https://xboxdevwiki.net/api.php?action=feedcontributions&feedformat=atom&user=Mborgersonxboxdevwiki - User contributions [en]2026-05-21T05:00:24ZUser contributionsMediaWiki 1.28.0https://xboxdevwiki.net/index.php?title=System_Link&diff=7382System Link2024-12-19T22:36:11Z<p>Mborgerson: Add system link patent</p>
<hr />
<div>=== Secured traffic ===<br />
<br />
Xbox network traffic is secured through [[wikipedia:IPSec|IPSec]]. The implementation appears to be similar to [https://tools.ietf.org/html/rfc3948#section-2.1 RFC 3498, Section 2.1] from 2005 which was co-authored by Microsoft.<br />
<br />
The protocol uses UDP port 3074 which is also registered with the IANA for use in the Xbox[https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=3074].<br />
Each Xbox uses the IP 0.0.0.1, so addressing relies on MAC-addresses{{FIXME|reason=Confirm this}}.<br />
<br />
The specific implementation in the Xbox uses TripleDES ([https://tools.ietf.org/html/rfc1851 RFC 1851]) for encryption, and SHA1-96 as [[wikipedia:HMAC|HMAC]].<br />
<br />
==== Key derivation ====<br />
<br />
The following keys are involved in generating the actual network crypto-keys:<br />
<br />
* XboxLANKey (Kernel export)<br />
* Game specific LAN Key (XBE Certificate Header)<br />
<br />
The algorithm to generate the final keys, is this:<br />
<br />
<pre><br />
LAN-Hash_1 = HMAC(XboxLANKey, concatenate(0x00, XBE-LAN-Key))<br />
LAN-Hash_2 = HMAC(XboxLANKey, concatenate(0x01, XBE-LAN-Key))<br />
<br />
LAN-Hash = concatenate(LAN-Hash_1, LAN-Hash_2)<br />
<br />
LAN-SHA = LAN-Hash_0_to_15<br />
LAN-DES = XcDESKeyParity(LAN-Hash_16_to_39)<br />
</pre><br />
<br />
[[Kernel/XcDESKeyParity|XcDESKeyParity]] is the same as the respective function in the Xbox kernel.<br />
<br />
==== Broadcast messages ====<br />
<br />
Because no security association exists for broadcast messages, these are handled differently.<br />
A common use case for broadcast messages is a server announce request / response.<br />
<br />
Broadcast messages are send to 255.255.255.255 (MAC-address: FF:FF:FF:FF:FF:FF) using SPI 0xFFFFFFFF and Sequence Number 0xFFFFFFFF.<br />
A random IV is chosen, but nothing prevents re-using an IV.<br />
<br />
==== Security association ====<br />
<br />
Most messages require an SA between devices{{FIXME|reason=Look into this}}.<br />
<br />
=== XDK API ===<br />
<br />
{{FIXME|reason=This probably shouldn't be here? there should be dedicated articles for the XDK APIs}}<br />
<br />
{| class="wikitable"<br />
|+XNet* Functions<br />
|-<br />
! function<br />
! description<br />
|-<br />
|XNetCreateKey(&xnkid, &xnkey)<br />
| <br />
|-<br />
|XNetRegisterKey(&xnkid, &xnkey)<br />
|Register the session key<br />
|-<br />
|XNetXnAddrToInAddr( pxnaddr, pxnkid, &pseudoIP )<br />
|Convert the address to a winsock usable format<br />
|-<br />
|XNetUnregisterKey( &xbc.SessionID )<br />
|<br />
|-<br />
|XNetGetTitleXnAddr( &hostAddr )<br />
|Gets your XNADDR. Used by syslink, and lots of other people.<br />
|-<br />
|XNetGetEthernetLinkStatus()<br />
|<br />
|}<br />
<br />
=== References and Links ===<br />
<br />
* [https://hllmn.net/blog/2023-09-18_h1x-net/ Exploring The Halo 1 System Link Protocol]<br />
* [https://www.google.com/patents/US20030093669 Patent: Network architecture for secure communications between two console-based gaming systems]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=System_Link&diff=7381System Link2024-12-19T22:33:39Z<p>Mborgerson: Fix section header</p>
<hr />
<div>=== Secured traffic ===<br />
<br />
Xbox network traffic is secured through [[wikipedia:IPSec|IPSec]]. The implementation appears to be similar to [https://tools.ietf.org/html/rfc3948#section-2.1 RFC 3498, Section 2.1] from 2005 which was co-authored by Microsoft.<br />
<br />
The protocol uses UDP port 3074 which is also registered with the IANA for use in the Xbox[https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=3074].<br />
Each Xbox uses the IP 0.0.0.1, so addressing relies on MAC-addresses{{FIXME|reason=Confirm this}}.<br />
<br />
The specific implementation in the Xbox uses TripleDES ([https://tools.ietf.org/html/rfc1851 RFC 1851]) for encryption, and SHA1-96 as [[wikipedia:HMAC|HMAC]].<br />
<br />
==== Key derivation ====<br />
<br />
The following keys are involved in generating the actual network crypto-keys:<br />
<br />
* XboxLANKey (Kernel export)<br />
* Game specific LAN Key (XBE Certificate Header)<br />
<br />
The algorithm to generate the final keys, is this:<br />
<br />
<pre><br />
LAN-Hash_1 = HMAC(XboxLANKey, concatenate(0x00, XBE-LAN-Key))<br />
LAN-Hash_2 = HMAC(XboxLANKey, concatenate(0x01, XBE-LAN-Key))<br />
<br />
LAN-Hash = concatenate(LAN-Hash_1, LAN-Hash_2)<br />
<br />
LAN-SHA = LAN-Hash_0_to_15<br />
LAN-DES = XcDESKeyParity(LAN-Hash_16_to_39)<br />
</pre><br />
<br />
[[Kernel/XcDESKeyParity|XcDESKeyParity]] is the same as the respective function in the Xbox kernel.<br />
<br />
==== Broadcast messages ====<br />
<br />
Because no security association exists for broadcast messages, these are handled differently.<br />
A common use case for broadcast messages is a server announce request / response.<br />
<br />
Broadcast messages are send to 255.255.255.255 (MAC-address: FF:FF:FF:FF:FF:FF) using SPI 0xFFFFFFFF and Sequence Number 0xFFFFFFFF.<br />
A random IV is chosen, but nothing prevents re-using an IV.<br />
<br />
==== Security association ====<br />
<br />
Most messages require an SA between devices{{FIXME|reason=Look into this}}.<br />
<br />
=== XDK API ===<br />
<br />
{{FIXME|reason=This probably shouldn't be here? there should be dedicated articles for the XDK APIs}}<br />
<br />
{| class="wikitable"<br />
|+XNet* Functions<br />
|-<br />
! function<br />
! description<br />
|-<br />
|XNetCreateKey(&xnkid, &xnkey)<br />
| <br />
|-<br />
|XNetRegisterKey(&xnkid, &xnkey)<br />
|Register the session key<br />
|-<br />
|XNetXnAddrToInAddr( pxnaddr, pxnkid, &pseudoIP )<br />
|Convert the address to a winsock usable format<br />
|-<br />
|XNetUnregisterKey( &xbc.SessionID )<br />
|<br />
|-<br />
|XNetGetTitleXnAddr( &hostAddr )<br />
|Gets your XNADDR. Used by syslink, and lots of other people.<br />
|-<br />
|XNetGetEthernetLinkStatus()<br />
|<br />
|}<br />
<br />
=== References and Links ===<br />
<br />
* [https://hllmn.net/blog/2023-09-18_h1x-net/ Exploring The Halo 1 System Link Protocol]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=System_Link&diff=7380System Link2024-12-19T22:32:58Z<p>Mborgerson: Add link to "Exploring The Halo 1 System Link Protocol" article</p>
<hr />
<div>=== Secured traffic ===<br />
<br />
Xbox network traffic is secured through [[wikipedia:IPSec|IPSec]]. The implementation appears to be similar to [https://tools.ietf.org/html/rfc3948#section-2.1 RFC 3498, Section 2.1] from 2005 which was co-authored by Microsoft.<br />
<br />
The protocol uses UDP port 3074 which is also registered with the IANA for use in the Xbox[https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=3074].<br />
Each Xbox uses the IP 0.0.0.1, so addressing relies on MAC-addresses{{FIXME|reason=Confirm this}}.<br />
<br />
The specific implementation in the Xbox uses TripleDES ([https://tools.ietf.org/html/rfc1851 RFC 1851]) for encryption, and SHA1-96 as [[wikipedia:HMAC|HMAC]].<br />
<br />
==== Key derivation ====<br />
<br />
The following keys are involved in generating the actual network crypto-keys:<br />
<br />
* XboxLANKey (Kernel export)<br />
* Game specific LAN Key (XBE Certificate Header)<br />
<br />
The algorithm to generate the final keys, is this:<br />
<br />
<pre><br />
LAN-Hash_1 = HMAC(XboxLANKey, concatenate(0x00, XBE-LAN-Key))<br />
LAN-Hash_2 = HMAC(XboxLANKey, concatenate(0x01, XBE-LAN-Key))<br />
<br />
LAN-Hash = concatenate(LAN-Hash_1, LAN-Hash_2)<br />
<br />
LAN-SHA = LAN-Hash_0_to_15<br />
LAN-DES = XcDESKeyParity(LAN-Hash_16_to_39)<br />
</pre><br />
<br />
[[Kernel/XcDESKeyParity|XcDESKeyParity]] is the same as the respective function in the Xbox kernel.<br />
<br />
==== Broadcast messages ====<br />
<br />
Because no security association exists for broadcast messages, these are handled differently.<br />
A common use case for broadcast messages is a server announce request / response.<br />
<br />
Broadcast messages are send to 255.255.255.255 (MAC-address: FF:FF:FF:FF:FF:FF) using SPI 0xFFFFFFFF and Sequence Number 0xFFFFFFFF.<br />
A random IV is chosen, but nothing prevents re-using an IV.<br />
<br />
==== Security association ====<br />
<br />
Most messages require an SA between devices{{FIXME|reason=Look into this}}.<br />
<br />
=== XDK API ===<br />
<br />
{{FIXME|reason=This probably shouldn't be here? there should be dedicated articles for the XDK APIs}}<br />
<br />
{| class="wikitable"<br />
|+XNet* Functions<br />
|-<br />
! function<br />
! description<br />
|-<br />
|XNetCreateKey(&xnkid, &xnkey)<br />
| <br />
|-<br />
|XNetRegisterKey(&xnkid, &xnkey)<br />
|Register the session key<br />
|-<br />
|XNetXnAddrToInAddr( pxnaddr, pxnkid, &pseudoIP )<br />
|Convert the address to a winsock usable format<br />
|-<br />
|XNetUnregisterKey( &xbc.SessionID )<br />
|<br />
|-<br />
|XNetGetTitleXnAddr( &hostAddr )<br />
|Gets your XNADDR. Used by syslink, and lots of other people.<br />
|-<br />
|XNetGetEthernetLinkStatus()<br />
|<br />
|}<br />
<br />
==== References and links ====<br />
<br />
* [https://hllmn.net/blog/2023-09-18_h1x-net/ Exploring The Halo 1 System Link Protocol]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Emulators&diff=7319Emulators2023-01-10T21:29:53Z<p>Mborgerson: Update xemu repo link</p>
<hr />
<div>This is a list of known Xbox emulation projects<br />
<br />
{| class="wikitable sortable"<br />
!Status<br />
!Approach<br />
!Chihiro<br />
!Name<br />
!Links<br />
!Initiator<br />
!Platform<br />
!License<br />
!Notes<br />
<br />
|-<br />
|{{Yes|Maintained}}<br />
|LLE<br />
|{{Yes}}<br />
|[[XQEMU]]<br />
|[http://xqemu.com/][https://github.com/xqemu/][https://github.com/espes/xqemu]<br />
|espes<br />
|Windows/macOS/Linux/Others <br />
|<br />
|XQEMU supports hardware-acceleration for the CPU emulation on Linux through KVM.<br />
<br />
|-<br />
|{{Yes|Maintained}}<br />
|LLE<br />
|{{Yes}}<br />
|[[Xemu|xemu]]<br />
|[https://xemu.app/][https://github.com/xemu-project/xemu]<br />
|mborgerson<br />
|Windows/macOS/Linux<br />
|<br />
|xemu is a fork of XQEMU but more usable<br />
<br />
|-<br />
|{{Yes|Maintained}}<br />
|HLE/LLE Hybrid<br />
|{{No}}<br />
|[[Cxbx-Reloaded]]<br />
|[http://cxbx-reloaded.co.uk/][https://github.com/Cxbx-Reloaded/Cxbx-Reloaded]<br />
|SoullessSentinel<br />
|Windows<br />
|<br />
|Cxbx-Reloaded supports LLE GPU emulation which was taken from XQEMU. At the time of writing, the LLE GPU is significantly slower than in XQEMU.<br />
<br />
|-<br />
|{{Yes|Maintained}}<br />
|LLE<br />
|{{Yes}}<br />
|[http://mamedev.org/ MAME]<br />
|[http://adb.arcadeitalia.net/?mame=xbox][http://adb.arcadeitalia.net/?mame=chihiro][http://emulation.gametechwiki.com/index.php/MAME_compatibility_list#Xbox][http://emulation.gametechwiki.com/index.php/MAME_compatibility_list#Chihiro_Arcade]<br />
|[https://github.com/mamedev/mame/commits?author=yz70s yz70s] (Samuele Zannoli) and MAME Team<br />
|Windows/macOS/Linux/Others<br />
|<br />
|Focus seems to be on Chihiro emulation.<br />
<br />
|-<br />
|{{No|Dead}}<br />
|LLE/HLE Hybrid<br />
|{{No}}<br />
|[[Fusion]][http://michaelbrundage.com/project/xbox-360-emulator/]<br />
|<br />
|Microsoft<br />
|Xbox 360<br />
|Proprietary<br />
|<br />
|-<br />
|{{Yes|Maintained}}<br />
|LLE/HLE Hybrid{{citation needed}}<br />
|{{No}}<br />
|[[Fission]][http://www.ign.com/articles/2017/10/23/the-untold-story-of-xbox-one-backwards-compatibility]<br />
|[http://www.xbox.com/en-US/xbox-one/backward-compatibility]<br />
|Microsoft<br />
|Xbox One<br />
|Proprietary<br />
|Announced at E3 2017. Said to be working similar to the 360 support in the Xbox One [https://youtu.be/x0NKP7-h_G0?t=8503]. The 360 support is probably ahead of time shader translation and runtime CPU translation [https://majornelson.com/podcast/584-xbox-one-backward-compatibility-turns-1/].<br />
|<br />
<br />
|-<br />
|{{No|Dead}}<br />
|LLE<br />
|{{No}}<br />
|Tortoise<br />
|[https://gitlab.com/kvmbox-reloaded/]<br />
|JayFoxRox, phire<br />
|<br />
|<br />
|The decision was made to create an HLE / LLE Xbox emulation project which is maintained similar to Dolphin or Citra. A key focus was on design simplicity. The project started as a continuation of kvmbox, with devices being copied from the XQEMU source code. The project was called kvmbox-reloaded, while the name was being decided. The HLE portion was never worked on.<br />
<br />
|-<br />
|{{No|Dead}}<br />
|LLE/HLE Hybrid<br />
|{{No}}<br />
|OpenXBOX<br />
|[https://github.com/mborgerson/OpenXBOX]<br />
|mborgerson<br />
|<br />
|<br />
|<br />
<br />
|-<br />
|{{No|Dead}}<br />
|HLE/LLE Hybrid<br />
|{{No}}<br />
|xexec<br />
|<br />
|[http://xboxdevwiki.net/User:Haxar Haxar]<br />
|Linux<br />
|<br />
|Xexec is an Xbox executable loader & emulator for x86/x64 Linux; handles direct execution of x86 code, executing Xbox game code directly on the CPU, in userspace Linux; All Windows kernel calls from Xbox game code are translated into POSIX syscalls, with no dependency on Wine.<br />
<br />
|-<br />
|{{No|Dead}}<br />
|LLE/HLE Hybrid<br />
|{{No}}<br />
|[https://github.com/blueshogun96/MacBox MacBox]<br />
|[http://shogun3d-cxbx.blogspot.com/2017/01/the-macos-experiment-part-1.html][http://shogun3d-cxbx.blogspot.com/2017/01/around-beginning-of-new-year-i.html]<br />
|blueshogun96<br />
|macOS<br />
|<br />
|"The macOS Experiment" - An experimental VM for Macs that don't have support for the official VM framework. A simple proof of concept.<br />
<br />
|-<br />
|{{Yes|Maintained}}<br />
|LLE/HLE Hybrid<br />
|{{No}}<br />
|StrikeBox<br />
|[https://github.com/StrikerX3/StrikeBox]<br />
|StrikerX3<br />
|Windows/Linux<br />
|<br />
|A fork of OpenXBOX, which was turned into a separate project.<br />
<br />
|-<br />
|{{No|Dead}}<br />
|HLE<br />
|{{No}}<br />
|[[Cxbx]]<br />
|<br />
|Caustik<br />
|Windows<br />
|<br />
|<br />
|-<br />
|{{No|Dead}}<br />
|HLE<br />
|{{No}}<br />
|Dxbx<br />
|[http://dxbx-emu.com][https://github.com/PatrickvL/Dxbx/]<br />
|ShadowTj<br />
|Windows<br />
|<br />
|The project was started on March 23rd 2008. It is an improved port of Cxbx to the Delphi programming language.<br />
<br />
|-<br />
|{{Unknown}}<br />
|Unknown<br />
|{{No}}<br />
|[https://github.com/impeachgod/Dirtbox Dirtbox]<br />
|<br />
|<br />
|Windows<br />
|<br />
|<br />
|-<br />
|{{Unknown}}<br />
|HLE<br />
|{{No}}<br />
|[https://sourceforge.net/p/ironbabel/code/HEAD/tree/trunk/Box/Xbox/ IronBabel]<br />
|<br />
|daeken<br />
|Unknown<br />
|<br />
|This seems to have been a generic portability framework<br />
|-<br />
|{{Unknown}}<br />
|HLE<br />
|{{No}}<br />
|[https://github.com/daeken/Steelbreeze Steelbreeze]<br />
|<br />
|daeken<br />
|Unknown<br />
|<br />
|<br />
|-<br />
|{{Unknown}}<br />
|LLE/HLE Hybrid<br />
|{{No}}<br />
|[https://github.com/daeken/Zookeeper Zookeeper]<br />
|[https://www.reddit.com/r/EmuDev/comments/4isyvu/project_zookeeper_a_new_xbox_emulator/]<br />
|daeken<br />
|macOS<br />
|<br />
|Using Apple's Hypervisor.framework to run a custom kernel (NightBeliever in the repo) and then running Xbox code from there<br />
|-<br />
|{{Unknown}}<br />
|Unknown<br />
|{{No}}<br />
|[http://ngemu.com/threads/.154342/ XbeNext]<br />
|[https://github.com/LoveMHz/XBENext]<br />
|LoveMHz<br />
|Windows<br />
|<br />
|<br />
|-<br />
|{{No|Dead}}<br />
|HLE<br />
|{{No}}<br />
|[http://ngemu.com/forums/.65/ Xeon]<br />
|<br />
|_SF_<br />
|Windows<br />
|<br />
|<br />
|-<br />
|{{Unknown}}<br />
|Unknown<br />
|{{No}}<br />
|[http://ngemu.com/threads/.105210/ XProject]<br />
|<br />
|<br />
|Windows<br />
|<br />
|<br />
|-<br />
|{{Unknown}}<br />
|Unknown<br />
|{{No}}<br />
|[https://code.google.com/p/xbem xbem]<br />
|<br />
|<br />
|Windows<br />
|<br />
|<br />
|-<br />
|{{No|Dead}}<br />
|LLE/HLE Hybrid<br />
|{{Yes}}<br />
|Hackbox<br />
|<br />
|JayFoxRox<br />
|Windows/Linux<br />
|Private<br />
|This was originally going to be a commercial emulator (but plans were dropped quickly in favor of preservation). The source code was temporarily public but then made private. The source code is still available to a selected group of developers. Hackbox was designed from scratch but re-used code from Cxbx for HLE routine detection.<br />
|-<br />
|{{Unknown}}<br />
|LLE<br />
|{{No}}<br />
|[https://github.com/phire/kvmbox kvmbox]<br />
|<br />
|phire<br />
|Linux<br />
|<br />
|<br />
|-<br />
|{{Unknown}}<br />
|HLE<br />
|{{No}}<br />
|[https://github.com/Gabriel-Maldonado/XboxHLE XboxHLE]<br />
|<br />
|<br />
|Windows<br />
|<br />
|<br />
|-<br />
|{{Unknown}}<br />
|Unknown<br />
|{{No}}<br />
|[https://github.com/bjh83/boombox boombox]<br />
|<br />
|<br />
|Windows<br />
|<br />
|<br />
|-<br />
|{{Unknown}}<br />
|Unknown<br />
|{{No}}<br />
|[https://github.com/docbrown/vxb vxb]<br />
|<br />
|<br />
|Windows<br />
|<br />
|<br />
|-<br />
|{{Unknown}}<br />
|Unknown<br />
|{{No}}<br />
|[https://github.com/quantumdude836/exciplex exciplex]<br />
|<br />
|<br />
|Windows<br />
|<br />
|<br />
|-<br />
|{{No|Dead}}<br />
|LLE<br />
|{{No}}<br />
|[https://github.com/monocasa/xbvm XBVM]<br />
|<br />
|monocasa<br />
|Linux<br />
|<br />
|<br />
|-<br />
|{{No|Dead}}<br />
|<br />
|{{No}}<br />
|[http://xenoborg-emu.blogspot.com/ Xenoborg]<br />
|<br />
|blueshogun96<br />
|Windows<br />
|<br />
|<br />
|}<br />
<br />
== References and links == <br />
<br />
* [https://www.reddit.com/r/emulation/comments/6a958p/cxbx_reloaded_xbox_emulator_panzer_dragoon_orta/ Discussion about Xbox emulation and technical differences between [[Cxbx-Reloaded]] and [[XQEMU]]]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Xbox_Live&diff=7296Xbox Live2022-10-21T09:43:36Z<p>Mborgerson: </p>
<hr />
<div>Xbox Live is an online multiplayer gaming and digital media delivery service created and operated by Microsoft. It was first made available to the Xbox system in November 2002. ([https://en.wikipedia.org/wiki/Xbox_Live Wikipedia]) Xbox Live support for the original Xbox ended in April 15, 2010. <br />
<br />
== Architecture ==<br />
The Xbox Live architecture consists of Kerberos-based authentication tickets, with a Secure Gateway used to then access services (such as Matchmaking, Statistics/Leaderboards, and custom game servers)<br />
<br />
Authentication and access to Xbox Live services is controlled using the Kerberos protocol with a few proprietary customisations for the Xbox. When an Xbox first connects, the server gives it a [[Xbox Live/Machine Account|Machine Account]] which it uses to access the service; this machine account is always sent, but it can only be used alone to access UACS (User Account Creation Service) to create a user account - with both a machine account and user account, all other services are accessible.<br />
<br />
== XDK Functions ==<br />
<br />
{| class="wikitable"<br />
|+XOnline* Functions<br />
|-<br />
! function<br />
! description<br />
|-<br />
|XOnlineGetUsers(XONLINE_USER* XBLAccountusers, DWORD* numOfXBLiveAccounts)<br />
|The XOnlineGetUsers function will enumerate both the hard disk and any attached memory units looking for user accounts<br />
|-<br />
|XOnlineTaskClose(XONLINETASK_HANDLE logonHandle)<br />
|Called to abort the authentication process.<br />
|-<br />
|XOnlineStartup( XONLINE_STARTUP_PARAMS* )<br />
|<br />
|-<br />
|XOnlineLogon(XONLINE_USER* XBLLoggedOnUsers, DWORD* XBLservices, DWORD SERVICE_COUNT, NULL, XONLINETASK_HANDLE &logonHandle)<br />
|When a title calls XOnlineLogon to sign in, instead of blocking until the authentication completes, an asynchronous task handle is returned. As part of the authentication process a title must specify which services it will be using (XBLservices, SERVICE_COUNT). <br />
|-<br />
|XOnlineTaskContinue(XONLINETASK_HANDLE logonHandle)<br />
|Called to check the status of XOnlineLogon. It will return XONLINETASK_S_RUNNING while the login process has not been completed.<br />
|-<br />
|XOnlineLogonTaskGetResults(XONLINETASK_HANDLE logonHandle)<br />
