-
| colspan = "3" | ...
|-
|0x20F || 0x00000000 || 0x00000000
|-
|0x2FF || 0x00000000 || 0x00000800 ||
|}

Once the MTRR have been written, the cache is enabled.{{FIXME}}

=== Register setup ===

Now the 2BL will set up the segment registers{{FIXME|reason=why?!}} and stack:

{| class="wikitable"
! Register !! Value !! Notes
|-
|ds || 0x0010 || rowspan="3" | Data segment{{citation needed}}

|-
|es || 0x0010

|-
|ss || 0x0010

|-
|esp || 0x00400000 ||

|-
|fs || 0x0000 ||

|-
|gs || 0x0000 ||
|}

=== Self-copy ===

Now the 2BL copies itself (24 kiB) from 0x00900000 to memory address 0x00400000.

=== Paging ===

Now a PDE is prepared at address 0x0000F000:

{| class="wikitable"
! Offset in PDE !! Value !! Notes
|-
|0x000 || 0x000000E3 || rowspan="7" | Identity maps the first 256MiB of RAM: 0x00000000 and 0x80000000 will both map to physical page 0 0xE3: Flags: * 0x80: 4 MiB page * 0x40: Marked as previously written (Dirty) * 0x20: Marked as previously accessed * 0x02: Read/Write * 0x01: Present
|-
|0x800 || 0x000000E3
|-
|0x004 || 0x004000E3
|-
|0x804 || 0x004000E3
|-
| colspan="2" | ...
|-
|0x8FC || 0x0FC000E3
|-
|0x0FC || 0x0FC000E3
|-
|0x900 || 0x00000000 || rowspan="5" | Unmapping the rest of the pages
|-
|0x100 || 0x00000000
|-
| colspan="2" | ...
|-
|0xFFC || 0x00000000
|-
|0x7FC || 0x00000000
|-
|0xC00 || 0x0000F063 || Maps the PDE (4 kiB page) to address 0xC0000000 0x63: Flags: * 0x40: Marked as previously written (Dirty) * 0x20: Marked as previously accessed * 0x02: Read/Write * 0x01: Present
|-
|0xFFC || 0xFFC000E3 || Identity maps the upper portion of the Flash (4 MiB page) to address 0xFFC00000 0xE3: Flags: * 0x80: 4 MiB page * 0x40: Marked as previously written (Dirty) * 0x20: Marked as previously accessed * 0x02: Read/Write * 0x01: Present
|-
|0xFD0 || 0xFD0000FB || rowspan="4" | Maps 16 MiB for the GPU control registers 0xFB: Flags: * 0x80: 4 MiB page * 0x40: Marked as previously written (Dirty) * 0x20: Marked as previously accessed * 0x10: Cache disabled * 0x08: Write-Through caching * 0x02: Read/Write * 0x01: Present
|-
|0xFD4 || 0xFD4000FB
|-
|0xFD8 || 0xFD8000FB
|-
|0xFDC || 0xFDC000FB
|}

After setting up the PDE, the PAT is set up using <code>wrmsr</code>: {{FIXME}}

CR4 is touched {{FIXME}}

CR3 is touched {{FIXME}}

Now paging is activated by enabling the PG and WP bits in CR0.
Additionally, the same <code>or</code> instruction is used to enable the NE bit in cr0.

=== 2BL main ===

esp is now also reloaded to point at the relocated address. It will be set to 0x80400000 (absolute value, independent of previous esp value).
The 2BL will now <code>call</code> into the relocated 2BL code somewhere near 0x00400000.

==== Disabling of the MCPX ROM ====

==== SMC handling ====

The [[SMC]] has a watchdog functionality which must be turned off.
This is done by querying the SMC registers 0x1C - 0x1F.
If all of them are 0x00 the 2BL will shutdown the system{{FIXME}}.
If this is not the case, the bootloader calculates the watchdog challenge response and sends it to SMC registers 0x20 and 0x21.

Additionally, the 2BL will set SMC register 0x01 to 0 (which resets the cursor position for reading the SMC revision information).

==== Weird stuff 0{{FIXME}} ====

==== Memory cleanup ====

The 2BL fills memory with 0xCC from 0x80090000 to 0x80095FFF. These are the 24 kiB where the 2BL was stored previously.

==== Weird stuff 1{{FIXME}} ====

==== Weird stuff 2{{FIXME}} ====

==== Weird stuff 3{{FIXME}} ====

==== Loading the kernel ====
===== Kernel-copy =====

The Kernel is now copied into RAM.

===== Kernel decryption =====

The 2BL will copy the kernel decryption key (16 bytes) from offset 32 of an array of 3 keys:

{| class="wikitable"
! Offset !! Use
|-
| 0 || EEPROM key
|-
| 16 || Certificate key
|-
| 32 || Kernel key
|}

The Kernel is then decrypted in-place using RC4.

===== Kernel decompression =====

The Kernel is decompressed directly to 0x80010000 where it will reside until a full system shutdown.

==== Running the kernel ====

The xboxkrnl.exe header at 0x8001000 is checked{{FIXME|reason=how?}}.
If it is invalid, {{FIXME}}.
If it is valid, the kernel entry point is looked up from the PE optional header. The hardcoded image base of 0x8001000 is added to the entry point.
The entry-point is now being called. Argumnts are passed on the stack, from right to left.
The first argument is a commandline string loaded from memory address 0x80400000. It is an empty string for retail BIOS{{FIXME|reason=Mention options for debug bioses here}}.
A pointer to the previously mentioned array of 3 keys is passed as the second argument.

== Kernel ==

=== Startup animation ===

=== Kernel Re-initialization ===

== References ==

* [http://hackspot.net/XboxBlog/?p=1 Understanding the Xbox boot process]
* [https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Boot ROM] (I cannot express enough just how helpful this page is)

BIOS

2017-05-17T19:39:04Z

Eighthpence: /* Known Retail BIOSs */

The '''BIOS''' (an acronym for '''Basic Input/Output System''' and also known as the '''BIOS ROM''' or '''Xbox ROM''') is a firmware image that is mapped to the top 16MB of the CPU's physical address space (0xFF000000-0xFFFFFFFF). Like the standard [https://en.wikipedia.org/wiki/BIOS PC BIOS], it is responsible for initializing the Xbox hardware and booting the system. Unlike the PC BIOS, however, the Xbox BIOS image also contains the kernel in a compressed and encrypted form.

On a standard Xbox, the BIOS image is stored on a 1MB non-volatile TSOP ROM chip and connected to the MCPX via the LPC bus. The image is actually 256KB, duplicated 4 times to fill the 1MB ROM chip. You can verify this by running:

<pre>
$ split -n 4 xbox.bin
$ md5sum xa*
542c62cb976a4993c8c5027dff9638ce xaa
542c62cb976a4993c8c5027dff9638ce xab
542c62cb976a4993c8c5027dff9638ce xac
542c62cb976a4993c8c5027dff9638ce xad
</pre>

You'll notice it is the same file repeated 4 times. That explains how some BIOS chips are 1MB and some are 256KB. The next thing is that the BIOS is repeated from 0xFF000000 until it fills the rest of memory. In other words, that 256KB of data is repeated 64 times.

== Components ==

The BIOS is split into different components. These are largely the same from BIOS to BIOS, but with some differences.

{| class="wikitable"
!
! Unknown
! X-Codes
! Copyright String
! Kernel
! Kernel Data Segment
! 2BL
! Decoy Boot Loader
|-
! 3944
| 0x00000
| 0x00080
| 0x00cfa
|
|
| 0x39E00
| 0x3FE00
|-
! 4034
| 0x00000
| 0x00080
| 0x00cfa
|
|
| 0x39E00
| 0x3FE00
|-
! 4134
| 0x00000
| 0x00080
| 0x00cfa
|
|
| 0x39E00
| 0x3FE00
|-
! 4817
| 0x00000
| 0x00080
| 0x00db9
|
|
|
| 0x3FE00
|-
! 5101
| 0x00000
| 0x00080
| 0x00e49
|
|
|
| 0x3FE00
|-
! 5530
| 0x00000
| 0x00080
| 0x00e59
|
|
|
| 0x3FE00
|-
! 5713
| 0x00000
| 0x00080
| 0x00e59
|
|
|
| 0x3FE00
|-
! 5838
| 0x00000
| 0x00080
| 0x00dcc
|
|
|
| 0x3FE00
|}

=== Unknown ===

From 0x00000000 - 0x000000079

Not sure what this does. Some people think it might be involved with initialising the [[MCPX ROM]], but I don't know. The Reset Vector on the Pentium 3 would mean that this wasn't called before the MCPX ROM, but I'm guessing there are people out there who know a lot more about it than me.

=== xcodes ===

From 0x00000080 - Copyright string

These are the xcode operations run by the MCPX interpreter. The first couple of lines appear to be nonsense (they don't execute any functionality), but then the first actual codes that I have found are:

The xcodes in the BIOS versions 3944, 4034, 4134 all start with:
04 10 08 00 80 01 80 00 00

The xcodes in the BIOS versions 4817, 5101, 5530, 5713, 5838 all start with:
04 84 08 00 80 01 80 00 00

This leads me to believe that the first three BIOS versions that I have are compatible with the 1.0 MCPX, and the rest are compatible with the 1.1 MCPX.

Next, some people believed that there was another unknown section between the xcodes and the copyright string. As far as I can tell, that section was to allow the xcode instruction set to expand, as the 5838 instructions are considerably larger than those in the 3944 BIOS.

=== Copyright String ===

Literally contains the ASCII encoded text: "Copyright (c) Microsoft Corporation. All rights reserved." (57 bytes long).
See the table above for the start positions.

=== Kernel ===

Still need to analyse

=== Kernel Data Segment ===

Still need to analyse

=== 2BL ===

Still need to analyse

=== Decoy bootloader ===

This is very similar to the [[MCPX ROM]], only the xcode interpreter is different, and it doesn't include any decryption/hashing algorithms.

== See Also ==

[[BIOS Dumping]]

== References ==

* [http://hackspot.net/XboxBlog/?p=1 Understanding the Xbox boot process]
* [http://redump.org/datfile/xbox-bios/ Xbox BIOS dat file from Redump Project]

Memory

2017-05-15T13:28:34Z

Eighthpence:

The Xbox has 64MB Memory. This could be expanded to 128MB of memory (and the motherboard has empty spots where these could have been) but no games took advantage of it. The debug Xbox and the Chihiro both contained 128MB Memory.

The memory was shared between the CPU and GPU. On the retail Xbox, the [[BIOS]] and [[MCPX ROM]] are also mapped to memory at the top 16MB and the top 512bytes respectively. On Debug Xboxs and Chihiro, only the BIOS is mapped.

{| class="wikitable"
! Memory Type
! Retail Xbox Range
! Debug/Chihiro Range
|-
|Main Memory
|0x00000000 - 0x04000000
|0x00000000 - 0x08000000
|-
|BIOS
|0xFF000000 - 0xFFFFFFFF
|0xFF000000 - 0xFFFFFFFF
|-
|MCPX
|0xFFFFFE00 - 0xFFFFFFFF
|N/A
|}

Code for emulating the memory might consist of:

<pre>
#ifdef DEBUG || CHIHIRO
#define MAIN_MEMORY 128 * 1024 * 1024
int mcpx_active = 0;
#else
#define MAIN_MEMORY 64 * 1024 * 1024
int mcpx_active = 1;
#endif

#define BIOS_SIZE 256 * 1024
#define BIOS_MEMORY_SIZE 16 * 1024 * 1024
#define BIOS_MEMORY (0xFFFFFFFF - BIOS_MEMORY_SIZE + 1)
#define MCPX_SIZE 0x200
#define MCPX_MEMORY (0xFFFFFFFF - MCPX_SIZE + 1)

uint8_t memory[MAIN_MEMORY] = {0};
uint8_t bios[BIOS_SIZE] = {0};
uint8_t mcpx[MCPX_SIZE] = {0};

uint8_t get_memory_byte(uint32_t location) {
if (location < MAIN_MEMORY) {
return memory[location];
}

if (mcpx_active && location >= MCPX_MEMORY) {
return mcpx[location - MCPX_MEMORY];
}

if (location >= BIOS_MEMORY) {
return bios[(location - BIOS_MEMORY) % BIOS_SIZE];
}

printf("Memory in unspecified range: %08X\n", location);
return 0;
}

uint16_t get_memory_word(uint32_t location) {
return get_memory(location + 1) << 8 | get_memory(location);
}

uint32_t get_memory_dword(uint32_t location) {
return get_memory_word(location + 2) << 16 | get_memory_word(location);
}

void deactivate_mcpx() {
mcpx_active = 0;
}
</pre>

BIOS

2017-05-15T13:27:39Z

Eighthpence: /* Components */

The '''BIOS''' (an acronym for '''Basic Input/Output System''' and also known as the '''BIOS ROM''' or '''Xbox ROM''') is a firmware image that is mapped to the top 16MB of the CPU's physical address space (0xFF000000-0xFFFFFFFF). Like the standard [https://en.wikipedia.org/wiki/BIOS PC BIOS], it is responsible for initializing the Xbox hardware and booting the system. Unlike the PC BIOS, however, the Xbox BIOS image also contains the kernel in a compressed and encrypted form.

On a standard Xbox, the BIOS image is stored on a 1MB non-volatile TSOP ROM chip and connected to the MCPX via the LPC bus. The image is actually 256KB, duplicated 4 times to fill the 1MB ROM chip. You can verify this by running:

<pre>
$ split -n 4 xbox.bin
$ md5sum xa*
542c62cb976a4993c8c5027dff9638ce xaa
542c62cb976a4993c8c5027dff9638ce xab
542c62cb976a4993c8c5027dff9638ce xac
542c62cb976a4993c8c5027dff9638ce xad
</pre>

You'll notice it is the same file repeated 4 times. That explains how some BIOS chips are 1MB and some are 256KB. The next thing is that the BIOS is repeated from 0xFF000000 until it fills the rest of memory. In other words, that 256KB of data is repeated 64 times.

== Components ==

The BIOS is split into different components. These are largely the same from BIOS to BIOS, but with some differences.

{| class="wikitable"
!
! Unknown
! X-Codes
! Copyright String
! Kernel
! Kernel Data Segment
! 2BL
! Decoy Boot Loader
|-
! 3944
| 0x00000
| 0x00080
| 0x00cfa
|
|
| 0x39E00
| 0x3FE00
|-
! 4034
| 0x00000
| 0x00080
| 0x00cfa
|
|
| 0x39E00
| 0x3FE00
|-
! 4134
| 0x00000
| 0x00080
| 0x00cfa
|
|
| 0x39E00
| 0x3FE00
|-
! 4817
| 0x00000
| 0x00080
| 0x00db9
|
|
|
| 0x3FE00
|-
! 5101
| 0x00000
| 0x00080
| 0x00e49
|
|
|
| 0x3FE00
|-
! 5530
| 0x00000
| 0x00080
| 0x00e59
|
|
|
| 0x3FE00
|-
! 5713
| 0x00000
| 0x00080
| 0x00e59
|
|
|
| 0x3FE00
|-
! 5838
| 0x00000
| 0x00080
| 0x00dcc
|
|
|
| 0x3FE00
|}

=== Unknown ===

From 0x00000000 - 0x000000079

Not sure what this does. Some people think it might be involved with initialising the [[MCPX ROM]], but I don't know. The Reset Vector on the Pentium 3 would mean that this wasn't called before the MCPX ROM, but I'm guessing there are people out there who know a lot more about it than me.

=== xcodes ===

From 0x00000080 - Copyright string

These are the xcode operations run by the MCPX interpreter. The first couple of lines appear to be nonsense (they don't execute any functionality), but then the first actual codes that I have found are:

The xcodes in the BIOS versions 3944, 4034, 4134 all start with:
04 10 08 00 80 01 80 00 00

The xcodes in the BIOS versions 4817, 5101, 5530, 5713, 5838 all start with:
04 84 08 00 80 01 80 00 00

This leads me to believe that the first three BIOS versions that I have are compatible with the 1.0 MCPX, and the rest are compatible with the 1.1 MCPX.

