https://xboxdevwiki.net/api.php?action=feedcontributions&user=JayFoxRox&feedformat=atomxboxdevwiki - User contributions [en]2024-03-28T15:34:32ZUser contributionsMediaWiki 1.28.0https://xboxdevwiki.net/index.php?title=EEPROM&diff=6876EEPROM2020-08-12T21:33:37Z<p>JayFoxRox: Added VGA port dumping method</p>
<hr />
<div>The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.<br />
Parts of the EEPROM are encrypted using [[Kernel/XboxEEPROMKey]].<br />
<br />
== Contents ==<br />
<br />
{| class="wikitable"<br />
! Start !! End !! Notes<br />
|-<br />
| 0x00<br />
| 0x13<br />
| HMAC_SHA1 Hash<br />
|-<br />
| 0x14<br />
| 0x1B<br />
| RC4 Encrypted Confounder ??<br />
|-<br />
| 0x1C<br />
| 0x2B<br />
| RC4 Encrypted HDD key<br />
|-<br />
| 0x2C<br />
| 0x2F<br />
| RC4 Encrypted Region code<br />
* 0x00000001 = North America<br />
* 0x00000002 = Japan<br />
* 0x00000004 = Europe & Australia<br />
* 0x80000000 = Manufacturing plant<br />
|-<br />
| 0x30<br />
| 0x33<br />
| Checksum2 - Checksum of next 44 (0x2C) bytes (0x34 - 0x5F)<sup>*</sup><br />
|-<br />
| 0x34<br />
| 0x3F<br />
| Xbox serial number - (ASCII chars 0x30 - 0x39 to match each digit in SN)<br />
|-<br />
| 0x40<br />
| 0x45<br />
| Ethernet MAC address (Microsoft Xbox - 00:50:F2:xx:xx:xx)<br />
This is the MAC address of the Ethernet hardware, which has been [https://web.archive.org/web/20100617020733/http://standards.ieee.org/regauth/oui/oui_public.txt issued by the IEEE].<br />
|-<br />
| 0x46<br />
| 0x47<br />
| Unknown Padding ?<br />
|-<br />
| 0x48<br />
| 0x57<br />
| Online Key ?<br />
|-<br />
| 0x58<br />
| 0x5B<br />
| Video Standard<br />
* 0x00000000 = not set (INVALID)<br />
* 0x00400100 = NTSC-M<br />
* 0x00400200 = NTSC-J<br />
* 0x00800300 = PAL-I<br />
* 0x00400400 = PAL-M<br />
|-<br />
| 0x5C<br />
| 0x5F<br />
| Unknown Padding ?<br />
|-<br />
| 0x60<br />
| 0x63<br />
| Checksum3 - Checksum of the next 92 (0x5C) bytes (0x64 - 0xBF)<sup>*</sup><br />
|-<br />
| 0x64<br />
| 0x67<br />
| Zone Bias - Offset in # minutes to subtract from GMT time <br />
(e.g., for GMT-06 Central; 6hr = 360min = 0x00000168)<br />
|-<br />
| 0x68<br />
| 0x6B<br />
| Standard Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CST\0, ACST)<br />
|-<br />
| 0x6C<br />
| 0x6F<br />
| Daylight Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CDT\0, ACDT)<br />
|-<br />
| 0x70<br />
| 0x77<br />
| Unknown Padding ?<br />
|-<br />
| 0x78<br />
| 0x7B<br />
| Standard Time Starts 10-05-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x7C<br />
| 0x7F<br />
| Daylight Savings Time Starts 04-01-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x80<br />
| 0x87<br />
| Unknown Padding ?<br />
|-<br />
| 0x88<br />
| 0x8B<br />
| Standard Timezone Bias; if not DST, 0 (0x00000000) minute time adjust<br />
|-<br />
| 0x8C<br />
| 0x8F<br />
| Daylight Savings Time Bias; if DST, -60 (0xFFFFFFC4) minute time adjust<br />
|-<br />
| 0x90<br />
| 0x93<br />
| Language ID (0 = not set)<br />
* 0x00000001 = English<br />
* 0x00000002 = Japanese<br />
* 0x00000003 = German<br />
* 0x00000004 = French<br />
* 0x00000005 = Spanish<br />
* 0x00000006 = Italian<br />
* 0x00000007 = Korean<br />
* 0x00000008 = Chinese<br />
* 0x00000009 = Portuguese<br />
|-<br />
| 0x94<br />
| 0x97<br />
| Video Settings<br />
* 0x00080000 = 480p<br />
* 0x00020000 = 720p<br />
* 0x00040000 = 1080i<br />
<br />
* 0x00010000 = Widescreen{{FIXME|reason=What happens if Widescreen and letterbox are enabled at the same time? Can this happen?}}<br />
