<?xml version="1.0"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
		<id>https://xboxdevwiki.net/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Espes</id>
		<title>xboxdevwiki - User contributions [en]</title>
		<link rel="self" type="application/atom+xml" href="https://xboxdevwiki.net/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Espes"/>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/Special:Contributions/Espes"/>
		<updated>2026-05-23T22:46:50Z</updated>
		<subtitle>User contributions</subtitle>
		<generator>MediaWiki 1.28.0</generator>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Emulators&amp;diff=6936</id>
		<title>Emulators</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Emulators&amp;diff=6936"/>
				<updated>2021-05-11T13:46:32Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This is a list of known Xbox emulation projects&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable sortable&amp;quot;&lt;br /&gt;
!Status&lt;br /&gt;
!Approach&lt;br /&gt;
!Chihiro&lt;br /&gt;
!Name&lt;br /&gt;
!Links&lt;br /&gt;
!Initiator&lt;br /&gt;
!Platform&lt;br /&gt;
!License&lt;br /&gt;
!Notes&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{Yes}}&lt;br /&gt;
|[[XQEMU]]&lt;br /&gt;
|[http://xqemu.com/][https://github.com/xqemu/][https://github.com/espes/xqemu]&lt;br /&gt;
|espes&lt;br /&gt;
|Windows/macOS/Linux/Others	&lt;br /&gt;
|&lt;br /&gt;
|XQEMU supports hardware-acceleration for the CPU emulation on Linux through KVM.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{Yes}}&lt;br /&gt;
|[[Xemu|xemu]]&lt;br /&gt;
|[https://xemu.app/][https://github.com/mborgerson/xemu]&lt;br /&gt;
|mborgerson&lt;br /&gt;
|Windows/macOS/Linux&lt;br /&gt;
|&lt;br /&gt;
|xemu is a fork of XQEMU but more usable&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|HLE/LLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[[Cxbx-Reloaded]]&lt;br /&gt;
|[http://cxbx-reloaded.co.uk/][https://github.com/Cxbx-Reloaded/Cxbx-Reloaded]&lt;br /&gt;
|SoullessSentinel&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|Cxbx-Reloaded supports LLE GPU emulation which was taken from XQEMU. At the time of writing, the LLE GPU is significantly slower than in XQEMU.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{Yes}}&lt;br /&gt;
|[http://mamedev.org/ MAME]&lt;br /&gt;
|[http://adb.arcadeitalia.net/?mame=xbox][http://adb.arcadeitalia.net/?mame=chihiro][http://emulation.gametechwiki.com/index.php/MAME_compatibility_list#Xbox][http://emulation.gametechwiki.com/index.php/MAME_compatibility_list#Chihiro_Arcade]&lt;br /&gt;
|[https://github.com/mamedev/mame/commits?author=yz70s yz70s] (Samuele Zannoli) and MAME Team&lt;br /&gt;
|Windows/macOS/Linux/Others&lt;br /&gt;
|&lt;br /&gt;
|Focus seems to be on Chihiro emulation.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[[Fusion]][http://michaelbrundage.com/project/xbox-360-emulator/]&lt;br /&gt;
|&lt;br /&gt;
|Microsoft&lt;br /&gt;
|Xbox 360&lt;br /&gt;
|Proprietary&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|LLE/HLE Hybrid{{citation needed}}&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[[Fission]][http://www.ign.com/articles/2017/10/23/the-untold-story-of-xbox-one-backwards-compatibility]&lt;br /&gt;
|[http://www.xbox.com/en-US/xbox-one/backward-compatibility]&lt;br /&gt;
|Microsoft&lt;br /&gt;
|Xbox One&lt;br /&gt;
|Proprietary&lt;br /&gt;
|Announced at E3 2017. Said to be working similar to the 360 support in the Xbox One [https://youtu.be/x0NKP7-h_G0?t=8503]. The 360 support is probably ahead of time shader translation and runtime CPU translation [https://majornelson.com/podcast/584-xbox-one-backward-compatibility-turns-1/].&lt;br /&gt;
|&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|Tortoise&lt;br /&gt;
|[https://gitlab.com/kvmbox-reloaded/]&lt;br /&gt;
|JayFoxRox, phire&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|The decision was made to create an HLE / LLE Xbox emulation project which is maintained similar to Dolphin or Citra. A key focus was on design simplicity. The project started as a continuation of kvmbox, with devices being copied from the XQEMU source code. The project was called kvmbox-reloaded, while the name was being decided. The HLE portion was never worked on.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|OpenXBOX&lt;br /&gt;
|[https://github.com/mborgerson/OpenXBOX]&lt;br /&gt;
|mborgerson&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|HLE/LLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|xexec&lt;br /&gt;
|&lt;br /&gt;
|[http://xboxdevwiki.net/User:Haxar Haxar]&lt;br /&gt;
|Linux&lt;br /&gt;
|&lt;br /&gt;
|Xexec is an Xbox executable loader &amp;amp; emulator for x86/x64 Linux; handles direct execution of x86 code, executing Xbox game code directly on the CPU, in userspace Linux; All Windows kernel calls from Xbox game code are translated into POSIX syscalls, with no dependency on Wine.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/blueshogun96/MacBox MacBox]&lt;br /&gt;
|[http://shogun3d-cxbx.blogspot.com/2017/01/the-macos-experiment-part-1.html][http://shogun3d-cxbx.blogspot.com/2017/01/around-beginning-of-new-year-i.html]&lt;br /&gt;
|blueshogun96&lt;br /&gt;
|macOS&lt;br /&gt;
|&lt;br /&gt;
|&amp;quot;The macOS Experiment&amp;quot; - An experimental VM for Macs that don't have support for the official VM framework. A simple proof of concept.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|StrikeBox&lt;br /&gt;
|[https://github.com/StrikerX3/StrikeBox]&lt;br /&gt;
|StrikerX3&lt;br /&gt;
|Windows/Linux&lt;br /&gt;
|&lt;br /&gt;
|A fork of OpenXBOX, which was turned into a separate project.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[[Cxbx]]&lt;br /&gt;
|&lt;br /&gt;
|Caustik&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|Dxbx&lt;br /&gt;
|[http://dxbx-emu.com][https://github.com/PatrickvL/Dxbx/]&lt;br /&gt;
|ShadowTj&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|The project was started on March 23rd 2008. It is an improved port of Cxbx to the Delphi programming language.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/impeachgod/Dirtbox Dirtbox]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://sourceforge.net/p/ironbabel/code/HEAD/tree/trunk/Box/Xbox/ IronBabel]&lt;br /&gt;
|&lt;br /&gt;
|daeken&lt;br /&gt;
|Unknown&lt;br /&gt;
|&lt;br /&gt;
|This seems to have been a generic portability framework&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/daeken/Steelbreeze Steelbreeze]&lt;br /&gt;
|&lt;br /&gt;
|daeken&lt;br /&gt;
|Unknown&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/daeken/Zookeeper Zookeeper]&lt;br /&gt;
|[https://www.reddit.com/r/EmuDev/comments/4isyvu/project_zookeeper_a_new_xbox_emulator/]&lt;br /&gt;
|daeken&lt;br /&gt;
|macOS&lt;br /&gt;
|&lt;br /&gt;
|Using Apple's Hypervisor.framework to run a custom kernel (NightBeliever in the repo) and then running Xbox code from there&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[http://ngemu.com/threads/.154342/ XbeNext]&lt;br /&gt;
|[https://github.com/LoveMHz/XBENext]&lt;br /&gt;
|LoveMHz&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[http://ngemu.com/forums/.65/ Xeon]&lt;br /&gt;
|&lt;br /&gt;
|_SF_&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[http://ngemu.com/threads/.105210/ XProject]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://code.google.com/p/xbem xbem]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{Yes}}&lt;br /&gt;
|Hackbox&lt;br /&gt;
|&lt;br /&gt;
|JayFoxRox&lt;br /&gt;
|Windows/Linux&lt;br /&gt;
|Private&lt;br /&gt;
|This was originally going to be a commercial emulator (but plans were dropped quickly in favor of preservation). The source code was temporarily public but then made private. The source code is still available to a selected group of developers. Hackbox was designed from scratch but re-used code from Cxbx for HLE routine detection.&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/phire/kvmbox kvmbox]&lt;br /&gt;
|&lt;br /&gt;
|phire&lt;br /&gt;
|Linux&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/Gabriel-Maldonado/XboxHLE XboxHLE]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/bjh83/boombox boombox]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/docbrown/vxb vxb]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/quantumdude836/exciplex exciplex]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/monocasa/xbvm XBVM]&lt;br /&gt;
|&lt;br /&gt;
|monocasa&lt;br /&gt;
|Linux&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[http://xenoborg-emu.blogspot.com/ Xenoborg]&lt;br /&gt;
|&lt;br /&gt;
|blueshogun96&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== References and links == &lt;br /&gt;
&lt;br /&gt;
* [https://www.reddit.com/r/emulation/comments/6a958p/cxbx_reloaded_xbox_emulator_panzer_dragoon_orta/ Discussion about Xbox emulation and technical differences between [[Cxbx-Reloaded]] and [[XQEMU]]]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=6935</id>
		<title>Main Page</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=6935"/>
				<updated>2021-05-11T13:46:02Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: /* Emulation */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{:Main Page/Header}}&lt;br /&gt;
__NOTOC__&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
* [[Chihiro]]&lt;br /&gt;
* [[Xbox]]&lt;br /&gt;
&lt;br /&gt;
* [[Hardware Revisions]]&lt;br /&gt;
* [[Motherboard]]&lt;br /&gt;
* [[CPU]]&lt;br /&gt;
* [[NV2A]]&lt;br /&gt;
** [[NV2A/Vertex attributes]]&lt;br /&gt;
** [[NV2A/Fixed Function Pipeline]]&lt;br /&gt;
** [[NV2A/Vertex Shader]]&lt;br /&gt;
** [[NV2A/Pixel Combiner]]&lt;br /&gt;
** [[NV2A/Surface Formats]]&lt;br /&gt;
* [[Memory]]&lt;br /&gt;
* [[Flash ROM]]&lt;br /&gt;
* [[MCPX]]&lt;br /&gt;
** [[LPC_Debug_Port|LPC]]&lt;br /&gt;
** [[APU]]&lt;br /&gt;
*** [[DSP]]&lt;br /&gt;
** [[ACI]]&lt;br /&gt;
** [[Network]]&lt;br /&gt;
* [[PCI]]&lt;br /&gt;
* [[SMBus]]&lt;br /&gt;
** [[EEPROM]]&lt;br /&gt;
** [[SMC]]&lt;br /&gt;
** [[Video Encoder]]&lt;br /&gt;
*** [[AV Cables]]&lt;br /&gt;
* [[DVD Drive]]&lt;br /&gt;
** [[Xbox Game Disc]]&lt;br /&gt;
* [[Hard Drive]]&lt;br /&gt;
** [[Config Sector]]&lt;br /&gt;
* [[USB]]&lt;br /&gt;
** [[Xbox Input Devices]]&lt;br /&gt;
** [[Xbox Memory Unit]]&lt;br /&gt;
** [[Xbox Live Communicator]] &amp;lt;!-- Maybe rename this to microphones later? --&amp;gt;&lt;br /&gt;
** [[Xbox DVD Movie Playback Kit]]&lt;br /&gt;
* [[Power Supply]]&lt;br /&gt;
* [[Development Kits]]&lt;br /&gt;
** [[Super I/O]]&lt;br /&gt;
** [[DVD Emulator]]&lt;br /&gt;
* [[Manufacturing Process]]&lt;br /&gt;
&lt;br /&gt;
== System Software ==&lt;br /&gt;
* [[MCPX ROM]]&lt;br /&gt;
* [[BIOS]] / [[Kernel]]&lt;br /&gt;
** [[Boot Process]]&lt;br /&gt;
** [[XBE]] (Executable file format)&lt;br /&gt;
* [[FATX]] (Filesystem)&lt;br /&gt;
* [[Xbox ADPCM]]&lt;br /&gt;
* [[Dashboard]]&lt;br /&gt;
** [[Soundtracks]]&lt;br /&gt;
** [[Fatal Error]]&lt;br /&gt;
* [[Exploits]]&lt;br /&gt;
&lt;br /&gt;
== Development Kits and Tools ==&lt;br /&gt;
* [https://github.com/xqemu/nxdk nxdk (New Xbox Development Kit)]&lt;br /&gt;
* [[OpenXDK]]&lt;br /&gt;
* [[Microsoft XDK]]&lt;br /&gt;
** [[Xbox Title Libraries]]&lt;br /&gt;
** [[Direct3D]]&lt;br /&gt;
** [[DirectSound]]&lt;br /&gt;
** [[System Link]]&lt;br /&gt;
** [[Xbox Live]]&lt;br /&gt;
*** [[Xbox Live/Connection Test|Connection Test]]&lt;br /&gt;
*** [[Xbox Live/Machine Account|Machine Account]]&lt;br /&gt;
** [[Xbox Debug Monitor]]&lt;br /&gt;
** [[Xbox Neighborhood]]&lt;br /&gt;
** [[Kernel_Debug|Xbox Kernel Debugging]]&lt;br /&gt;
&lt;br /&gt;
== Games ==&lt;br /&gt;
* [[:Category:Games|Games]]&lt;br /&gt;
* [[Engine List]]&lt;br /&gt;
&lt;br /&gt;
== Emulation ==&lt;br /&gt;
* [[Emulators]]&lt;br /&gt;
** [[Xemu|xemu]]&lt;br /&gt;
** [[Cxbx-Reloaded]]&lt;br /&gt;
** [[XQEMU]]&lt;br /&gt;
** [[Fusion]]&lt;br /&gt;
** [[Fission]]&lt;br /&gt;
&lt;br /&gt;
== Historical Pages ==&lt;br /&gt;
(archived from the xbox-linux wiki)&lt;br /&gt;
* [[Xbox Hard Drive Locking Mechanism]]&lt;br /&gt;
* [[Xbox Savegame System]]&lt;br /&gt;
* [[Xbox Hardware Overview]]&lt;br /&gt;
* [[Xbox Hard Disk Technical_Details]]&lt;br /&gt;
* [[Xbox Hard Disk Partitioning]]&lt;br /&gt;
* [[Xbox Manufacturing Process]]&lt;br /&gt;
* [[The Hidden Boot Code of the Xbox]]&lt;br /&gt;
* [[PIC]]&lt;br /&gt;
* [[SMBus]]&lt;br /&gt;
* [[NForce]]&lt;br /&gt;
* [[17 Mistakes Microsoft Made in the Xbox Security System]]&lt;br /&gt;
* [[Porting an Operating System to the Xbox HOWTO]]&lt;br /&gt;
&lt;br /&gt;
== Other ==&lt;br /&gt;
* [[Patents]]&lt;br /&gt;
* [[Resources]]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Xemu&amp;diff=6934</id>
		<title>Xemu</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Xemu&amp;diff=6934"/>
				<updated>2021-05-11T13:41:15Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: Espes moved page XEMU to Xemu without leaving a redirect&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;xemu is a continuation of xqemu which is a low-level Xbox / Chihiro Emulator started in mid-late 2012 by espes[https://github.com/espes/xqemu/commit/d823f5802e7c4c84163aea8b4d924044951c705e].&lt;br /&gt;
&lt;br /&gt;
xemu was started in early 2020 by mborgerson[https://github.com/mborgerson]&lt;br /&gt;
&lt;br /&gt;
The official homepage is https://xemu.app&lt;br /&gt;
&lt;br /&gt;
== Compatibility list ==&lt;br /&gt;
&lt;br /&gt;
Compatibility list can be found at https://xemu.app/#compatibility.&lt;br /&gt;
&lt;br /&gt;
== Features ==&lt;br /&gt;
&lt;br /&gt;
Currently the features that are supported are Gamepad Support, System Link, Snapshots (Save States).&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=6933</id>
		<title>Main Page</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=6933"/>
				<updated>2021-05-11T13:28:44Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: /* Emulation */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{:Main Page/Header}}&lt;br /&gt;
__NOTOC__&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
* [[Chihiro]]&lt;br /&gt;
* [[Xbox]]&lt;br /&gt;
&lt;br /&gt;
* [[Hardware Revisions]]&lt;br /&gt;
* [[Motherboard]]&lt;br /&gt;
* [[CPU]]&lt;br /&gt;
* [[NV2A]]&lt;br /&gt;
** [[NV2A/Vertex attributes]]&lt;br /&gt;
** [[NV2A/Fixed Function Pipeline]]&lt;br /&gt;
** [[NV2A/Vertex Shader]]&lt;br /&gt;
** [[NV2A/Pixel Combiner]]&lt;br /&gt;
** [[NV2A/Surface Formats]]&lt;br /&gt;
* [[Memory]]&lt;br /&gt;
* [[Flash ROM]]&lt;br /&gt;
* [[MCPX]]&lt;br /&gt;
** [[LPC_Debug_Port|LPC]]&lt;br /&gt;
** [[APU]]&lt;br /&gt;
*** [[DSP]]&lt;br /&gt;
** [[ACI]]&lt;br /&gt;
** [[Network]]&lt;br /&gt;
* [[PCI]]&lt;br /&gt;
* [[SMBus]]&lt;br /&gt;
** [[EEPROM]]&lt;br /&gt;
** [[SMC]]&lt;br /&gt;
** [[Video Encoder]]&lt;br /&gt;
*** [[AV Cables]]&lt;br /&gt;
* [[DVD Drive]]&lt;br /&gt;
** [[Xbox Game Disc]]&lt;br /&gt;
* [[Hard Drive]]&lt;br /&gt;
** [[Config Sector]]&lt;br /&gt;
* [[USB]]&lt;br /&gt;
** [[Xbox Input Devices]]&lt;br /&gt;
** [[Xbox Memory Unit]]&lt;br /&gt;
** [[Xbox Live Communicator]] &amp;lt;!-- Maybe rename this to microphones later? --&amp;gt;&lt;br /&gt;
** [[Xbox DVD Movie Playback Kit]]&lt;br /&gt;
* [[Power Supply]]&lt;br /&gt;
* [[Development Kits]]&lt;br /&gt;
** [[Super I/O]]&lt;br /&gt;
** [[DVD Emulator]]&lt;br /&gt;
* [[Manufacturing Process]]&lt;br /&gt;
&lt;br /&gt;
== System Software ==&lt;br /&gt;
* [[MCPX ROM]]&lt;br /&gt;
* [[BIOS]] / [[Kernel]]&lt;br /&gt;
** [[Boot Process]]&lt;br /&gt;
** [[XBE]] (Executable file format)&lt;br /&gt;
* [[FATX]] (Filesystem)&lt;br /&gt;
* [[Xbox ADPCM]]&lt;br /&gt;
* [[Dashboard]]&lt;br /&gt;
** [[Soundtracks]]&lt;br /&gt;
** [[Fatal Error]]&lt;br /&gt;
* [[Exploits]]&lt;br /&gt;
&lt;br /&gt;
== Development Kits and Tools ==&lt;br /&gt;
* [https://github.com/xqemu/nxdk nxdk (New Xbox Development Kit)]&lt;br /&gt;
* [[OpenXDK]]&lt;br /&gt;
* [[Microsoft XDK]]&lt;br /&gt;
** [[Xbox Title Libraries]]&lt;br /&gt;
** [[Direct3D]]&lt;br /&gt;
** [[DirectSound]]&lt;br /&gt;
** [[System Link]]&lt;br /&gt;
** [[Xbox Live]]&lt;br /&gt;
*** [[Xbox Live/Connection Test|Connection Test]]&lt;br /&gt;
*** [[Xbox Live/Machine Account|Machine Account]]&lt;br /&gt;
** [[Xbox Debug Monitor]]&lt;br /&gt;
** [[Xbox Neighborhood]]&lt;br /&gt;
** [[Kernel_Debug|Xbox Kernel Debugging]]&lt;br /&gt;
&lt;br /&gt;
== Games ==&lt;br /&gt;
* [[:Category:Games|Games]]&lt;br /&gt;
* [[Engine List]]&lt;br /&gt;
&lt;br /&gt;
== Emulation ==&lt;br /&gt;
* [[Emulators]]&lt;br /&gt;
** [[XEMU]]&lt;br /&gt;
** [[Cxbx-Reloaded]]&lt;br /&gt;
** [[XQEMU]]&lt;br /&gt;
** [[Fusion]]&lt;br /&gt;
** [[Fission]]&lt;br /&gt;
&lt;br /&gt;
== Historical Pages ==&lt;br /&gt;
(archived from the xbox-linux wiki)&lt;br /&gt;
* [[Xbox Hard Drive Locking Mechanism]]&lt;br /&gt;
* [[Xbox Savegame System]]&lt;br /&gt;
* [[Xbox Hardware Overview]]&lt;br /&gt;
* [[Xbox Hard Disk Technical_Details]]&lt;br /&gt;
* [[Xbox Hard Disk Partitioning]]&lt;br /&gt;
* [[Xbox Manufacturing Process]]&lt;br /&gt;
* [[The Hidden Boot Code of the Xbox]]&lt;br /&gt;
* [[PIC]]&lt;br /&gt;
* [[SMBus]]&lt;br /&gt;
* [[NForce]]&lt;br /&gt;
* [[17 Mistakes Microsoft Made in the Xbox Security System]]&lt;br /&gt;
* [[Porting an Operating System to the Xbox HOWTO]]&lt;br /&gt;
&lt;br /&gt;
== Other ==&lt;br /&gt;
* [[Patents]]&lt;br /&gt;
* [[Resources]]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Emulators&amp;diff=6880</id>
		<title>Emulators</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Emulators&amp;diff=6880"/>
				<updated>2020-09-01T13:43:52Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This is a list of known Xbox emulation projects&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable sortable&amp;quot;&lt;br /&gt;
!Status&lt;br /&gt;
!Approach&lt;br /&gt;
!Chihiro&lt;br /&gt;
!Name&lt;br /&gt;
!Links&lt;br /&gt;
!Initiator&lt;br /&gt;
!Platform&lt;br /&gt;
!License&lt;br /&gt;
!Notes&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{Yes}}&lt;br /&gt;
|[[XQEMU]]&lt;br /&gt;
|[http://xqemu.com/][https://github.com/xqemu/][https://github.com/espes/xqemu]&lt;br /&gt;
|espes&lt;br /&gt;
|Windows/macOS/Linux/Others	&lt;br /&gt;
|&lt;br /&gt;
|XQEMU supports hardware-acceleration for the CPU emulation on Linux through KVM.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{Yes}}&lt;br /&gt;
|xemu&lt;br /&gt;
|[https://xemu.app/][https://github.com/mborgerson/xemu]&lt;br /&gt;
|mborgerson&lt;br /&gt;
|Windows/macOS/Linux&lt;br /&gt;
|&lt;br /&gt;
|xemu is a fork of XQEMU but more usable&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|HLE/LLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[[Cxbx-Reloaded]]&lt;br /&gt;
|[http://cxbx-reloaded.co.uk/][https://github.com/Cxbx-Reloaded/Cxbx-Reloaded]&lt;br /&gt;
|SoullessSentinel&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|Cxbx-Reloaded supports LLE GPU emulation which was taken from XQEMU. At the time of writing, the LLE GPU is significantly slower than in XQEMU.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{Yes}}&lt;br /&gt;
|[http://mamedev.org/ MAME]&lt;br /&gt;
|[http://adb.arcadeitalia.net/?mame=xbox][http://adb.arcadeitalia.net/?mame=chihiro][http://emulation.gametechwiki.com/index.php/MAME_compatibility_list#Xbox][http://emulation.gametechwiki.com/index.php/MAME_compatibility_list#Chihiro_Arcade]&lt;br /&gt;
|[https://github.com/mamedev/mame/commits?author=yz70s yz70s] (Samuele Zannoli) and MAME Team&lt;br /&gt;
|Windows/macOS/Linux/Others&lt;br /&gt;
|&lt;br /&gt;
|Focus seems to be on Chihiro emulation.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[[Fusion]][http://michaelbrundage.com/project/xbox-360-emulator/]&lt;br /&gt;
|&lt;br /&gt;
|Microsoft&lt;br /&gt;
|Xbox 360&lt;br /&gt;
|Proprietary&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|LLE/HLE Hybrid{{citation needed}}&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[[Fission]][http://www.ign.com/articles/2017/10/23/the-untold-story-of-xbox-one-backwards-compatibility]&lt;br /&gt;
|[http://www.xbox.com/en-US/xbox-one/backward-compatibility]&lt;br /&gt;
|Microsoft&lt;br /&gt;
|Xbox One&lt;br /&gt;
|Proprietary&lt;br /&gt;
|Announced at E3 2017. Said to be working similar to the 360 support in the Xbox One [https://youtu.be/x0NKP7-h_G0?t=8503]. The 360 support is probably ahead of time shader translation and runtime CPU translation [https://majornelson.com/podcast/584-xbox-one-backward-compatibility-turns-1/].&lt;br /&gt;
|&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|Tortoise&lt;br /&gt;
|[https://gitlab.com/kvmbox-reloaded/]&lt;br /&gt;
|JayFoxRox, phire&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|The decision was made to create an HLE / LLE Xbox emulation project which is maintained similar to Dolphin or Citra. A key focus was on design simplicity. The project started as a continuation of kvmbox, with devices being copied from the XQEMU source code. The project was called kvmbox-reloaded, while the name was being decided. The HLE portion was never worked on.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|OpenXBOX&lt;br /&gt;
|[https://github.com/mborgerson/OpenXBOX]&lt;br /&gt;
|mborgerson&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|HLE/LLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|xexec&lt;br /&gt;
|&lt;br /&gt;
|[http://xboxdevwiki.net/User:Haxar Haxar]&lt;br /&gt;
|Linux&lt;br /&gt;
|&lt;br /&gt;
|Xexec is an Xbox executable loader &amp;amp; emulator for x86/x64 Linux; handles direct execution of x86 code, executing Xbox game code directly on the CPU, in userspace Linux; All Windows kernel calls from Xbox game code are translated into POSIX syscalls, with no dependency on Wine.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/blueshogun96/MacBox MacBox]&lt;br /&gt;
|[http://shogun3d-cxbx.blogspot.com/2017/01/the-macos-experiment-part-1.html][http://shogun3d-cxbx.blogspot.com/2017/01/around-beginning-of-new-year-i.html]&lt;br /&gt;
|blueshogun96&lt;br /&gt;
|macOS&lt;br /&gt;
|&lt;br /&gt;
|&amp;quot;The macOS Experiment&amp;quot; - An experimental VM for Macs that don't have support for the official VM framework. A simple proof of concept.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|StrikeBox&lt;br /&gt;
|[https://github.com/StrikerX3/StrikeBox]&lt;br /&gt;
|StrikerX3&lt;br /&gt;
|Windows/Linux&lt;br /&gt;
|&lt;br /&gt;
|A fork of OpenXBOX, which was turned into a separate project.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[[Cxbx]]&lt;br /&gt;
|&lt;br /&gt;
|Caustik&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|Dxbx&lt;br /&gt;
|[http://dxbx-emu.com][https://github.com/PatrickvL/Dxbx/]&lt;br /&gt;
|ShadowTj&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|The project was started on March 23rd 2008. It is an improved port of Cxbx to the Delphi programming language.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/impeachgod/Dirtbox Dirtbox]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://sourceforge.net/p/ironbabel/code/HEAD/tree/trunk/Box/Xbox/ IronBabel]&lt;br /&gt;
|&lt;br /&gt;
|daeken&lt;br /&gt;
|Unknown&lt;br /&gt;
|&lt;br /&gt;
|This seems to have been a generic portability framework&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/daeken/Steelbreeze Steelbreeze]&lt;br /&gt;
|&lt;br /&gt;
|daeken&lt;br /&gt;
|Unknown&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/daeken/Zookeeper Zookeeper]&lt;br /&gt;
|[https://www.reddit.com/r/EmuDev/comments/4isyvu/project_zookeeper_a_new_xbox_emulator/]&lt;br /&gt;
|daeken&lt;br /&gt;
|macOS&lt;br /&gt;
|&lt;br /&gt;
|Using Apple's Hypervisor.framework to run a custom kernel (NightBeliever in the repo) and then running Xbox code from there&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[http://ngemu.com/threads/.154342/ XbeNext]&lt;br /&gt;
|[https://github.com/LoveMHz/XBENext]&lt;br /&gt;
|LoveMHz&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[http://ngemu.com/forums/.65/ Xeon]&lt;br /&gt;
|&lt;br /&gt;
|_SF_&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[http://ngemu.com/threads/.105210/ XProject]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://code.google.com/p/xbem xbem]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{Yes}}&lt;br /&gt;
|Hackbox&lt;br /&gt;
|&lt;br /&gt;
|JayFoxRox&lt;br /&gt;
|Windows/Linux&lt;br /&gt;
|Private&lt;br /&gt;
|This was originally going to be a commercial emulator (but plans were dropped quickly in favor of preservation). The source code was temporarily public but then made private. The source code is still available to a selected group of developers. Hackbox was designed from scratch but re-used code from Cxbx for HLE routine detection.&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/phire/kvmbox kvmbox]&lt;br /&gt;
|&lt;br /&gt;
|phire&lt;br /&gt;
|Linux&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/Gabriel-Maldonado/XboxHLE XboxHLE]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/bjh83/boombox boombox]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/docbrown/vxb vxb]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/quantumdude836/exciplex exciplex]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/monocasa/xbvm XBVM]&lt;br /&gt;
|&lt;br /&gt;
|monocasa&lt;br /&gt;
|Linux&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[http://xenoborg-emu.blogspot.com/ Xenoborg]&lt;br /&gt;
|&lt;br /&gt;
|blueshogun96&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== References and links == &lt;br /&gt;
&lt;br /&gt;
* [https://www.reddit.com/r/emulation/comments/6a958p/cxbx_reloaded_xbox_emulator_panzer_dragoon_orta/ Discussion about Xbox emulation and technical differences between [[Cxbx-Reloaded]] and [[XQEMU]]]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Emulators&amp;diff=6879</id>
		<title>Emulators</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Emulators&amp;diff=6879"/>
				<updated>2020-09-01T13:42:08Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: Sort the more notable ones to the top&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This is a list of known Xbox emulation projects&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable sortable&amp;quot;&lt;br /&gt;
!Status&lt;br /&gt;
!Approach&lt;br /&gt;
!Chihiro&lt;br /&gt;
!Name&lt;br /&gt;
!Links&lt;br /&gt;
!Initiator&lt;br /&gt;
!Platform&lt;br /&gt;
!License&lt;br /&gt;
!Notes&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{Yes}}&lt;br /&gt;
|[[XQEMU]]&lt;br /&gt;
|[http://xqemu.com/][https://github.com/xqemu/][https://github.com/espes/xqemu]&lt;br /&gt;
|espes&lt;br /&gt;
|Windows/macOS/Linux/Others	&lt;br /&gt;
|&lt;br /&gt;
|XQEMU supports hardware-acceleration for the CPU emulation on Linux through KVM.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{Yes}}&lt;br /&gt;
|xemu&lt;br /&gt;
|[https://xemu.app/][https://github.com/mborgerson/xemu]&lt;br /&gt;
|mborgerson&lt;br /&gt;
|Windows/macOS/Linux&lt;br /&gt;
|&lt;br /&gt;
|xemu is a fork of XQEMU but more usable&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|HLE/LLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[[Cxbx-Reloaded]]&lt;br /&gt;
|[http://cxbx-reloaded.co.uk/][https://github.com/Cxbx-Reloaded/Cxbx-Reloaded]&lt;br /&gt;
|SoullessSentinel&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|Cxbx-Reloaded supports LLE GPU emulation which was taken from XQEMU. At the time of writing, the LLE GPU is significantly slower than in XQEMU.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{Yes}}&lt;br /&gt;
|[http://mamedev.org/ MAME]&lt;br /&gt;
|[http://adb.arcadeitalia.net/?mame=xbox][http://adb.arcadeitalia.net/?mame=chihiro][http://emulation.gametechwiki.com/index.php/MAME_compatibility_list#Xbox][http://emulation.gametechwiki.com/index.php/MAME_compatibility_list#Chihiro_Arcade]&lt;br /&gt;
|[https://github.com/mamedev/mame/commits?author=yz70s yz70s] (Samuele Zannoli) and MAME Team&lt;br /&gt;
|Windows/macOS/Linux/Others&lt;br /&gt;
|&lt;br /&gt;
|Focus seems to be on Chihiro emulation.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|Fusion[http://michaelbrundage.com/project/xbox-360-emulator/] ([[Xbox 360 Backward Compatibility]])&lt;br /&gt;
|&lt;br /&gt;
|Microsoft&lt;br /&gt;
|Xbox 360&lt;br /&gt;
|Proprietary&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|LLE/HLE Hybrid{{citation needed}}&lt;br /&gt;
|{{No}}&lt;br /&gt;
|Fission[http://www.ign.com/articles/2017/10/23/the-untold-story-of-xbox-one-backwards-compatibility] ([[Xbox One Backward Compatibility]])&lt;br /&gt;
|[http://www.xbox.com/en-US/xbox-one/backward-compatibility]&lt;br /&gt;
|Microsoft&lt;br /&gt;
|Xbox One&lt;br /&gt;
|Proprietary&lt;br /&gt;
|Announced at E3 2017. Said to be working similar to the 360 support in the Xbox One [https://youtu.be/x0NKP7-h_G0?t=8503]. The 360 support is probably ahead of time shader translation and runtime CPU translation [https://majornelson.com/podcast/584-xbox-one-backward-compatibility-turns-1/].&lt;br /&gt;
|&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|Tortoise&lt;br /&gt;
|[https://gitlab.com/kvmbox-reloaded/]&lt;br /&gt;
|JayFoxRox, phire&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|The decision was made to create an HLE / LLE Xbox emulation project which is maintained similar to Dolphin or Citra. A key focus was on design simplicity. The project started as a continuation of kvmbox, with devices being copied from the XQEMU source code. The project was called kvmbox-reloaded, while the name was being decided. The HLE portion was never worked on.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|OpenXBOX&lt;br /&gt;
|[https://github.com/mborgerson/OpenXBOX]&lt;br /&gt;
|mborgerson&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|HLE/LLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|xexec&lt;br /&gt;
|&lt;br /&gt;
|[http://xboxdevwiki.net/User:Haxar Haxar]&lt;br /&gt;
|Linux&lt;br /&gt;
|&lt;br /&gt;
|Xexec is an Xbox executable loader &amp;amp; emulator for x86/x64 Linux; handles direct execution of x86 code, executing Xbox game code directly on the CPU, in userspace Linux; All Windows kernel calls from Xbox game code are translated into POSIX syscalls, with no dependency on Wine.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/blueshogun96/MacBox MacBox]&lt;br /&gt;
|[http://shogun3d-cxbx.blogspot.com/2017/01/the-macos-experiment-part-1.html][http://shogun3d-cxbx.blogspot.com/2017/01/around-beginning-of-new-year-i.html]&lt;br /&gt;
|blueshogun96&lt;br /&gt;
|macOS&lt;br /&gt;
|&lt;br /&gt;
|&amp;quot;The macOS Experiment&amp;quot; - An experimental VM for Macs that don't have support for the official VM framework. A simple proof of concept.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|StrikeBox&lt;br /&gt;
|[https://github.com/StrikerX3/StrikeBox]&lt;br /&gt;
|StrikerX3&lt;br /&gt;
|Windows/Linux&lt;br /&gt;
|&lt;br /&gt;
|A fork of OpenXBOX, which was turned into a separate project.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[[Cxbx]]&lt;br /&gt;
|&lt;br /&gt;
|Caustik&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|Dxbx&lt;br /&gt;
|[http://dxbx-emu.com][https://github.com/PatrickvL/Dxbx/]&lt;br /&gt;
|ShadowTj&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|The project was started on March 23rd 2008. It is an improved port of Cxbx to the Delphi programming language.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/impeachgod/Dirtbox Dirtbox]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://sourceforge.net/p/ironbabel/code/HEAD/tree/trunk/Box/Xbox/ IronBabel]&lt;br /&gt;
|&lt;br /&gt;
|daeken&lt;br /&gt;
|Unknown&lt;br /&gt;
|&lt;br /&gt;
|This seems to have been a generic portability framework&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/daeken/Steelbreeze Steelbreeze]&lt;br /&gt;
|&lt;br /&gt;
|daeken&lt;br /&gt;
|Unknown&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/daeken/Zookeeper Zookeeper]&lt;br /&gt;
|[https://www.reddit.com/r/EmuDev/comments/4isyvu/project_zookeeper_a_new_xbox_emulator/]&lt;br /&gt;
|daeken&lt;br /&gt;
|macOS&lt;br /&gt;
|&lt;br /&gt;
|Using Apple's Hypervisor.framework to run a custom kernel (NightBeliever in the repo) and then running Xbox code from there&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[http://ngemu.com/threads/.154342/ XbeNext]&lt;br /&gt;
|[https://github.com/LoveMHz/XBENext]&lt;br /&gt;
|LoveMHz&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[http://ngemu.com/forums/.65/ Xeon]&lt;br /&gt;
|&lt;br /&gt;
|_SF_&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[http://ngemu.com/threads/.105210/ XProject]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://code.google.com/p/xbem xbem]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{Yes}}&lt;br /&gt;
|Hackbox&lt;br /&gt;
|&lt;br /&gt;
|JayFoxRox&lt;br /&gt;
|Windows/Linux&lt;br /&gt;
|Private&lt;br /&gt;
|This was originally going to be a commercial emulator (but plans were dropped quickly in favor of preservation). The source code was temporarily public but then made private. The source code is still available to a selected group of developers. Hackbox was designed from scratch but re-used code from Cxbx for HLE routine detection.&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/phire/kvmbox kvmbox]&lt;br /&gt;
|&lt;br /&gt;
|phire&lt;br /&gt;
|Linux&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/Gabriel-Maldonado/XboxHLE XboxHLE]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/bjh83/boombox boombox]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/docbrown/vxb vxb]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/quantumdude836/exciplex exciplex]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/monocasa/xbvm XBVM]&lt;br /&gt;
|&lt;br /&gt;
|monocasa&lt;br /&gt;
|Linux&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[http://xenoborg-emu.blogspot.com/ Xenoborg]&lt;br /&gt;
|&lt;br /&gt;
|blueshogun96&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== References and links == &lt;br /&gt;
&lt;br /&gt;
* [https://www.reddit.com/r/emulation/comments/6a958p/cxbx_reloaded_xbox_emulator_panzer_dragoon_orta/ Discussion about Xbox emulation and technical differences between [[Cxbx-Reloaded]] and [[XQEMU]]]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Emulators&amp;diff=6878</id>
		<title>Emulators</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Emulators&amp;diff=6878"/>
				<updated>2020-09-01T13:39:14Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: add xemu&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This is a list of known Xbox emulation projects&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable sortable&amp;quot;&lt;br /&gt;
!Status&lt;br /&gt;
!Approach&lt;br /&gt;
!Chihiro&lt;br /&gt;
!Name&lt;br /&gt;
!Links&lt;br /&gt;
!Initiator&lt;br /&gt;
!Platform&lt;br /&gt;
!License&lt;br /&gt;
!Notes&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{Yes}}&lt;br /&gt;
|[[XQEMU]]&lt;br /&gt;
|[http://xqemu.com/][https://github.com/xqemu/][https://github.com/espes/xqemu]&lt;br /&gt;
|espes&lt;br /&gt;
|Windows/macOS/Linux/Others	&lt;br /&gt;
|&lt;br /&gt;
|XQEMU supports hardware-acceleration for the CPU emulation on Linux through KVM.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{Yes}}&lt;br /&gt;
|xemu&lt;br /&gt;
|[https://xemu.app/][https://github.com/mborgerson/xemu]&lt;br /&gt;
|mborgerson&lt;br /&gt;
|Windows/macOS/Linux&lt;br /&gt;
|&lt;br /&gt;
|xemu is a fork of XQEMU but more usable&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|HLE/LLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[[Cxbx-Reloaded]]&lt;br /&gt;
|[http://cxbx-reloaded.co.uk/][https://github.com/Cxbx-Reloaded/Cxbx-Reloaded]&lt;br /&gt;
|SoullessSentinel&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|Cxbx-Reloaded supports LLE GPU emulation which was taken from XQEMU. At the time of writing, the LLE GPU is significantly slower than in XQEMU.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|Tortoise&lt;br /&gt;
|[https://gitlab.com/kvmbox-reloaded/]&lt;br /&gt;
|JayFoxRox, phire&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|The decision was made to create an HLE / LLE Xbox emulation project which is maintained similar to Dolphin or Citra. A key focus was on design simplicity. The project started as a continuation of kvmbox, with devices being copied from the XQEMU source code. The project was called kvmbox-reloaded, while the name was being decided. The HLE portion was never worked on.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|OpenXBOX&lt;br /&gt;
|[https://github.com/mborgerson/OpenXBOX]&lt;br /&gt;
|mborgerson&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|HLE/LLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|xexec&lt;br /&gt;
|&lt;br /&gt;
|[http://xboxdevwiki.net/User:Haxar Haxar]&lt;br /&gt;
|Linux&lt;br /&gt;
|&lt;br /&gt;
|Xexec is an Xbox executable loader &amp;amp; emulator for x86/x64 Linux; handles direct execution of x86 code, executing Xbox game code directly on the CPU, in userspace Linux; All Windows kernel calls from Xbox game code are translated into POSIX syscalls, with no dependency on Wine.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/blueshogun96/MacBox MacBox]&lt;br /&gt;
|[http://shogun3d-cxbx.blogspot.com/2017/01/the-macos-experiment-part-1.html][http://shogun3d-cxbx.blogspot.com/2017/01/around-beginning-of-new-year-i.html]&lt;br /&gt;
|blueshogun96&lt;br /&gt;
|macOS&lt;br /&gt;
|&lt;br /&gt;
|&amp;quot;The macOS Experiment&amp;quot; - An experimental VM for Macs that don't have support for the official VM framework. A simple proof of concept.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|StrikeBox&lt;br /&gt;
|[https://github.com/StrikerX3/StrikeBox]&lt;br /&gt;
|StrikerX3&lt;br /&gt;
|Windows/Linux&lt;br /&gt;
|&lt;br /&gt;
|A fork of OpenXBOX, which was turned into a separate project.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[[Cxbx]]&lt;br /&gt;
|&lt;br /&gt;
|Caustik&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|Dxbx&lt;br /&gt;
|[http://dxbx-emu.com][https://github.com/PatrickvL/Dxbx/]&lt;br /&gt;
|ShadowTj&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|The project was started on March 23rd 2008. It is an improved port of Cxbx to the Delphi programming language.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/impeachgod/Dirtbox Dirtbox]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://sourceforge.net/p/ironbabel/code/HEAD/tree/trunk/Box/Xbox/ IronBabel]&lt;br /&gt;
|&lt;br /&gt;
|daeken&lt;br /&gt;
|Unknown&lt;br /&gt;
|&lt;br /&gt;
|This seems to have been a generic portability framework&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/daeken/Steelbreeze Steelbreeze]&lt;br /&gt;
|&lt;br /&gt;
|daeken&lt;br /&gt;
|Unknown&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/daeken/Zookeeper Zookeeper]&lt;br /&gt;
|[https://www.reddit.com/r/EmuDev/comments/4isyvu/project_zookeeper_a_new_xbox_emulator/]&lt;br /&gt;
|daeken&lt;br /&gt;
|macOS&lt;br /&gt;
|&lt;br /&gt;
|Using Apple's Hypervisor.framework to run a custom kernel (NightBeliever in the repo) and then running Xbox code from there&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[http://ngemu.com/threads/.154342/ XbeNext]&lt;br /&gt;
|[https://github.com/LoveMHz/XBENext]&lt;br /&gt;
|LoveMHz&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[http://ngemu.com/forums/.65/ Xeon]&lt;br /&gt;
|&lt;br /&gt;
|_SF_&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[http://ngemu.com/threads/.105210/ XProject]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://code.google.com/p/xbem xbem]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{Yes}}&lt;br /&gt;
|Hackbox&lt;br /&gt;
|&lt;br /&gt;
|JayFoxRox&lt;br /&gt;
|Windows/Linux&lt;br /&gt;
|Private&lt;br /&gt;
|This was originally going to be a commercial emulator (but plans were dropped quickly in favor of preservation). The source code was temporarily public but then made private. The source code is still available to a selected group of developers. Hackbox was designed from scratch but re-used code from Cxbx for HLE routine detection.&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/phire/kvmbox kvmbox]&lt;br /&gt;
|&lt;br /&gt;
|phire&lt;br /&gt;
|Linux&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|HLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/Gabriel-Maldonado/XboxHLE XboxHLE]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/bjh83/boombox boombox]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/docbrown/vxb vxb]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Unknown}}&lt;br /&gt;
|Unknown&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/quantumdude836/exciplex exciplex]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{Yes}}&lt;br /&gt;
|[http://mamedev.org/ MAME]&lt;br /&gt;
|[http://adb.arcadeitalia.net/?mame=xbox][http://adb.arcadeitalia.net/?mame=chihiro][http://emulation.gametechwiki.com/index.php/MAME_compatibility_list#Xbox][http://emulation.gametechwiki.com/index.php/MAME_compatibility_list#Chihiro_Arcade]&lt;br /&gt;
|[https://github.com/mamedev/mame/commits?author=yz70s yz70s] (Samuele Zannoli) and MAME Team&lt;br /&gt;
|Windows/macOS/Linux/Others&lt;br /&gt;
|&lt;br /&gt;
|Focus seems to be on Chihiro emulation.&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[https://github.com/monocasa/xbvm XBVM]&lt;br /&gt;
|&lt;br /&gt;
|monocasa&lt;br /&gt;
|Linux&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|&lt;br /&gt;
|{{No}}&lt;br /&gt;
|[http://xenoborg-emu.blogspot.com/ Xenoborg]&lt;br /&gt;
|&lt;br /&gt;
|blueshogun96&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{No|Dead}}&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|{{No}}&lt;br /&gt;
|Fusion[http://michaelbrundage.com/project/xbox-360-emulator/] ([[Xbox 360 Backward Compatibility]])&lt;br /&gt;
|&lt;br /&gt;
|Microsoft&lt;br /&gt;
|Xbox 360&lt;br /&gt;
|Proprietary&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|{{Yes|Maintained}}&lt;br /&gt;
|LLE/HLE Hybrid{{citation needed}}&lt;br /&gt;
|{{No}}&lt;br /&gt;
|Fission[http://www.ign.com/articles/2017/10/23/the-untold-story-of-xbox-one-backwards-compatibility] ([[Xbox One Backward Compatibility]])&lt;br /&gt;
|[http://www.xbox.com/en-US/xbox-one/backward-compatibility]&lt;br /&gt;
|Microsoft&lt;br /&gt;
|Xbox One&lt;br /&gt;
|Proprietary&lt;br /&gt;
|Announced at E3 2017. Said to be working similar to the 360 support in the Xbox One [https://youtu.be/x0NKP7-h_G0?t=8503]. The 360 support is probably ahead of time shader translation and runtime CPU translation [https://majornelson.com/podcast/584-xbox-one-backward-compatibility-turns-1/].&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== References and links == &lt;br /&gt;
&lt;br /&gt;
* [https://www.reddit.com/r/emulation/comments/6a958p/cxbx_reloaded_xbox_emulator_panzer_dragoon_orta/ Discussion about Xbox emulation and technical differences between [[Cxbx-Reloaded]] and [[XQEMU]]]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=File:TestUploadPleaseIgnore.jpg&amp;diff=6848</id>
		<title>File:TestUploadPleaseIgnore.jpg</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=File:TestUploadPleaseIgnore.jpg&amp;diff=6848"/>
				<updated>2020-04-14T23:17:44Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: Test Upload Please Ignore&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Test Upload Please Ignore&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=MCPX&amp;diff=6699</id>
		<title>MCPX</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=MCPX&amp;diff=6699"/>
				<updated>2019-03-10T15:07:58Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: /* See Also */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The MCPX is the southbridge chip of the Xbox chipset by Nvidia. It contains the sound processors ([[APU]] and [[ACI]]) and also the USB, PCI, IDE, etc, controllers [https://web.archive.org/web/20010418214256/http://www.ga-hardware.com:80/preview.cfm?id=NVIDIAMCP], [https://web.archive.org/web/20010410003338/http://www.nvnews.net/previews/mcpx/mcpx.shtml].&lt;br /&gt;
&lt;br /&gt;
== ROM ==&lt;br /&gt;
&lt;br /&gt;
The MCPX is home to the secret [[MCPX ROM]].&lt;br /&gt;
&lt;br /&gt;
== Pin L21: PC Speaker ==&lt;br /&gt;
&lt;br /&gt;
The MCPX has PC Speaker pin which can be controlled using [https://wiki.osdev.org/PC_Speaker the standard PC Speaker interface].&lt;br /&gt;
However, no actual speaker is connected to the pin, so while the signal exists, there will be no audible sound on a stock Xbox.&lt;br /&gt;
&lt;br /&gt;
A speaker can be soldered to this pin and to make the signal audible [https://www.youtube.com/watch?v=Te4MSskbBEE][https://github.com/0DaveX/beep/]&lt;br /&gt;
&lt;br /&gt;
The original Microsoft code does not drive the PC Speaker at all, so this otherwise unused pin can also be used for inaudible forms of unidirectional communication.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;gallery mode=&amp;quot;slideshow&amp;quot;&amp;gt;&lt;br /&gt;
Image:XboxWithPcSpkr.jpg|'' ''&lt;br /&gt;
Image:XboxPcSpkrTrace.jpg|'' ''&lt;br /&gt;
Image:XboxPcSpkrSolderPoints.jpg|'' ''&lt;br /&gt;
&amp;lt;/gallery&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== See Also ==&lt;br /&gt;
* [[NForce]]&lt;br /&gt;
* [http://siliconpr0n.org/archive/doku.php?id=azonenberg:nvidia:mcpx Die Inspection]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=MCPX&amp;diff=6698</id>
		<title>MCPX</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=MCPX&amp;diff=6698"/>
				<updated>2019-03-10T15:04:17Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The MCPX is the southbridge chip of the Xbox chipset by Nvidia. It contains the sound processors ([[APU]] and [[ACI]]) and also the USB, PCI, IDE, etc, controllers [https://web.archive.org/web/20010418214256/http://www.ga-hardware.com:80/preview.cfm?id=NVIDIAMCP], [https://web.archive.org/web/20010410003338/http://www.nvnews.net/previews/mcpx/mcpx.shtml].&lt;br /&gt;
&lt;br /&gt;
== ROM ==&lt;br /&gt;
&lt;br /&gt;
The MCPX is home to the secret [[MCPX ROM]].&lt;br /&gt;
&lt;br /&gt;
== Pin L21: PC Speaker ==&lt;br /&gt;
&lt;br /&gt;
The MCPX has PC Speaker pin which can be controlled using [https://wiki.osdev.org/PC_Speaker the standard PC Speaker interface].&lt;br /&gt;
However, no actual speaker is connected to the pin, so while the signal exists, there will be no audible sound on a stock Xbox.&lt;br /&gt;
&lt;br /&gt;
A speaker can be soldered to this pin and to make the signal audible [https://www.youtube.com/watch?v=Te4MSskbBEE][https://github.com/0DaveX/beep/]&lt;br /&gt;
&lt;br /&gt;
The original Microsoft code does not drive the PC Speaker at all, so this otherwise unused pin can also be used for inaudible forms of unidirectional communication.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;lt;gallery mode=&amp;quot;slideshow&amp;quot;&amp;gt;&lt;br /&gt;
Image:XboxWithPcSpkr.jpg|'' ''&lt;br /&gt;
Image:XboxPcSpkrTrace.jpg|'' ''&lt;br /&gt;
Image:XboxPcSpkrSolderPoints.jpg|'' ''&lt;br /&gt;
&amp;lt;/gallery&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== See Also ==&lt;br /&gt;
[[NForce]]&lt;br /&gt;
&lt;br /&gt;
[http://siliconpr0n.org/archive/doku.php?id=azonenberg:nvidia:mcpx Die Inspection]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=6623</id>
		<title>Main Page</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=6623"/>
				<updated>2018-12-27T11:24:50Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{:Main Page/Header}}&lt;br /&gt;
__NOTOC__&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
* [[Chihiro]]&lt;br /&gt;
* [[Xbox]]&lt;br /&gt;
&lt;br /&gt;
* [[Hardware Revisions]]&lt;br /&gt;
* [[Motherboard]]&lt;br /&gt;
* [[CPU]]&lt;br /&gt;
* [[NV2A]]&lt;br /&gt;
** [[NV2A/Vertex attributes]]&lt;br /&gt;
** [[NV2A/Fixed Function Pipeline]]&lt;br /&gt;
** [[NV2A/Vertex Shader]]&lt;br /&gt;
** [[NV2A/Pixel Combiner]]&lt;br /&gt;
** [[NV2A/Surface Formats]]&lt;br /&gt;
* [[Memory]]&lt;br /&gt;
* [[Flash ROM]]&lt;br /&gt;
* [[MCPX]]&lt;br /&gt;
** [[APU]]&lt;br /&gt;
*** [[DSP]]&lt;br /&gt;
** [[ACI]]&lt;br /&gt;
** [[Network]]&lt;br /&gt;
* [[PCI]]&lt;br /&gt;
* [[SMBus]]&lt;br /&gt;
** [[EEPROM]]&lt;br /&gt;
** [[SMC]]&lt;br /&gt;
** [[Video Encoder]]&lt;br /&gt;
*** [[AV Cables]]&lt;br /&gt;
* [[DVD Drive]]&lt;br /&gt;
** [[Xbox Game Disc]]&lt;br /&gt;
* [[Hard Drive]]&lt;br /&gt;
* [[USB]]&lt;br /&gt;
** [[Xbox Input Devices]]&lt;br /&gt;
** [[Xbox Memory Unit]]&lt;br /&gt;
** [[Xbox Live Communicator]] &amp;lt;!-- Maybe rename this to microphones later? --&amp;gt;&lt;br /&gt;
** [[Xbox DVD Movie Playback Kit]]&lt;br /&gt;
* [[Power Supply]]&lt;br /&gt;
* [[Development Kits]]&lt;br /&gt;
** [[Super I/O]]&lt;br /&gt;
** [[DVD Emulator]]&lt;br /&gt;
* [[Manufacturing Process]]&lt;br /&gt;
&lt;br /&gt;
== System Software ==&lt;br /&gt;
* [[MCPX ROM]]&lt;br /&gt;
* [[BIOS]] / [[Kernel]]&lt;br /&gt;
** [[Boot Process]]&lt;br /&gt;
** [[XBE]] (Executable file format)&lt;br /&gt;
* [[FATX]] (Filesystem)&lt;br /&gt;
* [[Xbox ADPCM]]&lt;br /&gt;
* [[Dashboard]]&lt;br /&gt;
** [[Soundtracks]]&lt;br /&gt;
* [[Exploits]]&lt;br /&gt;
&lt;br /&gt;
== Development Kits and Tools ==&lt;br /&gt;
* [https://github.com/xqemu/nxdk nxdk (New Xbox Development Kit)]&lt;br /&gt;
* [[OpenXDK]]&lt;br /&gt;
* [[Microsoft XDK]]&lt;br /&gt;
** [[Xbox Title Libraries]]&lt;br /&gt;
** [[Direct3D]]&lt;br /&gt;
** [[DirectSound]]&lt;br /&gt;
** [[System Link]]&lt;br /&gt;
** [[Xbox Live]]&lt;br /&gt;
** [[Xbox Debug Monitor]]&lt;br /&gt;
** [[Xbox Neighborhood]]&lt;br /&gt;
** [[Kernel_Debug| Xbox Kernel Debugging]]&lt;br /&gt;
&lt;br /&gt;
== Games ==&lt;br /&gt;
* [[:Category:Games|Games]]&lt;br /&gt;
* [[Engine List]]&lt;br /&gt;
&lt;br /&gt;
== Emulation ==&lt;br /&gt;
* [[Emulators]]&lt;br /&gt;
** [[XQEMU]]&lt;br /&gt;
** [[Xbox 360 Backward Compatibility]]&lt;br /&gt;
&lt;br /&gt;
== Historical Pages ==&lt;br /&gt;
(archived from the xbox-linux wiki)&lt;br /&gt;
* [[Xbox Hard Drive Locking Mechanism]]&lt;br /&gt;
* [[Xbox Savegame System]]&lt;br /&gt;
* [[Xbox Hardware Overview]]&lt;br /&gt;
* [[Xbox Hard Disk Technical_Details]]&lt;br /&gt;
* [[Xbox Hard Disk Partitioning]]&lt;br /&gt;
* [[Xbox Manufacturing Process]]&lt;br /&gt;
* [[The Hidden Boot Code of the Xbox]]&lt;br /&gt;
* [[PIC]]&lt;br /&gt;
* [[SMBus]]&lt;br /&gt;
* [[NForce]]&lt;br /&gt;
* [[17 Mistakes Microsoft Made in the Xbox Security System]]&lt;br /&gt;
* [[Porting an Operating System to the Xbox HOWTO]]&lt;br /&gt;
&lt;br /&gt;
== Other ==&lt;br /&gt;
* [[Patents]]&lt;br /&gt;
* [[Resources]]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=6622</id>
		<title>Main Page</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=6622"/>
				<updated>2018-12-27T11:17:22Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{:Main Page/Header}}&lt;br /&gt;
__NOTOC__&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
* [[Chihiro]]&lt;br /&gt;
* [[Xbox]]&lt;br /&gt;
&lt;br /&gt;
* [[Hardware Revisions]]&lt;br /&gt;
* [[Motherboard]]&lt;br /&gt;
* [[CPU]]&lt;br /&gt;
* [[NV2A]]&lt;br /&gt;
** [[NV2A/Vertex attributes]]&lt;br /&gt;
** [[NV2A/Fixed Function Pipeline]]&lt;br /&gt;
** [[NV2A/Vertex Shader]]&lt;br /&gt;
** [[NV2A/Pixel Combiner]]&lt;br /&gt;
** [[NV2A/Surface Formats]]&lt;br /&gt;
* [[Memory]]&lt;br /&gt;
* [[Flash ROM]]&lt;br /&gt;
* [[MCPX]]&lt;br /&gt;
** [[APU]]&lt;br /&gt;
*** [[DSP]]&lt;br /&gt;
** [[ACI]]&lt;br /&gt;
** [[Network]]&lt;br /&gt;
* [[PCI]]&lt;br /&gt;
* [[SMBus]]&lt;br /&gt;
** [[EEPROM]]&lt;br /&gt;
** [[SMC]]&lt;br /&gt;
** [[Video Encoder]]&lt;br /&gt;
*** [[AV Cables]]&lt;br /&gt;
* [[DVD Drive]]&lt;br /&gt;
** [[Xbox Game Disc]]&lt;br /&gt;
* [[Hard Drive]]&lt;br /&gt;
* [[USB]]&lt;br /&gt;
** [[Xbox Input Devices]]&lt;br /&gt;
** [[Xbox Memory Unit]]&lt;br /&gt;
** [[Xbox Live Communicator]] &amp;lt;!-- Maybe rename this to microphones later? --&amp;gt;&lt;br /&gt;
** [[Xbox DVD Movie Playback Kit]]&lt;br /&gt;
* [[Power Supply]]&lt;br /&gt;
* [[Development Kits]]&lt;br /&gt;
** [[Super I/O]]&lt;br /&gt;
** [[DVD Emulator]]&lt;br /&gt;
* [[Manufacturing Process]]&lt;br /&gt;
&lt;br /&gt;
== System Software ==&lt;br /&gt;
* [[MCPX ROM]]&lt;br /&gt;
* [[BIOS]] / [[Kernel]]&lt;br /&gt;
** [[Boot Process]]&lt;br /&gt;
** [[XBE]] (Executable file format)&lt;br /&gt;
* [[FATX]] (Filesystem)&lt;br /&gt;
* [[Dashboard]]&lt;br /&gt;
** [[Soundtracks]]&lt;br /&gt;
* [[Exploits]]&lt;br /&gt;
&lt;br /&gt;
== Development Kits and Tools ==&lt;br /&gt;
* [https://github.com/xqemu/nxdk nxdk (New Xbox Development Kit)]&lt;br /&gt;
* [[OpenXDK]]&lt;br /&gt;
* [[Microsoft XDK]]&lt;br /&gt;
** [[Xbox Title Libraries]]&lt;br /&gt;
** [[Direct3D]]&lt;br /&gt;
** [[DirectSound]]&lt;br /&gt;
** [[System Link]]&lt;br /&gt;
** [[Xbox Live]]&lt;br /&gt;
** [[Xbox Debug Monitor]]&lt;br /&gt;
** [[Xbox Neighborhood]]&lt;br /&gt;
** [[Kernel_Debug| Xbox Kernel Debugging]]&lt;br /&gt;
&lt;br /&gt;
== Games ==&lt;br /&gt;
* [[:Category:Games|Games]]&lt;br /&gt;
* [[Engine List]]&lt;br /&gt;
&lt;br /&gt;
== Emulation ==&lt;br /&gt;
* [[Emulators]]&lt;br /&gt;
** [[XQEMU]]&lt;br /&gt;
** [[Xbox 360 Backward Compatibility]]&lt;br /&gt;
&lt;br /&gt;
== Historical Pages ==&lt;br /&gt;
(archived from the xbox-linux wiki)&lt;br /&gt;
* [[Xbox Hard Drive Locking Mechanism]]&lt;br /&gt;
* [[Xbox Savegame System]]&lt;br /&gt;
* [[Xbox Hardware Overview]]&lt;br /&gt;
* [[Xbox Hard Disk Technical_Details]]&lt;br /&gt;
* [[Xbox Hard Disk Partitioning]]&lt;br /&gt;
* [[Xbox Manufacturing Process]]&lt;br /&gt;
* [[The Hidden Boot Code of the Xbox]]&lt;br /&gt;
* [[PIC]]&lt;br /&gt;
* [[SMBus]]&lt;br /&gt;
* [[NForce]]&lt;br /&gt;
* [[17 Mistakes Microsoft Made in the Xbox Security System]]&lt;br /&gt;
* [[Porting an Operating System to the Xbox HOWTO]]&lt;br /&gt;
&lt;br /&gt;
== Other ==&lt;br /&gt;
* [[Patents]]&lt;br /&gt;
* [[Resources]]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=FATX&amp;diff=6621</id>
		<title>FATX</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=FATX&amp;diff=6621"/>
				<updated>2018-12-27T11:16:18Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The file system used on the Xbox is [[FATX]], a variant of FAT16/32 developed by Microsoft specifically for the Xbox.&lt;br /&gt;
&lt;br /&gt;
== Implementations ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&lt;br /&gt;
|-&lt;br /&gt;
! Name&lt;br /&gt;
! Platform&lt;br /&gt;
! Read/Write&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| Official&lt;br /&gt;
| Xbox&lt;br /&gt;
| Read/Write&lt;br /&gt;
| Official FATX implementation by Microsoft&lt;br /&gt;
|-&lt;br /&gt;
| [https://github.com/mborgerson/fatx fatxfs]&lt;br /&gt;
| GNU/Linux, macOS&lt;br /&gt;
| Read-Only&lt;br /&gt;
| [https://en.wikipedia.org/wiki/Filesystem_in_Userspace FUSE]-based implementation&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Further Reading ==&lt;br /&gt;
* [https://web.archive.org/web/20100617022009/http://www.xbox-linux.org/wiki/Differences_between_Xbox_FATX_and_MS-DOS_FAT Differences between Xbox FATX and MS-DOS FAT]&lt;br /&gt;
* [https://web.archive.org/web/20020617181617/http://www.tardis.ed.ac.uk:80/~lucien/computing/projects/xbox/XBOX-disk-layout.htm XBOX DISK LAYOUT v0.13]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Hard_Drive&amp;diff=6620</id>
		<title>Hard Drive</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Hard_Drive&amp;diff=6620"/>
				<updated>2018-12-27T11:14:04Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The original Xbox hard disk drive was 8 GB in size.  Later releases, 10 GB drives; however, only the first 8 GB of the drive was used. See [[Hardware Revisions]] for more information.&lt;br /&gt;
&lt;br /&gt;
== Partitions ==&lt;br /&gt;