Next, some people believed that there was another unknown section between the xcodes and the copyright string. As far as I can tell, that section was to allow the xcode instruction set to expand, as the 5838 instructions are considerably larger than those in the 3944 BIOS.

=== Copyright String ===

Literally contains the ASCII encoded text: "Copyright (c) Microsoft Corporation. All rights reserved." (57 bytes long).
See the table above for the start positions.

=== Kernel ===

Still need to analyse

=== Kernel Data Segment ===

Still need to analyse

=== 2BL ===

Still need to analyse

=== Decoy bootloader ===

This is very similar to the [[MCPX ROM]], only the xcode interpreter is different, and it doesn't include any decryption/hashing algorithms.

== Known Retail BIOSs ==

* 3944
* 4034
* 4134
* 4817
* 5101
* 5530
* 5713
* 5838

== See Also ==

[[BIOS Dumping]]

== References ==

* [http://hackspot.net/XboxBlog/?p=1 Understanding the Xbox boot process]

Talk:BIOS

2017-05-14T19:40:46Z

Eighthpence: /* Turn lists into a table? */

== Typo in the know Bios versions ==
@Eighthpence did you mean 3944 instead of 3394 --[[User:Codeasm|Codeasm]] ([[User talk:Codeasm|talk]]) 08:06, 14 May 2017 (PDT)

They are now changed --[[User:Eighthpence|Eighthpence]] ([[User talk:Eighthpence|talk]]) 12:23, 14 May 2017 (PDT)

== Turn lists into a table? ==

This article has various lists / sections which all mention the same list of bioses.
I believe we should instead transform it into a table / tables and possibly leave fields blank if we don't know something.
--[[User:JayFoxRox|JayFoxRox]] ([[User talk:JayFoxRox|talk]]) 08:05, 14 May 2017 (PDT)

I've added a table. It needs improving but it is a start. --[[User:Eighthpence|Eighthpence]] ([[User talk:Eighthpence|talk]]) 12:40, 14 May 2017 (PDT)

BIOS

2017-05-14T19:39:33Z

Eighthpence: /* Components */

The '''BIOS''' (an acronym for '''Basic Input/Output System''' and also known as the '''BIOS ROM''' or '''Xbox ROM''') is a firmware image that is mapped to the top 16MB of the CPU's physical address space (0xFF000000-0xFFFFFFFF). Like the standard [https://en.wikipedia.org/wiki/BIOS PC BIOS], it is responsible for initializing the Xbox hardware and booting the system. Unlike the PC BIOS, however, the Xbox BIOS image also contains the kernel in a compressed and encrypted form.

On a standard Xbox, the BIOS image is stored on a 1MB non-volatile TSOP ROM chip and connected to the MCPX via the LPC bus. The image is actually 256KB, duplicated 4 times to fill the 1MB ROM chip. You can verify this by running:

<pre>
$ split -n 4 xbox.bin
$ md5sum xa*
542c62cb976a4993c8c5027dff9638ce xaa
542c62cb976a4993c8c5027dff9638ce xab
542c62cb976a4993c8c5027dff9638ce xac
542c62cb976a4993c8c5027dff9638ce xad
</pre>

You'll notice it is the same file repeated 4 times. That explains how some BIOS chips are 1MB and some are 256KB. The next thing is that the BIOS is repeated from 0xFF000000 until it fills the rest of memory. In other words, that 256KB of data is repeated 64 times.

== Components ==

The BIOS is split into different components. These are largely the same from BIOS to BIOS, but with some differences.

{|
! Memory Type
! 3944
! 4034
! 4134
! 4817
! 5101
! 5530
! 5713
! 5838
|-
| Unknown
| 0x00000
| 0x00000
| 0x00000
| 0x00000
| 0x00000
| 0x00000
| 0x00000
| 0x00000
|-
| X-Codes
| 0x00080
| 0x00080
| 0x00080
| 0x00080
| 0x00080
| 0x00080
| 0x00080
| 0x00080
|-
| Copyright String
| 0x00cfa
| 0x00cfa
| 0x00cfa
| 0x00db9
| 0x00e49
| 0x00e59
| 0x00e59
| 0x00dcc
|-
| Kernel
|
|
|
|
|
|
|
|
|-
| Kernel Data Segment
|
|
|
|
|
|
|
|
|-
| 2BL
| 0x039E00
| 0x039E00
| 0x039E00
|
|
|
|
|
|-
| Decoy Boot Loader
| 0x3FE00
| 0x3FE00
| 0x3FE00
| 0x3FE00
| 0x3FE00
| 0x3FE00
| 0x3FE00
| 0x3FE00
|}

=== Unknown ===

From 0x00000000 - 0x000000079

Not sure what this does. Some people think it might be involved with initialising the [[MCPX ROM]], but I don't know. The Reset Vector on the Pentium 3 would mean that this wasn't called before the MCPX ROM, but I'm guessing there are people out there who know a lot more about it than me.

=== xcodes ===

From 0x00000080 - Copyright string

These are the xcode operations run by the MCPX interpreter. The first couple of lines appear to be nonsense (they don't execute any functionality), but then the first actual codes that I have found are:

The xcodes in the BIOS versions 3944, 4034, 4134 all start with:
04 10 08 00 80 01 80 00 00

The xcodes in the BIOS versions 4817, 5101, 5530, 5713, 5838 all start with:
04 84 08 00 80 01 80 00 00

This leads me to believe that the first three BIOS versions that I have are compatible with the 1.0 MCPX, and the rest are compatible with the 1.1 MCPX.

Next, some people believed that there was another unknown section between the xcodes and the copyright string. As far as I can tell, that section was to allow the xcode instruction set to expand, as the 5838 instructions are considerably larger than those in the 3944 BIOS.

=== Copyright String ===

57 bytes long with the following start positions:

* 3944 - 0xcfa
* 4034 - 0xcfa
* 4134 - 0xcfa
* 4817 - 0xdb9
* 5101 - 0xe49
* 5530 - 0xe59
* 5713 - 0xe59
* 5838 - 0xdcc

Literally contains the text: "Copyright (c) Microsoft Corporation. All rights reserved.".

=== Kernel ===

Still need to analyse

=== Kernel Data Segment ===

Still need to analyse

=== 2BL ===

Still need to analyse

=== Decoy bootloader ===

This is very similar to the [[MCPX ROM]], only the xcode interpreter is different, and it doesn't include any decryption/hashing algorithms.

== Known Retail BIOSs ==

* 3944
* 4034
* 4134
* 4817
* 5101
* 5530
* 5713
* 5838

== See Also ==

[[BIOS Dumping]]

== References ==

* [http://hackspot.net/XboxBlog/?p=1 Understanding the Xbox boot process]

Talk:BIOS

2017-05-14T19:23:58Z

Eighthpence: /* Typo in the know Bios versions */

BIOS

2017-05-14T19:23:03Z

Eighthpence: /* Known Retail BIOSs */

The '''BIOS''' (an acronym for '''Basic Input/Output System''' and also known as the '''BIOS ROM''' or '''Xbox ROM''') is a firmware image that is mapped to the top 16MB of the CPU's physical address space (0xFF000000-0xFFFFFFFF). Like the standard [https://en.wikipedia.org/wiki/BIOS PC BIOS], it is responsible for initializing the Xbox hardware and booting the system. Unlike the PC BIOS, however, the Xbox BIOS image also contains the kernel in a compressed and encrypted form.

On a standard Xbox, the BIOS image is stored on a 1MB non-volatile TSOP ROM chip and connected to the MCPX via the LPC bus. The image is actually 256KB, duplicated 4 times to fill the 1MB ROM chip. You can verify this by running:

<pre>
$ split -n 4 xbox.bin
$ md5sum xa*
542c62cb976a4993c8c5027dff9638ce xaa
542c62cb976a4993c8c5027dff9638ce xab
542c62cb976a4993c8c5027dff9638ce xac
542c62cb976a4993c8c5027dff9638ce xad
</pre>

You'll notice it is the same file repeated 4 times. That explains how some BIOS chips are 1MB and some are 256KB. The next thing is that the BIOS is repeated from 0xFF000000 until it fills the rest of memory. In other words, that 256KB of data is repeated 64 times.

== Components ==

The BIOS is split into different components. These are largely the same from BIOS to BIOS, but with some differences.

=== Unknown ===

From 0x00000000 - 0x000000079

Not sure what this does. Some people think it might be involved with initialising the [[MCPX ROM]], but I don't know. The Reset Vector on the Pentium 3 would mean that this wasn't called before the MCPX ROM, but I'm guessing there are people out there who know a lot more about it than me.

=== xcodes ===

From 0x00000080 - Copyright string

These are the xcode operations run by the MCPX interpreter. The first couple of lines appear to be nonsense (they don't execute any functionality), but then the first actual codes that I have found are:

The xcodes in the BIOS versions 3944, 4034, 4134 all start with:
04 10 08 00 80 01 80 00 00

The xcodes in the BIOS versions 4817, 5101, 5530, 5713, 5838 all start with:
04 84 08 00 80 01 80 00 00

This leads me to believe that the first three BIOS versions that I have are compatible with the 1.0 MCPX, and the rest are compatible with the 1.1 MCPX.

Next, some people believed that there was another unknown section between the xcodes and the copyright string. As far as I can tell, that section was to allow the xcode instruction set to expand, as the 5838 instructions are considerably larger than those in the 3944 BIOS.

=== Copyright String ===

57 bytes long with the following start positions:

* 3944 - 0xcfa
* 4034 - 0xcfa
* 4134 - 0xcfa
* 4817 - 0xdb9
* 5101 - 0xe49
* 5530 - 0xe59
* 5713 - 0xe59
* 5838 - 0xdcc

Literally contains the text: "Copyright (c) Microsoft Corporation. All rights reserved.".

=== Kernel ===

Still need to analyse

=== Kernel Data Segment ===

Still need to analyse

=== 2BL ===

Still need to analyse

=== Decoy bootloader ===

This is very similar to the [[MCPX ROM]], only the xcode interpreter is different, and it doesn't include any decryption/hashing algorithms.

== Known Retail BIOSs ==

* 3944
* 4034
* 4134
* 4817
* 5101
* 5530
* 5713
* 5838

== See Also ==

[[BIOS Dumping]]

== References ==

* [http://hackspot.net/XboxBlog/?p=1 Understanding the Xbox boot process]

BIOS

2017-05-14T19:22:44Z

Eighthpence: /* Copyright String */

The '''BIOS''' (an acronym for '''Basic Input/Output System''' and also known as the '''BIOS ROM''' or '''Xbox ROM''') is a firmware image that is mapped to the top 16MB of the CPU's physical address space (0xFF000000-0xFFFFFFFF). Like the standard [https://en.wikipedia.org/wiki/BIOS PC BIOS], it is responsible for initializing the Xbox hardware and booting the system. Unlike the PC BIOS, however, the Xbox BIOS image also contains the kernel in a compressed and encrypted form.

On a standard Xbox, the BIOS image is stored on a 1MB non-volatile TSOP ROM chip and connected to the MCPX via the LPC bus. The image is actually 256KB, duplicated 4 times to fill the 1MB ROM chip. You can verify this by running:

<pre>
$ split -n 4 xbox.bin
$ md5sum xa*
542c62cb976a4993c8c5027dff9638ce xaa
542c62cb976a4993c8c5027dff9638ce xab
542c62cb976a4993c8c5027dff9638ce xac
542c62cb976a4993c8c5027dff9638ce xad
</pre>

You'll notice it is the same file repeated 4 times. That explains how some BIOS chips are 1MB and some are 256KB. The next thing is that the BIOS is repeated from 0xFF000000 until it fills the rest of memory. In other words, that 256KB of data is repeated 64 times.

== Components ==

The BIOS is split into different components. These are largely the same from BIOS to BIOS, but with some differences.

=== Unknown ===

From 0x00000000 - 0x000000079

Not sure what this does. Some people think it might be involved with initialising the [[MCPX ROM]], but I don't know. The Reset Vector on the Pentium 3 would mean that this wasn't called before the MCPX ROM, but I'm guessing there are people out there who know a lot more about it than me.

=== xcodes ===

From 0x00000080 - Copyright string

These are the xcode operations run by the MCPX interpreter. The first couple of lines appear to be nonsense (they don't execute any functionality), but then the first actual codes that I have found are:

The xcodes in the BIOS versions 3944, 4034, 4134 all start with:
04 10 08 00 80 01 80 00 00

The xcodes in the BIOS versions 4817, 5101, 5530, 5713, 5838 all start with:
04 84 08 00 80 01 80 00 00

This leads me to believe that the first three BIOS versions that I have are compatible with the 1.0 MCPX, and the rest are compatible with the 1.1 MCPX.

Next, some people believed that there was another unknown section between the xcodes and the copyright string. As far as I can tell, that section was to allow the xcode instruction set to expand, as the 5838 instructions are considerably larger than those in the 3944 BIOS.

=== Copyright String ===

57 bytes long with the following start positions:

* 3944 - 0xcfa
* 4034 - 0xcfa
* 4134 - 0xcfa
* 4817 - 0xdb9
* 5101 - 0xe49
* 5530 - 0xe59
* 5713 - 0xe59
* 5838 - 0xdcc

Literally contains the text: "Copyright (c) Microsoft Corporation. All rights reserved.".

=== Kernel ===

Still need to analyse

=== Kernel Data Segment ===

Still need to analyse

=== 2BL ===

Still need to analyse

=== Decoy bootloader ===

This is very similar to the [[MCPX ROM]], only the xcode interpreter is different, and it doesn't include any decryption/hashing algorithms.

== Known Retail BIOSs ==

* 3394
* 4034
* 4134
* 4817
* 5101
* 5530
* 5713
* 5838

== See Also ==

[[BIOS Dumping]]

== References ==

* [http://hackspot.net/XboxBlog/?p=1 Understanding the Xbox boot process]

Boot Process

2017-04-27T19:37:29Z

Eighthpence: /* Stage 4 */

If we wish to HLE the MCPX, then there are certain things that can be ignored, for example, getting the CPU to 32 bit protected mode and enabling caching.

== Xcodes ==

The xcode interpreter is common through both versions of the MCPX ROM. The high level interpretation of the MCPX ROM might look like this:

<pre>
void xcode_interpreter() {
int run_xcodes = 1;
uint32_t eip = 0xff000080; // Not really EIP. This is just a pointer to the next xcode
uint32_t result, scratch = 0;
while (run_xcodes) {
opcode = get_memory_byte(eip);
operand_1 = get_memory_dword(eip+1);
operand_2 = get_memory_dword(eip+5);

if (opcode == 0x07) {
opcode = operand_1;
operand_1 = operand_2;
operand_2 = result;
}

switch (opcode) {
case 0x02:
result = get_memory_dword(operand_1 & 0x0fffffff);
break;
case 0x03:
set_memory_dword(operand_1) = operand_2;
break;
case 0x06:
result = (result & operand_1) | operand_2;
break;
case 0x04:
if (operand_1 == 0x80000880) {
operand_2 &= 0xfffffffd;
}
outl(operand_1, 0xcf8);
outl(operand_2, 0xcfc);
break;
case 0x05:
outl(operand_1, 0xcf8);
result = inl(0xcfc);
break;
case 0x08:
if (result != operand_1) {
eip += operand_2;
}
break;
case 0x09:
eip += operand_2;
break;
case 0x10:
scratch = (scratch & operand_1) | operand_2;
result = scratch;
break;
case 0x11:
outb(operand_2, operand_1);
break;
case 0x12:
result = inb(operand_1);
break;
case 0xee:
run_xcodes = 0;
default:
break;
}

eip += 9;
}
}
</pre>

== RC4 Decryption of the 2BL ==

Decryption of the 2BL seems to happen in 4 stages.