* 0x00100000 = Letterbox{{FIXME|reason=What happens if Widescreen and letterbox are enabled at the same time? Can this happen?}}<br />
<br />
* 0x00400000 = 60Hz{{FIXME|reason=Unconfirmed; Also, what happens if both refresh rates are disabled?}}<br />
* 0x00800000 = 50Hz{{FIXME|reason=Unconfirmed; Also, what happens if both refresh rates are disabled?}}<br />
|-<br />
| 0x98<br />
| 0x9B<br />
| Audio Settings<br />
* 0x00000000 = Stereo<br />
* 0x00000001 = Mono<br />
* 0x00000002 = Surround<br />
* 0x00010000 = Enable AC3<br />
* 0x00020000 = Enable DTS<br />
|-<br />
| 0x9C<br />
| 0x9F<br />
| Games Parental Control (0 = Max rating)<br />
* 0x00000000 = Rating Pending (RP)<br />
* 0x00000001 = Adults Only (AO)<br />
* 0x00000002 = Mature (M)<br />
* 0x00000003 = Teen (T)<br />
* 0x00000004 = Everyone (E)<br />
* 0x00000005 = Kids to Adults (K-A)<br />
* 0x00000006 = Early Childhood (EC)<br />
|-<br />
| 0xA0<br />
| 0xA3<br />
| Parental Control Passcode; 4 button sequence (each key stored in a nibble)<br />
* 0x1 = {{input-dy+}} or {{input-ly+}}<br />
* 0x2 = {{input-dy-}} or {{input-ly-}}<br />
* 0x3 = {{input-dx-}} or {{input-lx-}}<br />
* 0x4 = {{input-dx+}} or {{input-lx+}}<br />
* 0x5 = {{input-a}}<br />
* 0x6 = {{input-b}}<br />
* 0x7 = {{input-x}}<br />
* 0x8 = {{input-y}}<br />
* 0xB = {{input-lt}}<br />
* 0xC = {{input-rt}}<br />
* 0x0 = Disabled{{FIXME|reason=Is this 0x00000000 only, or are shorter codes possible? can a middle section be 0x00 or would that end the sequence?}}<br />
<br />
''Note'':<br />
* A passcode 0x00001423 is D-pad directions up (0x1), right (0x4), down (0x2), left (0x3). <br />
* Pass code only uses the lower 16 bits; each button is stored as a nibble in the word. First button in the most significant nibble and last in the least significant nibble.<br />
|-<br />
| 0xA4<br />
| 0xA7<br />
| Movies Parental Control (0 = Max rating)<br />
* 0x00000001 = Adults Only (NC-17)<br />
* 0x00000002 = Restricted (R)<br />
* 0x00000004 = Parents Strongly Cautioned (PG-13)<br />
* 0x00000005 = Parental Guidance Suggested (PG)<br />
* 0x00000007 = General Audiences (G)<br />
|- <br />
| 0xA8<br />
| 0xAB<br />
| XBOX Live IP Address..<br />
|-<br />
| 0xAC<br />
| 0xAF<br />
| XBOX Live DNS Server..<br />
|-<br />
| 0xB0<br />
| 0xB3<br />
| XBOX Live Gateway Address..<br />
|-<br />
| 0xB4<br />
| 0xB7<br />
| XBOX Live Subnet Mask..<br />
|-<br />
| 0xB8<br />
| 0xBB<br />
| Other XBLive settings ?<br />
|-<br />
| 0xBC<br />
| 0xBF<br />
| DVD Playback Kit Zone<br />
* 0x00000000 = None<br />
* 0x00000001 = Region 1<br />
* ...<br />
* 0x00000006 = Region 6{{FIXME|reason=We should document which regions were actually sold in stores}}<br />
|-<br />
| 0xC0<br />
| 0xFF<br />
| Unknown Codes / History ? do not change any values in this range<br />
|-<br />
|}<br />
<br />
Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].<br />
<br />
<sup>*</sup>Configmagic-FINAL-1.6 uses the wrong size when computing Checksum2 (40 instead of 44 bytes) and Checksum3 (96 instead of 92 bytes). Checksum2 value computed was correct only because the extra 4 bytes not used in the CRC computation were all 0's which does not change the CRC value. However, a similiar problem with computation of Checksum3 is present. The CRC computed for v1.6 Xbox's is incorrect as the 4 extra bytes are not 0's as on earlier versions.<br />
<br />
== Reading/Writing the EEPROM ==<br />
<br />
=== Software Method ===<br />
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.<br />
<br />
=== Hardware Method ===<br />