The Xbox hard disk contains multiple partitions. Unlike a PC, which typically contains either a [https://en.wikipedia.org/wiki/Master_boot_record Master Boot Record] or [https://en.wikipedia.org/wiki/GUID_Partition_Table GUID Partition Table] to specify the partition information, the Xbox kernel uses a fixed partition layout. The file system used on the Xbox is [[FATX]], a variant of FAT16/32 developed by Microsoft specifically for the Xbox.&lt;br /&gt;
{{FIXME|reason=Is this the same for all HDD sizes? could the number of free blocks in the savegame menu be used to calculate what kind of HDD you have?}}&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Drive Letter&lt;br /&gt;
! Description&lt;br /&gt;
! Offset (bytes)&lt;br /&gt;
! Size (bytes)&lt;br /&gt;
! Filesystem&lt;br /&gt;
! Device Object (MS Retail Kernel)&lt;br /&gt;
|-&lt;br /&gt;
| N/A&lt;br /&gt;
| Config Area&lt;br /&gt;
| 0x00000000&lt;br /&gt;
| 0x00080000&lt;br /&gt;
| Fixed Structure&lt;br /&gt;
| N/A&lt;br /&gt;
|-&lt;br /&gt;
| X&lt;br /&gt;
| Game Cache&lt;br /&gt;
| 0x00080000&lt;br /&gt;
| 0x2ee00000&lt;br /&gt;
| FATX&lt;br /&gt;
| \Device\Harddisk0\Partition3&lt;br /&gt;
|-&lt;br /&gt;
| Y&lt;br /&gt;
| Game Cache&lt;br /&gt;
| 0x2ee80000&lt;br /&gt;
| 0x2ee00000&lt;br /&gt;
| FATX&lt;br /&gt;
| \Device\Harddisk0\Partition4&lt;br /&gt;
|-&lt;br /&gt;
| Z&lt;br /&gt;
| Game Cache&lt;br /&gt;
| 0x5dc80000&lt;br /&gt;
| 0x2ee00000&lt;br /&gt;
| FATX&lt;br /&gt;
| \Device\Harddisk0\Partition5&lt;br /&gt;
|-&lt;br /&gt;
| C&lt;br /&gt;
| System&lt;br /&gt;
| 0x8ca80000&lt;br /&gt;
| 0x1f400000&lt;br /&gt;
| FATX&lt;br /&gt;
| \Device\Harddisk0\Partition2&lt;br /&gt;
|-&lt;br /&gt;
| E&lt;br /&gt;
| Data&lt;br /&gt;
| 0xabe80000&lt;br /&gt;
| 0x131f00000&lt;br /&gt;
| FATX&lt;br /&gt;
| \Device\Harddisk0\Partition1&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
::::::::::::::::::::::''side note: CD/DVD Drive &amp;quot;D:&amp;quot; &amp;lt;=&amp;gt; &amp;quot;\Device\CdRom0&amp;quot;''&lt;br /&gt;
::::::::::::::::::::::''and usually: added Drive &amp;quot;F:&amp;quot; &amp;lt;=&amp;gt; &amp;quot;\Device\Harddisk0\Partition6&amp;quot;''&lt;br /&gt;
:::::::::::::::::::::::::&amp;amp;nbsp;&amp;amp;nbsp;&amp;amp;nbsp;''added Drive &amp;quot;G:&amp;quot; &amp;lt;=&amp;gt; &amp;quot;\Device\Harddisk0\Partition7&amp;quot;''&lt;br /&gt;
&lt;br /&gt;
'''Debug/Devkit HDD:'''&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Drive Letter&lt;br /&gt;
! Description&lt;br /&gt;
! Offset (bytes)&lt;br /&gt;
! Size (bytes)&lt;br /&gt;
! Filesystem&lt;br /&gt;
! Device Object (MS Retail Kernel)&lt;br /&gt;
|-&lt;br /&gt;
| [FIXME]&lt;br /&gt;
| [FIXME]&lt;br /&gt;
| [FIXME]&lt;br /&gt;
| [FIXME]&lt;br /&gt;
| [FIXME]&lt;br /&gt;
| [FIXME]&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
'''FIXME:'''&lt;br /&gt;
* Add info on how extended partitions are added.&lt;br /&gt;
&lt;br /&gt;
== Locking ==&lt;br /&gt;
The hard drives in the Xbox are locked with a key which is unique to the specific Xbox. The drive is unlocked by the kernel at boot.&lt;br /&gt;
&lt;br /&gt;
=== Unlocking for Backups ===&lt;br /&gt;
Before connecting an Xbox HDD to a PC for a backup or modification, the drive must first be unlocked. This can be done with alternative dashboards (such as EvoX). But beware, once you unlock the disk you cannot use it with an official BIOS until you re-lock the disk! For this reason it is suggested to use a patched BIOS which does not require the disk to be locked. If you are unable to run unsigned code (needed to unlock the HDD before powering off), it is possible to hot-swap the drive after the Xbox has started. This is not a suggested method, but it has been known to work. The idea is that you start the Xbox and wait for the dashboard, at which point the drive will be unlocked. Then, while the Xbox is running, you disconnect the IDE cable (but not the power!), and then connect the drive to your PC. Then the drive can be mounted for read/write (using XboxHDM), or imaged directly.&lt;br /&gt;
&lt;br /&gt;
'''FIXME:'''&lt;br /&gt;
* Provide more info on locking/unlocking procedure.&lt;br /&gt;
* Provide details about the key and how it can be derived from the [[EEPROM]] data.&lt;br /&gt;
&lt;br /&gt;
== How To: Backup an HDD ==&lt;br /&gt;
There are two general methods to back up your HDD: copying the files, or creating a byte-for-byte image of the drive.&lt;br /&gt;
&lt;br /&gt;
=== Method 1: File Copy ===&lt;br /&gt;
This is an acceptable backup method, but it is not as accurate an exact copy. This method requires less work to create the backup, but more work to re-create a usable disk image. The dashboard files (found in C:) are the most essential part of a backup, and a complete disk image can be re-created (with some effort) with a copy of the dashboard files using a tool such as XboxHDM.&lt;br /&gt;
&lt;br /&gt;
==== Remote ====&lt;br /&gt;
Simply run an XBE on your Xbox that provides an FTP server. This is a standard feature for alternative dashboards (such as EvoX). Then connect to your Xbox from another system and copy all files in '''C:''' and '''E:'''.&lt;br /&gt;
&lt;br /&gt;
==== Direct ====&lt;br /&gt;
Unlock the HDD, connect it to your PC, mount the drive (see [[FATX]]), copy the files.&lt;br /&gt;
&lt;br /&gt;
=== Method 2: Exact Copy ===&lt;br /&gt;
This is the most accurate method to backup your hard disk. This method requires more work to create the backup, but does not require any effort to create a usable disk image like the first method. There are multiple ways to implement this method, one is provided here.&lt;br /&gt;
&lt;br /&gt;
Unlock the HDD, connect it to your PC using a USB-IDE adapter ([https://www.amazon.com/Sabrent-USB-DSC9-SATA-Drive-Converter/dp/B00DQJME7Y available for ~$20USD]).  In GNU/Linux and other *NIX variants, DD can be used to perform the block copy. For example: &amp;lt;code&amp;gt;sudo dd if=/dev/sdb of=xbox_hdd.raw bs=512&amp;lt;/code&amp;gt;. append &amp;lt;code&amp;gt;status=progress&amp;lt;/code&amp;gt; to see the progress during copying if you run a recent distro, like so: &amp;lt;code&amp;gt;sudo dd if=/dev/sdb of=xbox_hdd.raw bs=512 status=progress&amp;lt;/code&amp;gt;.If you're dumping an original Xbox HDD (capacity 8G or 10G), this will finish pretty quickly. The files can be extracted by mounting the filesystems in the image (see [[FATX]]).&lt;br /&gt;
&lt;br /&gt;
== Further Reading ==&lt;br /&gt;
* [http://hackipedia.org/Disk%20formats/Partition%20tables/X-Box/Xbox_Partitioning_and_Filesystem_Details.htm Xbox Partitioning and Filesystem Details]&lt;br /&gt;
* [https://web.archive.org/web/20020617181617/http://www.tardis.ed.ac.uk:80/~lucien/computing/projects/xbox/XBOX-disk-layout.htm XBOX DISK LAYOUT v0.13]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=FATX&amp;diff=6619</id>
		<title>FATX</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=FATX&amp;diff=6619"/>
				<updated>2018-12-27T11:12:35Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The file system used on the Xbox is [[FATX]], a variant of FAT16/32 developed by Microsoft specifically for the Xbox.&lt;br /&gt;
&lt;br /&gt;
== Implementations ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&lt;br /&gt;
|-&lt;br /&gt;
! Name&lt;br /&gt;
! Platform&lt;br /&gt;
! Read/Write&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| Official&lt;br /&gt;
| Xbox&lt;br /&gt;
| Read/Write&lt;br /&gt;
| Official FATX implementation by Microsoft&lt;br /&gt;
|-&lt;br /&gt;
| [https://github.com/mborgerson/fatx fatxfs]&lt;br /&gt;
| GNU/Linux, macOS&lt;br /&gt;
| Read-Only&lt;br /&gt;
| [https://en.wikipedia.org/wiki/Filesystem_in_Userspace FUSE]-based implementation&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Further Reading ==&lt;br /&gt;
* [http://hackipedia.org/Disk%20formats/File%20systems/FATX%2C%20File%20Allocation%20Table%20%28X-Box%29/Differences_between_Xbox_FATX_and_MS-DOS_FAT.htm Differences between Xbox FATX and MS-DOS FAT]&lt;br /&gt;
* [https://web.archive.org/web/20020617181617/http://www.tardis.ed.ac.uk:80/~lucien/computing/projects/xbox/XBOX-disk-layout.htm XBOX DISK LAYOUT v0.13]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=DSP&amp;diff=6618</id>
		<title>DSP</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=DSP&amp;diff=6618"/>
				<updated>2018-12-27T11:05:50Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The DSPs in the APU are probably &amp;quot;Parthus MediaStream&amp;quot; DSP cores (probably the 24-bit DSP2420 &amp;quot;Mozart&amp;quot; core).&lt;br /&gt;
&lt;br /&gt;
Those are similar to Motorola DSP56362 (DSP56300 Family). If so, the datasheet can be found at http://www.nxp.com/docs/en/data-sheet/DSP56362.pdf (Also see &amp;quot;Documentation&amp;quot; section in said datasheet for the related documentation)&lt;br /&gt;
&lt;br /&gt;
== Memory Size ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!&lt;br /&gt;
! Program RAM Size&lt;br /&gt;
! X Data RAM Size&lt;br /&gt;
! Y Data RAM Size&lt;br /&gt;
! MIXBUF Size&lt;br /&gt;
|-&lt;br /&gt;
! GP&lt;br /&gt;
| 4096 x 24-bit&lt;br /&gt;
| 4096 x 24-bit&lt;br /&gt;
| 2048 x 24-bit&lt;br /&gt;
| 992{{FIXME|reason=This is probably 1024 words, but the last 32 words were not working as intended during my testing}} x 24-bit&lt;br /&gt;
|-&lt;br /&gt;
! EP&lt;br /&gt;
| 4096 x 24-bit&lt;br /&gt;
| 3072 x 24-bit&lt;br /&gt;
| 256 x 24-bit&lt;br /&gt;
| n/a&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
MIXBUF is accessible at X:$001400 in the GP.&lt;br /&gt;
&lt;br /&gt;
Other datasheets for similar DSPs suggest that the memory sizes might be different if instruction cache or switch mode are toggled.&lt;br /&gt;
It is currently unknown if the DSPs in the Xbox APU support a similar feature{{FIXME}}.&lt;br /&gt;
&lt;br /&gt;
== DMA ==&lt;br /&gt;
&lt;br /&gt;
''This section is very incomplete and not much was tested on hardware either''&lt;br /&gt;
&lt;br /&gt;
DMA is controlled using peripheral registers:&lt;br /&gt;
&lt;br /&gt;
* 0xFFFFD4: Memory address of next command block&lt;br /&gt;
* 0xFFFFD5: DMA_START_BLOCK{{FIXME|reason=How is this used?}}&lt;br /&gt;
* 0xFFFFD6: DMA_CONTROL{{FIXME|reason=Explain the bits}}&lt;br /&gt;
* 0xFFFFD7: DMA_CONFIGURATION{{FIXME|reason=Explain the bits}}&lt;br /&gt;
&lt;br /&gt;
Additionally, bit 7 in the interrupt register at 0xFFFFC5 is set if a DMA End-Of-List has been encountered.&lt;br /&gt;
&lt;br /&gt;
=== Command blocks ===&lt;br /&gt;
&lt;br /&gt;
DSP command blocks are loaded from X-Memory.&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Word&lt;br /&gt;
! Meaning&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
! 0&lt;br /&gt;
| Next command block address || Memory address of next command block.&lt;br /&gt;
Bit 14 is used as End-Of-List marker.&lt;br /&gt;
|-&lt;br /&gt;
! 1&lt;br /&gt;
| Transfer control word || Controls the DMA transfer:&lt;br /&gt;
&lt;br /&gt;
* Unknown (Bit-offset 0; 1-bit).&lt;br /&gt;
** 0 = ?&lt;br /&gt;
** 1 = ?&lt;br /&gt;
&lt;br /&gt;
* Direction (Bit-offset 1; 1-bit).&lt;br /&gt;
** 0 = Buffer to DSP&lt;br /&gt;
** 1 = DSP to buffer&lt;br /&gt;
&lt;br /&gt;
* Unknown (Bit-offset 2; 2-bit).&lt;br /&gt;
** 0 = ?&lt;br /&gt;
** 1 = ?&lt;br /&gt;
** 2 = ?&lt;br /&gt;
** 3 = ?&lt;br /&gt;
&lt;br /&gt;
* Buffer offset writeback (Bit-offset 4; 1-bit).&lt;br /&gt;
** 0 = Don't update buffer offset (Word 4)&lt;br /&gt;
** 1 = Update buffer offset (Word 4); this respects address wrapping of circular buffers&lt;br /&gt;
&lt;br /&gt;
* Buffer (Bit-offset 5; 4-bits).&lt;br /&gt;
** 0x0 = FIFO0&lt;br /&gt;
** 0x1 = FIFO1&lt;br /&gt;
** 0x2 = FIFO2{{citation needed}}&lt;br /&gt;
** 0x3 = FIFO3{{citation needed}}&lt;br /&gt;
** 0x4&lt;br /&gt;
** 0x5&lt;br /&gt;
** 0x6&lt;br /&gt;
** 0x7&lt;br /&gt;
** 0x8&lt;br /&gt;
** 0x9&lt;br /&gt;
** 0xA&lt;br /&gt;
** 0xB&lt;br /&gt;
** 0xC&lt;br /&gt;
** 0xD&lt;br /&gt;
** 0xE = Scratch-Circular&lt;br /&gt;
** 0xF = Scratch&lt;br /&gt;
&lt;br /&gt;
* Unknown (Bit-offset 9; 1-bit).&lt;br /&gt;
** 0 = ?&lt;br /&gt;
** 1 = ?&lt;br /&gt;
&lt;br /&gt;
* Sample format (Bit-offset 10; 3-bits).{{FIXME|reason=Some of these need tests with signed datatypes}}&lt;br /&gt;
** 0x0 = 8 bit (1 DSP word / 1 byte); ''sample-count must be multiple of 4, or transfer is skipped; rounded; byte MSB is flipped''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x12,0x34,0x56,0x78&amp;lt;/code&amp;gt; &amp;amp;rarr; words: &amp;lt;code&amp;gt;0x920000, 0xB40000, 0xD60000, 0xF80000&amp;lt;/code&amp;gt;&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x92,0xB4,0xD6,0xF8&amp;lt;/code&amp;gt; &amp;amp;rarr; words: &amp;lt;code&amp;gt;0x120000, 0x340000, 0x560000, 0x780000&amp;lt;/code&amp;gt;&lt;br /&gt;
*** DSP to buffer: words: &amp;lt;code&amp;gt;0x927FFF, 0xB47FFF, 0xD67FFF, 0xF87FFF&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x12,0x34,0x56,0x78&amp;lt;/code&amp;gt; ''(Rounded down)''&lt;br /&gt;
*** DSP to buffer: words: &amp;lt;code&amp;gt;0x928000, 0xB48000, 0xD68000, 0xF88000&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x13,0x35,0x57,0x79&amp;lt;/code&amp;gt; ''(Rounded up)''&lt;br /&gt;
*** DSP to buffer: words: &amp;lt;code&amp;gt;0x800000, 0x7E7FFF, 0x7E8000, 0x7FFFFF&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x00,0xFE,0xFF,0xFF&amp;lt;/code&amp;gt; ''(Saturated)''&lt;br /&gt;
** 0x1 = 16 bit (1 DSP word / 2 bytes) ''sample-count must be multiple of 2, or transfer is skipped; truncated''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x34,0x12&amp;lt;/code&amp;gt; &amp;amp;rarr; word: &amp;lt;code&amp;gt;0x123400&amp;lt;/code&amp;gt;&lt;br /&gt;
*** DSP to buffer: word: &amp;lt;code&amp;gt;0x1234FF&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x34,0x12&amp;lt;/code&amp;gt; ''(Truncated)''&lt;br /&gt;
*** DSP to buffer: word: &amp;lt;code&amp;gt;0x123400&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x34,0x12&amp;lt;/code&amp;gt; ''(Truncated)''&lt;br /&gt;
** 0x2 = 24 bit in MSB (1 DSP word / 4 bytes); ''padded''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x00,0x56,0x34,0x12&amp;lt;/code&amp;gt; &amp;amp;rarr; word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; ''(Padding ignored)''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0xFF,0x56,0x34,0x12&amp;lt;/code&amp;gt; &amp;amp;rarr; word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; ''(Padding ignored)''&lt;br /&gt;
*** DSP to buffer: word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x00,0x56,0x34,0x12&amp;lt;/code&amp;gt; ''(Zero padding)''&lt;br /&gt;
** 0x3 = 32 bit (2 DSP words / 4 bytes); ''trunacted''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x12,0xBC,0x9A,0x78&amp;lt;/code&amp;gt; &amp;amp;rarr; words: &amp;lt;code&amp;gt;0x120000, 0x789ABC&amp;lt;/code&amp;gt;&lt;br /&gt;
*** DSP to buffer: words: &amp;lt;code&amp;gt;0x12FFFF, 0x789ABC&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x12,0xBC,0x9A,0x78&amp;lt;/code&amp;gt; ''(Truncated)''&lt;br /&gt;
*** DSP to buffer: words: &amp;lt;code&amp;gt;0x120000, 0x789ABC&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x12,0xBC,0x9A,0x78&amp;lt;/code&amp;gt; ''(Truncated)''&lt;br /&gt;
** 0x4 = ''Transfer skipped''&lt;br /&gt;
** 0x5 = ''Transfer skipped''&lt;br /&gt;
** 0x6 = 24 bit in LSB (1 DSP word / 4 bytes); ''padded''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x56,0x34,0x12,0x00&amp;lt;/code&amp;gt; &amp;amp;rarr; word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; ''(Padding ignored)''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x56,0x34,0x12,0xFF&amp;lt;/code&amp;gt; &amp;amp;rarr; word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; ''(Padding ignored)''&lt;br /&gt;
*** DSP to buffer: word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x56,0x34,0x12,0x00&amp;lt;/code&amp;gt; ''(Zero padding)''&lt;br /&gt;
** 0x7 = ''Transfer skipped''&lt;br /&gt;
&lt;br /&gt;
* Unknown (Bit-offset 13; 1-bit).&lt;br /&gt;
** 0 = ?&lt;br /&gt;
** 1 = ?&lt;br /&gt;
&lt;br /&gt;
* DSP address step size (Bit-offset 14; unknown size).&lt;br /&gt;
** Each DSP word is addressed using &amp;lt;code&amp;gt;dsp_address + sample_index * step_size&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
! 2&lt;br /&gt;
| Transfer sample count || The number of samples to transfer.&lt;br /&gt;
|-&lt;br /&gt;
! 3&lt;br /&gt;
| DSP address || This is the address in the DSP:&lt;br /&gt;
* 0x0000 - 0x17FF = X-Memory&lt;br /&gt;
* 0x1800 - 0x27FF = Y-Memory&lt;br /&gt;
* 0x2800 - 0x37FF = P-Memory&lt;br /&gt;
|-&lt;br /&gt;
! 4&lt;br /&gt;
| Buffer offset || This is the address within the buffer where the first sample is accessed.&lt;br /&gt;
|-&lt;br /&gt;
! 5&lt;br /&gt;
| Buffer base || ''Only used for circular buffers, ignored otherwise.''{{FIXME|reason=Assumption; it happens for buffer 0xE, but not for buffer 0xF}}&lt;br /&gt;
The start of the buffer.&lt;br /&gt;
|-&lt;br /&gt;
! 6&lt;br /&gt;
| Buffer size || ''Only used for circular buffers, ignored otherwise.''{{FIXME|reason=Assumption; it happens for buffer 0xE, but not for buffer 0xF}}&lt;br /&gt;
Size of buffer minus 1. For a buffer with 0x1000 bytes, this has to be 0xFFF.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Related links ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/XboxDev/a56 Modernized fork of a56, open-source assembler for the similar 56000 architecture]&lt;br /&gt;
* [https://web.archive.org/web/20010212122052/http://www.parthus.com:80/platforms/parthus_mediastream/index.html MediaStream product page]&lt;br /&gt;
* [https://web.archive.org/web/20011130084353/http://www.fs2.com:80/parthus_download/ First Silicon MediaStream tools]&lt;br /&gt;
* [https://web.archive.org/web/20020213235936/http://www.tasking.com/products/MediaStream/index.html Tasking MediaStream compiler]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=DSP&amp;diff=6617</id>
		<title>DSP</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=DSP&amp;diff=6617"/>
				<updated>2018-12-27T11:00:30Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The DSPs in the APU are probably &amp;quot;Parthus MediaStream&amp;quot; DSP cores (probably the 24-bit DSP2420 &amp;quot;Mozart&amp;quot; core).&lt;br /&gt;
&lt;br /&gt;
Those are similar to Motorola DSP56362 (DSP56300 Family). If so, the datasheet can be found at http://www.nxp.com/docs/en/data-sheet/DSP56362.pdf (Also see &amp;quot;Documentation&amp;quot; section in said datasheet for the related documentation)&lt;br /&gt;
&lt;br /&gt;
== Memory Size ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!&lt;br /&gt;
! Program RAM Size&lt;br /&gt;
! X Data RAM Size&lt;br /&gt;
! Y Data RAM Size&lt;br /&gt;
! MIXBUF Size&lt;br /&gt;
|-&lt;br /&gt;
! GP&lt;br /&gt;
| 4096 x 24-bit&lt;br /&gt;
| 4096 x 24-bit&lt;br /&gt;
| 2048 x 24-bit&lt;br /&gt;
| 992{{FIXME|reason=This is probably 1024 words, but the last 32 words were not working as intended during my testing}} x 24-bit&lt;br /&gt;
|-&lt;br /&gt;
! EP&lt;br /&gt;
| 4096 x 24-bit&lt;br /&gt;
| 3072 x 24-bit&lt;br /&gt;
| 256 x 24-bit&lt;br /&gt;
| n/a&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
MIXBUF is accessible at X:$001400 in the GP.&lt;br /&gt;
&lt;br /&gt;
Other datasheets for similar DSPs suggest that the memory sizes might be different if instruction cache or switch mode are toggled.&lt;br /&gt;
It is currently unknown if the DSPs in the Xbox APU support a similar feature{{FIXME}}.&lt;br /&gt;
&lt;br /&gt;
== DMA ==&lt;br /&gt;
&lt;br /&gt;
''This section is very incomplete and not much was tested on hardware either''&lt;br /&gt;
&lt;br /&gt;
DMA is controlled using peripheral registers:&lt;br /&gt;
&lt;br /&gt;
* 0xFFFFD4: Memory address of next command block&lt;br /&gt;
* 0xFFFFD5: DMA_START_BLOCK{{FIXME|reason=How is this used?}}&lt;br /&gt;
* 0xFFFFD6: DMA_CONTROL{{FIXME|reason=Explain the bits}}&lt;br /&gt;
* 0xFFFFD7: DMA_CONFIGURATION{{FIXME|reason=Explain the bits}}&lt;br /&gt;
&lt;br /&gt;
Additionally, bit 7 in the interrupt register at 0xFFFFC5 is set if a DMA End-Of-List has been encountered.&lt;br /&gt;
&lt;br /&gt;
=== Command blocks ===&lt;br /&gt;
&lt;br /&gt;
DSP command blocks are loaded from X-Memory.&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Word&lt;br /&gt;
! Meaning&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
! 0&lt;br /&gt;
| Next command block address || Memory address of next command block.&lt;br /&gt;
Bit 14 is used as End-Of-List marker.&lt;br /&gt;
|-&lt;br /&gt;
! 1&lt;br /&gt;
| Transfer control word || Controls the DMA transfer:&lt;br /&gt;
&lt;br /&gt;
* Unknown (Bit-offset 0; 1-bit).&lt;br /&gt;
** 0 = ?&lt;br /&gt;
** 1 = ?&lt;br /&gt;
&lt;br /&gt;
* Direction (Bit-offset 1; 1-bit).&lt;br /&gt;
** 0 = Buffer to DSP&lt;br /&gt;
** 1 = DSP to buffer&lt;br /&gt;
&lt;br /&gt;
* Unknown (Bit-offset 2; 2-bit).&lt;br /&gt;
** 0 = ?&lt;br /&gt;
** 1 = ?&lt;br /&gt;
** 2 = ?&lt;br /&gt;
** 3 = ?&lt;br /&gt;
&lt;br /&gt;
* Buffer offset writeback (Bit-offset 4; 1-bit).&lt;br /&gt;
** 0 = Don't update buffer offset (Word 4)&lt;br /&gt;
** 1 = Update buffer offset (Word 4); this respects address wrapping of circular buffers&lt;br /&gt;
&lt;br /&gt;
* Buffer (Bit-offset 5; 4-bits).&lt;br /&gt;
** 0x0 = FIFO0&lt;br /&gt;
** 0x1 = FIFO1&lt;br /&gt;
** 0x2 = FIFO2{{citation needed}}&lt;br /&gt;
** 0x3 = FIFO3{{citation needed}}&lt;br /&gt;
** 0x4&lt;br /&gt;
** 0x5&lt;br /&gt;
** 0x6&lt;br /&gt;
** 0x7&lt;br /&gt;
** 0x8&lt;br /&gt;
** 0x9&lt;br /&gt;
** 0xA&lt;br /&gt;
** 0xB&lt;br /&gt;
** 0xC&lt;br /&gt;
** 0xD&lt;br /&gt;
** 0xE = Scratch-Circular&lt;br /&gt;
** 0xF = Scratch&lt;br /&gt;
&lt;br /&gt;
* Unknown (Bit-offset 9; 1-bit).&lt;br /&gt;
** 0 = ?&lt;br /&gt;
** 1 = ?&lt;br /&gt;
&lt;br /&gt;
* Sample format (Bit-offset 10; 3-bits).{{FIXME|reason=Some of these need tests with signed datatypes}}&lt;br /&gt;
** 0x0 = 8 bit (1 DSP word / 1 byte); ''sample-count must be multiple of 4, or transfer is skipped; rounded; byte MSB is flipped''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x12,0x34,0x56,0x78&amp;lt;/code&amp;gt; &amp;amp;rarr; words: &amp;lt;code&amp;gt;0x920000, 0xB40000, 0xD60000, 0xF80000&amp;lt;/code&amp;gt;&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x92,0xB4,0xD6,0xF8&amp;lt;/code&amp;gt; &amp;amp;rarr; words: &amp;lt;code&amp;gt;0x120000, 0x340000, 0x560000, 0x780000&amp;lt;/code&amp;gt;&lt;br /&gt;
*** DSP to buffer: words: &amp;lt;code&amp;gt;0x927FFF, 0xB47FFF, 0xD67FFF, 0xF87FFF&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x12,0x34,0x56,0x78&amp;lt;/code&amp;gt; ''(Rounded down)''&lt;br /&gt;
*** DSP to buffer: words: &amp;lt;code&amp;gt;0x928000, 0xB48000, 0xD68000, 0xF88000&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x13,0x35,0x57,0x79&amp;lt;/code&amp;gt; ''(Rounded up)''&lt;br /&gt;
*** DSP to buffer: words: &amp;lt;code&amp;gt;0x800000, 0x7E7FFF, 0x7E8000, 0x7FFFFF&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x00,0xFE,0xFF,0xFF&amp;lt;/code&amp;gt; ''(Saturated)''&lt;br /&gt;
** 0x1 = 16 bit (1 DSP word / 2 bytes) ''sample-count must be multiple of 2, or transfer is skipped; truncated''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x34,0x12&amp;lt;/code&amp;gt; &amp;amp;rarr; word: &amp;lt;code&amp;gt;0x123400&amp;lt;/code&amp;gt;&lt;br /&gt;
*** DSP to buffer: word: &amp;lt;code&amp;gt;0x1234FF&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x34,0x12&amp;lt;/code&amp;gt; ''(Truncated)''&lt;br /&gt;
*** DSP to buffer: word: &amp;lt;code&amp;gt;0x123400&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x34,0x12&amp;lt;/code&amp;gt; ''(Truncated)''&lt;br /&gt;
** 0x2 = 24 bit in MSB (1 DSP word / 4 bytes); ''padded''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x00,0x56,0x34,0x12&amp;lt;/code&amp;gt; &amp;amp;rarr; word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; ''(Padding ignored)''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0xFF,0x56,0x34,0x12&amp;lt;/code&amp;gt; &amp;amp;rarr; word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; ''(Padding ignored)''&lt;br /&gt;
*** DSP to buffer: word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x00,0x56,0x34,0x12&amp;lt;/code&amp;gt; ''(Zero padding)''&lt;br /&gt;
** 0x3 = 32 bit (2 DSP words / 4 bytes); ''trunacted''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x12,0xBC,0x9A,0x78&amp;lt;/code&amp;gt; &amp;amp;rarr; words: &amp;lt;code&amp;gt;0x120000, 0x789ABC&amp;lt;/code&amp;gt;&lt;br /&gt;
*** DSP to buffer: words: &amp;lt;code&amp;gt;0x12FFFF, 0x789ABC&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x12,0xBC,0x9A,0x78&amp;lt;/code&amp;gt; ''(Truncated)''&lt;br /&gt;
*** DSP to buffer: words: &amp;lt;code&amp;gt;0x120000, 0x789ABC&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x12,0xBC,0x9A,0x78&amp;lt;/code&amp;gt; ''(Truncated)''&lt;br /&gt;
** 0x4 = ''Transfer skipped''&lt;br /&gt;
** 0x5 = ''Transfer skipped''&lt;br /&gt;
** 0x6 = 24 bit in LSB (1 DSP word / 4 bytes); ''padded''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x56,0x34,0x12,0x00&amp;lt;/code&amp;gt; &amp;amp;rarr; word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; ''(Padding ignored)''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x56,0x34,0x12,0xFF&amp;lt;/code&amp;gt; &amp;amp;rarr; word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; ''(Padding ignored)''&lt;br /&gt;
*** DSP to buffer: word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x56,0x34,0x12,0x00&amp;lt;/code&amp;gt; ''(Zero padding)''&lt;br /&gt;
** 0x7 = ''Transfer skipped''&lt;br /&gt;
&lt;br /&gt;
* Unknown (Bit-offset 13; 1-bit).&lt;br /&gt;
** 0 = ?&lt;br /&gt;
** 1 = ?&lt;br /&gt;
&lt;br /&gt;
* DSP address step size (Bit-offset 14; unknown size).&lt;br /&gt;
** Each DSP word is addressed using &amp;lt;code&amp;gt;dsp_address + sample_index * step_size&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
! 2&lt;br /&gt;
| Transfer sample count || The number of samples to transfer.&lt;br /&gt;
|-&lt;br /&gt;
! 3&lt;br /&gt;
| DSP address || This is the address in the DSP:&lt;br /&gt;
* 0x0000 - 0x17FF = X-Memory&lt;br /&gt;
* 0x1800 - 0x27FF = Y-Memory&lt;br /&gt;
* 0x2800 - 0x37FF = P-Memory&lt;br /&gt;
|-&lt;br /&gt;
! 4&lt;br /&gt;
| Buffer offset || This is the address within the buffer where the first sample is accessed.&lt;br /&gt;
|-&lt;br /&gt;
! 5&lt;br /&gt;
| Buffer base || ''Only used for circular buffers, ignored otherwise.''{{FIXME|reason=Assumption; it happens for buffer 0xE, but not for buffer 0xF}}&lt;br /&gt;
The start of the buffer.&lt;br /&gt;
|-&lt;br /&gt;
! 6&lt;br /&gt;
| Buffer size || ''Only used for circular buffers, ignored otherwise.''{{FIXME|reason=Assumption; it happens for buffer 0xE, but not for buffer 0xF}}&lt;br /&gt;
Size of buffer minus 1. For a buffer with 0x1000 bytes, this has to be 0xFFF.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Related links ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/XboxDev/a56 Modernized fork of a56, open-source assembler for the similar 56000 architecture]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=DSP&amp;diff=6616</id>
		<title>DSP</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=DSP&amp;diff=6616"/>
				<updated>2018-12-27T10:45:16Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The DSPs in the APU are probably &amp;quot;Parthus MediaStream&amp;quot; DSP cores (probably the 24-bit DSP2420 &amp;quot;Mozart&amp;quot; code).&lt;br /&gt;
&lt;br /&gt;
Those are similar to Motorola DSP56362 (DSP56300 Family). If so, the datasheet can be found at http://www.nxp.com/docs/en/data-sheet/DSP56362.pdf (Also see &amp;quot;Documentation&amp;quot; section in said datasheet for the related documentation)&lt;br /&gt;
&lt;br /&gt;
== Memory Size ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!&lt;br /&gt;
! Program RAM Size&lt;br /&gt;
! X Data RAM Size&lt;br /&gt;
! Y Data RAM Size&lt;br /&gt;
! MIXBUF Size&lt;br /&gt;
|-&lt;br /&gt;
! GP&lt;br /&gt;
| 4096 x 24-bit&lt;br /&gt;
| 4096 x 24-bit&lt;br /&gt;
| 2048 x 24-bit&lt;br /&gt;
| 992{{FIXME|reason=This is probably 1024 words, but the last 32 words were not working as intended during my testing}} x 24-bit&lt;br /&gt;
|-&lt;br /&gt;
! EP&lt;br /&gt;
| 4096 x 24-bit&lt;br /&gt;
| 3072 x 24-bit&lt;br /&gt;
| 256 x 24-bit&lt;br /&gt;
| n/a&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
MIXBUF is accessible at X:$001400 in the GP.&lt;br /&gt;
&lt;br /&gt;
Other datasheets for similar DSPs suggest that the memory sizes might be different if instruction cache or switch mode are toggled.&lt;br /&gt;
It is currently unknown if the DSPs in the Xbox APU support a similar feature{{FIXME}}.&lt;br /&gt;
&lt;br /&gt;
== DMA ==&lt;br /&gt;
&lt;br /&gt;
''This section is very incomplete and not much was tested on hardware either''&lt;br /&gt;
&lt;br /&gt;
DMA is controlled using peripheral registers:&lt;br /&gt;
&lt;br /&gt;
* 0xFFFFD4: Memory address of next command block&lt;br /&gt;
* 0xFFFFD5: DMA_START_BLOCK{{FIXME|reason=How is this used?}}&lt;br /&gt;
* 0xFFFFD6: DMA_CONTROL{{FIXME|reason=Explain the bits}}&lt;br /&gt;
* 0xFFFFD7: DMA_CONFIGURATION{{FIXME|reason=Explain the bits}}&lt;br /&gt;
&lt;br /&gt;
Additionally, bit 7 in the interrupt register at 0xFFFFC5 is set if a DMA End-Of-List has been encountered.&lt;br /&gt;
&lt;br /&gt;
=== Command blocks ===&lt;br /&gt;
&lt;br /&gt;
DSP command blocks are loaded from X-Memory.&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Word&lt;br /&gt;
! Meaning&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
! 0&lt;br /&gt;
| Next command block address || Memory address of next command block.&lt;br /&gt;
Bit 14 is used as End-Of-List marker.&lt;br /&gt;
|-&lt;br /&gt;
! 1&lt;br /&gt;
| Transfer control word || Controls the DMA transfer:&lt;br /&gt;
&lt;br /&gt;
* Unknown (Bit-offset 0; 1-bit).&lt;br /&gt;
** 0 = ?&lt;br /&gt;
** 1 = ?&lt;br /&gt;
&lt;br /&gt;
* Direction (Bit-offset 1; 1-bit).&lt;br /&gt;
** 0 = Buffer to DSP&lt;br /&gt;
** 1 = DSP to buffer&lt;br /&gt;
&lt;br /&gt;
* Unknown (Bit-offset 2; 2-bit).&lt;br /&gt;
** 0 = ?&lt;br /&gt;
** 1 = ?&lt;br /&gt;
** 2 = ?&lt;br /&gt;
** 3 = ?&lt;br /&gt;
&lt;br /&gt;
* Buffer offset writeback (Bit-offset 4; 1-bit).&lt;br /&gt;
** 0 = Don't update buffer offset (Word 4)&lt;br /&gt;
** 1 = Update buffer offset (Word 4); this respects address wrapping of circular buffers&lt;br /&gt;
&lt;br /&gt;
* Buffer (Bit-offset 5; 4-bits).&lt;br /&gt;
** 0x0 = FIFO0&lt;br /&gt;
** 0x1 = FIFO1&lt;br /&gt;
** 0x2 = FIFO2{{citation needed}}&lt;br /&gt;
** 0x3 = FIFO3{{citation needed}}&lt;br /&gt;
** 0x4&lt;br /&gt;
** 0x5&lt;br /&gt;
** 0x6&lt;br /&gt;
** 0x7&lt;br /&gt;
** 0x8&lt;br /&gt;
** 0x9&lt;br /&gt;
** 0xA&lt;br /&gt;
** 0xB&lt;br /&gt;
** 0xC&lt;br /&gt;
** 0xD&lt;br /&gt;
** 0xE = Scratch-Circular&lt;br /&gt;
** 0xF = Scratch&lt;br /&gt;
&lt;br /&gt;
* Unknown (Bit-offset 9; 1-bit).&lt;br /&gt;
** 0 = ?&lt;br /&gt;
** 1 = ?&lt;br /&gt;
&lt;br /&gt;
* Sample format (Bit-offset 10; 3-bits).{{FIXME|reason=Some of these need tests with signed datatypes}}&lt;br /&gt;
** 0x0 = 8 bit (1 DSP word / 1 byte); ''sample-count must be multiple of 4, or transfer is skipped; rounded; byte MSB is flipped''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x12,0x34,0x56,0x78&amp;lt;/code&amp;gt; &amp;amp;rarr; words: &amp;lt;code&amp;gt;0x920000, 0xB40000, 0xD60000, 0xF80000&amp;lt;/code&amp;gt;&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x92,0xB4,0xD6,0xF8&amp;lt;/code&amp;gt; &amp;amp;rarr; words: &amp;lt;code&amp;gt;0x120000, 0x340000, 0x560000, 0x780000&amp;lt;/code&amp;gt;&lt;br /&gt;
*** DSP to buffer: words: &amp;lt;code&amp;gt;0x927FFF, 0xB47FFF, 0xD67FFF, 0xF87FFF&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x12,0x34,0x56,0x78&amp;lt;/code&amp;gt; ''(Rounded down)''&lt;br /&gt;
*** DSP to buffer: words: &amp;lt;code&amp;gt;0x928000, 0xB48000, 0xD68000, 0xF88000&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x13,0x35,0x57,0x79&amp;lt;/code&amp;gt; ''(Rounded up)''&lt;br /&gt;
*** DSP to buffer: words: &amp;lt;code&amp;gt;0x800000, 0x7E7FFF, 0x7E8000, 0x7FFFFF&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x00,0xFE,0xFF,0xFF&amp;lt;/code&amp;gt; ''(Saturated)''&lt;br /&gt;
** 0x1 = 16 bit (1 DSP word / 2 bytes) ''sample-count must be multiple of 2, or transfer is skipped; truncated''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x34,0x12&amp;lt;/code&amp;gt; &amp;amp;rarr; word: &amp;lt;code&amp;gt;0x123400&amp;lt;/code&amp;gt;&lt;br /&gt;
*** DSP to buffer: word: &amp;lt;code&amp;gt;0x1234FF&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x34,0x12&amp;lt;/code&amp;gt; ''(Truncated)''&lt;br /&gt;
*** DSP to buffer: word: &amp;lt;code&amp;gt;0x123400&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x34,0x12&amp;lt;/code&amp;gt; ''(Truncated)''&lt;br /&gt;
** 0x2 = 24 bit in MSB (1 DSP word / 4 bytes); ''padded''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x00,0x56,0x34,0x12&amp;lt;/code&amp;gt; &amp;amp;rarr; word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; ''(Padding ignored)''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0xFF,0x56,0x34,0x12&amp;lt;/code&amp;gt; &amp;amp;rarr; word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; ''(Padding ignored)''&lt;br /&gt;
*** DSP to buffer: word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x00,0x56,0x34,0x12&amp;lt;/code&amp;gt; ''(Zero padding)''&lt;br /&gt;
** 0x3 = 32 bit (2 DSP words / 4 bytes); ''trunacted''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x12,0xBC,0x9A,0x78&amp;lt;/code&amp;gt; &amp;amp;rarr; words: &amp;lt;code&amp;gt;0x120000, 0x789ABC&amp;lt;/code&amp;gt;&lt;br /&gt;
*** DSP to buffer: words: &amp;lt;code&amp;gt;0x12FFFF, 0x789ABC&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x12,0xBC,0x9A,0x78&amp;lt;/code&amp;gt; ''(Truncated)''&lt;br /&gt;
*** DSP to buffer: words: &amp;lt;code&amp;gt;0x120000, 0x789ABC&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x12,0xBC,0x9A,0x78&amp;lt;/code&amp;gt; ''(Truncated)''&lt;br /&gt;
** 0x4 = ''Transfer skipped''&lt;br /&gt;
** 0x5 = ''Transfer skipped''&lt;br /&gt;
** 0x6 = 24 bit in LSB (1 DSP word / 4 bytes); ''padded''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x56,0x34,0x12,0x00&amp;lt;/code&amp;gt; &amp;amp;rarr; word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; ''(Padding ignored)''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x56,0x34,0x12,0xFF&amp;lt;/code&amp;gt; &amp;amp;rarr; word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; ''(Padding ignored)''&lt;br /&gt;
*** DSP to buffer: word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x56,0x34,0x12,0x00&amp;lt;/code&amp;gt; ''(Zero padding)''&lt;br /&gt;
** 0x7 = ''Transfer skipped''&lt;br /&gt;
&lt;br /&gt;
* Unknown (Bit-offset 13; 1-bit).&lt;br /&gt;
** 0 = ?&lt;br /&gt;
** 1 = ?&lt;br /&gt;
&lt;br /&gt;
* DSP address step size (Bit-offset 14; unknown size).&lt;br /&gt;
** Each DSP word is addressed using &amp;lt;code&amp;gt;dsp_address + sample_index * step_size&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
! 2&lt;br /&gt;
| Transfer sample count || The number of samples to transfer.&lt;br /&gt;
|-&lt;br /&gt;
! 3&lt;br /&gt;
| DSP address || This is the address in the DSP:&lt;br /&gt;
* 0x0000 - 0x17FF = X-Memory&lt;br /&gt;
* 0x1800 - 0x27FF = Y-Memory&lt;br /&gt;
* 0x2800 - 0x37FF = P-Memory&lt;br /&gt;
|-&lt;br /&gt;
! 4&lt;br /&gt;
| Buffer offset || This is the address within the buffer where the first sample is accessed.&lt;br /&gt;
|-&lt;br /&gt;
! 5&lt;br /&gt;
| Buffer base || ''Only used for circular buffers, ignored otherwise.''{{FIXME|reason=Assumption; it happens for buffer 0xE, but not for buffer 0xF}}&lt;br /&gt;
The start of the buffer.&lt;br /&gt;
|-&lt;br /&gt;
! 6&lt;br /&gt;
| Buffer size || ''Only used for circular buffers, ignored otherwise.''{{FIXME|reason=Assumption; it happens for buffer 0xE, but not for buffer 0xF}}&lt;br /&gt;
Size of buffer minus 1. For a buffer with 0x1000 bytes, this has to be 0xFFF.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Related links ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/XboxDev/a56 Modernized fork of a56, open-source assembler for the similar 56000 architecture]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=DSP&amp;diff=6615</id>
		<title>DSP</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=DSP&amp;diff=6615"/>
				<updated>2018-12-27T10:29:46Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The DSPs in the APU are probably &amp;quot;Parthus MediaStream&amp;quot; DSP core (DSP2410/DSP2420?).&lt;br /&gt;
&lt;br /&gt;
Those are similar to Motorola DSP56362 (DSP56300 Family). If so, the datasheet can be found at http://www.nxp.com/docs/en/data-sheet/DSP56362.pdf (Also see &amp;quot;Documentation&amp;quot; section in said datasheet for the related documentation)&lt;br /&gt;
&lt;br /&gt;
== Memory Size ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!&lt;br /&gt;
! Program RAM Size&lt;br /&gt;
! X Data RAM Size&lt;br /&gt;
! Y Data RAM Size&lt;br /&gt;
! MIXBUF Size&lt;br /&gt;
|-&lt;br /&gt;
! GP&lt;br /&gt;
| 4096 x 24-bit&lt;br /&gt;
| 4096 x 24-bit&lt;br /&gt;
| 2048 x 24-bit&lt;br /&gt;
| 992{{FIXME|reason=This is probably 1024 words, but the last 32 words were not working as intended during my testing}} x 24-bit&lt;br /&gt;
|-&lt;br /&gt;
! EP&lt;br /&gt;
| 4096 x 24-bit&lt;br /&gt;
| 3072 x 24-bit&lt;br /&gt;
| 256 x 24-bit&lt;br /&gt;
| n/a&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
MIXBUF is accessible at X:$001400 in the GP.&lt;br /&gt;
&lt;br /&gt;
Other datasheets for similar DSPs suggest that the memory sizes might be different if instruction cache or switch mode are toggled.&lt;br /&gt;
It is currently unknown if the DSPs in the Xbox APU support a similar feature{{FIXME}}.&lt;br /&gt;
&lt;br /&gt;
== DMA ==&lt;br /&gt;
&lt;br /&gt;
''This section is very incomplete and not much was tested on hardware either''&lt;br /&gt;
&lt;br /&gt;
DMA is controlled using peripheral registers:&lt;br /&gt;
&lt;br /&gt;
* 0xFFFFD4: Memory address of next command block&lt;br /&gt;
* 0xFFFFD5: DMA_START_BLOCK{{FIXME|reason=How is this used?}}&lt;br /&gt;
* 0xFFFFD6: DMA_CONTROL{{FIXME|reason=Explain the bits}}&lt;br /&gt;
* 0xFFFFD7: DMA_CONFIGURATION{{FIXME|reason=Explain the bits}}&lt;br /&gt;
&lt;br /&gt;
Additionally, bit 7 in the interrupt register at 0xFFFFC5 is set if a DMA End-Of-List has been encountered.&lt;br /&gt;
&lt;br /&gt;
=== Command blocks ===&lt;br /&gt;
&lt;br /&gt;
DSP command blocks are loaded from X-Memory.&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Word&lt;br /&gt;
! Meaning&lt;br /&gt;
! Notes&lt;br /&gt;
|-&lt;br /&gt;
! 0&lt;br /&gt;
| Next command block address || Memory address of next command block.&lt;br /&gt;
Bit 14 is used as End-Of-List marker.&lt;br /&gt;
|-&lt;br /&gt;
! 1&lt;br /&gt;
| Transfer control word || Controls the DMA transfer:&lt;br /&gt;
&lt;br /&gt;
* Unknown (Bit-offset 0; 1-bit).&lt;br /&gt;
** 0 = ?&lt;br /&gt;
** 1 = ?&lt;br /&gt;
&lt;br /&gt;
* Direction (Bit-offset 1; 1-bit).&lt;br /&gt;
** 0 = Buffer to DSP&lt;br /&gt;
** 1 = DSP to buffer&lt;br /&gt;
&lt;br /&gt;
* Unknown (Bit-offset 2; 2-bit).&lt;br /&gt;
** 0 = ?&lt;br /&gt;
** 1 = ?&lt;br /&gt;
** 2 = ?&lt;br /&gt;
** 3 = ?&lt;br /&gt;
&lt;br /&gt;
* Buffer offset writeback (Bit-offset 4; 1-bit).&lt;br /&gt;
** 0 = Don't update buffer offset (Word 4)&lt;br /&gt;
** 1 = Update buffer offset (Word 4); this respects address wrapping of circular buffers&lt;br /&gt;
&lt;br /&gt;
* Buffer (Bit-offset 5; 4-bits).&lt;br /&gt;
** 0x0 = FIFO0&lt;br /&gt;
** 0x1 = FIFO1&lt;br /&gt;
** 0x2 = FIFO2{{citation needed}}&lt;br /&gt;
** 0x3 = FIFO3{{citation needed}}&lt;br /&gt;
** 0x4&lt;br /&gt;
** 0x5&lt;br /&gt;
** 0x6&lt;br /&gt;
** 0x7&lt;br /&gt;
** 0x8&lt;br /&gt;
** 0x9&lt;br /&gt;
** 0xA&lt;br /&gt;
** 0xB&lt;br /&gt;
** 0xC&lt;br /&gt;
** 0xD&lt;br /&gt;
** 0xE = Scratch-Circular&lt;br /&gt;
** 0xF = Scratch&lt;br /&gt;
&lt;br /&gt;
* Unknown (Bit-offset 9; 1-bit).&lt;br /&gt;
** 0 = ?&lt;br /&gt;
** 1 = ?&lt;br /&gt;
&lt;br /&gt;
* Sample format (Bit-offset 10; 3-bits).{{FIXME|reason=Some of these need tests with signed datatypes}}&lt;br /&gt;
** 0x0 = 8 bit (1 DSP word / 1 byte); ''sample-count must be multiple of 4, or transfer is skipped; rounded; byte MSB is flipped''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x12,0x34,0x56,0x78&amp;lt;/code&amp;gt; &amp;amp;rarr; words: &amp;lt;code&amp;gt;0x920000, 0xB40000, 0xD60000, 0xF80000&amp;lt;/code&amp;gt;&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x92,0xB4,0xD6,0xF8&amp;lt;/code&amp;gt; &amp;amp;rarr; words: &amp;lt;code&amp;gt;0x120000, 0x340000, 0x560000, 0x780000&amp;lt;/code&amp;gt;&lt;br /&gt;
*** DSP to buffer: words: &amp;lt;code&amp;gt;0x927FFF, 0xB47FFF, 0xD67FFF, 0xF87FFF&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x12,0x34,0x56,0x78&amp;lt;/code&amp;gt; ''(Rounded down)''&lt;br /&gt;
*** DSP to buffer: words: &amp;lt;code&amp;gt;0x928000, 0xB48000, 0xD68000, 0xF88000&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x13,0x35,0x57,0x79&amp;lt;/code&amp;gt; ''(Rounded up)''&lt;br /&gt;
*** DSP to buffer: words: &amp;lt;code&amp;gt;0x800000, 0x7E7FFF, 0x7E8000, 0x7FFFFF&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x00,0xFE,0xFF,0xFF&amp;lt;/code&amp;gt; ''(Saturated)''&lt;br /&gt;
** 0x1 = 16 bit (1 DSP word / 2 bytes) ''sample-count must be multiple of 2, or transfer is skipped; truncated''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x34,0x12&amp;lt;/code&amp;gt; &amp;amp;rarr; word: &amp;lt;code&amp;gt;0x123400&amp;lt;/code&amp;gt;&lt;br /&gt;
*** DSP to buffer: word: &amp;lt;code&amp;gt;0x1234FF&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x34,0x12&amp;lt;/code&amp;gt; ''(Truncated)''&lt;br /&gt;
*** DSP to buffer: word: &amp;lt;code&amp;gt;0x123400&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x34,0x12&amp;lt;/code&amp;gt; ''(Truncated)''&lt;br /&gt;
** 0x2 = 24 bit in MSB (1 DSP word / 4 bytes); ''padded''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x00,0x56,0x34,0x12&amp;lt;/code&amp;gt; &amp;amp;rarr; word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; ''(Padding ignored)''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0xFF,0x56,0x34,0x12&amp;lt;/code&amp;gt; &amp;amp;rarr; word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; ''(Padding ignored)''&lt;br /&gt;
*** DSP to buffer: word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x00,0x56,0x34,0x12&amp;lt;/code&amp;gt; ''(Zero padding)''&lt;br /&gt;
** 0x3 = 32 bit (2 DSP words / 4 bytes); ''trunacted''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x12,0xBC,0x9A,0x78&amp;lt;/code&amp;gt; &amp;amp;rarr; words: &amp;lt;code&amp;gt;0x120000, 0x789ABC&amp;lt;/code&amp;gt;&lt;br /&gt;
*** DSP to buffer: words: &amp;lt;code&amp;gt;0x12FFFF, 0x789ABC&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x12,0xBC,0x9A,0x78&amp;lt;/code&amp;gt; ''(Truncated)''&lt;br /&gt;
*** DSP to buffer: words: &amp;lt;code&amp;gt;0x120000, 0x789ABC&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x12,0xBC,0x9A,0x78&amp;lt;/code&amp;gt; ''(Truncated)''&lt;br /&gt;
** 0x4 = ''Transfer skipped''&lt;br /&gt;
** 0x5 = ''Transfer skipped''&lt;br /&gt;
** 0x6 = 24 bit in LSB (1 DSP word / 4 bytes); ''padded''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x56,0x34,0x12,0x00&amp;lt;/code&amp;gt; &amp;amp;rarr; word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; ''(Padding ignored)''&lt;br /&gt;
*** Buffer to DSP: bytes: &amp;lt;code&amp;gt;0x56,0x34,0x12,0xFF&amp;lt;/code&amp;gt; &amp;amp;rarr; word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; ''(Padding ignored)''&lt;br /&gt;
*** DSP to buffer: word: &amp;lt;code&amp;gt;0x123456&amp;lt;/code&amp;gt; &amp;amp;rarr; bytes: &amp;lt;code&amp;gt;0x56,0x34,0x12,0x00&amp;lt;/code&amp;gt; ''(Zero padding)''&lt;br /&gt;
** 0x7 = ''Transfer skipped''&lt;br /&gt;
&lt;br /&gt;
* Unknown (Bit-offset 13; 1-bit).&lt;br /&gt;
** 0 = ?&lt;br /&gt;
** 1 = ?&lt;br /&gt;
&lt;br /&gt;
* DSP address step size (Bit-offset 14; unknown size).&lt;br /&gt;
** Each DSP word is addressed using &amp;lt;code&amp;gt;dsp_address + sample_index * step_size&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
! 2&lt;br /&gt;
| Transfer sample count || The number of samples to transfer.&lt;br /&gt;
|-&lt;br /&gt;
! 3&lt;br /&gt;
| DSP address || This is the address in the DSP:&lt;br /&gt;
* 0x0000 - 0x17FF = X-Memory&lt;br /&gt;
* 0x1800 - 0x27FF = Y-Memory&lt;br /&gt;
* 0x2800 - 0x37FF = P-Memory&lt;br /&gt;
|-&lt;br /&gt;
! 4&lt;br /&gt;
| Buffer offset || This is the address within the buffer where the first sample is accessed.&lt;br /&gt;
|-&lt;br /&gt;
! 5&lt;br /&gt;
| Buffer base || ''Only used for circular buffers, ignored otherwise.''{{FIXME|reason=Assumption; it happens for buffer 0xE, but not for buffer 0xF}}&lt;br /&gt;
The start of the buffer.&lt;br /&gt;
|-&lt;br /&gt;
! 6&lt;br /&gt;
| Buffer size || ''Only used for circular buffers, ignored otherwise.''{{FIXME|reason=Assumption; it happens for buffer 0xE, but not for buffer 0xF}}&lt;br /&gt;
Size of buffer minus 1. For a buffer with 0x1000 bytes, this has to be 0xFFF.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Related links ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/XboxDev/a56 Modernized fork of a56, open-source assembler for the similar 56000 architecture]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=6607</id>
		<title>Main Page</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=6607"/>
				<updated>2018-12-21T21:48:54Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: /* Historical Pages */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{:Main Page/Header}}&lt;br /&gt;
__NOTOC__&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
* [[Chihiro]]&lt;br /&gt;
* [[Xbox]]&lt;br /&gt;
&lt;br /&gt;
* [[Hardware Revisions]]&lt;br /&gt;
* [[Motherboard]]&lt;br /&gt;
* [[CPU]]&lt;br /&gt;
* [[NV2A]]&lt;br /&gt;
** [[NV2A/Vertex attributes]]&lt;br /&gt;
** [[NV2A/Fixed Function Pipeline]]&lt;br /&gt;
** [[NV2A/Vertex Shader]]&lt;br /&gt;
** [[NV2A/Pixel Combiner]]&lt;br /&gt;
** [[NV2A/Surface Formats]]&lt;br /&gt;
* [[Memory]]&lt;br /&gt;
* [[Flash ROM]]&lt;br /&gt;
* [[MCPX]]&lt;br /&gt;
** [[APU]]&lt;br /&gt;
** [[ACI]]&lt;br /&gt;
** [[Network]]&lt;br /&gt;
* [[SMBus]]&lt;br /&gt;
** [[EEPROM]]&lt;br /&gt;
** [[SMC]]&lt;br /&gt;
** [[Video Encoder]]&lt;br /&gt;
*** [[AV Cables]]&lt;br /&gt;
* [[DVD Drive]]&lt;br /&gt;
** [[Xbox Game Disc]]&lt;br /&gt;
* [[Hard Drive]]&lt;br /&gt;
* [[USB]]&lt;br /&gt;
** [[Xbox Input Devices]]&lt;br /&gt;
** [[Xbox Memory Unit]]&lt;br /&gt;
** [[Xbox Live Communicator]] &amp;lt;!-- Maybe rename this to microphones later? --&amp;gt;&lt;br /&gt;
** [[Xbox DVD Movie Playback Kit]]&lt;br /&gt;
* [[Power Supply]]&lt;br /&gt;
* [[Development Kits]]&lt;br /&gt;
** [[Super I/O]]&lt;br /&gt;
** [[DVD Emulator]]&lt;br /&gt;
* [[Manufacturing Process]]&lt;br /&gt;
&lt;br /&gt;
== System Software ==&lt;br /&gt;
* [[MCPX ROM]]&lt;br /&gt;
* [[BIOS]] / [[Kernel]]&lt;br /&gt;
** [[Boot Process]]&lt;br /&gt;
** [[XBE]] (Executable file format)&lt;br /&gt;
* [[FATX]] (Filesystem)&lt;br /&gt;
* [[Dashboard]]&lt;br /&gt;
** [[Soundtracks]]&lt;br /&gt;
* [[Exploits]]&lt;br /&gt;
&lt;br /&gt;
== Development Kits and Tools ==&lt;br /&gt;
* [https://github.com/xqemu/nxdk nxdk (New Xbox Development Kit)]&lt;br /&gt;
* [[OpenXDK]]&lt;br /&gt;
* [[Microsoft XDK]]&lt;br /&gt;
** [[Xbox Title Libraries]]&lt;br /&gt;
** [[Direct3D]]&lt;br /&gt;
** [[DirectSound]]&lt;br /&gt;
** [[System Link]]&lt;br /&gt;
** [[Xbox Live]]&lt;br /&gt;
** [[Xbox Debug Monitor]]&lt;br /&gt;
** [[Xbox Neighborhood]]&lt;br /&gt;
** [[Kernel_Debug| Xbox Kernel Debugging]]&lt;br /&gt;
&lt;br /&gt;
== Games ==&lt;br /&gt;
* [[:Category:Games|Games]]&lt;br /&gt;
* [[Engine List]]&lt;br /&gt;
&lt;br /&gt;
== Emulation ==&lt;br /&gt;
* [[Emulators]]&lt;br /&gt;
** [[XQEMU]]&lt;br /&gt;
** [[Xbox 360 Backward Compatibility]]&lt;br /&gt;
&lt;br /&gt;
== Historical Pages ==&lt;br /&gt;
(archived from the xbox-linux wiki)&lt;br /&gt;
* [[Xbox Hard Drive Locking Mechanism]]&lt;br /&gt;
* [[Xbox Savegame System]]&lt;br /&gt;
* [[Xbox Hardware Overview]]&lt;br /&gt;
* [[Xbox Hard Disk Technical_Details]]&lt;br /&gt;
* [[Xbox Hard Disk Partitioning]]&lt;br /&gt;
* [[Xbox Manufacturing Process]]&lt;br /&gt;
* [[The Hidden Boot Code of the Xbox]]&lt;br /&gt;
* [[PIC]]&lt;br /&gt;
* [[SMBus]]&lt;br /&gt;
* [[NForce]]&lt;br /&gt;
* [[17 Mistakes Microsoft Made in the Xbox Security System]]&lt;br /&gt;
* [[Porting an Operating System to the Xbox HOWTO]]&lt;br /&gt;
&lt;br /&gt;
== Other ==&lt;br /&gt;
* [[Patents]]&lt;br /&gt;
* [[Resources]]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=6606</id>
		<title>Main Page</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=6606"/>
				<updated>2018-12-21T21:46:27Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{:Main Page/Header}}&lt;br /&gt;
__NOTOC__&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
* [[Chihiro]]&lt;br /&gt;
* [[Xbox]]&lt;br /&gt;
&lt;br /&gt;
* [[Hardware Revisions]]&lt;br /&gt;
* [[Motherboard]]&lt;br /&gt;
* [[CPU]]&lt;br /&gt;
* [[NV2A]]&lt;br /&gt;
** [[NV2A/Vertex attributes]]&lt;br /&gt;
** [[NV2A/Fixed Function Pipeline]]&lt;br /&gt;
** [[NV2A/Vertex Shader]]&lt;br /&gt;
** [[NV2A/Pixel Combiner]]&lt;br /&gt;
** [[NV2A/Surface Formats]]&lt;br /&gt;
* [[Memory]]&lt;br /&gt;
* [[Flash ROM]]&lt;br /&gt;
* [[MCPX]]&lt;br /&gt;
** [[APU]]&lt;br /&gt;
** [[ACI]]&lt;br /&gt;
** [[Network]]&lt;br /&gt;
* [[SMBus]]&lt;br /&gt;
** [[EEPROM]]&lt;br /&gt;
** [[SMC]]&lt;br /&gt;
** [[Video Encoder]]&lt;br /&gt;
*** [[AV Cables]]&lt;br /&gt;
* [[DVD Drive]]&lt;br /&gt;
** [[Xbox Game Disc]]&lt;br /&gt;
* [[Hard Drive]]&lt;br /&gt;
* [[USB]]&lt;br /&gt;
** [[Xbox Input Devices]]&lt;br /&gt;
** [[Xbox Memory Unit]]&lt;br /&gt;
** [[Xbox Live Communicator]] &amp;lt;!-- Maybe rename this to microphones later? --&amp;gt;&lt;br /&gt;
** [[Xbox DVD Movie Playback Kit]]&lt;br /&gt;
* [[Power Supply]]&lt;br /&gt;
* [[Development Kits]]&lt;br /&gt;
** [[Super I/O]]&lt;br /&gt;
** [[DVD Emulator]]&lt;br /&gt;
* [[Manufacturing Process]]&lt;br /&gt;
&lt;br /&gt;
== System Software ==&lt;br /&gt;
* [[MCPX ROM]]&lt;br /&gt;
* [[BIOS]] / [[Kernel]]&lt;br /&gt;
** [[Boot Process]]&lt;br /&gt;
** [[XBE]] (Executable file format)&lt;br /&gt;
* [[FATX]] (Filesystem)&lt;br /&gt;
* [[Dashboard]]&lt;br /&gt;
** [[Soundtracks]]&lt;br /&gt;
* [[Exploits]]&lt;br /&gt;
&lt;br /&gt;
== Development Kits and Tools ==&lt;br /&gt;
* [https://github.com/xqemu/nxdk nxdk (New Xbox Development Kit)]&lt;br /&gt;
* [[OpenXDK]]&lt;br /&gt;
* [[Microsoft XDK]]&lt;br /&gt;
** [[Xbox Title Libraries]]&lt;br /&gt;
** [[Direct3D]]&lt;br /&gt;
** [[DirectSound]]&lt;br /&gt;
** [[System Link]]&lt;br /&gt;
** [[Xbox Live]]&lt;br /&gt;
** [[Xbox Debug Monitor]]&lt;br /&gt;
** [[Xbox Neighborhood]]&lt;br /&gt;
** [[Kernel_Debug| Xbox Kernel Debugging]]&lt;br /&gt;
&lt;br /&gt;
== Games ==&lt;br /&gt;
* [[:Category:Games|Games]]&lt;br /&gt;
* [[Engine List]]&lt;br /&gt;
&lt;br /&gt;
== Emulation ==&lt;br /&gt;
* [[Emulators]]&lt;br /&gt;
** [[XQEMU]]&lt;br /&gt;
** [[Xbox 360 Backward Compatibility]]&lt;br /&gt;
&lt;br /&gt;
== Historical Pages ==&lt;br /&gt;
(archived from the xbox-linux wiki)&lt;br /&gt;
* [[Xbox Hard Drive Locking Mechanism]]&lt;br /&gt;
* [[Xbox Savegame System]]&lt;br /&gt;
* [[Xbox Hardware Overview]]&lt;br /&gt;
* [[Xbox Hard Disk Technical_Details]]&lt;br /&gt;
* [[Xbox Hard Disk Partitioning]]&lt;br /&gt;
* [[Xbox Manufacturing Process]]&lt;br /&gt;
* [[PIC]]&lt;br /&gt;
* [[SMBus]]&lt;br /&gt;
* [[NForce]]&lt;br /&gt;
* [[17 Mistakes Microsoft Made in the Xbox Security System]]&lt;br /&gt;
* [[Porting an Operating System to the Xbox HOWTO]]&lt;br /&gt;
&lt;br /&gt;
== Other ==&lt;br /&gt;
* [[Patents]]&lt;br /&gt;
* [[Resources]]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Xbox_Input_Devices&amp;diff=5988</id>
		<title>Xbox Input Devices</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Xbox_Input_Devices&amp;diff=5988"/>
				<updated>2017-08-22T22:10:55Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== XID Overview ==&lt;br /&gt;
&lt;br /&gt;
XIDs are USB devices.&lt;br /&gt;
&lt;br /&gt;
The hardware side is USB with a different plug while the software side is USB without HID-descriptors.&lt;br /&gt;
Technicly a XID is a USB-hub for the Memory-Units and the XBL Communicator.&lt;br /&gt;
The logical XID gamepad USB device is internally connected to that hub.&lt;br /&gt;
&lt;br /&gt;
=== USB Adapters ===&lt;br /&gt;
The Xbox input devices are USB devices. As such, you can connect a keyboard to the Xbox, or a gamepad to your PC. In fact, Linux already has drivers for the gamepad. In order to preserve Xbox hardware, please do not cut OEM Xbox cables to make an adapter. Decent adapters can be acquired cheaply (~$10 USD ea. on 2017.04.30).&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Port (From)&lt;br /&gt;
! Plug (To)&lt;br /&gt;
! Link&lt;br /&gt;
|-&lt;br /&gt;
| Xbox&lt;br /&gt;
| USB-A&lt;br /&gt;
| [https://www.amazon.com/gp/product/B000RT2868 Amazon]&lt;br /&gt;
|-&lt;br /&gt;
| USB-A&lt;br /&gt;
| Xbox&lt;br /&gt;
| [https://www.amazon.com/gp/product/B00F52LQHO Amazon]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Wiring ===&lt;br /&gt;
&lt;br /&gt;
Untested / unverified! Take this with a grain of salt.&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
!Pin&lt;br /&gt;
!Typical cable color&lt;br /&gt;
!Description&lt;br /&gt;
|-&lt;br /&gt;
|1&lt;br /&gt;
|Green&lt;br /&gt;
|USB D-&lt;br /&gt;
|-&lt;br /&gt;
|2&lt;br /&gt;
|White&lt;br /&gt;
|USB D+&lt;br /&gt;
|-&lt;br /&gt;
|3&lt;br /&gt;
|Black&lt;br /&gt;
|GND&lt;br /&gt;
|-&lt;br /&gt;
|4&lt;br /&gt;
|Red&lt;br /&gt;
|VCC&lt;br /&gt;
|-&lt;br /&gt;
|5&lt;br /&gt;
|Yellow&lt;br /&gt;
|VBlank signal from video output (for Lightguns)&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Protocol ===&lt;br /&gt;
&lt;br /&gt;
==== Controller to Xbox ====&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;typedef struct XIDGamepadReport {&lt;br /&gt;
    uint8_t bReportId;&lt;br /&gt;
    uint8_t bLength;&lt;br /&gt;
    &amp;lt;Data&amp;gt;&lt;br /&gt;
}&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== Xbox to Controller ====&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;typedef struct XIDGamepadOutputReport {&lt;br /&gt;
    uint8_t report_id; //FIXME: is this correct?&lt;br /&gt;
    uint8_t length;&lt;br /&gt;
    &amp;lt;Data&amp;gt;&lt;br /&gt;
}&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Standard Gamepads ==&lt;br /&gt;
&lt;br /&gt;
=== USB Descriptors ===&lt;br /&gt;
&lt;br /&gt;
Most standard gamepads share the same USB descriptor.&lt;br /&gt;
Usually the only difference will be the VID / PID.&lt;br /&gt;
See https://github.com/xboxdrv/xboxdrv/blob/stable/src/xpad_device.cpp for a list of devices.&lt;br /&gt;
&lt;br /&gt;
=== Controller to Xbox ===&lt;br /&gt;
&lt;br /&gt;
20 bytes&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
!Field&lt;br /&gt;
!Offset (Bytes)&lt;br /&gt;
!Mask&lt;br /&gt;
!Notes&lt;br /&gt;
|-&lt;br /&gt;
|DPAD_UP&lt;br /&gt;
|2&lt;br /&gt;
|0x01&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|DPAD_DOWN&lt;br /&gt;
|2&lt;br /&gt;
|0x02&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|DPAD_LEFT&lt;br /&gt;
|2&lt;br /&gt;
|0x04&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|DPAD_RIGHT&lt;br /&gt;
|2&lt;br /&gt;
|0x08&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|START&lt;br /&gt;
|2&lt;br /&gt;
|0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|BACK&lt;br /&gt;
|2&lt;br /&gt;
|0x20&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|LEFT_THUMB&lt;br /&gt;
|2&lt;br /&gt;
|0x40&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|RIGHT_THUMB&lt;br /&gt;
|2&lt;br /&gt;
|0x80&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|A&lt;br /&gt;