=== Stage 1 ===

Initialising the working space. The MCPX ROM seems to just write 1, 2, 3, 4.... 253, 254, 255 in memory addresses 0x8f000 to 0x850FF. This might look something like:

<pre>
void init_rc4() {
uint32_t stack_pointer = 0x8f000;

for (int iterator = 0; iterator <= 255; iterator++) {
set_memory_byte(stack_pointer + iterator, iterator);
}
}
</pre>

=== Stage 2 ===

Preparing for decryption. This gets the key from memory location 0xFFFFFFA5 and starts preparing and environment for decryption of the 2BL.

<pre>
void load_key() {
uint32_t key_location = 0xffffffa5;
uint32_t stack_pointer = 0x8f000;
uint8_t i, j = 0;

for (int iterator = 0; iterator <= 255; iterator++) {
i = get_memory_byte(iterator + stack_pointer);
j += i + get_memory_byte(key_location + (iterator % 16));
set_memory_byte(iterator+stack_pointer, get_memory_byte(j+stack_pointer));
set_memory_byte(j+stack_pointer, i);
}
}
</pre>

=== Stage 3 ===

Perform the decryption. The MCPX reads the 2BL from 0xFFFF9E00 and decrypts it to 0x90000. It is 24K in size.

<pre>
void decrypt() {
uint32_t stack_pointer = 0x8f000;
uint32_t encrypted = 0xFFFF9E00;
uint32_t decrypted = 0x90000;

uint8_t a, b, j, i = 0;

i = get_memory_byte(stack_pointer + 0x100); // 0
j = get_memory_byte(stack_pointer + 0x101); // 0

for (int edi = 0; edi <= 0x6000; ++edi) {
++i;

a = get_memory_byte(stack_pointer + i);
j += a;
b = get_memory_byte(stack_pointer + j);
set_memory_byte(stack_pointer + i, b);
set_memory_byte(stack_pointer + j, a);
a += b;
b = get_memory_byte(edi + encrypted);
a = get_memory_byte(stack_pointer + a);
b ^= a;
set_memory_byte(edi + decrypted, b);
}
}
</pre>

=== Stage 4 ===

Verification. Finally the MCPX reads a string from the un-encrypted 2BL and compares it to a magic number. If it matches, all was successful, and we jump to the start of the 2BL to start decrypting the kernel.

<pre>
void verify() {
if (get_memory_dword(0x95FE4) == MAGIC_NUMBER) {
eip = 0x900000;
} else {
// Else, things have gone wrong
eip = 0xFFFFFF94;
}
}
</pre>

=== Notes ===

The RC4 algorithm was included as part of MCPX 1.0 and seems to work fine with BIOS versions 3944, 4034, and 4134.

== References ==

* [https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Boot ROM] (I cannot express enough just how helpful this page is)

Boot Process

2017-04-27T19:26:38Z

Eighthpence:

If we wish to HLE the MCPX, then there are certain things that can be ignored, for example, getting the CPU to 32 bit protected mode and enabling caching.

== Xcodes ==

The xcode interpreter is common through both versions of the MCPX ROM. The high level interpretation of the MCPX ROM might look like this:

<pre>
void xcode_interpreter() {
int run_xcodes = 1;
uint32_t eip = 0xff000080; // Not really EIP. This is just a pointer to the next xcode
uint32_t result, scratch = 0;
while (run_xcodes) {
opcode = get_memory_byte(eip);
operand_1 = get_memory_dword(eip+1);
operand_2 = get_memory_dword(eip+5);

if (opcode == 0x07) {
opcode = operand_1;
operand_1 = operand_2;
operand_2 = result;
}

switch (opcode) {
case 0x02:
result = get_memory_dword(operand_1 & 0x0fffffff);
break;
case 0x03:
set_memory_dword(operand_1) = operand_2;
break;
case 0x06:
result = (result & operand_1) | operand_2;
break;
case 0x04:
if (operand_1 == 0x80000880) {
operand_2 &= 0xfffffffd;
}
outl(operand_1, 0xcf8);
outl(operand_2, 0xcfc);
break;
case 0x05:
outl(operand_1, 0xcf8);
result = inl(0xcfc);
break;
case 0x08:
if (result != operand_1) {
eip += operand_2;
}
break;
case 0x09:
eip += operand_2;
break;
case 0x10:
scratch = (scratch & operand_1) | operand_2;
result = scratch;
break;
case 0x11:
outb(operand_2, operand_1);
break;
case 0x12:
result = inb(operand_1);
break;
case 0xee:
run_xcodes = 0;
default:
break;
}

eip += 9;
}
}
</pre>

== RC4 Decryption of the 2BL ==

Decryption of the 2BL seems to happen in 4 stages.

=== Stage 1 ===

Initialising the working space. The MCPX ROM seems to just write 1, 2, 3, 4.... 253, 254, 255 in memory addresses 0x8f000 to 0x850FF. This might look something like:

<pre>
void init_rc4() {
uint32_t stack_pointer = 0x8f000;

for (int iterator = 0; iterator <= 255; iterator++) {
set_memory_byte(stack_pointer + iterator, iterator);
}
}
</pre>

=== Stage 2 ===

Preparing for decryption. This gets the key from memory location 0xFFFFFFA5 and starts preparing and environment for decryption of the 2BL.

<pre>
void load_key() {
uint32_t key_location = 0xffffffa5;
uint32_t stack_pointer = 0x8f000;
uint8_t i, j = 0;

for (int iterator = 0; iterator <= 255; iterator++) {
i = get_memory_byte(iterator + stack_pointer);
j += i + get_memory_byte(key_location + (iterator % 16));
set_memory_byte(iterator+stack_pointer, get_memory_byte(j+stack_pointer));
set_memory_byte(j+stack_pointer, i);
}
}
</pre>

=== Stage 3 ===

Perform the decryption. The MCPX reads the 2BL from 0xFFFF9E00 and decrypts it to 0x90000. It is 24K in size.

<pre>
void decrypt() {
uint32_t stack_pointer = 0x8f000;
uint32_t encrypted = 0xFFFF9E00;
uint32_t decrypted = 0x90000;

uint8_t a, b, j, i = 0;

i = get_memory_byte(stack_pointer + 0x100); // 0
j = get_memory_byte(stack_pointer + 0x101); // 0

for (int edi = 0; edi <= 0x6000; ++edi) {
++i;

a = get_memory_byte(stack_pointer + i);
j += a;
b = get_memory_byte(stack_pointer + j);
set_memory_byte(stack_pointer + i, b);
set_memory_byte(stack_pointer + j, a);
a += b;
b = get_memory_byte(edi + encrypted);
a = get_memory_byte(stack_pointer + a);
b ^= a;
set_memory_byte(edi + decrypted, b);
}
}
</pre>

=== Stage 4 ===

Verification. Finally the MCPX reads a string from the un-encrypted 2BL and compares it to a magic number. If it matches, all was successful, and we jump to the start of the 2BL to start decrypting the kernel.

<pre>
void verify() {
if (get_memory_dword(0x95fe4) == MAGIC_NUMBER) {
eip = 0x900000;
}
}
</pre>

=== Notes ===

The RC4 algorithm was included as part of MCPX 1.0 and seems to work fine with BIOS versions 3944, 4034, and 4134.

== References ==

* [https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Boot ROM] (I cannot express enough just how helpful this page is)

Boot Process

2017-04-27T19:10:55Z

Eighthpence:

MCPX

2017-04-26T19:51:10Z

Eighthpence:

The MCPX is the southbridge chip of the Xbox chipset by Nvidia. It contains the sound processors (there are 4 of them) and also the USB, PCI, IDE, etc, controllers (please remove this disclaimer if I'm right, or fix it if I'm wrong.)

The MCPX is also the home to the secret [[MCPX ROM]].

Memory

2017-03-29T06:57:00Z

Eighthpence:

The Xbox has 64MB Memory. This could be expanded to 128MB of memory (and the motherboard has empty spots where these could have been) but no games took advantage of it. The debug Xbox and the Chihiro both contained 128MB Memory.

The memory was shared between the CPU and GPU. On the retail Xbox, the [[BIOS]] and [[MCPX ROM]] are also mapped to memory at the top 16MB and the top 512bytes respectively. On Debug Xboxs and Chihiro, only the BIOS is mapped.

{|
! Memory Type
! Retail Xbox Range
! Debug/Chihiro Range
|-
|Main Memory
|0x00000000 - 0x04000000
|0x00000000 - 0x08000000
|-
|BIOS
|0xFF000000 - 0xFFFFFFFF
|0xFF000000 - 0xFFFFFFFF
|-
|MCPX
|0xFFFFFE00 - 0xFFFFFFFF
|N/A
|}

Code for emulating the memory might consist of:

<pre>
#ifdef DEBUG || CHIHIRO
#define MAIN_MEMORY 128 * 1024 * 1024
int mcpx_active = 0;
#else
#define MAIN_MEMORY 64 * 1024 * 1024
int mcpx_active = 1;
#endif

#define BIOS_SIZE 256 * 1024
#define BIOS_MEMORY_SIZE 16 * 1024 * 1024
#define BIOS_MEMORY (0xFFFFFFFF - BIOS_MEMORY_SIZE + 1)
#define MCPX_SIZE 0x200
#define MCPX_MEMORY (0xFFFFFFFF - MCPX_SIZE + 1)

uint8_t memory[MAIN_MEMORY] = {0};
uint8_t bios[BIOS_SIZE] = {0};
uint8_t mcpx[MCPX_SIZE] = {0};

uint8_t get_memory_byte(uint32_t location) {
if (location < MAIN_MEMORY) {
return memory[location];
}

if (mcpx_active && location >= MCPX_MEMORY) {
return mcpx[location - MCPX_MEMORY];
}

if (location >= BIOS_MEMORY) {
return bios[(location - BIOS_MEMORY) % BIOS_SIZE];
}

printf("Memory in unspecified range: %08X\n", location);
return 0;
}

uint16_t get_memory_word(uint32_t location) {
return get_memory(location + 1) << 8 | get_memory(location);
}

uint32_t get_memory_dword(uint32_t location) {
return get_memory_word(location + 2) << 16 | get_memory_word(location);
}

void deactivate_mcpx() {
mcpx = 0;
}
</pre>

Boot Process

2017-03-28T21:26:35Z

Eighthpence:

If we wish to HLE the MCPX, then there are certain things that can be ignored, for example, getting the CPU to 32 bit protected mode and enabling caching. The xcode interpreter is common through both versions of the MCPX ROM. The high level interpretation of the MCPX ROM might look like this:

<pre>
void xcode_interpreter() {
int run_xcodes = 1;
uint32_t eip = 0xff000080; // Not really EIP. This is just a pointer to the next xcode
uint32_t result, scratch = 0;
while (run_xcodes) {
opcode = get_memory_byte(eip);
operand_1 = get_memory_dword(eip+1);
operand_2 = get_memory_dword(eip+5);

if (opcode == 0x07) {
opcode = operand_1;
operand_1 = operand_2;
operand_2 = result;
}

switch (opcode) {
case 0x02:
result = get_memory_dword(operand_1 & 0x0fffffff);
break;
case 0x03:
set_memory_dword(operand_1) = operand_2;
break;
case 0x06:
result = (result & operand_1) | operand_2;
break;
case 0x04:
if (operand_1 == 0x80000880) {
operand_2 &= 0xfffffffd;
}
outl(operand_1, 0xcf8);
outl(operand_2, 0xcfc);
break;
case 0x05:
outl(operand_1, 0xcf8);
result = inl(0xcfc);
break;
case 0x08:
if (result != operand_1) {
eip += operand_2;
}
break;
case 0x09:
eip += operand_2;
break;
case 0x10:
scratch = (scratch & operand_1) | operand_2;
result = scratch;
break;
case 0x11:
outb(operand_2, operand_1);
break;
case 0x12:
result = inb(operand_1);
break;
case 0xee:
run_xcodes = 0;
default:
break;
}

eip += 9;
}
}
</pre>

== References ==

* [https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Boot ROM] (I cannot express enough just how helpful this page is)

Memory

2017-03-28T21:15:19Z

Eighthpence:

The Xbox has 64MB Memory. This could be expanded to 128MB of memory (and the motherboard has empty spots where these could have been) but no games took advantage of it.

The memory was shared between the CPU and GPU. The [[BIOS]] and [[MCPX ROM]] are also mapped to memory at the top 16MB and the top 512bytes respectively.

Code for emulating the memory might consist of:

<pre>
#define MAIN_MEMORY 64 * 1024 * 1024
#define BIOS_SIZE 256 * 1024
#define BIOS_MEMORY_SIZE 16 * 1024 * 1024
#define BIOS_MEMORY (0xFFFFFFFF - BIOS_MEMORY_SIZE + 1)
#define MCPX_SIZE 0x200
#define MCPX_MEMORY (0xFFFFFFFF - MCPX_SIZE + 1)

int mcpx_active = 1;

uint8_t memory[MAIN_MEMORY] = {0};
uint8_t bios[BIOS_SIZE] = {0};
uint8_t mcpx[MCPX_SIZE] = {0};

uint8_t get_memory_byte(uint32_t location) {
if (location < MAIN_MEMORY) {
return memory[location];
}

if (mcpx_active && location >= MCPX_MEMORY) {
return mcpx[location - MCPX_MEMORY];
}

if (location >= BIOS_MEMORY) {
return bios[(location - BIOS_MEMORY) % BIOS_SIZE];
}

printf("Memory in unspecified range: %08X\n", location);
return 0;
}

uint16_t get_memory_word(uint32_t location) {
return get_memory(location + 1) << 8 | get_memory(location);
}

uint32_t get_memory_dword(uint32_t location) {
return get_memory_word(location + 2) << 16 | get_memory_word(location);
}

void deactivate_mcpx() {
mcpx = 0;
}
</pre>

Boot Process

2017-03-28T21:12:56Z

Eighthpence: Created page with "If we wish to HLE the MCPX, then there are certain things that can be ignored, for example, getting the CPU to 32 bit protected mode and enabling caching. The pseudo code for..."

If we wish to HLE the MCPX, then there are certain things that can be ignored, for example, getting the CPU to 32 bit protected mode and enabling caching. The pseudo code for a high level MCPX will look something like this:

<pre>
coming soon.....
</pre>

MCPX ROM

2017-03-28T20:55:43Z

Eighthpence:

The purpose of the MCPX ROM is to setup the GPT table, enter 32 bit mode, Enable caching, decrypt the second bootloader (2BL) and then transfer control over to it. It has a fair few things to do, so also contains an interpreter to read instructions from the BIOS (known as xcodes). There are two known versions of the MCPX ROM, 1.0 and 1.1. 1.0 was found in the 1.0 Xbox and used an RC4 algorithm to decrypt the 2BL. After Microsoft found this out, they changed the algorithm to a TEA algorithm. The code on the chips is largely the same, but for those two differences.

== Dumping the MCPX ROM ==

This is no mean feat. In the event of failure, or shortly after the 2BL execution has started, the Xbox executes the following codes:

<pre>
mov eax,0x80000880
mov dx,0xcf8
out dx,eax
</pre>

This turns off the MCPX ROM, making it invisible to anything trying to read it. See [[MCPX Dumping]] for more details.

== MCPX Common ==

As mentioned, the MCPX chips are largely the same. When the Xbox is powered on, the BIOS is loaded to the top 16 MB of memory (See [BIOS] for more details), and the MCPX ROM overlays the last 512 bytes of that memory. The Reset Vector tells the CPU to start executing code from 0xFFFFFFF0 (well, 0xFFFF:FFF0 due to being in 16 bit mode, but that is beyond the scope of this article). The first thing it does is setup the memory to consist of a 4GB continuous area, and then activates 32 bit mode. Starts executing code from BIOS (starting at 0xFF000080) using the [xcode interpreter]. Next it initialises the MTRR, enables caching, and then things become different.

== MCPX 1.0 ==

The 1.0 ROM runs an RC4 algorithm to decrypt the BL2 from flash (starting at 0xFFFF9E00) and load the unencrypted 2BL to memory (0x90000). It checks the signature of the decrypted 2BL and if it is correct, starts executing code at 0x90000. Otherwise it errors.