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see [http://dangerousprototypes.com/blog/bus-pirate-manual/ here]<br />
or [https://www.totalphase.com/products/aardvark-i2cspi/ here]), build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. Then use the corresponding software to read/write the EEPROM.<br />
<br />
== The HMAC HDD Key ==<br />
<br />
The HMAC HDD Key is generated{{FIXME|reason=Stored? Derived? At factory?}} out of the first 48 bytes{{FIXME|reason=..first 48 EEPROM bytes? Encrypted / Decrypted?}}. This section has been identified clearly{{FIXME|reason=What does this mean?}}.<br />
<br />
== Checksum Algorithm ==<br />
<br />
Checksum2 and Checksum3 values can be calculated by running the following code snippet over the area the checksum covers:<br />
<br />
<pre> /* The EepromCRC algorithm was obtained from the XKUtils 0.2 source released by<br />
* TeamAssembly under the GNU GPL.<br />
* Specifically, from XKCRC.cpp<br />
*<br />
* Rewritten to ANSI C by David Pye (dmp@davidmpye.dyndns.org)<br />
*<br />
* Adapted for XboxDevWiki<br />
*/<br />
uint32_t EepromCRC(unsigned char *data, long dataLen) {<br />
<br />
// Initialize result to zero<br />
uint8_t crc[4] = { 0x00, 0x00, 0x00, 0x00 };<br />
<br />
//Circle shift input data one byte right<br />
unsigned char* CRC_Data = (unsigned char *)malloc(dataLen + 4);<br />
memset(CRC_Data, 0x00, dataLen + 4);<br />
memcpy(CRC_Data + 0x01 , data, dataLen - 1);<br />
memcpy(CRC_Data, data + dataLen - 1, 0x01);<br />
<br />
// Calculate checksum<br />
for (unsigned int i = 0; i < 4; i++) {<br />
unsigned short CRCPosVal = 0xFFFF;<br />
for (unsigned long l = i; l < dataLen; l += 4) {<br />
CRCPosVal -= *(unsigned short*)(&amp;CRC_Data[l]);<br />
}<br />
CRCPosVal &= 0xFF00;<br />
crc[i] = (unsigned char) (CRCPosVal >> 8);<br />
}<br />
<br />
free(CRC_Data);<br />
<br />
return *(uint32_t*)&crc;<br />
}<br />
</pre><br />
<br />
== Read Checksum Algorithm ==<br />
<br />
When the Xbox reads from the FACTORY_SETTINGS or the USER_SETTINGS section of the EEPROM, this algorithm is ran over the entire section accessed (including the CRC checksum mentioned above) to ensure that the data is valid. If the result of the checksum algorithm does not equal 0xFFFFFFFF, STATUS_DEVICE_DATA_ERROR is returned from the Kernel.<br />
<br />
<pre>static uint32_t eeprom_section_checksum(<br />
const uint32_t* section_data,<br />
uint32_t section_data_length<br />
)<br />
{<br />
const uint32_t bitmask = 0xFFFFFFFF;<br />
uint64_t checksum = 0;<br />
uint32_t carry_count = 0;<br />
<br />
// Process the data in 32 bit steps<br />
for(unsigned int i = 0; i < section_data_length / 4; i++) {<br />
checksum += *section_data;<br />
if(checksum > bitmask) {<br />
carry_count++;<br />
checksum &= bitmask;<br />
}<br />
section_data++;<br />
}<br />
checksum += carry_count;<br />
if(checksum > bitmask) {<br />
checksum += 1;<br />
}<br />
return (uint32_t)(checksum & bitmask);<br />
}<br />
</pre><br />
<br />
== Further Reading ==<br />
<br />
* [https://web.archive.org/web/20040604013125/http://console-dev.com:80/eeprom.htm Information about EEPROM contents]<br />
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip using a Raspberry Pi]<br />
* [https://mehmedbasic.dk/post/xbox-eeprom/ Read/Write an original Xbox EEPROM using a VGA port]<br />
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]<br />
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=BIOS&diff=6866BIOS2020-05-26T14:31:12Z<p>JayFoxRox: Add skeptical note about 4132 / 4134</p>
<hr />