|4&lt;br /&gt;
|0xFF&lt;br /&gt;
|Button is analog&lt;br /&gt;
|-&lt;br /&gt;
|B&lt;br /&gt;
|5&lt;br /&gt;
|0xFF&lt;br /&gt;
|Button is analog&lt;br /&gt;
|-&lt;br /&gt;
|X&lt;br /&gt;
|6&lt;br /&gt;
|0xFF&lt;br /&gt;
|Button is analog&lt;br /&gt;
|-&lt;br /&gt;
|Y&lt;br /&gt;
|7&lt;br /&gt;
|0xFF&lt;br /&gt;
|Button is analog&lt;br /&gt;
|-&lt;br /&gt;
|BLACK&lt;br /&gt;
|8&lt;br /&gt;
|0xFF&lt;br /&gt;
|Button is analog&lt;br /&gt;
|-&lt;br /&gt;
|WHITE&lt;br /&gt;
|9&lt;br /&gt;
|0xFF&lt;br /&gt;
|Button is analog&lt;br /&gt;
|-&lt;br /&gt;
|LEFT_TRIGGER&lt;br /&gt;
|10&lt;br /&gt;
|0xFF&lt;br /&gt;
|Trigger is analog&lt;br /&gt;
|-&lt;br /&gt;
|RIGHT_TRIGGER&lt;br /&gt;
|11&lt;br /&gt;
|0xFF&lt;br /&gt;
|Trigger is analog&lt;br /&gt;
|-&lt;br /&gt;
|sThumbLX&lt;br /&gt;
|12&lt;br /&gt;
|0xFFFF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|sThumbLY&lt;br /&gt;
|14&lt;br /&gt;
|0xFFFF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|sThumbRX&lt;br /&gt;
|16&lt;br /&gt;
|0xFFFF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|sThumbRY&lt;br /&gt;
|18&lt;br /&gt;
|0xFFFF&lt;br /&gt;
|&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Xbox to Controller ===&lt;br /&gt;
&lt;br /&gt;
6 bytes&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
!Field&lt;br /&gt;
!Offset (Bytes)&lt;br /&gt;
!Mask&lt;br /&gt;
!Notes&lt;br /&gt;
|-&lt;br /&gt;
|Left actuator strength&lt;br /&gt;
|2&lt;br /&gt;
|0xFFFF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Right actuator strength&lt;br /&gt;
|4&lt;br /&gt;
|0xFFFF&lt;br /&gt;
|&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
The Microsoft Controller S will not react to packets which don't have a value of 6 in the &amp;lt;code&amp;gt;length&amp;lt;/code&amp;gt; field of the header.&lt;br /&gt;
The Fanatec Speedster 3 ForceShock will still react to those. Further testing is necessary with other gamepads.&lt;br /&gt;
&lt;br /&gt;
== Steering wheels ==&lt;br /&gt;
&lt;br /&gt;
=== MadCatz Wheel ===&lt;br /&gt;
&lt;br /&gt;
{{FIXME}}&lt;br /&gt;
&lt;br /&gt;
=== Fanatec Speedster 3 ForceShock ===&lt;br /&gt;
&lt;br /&gt;
==== Pedals ====&lt;br /&gt;
&lt;br /&gt;
The Pedals are ''not'' a USB device.&lt;br /&gt;
&lt;br /&gt;
Note that the cable going to the pedals is also ''not'' a USB port despite using the Xbox controller breakaway plug.&lt;br /&gt;
Likewise, plugging the pedals to a PC / Xbox won't provide a USB / XID (it is detected as garbage):&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
new full-speed USB device number 14 using xhci_hcd&lt;br /&gt;
device descriptor read/64, error -71&lt;br /&gt;
device descriptor read/64, error -71&lt;br /&gt;
new full-speed USB device number 15 using xhci_hcd&lt;br /&gt;
device descriptor read/64, error -71&lt;br /&gt;
device descriptor read/64, error -71&lt;br /&gt;
new full-speed USB device number 16 using xhci_hcd&lt;br /&gt;
Device not responding to setup address.&lt;br /&gt;
Device not responding to setup address.&lt;br /&gt;
device not accepting address 16, error -71&lt;br /&gt;
new full-speed USB device number 17 using xhci_hcd&lt;br /&gt;
Device not responding to setup address.&lt;br /&gt;
Device not responding to setup address.&lt;br /&gt;
device not accepting address 17, error -71&lt;br /&gt;
unable to enumerate USB device&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== Internal HUB ====&lt;br /&gt;
&lt;br /&gt;
===== USB Descriptors =====&lt;br /&gt;
&lt;br /&gt;
Power not connected, pedals not connected, not in Tuning mode:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
Device Descriptor:&lt;br /&gt;
  bLength                18&lt;br /&gt;
  bDescriptorType         1&lt;br /&gt;
  bcdUSB               1.10&lt;br /&gt;
  bDeviceClass            9 Hub&lt;br /&gt;
  bDeviceSubClass         0 &lt;br /&gt;
  bDeviceProtocol         0 Full speed (or root) hub&lt;br /&gt;
  bMaxPacketSize0         8&lt;br /&gt;
  idVendor           0x3767 &lt;br /&gt;
  idProduct          0x0102 &lt;br /&gt;
  bcdDevice            0.01&lt;br /&gt;
  iManufacturer           0 &lt;br /&gt;
  iProduct                1 End&lt;br /&gt;
  iSerial                 0 &lt;br /&gt;
  bNumConfigurations      1&lt;br /&gt;
  Configuration Descriptor:&lt;br /&gt;
    bLength                 9&lt;br /&gt;
    bDescriptorType         2&lt;br /&gt;
    wTotalLength           25&lt;br /&gt;
    bNumInterfaces          1&lt;br /&gt;
    bConfigurationValue     1&lt;br /&gt;
    iConfiguration          0 &lt;br /&gt;
    bmAttributes         0xa0&lt;br /&gt;
      (Bus Powered)&lt;br /&gt;
      Remote Wakeup&lt;br /&gt;
    MaxPower               64mA&lt;br /&gt;
    Interface Descriptor:&lt;br /&gt;
      bLength                 9&lt;br /&gt;
      bDescriptorType         4&lt;br /&gt;
      bInterfaceNumber        0&lt;br /&gt;
      bAlternateSetting       0&lt;br /&gt;
      bNumEndpoints           1&lt;br /&gt;
      bInterfaceClass         9 Hub&lt;br /&gt;
      bInterfaceSubClass      0 &lt;br /&gt;
      bInterfaceProtocol      0 Full speed (or root) hub&lt;br /&gt;
      iInterface              0 &lt;br /&gt;
      Endpoint Descriptor:&lt;br /&gt;
        bLength                 7&lt;br /&gt;
        bDescriptorType         5&lt;br /&gt;
        bEndpointAddress     0x81  EP 1 IN&lt;br /&gt;
        bmAttributes            3&lt;br /&gt;
          Transfer Type            Interrupt&lt;br /&gt;
          Synch Type               None&lt;br /&gt;
          Usage Type               Data&lt;br /&gt;
        wMaxPacketSize     0x0001  1x 1 bytes&lt;br /&gt;
        bInterval             255&lt;br /&gt;
Hub Descriptor:&lt;br /&gt;
  bLength               9&lt;br /&gt;
  bDescriptorType      41&lt;br /&gt;
  nNbrPorts             3&lt;br /&gt;
  wHubCharacteristic 0x000d&lt;br /&gt;
    Per-port power switching&lt;br /&gt;
    Compound device&lt;br /&gt;
    Per-port overcurrent protection&lt;br /&gt;
  bPwrOn2PwrGood       50 * 2 milli seconds&lt;br /&gt;
  bHubContrCurrent     64 milli Ampere&lt;br /&gt;
  DeviceRemovable    0x02&lt;br /&gt;
  PortPwrCtrlMask    0xff&lt;br /&gt;
 Hub Port Status:&lt;br /&gt;
   Port 1: 0000.0103 power enable connect&lt;br /&gt;
   Port 2: 0000.0100 power&lt;br /&gt;
   Port 3: 0000.0100 power&lt;br /&gt;
can't get debug descriptor: Resource temporarily unavailable&lt;br /&gt;
Device Status:     0x0003&lt;br /&gt;
  Self Powered&lt;br /&gt;
  Remote Wakeup Enabled&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== Steering wheel (and Pedals) ====&lt;br /&gt;
&lt;br /&gt;
Always connected to port 1 of the internal HUB&lt;br /&gt;
&lt;br /&gt;
===== USB Descriptors =====&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
Device Descriptor:&lt;br /&gt;
  bLength                18&lt;br /&gt;
  bDescriptorType         1&lt;br /&gt;
  bcdUSB               1.10&lt;br /&gt;
  bDeviceClass            0 &lt;br /&gt;
  bDeviceSubClass         0 &lt;br /&gt;
  bDeviceProtocol         0 &lt;br /&gt;
  bMaxPacketSize0         8&lt;br /&gt;
  idVendor           0x3767 &lt;br /&gt;
  idProduct          0x0101 &lt;br /&gt;
  bcdDevice            2.80&lt;br /&gt;
  iManufacturer           0 &lt;br /&gt;
  iProduct                0 &lt;br /&gt;
  iSerial                 0 &lt;br /&gt;
  bNumConfigurations      1&lt;br /&gt;
  Configuration Descriptor:&lt;br /&gt;
    bLength                 9&lt;br /&gt;
    bDescriptorType         2&lt;br /&gt;
    wTotalLength           32&lt;br /&gt;
    bNumInterfaces          1&lt;br /&gt;
    bConfigurationValue     1&lt;br /&gt;
    iConfiguration          0 &lt;br /&gt;
    bmAttributes         0x80&lt;br /&gt;
      (Bus Powered)&lt;br /&gt;
    MaxPower              100mA&lt;br /&gt;
    Interface Descriptor:&lt;br /&gt;
      bLength                 9&lt;br /&gt;
      bDescriptorType         4&lt;br /&gt;
      bInterfaceNumber        0&lt;br /&gt;
      bAlternateSetting       0&lt;br /&gt;
      bNumEndpoints           2&lt;br /&gt;
      bInterfaceClass        88 Xbox&lt;br /&gt;
      bInterfaceSubClass     66 Controller&lt;br /&gt;
      bInterfaceProtocol      0 &lt;br /&gt;
      iInterface              0 &lt;br /&gt;
      Endpoint Descriptor:&lt;br /&gt;
        bLength                 7&lt;br /&gt;
        bDescriptorType         5&lt;br /&gt;
        bEndpointAddress     0x82  EP 2 IN&lt;br /&gt;
        bmAttributes            3&lt;br /&gt;
          Transfer Type            Interrupt&lt;br /&gt;
          Synch Type               None&lt;br /&gt;
          Usage Type               Data&lt;br /&gt;
        wMaxPacketSize     0x0020  1x 32 bytes&lt;br /&gt;
        bInterval               4&lt;br /&gt;
      Endpoint Descriptor:&lt;br /&gt;
        bLength                 7&lt;br /&gt;
        bDescriptorType         5&lt;br /&gt;
        bEndpointAddress     0x02  EP 2 OUT&lt;br /&gt;
        bmAttributes            3&lt;br /&gt;
          Transfer Type            Interrupt&lt;br /&gt;
          Synch Type               None&lt;br /&gt;
          Usage Type               Data&lt;br /&gt;
        wMaxPacketSize     0x0020  1x 32 bytes&lt;br /&gt;
        bInterval               4&lt;br /&gt;
can't get debug descriptor: Resource temporarily unavailable&lt;br /&gt;
Device Status:     0x0000&lt;br /&gt;
  (Bus Powered)&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Light guns ==&lt;br /&gt;
&lt;br /&gt;
=== EMS TopGun II ===&lt;br /&gt;
&lt;br /&gt;
''This is an unlicensed / unofficial Xbox accessory.''&lt;br /&gt;
&lt;br /&gt;
The website for this product can be found at http://www.hkems.com/product/xbox/EMSTopGun2.htm&lt;br /&gt;
&lt;br /&gt;
The gun presents itself as a standard Xbox gamepad. It uses a different USB descriptor for Xbox (X) and the other mode (P).&lt;br /&gt;
There is no internal hub in this device.&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! EMS TopGun II !! Xbox Gamepad !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| Stick || Directional Pad ||&lt;br /&gt;
|-&lt;br /&gt;
| Trigger || A || rowspan=&amp;quot;4&amp;quot; | Digital only, either 0 or 255&lt;br /&gt;
|-&lt;br /&gt;
| Grip || B&lt;br /&gt;
|-&lt;br /&gt;
| A || X&lt;br /&gt;
|-&lt;br /&gt;
| B || Y&lt;br /&gt;
|-&lt;br /&gt;
| START || Start ||&lt;br /&gt;
|-&lt;br /&gt;
| SE/BA || Back ||&lt;br /&gt;
|-&lt;br /&gt;
| Aim Left / Right || Negative / Positive on left thumbstick X axis || rowspan=&amp;quot;2&amp;quot; | Absolute position using the full stick range&lt;br /&gt;
|-&lt;br /&gt;
| Aim Up / Down || Positive / Negative on left thumbstick Y axis&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
There is no right thumbstick, thumbstick presses, black/white button or trigger buttons (All of those read constant zeros).&lt;br /&gt;
&lt;br /&gt;
===== Turbo Mode =====&lt;br /&gt;
&lt;br /&gt;
* Turbo mode 0 keeps A pressed  while trigger is held&lt;br /&gt;
* Turbo mode 1 toggles A rapidly while trigger is held&lt;br /&gt;
* Turbo mode 2 toggles A rapidly and once in a while B while trigger is held&lt;br /&gt;
&lt;br /&gt;
===== Force Feedback =====&lt;br /&gt;
&lt;br /&gt;
The upper part of the gun is moveable and should push back to simulate recoil (possibly hurting your thumb while you are using the stick).&lt;br /&gt;
I could not get the force feedback working, but I'm sure I've had it working in the past on PC.{{citation needed}}&lt;br /&gt;
&lt;br /&gt;
==== USB Descriptors ====&lt;br /&gt;
&lt;br /&gt;
This is the descriptor in the Xbox mode (X).&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
Bus 003 Device 016: ID 0b9a:016b  &lt;br /&gt;
Device Descriptor:&lt;br /&gt;
  bLength                18&lt;br /&gt;
  bDescriptorType         1&lt;br /&gt;
  bcdUSB               1.10&lt;br /&gt;
  bDeviceClass            0 &lt;br /&gt;
  bDeviceSubClass         0 &lt;br /&gt;
  bDeviceProtocol         0 &lt;br /&gt;
  bMaxPacketSize0        64&lt;br /&gt;
  idVendor           0x0b9a &lt;br /&gt;
  idProduct          0x016b &lt;br /&gt;
  bcdDevice            4.57&lt;br /&gt;
  iManufacturer           1 EMS̖E&lt;br /&gt;
  iProduct                2 EMS TopGun&lt;br /&gt;
  iSerial                 0 &lt;br /&gt;
  bNumConfigurations      1&lt;br /&gt;
  Configuration Descriptor:&lt;br /&gt;
    bLength                 9&lt;br /&gt;
    bDescriptorType         2&lt;br /&gt;
    wTotalLength           32&lt;br /&gt;
    bNumInterfaces          1&lt;br /&gt;
    bConfigurationValue     1&lt;br /&gt;
    iConfiguration          0 &lt;br /&gt;
    bmAttributes         0x80&lt;br /&gt;
      (Bus Powered)&lt;br /&gt;
    MaxPower              100mA&lt;br /&gt;
    Interface Descriptor:&lt;br /&gt;
      bLength                 9&lt;br /&gt;
      bDescriptorType         4&lt;br /&gt;
      bInterfaceNumber        0&lt;br /&gt;
      bAlternateSetting       0&lt;br /&gt;
      bNumEndpoints           2&lt;br /&gt;
      bInterfaceClass        88 Xbox&lt;br /&gt;
      bInterfaceSubClass     66 Controller&lt;br /&gt;
      bInterfaceProtocol      0 &lt;br /&gt;
      iInterface              0 &lt;br /&gt;
      Endpoint Descriptor:&lt;br /&gt;
        bLength                 7&lt;br /&gt;
        bDescriptorType         5&lt;br /&gt;
        bEndpointAddress     0x81  EP 1 IN&lt;br /&gt;
        bmAttributes            3&lt;br /&gt;
          Transfer Type            Interrupt&lt;br /&gt;
          Synch Type               None&lt;br /&gt;
          Usage Type               Data&lt;br /&gt;
        wMaxPacketSize     0x0040  1x 64 bytes&lt;br /&gt;
        bInterval               4&lt;br /&gt;
      Endpoint Descriptor:&lt;br /&gt;
        bLength                 7&lt;br /&gt;
        bDescriptorType         5&lt;br /&gt;
        bEndpointAddress     0x02  EP 2 OUT&lt;br /&gt;
        bmAttributes            3&lt;br /&gt;
          Transfer Type            Interrupt&lt;br /&gt;
          Synch Type               None&lt;br /&gt;
          Usage Type               Data&lt;br /&gt;
        wMaxPacketSize     0x0040  1x 64 bytes&lt;br /&gt;
        bInterval               8&lt;br /&gt;
can't get debug descriptor: Resource temporarily unavailable&lt;br /&gt;
Device Status:     0x0000&lt;br /&gt;
  (Bus Powered)&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Steel Battalion Controller ==&lt;br /&gt;
&lt;br /&gt;
=== USB Descriptors ===&lt;br /&gt;
&lt;br /&gt;
From http://www.yaronet.com/topics/154490-steel-battalion-controller-homemade#post-15&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;bcdUSB:             0x0110&lt;br /&gt;
bDeviceClass:         0x00&lt;br /&gt;
bDeviceSubClass:      0x00&lt;br /&gt;
bDeviceProtocol:      0x00&lt;br /&gt;
bMaxPacketSize0:      0x08 (8)&lt;br /&gt;
idVendor:           0x0A7B&lt;br /&gt;
idProduct:          0xD000&lt;br /&gt;
bcdDevice:          0x0100&lt;br /&gt;
iManufacturer:        0x00&lt;br /&gt;
iProduct:             0x00&lt;br /&gt;
iSerialNumber:        0x00&lt;br /&gt;
bNumConfigurations:   0x01&lt;br /&gt;
&lt;br /&gt;
ConnectionStatus: DeviceConnected&lt;br /&gt;
Current Config Value: 0x00&lt;br /&gt;
Device Bus Speed:     Full&lt;br /&gt;
Device Address:       0x03&lt;br /&gt;
Open Pipes:              0&lt;br /&gt;
&lt;br /&gt;
Configuration Descriptor:&lt;br /&gt;
wTotalLength:       0x0020&lt;br /&gt;
bNumInterfaces:       0x01&lt;br /&gt;
bConfigurationValue:  0x01&lt;br /&gt;
iConfiguration:       0x00&lt;br /&gt;
bmAttributes:         0x80 (Bus Powered )&lt;br /&gt;
MaxPower:             0xFA (500 Ma)&lt;br /&gt;
&lt;br /&gt;
Interface Descriptor:&lt;br /&gt;
bInterfaceNumber:     0x00&lt;br /&gt;
bAlternateSetting:    0x00&lt;br /&gt;
bNumEndpoints:        0x02&lt;br /&gt;
bInterfaceClass:      0x58&lt;br /&gt;
bInterfaceSubClass:   0x42&lt;br /&gt;
bInterfaceProtocol:   0x00&lt;br /&gt;
iInterface:           0x00&lt;br /&gt;
&lt;br /&gt;
Endpoint Descriptor:&lt;br /&gt;
bEndpointAddress:     0x82&lt;br /&gt;
Transfer Type:   Interrupt&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Controller to Xbox ===&lt;br /&gt;
&lt;br /&gt;
From http://steelbattalionnet.codeplex.com/SourceControl/latest#SBC/SteelBattalionController.cs&lt;br /&gt;
&lt;br /&gt;
26 bytes&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
!Field&lt;br /&gt;
!Offset (Bytes)&lt;br /&gt;
!Mask&lt;br /&gt;
!Notes&lt;br /&gt;
|-&lt;br /&gt;
|RightJoyMainWeapon&lt;br /&gt;
|2&lt;br /&gt;
|0x01&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|RightJoyFire&lt;br /&gt;
|2&lt;br /&gt;
|0x03&lt;br /&gt;
|FIXME: WTF?! Mask might be bad?&lt;br /&gt;
|-&lt;br /&gt;
|RightJoyLockOn&lt;br /&gt;
|2&lt;br /&gt;
|0x04&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Eject&lt;br /&gt;
|2&lt;br /&gt;
|0x08&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|CockpitHatch&lt;br /&gt;
|2&lt;br /&gt;
|0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Ignition&lt;br /&gt;
|2&lt;br /&gt;
|0x20&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Start&lt;br /&gt;
|2&lt;br /&gt;
|0x40&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MultiMonOpenClose&lt;br /&gt;
|2&lt;br /&gt;
|0x80&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MultiMonMapZoomInOut&lt;br /&gt;
|3&lt;br /&gt;
|0x01&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MultiMonModeSelect&lt;br /&gt;
|3&lt;br /&gt;
|0x02&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MultiMonSubMonitor&lt;br /&gt;
|3&lt;br /&gt;
|0x04&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MainMonZoomIn&lt;br /&gt;
|3&lt;br /&gt;
|0x08&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MainMonZoomOut&lt;br /&gt;
|3&lt;br /&gt;
|0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|FunctionFSS&lt;br /&gt;
|3&lt;br /&gt;
|0x20&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|FunctionManipulator&lt;br /&gt;
|3&lt;br /&gt;
|0x40&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|FunctionLineColorChange&lt;br /&gt;
|3&lt;br /&gt;
|0x80&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Washing&lt;br /&gt;
|4&lt;br /&gt;
|0x01&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Extinguisher&lt;br /&gt;
|4&lt;br /&gt;
|0x02&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Chaff&lt;br /&gt;
|4&lt;br /&gt;
|0x04&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|FunctionTankDetach&lt;br /&gt;
|4&lt;br /&gt;
|0x08&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|FunctionOverride&lt;br /&gt;
|4&lt;br /&gt;
|0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|FunctionNightScope&lt;br /&gt;
|4&lt;br /&gt;
|0x20&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|FunctionF1&lt;br /&gt;
|4&lt;br /&gt;
|0x40&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|FunctionF2&lt;br /&gt;
|4&lt;br /&gt;
|0x80&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|FunctionF3&lt;br /&gt;
|5&lt;br /&gt;
|0x01&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|WeaponConMain&lt;br /&gt;
|5&lt;br /&gt;
|0x02&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|WeaponConSub&lt;br /&gt;
|5&lt;br /&gt;
|0x04&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|WeaponConMagazine&lt;br /&gt;
|5&lt;br /&gt;
|0x08&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Comm1&lt;br /&gt;
|5&lt;br /&gt;
|0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Comm2&lt;br /&gt;
|5&lt;br /&gt;
|0x20&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Comm3&lt;br /&gt;
|5&lt;br /&gt;
|0x40&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Comm4&lt;br /&gt;
|5&lt;br /&gt;
|0x80&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Comm5&lt;br /&gt;
|6&lt;br /&gt;
|0x01&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|LeftJoySightChange&lt;br /&gt;
|6&lt;br /&gt;
|0x02&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|ToggleFilterControl&lt;br /&gt;
|6&lt;br /&gt;
|0x04&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|ToggleOxygenSupply&lt;br /&gt;
|6&lt;br /&gt;
|0x08&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|ToggleFuelFlowRate&lt;br /&gt;
|6&lt;br /&gt;
|0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|ToggleBuffreMaterial&lt;br /&gt;
|6&lt;br /&gt;
|0x20&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|ToggleVTLocation&lt;br /&gt;
|6&lt;br /&gt;
|0x40&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
|6&lt;br /&gt;
|0x80&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
|7&lt;br /&gt;
|0xFF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
|8&lt;br /&gt;
|0xFF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|AimingX&lt;br /&gt;
|9&lt;br /&gt;
|0xFF, maybe 0xFFFF at offset 8?&lt;br /&gt;
|&amp;quot;Aiming Lever&amp;quot; joystick on the right.  X Axis value.&lt;br /&gt;
|-&lt;br /&gt;
|AimingY&lt;br /&gt;
|11&lt;br /&gt;
|0xFF, maybe 0xFFFF at offset 10?&lt;br /&gt;
|&amp;quot;Aiming Lever&amp;quot; joystick on the right.  Y Axis value.&lt;br /&gt;
|-&lt;br /&gt;
|RotationLever&lt;br /&gt;
|13&lt;br /&gt;
|0xFF, maybe 0xFFFF at offset 12?&lt;br /&gt;
|&amp;quot;Rotation Lever&amp;quot; joystick on the left.&lt;br /&gt;
|-&lt;br /&gt;
|SightChangeX&lt;br /&gt;
|15&lt;br /&gt;
|0xFF, maybe 0xFFFF at offset 14?&lt;br /&gt;
|&amp;quot;Sight Change&amp;quot; analog stick on the &amp;quot;Rotation Lever&amp;quot; joystick.  X Axis value.&lt;br /&gt;
|-&lt;br /&gt;
|SightChangeY&lt;br /&gt;
|17&lt;br /&gt;
|0xFF, maybe 0xFFFF at offset 16?&lt;br /&gt;
|&amp;quot;Sight Change&amp;quot; analog stick on the &amp;quot;Rotation Lever&amp;quot; joystick.  Y Axis value.&lt;br /&gt;
|-&lt;br /&gt;
|LeftPedal&lt;br /&gt;
|19&lt;br /&gt;
|0xFF, maybe 0xFFFF at offset 18?&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MiddlePedal&lt;br /&gt;
|21&lt;br /&gt;
|0xFF, maybe 0xFFFF at offset 20?&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|RightPedal&lt;br /&gt;
|23&lt;br /&gt;
|0xFF, maybe 0xFFFF at offset 22?&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|TunerDial&lt;br /&gt;
|24&lt;br /&gt;
|0x0F&lt;br /&gt;
|The 9 o'clock postion is 0, and the 6 o'clock position is 12. The blank area between the 6 and 9 o'clock positions is 13, 14, and 15 clockwise.&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
|24&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|GearLever&lt;br /&gt;
|25&lt;br /&gt;
|0xFF&lt;br /&gt;
|The gear lever on the left block.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Xbox to Controller ===&lt;br /&gt;
&lt;br /&gt;
From http://steelbattalionnet.codeplex.com/SourceControl/latest#SBC/SteelBattalionController.cs&lt;br /&gt;
&lt;br /&gt;
34 bytes&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
!Field&lt;br /&gt;
!Offset (Bytes)&lt;br /&gt;
!Mask&lt;br /&gt;
!Notes&lt;br /&gt;
|-&lt;br /&gt;
|EmergencyEject&lt;br /&gt;
|2&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|CockpitHatch&lt;br /&gt;
|2&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Ignition&lt;br /&gt;
|3&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Start&lt;br /&gt;
|3&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|OpenClose&lt;br /&gt;
|4&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MapZoomInOut&lt;br /&gt;
|4&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|ModeSelect&lt;br /&gt;
|5&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|SubMonitorModeSelect&lt;br /&gt;
|5&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MainMonitorZoomIn&lt;br /&gt;
|6&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MainMonitorZoomOut&lt;br /&gt;
|6&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|ForecastShootingSystem&lt;br /&gt;
|7&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Manipulator&lt;br /&gt;
|7&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|LineColorChange&lt;br /&gt;
|8&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Washing&lt;br /&gt;
|8&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Extinguisher&lt;br /&gt;
|9&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Chaff&lt;br /&gt;
|9&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|TankDetach&lt;br /&gt;
|10&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Override&lt;br /&gt;
|10&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|NightScope&lt;br /&gt;
|11&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|F1&lt;br /&gt;
|11&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|F2&lt;br /&gt;
|12&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|F3&lt;br /&gt;
|12&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MainWeaponControl&lt;br /&gt;
|13&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|SubWeaponControl&lt;br /&gt;
|13&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MagazineChange&lt;br /&gt;
|14&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Comm1&lt;br /&gt;
|14&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Comm2&lt;br /&gt;
|15&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Comm3&lt;br /&gt;
|15&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Comm4&lt;br /&gt;
|16&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Comm5&lt;br /&gt;
|16&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
|17&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|GearR&lt;br /&gt;
|17&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|GearN&lt;br /&gt;
|18&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Gear1&lt;br /&gt;
|18&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Gear2&lt;br /&gt;
|19&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Gear3&lt;br /&gt;
|19&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Gear4&lt;br /&gt;
|20&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Gear5&lt;br /&gt;
|20&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Related links ==&lt;br /&gt;
[https://github.com/xqemu/xqemu/blob/xbox/hw/xbox/xid.c XID emulation in XQEMU]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Xbox_Input_Devices&amp;diff=5987</id>
		<title>Xbox Input Devices</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Xbox_Input_Devices&amp;diff=5987"/>
				<updated>2017-08-22T22:10:15Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== XID Overview ==&lt;br /&gt;
&lt;br /&gt;
XIDs are USB devices.&lt;br /&gt;
&lt;br /&gt;
The hardware side is USB with a different plug while the software side is USB without HID-descriptors.&lt;br /&gt;
Technicly a XID is a USB-hub for the Memory-Units and the XBL Communicator.&lt;br /&gt;
The logical XID gamepad USB device is internally connected to that hub.&lt;br /&gt;
&lt;br /&gt;
=== USB Adapters ===&lt;br /&gt;
The Xbox input devices are USB devices. As such, you can connect a keyboard to the Xbox, or a gamepad to your PC. In fact, Linux already has drivers for the gamepad. In order to preserve Xbox hardware, please do not cut OEM Xbox cables to make an adapter. Decent adapters can be acquired cheaply (~$10 USD ea. on 2017.04.30).&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Port (From)&lt;br /&gt;
! Plug (To)&lt;br /&gt;
! Link&lt;br /&gt;
|-&lt;br /&gt;
| Xbox&lt;br /&gt;
| USB-A&lt;br /&gt;
| [https://www.amazon.com/gp/product/B000RT2868 Amazon]&lt;br /&gt;
|-&lt;br /&gt;
| USB-A&lt;br /&gt;
| Xbox&lt;br /&gt;
| [https://www.amazon.com/gp/product/B00F52LQHO Amazon]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Wiring ===&lt;br /&gt;
&lt;br /&gt;
Untested / unverified! Take this with a grain of salt.&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
!Pin&lt;br /&gt;
!Typical cable color&lt;br /&gt;
!Description&lt;br /&gt;
|-&lt;br /&gt;
|1&lt;br /&gt;
|Green&lt;br /&gt;
|USB D-&lt;br /&gt;
|-&lt;br /&gt;
|2&lt;br /&gt;
|White&lt;br /&gt;
|USB D+&lt;br /&gt;
|-&lt;br /&gt;
|3&lt;br /&gt;
|Black&lt;br /&gt;
|GND&lt;br /&gt;
|-&lt;br /&gt;
|4&lt;br /&gt;
|Red&lt;br /&gt;
|VCC&lt;br /&gt;
|-&lt;br /&gt;
|5&lt;br /&gt;
|Yellow&lt;br /&gt;
|VBlank signal from video output (for Lightguns)&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Protocol ===&lt;br /&gt;
&lt;br /&gt;
==== Controller to Xbox ====&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;typedef struct XIDGamepadReport {&lt;br /&gt;
    uint8_t bReportId;&lt;br /&gt;
    uint8_t bLength;&lt;br /&gt;
    &amp;lt;Data&amp;gt;&lt;br /&gt;
}&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== Xbox to Controller ====&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;typedef struct XIDGamepadOutputReport {&lt;br /&gt;
    uint8_t report_id; //FIXME: is this correct?&lt;br /&gt;
    uint8_t length;&lt;br /&gt;
    &amp;lt;Data&amp;gt;&lt;br /&gt;
}&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Standard Gamepads ==&lt;br /&gt;
&lt;br /&gt;
=== USB Descriptors ===&lt;br /&gt;
&lt;br /&gt;
Most standard gamepads share the same USB descriptor.&lt;br /&gt;
Usually the only difference will be the VID / PID.&lt;br /&gt;
See https://github.com/xboxdrv/xboxdrv/blob/stable/src/xpad_device.cpp for a list of devices.&lt;br /&gt;
&lt;br /&gt;
=== Controller to Xbox ===&lt;br /&gt;
&lt;br /&gt;
20 bytes&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
!Field&lt;br /&gt;
!Offset (Bytes)&lt;br /&gt;
!Mask&lt;br /&gt;
!Notes&lt;br /&gt;
|-&lt;br /&gt;
|DPAD_UP&lt;br /&gt;
|2&lt;br /&gt;
|0x01&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|DPAD_DOWN&lt;br /&gt;
|2&lt;br /&gt;
|0x02&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|DPAD_LEFT&lt;br /&gt;
|2&lt;br /&gt;
|0x04&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|DPAD_RIGHT&lt;br /&gt;
|2&lt;br /&gt;
|0x08&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|START&lt;br /&gt;
|2&lt;br /&gt;
|0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|BACK&lt;br /&gt;
|2&lt;br /&gt;
|0x20&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|LEFT_THUMB&lt;br /&gt;
|2&lt;br /&gt;
|0x40&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|RIGHT_THUMB&lt;br /&gt;
|2&lt;br /&gt;
|0x80&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|A&lt;br /&gt;
|4&lt;br /&gt;
|0xFF&lt;br /&gt;
|Button is analog&lt;br /&gt;
|-&lt;br /&gt;
|B&lt;br /&gt;
|5&lt;br /&gt;
|0xFF&lt;br /&gt;
|Button is analog&lt;br /&gt;
|-&lt;br /&gt;
|X&lt;br /&gt;
|6&lt;br /&gt;
|0xFF&lt;br /&gt;
|Button is analog&lt;br /&gt;
|-&lt;br /&gt;
|Y&lt;br /&gt;
|7&lt;br /&gt;
|0xFF&lt;br /&gt;
|Button is analog&lt;br /&gt;
|-&lt;br /&gt;
|BLACK&lt;br /&gt;
|8&lt;br /&gt;
|0xFF&lt;br /&gt;
|Button is analog&lt;br /&gt;
|-&lt;br /&gt;
|WHITE&lt;br /&gt;
|9&lt;br /&gt;
|0xFF&lt;br /&gt;
|Button is analog&lt;br /&gt;
|-&lt;br /&gt;
|LEFT_TRIGGER&lt;br /&gt;
|10&lt;br /&gt;
|0xFF&lt;br /&gt;
|Trigger is analog&lt;br /&gt;
|-&lt;br /&gt;
|RIGHT_TRIGGER&lt;br /&gt;
|11&lt;br /&gt;
|0xFF&lt;br /&gt;
|Trigger is analog&lt;br /&gt;
|-&lt;br /&gt;
|sThumbLX&lt;br /&gt;
|12&lt;br /&gt;
|0xFFFF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|sThumbLY&lt;br /&gt;
|14&lt;br /&gt;
|0xFFFF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|sThumbRX&lt;br /&gt;
|16&lt;br /&gt;
|0xFFFF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|sThumbRY&lt;br /&gt;
|18&lt;br /&gt;
|0xFFFF&lt;br /&gt;
|&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Xbox to Controller ===&lt;br /&gt;
&lt;br /&gt;
6 bytes&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
!Field&lt;br /&gt;
!Offset (Bytes)&lt;br /&gt;
!Mask&lt;br /&gt;
!Notes&lt;br /&gt;
|-&lt;br /&gt;
|Left actuator strength&lt;br /&gt;
|2&lt;br /&gt;
|0xFFFF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Right actuator strength&lt;br /&gt;
|4&lt;br /&gt;
|0xFFFF&lt;br /&gt;
|&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
The Microsoft Controller S will not react to packets which don't have a value of 6 in the &amp;lt;code&amp;gt;length&amp;lt;/code&amp;gt; field of the header.&lt;br /&gt;
The Fanatec Speedster 3 ForceShock will still react to those. Further testing is necessary with other gamepads.&lt;br /&gt;
&lt;br /&gt;
== Steering wheels ==&lt;br /&gt;
&lt;br /&gt;
=== MadCatz Wheel ===&lt;br /&gt;
&lt;br /&gt;
{{FIXME}}&lt;br /&gt;
&lt;br /&gt;
=== Fanatec Speedster 3 ForceShock ===&lt;br /&gt;
&lt;br /&gt;
==== Pedals ====&lt;br /&gt;
&lt;br /&gt;
The Pedals are ''not'' a USB device.&lt;br /&gt;
&lt;br /&gt;
Note that the cable going to the pedals is also ''not'' a USB port despite using the Xbox controller breakaway plug.&lt;br /&gt;
Likewise, plugging the pedals to a PC / Xbox won't provide a USB / XID (it is detected as garbage):&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
new full-speed USB device number 14 using xhci_hcd&lt;br /&gt;
device descriptor read/64, error -71&lt;br /&gt;
device descriptor read/64, error -71&lt;br /&gt;
new full-speed USB device number 15 using xhci_hcd&lt;br /&gt;
device descriptor read/64, error -71&lt;br /&gt;
device descriptor read/64, error -71&lt;br /&gt;
new full-speed USB device number 16 using xhci_hcd&lt;br /&gt;
Device not responding to setup address.&lt;br /&gt;
Device not responding to setup address.&lt;br /&gt;
device not accepting address 16, error -71&lt;br /&gt;
new full-speed USB device number 17 using xhci_hcd&lt;br /&gt;
Device not responding to setup address.&lt;br /&gt;
Device not responding to setup address.&lt;br /&gt;
device not accepting address 17, error -71&lt;br /&gt;
unable to enumerate USB device&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== Internal HUB ====&lt;br /&gt;
&lt;br /&gt;
===== USB Descriptors =====&lt;br /&gt;
&lt;br /&gt;
Power not connected, pedals not connected, not in Tuning mode:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
Device Descriptor:&lt;br /&gt;
  bLength                18&lt;br /&gt;
  bDescriptorType         1&lt;br /&gt;
  bcdUSB               1.10&lt;br /&gt;
  bDeviceClass            9 Hub&lt;br /&gt;
  bDeviceSubClass         0 &lt;br /&gt;
  bDeviceProtocol         0 Full speed (or root) hub&lt;br /&gt;
  bMaxPacketSize0         8&lt;br /&gt;
  idVendor           0x3767 &lt;br /&gt;
  idProduct          0x0102 &lt;br /&gt;
  bcdDevice            0.01&lt;br /&gt;
  iManufacturer           0 &lt;br /&gt;
  iProduct                1 End&lt;br /&gt;
  iSerial                 0 &lt;br /&gt;
  bNumConfigurations      1&lt;br /&gt;
  Configuration Descriptor:&lt;br /&gt;
    bLength                 9&lt;br /&gt;
    bDescriptorType         2&lt;br /&gt;
    wTotalLength           25&lt;br /&gt;
    bNumInterfaces          1&lt;br /&gt;
    bConfigurationValue     1&lt;br /&gt;
    iConfiguration          0 &lt;br /&gt;
    bmAttributes         0xa0&lt;br /&gt;
      (Bus Powered)&lt;br /&gt;
      Remote Wakeup&lt;br /&gt;
    MaxPower               64mA&lt;br /&gt;
    Interface Descriptor:&lt;br /&gt;
      bLength                 9&lt;br /&gt;
      bDescriptorType         4&lt;br /&gt;
      bInterfaceNumber        0&lt;br /&gt;
      bAlternateSetting       0&lt;br /&gt;
      bNumEndpoints           1&lt;br /&gt;
      bInterfaceClass         9 Hub&lt;br /&gt;
      bInterfaceSubClass      0 &lt;br /&gt;
      bInterfaceProtocol      0 Full speed (or root) hub&lt;br /&gt;
      iInterface              0 &lt;br /&gt;
      Endpoint Descriptor:&lt;br /&gt;
        bLength                 7&lt;br /&gt;
        bDescriptorType         5&lt;br /&gt;
        bEndpointAddress     0x81  EP 1 IN&lt;br /&gt;
        bmAttributes            3&lt;br /&gt;
          Transfer Type            Interrupt&lt;br /&gt;
          Synch Type               None&lt;br /&gt;
          Usage Type               Data&lt;br /&gt;
        wMaxPacketSize     0x0001  1x 1 bytes&lt;br /&gt;
        bInterval             255&lt;br /&gt;
Hub Descriptor:&lt;br /&gt;
  bLength               9&lt;br /&gt;
  bDescriptorType      41&lt;br /&gt;
  nNbrPorts             3&lt;br /&gt;
  wHubCharacteristic 0x000d&lt;br /&gt;
    Per-port power switching&lt;br /&gt;
    Compound device&lt;br /&gt;
    Per-port overcurrent protection&lt;br /&gt;
  bPwrOn2PwrGood       50 * 2 milli seconds&lt;br /&gt;
  bHubContrCurrent     64 milli Ampere&lt;br /&gt;
  DeviceRemovable    0x02&lt;br /&gt;
  PortPwrCtrlMask    0xff&lt;br /&gt;
 Hub Port Status:&lt;br /&gt;
   Port 1: 0000.0103 power enable connect&lt;br /&gt;
   Port 2: 0000.0100 power&lt;br /&gt;
   Port 3: 0000.0100 power&lt;br /&gt;
can't get debug descriptor: Resource temporarily unavailable&lt;br /&gt;
Device Status:     0x0003&lt;br /&gt;
  Self Powered&lt;br /&gt;
  Remote Wakeup Enabled&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== Steering wheel (and Pedals) ====&lt;br /&gt;
&lt;br /&gt;
Always connected to port 1 of the internal HUB&lt;br /&gt;
&lt;br /&gt;
===== USB Descriptors =====&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
Device Descriptor:&lt;br /&gt;
  bLength                18&lt;br /&gt;
  bDescriptorType         1&lt;br /&gt;
  bcdUSB               1.10&lt;br /&gt;
  bDeviceClass            0 &lt;br /&gt;
  bDeviceSubClass         0 &lt;br /&gt;
  bDeviceProtocol         0 &lt;br /&gt;
  bMaxPacketSize0         8&lt;br /&gt;
  idVendor           0x3767 &lt;br /&gt;
  idProduct          0x0101 &lt;br /&gt;
  bcdDevice            2.80&lt;br /&gt;
  iManufacturer           0 &lt;br /&gt;
  iProduct                0 &lt;br /&gt;
  iSerial                 0 &lt;br /&gt;
  bNumConfigurations      1&lt;br /&gt;
  Configuration Descriptor:&lt;br /&gt;
    bLength                 9&lt;br /&gt;
    bDescriptorType         2&lt;br /&gt;
    wTotalLength           32&lt;br /&gt;
    bNumInterfaces          1&lt;br /&gt;
    bConfigurationValue     1&lt;br /&gt;
    iConfiguration          0 &lt;br /&gt;
    bmAttributes         0x80&lt;br /&gt;
      (Bus Powered)&lt;br /&gt;
    MaxPower              100mA&lt;br /&gt;
    Interface Descriptor:&lt;br /&gt;
      bLength                 9&lt;br /&gt;
      bDescriptorType         4&lt;br /&gt;
      bInterfaceNumber        0&lt;br /&gt;
      bAlternateSetting       0&lt;br /&gt;
      bNumEndpoints           2&lt;br /&gt;
      bInterfaceClass        88 Xbox&lt;br /&gt;
      bInterfaceSubClass     66 Controller&lt;br /&gt;
      bInterfaceProtocol      0 &lt;br /&gt;
      iInterface              0 &lt;br /&gt;
      Endpoint Descriptor:&lt;br /&gt;
        bLength                 7&lt;br /&gt;
        bDescriptorType         5&lt;br /&gt;
        bEndpointAddress     0x82  EP 2 IN&lt;br /&gt;
        bmAttributes            3&lt;br /&gt;
          Transfer Type            Interrupt&lt;br /&gt;
          Synch Type               None&lt;br /&gt;
          Usage Type               Data&lt;br /&gt;
        wMaxPacketSize     0x0020  1x 32 bytes&lt;br /&gt;
        bInterval               4&lt;br /&gt;
      Endpoint Descriptor:&lt;br /&gt;
        bLength                 7&lt;br /&gt;
        bDescriptorType         5&lt;br /&gt;
        bEndpointAddress     0x02  EP 2 OUT&lt;br /&gt;
        bmAttributes            3&lt;br /&gt;
          Transfer Type            Interrupt&lt;br /&gt;
          Synch Type               None&lt;br /&gt;
          Usage Type               Data&lt;br /&gt;
        wMaxPacketSize     0x0020  1x 32 bytes&lt;br /&gt;
        bInterval               4&lt;br /&gt;
can't get debug descriptor: Resource temporarily unavailable&lt;br /&gt;
Device Status:     0x0000&lt;br /&gt;
  (Bus Powered)&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Light guns ==&lt;br /&gt;
&lt;br /&gt;
=== EMS TopGun II ===&lt;br /&gt;
&lt;br /&gt;
''This is an unlicensed / unofficial Xbox accessory.''&lt;br /&gt;
&lt;br /&gt;
The website for this product can be found at http://www.hkems.com/product/xbox/EMSTopGun2.htm&lt;br /&gt;
&lt;br /&gt;
The gun presents itself as a standard Xbox gamepad. It uses a different USB descriptor for Xbox (X) and the other mode (P).&lt;br /&gt;
There is no internal hub in this device.&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! EMS TopGun II !! Xbox Gamepad !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| Stick || Directional Pad ||&lt;br /&gt;
|-&lt;br /&gt;
| Trigger || A || rowspan=&amp;quot;4&amp;quot; | Digital only, either 0 or 255&lt;br /&gt;
|-&lt;br /&gt;
| Grip || B&lt;br /&gt;
|-&lt;br /&gt;
| A || X&lt;br /&gt;
|-&lt;br /&gt;
| B || Y&lt;br /&gt;
|-&lt;br /&gt;
| START || Start ||&lt;br /&gt;
|-&lt;br /&gt;
| SE/BA || Back ||&lt;br /&gt;
|-&lt;br /&gt;
| Aim Left / Right || Negative / Positive on left thumbstick X axis || rowspan=&amp;quot;2&amp;quot; | Absolute position using the full stick range&lt;br /&gt;
|-&lt;br /&gt;
| Aim Up / Down || Positive / Negative on left thumbstick Y axis&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
There is no right thumbstick, thumbstick presses, black/white button or trigger buttons (All of those read constant zeros).&lt;br /&gt;
&lt;br /&gt;
===== Turbo Mode =====&lt;br /&gt;
&lt;br /&gt;
* Turbo mode 0 keeps A pressed  while trigger is held&lt;br /&gt;
* Turbo mode 1 toggles A rapidly while trigger is held&lt;br /&gt;
* Turbo mode 2 toggles A rapidly and once in a while B while trigger is held&lt;br /&gt;
&lt;br /&gt;
===== Force Feedback =====&lt;br /&gt;
&lt;br /&gt;
The upper part of the gun is moveable and should push back to simulate recoil (possibly hurting your thumb while you are using the stick).&lt;br /&gt;
I could not get the force feedback working, but I'm sure I've had it working in the past on PC.{{citation needed}}&lt;br /&gt;
&lt;br /&gt;
==== USB Descriptors ====&lt;br /&gt;
&lt;br /&gt;
This is the descriptor in the Xbox mode (X).&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
Bus 003 Device 016: ID 0b9a:016b  &lt;br /&gt;
Device Descriptor:&lt;br /&gt;
  bLength                18&lt;br /&gt;
  bDescriptorType         1&lt;br /&gt;
  bcdUSB               1.10&lt;br /&gt;
  bDeviceClass            0 &lt;br /&gt;
  bDeviceSubClass         0 &lt;br /&gt;
  bDeviceProtocol         0 &lt;br /&gt;
  bMaxPacketSize0        64&lt;br /&gt;
  idVendor           0x0b9a &lt;br /&gt;
  idProduct          0x016b &lt;br /&gt;
  bcdDevice            4.57&lt;br /&gt;
  iManufacturer           1 EMS̖E&lt;br /&gt;
  iProduct                2 EMS TopGun&lt;br /&gt;
  iSerial                 0 &lt;br /&gt;
  bNumConfigurations      1&lt;br /&gt;
  Configuration Descriptor:&lt;br /&gt;
    bLength                 9&lt;br /&gt;
    bDescriptorType         2&lt;br /&gt;
    wTotalLength           32&lt;br /&gt;
    bNumInterfaces          1&lt;br /&gt;
    bConfigurationValue     1&lt;br /&gt;
    iConfiguration          0 &lt;br /&gt;
    bmAttributes         0x80&lt;br /&gt;
      (Bus Powered)&lt;br /&gt;
    MaxPower              100mA&lt;br /&gt;
    Interface Descriptor:&lt;br /&gt;
      bLength                 9&lt;br /&gt;
      bDescriptorType         4&lt;br /&gt;
      bInterfaceNumber        0&lt;br /&gt;
      bAlternateSetting       0&lt;br /&gt;
      bNumEndpoints           2&lt;br /&gt;
      bInterfaceClass        88 Xbox&lt;br /&gt;
      bInterfaceSubClass     66 Controller&lt;br /&gt;
      bInterfaceProtocol      0 &lt;br /&gt;
      iInterface              0 &lt;br /&gt;
      Endpoint Descriptor:&lt;br /&gt;
        bLength                 7&lt;br /&gt;
        bDescriptorType         5&lt;br /&gt;
        bEndpointAddress     0x81  EP 1 IN&lt;br /&gt;
        bmAttributes            3&lt;br /&gt;
          Transfer Type            Interrupt&lt;br /&gt;
          Synch Type               None&lt;br /&gt;
          Usage Type               Data&lt;br /&gt;
        wMaxPacketSize     0x0040  1x 64 bytes&lt;br /&gt;
        bInterval               4&lt;br /&gt;
      Endpoint Descriptor:&lt;br /&gt;
        bLength                 7&lt;br /&gt;
        bDescriptorType         5&lt;br /&gt;
        bEndpointAddress     0x02  EP 2 OUT&lt;br /&gt;
        bmAttributes            3&lt;br /&gt;
          Transfer Type            Interrupt&lt;br /&gt;
          Synch Type               None&lt;br /&gt;
          Usage Type               Data&lt;br /&gt;
        wMaxPacketSize     0x0040  1x 64 bytes&lt;br /&gt;
        bInterval               8&lt;br /&gt;
can't get debug descriptor: Resource temporarily unavailable&lt;br /&gt;
Device Status:     0x0000&lt;br /&gt;
  (Bus Powered)&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Steel Battalion Controller ==&lt;br /&gt;
&lt;br /&gt;
=== USB Descriptors ===&lt;br /&gt;
&lt;br /&gt;
From http://www.yaronet.com/topics/154490-steel-battalion-controller-homemade#post-15&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;bcdUSB:             0x0110&lt;br /&gt;
bDeviceClass:         0x00&lt;br /&gt;
bDeviceSubClass:      0x00&lt;br /&gt;
bDeviceProtocol:      0x00&lt;br /&gt;
bMaxPacketSize0:      0x08 (8)&lt;br /&gt;
idVendor:           0x0A7B&lt;br /&gt;
idProduct:          0xD000&lt;br /&gt;
bcdDevice:          0x0100&lt;br /&gt;
iManufacturer:        0x00&lt;br /&gt;
iProduct:             0x00&lt;br /&gt;
iSerialNumber:        0x00&lt;br /&gt;
bNumConfigurations:   0x01&lt;br /&gt;
&lt;br /&gt;
ConnectionStatus: DeviceConnected&lt;br /&gt;
Current Config Value: 0x00&lt;br /&gt;
Device Bus Speed:     Full&lt;br /&gt;
Device Address:       0x03&lt;br /&gt;
Open Pipes:              0&lt;br /&gt;
&lt;br /&gt;
Configuration Descriptor:&lt;br /&gt;
wTotalLength:       0x0020&lt;br /&gt;
bNumInterfaces:       0x01&lt;br /&gt;
bConfigurationValue:  0x01&lt;br /&gt;
iConfiguration:       0x00&lt;br /&gt;
bmAttributes:         0x80 (Bus Powered )&lt;br /&gt;
MaxPower:             0xFA (500 Ma)&lt;br /&gt;
&lt;br /&gt;
Interface Descriptor:&lt;br /&gt;
bInterfaceNumber:     0x00&lt;br /&gt;
bAlternateSetting:    0x00&lt;br /&gt;
bNumEndpoints:        0x02&lt;br /&gt;
bInterfaceClass:      0x58&lt;br /&gt;
bInterfaceSubClass:   0x42&lt;br /&gt;
bInterfaceProtocol:   0x00&lt;br /&gt;
iInterface:           0x00&lt;br /&gt;
&lt;br /&gt;
Endpoint Descriptor:&lt;br /&gt;
bEndpointAddress:     0x82&lt;br /&gt;
Transfer Type:   Interrupt&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Controller to Xbox ===&lt;br /&gt;
&lt;br /&gt;
From http://steelbattalionnet.codeplex.com/SourceControl/latest#SBC/SteelBattalionController.cs&lt;br /&gt;
&lt;br /&gt;
26 bytes&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
!Field&lt;br /&gt;
!Offset (Bytes)&lt;br /&gt;
!Mask&lt;br /&gt;
!Notes&lt;br /&gt;
|-&lt;br /&gt;
|RightJoyMainWeapon&lt;br /&gt;
|2&lt;br /&gt;
|0x01&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|RightJoyFire&lt;br /&gt;
|2&lt;br /&gt;
|0x03&lt;br /&gt;
|FIXME: WTF?! Mask might be bad?&lt;br /&gt;
|-&lt;br /&gt;
|RightJoyLockOn&lt;br /&gt;
|2&lt;br /&gt;
|0x04&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Eject&lt;br /&gt;
|2&lt;br /&gt;
|0x08&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|CockpitHatch&lt;br /&gt;
|2&lt;br /&gt;
|0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Ignition&lt;br /&gt;
|2&lt;br /&gt;
|0x20&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Start&lt;br /&gt;
|2&lt;br /&gt;
|0x40&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MultiMonOpenClose&lt;br /&gt;
|2&lt;br /&gt;
|0x80&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MultiMonMapZoomInOut&lt;br /&gt;
|3&lt;br /&gt;
|0x01&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MultiMonModeSelect&lt;br /&gt;
|3&lt;br /&gt;
|0x02&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MultiMonSubMonitor&lt;br /&gt;
|3&lt;br /&gt;
|0x04&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MainMonZoomIn&lt;br /&gt;
|3&lt;br /&gt;
|0x08&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MainMonZoomOut&lt;br /&gt;
|3&lt;br /&gt;
|0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|FunctionFSS&lt;br /&gt;
|3&lt;br /&gt;
|0x20&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|FunctionManipulator&lt;br /&gt;
|3&lt;br /&gt;
|0x40&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|FunctionLineColorChange&lt;br /&gt;
|3&lt;br /&gt;
|0x80&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Washing&lt;br /&gt;
|4&lt;br /&gt;
|0x01&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Extinguisher&lt;br /&gt;
|4&lt;br /&gt;
|0x02&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Chaff&lt;br /&gt;
|4&lt;br /&gt;
|0x04&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|FunctionTankDetach&lt;br /&gt;
|4&lt;br /&gt;
|0x08&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|FunctionOverride&lt;br /&gt;
|4&lt;br /&gt;
|0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|FunctionNightScope&lt;br /&gt;
|4&lt;br /&gt;
|0x20&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|FunctionF1&lt;br /&gt;
|4&lt;br /&gt;
|0x40&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|FunctionF2&lt;br /&gt;
|4&lt;br /&gt;
|0x80&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|FunctionF3&lt;br /&gt;
|5&lt;br /&gt;
|0x01&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|WeaponConMain&lt;br /&gt;
|5&lt;br /&gt;
|0x02&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|WeaponConSub&lt;br /&gt;
|5&lt;br /&gt;
|0x04&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|WeaponConMagazine&lt;br /&gt;
|5&lt;br /&gt;
|0x08&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Comm1&lt;br /&gt;
|5&lt;br /&gt;
|0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Comm2&lt;br /&gt;
|5&lt;br /&gt;
|0x20&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Comm3&lt;br /&gt;
|5&lt;br /&gt;
|0x40&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Comm4&lt;br /&gt;
|5&lt;br /&gt;
|0x80&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Comm5&lt;br /&gt;
|6&lt;br /&gt;
|0x01&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|LeftJoySightChange&lt;br /&gt;
|6&lt;br /&gt;
|0x02&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|ToggleFilterControl&lt;br /&gt;
|6&lt;br /&gt;
|0x04&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|ToggleOxygenSupply&lt;br /&gt;
|6&lt;br /&gt;
|0x08&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|ToggleFuelFlowRate&lt;br /&gt;
|6&lt;br /&gt;
|0x10&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|ToggleBuffreMaterial&lt;br /&gt;
|6&lt;br /&gt;
|0x20&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|ToggleVTLocation&lt;br /&gt;
|6&lt;br /&gt;
|0x40&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
|6&lt;br /&gt;
|0x80&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
|7&lt;br /&gt;
|0xFF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
|8&lt;br /&gt;
|0xFF&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|AimingX&lt;br /&gt;
|9&lt;br /&gt;
|0xFF, maybe 0xFFFF at offset 8?&lt;br /&gt;
|&amp;quot;Aiming Lever&amp;quot; joystick on the right.  X Axis value.&lt;br /&gt;
|-&lt;br /&gt;
|AimingY&lt;br /&gt;
|11&lt;br /&gt;
|0xFF, maybe 0xFFFF at offset 10?&lt;br /&gt;
|&amp;quot;Aiming Lever&amp;quot; joystick on the right.  Y Axis value.&lt;br /&gt;
|-&lt;br /&gt;
|RotationLever&lt;br /&gt;
|13&lt;br /&gt;
|0xFF, maybe 0xFFFF at offset 12?&lt;br /&gt;
|&amp;quot;Rotation Lever&amp;quot; joystick on the left.&lt;br /&gt;
|-&lt;br /&gt;
|SightChangeX&lt;br /&gt;
|15&lt;br /&gt;
|0xFF, maybe 0xFFFF at offset 14?&lt;br /&gt;
|&amp;quot;Sight Change&amp;quot; analog stick on the &amp;quot;Rotation Lever&amp;quot; joystick.  X Axis value.&lt;br /&gt;
|-&lt;br /&gt;
|SightChangeY&lt;br /&gt;
|17&lt;br /&gt;
|0xFF, maybe 0xFFFF at offset 16?&lt;br /&gt;
|&amp;quot;Sight Change&amp;quot; analog stick on the &amp;quot;Rotation Lever&amp;quot; joystick.  Y Axis value.&lt;br /&gt;
|-&lt;br /&gt;
|LeftPedal&lt;br /&gt;
|19&lt;br /&gt;
|0xFF, maybe 0xFFFF at offset 18?&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MiddlePedal&lt;br /&gt;
|21&lt;br /&gt;
|0xFF, maybe 0xFFFF at offset 20?&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|RightPedal&lt;br /&gt;
|23&lt;br /&gt;
|0xFF, maybe 0xFFFF at offset 22?&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|TunerDial&lt;br /&gt;
|24&lt;br /&gt;
|0x0F&lt;br /&gt;
|The 9 o'clock postion is 0, and the 6 o'clock position is 12. The blank area between the 6 and 9 o'clock positions is 13, 14, and 15 clockwise.&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
|24&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|GearLever&lt;br /&gt;
|25&lt;br /&gt;
|0xFF&lt;br /&gt;
|The gear lever on the left block.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Xbox to Controller ===&lt;br /&gt;
&lt;br /&gt;
From http://steelbattalionnet.codeplex.com/SourceControl/latest#SBC/SteelBattalionController.cs&lt;br /&gt;
&lt;br /&gt;
34 bytes&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
!Field&lt;br /&gt;
!Offset (Bytes)&lt;br /&gt;
!Mask&lt;br /&gt;
!Notes&lt;br /&gt;
|-&lt;br /&gt;
|EmergencyEject&lt;br /&gt;
|2&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|CockpitHatch&lt;br /&gt;
|2&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Ignition&lt;br /&gt;
|3&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Start&lt;br /&gt;
|3&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|OpenClose&lt;br /&gt;
|4&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MapZoomInOut&lt;br /&gt;
|4&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|ModeSelect&lt;br /&gt;
|5&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|SubMonitorModeSelect&lt;br /&gt;
|5&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MainMonitorZoomIn&lt;br /&gt;
|6&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MainMonitorZoomOut&lt;br /&gt;
|6&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|ForecastShootingSystem&lt;br /&gt;
|7&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Manipulator&lt;br /&gt;
|7&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|LineColorChange&lt;br /&gt;
|8&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Washing&lt;br /&gt;
|8&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Extinguisher&lt;br /&gt;
|9&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Chaff&lt;br /&gt;
|9&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|TankDetach&lt;br /&gt;
|10&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Override&lt;br /&gt;
|10&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|NightScope&lt;br /&gt;
|11&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|F1&lt;br /&gt;
|11&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|F2&lt;br /&gt;
|12&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|F3&lt;br /&gt;
|12&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MainWeaponControl&lt;br /&gt;
|13&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|SubWeaponControl&lt;br /&gt;
|13&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|MagazineChange&lt;br /&gt;
|14&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Comm1&lt;br /&gt;
|14&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Comm2&lt;br /&gt;
|15&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Comm3&lt;br /&gt;
|15&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Comm4&lt;br /&gt;
|16&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Comm5&lt;br /&gt;
|16&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|&lt;br /&gt;
|17&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|GearR&lt;br /&gt;
|17&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|GearN&lt;br /&gt;
|18&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Gear1&lt;br /&gt;
|18&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Gear2&lt;br /&gt;
|19&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Gear3&lt;br /&gt;
|19&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Gear4&lt;br /&gt;
|20&lt;br /&gt;
|0x0F&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Gear5&lt;br /&gt;
|20&lt;br /&gt;
|0xF0&lt;br /&gt;
|&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Related links ===&lt;br /&gt;
[https://github.com/xqemu/xqemu/blob/xbox/hw/xbox/xid.c XID emulation in XQEMU]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Xbox_DVD_Movie_Playback_Kit&amp;diff=5986</id>
		<title>Xbox DVD Movie Playback Kit</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Xbox_DVD_Movie_Playback_Kit&amp;diff=5986"/>
				<updated>2017-08-22T22:06:42Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;==Introduction==&lt;br /&gt;
&lt;br /&gt;
The DVD Movie Playback Kit contains 2 parts: A remote and a dongle for the Xbox.&lt;br /&gt;