== MCPX 1.1 ==

Because of the flaws of the previous method, Microsoft changed the way the 2BL was decrypted. From what I can tell, Microsoft implemented a TEA algorithm to create a hash of a particular section of the BIOS (many times), and if that was correct, it would jump to 0xffffd600. This isn't in Memory, but rather in the BIOS. Otherwise it would error.

== Error Handling ==

The MCPX turns itself off when there is an error and then jumps to 0x000001FA. This is technically in the BIOS (there is no MCPX to read from any more), but the code is still relevant. It pretty much just makes the LEDs flash and hang.

== See Also ==

* [[MCPX HLE]]

== References ==

* [https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Xbox Boot ROM]

MCPX ROM

2017-03-28T20:48:02Z

Eighthpence:

The purpose of the MCPX ROM is to setup the GPT table, enter 32 bit mode, Enable caching, decrypt the second bootloader (2BL) and then transfer control over to it. It has a fair few things to do, so also contains an interpreter to read instructions from the BIOS (known as xcodes). There are two known versions of the MCPX ROM, 1.0 and 1.1. 1.0 was found in the 1.0 Xbox and used an RC4 algorithm to decrypt the 2BL. After Microsoft found this out, they changed the algorithm to a TEA algorithm. The code on the chips is largely the same, but for those two differences.

== Dumping the MCPX ROM ==

This is no mean feat. In the event of failure, or shortly after the 2BL execution has started, the Xbox executes the following codes:

<pre>
mov eax,0x80000880
mov dx,0xcf8
out dx,eax
</pre>

This turns off the MCPX ROM, making it invisible to anything trying to read it. See [[MCPX Dumping]] for more details.

== MCPX Common ==

As mentioned, the MCPX chips are largely the same. When the Xbox is powered on, the BIOS is loaded to the top 16 MB of memory (See [BIOS] for more details), and the MCPX ROM overlays the last 512 bytes of that memory. The Reset Vector tells the CPU to start executing code from 0xFFFFFFF0 (well, 0xFFFF:FFF0 due to being in 16 bit mode, but that is beyond the scope of this article). The first thing it does is setup the memory to consist of a 4GB continuous area, and then activates 32 bit mode. Starts executing code from BIOS (starting at 0xFF000080) using the [xcode interpreter]. Next it initialises the MTRR, enables caching, and then things become different.

== MCPX 1.0 ==

The 1.0 ROM runs an RC4 algorithm to decrypt the BL2 from flash (starting at 0xFFFF9E00) and load the unencrypted 2BL to memory (0x90000). It checks the signature of the decrypted 2BL and if it is correct, starts executing code at 0x90000. Otherwise it errors.

== MCPX 1.1 ==

Because of the flaws of the previous method, Microsoft changed the way the 2BL was decrypted. From what I can tell, Microsoft implemented a TEA algorithm to create a hash of a particular section of the BIOS (many times), and if that was correct, it would jump to 0xffffd600. This isn't in Memory, but rather in the BIOS. Otherwise it would error.

== Error Handling ==

The MCPX turns itself off when there is an error and then jumps to 0x000001FA. This is technically in the BIOS (there is no MCPX to read from any more), but the code is still relevant. It pretty much just makes the LEDs flash and hang.

== See Also ==

* [[MCPX 1.0]]
* [[MCPX 1.1]]

== References ==

* [https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Xbox Boot ROM]

MCPX ROM

2017-03-28T20:47:32Z

Eighthpence:

The purpose of the MCPX ROM is to setup the GPT table, enter 32 bit mode, Enable caching, decrypt the second bootloader (2BL) and then transfer control over to it. It has a fair few things to do, so also contains an interpreter to read instructions from the BIOS (known as xcodes). There are two known versions of the MCPX ROM, 1.0 and 1.1. 1.0 was found in the 1.0 Xbox and used an RC4 algorithm to decrypt the 2BL. After Microsoft found this out, they changed the algorithm to a TEA algorithm. The code on the chips is largely the same, but for those two differences.

== Dumping the MCPX ROM ==

This is no mean feat. In the event of failure, or shortly after the 2BL execution has started, the Xbox executes the following codes:

<pre>
mov eax,0x80000880
mov dx,0xcf8
out dx,eax
</pre>

This turns off the MCPX ROM, making it invisible to anything trying to read it. See [[MCPX Dumping]] for more details.

== MCPX Common ==

As mentioned, the MCPX chips are largely the same. When the Xbox is powered on, the BIOS is loaded to the top 16 MB of memory (See [BIOS] for more details), and the MCPX ROM overlays the last 512 bytes of that memory. The Reset Vector tells the CPU to start executing code from 0xFFFFFFF0 (well, 0xFFFF:FFF0 due to being in 16 bit mode, but that is beyond the scope of this article). The first thing it does is setup the memory to consist of a 4GB continuous area, and then activates 32 bit mode. Starts executing code from BIOS (starting at 0xFF000080) using the [xcode interpreter]. Next it initialises the MTRR, enables caching, and then things become different.

== MCPX 1.0 ==

The 1.0 ROM runs an RC4 algorithm to decrypt the BL2 from flash (starting at 0xFFFF9E00) and load the unencrypted 2BL to memory (0x90000). It checks the signature of the decrypted 2BL and if it is correct, starts executing code at 0x90000. Otherwise it errors.

== MCPX 1.1 ==

Because of the flaws of the previous method, Microsoft changed the way the 2BL was decrypted. From what I can tell, Microsoft implemented a TEA algorithm to create a hash of a particular section of the BIOS (many times), and if that was correct, it would jump to 0xffffd600. This isn't in Memory, but rather in the BIOS. Otherwise it would error.

== Error Handling ==

The MCPX turns itself off when there is an error and then jumps to 0x000001FA. This is technically in the BIOS (there is no MCPX to read from any more), but the code is still relevant. It pretty much just makes the LEDs flash and hang.

== See Also ==

* [MCPX 1.0]
* [MCPX 1.1]

== References ==

* [https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Xbox Boot ROM]

Main Page

2017-03-28T20:43:32Z

Eighthpence:

== xboxdevwiki.net ==

Please help us fix this mess.
This is an effort to document how the original Microsoft Xbox and the SEGA Chihiro work.
We not only care about technical details about those platforms, but also how to develop homebrew and emulate them.

We are not interested in documenting the Xbox 360, Xbox One or any other console at this point.

This wiki was started by xqemu (Xbox emulator) authors. It will become the place for all remaining Xbox projects to come together.
If you are interested in helping or discussing this, please come chat with us in #xqemu on freenode.

----

Development

* [https://github.com/xqemu/nxdk NXDK (New Xbox Development Kit)]
* [[OpenXDK]]
* [[Microsoft XDK]]

[[Xbox]]

* [[Hardware revisions]]
** [[CPU|CPU (Custom Pentium 3 733 MHz)]]
** [[Memory]]
** [[BIOS]]
** [[MCPX]] [[MCPX ROM|(ROM)]]
* [[Xbox Input Devices]]
* [[Operating System]]
* [[NV2A]]
** [[NV2A/Pixel Combiner]]
** [[NV2A/Fixed Function Pipeline]]
** [[NV2A/Vertex Shader]]
** [[NV2A/Surface Formats]]

[http://segaretro.org/Sega_Chihiro Chihiro]

* [[Chihiro Pictures]]
* [[Chihiro-Tools]]
* [[Chihiro-Launcher]]

Games

* [[Games/Grand Theft Auto 3]]
* [[Games/Grand Theft Auto Vice City]]
* [[Games/Grand Theft Auto San Andreas]]
* [[Games/Kung Fu Chaos]]
* [[Games/Tony Hawk's Pro Skater 2x]]

Emulation / Emulators

* [http://xqemu.com xqemu Xbox emulator]
* [http://cxbx-reloaded.co.uk Cxbx-Reloaded]
* [http://www.caustik.com/cxbx/ cxbx]
* [http://dxbx-emu.com Dxbx]
* [http://www.emulator-zone.com/doc.php/xbox/xeon.html Xeon (no known official homepage)]
* [http://ngemu.com/threads/hackbox.146461/ Hackbox]
* [https://github.com/phire/kvmbox kvmbox]
* [http://mamedev.org/ MAME/Chihiro]
* [http://mamedev.org/ MAME/Xbox]
* [https://github.com/monocasa/xbvm XBVM]

Find random stuff in [[Resources]]

== Getting started ==

* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Configuration_settings Configuration settings list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:FAQ MediaWiki FAQ]
* [https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce MediaWiki release mailing list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Localisation#Translation_resources Localise MediaWiki for your language]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Combating_spam Learn how to combat spam on your wiki]

Xbox

2017-03-28T20:38:55Z

Eighthpence: Created page with "The Xbox is a games console developed by Microsoft and released in 2001. Emulation for it is not up to scratch."

The Xbox is a games console developed by Microsoft and released in 2001. Emulation for it is not up to scratch.

CPU

2017-03-28T20:36:01Z

Eighthpence: Created page with "The CPU in the Xbox was a custom Pentium 3 running at 733MHz. The 'custom' part of this was that that the Pentium 3 in the Xbox was that it had only 128KB L2 cache instead of..."

The CPU in the Xbox was a custom Pentium 3 running at 733MHz. The 'custom' part of this was that that the Pentium 3 in the Xbox was that it had only 128KB L2 cache instead of the usual 256KB. This allowed Microsoft to buy them at a bit of a discount and Intel to shift a few more CPUs.

== References ==

* [https://software.intel.com/en-us/articles/intel-sdm Intel® 64 and IA-32 Architectures Software Developer Manuals] (Sorry, I can't find just the documentation for the Pentium 3. Enjoy 4600+ pages, half of which is irrelevant!)

Main Page

2017-03-28T20:29:57Z

Eighthpence:

== xboxdevwiki.net ==

Please help us fix this mess.
This is an effort to document how the original Microsoft Xbox and the SEGA Chihiro work.
We not only care about technical details about those platforms, but also how to develop homebrew and emulate them.

We are not interested in documenting the Xbox 360, Xbox One or any other console at this point.

This wiki was started by xqemu (Xbox emulator) authors. It will become the place for all remaining Xbox projects to come together.
If you are interested in helping or discussing this, please come chat with us in #xqemu on freenode.

----

Development

* [https://github.com/xqemu/nxdk NXDK (New Xbox Development Kit)]
* [[OpenXDK]]
* [[Microsoft XDK]]

[[Xbox]]

* [[Hardware revisions]]
** [[CPU|CPU (Custom Pentium 3 733 MHz)]]
** [[Memory]]
** [[BIOS]]
** [[MCPX]] [[MCPX ROM|(ROM)]]
* [[Xbox Input Devices]]
* [[Operating System]]
* [[NV2A]]
** [[NV2A/Pixel Combiner]]
** [[NV2A/Fixed Function Pipeline]]
** [[NV2A/Vertex Shader]]
** [[NV2A/Surface Formats]]

[http://segaretro.org/Sega_Chihiro Chihiro]

* [[Chihiro Pictures]]
* [[Chihiro-Tools]]
* [[Chihiro-Launcher]]

Games

* [[Games/Grand Theft Auto 3]]
* [[Games/Grand Theft Auto Vice City]]
* [[Games/Grand Theft Auto San Andreas]]
* [[Games/Kung Fu Chaos]]
* [[Games/Tony Hawk's Pro Skater 2x]]

Emulation / Emulators

* [http://xqemu.com xqemu Xbox emulator]
* [http://cxbx-reloaded.co.uk Cxbx-Reloaded]
* [[cxbx]]
* [http://dxbx-emu.com Dxbx]
* [[Xeon]]
* [[Hackbox]]
* [[kvmbox]]
* [[MAME/Chihiro]]
* [[MAME/Xbox]]

Find random stuff in [[Resources]]

== Getting started ==

* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Configuration_settings Configuration settings list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:FAQ MediaWiki FAQ]
* [https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce MediaWiki release mailing list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Localisation#Translation_resources Localise MediaWiki for your language]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Combating_spam Learn how to combat spam on your wiki]

OpenXDK

2017-03-28T20:27:56Z

Eighthpence: /* References */

Seemingly abandoned, but then sprung back into life in 2016 after 7 years of inactivity.

== References ==

[http://openxdk.sourceforge.net/ openxdk.sourceforge.net]

OpenXDK

2017-03-28T20:27:38Z

Eighthpence: Created page with "Seemingly abandoned, but then sprung back into life in 2016 after 7 years of inactivity. == References == [http://openxdk.sourceforge.net/]"

Seemingly abandoned, but then sprung back into life in 2016 after 7 years of inactivity.

== References ==

[http://openxdk.sourceforge.net/]

Microsoft XDK

2017-03-28T10:00:43Z

Eighthpence: /* List of known versions */

The official XDK (Xbox Development Kit) was only released to licensed developers. However, it got leaked a couple of times.

== List of known versions ==

5849 (Dec 2003)

Hard Drive Files

2017-03-27T20:56:46Z

Eighthpence: Created page with "The files on the Xbox look something like this (file sizes and MD5 checksums included): <pre> C Audio AmbientAudio AMB_05_ENGINEROOM_LR.wav 5562348..."

The files on the Xbox look something like this (file sizes and MD5 checksums included):