|Will return XONLINE_S_LOGON_CONNECTION_ESTABLISHED when the task is successfully completed. Otherwise it will return an error code.<br />
|-<br />
|XOnlineGetLogonUsers()<br />
|This returns a pointer to an array of XONLINE USER structures. This array is similar the XONLINE USER array we populated and passed into XOnlineLogon, but is updated with error status and permission flags for each user.<br />
|-<br />
|XOnlineSetUserGuestNumber(dwUserFlags , 1)<br />
|<br />
|-<br />
|XOnlineTitleUpdate(DWORD)<br />
|The XOnlineTitleUpdate function will boot into an updater application, which performs the actual update<br />
|-<br />
|XOnlineGetServiceInfo(Service, ?)<br />
|XOnlineGetServiceInfo returns the connection status for a service<br />
|-<br />
|XOnlineNotificationSetState<br />
|<br />
|}<br />
<br />
== Discontinuation of service ==<br />
<br />
The service was officially discontinued on April 15th, 2010.<br />
<br />
12 players decided to stay in a lobby of ''Halo 2'' 24/7 to keep a server running.<br />
The final player, Apache N4SIR was streaming the entire event, as the player count of 12 twindeled down to just him. At 11:40 PM PDT, on May 11th 2010, Apache N4SIR was booted from the game[http://i.imgur.com/oQw6k5H.jpg].<br />
<br />
== See Also ==<br />
<br />
* [https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20video%20and%20slides/DEF%20CON%2030%20-%20Tristan%20Miller%20-%20Reversing%20the%20Original%20Xbox%20Live%20Protocols.mp4 Reversing the Original Xbox Live Protocols] presented by [[User:monocasa]] at DEF CON 30 (2022).</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Resources&diff=7295Resources2022-10-21T09:40:36Z<p>Mborgerson: </p>
<hr />
<div>== Xbox Post-Mortems by developers ==<br />
<br />
=== Xbox Launch ===<br />
<br />
* GDC2002: [https://www.powershow.com/download/6f1ff7-NmE2O/Xbox_Launch_Lessons_Learned_powerpoint_ppt_presentation Xbox Launch: Lessons Learned] ([https://www.gdcvault.com/play/1022522/Xbox-Launch-Lessons Audio])<br />
<br />
=== Post processing ===<br />
<br />
* CEDEC2002: [https://web.archive.org/web/20031212044938/http://www.daionet.gr.jp/~masa/column/2002-09-22.html DOUBLE-S.T.E.A.L techniques] ''(Japanese)''<br />
* GDC2003: [https://web.archive.org/web/20031212140633/http://www.daionet.gr.jp/~masa/column/2003-03-21.html Frame Buffer Postprocessing Effects in DOUBLE-S.T.E.A.L (Wreckless)] ''(English)''<br />
<br />
=== HDR rendering ===<br />
<br />
* GDC2004: [https://web.archive.org/web/20060404103630/http://www.daionet.gr.jp/~masa/column/2004-04-04.html Practical Implementation of High Dynamic Range Rendering]<br />
<br />
=== Deferred Shading ===<br />
<br />
* https://sites.google.com/site/richgel99/index#TOC-Shrek-Xbox-and-Deferred-Shading<br />
* https://sites.google.com/site/richgel99/home<br />
* https://sites.google.com/site/richgel99/home/xbox-1-g-buffer-attribute-packing-pixel-shader<br />
* https://web.archive.org/web/20171008031141/http://www.tenacioussoftware.com/gdc_2004_deferred_shading.ppt<br />
<br />
== Random resources about Xbox hacking ==<br />
* [https://events.ccc.de/congress/2005/fahrplan/attachments/591-paper_xbox.pdf Michael Steils Xbox Presentation from C3 in 2005]<br />
* https://media.ccc.de/v/19C3-399-xbox-linux<br />
* https://media.ccc.de/v/22C3-559-en-xbox_hacking<br />
* https://www.youtube.com/watch?v=6fOjGLCctEY<br />
* [http://www.bunniestudios.com/bunnie/proj/anatak/xboxmod.html Bunnies original Xbox page]<br />
* [https://www.nostarch.com/xboxfree Bunnies "Hacking the Xbox" e-book for free]<br />
* [http://web.archive.org/web/20010417064218/ddj.com/articles/2000/0008/0008a/0008a.htm?topic=graphics Article about Xbox Graphics (before release) from Dr. Dobbs]<br />
* [http://www.anandtech.com/show/853 Technical article about the Xbox by AnandTech]<br />
* [https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20video%20and%20slides/DEF%20CON%2030%20-%20Tristan%20Miller%20-%20Reversing%20the%20Original%20Xbox%20Live%20Protocols.mp4 Reversing the Original Xbox Live Protocols] presented by [[User:monocasa]] at DEF CON 30 (2022)<br />
<br />
== History ==<br />
* [https://www.youtube.com/watch?v=rUODlNffWmU 3 Xbox Bosses Share Secrets of the Console's Past (Video)]<br />
* [https://www.youtube.com/watch?v=iWQb7LGH71s Xbox Assembly Line Tour (Video)]<br />
* [https://www.youtube.com/watch?v=_gOoI57q72M XBox Oral History Panel with Nick Baker, Todd Holmdahl, and Albert Penello (Video)]<br />
* [https://www.youtube.com/watch?v=2VCb-y7MC5U?t=1248 Behind the Code - Interview with Nick Baker (Video) intresting xbox part starts 20:48]<br />
<br />
== Background knowledge about related topics ==<br />
<br />
=== Graphics programming ===<br />
<br />
* Meltdown 2001 (Microsoft Game development conference): [https://web.archive.org/web/20060203201117/https://www.microsoft.com/mscorp/corpevents/meltdown2001/presentations.asp Presentation slides]<br />
* GDC2001: [http://developer.download.nvidia.com/assets/gamedev/docs/GDC2K1_DX8_Pixel_Shaders.pdf DirectX8 Pixel Shaders]<br />
* [http://download.nvidia.com/developer/Papers/ Papers by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/presentations/ Presentation slides by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/movies/ Presentation recordings by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/NVTextureSuite/ Texturing tools by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/Tools/ Tools by nvidia from Xbox era]<br />
* http://download.nvidia.com/developer/Third_Party/<br />
* http://iquilezles.org/www/index.htm<br />
* https://web.archive.org/web/20150408045127/http://freespace.virgin.net/hugo.elias/<br />
* http://www.mvps.org/directx/indexes/<br />
* https://www.gdcvault.com/play/247/CRYSIS-Next-Gen ''(Contains some parts which are also applicable to original Xbox)''<br />
* [https://www.valvesoftware.com/en/publications Publications by Valve Software]<br />
* http://graphics.uni-konstanz.de/publikationen/Luft2006ImageEnhancementUnsharp/Luft2006ImageEnhancementUnsharp.pdf<br />
* [https://web.archive.org/web/20090518092325/http://www.daionet.gr.jp:80/~masa/column/index.html Masa's Column (DOUBLE-S.T.E.A.L / Wrecked developer)]<br />
* [https://fgiesen.wordpress.com/ Blog by ryg]<br />
* [http://filmicworlds.com/blog/ Filmic Worlds]<br />
* [https://gpuopen.com/archive/gamescgi/cubemapgen/ AMD CubeMapGen tool for mipmapping cubemaps]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=NV2A/Vertex_attributes&diff=6671NV2A/Vertex attributes2019-01-22T23:11:53Z<p>Mborgerson: </p>
<hr />
<div>This article documents the attribute types which are supported by the Xbox GPU.<br />
Please take everything with a grain of salt - it's still being researched.<br />
<br />
== Draw methods ==<br />
<br />
=== Draw Arrays ===<br />
<br />
Data uploaded through DMA.<br />
Each attribute has it's own offset and stride.<br />
Decoded using the attribute information.<br />
<br />
=== Inline Buffer ===<br />
<br />
Data uploaded and decoded through PGRAPH methods.<br />
<br />
==== NV097_SET_VERTEX_DATA2F_M ... NV097_SET_VERTEX_DATA2F_M + 0x7c ====<br />
==== NV097_SET_VERTEX_DATA4F_M ... NV097_SET_VERTEX_DATA4F_M + 0xfc ====<br />
==== NV097_SET_VERTEX_DATA2S ... NV097_SET_VERTEX_DATA2S + 0x3c ====<br />
<br />
Vertex attribute values provided via NV097_SET_VERTEX_DATA2S are<br />
apparently two 16-bit signed integers, packed into 32 bits, which are<br />
then to be directly mapped to floating point values in the range<br />
[-32768.0, 32767.0].<br />
<br />
==== NV097_SET_VERTEX_DATA4UB ... NV097_SET_VERTEX_DATA4UB + 0x3c ====<br />
==== NV097_SET_VERTEX_DATA4S_M ... NV097_SET_VERTEX_DATA4S_M + 0x7c ====<br />
<br />
=== Inline Array ===<br />
<br />
Data uploaded through PGRAPH method NV097_INLINE_ARRAY.<br />
The attributes are tightly packed in that buffer.<br />
Decoded using the attribute information.<br />
<br />
=== Inline Elements ===<br />
<br />
Same as "Draw Arrays" but with an extra index buffer.<br />
The index buffer is uploaded through PGRAPH methods NV097_ARRAY_ELEMENT16 and NV097_ARRAY_ELEMENT32.<br />
<br />
== Attribute Types ==<br />
<br />
=== Normalized unsigned byte (D3D) === <br />
<br />
Unsigned bytes aranged as ZYXW (BGRA) in memory (Also see [http://www.opengl.org/registry/specs/ARB/vertex_array_bgra.txt this GL extension]).<br />
This is commonly used with an attribute count of 4.<br />
FIXME: Does this still work with attribute count =/= 4 ?<br />
Each byte will be mapped into the range 0.0 to 1.0.<br />
FIXME: Verify<br />
<br />
=== Normalized unsigned byte (GL) ===<br />
<br />
Unsigned bytes arranged as XYZW (RGBA) in memory.<br />
Each byte will be mapped into the range 0.0 to 1.0.<br />
FIXME: Verify<br />
<br />
=== Normalized short ===<br />
<br />
Shorts, arranged as XYZW.<br />
Each short will be mapped into the range -1.0 to 1.0<br />
FIXME: Verify<br />
<br />
=== Float ===<br />
<br />
IEEE-754 single precision float arranged as XYZW.<br />
FIXME: What happens to NaN or denormals?<br />
<br />
=== Short ===<br />
<br />
Shorts, arranged as XYZW.<br />
Each short will be mapped into the range -32768.0 to 32767.0<br />
FIXME: Verify<br />
<br />
=== Compressed normal ===<br />
<br />
Each 32 bit attribute is consisting of 11 bit X, 11 bit Y, 10 bit Z.<br />
Each component is signed and will be mapped into the range -1.0 to 1.0.<br />
FIXME: Verify<br />
FIXME: Is the attribute count ignored?<br />
<br />
<br />
[[Category:NV2A]]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Xbox_Game_Disc&diff=6648Xbox Game Disc2019-01-11T03:23:32Z<p>Mborgerson: </p>
<hr />
<div>Xbox games are shipped on DVDs. They are commonly referred to as Xbox Game Discs (XGD).<br />
<br />
== Visible information on ring ==<br />
<br />
'''The DVD inner ring usually contains:'''<br />
<br />
(The examples are from a German [[FIFA Soccer 2003]] disc)<br />
<br />
An outer portion with labels:<br />
* Outer ring Layer 1<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L1*)<br />
** Text for Mastering code ("EA02302E L1 02 0MM", where "02" is a smaller font and slightly higher than the previous baseline, followed by "0MM" on the original baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
* Inner ring for Layer 0<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L0*)<br />
** Text for Mastering code ("EA02302E L0 06", where "06" is a smaller font and slightly higher than the previous baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
<br />
An inner porition with Xbox logo:<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* 1 time "XBOX" text with blank background<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* Another tiny pattern segmented into 7 portions in alternating position,(opposite of the "XBOX" text without logo)<br />
** 4 times a Xbox logo <br />
** 2 times the word "genuine"<br />
** and in the middle the word ASPnnnn where n is a number{{citation needed}} <br />
<br />
''' ASP code '''<br />
[[File:Asp demodisk.jpg|thumb|right|Detail of the DVD hologram, reflecting the ASP5080 by the flash of the camera. found on a demodisk (IM00113E-IM)]]<br />
The following table lists known ASPnnnn numbers found on Xbox dvd disks, they are also on 360 disks but we dont list those in this wiki.<br />
The games listed are examples, its known for sure more disks can have these numbers and further research can be done, to determine the meaning.<br />
It is rumoured it might be a version string of some sorts slowly raising in xbox years old. {{citation needed}}<br />
{| class="wikitable"<br />
|-<br />
! ASP number<br />
! found on<br />
! game serial<br />
|-<br />
| ASP0180<br />
| Xbox Hardware Refresh Disc<br />
| XB01101W<br />
|-<br />
| ASP0380<br />
| Tom Clancy's Splinter Cell Exclusive Playable Demo<br />
| US01251E<br />
|-<br />
| ASP0980<br />
| Tom Clancy's Rainbow Six 3 DEMO DISC<br />
| US03152E-US<br />
|-<br />
| ASP5080<br />
| The official xbox 50 best games (Demo disk)<br />
| IM00113E-IM<br />
|-<br />
| ASP5180<br />
| Rayman 3 hoodlum havoc<br />
| <br />
|-<br />
| ASP5280<br />
| Xbox Music Mixer<br />
| MS09005A-MS<br />
|}<br />
<br />
== Dumps ==<br />
<br />
=== Files ===<br />
<br />
===== Example timestamps =====<br />
<br />
Timestamps for [[Petit Copter]]:<br />
<pre><br />
126779196239020000ULL, // XDVDFS timestamp<br />
126956823480700000ULL, // SS timestamp<br />
126957328439576418ULL, // SS unk3 timestamp<br />
126957649743869476ULL, // DMI Timestamp<br />
126961143392830592ULL, // SS unk4 timestamp<br />
</pre><br />
<br />
==== Disc Manufacturing Information (DMI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x04<br />
<br />
DMI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u32? || Unknown || Always 1?<br />
|-<br />
|4 || u32? || Unknown || Always zero?<br />
|-<br />
|8 || ascii_char[8] || Mastering Code || Example: EA02302E <br> Also see [[Xbe#Title_ID]]<br />
|-<br />
|16 || u64 || || Some timestamp?<br />
|-<br />
|24 || u32? || Unknown || Always 2?<br />
|}<br />
<br />
==== Physical Format Information (PFI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x00<br />
<br />
Read from the Lead-In.<br />
<br />
PFI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || <code>booktype << 4 <nowiki>|</nowiki> part_version</code> || 4 bit each<br />
|-<br />
|1 || u8 || <code>disc_size << 4 <nowiki>|</nowiki> maximum_rate</code> || 4 bit each<br />
|-<br />
|2 || u8 || <code>number_of_layers << 5 <nowiki>|</nowiki> track_path << 4 <nowiki>|</nowiki> layer_type</code> || 1 bit padding, 2 bit, 1 bit, 4 bit<br />
|-<br />
|3 || u8 || <code>linear_density << 4 <nowiki>|</nowiki> track_density</code> || 4 bit each<br />
|-<br />
|4 || u8 || || Always zero<br />
|-<br />
|5 || u24 || Starting Physical Sector Number of Data Area ||<br />
|-<br />
|8 || u8 || || Always zero<br />
|-<br />
|9 || u24 || End Physical Sector Number of Data Area ||<br />
|-<br />
|12 || u8 || || Always zero<br />
|-<br />
|13 || u24 || End Sector Number in Layer 0 || Always 0x2033AF for original Xbox discs<br />
|}<br />
<br />
From [ftp://ftp.avc-pioneer.com/Mtfuji_5/Proposal/Jan01/RDVDSTRC.pdf] (page 4)<br />
<br />
==== Security Sectors (SS.bin) ====<br />
<br />
Challenge entry (11 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || Valid || Always 1 if the challenge is valid, else the challenge is ignored<br />
|-<br />
|1 || u8 || Challenge id ||<br />
|-<br />
|2 || u32 || Challenge value ||<br />
|-<br />
|6 || u8 || Response modifier || multimedia.cx says this might be a Response id. However, it's always 0 anyway?!<br />
|-<br />
|7 || u32 || Response value ||<br />
|}<br />
<br />
Security sector range (9 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|3 || u24 || Start PSN ||<br />
|-<br />
|6 || u24 || End PSN ||<br />
|}<br />
<br />
Unknown1 (44 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u64 || || Yet another timestamp?! (Similar to 1183 in complete format)<br />
|-<br />
|8 || u32 || || Unknown<br />
|-<br />
|27 || u8 || || Unknown<br />
|-<br />
|28 || u8[16] || || Unknown<br />
|}<br />
<br />
Complete format (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || PFI || Physical Format Information || PFI for the actual data, unknown size<br />
|-<br />
|720 || u32 || Unknown ||<br />
|-<br />
|768 || u8 || Version of challenge table || Always 1<br />
|-<br />
|769 || u8 || Number of challenge entries || Always 23<br />
|-<br />
|770 || Challenge entry[] || Encrypted challenge entries ||<br />
|-<br />
|1055 || u64 || || Some large number timestamp?<br />
|-<br />
|1083 || u8[16] || || Unknown<br />
|-<br />
|1183 || Unknown1 || || Unknown, this structure is SHA-1 hashed, to generate a RC4 key to decrypt challenge entries<br />
|-<br />
|1227 || u8[20] || SHA-1 hash A || Hash until here (of the complete format)<br />
|-<br />
|1247 || u8[256] || Signature A || For hash in previous field<br />
|-<br />
|1503 || Unknown1 || || Unknown<br />
|-<br />
|1547 || u8[20] || SHA-1 hash B || Hash until here (of the complete format)<br />
|-<br />
|1567 || u8[64] || Signature B || For hash in previous field (note that this is somewhat shorter than the other signature?!)<br />
|-<br />
! colspan="4" | End of data readable by a stock Xbox drive (1632 Bytes)<br />
|-<br />
|1632 || u8 || Number of security sector ranges || Always 23<br />
|-<br />
|1633 || Security sector range[] || Security sector ranges || Only 16 of which are used.<br />
|-<br />
|1840 || Security sector range[] || Security sector ranges || Only 16 of which are used. <br> ''(Copy from Offset 1633)''<br />
|}<br />
<br />
All other fields are assumed to be zero!<br />
<br />
===== Decryption of challenge entries =====<br />
<br />
Starting at offset 1183, a 44 byte SHA-1 hash is generated.<br />
The first 7 byte of the resulting hash are used as the key in RC4 decryption. The 253 Bytes of the challenge entries (Offset 770) will be decrypted.<br />
<br />
There'll only be a handful of valid entries in the challenge entries.<br />
However there'll be at least 2.<br />
<br />
=== Dumping ===<br />
<br />
To dump Xbox Game Discs you need one of the following drives / firmwares:<br />
<br />
{| class="wikitable"<br />
!Drive<br />
!Standard<br />
!Original Firmware download<br />
!Name of modified Firmware for dumping<br />
|-<br />
|{{FIXME|reason=Which drives?}}<br />
|<br />
|<br />
|<br />
* 0800{{citation needed}}<br />
|-<br />
|Toshiba SD-M2012C<br />
|IDE<br />
|<br />
|<br />
* Kreon{{citation needed}}<br />
|-<br />
|Samsung SH-D162C<br />
|IDE<br />
|<br />
|rowspan=2 |<br />
* SB00 Kreon 0.60 (July 30th 2006)<br />
* SB00 Kreon 0.80 (September 9th 2006)<br />
* SB01 Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Toshiba TS-H352C<br />
|IDE<br />
|<br />
|-<br />
|Samsung SH-D162D<br />
|IDE<br />
|[https://web.archive.org/web/20090601193905/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200706281644411972_SH-D162D_SB00.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB00] <br> [https://web.archive.org/web/20090916202345/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200811051941150901_SH-D162D_SB01.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01] <br> SB02{{citation needed}}[http://www.firmwarehq.com/download_995-file_SH-D162D_SB02.exe.html unknown if safe or legit] <br> [https://web.archive.org/web/20090402052613/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191825218171_SH-D162D_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] <br> [https://web.archive.org/web/20120123040117/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200909281412336931_SH-D162D_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]<br />
|rowspan=2 |<br />
* SB00 Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H352D<br />
|IDE<br />
|<br />
|-<br />
|Samsung SH-D163A<br />
|SATA<br />
|[http://web.archive.org/web/20090601191704/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200701031704489471_SH-D163A_SB01.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01]<br />
|rowspan=2 |<br />
* Kreon 0.80 (October 17th 2006)<br />
* SB01 Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Toshiba TS-H353A<br />
|SATA<br />
|<br />
|-<br />
|Samsung SH-D163B<br />
|SATA<br />
|<br />
|rowspan=2 |<br />
* Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H353B<br />
|SATA<br />
|<br />
|}<br />
<br />
Please note that the modified firmwares are based on copyrighted material and can therefore not be legally shared here.<br />
Patch files to patch original firmwares into dumping-firmwares would be appreciated. <br />
<br />
Flashing software:<br />
<br />
* TSDNMAC for MacOS<br />
* [http://web.archive.org/web/20070301000000/http://www.samsungodd.com/KorLib/File/sfdnwin.exe SFDNWIN] for Microsoft Windows 2000 and XP<br />
* TSDNWIN for Microsoft Windows Vista and 7<br />
* Dell SFDNDOS and the newer TSDNDOS for Microsoft DOS<br />
<br />
For current dumping instructions see [http://forum.redump.org/topic/6073/xbox-1-360-dumping-instructions/ the Dumping Guide by the Redump Project].<br />
<br />
==== USB Adapters ====<br />
<br />
There are many USB-IDE/SATA adapters on the market. The following have been known to work well with the Kreon-compatible drives.<br />
<br />
{|class="wikitable"<br />
! Adapter Model / USB VID:DID<br />