&lt;br /&gt;
== Remote Control ==&lt;br /&gt;
&lt;br /&gt;
== Dongle ==&lt;br /&gt;
&lt;br /&gt;
The dongle contains a ROM with an XBE which provides some functions for the DVD playback application. However, the XBE is not standalone.&lt;br /&gt;
&lt;br /&gt;
Why would they not just put this little &amp;lt; 512kiB library on the harddisk? Why another ROM which contains the program?&lt;br /&gt;
One could think it is to allow them to upgrade the application easily, but the real reason seems to be different: licensing. As the label on the back notes: &amp;quot;Made under license from Dolby Laboratories&amp;quot;. By including the software in the DVD Remote kit, they don't have to pay Dolby for every Xbox sold, but just for every DVD Remote kit sold. This allows them to keep the cost of the Xbox down.&lt;br /&gt;
&lt;br /&gt;
Additionally the dongle contains an IR receiver to receive commands from the Remote control.&lt;br /&gt;
&lt;br /&gt;
=== Known versions ===&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot; &amp;lt;!-- Version is: &amp;quot;%X.%X&amp;quot; % (version &amp;gt;&amp;gt; 8, version &amp;amp; 0xFF) --&amp;gt;&lt;br /&gt;
! Part No.      !! Manufactured in !! Version !! DVD Region !! ROM Size     !! ROM SHA1                                              !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| X08-25402     || Indonesia       || 1.1     || 2          || 229790 Bytes || &amp;lt;code&amp;gt;70d4b5f8e073b05610fba9e9617d7356196b61ff&amp;lt;/code&amp;gt; ||&lt;br /&gt;
|-&lt;br /&gt;
| X08-25402-002     || Indonesia       ||      ||           ||  ||  ||&lt;br /&gt;
|-&lt;br /&gt;
| X08-25387     || Indonesia       ||      ||           ||  ||  ||&lt;br /&gt;
|-&lt;br /&gt;
| X08-25387-002 || Indonesia       || 1.1     || 1          || 229790 Bytes || &amp;lt;code&amp;gt;73814aa736d83d636380f5c6b1c291441b35354d&amp;lt;/code&amp;gt; || Sticker: &amp;quot;2341P&amp;quot; on PCB&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== USB Protocol ===&lt;br /&gt;
&lt;br /&gt;
{{FIXME|reason=Partially documented in JayFoxRox/xbox-tools on github}}&lt;br /&gt;
&lt;br /&gt;
=== Components ===&lt;br /&gt;
&lt;br /&gt;
Different versions of the dongle seem to use different hardware internally.&lt;br /&gt;
&lt;br /&gt;
==== X08-25387-002 (PCB: &amp;quot;X01469-100&amp;quot;) ====&lt;br /&gt;
&lt;br /&gt;
* U1 ATMEL AT43USB352M-AC{{FIXME|reason=Can't find datasheet.. only for AT43USB351M-AC and AT43USB353M-AC; both of which have various differences}}&lt;br /&gt;
* U2 TSOP-1556&lt;br /&gt;
* U3 X393121C{{FIXME|reason=What is this? a ROM? how large?}}&lt;br /&gt;
&lt;br /&gt;
==== Unknown version (PCB: &amp;quot;IR DONGLE REV B&amp;quot;) ====&lt;br /&gt;
&lt;br /&gt;
{{FIXME|reason=See http://wiki.tolabaki.gr/mediawiki/images/d/db/Xbox_rc_vanilla.jpg . Needs more pics}}&lt;br /&gt;
&lt;br /&gt;
==== Unknown version (PCB: &amp;quot;REV C.&amp;quot;) ====&lt;br /&gt;
&lt;br /&gt;
[[File:Xbox-linux-dvd-dongle-front.jpg|thumb|200px|Frontside]]&lt;br /&gt;
[[File:Xbox-linux-dvd-dongle-back.jpg|thumb|200px|Backside]]&lt;br /&gt;
&lt;br /&gt;
* U1 92163 [https://web.archive.org/web/20100617020513/http://www.st.com/ STMicroelectronics] &amp;amp;lt;[https://web.archive.org/web/20100617020513/http://www.st.com/stonline/books/pdf/docs/5521.pdf Datasheet]&amp;amp;gt;&lt;br /&gt;
: This big square IC on the backside is the microcontroller. STMicroelectronics describes it as &amp;quot;8/16-BIT FULL SPEED USB MCU FOR COMPOSITE DEVICES WITH 16 ENDPOINTS, 20K ROM, 2K RAM, I 2 C, SCI, &amp;amp;amp; MFT&amp;quot;. Since the program resides inside in its ROM, it is almost impossible to extract the program from inside.&lt;br /&gt;
&lt;br /&gt;
* U2 TSOP-1556 [https://web.archive.org/web/20100617020513/http://www.vishay.com/ Vishay Telefunken] &amp;amp;lt;[https://web.archive.org/web/20100617020513/http://www.vishay.com/docs/82029/82029.pdf Datasheet]&amp;amp;gt;&lt;br /&gt;
: This black box on the middle of the frontside is an integrated IR receiver. It filters the received infrared pulses and demodulates them. Its filter frequency is 56kHz, while 38kHz is standard for most remote controls. Therefore, chances are few other remotes will work with the Xbox receiver.&lt;br /&gt;
&lt;br /&gt;
* U3 MX23C4000TC-10 [https://web.archive.org/web/20100617020513/http://www.macronix.com/ Macronix] &amp;amp;lt;[https://web.archive.org/web/20100617020513/http://www.macronix.com/QuickPlace/hq/PageLibrary48256D9D002BA613.nsf/h_6057FA6682A90C3948256DCE0052D2D3/67DCB124F1BE4E7D48256DC50039AC31/$File/MX23C4000-4.2.pdf/?OpenElement Datasheet]&amp;amp;gt;&lt;br /&gt;
: This wide TSOP IC on the frontside could be the most interesting of all. It is a 4MBit mask ROM.&lt;br /&gt;
&lt;br /&gt;
* U4 HC574 [https://web.archive.org/web/20100617020513/http://www.ti.com/ Texas Instruments] &amp;amp;lt;[https://web.archive.org/web/20100617020513/http://focus.ti.com/lit/ds/symlink/sn74hc574.pdf Datasheet]&amp;amp;gt;&lt;br /&gt;
: This 20-pin standard logic IC is an octal D-flipflop, which splits the databus from the 92163 to 8 adress bits. This technique is very well known from the 8051 and other microcontrollers.&lt;br /&gt;
&lt;br /&gt;
=== Hacking ===&lt;br /&gt;
&lt;br /&gt;
As the dashboard presumably downloads the code from the ROM into the memory of the Xbox, this could be a hardware hack requiring no hardware modifications. The XBE loader for the DVD image is different from the usual XBE loader. However, the XBE is still signed and checked for security.&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
* [https://ibb.co/album/cmr5rF Pictures of X08-25387-002 including internals]&lt;br /&gt;
* [https://github.com/JayFoxRox/xbox-tools/tree/master/dump-dvd-kit Tool to dump DVD Dongle ROM]&lt;br /&gt;
* [https://web.archive.org/web/20100617020513/http://www.xbox-linux.org/wiki/DVD-IR_Internals DVD-IR Internals]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=5661</id>
		<title>Main Page</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=5661"/>
				<updated>2017-06-04T01:15:45Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: /* Hardware */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{:Main Page/Header}}&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
* [[Chihiro]]&lt;br /&gt;
* [[Xbox]]&lt;br /&gt;
&lt;br /&gt;
* [[Hardware Revisions]]&lt;br /&gt;
* [[Motherboard]]&lt;br /&gt;
* [[CPU]]&lt;br /&gt;
* [[NV2A]]&lt;br /&gt;
** [[NV2A/Vertex attributes]]&lt;br /&gt;
** [[NV2A/Fixed Function Pipeline]]&lt;br /&gt;
** [[NV2A/Vertex Shader]]&lt;br /&gt;
** [[NV2A/Pixel Combiner]]&lt;br /&gt;
** [[NV2A/Surface Formats]]&lt;br /&gt;
* [[DSP]]&lt;br /&gt;
* [[Memory]]&lt;br /&gt;
* [[Flash]]&lt;br /&gt;
* [[MCPX]]&lt;br /&gt;
* [[EEPROM]]&lt;br /&gt;
* [[SMC]]&lt;br /&gt;
* [[Video Encoder]]&lt;br /&gt;
* [[NVNet|Network Controller (NVNet)]]&lt;br /&gt;
* [[DVD Drive]]&lt;br /&gt;
** [[Xbox Game Disc]]&lt;br /&gt;
* [[Hard Drive]]&lt;br /&gt;
* [[USB]]&lt;br /&gt;
** [[Xbox Input Devices]]&lt;br /&gt;
** [[Xbox Memory Unit]]&lt;br /&gt;
** [[Xbox Live Communicator]] &amp;lt;!-- Maybe rename this to microphones later? --&amp;gt;&lt;br /&gt;
** [[DVD-IR Internals]]&lt;br /&gt;
* [[Power Supply]]&lt;br /&gt;
&lt;br /&gt;
== System Software ==&lt;br /&gt;
* [[MCPX ROM]]&lt;br /&gt;
* [[BIOS]] / [[Kernel]]&lt;br /&gt;
** [[Boot Process]]&lt;br /&gt;
** [[XBE]] (Executable file format)&lt;br /&gt;
* [[FATX]] (Filesystem)&lt;br /&gt;
* [[Dashboard]]&lt;br /&gt;
* [[Exploits]]&lt;br /&gt;
&lt;br /&gt;
== Development Kits and Tools ==&lt;br /&gt;
* [https://github.com/xqemu/nxdk nxdk (New Xbox Development Kit)]&lt;br /&gt;
* [[OpenXDK]]&lt;br /&gt;
* [[Microsoft XDK]]&lt;br /&gt;
** [[Xbox Debug Monitor]]&lt;br /&gt;
** [[Xbox Neighborhood]]&lt;br /&gt;
&lt;br /&gt;
== Games ==&lt;br /&gt;
* [[:Category:Games|Games]]&lt;br /&gt;
* [[Engine List]]&lt;br /&gt;
&lt;br /&gt;
== Emulation ==&lt;br /&gt;
* [[Emulators]]&lt;br /&gt;
** [[XQEMU]]&lt;br /&gt;
** [[Xbox 360 Backward Compatibility]]&lt;br /&gt;
&lt;br /&gt;
== Other ==&lt;br /&gt;
* [[Network]]&lt;br /&gt;
* Find random stuff in [[Resources]]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=5611</id>
		<title>Main Page</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=5611"/>
				<updated>2017-05-31T09:15:12Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: /* Emulation */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{:Main Page/Header}}&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
* [[Chihiro]]&lt;br /&gt;
* [[Xbox]]&lt;br /&gt;
&lt;br /&gt;
* [[Hardware Revisions]]&lt;br /&gt;
* [[Motherboard]]&lt;br /&gt;
* [[CPU|CPU (Custom Pentium 3 733 MHz)]]&lt;br /&gt;
* [[NV2A]]&lt;br /&gt;
** [[NV2A/Vertex attributes]]&lt;br /&gt;
** [[NV2A/Fixed Function Pipeline]]&lt;br /&gt;
** [[NV2A/Vertex Shader]]&lt;br /&gt;
** [[NV2A/Pixel Combiner]]&lt;br /&gt;
** [[NV2A/Surface Formats]]&lt;br /&gt;
* [[DSP]]&lt;br /&gt;
* [[Memory]]&lt;br /&gt;
* [[Flash]]&lt;br /&gt;
* [[MCPX]]&lt;br /&gt;
* [[EEPROM]]&lt;br /&gt;
* [[SMC]]&lt;br /&gt;
* [[Video Encoder]]&lt;br /&gt;
* [[NVNet|Network Controller (NVNet)]]&lt;br /&gt;
* [[DVD Drive]]&lt;br /&gt;
** [[Xbox Game Disc]]&lt;br /&gt;
* [[Hard Drive]]&lt;br /&gt;
* [[USB]]&lt;br /&gt;
** [[Xbox Input Devices]]&lt;br /&gt;
* [[Power Supply]]&lt;br /&gt;
&lt;br /&gt;
== System Software ==&lt;br /&gt;
* [[MCPX ROM]]&lt;br /&gt;
* [[BIOS]] / [[Kernel]]&lt;br /&gt;
** [[Boot Process]]&lt;br /&gt;
** [[XBE]] (Executable file format)&lt;br /&gt;
* [[FATX]] (Filesystem)&lt;br /&gt;
* [[Dashboard]]&lt;br /&gt;
* [[Exploits]]&lt;br /&gt;
&lt;br /&gt;
== Development Kits and Tools ==&lt;br /&gt;
* [https://github.com/xqemu/nxdk nxdk (New Xbox Development Kit)]&lt;br /&gt;
* [[OpenXDK]]&lt;br /&gt;
* [[Microsoft XDK]]&lt;br /&gt;
** [[Xbox Debug Monitor]]&lt;br /&gt;
** [[Xbox Neighborhood]]&lt;br /&gt;
&lt;br /&gt;
== Games ==&lt;br /&gt;
* [[:Category:Games|Games]]&lt;br /&gt;
* [[Engine List]]&lt;br /&gt;
&lt;br /&gt;
== Emulation ==&lt;br /&gt;
* [[Emulators]]&lt;br /&gt;
** [[XQEMU]]&lt;br /&gt;
** [[Xbox 360 Backward Compatibility]]&lt;br /&gt;
&lt;br /&gt;
== Other ==&lt;br /&gt;
* [[Network]]&lt;br /&gt;
* Find random stuff in [[Resources]]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=PIC&amp;diff=5606</id>
		<title>PIC</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=PIC&amp;diff=5606"/>
				<updated>2017-05-31T09:12:12Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: Created page with &amp;quot;Retrieved from [https://web.archive.org/web/20100617022549/http://www.xbox-linux.org/wiki/PIC]  by ''Georg Lukas, Michael Steil, Jeff Mears'', 26 June 2002  Little is known ab...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Retrieved from [https://web.archive.org/web/20100617022549/http://www.xbox-linux.org/wiki/PIC]&lt;br /&gt;
&lt;br /&gt;
by ''Georg Lukas, Michael Steil, Jeff Mears'', 26 June 2002&lt;br /&gt;
&lt;br /&gt;
Little is known about how to program the PIC. Basically, the PIC is an independent 16 bit microprocessor with its own RAM and I/O lines, connected to the CPU through the SMBus. Its own firmware makes it possible for the PIC to be talked to on a very high level. Flashing of the LED, for instance, is completely controlled by the PIC.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Command overview==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|  '''Command'''&lt;br /&gt;
|  '''Description'''&lt;br /&gt;
|-&lt;br /&gt;
|  0x01&lt;br /&gt;
|  PIC version string&lt;br /&gt;
|-&lt;br /&gt;
|  0x03&lt;br /&gt;
|  tray state&lt;br /&gt;
|-&lt;br /&gt;
|  0x04&lt;br /&gt;
|  A/V Pack state&lt;br /&gt;
|-&lt;br /&gt;
|  0x09&lt;br /&gt;
|  CPU temperature (C)&lt;br /&gt;
|-&lt;br /&gt;
|  0x0A&lt;br /&gt;
|  board temperature (C)&lt;br /&gt;
|-&lt;br /&gt;
|  0x0F&lt;br /&gt;
|  reads scratch register written with 0x0E&lt;br /&gt;
|-&lt;br /&gt;
|  0x10&lt;br /&gt;
|  current fan speed (0~50)&lt;br /&gt;
|-&lt;br /&gt;
|  0x11&lt;br /&gt;
|  interrupt reason&lt;br /&gt;
|-&lt;br /&gt;
|  0x18&lt;br /&gt;
|  reading this reg locks up xbox in &amp;quot;overheated&amp;quot; state&lt;br /&gt;
|-&lt;br /&gt;
|  0x1B&lt;br /&gt;
|  scratch register for the original kernel&lt;br /&gt;
|-&lt;br /&gt;
|  0x1C&lt;br /&gt;
|  random number for boot challenge&lt;br /&gt;
|-&lt;br /&gt;
|  0x1D&lt;br /&gt;
|  random number for boot challenge&lt;br /&gt;
|-&lt;br /&gt;
|  0x1E&lt;br /&gt;
|  random number for boot challenge&lt;br /&gt;
|-&lt;br /&gt;
|  0x1F&lt;br /&gt;
|  random number for boot challenge&lt;br /&gt;
|}&lt;br /&gt;
&amp;lt;br /&amp;gt;&lt;br /&gt;
&amp;lt;br /&amp;gt;&lt;br /&gt;
'''Writing:'''&lt;br /&gt;
&amp;lt;br /&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|  '''Command'''&lt;br /&gt;
|  '''Description'''&lt;br /&gt;
|-&lt;br /&gt;
|  0x01&lt;br /&gt;
|  PIC version string counter reset&lt;br /&gt;
|-&lt;br /&gt;
|  0x02&lt;br /&gt;
|  reset and power off control&lt;br /&gt;
|-&lt;br /&gt;
|  0x05&lt;br /&gt;
|  power fan mode (0 = automatic; 1 = custom speed from reg&lt;br /&gt;
&lt;br /&gt;
0x06)&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|  0x06&lt;br /&gt;
|  power fan speed (0..~50)&lt;br /&gt;
|-&lt;br /&gt;
|  0x07&lt;br /&gt;
|  LED mode (0 = automatic; 1 = custom sequence from reg 0x08)&lt;br /&gt;
|-&lt;br /&gt;
|  0x08&lt;br /&gt;
|  LED flashing sequence&lt;br /&gt;
|-&lt;br /&gt;
|  0x0C&lt;br /&gt;
|  tray eject (0 = eject; 1 = load)&lt;br /&gt;
|-&lt;br /&gt;
|  0x0E&lt;br /&gt;
|  another scratch register? seems like an error code.&lt;br /&gt;
|-&lt;br /&gt;
|  0x19&lt;br /&gt;
|  reset on eject (0 = enable; 1 = disable)&lt;br /&gt;
|-&lt;br /&gt;
|  0x1A&lt;br /&gt;
|  interrupt enable (write 0x01 to enable; can't disable once&lt;br /&gt;
&lt;br /&gt;
enabled)&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|  0x1B&lt;br /&gt;
|  scratch register for the original kernel&lt;br /&gt;
|-&lt;br /&gt;
|  0x20&lt;br /&gt;
|  response to PIC challenge (written first)&lt;br /&gt;
|-&lt;br /&gt;
|  0x21&lt;br /&gt;
|  response to PIC challenge (written second)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==PIC version string==&lt;br /&gt;
&lt;br /&gt;
The PIC version can be read from register 0x01 as a 3-character ASCII string. Each time you read that register, the next of the 3 characters is returned. It repeats after the third read. Also, the counter can be reset to the first letter by writing 0x00 to this register. Some Xboxes have the letters &amp;quot;SMC P01&amp;quot; physically etched into the top of the PIC, and some have it on a sticker. The P01 is the version number. The following table shows known PIC versions:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;br /&amp;gt;&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|  '''Version'''&lt;br /&gt;
|  '''Hex'''&lt;br /&gt;
|  '''Description'''&lt;br /&gt;
|-&lt;br /&gt;
|  P01&lt;br /&gt;
|  50 30 31&lt;br /&gt;
|  retail xbox 1.0&lt;br /&gt;
|-&lt;br /&gt;
|  P05&lt;br /&gt;
|  50 30 35&lt;br /&gt;
|  retail xbox 1.1&lt;br /&gt;
|-&lt;br /&gt;
|  DXB&lt;br /&gt;
|  44 58 42&lt;br /&gt;
|  debug kit&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==Reset and Power Off==&lt;br /&gt;
&lt;br /&gt;
The PIC controls the power system of the Xbox. To reset or power off the system, you write a request to register 0x02. Since the PIC takes some time to respond, you should do a cli/hlt loop after writing to the PIC. These are the values you can use (this is NOT a bitfield):&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|  '''Value'''&lt;br /&gt;
|  '''Description'''&lt;br /&gt;
|-&lt;br /&gt;
|  0x01&lt;br /&gt;
|  resets the system and all hardware&lt;br /&gt;
|-&lt;br /&gt;
|  0x40&lt;br /&gt;
|  power cycle: powers off then on (also clears scratch register)&lt;br /&gt;
|-&lt;br /&gt;
|  0x80&lt;br /&gt;
|  power off&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==The AV Pack==&lt;br /&gt;
&lt;br /&gt;
The A/V connector on the xbox rear contains several pins to detect the kind of attached cable. In the PIC there is a register (0x04), where this information can be read out by software. The following values are known:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|  '''Value'''&lt;br /&gt;
|  '''Description'''&lt;br /&gt;
|-&lt;br /&gt;
|  0x00&lt;br /&gt;
|  SCART&lt;br /&gt;
|-&lt;br /&gt;
|  0x01&lt;br /&gt;
|  HDTV&lt;br /&gt;
|-&lt;br /&gt;
|  0x02&lt;br /&gt;
|  VGA&lt;br /&gt;
|-&lt;br /&gt;
|  0x03&lt;br /&gt;
|  RFU&lt;br /&gt;
|-&lt;br /&gt;
|  0x04&lt;br /&gt;
|  S-Video&lt;br /&gt;
|-&lt;br /&gt;
|  0x05&lt;br /&gt;
|  undefined&lt;br /&gt;
|-&lt;br /&gt;
|  0x06&lt;br /&gt;
|  standard&lt;br /&gt;
|-&lt;br /&gt;
|  0x07&lt;br /&gt;
|  missing/disconnected&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==The LED==&lt;br /&gt;
&lt;br /&gt;
The PIC has its own timer to flash the LEDs: The LED color goes through four phases, 0 to 3. In each phase, the color of the LED can be different. The LED can be off, red, green, or, by turning on both red and green, orange. All the CPU has to do to make the PIC control the LED in a specified way is to transmit a byte containing the color sequence to it.&lt;br /&gt;
&lt;br /&gt;
The PIC, by default, manages the LEDs itself. While the system is on, the LED normally is solid green. But when you hit eject, the PIC causes the LED to flash green. To override this, and control the LEDs as desired, you must write 0x01 to register 0x07 after writing your color sequence to 0x08.&lt;br /&gt;
&lt;br /&gt;
Each phase consists of two bits, one for red and one for green, so four phases fit into a byte. Thus, the control byte looks as follows:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|  '''Bit #'''&lt;br /&gt;
|  '''Description'''&lt;br /&gt;
|-&lt;br /&gt;
|  7&lt;br /&gt;
|  Red (Phase 0)&lt;br /&gt;
|-&lt;br /&gt;
|  6&lt;br /&gt;
|  Red (Phase 1)&lt;br /&gt;
|-&lt;br /&gt;
|  5&lt;br /&gt;
|  Red (Phase 2)&lt;br /&gt;
|-&lt;br /&gt;
|  4&lt;br /&gt;
|  Red (Phase 3)&lt;br /&gt;
|-&lt;br /&gt;
|  3&lt;br /&gt;
|  Green (Phase 0)&lt;br /&gt;
|-&lt;br /&gt;
|  2&lt;br /&gt;
|  Green (Phase 1)&lt;br /&gt;
|-&lt;br /&gt;
|  1&lt;br /&gt;
|  Green (Phase 2)&lt;br /&gt;
|-&lt;br /&gt;
|  0&lt;br /&gt;
|  Green (Phase 3)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
To set an LED code, the command code 0x08 and the LED code as data must to be sent to I2C device 0x20, followed by the command code 0x07 with a 0x01 as data, both in byte mode.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt; SMBusWriteCommand(0x20, 8, false, states);&lt;br /&gt;
 SMBusWriteCommand(0x20, 7, false, 1);&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&amp;lt;br /&amp;gt;&lt;br /&gt;
These are some example settings:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|  '''Code'''&lt;br /&gt;
|  '''Binary'''&lt;br /&gt;
|  '''Description'''&lt;br /&gt;
|-&lt;br /&gt;
|  0x00&lt;br /&gt;
|  00000000&lt;br /&gt;
|  Off&lt;br /&gt;
|-&lt;br /&gt;
|  0xF0&lt;br /&gt;
|  11110000&lt;br /&gt;
|  Solid red&lt;br /&gt;
|-&lt;br /&gt;
|  0x0F&lt;br /&gt;
|  00001111&lt;br /&gt;
|  Solid green&lt;br /&gt;
|-&lt;br /&gt;
|  0xFF&lt;br /&gt;
|  11111111&lt;br /&gt;
|  Solid orange&lt;br /&gt;
|-&lt;br /&gt;
|  0xC0&lt;br /&gt;
|  11000000&lt;br /&gt;
|  Slow red flashing&lt;br /&gt;
|-&lt;br /&gt;
|  0xA0&lt;br /&gt;
|  10100000&lt;br /&gt;
|  Fast red flashing&lt;br /&gt;
|-&lt;br /&gt;
|  0x63&lt;br /&gt;
|  01100011&lt;br /&gt;
|  Off - red - orange - green flashing&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
You can use the blink tool available from CVS as a frontend for this:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
# blink ABCD&lt;br /&gt;
&amp;lt;br /&amp;gt;&lt;br /&gt;
ABCD are the LED states for the four phases, possible values for every state are:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|  '''Value'''&lt;br /&gt;
|  '''Description'''&lt;br /&gt;
|-&lt;br /&gt;
|  r&lt;br /&gt;
|  red&lt;br /&gt;
|-&lt;br /&gt;
|  g&lt;br /&gt;
|  green&lt;br /&gt;
|-&lt;br /&gt;
|  o&lt;br /&gt;
|  orange (red+green)&lt;br /&gt;
|-&lt;br /&gt;
|  x&lt;br /&gt;
|  off&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
If you want to make it slowly switch red/green, run blink rrgg, fast orange blinking can be achieved with blink oxox.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Interrupt reasons==&lt;br /&gt;
&lt;br /&gt;
The PIC sets the interrupt reason register (0x11) with a bitmask of the following values to indicate to the operating system why the interrupt occurred:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|  '''Value'''&lt;br /&gt;
|  '''Description'''&lt;br /&gt;
|-&lt;br /&gt;
|  0x01&lt;br /&gt;
|  power button pressed&lt;br /&gt;
|-&lt;br /&gt;
|  0x10&lt;br /&gt;
|  A/V Pack removed&lt;br /&gt;
|-&lt;br /&gt;
|  0x20&lt;br /&gt;
|  eject button pressed&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==Scratch register values==&lt;br /&gt;
&lt;br /&gt;
The original kernel uses this register (0x1B) to &amp;quot;remember&amp;quot; some information across a reboot, and interprets its contents after rebooting. The PIC itself probably makes no interpretation of this register. The register is a bitmask with the following values:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|  '''Value'''&lt;br /&gt;
|  '''Description'''&lt;br /&gt;
|-&lt;br /&gt;
|  0x01&lt;br /&gt;
|  eject after boot&lt;br /&gt;
|-&lt;br /&gt;
|  0x02&lt;br /&gt;
|  display error message after boot&lt;br /&gt;
|-&lt;br /&gt;
|  0x04&lt;br /&gt;
|  skip boot animation&lt;br /&gt;
|-&lt;br /&gt;
|  0x08&lt;br /&gt;
|  run dashboard no matter what&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==PIC Challenge (regs 0x1C~0x21)==&lt;br /&gt;
&lt;br /&gt;
To try to thwart any attempt to hijack the entire boot process by bypassing the MCPX, the PIC does a security check on the booting ROM. After reset, the PIC gives the CPU about 250 ms to respond to a cryptographic challenge before the system is reset. The PIC generates four random(?) bytes, read from registers 0x1C~0x1F. To disable the countdown, you hash these four bytes and write the result to 0x20 and 0x21. Details of this process are given [https://web.archive.org/web/20100617022549/http://www.xbox-linux.org/docs/pichandshake.html here] .&lt;br /&gt;
&lt;br /&gt;
On a &amp;quot;Debug Kit&amp;quot; (PIC version &amp;quot;DXB&amp;quot;), registers 0x1C~0x1F all return a value of 0x00. It is unknown whether the challenge system is active at all on these machines.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;hr /&amp;gt;&lt;br /&gt;
&lt;br /&gt;
(original version: [https://web.archive.org/web/20100617022549/http://www.xbox-linux.org/docs/smc.html])&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Xbox_Hard_Disk_Partitioning&amp;diff=5601</id>
		<title>Xbox Hard Disk Partitioning</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Xbox_Hard_Disk_Partitioning&amp;diff=5601"/>
				<updated>2017-05-31T09:07:12Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: Created page with &amp;quot;Retrieved from [https://web.archive.org/web/20100617023145/http://www.xbox-linux.org/wiki/Xbox_Hard_Disk_Partitioning]   by ''Michael Steil'' (original version: 8 May 2002)  T...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Retrieved from [https://web.archive.org/web/20100617023145/http://www.xbox-linux.org/wiki/Xbox_Hard_Disk_Partitioning]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
by ''Michael Steil'' (original version: 8 May 2002)&lt;br /&gt;
&lt;br /&gt;
The Xbox uses a hard disk partitioning scheme that is hardwired into the kernel. The hard disk consists of a header, 3 game cache partitions, a system partition and a data partition:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
!  Offset&lt;br /&gt;
!  Size&lt;br /&gt;
!  Description&lt;br /&gt;
|-&lt;br /&gt;
|  0&amp;amp;nbsp;MB&amp;lt;br /&amp;gt;&amp;lt;code&amp;gt;0x00000000&amp;lt;/code&amp;gt;&lt;br /&gt;
|  0.5&amp;amp;nbsp;MB&lt;br /&gt;
|  '''Disk Config Area''' &amp;lt;br /&amp;gt;This partition contains no filesystem. Various configuration data is stored on fixed offsets.&amp;lt;br /&amp;gt;Linux device: &amp;lt;code&amp;gt;none&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
|  0.5&amp;amp;nbsp;MB&amp;lt;br /&amp;gt;&amp;lt;code&amp;gt;0x00000400&amp;lt;/code&amp;gt;&lt;br /&gt;
|  750&amp;amp;nbsp;MB&lt;br /&gt;
|  '''Game Cache A''' (Drive X:)&amp;lt;br /&amp;gt;FATX volume containing temporary data of a game for faster access.&amp;lt;br /&amp;gt;Linux device: &amp;lt;code&amp;gt;/dev/hda52&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
|  750.5&amp;amp;nbsp;MB&amp;lt;br /&amp;gt;&amp;lt;code&amp;gt;0x00177400&amp;lt;/code&amp;gt;&lt;br /&gt;
|  750&amp;amp;nbsp;MB&lt;br /&gt;
|  '''Game Cache B''' (Drive Y:)&amp;lt;br /&amp;gt;Linux device: &amp;lt;code&amp;gt;/dev/hda53&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
|  1500.5&amp;amp;nbsp;MB&amp;lt;br /&amp;gt;&amp;lt;code&amp;gt;0x002EE400&amp;lt;/code&amp;gt;&lt;br /&gt;
|  750&amp;amp;nbsp;MB&lt;br /&gt;
|  '''Game Cache C''' (Drive Z:)&amp;lt;br /&amp;gt;Linux device: &amp;lt;code&amp;gt;/dev/hda54&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
|  2250.5&amp;amp;nbsp;MB&amp;lt;br /&amp;gt;&amp;lt;code&amp;gt;0x00465400&amp;lt;/code&amp;gt;&lt;br /&gt;
|  500&amp;amp;nbsp;MB&lt;br /&gt;
|  '''System Files''' (Drive C:)&amp;lt;br /&amp;gt;FATX volume containing menu code, graphics, sound, DVD player, music import,&amp;amp;nbsp;...&amp;lt;br /&amp;gt;Linux device: &amp;lt;code&amp;gt;/dev/hda51&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
|  2750.5&amp;amp;nbsp;MB&amp;lt;br /&amp;gt;&amp;lt;code&amp;gt;0x0055F400&amp;lt;/code&amp;gt;&lt;br /&gt;
|  4895&amp;amp;nbsp;MB&lt;br /&gt;
|  '''Data''' (Drive E:)&amp;lt;br /&amp;gt;FATX volume containing saved games and imported CD audio tracks.&amp;lt;br /&amp;gt;Linux device: &amp;lt;code&amp;gt;/dev/hda50&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
! &lt;br /&gt;
! &lt;br /&gt;
!  '''Non-Standard partitions on disks &amp;amp;gt;8GB'''&lt;br /&gt;
|-&lt;br /&gt;
|  7645.5&amp;amp;nbsp;MB&amp;lt;br /&amp;gt;&amp;lt;code&amp;gt;0x00EE8AB0&amp;lt;/code&amp;gt;&lt;br /&gt;
|  1896&amp;amp;nbsp;MB&amp;lt;br /&amp;gt;- 130&amp;amp;nbsp;GB&lt;br /&gt;
|  '''Unused/Additional''' (Drive F:)&amp;lt;br /&amp;gt;The first xboxes had a 8GB disk, later versions came with a 10GB disk. This the space difference between the two and not used. Some tools allow it to be used as additional FATX filesystem&amp;lt;br /&amp;gt;Linux device: &amp;lt;code&amp;gt;/dev/hda55&amp;lt;/code&amp;gt; (only present if signature of formatted FATX found)&amp;lt;br /&amp;gt;Linux assumes that all remaining space on the disk belongs to this partition unless another FATX filesystem is detected at the LBA28 boundary. See below.&lt;br /&gt;
|-&lt;br /&gt;
|  137&amp;amp;nbsp;GB&amp;lt;br /&amp;gt;&amp;lt;code&amp;gt;0x0FFFFFFF&amp;lt;/code&amp;gt;&lt;br /&gt;
|  remaining space&lt;br /&gt;
|  '''LBA28''' (Drive G:)&amp;lt;br /&amp;gt;If you install a very big disk some tools are limited by the LBA24 boundary. The drive G allows this space to be used in a separate drive, only accessible to LBA48 capable tools and BIOS'es.&amp;lt;br /&amp;gt;Linux device: &amp;lt;code&amp;gt;/dev/hda56&amp;lt;/code&amp;gt; (only present if signature of formatted FATX found at LBA24 boundary)&amp;lt;br /&amp;gt;Linux assumes that all remaining space on the disk belongs to this partition.&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
This table has been completed by Markus Baertschi with lots of stuff. There might be errors and misconceptions, caveat emptor&amp;amp;nbsp;!&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! '''Missing image'''&amp;lt;br /&amp;gt;''Icon-admonition-tip.png'' &amp;lt;br /&amp;gt;Tip&amp;lt;br /&amp;gt;&amp;lt;br /&amp;gt; | For a more detailed description of the format and contents of the partitions see [https://web.archive.org/web/20100617023145/http://www.xbox-linux.org/wiki/Xbox_Partitioning_and_Filesystem_Details Xbox Partitioning and Filesystem Details].|}&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=17_Mistakes_Microsoft_Made_in_the_Xbox_Security_System&amp;diff=5600</id>
		<title>17 Mistakes Microsoft Made in the Xbox Security System</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=17_Mistakes_Microsoft_Made_in_the_Xbox_Security_System&amp;diff=5600"/>
				<updated>2017-05-31T08:57:09Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: Created page with &amp;quot;Retrieved from [https://web.archive.org/web/20100617003620/http://www.xbox-linux.org/wiki/17_Mistakes_Microsoft_Made_in_the_Xbox_Security_System]    by [https://web.archive.or...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Retrieved from [https://web.archive.org/web/20100617003620/http://www.xbox-linux.org/wiki/17_Mistakes_Microsoft_Made_in_the_Xbox_Security_System]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
by [https://web.archive.org/web/20100617003620/http://www.xbox-linux.org/wiki/User:Michael_Steil Michael Steil]&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
| &lt;br /&gt;
&lt;br /&gt;
This [https://web.archive.org/web/20100617003620/http://events.ccc.de/congress/2005/fahrplan/attachments/591-paper_xbox.pdf paper], dated 2005-10-25, has been submitted to the [https://web.archive.org/web/20100617003620/http://events.ccc.de/congress/2005/ 22nd Chaos Communication Congress] and has been on [https://web.archive.org/web/20100617003620/http://events.ccc.de/congress/2005/fahrplan/events/559.en.html December 29th 2005, 18:00], at the Berliner Congress Center, Berlin, Germany.&lt;br /&gt;
&lt;br /&gt;
A '''recording''' of the presentation is available here: [https://web.archive.org/web/20100617003620/http://video.google.com/videoplay?docid=-749497642180741726 Google Video: Team Xbox-Linux at 22C3].&lt;br /&gt;
&lt;br /&gt;
'''Another recording''' of a slightly updated talk is available here: [https://web.archive.org/web/20100617003620/http://video.google.com/videoplay?docid=-4356347903120410001 Google Video: Deconstructing The Xbox Security System]&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Introduction ==&lt;br /&gt;
&lt;br /&gt;
The Xbox is a gaming console, which has been introduced by Microsoft Corporation in late 2001 and competed with the Sony Playstation 2 and the Nintendo GameCube. Microsoft wanted to prevent the Xbox from being used with copied games, unofficial applications and alternative operating systems, and therefore designed and implemented a security system for this purpose.&lt;br /&gt;
&lt;br /&gt;
This article is about the security system of the Xbox and the mistakes Microsoft made. It will not explain basic concepts like buffer exploits, and it will not explain how to construct an effective security system, but it will explain how ''not'' to do it: This article is about how easy it is to make terrible mistakes and how easily people seem to overestimate their skills. So this article is also about how to avoid the most common mistakes.&lt;br /&gt;
&lt;br /&gt;
For every security concept, this article will first explain the design from Microsoft's perspective, and then describe the hackers' efforts to break the security. If the reader finds the mistakes in the design, this proves that Microsoft has weak developers. If, on the other hand, the reader doesn't find the mistakes, this proves that constructing a security system is indeed hard.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== The Xbox Hardware ===&lt;br /&gt;
&lt;br /&gt;
Because Microsoft had a very tight time frame for the development of the Xbox, they used off-the-shelf PC hardware and their Windows and DirectX technologies as the basis of the console. The Xbox consists of a Pentium III Celeron mobile 733 MHz CPU, 64 MB of RAM, a GeForce 3 MX with TV out, a 10 GB IDE hard disk, an IDE DVD drive, Fast Ethernet, as well as USB for the gamepads. It runs a simplified Windows 2000 kernel, and the games include adapted versions of Win32, libc and DirectX statically linked to them.&lt;br /&gt;
&lt;br /&gt;
Although this sounds a lot more like a PC than, for example, a GameCube with its PowerPC processor, custom optical drive and custom gamepad connectors, it is important to point out that, from a hardware point of view, the Xbox shares ''all'' properties of a PC: It has LPC, PCI and AGP busses, it has IDE drives, it has a Northbridge and a Southbridge, and it includes all the legacy PC features such as the &amp;quot;PIC&amp;quot; interrupt controller, the &amp;quot;PIT&amp;quot; timer and the A20 gate. nVidia sold a slightly modified Southbridge and a Northbridge with another graphics core embedded for the PC market as the &amp;quot;nForce&amp;quot; chipset between 2001 and 2002.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Motivation for the Security System ===&lt;br /&gt;
&lt;br /&gt;
The Xbox being a PC, it should be trivial to install Linux on it in order to have a cheap and, for that time, powerful PC. Even today, a small and silent 733 MHz PC with TV connectivity for 149 USD/EUR is still attractive. But this is not the only thing Microsoft wanted to prevent. There are three uses that should not have been possible:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* '''Linux''': The hardware is subsidized and money is gained with the games, therefore people should not be able to buy an Xbox without the intent to buy any games. Microsoft apparently feels that allowing the Xbox to be used as a (Linux) computer would be too expensive for them.&lt;br /&gt;
* '''Homebrew/Unlicensed''': Microsoft wants the software monopoly on the Xbox platform. Nobody should be able to publish unlicensed software, because Microsoft wants to gain money with the games to amortize the hardware losses, and because they do not want anyone to release non-Internet Explorer browsers and non-Windows Media Player multimedia software.&lt;br /&gt;
* '''Copies''': Obviously it is important to Microsoft that it is not possible to run copied games on the Xbox.&lt;br /&gt;
&lt;br /&gt;
Microsoft decided to design a single security system that was supposed to make Linux, homebrew/unlicensed software and copies impossible. The idea to accomplish this was by simply locking out all software that is either not on the intended (original) medium or not by Microsoft.&lt;br /&gt;
&lt;br /&gt;
On the one hand, this idea makes the security system easier and there are less possible points off attack. But on the other hand, 3 times more attackers have a single security system to hack: Although Open Source and Linux people, homebrew developers, game companies as well as crackers have little common interests, they could unite in this case and jointly hack the Xbox security system.&lt;br /&gt;
&lt;br /&gt;
Of the three consoles of its generation, Xbox, Playstation 2 and GameCube, the Xbox is the one whose security system has been compromised first, the one that is now easiest to modify for a hobbyist, the one with the most security system workarounds, and the one with the most powerful hacks. This may be, because the Xbox security is the weakest one of the three, but also because Open Source people, homebrew people and crackers attacked the Xbox, while the Open Source people did not attack the Playstation 2, as Linux had been officially supported by Sony, so the total number of hackers was lower, buying them time.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Idea of the Security System ===&lt;br /&gt;
&lt;br /&gt;
In order to allow only licensed and authentic code to run, it is necessary to build a TCPA/Palladium-like chain of trust, which reaches from system boot to the actual execution of the game. The first link is from the CPU to the code in ROM, which includes the Windows kernel, and the second link is from the kernel to the game.&lt;br /&gt;
&lt;br /&gt;
There are several reasons that the operating system is contained in ROM (256 KB) instead of being stored on hard disk, like on a PC. First, it allows a faster startup, as the kernel can initialize while the hard disk is spinning up, furthermore, there is one link less in the chain of trust, and in case verification of the kernel gets compromised, it is harder to overwrite a ROM chip than modify data on a hard disk.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Startup Security ==&lt;br /&gt;
&lt;br /&gt;
When turned on, x86-compatible CPUs start at the address 0xFFFFFFF0 in the address space, which is usually flash memory. For the Xbox, this is obviously no good idea, as flash memory can be&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* replaced, by removing the chip, fitting a socket and inserting a replacement chip.&lt;br /&gt;
* overridden, by adding another flash memory chip to the LPC bus. This override functionality is necessary, because during manufacturing, an empty flash memory chip gets soldered onto the board, an override LPC ROM chip gets connected to the board and the system boots from the external ROM, which then programs the internal flash memory. This procedure is significantly cheaper than preprogramming the flash memory chips.&lt;br /&gt;
* reprogrammed, because flash memory can be written to many times. It would be possible to use ROM instead of flash memory, but ROM is more expensive than flash memory.&lt;br /&gt;
&lt;br /&gt;
Thus, the machine must not start from flash memory.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Microsoft's Perspective ===&lt;br /&gt;
&lt;br /&gt;
It would be possible to make two of the attacks impossible, by using ROM chips instead of flash. There would be no way to reprogram them, and it would be possible to disable the LPC override functionality in the chipset, because it is not needed for the manufacturing process any more.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== The Hidden ROM ====&lt;br /&gt;
&lt;br /&gt;
There is a solution between flash memory and ROM that combines advantages of both these approaches. This trick is rather old and had already been used in previous gaming consoles like the Nintendo 64: Use a tiny non-replaceable startup ROM, and put the bulk of the firmware data (i.e. the Windows kernel) into flash memory. The &amp;quot;internal&amp;quot; ROM checks whether the contents of the flash memory are authentic, and if yes, it passes execution to it.&lt;br /&gt;
&lt;br /&gt;
This way, there will be another link in the chain of trust, but the ROM code can be trusted (if it is non-replaceable), and if, in addition, it is non-accessible, an attacker may not even have a clue how verification works.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Location of the ROM ====&lt;br /&gt;
&lt;br /&gt;
But where can this ROM be put? It cannot be a separate chip, as it would be replaceable. It would have to be included into another chip. The CPU would be ideal, as the ROM contents would not travel over any visible bus, but then it would be impossible to use cheap off-the-shelf Celerons. Including it in any other chip would make it non-replaceable, but data would travel over a bus. It seems to be a good compromise to store the ROM data in the Southbridge (&amp;quot;MCPX&amp;quot;), as it is connected via the ''very'' fast HyperTransport bus, so it is very hard to sniff. A former Microsoft employee confirmed that the developers tought that nobody was able to sniff HyperTransport.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Verification Algorithm ====&lt;br /&gt;
&lt;br /&gt;
This secret ROM stored in the Southbridge must verify the Windows kernel in the external flash memory before executing it. One idea would be to checksum (hash) the flash contents using an algorithm like MD5 or SHA-1, but this would mean that the hash of the kernel has to be stored in the secret ROM as well, which would make it imposible to ship updated versions of the kernel in future Xboxes without also updating the ROM contents - which would be very expensive.&lt;br /&gt;
&lt;br /&gt;
A digital signature algorithm like RSA would be better: It would be possible to update the kernel without changing the ROM, but an RSA implementation takes up a lot of space, and embedded ROM in the Southbridge is expensive. It would be ideal if the algorithm fit in only 512 bytes, which is impossible for RSA.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Second Bootloader (&amp;quot;2bl&amp;quot;) ====&lt;br /&gt;
&lt;br /&gt;
A solution for this problem is again to introduce another link in the chain of trust: The ROM only hashes a small loader (&amp;quot;2bl&amp;quot;, &amp;quot;second bootloader&amp;quot;) in flash memory, which can never be changed. It is then the job of this loader to verify the rest of flash, and as the second loader can be any size, there are no restrictions.&lt;br /&gt;
&lt;br /&gt;
So the final chain of trust looks like this: The CPU boots from the secret ROM embedded into the Southbridge, which cannot be changed. The secret ROM verifies the second bootloader in flash memory using a hash algorithm, and if it is authentic, runs it. The second bootloader checks the kernel, and if authentic, runs it.&lt;br /&gt;
&lt;br /&gt;
Now the second bootloader and the Windows kernel would be stored in flash memory in plain text, which is a bad idea: An attacker can immediately see how the second bootloader verifies the integrity of the kernel, and even analyze the complex kernel for possible exploits. Encrypting all the flash contents will not solve possible vulnerability problems, but it will buy us time until the decryption of the flash contents is understood by hackers.&lt;br /&gt;
&lt;br /&gt;
The decryption key would have to be stored in the secret ROM, and the 2bl verification code would also have to decrypt the flash contents into RAM while reading it.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== RAM Initialization ====&lt;br /&gt;
&lt;br /&gt;
Decrypting flash memory contents into RAM is a challenge if we are living inside the first few hundred bytes of code after the machine has started up: At this point, RAM might not be stable yet. The reason for this is that Microsoft bought cheap RAM chips; they just took everything Samsung could give them to lower the price, even faulty ones, i.e. chips that will be unstable when clocked at the highest frequencies specified.&lt;br /&gt;
&lt;br /&gt;
The Xbox is supposed to find out the highest clock speed the RAM chips can go and run them at this frequency - this is the reason why some games don't run as smoothly on some Xboxes as on others. So the startup code in the secret ROM has to do a memory test, and if it fails, clock down the RAM, do another memory test, and if it fails again, clock down again, and so on, until the test succeeds or the RAM cannot be clocked down any further.&lt;br /&gt;
&lt;br /&gt;
The problem now is that it is impossible to do complex RAM initialization, data decryption and hashing in 512 bytes. This code would need at least 2 KB, which would be significantly more expensive, if embedded into the Southbridge.&lt;br /&gt;
&lt;br /&gt;
We could put the RAM initialization code, which is the biggest part of what the startup code needs to do, into flash memory, and call it from the secret ROM, but this would kill security, as an attacker could easily see the unencrypted code in flash, modify it and have the control of the machine right at the startup.&lt;br /&gt;
&lt;br /&gt;
The developers at Microsoft had a brilliant idea how to solve this problem: They designed an interpreter for a virtual machine that can read and write memory, access the PCI config space, do &amp;quot;AND&amp;quot; and &amp;quot;OR&amp;quot; calculations, jump conditionally etc. The instruction code has one byte instructions and two 32 bit operands, it can use immediate values as well as an accumulator.&lt;br /&gt;
&lt;br /&gt;
The interpreter for the virtual machine is stored in the secret ROM, and its code (&amp;quot;xcodes&amp;quot;) is stored in flash memory. This code does the memory initialization (plus extra hardware initialization, which would not be necessary). This program cannot be encrypted, as there is again no space for it in the secret ROM, but as the virtual machine is unknown to the hacker, encryption should not be that important. It also cannot be hashed, as this would make it impossible to change the xcodes for later revisions of the Xbox hardware. Therefore we have to make sure that, if the hacker knows how the virtual machine works, it is impossible to do anything malicious with the xcodes.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== The Virtual Machine ====&lt;br /&gt;
&lt;br /&gt;
There are several ways an attacker could exploit the xcodes, which are by definition untrusted, because they reside in &amp;quot;external&amp;quot; flash memory. Microsoft included some code to make sure there were no possible exploits.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===== Read the Secret ROM =====&lt;br /&gt;
&lt;br /&gt;
The xcodes can read memory and access I/O ports. This way an attacker could place xcodes into flash memory that dump the secret ROM, which must be mapped into the address space somewhere, to a slow bus, like the LPC or the I2C bus, or write it into CMOS or the EEPROM, so that we can read it later.&lt;br /&gt;
&lt;br /&gt;
The xcode interpreter has to make sure that the xcodes cannot read the secret ROM, which is located at the upper 512 bytes of the address space. The simplest way to accomplish this is to mask the address when reading from memory:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;   and ebx, 0FFFFFFFh &amp;amp;nbsp;; clear upper 4 bits&lt;br /&gt;
   mov edi, [ebx]      &amp;amp;nbsp;; read from memory location op1 into di&lt;br /&gt;
   jmp next_instruction&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This way, the xcodes can only ready from the lower 256 MB, which is no problem, as there are only 64 MB of RAM, and memory mapped I/O can be mapped into this region using PCI config cycles.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===== Turn off the Secret ROM =====&lt;br /&gt;
&lt;br /&gt;
The xcodes may also not turn off the secret ROM, or else the CPU, while executing the xcode interpreter, would &amp;quot;fall down&amp;quot; from the secret ROM into the underlying flash ROM, which is also mapped to the top end of the address space. The turn off functionality is important: As soon as the second bootloader takes over, the secret ROM has to be turned off, or else an attack against a game, which makes it possible to run arbitrary code, could dump the secret ROM, making additional attacks against it possible.&lt;br /&gt;
&lt;br /&gt;
The secret ROM can be turned off by writing a value with bit #1 set to the PCI config space of device 0:1:0, register 0x80. So the xcode interpreter always clears this bit in case there is a write to this PCI config space register:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;   cmp ebx, 80000880h        &amp;amp;nbsp;; ISA Bridge, MCPX disable?&lt;br /&gt;
   jnz short not_mcpx_disable&amp;amp;nbsp;; no&lt;br /&gt;
   and ecx, not 2            &amp;amp;nbsp;; clear  bit 1&lt;br /&gt;
not_mcpx_disable:&lt;br /&gt;
   mov eax, ebx&lt;br /&gt;
   mov dx, 0CF8h&lt;br /&gt;
   out dx, eax               &amp;amp;nbsp;; PCI configuration address&lt;br /&gt;
   add dl, 4&lt;br /&gt;
   mov eax, ecx&lt;br /&gt;
   out dx, eax               &amp;amp;nbsp;; PCI configuration data&lt;br /&gt;
   jmp short next_instruction&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== Encryption and Hashing ====&lt;br /&gt;
&lt;br /&gt;
For the decryption of the second bootloader, Microsoft chose the RC4 algorithm, which is pretty small, as it fits into 150 bytes. It uses a 16 bytes key, which is also stored in the secret ROM. Microsoft's engineers also chose to use RC4 as a hash, so that no additional algorithm had to be implemented for this. Differential decryption algorithms feed the decrypted data into the generator of the decryption key stream, so if the encrypted code is changed at one byte, all the following bytes will decrypted incorrectly, up to the last bytes. This way, it is possible to only test the last few bytes. If they have been decrypted correctly, then the encrypted code has been authentic. (If you are getting suspicious now - read on!)&lt;br /&gt;
&lt;br /&gt;
In practice, the secret ROM in the Xbox compares the last decrypted 32 bit value with the constant of 0x7854794A. If it is incorrect, the Xbox has to panic.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Panic Code ====&lt;br /&gt;
&lt;br /&gt;
So far, the code in the secret ROM does this:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* Enter protected mode, and set up segment descriptors, so that we have access to the complete flat 32 bit address space.&lt;br /&gt;
* Interpret the xcodes.&lt;br /&gt;
* Decrypt and hash the second bootloader, store it in RAM&lt;br /&gt;
* If the hash is correct, jump to the decrypted second bootloader in RAM, else panic.&lt;br /&gt;
&lt;br /&gt;
There is another possible attack here: A hacker could deliberately make the hash fail. If the Xbox then halts and flashes its lights to indicate an error, the attacker can attach a device to dump the secret ROM after the CPU has shut down and the bus is idle. Although HyperTransport is fast, it would be a lot easier to attach a device that actively requests the data from the Southbridge than sniffing it when the CPU requests it.&lt;br /&gt;
&lt;br /&gt;
One solution would be not to halt but to shut down the Xbox in case of a problem. The support chips have this functionality. But incorrect flash memory does not necessarily mean that there has been an attack, it could also be a malfunction, and the machine should use the LED to blink an error code.&lt;br /&gt;
&lt;br /&gt;
So we should leave the Xbox running, but just turn off the secret ROM, so that it cannot be read any more. But there is a problem: We have to do this inside the secret ROM. So if we disable the ROM, we cannot have the &amp;quot;hlt&amp;quot; instruction after that, because the CPU will &amp;quot;fall down&amp;quot; into flash memory - where an attacker could put code. On the other hand, if we halt the CPU, we cannot turn off the secret ROM afterwards.&lt;br /&gt;
&lt;br /&gt;
We cannot put the disable and halt code into RAM and jump there, because RAM might not be stable, and might even have been tampered with by an attacker (e.g. by turning off the memory controller using the xcodes) so that the secret ROM does not get turned off. We cannot put the disable and halt code into flash either, as again, an attacker could simply put arbitrary code to circumvent the complete system there.&lt;br /&gt;
&lt;br /&gt;
The Microsoft engineers used yet another brilliant trick: They jump to the very end of the address space (which is covered by the secret ROM) and turn off the secret ROM in the very last instruction inside the address space. This is a simplified version of the idea:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;FFFFFFF1    mov eax, 80000880h&lt;br /&gt;
FFFFFFF6    mov dx, 0CF8h&lt;br /&gt;
FFFFFFF9    out dx, eax&lt;br /&gt;
FFFFFFFB    add dl, 4&lt;br /&gt;
FFFFFFFC    mov al, 2&lt;br /&gt;
FFFFFFFE    out dx, al&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
After the last instruction, the program counter (EIP) will overflow to 00000000, which, according to the CPU documentation, causes an exception, and as there is no exception handler set up, it causes a double fault, which will effectively halt the machine.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== The Hacker Perspective ===&lt;br /&gt;
&lt;br /&gt;
So much for the theory. The design looked pretty good, although the trade off between cost and security as it has been decided, might give some people headaches. Let us now have a look at the Xbox from the hackers' point of view.&lt;br /&gt;
&lt;br /&gt;
It has been well known that the Xbox chipset is a modified version of nVidia's nForce chipset, so we knew that it was standard IDE, USB, there was an internal PCI bus and so on. Two hackers from Great Britain, Luke and Andy, checked the hard disk and found out that it uses a custom partitioning scheme, a FAT-like filesystem, that there is no kernel on the hard disk, but there is the Xbox Dashboard on the fourth partition, the main program that gets executed if there is no game in the DVD drive, which allows changing settings, playing audio CDs and managing savegames.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Extracting the Secret ROM ====&lt;br /&gt;
&lt;br /&gt;
Andrew &amp;quot;bunnie&amp;quot; Huang, then a PhD student at the MIT, disassembled his Xbox, saw the flash memory, de-soldered it, extracted the contents, put it on his website and got a phone call from one of Microsoft's lawyers.&lt;br /&gt;
&lt;br /&gt;
The flash memory image was obviously encrypted, but there was x86 binary code in the upper 512 bytes! Obviously, there should be no code in the upper 512 bytes, as this gets overridden by the secret ROM, which contains the actual machine setup and flash decryption code.&lt;br /&gt;
&lt;br /&gt;
Bunnie found out that this code was an interpreter for tables in flash memory, plus a decryption function that looked like RC4. He rewrote the crypto code in C and tried it on the data - but the resulting data was random, obviously something was wrong. The interpreter didn't make much sense either. The code used opcodes that were unknown to the interpreter.&lt;br /&gt;
&lt;br /&gt;
In order to find out what was wrong, bunnie rewrote the top of flash with his own code, and later even completely erased the upper 512 bytes, but the Xbox still booted! So it was obvious to him that this region gets overridden by some internal code. As it turned out later, the code in the upper 512 bytes of the flash image was a very old version of the secret ROM code, which had been unintentionally linked to the image by the build tools. It seems like nobody had looked at the resulting image at the end, before they shipped the consoles. This mistake was very close to a fatal one, and Microsoft was lucky that they didn't link the actual version of the secret ROM.&lt;br /&gt;
&lt;br /&gt;
But it didn't make that much of a difference, as bunnie sniffed the busses, and eventually dumped the complete secret ROM, including the RC4 key from HyperTransport, using a custom built sniffer - after all, he was working on his PhD degree about high performance computing, and he could use the excellent resources of the MIT hardware lab.&lt;br /&gt;
&lt;br /&gt;
When he published his findings, other people found out quite quickly that the validity check did nothing at all: The combination of decryption and hash with a cypher that feeds back the decrypted data into the key stream is a good idea, but unfortunately, RC4 is no such cypher. It decrypts bytes independently, so if one byte is wrong, all the following bytes will still be decrypted correctly. So checking the last four bytes has no effect: There is no hash. &lt;br /&gt;
&lt;br /&gt;
It turned out that the cypher used in the old version of the secret ROM as found in flash memory used the RC5 cypher. In contrast to RC4, RC5 does feed the decrypted stream back into the key stream. So they seem to have replaced RC5 with RC4 without understanding that RC4 cannot be used as a hash. Bunnie's theory why they abandoned RC5 is that RC5 was still a work in progress, and that Microsoft wasn't supposed to have it, so they went for the closest relative - RC4.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Modchips ====&lt;br /&gt;