<pre>
C
Audio
AmbientAudio
AMB_05_ENGINEROOM_LR.wav 5562348 565b84c327ef10b4854db6d3c943078e
AMB_06_COMMUNICATION_LR.wav 5412228 767c124d7260a8c0072ed21fb2d46915
AMB_12_HYDROTHUNDER_LR.wav 6447588 8fe6214758f24524ea7af2f3a30258a0
AMB_EC_Pinger1.wav 1259412 076eb4b27b9ff381a8e188898975fb4d
AMB_EC_Steam1.wav 656484 43ac56a62ed8459239b97a39e665af2f
AMB_EC_Steam2.wav 943836 337bc7e89097d2b3ddcdb0eab0a92e13
AMB_EC_Steam3.wav 516156 88537eaeed16c6a4475d3b3738623aab
AMB_EC_Steam4.wav 746556 b0916cc4d6668a9771afd01496f4e9d7
AMB_EC_Steam5.wav 737340 552e8c32ea1a04f69e98859e56077f1b
AMB_EC_Steam6.wav 534588 f4cbc9d9a4f32adf2844ab97df798c76
AMB_EC_Steam7.wav 1021884 f041eb53748e5d47410a188c6e280b15
AMB_EC_Voices1.wav 307932 741c2d6d63ba0b3b464ea5b6b318cdbc
AMB_EC_Voices10.wav 525372 28a17555fa442249cbd7861e80bcf5ac
AMB_EC_Voices11.wav 313404 1b97f1b14fcab2201da745ed4f44e491
AMB_EC_Voices12.wav 672828 80c65f6b627b259796927adc6dde86f6
AMB_EC_Voices13.wav 362580 026576c28474118b04cc4a09fb6b5480
AMB_EC_Voices2.wav 307644 b3de08af73e56f93c10147e0b7f3bc57
AMB_EC_Voices3.wav 695292 ce594325ac41b2d95bea4a1a2a0449b4
AMB_EC_Voices4.wav 521916 b368c2a8995b000c340d3e1408e0fdc5
AMB_EC_Voices5.wav 292092 bf018e7ad6d6d4531753ef7ea0a1d16e
AMB_EC_Voices6.wav 709692 be2f2d7447cb69309595e115f72e5500
AMB_EC_Voices7.wav 502332 1fb09252f8ac69036351661f653da142
AMB_EC_Voices8.wav 313404 aa2849ce3b7df30ffc894322f83a7497
AMB_EC_Voices9.wav 691260 4ff4887384d0d5697df491ea9ce6b51b
comm static 1.wav 39012 4820878be0a0c67e2e2bfd1a82e9af60
comm static 2.wav 71052 6db8cae9fd2a8a7cf8fa9d3abe53ea1d
comm static 3.wav 104172 2abe2439e393432e6ae4d596c283690c
comm static 4.wav 93948 5e00320ced41a87a79aedc7ceaf5d57c
comm voice 1.wav 189636 0b208c6775907edc63a65054fc807af5
comm voice 2.wav 196116 7af4f6576c1714391f1aa4a8b0100ca5
comm voice 3.wav 241044 08781a9e45eac3df26142d8478eb684d
comm voice 4.wav 69036 948c41545db45969e71c0a5e7614a22f
comm voice 5.wav 116484 d67a914b933f85f513f4d8e44d09980a
comm voice 6.wav 83796 1f595aeaef1bdfb501a91de7638fe28f
comm voice 7.wav 81852 b2b9fa426e3237ddeb79f0536869eca2
comm voice 8.wav 178620 df652e1d62a8b33af6a47acffb4fcadb
comm voice 9.wav 110076 39b0f0a3d6d5ec10055b68e602b8675c
Control Room Loop ver2.wav 543732 093c1519cb6bd6d6d3930d3f774b3485
Control Room Loop.wav 541860 0f23001b0319a568ac862ec7a1f5ee6f
MainAudio
Global A Button Select.wav 18708 895b82ec5a33bc8a786e2a690a734de3
Global B Button Back.wav 18708 45e2b8b11534d2da41900fa5ef5418f4
Global Completion Beep.wav 12012 2aa770f713594310639ec15ebf2695af
Global Delete_Destroy.wav 41820 cdefc6e08f772d2c4ab77a564dc50183
Global Error Message B.wav 14964 dade2d5ecb0b754ec69d4bb4e887d42e
Global Keyboard Stroke 1.wav 7044 e7662531b5b05431966732cb76a6fffa
Global Keyboard Stroke 2.wav 11220 b516137d9257d3b975f6d9ad82b75750
Global Main MenuBack3ver2.wav 32892 b825773a71e8d3655bd8998cbbb424f4
Global Main MenuFwd3ver2.wav 24108 e5035e8fb6d1d16c16c1fda2a3339153
Global Progress Bar.wav 235356 d9820e39524a3b37e982fa77004655be
Global Scroll Beep.wav 1572 67bc6aba697a1eb2714d8eda84da0405
MemoryAudio
Memory Controller Select.wav 15828 54e676b7ff4dcdd295fabf1dfb9290e5
Memory Games Select.wav 45348 9e95263f0767a62119aa38e668248957
Memory Memory Slot Select.wav 12084 bb86674f7a85e0bf6d9dfb569cfcead4
MusicAudio
Games Info Screen In MSurr.wav 63348 17a245d749339571cdc0fb9524a0ba20
Games Info Screen In.wav 63348 b02a19fcbbbe8f394c79c560e67fbeb6
Games Info Screen Out MSurr.wav 71052 c8a81e0046acbc0ce5712f7621422b5b
Games Info Screen Out.wav 5964 2080b7f318e72e06c8e3c8a03656d03c
Music CD Select.wav 30300 1104afb43a6aec2b678cda13befa811e
SettingsAudio
Settings Lang SubMenu Sel.wav 161340 73a89aab381849b9a51bf097293e9449
Settings Parent SubMenu Sel.wav 21372 74a51e1d0634f2a25585389c77b3dd63
TransitionAudio
Games Main Menu In_LR.wav 72132 4ebfcf1125ace7e7417e513cf55faf84
Games Main Menu Out_LR.wav 75444 9f1e83b02961528a8920693ba2654a24
Games Sub Menu In_LR.wav 74220 8be59cc1ea9dd4c1349e446554a9e50c
Games Sub Menu Out_LR.wav 83148 0d2b3642ed00c68ff26fea337bb21d17
Music Main Menu In_LR.wav 53484 cd9b4b30a8829689be34e10648b89257
Music Main Menu Out_LR.wav 51036 5dcceccf08ae7d4c537a1ad03d1b4d64
Music Select Track In_LR.wav 68388 80af0c1585d8f6fbfd02623182bc8155
Music Select Track Out_LR.wav 68100 e3aa18fd82b3d34df22e34b4fe3d49ed
Settings Main Menu In_LR.wav 188844 7553686ac2ab1f1f9c9e16929ffce5ab
Settings Main Menu Out_LR.wav 159252 4bc9fbffabb006fcc6d321ee4ba127ee
Settings Sub Menu In_LR.wav 97908 2b6b47c092d70ae2ef926ff521b9d3d1
Settings Sub Menu Out_LR.wav 60468 1439f81e8dfab007d9dda12e3b8d34df
fonts
XBox Book.xtf 14440996 8f5b7cee650f389f1c5c7bb5f70386bb
Xbox.xtf 19124720 de4a26c39de8001b95c749f8d3d22128
xboxdashdata.<see versions>
AccountSelection.xip 1322518 497f17cc0941611e438093e5af73feb9
default.xip 1619954 c5f0ac7c917ff431739be68528562990
dvd.xip 167045 64feb8f1e5844fc3d4c4a4269677b8a3
jkeyboard.xip 732966 e2d462cd3df9f57a0d572f3229a87b51
Keyboard.xip 658238 c1b2b05a0a47a521d1f7d05ecb566432
LiveToday.xip 1226668 5f33f99506bb687bad95a735c6a9ea80
mainmenu5.xip 2300516 f2e318a54e2a7326c5b42c6def7d64d4
memory_files2.xip 2708134 295fcaec6ad66b14cf51c94d0ac1b999
Memory2.xip 2218462 4c7fcc324216117b8d54a273eb581c29
Message.xip 801609 abd85ff52590e61e0b7081f650175bae
music_copy3.xip 1618605 2f7257186e5093b09a1fe5d96716b0c6
Music_PlayEdit2.xip 2593642 628a0c8ce9ee64a6fd3bc339fbb28913
music2.xip 2007578 4979f2dbcf721c1702cde15ed7961800
PasscodeVerify.xip 2813123 f25f5447def27c67d5842bfc0474b28f
settings_adoc.xip 4208200 a73817afb22f622fc4c25bbd291db66a
Settings_Clock.xip 1684098 c49e21dacb92d81ed18380e4354904e1
settings_language.xip 1429750 cf45a77a9bf6dc972344c6cee48adacc
settings_list.xip 2928635 123a550fafb5c08b7a0c4437f7989820
settings_panel.xip 2813123 f25f5447def27c67d5842bfc0474b28f
settings_parental.xip 1008362 1ae35811db2ecf5af08695ae8b681e6d
settings_timezone.xip 1371154 b148d86596529ae3abaec6bb3185d13b
settings_video.xip 1978178 a91d26866b85bf80005a7fc1ba59b442
settings3.xip 2966303 8d6076c0ee3a22646c0764c34296c8b8
WaitCursor.xip 33641 6ccd2d7f083ef995f3f67ce747e289a9
xodash
audio
LiveNowAudio
Friend Offline.wav 54092 41b7a8fe061a1ff2552c9bf1188736f5
Friend Online.wav 54060 81ccfe1005276370c5cbb3e708807b62
Friend Request.wav 52436 d7c8b57e754b761d1b3101b3e709b3dd
Game Invite.wav 29396 cd580938613a5407eb8bcaffe2688667
VoiceChatAudio
Voice Chat Join.wav 26156 7fb1fe01240795fcbf564dabfad01b21
Voice Chat Leave.wav 37028 8021bcf17888d2803c0e419cffa7dbb5
media
Content
Japanese
coc_jpn.txt 2347 f2feb7aa376a74240926d158dd74d65d
ximejpm.dic 250528 b1a7b55b9694ed6a47a2b901415e6fc5
ximejps.dic 188288 83f581a5d8023013de26eb65b1467486
SavedGame
SaveImage.xbx 18432 f378f3f8f19f3f679ee6a3a7497e104d
TitleImage.xbx 67584 6327fec35dd1abe0c3f33ac5cde11c10
TitleMeta.xbx 800 630de678413ed09e15ae45aa231c1af6
TChinese
twroc.dic 55226 48d0d50142126651f6090ec99e00b8c5
Xbg
3_doublebutton.xbg 207993 42b0b013d2c2e5817a3e4c8ab04bffb4
act_accountpin.xbg 653118 fe632805e6d6729e7e442fc96771a7d9
act_activation.xbg 59625 a7db0e486f391ad9101ee7d9a6abe7ca
act_admin_policy.xbg 71938 135c297799488b118e93deb8ba6ea44e
act_alt_names.xbg 84324 158225c13adae3057c062fb8f6730be7
act_billing.xbg 226372 fb04f93f5afed327400f6dae41a3f4e8
act_congrats.xbg 145440 4f773200049c715436c27cad462d3725
act_copy_delete.xbg 888221 66321645c2e21dc97221946871ad8894
act_country.xbg 184789 11ef5a0db7ff1c4e57c372f5ca8a474c
act_forced_name.xbg 70512 b47c0cd89ef89019b8d4fb7e9f29078a
act_id.xbg 80213 d7b2f7b2c8444c353a00b61963a37ff0
act_message_server.xbg 241052 6876fb92e1c92afc662562fb99a5abb4
act_new_opt_in.xbg 283121 2997402d4dd252d0746e5790b35abeab
act_online.xbg 77774 dbd09ce5f9fd916724997bbe64aa7e6c
act_overwrite.xbg 578090 c71ca452229dcd95bfee26b7d9424f3a
act_passcode.xbg 722464 81526772f069a1c81b76254399fb8666
act_restrictions.xbg 198867 ecbfd5abe9bde3f28e7e21722c85e47c
act_state.xbg 797805 1f2a1cacb023ac3c754d9548a38e8039
act_sub_3button.xbg 158866 112821cc587d1ad4cc99fa0d0a917273
act_sure.xbg 65137 5c1540d7ccec2c6607c8b0510f8f825a
act_user_options.xbg 185180 e496c0538f2b825186b00e30f5709931
act_users2.xbg 88313 12ce8b2ae9d7d450660b7de5aebcaaf8
addfriend.xbg 1890765 f6bf945bea8ef86d593109b2d1866b89
anim_connecting.xbg 1034604 d414eabc933dc46e64b3703c54b8e574
anim_wait_5.xbg 25575 007a7e8f3f4b262414100cc48d8cbdb0
backbutton.xbg 81349 6b894fe7c6392836808dc6230bd7b0d0
bud_actions.xbg 146828 dbc004a2b3081507ae2c2efed71fb4a3
cellwall.xbg 190846 219a43d501df170e4affcae9e4b35e92
contextual.xbg 1937307 007ac7c3ddedad86a662bc9b115d1f00
feedback.xbg 1929240 d26e11eb96b135eac630dfcee1b7e5fb
friends.xbg 2224276 afae13fb39cc559c24c85262509e888e
gen_dob_tumblers.xbg 1276515 83c24a1a6ed4f405dc0caad816a0a204
gen_exp_tumblers.xbg 1262446 9e4d5fd47c810132f42bf9bc173a1908
gen_large_panel.xbg 210906 814dfbf474a031ab82f6271a4c0648db
gen_mess_panel.xbg 347851 397c04b140e03b293b1a104e540d73fc
j_candidates.xbg 254619 060728bbf7498173420a45be61b7c339
j_keyboard.xbg 737322 88c480d6b5ab9feb95b3e906760e2373
k_keyboard.xbg 426877 6388aede82d338db42b55752aa5b9d06
keyboard.xbg 375657 873fbf9ec6585103346bf0a381f95d93
keypad.xbg 202889 decf2d76e67af781ad34c220be6308f8
nts_dns.xbg 192159 bd54bc1e4246605937a828b3b6278a95
nts_ip.xbg 202623 9e100d8c7029c20cfc9bd7ee0fa6bc65
nts_settings.xbg 216718 512de7f31ef378651a5e783965ea7f24
nts_status.xbg 181806 0a0d4a2ed3c61c86258d6d3ae3fe3837
nts_wireless.xbg 231935 82a12b613465f617c90c7fdce118adef
orb_master.xbg 348747 c259f4d1276582d32044826f6d88cedc
selectbutton.xbg 73523 bf0fcf1cde1d1aa92b7335ab5d8c10a3
t_keyboard.xbg 405161 912e6bd830337868cb9b51d30c8c0121
voicechat.xbg 2327218 dd2e8dcea71fc8fa661daa7d6c9b0f6d
voicemail.xbg 1948139 662585947a38eff1b5e74e871ea4d5be
Xbx
button.xbx 10240 fc14f24784a74a5d48004e48880086cb
cellwall.xbx 67584 ff23d97f5263ee657cdd7d528bb1c95e
darken_opacity.xbx 18432 7f24ebbab4f77fe612d0dd9491001e49
Disabled.xbx 10240 6d8da8de70e262767600d2b84eec43c2
disabled_highlight.xbx 6144 64f4dd2e2f5539ad6a11417abe0ef336
footer.xbx 34816 6a2124d31b374d9c3f426436aec35161
GameHilite_01.xbx 6144 c4fa23bce07f08dd360565d9b267b0b0
highlight.xbx 10240 1e99278554e5d4a0e42b808ebd833385
keyboard_alpha.xbx 18432 65553de7e37186f96942948cbe4639b9
Live_header.xbx 34816 fc46134b8dd7abf183e1d466d5afe6bf
live_highlight_disabled.xbx 10240 5a2da8c4c763cdcf6ab7c23deaa64205
LiveChrome.xbx 67584 f64b49852005cc389d205ea1de8d1048
mess_panel_backing.xbx 18432 24459f91d4de55a521d2c75da81ac7de
Options.xbx 18432 9e442a174906ef3e06c04c5cd43b6ddd
panel1.xbx 18432 7ef04f5b0d0ce60e9ac385d5734d35a3
panel10.xbx 10240 2852c18e0b898a0cd0f74d957d1c4e1f
panel11.xbx 18432 188290082b02fc03a2656ffdc131f309
panel12.xbx 18432 bf234eb3313b4af0f04a7eea816b0819
panel13.xbx 18432 c465aaacf64ff98d7e5c7501f15df4cd
panel14.xbx 18432 5b52636f2ae781df267c27ba4f1fa1f4
panel15.xbx 10240 43ce1530ac07161c65b1ff5d02ddaf07
panel16.xbx 18432 1c35588436ba6d4a437fb1d22e8ed029
panel17.xbx 10240 7b9d574182f87b7c8bb9b1f16d07a234
panel18.xbx 18432 192a162567836159e44355a13b108ec6
panel19.xbx 18432 3d205c154cd434ae46009670b8a5c830
panel2.xbx 18432 4958bbd39d6adc867a323bd14e7fedfb
panel20.xbx 18432 70fcee44a106f94f3d505b8fe36e89bd
panel3.xbx 18432 7ddc37a40c11f91c4f5709275753682c
panel4.xbx 18432 54ca9e18cadcabd704eff52270cf5aef
panel5.xbx 18432 9a92cefceb843e4b634ef4862b2838f0
panel6.xbx 18432 5220d145a2d73f10018f822b746a33f9
panel7.xbx 18432 0fb78b53c5b037f006342a10f13447f5
panel8.xbx 18432 212a8b96d91eaab3788d33ea3f0f99d0
panel9.xbx 18432 25b985d4c995f4898ea1c3344cf0d2f0
Plain_header.xbx 34816 494a987d8bf0000ff972ec0926aa08dd
pulse_3D_64_matte_trans.xbx 4096 7d9b93b859d90f855dbb0a17170821bc
Pulse1.xbx 34816 364898b79abf0110779b849a4df38154
ridges.xbx 34816 caabfdb8e5aa2390d001d60247ff3b72
wireframe.xbx 10240 48468dbefff5fb21d52f8b66418a89f2
xbox2.xbx 264192 e86870b16246b4399a86c592a1f87b3b
xbox4.xbx 67584 67f33ec44e706a322e2550a342340a3c
xboxlogo.xbx 264192 77cf58d065229b28edda8b08709ac31d
xboxlogow.xbx 264192 c4816fb72fe27cd18bb04a109b9facd1
update.xbe 2260992 <see versions>
xonlinedash.xbe 2617344 <see versions>
XBox Book.xtf 17068868 54751950aa215228a4915955f7d2ce0c
Xbox.xtf 15613736 0466dd6c19ec9c1785e8aadfc8c5269e
xboxdash.xbe 1961984 <see versions>

E
TDATA
UDATA
</pre>

I have seen a few differences. I thought all my Xboxs had the same dashboard version, but I have 2 slightly different versions of files:

== 185ead00 ==

Here are the differences for this dashboard

<pre>
C
xboxdashdata.185ead00
xodash
update.xbe 2260992 bc99ef8730158ba1bf3f1c9c84520661
xonlinedash.xbe 2617344 8149654a030d813bcc02a24f39fd3ce9
xboxdash.xbe 1961984 08d3a6f99184679aa13008d6397bacce
</pre>

== 185a6100 ==

Here are the differences for this dashboard

<pre>
C
xboxdashdata.185a6100
xodash
update.xbe 2260992 78ad0f3f0cb83010728e00457a778121
xonlinedash.xbe 2617344 01dd6c8aa72b473ba1523c73c6527d86
xboxdash.xbe 1961984 1fa397b44ec78965ef955539fd8f4fbd
</pre>

Kernel

2017-03-27T20:48:37Z

Eighthpence: Created page with "== See Also == Hard Drive Files"

== See Also ==

[[Hard Drive Files]]

BIOS

2017-03-23T15:06:02Z

Eighthpence:

The BIOS is either a 1MB or 256KB memory which is loaded to the top 16MB of memory (from 0xFF000000). There are a couple of things to understand in order for this to make sense. First, the 1MB BIOS is actually 256KB of data repeated 4 times. So, if you do:

<pre>
$ split -n 4 xbox.bin
$ md5sum xa*
542c62cb976a4993c8c5027dff9638ce xaa
542c62cb976a4993c8c5027dff9638ce xab
542c62cb976a4993c8c5027dff9638ce xac
542c62cb976a4993c8c5027dff9638ce xad
</pre>

You'll notice it is the same file repeated 4 times. That explains how some BIOS chips are 1MB and some are 256KB. The next thing is that the BIOS is repeated from 0xFF000000 until it fills the rest of memory. In other words, that 256KB of data is repeated 64 times.