! Drive Model<br />
! Notes<br />
|-<br />
| [https://www.amazon.com/Sabrent-5-25-INCH-Converter-Activity-USB-DSC9/dp/B00DQJME7Y Sabrent USB-DSC9]<br />
<code>1f75:0611 Innostor Technology Corporation</code><br />
| SH-D162D/BEWE<br />
<code>H/W:A Ver.D JULY 2007</code><br />
| Ubuntu 18.04 host with VirtualBox WinXP VM. USB pass-thru of adapter. No extra drivers required. Drive flashed. Works with Xbox Backup Creator.<br />
|}<br />
<br />
=== Xbox related commands ===<br />
<br />
==== Enable Unlock 1 (xtreme) state ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 01</pre><br />
<br />
Enable Unlock 1 (xtreme) state' as we already know it from the 360 xtreme modded drives. <br />
This command is supported for legacy reasons only. Custom applications should use the new 'Set Lock State' instead.<br />
<br />
==== Set Lock State ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 11 xx</pre><br />
<br />
* <code>xx=00</code> - Drive locked (no unlock state)<br />
* <code>xx=01</code> - Unlock State 1 (xtreme) enabled<br />
* <code>xx=02</code> - Unlock state 2 (wxripper) enabled<br />
<br />
==== SS extract command ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>AD 00 FF 02 FD FF FE 00 08 00 xx C0</pre><br />
<br />
This is the well known from the xtreme firmware.<br />
<br />
==== Get Feature List ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 10</pre><br />
<br />
This command will return a list of the additional features supported by the drive.<br />
All values returned are 16 bit values, and the list is terminated with null (<code>0x0000</code>).<br />
The two first words of the returned list always reads as <code>0xA55A 0X5AA5</code> in order to guarantee that a reply from a drive not supporting this command correctly isn't mistaken for a feature list.<br />
<br />
An example feature list could be: <code>0xA55A, 0x5AA5, 0x0100, 0xF000, 0xF001, 0x0000</code><br />
<br />
This list would indicate that the drive supports XBOX360 Unlock 1, Lock and Error Skip, as it can be seen from the values defined below:<br />
<br />
XBOX 360 related features:<br />
<br />
* <code>0x0100</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0101</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0120</code> : The drive can read and decrypt the SS<br />
* <code>0x0121</code> : The drive has full challenge response functionality<br />
<br />
XBOX related features:<br />
<br />
* <code>0x0200</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0201</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0220</code> : The drive can read and decrypt the SS<br />
* <code>0x0221</code> : The drive has full challenge response functionality<br />
<br />
General drive features:<br />
<br />
* <code>0xF000</code> : The drive supports the lock (cancel any unlock state) command<br />
* <code>0xF001</code> : The drive supports error skipping<br />
<br />
This is the complete list of defined features at the moment. If you're working on a custom application you might want to contact me in order to get the latest list.<br />
<br />
== References and links == <br />
* [https://web.archive.org/web/20150616131202/http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf]<br />
* [https://multimedia.cx/eggs/xbox-sphinx-protocol/ Overview of the challenge/response security protocol]<br />
* [http://redump.org/discs/system/xbox/ Xbox Game Discs preserved by the Redump Project]<br />
* [http://wiki.redump.org/index.php?title=Discs_not_yet_dumped#Microsoft_Xbox Missing Xbox Game Disc dumps at Redump Project]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Xbox_Game_Disc&diff=6647Xbox Game Disc2019-01-11T03:16:42Z<p>Mborgerson: Add a table containing info on which adapters are known to work well with Kreon drives.</p>
<hr />
<div>Xbox games are shipped on DVDs. They are commonly referred to as Xbox Game Discs (XGD).<br />
<br />
== Visible information on ring ==<br />
<br />
'''The DVD inner ring usually contains:'''<br />
<br />
(The examples are from a German [[FIFA Soccer 2003]] disc)<br />
<br />
An outer portion with labels:<br />
* Outer ring Layer 1<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L1*)<br />
** Text for Mastering code ("EA02302E L1 02 0MM", where "02" is a smaller font and slightly higher than the previous baseline, followed by "0MM" on the original baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
* Inner ring for Layer 0<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L0*)<br />
** Text for Mastering code ("EA02302E L0 06", where "06" is a smaller font and slightly higher than the previous baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
<br />
An inner porition with Xbox logo:<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* 1 time "XBOX" text with blank background<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* Another tiny pattern segmented into 7 portions in alternating position,(opposite of the "XBOX" text without logo)<br />
** 4 times a Xbox logo <br />
** 2 times the word "genuine"<br />
** and in the middle the word ASPnnnn where n is a number{{citation needed}} <br />
<br />
''' ASP code '''<br />
[[File:Asp demodisk.jpg|thumb|right|Detail of the DVD hologram, reflecting the ASP5080 by the flash of the camera. found on a demodisk (IM00113E-IM)]]<br />
The following table lists known ASPnnnn numbers found on Xbox dvd disks, they are also on 360 disks but we dont list those in this wiki.<br />
The games listed are examples, its known for sure more disks can have these numbers and further research can be done, to determine the meaning.<br />
It is rumoured it might be a version string of some sorts slowly raising in xbox years old. {{citation needed}}<br />
{| class="wikitable"<br />
|-<br />
! ASP number<br />
! found on<br />
! game serial<br />
|-<br />
| ASP0180<br />
| Xbox Hardware Refresh Disc<br />
| XB01101W<br />
|-<br />
| ASP0380<br />
| Tom Clancy's Splinter Cell Exclusive Playable Demo<br />
| US01251E<br />
|-<br />
| ASP0980<br />
| Tom Clancy's Rainbow Six 3 DEMO DISC<br />
| US03152E-US<br />
|-<br />
| ASP5080<br />
| The official xbox 50 best games (Demo disk)<br />
| IM00113E-IM<br />
|-<br />
| ASP5180<br />
| Rayman 3 hoodlum havoc<br />
| <br />
|-<br />
| ASP5280<br />
| Xbox Music Mixer<br />
| MS09005A-MS<br />
|}<br />
<br />
== Dumps ==<br />
<br />
=== Files ===<br />
<br />
===== Example timestamps =====<br />
<br />
Timestamps for [[Petit Copter]]:<br />
<pre><br />
126779196239020000ULL, // XDVDFS timestamp<br />
126956823480700000ULL, // SS timestamp<br />
126957328439576418ULL, // SS unk3 timestamp<br />
126957649743869476ULL, // DMI Timestamp<br />
126961143392830592ULL, // SS unk4 timestamp<br />
</pre><br />
<br />
==== Disc Manufacturing Information (DMI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x04<br />
<br />
DMI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u32? || Unknown || Always 1?<br />
|-<br />
|4 || u32? || Unknown || Always zero?<br />
|-<br />
|8 || ascii_char[8] || Mastering Code || Example: EA02302E <br> Also see [[Xbe#Title_ID]]<br />
|-<br />
|16 || u64 || || Some timestamp?<br />
|-<br />
|24 || u32? || Unknown || Always 2?<br />
|}<br />
<br />
==== Physical Format Information (PFI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x00<br />
<br />
Read from the Lead-In.<br />
<br />
PFI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || <code>booktype << 4 <nowiki>|</nowiki> part_version</code> || 4 bit each<br />
|-<br />
|1 || u8 || <code>disc_size << 4 <nowiki>|</nowiki> maximum_rate</code> || 4 bit each<br />
|-<br />
|2 || u8 || <code>number_of_layers << 5 <nowiki>|</nowiki> track_path << 4 <nowiki>|</nowiki> layer_type</code> || 1 bit padding, 2 bit, 1 bit, 4 bit<br />
|-<br />
|3 || u8 || <code>linear_density << 4 <nowiki>|</nowiki> track_density</code> || 4 bit each<br />
|-<br />
|4 || u8 || || Always zero<br />
|-<br />
|5 || u24 || Starting Physical Sector Number of Data Area ||<br />
|-<br />
|8 || u8 || || Always zero<br />
|-<br />
|9 || u24 || End Physical Sector Number of Data Area ||<br />
|-<br />
|12 || u8 || || Always zero<br />
|-<br />
|13 || u24 || End Sector Number in Layer 0 || Always 0x2033AF for original Xbox discs<br />
|}<br />
<br />
From [ftp://ftp.avc-pioneer.com/Mtfuji_5/Proposal/Jan01/RDVDSTRC.pdf] (page 4)<br />
<br />
==== Security Sectors (SS.bin) ====<br />
<br />
Challenge entry (11 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || Valid || Always 1 if the challenge is valid, else the challenge is ignored<br />
|-<br />
|1 || u8 || Challenge id ||<br />
|-<br />
|2 || u32 || Challenge value ||<br />
|-<br />
|6 || u8 || Response modifier || multimedia.cx says this might be a Response id. However, it's always 0 anyway?!<br />
|-<br />
|7 || u32 || Response value ||<br />
|}<br />
<br />
Security sector range (9 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|3 || u24 || Start PSN ||<br />
|-<br />
|6 || u24 || End PSN ||<br />
|}<br />
<br />
Unknown1 (44 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u64 || || Yet another timestamp?! (Similar to 1183 in complete format)<br />
|-<br />
|8 || u32 || || Unknown<br />
|-<br />
|27 || u8 || || Unknown<br />
|-<br />
|28 || u8[16] || || Unknown<br />
|}<br />
<br />
Complete format (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || PFI || Physical Format Information || PFI for the actual data, unknown size<br />
|-<br />
|720 || u32 || Unknown ||<br />
|-<br />
|768 || u8 || Version of challenge table || Always 1<br />
|-<br />
|769 || u8 || Number of challenge entries || Always 23<br />
|-<br />
|770 || Challenge entry[] || Encrypted challenge entries ||<br />
|-<br />
|1055 || u64 || || Some large number timestamp?<br />
|-<br />
|1083 || u8[16] || || Unknown<br />
|-<br />
|1183 || Unknown1 || || Unknown, this structure is SHA-1 hashed, to generate a RC4 key to decrypt challenge entries<br />
|-<br />
|1227 || u8[20] || SHA-1 hash A || Hash until here (of the complete format)<br />
|-<br />
|1247 || u8[256] || Signature A || For hash in previous field<br />
|-<br />
|1503 || Unknown1 || || Unknown<br />
|-<br />
|1547 || u8[20] || SHA-1 hash B || Hash until here (of the complete format)<br />
|-<br />
|1567 || u8[64] || Signature B || For hash in previous field (note that this is somewhat shorter than the other signature?!)<br />
|-<br />
! colspan="4" | End of data readable by a stock Xbox drive (1632 Bytes)<br />
|-<br />
|1632 || u8 || Number of security sector ranges || Always 23<br />
|-<br />
|1633 || Security sector range[] || Security sector ranges || Only 16 of which are used.<br />
|-<br />
|1840 || Security sector range[] || Security sector ranges || Only 16 of which are used. <br> ''(Copy from Offset 1633)''<br />
|}<br />
<br />
All other fields are assumed to be zero!<br />
<br />
===== Decryption of challenge entries =====<br />
<br />
Starting at offset 1183, a 44 byte SHA-1 hash is generated.<br />
The first 7 byte of the resulting hash are used as the key in RC4 decryption. The 253 Bytes of the challenge entries (Offset 770) will be decrypted.<br />
<br />
There'll only be a handful of valid entries in the challenge entries.<br />
However there'll be at least 2.<br />
<br />
=== Dumping ===<br />
<br />
To dump Xbox Game Discs you need one of the following drives / firmwares:<br />
<br />
{| class="wikitable"<br />
!Drive<br />
!Standard<br />
!Original Firmware download<br />
!Name of modified Firmware for dumping<br />
|-<br />
|{{FIXME|reason=Which drives?}}<br />
|<br />
|<br />
|<br />
* 0800{{citation needed}}<br />
|-<br />
|Toshiba SD-M2012C<br />
|IDE<br />
|<br />
|<br />
* Kreon{{citation needed}}<br />
|-<br />
|Samsung SH-D162C<br />
|IDE<br />
|<br />
|rowspan=2 |<br />
* SB00 Kreon 0.60 (July 30th 2006)<br />
* SB00 Kreon 0.80 (September 9th 2006)<br />
* SB01 Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Toshiba TS-H352C<br />
|IDE<br />
|<br />
|-<br />
|Samsung SH-D162D<br />
|IDE<br />
|[https://web.archive.org/web/20090601193905/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200706281644411972_SH-D162D_SB00.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB00] <br> [https://web.archive.org/web/20090916202345/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200811051941150901_SH-D162D_SB01.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01] <br> SB02{{citation needed}}[http://www.firmwarehq.com/download_995-file_SH-D162D_SB02.exe.html unknown if safe or legit] <br> [https://web.archive.org/web/20090402052613/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191825218171_SH-D162D_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] <br> [https://web.archive.org/web/20120123040117/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200909281412336931_SH-D162D_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]<br />
|rowspan=2 |<br />
* SB00 Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H352D<br />
|IDE<br />
|<br />
|-<br />
|Samsung SH-D163A<br />
|SATA<br />
|[http://web.archive.org/web/20090601191704/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200701031704489471_SH-D163A_SB01.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01]<br />
|rowspan=2 |<br />
* Kreon 0.80 (October 17th 2006)<br />
* SB01 Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Toshiba TS-H353A<br />
|SATA<br />
|<br />
|-<br />
|Samsung SH-D163B<br />
|SATA<br />
|<br />
|rowspan=2 |<br />
* Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H353B<br />
|SATA<br />
|<br />
|}<br />
<br />
Please note that the modified firmwares are based on copyrighted material and can therefore not be legally shared here.<br />
Patch files to patch original firmwares into dumping-firmwares would be appreciated. <br />
<br />
Flashing software:<br />
<br />
* TSDNMAC for MacOS<br />
* [http://web.archive.org/web/20070301000000/http://www.samsungodd.com/KorLib/File/sfdnwin.exe SFDNWIN] for Microsoft Windows 2000 and XP<br />
* TSDNWIN for Microsoft Windows Vista and 7<br />
* Dell SFDNDOS and the newer TSDNDOS for Microsoft DOS<br />
<br />
For current dumping instructions see [http://forum.redump.org/topic/6073/xbox-1-360-dumping-instructions/ the Dumping Guide by the Redump Project].<br />
<br />
==== USB Adapters ====<br />
<br />
There are many USB-IDE/SATA adapters on the market. The following have been known to work well with the Kreon-compatible drives.<br />
<br />
{|class="wikitable"<br />
! Adapter Model / USB VID:DID<br />
! Drive Model<br />
! Notes<br />
|-<br />
| [https://www.amazon.com/Sabrent-5-25-INCH-Converter-Activity-USB-DSC9/dp/B00DQJME7Y Sabrent USB-DSC9]<br />
<code>1f75:0611 Innostor Technology Corporation</code><br />
| SH-D162D (<code>H/W:A Ver.D JULY 2007</code>)<br />
| Ubuntu 18.04 host with VirtualBox WinXP VM. USB pass-thru of adapter. Drive flashed. Works with Xbox Backup Creator.<br />
|}<br />
<br />
=== Xbox related commands ===<br />
<br />
==== Enable Unlock 1 (xtreme) state ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 01</pre><br />
<br />
Enable Unlock 1 (xtreme) state' as we already know it from the 360 xtreme modded drives. <br />
This command is supported for legacy reasons only. Custom applications should use the new 'Set Lock State' instead.<br />
<br />
==== Set Lock State ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 11 xx</pre><br />
<br />
* <code>xx=00</code> - Drive locked (no unlock state)<br />
* <code>xx=01</code> - Unlock State 1 (xtreme) enabled<br />
* <code>xx=02</code> - Unlock state 2 (wxripper) enabled<br />
<br />
==== SS extract command ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>AD 00 FF 02 FD FF FE 00 08 00 xx C0</pre><br />
<br />
This is the well known from the xtreme firmware.<br />
<br />
==== Get Feature List ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 10</pre><br />
<br />
This command will return a list of the additional features supported by the drive.<br />
All values returned are 16 bit values, and the list is terminated with null (<code>0x0000</code>).<br />
The two first words of the returned list always reads as <code>0xA55A 0X5AA5</code> in order to guarantee that a reply from a drive not supporting this command correctly isn't mistaken for a feature list.<br />
<br />
An example feature list could be: <code>0xA55A, 0x5AA5, 0x0100, 0xF000, 0xF001, 0x0000</code><br />
<br />
This list would indicate that the drive supports XBOX360 Unlock 1, Lock and Error Skip, as it can be seen from the values defined below:<br />
<br />
XBOX 360 related features:<br />
<br />
* <code>0x0100</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0101</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0120</code> : The drive can read and decrypt the SS<br />
* <code>0x0121</code> : The drive has full challenge response functionality<br />
<br />
XBOX related features:<br />
<br />
* <code>0x0200</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0201</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0220</code> : The drive can read and decrypt the SS<br />
* <code>0x0221</code> : The drive has full challenge response functionality<br />
<br />
General drive features:<br />
<br />
* <code>0xF000</code> : The drive supports the lock (cancel any unlock state) command<br />
* <code>0xF001</code> : The drive supports error skipping<br />
<br />
This is the complete list of defined features at the moment. If you're working on a custom application you might want to contact me in order to get the latest list.<br />
<br />
== References and links == <br />
* [https://web.archive.org/web/20150616131202/http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf]<br />
* [https://multimedia.cx/eggs/xbox-sphinx-protocol/ Overview of the challenge/response security protocol]<br />
* [http://redump.org/discs/system/xbox/ Xbox Game Discs preserved by the Redump Project]<br />
* [http://wiki.redump.org/index.php?title=Discs_not_yet_dumped#Microsoft_Xbox Missing Xbox Game Disc dumps at Redump Project]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Talk:Main_Page&diff=6395Talk:Main Page2018-04-28T01:22:14Z<p>Mborgerson: </p>
<hr />
<div>== Cleanup ==<br />
<br />
The main page could stand to be cleaned up now that we have many pages in the wiki. Also some pictures would be nice.<br />
[[User:Mborgerson|Mborgerson]] ([[User talk:Mborgerson|talk]]) 17:10, 25 May 2017 (PDT)<br />
<br />
Re cleanup I was going to do something like the navigation at https://www.3dbrew.org/wiki/Main_Page - but I only ever finished the box on top.<br />
--[[User:JayFoxRox|JayFoxRox]] ([[User talk:JayFoxRox|talk]]) 01:34, 26 May 2017 (PDT)<br />
<br />
== Logo ==<br />
<br />
Also we need a wiki logo. See [https://commons.wikimedia.org/wiki/User:Evan-Amos/VOGM/Xbox here] for some great high-quality pictures. [[User:Mborgerson|Mborgerson]] ([[User talk:Mborgerson|talk]]) 17:10, 25 May 2017 (PDT)<br />
<br />
Agreed.<br />
[https://upload.wikimedia.org/wikipedia/commons/thumb/4/43/Xbox-console.jpg/800px-Xbox-console.jpg I vote this one (Click here)].<br />
Maybe we can add a text to it later or replace it with one which suggests we are interested in the internals, but so far, I don't like the others<br />
--[[User:JayFoxRox|JayFoxRox]] ([[User talk:JayFoxRox|talk]]) 01:34, 26 May 2017 (PDT)<br />
<br />
== Contribution Policy ==<br />
<br />
I also think we should create a contribution policy page. One thought on the matter is this: Instead of linking to content elsewhere, we should try to bring as much content into the wiki as possible. This is so we don't lose valuable content as things tend to become unavailable over time (that is, dead links). It also makes for a better experience when browsing the wiki and provides a place for visitors to improve the info. [[User:Mborgerson|Mborgerson]] ([[User talk:Mborgerson|talk]]) 17:10, 25 May 2017 (PDT)<br />
<br />
<br />
Agreed: the {{input-*}} templates are being used.. differently. we use `A+B`; `A,B`; `AB`; `A B`; `A then B`; ...<br />
all of them are supposed to mean: "press B after pressing A"<br />
<br />
IMO: `A + B` is always pressing "A and B at same time"; for sequences we should always use something like `A, B + Y, X` (= press "A", then "B and Y at same time", then press "X")<br />
<br />
--[[User:JayFoxRox|JayFoxRox]] ([[User talk:JayFoxRox|talk]]) 12:24, 5 September 2017 (PDT)<br />