&lt;br /&gt;
Now that the encryption key was known and there was effectively no hash over the second bootloader, it was possible to patch this code: People added code to the second bootloader to patch the kernel after decryption (and decompression) to accept executables even if on the wrong media (DVD-R instead of original) or if the RSA signature of the executables was broken (i.e. unsigned homebrew software).&lt;br /&gt;
&lt;br /&gt;
Modchips appeared: Some of them had a complete replacement flash memory chip on them, others only patches a few bytes and passed most reads down to the original flash chip. All these modchips had to be soldered in parallel to the original flash chip, using 31 wires.&lt;br /&gt;
&lt;br /&gt;
Now other people found out that, if the flash chip is completely missing, the Xbox wants to read from a (non-existant) ROM chip connected to the (serial) LPC bus. This is of course because of the manufacturing process: As it has been explained before, the flash chip gets programmed in-system, the first time they are turned on, using an external LPC ROM chip. Modchip makers soon developed chips that only needed 9 wires and connected to the LPC bus. It was enough to ground the data line D0 to make the Xbox think that flash memory is empty.&lt;br /&gt;
&lt;br /&gt;
Lots of these &amp;quot;cheapermods&amp;quot; appeared, as they only consisted of a single serial flash memory chip. They could be installed within minutes, especially after some companies started shipping chips that used pogo pins, so that no soldering was required.&lt;br /&gt;
&lt;br /&gt;
Some groups wrote applications like boot menus that made it possible to copy games to hard disk and run them from there. Patched Xbox kernels appeared that supported bigger hard disks. Making the Xbox run copies from DVD-R or hard disk as well as homebrew applications written with the official Xbox SDK was now easy.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Backdoors ====&lt;br /&gt;
&lt;br /&gt;
The Xbox Linux Project was working on two ways to start Linux: Either run the Linux kernel from a CD/DVD as if it was a game, or run it directly from flash memory, or from HD/DVD using a Linux bootloader in flash memory, so that the Xbox behaved like a PC. For the latter, Xbox Linux was working on a replacement firmware.&lt;br /&gt;
&lt;br /&gt;
It would have been no problem to write a replacement firmware that took over execution instead of the second bootloader, as it was possible to completely replace this second bootloader, as well as encrypt it, using the well-known key from the secret ROM. But the firmware developers felt very uncomfortable with the idea of using this secret key in their GPL code. Other hackers felt the same, and thus were looking for bugs and backdoors in the secret ROM code, in order to find a way to be able to implement a replacement firmware without having to deal with encryption.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===== The Visor Backdoor =====&lt;br /&gt;
&lt;br /&gt;
A hacker named visor, who never revealed his real name, wondered whether the rollover to 00000000 in case of an incorrect 2bl &amp;quot;hash&amp;quot; really caused a double fault and halted the CPU. He used the xcodes to write the assembly instruction for &amp;quot;jmp 0xFFFF0000&amp;quot; to the memory location 00000000 in RAM and changed the last four bytes in 2bl, in order to make the secret ROM run the panic code. The Xbox happily continued executing code at 00000000 and took the jump into flash.&lt;br /&gt;
&lt;br /&gt;
When appending these instructions to the existing xcodes, he could make sure that RAM had been properly initialized and was thus stable. So there was no need to encrypt the Xbox Linux bootloader firmware with the secret key any more. It was enough to add the memory write instruction to the end of the xcodes and make sure that 2bl decryption fails - which will automatically happen, if the firmware replacement does not contain the 2bl code.&lt;br /&gt;
&lt;br /&gt;
Now why is there no double fault? Hackers from the Xbox Linux team checked with AMD employees and they explained that AMD CPUs ''do'' throw an exception in case of EIP overflows, but Intel CPUs don't.&lt;br /&gt;
&lt;br /&gt;
The reason that Intel CPUs don't is because of... 1970s stuff. Execution on x86 CPUs starts at the top of the address space (minus 16 bytes), but some computer makers wanted to have their ROM at the bottom of the address space, i.e. at 0, so Intel implemented the instruction with the encoding 0xFFFF, which is what you get when reading from addresses not connected to any chip, as a No-Operation (&amp;quot;nop&amp;quot;) and made the CPU throw no exception in case of the address space wraparound. This way, the CPU would &amp;quot;nop&amp;quot; its way up to the top, and finally execute the code at 0.&lt;br /&gt;
&lt;br /&gt;
AMD did not implement this behavior, as it had not been necessary any more by the time AMD entered the x86 market with it own designs, and because they felt that this behavior was a security risk and fixing it would not mean a significant incompatibility.&lt;br /&gt;
&lt;br /&gt;
But why did Microsoft do it wrong? This can be explained with the history of the Xbox: AMD offered to design and manufacture both the CPU and the motherboard (including the chipset), and nVidia was contracted to contribute the graphics hardware. The first developer systems, even outside of Microsoft, were Athlon-based, but then Intel came in and offered their chips for less money, as well as the complementary redesign of the existing AMD chipset to work with their CPU. Consequently, nVidia licensed the AMD chipset so that the AMD name vanished. This also means, that nVidia nForce chipset is essentially AMD technology, closely related to the AMD-760 chipset.&lt;br /&gt;
&lt;br /&gt;
So when Microsoft switched from AMD to Intel, they apparently forgot to test their security code again with the new hardware, or to read the Intel datasheets.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===== The MIST Hack =====&lt;br /&gt;
&lt;br /&gt;
Soon after the visor hack, another vulnerability was found in the secret ROM code, attacking the code that checks whether an xcode wants to disable the secret ROM. Let us look at this code again:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;   cmp ebx, 80000880h        &amp;amp;nbsp;; ISA Bridge, MCPX disable?&lt;br /&gt;
   jnz short not_mcpx_disable&amp;amp;nbsp;; no&lt;br /&gt;
   and ecx, not 2            &amp;amp;nbsp;; clear  bit 1&lt;br /&gt;
not_mcpx_disable:&lt;br /&gt;
   mov eax, ebx&lt;br /&gt;
   mov dx, 0CF8h&lt;br /&gt;
   out dx, eax               &amp;amp;nbsp;; PCI configuration address&lt;br /&gt;
   add dl, 4&lt;br /&gt;
   mov eax, ecx&lt;br /&gt;
   out dx, eax               &amp;amp;nbsp;; PCI configuration data&lt;br /&gt;
   jmp short next_instruction&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
The PCI config address is stored in the EBX register in the beginning. This address has to be sent to I/O port 0x0CF8, and the 32 bit data has to be sent to I/O port 0x0CFC. The address is encoded like this:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;0-7    reg&lt;br /&gt;
8-10   func&lt;br /&gt;
11-15  device&lt;br /&gt;
16-23  bus&lt;br /&gt;
24-30  reserved&lt;br /&gt;
31     always 1&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
The attack is pretty obvoius: there are seven reserved bits in the address, and the code tests for a single exact value. What happens if we write to an alias of the same address, by using an address with only some of the bits 24 to 30 changed? While the instruction&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;POKEPCI(80000880h, 2)&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
will be caught, the instruction&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;POKEPCI(C0000880h, 2)&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
will not be caught - and works just as well, because the PCI bus controller just ignores the unused bits.&lt;br /&gt;
&lt;br /&gt;
This instruction disables the secret ROM, that is, the interpreter disables itself when sending the value to port 0x0CFC, and the CPU falls down to flash memory. We can put a &amp;quot;landing zone&amp;quot; into flash, by filling all of the top 512 bytes with &amp;quot;nop&amp;quot; instructions, and putting a jump to the beginning of flash into the last instruction, so that we do not have to care where exactly the CPU lands after falling down, and we are independent of possibly hard to reproduce caching effects.&lt;br /&gt;
&lt;br /&gt;
It is hard to find a good reason for this bug other than carelessness. It might be attributed to not reading the documentation closely enough, as well as not looking at it from the perspective of a hacker well enough. After all, this code had been written with a specific attack in mind - but the code made hacking easier, by giving hackers a hint how to attack.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===== Another PCI Config Space Attack =====&lt;br /&gt;
&lt;br /&gt;
There is a second sequence of xcode instructions that can disable the secret ROM just as well, which are not caught by the interpreter: The interpreter supports writing bytes to I/O ports, so it is possible to put together the code to disable the secret ROM using 8 bit I/O writes:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;OUTB(0xcf8), 0x80&lt;br /&gt;
OUTB(0xcf9), 0x08&lt;br /&gt;
OUTB(0xcfa), 0x00&lt;br /&gt;
OUTB(0xcfb), 0x80&lt;br /&gt;
OUTB(0xcfc), 0x02&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This hack has been unreleased until now. It has been found not long after the MIST hack, but kept secret, in case Microsoft fixed the MIST bug. In the meantime, they have implemented a fix that makes all hacks impossible that are based on turning off the secret ROM. This will be described in detail later.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===== More Ideas =====&lt;br /&gt;
&lt;br /&gt;
There have been more ideas, but few of them have been pursued, as long as other existing backdoor existed. One possible idea is to base a hack on caching...&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Startup Security, Take Two ==&lt;br /&gt;
&lt;br /&gt;
When bunnie hacked the secret ROM, Microsoft reacted by updating the ROM. Thousands of already manufactured Southbridges were trashed, new ones made. The hacker community called these Xboxes &amp;quot;version 1.1&amp;quot; machines.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Microsoft's Perspective ===&lt;br /&gt;
&lt;br /&gt;
Microsoft had now understood that RC4 cannot be used as a hash, so they implemented an additional hash algorithm, which was to be executed after decryption. As there were only few bytes left, the hash algorithm had to be tiny - so the &amp;quot;Tiny Encryption Algorithm&amp;quot; (&amp;quot;TEA&amp;quot;) was used. Every encryption algorithm can be changed to be used as a hash, and TEA seemed to be a good choice, as it is really small. While they were at it, they also changed the RC4 key in the secret ROM, so that hackers would not be able to decrypt 2bl and the kernel without dumping the new secret ROM.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== The Hacker Perspective ===&lt;br /&gt;
&lt;br /&gt;
The extraction of the secret ROM was done by members of the Xbox Linux Project this time, only days after they got their hands on the new 1.1 boxes, and only two weeks after they first appeared.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== The A20 Hack ====&lt;br /&gt;
&lt;br /&gt;
To date, Microsoft does not know how the Xbox Linux Project did it. But since there will most probably be no future revisions of the Xbox, as the Xbox 360 has already taken over, we can release this now.&lt;br /&gt;
&lt;br /&gt;
Let us start with some PC history. The 8086/8088, the first CPU in the x86 line, was supposed to be as closely compatible to the 8080, which was very successful on the CP/M market. The memory model therefore was similar to the 8080, which could access only 64 KB, by dividing memory into 64 KB blocks. Intel decided that the 8086/8088 could have a maximum of 1 MB of RAM, which would have meant 16 &amp;quot;segments&amp;quot; of 64 KB each. But instead of doing it this way, they decided to let the 64 KB segments overlap, and have 65536 of these segments, starting every 16 bytes.&lt;br /&gt;
&lt;br /&gt;
An address was therefore specified by a segment and an offset. The segment would be multiplied by 16, and the offset would be added, to result in the effective address. As an example, 0x0040:0x006C would be 0x40*0x10+0x6C=0x46C. An interesting side effect of this method is that it is possible to have addresses above 1 MB: The segment 0xFFFF starts at the effective address 0xFFFF0, so it should only contain 16 bytes instead of 64 KB. So the address 0xFFFF:0x0010 would be at 1 MB, and 0xFFFF:0xFFFF would be at 1 MB plus roughly 64 KB.&lt;br /&gt;
&lt;br /&gt;
The 8086/8088 could not address more than 1 MB, because it only had 20 address lines, so addresses above 0xFFFF:0x000F were wrapped around to the lower 64 KB. But this behavior was different on the 286, which had 24 address lines: It was actually possible to access roughly 64 KB more using this trick, which was later abused by MS-DOS as &amp;quot;high memory&amp;quot;.&lt;br /&gt;
&lt;br /&gt;
Unfortunately there were some 8086/8088 application that broke, because they required the wraparound for some reason. It wasn't Intel who found that out, but IBM, when they designed the IBM AT, and it was too late to modify the behavior of the 286, so they fixed it themselves, by introducing the A20 Gate (&amp;quot;A20#&amp;quot;). An unused I/O pin in the keyboard controller was attached to the 20th address line, so that software could pull down address line 20 to 0, thus emulating the 8086/8088 behaviour.&lt;br /&gt;
&lt;br /&gt;
This feature was later moved into the CPUs, and all Pentiums and Athlons have it - and so does the Xbox. If A20# is triggered, bit 20 of all addresses will be 0. So, for example, an address of 1 MB will be 0 MB, and if the CPU wants to access the top of RAM, it will actually access memory that is 1 MB lower than the top.&lt;br /&gt;
&lt;br /&gt;
Keeping this in mind, the attack on the Xbox is pretty straightforward: If we connect the CPU's A20# pin to GND, the Xbox will not start from FFFFFFF0, but from FFEFFFF0 - this is not covered by the secret ROM, but is ordinary flash memory, because flash is mirrored over the upper 16 MB. So by only connecting a single pin, the secret ROM is completely bypassed.&lt;br /&gt;
&lt;br /&gt;
What is cool about this, is that the secret ROM is still turned on. So we could easily dump the secret ROM trough one of the low speed busses (we used the I2C bus), by placing a small dump application into flash memory.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== The TEA Hash ====&lt;br /&gt;
&lt;br /&gt;
After reading Bruce Schneier's book on crypto, we learned that TEA was a really bad choice as a hash. The book says that TEA must never be used as a hash, because it is insecure if used this way. If you flip both bit 16 and 31 of a 32 bit word, the hash will be the same. We could easily patch a jump in the second bootloader so that it would not be recognized. This modified jump lead us directly into flash memory.&lt;br /&gt;
&lt;br /&gt;
But why did they make this mistake? Obviously the designers knew nothing about crypto - again! - and just added code without understanding it and without even reading the most basic books on the topic. A possible explanation why they chose TEA would be that they might have searched the internet for a &amp;quot;tiny&amp;quot; encryption algorithm - and got TEA.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Visor Backdoor and MIST Hack ====&lt;br /&gt;
&lt;br /&gt;
The Visor Backdoor was still present, so again, for the replacement Linux firmware, the Xbox Linux developers did not have to exploit the crypto code, but could simply use this backdoor. Microsoft obviously released the updated secret ROM much too quickly, just after bunnie dumped it and people saw that RC4 was no hash, but before the visor backdoor had been discovered.&lt;br /&gt;
&lt;br /&gt;
The MIST hack had been discovered after the visor bug - but it no longer worked on the Xbox 1.1. Not because they fixed the comparison - they didn't -, but because they changed the address logic: If you accessed the upper 512 bytes of the address space, and the secret ROM was turned off, the Xbox would just crash, thus making all &amp;quot;fall down&amp;quot; hacks impossible. This way they closed both possible attacks, writing to an alias, and using 5 OUTB instructions.&lt;br /&gt;
&lt;br /&gt;
Microsoft obviously discovered the turnoff vulnerability themselves, closing at least one backdoor, but keeping another one open, and not really closing a second one. It was too expensive to trash the 1.1 Southbridge chips again for yet another update, so Microsoft still uses these chips in today's Xboxes.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Today ===&lt;br /&gt;
&lt;br /&gt;
In later revisions of the Xbox, Microsoft removed some pins of the LPC bus, making modchip design harder, but they could not remove the LPC bus altogether, because they needed it during the manufacturing process.&lt;br /&gt;
&lt;br /&gt;
In the latest revision of the Xbox hardware (v1.6), they finally switched from flash memory to real ROM - and even integrated the ROM with the video encoder. The LPC bus is not needed for manufacturing any more, as the ROM chips are already preprogrammed. So now it is impossible to replace or to overwrite the kernel image, and because of the missing LPC bus, it also seems impossible to attach a ROM override.&lt;br /&gt;
&lt;br /&gt;
But modchips are still possible. The obvious LPC pins are gone now, but the bus is still there. If you find the LPC pins on the board, you can attach a ROM override just as before, the modchips are only a bit harder to install. This is because the Southbridge still has the LPC override functionality, since they did not make a new revision of it - as so often, obviously for monetary reasons.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Xbox Kernel Security ==&lt;br /&gt;
&lt;br /&gt;
Let us have a look at the chain of trust again:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* The CPU starts execution of code stored in the secret ROM.&lt;br /&gt;
* The secret ROM decrypts and verifies the second bootloader.&lt;br /&gt;
* The second bootloader decrypts and verifies the Windows kernel.&lt;br /&gt;
* The Windows kernel checks the allowed media bits and the RSA signature of the game.&lt;br /&gt;
&lt;br /&gt;
This last link is a complete software thing, so all the attacks have been pretty much standard. Some people tried to brute force the RSA key used for the game signature - no joke! But what is more likely, successfully brute forcing RSA 2048, or finding a bug in Microsoft's security code? After the experience with the first links of the chain of trust, the Xbox Linux Project focused on finding bugs in the software.&lt;br /&gt;
&lt;br /&gt;
We found no bug in the RSA implementation. It is taken straight out of Windows 2000 and looks pretty good. But there are always implicit additional links in the chain of trust: All code reads data, and data can cause security risks if handled incorrectly.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Game Exploits ===&lt;br /&gt;
&lt;br /&gt;
What data do games load? Graphics data, audio data, video data... - but we cannot alter them, because it is not easily possible to create authentic Xbox DVDs, and the Xbox won't boot originals from DVD-R etc.&lt;br /&gt;
&lt;br /&gt;
But most games can load savegames, and these can easily be changed: The Xbox memory units are more or less standard USB storage devices (&amp;quot;USB sticks&amp;quot;), so it is possible to use most USB sticks with the Xbox, and just store hacked savegames on them.&lt;br /&gt;
&lt;br /&gt;
Plenty of Xbox games had buffer vulnerabilities in their savegame handlers. It was often as easy as extending the length of strings like the name of the player, and the game would overwrite its stack with our data and eventually jump to the code we embedded in the savegame.&lt;br /&gt;
&lt;br /&gt;
The procedure for the user was then to simply copy a hacked savegame from a USB stick onto the Xbox hard disk, run the game and load the savegame. But after a buffer exploit, we would normally only be in user mode - not on the Xbox, as all Xbox games run in kernel mode. The reason for this is probably a slight speed advantage, or, less likely, a simpler environment for the game, but Microsoft tried to make the environment as similar to the Windows/DirectX environment as possible, so user mode would have actually made the environment &amp;quot;simpler&amp;quot; for many Windows/DirectX developers.&lt;br /&gt;
&lt;br /&gt;
Now that we have full control of the machine, we can overwrite the flash memory chip. It is write protected by default, but disabling the write protection is as easy as soldering a single bridge on the motherboard. After all, this bridge has to be closed temporarily during manufacturing when programming flash memory for the first time. Using this hack, it is possible, only with a USB stick, one of several games (007 Agent Under Fire, MechAssault, Splinter Cell, ...) and a soldering iron, to permanently modify the Xbox, just as if a modchip was installed. Because early Xboxes had a 1 MB flash chip, although only 256 KB had been used, it was even possible to install several ROM images in flash and attach a switch.&lt;br /&gt;
&lt;br /&gt;
But the Xbox Linux Project did not blindly release this hack. The first savegame proof of concept exploit had been finished in January 2003. After that, a lot of energy was invested in finding out a way to free the Xbox for homebrew development and Linux, but not allowing game copies. Microsoft was contacted, but without any success. They just ignored the problem.&lt;br /&gt;
&lt;br /&gt;
Finally in July, the hack was released, with heavy obfuscation, and lockout code for non-Linux use. It was obvious that this would only slow down the &amp;quot;hacking of the hack&amp;quot;, so eventually, people would be able to use this vulnerability for copied games, but since Microsoft showed no interest in finding a solution, there was no other option than full disclosure. The suggestion of the Xbox Linux Project would have been to work together with Microsoft to silently close the security holes and, in return, work on a method to let homebrew and Linux run on the Xbox.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Dashboard Exploits ===&lt;br /&gt;
&lt;br /&gt;
The problem with the savegame hack was that, if you didn't want to overwrite the flash memory chip, you had to insert the game and load the savegame every time you wanted to run unsigned code. But having full control of the machine using the savegame exploit also meant we could access the hard disk without opening the Xbox. This way, it became interesting to closely examine the hard disk contents for vulnerabilities.&lt;br /&gt;
&lt;br /&gt;
The Dashboard is the main program on hard disk, executed every time the Xbox is started without a game in the DVD drive. The dashboard may even be the very reason the Xbox ships with a hard disk: While the settings menu and savegame management on the Nintendo GameCube fit well into 2 MB of ROM, the Xbox Dashboard, which is roughly comparable in its functionality, occupies more than 100 MB. So the original idea why to include a hard disk might have been initiated by the inability to compress the Dashboard into typical ROM sizes - and they might have decided to make the best out of it, and find additional uses for the hard disk.&lt;br /&gt;
&lt;br /&gt;
The dashboard loads its data files, like audio and graphics, from hard disk. With the savegame exploit, we can now alter the hard disk contents, even without opening the Xbox. Of course the dashboard executable is signed and can therefore not be altered, and all data files are hashed, with the hashes stored inside the dashboard executable. Well, all files, except for two: the font files.&lt;br /&gt;
&lt;br /&gt;
Consequently, there was an integer vulnerability in the font handling routines, so that we could run our own code by replacing the font files. Combined with the savegame exploit, it was as easy as transferring the savegame and loading it, which would run a script that modifies the fonts.&lt;br /&gt;
&lt;br /&gt;
Now every time the Xbox is turned on, the Dashboard crashes because of the faulty fonts and runs our code embedded in these files. Our code reloads the Dashboard with the original fonts, hacks it, and runs it. Hacking the Dashboard meant two things: Modifying one menu entry to read &amp;quot;XBOX LINUX&amp;quot; instead of &amp;quot;XBOX LIVE&amp;quot; and running the Linux bootloader instead of the Xbox Live setup executable, and modifying the kernel to accept both applications signed with Microsoft's RSA key as well as those signed with our RSA key, from hard disk and from CD/DVD. We called this &amp;quot;MechInstaller&amp;quot;, as it was based on the &amp;quot;MechAssault&amp;quot; savegame exploit.&lt;br /&gt;
&lt;br /&gt;
Only accepting code either signed by the original key or by our key, keeping our key secret, and using heavy obfuscation again, meant that nobody could easily abuse this solution for copied games.&lt;br /&gt;
&lt;br /&gt;
This hack shows several things: Hackers have phantasy, the combination of flaws can lead to fully compromising the security system, powerful privileged code should be bug-free and security code should really catch ''all'' cases.&lt;br /&gt;
&lt;br /&gt;
Oh, and there is another vulnerability, an integer vulnerability in the audio player code. The attack was developed independently of the font attack, but was inferior because it would have required the user to enter the audio player every time to run Linux.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Microsoft's Fixes ====&lt;br /&gt;
&lt;br /&gt;
The history of Microsoft's reactions to the font vulnerability is the perfect lesson of how to do it wrong.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
# After MechInstaller had been released, Microsoft fixed the buffer vulnerability in the Dashboard and distributed this new version over the Xbox Live network and shipped it with new Xboxes.&lt;br /&gt;
# For the hackers, this was no major problem: It was possible to downgrade the Dashboard of a new Xbox to the vulnerable version. Just run Linux using a savegame exploit, and &amp;quot;dd&amp;quot; the old image. Some people felt downgrading on new Xboxes was not piracy, because after all, Microsoft upgraded Xbox Live users' hard disks to the new version without asking.&lt;br /&gt;
# As the next step, Microsoft blacklisted the old Dashboard in the new kernel. It was impossible to just &amp;quot;dd&amp;quot; an old Dashboard image onto newer Xboxes.&lt;br /&gt;
# Still no major problem for hackers: The second executable on the hard disk, &amp;quot;xonlinedash&amp;quot;, which is used for Xbox Live configuration, had the same bug, so it was possible to copy the old &amp;quot;xonlinedash&amp;quot; and to rename it to &amp;quot;xboxdash&amp;quot; to make it crash because of the faulty fonts.&lt;br /&gt;
# Microsoft consequently blacklisted the vulnerable version of &amp;quot;xonlinedash&amp;quot;.&lt;br /&gt;
# Again, no major problem for hackers: All Xbox Live games come with the &amp;quot;dashupdate&amp;quot; application, which adds Xbox Live functionality to the Dashboard for the first Xboxes which came without it. This update application has the same font bug, and it can be run from hard disk. So it is possible to copy the file from any Xbox Live game DVD, rename it to &amp;quot;xboxdash&amp;quot; and let it crash.&lt;br /&gt;
# Microsoft could not blacklist this one. Xbox Live enabled games run the update application every time they start, making sure the Xbox has the Xbox Live functionality. Blacklisting &amp;quot;dashupdate&amp;quot; would break these games.&lt;br /&gt;
&lt;br /&gt;
We won.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== The Mistakes that Have Been Made ==&lt;br /&gt;
&lt;br /&gt;
Microsoft obviously made a lot of mistakes. But it would be too easy to just attribute all these to stupid engineers. There have been good (and different) reasons for most of these mistakes, and one can learn a lot from them.&lt;br /&gt;
&lt;br /&gt;
There are 17 kinds of mistakes they made, several of which have been made more than once. I will group the 17 mistake types into three categories: Design mistakes, implementation mistakes and bad policy decisions.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Design ===&lt;br /&gt;
&lt;br /&gt;
==== #1: Security vs. Money ====&lt;br /&gt;
&lt;br /&gt;
Be very careful with tradeoffs between security and money. There are rarely sensible compromises. Keep in mind that the very reason for the security system is to make more money, or to prevent money losses. Security systems cannot be &amp;quot;a little better&amp;quot; or &amp;quot;a little worse&amp;quot;. Either they are effective - or they are not. By saving money on the security system, you may easily make it not effective at all, not only wasting the money spent on the security system, but also making losses because it is not effective.&lt;br /&gt;
&lt;br /&gt;
Microsoft made many compromises.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* In-system programming of flash memory is cheaper than preprogramming, but an attacker can also override the firmware with an LPC ROM.&lt;br /&gt;
* Buying all of Samsung's RAM chips is cheaper than only buying those within the specs, but it made RAM initialization more complex, using up space that could otherwise be used for better security code.&lt;br /&gt;
* They chose to put the secret ROM into the Southbridge instead of the CPU, because the Southbridge was a custom component anyway and having a custom CPU would have been a lot more expensive, but keys travel over a visible bus if the secret ROM is outside the CPU.&lt;br /&gt;
* They saved money choosing not to update the Southbridge a second time, which would have fixed the TEA hash and removed the visor backdoor. This would have made modchips virtually impossible.&lt;br /&gt;
&lt;br /&gt;
==== #2: Security vs. Speed ====&lt;br /&gt;
&lt;br /&gt;
Don't trade security for speed. Although it may be true that the product in question must be as fast as possible in order to be able to compete with similar products on the market, remember that in IT, computers aren't slower or faster by some percentage - but by factors! Besides, you might lose more money because of a security system that does not work than because of a product that is 10 percent slower than it could be.&lt;br /&gt;
&lt;br /&gt;
Most probably for added speed (one address space, no TLB misses), Microsoft chose to run all code in kernel mode, even games that interacted with untrusted data that came from the outside. This made it possible to have complete control of the machine once a game crashed because of a prepared savegame, including complete control of the hard disk and the possibility of booting another operating system.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== #3: Combinations of Weaknesses ====&lt;br /&gt;
&lt;br /&gt;
Be aware of the fact that a combination of security flaws can lead to a successful attack. Don't think that a possible security hole (or &amp;quot;only&amp;quot; a security risk) cannot be exploited because there are so many barriers in front of it. Attackers might break all the other barriers that block the vulnerability, and fixing that one hole would have stopped them.&lt;br /&gt;
&lt;br /&gt;
MechInstaller is a great example for that. It was only possible because of the combination of several security weaknesses:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* The boot process was vulnerable, so we could use a modified kernel to analyze games.&lt;br /&gt;
* Some games are not careful enough with savegames, so that we can run our own code.&lt;br /&gt;
* Games run in kernel mode, so we have full control of the hardware.&lt;br /&gt;
* The Dashboard does not verify the integrity of the font files.&lt;br /&gt;
* The Dashboard has a vulnerability in the font code.&lt;br /&gt;
&lt;br /&gt;
If any of these weaknesses had not been there, then MechInstaller would not have been possible. Also note that hackers have enough fantasy to find out these combinations.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== #4: Hackers' Resources ====&lt;br /&gt;
&lt;br /&gt;
Understand that hackers may have excellent resources. Hobbyists may use resources from work or from university, and professional attackers can also be very well-equipped. It is a big mistake to underestimate them. So never think you are safe because it would be too much work or too expensive to exploit a weakness. If it is a weakness, it will eventually be exploited. Also understand that hackers may have excellent human resources. Not only in number, but also in qualifications.&lt;br /&gt;
&lt;br /&gt;
Microsoft put the secret ROM into the Southbridge instead of the CPU, which meant that the secret key would travel over a visible bus. This is the very fast HyperTransport bus, which, at that time, could not be sniffed using logic analyzers any mortal could afford. But with help of the resources of the MIT and using all of his expertise, bunnie could build his own hardware that could sniff the bus.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== #5: Barriers and Obstacles ====&lt;br /&gt;
&lt;br /&gt;
Don't make anything &amp;quot;harder for hackers&amp;quot;. Instead make it &amp;quot;impossible for hackers&amp;quot;, or, if it cannot be made impossible, don't care about it. Because of the potential great number and excellent qualifications of hackers, no obstacle will have any effect or slow down hacking significantly. But instead, in security design, you might make mistake #3, because you think you are safe as there are so many obstacles in the hackers' way. Use the resources you would invest into building obstacles into building or strengthening barriers instead - possibly at a different location.&lt;br /&gt;
&lt;br /&gt;
Microsoft built obstacles into the system at many different locations. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* Savegames will only be accepted if they are signed, but the private key is of course stored inside the game, so this is no barrier. Instead, they should have made sure the games contain no buffer vulnerabilities in their savegame handlers.&lt;br /&gt;
* The hard disk is secured with an ATA password, different for every Xbox and stored on an EEPROM inside the Xbox, but an attacker can just &amp;quot;hotswap&amp;quot; an unlocked hard disk from a running Xbox to a running PC. Instead, they should have put that energy into verifying whether the Dashboard really hashes all data it reads from the hard disk.&lt;br /&gt;
* The 512 bytes of security startup code were embedded in a custom chip to make it hard to sniff. Instead, they should have made sure that there are no bugs in that security code.&lt;br /&gt;
&lt;br /&gt;
==== #6: Hacker Groups ====&lt;br /&gt;
&lt;br /&gt;
Don't use one security system for different purposes, or else attackers with very different goals will jointly attack it, being a lot more effective. Instead, try to find out who your enemies really are and what they want, and design your security system so that every group gets as much of what they want so that it does not hurt you.&lt;br /&gt;
&lt;br /&gt;
There were three possible goals for Xbox hackers: Run Linux and use it as a computer, run homebrew software like media players and emulators, and run copies. Although there were some overlaps between Linux and homebrew people, as well as between homebrew people and people interested in copies, these were essentially three very different groups. Because they were all locked out by the same protection, they worked together, either explicitly, or implicitly, by using the results of each other. No Linux hackers ever attacked the Playstation. When you are fair, people don't fight you.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== #7: Security by Obscurity ====&lt;br /&gt;
&lt;br /&gt;
Security by obscurity does not work. Well-proven algorithms like SHA-1 and RSA work (of course given your implementation is well-proven as well).&lt;br /&gt;
&lt;br /&gt;
Microsoft hid the secret ROM, the Windows kernel, the game DVD contents (no way to read them on a standard DVD drive) and the hard disk contents using different methods. None had any effect. Also see #5.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== #8: Fixes ====&lt;br /&gt;
&lt;br /&gt;
When your security system has been broken, don't release quick fixes, for two reasons: Your fixes may be flawed and may not actually correct the problem, and even worse holes may be found not much later, which you must fix again - and ship yet another version. Instead, every time a security vulnerability is found, audit your complete security system and search for similar bugs, as well as other bugs in the same part of the system, based on the knowledge you gained from the successful hack.&lt;br /&gt;
&lt;br /&gt;
Microsoft failed to correct the hash problem in the second version of the secret ROM, and didn't fix the visor vulnerability, which was found just weeks later. After trashing thousands of already manufactured v1.0 Southbridge chips, which was very expensive, they decided not to update the Southbridge a second time. Another example is the dashboard odyssey: Instead of blacklisting the vulnerable executables at a time, they released three updates, none of which was effective.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Implementation ===&lt;br /&gt;
&lt;br /&gt;
==== #9: Data Sheets ====&lt;br /&gt;
&lt;br /&gt;
Know everything about the components you use. Do read data sheets. Be very careful with components that have legacy functionality.&lt;br /&gt;
&lt;br /&gt;
Microsoft did not notice the A20# legacy functionality as a security risk. It seems that they did not completely analyze the functionality of the Pentium III Celeron, or else they should have noticed. They also apparently did not read the Pentium programmers' manual, or else they would have noticed that Intel CPUs do not panic on a FFFFFFFF/00000000 wraparound.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== #10: Literature ====&lt;br /&gt;
&lt;br /&gt;
Read (at least!) standard literature. If you are dealing with cryptography, this means you have to read at last Schneier's &amp;quot;Applied Cryptography&amp;quot;.&lt;br /&gt;
&lt;br /&gt;
Microsoft's engineers did not know that TEA must not be used as a hash, and that RC4 does not feed the decrypted stream back into the key stream.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== #11: Pros ====&lt;br /&gt;
&lt;br /&gt;
Get experienced professionals to work on your security system, both on the design and the implementation. If it's a money issue, see #1.&lt;br /&gt;
&lt;br /&gt;
Looking at mistakes #9 and #10, it seems very probable that at least some of Microsoft's engineers had no prior experience with cryptography or the design of a security system. We also know that people on an internship were working on Xbox security.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== #12: Completeness ====&lt;br /&gt;
&lt;br /&gt;
Check whether your security code catches all cases. If it does not, you did not only waste time implementing all of it, but you may also give hints to hackers: If there are many checks at one point of the code, it looks a lot like code that is relevant for security and an attacker can check whether all cases are caught.&lt;br /&gt;
&lt;br /&gt;
Microsoft made this mistake twice: The xcode interpreter tests for the secret ROM turnoff code, and doesn't catch all cases. And the Dashboard hashes all files it is going to read, except for two. This gave us the ideas where to attack.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== #13: Leftovers ====&lt;br /&gt;
&lt;br /&gt;
Look at the final product from the perspective of a hacker. Hexdump and disassemble your final builds. There could be leftovers!&lt;br /&gt;
&lt;br /&gt;
The Xbox flash memory image contained an old version of the secret ROM, giving us not only hints about the contents of the actual secret ROM, but also an insight into what Microsoft planned and why some mistakes have been made.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== #14: Final Test ====&lt;br /&gt;
&lt;br /&gt;
Test your security system when you have the final parts and with the final software components in place. Changing something may very well open holes somewhere else. When you change something, rethink the complete system, and check all assumptions that you made.&lt;br /&gt;
&lt;br /&gt;
The visor hack was only possible because Microsoft failed to adapt their security system, designed for the AMD CPU, to the Intel CPU. The &amp;quot;hash&amp;quot; in the secret ROM had no effect because they changed RC5 to RC4 without thinking about the implications.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Policies ===&lt;br /&gt;
&lt;br /&gt;
==== #15: Source ====&lt;br /&gt;
&lt;br /&gt;
Keep your source safe. Find engineers you can trust.&lt;br /&gt;
&lt;br /&gt;
The complete Xbox source code has leaked, including the kernel and libraries source. Groups interested in copies could easily modify it to support running games from hard disk, support for hard disks bigger than 137 GB, custom boot logos etc. This had been previously done by patching the binary.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== #16: Many People ====&lt;br /&gt;
&lt;br /&gt;
Have many good people have a look at both your design and your implementation. Keeping your source code safe means having engineers you can trust, and not letting none of your engineers see the source code. As stated at #7, your system should not rely on the source code being safe. Unless you did #7 completely wrong, a bug in the security system is typically a lot worse than a leak of the source code.&lt;br /&gt;
&lt;br /&gt;
It seems a lot like very few people have actually seen the Xbox security code.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== #17: Talk ====&lt;br /&gt;
&lt;br /&gt;
Know your enemy - and talk to them. They are not terrorists that you are not supposed to negotiate with. Their intent is not to harm you but to reach their goals. Working on their goals on their own might harm you indirectly, because the hackers may not care about the same things as you do. Seek the contact to hackers, know what they are doing and have them inform you about a vulnerability before publishing it. Make them know your position and why they should respect it, but also respect their position. Offer them to loosen the security system for what they want in exchange for the non-disclosure of their findings.&lt;br /&gt;
&lt;br /&gt;
Microsoft refused to talk about the savegame and font vulnerabilities. If we had been bad hackers, we could have released both of them as-is, immediately making it possible to run copies on Xboxes without the use of a modchip. Instead, we sought contact to Microsoft: We would have preferred to see a backdoor for Linux in the Xbox security system, instead of a solution based on our findings that would allow running copies. But as they refused to talk, we were forced to release the exploits, and they were lucky we heavily obfuscated our solutions so in order to slow down people interested in using it for copies.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Conclusion ==&lt;br /&gt;
&lt;br /&gt;
The security system of the Xbox has been a complete failure.&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Xbox_Hard_Drive_Locking_Mechanism&amp;diff=5599</id>
		<title>Xbox Hard Drive Locking Mechanism</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Xbox_Hard_Drive_Locking_Mechanism&amp;diff=5599"/>
				<updated>2017-05-31T08:54:23Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: Created page with &amp;quot;Retrieved from [https://web.archive.org/web/20100617023052/http://www.xbox-linux.org/wiki/Xbox_Hard_Drive_Locking_Mechanism]    by ''SpeedBump'' (original version: 13 August 2...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Retrieved from [https://web.archive.org/web/20100617023052/http://www.xbox-linux.org/wiki/Xbox_Hard_Drive_Locking_Mechanism]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
by ''SpeedBump'' (original version: 13 August 2002)&lt;br /&gt;
&lt;br /&gt;
The hard drive in the MS Xbox(tm) is a standard ide drive, which implements a rarely used security feature to restrict access to its data. This document will describe in full the security features, and the algorithms required to access the data on an xbox drive.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==The IDE (ATA) commands==&lt;br /&gt;
&lt;br /&gt;
The ATA spec defines a feature subset which allows for the user to limit access to the drive's data behind a hardware implemented locking mechanism. There are several commands in the SECURITY feature subset, but the command of most interest is the SECURITY_UNLOCK command.&lt;br /&gt;
&lt;br /&gt;
SECURITY_UNLOCK requires that the user provide one of two 32 byte passwords, either a user or master password. The Xbox uses the user password. Details on the data formats and timings for the data to be sent to the ide drive can be found in the ata specs (see [[https://web.archive.org/web/20100617023052/http://www.t13.org/]]).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==The password==&lt;br /&gt;
&lt;br /&gt;
The drive password is generated in two distinct phases. The first phase extracts a key (referred to as the HDKey) from the eeprom data on the Xbox. The HDKey is unique to each Xbox making this first phase dependant only on the Xbox eeprom of the unit. The second phase uses this HDKey to generate a password which is specific to the drive being unlocked (keyed to the model and serial numbers of the drive).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Drive Data==&lt;br /&gt;
&lt;br /&gt;
During the second phase, the serial and model numbers are needed. These values are available in the response data from the DEVICE_IDENTITY ata command. However, the data needs to be properly reorganized. It is read in big endian words, and needs to be byte swapped first to get the byte ordering correct. Then, starting from the end of the data (serial == 20 bytes, model == 40 bytes) ignore ASCII spaces (byte value of 0x20) at the end of the data. Zeros are *not* trimmed, *only* spaces. Do not be fooled into believing that this data is a string. On some drives this is the case, but on others there are non-ascii values in the fields.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Basic Security algorithms==&lt;br /&gt;
&lt;br /&gt;
There are two primary crytography routines needed when generating an XBox drive password, SHA1 and RC4.&lt;br /&gt;
&lt;br /&gt;
SHA1 is a hashing algorithm. It's primary purpose is to take an input message and create a (relatively) small signature (called a digest) which is unique to the original message. One of the goals of SHA1 is to make it difficult to alter the input message in such a way as to result in the same output digest.&lt;br /&gt;
&lt;br /&gt;
RC4 is a symmetric cipher. This means that the algorithm for encryption is the same as that for decryption. The purpose is to make one key work in both directions.&lt;br /&gt;
&lt;br /&gt;
There is an algorithm called HMAC which uses a hashing algorithm (in this case SHA1) to generate a cryptographically &amp;quot;strong&amp;quot; signature. I'm sure there is a mathematical basis for this, but I'm not willing to try to understand it&amp;amp;nbsp;:)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==The Password Algorithm==&lt;br /&gt;
&lt;br /&gt;
(some syntax notes, key data is shown entering functions from the side, data is shown entring from above or below, in order of presentation from left to right)&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;                                       RC4_key &amp;amp;gt;--(second)--&amp;amp;gt;--,&lt;br /&gt;
                                         /|\                   |&lt;br /&gt;
                                          |                    |&lt;br /&gt;
 .-&amp;amp;lt;--|__eeprom_key__|--&amp;amp;gt;-----------&amp;amp;gt; HMAC_SHA1                |&lt;br /&gt;
 |                                       /|\                   |&lt;br /&gt;
 |                                        |                    |&lt;br /&gt;
 |                        .---&amp;amp;gt;-----------'                    |&lt;br /&gt;
 |                        |                                    |&lt;br /&gt;
 |  eeprom_data = |__data_hash___|__enc_conf__|__enc_data__|   |&lt;br /&gt;
 |                        |             |           |          |&lt;br /&gt;
 |                        |            \|/          |          |&lt;br /&gt;
 |                        |        rc4_decrypt &amp;amp;lt;----|---------&amp;amp;lt;|&lt;br /&gt;
 |                        |             |           |          |&lt;br /&gt;
 |                       \|/            |           |          |&lt;br /&gt;
 |                 (must be equal)      |          \|/         |&lt;br /&gt;
 |                       /|\            |      rc4_decrypt &amp;amp;lt;---'&lt;br /&gt;
 |                        |             |           |&lt;br /&gt;
 |                        |            \|/         \|/&lt;br /&gt;
 |                        |      |_confounder_|____data____|&lt;br /&gt;
 |                        |       /            /    |&lt;br /&gt;
 |                        |      /            /     |&lt;br /&gt;
 |                        |     /            /      |&lt;br /&gt;
 |                        |    /            /       |&lt;br /&gt;
 |                        |   \|/          /       \|/&lt;br /&gt;
 `---&amp;amp;gt;-----------------&amp;amp;gt; HMAC_SHA1        /   |__HDKey__|__|&lt;br /&gt;
                                /|\      /         |&lt;br /&gt;
                                 \______/          |&lt;br /&gt;
                                                   |&lt;br /&gt;
               .-------------------------&amp;amp;lt;--------'&lt;br /&gt;
               |&lt;br /&gt;
               |              model_number   serial_number&lt;br /&gt;
               |                      \        /&lt;br /&gt;
               |                       \      /&lt;br /&gt;
               `---&amp;amp;gt;-----------------&amp;amp;gt; HMAC_SHA1&lt;br /&gt;
                                           |&lt;br /&gt;
                                          \|/&lt;br /&gt;
                                      HD_password&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&amp;lt;br /&amp;gt;&lt;br /&gt;
This seems to be the easiest way to show the required calculations.&lt;br /&gt;
&lt;br /&gt;
Basically there are several intermediate steps. First, generate the RC4_key from the eeprom_key and the data_hash (first 20 bytes of eeprom_data). Use the RC4_key to decrypt the encrypted confounder (8 bytes 20 bytes into eeprom_data) and the encrypted data (20 bytes 28 bytes into eeprom_data). Now generate an HMAC_SHA1 hash from the eeprom_key and the decrypted confounder and data. Verify that this hash matches the data_hash stored in the eeprom. If they don't match then the eeprom data is not correct. If the hashes match then the first 16 bytes of the decrypted data field is the HDKey.&lt;br /&gt;
&lt;br /&gt;
Once you have the HDKey get the model number and serial number from the ide drive. Generate an HMAC_SHA1 hash from the HDKey, model and serial numbers. The resulting 20 bytes are the HD password. The remaining 12 bytes needed for the password are zeros.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Remaining Questions==&lt;br /&gt;
&lt;br /&gt;
The algorithm is well known, however it is dependant on the eeprom_key. It would be ideal if this key could be compiled into a driver to perform the generation and the unlocking. However noone appears to be able to answer the question of legality. Is it legal to privide the eeprom key? Either way, the drive can be unlocked. The ability to distribute the key will only help people use the drive outside the xbox (plus make it simpler to unlock the drive in the xbox).&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=5598</id>
		<title>Main Page</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=5598"/>
				<updated>2017-05-31T08:52:25Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: /* Emulation */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{:Main Page/Header}}&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
* [[Chihiro]]&lt;br /&gt;
* [[Xbox]]&lt;br /&gt;
&lt;br /&gt;
* [[Hardware Revisions]]&lt;br /&gt;
* [[Motherboard]]&lt;br /&gt;
* [[CPU|CPU (Custom Pentium 3 733 MHz)]]&lt;br /&gt;
* [[NV2A]]&lt;br /&gt;
** [[NV2A/Vertex attributes]]&lt;br /&gt;
** [[NV2A/Fixed Function Pipeline]]&lt;br /&gt;
** [[NV2A/Vertex Shader]]&lt;br /&gt;
** [[NV2A/Pixel Combiner]]&lt;br /&gt;
** [[NV2A/Surface Formats]]&lt;br /&gt;
* [[DSP]]&lt;br /&gt;
* [[Memory]]&lt;br /&gt;
* [[Flash]]&lt;br /&gt;
* [[MCPX]]&lt;br /&gt;
* [[EEPROM]]&lt;br /&gt;
* [[SMC]]&lt;br /&gt;
* [[Video Encoder]]&lt;br /&gt;
* [[NVNet|Network Controller (NVNet)]]&lt;br /&gt;
* [[DVD Drive]]&lt;br /&gt;
** [[Xbox Game Disc]]&lt;br /&gt;
* [[Hard Drive]]&lt;br /&gt;
* [[USB]]&lt;br /&gt;
** [[Xbox Input Devices]]&lt;br /&gt;
* [[Power Supply]]&lt;br /&gt;
&lt;br /&gt;
== System Software ==&lt;br /&gt;
* [[MCPX ROM]]&lt;br /&gt;
* [[BIOS]] / [[Kernel]]&lt;br /&gt;
** [[Boot Process]]&lt;br /&gt;
** [[XBE]] (Executable file format)&lt;br /&gt;
* [[FATX]] (Filesystem)&lt;br /&gt;
* [[Dashboard]]&lt;br /&gt;
* [[Exploits]]&lt;br /&gt;
&lt;br /&gt;
== Development Kits and Tools ==&lt;br /&gt;
* [https://github.com/xqemu/nxdk nxdk (New Xbox Development Kit)]&lt;br /&gt;
* [[OpenXDK]]&lt;br /&gt;
* [[Microsoft XDK]]&lt;br /&gt;
** [[Xbox Debug Monitor]]&lt;br /&gt;
** [[Xbox Neighborhood]]&lt;br /&gt;
&lt;br /&gt;
== Games ==&lt;br /&gt;
* [[:Category:Games|Games]]&lt;br /&gt;
* [[Engine List]]&lt;br /&gt;
&lt;br /&gt;
== Emulation ==&lt;br /&gt;
* [[Emulators]]&lt;br /&gt;
** [[XQEMU]]&lt;br /&gt;
&lt;br /&gt;
== Other ==&lt;br /&gt;
* [[Network]]&lt;br /&gt;
* Find random stuff in [[Resources]]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=5592</id>
		<title>Main Page</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=5592"/>
				<updated>2017-05-31T08:48:23Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: /* Development Kits and Tools */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{:Main Page/Header}}&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
* [[Chihiro]]&lt;br /&gt;
* [[Xbox]]&lt;br /&gt;
&lt;br /&gt;
* [[Hardware Revisions]]&lt;br /&gt;
* [[Motherboard]]&lt;br /&gt;
* [[CPU|CPU (Custom Pentium 3 733 MHz)]]&lt;br /&gt;
* [[NV2A]]&lt;br /&gt;
** [[NV2A/Vertex attributes]]&lt;br /&gt;
** [[NV2A/Fixed Function Pipeline]]&lt;br /&gt;
** [[NV2A/Vertex Shader]]&lt;br /&gt;
** [[NV2A/Pixel Combiner]]&lt;br /&gt;
** [[NV2A/Surface Formats]]&lt;br /&gt;
* [[DSP]]&lt;br /&gt;