<div>The '''BIOS''' (an acronym for '''Basic Input/Output System''' and also known as the '''BIOS ROM''' or '''Xbox ROM''') is a firmware image that is mapped to the top 16MiB of the CPU's physical address space (0xFF000000 - 0xFFFFFFFF). Like the standard [https://en.wikipedia.org/wiki/BIOS PC BIOS], it is responsible for initializing the Xbox hardware and booting the system. Unlike the PC BIOS, however, the Xbox BIOS image also contains the kernel in a compressed and encrypted form.<br />
<br />
On a standard Xbox, the BIOS image is stored in the [[Flash ROM]]. The BIOS image is actually 256 kiB, duplicated 4 times to fill the 1 MiB ROM chip. You can verify this by running:<br />
<br />
<pre><br />
$ split -n 4 xbox.bin <br />
$ md5sum xa*<br />
542c62cb976a4993c8c5027dff9638ce xaa<br />
542c62cb976a4993c8c5027dff9638ce xab<br />
542c62cb976a4993c8c5027dff9638ce xac<br />
542c62cb976a4993c8c5027dff9638ce xad<br />
</pre><br />
<br />
You'll notice it is the same file repeated 4 times. That explains how some BIOS chips are 1 MiB and some are 256 kiB. The next thing is that the BIOS is repeated from 0xFF000000 until it fills the rest of memory. In other words, that 256 kiB of data is repeated 64 times.<br />
<br />
== Components ==<br />
<br />
The BIOS is split into different components. These are largely the same from BIOS to BIOS, but with some differences.<br />
<br />
{| class="wikitable"<br />
! <br />
! 3944 !! 4034 !! 4134{{FIXME|reason=Some sources claim there is 4132; however, neither 4134 or 4132 are listed in redump. So this might not be a real MS bios}} !! 4817 !! 5101 !! 5530 !! 5713 !! 5838 <br />
|-<br />
! NV2A Initialization Table <br />
| 0x00000 || 0x00000 || 0x00000 || 0x00000 || 0x00000 || 0x00000 || 0x00000 || 0x00000<br />
|-<br />
! MCPX Initialization Table<br />
| 0x00070 || 0x00070 || 0x00070 || 0x00070 || 0x00070 || 0x00070 || 0x00070 || 0x00070<br />
|-<br />
! X-Codes <br />
| 0x00080 || 0x00080 || 0x00080 || 0x00080 || 0x00080 || 0x00080 || 0x00080 || 0x00080<br />
|-<br />
! Copyright String <br />
| 0x00CFA || 0x00CFA || 0x00CFA || 0x00DB9 || 0x00E49 || 0x00E59 || 0x00E59 || 0x00DCC<br />
|-<br />
! Kernel<br />
| 0x0619C || || || || || || || <br />
|-<br />
! Kernel Data Segment<br />
| 0x3944C || || || || || || || <br />
|-<br />
! 2BL <br> ''Always 0x6000 bytes'' <br />
| 0x39E00 || 0x39E00 || 0x39E00 || || || || || <br />
|-<br />
! FBL <br> ''Always 0x2880 bytes''<br />
| || || || 0x3D400 || 0x3D400 || 0x3D400 || 0x3D400 || 0x3D400<br />
|-<br />
! Decoy Boot Loader <br />
| 0x3FE00 || 0x3FE00 || 0x3FE00 || 0x3FE00 || 0x3FE00 || 0x3FE00 || 0x3FE00 || 0x3FE00<br />
|}<br />
<br />
For information how these sections are used, see [[Boot Process]].<br />
<br />
=== NV2A Initialization Table ===<br />
<br />
The first DWORD is a pointer to a table of values that the NV2A northbridge uses to initialize itself, but with the least-significant bit always set to 1 (likely some sort of sanity check). The second DWORD is the unmodified table pointer. On all Xbox BIOS, the NV2A initialization table is always at file offset 8, virtual address 0xFF000008.<br />
<br />
The first DWORD of the NV2A initialization table is the magic number 0x2B16D065 (called the "boot header"). The purpose of the remaining values in the table is unknown{{FIXME}}.<br />
<br />
=== MCPX Initialization Table ===<br />
<br />
This is a table of values used to initialize the MCPX southbridge. It ''must'' be placed at offset 0x70 in the ROM image.<br />
<br />
=== xcodes ===<br />
<br />