== Components ==

The BIOS is split into different components. These are largely the same from BIOS to BIOS, but with some differences.

=== Unknown ===

From 0x00000000 - 0x000000079

Not sure what this does. Some people think it might be involved with initialising the [[MCPX ROM]], but I don't know. The Reset Vector on the Pentium 3 would mean that this wasn't called before the MCPX ROM, but I'm guessing there are people out there who know a lot more about it than me.

=== xcodes ===

From 0x00000080 - Copyright string

These are the xcode operations run by the MCPX interpreter. The first couple of lines appear to be nonsense (they don't execute any functionality), but then the first actual codes that I have found are:

The xcodes in the BIOS versions 3944, 4034, 4134 all start with:
04 10 08 00 80 01 80 00 00

The xcodes in the BIOS versions 4817, 5101, 5530, 5713, 5838 all start with:
04 84 08 00 80 01 80 00 00

This leads me to believe that the first three BIOS versions that I have are compatible with the 1.0 MCPX, and the rest are compatible with the 1.1 MCPX.

Next, some people believed that there was another unknown section between the xcodes and the copyright string. As far as I can tell, that section was to allow the xcode instruction set to expand, as the 5838 instructions are considerably larger than those in the 3944 BIOS.

=== Copyright String ===

57 bytes long with the following start positions:

* 3394 - 0xcfa
* 4034 - 0xcfa
* 4134 - 0xcfa
* 4817 - 0xdb9
* 5101 - 0xe49
* 5530 - 0xe59
* 5713 - 0xe59
* 5838 - 0xdcc

Literally contains the text: "Copyright (c) Microsoft Corporation. All rights reserved.".

=== Kernel ===

Still need to analyse

=== Kernel Data Segment ===

Still need to analyse

=== 2BL ===

Still need to analyse

=== Decoy bootloader ===

This is very similar to the [[MCPX ROM]], only the xcode interpreter is different, and it doesn't include any decryption/hashing algorithms.

== Known Retail BIOSs ==

* 3394
* 4034
* 4134
* 4817
* 5101
* 5530
* 5713
* 5838

== See Also ==

[[BIOS Dumping]]

== References ==

* [http://hackspot.net/XboxBlog/?p=1 Understanding the Xbox boot process]

BIOS Dumping

2017-03-23T15:05:32Z

Eighthpence: Created page with "Dumping a BIOS can be done in several ways. == Using a chip reader == The BIOS is an ordinary TSOP and can be read with an ordinary TSOP reader. == Using a softmod exploit..."

Dumping a BIOS can be done in several ways.

== Using a chip reader ==

The BIOS is an ordinary TSOP and can be read with an ordinary TSOP reader.

== Using a softmod exploit ==

Using a softmod exploit, you can usually choose to 'backup' your Xbox. This dumps a load of information to E:\Backup, including the BIOS. You can then FTP into your Xbox and retrieve it.

MCPX ROM

2017-03-23T14:53:35Z

Eighthpence: /* Dumping the MCPX ROM */

The purpose of the MCPX ROM is to setup the GPT table, enter 32 bit mode, Enable caching, decrypt the second bootloader (2BL) and then transfer control over to it. It has a fair few things to do, so also contains an interpreter to read instructions from the BIOS (known as xcodes). There are two known versions of the MCPX ROM, 1.0 and 1.1. 1.0 was found in the 1.0 Xbox and used an RC4 algorithm to decrypt the 2BL. After Microsoft found this out, they changed the algorithm to a TEA algorithm. The code on the chips is largely the same, but for those two differences.

== Dumping the MCPX ROM ==

This is no mean feat. In the event of failure, or shortly after the 2BL execution has started, the Xbox executes the following codes:

<pre>
mov eax,0x80000880
mov dx,0xcf8
out dx,eax
</pre>

This turns off the MCPX ROM, making it invisible to anything trying to read it. See [[MCPX Dumping]] for more details.

== MCPX Common ==

As mentioned, the MCPX chips are largely the same. When the Xbox is powered on, the BIOS is loaded to the top 16 MB of memory (See [BIOS] for more details), and the MCPX ROM overlays the last 512 bytes of that memory. The Reset Vector tells the CPU to start executing code from 0xFFFFFFF0 (well, 0xFFFF:FFF0 due to being in 16 bit mode, but that is beyond the scope of this article). The first thing it does is setup the memory to consist of a 4GB continuous area, and then activates 32 bit mode. Starts executing code from BIOS (starting at 0xFF000080) using the [xcode interpreter]. Next it initialises the MTRR, enables caching, and then things become different.

== MCPX 1.0 ==

The 1.0 ROM runs an RC4 algorithm to decrypt the BL2 from flash (starting at 0xFFFF9E00) and load the unencrypted 2BL to memory (0x90000). It checks the signature of the decrypted 2BL and if it is correct, starts executing code at 0x90000. Otherwise it errors.

== MCPX 1.1 ==

Because of the flaws of the previous method, Microsoft changed the way the 2BL was decrypted. From what I can tell, Microsoft implemented a TEA algorithm to create a hash of a particular section of the BIOS (many times), and if that was correct, it would jump to 0xffffd600. This isn't in Memory, but rather in the BIOS. Otherwise it would error.

== Error Handling ==

The MCPX turns itself off when there is an error and then jumps to 0x000001FA. This is technically in the BIOS (there is no MCPX to read from any more), but the code is still relevant. It pretty much just makes the LEDs flash and hang.

== References ==

* [https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Xbox Boot ROM]

Hardware Revisions

2017-03-23T14:22:05Z

Eighthpence:

There are 7 Xbox revisions

== 1.0 ==

* Made in Hungary
* USB controller is on a separate PCB
* GPU has a fan on the heat sink
* MCPX 1.0 ROM
* Thomson DVD Drive
* Seagate Hard Drive
* Conexant [[Video Chip]]

== 1.1 ==

Same as 1.0, except:
* Made in Hungary or Mexico
* USB controller moved onto the motherboard
* Fan removed from the GPU heat sink
* MCPX 1.1 ROM

== 1.2 ==

Same as 1.1, except:
* Made in China
* Philips DVD Drive
* Western Digital Hard Drive

== 1.3 ==
Same as 1.2, except:
* Samsung DVD Drive
* Seagate Hard Drive

== 1.4 ==

Same as 1.3, except:
* Western Digital Hard Drive
* Focus video chip

== 1.5 ==

Same as 1.4. Possibly never existed, but will otherwise be very rare. Production was halted and 1.4 was produced again.

== 1.6 ==

Same as 1.4, except:
* Made in China or Taiwan
* BIOS no longer flashable
* Removed data and power lines from LPC port
* Xcalibur video chip

== Identifying ==

While not definitive, here are some ways to help identify the revision of your Xbox.

=== Manufacturing Details ===

{|
! scope="col" | Date Range
! scope="col" | Revision
! scope="col" | Location
|-
| 01/2001-10/2002 || 1.0 || Hungary
|-
| 11/2002-04/2003 || 1.1 || Hungary, Mexico
|-
| 05/2003-03/2004 || 1.2 || China
|-
| 04/2004 Onward || 1.6 || China, Taiwan
|}

=== Serial Number ===

The serial number looks like this:

LNNNNNN TWWFF

L is the production line
NNNNNN is the number produced that week
Y is the last digit of the production year
WW is the number of the week
FF is the factory code

Note, this table contradicts the previous table.

{|
! scope="col" | Factory
! scope="col" | Location
! scope="col" | Revision
|-
| 02 || Mexico || 1.0 or 1.1
|-
| 03 || Hungary || 1.0
|-
| 05 || China || 1.2 or later
|-
| 06 || Taiwan || 1.2 or later
|}

{|
! scope="col" | Serial Number
! scope="col" | Revision
|-
| LNNNNNN 20WFF || 1.0
|-
| LNNNNNN 21WFF || 1.0
|-
| LNNNNNN 23WFF || 1.0 or 1.1
|-
| LNNNNNN 24WFF || 1.1
|-
| LNNNNNN 25WFF || 1.1
|-
| LNNNNNN 30WFF || 1.2
|-
| LNNNNNN 31WFF || 1.3
|-
| LNNNNNN 32WFF || 1.3
|-
| LNNNNNN 33WFF || 1.4 or 1.5
|-
| LNNNNNN 42WFF || 1.6
|}

{|
! scope="col" | Video Chip
! scope="col" | Revision
|-
| Conexant || 1.0, 1.1, 1.2, 1.3
|-
| Focus || 1.4, 1.5
|-
| Xcalibur || 1.6
|}

=== BIOS Version ===

{|
! scope="col" | Kernel Version
! scope="col" | Revision
|-
| 3944, 4034, 4036, 4627 || 1.0
|-
| 4817, 4972 || 1.1
|-
| 5101, 5713 || 1.2 - 1.5
|-
| 5838 || 1.6
|}

== References ==

* [http://www.informit.com/articles/article.aspx?p=367210&seqNum=2 InformIT Methods of Identification]
* [http://www.informit.com/articles/article.aspx?p=367210 InformIT Identifying your Xbox Revision]

Hardware Revisions

2017-03-23T14:21:57Z

Eighthpence:

There are 7 Xbox revisions

== 1.0 ==

* Made in Hungary
* USB controller is on a separate PCB
* GPU has a fan on the heat sink
* MCPX 1.0 ROM
* Thomson DVD Drive
* Seagate Hard Drive
* Conexant [Video Chip]

== 1.1 ==

Same as 1.0, except:
* Made in Hungary or Mexico
* USB controller moved onto the motherboard
* Fan removed from the GPU heat sink
* MCPX 1.1 ROM

== 1.2 ==

Same as 1.1, except:
* Made in China
* Philips DVD Drive
* Western Digital Hard Drive

== 1.3 ==
Same as 1.2, except:
* Samsung DVD Drive
* Seagate Hard Drive

== 1.4 ==

Same as 1.3, except:
* Western Digital Hard Drive
* Focus video chip

== 1.5 ==

Same as 1.4. Possibly never existed, but will otherwise be very rare. Production was halted and 1.4 was produced again.

== 1.6 ==

Same as 1.4, except:
* Made in China or Taiwan
* BIOS no longer flashable
* Removed data and power lines from LPC port
* Xcalibur video chip

== Identifying ==

While not definitive, here are some ways to help identify the revision of your Xbox.

=== Manufacturing Details ===

{|
! scope="col" | Date Range
! scope="col" | Revision
! scope="col" | Location
|-
| 01/2001-10/2002 || 1.0 || Hungary
|-
| 11/2002-04/2003 || 1.1 || Hungary, Mexico
|-
| 05/2003-03/2004 || 1.2 || China
|-
| 04/2004 Onward || 1.6 || China, Taiwan
|}

=== Serial Number ===

The serial number looks like this:

LNNNNNN TWWFF

L is the production line
NNNNNN is the number produced that week
Y is the last digit of the production year
WW is the number of the week
FF is the factory code

Note, this table contradicts the previous table.

{|
! scope="col" | Factory
! scope="col" | Location
! scope="col" | Revision
|-
| 02 || Mexico || 1.0 or 1.1
|-
| 03 || Hungary || 1.0
|-
| 05 || China || 1.2 or later
|-
| 06 || Taiwan || 1.2 or later
|}

{|
! scope="col" | Serial Number
! scope="col" | Revision
|-
| LNNNNNN 20WFF || 1.0
|-
| LNNNNNN 21WFF || 1.0
|-
| LNNNNNN 23WFF || 1.0 or 1.1
|-
| LNNNNNN 24WFF || 1.1
|-
| LNNNNNN 25WFF || 1.1
|-
| LNNNNNN 30WFF || 1.2
|-
| LNNNNNN 31WFF || 1.3
|-
| LNNNNNN 32WFF || 1.3
|-
| LNNNNNN 33WFF || 1.4 or 1.5
|-
| LNNNNNN 42WFF || 1.6
|}

{|
! scope="col" | Video Chip
! scope="col" | Revision
|-
| Conexant || 1.0, 1.1, 1.2, 1.3
|-
| Focus || 1.4, 1.5
|-
| Xcalibur || 1.6
|}

=== BIOS Version ===

{|
! scope="col" | Kernel Version
! scope="col" | Revision
|-
| 3944, 4034, 4036, 4627 || 1.0
|-
| 4817, 4972 || 1.1
|-
| 5101, 5713 || 1.2 - 1.5
|-
| 5838 || 1.6
|}

== References ==

* [http://www.informit.com/articles/article.aspx?p=367210&seqNum=2 InformIT Methods of Identification]
* [http://www.informit.com/articles/article.aspx?p=367210 InformIT Identifying your Xbox Revision]

NV2A

2017-03-23T14:12:39Z

Eighthpence: Created page with "The northbridge of the chipset, and is the GPU"

The northbridge of the chipset, and is the GPU

Memory

2017-03-23T14:11:11Z

Eighthpence: Created page with "The Xbox has 64MB Memory. This could be expanded to 128MB of memory (and the motherboard has empty spots where these could have been) but no games took advantage of it. The m..."

Main Page

2017-03-23T14:04:20Z

Eighthpence:

== xboxdevwiki.net ==

Please help us fix this mess.
This is an effort to document how the original Microsoft Xbox and the SEGA Chihiro work.
We not only care about technical details about those platforms, but also how to develop homebrew and emulate them.

We are not interested in documenting the Xbox 360, Xbox One or any other console at this point.

This wiki was started by xqemu (Xbox emulator) authors. It will become the place for all remaining Xbox projects to come together.
If you are interested in helping or discussing this, please come chat with us in #xqemu on freenode.