* [[Memory]]&lt;br /&gt;
* [[Flash]]&lt;br /&gt;
* [[MCPX]]&lt;br /&gt;
* [[EEPROM]]&lt;br /&gt;
* [[SMC]]&lt;br /&gt;
* [[Video Encoder]]&lt;br /&gt;
* [[NVNet|Network Controller (NVNet)]]&lt;br /&gt;
* [[DVD Drive]]&lt;br /&gt;
** [[Xbox Game Disc]]&lt;br /&gt;
* [[Hard Drive]]&lt;br /&gt;
* [[USB]]&lt;br /&gt;
** [[Xbox Input Devices]]&lt;br /&gt;
* [[Power Supply]]&lt;br /&gt;
&lt;br /&gt;
== System Software ==&lt;br /&gt;
* [[MCPX ROM]]&lt;br /&gt;
* [[BIOS]] / [[Kernel]]&lt;br /&gt;
** [[Boot Process]]&lt;br /&gt;
** [[XBE]] (Executable file format)&lt;br /&gt;
* [[FATX]] (Filesystem)&lt;br /&gt;
* [[Dashboard]]&lt;br /&gt;
* [[Exploits]]&lt;br /&gt;
&lt;br /&gt;
== Development Kits and Tools ==&lt;br /&gt;
* [https://github.com/xqemu/nxdk nxdk (New Xbox Development Kit)]&lt;br /&gt;
* [[OpenXDK]]&lt;br /&gt;
* [[Microsoft XDK]]&lt;br /&gt;
** [[Xbox Debug Monitor]]&lt;br /&gt;
** [[Xbox Neighborhood]]&lt;br /&gt;
&lt;br /&gt;
== Games ==&lt;br /&gt;
* [[:Category:Games|Games]]&lt;br /&gt;
* [[Engine List]]&lt;br /&gt;
&lt;br /&gt;
== Emulation ==&lt;br /&gt;
* [[Emulators]]&lt;br /&gt;
&lt;br /&gt;
== Other ==&lt;br /&gt;
* [[Network]]&lt;br /&gt;
* Find random stuff in [[Resources]]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Xbox_Manufacturing_Process&amp;diff=5580</id>
		<title>Xbox Manufacturing Process</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Xbox_Manufacturing_Process&amp;diff=5580"/>
				<updated>2017-05-31T08:35:31Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: Created page with &amp;quot;Retrieved from [https://web.archive.org/web/20100617013616/http://www.xbox-linux.org/wiki/Xbox_Manufacturing_Process]    by ''Michael Steil''  There are many different Xboxes....&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Retrieved from [https://web.archive.org/web/20100617013616/http://www.xbox-linux.org/wiki/Xbox_Manufacturing_Process]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
by ''Michael Steil''&lt;br /&gt;
&lt;br /&gt;
There are many different Xboxes. Although they all look the same (except for the &amp;quot;Special Edition&amp;quot;), and all of them work with all games, they have been produced in three different factories and may contain different components.&lt;br /&gt;
&lt;br /&gt;
This article describes the &amp;quot;reverse-engineered&amp;quot; internals of Xbox manufacturing.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==The Serial Number==&lt;br /&gt;
&lt;br /&gt;
Every Xbox has a sticker on the bottom that looks like this:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;img src=&amp;quot;https://web.archive.org/web/20100617013616im_/http://www.xbox-linux.org/pic/serial-sticker.jpg&amp;quot; alt=&amp;quot;serial-sticker.jpg&amp;quot; /&amp;gt;&lt;br /&gt;
&lt;br /&gt;
It contains the manufacturing date and the 12-digit serial number:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;1166356 20903&lt;br /&gt;
||    | |||||__&lt;br /&gt;
||    | ||||___ factory number&lt;br /&gt;
||    | |||____&lt;br /&gt;
||    | ||_____ week of year (starting Mondays)&lt;br /&gt;
||    | |______ last digit of year&lt;br /&gt;
||    |________&lt;br /&gt;
||_____________ number of Xbox within week and factory&lt;br /&gt;
|______________ production line within factory &lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&amp;lt;br /&amp;gt;&lt;br /&gt;
Three factories have produced the Xbox. Mexico (Guadalajara) is &amp;quot;02&amp;quot;, Hungary (S�rv�r) is &amp;quot;03&amp;quot; and China (Doumen) is &amp;quot;05&amp;quot;.&lt;br /&gt;
&lt;br /&gt;
So this Xbox has been manufactured in week #9, 2002 in line 1 of the factory in Hungary, and it was number 166,356 of this week.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Factories==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|  '''Date'''&lt;br /&gt;
|  '''Mexico'''&lt;br /&gt;
|  '''Hungary'''&lt;br /&gt;
|  '''China'''&lt;br /&gt;
|-&lt;br /&gt;
|  10/2001&lt;br /&gt;
|  Production of 110V 1.0 Xboxes with Thomson drives is started for the USA/Canada market.&lt;br /&gt;
|  Production of 110V 1.0 Xboxes with Thomson drives is started for the USA/Canada market.&lt;br /&gt;
|-&lt;br /&gt;
|  01/2002&lt;br /&gt;
|  Production gets extended for Japan.&lt;br /&gt;
|  Complete switch to 220V European/Australian models.&lt;br /&gt;
|-&lt;br /&gt;
|  04/2002&lt;br /&gt;
|  Production lines #1 and #6 get closed and get moved to China. The other four lines continue production. The first Xboxes with Philips DVD drives are made, now 50% of all Mexican devices have Philips, and 50% have Thomson.&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
|  05/2002&lt;br /&gt;
| &lt;br /&gt;
|  Production stops after only less than 9 months, and after about 3 Million Xboxes. All four production lines get moved to China.&lt;br /&gt;
|-&lt;br /&gt;
|  08/2002&lt;br /&gt;
| &lt;br /&gt;
| &lt;br /&gt;
|  Production of the 220V 1.1 Xbox for Europe and Australia only begins, with mostly Philips and sometimes Thomson DVD drives.&lt;br /&gt;
|-&lt;br /&gt;
|  09/2002&lt;br /&gt;
| &lt;br /&gt;
| &lt;br /&gt;
|  First Samsung DVD drives. Most Xboxes now contain Samsung devices, a few contain Philips ones, and very few still contain Thomson ones.&lt;br /&gt;
|-&lt;br /&gt;
|  10/2002&lt;br /&gt;
|  Switch the remaining four lines to version 1.1.&lt;br /&gt;
| &lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
|  11/2002&lt;br /&gt;
| &lt;br /&gt;
| &lt;br /&gt;
|  Production gets extended by 110V USA/Canada/Japan models.&lt;br /&gt;
|-&lt;br /&gt;
|  12/2002&lt;br /&gt;
|  Production ends after 14 months, and after nearly 7 Million Xboxes.&lt;br /&gt;
| &lt;br /&gt;
|  First line changes to version 1.2&lt;br /&gt;
|-&lt;br /&gt;
|  02/2003&lt;br /&gt;
| &lt;br /&gt;
| &lt;br /&gt;
|  Last line changes to version 1.2&lt;br /&gt;
|-&lt;br /&gt;
|  03/2003&lt;br /&gt;
| &lt;br /&gt;
| &lt;br /&gt;
|  First line changes to version 1.3&lt;br /&gt;
|-&lt;br /&gt;
|  04/2003&lt;br /&gt;
| &lt;br /&gt;
| &lt;br /&gt;
|  Last line changes to version 1.3&lt;br /&gt;
|-&lt;br /&gt;
|  07/2003&lt;br /&gt;
| &lt;br /&gt;
| &lt;br /&gt;
|  First line changes to version 1.4&lt;br /&gt;
|-&lt;br /&gt;
|  08/2003&lt;br /&gt;
| &lt;br /&gt;
| &lt;br /&gt;
|  First line changes to version 1.5&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Look at the &amp;lt;a href=&amp;quot;/web/20100617013616/http://www.xbox-linux.org/wiki/Xbox_Versions_HOWTO&amp;quot; title=&amp;quot;Xbox Versions HOWTO&amp;quot;&amp;gt;Xbox Versions HOWTO&amp;lt;/a&amp;gt; for details on when which Chinese line switched to a new version.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Manufacturing Process==&lt;br /&gt;
&lt;br /&gt;
(Please note that a lot of this information has been concluded from implicit information, it may contain errors.)&lt;br /&gt;
&lt;br /&gt;
When a computer such as the Xbox is manufactured, three very different tasks have to be done:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* assemble the hardware&lt;br /&gt;
* copy the software on the hardware&lt;br /&gt;
* test the device&lt;br /&gt;
&lt;br /&gt;
The most interesting part about this is when the software is copied, and when and how the device is tested, because there is a lot of room for optimization.&lt;br /&gt;
&lt;br /&gt;
Not counting the firmware of independent components such as the HD, the DVD and the SMC, the Xbox contains three pieces of software:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* The Xbox kernel in Flash ROM&lt;br /&gt;
* The hard disk contents (and hard disk key)&lt;br /&gt;
* The EEPROM contents&lt;br /&gt;
&lt;br /&gt;
It depends on the device whether it is more convenient to program it before putting it into the Xbox or doing in-system-programming.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===Putting the System together===&lt;br /&gt;
&lt;br /&gt;
The Flash ROM chips gets programmed externally with the final Xbox kernel and then gets soldered onto the Xbox motherboard. The EEPROM is empty when it gets soldered onto it. So is the hard disk when it gets connected.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===The Installation CD===&lt;br /&gt;
&lt;br /&gt;
So when the Xbox is complete, but the EEPROM and the hard disk are still empty and the hard disk is not locked yet, an optical media gets inserted into the DVD drive (this needn't be an Xbox DVD), which contains a properly retail-signed default.xbe built with the XDK that has the allow eject flag set and has the region code set to 0x80000000 (&amp;quot;DEBUG&amp;quot;).&lt;br /&gt;
&lt;br /&gt;
When the Xbox kernel initializes, it checksums the EEPROM. If it fails, the Xbox will be in DEBUG mode, i.e. the region code is set to 0x80000000. With the region code set to this value, the kernel ignores it if the hard disk is not locked. Because the region code matches, the kernel will run the executable from CD, which does the following:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* format the three swap partitions&lt;br /&gt;
* copy XMTAXBOX.XBE from CD to the first cache partition and run it&lt;br /&gt;
&lt;br /&gt;
Then the DVD can be ejected and put into the next Xbox.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===XMTAXBOX.XBE===&lt;br /&gt;
&lt;br /&gt;
This XMTAXBOX.XBE is an XBE retail-signed for hard disk, also with the region code set to 0x80000000, that does the following:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* retrieve the EEPROM contents from a network server&lt;br /&gt;
* retrieve the contents of the system and data partitions from a network server&lt;br /&gt;
* lock the hard disk&lt;br /&gt;
* make some self tests and send the report to the server&lt;br /&gt;
&lt;br /&gt;
A new Xbox still contains the file XMTAXBOX.XBE on the first cache partition, as well as some temporary files on the third one.&lt;br /&gt;
&lt;br /&gt;
Xbox kernels since version 4034 have another backdoor that even works if the EEPROM check succeeds: If bit 30 of the media flag of an XBE is set, the condition of the hard disk is ignored as well. This change allows Microsoft to replace broken hard disks without replacing a valid EEPROM on an Xbox sent in for repair. Before this change, they had to rewrite the EEPROM whenever they replaced the drive.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;img src=&amp;quot;https://web.archive.org/web/20100617013616im_/http://www.xbox-linux.org/pic/repairdvd.jpg&amp;quot; alt=&amp;quot;repairdvd.jpg&amp;quot; /&amp;gt;&lt;br /&gt;
&amp;lt;img src=&amp;quot;https://web.archive.org/web/20100617013616im_/http://www.xbox-linux.org/pic/xboxqc.jpg&amp;quot; alt=&amp;quot;xboxqc.jpg&amp;quot; /&amp;gt; [https://web.archive.org/web/20100617013616/http://www.amcham.hu/BusinessHungary/16-01/articles/16-01_26.asp]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Further Reading ==&lt;br /&gt;
&lt;br /&gt;
* [https://web.archive.org/web/20100617013616/http://www.xbox-linux.org/wiki/Xbox_Manufacturing_Process_Pictures Xbox Manufacturing Process Pictures]&lt;br /&gt;
* [https://web.archive.org/web/20100617013616/http://www.ifm.eng.cam.ac.uk/ctm/idm/cases/xbox.html] Innovation and Design Management case study&lt;br /&gt;
* O'Brien, J. [https://web.archive.org/web/20100617013616/http://www.wired.com/wired/archive/9.11/flex_pr.html The making of the Xbox], Wired, Issue 9.11, November 2001&lt;br /&gt;
* Shah, J. and Serant, C. [https://web.archive.org/web/20100617013616/http://www.ebnonline.com/story/OEG20020311S0076 Microsoft's Xbox sets supply chain standard], EBN Online, 11 March 2002&lt;br /&gt;
* Olavsrud, T. [https://web.archive.org/web/20100617013616/http://www.internetnews.com/bus-news/article.php/1129171 Flextronics relocates Xbox manufacturing facility], Internetnews.com, 15 May 2002&lt;br /&gt;
* Penz, B. [https://web.archive.org/web/20100617013616/http://www.amcham.hu/BusinessHungary/16-06/articles/16-06_27.asp Game Over? Xbox production heads east], Business Hungary, Vol 16 No 6, June 2002&lt;br /&gt;
* Carbone, J. [https://web.archive.org/web/20100617013616/http://manufacturing.net/pur/article/CA237778?stt=001&amp;amp;amp;pubdate=08%2F15%2F02 Outsourcing the Xbox], Purchasing Magazine Online, 15 August 2002&lt;br /&gt;
* Neilley, R: [https://web.archive.org/web/20100617013616/http://www.immnet.com/articles?article=1763 Molding is big man on this campus]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Xbox_Savegame_System&amp;diff=5578</id>
		<title>Xbox Savegame System</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Xbox_Savegame_System&amp;diff=5578"/>
				<updated>2017-05-31T08:26:55Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: Created page with &amp;quot;Retrieved from [https://web.archive.org/web/20100617021545/http://www.xbox-linux.org/wiki/Xbox_Savegame_System]    The Xbox savegame management system is a simple organization...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Retrieved from [https://web.archive.org/web/20100617021545/http://www.xbox-linux.org/wiki/Xbox_Savegame_System]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The Xbox savegame management system is a simple organizational system that allows users to manage their saved games, downloaded contents from Xbox LIVE, and copy savegames to memory units.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Overview==&lt;br /&gt;
&lt;br /&gt;
The Xbox savegame system uses folders and metadata to organize savegames according to its game, type, and name (in that order). All game-generated data are stored in either E:\UDATA or E:\TDATA. The UDATA folder is generally used to store gamesaves (user data), and the TDATA folder is generally used to store LIVE contents and other configurations (such as downloaded levels, high-score tables, game updates, and other miscellaneous configurations). These are the universal elements of gamesaves:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* A title meta (universal)&lt;br /&gt;
* A title image (universal)&lt;br /&gt;
* A save title&lt;br /&gt;
* A save image&lt;br /&gt;
&lt;br /&gt;
Saves are nested individually inside the game's folder, which are nested inside the game-data folders (UDATA and TDATA). Every XBE that had ever run will have a folder for itself in both of the game-data folders (however, the Xbox Dashboard is a special case).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Structure Layout==&lt;br /&gt;
&lt;br /&gt;
Here's a typical layout of a the savegame folders, shown with Splinter Cell and Xbox Dashboard Music.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;+-E:&lt;br /&gt;
  +-TDATA&lt;br /&gt;
  | +-5553000c&lt;br /&gt;
  | | +-audiovideo.par&lt;br /&gt;
  | | +-contentimage.xbx&lt;br /&gt;
  | +-fffe0000&lt;br /&gt;
  |   +-music&lt;br /&gt;
  |     +-ST.DB&lt;br /&gt;
  +-UDATA&lt;br /&gt;
    +-5553000c&lt;br /&gt;
      +-8E6AA806E588&lt;br /&gt;
      | +-GMMAN_Profile.sg1&lt;br /&gt;
      | +-GMMAN_Profile.sg2&lt;br /&gt;
      | +-GMMAN_Profile.sg3&lt;br /&gt;
      | +-Profile.inf&lt;br /&gt;
      | +-SaveMeta.xbx&lt;br /&gt;
      +-SaveImage.xbx&lt;br /&gt;
      +-TitleImage.xbx&lt;br /&gt;
      +-TitleMeta.xbx&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
As you can see, in the top level there are two folders, TDATA and UDATA. Under each of those folders are folders named according to the game's ID (for example, Splinter Cell's ID is 5553000c). They are in both TDATA and UDATA folders.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===UDATA Folder===&lt;br /&gt;
&lt;br /&gt;
The UDATA folder is generally used to store user content, such as save games, settings, and user-created customizations. Under this folder are folders for each individual game, named by their ID number. Under every game folder, there are two files: TitleImage.xbx and TitleMeta.xbx.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
====TitleImage.xbx====&lt;br /&gt;
&lt;br /&gt;
TitleImage.xbx is a 128*128px Xbox texture, used for displaying the game's logo at the left of the game's section in the Memory browser. If this file is missing or corrupted, a generic Xbox logo will be displayed in its place.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
====TitleMeta.xbx====&lt;br /&gt;
&lt;br /&gt;
TitleMeta.xbx is a text file for indicating what title of the game would be displayed in the Memory browser. The title is taken from the embedded title of the executable that created the game folder (ie. if you run Splinter Cell's default.xbe first, the title will be &amp;quot;Splinter Cell&amp;quot;. If you run its downloader.xbe (same game ID), the title will be &amp;quot;Downloader&amp;quot;). If this file is missing or corrupted, the game's title will be displayed as &amp;quot;Unknown Title&amp;quot;. The structure for TitleMeta.xbx is:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
TitleName=Game Name&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
In the case of Splinter Cell, it is &amp;lt;code&amp;gt;TitleName=Splinter Cell&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=====Localization=====&lt;br /&gt;
&lt;br /&gt;
The TitleMeta.xbx file may contain localization:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
[default]&lt;br /&gt;
TitleName=Network Configurations&lt;br /&gt;
[EN]&lt;br /&gt;
TitleName=Network Configurations&lt;br /&gt;
[JA]&lt;br /&gt;
TitleName=ネットワーク設定データ&lt;br /&gt;
[DE]&lt;br /&gt;
TitleName=Daten für Netzwerkeinstellungen&lt;br /&gt;
[FR]&lt;br /&gt;
TitleName=Données des paramètres réseau&lt;br /&gt;
[ES]&lt;br /&gt;
TitleName=Datos de configuración de red&lt;br /&gt;
[IT]&lt;br /&gt;
TitleName=Dati impostazioni di rete&lt;br /&gt;
[KO]&lt;br /&gt;
TitleName=네트워크 설정 데이터&lt;br /&gt;
[TW]&lt;br /&gt;
TitleName=網路設定資料&lt;br /&gt;
[BR]&lt;br /&gt;
TitleName=Dados de Configurações da Rede&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
There is a separate TitleName entry listed under each of the languages. The entry under &amp;lt;code&amp;gt;[default]&amp;lt;/code&amp;gt; will be used if a localized game title cannot be found in this file for the current system language.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===Gamesaves===&lt;br /&gt;
&lt;br /&gt;
Each individual gamesave or game profile is under the game's folder in the UDATA folder. Each save or profile has its own folder. The name of the folders differs from game to game, as there is not set format for the name of a save folder. Ie. one game may choose to name its save folder as &amp;quot;001aecf7&amp;quot;, another game may name the save folder as &amp;quot;Profile01&amp;quot;. There is always a SaveMeta.xbx file under the folder, and there may also be a SaveImage.xbx file there. Each save folder may contain whatever data that is needed for a valid save.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
====SaveMeta.xbx====&lt;br /&gt;
&lt;br /&gt;
SaveMeta.xbx is very similar to TitleMeta.xbx. This defines the name of a save and is displayed on the left side of the screen when the save is selected. If this file is missing or corrupted, the gamesave's name will be displayed as &amp;quot;Corrupted Save&amp;quot;. Its format is as the following:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
Name=Save Name&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
In the case of a Splinter Cell game save, it is something like &amp;lt;code&amp;gt;Name=GMMAN_Profile&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
====SaveImage.xbx====&lt;br /&gt;
&lt;br /&gt;
SaveImage.xbx is a 64*64px Xbox texture, used to represent an individual save folder. It'll be located in the game's folder under the UDATA folder if all of the saves use the same image (to avoid unnecessary duplication), or under each individual save folder, if there are different kinds of saves located in each folder. The gamesave folder's SaveImage.xbx has precedence over the game folder's SaveImage.xbx. If this file is missing or corrupted, a generic Xbox logo will be in its place.&lt;br /&gt;
&lt;br /&gt;
Universal save image:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
+-UDATA&lt;br /&gt;
  +-5553000c&lt;br /&gt;
    +-SaveImage.xbx&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Individual save image:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
+-UDATA&lt;br /&gt;
  +-4d530013&lt;br /&gt;
    +-129E1A3F1B2A&lt;br /&gt;
      +-SaveImage.xbx&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
===TDATA Folder===&lt;br /&gt;
&lt;br /&gt;
The TDATA folder is similar in structure to the UDATA folder. However, it is used to store Xbox LIVE contents, game configurations, and other miscellaneous data. With the TDATA game folders, there is no specific structure, so games may store whatever file it needs wherever inside its game folder.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
====contentimage.xbx====&lt;br /&gt;
&lt;br /&gt;
Contentimage.xbx is used in the same way as SaveImage.xbx, except that it is used specifically to indicate downloaded contents.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Special Case of Xbox Dashboard==&lt;br /&gt;
&lt;br /&gt;
The Xbox Dashboard does not abide by these structures. For one, it doesn't have a UDATA folder, and in the TDATA folder it doesn't have any .xbx files. However, in its TDATA folder (E:\TDATA\fffe0000), there is a folder named &amp;lt;code&amp;gt;music&amp;lt;/code&amp;gt;. Inside it is a file named &amp;lt;code&amp;gt;ST.DB&amp;lt;/code&amp;gt; and several folders with hexadecimal names. This is where soundtracks are stored.&lt;br /&gt;
&lt;br /&gt;
If you go into the LIVE Dash's &amp;quot;Test Connections&amp;quot; screen and press the Black button, a folder that follows the structure will be created under the game folder fffe0000 under the UDATA folder. This contains diagnostic information about the connection to Xbox LIVE.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Other Occurrences in the UDATA and TDATA Folders==&lt;br /&gt;
&lt;br /&gt;
* Under the Dashboard's TDATA game folder, a blank file named &amp;amp;lt;code&amp;amp;gt;NoisyCamera&amp;amp;lt;/code&amp;amp;gt; may be present. This is a marker for an Easter egg on the main menu of the Dashboard. Toggle it the same way as the full-screen visualization egg.&lt;br /&gt;
* Under the UDATA folder, there may be a file named &amp;amp;lt;code&amp;amp;gt;NICKNAME.XBN&amp;amp;lt;/code&amp;amp;gt;. This stores the Xbox's nickname for online games.&lt;br /&gt;
&lt;br /&gt;
==Application to Xbox-Linux==&lt;br /&gt;
&lt;br /&gt;
One way the Xbox-Linux project can take advantage of the gamesave system is by having a all Xbox-Linux distributions reside inside an Xbox-Linux game folder. Each individual distribution would be a &amp;quot;gamesave.&amp;quot; For example, suppose that the Xbox-Linux project uses the game ID &amp;lt;code&amp;gt;ffffff00&amp;lt;/code&amp;gt; and that we're using Xebian as the distro. Here would be the layout of the files following the gamesave structure:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;+-E:&lt;br /&gt;
  +-TDATA&lt;br /&gt;
  | +-ffffff00&lt;br /&gt;
  |   +-linuxboot.cfg&lt;br /&gt;
  +-UDATA&lt;br /&gt;
    +-ffffff00&lt;br /&gt;
      +-debian&lt;br /&gt;
      | +-initrd&lt;br /&gt;
      | +-rootfs&lt;br /&gt;
      | +-SaveImage.xbx&lt;br /&gt;
      | +-SaveMeta.xbx&lt;br /&gt;
      | +-swap&lt;br /&gt;
      | +-vmlinuz&lt;br /&gt;
      +-TitleImage.xbx&lt;br /&gt;
      +-TitleMeta.xbx&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Xromwell would search the gamesave directories for linuxboot.cfg and have a special method of handling of a special tag for the gamesave system, so that the following would point to the Xebian files in the UDATA structure:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;title Xebian&lt;br /&gt;
kernel&amp;amp;nbsp;!gs/debian/vmlinuz&lt;br /&gt;
initrd&amp;amp;nbsp;!gs/debian/initrd&lt;br /&gt;
append init=/linuxrc root=/dev/ram0 kbd-reset xbox=fatx_e:/UDATA/ffffff00/debian ramdisk_blocksize=4096 &lt;br /&gt;
xboxfb y&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Contents of SaveMeta.xbx:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
Name=Xebian&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Contents of TitleMeta.xbx:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
TitleName=Xbox-Linux&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
SaveImage.xbx would show the Debian logo, and TitleImage.xbx would show Tux.&lt;br /&gt;
&lt;br /&gt;
With this arrangement, it would be easy to uninstall or copy Xbox-Linux distributions simply by selecting its icon in the Memory browser. To completely get rid of Xbox-Linux distributions, just select the Tux icon. Distribution on a specially formatted USB drive would also be possible: create a pre-installed Linux image with a FATX filesystem, and then &amp;lt;code&amp;gt;dd&amp;lt;/code&amp;gt; it onto the flash drive.&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=The_Hidden_Boot_Code_of_the_Xbox&amp;diff=5577</id>
		<title>The Hidden Boot Code of the Xbox</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=The_Hidden_Boot_Code_of_the_Xbox&amp;diff=5577"/>
				<updated>2017-05-31T08:19:56Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: Created page with &amp;quot; Retrieved from [https://web.archive.org/web/20100617012156/http://www.xbox-linux.org/wiki/The_Hidden_Boot_Code_of_the_Xbox]  or '''&amp;quot;How to fit three bugs in 512 bytes of secu...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;br /&gt;
Retrieved from [https://web.archive.org/web/20100617012156/http://www.xbox-linux.org/wiki/The_Hidden_Boot_Code_of_the_Xbox]&lt;br /&gt;
&lt;br /&gt;
or '''&amp;quot;How to fit three bugs in 512 bytes of security code&amp;quot;'''&lt;br /&gt;
&lt;br /&gt;
by [https://web.archive.org/web/20100617012156/http://www.xbox-linux.org/wiki/User:Michael_Steil Michael Steil]&lt;br /&gt;
&lt;br /&gt;
Note: This article is partially incomplete. It is superseded by the more detailed article [https://web.archive.org/web/20100617012156/http://www.xbox-linux.org/wiki/The_Hidden_Boot_Code_of_the_Xbox 17 Mistakes Microsoft Made in the Xbox Security System]&lt;br /&gt;
&lt;br /&gt;
In order to lock out both copied games as well as homebrew software, including the GNU/Linux operating system, Microsoft built a chain of trust on the Xbox reaching from the hardware to the execution of game code, in order to avoid the infiltration of code that has not been authorized by Microsoft. The link between hardware and software in this chain of trust is the hidden &amp;quot;MCPX&amp;quot; boot ROM. The principles, the implementations and the security vulnerabilities of this 512 bytes ROM will be discussed in this article.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;div class=&amp;quot;center&amp;quot;&amp;gt;'''Missing image'''&amp;lt;br /&amp;gt;''Chain_Of_Trust.png'' &amp;lt;br /&amp;gt;Image:Chain Of Trust.png&amp;lt;br /&amp;gt;&amp;lt;br /&amp;gt; &amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
In short: The memory limitations in the hidden ROM made the system vulnerable in principle. A terribly wrong design and three bugs in the implementation opened three independent backdoors.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Why a Hidden ROM is Needed ==&lt;br /&gt;
&lt;br /&gt;
The Xbox is an IBM PC, i.e. it has an x86 CPU. When the machine is turned on, it starts execution 16 bytes from the top of its address space, at the address FFFF_FFF0 (F000:FFF0 in 8086 segment:offset notation). On an IBM PC, the upper 64 KB (or more) of the address space are occupied by the BIOS ROM, so the CPU starts execution in this ROM.&lt;br /&gt;
&lt;br /&gt;
The Xbox, having an external (reprogrammable) 1 MB Flash ROM chip (models since 2003 have only 256 KB), would normally start running code there as well, since this megabyte is also mapped into the uppermost area of the address space. But this would make it too easy for someone who wants to either replace the ROM image with a self-written one or patch it to break the chain of trust (&amp;quot;modchips&amp;quot;). If the ROM image could be fully accessed, it would be easy to reverse-engineer the code; encryption and obfuscation would only slow down the hacking process a bit.&lt;br /&gt;
&lt;br /&gt;
A common idea to make the code inaccessible is not to put it into an external chip, but integrate it into one of the other chips. Then there is no standard way to extract the data, and none to replace the chip with one with different contents. But this way, it is a lot more expensive, both the design of a chip that includes both ROM and additional logic, and updating the ROM in a new version of the Xbox if there is a flaw in the ROM.&lt;br /&gt;
&lt;br /&gt;
A good compromise is to store only a small amount of code in one of the other chips, and store the bulk of it in the external Flash chip. This small ROM can not be extracted easily, and it cannot be changed or replaced. The code in there just has to make sure that an attacker can neither understand nor successfully patch the bulk of the code he has access to, which is stored in Flash ROM.&lt;br /&gt;
&lt;br /&gt;
Microsoft decided to go this way, and they stored 512 bytes of code in the Xbox' Southbridge, the MCPX (Media and Communications Processor for Xbox), which is manufactured by nVidia. This code is supposed to be mapped into the uppermost 512 bytes of the address space, overriding the Flash ROM at this position, so that the CPU starts execution there. It includes x86 code for a decryption function with a secret key that makes the CPU decipher (parts of the) &amp;quot;unsafe&amp;quot; code in the Flash ROM into RAM and run it. Without knowing the key, it is practically impossible to understand or even patch the encrypted code in Flash ROM.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== The Code in the Hidden ROM ==&lt;br /&gt;
&lt;br /&gt;
ROM in a multifunction IC is expensive, therefore it has to be small. Microsoft decided it to be only 512 bytes. Microsoft's implementation of the RC4 decryption algorithm fits well in about 150 bytes, so, at first inspection, this should be no problem.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== The 512 Bytes problem ===&lt;br /&gt;
&lt;br /&gt;
But it is. When the CPU starts up, we cannot simply start decrypting data from flash ROM into RAM. We have to&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* initialize the CPU (32 bit mode, caching, segmenting)&lt;br /&gt;
* initialize the chipset and RAM so that the machine is in a stable state&lt;br /&gt;
&lt;br /&gt;
While the CPU initialization can be done in less than 150 bytes, the initialization of the chipset and RAM, if done completely, will require more than 1000 bytes of assembly code. Even at a minimum, Microsoft probably did not see a way to fit all this into these 512 bytes.&lt;br /&gt;
&lt;br /&gt;
Therefore it was decided to store some initialization tables in Flash ROM. The Southbridge was modified to read these tables even before the CPU starts running, and to pass these values to the Northbridge and Southbridge components. These tables are fetched from the very beginning of Flash ROM (FFF0_0000) and are 52 bytes long.&lt;br /&gt;
&lt;br /&gt;
But these tables are not enough for full hardware initialization. Tables are just not powerful enough - for memory initialization, memory stability tests have to be made. Putting some x86 code to do this into Flash ROM would pervert the security system, because a hacker could then easily put his own code there.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== The Xcodes ===&lt;br /&gt;
&lt;br /&gt;
Microsoft decided to create a simple virtual machine that was well-suited for running hardware initialization code, but not much else. They created a tiny interpreter that understands 12 statements, but is not supposed to be powerful enough to take over the machine. As it is secure, this bytecode, called Xcode by the hackers that discovered it, can then be stored in Flash ROM. So the hidden ROM initializes the CPU, interprets the Xcodes stored in Flash ROM to set up the machine and then decrypts and runs x86 code from Flash ROM.&lt;br /&gt;
&lt;br /&gt;
The Xcodes start at FFF0_0080 (at 128 bytes) in Flash ROM. As the Flash can be easily updated in newer revisions of the Xbox, their size needn't be constant; they are typically about 3000 bytes in size, which is about 330 statements.&lt;br /&gt;
&lt;br /&gt;
An Xcode consists of an 8 bit statement, always followed by two 32 bit operands. The virtual machine has a 32 bit accumulator. The following table summarizes possible instructions; all other codes are treated as NOP:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|  0x02&lt;br /&gt;
|  PEEK&lt;br /&gt;
|  ACC&amp;amp;nbsp;:= MEM[OP1]&lt;br /&gt;
|-&lt;br /&gt;
|  0x03&lt;br /&gt;
|  POKE&lt;br /&gt;
|  MEM[OP1]&amp;amp;nbsp;:= OP2&lt;br /&gt;
|-&lt;br /&gt;
|  0x04&lt;br /&gt;
|  POKEPCI&lt;br /&gt;
|  PCICONF[OP1]	:= OP2&lt;br /&gt;
|-&lt;br /&gt;
|  0x05&lt;br /&gt;
|  PEEKPCI&lt;br /&gt;
|  ACC&amp;amp;nbsp;:= PCICONF[OP1]&lt;br /&gt;
|-&lt;br /&gt;
|  0x06&lt;br /&gt;
|  AND/OR&lt;br /&gt;
|  ACC&amp;amp;nbsp;:= (ACC &amp;amp;amp; OP1) 	OP2&lt;br /&gt;
|-&lt;br /&gt;
|  0x07&lt;br /&gt;
|  (prefix)&lt;br /&gt;
|  execute the instruction code in OP1 with OP1&amp;amp;nbsp;:= OP2, OP2&amp;amp;nbsp;:= ACC&lt;br /&gt;
|-&lt;br /&gt;
|  0x08&lt;br /&gt;
|  BNE&lt;br /&gt;
|  IF ACC = OP1	THEN PC	:= PC +	OP2&lt;br /&gt;
|-&lt;br /&gt;
|  0x09&lt;br /&gt;
|  BRA&lt;br /&gt;
|  PC&amp;amp;nbsp;:= PC + OP2&lt;br /&gt;
|-&lt;br /&gt;
|  0x10&lt;br /&gt;
|  AND/OR ACC2&lt;br /&gt;
|  ''(unused/defunct)'' ACC2&amp;amp;nbsp;:= (ACC2 &amp;amp;amp; OP1)  OP2&lt;br /&gt;
|-&lt;br /&gt;
|  0x11&lt;br /&gt;
|  OUTB&lt;br /&gt;
|  PORT[OP1]&amp;amp;nbsp;:=	OP2&lt;br /&gt;
|-&lt;br /&gt;
|  0x12&lt;br /&gt;
|  INB&lt;br /&gt;
|  ACC&amp;amp;nbsp;:= PORT(OP1)&lt;br /&gt;
|-&lt;br /&gt;
|  0xEE&lt;br /&gt;
|  END&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
So the interpreter, rewritten in C, looks roughly like this:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;struct {&lt;br /&gt;
    char opcode;&lt;br /&gt;
    int op1;&lt;br /&gt;
    int op2;&lt;br /&gt;
} *p;&lt;br /&gt;
int acc;&lt;br /&gt;
&lt;br /&gt;
p = 0xFFF00080;&lt;br /&gt;
&lt;br /&gt;
while(1) {&lt;br /&gt;
    switch(p-&amp;amp;gt;opcode) {&lt;br /&gt;
        case 2:&lt;br /&gt;
            acc = *((int*)p-&amp;amp;gt;op1);&lt;br /&gt;
            break;&lt;br /&gt;
        case 3:&lt;br /&gt;
            *((int*)p-&amp;amp;gt;op1) = p-&amp;amp;gt;op2;&lt;br /&gt;
            break;&lt;br /&gt;
        case 4:&lt;br /&gt;
            outl(p-&amp;amp;gt;op1, 0x0CF8);&lt;br /&gt;
            outl(p-&amp;amp;gt;op2, 0x0CFC);&lt;br /&gt;
            break;&lt;br /&gt;
        case 5:&lt;br /&gt;
            ...&lt;br /&gt;
        case 0xEE:&lt;br /&gt;
            goto end;&lt;br /&gt;
    }&lt;br /&gt;
    p++;&lt;br /&gt;
}&lt;br /&gt;
end:&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
PEEK and POKE read from and write constants to main memory. OUTB and INB do the same with 8 bit I/O ports. (I/O ports are another address space, 16 bit wide, next to the 32 bit memory address space. While most other CPU architectures control hardware by accessing their registers as if they were memory, the Intel architecture can access some older components through specialized in/out assembly instructions.) POKEPCI and PEEKPCI access the PCI configuration area, by sending the PCI config address to 32 bit I/O port 0xCF8 and accessing the value at 32 bit I/O port 0xCFC. (On PCI-equipped computers, every PCI device has at least 64 bytes of PCI config registers. On a PC, the BIOS or a Plug-and-Play operating system communicates through these registers to find out what resources (memory, I/O ports, interrupts) a device needs and then maps these resources. The I/O ports 0xCF8/0xCFC are the communication mechanism for the PCI config space on PCs.)&lt;br /&gt;
&lt;br /&gt;
The AND/OR instruction can do a 32 bit AND or OR or both at the same time with the accumulator. BNE branches if the accumulator is equal to a constant, BRA branches always. The prefix 0x07 can be used to execute any of the other statements with the accumulator as the second operand. This way, &amp;quot;POKE addr, ACC&amp;quot;, &amp;quot;POKEPCI addr, ACC&amp;quot;, &amp;quot;BNE PC+ACC&amp;quot;, &amp;quot;BRA PC+ACC&amp;quot; and &amp;quot;OUT addr, ACC&amp;quot; are possible. The code 0x07 is handled by the interpreter, and uses a second accumulator, but this code is never used by the Xcodes. The code 0xEE ends the interpreter and makes the hidden ROM go on with the RC4 decryption.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== RC4 decryption, validity check and panic code ===&lt;br /&gt;
&lt;br /&gt;
After the Xcodes have completed the hardware setup, the machine is in a stable state, so that it is possible to decrypt parts of the Flash ROM directly into RAM and run it there. As mentioned earlier, the RC4 code including the key is about 150 bytes in size. The Xcode interpreter is about 175 bytes, and CPU init about 145 bytes. This leaves only about 40 bytes for a check whether decryption was successful and halt the machine otherwise.&lt;br /&gt;
&lt;br /&gt;
This seems not to have been enough space for Microsoft's engineers to implement a small checksum routine, so they only checked for one 32 bit constant (0x7854794A) at the end of the decrypted data in RAM (0x0009_5FE4). If this is successful, the CPU jumps to 0x9_0000 in RAM, where the new code has been written. This code, the &amp;quot;second bootloader&amp;quot; (&amp;quot;2bl&amp;quot;) is about 25 KB in size. It continues initializing the hardware and decompresses the kernel from Flash ROM.&lt;br /&gt;
&lt;br /&gt;
If the decrypted value is not correct, the CPU is supposed to halt. Simply using the &amp;quot;hlt&amp;quot; opcode would mean that the machine would remain turned on and idle with the hidden ROM visible in the address space. A hacker could then use some hardware attached to the chipset that extracts the data from ROM from a running machine. The designers therefore decided to always turn off the hidden ROM as soon as possible in both branches, when decryption was successful (then it is turned off as one of the first instructions in the &amp;quot;2bl&amp;quot; code), and if it wasn't.&lt;br /&gt;
&lt;br /&gt;
But making the CPU crash and turning off the ROM it is running in is a challenge. If we halt the CPU, we cannot turn off the ROM afterwards. If we turn off the ROM, we turn off the code that gets run and we cannot halt the CPU - even worse, the CPU would continue fetching its opcodes from the underlying Flash ROM as soon as the hidden ROM is deactivated.&lt;br /&gt;
&lt;br /&gt;
Microsoft's developers came up with a very interesting trick: They led execution to the absolute top of the address space, and as the very last instruction, they turn off the hidden ROM. Then the instruction pointer is supposed to overflow from FFFF_FFFF to 0000_0000 and an exception is supposed to be generated which in turn is supposed to halt the CPU because no exception handler is registered.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;div class=&amp;quot;center&amp;quot;&amp;gt;&amp;lt;img src=&amp;quot;https://web.archive.org/web/20100617012156im_/http://www.xbox-linux.org/pic/memorymap.png&amp;quot; alt=&amp;quot;memorymap.png&amp;quot; /&amp;gt;&amp;lt;/div&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Security Issues ==&lt;br /&gt;
&lt;br /&gt;
This system looks pretty secure. If we don't know what's going on, it is a lot of work to find out that there is a hidden boot ROM (but it's easy to prove because the Xbox still boots if you overwrite the upper 512 bytes of Flash ROM since they never get used). If we don't have access to the boot ROM, we cannot decrypt and thus cannot understand the code in Flash ROM. Because we don't know how to reencrypt, we cannot patch the code in Flash.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== The Importance of the Secret Key ===&lt;br /&gt;
&lt;br /&gt;
But what happens if someone finds out the hidden 512 bytes? [https://web.archive.org/web/20100617012156/http://www.xenatera.com/bunnie/proj/anatak/xboxmod.html Bunnie] did, Christmas 2001. He tapped the bus between the Southbridge (where the secret MCPX code is stored) and the Northbridge (the CPU's memory interface) where all secret data gets transmitted. The compromise to store the secret ROM in the MCPX instead of the CPU, so that data would travel over a bus, finally broke the system. Knowing the algorithm and the secret key, he could easily disassemble the whole code in Flash ROM, and he could have even patched and reencrypted the code - the decryption code won't notice the difference, as the Flash ROM is not hashed: Only a single 32 bit value is checked. Modchip makers, who used similar tricks to get hold of the hidden ROM, used this knowledge to create patched versions of the Flash ROM image and distributed them on boards that, soldered to the Xbox motherboard, overrode the onboard Flash ROM.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Security Measures in the Hidden ROM ===&lt;br /&gt;
&lt;br /&gt;
So as soon as the encryption algorithm and the key are known, everything is possible? Not quite. In order to create a working Flash ROM image, you have to use Microsoft's secret key, which is considered illegal under certain jurisdictions. So for a completely legal replacement Flash ROM image that takes over the machine to be free to run any homebrew software or alternative operating systems, a complete security analysis had to be made.&lt;br /&gt;
&lt;br /&gt;
Since the hidden code depends in some way on external data, stored in Flash ROM, which can be quite easily changed by the user, it may be attackable through certain data stored there. Microsoft understood this danger and added some precautions so that the Xcodes could not be abused - supposedly - in case the secret ROM was known.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== PEEK ====&lt;br /&gt;
&lt;br /&gt;
The Xcode language is powerful enough to easily read and write memory, the PCI configuration space as well as I/O ports. The user could easily add Xcodes that read the hidden MCPX ROM and send the data to some I/O ports, e.g. the I2C bus. Therefore all memory reads are limited to the lower 256 MB:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;    and ebx, 0FFFFFFFh &amp;amp;nbsp;; clear	upper 4 bits&lt;br /&gt;
    mov edi, [ebx]      &amp;amp;nbsp;; read from memory location op1 into di&lt;br /&gt;
    jmp next_instruction&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== POKEPCI ====&lt;br /&gt;
&lt;br /&gt;
Turning off the hidden ROM is done by the following statements:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;    mov eax, 80000880h&lt;br /&gt;
    mov dx, 0CF8h&lt;br /&gt;
    out dx, eax&lt;br /&gt;
    add dl, 4&lt;br /&gt;
    mov al, 2&lt;br /&gt;
    out dx, al&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This code sets bit #1 in the PCI config space, device 0:1:0, register offset 0x80 (coded in 0x80000880).&lt;br /&gt;
&lt;br /&gt;
Using the POKEPCI instruction, it would be possible to disable the hidden ROM prematurely, so that the underlying Flash ROM, which is normally overlapped by the secret ROM, would be visible, and CPU would continue running there, where the hacker could simly store his code:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;    POKEPCI 0x80000880, 2&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Therefore the interpreter always clears bit 1 if the Xcode wants to write to 0x80000880:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;    cmp ebx, 80000880h        &amp;amp;nbsp;; ISA Bridge, MCPX disable?&lt;br /&gt;
    jnz short not_mcpx_disable&amp;amp;nbsp;; no&lt;br /&gt;
    and ecx, not 2            &amp;amp;nbsp;; clear	bit 1&lt;br /&gt;
not_mcpx_disable:&lt;br /&gt;
    mov eax, ebx&lt;br /&gt;
    mov dx, 0CF8h&lt;br /&gt;
    out dx, eax               &amp;amp;nbsp;; PCI configuration address&lt;br /&gt;
    add dl, 4&lt;br /&gt;
    mov eax, ecx&lt;br /&gt;
    out dx, eax               &amp;amp;nbsp;; PCI configuration data&lt;br /&gt;
    jmp short next_instruction&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== Halt ====&lt;br /&gt;
&lt;br /&gt;
As described earlier, if the hidden ROM detects that decryption was unsuccessful, it halts the CPU and turns off the hidden ROM by turning it off as the very last statement in the CPU's address space, causing an address overflow exception and thus a CPU halt in the very next cycle. This is supposed to make it impossible for a hacker to extract the hidden ROM contents, because the hidden ROM is always turned off very quickly, even if the machine does not boot correctly.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;    mov eax, ds:95FE4h&lt;br /&gt;
    cmp eax, 7854794Ah&lt;br /&gt;
    jnz short bad_checkcode&lt;br /&gt;
    mov eax, ds:90000h&lt;br /&gt;
    jmp eax                 &amp;amp;nbsp;; jump to decrypted second bootloader in RAM&lt;br /&gt;
bad_checkcode:&lt;br /&gt;
    mov eax, 80000880h	     &amp;amp;nbsp;; prepare MCPX ROM disable&lt;br /&gt;
    mov dx, 0CF8h&lt;br /&gt;
    out dx, eax&lt;br /&gt;
    jmp far ptr 8:0FFFFFFFAh&amp;amp;nbsp;; jump to end of ROM, wraparound&lt;br /&gt;
[...]&lt;br /&gt;
FFFA:&amp;amp;nbsp;; this is address FFFFFFFA&lt;br /&gt;
    add	dl, 4&lt;br /&gt;
    mov	al, 2&lt;br /&gt;
    out	dx, al&lt;br /&gt;
; ------ this is address 00000000 ------&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Security Flaws in the Hidden ROM ===&lt;br /&gt;
&lt;br /&gt;
While these three security precautions that have just been described are indeed vital, two of them are faulty. The POKEPCI check is incorrectly implemented, and the somewhat clever &amp;quot;Halt&amp;quot; trick, which was supposed to lock out hardware sniffers, opened a software backdoor.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== The Visor Trick ====&lt;br /&gt;
&lt;br /&gt;
The roll over of the instruction pointer from FFFF_FFFF to 0000_0000 is supposed to generate an exception. Since no exception handlers are installed, this is supposed to halt the machine. But in reality, no exception is generated. Execution just happily continues at 0000_0000 - in RAM! Apparently the i386 CPU family throws no exception in this case, Microsoft's engineers only assumed it or misread the documentation and never tested it.&lt;br /&gt;
&lt;br /&gt;
By adding Xcodes to write a jump to some Flash ROM address, like FFF0_0000, into memory at location 0, and causing the decryption check to fail by just not including the 32 bit check value into the Flash ROM, one's own code will be run right after the RC4 decryption:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;    POKE 0x00000000, 0x001000B8&amp;amp;nbsp;; store &amp;quot;mov eax, 0xFF001000; jmp eax&amp;quot;&lt;br /&gt;
    POKE 0x00000004, 0x90E0FFFF&amp;amp;nbsp;; at 0x00000000 in memory&lt;br /&gt;
    END&lt;br /&gt;
   &amp;amp;nbsp;; now we can place our code at 0x1000 in Flash&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== The MIST Trick ====&lt;br /&gt;
&lt;br /&gt;
POKEPCI's check for 0x80000880, the address of the configuration register to turn off the hidden ROM, is incorrect. The Southbridge, which decodes the 32 bit value into &amp;quot;bus&amp;quot;, &amp;quot;device&amp;quot;, &amp;quot;function&amp;quot; and &amp;quot;register&amp;quot; and sends the funcion and register numbers to the specific device on the specific bus, simply ignores the unused bits of that 32 bit value, so 0x88000880 or 0xF0000880 behave exactly the same as 0x80000880 - but POKEPCI's check does not detect them. So this check even gives the attacker a hint how to circumvent it.&lt;br /&gt;
&lt;br /&gt;
By adding the statement POKEPCI 0x88000880, 2 to the Xcodes, the interpreter will turn off the hidden ROM - where it is running itself! As soon as the CPU cache has run empty, execution will continue somewhere between FFFF_FE00 and FFFF_FFFF in Flash ROM. You can simply fill everything with NOPs and add a JMP to your own code at the very top.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== More Attacks? ====&lt;br /&gt;
&lt;br /&gt;
Since two methods to circumvent the Xbox hidden ROM security without touching any crypto both work equally well, there has been little need for further research, but there might very well be more than two security issues in these 512 bytes. There are two more approaches for attacks that we do not want to disclose yet, as Microsoft may still offer updated Xboxes in the future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Microsoft's Fixes ==&lt;br /&gt;
&lt;br /&gt;
In August 2002, Microsoft started manufacturing V1.1 Xboxes, which had been improved in many ways. In concerns of security, the hidden ROM and the MCPX' PCI config behavior had been updated (the MCPX revision is &amp;quot;C3&amp;quot; instead of &amp;quot;B2&amp;quot;): They now squeezed a TEA hash into the 512 bytes, replacing the old 32 bit test. The &amp;quot;2bl&amp;quot; code now couldn't be altered easily. And they changed the RC4 secret key.&lt;br /&gt;
&lt;br /&gt;
But although they had the possibility to patch their design, Microsoft again failed to make the Xbox secure this time:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* They left both the MIST backdoor and the Visor backdoor wide open.&lt;br /&gt;
* The TEA hash has been a bad choice. If they had even read Schneier's &amp;quot;Applied Cryptography&amp;quot; (''the'' book on crypto), they would have known that TEA is insecure if used as a hash. This can be easily exploited so that 2bl changes remain undetected, leading to the third bug in the second implementation.&lt;br /&gt;
&lt;br /&gt;
It is pretty obvious that the changes had been made in reaction to Bunnie's hack, who retrieved the secret key for the RC4 decryption, and before the Visor or MIST bugs had been found.&lt;br /&gt;
&lt;br /&gt;
In May 2004, Microsoft started shipping Xboxes that had the ROM image, the video encoder and the security chip (SMC) integrated into a single package, so that it was no longer possible to overwrite the firmware. The secret ROM in the MCPX was still the same though. But as of November 2005, it is still possible to attach a replacement ROM to the LPC bus (&amp;quot;modchip&amp;quot;) of new Xboxes, as the verification weakness is still there.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Microsoft's Strategy ==&lt;br /&gt;
&lt;br /&gt;
Microsoft's engineers first seem to have thought that the secret key would never be revealed: security by obscurity. This explains why the decrypted code did not get hashed. Once the secret key was known, anyone could decrypt, patch and reencrypt the flash contents.&lt;br /&gt;
&lt;br /&gt;
So when the secret key had been extracted, Microsoft understood that it could be done again with another key very easily, so they added a hash function over the decrypted code. If the new secret key was to be found out again, attackers should at least not have had the possibility to change the code. Changing the key introduced no security, but was easy to do and at least required attackers to repeat the ROM extraction process.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Conclusion ==&lt;br /&gt;
&lt;br /&gt;
The design of the first MCPX was very wrong, and the implementation was catastrophic. The design of the second version was a lot better, but the implementation was not.&lt;br /&gt;
&lt;br /&gt;
Without the various security holes (Visor and MIST bugs as well as possibly more) and with a working hash function, the system would have been pretty secure. Encrypting the ROM contents with a secret key, i.e. security by obscurity, simply does not work if the key travels over a bus that can be sniffed.&lt;br /&gt;
&lt;br /&gt;
So with the first version of the MCPX, Microsoft was too naive and apparently did not understand basic security concepts. After they had learnt their lesson, they designed a pretty good system with the second version of the MCPX - but the implementation still contained at least three security holes (Visor, MIST, TEA). They were too fast releasing a new version of the MCPX, spending a lot of money in trashing tons of already manufactured MCPX chips and manufacturing updated ones, apparently without any further code audit which should have revealed the security holes.&lt;br /&gt;
&lt;br /&gt;
512 bytes is a very small amount of code (it fits on a single sheet of paper!), compared to the megabytes of code contained in software like Windows, Internet Explorer or Internet Information Server. Three bugs within these 512 bytes compromised the security completely - a bunch of hackers found them within days after first looking at the code. Why hasn't Microsoft Corp. been able to do the same? Why?&lt;br /&gt;
&lt;br /&gt;
==Links==&lt;br /&gt;
&lt;br /&gt;
* [https://web.archive.org/web/20100617012156/http://www.xbox-linux.org/ The Xbox Linux Project]&lt;br /&gt;
* [https://web.archive.org/web/20100617012156/http://hackingthexbox.com/ Hacking the Xbox]&lt;br /&gt;
* [https://web.archive.org/web/20100617012156/http://www.xenatera.com/bunnie/proj/anatak/xboxmod.html bunnie's adventures hacking the Xbox]&lt;br /&gt;
* [https://web.archive.org/web/20100617012156/http://web.archive.org/web/20021208233956/http://65.108.63.67/visor/ visor's aXventure]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Xbox_DVD_Movie_Playback_Kit&amp;diff=5542</id>
		<title>Xbox DVD Movie Playback Kit</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Xbox_DVD_Movie_Playback_Kit&amp;diff=5542"/>
				<updated>2017-05-29T12:23:49Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: Created page with &amp;quot;Retrieved from [http://www.xbox-linux.org/wiki/DVD-IR_Internals]    by ''Rob Reilink'', 3 Mar 2003    ==Introduction==  The DVD-IR remote receiver is a part of the DVD kit whi...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Retrieved from [http://www.xbox-linux.org/wiki/DVD-IR_Internals]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
by ''Rob Reilink'', 3 Mar 2003&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Introduction==&lt;br /&gt;
&lt;br /&gt;
The DVD-IR remote receiver is a part of the DVD kit which allows you to view DVDs on your Xbox. It comes together with a remote controller. Although it may seem just a simple microcontroller device with a receiver module, there is something more inside which could make it even more interesting.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Pictures==&lt;br /&gt;
&lt;br /&gt;
Ok, let's start with the pictures from the internals:&lt;br /&gt;
&lt;br /&gt;
'''Missing image'''&amp;lt;br /&amp;gt;''Dvdirfront.jpg'' &amp;lt;br /&amp;gt;Image:Dvdirfront.jpg&amp;lt;br /&amp;gt;&amp;lt;br /&amp;gt;&lt;br /&gt;
'''Missing image'''&amp;lt;br /&amp;gt;''Dvdirback.jpg'' &amp;lt;br /&amp;gt;Image:Dvdirback.jpg&amp;lt;br /&amp;gt;&amp;lt;br /&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==IC's==&lt;br /&gt;
&lt;br /&gt;
So, what is inside and what does it do?&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* U1 92163 [https://web.archive.org/web/20100617020513/http://www.st.com/ STMicroelectronics] &amp;amp;lt;[https://web.archive.org/web/20100617020513/http://www.st.com/stonline/books/pdf/docs/5521.pdf Datasheet]&amp;amp;gt;&lt;br /&gt;