<br />
== Translation to german ==<br />
<br />
Hey i would like to translate some pages into german, can anyone explain how i can translate them? :)<br />
Greetings.<br />
<br />
----<br />
<br />
: I'm not sure if there is any benefit in this.<br />
: As the articles mostly focus on technical documentation, there'd be a lot of english terms anyway (regardless of main-language).<br />
: I'd assume any reader who is able to make sense of this information already speaks english good enough.<br />
<br />
: Also, even internationally, we are a rather small community.<br />
: So introducing the small subset of germans with technical skills but without english language skills wouldn't add any new readers or writers.<br />
<br />
: We'd also run into further administration issues:<br />
: We currently don't even patrol page changes, because we don't have enough time / people to do it.<br />
: With 2 languages there's also the risk of articles going out-of-sync.<br />
: (There is also the minor issue that I don't know how mediawiki handles translations, but this is the least of our problems)<br />
<br />
: If you want to attract new people (beginners or people who still lack skills in english), I'd suggest writing posts on another medium instead.<br />
: For example, a blog post which puts stuff in layman terms (in whatever language you feel like), but might cross-reference XboxDevWiki as a source.<br />
<br />
: I think google or some other translation services have features which allow translation of websites as some kind of interactive overlay.<br />
: So it's auto-translated but you can improve the translation.<br />
: I'd prefer these methods over overcomplicating XboxDevWiki with niche features which target a very small fraction (maybe none?) of the community, but add a maintenance burden.<br />
<br />
: --[[User:JayFoxRox|JayFoxRox]] ([[User talk:JayFoxRox|talk]]) 05:27, 22 April 2018 (PDT) (This is my personal opinion, I don't speak on behalf of the other wiki admins / users)<br />
<br />
: +1 [[User:Mborgerson|Mborgerson]] ([[User talk:Mborgerson|talk]]) 18:22, 27 April 2018 (PDT)</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Talk:Main_Page&diff=6394Talk:Main Page2018-04-28T01:20:22Z<p>Mborgerson: </p>
<hr />
<div>== Cleanup ==<br />
<br />
The main page could stand to be cleaned up now that we have many pages in the wiki. Also some pictures would be nice.<br />
[[User:Mborgerson|Mborgerson]] ([[User talk:Mborgerson|talk]]) 17:10, 25 May 2017 (PDT)<br />
<br />
Re cleanup I was going to do something like the navigation at https://www.3dbrew.org/wiki/Main_Page - but I only ever finished the box on top.<br />
--[[User:JayFoxRox|JayFoxRox]] ([[User talk:JayFoxRox|talk]]) 01:34, 26 May 2017 (PDT)<br />
<br />
== Logo ==<br />
<br />
Also we need a wiki logo. See [https://commons.wikimedia.org/wiki/User:Evan-Amos/VOGM/Xbox here] for some great high-quality pictures. [[User:Mborgerson|Mborgerson]] ([[User talk:Mborgerson|talk]]) 17:10, 25 May 2017 (PDT)<br />
<br />
Agreed.<br />
[https://upload.wikimedia.org/wikipedia/commons/thumb/4/43/Xbox-console.jpg/800px-Xbox-console.jpg I vote this one (Click here)].<br />
Maybe we can add a text to it later or replace it with one which suggests we are interested in the internals, but so far, I don't like the others<br />
--[[User:JayFoxRox|JayFoxRox]] ([[User talk:JayFoxRox|talk]]) 01:34, 26 May 2017 (PDT)<br />
<br />
== Contribution Policy ==<br />
<br />
I also think we should create a contribution policy page. One thought on the matter is this: Instead of linking to content elsewhere, we should try to bring as much content into the wiki as possible. This is so we don't lose valuable content as things tend to become unavailable over time (that is, dead links). It also makes for a better experience when browsing the wiki and provides a place for visitors to improve the info. [[User:Mborgerson|Mborgerson]] ([[User talk:Mborgerson|talk]]) 17:10, 25 May 2017 (PDT)<br />
<br />
<br />
Agreed: the {{input-*}} templates are being used.. differently. we use `A+B`; `A,B`; `AB`; `A B`; `A then B`; ...<br />
all of them are supposed to mean: "press B after pressing A"<br />
<br />
IMO: `A + B` is always pressing "A and B at same time"; for sequences we should always use something like `A, B + Y, X` (= press "A", then "B and Y at same time", then press "X")<br />
<br />
--[[User:JayFoxRox|JayFoxRox]] ([[User talk:JayFoxRox|talk]]) 12:24, 5 September 2017 (PDT)<br />
<br />
== Translation to german ==<br />
<br />
Hey i would like to translate some pages into german, can anyone explain how i can translate them? :)<br />
Greetings.<br />
<br />
----<br />
<br />
: I'm not sure if there is any benefit in this.<br />
: As the articles mostly focus on technical documentation, there'd be a lot of english terms anyway (regardless of main-language).<br />
: I'd assume any reader who is able to make sense of this information already speaks english good enough.<br />
<br />
: Also, even internationally, we are a rather small community.<br />
: So introducing the small subset of germans with technical skills but without english language skills wouldn't add any new readers or writers.<br />
<br />
: We'd also run into further administration issues:<br />
: We currently don't even patrol page changes, because we don't have enough time / people to do it.<br />
: With 2 languages there's also the risk of articles going out-of-sync.<br />
: (There is also the minor issue that I don't know how mediawiki handles translations, but this is the least of our problems)<br />
<br />
: If you want to attract new people (beginners or people who still lack skills in english), I'd suggest writing posts on another medium instead.<br />
: For example, a blog post which puts stuff in layman terms (in whatever language you feel like), but might cross-reference XboxDevWiki as a source.<br />
<br />
: I think google or some other translation services have features which allow translation of websites as some kind of interactive overlay.<br />
: So it's auto-translated but you can improve the translation.<br />
: I'd prefer these methods over overcomplicating XboxDevWiki with niche features which target a very small fraction (maybe none?) of the community, but add a maintenance burden.<br />
<br />
: --[[User:JayFoxRox|JayFoxRox]] ([[User talk:JayFoxRox|talk]]) 05:27, 22 April 2018 (PDT) (This is my personal opinion, I don't speak on behalf of the other wiki admins / users [MB: agree])</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Main_Page/Header&diff=6382Main Page/Header2018-03-28T03:39:01Z<p>Mborgerson: </p>
<hr />
<div><div style="background-color:#e7eef6; border: 1px solid #ccc; color:#000; margin-top: 15px; margin-bottom: 10px; padding: 8px; text-align:center;"><br />
<div style="font-size: 162%; border: none; margin: 0; padding:.1em;">Welcome to XboxDevWiki.net,</div><br />
<div style="font-size: 95%">a wiki dedicated to research of the original Microsoft Xbox.</div><br />
<div style="text-align:left;"><br />
<br />
<hr><br />
<br />
This is an effort to document the inner workings of the original Microsoft Xbox and Xbox-based SEGA Chihiro.<br />
We not only care about technical details about those platforms, but also how to develop homebrew and emulate them.<br />
<br />
We are not interested in documenting the Xbox 360, Xbox One or any other console at this point.<br />
<br />
<hr><br />
<br />
'''Want to help? Contact us!'''<br />
<br />
This wiki is the place for all remaining Xbox projects to come together.<br />
Please come chat with us in [irc://chat.freenode.net/xqemu #xqemu on Freenode IRC] ([http://webchat.freenode.net?channels=%23xqemu Webchat]), [https://discord.gg/WxJPPyz Discord], or [https://gitter.im/Cxbx-Reloaded/Lobby Cxbx-Reloaded on gitter.im].<br />
<br />
You'll also get the details for wiki account creation there.<br />
</div><br />
</div></div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Boot_Process&diff=5568Boot Process2017-05-30T04:36:24Z<p>Mborgerson: </p>
<hr />
<div>== Overview ==<br />
<br />
The Xbox has a 256 KB ROM containing the startup animation and sound, as well as the Xbox kernel, which contains a stripped down version of the Windows 2000 (NT 5.0) microkernel, the HAL, filesystems, as well as HD and DVD drivers.<br />
<br />
When the Xbox is turned on, the software in ROM is decompressed into RAM, and the kernel initializes the hardware. Because there are no audio or video drivers in the kernel, the startup code plays the animation and sound by accessing the registers of the hardware directly. As soon as the Xbox logo is on the display, the kernel unlocks the hard disk and checks whether there is a valid game medium in the DVD drive. If not, the file xboxdash.xbe gets loaded from partition #3. In either case, the Microsoft logo is shown below the Xbox logo and the executable is started. If an error occurs (no/wrong hard disk, wrong signature, ...), the boot loader shows an error screen and halts.<br />
<br />
== MCPX ROM ==<br />
<br />
Certain things are still missing, for example, getting the CPU to 32 bit protected mode and enabling caching.{{FIXME}}<br />
<br />
=== Xcodes ===<br />
<br />
The xcode interpreter is common through both versions of the MCPX ROM. The high level interpretation of the MCPX ROM might look like this:<br />
<br />
<pre><br />
void xcode_interpreter() {<br />
int run_xcodes = 1;<br />
uint32_t eip = 0xff000080; // Not really EIP. This is just a pointer to the next xcode<br />
uint32_t result, scratch = 0;<br />
while (run_xcodes) {<br />
opcode = get_memory_byte(eip);<br />
operand_1 = get_memory_dword(eip+1);<br />
operand_2 = get_memory_dword(eip+5);<br />
<br />
if (opcode == 0x07) {<br />
opcode = operand_1;<br />
operand_1 = operand_2;<br />
operand_2 = result;<br />
}<br />
<br />
switch (opcode) {<br />
case 0x02:<br />
result = get_memory_dword(operand_1 & 0x0fffffff);<br />
break;<br />
case 0x03:<br />
set_memory_dword(operand_1) = operand_2;<br />
break;<br />
case 0x06:<br />
result = (result & operand_1) | operand_2;<br />
break;<br />
case 0x04:<br />
if (operand_1 == 0x80000880) {<br />
operand_2 &= 0xfffffffd;<br />
}<br />
outl(operand_1, 0xcf8);<br />
outl(operand_2, 0xcfc);<br />
break;<br />
case 0x05:<br />
outl(operand_1, 0xcf8);<br />
result = inl(0xcfc);<br />
break;<br />
case 0x08:<br />
if (result != operand_1) {<br />
eip += operand_2;<br />
}<br />
break;<br />
case 0x09:<br />
eip += operand_2;<br />
break;<br />
case 0x10:<br />
scratch = (scratch & operand_1) | operand_2;<br />
result = scratch;<br />
break;<br />
case 0x11:<br />
outb(operand_2, operand_1);<br />
break;<br />
case 0x12:<br />
result = inb(operand_1);<br />
break;<br />
case 0xee:<br />
run_xcodes = 0;<br />
default:<br />
break;<br />
}<br />
<br />
eip += 9;<br />
}<br />
}<br />
</pre><br />
<br />
=== MCPX 1.0: RC4 Decryption of the 2BL ===<br />
<br />
Version 1.0 of the ROM uses RC4 to decrypt the 2BL.<br />
<br />
==== Stage 1: Key Scheduling ====<br />
<br />
The [https://en.wikipedia.org/wiki/RC4#Key-scheduling_algorithm_.28KSA.29 RC4 Key-Scheduling Algorithm] is used to initialize the RC4 “S” array, first initializing the identity permutation (writing 1, 2, ..., 255 to 0x8f000 to 0x850FF), then processed in a way similar to the PRGA to mix in the key.<br />
<br />
<pre><br />
uint8_t *s = (uint8_t *)0x8f000;<br />
uint32_t i;<br />
<br />
for (i = 0; i <= 255; i++) {<br />
s[i] = i;<br />
}<br />
<br />
uint8_t *key = (uint8_t *)0xffffffa5; /* ROM offset 0x1a5. */<br />
uint8_t j, t;<br />
<br />
/* It is unclear why values s[0x100..0x101] are being set to 0. They are<br />
* not modified by the code, but later these will be be used as the initial<br />
* i, j values in the PRGA.<br />
*/<br />
s[0x100] = 0x00;<br />
s[0x101] = 0x00;<br />
<br />
for (i = 0, j = 0; i <= 255; i++) {<br />
j = j + s[i] + key[i%16];<br />
<br />
/* Swap s[i] and s[j] */<br />
t = s[i];<br />
s[i] = s[j];<br />
s[j] = t;<br />
}<br />
</pre><br />
<br />
==== Stage 2: PRGA ====<br />
<br />
The [https://en.wikipedia.org/wiki/RC4#Pseudo-random_generation_algorithm_.28PRGA.29 RC4 Pseudo-random generation algorithm (PRGA)] is then used to decrypt the 2BL from 0xFFFF9E00, storing the decrypted 2BL at 0x00090000. It is 24KiB in size.<br />
<br />
<pre><br />
uint8_t *encrypted = (uint8_t*)0xFFFF9E00; /* 2bl */<br />
uint8_t *decrypted = (uint8_t*)0x90000; /* Decrypted 2bl Destination */<br />
uint32_t pos;<br />
<br />
/* As noted above, s[0x100..0x101] were set to 0 earlier, but have not been<br />
* modified since. The RC4 algorithm defines i and j both to be set to 0<br />
* before PRGA begins. */<br />
i = s[0x100];<br />
j = s[0x101];<br />
<br />
for (pos = 0; pos < 0x6000; pos++) {<br />
/* Update i, j. */<br />
i = (i + 1) & 0xff;<br />
j += s[i];<br />
<br />
/* Swap s[i] and s[j]. */<br />
t = s[i];<br />
s[i] = s[j];<br />
s[j] = t;<br />
<br />
/* Decrypt message and write output. */<br />
decrypted[pos] = encrypted[pos] ^ s[ s[i] + s[j] ];<br />
}<br />
</pre><br />
<br />
==== Stage 3: Signature Verification ====<br />
<br />
Now that the Second-Stage Bootloader has been loaded, a quick sanity-check is performed: a “magic” signature is verified. If the signature doesn’t match, control goes to the error handler. If the signature does match, the code will jump to the 2bl entry point, which is given by the first dword of the decrypted 2bl.<br />
<br />
<pre><br />
mov eax, [0x95fe4]<br />
cmp eax, MAGIC_NUMBER<br />
jne 0xffffff94 ; If signature check failed, jump to error handler<br />
mov eax, [0x90000]<br />
jmp eax ; Jump to 2BL entry point<br />
</pre><br />
<br />
=== Notes ===<br />
<br />
The RC4 algorithm was included as part of MCPX 1.0 and seems to work fine with BIOS versions 3944, 4034, and 4134.<br />
<br />
=== MCPX 1.1: TEA Decryption of the 2BL ===<br />
<br />
{{FIXME}}<br />
<br />
== 2BL ==<br />
<br />
Certain parts are still missing<br />
<br />
=== MTRR Setup ===<br />
<br />
First, the cache is disabled.{{FIXME}}<br />
Then, the MTRR (Memory Type Range Register) will be setup (using <code>wrmsr</code>) in the following way:<br />
<br />
{| class="wikitable"<br />
! MTRR (ecx) !! High value (edx) !! Low value (eax) !! Notes<br />
|-<br />
|0x200 || 0x00000000 || 0x00000006 ||<br />
|-<br />
| rowspan = "2" | 0x201 || rowspan = "2" | 0x0000000F || 0xFC000800 || ''(For 64 MiB RAM BIOS)''<br />
|-<br />
|0xF8000800 || (''For 128 MiB RAM BIOS'')<br />
|-<br />
|0x202 || 0x00000000 || 0xFFF80005 ||<br />
|-<br />
|0x203 || 0x0000000F || 0xFFF80800 ||<br />
|-<br />
|0x204 || 0x00000000 || 0x00000000 || rowspan="3" | Clear all unused MTRR<br />
|-<br />
| colspan = "3" | ...<br />
|-<br />
|0x20F || 0x00000000 || 0x00000000<br />
|-<br />
|0x2FF || 0x00000000 || 0x00000800 ||<br />
|}<br />
<br />
Once the MTRR have been written, the cache is enabled.{{FIXME}}<br />
<br />
=== Register setup ===<br />
<br />
Now the 2BL will set up the segment registers{{FIXME|reason=why?!}} and stack:<br />
<br />
{| class="wikitable"<br />
! Register !! Value !! Notes<br />
|-<br />
|ds || 0x0010 || rowspan="3" | Data segment{{citation needed}}<br />
<br />
|-<br />
|es || 0x0010<br />
<br />
|-<br />
|ss || 0x0010<br />
<br />
|-<br />
|esp || 0x00400000 ||<br />
<br />
|-<br />
|fs || 0x0000 ||<br />
<br />
|-<br />
|gs || 0x0000 ||<br />
|}<br />
<br />
=== Self-copy ===<br />
<br />
Now the 2BL copies itself (24 kiB) from 0x00900000 to memory address 0x00400000.<br />
<br />
=== Paging ===<br />
<br />
Now a PDE is prepared at address 0x0000F000:<br />
<br />
{| class="wikitable"<br />
! Offset in PDE !! Value !! Notes<br />
|-<br />
|0x000 || 0x000000E3 || rowspan="7" | Identity maps the first 256MiB of RAM: 0x00000000 and 0x80000000 will both map to physical page 0 <br><br> 0xE3: Flags: <br> * 0x80: 4 MiB page <br> * 0x40: Marked as previously written (Dirty) <br> * 0x20: Marked as previously accessed <br> * 0x02: Read/Write <br> * 0x01: Present<br />
|-<br />
|0x800 || 0x000000E3<br />
|-<br />
|0x004 || 0x004000E3<br />
|-<br />
|0x804 || 0x004000E3<br />
|-<br />
| colspan="2" | ...<br />
|-<br />
|0x8FC || 0x0FC000E3<br />
|-<br />
|0x0FC || 0x0FC000E3<br />
|-<br />
|0x900 || 0x00000000 || rowspan="5" | Unmapping the rest of the pages<br />
|-<br />
|0x100 || 0x00000000<br />
|-<br />
| colspan="2" | ...<br />
|-<br />
|0xFFC || 0x00000000<br />
|-<br />
|0x7FC || 0x00000000<br />
|-<br />
|0xC00 || 0x0000F063 || Maps the PDE (4 kiB page) to address 0xC0000000 <br><br> 0x63: Flags: <br> * 0x40: Marked as previously written (Dirty) <br> * 0x20: Marked as previously accessed <br> * 0x02: Read/Write <br> * 0x01: Present<br />
|-<br />
|0xFFC || 0xFFC000E3 || Identity maps the upper portion of the Flash (4 MiB page) to address 0xFFC00000 <br><br> 0xE3: Flags: <br> * 0x80: 4 MiB page <br> * 0x40: Marked as previously written (Dirty) <br> * 0x20: Marked as previously accessed <br> * 0x02: Read/Write <br> * 0x01: Present<br />
|-<br />
|0xFD0 || 0xFD0000FB || rowspan="4" | Maps 16 MiB for the GPU control registers <br><br> 0xFB: Flags: <br> * 0x80: 4 MiB page <br> * 0x40: Marked as previously written (Dirty) <br> * 0x20: Marked as previously accessed <br> * 0x10: Cache disabled <br> * 0x08: Write-Through caching <br> * 0x02: Read/Write <br> * 0x01: Present<br />
|-<br />
|0xFD4 || 0xFD4000FB<br />
|-<br />
|0xFD8 || 0xFD8000FB<br />
|-<br />
|0xFDC || 0xFDC000FB<br />
|}<br />
<br />
After setting up the PDE, the PAT is set up using <code>wrmsr</code>: {{FIXME}}<br />
<br />
CR4 is touched {{FIXME}}<br />
<br />
CR3 is touched {{FIXME}}<br />
<br />
Now paging is activated by enabling the PG and WP bits in CR0.<br />
Additionally, the same <code>or</code> instruction is used to enable the NE bit in cr0.<br />
<br />
=== 2BL main ===<br />
<br />
esp is now also reloaded to point at the relocated address. It will be set to 0x80400000 (absolute value, independent of previous esp value).<br />
The 2BL will now <code>call</code> into the relocated 2BL code somewhere near 0x00400000.<br />
<br />
==== Disabling of the MCPX ROM ====<br />
<br />
<pre><br />
out32(0xCF8, 0x80000880);<br />
out8(0xCFC, 0x02);<br />
</pre><br />
<br />
==== SMC handling ====<br />
<br />
The [[SMC]] has a watchdog functionality which must be turned off.<br />
This is done by querying the SMC registers 0x1C - 0x1F.<br />
If all of them are 0x00 the 2BL will shutdown the system{{FIXME}}.<br />
If this is not the case, the bootloader calculates the watchdog challenge response and sends it to SMC registers 0x20 and 0x21.<br />
<br />
Additionally, the 2BL will set SMC register 0x01 to 0 (which resets the cursor position for reading the SMC revision information).<br />
<br />
==== Enable IDE and NIC ====<br />
<br />
<pre><br />
out32(0xCF8, 0x8000088C);<br />
out32(0xCFC, 0x40000000);<br />
</pre><br />
<br />
==== Memory cleanup ====<br />
<br />
The 2BL fills memory with 0xCC from 0x80090000 to 0x80095FFF. These are the 24 kiB where the 2BL was stored previously.<br />
<br />
==== Setup RAM timing ====<br />
<br />
Not described yet, this is complicated{{FIXME}}.<br />
This got a lot more complicated when Microsoft started using different RAM sometime after [[Hardware Revisions#1.6|Hardware Revision 1.6]] was already out.<br />
<br />
==== Weird stuff 2 ====<br />
<br />
This does some PCI config, use unknown{{FIXME}}.<br />
<br />
<pre><br />
out32(0xCF8, 0x80000854);<br />
out32(0xCFC, in32(0xCFC) | 0x88000000);<br />
<br />
out32(0xCF8, 0x80000064);<br />
out32(0xCFC, in32(0xCFC) | 0x88000000);<br />
<br />
out32(0xCF8, 0x8000006C);<br />
uint32_t tmp = in32(0xCFC);<br />
out32(0xCFC, tmp & 0xFFFFFFFE);<br />
out32(0xCFC, tmp);<br />
<br />
out32(0xCF8, 0x80000080);<br />
out32(0xCFC, 0x00000100);<br />
</pre><br />
<br />
==== Weird stuff 3 ====<br />
<br />
{{FIXME|reason=Why?}}<br />
<br />
<pre><br />
out32(0xCF8, 0x80000808);<br />
uint8_t mcpx_revision = in8(0xCFC); <br />
<br />
if (mcpx_revision >= 0xD1) {<br />
out32(0xCF8, 0x800008C8);<br />
out32(0xCFC, 0x00008F00);<br />
}<br />
</pre><br />
<br />
==== Loading the kernel ====<br />
===== Kernel-copy =====<br />
<br />
The Kernel is now copied into RAM.<br />
<br />
===== Kernel decryption =====<br />
<br />
The 2BL will copy the kernel decryption key (16 bytes) from offset 32 of an array of 3 keys:<br />