----

Development

* [https://github.com/xqemu/nxdk NXDK (New Xbox Development Kit)]
* [[OpenXDK]]
* [[Microsoft XDK]]

[[Xbox]]

* [[Hardware revisions]]
** [[Memory]]
** [[BIOS]]
** [[MCPX]] [[MCPX ROM|(ROM)]]
* [[Xbox Input Devices]]
* [[Operating System]]
* [[NV2A]]
** [[NV2A/Pixel Combiner]]
** [[NV2A/Fixed Function Pipeline]]
** [[NV2A/Vertex Shader]]
** [[NV2A/Surface Formats]]

[http://segaretro.org/Sega_Chihiro Chihiro]

* [[Chihiro Pictures]]
* [[Chihiro-Tools]]
* [[Chihiro-Launcher]]

Games

* [[Games/Grand Theft Auto 3]]
* [[Games/Grand Theft Auto Vice City]]
* [[Games/Grand Theft Auto San Andreas]]
* [[Games/Kung Fu Chaos]]
* [[Games/Tony Hawk's Pro Skater 2x]]

Emulation / Emulators

* [http://xqemu.com xqemu Xbox emulator]
* [[cxbx-reloaded]]
* [[cxbx]]
* [[dxbx]]
* [[Xeon]]
* [[Hackbox]]
* [[kvmbox]]
* [[MAME/Chihiro]]
* [[MAME/Xbox]]

Find random stuff in [[Resources]]

== Getting started ==

* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Configuration_settings Configuration settings list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:FAQ MediaWiki FAQ]
* [https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce MediaWiki release mailing list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Localisation#Translation_resources Localise MediaWiki for your language]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Combating_spam Learn how to combat spam on your wiki]

User:Eighthpence

2017-03-23T14:03:05Z

Eighthpence: Created page with "I'm a prick, don't listen to me."

I'm a prick, don't listen to me.

MCPX ROM

2017-03-23T14:02:35Z

Eighthpence:

The purpose of the MCPX ROM is to setup the GPT table, enter 32 bit mode, Enable caching, decrypt the second bootloader (2BL) and then transfer control over to it. It has a fair few things to do, so also contains an interpreter to read instructions from the BIOS (known as xcodes). There are two known versions of the MCPX ROM, 1.0 and 1.1. 1.0 was found in the 1.0 Xbox and used an RC4 algorithm to decrypt the 2BL. After Microsoft found this out, they changed the algorithm to a TEA algorithm. The code on the chips is largely the same, but for those two differences.

== Dumping the MCPX ROM ==

This is no mean feat. In the event of failure, or shortly after the 2BL execution has started, the Xbox executes the following codes:

<pre>
mov eax,0x80000880
mov dx,0xcf8
out dx,eax
</pre>

This turns off the MCPX ROM, making it invisible to anything trying to read it. See [MCPX Dumping] for more details.

== MCPX Common ==

As mentioned, the MCPX chips are largely the same. When the Xbox is powered on, the BIOS is loaded to the top 16 MB of memory (See [BIOS] for more details), and the MCPX ROM overlays the last 512 bytes of that memory. The Reset Vector tells the CPU to start executing code from 0xFFFFFFF0 (well, 0xFFFF:FFF0 due to being in 16 bit mode, but that is beyond the scope of this article). The first thing it does is setup the memory to consist of a 4GB continuous area, and then activates 32 bit mode. Starts executing code from BIOS (starting at 0xFF000080) using the [xcode interpreter]. Next it initialises the MTRR, enables caching, and then things become different.

== MCPX 1.0 ==

The 1.0 ROM runs an RC4 algorithm to decrypt the BL2 from flash (starting at 0xFFFF9E00) and load the unencrypted 2BL to memory (0x90000). It checks the signature of the decrypted 2BL and if it is correct, starts executing code at 0x90000. Otherwise it errors.

== MCPX 1.1 ==

Because of the flaws of the previous method, Microsoft changed the way the 2BL was decrypted. From what I can tell, Microsoft implemented a TEA algorithm to create a hash of a particular section of the BIOS (many times), and if that was correct, it would jump to 0xffffd600. This isn't in Memory, but rather in the BIOS. Otherwise it would error.

== Error Handling ==

The MCPX turns itself off when there is an error and then jumps to 0x000001FA. This is technically in the BIOS (there is no MCPX to read from any more), but the code is still relevant. It pretty much just makes the LEDs flash and hang.

== References ==

* [https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Xbox Boot ROM]

BIOS

2017-03-23T14:01:29Z

Eighthpence: /* Decoy bootloader */

The BIOS is either a 1MB or 256KB memory which is loaded to the top 16MB of memory (from 0xFF000000). There are a couple of things to understand in order for this to make sense. First, the 1MB BIOS is actually 256KB of data repeated 4 times. So, if you do:

<pre>
$ split -n 4 xbox.bin
$ md5sum xa*
542c62cb976a4993c8c5027dff9638ce xaa
542c62cb976a4993c8c5027dff9638ce xab
542c62cb976a4993c8c5027dff9638ce xac
542c62cb976a4993c8c5027dff9638ce xad
</pre>

You'll notice it is the same file repeated 4 times. That explains how some BIOS chips are 1MB and some are 256KB. The next thing is that the BIOS is repeated from 0xFF000000 until it fills the rest of memory. In other words, that 256KB of data is repeated 64 times.

== Components ==

The BIOS is split into different components. These are largely the same from BIOS to BIOS, but with some differences.

=== Unknown ===

From 0x00000000 - 0x000000079

Not sure what this does. Some people think it might be involved with initialising the [[MCPX ROM]], but I don't know. The Reset Vector on the Pentium 3 would mean that this wasn't called before the MCPX ROM, but I'm guessing there are people out there who know a lot more about it than me.

=== xcodes ===

From 0x00000080 - Copyright string

These are the xcode operations run by the MCPX interpreter. The first couple of lines appear to be nonsense (they don't execute any functionality), but then the first actual codes that I have found are:

The xcodes in the BIOS versions 3944, 4034, 4134 all start with:
04 10 08 00 80 01 80 00 00

The xcodes in the BIOS versions 4817, 5101, 5530, 5713, 5838 all start with:
04 84 08 00 80 01 80 00 00

This leads me to believe that the first three BIOS versions that I have are compatible with the 1.0 MCPX, and the rest are compatible with the 1.1 MCPX.

Next, some people believed that there was another unknown section between the xcodes and the copyright string. As far as I can tell, that section was to allow the xcode instruction set to expand, as the 5838 instructions are considerably larger than those in the 3944 BIOS.

=== Copyright String ===

57 bytes long with the following start positions:

* 3394 - 0xcfa
* 4034 - 0xcfa
* 4134 - 0xcfa
* 4817 - 0xdb9
* 5101 - 0xe49
* 5530 - 0xe59
* 5713 - 0xe59
* 5838 - 0xdcc

Literally contains the text: "Copyright (c) Microsoft Corporation. All rights reserved.".

=== Kernel ===

Still need to analyse

=== Kernel Data Segment ===

Still need to analyse

=== 2BL ===

Still need to analyse

=== Decoy bootloader ===

This is very similar to the [[MCPX ROM]], only the xcode interpreter is different, and it doesn't include any decryption/hashing algorithms.

== Known Retail BIOSs ==

* 3394
* 4034
* 4134
* 4817
* 5101
* 5530
* 5713
* 5838

== References ==

* [http://hackspot.net/XboxBlog/?p=1 Understanding the Xbox boot process]

BIOS

2017-03-23T14:01:16Z

Eighthpence: /* Unknown */

The BIOS is either a 1MB or 256KB memory which is loaded to the top 16MB of memory (from 0xFF000000). There are a couple of things to understand in order for this to make sense. First, the 1MB BIOS is actually 256KB of data repeated 4 times. So, if you do:

<pre>
$ split -n 4 xbox.bin
$ md5sum xa*
542c62cb976a4993c8c5027dff9638ce xaa
542c62cb976a4993c8c5027dff9638ce xab
542c62cb976a4993c8c5027dff9638ce xac
542c62cb976a4993c8c5027dff9638ce xad
</pre>

You'll notice it is the same file repeated 4 times. That explains how some BIOS chips are 1MB and some are 256KB. The next thing is that the BIOS is repeated from 0xFF000000 until it fills the rest of memory. In other words, that 256KB of data is repeated 64 times.

== Components ==

The BIOS is split into different components. These are largely the same from BIOS to BIOS, but with some differences.

=== Unknown ===

From 0x00000000 - 0x000000079

Not sure what this does. Some people think it might be involved with initialising the [[MCPX ROM]], but I don't know. The Reset Vector on the Pentium 3 would mean that this wasn't called before the MCPX ROM, but I'm guessing there are people out there who know a lot more about it than me.

=== xcodes ===

From 0x00000080 - Copyright string

These are the xcode operations run by the MCPX interpreter. The first couple of lines appear to be nonsense (they don't execute any functionality), but then the first actual codes that I have found are:

The xcodes in the BIOS versions 3944, 4034, 4134 all start with:
04 10 08 00 80 01 80 00 00

The xcodes in the BIOS versions 4817, 5101, 5530, 5713, 5838 all start with:
04 84 08 00 80 01 80 00 00

This leads me to believe that the first three BIOS versions that I have are compatible with the 1.0 MCPX, and the rest are compatible with the 1.1 MCPX.

Next, some people believed that there was another unknown section between the xcodes and the copyright string. As far as I can tell, that section was to allow the xcode instruction set to expand, as the 5838 instructions are considerably larger than those in the 3944 BIOS.

=== Copyright String ===

57 bytes long with the following start positions:

* 3394 - 0xcfa
* 4034 - 0xcfa
* 4134 - 0xcfa
* 4817 - 0xdb9
* 5101 - 0xe49
* 5530 - 0xe59
* 5713 - 0xe59
* 5838 - 0xdcc

Literally contains the text: "Copyright (c) Microsoft Corporation. All rights reserved.".

=== Kernel ===

Still need to analyse

=== Kernel Data Segment ===

Still need to analyse

=== 2BL ===

Still need to analyse

=== Decoy bootloader ===

This is very similar to the [MCPX ROM], only the xcode interpreter is different, and it doesn't include any decryption/hashing algorithms.

== Known Retail BIOSs ==

* 3394
* 4034
* 4134
* 4817
* 5101
* 5530
* 5713
* 5838

== References ==

* [http://hackspot.net/XboxBlog/?p=1 Understanding the Xbox boot process]

BIOS

2017-03-23T14:01:03Z

Eighthpence: /* Unknown */

The BIOS is either a 1MB or 256KB memory which is loaded to the top 16MB of memory (from 0xFF000000). There are a couple of things to understand in order for this to make sense. First, the 1MB BIOS is actually 256KB of data repeated 4 times. So, if you do:

<pre>
$ split -n 4 xbox.bin
$ md5sum xa*
542c62cb976a4993c8c5027dff9638ce xaa
542c62cb976a4993c8c5027dff9638ce xab
542c62cb976a4993c8c5027dff9638ce xac
542c62cb976a4993c8c5027dff9638ce xad
</pre>

You'll notice it is the same file repeated 4 times. That explains how some BIOS chips are 1MB and some are 256KB. The next thing is that the BIOS is repeated from 0xFF000000 until it fills the rest of memory. In other words, that 256KB of data is repeated 64 times.

== Components ==

The BIOS is split into different components. These are largely the same from BIOS to BIOS, but with some differences.

=== Unknown ===

From 0x00000000 - 0x000000079

Not sure what this does. Some people think it might be involved with initialising the ][MCPX ROM]], but I don't know. The Reset Vector on the Pentium 3 would mean that this wasn't called before the MCPX ROM, but I'm guessing there are people out there who know a lot more about it than me.

=== xcodes ===

From 0x00000080 - Copyright string

These are the xcode operations run by the MCPX interpreter. The first couple of lines appear to be nonsense (they don't execute any functionality), but then the first actual codes that I have found are:

The xcodes in the BIOS versions 3944, 4034, 4134 all start with:
04 10 08 00 80 01 80 00 00

The xcodes in the BIOS versions 4817, 5101, 5530, 5713, 5838 all start with:
04 84 08 00 80 01 80 00 00

This leads me to believe that the first three BIOS versions that I have are compatible with the 1.0 MCPX, and the rest are compatible with the 1.1 MCPX.

Next, some people believed that there was another unknown section between the xcodes and the copyright string. As far as I can tell, that section was to allow the xcode instruction set to expand, as the 5838 instructions are considerably larger than those in the 3944 BIOS.

=== Copyright String ===

57 bytes long with the following start positions:

* 3394 - 0xcfa
* 4034 - 0xcfa
* 4134 - 0xcfa
* 4817 - 0xdb9
* 5101 - 0xe49
* 5530 - 0xe59
* 5713 - 0xe59
* 5838 - 0xdcc

Literally contains the text: "Copyright (c) Microsoft Corporation. All rights reserved.".

=== Kernel ===

Still need to analyse

=== Kernel Data Segment ===

Still need to analyse

=== 2BL ===

Still need to analyse

=== Decoy bootloader ===

This is very similar to the [MCPX ROM], only the xcode interpreter is different, and it doesn't include any decryption/hashing algorithms.

== Known Retail BIOSs ==

* 3394
* 4034
* 4134
* 4817
* 5101
* 5530
* 5713
* 5838

== References ==

* [http://hackspot.net/XboxBlog/?p=1 Understanding the Xbox boot process]

BIOS

2017-03-23T14:00:42Z

Eighthpence: Created page with "The BIOS is either a 1MB or 256KB memory which is loaded to the top 16MB of memory (from 0xFF000000). There are a couple of things to understand in order for this to make sens..."

The BIOS is either a 1MB or 256KB memory which is loaded to the top 16MB of memory (from 0xFF000000). There are a couple of things to understand in order for this to make sense. First, the 1MB BIOS is actually 256KB of data repeated 4 times. So, if you do:

<pre>
$ split -n 4 xbox.bin
$ md5sum xa*
542c62cb976a4993c8c5027dff9638ce xaa
542c62cb976a4993c8c5027dff9638ce xab
542c62cb976a4993c8c5027dff9638ce xac
542c62cb976a4993c8c5027dff9638ce xad
</pre>

You'll notice it is the same file repeated 4 times. That explains how some BIOS chips are 1MB and some are 256KB. The next thing is that the BIOS is repeated from 0xFF000000 until it fills the rest of memory. In other words, that 256KB of data is repeated 64 times.

== Components ==

The BIOS is split into different components. These are largely the same from BIOS to BIOS, but with some differences.

=== Unknown ===

From 0x00000000 - 0x000000079

Not sure what this does. Some people think it might be involved with initialising the [MCPX ROM], but I don't know. The Reset Vector on the Pentium 3 would mean that this wasn't called before the MCPX ROM, but I'm guessing there are people out there who know a lot more about it than me.

=== xcodes ===

From 0x00000080 - Copyright string

These are the xcode operations run by the MCPX interpreter. The first couple of lines appear to be nonsense (they don't execute any functionality), but then the first actual codes that I have found are:

The xcodes in the BIOS versions 3944, 4034, 4134 all start with:
04 10 08 00 80 01 80 00 00

The xcodes in the BIOS versions 4817, 5101, 5530, 5713, 5838 all start with:
04 84 08 00 80 01 80 00 00

This leads me to believe that the first three BIOS versions that I have are compatible with the 1.0 MCPX, and the rest are compatible with the 1.1 MCPX.

Next, some people believed that there was another unknown section between the xcodes and the copyright string. As far as I can tell, that section was to allow the xcode instruction set to expand, as the 5838 instructions are considerably larger than those in the 3944 BIOS.

=== Copyright String ===

57 bytes long with the following start positions:

* 3394 - 0xcfa
* 4034 - 0xcfa
* 4134 - 0xcfa
* 4817 - 0xdb9
* 5101 - 0xe49
* 5530 - 0xe59
* 5713 - 0xe59
* 5838 - 0xdcc

Literally contains the text: "Copyright (c) Microsoft Corporation. All rights reserved.".