: This big square IC on the backside is the microcontroller. STMicroelectronics describes it as &amp;quot;8/16-BIT FULL SPEED USB MCU FOR COMPOSITE DEVICES WITH 16 ENDPOINTS, 20K ROM, 2K RAM, I 2 C, SCI, &amp;amp;amp; MFT&amp;quot;. Since the program resides inside in its ROM, it is almost impossible to extract the program from inside.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* U2 TSOP-1556 [https://web.archive.org/web/20100617020513/http://www.vishay.com/ Vishay Telefunken] &amp;amp;lt;[https://web.archive.org/web/20100617020513/http://www.vishay.com/docs/82029/82029.pdf Datasheet]&amp;amp;gt;&lt;br /&gt;
: This black box on the middle of the frontside is an integrated IR receiver. It filters the received infrared pulses and demodulates them. Its filter frequency is 56kHz, while 38kHz is standard for most remote controls. Therefore, chances are few other remotes will work with the Xbox receiver.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* U3 MX23C4000TC-10 [https://web.archive.org/web/20100617020513/http://www.macronix.com/ Macronix] &amp;amp;lt;[https://web.archive.org/web/20100617020513/http://www.macronix.com/QuickPlace/hq/PageLibrary48256D9D002BA613.nsf/h_6057FA6682A90C3948256DCE0052D2D3/67DCB124F1BE4E7D48256DC50039AC31/$File/MX23C4000-4.2.pdf/?OpenElement Datasheet]&amp;amp;gt;&lt;br /&gt;
: This wide TSOP IC on the frontside could be the most interesting of all. It is a 4MBit mask ROM. It is assumed that it contains the DVD player application. WHY? Why would they not just put this little 512kb max. application on the harddisk? Why another ROM which contains the program?&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
: One could think it is to allow them to upgrade the application easily, but the real reason seems to be different: licensing. As the label on the back notes: &amp;quot;Made under license from Dolby Laboratories&amp;quot;. By including the software in the DVD Remote kit, they don't have to pay Dolby for every Xbox sold, but just for every DVD Remote kit sold. This allows them to keep the cost of the Xbox down.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* U4 HC574 [https://web.archive.org/web/20100617020513/http://www.ti.com/ Texas Instruments] &amp;amp;lt;[https://web.archive.org/web/20100617020513/http://focus.ti.com/lit/ds/symlink/sn74hc574.pdf Datasheet]&amp;amp;gt;&lt;br /&gt;
: This 20-pin standard logic IC is an octal D-flipflop, which splits the databus from the 92163 to 8 adress bits. This technique is very well known from the 8051 and other microcontrollers.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Hacking!==&lt;br /&gt;
&lt;br /&gt;
As the dashboard presumably downloads the code from the ROM into the memory of the Xbox, this could be a hardware hack requiring no hardware modifications. It should be noted though, that the ROM is probably scrambled. Also, the microcontroller could encrypt the data even more. As the mask ROM is not a proprietary device, it is known not to contain any encryption hardware. On the other hand is it quite reasonable to assume Microsoft also signed this piece of code, and the dashboard might refuse to run it if it is not signed.&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Xbox_Hardware_Overview&amp;diff=5541</id>
		<title>Xbox Hardware Overview</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Xbox_Hardware_Overview&amp;diff=5541"/>
				<updated>2017-05-29T12:22:36Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: Created page with &amp;quot;Retrieved from [http://www.xbox-linux.org/wiki/Xbox_Hardware_Overview]   The Xbox is a standard PC, based on standard components, but extended with a some security solutions....&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Retrieved from [http://www.xbox-linux.org/wiki/Xbox_Hardware_Overview]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The Xbox is a standard PC, based on standard components, but extended with a some security solutions. This document gives an overview of the components the Xbox is made of.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
= Overview =&lt;br /&gt;
&lt;br /&gt;
Viewed by connection (similar to the Windows 2000 Device Manager&lt;br /&gt;
view), the Xbox system hardware looks like this:&lt;br /&gt;
&lt;br /&gt;
Diagram modified by Fahad&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;Xbox V1.0-1.5&lt;br /&gt;
|&lt;br /&gt;
|-- Mobile Intel Pentium III 733mHz w/128kb Cache&lt;br /&gt;
|&lt;br /&gt;
|-- Flash ROM (V1.0/1.1 -&lt;br /&gt;
|&lt;br /&gt;
\-- PCI bus&lt;br /&gt;
    |&lt;br /&gt;
    |-- Programmable Interrupt Controller&lt;br /&gt;
    |&lt;br /&gt;
    |-- System Timer&lt;br /&gt;
    |&lt;br /&gt;
    |-- DMA Controller&lt;br /&gt;
    |&lt;br /&gt;
    |-- PCI Bridge Device - Host Bridge									(0:0:0, 0x2a5)&lt;br /&gt;
    |&lt;br /&gt;
    |-- Memory Controller - SDRAM - Samsung K4D263238M-QC50 133mHz 16mb			(0:0:3, 0x2a6)&lt;br /&gt;
    |   |&lt;br /&gt;
    |   |-- Top of Motherboard &lt;br /&gt;
    |   |   |&lt;br /&gt;
    |   |   |-- Pad 1 (closest to power connector) (empty)&lt;br /&gt;
    |   |   |&lt;br /&gt;
    |   |   |-- Pad 2 (left of Pad 1)&lt;br /&gt;
    |   |   |&lt;br /&gt;
    |   |   |-- Pad 3 (below Pad 4)&lt;br /&gt;
    |   |   |&lt;br /&gt;
    |   |   \-- Pad 4 (closest to AV connector) (empty)&lt;br /&gt;
    |   |&lt;br /&gt;
    |   \-- Bottom of Motherboard&lt;br /&gt;
    |       |&lt;br /&gt;
    |       |-- Pad 5 (paralell to Pad 1) (empty)&lt;br /&gt;
    |       |&lt;br /&gt;
    |       |-- Pad 6 (paralell to Pad 2)&lt;br /&gt;
    |       |&lt;br /&gt;
    |       |-- Pad 7 (paralell to Pad 3)&lt;br /&gt;
    |       |&lt;br /&gt;
    |       \-- Pad 8 (paralell to Pad 4) (empty)&lt;br /&gt;
    |&lt;br /&gt;
    |-- HUB Interface - ISA Bridge 									(0:1:0, 0x1b2) [nForce]&lt;br /&gt;
    |&lt;br /&gt;
    |-- SMBus Controller	 										(0:1:1, 0x1b4) [nForce]&lt;br /&gt;
    |   |&lt;br /&gt;
    |   |-- PIC16LC&lt;br /&gt;
    |   |&lt;br /&gt;
    |   |-- Conexant 25871/Focus 454/Xcalibur Video Encoder&lt;br /&gt;
    |   |&lt;br /&gt;
    |   |-- ADM1032 System Temperature Monitor&lt;br /&gt;
    |   |&lt;br /&gt;
    |   \-- Serial EEPROM&lt;br /&gt;
    |&lt;br /&gt;
    |-- OHCI USB Controller 											(0:2:0, 0x1c2) [nForce]&lt;br /&gt;
    |   |&lt;br /&gt;
    |   \-- USB HUB (Controller Ports 1 &amp;amp;amp; 2) &lt;br /&gt;
    |&lt;br /&gt;
    |-- OHCI USB Controller 											(0:3:0, 0x1c2) [nForce]&lt;br /&gt;
    |   |&lt;br /&gt;
    |   \-- USB HUB (Controller Ports 3 &amp;amp;amp; 4)&lt;br /&gt;
    |&lt;br /&gt;
    |-- MCP-X V3 Southbridge &lt;br /&gt;
    |   |&lt;br /&gt;
    |   |-- MCP Networking Adapter 									(0:4:0, 0x1c3) [nForce]&lt;br /&gt;
    |   |&lt;br /&gt;
    |   \-- MCP APU 												(0:5:0, 0x1b0) [nForce]&lt;br /&gt;
    |&lt;br /&gt;
    |-- AC`97 Audio Codec Interface 									(0:6:0, 0x1b1) [nForce]&lt;br /&gt;
    |&lt;br /&gt;
    |-- Simple Communication Controller - Generic Modem 	(0:6:1, 0x1c1) [???]&lt;br /&gt;
    |&lt;br /&gt;
    |-- IDE Controller 											(0:9:0, 0x1bc) [nForce]&lt;br /&gt;
    |   |&lt;br /&gt;
    |   |-- Primary IDE Channel&lt;br /&gt;
    |   |   |&lt;br /&gt;
    |   |   |-- Seagate ST3210014ACE 10.2gb (8gb used)/Custom Western Digital WD80EB 8gb hard drive&lt;br /&gt;
    |   |   |&lt;br /&gt;
    |   |   \-- Custom Samsung/Phillips/Thompson/LG DVD Drive&lt;br /&gt;
    |   |&lt;br /&gt;
    |   \--- Secondary IDE Channel&lt;br /&gt;
    |&lt;br /&gt;
    |-- PCI Bridge												(0:8:0, 0x1b8) [nForce]&lt;br /&gt;
    |&lt;br /&gt;
    \-- AGP Host to PCI Bridge										(0:30:0, 0x1b7) [nForce]&lt;br /&gt;
        |&lt;br /&gt;
        \-- NV2A GeForce 3MX Integrated GPU/Northbridge 233mHz					(1:0:0, 0x2a0)&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&amp;lt;br /&amp;gt;&lt;br /&gt;
PCI devices have their Bus:Dev:Func numbers as well as the DevID&lt;br /&gt;
printed next to them. PCI devices with &amp;quot;[nForce]&amp;quot; have the same DevIDs as&lt;br /&gt;
their counterparts of the nForce chipset.&lt;br /&gt;
&lt;br /&gt;
A derivative of the Xbox chipset is also available as the PC chipset&lt;br /&gt;
&amp;quot;nVidia nForce&amp;quot;, which consists of a northbridge with the memory&lt;br /&gt;
interface and the GPU and the southbridge with the PCI bus and its&lt;br /&gt;
devices, just like the Xbox chipset. Many of the southbridge PCI devices&lt;br /&gt;
are the same on both versions, i.e. they have the same DevID.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
= The Devices in Detail =&lt;br /&gt;
&lt;br /&gt;
== Intel Pentium III CPU ==&lt;br /&gt;
&lt;br /&gt;
The CPU is a standard Pentium III Coppermine mobile at 733 MHz.  This CPU has been found to be a modified Pentium III, as it has many of the features a Celeron lacks.  Therefore, it can be classified as a Pentium III with a smaller cache. (Regular has 256kb or more, XBox has 128kb)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Flash ROM ==&lt;br /&gt;
&lt;br /&gt;
The Flash ROM is mapped at 0xFFF00000 (if the ROM is 1 MB; 0xFFFC0000, if the ROM is 256 KB) into the  but the Xbox kernel.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== PCI bus, Host Bridge, ISA Bridge, AGP Host to PCI Bridge, Memory Controller ==&lt;br /&gt;
&lt;br /&gt;
These devices are identical to the corresponding devices contained in the nForce chipset. The PCI bus can be accessed like on any PC.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Programmable Interrupt Controller, System Timer, DMA Controller ==&lt;br /&gt;
&lt;br /&gt;
These legacy PC/AT system devices are fully PC-compatible, but the timer frequency is 6% higher than in a PC.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== SMBus Controller ==&lt;br /&gt;
&lt;br /&gt;
Some low-speed devices are connected through the SMBus, so the&lt;br /&gt;
southbridge contains an SMBus controller, compatible to the SMBus&lt;br /&gt;
controller in the nVidia nForce chipset. Since nForce is based on AMD's original chipset for Athlon CPUs, the SMBus controller is AMD-756 compatible.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== PIC16LC ==&lt;br /&gt;
&lt;br /&gt;
The PIC16LC is a small 8 bit processor running at 20 MHz with its&lt;br /&gt;
own ROM, RAM and I/O lines. It controls:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* Power button&lt;br /&gt;
* Eject button&lt;br /&gt;
* Power/error LED&lt;br /&gt;
* DVD tray status (through extra pins to DVD drive)&lt;br /&gt;
* Video cable type (3 pins)&lt;br /&gt;
&lt;br /&gt;
The PIC is always running, even if the Xbox is turned off. When the&lt;br /&gt;
power cable is unplugged, it gets its energy from a capacitor for some&lt;br /&gt;
hours.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Video Encoder ==&lt;br /&gt;
&lt;br /&gt;
The Xbox does not use an ordinary [https://web.archive.org/web/20100617022211/http://en.wikipedia.org/wiki/RAMDAC RAMDAC] for video output. Instead, it employs a &amp;lt;em&amp;gt;video encoder&amp;lt;/em&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
Video encoder is a chip that converts a digital pixel data stream (coming from the nVidia NV2A graphics processor) into analog video signal, just like a RAMDAC would. An ordinary RAMDAC, however, can only output VGA-style RGB signal. The video encoder used in the Xbox is more flexible, and can generate several different types of signals that adhere to various video standards and color formats. These include, but are not necessarily limited to:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* VGA-style &amp;amp;gt;31 kHz RGB, though only with Sync-on-Green sync signals. (If needed, separate HSYNC and VSYNC signals can be obtained from the motherboard, or by building a special video cable with active electronics for stripping and separating the Sync-on-Green sync signal. In any case, separate HSYNC and VSYNC are not available directly through the AV connector.)&lt;br /&gt;
* TV-compatible 15 kHz RGB (with composite sync) &amp;amp;ndash; suitable for European-style SCART RGB output (are progressive 625/50 signals supported?)&lt;br /&gt;
* Component (Y'PbPr) signal, both in SDTV and HDTV resolutions; suitable for American-style &amp;quot;component&amp;quot; output&lt;br /&gt;
* PAL color signal with typical PAL timings (including PAL60), in both composite (CVBS) and s-video (Y/C) formats&lt;br /&gt;
* SECAM color signal with typical SECAM timings, in both composite (CVBS) and s-video (Y/C) formats&lt;br /&gt;
* NTSC color signal with typical NTSC timings, in both composite (CVBS) and s-video (Y/C) formats&lt;br /&gt;
* Black and white composite video signal without a color carrier&lt;br /&gt;
&lt;br /&gt;
The video encoder is also capable of PALplus style Line 23 Wide Screen Signalling (WSS), and the Xbox PIC is rigged with the capability of controlling Scart pin 8 (the ''function switching pin'', which is used as an alternative method of Wide Screen Signalling) and pin 16 (the ''fast switching pin''.)&lt;br /&gt;
&lt;br /&gt;
The make and model of the video encoder has varied through the times &amp;amp;ndash; three different video encoders have been used this far. All three are very similar in their features; they support various modes and are flexible enough to be able to output a VGA compatible signal (which is not supported by the Xbox kernel.) They are, however, not register-compatible.&lt;br /&gt;
&lt;br /&gt;
Two of the video encoders (namely, Conexant CX25871 and Focus FS454) also have extensive scaling and filtering functionality, which allows for [https://web.archive.org/web/20100617022211/http://scanline.ca/overscan/ overscan compensation] in desktop-style &amp;quot;TV out&amp;quot; usage. (This means that the GPU can output ordinary VGA resolutions with VGA timings and the video encoder can convert them to SDTV resolutions with TV-style timings on the fly, adding borders around the image so that a projection of the VGA framebuffer image falls within the &amp;quot;safe area&amp;quot; of the video signal.) The capabilities of the Xcalibur chip, however, remain a mystery in this regard: it is not known whether it has a scaler.&lt;br /&gt;
&lt;br /&gt;
All video encoders are connected to (and controlled via) &amp;lt;a href=&amp;quot;/web/20100617022211/http://www.xbox-linux.org/wiki/SMBus_Controller&amp;quot; title=&amp;quot;SMBus Controller&amp;quot;&amp;gt;IÃÂÃÂÃÂÃÂ²C/SMBus&amp;lt;/a&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Conexant CX25871 ===&lt;br /&gt;
&lt;br /&gt;
[https://web.archive.org/web/20100617022211/http://www.conexant.com:9000/cgi-bin/query?mss=srchprod&amp;amp;amp;pg=q&amp;amp;amp;i=IDXPRODSRCH&amp;amp;amp;q=cx25870 Conexant CX25871] is a close relative of the Brooktree BT868/BT869. There is also a sister model (CX25870) without the Macrovision capability. This chip was used in Xbox versions v1.0 through v1.3. If you follow the link, you will find a product brief and a complete data sheet, with register-level programming information.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Focus FS454 ===&lt;br /&gt;
&lt;br /&gt;
[https://web.archive.org/web/20100617022211/http://www.focusinfo.com/solutions/catalog.asp?id=30 Focus FS454] was used in v1.4 (and possibly v1.5) Xboxes. There is also a sister model (FS453) without the Macrovision capability. The data sheet containing the necessary programming information is available from the manufacturer by separate request. Copies of it have also been seen floating around the net.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Xcalibur ===&lt;br /&gt;
&lt;br /&gt;
The &amp;quot;Xcalibur&amp;quot; video encoder is a custom chip manufactured for Microsoft. It was first used in the Xbox hardware revision 1.6.&lt;br /&gt;
&lt;br /&gt;
The Xbox-Linux support the Xcalibur video encoders is very limited at present (see &amp;lt;a href=&amp;quot;/web/20100617022211/http://www.xbox-linux.org/wiki/Xbox_v1.6_Issues&amp;quot; title=&amp;quot;Xbox v1.6 Issues&amp;quot;&amp;gt;Xbox v1.6 Issues&amp;lt;/a&amp;gt;). The reason for this is that there is, at least currently, no official programming documentation available for this chip. It seems the only way to find out more is through reverse-engineering techniques.&lt;br /&gt;
&lt;br /&gt;
Xboxes that contain the Xcalibur encoder have the firmware ROM and the PIC physically integrated into another MS-specific chip, named Xyclops.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== ADM1032 System Temperature Monitor ==&lt;br /&gt;
&lt;br /&gt;
The Analog Devices ADM1032 is an SMBus device that does temperature&lt;br /&gt;
measurement.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Serial EEPROM ==&lt;br /&gt;
&lt;br /&gt;
The Serial EEPROM holds some settings, such as time zone, language,&lt;br /&gt;
IP address etc., as well as the hard disk key and the Xbox serial number.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== OHCI USB Controller, IDE Controller ==&lt;br /&gt;
&lt;br /&gt;
These devices are compatible to standard PC devices.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== MCP Networking Adapter, MCP APU, Audio Codec Interface ==&lt;br /&gt;
&lt;br /&gt;
These are identical with the nForce devices.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Simple Communication Controller - Generic Modem ==&lt;br /&gt;
&lt;br /&gt;
Nothing is known about the purpose of this device. It never gets&lt;br /&gt;
used by the Xbox system software. It is probably there, because the nForce has a PCI softmodem, but in the Xbox, the corresponding lines of the Southbridge don't seem to be connected.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== NV2A GeForce3 Integrated GPU ==&lt;br /&gt;
&lt;br /&gt;
The Xbox graphics hardware is VGA compatible and very similar to&lt;br /&gt;
existing nVidia graphics cards.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
= Further Information =&lt;br /&gt;
&lt;br /&gt;
Information about all chips and links to technical documentation can&lt;br /&gt;
be found at &lt;br /&gt;
[https://web.archive.org/web/20100617022211/http://www.console-dev.com/xbox.htm Pixel8's site]&lt;br /&gt;
somehting&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=SMBus&amp;diff=5540</id>
		<title>SMBus</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=SMBus&amp;diff=5540"/>
				<updated>2017-05-29T12:20:54Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: Created page with &amp;quot;Retreived from http://www.xbox-linux.org/wiki/SMBus_Controller  by ''Michael Steil'' (original version: 15/26 June 2002)  All non-PC components of the Xbox console are connect...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Retreived from http://www.xbox-linux.org/wiki/SMBus_Controller&lt;br /&gt;
&lt;br /&gt;
by ''Michael Steil'' (original version: 15/26 June 2002)&lt;br /&gt;
&lt;br /&gt;
All non-PC components of the Xbox console are connected through an I²C/SMbus interface. I²C/SMBus is a slow low-cost serial bus with each device having a unique 7-bit ID. (Wikipedia has informative articles about [https://web.archive.org/web/20100617015507/http://en.wikipedia.org/wiki/I2c I²C] and [https://web.archive.org/web/20100617015507/http://en.wikipedia.org/wiki/SMBus SMBus], you might want to check them out.)&lt;br /&gt;
&lt;br /&gt;
There are only two operations of an SMBus controller: write and read. Writing means that an 8 bit command code and an 8 or 16 bit operand are sent to an SMBus device. Reading means that an 8 bit command code is sent to the device and an 8 or 16 bit answer is expected.&lt;br /&gt;
&lt;br /&gt;
The controller for the SMBus interface in the Xbox is a PCI device with the DevID 01B4 and it is built into MPCX southbridge.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==SMBus Controller Port Layout==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|  '''Port'''&lt;br /&gt;
|  Description''''''&lt;br /&gt;
|-&lt;br /&gt;
|  0xc000&lt;br /&gt;
|  '''Status'''&lt;br /&gt;
&lt;br /&gt;
bit 0: abort &lt;br /&gt;
&lt;br /&gt;
bit 1: collision &lt;br /&gt;
&lt;br /&gt;
bit 2: protocol error &lt;br /&gt;
&lt;br /&gt;
bit 3: busy &lt;br /&gt;
&lt;br /&gt;
bit 4: cycle complete &lt;br /&gt;
&lt;br /&gt;
bit 5: timeout&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|  0xc002&lt;br /&gt;
|  '''Control'''&lt;br /&gt;
&lt;br /&gt;
bit 2-0: cycle type &lt;br /&gt;
&lt;br /&gt;
bit 3: start &lt;br /&gt;
&lt;br /&gt;
bit 4: enable interrupt &lt;br /&gt;
&lt;br /&gt;
bit 5: abort&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|  0xc004&lt;br /&gt;
|  '''Address'''&lt;br /&gt;
|-&lt;br /&gt;
|  0xc006&lt;br /&gt;
|  '''Data'''&lt;br /&gt;
|-&lt;br /&gt;
|  0xc008&lt;br /&gt;
|  '''Command'''&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
This is very similar (but not identical) to the AMD756/AMD766/AMD768 SMBus controllers. The [https://web.archive.org/web/20100617015507/http://www.lm-sensors.nu/ lm_sensors project] includes GPLed Linux kernel code for it since version 2.6.4 (kernel/busses/i2c-amd756.c).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==SMBus Controller Programming==&lt;br /&gt;
&lt;br /&gt;
The following two routines illustrate how to read and write data from and to an SMBus device:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt; int SMBusWriteCommand(unsigned char slave, unsigned char command, int isWord, unsigned short data) {&lt;br /&gt;
 again:&lt;br /&gt;
     _outp(0xc004, (slave&amp;amp;lt;&amp;amp;lt;1)&amp;amp;amp;0xfe);&lt;br /&gt;
     _outp(0xc008, command);&lt;br /&gt;
     _outpw(0xc006, data);&lt;br /&gt;
     _outpw(0xc000, _inpw(0xc000));&lt;br /&gt;
     _outp(0xc002, (isWord)&amp;amp;nbsp;? 0x0b&amp;amp;nbsp;: 0x0a);&lt;br /&gt;
     while ((_inp(0xc000) &amp;amp;amp; 8)); /* wait while busy */&lt;br /&gt;
     if (_inp(0xc000) &amp;amp;amp; 0x02) goto again; /* retry transmission */&lt;br /&gt;
     if (_inp(0xc000) &amp;amp;amp; 0x34) return 0;  /* fatal error */&lt;br /&gt;
     return 1;&lt;br /&gt;
 }&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&amp;lt;pre&amp;gt; int SMBusReadCommand(unsigned char slave, unsigned char command, int isWord, unsigned short *data) {&lt;br /&gt;
 again:&lt;br /&gt;
     _outp(0xc004, (slave&amp;amp;lt;&amp;amp;lt;1)|0x01);&lt;br /&gt;
     _outp(0xc008, command);&lt;br /&gt;
     _outpw(0xc000, _inpw(0xc000));&lt;br /&gt;
     _outp(0xc002, (isWord)&amp;amp;nbsp;? 0x0b&amp;amp;nbsp;: 0x0a);&lt;br /&gt;
     while ((_inp(0xc000) &amp;amp;amp; 8)); /* wait while busy */&lt;br /&gt;
     if (_inp(0xc000) &amp;amp;amp; 0x02) goto again; /* retry transmission */&lt;br /&gt;
     if (_inp(0xc000) &amp;amp;amp; 0x34) return 0;  /* fatal error */&lt;br /&gt;
     *data = _inpw(0xc006);&lt;br /&gt;
     return 1;&lt;br /&gt;
 }&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&amp;lt;br /&amp;gt;&lt;br /&gt;
To avoid busy waiting of the CPU, the SMBus controller can also issue an interrupt when the operation is complete, by setting bit #4 in the control port when initiating the transfer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Xbox SMBus Devices==&lt;br /&gt;
&lt;br /&gt;
The following four devices are connected to the Xbox SMBus:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|  '''Device'''&lt;br /&gt;
|  '''Hardware Address'''&lt;br /&gt;
|  '''Software Address'''&lt;br /&gt;
|-&lt;br /&gt;
|  PIC16LC&lt;br /&gt;
|  0x10&lt;br /&gt;
|  0x20&lt;br /&gt;
|-&lt;br /&gt;
|  Conexant CX25871 Video Encoder&lt;br /&gt;
|  0x45&lt;br /&gt;
|  0x8a&lt;br /&gt;
|-&lt;br /&gt;
|  ADM1032 System Temperature Monitor&lt;br /&gt;
|  0x4c&lt;br /&gt;
|  0x98&lt;br /&gt;
|-&lt;br /&gt;
|  Serial EEPROM&lt;br /&gt;
|  0x54&lt;br /&gt;
|  0xa8&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Do not confuse the hardware with the software addresses: The software ID is the hardware ID shifted by one bit left. The code above expects the hardware ID.&lt;br /&gt;
&lt;br /&gt;
Actually, these addresses are not literally accurate; you find that the hardware address is 0x54 for the EEPROM: the actual address of the EEPROM on the i2c bus is 1010 (0xa), however, you will also notice that 0x54 is '''1010'''100 in binary, and it seems that this 100 is also appended onto the other devices as well (although their software address is naturally read as say '''1010'''1000 - obviously because of the left shifting, however, it could be speculated that it would be possible to communicate with devices over the SMBus that are connected via i2c, so long as you knew their base address.&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Boot_Process&amp;diff=5539</id>
		<title>Boot Process</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Boot_Process&amp;diff=5539"/>
				<updated>2017-05-29T12:19:04Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: /* Overview */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Overview ==&lt;br /&gt;
&lt;br /&gt;
The Xbox has a 256 KB ROM containing the startup animation and sound, as well as the Xbox kernel, which contains a stripped down version of the Windows 2000 (NT 5.0) microkernel, the HAL, filesystems, as well as HD and DVD drivers.&lt;br /&gt;
&lt;br /&gt;
When the Xbox is turned on, the software in ROM is decompressed into RAM, and the kernel initializes the hardware. Because there are no audio or video drivers in the kernel, the startup code plays the animation and sound by accessing the registers of the hardware directly. As soon as the Xbox logo is on the display, the kernel unlocks the hard disk and checks whether there is a valid game medium in the DVD drive. If not, the file xboxdash.xbe gets loaded from partition #3. In either case, the Microsoft logo is shown below the Xbox logo and the executable is started. If an error occurs (no/wrong hard disk, wrong signature, ...), the boot loader shows an error screen and halts.&lt;br /&gt;
&lt;br /&gt;
== MCPX ==&lt;br /&gt;
&lt;br /&gt;
Certain things are still missing, for example, getting the CPU to 32 bit protected mode and enabling caching.{{FIXME}}&lt;br /&gt;
&lt;br /&gt;
=== Xcodes ===&lt;br /&gt;
&lt;br /&gt;
The xcode interpreter is common through both versions of the MCPX ROM. The high level interpretation of the MCPX ROM might look like this:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
void xcode_interpreter() {&lt;br /&gt;
    int run_xcodes = 1;&lt;br /&gt;
    uint32_t eip = 0xff000080; // Not really EIP. This is just a pointer to the next xcode&lt;br /&gt;
    uint32_t result, scratch = 0;&lt;br /&gt;
    while (run_xcodes) {&lt;br /&gt;
        opcode    = get_memory_byte(eip);&lt;br /&gt;
        operand_1 = get_memory_dword(eip+1);&lt;br /&gt;
        operand_2 = get_memory_dword(eip+5);&lt;br /&gt;
&lt;br /&gt;
        if (opcode == 0x07) {&lt;br /&gt;
            opcode    = operand_1;&lt;br /&gt;
            operand_1 = operand_2;&lt;br /&gt;
            operand_2 = result;&lt;br /&gt;
        }&lt;br /&gt;
&lt;br /&gt;
        switch (opcode) {&lt;br /&gt;
            case 0x02:&lt;br /&gt;
                result = get_memory_dword(operand_1 &amp;amp; 0x0fffffff);&lt;br /&gt;
                break;&lt;br /&gt;
            case 0x03:&lt;br /&gt;
                set_memory_dword(operand_1) = operand_2;&lt;br /&gt;
                break;&lt;br /&gt;
            case 0x06:&lt;br /&gt;
                result = (result &amp;amp; operand_1) | operand_2;&lt;br /&gt;
                break;&lt;br /&gt;
            case 0x04:&lt;br /&gt;
                if (operand_1 == 0x80000880) {&lt;br /&gt;
                    operand_2 &amp;amp;= 0xfffffffd;&lt;br /&gt;
                }&lt;br /&gt;
                outl(operand_1, 0xcf8);&lt;br /&gt;
                outl(operand_2, 0xcfc);&lt;br /&gt;
                break;&lt;br /&gt;
            case 0x05:&lt;br /&gt;
                outl(operand_1, 0xcf8);&lt;br /&gt;
                result = inl(0xcfc);&lt;br /&gt;
                break;&lt;br /&gt;
            case 0x08:&lt;br /&gt;
                if (result != operand_1) {&lt;br /&gt;
                    eip += operand_2;&lt;br /&gt;
                }&lt;br /&gt;
                break;&lt;br /&gt;
            case 0x09:&lt;br /&gt;
                eip += operand_2;&lt;br /&gt;
                break;&lt;br /&gt;
            case 0x10:&lt;br /&gt;
                scratch = (scratch &amp;amp; operand_1) | operand_2;&lt;br /&gt;
                result = scratch;&lt;br /&gt;
                break;&lt;br /&gt;
            case 0x11:&lt;br /&gt;
                outb(operand_2, operand_1);&lt;br /&gt;
                break;&lt;br /&gt;
            case 0x12:&lt;br /&gt;
                result = inb(operand_1);&lt;br /&gt;
                break;&lt;br /&gt;
            case 0xee:&lt;br /&gt;
                run_xcodes = 0;&lt;br /&gt;
            default:&lt;br /&gt;
                break;&lt;br /&gt;
        }&lt;br /&gt;
&lt;br /&gt;
        eip += 9;&lt;br /&gt;
    }&lt;br /&gt;
}&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== RC4 Decryption of the 2BL ===&lt;br /&gt;
&lt;br /&gt;
Decryption of the 2BL seems to happen in 4 stages.&lt;br /&gt;
&lt;br /&gt;
==== Stage 1 ====&lt;br /&gt;
&lt;br /&gt;
Initialising the working space. The MCPX ROM seems to just write 1, 2, 3, 4.... 253, 254, 255 in memory addresses 0x8f000 to 0x850FF. This might look something like:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
void init_rc4() {&lt;br /&gt;
    uint32_t stack_pointer = 0x8f000;&lt;br /&gt;
&lt;br /&gt;
    for (int iterator = 0; iterator &amp;lt;= 255; iterator++) {&lt;br /&gt;
        set_memory_byte(stack_pointer + iterator, iterator);&lt;br /&gt;
    }&lt;br /&gt;
}&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== Stage 2 ====&lt;br /&gt;
&lt;br /&gt;
Preparing for decryption. This gets the key from memory location 0xFFFFFFA5 and starts preparing and environment for decryption of the 2BL.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
void load_key() {&lt;br /&gt;
    uint32_t key_location = 0xffffffa5;&lt;br /&gt;
    uint32_t stack_pointer = 0x8f000;&lt;br /&gt;
    uint8_t i, j = 0;&lt;br /&gt;
&lt;br /&gt;
    for (int iterator = 0; iterator &amp;lt;= 255; iterator++) {&lt;br /&gt;
        i = get_memory_byte(iterator + stack_pointer);&lt;br /&gt;
        j += i + get_memory_byte(key_location + (iterator % 16));&lt;br /&gt;
        set_memory_byte(iterator+stack_pointer, get_memory_byte(j+stack_pointer));&lt;br /&gt;
        set_memory_byte(j+stack_pointer, i);&lt;br /&gt;
    }&lt;br /&gt;
}&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== Stage 3 ====&lt;br /&gt;
&lt;br /&gt;
Perform the decryption. The MCPX reads the 2BL from 0xFFFF9E00 and decrypts it to 0x00090000. It is 24KiB in size.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
void decrypt() {&lt;br /&gt;
    uint32_t stack_pointer = 0x0008F000;&lt;br /&gt;
    uint32_t encrypted = 0xFFFF9E00;&lt;br /&gt;
    uint32_t decrypted = 0x00090000;&lt;br /&gt;
&lt;br /&gt;
    uint8_t a, b, j, i = 0;&lt;br /&gt;
&lt;br /&gt;
    i = get_memory_byte(stack_pointer + 0x100); // 0&lt;br /&gt;
    j = get_memory_byte(stack_pointer + 0x101); // 0&lt;br /&gt;
&lt;br /&gt;
    for (int edi = 0; edi &amp;lt;= 0x6000; ++edi) {&lt;br /&gt;
        ++i;&lt;br /&gt;
&lt;br /&gt;
        a = get_memory_byte(stack_pointer + i);&lt;br /&gt;
        j += a;&lt;br /&gt;
        b = get_memory_byte(stack_pointer + j);&lt;br /&gt;
        set_memory_byte(stack_pointer + i, b);&lt;br /&gt;
        set_memory_byte(stack_pointer + j, a);&lt;br /&gt;
        a += b;&lt;br /&gt;
        b = get_memory_byte(edi + encrypted);&lt;br /&gt;
        a = get_memory_byte(stack_pointer + a);&lt;br /&gt;
        b ^= a;&lt;br /&gt;
        set_memory_byte(edi + decrypted, b);&lt;br /&gt;
    }&lt;br /&gt;
}&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== Stage 4 ====&lt;br /&gt;
&lt;br /&gt;
Verification. Finally the MCPX reads a string from the un-encrypted 2BL and compares it to a magic number. If it matches, all was successful, and we jump to the start of the 2BL to start decrypting the kernel.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
void verify() {&lt;br /&gt;
    if (get_memory_dword(0x95FE4) == MAGIC_NUMBER) {&lt;br /&gt;
        eip = 0x900000;&lt;br /&gt;
    } else {&lt;br /&gt;
        // Else, things have gone wrong&lt;br /&gt;
        eip = 0xFFFFFF94;&lt;br /&gt;
    }&lt;br /&gt;
}&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Notes ===&lt;br /&gt;
&lt;br /&gt;
The RC4 algorithm was included as part of MCPX 1.0 and seems to work fine with BIOS versions 3944, 4034, and 4134.&lt;br /&gt;
&lt;br /&gt;
== 2BL ==&lt;br /&gt;
&lt;br /&gt;
Certain parts are still missing&lt;br /&gt;
&lt;br /&gt;
=== MTRR Setup ===&lt;br /&gt;
&lt;br /&gt;
First, the cache is disabled.{{FIXME}}&lt;br /&gt;
Then, the MTRR (Memory Type Range Register) will be setup (using &amp;lt;code&amp;gt;wrmsr&amp;lt;/code&amp;gt;) in the following way:&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! MTRR (ecx) !! High value (edx) !! Low value (eax) !! Notes&lt;br /&gt;
|-&lt;br /&gt;
|0x200 || 0x00000000 || 0x00000006 ||&lt;br /&gt;
|-&lt;br /&gt;
| rowspan = &amp;quot;2&amp;quot; | 0x201 || rowspan = &amp;quot;2&amp;quot; | 0x0000000F || 0xFC000800 || ''(For 64 MiB RAM BIOS)''&lt;br /&gt;
|-&lt;br /&gt;
|0xF8000800 || (''For 128 MiB RAM BIOS'')&lt;br /&gt;
|-&lt;br /&gt;
|0x202 || 0x00000000 || 0xFFF80005 ||&lt;br /&gt;
|-&lt;br /&gt;
|0x203 || 0x0000000F || 0xFFF80800 ||&lt;br /&gt;
|-&lt;br /&gt;
|0x204 || 0x00000000 || 0x00000000 || rowspan=&amp;quot;3&amp;quot; | Clear all unused MTRR&lt;br /&gt;
|-&lt;br /&gt;
| colspan = &amp;quot;3&amp;quot; | ...&lt;br /&gt;
|-&lt;br /&gt;
|0x20F || 0x00000000 || 0x00000000&lt;br /&gt;
|-&lt;br /&gt;
|0x2FF || 0x00000000 || 0x00000800 ||&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Once the MTRR have been written, the cache is enabled.{{FIXME}}&lt;br /&gt;
&lt;br /&gt;
=== Register setup ===&lt;br /&gt;
&lt;br /&gt;
Now the 2BL will set up the segment registers{{FIXME|reason=why?!}} and stack:&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Register !! Value !! Notes&lt;br /&gt;
|-&lt;br /&gt;
|ds || 0x0010 || rowspan=&amp;quot;3&amp;quot; | Data segment{{citation needed}}&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|es || 0x0010&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|ss || 0x0010&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|esp || 0x00400000 ||&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|fs || 0x0000 ||&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
|gs || 0x0000 ||&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Self-copy ===&lt;br /&gt;
&lt;br /&gt;
Now the 2BL copies itself (24 kiB) from 0x00900000 to memory address 0x00400000.&lt;br /&gt;
&lt;br /&gt;
=== Paging ===&lt;br /&gt;
&lt;br /&gt;
Now a PDE is prepared at address 0x0000F000:&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Offset in PDE !! Value !! Notes&lt;br /&gt;
|-&lt;br /&gt;
|0x000 || 0x000000E3 || rowspan=&amp;quot;7&amp;quot; | Identity maps the first 256MiB of RAM: 0x00000000 and 0x80000000 will both map to physical page 0 &amp;lt;br&amp;gt;&amp;lt;br&amp;gt; 0xE3: Flags: &amp;lt;br&amp;gt; * 0x80: 4 MiB page &amp;lt;br&amp;gt; * 0x40: Marked as previously written (Dirty) &amp;lt;br&amp;gt; * 0x20: Marked as previously accessed &amp;lt;br&amp;gt; * 0x02: Read/Write &amp;lt;br&amp;gt; * 0x01: Present&lt;br /&gt;
|-&lt;br /&gt;
|0x800 || 0x000000E3&lt;br /&gt;
|-&lt;br /&gt;
|0x004 || 0x004000E3&lt;br /&gt;
|-&lt;br /&gt;
|0x804 || 0x004000E3&lt;br /&gt;
|-&lt;br /&gt;
| colspan=&amp;quot;2&amp;quot; | ...&lt;br /&gt;
|-&lt;br /&gt;
|0x8FC || 0x0FC000E3&lt;br /&gt;
|-&lt;br /&gt;
|0x0FC || 0x0FC000E3&lt;br /&gt;
|-&lt;br /&gt;
|0x900 || 0x00000000 || rowspan=&amp;quot;5&amp;quot; | Unmapping the rest of the pages&lt;br /&gt;
|-&lt;br /&gt;
|0x100 || 0x00000000&lt;br /&gt;
|-&lt;br /&gt;
| colspan=&amp;quot;2&amp;quot; | ...&lt;br /&gt;
|-&lt;br /&gt;
|0xFFC || 0x00000000&lt;br /&gt;
|-&lt;br /&gt;
|0x7FC || 0x00000000&lt;br /&gt;
|-&lt;br /&gt;
|0xC00 || 0x0000F063 || Maps the PDE (4 kiB page) to address 0xC0000000 &amp;lt;br&amp;gt;&amp;lt;br&amp;gt; 0x63: Flags: &amp;lt;br&amp;gt; * 0x40: Marked as previously written (Dirty) &amp;lt;br&amp;gt; * 0x20: Marked as previously accessed &amp;lt;br&amp;gt; * 0x02: Read/Write &amp;lt;br&amp;gt; * 0x01: Present&lt;br /&gt;
|-&lt;br /&gt;
|0xFFC || 0xFFC000E3 || Identity maps the upper portion of the Flash (4 MiB page) to address 0xFFC00000 &amp;lt;br&amp;gt;&amp;lt;br&amp;gt; 0xE3: Flags: &amp;lt;br&amp;gt; * 0x80: 4 MiB page &amp;lt;br&amp;gt; * 0x40: Marked as previously written (Dirty) &amp;lt;br&amp;gt; * 0x20: Marked as previously accessed &amp;lt;br&amp;gt; * 0x02: Read/Write &amp;lt;br&amp;gt; * 0x01: Present&lt;br /&gt;
|-&lt;br /&gt;
|0xFD0 || 0xFD0000FB || rowspan=&amp;quot;4&amp;quot; | Maps 16 MiB for the GPU control registers &amp;lt;br&amp;gt;&amp;lt;br&amp;gt; 0xFB: Flags: &amp;lt;br&amp;gt; * 0x80: 4 MiB page &amp;lt;br&amp;gt; * 0x40: Marked as previously written (Dirty) &amp;lt;br&amp;gt; * 0x20: Marked as previously accessed &amp;lt;br&amp;gt; * 0x10: Cache disabled &amp;lt;br&amp;gt; * 0x08: Write-Through caching &amp;lt;br&amp;gt; * 0x02: Read/Write &amp;lt;br&amp;gt; * 0x01: Present&lt;br /&gt;
|-&lt;br /&gt;
|0xFD4 || 0xFD4000FB&lt;br /&gt;
|-&lt;br /&gt;
|0xFD8 || 0xFD8000FB&lt;br /&gt;
|-&lt;br /&gt;
|0xFDC || 0xFDC000FB&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
After setting up the PDE, the PAT is set up using &amp;lt;code&amp;gt;wrmsr&amp;lt;/code&amp;gt;: {{FIXME}}&lt;br /&gt;
&lt;br /&gt;
CR4 is touched {{FIXME}}&lt;br /&gt;
&lt;br /&gt;
CR3 is touched {{FIXME}}&lt;br /&gt;
&lt;br /&gt;
Now paging is activated by enabling the PG and WP bits in CR0.&lt;br /&gt;
Additionally, the same &amp;lt;code&amp;gt;or&amp;lt;/code&amp;gt; instruction is used to enable the NE bit in cr0.&lt;br /&gt;
&lt;br /&gt;
=== 2BL main ===&lt;br /&gt;
&lt;br /&gt;
esp is now also reloaded to point at the relocated address. It will be set to 0x80400000 (absolute value, independent of previous esp value).&lt;br /&gt;
The 2BL will now &amp;lt;code&amp;gt;call&amp;lt;/code&amp;gt; into the relocated 2BL code somewhere near 0x00400000.&lt;br /&gt;
&lt;br /&gt;
==== Disabling of the MCPX ROM ====&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
out32(0xCF8, 0x80000880);&lt;br /&gt;
out8(0xCFC, 0x02);&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== SMC handling ====&lt;br /&gt;
&lt;br /&gt;
The [[SMC]] has a watchdog functionality which must be turned off.&lt;br /&gt;
This is done by querying the SMC registers 0x1C - 0x1F.&lt;br /&gt;
If all of them are 0x00 the 2BL will shutdown the system{{FIXME}}.&lt;br /&gt;
If this is not the case, the bootloader calculates the watchdog challenge response and sends it to SMC registers 0x20 and 0x21.&lt;br /&gt;
&lt;br /&gt;
Additionally, the 2BL will set SMC register 0x01 to 0 (which resets the cursor position for reading the SMC revision information).&lt;br /&gt;
&lt;br /&gt;
==== Enable IDE and NIC ====&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
out32(0xCF8, 0x8000088C);&lt;br /&gt;
out32(0xCFC, 0x40000000);&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== Memory cleanup ====&lt;br /&gt;
&lt;br /&gt;
The 2BL fills memory with 0xCC from 0x80090000 to 0x80095FFF. These are the 24 kiB where the 2BL was stored previously.&lt;br /&gt;
&lt;br /&gt;
==== Setup RAM timing ====&lt;br /&gt;
&lt;br /&gt;
Not described yet, this is complicated{{FIXME}}.&lt;br /&gt;
This got a lot more complicated when Microsoft started using different RAM sometime after [[Hardware Revisions#1.6|Hardware Revision 1.6]] was already out.&lt;br /&gt;
&lt;br /&gt;
==== Weird stuff 2 ====&lt;br /&gt;
&lt;br /&gt;
This does some PCI config, use unknown{{FIXME}}.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
out32(0xCF8, 0x80000854);&lt;br /&gt;
out32(0xCFC, in32(0xCFC) | 0x88000000);&lt;br /&gt;
&lt;br /&gt;
out32(0xCF8, 0x80000064);&lt;br /&gt;
out32(0xCFC, in32(0xCFC) | 0x88000000);&lt;br /&gt;
&lt;br /&gt;
out32(0xCF8, 0x8000006C);&lt;br /&gt;
uint32_t tmp = in32(0xCFC);&lt;br /&gt;
out32(0xCFC, tmp &amp;amp; 0xFFFFFFFE);&lt;br /&gt;
out32(0xCFC, tmp);&lt;br /&gt;
&lt;br /&gt;
out32(0xCF8, 0x80000080);&lt;br /&gt;
out32(0xCFC, 0x00000100);&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== Weird stuff 3 ====&lt;br /&gt;
&lt;br /&gt;
{{FIXME|reason=Why?}}&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
out32(0xCF8, 0x80000808);&lt;br /&gt;
uint8_t mcpx_revision = in8(0xCFC);    &lt;br /&gt;
&lt;br /&gt;
if (mcpx_revision &amp;gt;= 0xD1) {&lt;br /&gt;
  out32(0xCF8, 0x800008C8);&lt;br /&gt;
  out32(0xCFC, 0x00008F00);&lt;br /&gt;
}&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== Loading the kernel ====&lt;br /&gt;
===== Kernel-copy =====&lt;br /&gt;
&lt;br /&gt;
The Kernel is now copied into RAM.&lt;br /&gt;
&lt;br /&gt;
===== Kernel decryption =====&lt;br /&gt;
&lt;br /&gt;
The 2BL will copy the kernel decryption key (16 bytes) from offset 32 of an array of 3 keys:&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Offset !! Use&lt;br /&gt;
|-&lt;br /&gt;
| 0 || EEPROM key&lt;br /&gt;
|-&lt;br /&gt;
| 16 || Certificate key&lt;br /&gt;
|-&lt;br /&gt;
| 32 || Kernel key&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
The Kernel is then decrypted in-place using RC4.&lt;br /&gt;
&lt;br /&gt;
===== Kernel decompression =====&lt;br /&gt;
&lt;br /&gt;
The Kernel is decompressed directly to 0x80010000 where it will reside until a full system shutdown.&lt;br /&gt;
&lt;br /&gt;
==== Running the kernel ====&lt;br /&gt;
&lt;br /&gt;
The xboxkrnl.exe header at 0x8001000 is checked{{FIXME|reason=how?}}.&lt;br /&gt;
If it is invalid, {{FIXME}}.&lt;br /&gt;
If it is valid, the kernel entry point is looked up from the PE optional header. The hardcoded image base of 0x8001000 is added to the entry point.&lt;br /&gt;
The entry-point is now being called. Argumnts are passed on the stack, from right to left.&lt;br /&gt;
The first argument is a commandline string loaded from memory address 0x80400000. It is an empty string for retail BIOS{{FIXME|reason=Mention options for debug bioses here}}.&lt;br /&gt;
A pointer to the previously mentioned array of 3 keys is passed as the second argument.&lt;br /&gt;
&lt;br /&gt;
== Kernel ==&lt;br /&gt;
&lt;br /&gt;
=== Startup animation ===&lt;br /&gt;
&lt;br /&gt;
=== Kernel Re-initialization ===&lt;br /&gt;
&lt;br /&gt;
== References ==&lt;br /&gt;
&lt;br /&gt;
* [http://hackspot.net/XboxBlog/?p=1 Understanding the Xbox boot process]&lt;br /&gt;
* [https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Boot ROM] (I cannot express enough just how helpful this page is)&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=EEPROM&amp;diff=5538</id>
		<title>EEPROM</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=EEPROM&amp;diff=5538"/>
				<updated>2017-05-29T12:18:02Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.&lt;br /&gt;
&lt;br /&gt;
The Chihiro EEPROM key is &amp;lt;code&amp;gt;7B 35 A8 B7 27 ED 43 7A A0 BA FB 8F A4 38 61 80&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Chip Models ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Xbox Model&lt;br /&gt;
! Manufacturer&lt;br /&gt;
! Model&lt;br /&gt;
|-&lt;br /&gt;
| 1.4 (Others?)&lt;br /&gt;
| Catalyst&lt;br /&gt;
| CAT24WC02J&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Contents ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Start !! End !! Notes&lt;br /&gt;
|-&lt;br /&gt;
| 0x00&lt;br /&gt;
| 0x13&lt;br /&gt;
| HMAC_SHA1 Hash&lt;br /&gt;
|-&lt;br /&gt;
| 0x14&lt;br /&gt;
| 0x1B&lt;br /&gt;
| RC4 Encrypted Confounder ??&lt;br /&gt;
|-&lt;br /&gt;
| 0x1C&lt;br /&gt;
| 0x2B&lt;br /&gt;
| RC4 Encrypted HDD key&lt;br /&gt;
|-&lt;br /&gt;
| 0x2C&lt;br /&gt;
| 0x2F&lt;br /&gt;
| RC4 Encrypted Region code (0x01 North America, 0x02 Japan, 0x04 Europe)&lt;br /&gt;
|-&lt;br /&gt;
| 0x30&lt;br /&gt;
| 0x33&lt;br /&gt;
| Checksum of next 44 bytes&lt;br /&gt;
|-&lt;br /&gt;
| 0x34&lt;br /&gt;
| 0x3F&lt;br /&gt;
| Xbox serial number&lt;br /&gt;
|-&lt;br /&gt;
| 0x40&lt;br /&gt;
| 0x45&lt;br /&gt;
| Ethernet MAC address&lt;br /&gt;
|-&lt;br /&gt;
| 0x46&lt;br /&gt;
| 0x47&lt;br /&gt;
|  Unknown Padding ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x48&lt;br /&gt;
| 0x57&lt;br /&gt;
| Online Key ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x58&lt;br /&gt;
| 0x5B&lt;br /&gt;
|  ** 0x00014000 = NTSC, 0x00038000 = PAL&lt;br /&gt;
|-&lt;br /&gt;
| 0x5C&lt;br /&gt;
| 0x5F&lt;br /&gt;
|  Unknown Padding ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x60&lt;br /&gt;
| 0x63&lt;br /&gt;
| other Checksum of next&lt;br /&gt;
|-&lt;br /&gt;
| 0x64&lt;br /&gt;
| 0x67&lt;br /&gt;
| Zone Bias?&lt;br /&gt;
|-&lt;br /&gt;
| 0x68&lt;br /&gt;
| 0x6B&lt;br /&gt;
| Standard timezone&lt;br /&gt;
|-&lt;br /&gt;
| 0x5C&lt;br /&gt;
| 0x6F&lt;br /&gt;
| Daylight timezone&lt;br /&gt;
|-&lt;br /&gt;
| 0x70&lt;br /&gt;
| 0x77&lt;br /&gt;
| Unknown Padding ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x78&lt;br /&gt;
| 0x7B&lt;br /&gt;
| 10-05-00-02 (Month-Day-DayOfWeek-Hour)&lt;br /&gt;
|-&lt;br /&gt;
| 0x7C&lt;br /&gt;
| 0x7F&lt;br /&gt;
| 04-01-00-02 (Month-Day-DayOfWeek-Hour)&lt;br /&gt;
|-&lt;br /&gt;
| 0x80&lt;br /&gt;
| 0x87&lt;br /&gt;
| Unknown Padding ?&lt;br /&gt;
|-&lt;br /&gt;
| 0x88&lt;br /&gt;
| 0x8B&lt;br /&gt;
| Standard Bias?&lt;br /&gt;
|-&lt;br /&gt;
| 0x8C&lt;br /&gt;
| 0x8F&lt;br /&gt;
| Daylight Bias?&lt;br /&gt;
|-&lt;br /&gt;
| 0x90&lt;br /&gt;
| 0x93&lt;br /&gt;
| Language ID&lt;br /&gt;
|-&lt;br /&gt;
| 0x94&lt;br /&gt;
| 0x97&lt;br /&gt;
| Video Settings&lt;br /&gt;
|-&lt;br /&gt;
| 0x98&lt;br /&gt;
| 0x9B&lt;br /&gt;
| Audio Settings&lt;br /&gt;
|-&lt;br /&gt;
| 0x9C&lt;br /&gt;
| 0x9F&lt;br /&gt;
| 0=MAX rating&lt;br /&gt;
|-&lt;br /&gt;
| 0xA0&lt;br /&gt;
| 0xA3&lt;br /&gt;
| 7=X, 8=Y, B=LTrigger, C=RTrigger&lt;br /&gt;
|-&lt;br /&gt;
| 0xA4&lt;br /&gt;
| 0xA7&lt;br /&gt;
| 0=Max rating&lt;br /&gt;
|-&lt;br /&gt;
| 0xA8&lt;br /&gt;
| 0xAB&lt;br /&gt;
| XBOX Live IP Address..&lt;br /&gt;
|-&lt;br /&gt;
| 0xAC&lt;br /&gt;
| 0xAF&lt;br /&gt;
| XBOX Live DNS Server..&lt;br /&gt;
|-&lt;br /&gt;
| 0xB0&lt;br /&gt;
| 0xB3&lt;br /&gt;
| XBOX Live Gateway Address..&lt;br /&gt;
|-&lt;br /&gt;
| 0xB4&lt;br /&gt;
| 0xB7&lt;br /&gt;
| XBOX Live Subnet Mask..&lt;br /&gt;
|-&lt;br /&gt;
| 0xA8&lt;br /&gt;
| 0xBB&lt;br /&gt;
| Other XBLive settings ?&lt;br /&gt;
|-&lt;br /&gt;
| 0xBC&lt;br /&gt;
| 0xBF&lt;br /&gt;
| DVD Playback Kit Zone&lt;br /&gt;
|-&lt;br /&gt;
| 0xC0&lt;br /&gt;
| 0xFF&lt;br /&gt;
| Unknown Codes / History ?&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].&lt;br /&gt;
&lt;br /&gt;
== Reading/Writing the EEPROM ==&lt;br /&gt;
&lt;br /&gt;
=== Software Method ===&lt;br /&gt;
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.&lt;br /&gt;
&lt;br /&gt;
=== Hardware Method ===&lt;br /&gt;
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see [http://dangerousprototypes.com/blog/bus-pirate-manual/ here]&lt;br /&gt;
or [https://www.totalphase.com/products/aardvark-i2cspi/ here]), build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. Then use the corresponding software to read/write the EEPROM.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==The HMAC HDD Key==&lt;br /&gt;
&lt;br /&gt;
The HMAC HDD Key is generated out of the first 48 bytes. This section has been identified clearly.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==The Region Code==&lt;br /&gt;
&lt;br /&gt;
This DWORD is encrypted. It corresponds to the region code in the XBE header:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|  1&lt;br /&gt;
|  North America&lt;br /&gt;
|-&lt;br /&gt;
|  2&lt;br /&gt;
|  Japan&lt;br /&gt;
|-&lt;br /&gt;
|  4&lt;br /&gt;
|  Europe/Australia&lt;br /&gt;
|-&lt;br /&gt;
|  0x80000000&lt;br /&gt;
|  Manufacturing plant&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==The Serial Number==&lt;br /&gt;
&amp;lt;pre&amp;gt;     1166356 20903&lt;br /&gt;
     ||    | |||||__&lt;br /&gt;
     ||    | ||||___ factory number&lt;br /&gt;
     ||    | |||____&lt;br /&gt;
     ||    | ||_____ week of year (starting Mondays)&lt;br /&gt;
     ||    | |______ last digit of year&lt;br /&gt;
     ||    |________&lt;br /&gt;
     ||_____________ number of Xbox within week and factory&lt;br /&gt;
     |______________ production line within factory &lt;br /&gt;
   &lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==The MAC address==&lt;br /&gt;
&lt;br /&gt;
This is the MAC address of the Ethernet hardware, which has been [https://web.archive.org/web/20100617020733/http://standards.ieee.org/regauth/oui/oui_public.txt issued by the IEEE].&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==DVD Region==&lt;br /&gt;
&lt;br /&gt;
This DWORD corresponds to the region code for playback of DVD movies:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|  0x00&lt;br /&gt;
|  None&lt;br /&gt;
|-&lt;br /&gt;
|  0x01&lt;br /&gt;
|  Region 1&lt;br /&gt;
|-&lt;br /&gt;
|  ...&lt;br /&gt;
|  ...&lt;br /&gt;
|-&lt;br /&gt;
|  0x06&lt;br /&gt;
|  Region 6&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Checksum Algorithm ==&lt;br /&gt;
&lt;br /&gt;
Checksum2 and Checksum3 values can be calculated by running the following code snippet over the area the checksum covers:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt; /* The EepromCRC algorithm was obtained from the XKUtils 0.2 source released by&lt;br /&gt;
  * TeamAssembly under the GNU GPL.&lt;br /&gt;
  * Specifically, from XKCRC.cpp&lt;br /&gt;
  *&lt;br /&gt;
  * Rewritten to ANSI C by David Pye (dmp@davidmpye.dyndns.org)&lt;br /&gt;
  *&lt;br /&gt;
  * Thanks! */&lt;br /&gt;
 void EepromCRC(unsigned char *crc, unsigned char *data, long dataLen) {&lt;br /&gt;
         unsigned char* CRC_Data = (unsigned char *)malloc(dataLen+4);&lt;br /&gt;
         int pos=0;&lt;br /&gt;
         memset(crc,0x00,4);&lt;br /&gt;
 &lt;br /&gt;
         memset(CRC_Data,0x00, dataLen+4);&lt;br /&gt;
         //Circle shift input data one byte right&lt;br /&gt;
         memcpy(CRC_Data + 0x01 , data, dataLen-1);&lt;br /&gt;
         memcpy(CRC_Data, data + dataLen-1, 0x01);&lt;br /&gt;
 &lt;br /&gt;
         for (pos=0; pos&amp;amp;lt;4; ++pos) {&lt;br /&gt;
                 unsigned short CRCPosVal = 0xFFFF;&lt;br /&gt;
                 unsigned long l;&lt;br /&gt;
                 for (l=pos; l&amp;amp;lt;dataLen; l+=4) {&lt;br /&gt;
                         CRCPosVal -= *(unsigned short*)(&amp;amp;amp;CRC_Data[l]);&lt;br /&gt;
                 }&lt;br /&gt;
                 CRCPosVal &amp;amp;amp;= 0xFF00;&lt;br /&gt;
                 crc[pos] = (unsigned char) (CRCPosVal &amp;amp;gt;&amp;amp;gt; 8);&lt;br /&gt;
         }&lt;br /&gt;
         free(CRC_Data);&lt;br /&gt;
 }&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Further Reading ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip with a Raspberry Pi]&lt;br /&gt;
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]&lt;br /&gt;
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Xbox_Hard_Disk_Technical_Details&amp;diff=5537</id>
		<title>Xbox Hard Disk Technical Details</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Xbox_Hard_Disk_Technical_Details&amp;diff=5537"/>
				<updated>2017-05-29T12:14:44Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Retrieved from [http://www.xbox-linux.org/wiki/Xbox_Hard_Disk_Technical_Details]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
by Michael Steil (original version: 1 May 2002, updated 26 September 2002)&lt;br /&gt;
&lt;br /&gt;
== Seagate (10 GB) ==&lt;br /&gt;
=== Harddisk information as reported by hdparm -i ===&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;Model=ST310211A, FwRev=6.55, SerialNo=6DB2WQW2&lt;br /&gt;
Config={ HardSect NotMFM HdSw&amp;amp;gt;15uSec Fixed DTR&amp;amp;gt;10Mbs RotSpdTol&amp;amp;gt;.5% }&lt;br /&gt;
RawCHS=16383/16/63, TrkSize=0, SectSize=0, ECCbytes=0&lt;br /&gt;
BuffType=unknown, BuffSize=512kB, MaxMultSect=16, MultSect=16&lt;br /&gt;
CurCHS=16383/16/63, CurSects=16514064, LBA=yes, LBAsects=19541088&lt;br /&gt;
IORDY=on/off, tPIO={min:240,w/IORDY:120}, tDMA={min:120,rec:120}&lt;br /&gt;
PIO modes: pio0 pio1 pio2 pio3 pio4 &lt;br /&gt;
DMA modes: mdma0 mdma1 mdma2 udma0 udma1 *udma2 &lt;br /&gt;
AdvancedPM=no WriteCache=enabled&lt;br /&gt;
Drive Supports : Reserved : ATA-1 ATA-2 ATA-3 ATA-4 &lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
=== Detailed information as reported by hdparm -I ===&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;non-removable ATA device, with non-removable media&lt;br /&gt;
        Model Number:           ST310211A                          &lt;br /&gt;
    &lt;br /&gt;
        Serial Number:          6DB2WQW2            &lt;br /&gt;
        Firmware Revision:      6.55    &lt;br /&gt;
Standards:&lt;br /&gt;
        Supported: 1 2 3 4 &lt;br /&gt;
        Likely used: 5&lt;br /&gt;
Configuration:&lt;br /&gt;
        Logical         max     current&lt;br /&gt;
        cylinders       16383   16383&lt;br /&gt;
        heads           16      16&lt;br /&gt;
        sectors/track   63      63&lt;br /&gt;
        bytes/track:    0               (obsolete)&lt;br /&gt;
        bytes/sector:   0               (obsolete)&lt;br /&gt;
        current sector capacity: 16514064&lt;br /&gt;
        LBA user addressable sectors = 19541088&lt;br /&gt;
Capabilities:&lt;br /&gt;
        LBA, IORDY(can be disabled)&lt;br /&gt;
        Buffer size: 512.0kB    Queue depth: 1&lt;br /&gt;
        Standby timer values: spec'd by standard&lt;br /&gt;
        r/w multiple sector transfer: Max = 16  Current = 16&lt;br /&gt;
        DMA: mdma0 mdma1 mdma2 udma0 udma1 *udma2 udma3 udma4 udma5&lt;br /&gt;
&lt;br /&gt;
             Cycle time: min=120ns recommended=120ns&lt;br /&gt;
        PIO: pio0 pio1 pio2 pio3 pio4 &lt;br /&gt;
             Cycle time: no flow control=240ns  IORDY flow control=120ns&lt;br /&gt;
Commands/features:&lt;br /&gt;
        Enabled Supported:&lt;br /&gt;
           *    READ BUFFER cmd&lt;br /&gt;
           *    WRITE BUFFER cmd&lt;br /&gt;
           *    Host Protected Area feature set&lt;br /&gt;
           *    look-ahead&lt;br /&gt;
           *    write cache&lt;br /&gt;
           *    Power Management feature set&lt;br /&gt;
           *    Security Mode feature set&lt;br /&gt;
                SMART feature set&lt;br /&gt;
                SET MAX security extension&lt;br /&gt;
           *    DOWNLOAD MICROCODE cmd&lt;br /&gt;
Security: &lt;br /&gt;
                supported&lt;br /&gt;
                enabled&lt;br /&gt;
        not     locked&lt;br /&gt;
        not     frozen&lt;br /&gt;
        not     expired: security count&lt;br /&gt;
        not     supported: enhanced erase&lt;br /&gt;
        Security level high&lt;br /&gt;
HW reset results:&lt;br /&gt;
        CBLID- below Vih&lt;br /&gt;
        Device num = 1&lt;br /&gt;
Checksum: correct&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Hard disk performance measured by hdparm -t ===&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;Timing buffered disk reads:  64 MB in  3.51 seconds = 18.23 MB/sec&lt;br /&gt;
Timing buffer-cache reads:   128 MB in  0.85 seconds =150.59 MB/sec&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Western Digital (8 GB) ==&lt;br /&gt;
&lt;br /&gt;
=== Harddisk information as reported by hdparm -i ===&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;Model=WDC WD80EB-28CGH1, FwRev=24.84G24, SerialNo=***************&lt;br /&gt;
Config={ HardSect NotMFM HdSw&amp;amp;gt;15uSec SpinMotCtl Fixed DTR&amp;amp;gt;5Mbs FmtGapReq }&lt;br /&gt;
RawCHS=15509/16/63, TrkSize=57600, SectSize=600, ECCbytes=40&lt;br /&gt;
BuffType=DualPortCache, BuffSize=768kB, MaxMultSect=16, MultSect=off&lt;br /&gt;