<br />
{| class="wikitable"<br />
! Offset !! Use<br />
|-<br />
| 0 || EEPROM key<br />
|-<br />
| 16 || Certificate key<br />
|-<br />
| 32 || Kernel key<br />
|}<br />
<br />
The Kernel is then decrypted in-place using RC4.<br />
<br />
===== Kernel decompression =====<br />
<br />
The Kernel is decompressed directly to 0x80010000 where it will reside until a full system shutdown.<br />
<br />
==== Running the kernel ====<br />
<br />
The xboxkrnl.exe header at 0x8001000 is checked{{FIXME|reason=how?}}.<br />
If it is invalid, {{FIXME}}.<br />
If it is valid, the kernel entry point is looked up from the PE optional header. The hardcoded image base of 0x8001000 is added to the entry point.<br />
The entry-point is now being called. Argumnts are passed on the stack, from right to left.<br />
The first argument is a commandline string loaded from memory address 0x80400000. It is an empty string for retail BIOS{{FIXME|reason=Mention options for debug bioses here}}.<br />
A pointer to the previously mentioned array of 3 keys is passed as the second argument.<br />
<br />
== Kernel ==<br />
<br />
=== Startup animation ===<br />
<br />
=== Kernel Re-initialization ===<br />
<br />
== References ==<br />
<br />
* [http://hackspot.net/XboxBlog/?p=1 Understanding the Xbox boot process]<br />
* [https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Boot ROM]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Boot_Process&diff=5549Boot Process2017-05-29T17:52:24Z<p>Mborgerson: </p>
<hr />
<div>== Overview ==<br />
<br />
The Xbox has a 256 KB ROM containing the startup animation and sound, as well as the Xbox kernel, which contains a stripped down version of the Windows 2000 (NT 5.0) microkernel, the HAL, filesystems, as well as HD and DVD drivers.<br />
<br />
When the Xbox is turned on, the software in ROM is decompressed into RAM, and the kernel initializes the hardware. Because there are no audio or video drivers in the kernel, the startup code plays the animation and sound by accessing the registers of the hardware directly. As soon as the Xbox logo is on the display, the kernel unlocks the hard disk and checks whether there is a valid game medium in the DVD drive. If not, the file xboxdash.xbe gets loaded from partition #3. In either case, the Microsoft logo is shown below the Xbox logo and the executable is started. If an error occurs (no/wrong hard disk, wrong signature, ...), the boot loader shows an error screen and halts.<br />
<br />
== MCPX ROM ==<br />
<br />
Certain things are still missing, for example, getting the CPU to 32 bit protected mode and enabling caching.{{FIXME}}<br />
<br />
=== Xcodes ===<br />
<br />
The xcode interpreter is common through both versions of the MCPX ROM. The high level interpretation of the MCPX ROM might look like this:<br />
<br />
<pre><br />
void xcode_interpreter() {<br />
int run_xcodes = 1;<br />
uint32_t eip = 0xff000080; // Not really EIP. This is just a pointer to the next xcode<br />
uint32_t result, scratch = 0;<br />
while (run_xcodes) {<br />
opcode = get_memory_byte(eip);<br />
operand_1 = get_memory_dword(eip+1);<br />
operand_2 = get_memory_dword(eip+5);<br />
<br />
if (opcode == 0x07) {<br />
opcode = operand_1;<br />
operand_1 = operand_2;<br />
operand_2 = result;<br />
}<br />
<br />
switch (opcode) {<br />
case 0x02:<br />
result = get_memory_dword(operand_1 & 0x0fffffff);<br />
break;<br />
case 0x03:<br />
set_memory_dword(operand_1) = operand_2;<br />
break;<br />
case 0x06:<br />
result = (result & operand_1) | operand_2;<br />
break;<br />
case 0x04:<br />
if (operand_1 == 0x80000880) {<br />
operand_2 &= 0xfffffffd;<br />
}<br />
outl(operand_1, 0xcf8);<br />
outl(operand_2, 0xcfc);<br />
break;<br />
case 0x05:<br />
outl(operand_1, 0xcf8);<br />
result = inl(0xcfc);<br />
break;<br />
case 0x08:<br />
if (result != operand_1) {<br />
eip += operand_2;<br />
}<br />
break;<br />
case 0x09:<br />
eip += operand_2;<br />
break;<br />
case 0x10:<br />
scratch = (scratch & operand_1) | operand_2;<br />
result = scratch;<br />
break;<br />
case 0x11:<br />
outb(operand_2, operand_1);<br />
break;<br />
case 0x12:<br />
result = inb(operand_1);<br />
break;<br />
case 0xee:<br />
run_xcodes = 0;<br />
default:<br />
break;<br />
}<br />
<br />
eip += 9;<br />
}<br />
}<br />
</pre><br />
<br />
=== MCPX 1.0: RC4 Decryption of the 2BL ===<br />
<br />
Version 1.0 of the ROM uses RC4 to decrypt the 2BL.<br />
<br />
==== Stage 1: Key Scheduling ====<br />
<br />
The [https://en.wikipedia.org/wiki/RC4#Key-scheduling_algorithm_.28KSA.29 RC4 Key-Scheduling Algorithm] is used to initialize the RC4 “S” array, first initializing the identity permutation (writing 1, 2, ..., 255 to 0x8f000 to 0x850FF), then processed in a way similar to the PRGA to mix in the key.<br />
<br />
<pre><br />
uint8_t *s = (uint8_t *)0x8f000;<br />
uint32_t i;<br />
<br />
for (i = 0; i <= 255; i++) {<br />
s[i] = i;<br />
}<br />
<br />
uint8_t *key = (uint8_t *)0xffffffa5; /* ROM offset 0x1a5. */<br />
uint8_t j, t;<br />
<br />
/* It is unclear why values s[0x100..0x101] are being set to 0. They are<br />
* not modified by the code, but later these will be be used as the initial<br />
* i, j values in the PRGA.<br />
*/<br />
s[0x100] = 0x00;<br />
s[0x101] = 0x00;<br />
<br />
for (i = 0, j = 0; i <= 255; i++) {<br />
j = j + s[i] + key[i%16];<br />
<br />
/* Swap s[i] and s[j] */<br />
t = s[i];<br />
s[i] = s[j];<br />
s[j] = t;<br />
}<br />
</pre><br />
<br />
==== Stage 2: PRGA ====<br />
<br />
The [https://en.wikipedia.org/wiki/RC4#Pseudo-random_generation_algorithm_.28PRGA.29 RC4 Pseudo-random generation algorithm (PRGA)] is then used to decrypt the 2BL from 0xFFFF9E00, storing the decrypted 2BL at 0x00090000. It is 24KiB in size.<br />
<br />
<pre><br />
uint8_t *encrypted = (uint8_t*)0xFFFF9E00; /* 2bl */<br />
uint8_t *decrypted = (uint8_t*)0x90000; /* Decrypted 2bl Destination */<br />
uint32_t pos;<br />
<br />
/* As noted above, s[0x100..0x101] were set to 0 earlier, but have not been<br />
* modified since. The RC4 algorithm defines i and j both to be set to 0<br />
* before PRGA begins. */<br />
i = s[0x100];<br />
j = s[0x101];<br />
<br />
for (pos = 0; pos < 0x6000; pos++) {<br />
/* Update i, j. */<br />
i = (i + 1) & 0xff;<br />
j += s[i];<br />
<br />
/* Swap s[i] and s[j]. */<br />
t = s[i];<br />
s[i] = s[j];<br />
s[j] = t;<br />
<br />
/* Decrypt message and write output. */<br />
decrypted[pos] = encrypted[pos] ^ s[ s[i] + s[j] ];<br />
}<br />
</pre><br />
<br />
==== Stage 3: Verification ====<br />
<br />
Now that the Second-Stage Bootloader has been loaded, a quick sanity-check is performed: a “magic” signature is verified. If the signature doesn’t match, control goes to the error handler. If the signature does match, the code will jump to the 2bl entry point, which is given by the first dword of the decrypted 2bl.<br />
<br />
<pre><br />
if (get_memory_dword(0x95FE4) == MAGIC_NUMBER) {<br />
eip = get_memory_dword(0x900000);<br />
} else {<br />
// Else, things have gone wrong<br />
eip = 0xFFFFFF94;<br />
}<br />
</pre><br />
<br />
=== Notes ===<br />
<br />
The RC4 algorithm was included as part of MCPX 1.0 and seems to work fine with BIOS versions 3944, 4034, and 4134.<br />
<br />
=== MCPX 1.1: TEA Decryption of the 2BL ===<br />
<br />
{{FIXME}}<br />
<br />
== 2BL ==<br />
<br />
Certain parts are still missing<br />
<br />
=== MTRR Setup ===<br />
<br />
First, the cache is disabled.{{FIXME}}<br />
Then, the MTRR (Memory Type Range Register) will be setup (using <code>wrmsr</code>) in the following way:<br />
<br />
{| class="wikitable"<br />
! MTRR (ecx) !! High value (edx) !! Low value (eax) !! Notes<br />
|-<br />
|0x200 || 0x00000000 || 0x00000006 ||<br />
|-<br />
| rowspan = "2" | 0x201 || rowspan = "2" | 0x0000000F || 0xFC000800 || ''(For 64 MiB RAM BIOS)''<br />
|-<br />
|0xF8000800 || (''For 128 MiB RAM BIOS'')<br />
|-<br />
|0x202 || 0x00000000 || 0xFFF80005 ||<br />
|-<br />
|0x203 || 0x0000000F || 0xFFF80800 ||<br />
|-<br />
|0x204 || 0x00000000 || 0x00000000 || rowspan="3" | Clear all unused MTRR<br />
|-<br />
| colspan = "3" | ...<br />
|-<br />
|0x20F || 0x00000000 || 0x00000000<br />
|-<br />
|0x2FF || 0x00000000 || 0x00000800 ||<br />
|}<br />
<br />
Once the MTRR have been written, the cache is enabled.{{FIXME}}<br />
<br />
=== Register setup ===<br />
<br />
Now the 2BL will set up the segment registers{{FIXME|reason=why?!}} and stack:<br />
<br />
{| class="wikitable"<br />
! Register !! Value !! Notes<br />
|-<br />
|ds || 0x0010 || rowspan="3" | Data segment{{citation needed}}<br />
<br />
|-<br />
|es || 0x0010<br />
<br />
|-<br />
|ss || 0x0010<br />
<br />
|-<br />
|esp || 0x00400000 ||<br />
<br />
|-<br />
|fs || 0x0000 ||<br />
<br />
|-<br />
|gs || 0x0000 ||<br />
|}<br />
<br />
=== Self-copy ===<br />
<br />
Now the 2BL copies itself (24 kiB) from 0x00900000 to memory address 0x00400000.<br />
<br />
=== Paging ===<br />
<br />
Now a PDE is prepared at address 0x0000F000:<br />
<br />
{| class="wikitable"<br />
! Offset in PDE !! Value !! Notes<br />
|-<br />
|0x000 || 0x000000E3 || rowspan="7" | Identity maps the first 256MiB of RAM: 0x00000000 and 0x80000000 will both map to physical page 0 <br><br> 0xE3: Flags: <br> * 0x80: 4 MiB page <br> * 0x40: Marked as previously written (Dirty) <br> * 0x20: Marked as previously accessed <br> * 0x02: Read/Write <br> * 0x01: Present<br />
|-<br />
|0x800 || 0x000000E3<br />
|-<br />
|0x004 || 0x004000E3<br />
|-<br />
|0x804 || 0x004000E3<br />
|-<br />
| colspan="2" | ...<br />
|-<br />
|0x8FC || 0x0FC000E3<br />
|-<br />
|0x0FC || 0x0FC000E3<br />
|-<br />
|0x900 || 0x00000000 || rowspan="5" | Unmapping the rest of the pages<br />
|-<br />
|0x100 || 0x00000000<br />
|-<br />
| colspan="2" | ...<br />
|-<br />
|0xFFC || 0x00000000<br />
|-<br />
|0x7FC || 0x00000000<br />
|-<br />
|0xC00 || 0x0000F063 || Maps the PDE (4 kiB page) to address 0xC0000000 <br><br> 0x63: Flags: <br> * 0x40: Marked as previously written (Dirty) <br> * 0x20: Marked as previously accessed <br> * 0x02: Read/Write <br> * 0x01: Present<br />
|-<br />
|0xFFC || 0xFFC000E3 || Identity maps the upper portion of the Flash (4 MiB page) to address 0xFFC00000 <br><br> 0xE3: Flags: <br> * 0x80: 4 MiB page <br> * 0x40: Marked as previously written (Dirty) <br> * 0x20: Marked as previously accessed <br> * 0x02: Read/Write <br> * 0x01: Present<br />
|-<br />
|0xFD0 || 0xFD0000FB || rowspan="4" | Maps 16 MiB for the GPU control registers <br><br> 0xFB: Flags: <br> * 0x80: 4 MiB page <br> * 0x40: Marked as previously written (Dirty) <br> * 0x20: Marked as previously accessed <br> * 0x10: Cache disabled <br> * 0x08: Write-Through caching <br> * 0x02: Read/Write <br> * 0x01: Present<br />
|-<br />
|0xFD4 || 0xFD4000FB<br />
|-<br />
|0xFD8 || 0xFD8000FB<br />
|-<br />
|0xFDC || 0xFDC000FB<br />
|}<br />
<br />
After setting up the PDE, the PAT is set up using <code>wrmsr</code>: {{FIXME}}<br />
<br />
CR4 is touched {{FIXME}}<br />
<br />
CR3 is touched {{FIXME}}<br />
<br />
Now paging is activated by enabling the PG and WP bits in CR0.<br />
Additionally, the same <code>or</code> instruction is used to enable the NE bit in cr0.<br />
<br />
=== 2BL main ===<br />
<br />
esp is now also reloaded to point at the relocated address. It will be set to 0x80400000 (absolute value, independent of previous esp value).<br />
The 2BL will now <code>call</code> into the relocated 2BL code somewhere near 0x00400000.<br />
<br />
==== Disabling of the MCPX ROM ====<br />
<br />
<pre><br />
out32(0xCF8, 0x80000880);<br />
out8(0xCFC, 0x02);<br />
</pre><br />
<br />
==== SMC handling ====<br />
<br />
The [[SMC]] has a watchdog functionality which must be turned off.<br />
This is done by querying the SMC registers 0x1C - 0x1F.<br />
If all of them are 0x00 the 2BL will shutdown the system{{FIXME}}.<br />
If this is not the case, the bootloader calculates the watchdog challenge response and sends it to SMC registers 0x20 and 0x21.<br />
<br />
Additionally, the 2BL will set SMC register 0x01 to 0 (which resets the cursor position for reading the SMC revision information).<br />
<br />
==== Enable IDE and NIC ====<br />
<br />
<pre><br />
out32(0xCF8, 0x8000088C);<br />
out32(0xCFC, 0x40000000);<br />
</pre><br />
<br />
==== Memory cleanup ====<br />
<br />
The 2BL fills memory with 0xCC from 0x80090000 to 0x80095FFF. These are the 24 kiB where the 2BL was stored previously.<br />
<br />
==== Setup RAM timing ====<br />
<br />
Not described yet, this is complicated{{FIXME}}.<br />
This got a lot more complicated when Microsoft started using different RAM sometime after [[Hardware Revisions#1.6|Hardware Revision 1.6]] was already out.<br />
<br />
==== Weird stuff 2 ====<br />
<br />
This does some PCI config, use unknown{{FIXME}}.<br />
<br />
<pre><br />
out32(0xCF8, 0x80000854);<br />
out32(0xCFC, in32(0xCFC) | 0x88000000);<br />
<br />
out32(0xCF8, 0x80000064);<br />
out32(0xCFC, in32(0xCFC) | 0x88000000);<br />
<br />
out32(0xCF8, 0x8000006C);<br />
uint32_t tmp = in32(0xCFC);<br />
out32(0xCFC, tmp & 0xFFFFFFFE);<br />
out32(0xCFC, tmp);<br />
<br />
out32(0xCF8, 0x80000080);<br />
out32(0xCFC, 0x00000100);<br />
</pre><br />
<br />
==== Weird stuff 3 ====<br />
<br />
{{FIXME|reason=Why?}}<br />
<br />
<pre><br />
out32(0xCF8, 0x80000808);<br />
uint8_t mcpx_revision = in8(0xCFC); <br />
<br />
if (mcpx_revision >= 0xD1) {<br />
out32(0xCF8, 0x800008C8);<br />
out32(0xCFC, 0x00008F00);<br />
}<br />
</pre><br />
<br />
==== Loading the kernel ====<br />
===== Kernel-copy =====<br />
<br />
The Kernel is now copied into RAM.<br />
<br />
===== Kernel decryption =====<br />
<br />
The 2BL will copy the kernel decryption key (16 bytes) from offset 32 of an array of 3 keys:<br />
<br />
{| class="wikitable"<br />
! Offset !! Use<br />
|-<br />
| 0 || EEPROM key<br />
|-<br />
| 16 || Certificate key<br />
|-<br />
| 32 || Kernel key<br />
|}<br />
<br />
The Kernel is then decrypted in-place using RC4.<br />
<br />
===== Kernel decompression =====<br />
<br />
The Kernel is decompressed directly to 0x80010000 where it will reside until a full system shutdown.<br />
<br />
==== Running the kernel ====<br />
<br />
The xboxkrnl.exe header at 0x8001000 is checked{{FIXME|reason=how?}}.<br />
If it is invalid, {{FIXME}}.<br />
If it is valid, the kernel entry point is looked up from the PE optional header. The hardcoded image base of 0x8001000 is added to the entry point.<br />
The entry-point is now being called. Argumnts are passed on the stack, from right to left.<br />
The first argument is a commandline string loaded from memory address 0x80400000. It is an empty string for retail BIOS{{FIXME|reason=Mention options for debug bioses here}}.<br />
A pointer to the previously mentioned array of 3 keys is passed as the second argument.<br />
<br />
== Kernel ==<br />
<br />
=== Startup animation ===<br />
<br />
=== Kernel Re-initialization ===<br />
<br />
== References ==<br />
<br />
* [http://hackspot.net/XboxBlog/?p=1 Understanding the Xbox boot process]<br />
* [https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Boot ROM]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Boot_Process&diff=5548Boot Process2017-05-29T17:51:53Z<p>Mborgerson: </p>
<hr />
<div>== Overview ==<br />
<br />
The Xbox has a 256 KB ROM containing the startup animation and sound, as well as the Xbox kernel, which contains a stripped down version of the Windows 2000 (NT 5.0) microkernel, the HAL, filesystems, as well as HD and DVD drivers.<br />
<br />
When the Xbox is turned on, the software in ROM is decompressed into RAM, and the kernel initializes the hardware. Because there are no audio or video drivers in the kernel, the startup code plays the animation and sound by accessing the registers of the hardware directly. As soon as the Xbox logo is on the display, the kernel unlocks the hard disk and checks whether there is a valid game medium in the DVD drive. If not, the file xboxdash.xbe gets loaded from partition #3. In either case, the Microsoft logo is shown below the Xbox logo and the executable is started. If an error occurs (no/wrong hard disk, wrong signature, ...), the boot loader shows an error screen and halts.<br />
<br />
== MCPX ==<br />
<br />
Certain things are still missing, for example, getting the CPU to 32 bit protected mode and enabling caching.{{FIXME}}<br />
<br />
=== Xcodes ===<br />
<br />
The xcode interpreter is common through both versions of the MCPX ROM. The high level interpretation of the MCPX ROM might look like this:<br />
<br />
<pre><br />
void xcode_interpreter() {<br />
int run_xcodes = 1;<br />
uint32_t eip = 0xff000080; // Not really EIP. This is just a pointer to the next xcode<br />
uint32_t result, scratch = 0;<br />
while (run_xcodes) {<br />
opcode = get_memory_byte(eip);<br />
operand_1 = get_memory_dword(eip+1);<br />
operand_2 = get_memory_dword(eip+5);<br />
<br />
if (opcode == 0x07) {<br />
opcode = operand_1;<br />
operand_1 = operand_2;<br />
operand_2 = result;<br />
}<br />
<br />
switch (opcode) {<br />
case 0x02:<br />
result = get_memory_dword(operand_1 & 0x0fffffff);<br />
break;<br />
case 0x03:<br />
set_memory_dword(operand_1) = operand_2;<br />
break;<br />
case 0x06:<br />
result = (result & operand_1) | operand_2;<br />
break;<br />
case 0x04:<br />
if (operand_1 == 0x80000880) {<br />
operand_2 &= 0xfffffffd;<br />
}<br />
outl(operand_1, 0xcf8);<br />
outl(operand_2, 0xcfc);<br />
break;<br />
case 0x05:<br />
outl(operand_1, 0xcf8);<br />
result = inl(0xcfc);<br />
break;<br />
case 0x08:<br />
if (result != operand_1) {<br />
eip += operand_2;<br />
}<br />
break;<br />
case 0x09:<br />
eip += operand_2;<br />
break;<br />
case 0x10:<br />
scratch = (scratch & operand_1) | operand_2;<br />
result = scratch;<br />
break;<br />
case 0x11:<br />
outb(operand_2, operand_1);<br />
break;<br />
case 0x12:<br />
result = inb(operand_1);<br />
break;<br />
case 0xee:<br />
run_xcodes = 0;<br />
default:<br />
break;<br />
}<br />
<br />
eip += 9;<br />
}<br />
}<br />
</pre><br />
<br />
=== MCPX 1.0: RC4 Decryption of the 2BL ===<br />
<br />
Version 1.0 of the ROM uses RC4 to decrypt the 2BL.<br />
<br />
==== Stage 1: Key Scheduling ====<br />
<br />
The [https://en.wikipedia.org/wiki/RC4#Key-scheduling_algorithm_.28KSA.29 RC4 Key-Scheduling Algorithm] is used to initialize the RC4 “S” array, first initializing the identity permutation (writing 1, 2, ..., 255 to 0x8f000 to 0x850FF), then processed in a way similar to the PRGA to mix in the key.<br />
<br />
<pre><br />
uint8_t *s = (uint8_t *)0x8f000;<br />
uint32_t i;<br />
<br />
for (i = 0; i <= 255; i++) {<br />
s[i] = i;<br />
}<br />
<br />
uint8_t *key = (uint8_t *)0xffffffa5; /* ROM offset 0x1a5. */<br />
uint8_t j, t;<br />
<br />
/* It is unclear why values s[0x100..0x101] are being set to 0. They are<br />
* not modified by the code, but later these will be be used as the initial<br />
* i, j values in the PRGA.<br />
*/<br />
s[0x100] = 0x00;<br />
s[0x101] = 0x00;<br />
<br />
for (i = 0, j = 0; i <= 255; i++) {<br />
j = j + s[i] + key[i%16];<br />
<br />
/* Swap s[i] and s[j] */<br />
t = s[i];<br />
s[i] = s[j];<br />
s[j] = t;<br />
}<br />
</pre><br />
<br />
==== Stage 2: PRGA ====<br />
<br />
The [https://en.wikipedia.org/wiki/RC4#Pseudo-random_generation_algorithm_.28PRGA.29 RC4 Pseudo-random generation algorithm (PRGA)] is then used to decrypt the 2BL from 0xFFFF9E00, storing the decrypted 2BL at 0x00090000. It is 24KiB in size.<br />
<br />
<pre><br />
uint8_t *encrypted = (uint8_t*)0xFFFF9E00; /* 2bl */<br />
uint8_t *decrypted = (uint8_t*)0x90000; /* Decrypted 2bl Destination */<br />
uint32_t pos;<br />
<br />
/* As noted above, s[0x100..0x101] were set to 0 earlier, but have not been<br />
* modified since. The RC4 algorithm defines i and j both to be set to 0<br />
* before PRGA begins. */<br />
i = s[0x100];<br />
j = s[0x101];<br />
<br />
for (pos = 0; pos < 0x6000; pos++) {<br />
/* Update i, j. */<br />
i = (i + 1) & 0xff;<br />
j += s[i];<br />
<br />
/* Swap s[i] and s[j]. */<br />
t = s[i];<br />
s[i] = s[j];<br />
s[j] = t;<br />
<br />
/* Decrypt message and write output. */<br />
decrypted[pos] = encrypted[pos] ^ s[ s[i] + s[j] ];<br />