=== Kernel ===

Still need to analyse

=== Kernel Data Segment ===

Still need to analyse

=== 2BL ===

Still need to analyse

=== Decoy bootloader ===

This is very similar to the [MCPX ROM], only the xcode interpreter is different, and it doesn't include any decryption/hashing algorithms.

== Known Retail BIOSs ==

* 3394
* 4034
* 4134
* 4817
* 5101
* 5530
* 5713
* 5838

== References ==

* [http://hackspot.net/XboxBlog/?p=1 Understanding the Xbox boot process]

MCPX

2017-03-23T13:18:15Z

Eighthpence: Created page with "The MCPX is the southbridge chip of the Xbox chipset by Nvidia. It contains the sound processors (there are 4 of them) and also the USB, PCI, IDE, etc, controllers (please rem..."

MCPX ROM

2017-03-23T12:21:22Z

Eighthpence: /* Dumping the MCPX ROM */

The purpose of the MCPX ROM is to setup the GPT table, enter 32 bit mode, Enable caching, decrypt the second bootloader (2BL) and then transfer control over to it. It has a fair few things to do, so also contains an interpreter to read instructions from the BIOS (known as xcodes). There are two known versions of the MCPX ROM, 1.0 and 1.1. 1.0 was found in the 1.0 Xbox and used an RC4 algorithm to decrypt the 2BL. After Microsoft found this out, they changed the algorithm to a TEA algorithm. The code on the chips is largely the same, but for those two differences.

== Dumping the MCPX ROM ==

This is no mean feat. In the event of failure, or shortly after the 2BL execution has started, the Xbox executes the following codes:

<pre>
mov eax,0x80000880
mov dx,0xcf8
out dx,eax
</pre>

This turns off the MCPX ROM, making it invisible to anything trying to read it. See [MCPX Dumping] for more details.

== MCPX Common ==

As mentioned, the MCPX chips are largely the same. When the Xbox is powered on, the BIOS is loaded to the top 16 MB of memory (See [BIOS] for more details), and the MCPX ROM overlays the last 512 bytes of that memory. The Reset Vector tells the CPU to start executing code from 0xFFFFFFF0 (well, 0xFFFF:FFF0 due to being in 16 bit mode, but that is beyond the scope of this article). The first thing it does is setup the memory to consist of a 4GB continuous area, and then activates 32 bit mode. Starts executing code from BIOS (starting at 0xFF000080) using the [xcode interpreter]. Next it initialises the MTRR, enables caching, and then things become different.

== MCPX 1.0 ==

The 1.0 ROM runs an RC4 algorithm to decrypt the BL2 from flash (starting at 0xFFFF9E00) and load the unencrypted 2BL to memory (0x90000). It checks the signature of the decrypted 2BL and if it is correct, starts executing code at 0x90000. Otherwise it errors.

== MCPX 1.1 ==

Because of the flaws of the previous method, Microsoft changed the way the 2BL was decrypted. From what I can tell, Microsoft implemented a TEA algorithm to create a hash of a particular section of the BIOS (many times), and if that was correct, it would jump to 0xffffd600. This isn't in Memory, but rather in the BIOS. Otherwise it would error.

== Error Handling ==

The MCPX turns itself off when there is an error and then jumps to 0x000001FA. This is technically in the BIOS (there is no MCPX to read from any more), but the code is still relevant. It pretty much just makes the LEDs flash and hang.

MCPX ROM

2017-03-23T12:17:10Z

Eighthpence: Created page with "The purpose of the MCPX ROM is to setup the GPT table, enter 32 bit mode, Enable caching, decrypt the second bootloader (2BL) and then transfer control over to it. It has a fa..."

The purpose of the MCPX ROM is to setup the GPT table, enter 32 bit mode, Enable caching, decrypt the second bootloader (2BL) and then transfer control over to it. It has a fair few things to do, so also contains an interpreter to read instructions from the BIOS (known as xcodes). There are two known versions of the MCPX ROM, 1.0 and 1.1. 1.0 was found in the 1.0 Xbox and used an RC4 algorithm to decrypt the 2BL. After Microsoft found this out, they changed the algorithm to a TEA algorithm. The code on the chips is largely the same, but for those two differences.

== Dumping the MCPX ROM ==

This is no mean feat. In the event of failure, or shortly after the 2BL execution has started, the Xbox executes the following codes:

<code>mov eax,0x80000880
mov dx,0xcf8
out dx,eax</code>

This turns off the MCPX ROM, making it invisible to anything trying to read it. See [MCPX Dumping] for more details.

== MCPX Common ==

As mentioned, the MCPX chips are largely the same. When the Xbox is powered on, the BIOS is loaded to the top 16 MB of memory (See [BIOS] for more details), and the MCPX ROM overlays the last 512 bytes of that memory. The Reset Vector tells the CPU to start executing code from 0xFFFFFFF0 (well, 0xFFFF:FFF0 due to being in 16 bit mode, but that is beyond the scope of this article). The first thing it does is setup the memory to consist of a 4GB continuous area, and then activates 32 bit mode. Starts executing code from BIOS (starting at 0xFF000080) using the [xcode interpreter]. Next it initialises the MTRR, enables caching, and then things become different.

== MCPX 1.0 ==

The 1.0 ROM runs an RC4 algorithm to decrypt the BL2 from flash (starting at 0xFFFF9E00) and load the unencrypted 2BL to memory (0x90000). It checks the signature of the decrypted 2BL and if it is correct, starts executing code at 0x90000. Otherwise it errors.

== MCPX 1.1 ==

Because of the flaws of the previous method, Microsoft changed the way the 2BL was decrypted. From what I can tell, Microsoft implemented a TEA algorithm to create a hash of a particular section of the BIOS (many times), and if that was correct, it would jump to 0xffffd600. This isn't in Memory, but rather in the BIOS. Otherwise it would error.

== Error Handling ==

The MCPX turns itself off when there is an error and then jumps to 0x000001FA. This is technically in the BIOS (there is no MCPX to read from any more), but the code is still relevant. It pretty much just makes the LEDs flash and hang.

Main Page

2017-03-23T11:26:58Z

Eighthpence: /* xboxdevwiki.net */

== xboxdevwiki.net ==

Please help us fix this mess.
This is an effort to document how the original Microsoft Xbox and the SEGA Chihiro work.
We not only care about technical details about those platforms, but also how to develop homebrew and emulate them.

We are not interested in documenting the Xbox 360, Xbox One or any other console at this point.

This wiki was started by xqemu (Xbox emulator) authors. It will become the place for all remaining Xbox projects to come together.
If you are interested in helping or discussing this, please come chat with us in #xqemu on freenode.

----

Development

* [https://github.com/xqemu/nxdk NXDK (New Xbox Development Kit)]
* [[OpenXDK]]
* [[Microsoft XDK]]

[[Xbox]]

* [[Hardware revisions]]
** [[BIOS]]
** [[MCPX]] [[MCPX ROM|(ROM)]]
* [[Xbox Input Devices]]
* [[Operating System]]
* [[NV2A]]
** [[NV2A/Pixel Combiner]]
** [[NV2A/Fixed Function Pipeline]]
** [[NV2A/Vertex Shader]]
** [[NV2A/Surface Formats]]

[http://segaretro.org/Sega_Chihiro Chihiro]

* [[Chihiro Pictures]]
* [[Chihiro-Tools]]
* [[Chihiro-Launcher]]

Games

* [[Games/Grand Theft Auto 3]]
* [[Games/Grand Theft Auto Vice City]]
* [[Games/Grand Theft Auto San Andreas]]
* [[Games/Kung Fu Chaos]]
* [[Games/Tony Hawk's Pro Skater 2x]]

Emulation / Emulators

* [http://xqemu.com xqemu Xbox emulator]
* [[cxbx-reloaded]]
* [[cxbx]]
* [[dxbx]]
* [[Xeon]]
* [[Hackbox]]
* [[kvmbox]]
* [[MAME/Chihiro]]
* [[MAME/Xbox]]

Find random stuff in [[Resources]]

== Getting started ==

* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Configuration_settings Configuration settings list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:FAQ MediaWiki FAQ]
* [https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce MediaWiki release mailing list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Localisation#Translation_resources Localise MediaWiki for your language]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Combating_spam Learn how to combat spam on your wiki]

Main Page

2017-03-23T11:26:01Z

Eighthpence:

== xboxdevwiki.net ==

Please help us fix this mess.
This is an effort to document how the original Microsoft Xbox and the SEGA Chihiro work.
We not only care about technical details about those platforms, but also how to develop homebrew and emulate them.

We are not interested in documenting the Xbox 360, Xbox One or any other console at this point.

This wiki was started by xqemu (Xbox emulator) authors. It will become the place for all remaining Xbox projects to come together.
If you are interested in helping or discussing this, please come chat with us in #xqemu on freenode.

----

Development

* [https://github.com/xqemu/nxdk NXDK (New Xbox Development Kit)]
* [[OpenXDK]]
* [[Microsoft XDK]]

[[Xbox]]

* [[Hardware revisions]]
** [[BIOS]]
** [[MCPX]]
* [[Xbox Input Devices]]
* [[Operating System]]
* [[NV2A]]
** [[NV2A/Pixel Combiner]]
** [[NV2A/Fixed Function Pipeline]]
** [[NV2A/Vertex Shader]]
** [[NV2A/Surface Formats]]

[http://segaretro.org/Sega_Chihiro Chihiro]

* [[Chihiro Pictures]]
* [[Chihiro-Tools]]
* [[Chihiro-Launcher]]

Games

* [[Games/Grand Theft Auto 3]]
* [[Games/Grand Theft Auto Vice City]]
* [[Games/Grand Theft Auto San Andreas]]
* [[Games/Kung Fu Chaos]]
* [[Games/Tony Hawk's Pro Skater 2x]]

Emulation / Emulators

* [http://xqemu.com xqemu Xbox emulator]
* [[cxbx-reloaded]]
* [[cxbx]]
* [[dxbx]]
* [[Xeon]]
* [[Hackbox]]
* [[kvmbox]]
* [[MAME/Chihiro]]
* [[MAME/Xbox]]

Find random stuff in [[Resources]]

== Getting started ==

* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Configuration_settings Configuration settings list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:FAQ MediaWiki FAQ]
* [https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce MediaWiki release mailing list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Localisation#Translation_resources Localise MediaWiki for your language]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Combating_spam Learn how to combat spam on your wiki]

Main Page

2017-03-23T11:25:51Z

Eighthpence:

== xboxdevwiki.net ==

Please help us fix this mess.
This is an effort to document how the original Microsoft Xbox and the SEGA Chihiro work.
We not only care about technical details about those platforms, but also how to develop homebrew and emulate them.

We are not interested in documenting the Xbox 360, Xbox One or any other console at this point.

This wiki was started by xqemu (Xbox emulator) authors. It will become the place for all remaining Xbox projects to come together.
If you are interested in helping or discussing this, please come chat with us in #xqemu on freenode.

----

Development

* [https://github.com/xqemu/nxdk NXDK (New Xbox Development Kit)]
* [[OpenXDK]]
* [[Microsoft XDK]]

[[Xbox]]

* [[Hardware revisions]]
** [[Bios]]
** [[MCPX]]
* [[Xbox Input Devices]]
* [[Operating System]]
* [[NV2A]]
** [[NV2A/Pixel Combiner]]
** [[NV2A/Fixed Function Pipeline]]
** [[NV2A/Vertex Shader]]
** [[NV2A/Surface Formats]]

[http://segaretro.org/Sega_Chihiro Chihiro]

* [[Chihiro Pictures]]
* [[Chihiro-Tools]]
* [[Chihiro-Launcher]]

Games

* [[Games/Grand Theft Auto 3]]
* [[Games/Grand Theft Auto Vice City]]
* [[Games/Grand Theft Auto San Andreas]]
* [[Games/Kung Fu Chaos]]
* [[Games/Tony Hawk's Pro Skater 2x]]

Emulation / Emulators

* [http://xqemu.com xqemu Xbox emulator]
* [[cxbx-reloaded]]
* [[cxbx]]
* [[dxbx]]
* [[Xeon]]
* [[Hackbox]]
* [[kvmbox]]
* [[MAME/Chihiro]]
* [[MAME/Xbox]]

Find random stuff in [[Resources]]

== Getting started ==

* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Configuration_settings Configuration settings list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:FAQ MediaWiki FAQ]
* [https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce MediaWiki release mailing list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Localisation#Translation_resources Localise MediaWiki for your language]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Combating_spam Learn how to combat spam on your wiki]

Hardware Revisions

2017-03-23T10:50:08Z

Eighthpence: Base page creation

There are 7 Xbox revisions

== 1.0 ==

* Made in Hungary
* USB controller is on a separate PCB
* GPU has a fan on the heat sink
* MCPX 1.0 ROM
* Thomson DVD Drive
* Seagate Hard Drive
* Conexant Video Chip

== 1.1 ==

Same as 1.0, except:
* Made in Hungary or Mexico
* USB controller moved onto the motherboard
* Fan removed from the GPU heat sink
* MCPX 1.1 ROM

== 1.2 ==

Same as 1.1, except:
* Made in China
* Philips DVD Drive
* Western Digital Hard Drive

== 1.3 ==
Same as 1.2, except:
* Samsung DVD Drive
* Seagate Hard Drive

== 1.4 ==

Same as 1.3, except:
* Western Digital Hard Drive
* Focus video chip

== 1.5 ==

Same as 1.4. Possibly never existed, but will otherwise be very rare. Production was halted and 1.4 was produced again.

== 1.6 ==

Same as 1.4, except:
* Made in China or Taiwan
* BIOS no longer flashable
* Removed data and power lines from LPC port
* Xcalibur video chip

== Identifying ==

While not definitive, here are some ways to help identify the revision of your Xbox.

=== Manufacturing Details ===

{|
! scope="col" | Date Range
! scope="col" | Revision
! scope="col" | Location
|-
| 01/2001-10/2002 || 1.0 || Hungary
|-
| 11/2002-04/2003 || 1.1 || Hungary, Mexico
|-
| 05/2003-03/2004 || 1.2 || China
|-
| 04/2004 Onward || 1.6 || China, Taiwan
|}

=== Serial Number ===

The serial number looks like this:

LNNNNNN TWWFF

L is the production line
NNNNNN is the number produced that week
Y is the last digit of the production year
WW is the number of the week
FF is the factory code

Note, this table contradicts the previous table.

{|
! scope="col" | Factory
! scope="col" | Location
! scope="col" | Revision
|-
| 02 || Mexico || 1.0 or 1.1
|-
| 03 || Hungary || 1.0
|-
| 05 || China || 1.2 or later
|-
| 06 || Taiwan || 1.2 or later
|}

{|
! scope="col" | Serial Number
! scope="col" | Revision
|-
| LNNNNNN 20WFF || 1.0
|-
| LNNNNNN 21WFF || 1.0
|-
| LNNNNNN 23WFF || 1.0 or 1.1
|-
| LNNNNNN 24WFF || 1.1
|-
| LNNNNNN 25WFF || 1.1
|-
| LNNNNNN 30WFF || 1.2
|-
| LNNNNNN 31WFF || 1.3
|-
| LNNNNNN 32WFF || 1.3
|-
| LNNNNNN 33WFF || 1.4 or 1.5
|-
| LNNNNNN 42WFF || 1.6
|}

{|
! scope="col" | Video Chip
! scope="col" | Revision
|-
| Conexant || 1.0, 1.1, 1.2, 1.3
|-
| Focus || 1.4, 1.5
|-
| Xcalibur || 1.6
|}

=== BIOS Version ===

{|
! scope="col" | Kernel Version
! scope="col" | Revision
|-
| 3944, 4034, 4036, 4627 || 1.0
|-
| 4817, 4972 || 1.1
|-
| 5101, 5713 || 1.2 - 1.5
|-
| 5838 || 1.6
|}

== References ==

* [http://www.informit.com/articles/article.aspx?p=367210&seqNum=2 InformIT Methods of Identification]
* [http://www.informit.com/articles/article.aspx?p=367210 InformIT Identifying your Xbox Revision]