CurCHS=15509/16/63, CurSects=15633072, LBA=yes, LBAsects=15633072&lt;br /&gt;
IORDY=on/off, tPIO={min:120,w/IORDY:120}, tDMA={min:120,rec:120}&lt;br /&gt;
PIO modes:  pio0 pio1 pio2 pio3 pio4 &lt;br /&gt;
DMA modes:  mdma0 mdma1 *mdma2 &lt;br /&gt;
UDMA modes: udma0 udma1 udma2 udma3 udma4 udma5 &lt;br /&gt;
AdvancedPM=no WriteCache=enabled&lt;br /&gt;
Drive conforms to: device does not report version:  1 2 3 4 5&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
=== Detailed information as reported by hdparm -I ===&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;ATA device, with non-removable media&lt;br /&gt;
        Model Number:       WDC WD80EB-28CGH1                      &lt;br /&gt;
&lt;br /&gt;
        Serial Number:      *************** &lt;br /&gt;
        Firmware Revision:  24.84G24&lt;br /&gt;
Standards:&lt;br /&gt;
        Supported: 5 4 3 2 &lt;br /&gt;
        Likely used: 6&lt;br /&gt;
Configuration:&lt;br /&gt;
        Logical         max     current&lt;br /&gt;
        cylinders       15509   15509&lt;br /&gt;
        heads           16      16&lt;br /&gt;
        sectors/track   63      63&lt;br /&gt;
        --&lt;br /&gt;
        CHS current addressable sectors:   15633072&lt;br /&gt;
        LBA    user addressable sectors:   15633072&lt;br /&gt;
        device size with M = 1024*1024:        7633 MBytes&lt;br /&gt;
        device size with M = 1000*1000:        8004 MBytes (8 GB)&lt;br /&gt;
Capabilities:&lt;br /&gt;
        LBA, IORDY(can be disabled)&lt;br /&gt;
        bytes avail on r/w long: 40     Queue depth: 1&lt;br /&gt;
        Standby timer values: spec'd by Standard, with device specific minimum&lt;br /&gt;
        R/W multiple sector transfer: Max = 16  Current = 0&lt;br /&gt;
        Recommended acoustic management value: 128, current value: 254&lt;br /&gt;
        DMA: mdma0 mdma1 *mdma2 udma0 udma1 udma2 udma3 udma4 udma5&lt;br /&gt;
&lt;br /&gt;
             Cycle time: min=120ns recommended=120ns&lt;br /&gt;
        PIO: pio0 pio1 pio2 pio3 pio4 &lt;br /&gt;
             Cycle time: no flow control=120ns  IORDY flow control=120ns&lt;br /&gt;
Commands/features:&lt;br /&gt;
        Enabled Supported:&lt;br /&gt;
           *    READ BUFFER cmd&lt;br /&gt;
           *    WRITE BUFFER cmd&lt;br /&gt;
           *    Host Protected Area feature set&lt;br /&gt;
           *    Look-ahead&lt;br /&gt;
           *    Write cache&lt;br /&gt;
           *    Power Management feature set&lt;br /&gt;
           *    Security Mode feature set&lt;br /&gt;
           *    SMART feature set&lt;br /&gt;
                Automatic Acoustic Management feature set &lt;br /&gt;
                SET MAX security extension&lt;br /&gt;
           *    DOWNLOAD MICROCODE cmd&lt;br /&gt;
Security: &lt;br /&gt;
                supported&lt;br /&gt;
                enabled&lt;br /&gt;
        not     locked&lt;br /&gt;
        not     frozen&lt;br /&gt;
        not     expired: security count&lt;br /&gt;
        not     supported: enhanced erase&lt;br /&gt;
        Security level high&lt;br /&gt;
HW reset results:&lt;br /&gt;
        CBLID- above Vih&lt;br /&gt;
        Device num = 0 determined by CSEL&lt;br /&gt;
Checksum: correct&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
=== Hard disk performance measured by hdparm -t ===&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;Timing buffered disk reads:  64 MB in  6.58 seconds =  9.73 MB/sec&lt;br /&gt;
Timing buffer-cache reads:   128 MB in  3.28 seconds = 39.02 MB/sec&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=NForce&amp;diff=5536</id>
		<title>NForce</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=NForce&amp;diff=5536"/>
				<updated>2017-05-29T12:13:54Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: Created page with &amp;quot;Retrieved from [http://www.xbox-linux.org/wiki/NForce]   This documents collects information about the Xbox chipset and its sibling, the nVidia nForce chipset, as well as furt...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Retrieved from [http://www.xbox-linux.org/wiki/NForce]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
This documents collects information about the Xbox chipset and its sibling, the nVidia nForce chipset, as well as further relatives.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== nForce ==&lt;br /&gt;
&lt;br /&gt;
The nForce chipset consists of the IGP (Integrated Graphics Processor) Northbridge and the MCP (Media and Communications Processor) Southbridge. Both are available in different flavours:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* IGP-64: 64 bit memory bus&lt;br /&gt;
* IGP-128: 128 bit memory bus (TwinBank), requires two DIMM modules for 128 bit operation&lt;br /&gt;
* MCP-D: includes Dolby Digital encoder&lt;br /&gt;
* MCP: Dolby Digital encoder disabled&lt;br /&gt;
&lt;br /&gt;
So these are the four possible combinations:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
| &lt;br /&gt;
|  MCP&lt;br /&gt;
|  MCP-D&lt;br /&gt;
|-&lt;br /&gt;
|  IGP-64&lt;br /&gt;
|  nForce 220&lt;br /&gt;
|  nForce 220D&lt;br /&gt;
|-&lt;br /&gt;
|  IGP-128&lt;br /&gt;
|  nForce 420&lt;br /&gt;
|  nForce 420D&lt;br /&gt;
|}&lt;br /&gt;
[https://web.archive.org/web/20100617023830/http://www.theregister.co.uk/2001/05/31/nvidia_crush_chipset_named_nforce/]&lt;br /&gt;
[https://web.archive.org/web/20100617023830/http://www.theregister.co.uk/2001/06/01/nvidia_crush_is_called_nforce/]&lt;br /&gt;
&lt;br /&gt;
The VGA controller inside the IGP is a &amp;quot;GeForce2 MX Integrated Graphics&amp;quot; (PCI ID:10de/01a0). Its internal name is NV1A.&lt;br /&gt;
&lt;br /&gt;
[https://web.archive.org/web/20100617023830/http://pciids.sourceforge.net/iii/?i=10de]&lt;br /&gt;
[https://web.archive.org/web/20100617023830/http://www.nvitalia.com/articoli/editoriali/produzione_nvidia_2001.htm]&lt;br /&gt;
&lt;br /&gt;
Although IGP-64 and IGP-128 are different and their respective chipsets have different codenames (Crush11 and Crush12, see below), there seems to be no difference from the software side:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* The VGA BIOS of the MS-6367 mainboard (nForce 420D configuration, i.e. Crush12) has the internal name &amp;quot;CR11BT.ROM&amp;quot;. It also includes the strings &amp;quot;NVIDIA GeForce2 Integrated GPU&amp;quot;, &amp;quot;CR11 Board&amp;quot; and &amp;quot;Chip Rev B2&amp;quot;.&lt;br /&gt;
* The PCI IDs seem to be the same for the GPUs inside IGP-64 and IGP-128.&lt;br /&gt;
&lt;br /&gt;
== Crush ==&lt;br /&gt;
&lt;br /&gt;
&amp;quot;Crush&amp;quot; was the codename of the nForce chipset. Crush11 is the nForce 220/220D/230/230-T, Crush12 is the nForce 420/420D/430/430-T, and Crush18 is the nForce2. The &amp;quot;11&amp;quot; probably derives from &amp;quot;NV11&amp;quot;, the internal name of the GeForce2 MX.&lt;br /&gt;
&lt;br /&gt;
[https://web.archive.org/web/20100617023830/http://users.erols.com/chare/chipsets.htm]&lt;br /&gt;
[https://web.archive.org/web/20100617023830/http://www.theregister.co.uk/2000/11/17/nvidias_super_secret_crush_spec/]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== nForce &amp;amp;amp; Xbox ==&lt;br /&gt;
&lt;br /&gt;
The Xbox has an IGP-128 that uses an NV2A video core (PCI ID:10de/02a5), which is between the GeForce3 (NV20) and the GeForce4 (NV25). The Southbridge is called &amp;quot;MCP-X&amp;quot; and lacks the PCI card bus (PCI bus #1).&lt;br /&gt;
&lt;br /&gt;
[https://web.archive.org/web/20100617023830/http://www.digit-life.com/articles/nvidianforce/]&lt;br /&gt;
[https://web.archive.org/web/20100617023830/http://www.anandtech.com/showdoc.html?i=1484]&lt;br /&gt;
[https://web.archive.org/web/20100617023830/http://www.anandtech.com/cpuchipsets/showdoc.aspx?i=1535]&lt;br /&gt;
[https://web.archive.org/web/20100617023830/http://www.anandtech.com/systems/showdoc.aspx?i=1561&amp;amp;amp;p=3]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== AMD Heritage ==&lt;br /&gt;
&lt;br /&gt;
There is the following rumour, which is could not fully verify yet:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* Microsoft wanted AMD to make the CPU and the chipset for the Xbox, and nVidia to make the video hardware.&lt;br /&gt;
* When alpha hardware had already bee built, Intel made a better deal&lt;br /&gt;
* Microsoft agreed to have Intel CPUs; Intel had to modify AMD's chipset to support an AMD CPU&lt;br /&gt;
* Intel insisted that the brand name AMD could not be associated with the Xbox, so nVidia licensed the AMD chipset. Now the Xbox chipset was by nVidia.&lt;br /&gt;
* nVidia sold the same chipset for PCs, calling it &amp;quot;nForce&amp;quot;.&lt;br /&gt;
&lt;br /&gt;
This is the reason why&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* the Xbox is the only nForce chipset with an Intel CPU&lt;br /&gt;
* the AMD chipset and the nForce chipset are so similar&lt;br /&gt;
&lt;br /&gt;
Evidence:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* The AMD and nForce AMD IDE controllers are fully compatible. (Linux kernel: &amp;quot;AMD 755/756/766/8111 and nVidia nForce/2/2s/3/3s/CK804/MCP04 IDE driver for Linux.&amp;quot; [https://web.archive.org/web/20100617023830/http://lxr.linux.no/source/drivers/ide/pci/amd74xx.c])&lt;br /&gt;
* The I2C/SMBus controller on the nForce is fully AMD-756/766/68 compatible. [https://web.archive.org/web/20100617023830/http://lxr.linux.no/source/drivers/i2c/busses/i2c-amd756.c]&lt;br /&gt;
* The audio controller is i810 compatible - as is the audio controller of the AMD-768 and the AMD-8111.&lt;br /&gt;
* The nForce and AMD-768 modems are compatible.&lt;br /&gt;
* At least one register (&amp;quot;VGA_en&amp;quot;) in the nForce PCI-to-AGP bridge is compatible with the AMD chipset (AMD-761, 24081.pdf, page 136).&lt;br /&gt;
* The nForce uses HyperTransport.&lt;br /&gt;
* [https://web.archive.org/web/20100617023830/http://www.uwsg.iu.edu/hypermail/linux/kernel/0307.3/0922.html], [https://web.archive.org/web/20100617023830/http://www.uwsg.iu.edu/hypermail/linux/kernel/0301.3/0305.html]&lt;br /&gt;
* ''&amp;quot;One man's guess, the silicon is not a major factor. Because the nForce and 760 MP have a similar pin count, they are going to be cost comparable.&amp;quot;'' [https://web.archive.org/web/20100617023830/http://overclockers.com/articles446/]&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
| &lt;br /&gt;
|  Northbridge&lt;br /&gt;
|  Southbridge&lt;br /&gt;
|-&lt;br /&gt;
|  AMD-760&lt;br /&gt;
|  AMD-761&lt;br /&gt;
|  AMD-766&lt;br /&gt;
|-&lt;br /&gt;
|  AMD-760MP&lt;br /&gt;
|  AMD-762&lt;br /&gt;
|  AMD-766&lt;br /&gt;
|-&lt;br /&gt;
|  AMD-760MPX&lt;br /&gt;
|  AMD-762&lt;br /&gt;
|  AMD-768&lt;br /&gt;
|}&lt;br /&gt;
[https://web.archive.org/web/20100617023830/http://www.amd.com/us-en/Processors/TechnicalResources/0,,30_182_873_1133,00.html AMD-760™ Chipset Tech Docs]&lt;br /&gt;
[https://web.archive.org/web/20100617023830/http://www.amd.com/us-en/Processors/TechnicalResources/0,,30_182_739_1130,00.html AMD-760™ MP Chipset Tech Docs]&lt;br /&gt;
[https://web.archive.org/web/20100617023830/http://www.amd.com/us-en/Processors/TechnicalResources/0,,30_182_873_4296,00.html AMD-760™ MPX Chipset Tech Docs]&lt;br /&gt;
&amp;lt;br /&amp;gt;&lt;br /&gt;
The nForce chipset might be based on the AMD-760 chipset.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== More Links ==&lt;br /&gt;
&lt;br /&gt;
[https://web.archive.org/web/20100617023830/http://www.duxcw.com/digest/guides/mb_chip/nforce/print.htm]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Porting_an_Operating_System_to_the_Xbox_HOWTO&amp;diff=5534</id>
		<title>Porting an Operating System to the Xbox HOWTO</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Porting_an_Operating_System_to_the_Xbox_HOWTO&amp;diff=5534"/>
				<updated>2017-05-29T11:32:42Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: Created page with &amp;quot;Retrieved from [http://www.xbox-linux.org/wiki/Porting_an_Operating_System_to_the_Xbox_HOWTO]   == Differences ==   The Xbox hardware consists of standard components, like a P...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Retrieved from [http://www.xbox-linux.org/wiki/Porting_an_Operating_System_to_the_Xbox_HOWTO]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== Differences ==&lt;br /&gt;
 &lt;br /&gt;
The Xbox hardware consists of standard components, like a Pentium III Celeron CPU, an nForce chipset and IDE DVD and hard disk drives. Still there are a few differences, some of which would make an unmodified operating system crash.&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
=== Chipset ===&lt;br /&gt;
 &lt;br /&gt;
The Xbox chipset is basically an nVidia nForce 420, but with a GeForce &amp;quot;NV2A&amp;quot; integrated (instead of a GeForce2 MX), and with an Intel instead of an AMD CPU. Here is the output of &amp;quot;lspci&amp;quot; on a PC nForce:&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;00:00.0 Host bridge: nVidia Corporation nForce CPU bridge (rev b2)&lt;br /&gt;
00:00.1 RAM memory: nVidia Corporation nForce 220/420 Memory Controller (rev b2)&lt;br /&gt;
00:00.2 RAM memory: nVidia Corporation nForce 220/420 Memory Controller (rev b2)&lt;br /&gt;
00:00.3 RAM memory: nVidia Corporation nForce 420 Memory Controller (DDR) (rev b2)&lt;br /&gt;
00:01.0 ISA bridge: nVidia Corporation nForce ISA Bridge (rev c3)&lt;br /&gt;
00:01.1 SMBus: nVidia Corporation nForce PCI System Management (rev c1)&lt;br /&gt;
00:02.0 USB Controller: nVidia Corporation nForce USB Controller (rev c3)&lt;br /&gt;
00:03.0 USB Controller: nVidia Corporation nForce USB Controller (rev c3)&lt;br /&gt;
00:04.0 Ethernet controller: nVidia Corporation nForce Ethernet Controller (rev d2)&lt;br /&gt;
00:05.0 Multimedia audio controller: nVidia Corporation: Unknown device 01b0 (rev c2)&lt;br /&gt;
00:06.0 Multimedia audio controller: nVidia Corporation nForce Audio (rev c2)&lt;br /&gt;
00:08.0 PCI bridge: nVidia Corporation nForce PCI-to-PCI bridge (rev c2)&lt;br /&gt;
00:09.0 IDE interface: nVidia Corporation nForce IDE (rev c3)&lt;br /&gt;
00:1e.0 PCI bridge: nVidia Corporation nForce AGP to PCI Bridge (rev b2)&lt;br /&gt;
02:00.0 VGA compatible controller: nVidia Corporation NVCrush11 [GeForce2 MX Integrated Graphics] (rev b1)&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
On the Xbox, the output looks like this:&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;00:00.0 Host bridge: nVidia Corporation: Unknown device 02a5 (rev a1)&lt;br /&gt;
00:00.3 RAM memory: nVidia Corporation: Unknown device 02a6 (rev a1)&lt;br /&gt;
00:01.0 ISA bridge: nVidia Corporation nForce ISA Bridge (rev d4)&lt;br /&gt;
00:01.1 SMBus: nVidia Corporation nForce PCI System Management (rev d1)&lt;br /&gt;
00:02.0 USB Controller: nVidia Corporation nForce USB Controller (rev d4)&lt;br /&gt;
00:03.0 USB Controller: nVidia Corporation nForce USB Controller (rev d4)&lt;br /&gt;
00:04.0 Ethernet controller: nVidia Corporation nForce Ethernet Controller (rev d2)&lt;br /&gt;
00:05.0 Multimedia audio controller: nVidia Corporation: Unknown device 01b0 (rev d2)&lt;br /&gt;
00:06.0 Multimedia audio controller: nVidia Corporation nForce Audio (rev d2)&lt;br /&gt;
00:06.1 Modem: nVidia Corporation Intel 537 [nForce MC97 Modem] (rev d1)&lt;br /&gt;
00:08.0 PCI bridge: nVidia Corporation nForce PCI-to-PCI bridge (rev d2)&lt;br /&gt;
00:09.0 IDE interface: nVidia Corporation nForce IDE (rev d4)&lt;br /&gt;
00:1e.0 PCI bridge: nVidia Corporation nForce AGP to PCI Bridge (rev a1)&lt;br /&gt;
01:00.0 VGA compatible controller: nVidia Corporation: Unknown device 02a0 (rev a1)&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
PCI bus 0 is almost identical, except for the Xbox only having a single memory controller. Bus 1 on the PC contains all PCI cards. Since the Xbox does not support PCI cards, the AGP bus on the Xbox is bus 1 instead of bus 2.&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
==== PCI Enumeration Bug ====&lt;br /&gt;
 &lt;br /&gt;
These two differences between the PC and the Xbox version of the nForce chipset have introduced three bugs into the chipset that all have to do with PCI enumeration:&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
* The nonexistent memory controllers at 0:0.1 and 0:0.2 are completely broken: If you try to probe them, i.e. read out their PCI IDs, the Xbox freezes.&lt;br /&gt;
* There are ghost devices on bus 1, after the video controller (1:0.0). You get garbage if you try to probe them.&lt;br /&gt;
* The same is true for the complete bus 2.&lt;br /&gt;
 &lt;br /&gt;
So if your operating system scans the PCI bus in order to find out what drivers need to be loaded for the PCI devices, do not touch 0:0.1 and 0:0.2. The easiest fix would be to start the PCI enumeration with 0:1.0, as the first few devices need no driver anyway, but the following code, taken from the Xbox Linux kernel, handles this better and also hides the ghost devices:&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;if (mach_pci_is_blacklisted(bus, PCI_SLOT(devfn), PCI_FUNC(devfn)))&lt;br /&gt;
    return -EINVAL;&lt;br /&gt;
&lt;br /&gt;
static inline int mach_pci_is_blacklisted(int bus, int dev, int fn)&lt;br /&gt;
{&lt;br /&gt;
    if(machine_is_xbox) {&lt;br /&gt;
        return (bus &amp;amp;gt; 1) || ((bus != 0) &amp;amp;amp;&amp;amp;amp; ((dev != 0) || (fn != 0))) ||&lt;br /&gt;
            (!bus &amp;amp;amp;&amp;amp;amp; !dev &amp;amp;amp;&amp;amp;amp; ((fn == 1) || (fn == 2)));&lt;br /&gt;
    }&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
Note that some operating systems (or even some applications) repeat the PCI enumeration later: On Unix systems, the XFree86/X.org X Window servers for example do that, but this can be deactivated using a configuration parameter (or of course patched in the source code).&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
==== No Keyboard Controller ====&lt;br /&gt;
 &lt;br /&gt;
The Xbox is a legacy free PC, so it does not contain a so-called &amp;quot;Super-I/O Chip&amp;quot; which includes old ISA hardware such as&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
* serial port&lt;br /&gt;
* parallell port&lt;br /&gt;
* floppy disk controller&lt;br /&gt;
* keyboard controller&lt;br /&gt;
 &lt;br /&gt;
In general, this should be no problem for any operating system; there is just one thing: Many operating systems (such as Linux up some 2.4.x version) assume that every PC has a keyboard controller (although this is not true for many embedded x86 as well as Itanium systems), and therefore statically allocate interrupt line 1 for the keyboard controller.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The problem is that the original Xbox hardware initialization code (as well as Cromwell) put the first USB controller on interrupt 1, so if the operating system already has it allocated, the first USB controller will not work. On a 1.0 Xbox this means that no USB devices (including, ironically, a keyboard) will work, while on later boxes this only affects two of the four connectors.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
So make sure that your operating system checks for a keyboard controller and allocates no interrupt if it does not exist. The following code, taken from the Linux kernel, shows how to check for a keyboard controller:&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;#define kbd_read_input() inb(KBD_DATA_REG)&lt;br /&gt;
#define kbd_read_status() inb(KBD_STATUS_REG)&lt;br /&gt;
&lt;br /&gt;
if (kbd_read_status() == 0xff &amp;amp;amp;&amp;amp;amp; kbd_read_input() == 0xff)&lt;br /&gt;
    kbd_exists = 0;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
==== Timer Frequency ====&lt;br /&gt;
 &lt;br /&gt;
The system timer inside the &amp;quot;8254 PIT&amp;quot; unit of the chipset on a PC has a base frequency of 1.193182 MHz. The number of task switches, the system clock and all timing for multimedia is usually based on the interrupts generated by the PIT unit. For some unknown reason, this base frequency is 1.125000 MHz on the Xbox, which is about 6% lower. If your operating system does not handle this difference, multimedia plays at the wrong speed and the system clock (if you have a software clock and do not use the hardware clock) will be incorrect quite quickly.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
So all you have to do is to search for the constant of 1193182 (sometimes it is 1193180) and replace it with code like this:&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;timer_base = machine_is_xbox? 1125000 : 1193182;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
In case your operating system defines this as a constant, you have to change it into a variable and make sure it is assigned early enough. In this case, it should be a good idea to assign it as soon as you detect whether the machine is an Xbox.&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
==== Reboot and Poweroff ====&lt;br /&gt;
 &lt;br /&gt;
The Xbox chipset has no ACPI capabilities, so it is not possible to shut it down using the ACPI protocol. It is also not possible to reset the Xbox like a PC, because it lacks the keyboard controller which usually includes this feature. Both these functions are handled by the &amp;quot;System Management Controller&amp;quot; SMC (also called the &amp;quot;PIC&amp;quot;), which is a device on the SMBus.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
In order to communicate with a device on the SMBus, you need a driver for the Xbox SMBus controller, which is AMD754 compatible. Linux for example includes this driver. But there is no need to statically include a complete bus driver just for this simple function: The SMBus on the Xbox is simple enough to be controlled with just two small C functions. The following code is all you need:&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;#define XBOX_SMB_IO_BASE       0xC000&lt;br /&gt;
#define XBOX_SMB_GLOBAL_ENABLE  (0x2 + XBOX_SMB_IO_BASE)&lt;br /&gt;
#define XBOX_SMB_HOST_ADDRESS  (0x4 + XBOX_SMB_IO_BASE)&lt;br /&gt;
#define XBOX_SMB_HOST_DATA     (0x6 + XBOX_SMB_IO_BASE)&lt;br /&gt;
#define XBOX_SMB_HOST_COMMAND  (0x8 + XBOX_SMB_IO_BASE)&lt;br /&gt;
&lt;br /&gt;
#define XBOX_PIC_ADDRESS        0x10&lt;br /&gt;
&lt;br /&gt;
#define SMC_CMD_POWER           0x02&lt;br /&gt;
#define SMC_SUBCMD_POWER_RESET      0x01&lt;br /&gt;
#define SMC_SUBCMD_POWER_CYCLE      0x40&lt;br /&gt;
#define SMC_SUBCMD_POWER_OFF        0x80&lt;br /&gt;
&lt;br /&gt;
static void xbox_pic_cmd(u8 command)&lt;br /&gt;
{&lt;br /&gt;
    outw_p(((XBOX_PIC_ADDRESS) &amp;amp;lt;&amp;amp;lt; 1), XBOX_SMB_HOST_ADDRESS);&lt;br /&gt;
    outb_p(SMC_CMD_POWER, XBOX_SMB_HOST_COMMAND);&lt;br /&gt;
    outw_p(command, XBOX_SMB_HOST_DATA);&lt;br /&gt;
    outw_p(inw(XBOX_SMB_IO_BASE), XBOX_SMB_IO_BASE);&lt;br /&gt;
    outb_p(0x0a, XBOX_SMB_GLOBAL_ENABLE);&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
void xbox_power_reset(char * __unused)&lt;br /&gt;
{&lt;br /&gt;
    xbox_pic_cmd(SMC_SUBCMD_POWER_RESET);&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
void xbox_power_cycle(char * __unused)&lt;br /&gt;
{&lt;br /&gt;
    xbox_pic_cmd(SMC_SUBCMD_POWER_CYCLE);&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
void xbox_power_off(void)&lt;br /&gt;
{&lt;br /&gt;
    xbox_pic_cmd(SMC_SUBCMD_POWER_OFF);&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
''xbox_power_reset'' just resets the system while ''xbox_power_cycle'' turns it off and turns it back on after half a second. Please note that the above SMBus code lacks error detection and should not be used in the general case.&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
=== DVD Driver ===&lt;br /&gt;
 &lt;br /&gt;
Although the DVD drives in the Xbox are basically standard IDE drives, there are some differences, some due to protection issues, and some because of bugs in their firmwares.&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
==== Reset on Eject ====&lt;br /&gt;
 &lt;br /&gt;
On the PlayStation, it was possible to trick the console into loading copies by inserting an original, having the CD checked and quickly replacing it with a copy. The designers of the Xbox made this trick impossible by having an additional security chip, the SMC, which resets the system if the user presses the eject button or even tries to manually eject the tray.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
But the system does not ''always'' reset in this case. In the Xbox Dashboard, for example, it is possible to open the tray. Every time the user presses the eject button or the tray opens (for example if the drive ejects on request of software), the PIC sends an EXTSMI# interrupt to the CPU. If the software running on the CPU handles this interrupt and sends back a message to the PIC, then the system will not be reset.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The code in [[arch/i386/mach-xbox/reset-on-eject.c]] (''http://cvs.sourceforge.net/viewcvs.py/xbox-linux/kernel-2.6/arch/i386/mach-xbox/reset-on-eject.c?rev=1.2&amp;amp;amp;view=auto'') in the Xbox Linux kernel handles this. Again, you need SMBus code to talk to the SMC.&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
==== DVD Drive Bugs ====&lt;br /&gt;
 &lt;br /&gt;
Microsoft uses several different DVD drives in the Xbox, some of which have its compatibility problems:&lt;br /&gt;
&lt;br /&gt;
           &lt;br /&gt;
{| border=&amp;quot;1&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
| '''drive string''' &lt;br /&gt;
| '''problems''' &lt;br /&gt;
|-&lt;br /&gt;
| &amp;quot;THOMSON-DVD&amp;quot;&lt;br /&gt;
&lt;br /&gt;
| pretends it cannot play audio or dvds; does not understand the ATAPI eject command&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| &amp;quot;PHILIPS XBOX DVD DRIVE&amp;quot;&lt;br /&gt;
&lt;br /&gt;
| does not understand the ATAPI eject command&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| &amp;quot;PHILIPS J5 3235C&amp;quot;&lt;br /&gt;
&lt;br /&gt;
| pretends it cannot play audio or dvds&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| &amp;quot;SAMSUNG DVD-ROM SDG-605B&amp;quot;&lt;br /&gt;
&lt;br /&gt;
| no issues&lt;br /&gt;
&lt;br /&gt;
|} &lt;br /&gt;
In addition, none of these drives respect door locking when the user presses the eject button.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
So if you do nothing, some drives won't respond to software eject commands, and some will refuse to play DVD or audio content, because the player software thinks the drive cannot do it. If you want to support all these DVD drives completely, you have to add some code to the ATAPI CD/DVD driver code in your operating system, which probably already includes some tests for other devices, because many CD/DVD drives report incorrect capabilities. The table above includes the exact string identifiers for these Xbox DVD drives, so you can easily check for them.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
If the drive does not understand the ATAPI eject command (as well as the load command), you have to issue an eject command to the SMC. The file [[include/linux/xbox.h]] (''http://cvs.sourceforge.net/viewcvs.py/xbox-linux/kernel-2.6/include/linux/xbox.h?rev=1.1&amp;amp;amp;view=auto'') includes the code you will need. The following two lines are taken from this file:&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;#define Xbox_tray_load() Xbox_SMC_write(SMC_CMD_EJECT, SMC_SUBCMD_EJECT_LOAD);&lt;br /&gt;
#define Xbox_tray_eject() Xbox_SMC_write(SMC_CMD_EJECT, SMC_SUBCMD_EJECT_EJECT);&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
Please note that having an Xbox DVD drive installed does not necessarily mean that we are running on an Xbox. It is possible (although impractical, because of the incompatible power connectors) to use them in a standard PC. So if the drive does not understand the ATAPI eject command, and we are not running on an Xbox, there is no way to eject the tray, as the drive does not even have its own eject button - and you should of course not send SMC commands on the PC.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The Linux implementation of this behaviour can be found in [[drivers/ide/ide-cd.c]] (''http://cvs.sourceforge.net/viewcvs.py/xbox-linux/kernel-2.6/drivers/ide/ide-cd.c?rev=1.13&amp;amp;amp;view=auto''). When detecting the drives, the driver notes in the drive's kernel structure whether it is an Xbox drive and whether it can eject, and corrects the incorrect capabilities. As the physical eject button, which is connected to the SMC, does not respect whether the tray is supposed to be locked, the driver simulates this in software.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Locking/unlocking the door:&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;if (xbox_drive &amp;amp;amp;&amp;amp;amp; machine_is_xbox) {&lt;br /&gt;
   simulated_lock = lock;&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
Ejecting/loading:&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;if (machine_is_xbox &amp;amp;amp;&amp;amp;amp; xbox_drive &amp;amp;amp;&amp;amp;amp; cannot_eject) {&lt;br /&gt;
   if (load) {&lt;br /&gt;
       Xbox_tray_load();&lt;br /&gt;
   } else {&lt;br /&gt;
       simulated_lock = 0;&lt;br /&gt;
       Xbox_tray_eject();&lt;br /&gt;
   }&lt;br /&gt;
   return;&lt;br /&gt;
}&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
The reset-on-eject driver, which catches eject button presses, should then also respect the flag &amp;quot;simulated_lock&amp;quot; and not open the door if it is locked in software.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Please also note that although certain capability flags of the Xbox drives are correct, software can still have a problem with them. An example on Unix is cdparanoia: If a CD drive has a headphone, then it assumes it must support playing audio CDs. This is logical. But cdparanoia assumes that if a drive has no headphone jack, it does not support audio CDs, but this is not true. All Xbox DVD drives can rip audio CDs, although they all have no headphone jack (and correctly report that).&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
=== Video Driver ===&lt;br /&gt;
 &lt;br /&gt;
Fully supporting the Xbox video hardware could mean a lot of work (or at least a lot of copying from the Xbox kernel). But there is no need to implement a complete video driver. Both bootloaders provided by the Xbox Linux project set up a 640x480 screen (32 bit colour, RGBX), which is useful for many setups. This linear framebuffer lies at the top of memory (around 60 MB) and can be used by your operating system without ever touching any video registers. This just works like the VESA modes supported by most operating systems, which get set up by the boot loader (using BIOS functions) and never get switched afterwards. Have a look at the bootloader section to learn how to find out where this framebuffer is located.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
If you want full support, you can reuse driver code for nVidia video hardware, as the Xbox video hardware is fully nVidia compatible. The problem is just that the Xbox does not have a VGA RAMDAC, but a PAL/NTSC video encoder (which is connected through the SMBus), so you always need to make sure when you set up a new mode that the video encoder is also correctly set up, or else you will get garbage on the screen.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Unfortunately, there is one of three incompatible video encoders in every Xbox: The first Xboxes used Connexant chips (1.0 to 1.3), later ones used Focus components (1.4 and 1.5), and 1.6 Xboxes include an integrated Xcalibur unit. That is why you might have to copy a lot of code from the Xbox Linux kernel and have others with different Xboxes test your code. You can find all this code in [[drivers/video/xbox/*]] (''http://cvs.sourceforge.net/viewcvs.py/xbox-linux/kernel-2.6/drivers/video/xbox/'').&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
=== Hard Disk ===&lt;br /&gt;
 &lt;br /&gt;
The Xbox includes a standard 8 or 10 GB hard disk. For security reasons (the user should be unable to just connect it to a PC) they are locked with an ATA password, but as the firmware already unlocks it, you should not have to care about this, unless you send ATA reset commands to the drive - which you should avoid.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Nevertheless, you might want your operating system to coexist with the Xbox system software, then you have to respect the existing partitioning and install it (probably as an image file) onto an existing partition.&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
==== Xbox Partitioning ====&lt;br /&gt;
 &lt;br /&gt;
The Xbox uses an implicit partitioning scheme, which is described in the articles [[Xbox Partitioning and Filesystem Details]] and [[Xbox Hard Disk Partitioning]]. In order to detect whether the hard drive is Xbox-partitioned, you have to check for the &amp;quot;BRFR&amp;quot; magic value, which must always be present. If this is too little evidence for you, you can also check for the &amp;quot;FATX&amp;quot; header in the &amp;quot;System Files&amp;quot; (C:) partition, but you should not assume any more FATX headers.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
You should also create a sixth partition for the space between 8 GB and 137 GB, and a seventh partition for the space above 137 GB in order to be compatible with patched Xbox kernels that work with larger hard disks.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
You might want to consider allowing two partitioning systems active at the same time: Xbox partitioning, which defines (at least) the lowermost 8 GB, and standard PC partitioning using a PC partition table (the first sector on the hard disk is unused). Therefore, in Xbox Linux, the Xbox partitions are assigned the numbers 50 to 56, while the Pc partitions start with 1.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
In Xbox Linux, this code is located in [[fs/partitions/check.c]] (''http://cvs.sourceforge.net/viewcvs.py/xbox-linux/kernel-2.6/fs/partitions/check.c?rev=1.9&amp;amp;amp;view=auto'') and [[fs/partitions/xbox.c xbox.c]] (''http://cvs.sourceforge.net/viewcvs.py/xbox-linux/kernel-2.6/fs/partitions/xbox.c?rev=1.7&amp;amp;amp;view=auto'').&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
==== FATX filesystem ====&lt;br /&gt;
 &lt;br /&gt;
On the hard disk, the Xbox exclusively uses the FATX filesystem, which is a simplified version of FAT16/FAT32. The articles [[Xbox Partitioning and Filesystem Details]] and [[Differences between Xbox FATX and MS-DOS FAT]] explain FATX in detail.&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
=== Peripherals ===&lt;br /&gt;
 &lt;br /&gt;
==== Xbox Gamepad ====&lt;br /&gt;
 &lt;br /&gt;
The Xbox gamepad is a USB device with a proprietary protocol, which you can find in the Xbox Linux kernel in [[drivers/usb/input/xpad.c]] (''http://cvs.sourceforge.net/viewcvs.py/xbox-linux/kernel-2.6/drivers/usb/input/xpad.c?rev=1.5&amp;amp;amp;view=auto''). You might want to add emulation for mouse and/or keyboard as well.&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
==== Remote Control ====&lt;br /&gt;
 &lt;br /&gt;
The remote control is similar to the gamepad. Keyboard and mouse emulation may make sense for it as well.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&amp;amp;lt;! --==== Xbox Live Headset ==== --&amp;amp;gt;&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
=== Other System Components ===&lt;br /&gt;
 &lt;br /&gt;
==== USB ====&lt;br /&gt;
 &lt;br /&gt;
The Xbox has a standard OHCI host controller, which your operating system hopefully supports out of the box.&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
==== Ethernet ====&lt;br /&gt;
 &lt;br /&gt;
The Ethernet controller of the Xbox is an nForce &amp;quot;nvnet&amp;quot;. The Linux driver [[forcedeth]] (''http://www.hailfinger.org/carldani/linux/patches/forcedeth/'') supports it completely.&lt;br /&gt;
&lt;br /&gt;
 &lt;br /&gt;
=== Sensors ===&lt;br /&gt;
 &lt;br /&gt;
There are two temperature sensors on the Xbox (CPU and system). Standard Linux drivers support them. You can control the system fan using the SMC. See the Xbox Linux &amp;quot;tools&amp;quot; source code for details.&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Xbox_Hard_Disk_Technical_Details&amp;diff=5533</id>
		<title>Xbox Hard Disk Technical Details</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Xbox_Hard_Disk_Technical_Details&amp;diff=5533"/>
				<updated>2017-05-29T11:27:19Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: Created page with &amp;quot;   by Michael Steil (original version: 1 May 2002, updated 26 September 2002)  == Seagate (10 GB) == === Harddisk information as reported by hdparm -i ===   &amp;lt;pre&amp;gt;Model=ST31021...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;  &lt;br /&gt;
by Michael Steil (original version: 1 May 2002, updated 26 September 2002)&lt;br /&gt;
&lt;br /&gt;
== Seagate (10 GB) ==&lt;br /&gt;
=== Harddisk information as reported by hdparm -i ===&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;Model=ST310211A, FwRev=6.55, SerialNo=6DB2WQW2&lt;br /&gt;
Config={ HardSect NotMFM HdSw&amp;amp;gt;15uSec Fixed DTR&amp;amp;gt;10Mbs RotSpdTol&amp;amp;gt;.5% }&lt;br /&gt;
RawCHS=16383/16/63, TrkSize=0, SectSize=0, ECCbytes=0&lt;br /&gt;
BuffType=unknown, BuffSize=512kB, MaxMultSect=16, MultSect=16&lt;br /&gt;
CurCHS=16383/16/63, CurSects=16514064, LBA=yes, LBAsects=19541088&lt;br /&gt;
IORDY=on/off, tPIO={min:240,w/IORDY:120}, tDMA={min:120,rec:120}&lt;br /&gt;
PIO modes: pio0 pio1 pio2 pio3 pio4 &lt;br /&gt;
DMA modes: mdma0 mdma1 mdma2 udma0 udma1 *udma2 &lt;br /&gt;
AdvancedPM=no WriteCache=enabled&lt;br /&gt;
Drive Supports : Reserved : ATA-1 ATA-2 ATA-3 ATA-4 &lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
=== Detailed information as reported by hdparm -I ===&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;non-removable ATA device, with non-removable media&lt;br /&gt;
        Model Number:           ST310211A                          &lt;br /&gt;
    &lt;br /&gt;
        Serial Number:          6DB2WQW2            &lt;br /&gt;
        Firmware Revision:      6.55    &lt;br /&gt;
Standards:&lt;br /&gt;
        Supported: 1 2 3 4 &lt;br /&gt;
        Likely used: 5&lt;br /&gt;
Configuration:&lt;br /&gt;
        Logical         max     current&lt;br /&gt;
        cylinders       16383   16383&lt;br /&gt;
        heads           16      16&lt;br /&gt;
        sectors/track   63      63&lt;br /&gt;
        bytes/track:    0               (obsolete)&lt;br /&gt;
        bytes/sector:   0               (obsolete)&lt;br /&gt;
        current sector capacity: 16514064&lt;br /&gt;
        LBA user addressable sectors = 19541088&lt;br /&gt;
Capabilities:&lt;br /&gt;
        LBA, IORDY(can be disabled)&lt;br /&gt;
        Buffer size: 512.0kB    Queue depth: 1&lt;br /&gt;
        Standby timer values: spec'd by standard&lt;br /&gt;
        r/w multiple sector transfer: Max = 16  Current = 16&lt;br /&gt;
        DMA: mdma0 mdma1 mdma2 udma0 udma1 *udma2 udma3 udma4 udma5&lt;br /&gt;
&lt;br /&gt;
             Cycle time: min=120ns recommended=120ns&lt;br /&gt;
        PIO: pio0 pio1 pio2 pio3 pio4 &lt;br /&gt;
             Cycle time: no flow control=240ns  IORDY flow control=120ns&lt;br /&gt;
Commands/features:&lt;br /&gt;
        Enabled Supported:&lt;br /&gt;
           *    READ BUFFER cmd&lt;br /&gt;
           *    WRITE BUFFER cmd&lt;br /&gt;
           *    Host Protected Area feature set&lt;br /&gt;
           *    look-ahead&lt;br /&gt;
           *    write cache&lt;br /&gt;
           *    Power Management feature set&lt;br /&gt;
           *    Security Mode feature set&lt;br /&gt;
                SMART feature set&lt;br /&gt;
                SET MAX security extension&lt;br /&gt;
           *    DOWNLOAD MICROCODE cmd&lt;br /&gt;
Security: &lt;br /&gt;
                supported&lt;br /&gt;
                enabled&lt;br /&gt;
        not     locked&lt;br /&gt;
        not     frozen&lt;br /&gt;
        not     expired: security count&lt;br /&gt;
        not     supported: enhanced erase&lt;br /&gt;
        Security level high&lt;br /&gt;
HW reset results:&lt;br /&gt;
        CBLID- below Vih&lt;br /&gt;
        Device num = 1&lt;br /&gt;
Checksum: correct&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== Hard disk performance measured by hdparm -t ===&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;Timing buffered disk reads:  64 MB in  3.51 seconds = 18.23 MB/sec&lt;br /&gt;
Timing buffer-cache reads:   128 MB in  0.85 seconds =150.59 MB/sec&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Western Digital (8 GB) ==&lt;br /&gt;
&lt;br /&gt;
=== Harddisk information as reported by hdparm -i ===&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;Model=WDC WD80EB-28CGH1, FwRev=24.84G24, SerialNo=***************&lt;br /&gt;
Config={ HardSect NotMFM HdSw&amp;amp;gt;15uSec SpinMotCtl Fixed DTR&amp;amp;gt;5Mbs FmtGapReq }&lt;br /&gt;
RawCHS=15509/16/63, TrkSize=57600, SectSize=600, ECCbytes=40&lt;br /&gt;
BuffType=DualPortCache, BuffSize=768kB, MaxMultSect=16, MultSect=off&lt;br /&gt;
CurCHS=15509/16/63, CurSects=15633072, LBA=yes, LBAsects=15633072&lt;br /&gt;
IORDY=on/off, tPIO={min:120,w/IORDY:120}, tDMA={min:120,rec:120}&lt;br /&gt;
PIO modes:  pio0 pio1 pio2 pio3 pio4 &lt;br /&gt;
DMA modes:  mdma0 mdma1 *mdma2 &lt;br /&gt;
UDMA modes: udma0 udma1 udma2 udma3 udma4 udma5 &lt;br /&gt;
AdvancedPM=no WriteCache=enabled&lt;br /&gt;
Drive conforms to: device does not report version:  1 2 3 4 5&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
=== Detailed information as reported by hdparm -I ===&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;ATA device, with non-removable media&lt;br /&gt;
        Model Number:       WDC WD80EB-28CGH1                      &lt;br /&gt;
&lt;br /&gt;
        Serial Number:      *************** &lt;br /&gt;
        Firmware Revision:  24.84G24&lt;br /&gt;
Standards:&lt;br /&gt;
        Supported: 5 4 3 2 &lt;br /&gt;
        Likely used: 6&lt;br /&gt;
Configuration:&lt;br /&gt;
        Logical         max     current&lt;br /&gt;
        cylinders       15509   15509&lt;br /&gt;
        heads           16      16&lt;br /&gt;
        sectors/track   63      63&lt;br /&gt;
        --&lt;br /&gt;
        CHS current addressable sectors:   15633072&lt;br /&gt;
        LBA    user addressable sectors:   15633072&lt;br /&gt;
        device size with M = 1024*1024:        7633 MBytes&lt;br /&gt;
        device size with M = 1000*1000:        8004 MBytes (8 GB)&lt;br /&gt;
Capabilities:&lt;br /&gt;
        LBA, IORDY(can be disabled)&lt;br /&gt;
        bytes avail on r/w long: 40     Queue depth: 1&lt;br /&gt;
        Standby timer values: spec'd by Standard, with device specific minimum&lt;br /&gt;
        R/W multiple sector transfer: Max = 16  Current = 0&lt;br /&gt;
        Recommended acoustic management value: 128, current value: 254&lt;br /&gt;
        DMA: mdma0 mdma1 *mdma2 udma0 udma1 udma2 udma3 udma4 udma5&lt;br /&gt;
&lt;br /&gt;
             Cycle time: min=120ns recommended=120ns&lt;br /&gt;
        PIO: pio0 pio1 pio2 pio3 pio4 &lt;br /&gt;
             Cycle time: no flow control=120ns  IORDY flow control=120ns&lt;br /&gt;
Commands/features:&lt;br /&gt;
        Enabled Supported:&lt;br /&gt;
           *    READ BUFFER cmd&lt;br /&gt;
           *    WRITE BUFFER cmd&lt;br /&gt;
           *    Host Protected Area feature set&lt;br /&gt;
           *    Look-ahead&lt;br /&gt;
           *    Write cache&lt;br /&gt;
           *    Power Management feature set&lt;br /&gt;
           *    Security Mode feature set&lt;br /&gt;
           *    SMART feature set&lt;br /&gt;
                Automatic Acoustic Management feature set &lt;br /&gt;
                SET MAX security extension&lt;br /&gt;
           *    DOWNLOAD MICROCODE cmd&lt;br /&gt;
Security: &lt;br /&gt;
                supported&lt;br /&gt;
                enabled&lt;br /&gt;
        not     locked&lt;br /&gt;
        not     frozen&lt;br /&gt;
        not     expired: security count&lt;br /&gt;
        not     supported: enhanced erase&lt;br /&gt;
        Security level high&lt;br /&gt;
HW reset results:&lt;br /&gt;
        CBLID- above Vih&lt;br /&gt;
        Device num = 0 determined by CSEL&lt;br /&gt;
Checksum: correct&lt;br /&gt;
&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
=== Hard disk performance measured by hdparm -t ===&lt;br /&gt;
 &lt;br /&gt;
&amp;lt;pre&amp;gt;Timing buffered disk reads:  64 MB in  6.58 seconds =  9.73 MB/sec&lt;br /&gt;
Timing buffer-cache reads:   128 MB in  3.28 seconds = 39.02 MB/sec&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Retrieved from [http://www.xbox-linux.org/wiki/Xbox_Hard_Disk_Technical_Details]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Chihiro&amp;diff=5532</id>
		<title>Chihiro</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Chihiro&amp;diff=5532"/>
				<updated>2017-05-29T11:16:13Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Also see ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/mamedev/mame/blob/master/src/mame/drivers/chihiro.cpp Chihiro MAME driver]&lt;br /&gt;
* [http://segaretro.org/Sega_Chihiro Chihiro information at Sega Retro]&lt;br /&gt;
* [https://github.com/JayFoxRox/Chihiro-Tools Set of tools to extract MAME Chihiro dumps]&lt;br /&gt;
* [https://github.com/JayFoxRox/Chihiro-Launcher A tool to load some Chihiro games on the original Xbox]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=5465</id>
		<title>Main Page</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Main_Page&amp;diff=5465"/>
				<updated>2017-05-26T18:42:21Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;{{:Main Page/Header}}&lt;br /&gt;
&lt;br /&gt;
== Hardware ==&lt;br /&gt;
&lt;br /&gt;
* [[Chihiro]]&lt;br /&gt;
* [[Xbox]]&lt;br /&gt;
&lt;br /&gt;
* [[Hardware revisions]]&lt;br /&gt;
* [[CPU|CPU (Custom Pentium 3 733 MHz)]]&lt;br /&gt;
* [[Memory]]&lt;br /&gt;
* [[MCPX]]&lt;br /&gt;
* [[DVD Drive]]&lt;br /&gt;
* [[Hard Drive]]&lt;br /&gt;
* [[USB]]&lt;br /&gt;
* [[EEPROM]]&lt;br /&gt;
* [[SMC]]&lt;br /&gt;
* [[Video encoder]]&lt;br /&gt;
* [[Xbox Game Disc]]&lt;br /&gt;
* [[Xbox Input Devices]]&lt;br /&gt;
* [[NV2A]]&lt;br /&gt;
** [[NV2A/Vertex attributes]]&lt;br /&gt;
** [[NV2A/Fixed Function Pipeline]]&lt;br /&gt;
** [[NV2A/Vertex Shader]]&lt;br /&gt;
** [[NV2A/Pixel Combiner]]&lt;br /&gt;
** [[NV2A/Surface Formats]]&lt;br /&gt;
* [[NVNet|Network Controller (NVNet)]]&lt;br /&gt;
&lt;br /&gt;
== System Software ==&lt;br /&gt;
* [[MCPX ROM]]&lt;br /&gt;
* [[BIOS]] / [[Kernel]]&lt;br /&gt;
* [[FATX]] (Filesystem)&lt;br /&gt;
* [[Dashboard]]&lt;br /&gt;
* [[Exploits]]&lt;br /&gt;
&lt;br /&gt;
== Development Kits and Tools ==&lt;br /&gt;
* [https://github.com/xqemu/nxdk NXDK (New Xbox Development Kit)]&lt;br /&gt;
* [[OpenXDK]]&lt;br /&gt;
* [[Microsoft XDK]]&lt;br /&gt;
** [[Xbox Debug Monitor]]&lt;br /&gt;
&lt;br /&gt;
== Games ==&lt;br /&gt;
* [[:Category:Games|Games]]&lt;br /&gt;
* [[Engine List]]&lt;br /&gt;
&lt;br /&gt;
== Emulation ==&lt;br /&gt;
* [[Emulators]]&lt;br /&gt;
&lt;br /&gt;
== Other ==&lt;br /&gt;
* [[Network]]&lt;br /&gt;
* Find random stuff in [[Resources]]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Main_Page/Header&amp;diff=5464</id>
		<title>Main Page/Header</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Main_Page/Header&amp;diff=5464"/>
				<updated>2017-05-26T18:39:20Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;div style=&amp;quot;background-color:#e7eef6; border: 1px solid #ccc; color:#000; margin-top: 15px; margin-bottom: 10px; padding: 8px; text-align:center;&amp;quot;&amp;gt;&lt;br /&gt;
&amp;lt;div style=&amp;quot;font-size: 162%; border: none; margin: 0; padding:.1em;&amp;quot;&amp;gt;Welcome to XboxDevWiki.net,&amp;lt;/div&amp;gt;&lt;br /&gt;
&amp;lt;div style=&amp;quot;font-size: 95%&amp;quot;&amp;gt;a wiki dedicated to research of the original Microsoft Xbox.&amp;lt;/div&amp;gt;&lt;br /&gt;
&amp;lt;div style=&amp;quot;text-align:left;&amp;quot;&amp;gt;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;hr&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This is an effort to document the inner workings of the original Microsoft Xbox and Xbox-based SEGA Chihiro.&lt;br /&gt;
We not only care about technical details about those platforms, but also how to develop homebrew and emulate them.&lt;br /&gt;
&lt;br /&gt;
We are not interested in documenting the Xbox 360, Xbox One or any other console at this point.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;hr&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This wiki will become the place for all remaining Xbox projects to come together.&lt;br /&gt;
If you are interested in helping or discussing this, please come chat with us in #xqemu on freenode or Cxbx-Reloaded/Lobby on gitter.im. &lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;br /&gt;
&amp;lt;/div&amp;gt;&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=Emulators&amp;diff=5463</id>
		<title>Emulators</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=Emulators&amp;diff=5463"/>
				<updated>2017-05-26T18:38:21Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This is a list of known Xbox emulation projects&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable sortable&amp;quot;&lt;br /&gt;
!Status&lt;br /&gt;
!Approach&lt;br /&gt;
!Name&lt;br /&gt;
!Links&lt;br /&gt;
!Initiator&lt;br /&gt;
!Platform&lt;br /&gt;
!License&lt;br /&gt;
!Notes&lt;br /&gt;
|-&lt;br /&gt;
|Maintained&lt;br /&gt;
|LLE&lt;br /&gt;
|[[XQEMU]]&lt;br /&gt;
|&lt;br /&gt;
|espes&lt;br /&gt;
|Windows/Linux/Mac/Others	&lt;br /&gt;
|&lt;br /&gt;
|XQEMU supports hardware-acceleration for the CPU emulation on Linux through KVM.&lt;br /&gt;
|-&lt;br /&gt;
|Maintained&lt;br /&gt;
|HLE&lt;br /&gt;
|[[Cxbx-Reloaded]]&lt;br /&gt;
|&lt;br /&gt;
|SoullessSentinel&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|At the time of writing Cxbx-Reloaded is almost purely HLE. LLE GPU emulation is planned, but currently not implemented.&lt;br /&gt;
|-&lt;br /&gt;
|Dead&lt;br /&gt;
|HLE&lt;br /&gt;
|[[Cxbx]]&lt;br /&gt;
|&lt;br /&gt;
|Caustik&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Dead&lt;br /&gt;
|HLE&lt;br /&gt;
|Dxbx&lt;br /&gt;
|[http://dxbx-emu.com][https://github.com/PatrickvL/Dxbx/]&lt;br /&gt;
|ShadowTj&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|The project was started on March 23rd 2008. It is an improved port of Cxbx to the Delphi programming language.&lt;br /&gt;
|-&lt;br /&gt;
|Unknown&lt;br /&gt;
|Unknown&lt;br /&gt;
|[https://github.com/impeachgod/Dirtbox Dirtbox]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Unknown&lt;br /&gt;
|HLE&lt;br /&gt;
|[https://sourceforge.net/p/ironbabel/code/HEAD/tree/trunk/Box/Xbox/ IronBabel]&lt;br /&gt;
|&lt;br /&gt;
|daeken&lt;br /&gt;
|Unknown&lt;br /&gt;
|&lt;br /&gt;
|This seems to have been a generic portability framework&lt;br /&gt;
|-&lt;br /&gt;
|Unknown&lt;br /&gt;
|HLE&lt;br /&gt;
|[https://github.com/daeken/Steelbreeze Steelbreeze]&lt;br /&gt;
|&lt;br /&gt;
|daeken&lt;br /&gt;
|Unknown&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Unknown&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|[https://github.com/daeken/Zookeeper Zookeeper]&lt;br /&gt;
|&lt;br /&gt;
|daeken&lt;br /&gt;
|Unknown&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Unknown&lt;br /&gt;
|Unknown&lt;br /&gt;
|[http://ngemu.com/threads/.154342/ XbeNext]&lt;br /&gt;
|&lt;br /&gt;
|LoveMHz&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Dead&lt;br /&gt;
|HLE&lt;br /&gt;
|[http://ngemu.com/forums/.65/ Xeon]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Unknown&lt;br /&gt;
|Unknown&lt;br /&gt;
|[http://ngemu.com/threads/.105210/ XProject]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Unknown&lt;br /&gt;
|Unknown&lt;br /&gt;
|[https://code.google.com/p/xbem xbem]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Dead&lt;br /&gt;
|LLE/HLE Hybrid&lt;br /&gt;
|Hackbox&lt;br /&gt;
|&lt;br /&gt;
|JayFoxRox&lt;br /&gt;
|Windows/Linux&lt;br /&gt;
|Private&lt;br /&gt;
|This was originally going to be a commercial emulator (but plans were dropped quickly in favor of preservation). The source code was temporarily public but then made private. The source code is still available to a selected group of developers. Hackbox was designed from scratch but re-used code from Cxbx for HLE routine detection.&lt;br /&gt;
|-&lt;br /&gt;
|Unknown&lt;br /&gt;
|LLE&lt;br /&gt;
|[https://github.com/phire/kvmbox kvmbox]&lt;br /&gt;
|&lt;br /&gt;
|phire&lt;br /&gt;
|Linux&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Unknown&lt;br /&gt;
|HLE&lt;br /&gt;
|[https://github.com/Gabriel-Maldonado/XboxHLE XboxHLE]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Unknown&lt;br /&gt;
|Unknown&lt;br /&gt;
|[https://github.com/bjh83/boombox boombox]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Unknown&lt;br /&gt;
|Unknown&lt;br /&gt;
|[https://github.com/docbrown/vxb vxb]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Unknown&lt;br /&gt;
|Unknown&lt;br /&gt;
|[https://github.com/quantumdude836/exciplex exciplex]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Maintained&lt;br /&gt;
|LLE&lt;br /&gt;
|[http://mamedev.org/ MAME/Chihiro]&lt;br /&gt;
|&lt;br /&gt;
|MAME Team&lt;br /&gt;
|Windows/Linux/Mac/Others&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Unknown&lt;br /&gt;
|LLE&lt;br /&gt;
|[http://mamedev.org/ MAME/Xbox]&lt;br /&gt;
|&lt;br /&gt;
|MAME Team&lt;br /&gt;
|Windows/Linux/Mac/Others&lt;br /&gt;
|&lt;br /&gt;
|Does this exist yet?{{citation needed}}&lt;br /&gt;
|-&lt;br /&gt;
|Dead&lt;br /&gt;
|Unknown&lt;br /&gt;
|[https://github.com/monocasa/xbvm XBVM]&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Dead&lt;br /&gt;
|&lt;br /&gt;
|[http://xenoborg-emu.blogspot.com/ Xenoborg]&lt;br /&gt;
|&lt;br /&gt;
|blueshogun96&lt;br /&gt;
|Windows&lt;br /&gt;
|&lt;br /&gt;
|&lt;br /&gt;
|-&lt;br /&gt;
|Dead&lt;br /&gt;
|Unknown&lt;br /&gt;
|[[Xbox 360 Backward Compatibility]]&lt;br /&gt;
|&lt;br /&gt;
|Microsoft&lt;br /&gt;
|Xbox 360&lt;br /&gt;
|Proprietary&lt;br /&gt;
|&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== References and links == &lt;br /&gt;
&lt;br /&gt;
* [https://www.reddit.com/r/emulation/comments/6a958p/cxbx_reloaded_xbox_emulator_panzer_dragoon_orta/ Discussion about Xbox emulation and technical differences between [[Cxbx-Reloaded]] and [[XQEMU]]]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	<entry>
		<id>https://xboxdevwiki.net/index.php?title=EEPROM&amp;diff=5423</id>
		<title>EEPROM</title>
		<link rel="alternate" type="text/html" href="https://xboxdevwiki.net/index.php?title=EEPROM&amp;diff=5423"/>
				<updated>2017-05-25T19:01:36Z</updated>
		
		<summary type="html">&lt;p&gt;Espes: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The EEPROM of the Xbox is connected via I²C and located on address 0x54.&lt;br /&gt;
The EEPROM is 256 bytes and stores the settings and other information about the Xbox.&lt;br /&gt;
&lt;br /&gt;
The Chihiro EEPROM key is &amp;lt;code&amp;gt;7B 35 A8 B7 27 ED 43 7A A0 BA FB 8F A4 38 61 80&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Contents ==&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
! Offset !! Field !! Notes&lt;br /&gt;
|-&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
== Notes ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip with a Raspberry Pi]&lt;/div&gt;</summary>
		<author><name>Espes</name></author>	</entry>

	</feed>