}<br />
</pre><br />
<br />
==== Stage 3: Verification ====<br />
<br />
Now that the Second-Stage Bootloader has been loaded, a quick sanity-check is performed: a “magic” signature is verified. If the signature doesn’t match, control goes to the error handler. If the signature does match, the code will jump to the 2bl entry point, which is given by the first dword of the decrypted 2bl.<br />
<br />
<pre><br />
if (get_memory_dword(0x95FE4) == MAGIC_NUMBER) {<br />
eip = get_memory_dword(0x900000);<br />
} else {<br />
// Else, things have gone wrong<br />
eip = 0xFFFFFF94;<br />
}<br />
</pre><br />
<br />
=== Notes ===<br />
<br />
The RC4 algorithm was included as part of MCPX 1.0 and seems to work fine with BIOS versions 3944, 4034, and 4134.<br />
<br />
=== MCPX 1.1: TEA Decryption of the 2BL ===<br />
<br />
{{FIXME}}<br />
<br />
== 2BL ==<br />
<br />
Certain parts are still missing<br />
<br />
=== MTRR Setup ===<br />
<br />
First, the cache is disabled.{{FIXME}}<br />
Then, the MTRR (Memory Type Range Register) will be setup (using <code>wrmsr</code>) in the following way:<br />
<br />
{| class="wikitable"<br />
! MTRR (ecx) !! High value (edx) !! Low value (eax) !! Notes<br />
|-<br />
|0x200 || 0x00000000 || 0x00000006 ||<br />
|-<br />
| rowspan = "2" | 0x201 || rowspan = "2" | 0x0000000F || 0xFC000800 || ''(For 64 MiB RAM BIOS)''<br />
|-<br />
|0xF8000800 || (''For 128 MiB RAM BIOS'')<br />
|-<br />
|0x202 || 0x00000000 || 0xFFF80005 ||<br />
|-<br />
|0x203 || 0x0000000F || 0xFFF80800 ||<br />
|-<br />
|0x204 || 0x00000000 || 0x00000000 || rowspan="3" | Clear all unused MTRR<br />
|-<br />
| colspan = "3" | ...<br />
|-<br />
|0x20F || 0x00000000 || 0x00000000<br />
|-<br />
|0x2FF || 0x00000000 || 0x00000800 ||<br />
|}<br />
<br />
Once the MTRR have been written, the cache is enabled.{{FIXME}}<br />
<br />
=== Register setup ===<br />
<br />
Now the 2BL will set up the segment registers{{FIXME|reason=why?!}} and stack:<br />
<br />
{| class="wikitable"<br />
! Register !! Value !! Notes<br />
|-<br />
|ds || 0x0010 || rowspan="3" | Data segment{{citation needed}}<br />
<br />
|-<br />
|es || 0x0010<br />
<br />
|-<br />
|ss || 0x0010<br />
<br />
|-<br />
|esp || 0x00400000 ||<br />
<br />
|-<br />
|fs || 0x0000 ||<br />
<br />
|-<br />
|gs || 0x0000 ||<br />
|}<br />
<br />
=== Self-copy ===<br />
<br />
Now the 2BL copies itself (24 kiB) from 0x00900000 to memory address 0x00400000.<br />
<br />
=== Paging ===<br />
<br />
Now a PDE is prepared at address 0x0000F000:<br />
<br />
{| class="wikitable"<br />
! Offset in PDE !! Value !! Notes<br />
|-<br />
|0x000 || 0x000000E3 || rowspan="7" | Identity maps the first 256MiB of RAM: 0x00000000 and 0x80000000 will both map to physical page 0 <br><br> 0xE3: Flags: <br> * 0x80: 4 MiB page <br> * 0x40: Marked as previously written (Dirty) <br> * 0x20: Marked as previously accessed <br> * 0x02: Read/Write <br> * 0x01: Present<br />
|-<br />
|0x800 || 0x000000E3<br />
|-<br />
|0x004 || 0x004000E3<br />
|-<br />
|0x804 || 0x004000E3<br />
|-<br />
| colspan="2" | ...<br />
|-<br />
|0x8FC || 0x0FC000E3<br />
|-<br />
|0x0FC || 0x0FC000E3<br />
|-<br />
|0x900 || 0x00000000 || rowspan="5" | Unmapping the rest of the pages<br />
|-<br />
|0x100 || 0x00000000<br />
|-<br />
| colspan="2" | ...<br />
|-<br />
|0xFFC || 0x00000000<br />
|-<br />
|0x7FC || 0x00000000<br />
|-<br />
|0xC00 || 0x0000F063 || Maps the PDE (4 kiB page) to address 0xC0000000 <br><br> 0x63: Flags: <br> * 0x40: Marked as previously written (Dirty) <br> * 0x20: Marked as previously accessed <br> * 0x02: Read/Write <br> * 0x01: Present<br />
|-<br />
|0xFFC || 0xFFC000E3 || Identity maps the upper portion of the Flash (4 MiB page) to address 0xFFC00000 <br><br> 0xE3: Flags: <br> * 0x80: 4 MiB page <br> * 0x40: Marked as previously written (Dirty) <br> * 0x20: Marked as previously accessed <br> * 0x02: Read/Write <br> * 0x01: Present<br />
|-<br />
|0xFD0 || 0xFD0000FB || rowspan="4" | Maps 16 MiB for the GPU control registers <br><br> 0xFB: Flags: <br> * 0x80: 4 MiB page <br> * 0x40: Marked as previously written (Dirty) <br> * 0x20: Marked as previously accessed <br> * 0x10: Cache disabled <br> * 0x08: Write-Through caching <br> * 0x02: Read/Write <br> * 0x01: Present<br />
|-<br />
|0xFD4 || 0xFD4000FB<br />
|-<br />
|0xFD8 || 0xFD8000FB<br />
|-<br />
|0xFDC || 0xFDC000FB<br />
|}<br />
<br />
After setting up the PDE, the PAT is set up using <code>wrmsr</code>: {{FIXME}}<br />
<br />
CR4 is touched {{FIXME}}<br />
<br />
CR3 is touched {{FIXME}}<br />
<br />
Now paging is activated by enabling the PG and WP bits in CR0.<br />
Additionally, the same <code>or</code> instruction is used to enable the NE bit in cr0.<br />
<br />
=== 2BL main ===<br />
<br />
esp is now also reloaded to point at the relocated address. It will be set to 0x80400000 (absolute value, independent of previous esp value).<br />
The 2BL will now <code>call</code> into the relocated 2BL code somewhere near 0x00400000.<br />
<br />
==== Disabling of the MCPX ROM ====<br />
<br />
<pre><br />
out32(0xCF8, 0x80000880);<br />
out8(0xCFC, 0x02);<br />
</pre><br />
<br />
==== SMC handling ====<br />
<br />
The [[SMC]] has a watchdog functionality which must be turned off.<br />
This is done by querying the SMC registers 0x1C - 0x1F.<br />
If all of them are 0x00 the 2BL will shutdown the system{{FIXME}}.<br />
If this is not the case, the bootloader calculates the watchdog challenge response and sends it to SMC registers 0x20 and 0x21.<br />
<br />
Additionally, the 2BL will set SMC register 0x01 to 0 (which resets the cursor position for reading the SMC revision information).<br />
<br />
==== Enable IDE and NIC ====<br />
<br />
<pre><br />
out32(0xCF8, 0x8000088C);<br />
out32(0xCFC, 0x40000000);<br />
</pre><br />
<br />
==== Memory cleanup ====<br />
<br />
The 2BL fills memory with 0xCC from 0x80090000 to 0x80095FFF. These are the 24 kiB where the 2BL was stored previously.<br />
<br />
==== Setup RAM timing ====<br />
<br />
Not described yet, this is complicated{{FIXME}}.<br />
This got a lot more complicated when Microsoft started using different RAM sometime after [[Hardware Revisions#1.6|Hardware Revision 1.6]] was already out.<br />
<br />
==== Weird stuff 2 ====<br />
<br />
This does some PCI config, use unknown{{FIXME}}.<br />
<br />
<pre><br />
out32(0xCF8, 0x80000854);<br />
out32(0xCFC, in32(0xCFC) | 0x88000000);<br />
<br />
out32(0xCF8, 0x80000064);<br />
out32(0xCFC, in32(0xCFC) | 0x88000000);<br />
<br />
out32(0xCF8, 0x8000006C);<br />
uint32_t tmp = in32(0xCFC);<br />
out32(0xCFC, tmp & 0xFFFFFFFE);<br />
out32(0xCFC, tmp);<br />
<br />
out32(0xCF8, 0x80000080);<br />
out32(0xCFC, 0x00000100);<br />
</pre><br />
<br />
==== Weird stuff 3 ====<br />
<br />
{{FIXME|reason=Why?}}<br />
<br />
<pre><br />
out32(0xCF8, 0x80000808);<br />
uint8_t mcpx_revision = in8(0xCFC); <br />
<br />
if (mcpx_revision >= 0xD1) {<br />
out32(0xCF8, 0x800008C8);<br />
out32(0xCFC, 0x00008F00);<br />
}<br />
</pre><br />
<br />
==== Loading the kernel ====<br />
===== Kernel-copy =====<br />
<br />
The Kernel is now copied into RAM.<br />
<br />
===== Kernel decryption =====<br />
<br />
The 2BL will copy the kernel decryption key (16 bytes) from offset 32 of an array of 3 keys:<br />
<br />
{| class="wikitable"<br />
! Offset !! Use<br />
|-<br />
| 0 || EEPROM key<br />
|-<br />
| 16 || Certificate key<br />
|-<br />
| 32 || Kernel key<br />
|}<br />
<br />
The Kernel is then decrypted in-place using RC4.<br />
<br />
===== Kernel decompression =====<br />
<br />
The Kernel is decompressed directly to 0x80010000 where it will reside until a full system shutdown.<br />
<br />
==== Running the kernel ====<br />
<br />
The xboxkrnl.exe header at 0x8001000 is checked{{FIXME|reason=how?}}.<br />
If it is invalid, {{FIXME}}.<br />
If it is valid, the kernel entry point is looked up from the PE optional header. The hardcoded image base of 0x8001000 is added to the entry point.<br />
The entry-point is now being called. Argumnts are passed on the stack, from right to left.<br />
The first argument is a commandline string loaded from memory address 0x80400000. It is an empty string for retail BIOS{{FIXME|reason=Mention options for debug bioses here}}.<br />
A pointer to the previously mentioned array of 3 keys is passed as the second argument.<br />
<br />
== Kernel ==<br />
<br />
=== Startup animation ===<br />
<br />
=== Kernel Re-initialization ===<br />
<br />
== References ==<br />
<br />
* [http://hackspot.net/XboxBlog/?p=1 Understanding the Xbox boot process]<br />
* [https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Boot ROM]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Hardware_Revisions&diff=5484Hardware Revisions2017-05-26T21:23:24Z<p>Mborgerson: </p>
<hr />
<div>There are 7 Xbox revisions<br />
<br />
== 1.0 ==<br />
<br />
* Made in Hungary<br />
* USB controller is on a separate PCB<br />
* GPU has a fan on the heat sink<br />
* MCPX 1.0 ROM<br />
* Thomson DVD Drive<br />
* Seagate Hard Drive<br />
* Conexant [[Video Encoder]]<br />
<br />
== 1.1 ==<br />
<br />
Same as 1.0, except:<br />
* Made in Hungary or Mexico<br />
* USB controller moved onto the motherboard<br />
* Fan removed from the GPU heat sink<br />
* MCPX 1.1 ROM<br />
<br />
== 1.2 ==<br />
<br />
Same as 1.1, except:<br />
* Made in China<br />
* Philips DVD Drive<br />
* Western Digital Hard Drive<br />
<br />
== 1.3 ==<br />
Same as 1.2, except:<br />
* Samsung DVD Drive<br />
* Seagate Hard Drive<br />
<br />
== 1.4 ==<br />
<br />
Same as 1.3, except:<br />
* Western Digital Hard Drive<br />
* Focus video chip<br />
<br />
== 1.5 ==<br />
<br />
Same as 1.4. Possibly never existed, but will otherwise be very rare. Production was halted and 1.4 was produced again.<br />
<br />
== 1.6 ==<br />
<br />
Same as 1.4, except:<br />
* Made in China or Taiwan<br />
* BIOS no longer flashable<br />
* Removed data and power lines from LPC port<br />
* Xcalibur video chip<br />
<br />
== Identifying ==<br />
<br />
While not definitive, here are some ways to help identify the revision of your Xbox.<br />
<br />
=== Manufacturing Details ===<br />
<br />
{|<br />
! scope="col" | Date Range<br />
! scope="col" | Revision<br />
! scope="col" | Location<br />
|-<br />
| 01/2001-10/2002 || 1.0 || Hungary<br />
|-<br />
| 11/2002-04/2003 || 1.1 || Hungary, Mexico<br />
|-<br />
| 05/2003-03/2004 || 1.2 || China<br />
|-<br />
| 04/2004 Onward || 1.6 || China, Taiwan<br />
|}<br />
<br />
=== Serial Number ===<br />
<br />
The serial number looks like this:<br />
<br />
LNNNNNN TWWFF<br />
<br />
L is the production line<br />
NNNNNN is the number produced that week<br />
Y is the last digit of the production year<br />
WW is the number of the week<br />
FF is the factory code<br />
<br />
Note, this table contradicts the previous table.<br />
<br />
{|<br />
! scope="col" | Factory<br />
! scope="col" | Location<br />
! scope="col" | Revision<br />
|-<br />
| 02 || Mexico || 1.0 or 1.1<br />
|-<br />
| 03 || Hungary || 1.0<br />
|-<br />
| 05 || China || 1.2 or later<br />
|-<br />
| 06 || Taiwan || 1.2 or later<br />
|}<br />
<br />
{|<br />
! scope="col" | Serial Number<br />
! scope="col" | Revision<br />
|-<br />
| LNNNNNN 20WFF || 1.0<br />
|-<br />
| LNNNNNN 21WFF || 1.0<br />
|-<br />
| LNNNNNN 23WFF || 1.0 or 1.1<br />
|-<br />
| LNNNNNN 24WFF || 1.1<br />
|-<br />
| LNNNNNN 25WFF || 1.1<br />
|-<br />
| LNNNNNN 30WFF || 1.2<br />
|-<br />
| LNNNNNN 31WFF || 1.3<br />
|-<br />
| LNNNNNN 32WFF || 1.3<br />
|-<br />
| LNNNNNN 33WFF || 1.4 or 1.5<br />
|-<br />
| LNNNNNN 42WFF || 1.6<br />
|}<br />
<br />
{|<br />
! scope="col" | Video Chip<br />
! scope="col" | Revision<br />
|-<br />
| Conexant || 1.0, 1.1, 1.2, 1.3<br />
|-<br />
| Focus || 1.4, 1.5<br />
|-<br />
| Xcalibur || 1.6<br />
|}<br />
<br />
=== BIOS Version ===<br />
<br />
{|<br />
! scope="col" | Kernel Version<br />
! scope="col" | Revision<br />
|-<br />
| 3944, 4034, 4036, 4627 || 1.0<br />
|-<br />
| 4817, 4972 || 1.1<br />
|-<br />
| 5101, 5713 || 1.2 - 1.5<br />
|-<br />
| 5838 || 1.6<br />
|}<br />
<br />
== References ==<br />
<br />
* [http://www.informit.com/articles/article.aspx?p=367210&seqNum=2 InformIT Methods of Identification]<br />
* [http://www.informit.com/articles/article.aspx?p=367210 InformIT Identifying your Xbox Revision]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Motherboard&diff=5483Motherboard2017-05-26T21:20:41Z<p>Mborgerson: </p>
<hr />
<div>[[File:Xbox-Motherboard-BR.jpg|400px|thumb|right|Xbox Version 1.0 Motherboard]]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Motherboard&diff=5482Motherboard2017-05-26T21:20:27Z<p>Mborgerson: </p>
<hr />
<div>[[File:Xbox-Motherboard-BR.jpg|400px|thumb|right|Xbox 1.0 Motherboard]]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Motherboard&diff=5481Motherboard2017-05-26T21:18:33Z<p>Mborgerson: </p>
<hr />
<div>[[File:Xbox-Motherboard-BR.jpg|400px|thumb|right|Xbox Motherboard]]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=File:Xbox-Motherboard-BR.jpg&diff=5480File:Xbox-Motherboard-BR.jpg2017-05-26T21:16:34Z<p>Mborgerson: English: The motherboard for the Xbox, a sixth-generation gaming console made by Microsoft that was first released in 2001. The Xbox was Microsoft's first foray into the gaming console market, and was followed by the Xbox 360 in 2005. The console is no...</p>
<hr />
<div>English: The motherboard for the Xbox, a sixth-generation gaming console made by Microsoft that was first released in 2001. The Xbox was Microsoft's first foray into the gaming console market, and was followed by the Xbox 360 in 2005. The console is notable for having a built-in hard drive, breakaway controller dongles and an Ethernet port to support Microsoft's online gaming service, Xbox Live.<br />
The motherboard for the Xbox contains a custom 32-bit, 733 MHz Intel Pentium III CPU. It has 64 MB of DDR memory and a 233 MHz Nvidia GPU.<br />
<br />
Source: https://commons.wikimedia.org/wiki/File:Xbox-Motherboard-BR.jpg<br />
Author: Evan-Amos<br />
License: Public Domain</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Motherboard&diff=5479Motherboard2017-05-26T21:15:04Z<p>Mborgerson: </p>
<hr />
<div>[[File:Xbox-Motherboard-BR.jpg|Xbox-Motherboard-BR]]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Motherboard&diff=5478Motherboard2017-05-26T21:14:27Z<p>Mborgerson: Created page with "File:800px-Xbox-Motherboard-BR.jpg"</p>
<hr />
<div>[[File:800px-Xbox-Motherboard-BR.jpg]]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Main_Page&diff=5477Main Page2017-05-26T21:10:29Z<p>Mborgerson: </p>
<hr />
<div>{{:Main Page/Header}}<br />
<br />
== Hardware ==<br />
<br />
* [[Chihiro]]<br />
* [[Xbox]]<br />
<br />
* [[Hardware Revisions]]<br />
* [[Motherboard]]<br />
* [[Power Supply]]<br />
* [[CPU|CPU (Custom Pentium 3 733 MHz)]]<br />
* [[Memory]]<br />
* [[MCPX]]<br />
* [[DVD Drive]]<br />
* [[Hard Drive]]<br />
* [[USB]]<br />
* [[EEPROM]]<br />
* [[SMC]]<br />
* [[Video Encoder]]<br />
* [[Xbox Game Disc]]<br />
* [[Xbox Input Devices]]<br />
* [[NV2A]]<br />
** [[NV2A/Vertex attributes]]<br />
** [[NV2A/Fixed Function Pipeline]]<br />
** [[NV2A/Vertex Shader]]<br />
** [[NV2A/Pixel Combiner]]<br />
** [[NV2A/Surface Formats]]<br />
* [[NVNet|Network Controller (NVNet)]]<br />
<br />
== System Software ==<br />
* [[MCPX ROM]]<br />
* [[BIOS]] / [[Kernel]]<br />
* [[FATX]] (Filesystem)<br />
* [[Dashboard]]<br />
* [[Exploits]]<br />
<br />
== Development Kits and Tools ==<br />
* [https://github.com/xqemu/nxdk NXDK (New Xbox Development Kit)]<br />
* [[OpenXDK]]<br />
* [[Microsoft XDK]]<br />
** [[Xbox Debug Monitor]]<br />
<br />
== Games ==<br />
* [[:Category:Games|Games]]<br />
* [[Engine List]]<br />
<br />
== Emulation ==<br />
* [[Emulators]]<br />
<br />
== Other ==<br />
* [[Network]]<br />
* Find random stuff in [[Resources]]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Main_Page&diff=5476Main Page2017-05-26T21:09:02Z<p>Mborgerson: </p>
<hr />
<div>{{:Main Page/Header}}<br />
<br />
== Hardware ==<br />
<br />
* [[Chihiro]]<br />
* [[Xbox]]<br />
<br />
* [[Hardware Revisions]]<br />
* [[Motherboard]]<br />
* [[CPU|CPU (Custom Pentium 3 733 MHz)]]<br />
* [[Memory]]<br />
* [[MCPX]]<br />
* [[DVD Drive]]<br />
* [[Hard Drive]]<br />
* [[USB]]<br />
* [[EEPROM]]<br />
* [[SMC]]<br />
* [[Video Encoder]]<br />
* [[Xbox Game Disc]]<br />
* [[Xbox Input Devices]]<br />
* [[NV2A]]<br />
** [[NV2A/Vertex attributes]]<br />
** [[NV2A/Fixed Function Pipeline]]<br />
** [[NV2A/Vertex Shader]]<br />
** [[NV2A/Pixel Combiner]]<br />
** [[NV2A/Surface Formats]]<br />
* [[NVNet|Network Controller (NVNet)]]<br />
<br />
== System Software ==<br />
* [[MCPX ROM]]<br />
* [[BIOS]] / [[Kernel]]<br />
* [[FATX]] (Filesystem)<br />
* [[Dashboard]]<br />
* [[Exploits]]<br />
<br />
== Development Kits and Tools ==<br />
* [https://github.com/xqemu/nxdk NXDK (New Xbox Development Kit)]<br />
* [[OpenXDK]]<br />
* [[Microsoft XDK]]<br />
** [[Xbox Debug Monitor]]<br />
<br />
== Games ==<br />
* [[:Category:Games|Games]]<br />
* [[Engine List]]<br />
<br />
== Emulation ==<br />
* [[Emulators]]<br />
<br />
== Other ==<br />
* [[Network]]<br />
* Find random stuff in [[Resources]]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Video_Encoder&diff=5474Video Encoder2017-05-26T21:08:54Z<p>Mborgerson: Mborgerson moved page Video encoder to Video Encoder</p>
<hr />
<div>== Conexant ==<br />
<br />
== Focus == <br />
<br />
== xcalibur ==</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Main_Page&diff=5473Main Page2017-05-26T21:08:43Z<p>Mborgerson: </p>
<hr />
<div>{{:Main Page/Header}}<br />
<br />
== Hardware ==<br />
<br />
* [[Chihiro]]<br />
* [[Xbox]]<br />
<br />
* [[Hardware Revisions]]<br />
* [[Motherboard]]<br />
* [[CPU|CPU (Custom Pentium 3 733 MHz)]]<br />
* [[Memory]]<br />
* [[MCPX]]<br />
* [[DVD Drive]]<br />
* [[Hard Drive]]<br />
* [[USB]]<br />
* [[EEPROM]]<br />
* [[SMC]]<br />
* [[Video encoder]]<br />
* [[Xbox Game Disc]]<br />
* [[Xbox Input Devices]]<br />
* [[NV2A]]<br />
** [[NV2A/Vertex attributes]]<br />
** [[NV2A/Fixed Function Pipeline]]<br />
** [[NV2A/Vertex Shader]]<br />
** [[NV2A/Pixel Combiner]]<br />
** [[NV2A/Surface Formats]]<br />
* [[NVNet|Network Controller (NVNet)]]<br />
<br />
== System Software ==<br />
* [[MCPX ROM]]<br />
* [[BIOS]] / [[Kernel]]<br />
* [[FATX]] (Filesystem)<br />
* [[Dashboard]]<br />
* [[Exploits]]<br />
<br />
== Development Kits and Tools ==<br />
* [https://github.com/xqemu/nxdk NXDK (New Xbox Development Kit)]<br />
* [[OpenXDK]]<br />
* [[Microsoft XDK]]<br />
** [[Xbox Debug Monitor]]<br />
<br />
== Games ==<br />
* [[:Category:Games|Games]]<br />
* [[Engine List]]<br />
<br />
== Emulation ==<br />
* [[Emulators]]<br />
<br />
== Other ==<br />
* [[Network]]<br />
* Find random stuff in [[Resources]]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Hardware_Revisions&diff=5471Hardware Revisions2017-05-26T21:08:34Z<p>Mborgerson: Mborgerson moved page Hardware revisions to Hardware Revisions</p>
<hr />
<div>There are 7 Xbox revisions<br />
<br />
== 1.0 ==<br />
<br />
* Made in Hungary<br />
* USB controller is on a separate PCB<br />
* GPU has a fan on the heat sink<br />
* MCPX 1.0 ROM<br />
* Thomson DVD Drive<br />
* Seagate Hard Drive<br />
* Conexant [[Video Chip]]<br />
<br />
== 1.1 ==<br />
<br />
Same as 1.0, except:<br />
* Made in Hungary or Mexico<br />
* USB controller moved onto the motherboard<br />
* Fan removed from the GPU heat sink<br />
* MCPX 1.1 ROM<br />
<br />
== 1.2 ==<br />
<br />
Same as 1.1, except:<br />
* Made in China<br />
* Philips DVD Drive<br />
* Western Digital Hard Drive<br />
<br />
== 1.3 ==<br />
Same as 1.2, except:<br />
* Samsung DVD Drive<br />
* Seagate Hard Drive<br />
<br />
== 1.4 ==<br />
<br />
Same as 1.3, except:<br />
* Western Digital Hard Drive<br />
* Focus video chip<br />
<br />
== 1.5 ==<br />
<br />
Same as 1.4. Possibly never existed, but will otherwise be very rare. Production was halted and 1.4 was produced again.<br />
<br />
== 1.6 ==<br />
<br />
Same as 1.4, except:<br />
* Made in China or Taiwan<br />
* BIOS no longer flashable<br />
* Removed data and power lines from LPC port<br />
* Xcalibur video chip<br />
<br />
== Identifying ==<br />
<br />
While not definitive, here are some ways to help identify the revision of your Xbox.<br />
<br />
=== Manufacturing Details ===<br />
<br />
{|<br />
! scope="col" | Date Range<br />
! scope="col" | Revision<br />
! scope="col" | Location<br />
|-<br />
| 01/2001-10/2002 || 1.0 || Hungary<br />
|-<br />
| 11/2002-04/2003 || 1.1 || Hungary, Mexico<br />
|-<br />
| 05/2003-03/2004 || 1.2 || China<br />
|-<br />
| 04/2004 Onward || 1.6 || China, Taiwan<br />
|}<br />
<br />
=== Serial Number ===<br />
<br />
The serial number looks like this:<br />
<br />
LNNNNNN TWWFF<br />
<br />
L is the production line<br />
NNNNNN is the number produced that week<br />
Y is the last digit of the production year<br />
WW is the number of the week<br />
FF is the factory code<br />
<br />
Note, this table contradicts the previous table.<br />
<br />
{|<br />
! scope="col" | Factory<br />
! scope="col" | Location<br />
! scope="col" | Revision<br />
|-<br />
| 02 || Mexico || 1.0 or 1.1<br />
|-<br />
| 03 || Hungary || 1.0<br />
|-<br />
| 05 || China || 1.2 or later<br />
|-<br />
| 06 || Taiwan || 1.2 or later<br />
|}<br />
<br />
{|<br />
! scope="col" | Serial Number<br />
! scope="col" | Revision<br />
|-<br />
| LNNNNNN 20WFF || 1.0<br />
|-<br />
| LNNNNNN 21WFF || 1.0<br />
|-<br />
| LNNNNNN 23WFF || 1.0 or 1.1<br />
|-<br />
| LNNNNNN 24WFF || 1.1<br />
|-<br />
| LNNNNNN 25WFF || 1.1<br />
|-<br />
| LNNNNNN 30WFF || 1.2<br />
|-<br />
| LNNNNNN 31WFF || 1.3<br />
|-<br />
| LNNNNNN 32WFF || 1.3<br />
|-<br />
| LNNNNNN 33WFF || 1.4 or 1.5<br />
|-<br />
| LNNNNNN 42WFF || 1.6<br />
|}<br />
<br />
{|<br />
! scope="col" | Video Chip<br />
! scope="col" | Revision<br />
|-<br />
| Conexant || 1.0, 1.1, 1.2, 1.3<br />
|-<br />
| Focus || 1.4, 1.5<br />
|-<br />
| Xcalibur || 1.6<br />
|}<br />
<br />
=== BIOS Version ===<br />
<br />
{|<br />
! scope="col" | Kernel Version<br />
! scope="col" | Revision<br />
|-<br />
| 3944, 4034, 4036, 4627 || 1.0<br />
|-<br />
| 4817, 4972 || 1.1<br />
|-<br />
| 5101, 5713 || 1.2 - 1.5<br />
|-<br />
| 5838 || 1.6<br />
|}<br />
<br />
== References ==<br />
<br />
* [http://www.informit.com/articles/article.aspx?p=367210&seqNum=2 InformIT Methods of Identification]<br />
* [http://www.informit.com/articles/article.aspx?p=367210 InformIT Identifying your Xbox Revision]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Hardware_revisions&diff=5472Hardware revisions2017-05-26T21:08:34Z<p>Mborgerson: Mborgerson moved page Hardware revisions to Hardware Revisions</p>
<hr />
<div>#REDIRECT [[Hardware Revisions]]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Main_Page&diff=5470Main Page2017-05-26T21:08:16Z<p>Mborgerson: </p>
<hr />
<div>{{:Main Page/Header}}<br />
<br />
== Hardware ==<br />
<br />
* [[Chihiro]]<br />
* [[Xbox]]<br />
<br />
* [[Hardware revisions]]<br />
* [[Motherboard]]<br />
* [[CPU|CPU (Custom Pentium 3 733 MHz)]]<br />
* [[Memory]]<br />
* [[MCPX]]<br />
* [[DVD Drive]]<br />
* [[Hard Drive]]<br />
* [[USB]]<br />
* [[EEPROM]]<br />
* [[SMC]]<br />
* [[Video encoder]]<br />
* [[Xbox Game Disc]]<br />
* [[Xbox Input Devices]]<br />
* [[NV2A]]<br />
** [[NV2A/Vertex attributes]]<br />
** [[NV2A/Fixed Function Pipeline]]<br />
** [[NV2A/Vertex Shader]]<br />
** [[NV2A/Pixel Combiner]]<br />
** [[NV2A/Surface Formats]]<br />
* [[NVNet|Network Controller (NVNet)]]<br />
<br />
== System Software ==<br />
* [[MCPX ROM]]<br />
* [[BIOS]] / [[Kernel]]<br />
* [[FATX]] (Filesystem)<br />
* [[Dashboard]]<br />
* [[Exploits]]<br />
<br />
== Development Kits and Tools ==<br />
* [https://github.com/xqemu/nxdk NXDK (New Xbox Development Kit)]<br />
* [[OpenXDK]]<br />
* [[Microsoft XDK]]<br />
** [[Xbox Debug Monitor]]<br />
<br />
== Games ==<br />
* [[:Category:Games|Games]]<br />
* [[Engine List]]<br />
<br />
== Emulation ==<br />
* [[Emulators]]<br />
<br />
== Other ==<br />
* [[Network]]<br />
* Find random stuff in [[Resources]]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Main_Page&diff=5469Main Page2017-05-26T21:07:21Z<p>Mborgerson: /* Hardware */</p>
<hr />
<div>{{:Main Page/Header}}<br />
<br />
== Hardware ==<br />
<br />
* [[Chihiro]]<br />
* [[Xbox]]<br />
<br />
* [[Hardware Revisions]]<br />
* [[Motherboard]]<br />
* [[CPU|CPU (Custom Pentium 3 733 MHz)]]<br />
* [[Memory]]<br />
* [[MCPX]]<br />
* [[DVD Drive]]<br />
* [[Hard Drive]]<br />
* [[USB]]<br />
* [[EEPROM]]<br />
* [[SMC]]<br />
* [[Video Encoder]]<br />
* [[Xbox Game Disc]]<br />
* [[Xbox Input Devices]]<br />
* [[NV2A]]<br />
** [[NV2A/Vertex attributes]]<br />
** [[NV2A/Fixed Function Pipeline]]<br />
** [[NV2A/Vertex Shader]]<br />
** [[NV2A/Pixel Combiner]]<br />
** [[NV2A/Surface Formats]]<br />
* [[NVNet|Network Controller (NVNet)]]<br />
<br />
== System Software ==<br />
* [[MCPX ROM]]<br />
* [[BIOS]] / [[Kernel]]<br />
* [[FATX]] (Filesystem)<br />
* [[Dashboard]]<br />
* [[Exploits]]<br />
<br />
== Development Kits and Tools ==<br />
* [https://github.com/xqemu/nxdk NXDK (New Xbox Development Kit)]<br />
* [[OpenXDK]]<br />
* [[Microsoft XDK]]<br />
** [[Xbox Debug Monitor]]<br />
<br />
== Games ==<br />
* [[:Category:Games|Games]]<br />
* [[Engine List]]<br />
<br />
== Emulation ==<br />
* [[Emulators]]<br />
<br />
== Other ==<br />
* [[Network]]<br />
* Find random stuff in [[Resources]]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Resources&diff=5468Resources2017-05-26T20:13:46Z<p>Mborgerson: </p>
<hr />
<div>== Random resources about Xbox hacking ==<br />
* [https://events.ccc.de/congress/2005/fahrplan/attachments/591-paper_xbox.pdf Michael Steils Xbox Presentation from C3 in 2005]<br />
* [http://www.bunniestudios.com/bunnie/proj/anatak/xboxmod.html Bunnies original Xbox page]<br />
* [https://www.nostarch.com/xboxfree Bunnies "Hacking the Xbox" e-book for free]<br />
* [https://web-beta.archive.org/web/20010827184126/ddj.com/articles/2000/0008/0008a/0008a.htm?topic=graphics Article about Xbox Graphics (before release) from Dr. Dobbs]<br />
* [http://www.anandtech.com/show/853 Technical article about the Xbox by AnandTech]<br />
<br />
== History ==<br />
* [https://www.youtube.com/watch?v=rUODlNffWmU 3 Xbox Bosses Share Secrets of the Console's Past (Video)]<br />
* [https://www.youtube.com/watch?v=iWQb7LGH71s Xbox Assembly Line Tour (Video)]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Resources&diff=5467Resources2017-05-26T20:13:38Z<p>Mborgerson: /* History */</p>
<hr />
<div>== Random resources about Xbox hacking ==<br />
* [https://events.ccc.de/congress/2005/fahrplan/attachments/591-paper_xbox.pdf Michael Steils Xbox Presentation from C3 in 2005]<br />
* [http://www.bunniestudios.com/bunnie/proj/anatak/xboxmod.html Bunnies original Xbox page]<br />
* [https://www.nostarch.com/xboxfree Bunnies "Hacking the Xbox" e-book for free]<br />
* [https://web-beta.archive.org/web/20010827184126/ddj.com/articles/2000/0008/0008a/0008a.htm?topic=graphics Article about Xbox Graphics (before release) from Dr. Dobbs]<br />
* [http://www.anandtech.com/show/853 Technical article about the Xbox by AnandTech]<br />
<br />
== History ==<br />
* [https://www.youtube.com/watch?v=rUODlNffWmU 3 Xbox Bosses Share Secrets of the Console's Past (Video)]<br />
* [https://www.youtube.com/watch?v=iWQb7LGH71s Xbox Assembly Line Tour (Video)</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Talk:Xbe&diff=5439Talk:Xbe2017-05-26T00:11:05Z<p>Mborgerson: </p>
<hr />
<div>FIXME: The file format details should be inlined into the wiki. [[User:Mborgerson|Mborgerson]] ([[User talk:Mborgerson|talk]]) 17:11, 25 May 2017 (PDT)<br />
<br />
== Citation needed ==<br />
Some games have a citation needed note. ive taken the liberty to add a note where I thought this might help checking if a publisher was known for sure or somewhat further research is needed. if needed, we could remove those notes to here or use another tag for those.<br />
I dont want to just drop a "citation needed" without any reasoning. I could have made an error and for these I shared why I am not sure about one.<br />
<br />
Feel free to remove a note and cintation needed if you find the publisher correct.<br />
--[[User:Codeasm|Codeasm]] ([[User talk:Codeasm|talk]]) 16:19, 24 May 2017 (PDT)</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Talk:FATX&diff=5438Talk:FATX2017-05-26T00:11:00Z<p>Mborgerson: </p>
<hr />
<div>FIXME: Inline details about FATX [[User:Mborgerson|Mborgerson]] ([[User talk:Mborgerson|talk]]) 17:11, 25 May 2017 (PDT)</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Talk:Main_Page&diff=5437Talk:Main Page2017-05-26T00:10:43Z<p>Mborgerson: </p>
<hr />
<div>The main page could stand to be cleaned up now that we have many pages in the wiki. Also some pictures would be nice. Also we need a wiki logo. See [https://commons.wikimedia.org/wiki/User:Evan-Amos/VOGM/Xbox here] for some great high-quality pictures. [[User:Mborgerson|Mborgerson]] ([[User talk:Mborgerson|talk]]) 17:10, 25 May 2017 (PDT)<br />
<br />
I also think we should create a contribution policy page. One thought on the matter is this: Instead of linking to content elsewhere, we should try to bring as much content into the wiki as possible. This is so we don't lose valuable content as things tend to become unavailable over time (that is, dead links). It also makes for a better experience when browsing the wiki and provides a place for visitors to improve the info. [[User:Mborgerson|Mborgerson]] ([[User talk:Mborgerson|talk]]) 17:10, 25 May 2017 (PDT)</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Talk:Main_Page&diff=5436Talk:Main Page2017-05-26T00:08:43Z<p>Mborgerson: </p>
<hr />
<div>The main page could stand to be cleaned up now that we have many pages in the wiki. Also some pictures would be nice. Also we need a wiki logo. See [https://commons.wikimedia.org/wiki/User:Evan-Amos/VOGM/Xbox here] for some great high-quality pictures. -MB<br />
<br />
I also think we should create a contribution policy page. One thought on the matter is this: Instead of linking to content elsewhere, we should try to bring as much content into the wiki as possible. This is so we don't lose valuable content as things tend to become unavailable over time (that is, dead links). It also makes for a better experience when browsing the wiki and provides a place for visitors to improve the info. -MB</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Talk:Main_Page&diff=5435Talk:Main Page2017-05-26T00:08:11Z<p>Mborgerson: </p>
<hr />
<div>The main page could stand to be cleaned up now that we have many pages in the wiki. Also some pictures would be nice. Also we need a wiki logo. See [https://commons.wikimedia.org/wiki/User:Evan-Amos/VOGM/Xbox here] for some great high-quality pictures. -MB<br />
<br />
I also think we should create a contribution policy page. One thought on the matter is this: Instead of linking to content elsewhere, we should try to bring as much content into the wiki as possible. This is so we don't lose valuable content as things tend to become unavailable over time. It also makes for a better experience when browsing the wiki and provides a place for visitors to improve the info. -MB</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Talk:FATX&diff=5434Talk:FATX2017-05-26T00:06:25Z<p>Mborgerson: Created page with "FIXME: Inline details about FATX"</p>
<hr />
<div>FIXME: Inline details about FATX</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Talk:Xbe&diff=5433Talk:Xbe2017-05-26T00:05:58Z<p>Mborgerson: </p>
<hr />
<div>FIXME: The file format details should be inlined into the wiki.<br />
<br />
== Citation needed ==<br />
Some games have a citation needed note. ive taken the liberty to add a note where I thought this might help checking if a publisher was known for sure or somewhat further research is needed. if needed, we could remove those notes to here or use another tag for those.<br />
I dont want to just drop a "citation needed" without any reasoning. I could have made an error and for these I shared why I am not sure about one.<br />
<br />
Feel free to remove a note and cintation needed if you find the publisher correct.<br />
--[[User:Codeasm|Codeasm]] ([[User talk:Codeasm|talk]]) 16:19, 24 May 2017 (PDT)</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Main_Page&diff=5432Main Page2017-05-25T23:53:01Z<p>Mborgerson: </p>
<hr />
<div>{{:Main Page/Header}}<br />
<br />
== Hardware ==<br />
* [[Hardware revisions]]<br />
* [[CPU|CPU (Custom Pentium 3 733 MHz)]]<br />
* [[Memory]]<br />
* [[MCPX]]<br />
* [[DVD Drive]]<br />
* [[Hard Drive]]<br />
* [[USB]]<br />
* [[EEPROM]]<br />
* [[Xbox Game Disc]]<br />
* [[Xbox Input Devices]]<br />
* [[NV2A]]<br />
** [[NV2A/Vertex attributes]]<br />
** [[NV2A/Fixed Function Pipeline]]<br />
** [[NV2A/Vertex Shader]]<br />
** [[NV2A/Pixel Combiner]]<br />
** [[NV2A/Surface Formats]]<br />
* [[NVNet|Network Controller (NVNet)]]<br />
* [http://segaretro.org/Sega_Chihiro Chihiro]<br />
<br />
== Firmware/Kernel ==<br />
* [[MCPX ROM]]<br />
* [[BIOS]] / [[Kernel]]<br />
* [[FATX]] (Filesystem)<br />
<br />
== Development Kits and Tools ==<br />
* [https://github.com/xqemu/nxdk NXDK (New Xbox Development Kit)]<br />
* [[OpenXDK]]<br />
* [[Microsoft XDK]]<br />
* [[Chihiro-Tools]]<br />
* [[Xbox Debug Monitor]]<br />
* [[Chihiro-Launcher]]<br />
<br />
== Games ==<br />
* [[:Category:Games|Games]]<br />
* [[Engine List]]<br />
<br />
== Emulation ==<br />
* [[Emulators]]<br />
<br />
== Other ==<br />
* [[Network]]<br />
* Find random stuff in [[Resources]]<br />
<br />
== Getting started ==<br />
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Configuration_settings Configuration settings list]<br />
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:FAQ MediaWiki FAQ]<br />
* [https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce MediaWiki release mailing list]<br />
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Localisation#Translation_resources Localise MediaWiki for your language]<br />
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Combating_spam Learn how to combat spam on your wiki]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Main_Page&diff=5431Main Page2017-05-25T23:46:40Z<p>Mborgerson: </p>
<hr />
<div>{{:Main Page/Header}}<br />
<br />
== Hardware ==<br />
* [[Hardware revisions]]<br />
* [[CPU|CPU (Custom Pentium 3 733 MHz)]]<br />
* [[Memory]]<br />
* [[MCPX]]<br />
* [[DVD Drive]]<br />
* [[Hard Drive]]<br />
* [[USB]]<br />
* [[EEPROM]]<br />
* [[Xbox Game Disc]]<br />
* [[Xbox Input Devices]]<br />
* [[NV2A]]<br />
** [[NV2A/Vertex attributes]]<br />
** [[NV2A/Fixed Function Pipeline]]<br />
** [[NV2A/Vertex Shader]]<br />
** [[NV2A/Pixel Combiner]]<br />
** [[NV2A/Surface Formats]]<br />
* [[NVNet]]<br />
* [http://segaretro.org/Sega_Chihiro Chihiro]<br />
<br />
== Firmware/Kernel ==<br />
* [[MCPX ROM]]<br />
* [[BIOS]]<br />
* [[Kernel]]<br />
<br />
== Development Kits and Tools ==<br />
* [https://github.com/xqemu/nxdk NXDK (New Xbox Development Kit)]<br />
* [[OpenXDK]]<br />
* [[Microsoft XDK]]<br />
* [[Chihiro-Tools]]<br />
* [[Xbox Debug Monitor]]<br />
* [[Chihiro-Launcher]]<br />
<br />
== Games ==<br />
* [[:Category:Games|Games]]<br />
* [[Engine List]]<br />
<br />
== Emulation ==<br />
* [[Emulators]]<br />
<br />
== Other ==<br />
* [[Network]]<br />
* Find random stuff in [[Resources]]<br />
<br />
== Getting started ==<br />
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Configuration_settings Configuration settings list]<br />
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:FAQ MediaWiki FAQ]<br />
* [https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce MediaWiki release mailing list]<br />
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Localisation#Translation_resources Localise MediaWiki for your language]<br />
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Combating_spam Learn how to combat spam on your wiki]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Talk:Main_Page&diff=5430Talk:Main Page2017-05-25T23:27:10Z<p>Mborgerson: Created page with "The main page could stand to be cleaned up now that we have many pages in the wiki. Also some pictures would be nice. Also we need a wiki logo. See [https://commons.wikimedia...."</p>
<hr />
<div>The main page could stand to be cleaned up now that we have many pages in the wiki. Also some pictures would be nice. Also we need a wiki logo. See [https://commons.wikimedia.org/wiki/User:Evan-Amos/VOGM/Xbox here] for some great high-quality pictures.</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=EEPROM&diff=5428EEPROM2017-05-25T20:19:48Z<p>Mborgerson: </p>
<hr />
<div>The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.<br />
<br />
The Chihiro EEPROM key is <code>7B 35 A8 B7 27 ED 43 7A A0 BA FB 8F A4 38 61 80</code><br />
<br />
== Chip Models ==<br />
<br />
{| class="wikitable"<br />
! Xbox Model<br />
! Manufacturer<br />
! Model<br />
|-<br />
| 1.4 (Others?)<br />
| Catalyst<br />
| CAT24WC02J<br />
|}<br />
<br />
== Contents ==<br />
<br />
{| class="wikitable"<br />
! Start !! End !! Notes<br />
|-<br />
| 0x00<br />
| 0x13<br />
| HMAC_SHA1 Hash<br />
|-<br />
| 0x14<br />
| 0x1B<br />
| RC4 Encrypted Confounder ??<br />
|-<br />
| 0x1C<br />
| 0x2B<br />
| RC4 Encrypted HDD key<br />
|-<br />
| 0x2C<br />
| 0x2F<br />
| RC4 Encrypted Region code (0x01 North America, 0x02 Japan, 0x04 Europe)<br />
|-<br />
| 0x30<br />
| 0x33<br />
| Checksum of next 44 bytes<br />
|-<br />
| 0x34<br />
| 0x3F<br />
| Xbox serial number<br />
|-<br />
| 0x40<br />
| 0x45<br />
| Ethernet MAC address<br />
|-<br />
| 0x46<br />
| 0x47<br />
| Unknown Padding ?<br />
|-<br />
| 0x48<br />
| 0x57<br />
| Online Key ?<br />
|-<br />
| 0x58<br />
| 0x5B<br />
| ** 0x00014000 = NTSC, 0x00038000 = PAL<br />
|-<br />
| 0x5C<br />
| 0x5F<br />
| Unknown Padding ?<br />
|-<br />
| 0x60<br />
| 0x63<br />
| other Checksum of next<br />
|-<br />
| 0x64<br />
| 0x67<br />
| Zone Bias?<br />
|-<br />
| 0x68<br />
| 0x6B<br />
| Standard timezone<br />
|-<br />
| 0x5C<br />
| 0x6F<br />
| Daylight timezone<br />
|-<br />
| 0x70<br />
| 0x77<br />
| Unknown Padding ?<br />
|-<br />
| 0x78<br />
| 0x7B<br />
| 10-05-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x7C<br />
| 0x7F<br />
| 04-01-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x80<br />
| 0x87<br />
| Unknown Padding ?<br />
|-<br />
| 0x88<br />
| 0x8B<br />
| Standard Bias?<br />
|-<br />
| 0x8C<br />
| 0x8F<br />
| Daylight Bias?<br />
|-<br />
| 0x90<br />
| 0x93<br />
| Language ID<br />
|-<br />
| 0x94<br />
| 0x97<br />
| Video Settings<br />
|-<br />
| 0x98<br />
| 0x9B<br />
| Audio Settings<br />
|-<br />
| 0x9C<br />
| 0x9F<br />
| 0=MAX rating<br />
|-<br />
| 0xA0<br />
| 0xA3<br />
| 7=X, 8=Y, B=LTrigger, C=RTrigger<br />
|-<br />
| 0xA4<br />
| 0xA7<br />
| 0=Max rating<br />
|-<br />
| 0xA8<br />
| 0xAB<br />
| XBOX Live IP Address..<br />
|-<br />
| 0xAC<br />
| 0xAF<br />
| XBOX Live DNS Server..<br />
|-<br />
| 0xB0<br />
| 0xB3<br />
| XBOX Live Gateway Address..<br />
|-<br />
| 0xB4<br />
| 0xB7<br />
| XBOX Live Subnet Mask..<br />
|-<br />
| 0xA8<br />
| 0xBB<br />
| Other XBLive settings ?<br />
|-<br />
| 0xBC<br />
| 0xBF<br />
| DVD Playback Kit Zone<br />
|-<br />
| 0xC0<br />
| 0xFF<br />
| Unknown Codes / History ?<br />
|-<br />
|}<br />
<br />
Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].<br />
<br />
== Reading/Writing the EEPROM ==<br />
<br />
=== Software Method ===<br />
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.<br />
<br />
=== Hardware Method ===<br />
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see [http://dangerousprototypes.com/blog/bus-pirate-manual/ here]<br />
or [https://www.totalphase.com/products/aardvark-i2cspi/ here]), build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. Then use the corresponding software to read/write the EEPROM.<br />
<br />
== Further Reading ==<br />
<br />
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip with a Raspberry Pi]<br />
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]<br />
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=EEPROM&diff=5426EEPROM2017-05-25T19:32:05Z<p>Mborgerson: </p>
<hr />
<div>The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.<br />
<br />
The Chihiro EEPROM key is <code>7B 35 A8 B7 27 ED 43 7A A0 BA FB 8F A4 38 61 80</code><br />
<br />
== Contents ==<br />
<br />
{| class="wikitable"<br />
! Start !! End !! Notes<br />
|-<br />
| 0x00<br />
| 0x13<br />
| HMAC_SHA1 Hash<br />
|-<br />
| 0x14<br />
| 0x1B<br />
| RC4 Encrypted Confounder ??<br />
|-<br />
| 0x1C<br />
| 0x2B<br />
| RC4 Encrypted HDD key<br />
|-<br />
| 0x2C<br />
| 0x2F<br />
| RC4 Encrypted Region code (0x01 North America, 0x02 Japan, 0x04 Europe)<br />
|-<br />
| 0x30<br />
| 0x33<br />
| Checksum of next 44 bytes<br />
|-<br />
| 0x34<br />
| 0x3F<br />
| Xbox serial number<br />
|-<br />
| 0x40<br />
| 0x45<br />
| Ethernet MAC address<br />
|-<br />
| 0x46<br />
| 0x47<br />
| Unknown Padding ?<br />
|-<br />
| 0x48<br />
| 0x57<br />
| Online Key ?<br />
|-<br />
| 0x58<br />
| 0x5B<br />
| ** 0x00014000 = NTSC, 0x00038000 = PAL<br />
|-<br />
| 0x5C<br />
| 0x5F<br />
| Unknown Padding ?<br />
|-<br />
| 0x60<br />
| 0x63<br />
| other Checksum of next<br />
|-<br />
| 0x64<br />
| 0x67<br />
| Zone Bias?<br />
|-<br />
| 0x68<br />
| 0x6B<br />
| Standard timezone<br />
|-<br />
| 0x5C<br />
| 0x6F<br />
| Daylight timezone<br />
|-<br />
| 0x70<br />
| 0x77<br />
| Unknown Padding ?<br />
|-<br />
| 0x78<br />
| 0x7B<br />
| 10-05-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x7C<br />
| 0x7F<br />
| 04-01-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x80<br />
| 0x87<br />
| Unknown Padding ?<br />
|-<br />
| 0x88<br />
| 0x8B<br />
| Standard Bias?<br />
|-<br />
| 0x8C<br />
| 0x8F<br />
| Daylight Bias?<br />
|-<br />
| 0x90<br />
| 0x93<br />
| Language ID<br />
|-<br />
| 0x94<br />
| 0x97<br />
| Video Settings<br />
|-<br />
| 0x98<br />
| 0x9B<br />
| Audio Settings<br />
|-<br />
| 0x9C<br />
| 0x9F<br />
| 0=MAX rating<br />
|-<br />
| 0xA0<br />
| 0xA3<br />
| 7=X, 8=Y, B=LTrigger, C=RTrigger<br />
|-<br />
| 0xA4<br />
| 0xA7<br />
| 0=Max rating<br />
|-<br />
| 0xA8<br />
| 0xAB<br />
| XBOX Live IP Address..<br />
|-<br />
| 0xAC<br />
| 0xAF<br />
| XBOX Live DNS Server..<br />
|-<br />
| 0xB0<br />
| 0xB3<br />
| XBOX Live Gateway Address..<br />
|-<br />
| 0xB4<br />
| 0xB7<br />
| XBOX Live Subnet Mask..<br />
|-<br />
| 0xA8<br />
| 0xBB<br />
| Other XBLive settings ?<br />
|-<br />
| 0xBC<br />
| 0xBF<br />
| DVD Playback Kit Zone<br />
|-<br />
| 0xC0<br />
| 0xFF<br />
| Unknown Codes / History ?<br />
|-<br />
|}<br />
<br />
Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].<br />
<br />
== Reading/Writing the EEPROM ==<br />
<br />
=== Software Method ===<br />
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.<br />
<br />
=== Hardware Method ===<br />
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see [http://dangerousprototypes.com/blog/bus-pirate-manual/ here]<br />
or [https://www.totalphase.com/products/aardvark-i2cspi/ here]), build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. Then use the corresponding software to read/write the EEPROM.<br />
<br />
== Further Reading ==<br />
<br />
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip with a Raspberry Pi]<br />
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]<br />
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=EEPROM&diff=5425EEPROM2017-05-25T19:08:48Z<p>Mborgerson: </p>
<hr />
<div>The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.<br />
<br />
The Chihiro EEPROM key is <code>7B 35 A8 B7 27 ED 43 7A A0 BA FB 8F A4 38 61 80</code><br />
<br />
== Contents ==<br />
<br />
{| class="wikitable"<br />
! Start !! End !! Notes<br />
|-<br />
| 0x00<br />
| 0x13<br />
| HMAC_SHA1 Hash<br />
|-<br />
| 0x14<br />
| 0x1B<br />
| RC4 Encrypted Confounder ??<br />
|-<br />
| 0x1C<br />
| 0x2B<br />
| RC4 Encrypted HDD key<br />
|-<br />
| 0x2C<br />
| 0x2F<br />
| RC4 Encrypted Region code (0x01 North America, 0x02 Japan, 0x04 Europe)<br />
|-<br />
| 0x30<br />
| 0x33<br />
| Checksum of next 44 bytes<br />
|-<br />
| 0x34<br />
| 0x3F<br />
| Xbox serial number<br />
|-<br />
| 0x40<br />
| 0x45<br />
| Ethernet MAC address<br />
|-<br />
| 0x46<br />
| 0x47<br />
| Unknown Padding ?<br />
|-<br />
| 0x48<br />
| 0x57<br />
| Online Key ?<br />
|-<br />
| 0x58<br />
| 0x5B<br />
| ** 0x00014000 = NTSC, 0x00038000 = PAL<br />
|-<br />
| 0x5C<br />
| 0x5F<br />
| Unknown Padding ?<br />
|-<br />
| 0x60<br />
| 0x63<br />
| other Checksum of next<br />
|-<br />
| 0x64<br />
| 0x67<br />
| Zone Bias?<br />
|-<br />
| 0x68<br />
| 0x6B<br />
| Standard timezone<br />
|-<br />
| 0x5C<br />
| 0x6F<br />
| Daylight timezone<br />
|-<br />
| 0x70<br />
| 0x77<br />
| Unknown Padding ?<br />
|-<br />
| 0x78<br />
| 0x7B<br />
| 10-05-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x7C<br />
| 0x7F<br />
| 04-01-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x80<br />
| 0x87<br />
| Unknown Padding ?<br />
|-<br />
| 0x88<br />
| 0x8B<br />
| Standard Bias?<br />
|-<br />
| 0x8C<br />
| 0x8F<br />
| Daylight Bias?<br />
|-<br />
| 0x90<br />
| 0x93<br />
| Language ID<br />
|-<br />
| 0x94<br />
| 0x97<br />
| Video Settings<br />
|-<br />
| 0x98<br />
| 0x9B<br />
| Audio Settings<br />
|-<br />
| 0x9C<br />
| 0x9F<br />
| 0=MAX rating<br />
|-<br />
| 0xA0<br />
| 0xA3<br />
| 7=X, 8=Y, B=LTrigger, C=RTrigger<br />
|-<br />
| 0xA4<br />
| 0xA7<br />
| 0=Max rating<br />
|-<br />
| 0xA8<br />
| 0xAB<br />
| XBOX Live IP Address..<br />
|-<br />
| 0xAC<br />
| 0xAF<br />
| XBOX Live DNS Server..<br />
|-<br />
| 0xB0<br />
| 0xB3<br />
| XBOX Live Gateway Address..<br />
|-<br />
| 0xB4<br />
| 0xB7<br />
| XBOX Live Subnet Mask..<br />
|-<br />
| 0xA8<br />
| 0xBB<br />
| Other XBLive settings ?<br />
|-<br />
| 0xBC<br />
| 0xBF<br />
| DVD Playback Kit Zone<br />
|-<br />
| 0xC0<br />
| 0xFF<br />
| Unknown Codes / History ?<br />
|-<br />
|}<br />
<br />
Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].<br />
<br />
== Reading/Writing the EEPROM ==<br />
<br />
=== Software Method ===<br />
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.<br />
<br />
=== Hardware Method ===<br />
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an [https://www.totalphase.com/products/aardvark-i2cspi/ I2C/SPI USB host adapter], build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface already. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. <br />
<br />
== Further Reading ==<br />
<br />
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip with a Raspberry Pi]<br />
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]<br />
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=EEPROM&diff=5424EEPROM2017-05-25T19:06:36Z<p>Mborgerson: </p>
<hr />
<div>The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.<br />
<br />
The Chihiro EEPROM key is <code>7B 35 A8 B7 27 ED 43 7A A0 BA FB 8F A4 38 61 80</code><br />
<br />
== Contents ==<br />
<br />
{| class="wikitable"<br />
! Start !! End !! Notes<br />
|-<br />
| 0x00<br />
| 0x13<br />
| HMAC_SHA1 Hash<br />
|-<br />
| 0x14<br />
| 0x1B<br />
| RC4 Encrypted Confounder ??<br />
|-<br />
| 0x1C<br />
| 0x2B<br />
| RC4 Encrypted HDD key<br />
|-<br />
| 0x2C<br />
| 0x2F<br />
| RC4 Encrypted Region code (0x01 North America, 0x02 Japan, 0x04 Europe)<br />
|-<br />
| 0x30<br />
| 0x33<br />
| Checksum of next 44 bytes<br />
|-<br />
| 0x34<br />
| 0x3F<br />
| Xbox serial number<br />
|-<br />
| 0x40<br />
| 0x45<br />
| Ethernet MAC address<br />
|-<br />
| 0x46<br />
| 0x47<br />
| Unknown Padding ?<br />
|-<br />
| 0x48<br />
| 0x57<br />
| Online Key ?<br />
|-<br />
| 0x58<br />
| 0x5B<br />
| ** 0x00014000 = NTSC, 0x00038000 = PAL<br />
|-<br />
| 0x5C<br />
| 0x5F<br />
| Unknown Padding ?<br />
|-<br />
| 0x60<br />
| 0x63<br />
| other Checksum of next<br />
|-<br />
| 0x64<br />
| 0x67<br />
| Zone Bias?<br />
|-<br />
| 0x68<br />
| 0x6B<br />
| Standard timezone<br />
|-<br />
| 0x5C<br />
| 0x6F<br />
| Daylight timezone<br />
|-<br />
| 0x70<br />
| 0x77<br />
| Unknown Padding ?<br />
|-<br />
| 0x78<br />
| 0x7B<br />
| 10-05-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x7C<br />
| 0x7F<br />
| 04-01-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x80<br />
| 0x87<br />
| Unknown Padding ?<br />
|-<br />
| 0x88<br />
| 0x8B<br />
| Standard Bias?<br />
|-<br />
| 0x8C<br />
| 0x8F<br />
| Daylight Bias?<br />
|-<br />
| 0x90<br />
| 0x93<br />
| Language ID<br />
|-<br />
| 0x94<br />
| 0x97<br />
| Video Settings<br />
|-<br />
| 0x98<br />
| 0x9B<br />
| Audio Settings<br />
|-<br />
| 0x9C<br />
| 0x9F<br />
| 0=MAX rating<br />
|-<br />
| 0xA0<br />
| 0xA3<br />
| 7=X, 8=Y, B=LTrigger, C=RTrigger<br />
|-<br />
| 0xA4<br />
| 0xA7<br />
| 0=Max rating<br />
|-<br />
| 0xA8<br />
| 0xAB<br />
| XBOX Live IP Address..<br />
|-<br />
| 0xAC<br />
| 0xAF<br />
| XBOX Live DNS Server..<br />
|-<br />
| 0xB0<br />
| 0xB3<br />
| XBOX Live Gateway Address..<br />
|-<br />
| 0xB4<br />
| 0xB7<br />
| XBOX Live Subnet Mask..<br />
|-<br />
| 0xA8<br />
| 0xBB<br />
| Other XBLive settings ?<br />
|-<br />
| 0xBC<br />
| 0xBF<br />
| DVD Playback Kit Zone<br />
|-<br />
| 0xC0<br />
| 0xFF<br />
| Unknown Codes / History ?<br />
|-<br />
|}<br />
<br />
Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].<br />
<br />
== How to Dump Your EEPROM ==<br />
<br />
=== Software Dump ===<br />
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.<br />
<br />
=== Hardware Dump ===<br />
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an [https://www.totalphase.com/products/aardvark-i2cspi/ I2C/SPI USB host adapter], build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface already. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. <br />
<br />
== Further Reading ==<br />
<br />
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip with a Raspberry Pi]<br />
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]<br />
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Main_Page&diff=5422Main Page2017-05-25T18:52:06Z<p>Mborgerson: </p>
<hr />
<div>{{:Main Page/Header}}<br />
<br />
Development<br />
<br />
* [https://github.com/xqemu/nxdk NXDK (New Xbox Development Kit)]<br />
* [[OpenXDK]]<br />
* [[Microsoft XDK]]<br />
<br />
[[Xbox]]<br />
<br />
* [[Hardware revisions]]<br />
** [[CPU|CPU (Custom Pentium 3 733 MHz)]]<br />
** [[Memory]]<br />
** [[BIOS]]<br />
** [[MCPX]] [[MCPX ROM|(ROM)]]<br />
** [[DVD Drive]]<br />
** [[Hard Drive]]<br />
** [[USB]]<br />
** [[EEPROM]]<br />
* [[Xbox Game Disc]]<br />
* [[Xbox Input Devices]]<br />
* [[Xbox Debug Monitor]]<br />
* [[Operating System]]<br />
* [[NV2A]]<br />
** [[NV2A/Vertex attributes]]<br />
** [[NV2A/Fixed Function Pipeline]]<br />
** [[NV2A/Vertex Shader]]<br />
** [[NV2A/Pixel Combiner]]<br />
** [[NV2A/Surface Formats]]<br />
<br />
[http://segaretro.org/Sega_Chihiro Chihiro]<br />
<br />
* [[Chihiro-Tools]]<br />
* [[Chihiro-Launcher]]<br />
<br />
[[:Category:Games|Games]]<br />
<br />
* [[Engine List]]<br />
<br />
Emulation<br />
<br />
* [[Emulators]]<br />
<br />
{{:Main Page/Xbox Live}}<br />
<br />
Find random stuff in [[Resources]]<br />
<br />
== Getting started ==<br />
<br />
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Configuration_settings Configuration settings list]<br />
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:FAQ MediaWiki FAQ]<br />
* [https://lists.wikimedia.org/mailman/listinfo/mediawiki-announce MediaWiki release mailing list]<br />
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Localisation#Translation_resources Localise MediaWiki for your language]<br />
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Combating_spam Learn how to combat spam on your wiki]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Hard_Drive&diff=5257Hard Drive2017-05-20T19:18:21Z<p>Mborgerson: </p>
<hr />
<div>The original Xbox hard disk drive was 8GB in size. Later releases, 1.3 and 1.4's had Seagate 10GB drives; however, only the first 8GB of the drive was used.<br />
<br />
== Models ==<br />
{| class="wikitable<br />
|-<br />
! Xbox Version<br />
! Manufacturer<br />
! Model Number<br />
! Capacity<br />
|-<br />
| 1.0?<br />
| ?<br />
| ?<br />
| 8G<br />
|-<br />
| 1.3+<br />
| Seagate<br />
| ?<br />
| 10G<br />
|}<br />
<br />
== Partitions ==<br />
The Xbox hard disk contains multiple partitions. Unlike a PC, which typically contains either a [https://en.wikipedia.org/wiki/Master_boot_record Master Boot Record] or [https://en.wikipedia.org/wiki/GUID_Partition_Table GUID Partition Table] to specify the partition information, the Xbox kernel uses a fixed partition layout. The file system used on the Xbox is [[FATX]], a variant of FAT16/32 developed by Microsoft specifically for the Xbox.<br />
<br />
{| class="wikitable"<br />
|-<br />
! Drive Letter<br />
! Description<br />
! Offset (bytes)<br />
! Size (bytes)<br />
! Filesystem<br />
|-<br />
| N/A<br />
| Config Area<br />
| 0x00000000<br />
| 0x00080000<br />
| Fixed Structure<br />
|-<br />
| X<br />
| Game Cache<br />
| 0x00080000<br />
| 0x2ee00000<br />
| FATX<br />
|-<br />
| Y<br />
| Game Cache<br />
| 0x2ee80000<br />
| 0x2ee00000<br />
| FATX<br />
|-<br />
| Z<br />
| Game Cache<br />
| 0x5dc80000<br />
| 0x2ee00000<br />
| FATX<br />
|-<br />
| C<br />
| System<br />
| 0x8ca80000<br />
| 0x1f400000<br />
| FATX<br />
|-<br />
| E<br />
| Data<br />
| 0xabe80000<br />
| 0x131f00000<br />
| FATX<br />
|}<br />
<br />
'''FIXME:'''<br />
* Add info on how extended partitions are added.<br />
<br />
== Locking ==<br />
The hard drives in the Xbox are locked with a key which is unique to the specific Xbox. The drive is unlocked by the kernel at boot.<br />
<br />
=== Unlocking for Backups ===<br />
Before connecting an Xbox HDD to a PC for a backup or modification, the drive must first be unlocked. This can be done with alternative dashboards (such as EvoX). But beware, once you unlock the disk you cannot use it with an official BIOS until you re-lock the disk! For this reason it is suggested to use a patched BIOS which does not require the disk to be locked. If you are unable to run unsigned code (needed to unlock the HDD before powering off), it is possible to hot-swap the drive after the Xbox has started. This is not a suggested method, but it has been known to work. The idea is that you start the Xbox and wait for the dashboard, at which point the drive will be unlocked. Then, while the Xbox is running, you disconnect the IDE cable (but not the power!), and then connect the drive to your PC. Then the drive can be mounted for read/write (using XboxHDM), or imaged directly.<br />
<br />
'''FIXME:'''<br />
* Provide more info on locking/unlocking procedure.<br />
* Provide details about the key and how it can be derived from the [[EEPROM]] data.<br />
<br />
== How To: Backup an HDD ==<br />
There are two general methods to back up your HDD: copying the files, or creating a byte-for-byte image of the drive.<br />
<br />
=== Method 1: File Copy ===<br />
This is an acceptable backup method, but it is not as accurate an exact copy. This method requires less work to create the backup, but more work to re-create a usable disk image. The dashboard files (found in C:) are the most essential part of a backup, and a complete disk image can be re-created (with some effort) with a copy of the dashboard files using a tool such as XboxHDM.<br />
<br />
==== Remote ====<br />
Simply run an XBE on your Xbox that provides an FTP server. This is a standard feature for alternative dashboards (such as EvoX). Then connect to your Xbox from another system and copy all files in '''C:''' and '''E:'''.<br />
<br />
==== Direct ====<br />
Unlock the HDD, connect it to your PC, mount the drive (see [[FATX]]), copy the files.<br />
<br />
=== Method 2: Exact Copy ===<br />
This is the most accurate method to backup your hard disk. This method requires more work to create the backup, but does not require any effort to create a usable disk image like the first method. There are multiple ways to implement this method, one is provided here.<br />
<br />
Unlock the HDD, connect it to your PC using a USB-IDE adapter ([https://www.amazon.com/Sabrent-USB-DSC9-SATA-Drive-Converter/dp/B00DQJME7Y available for ~$20USD]). In GNU/Linux and other *NIX variants, DD can be used to perform the block copy. For example: <code>sudo dd if=/dev/sdb of=xbox_hdd.raw bs=512</code>. If you're dumping an original Xbox HDD (capacity 8G or 10G), this will finish pretty quickly. The files can be extracted by mounting the filesystems in the image (see [[FATX]]).<br />
<br />
== Further Reading ==<br />
* [http://hackipedia.org/Disk%20formats/Partition%20tables/X-Box/Xbox_Partitioning_and_Filesystem_Details.htm Xbox Partitioning and Filesystem Details]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=FATX&diff=5254FATX2017-05-20T01:08:41Z<p>Mborgerson: Created page with "The file system used on the Xbox is FATX, a variant of FAT16/32 developed by Microsoft specifically for the Xbox. == Implementations == {| class="wikitable |- ! Name ! P..."</p>
<hr />
<div>The file system used on the Xbox is [[FATX]], a variant of FAT16/32 developed by Microsoft specifically for the Xbox.<br />
<br />
== Implementations ==<br />
<br />
{| class="wikitable<br />
|-<br />
! Name<br />
! Platform<br />
! Read/Write<br />
! Description<br />
|-<br />
| Official<br />
| Xbox<br />
| Read/Write<br />
| Official FATX implementation by Microsoft<br />
|-<br />
| [https://github.com/mborgerson/fatx fatxfs]<br />
| GNU/Linux, macOS<br />
| Read-Only<br />
| [https://en.wikipedia.org/wiki/Filesystem_in_Userspace FUSE]-based implementation<br />
|}<br />
<br />
== Further Reading ==<br />
* [http://hackipedia.org/Disk%20formats/File%20systems/FATX%2C%20File%20Allocation%20Table%20%28X-Box%29/Differences_between_Xbox_FATX_and_MS-DOS_FAT.htm Differences between Xbox FATX and MS-DOS FAT]</div>Mborgersonhttps://xboxdevwiki.net/index.php?title=Hard_Drive&diff=5253Hard Drive2017-05-20T00:59:30Z<p>Mborgerson: Add partition info, stub other sections</p>
<hr />
<div>The original Xbox hard disk drive was 8GB in size. Later releases, 1.3 and 1.4's had Seagate 10GB drives; however, only the first 8GB of the drive was used.<br />
<br />
== Models ==<br />
{| class="wikitable<br />
|-<br />
! Xbox Version<br />
! Manufacturer<br />
! Model Number<br />
! Capacity<br />
|-<br />
| 1.0?<br />
| ?<br />
| ?<br />
| 8G<br />
|-<br />
| 1.3+<br />
| Seagate<br />
| ?<br />
| 10G<br />
|}<br />
<br />
== Partitions ==<br />
The Xbox hard disk contains multiple partitions. Unlike a PC, which typically contains either a [https://en.wikipedia.org/wiki/Master_boot_record Master Boot Record] or [https://en.wikipedia.org/wiki/GUID_Partition_Table GUID Partition Table] to specify the partition information, the Xbox kernel uses a fixed partition layout. The file system used on the Xbox is [[FATX]], a variant of FAT16/32 developed by Microsoft specifically for the Xbox.<br />
<br />
{| class="wikitable"<br />
|-<br />
! Drive Letter<br />
! Description<br />
! Offset (bytes)<br />
! Size (bytes)<br />
! Filesystem<br />
|-<br />
| N/A<br />
| Config Area<br />
| 0x00000000<br />
| 0x00080000<br />
| Fixed Structure<br />
|-<br />
| X<br />
| Game Cache<br />
| 0x00080000<br />
| 0x2ee00000<br />
| FATX<br />
|-<br />
| Y<br />
| Game Cache<br />
| 0x2ee80000<br />
| 0x2ee00000<br />
| FATX<br />
|-<br />
| Z<br />
| Game Cache<br />
| 0x5dc80000<br />
| 0x2ee00000<br />
| FATX<br />
|-<br />
| C<br />
| System<br />
| 0x8ca80000<br />
| 0x1f400000<br />
| FATX<br />
|-<br />
| E<br />
| Data<br />
| 0xabe80000<br />
| 0x131f00000<br />
| FATX<br />
|}<br />
<br />
'''FIXME:'''<br />
* Add info on how extended partitions are added.<br />
<br />
== Locking ==<br />
The hard drives in the Xbox are locked with a key which is unique to the specific Xbox. The drive is unlocked by the kernel at boot.<br />
<br />
'''FIXME:'''<br />
* Provide more info on locking/unlocking procedure.<br />
* Provide details about the key and how it can be derived from the EEPROM data.<br />
<br />
== How To: Backup an HDD ==<br />
'''FIXME'''<br />
<br />
== Further Reading ==<br />
* [http://hackipedia.org/Disk%20formats/Partition%20tables/X-Box/Xbox_Partitioning_and_Filesystem_Details.htm Xbox Partitioning and Filesystem Details]</div>Mborgerson