These are the xcode operations run by the MCPX interpreter. The first couple of lines appear to be nonsense (they don't execute any functionality), but then the first actual codes that I have found are:<br />
<br />
The xcodes in the BIOS versions 3944, 4034, 4134 all start with:<br />
<code>04 10 08 00 80 01 80 00 00</code><br />
<br />
The xcodes in the BIOS versions 4817, 5101, 5530, 5713, 5838 all start with:<br />
<code>04 84 08 00 80 01 80 00 00</code><br />
<br />
This leads me to believe that the first three BIOS versions that I have are compatible with the 1.0 MCPX, and the rest are compatible with the 1.1 MCPX.<br />
<br />
Next, some people believed that there was another unknown section between the xcodes and the copyright string. As far as I can tell, that section was to allow the xcode instruction set to expand, as the 5838 BIOS has considerably more xcodes than the 3944 BIOS.<br />
<br />
=== Copyright String ===<br />
<br />
Literally contains the ASCII encoded text: "<code>Copyright (c) Microsoft Corporation. All rights reserved.</code>" (57 bytes long).<br />
<br />
=== Decoy bootloader ===<br />
<br />
This is very similar to the [[MCPX ROM]], only the xcode interpreter is different, and it doesn't include any decryption/hashing algorithms.<br />
<br />
== See Also ==<br />
<br />
[[BIOS Dumping]]<br />
<br />
== References ==<br />
<br />
* [http://redump.org/datfile/xbox-bios/ Xbox BIOS dat file from Redump Project]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=NV2A/Pixel_Combiner&diff=6853NV2A/Pixel Combiner2020-05-06T03:37:19Z<p>JayFoxRox: Found another nvidia mirror for BRDFs.pdf; added to archive.org</p>
<hr />
<div>== Data types ==<br />
<br />
NV_texture_shader suggests that: ''"The 8-bit and 16-bit signed fixed-point types are used for signed internal texture formats, while the 9-bit signed fixed-point type is used for register combiners computations."''<br />
Here is a table from the GL extension:<br />
<br />
{| class="wikitable"<br />
! floating-point !! 8-bit fixed-point !! 9-bit fixed-point !! 16-bit fixed-point<br />
|-<br />
| 1.0 || n/a || 255 || n/a <br />
|-<br />
| 0.99996... || n/a || n/a || 32767<br />
|-<br />
| 0.99218... || 127 || n/a || n/a <br />
|-<br />
| 0.0 || 0 || 0 || 0<br />
|-<br />
| -1.0 || -128 || -255 || -32768<br />
|-<br />
| -1.00392... || n/a || -256 || n/a<br />
|}<br />
<br />
This means:<br />
<br />
* 8-bit fixed-point: [-128, 127] &rarr; [-128/128, 127/128] &rarr; [-1.0, 0.99218...]<br />
* 9-bit fixed-point: [-256, 255] &rarr; [-256/255, 255/255] &rarr; [-1.00392..., 1.0]<br />
* 16-bit fixed-point: [-32768, 32767] &rarr; [-32768/32768, 32767/32768] &rarr; [-1.0, 0.99996...]<br />
<br />
It is not known if the NV2A really implements these 3 datatypes.<br />
It is also not yet known how exactly conversion or negation of these types would work.<br />
<br />
== Texture Shaders ==<br />
<br />
The NV2A implements at least parts of the following OpenGL extensions:<br />
<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader.txt NV_texture_shader]<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader2.txt NV_texture_shader2]<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader3.txt NV_texture_shader3]{{citation needed}}<br />
<br />
=== Texturing modes ===<br />
<br />
{|class="wikitable"<br />
!ID<br />
!Name<br />
!D3D name<br />
!GL Name<br />
!Stage 1<br />
!Stage 2<br />
!Stage 3<br />
!Stage 4<br />
!Notes<br />
|-<br />
|0x00<br />
|PS_TEXTUREMODES_NONE<br />
|<br />
|NONE<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x01<br />
|PS_TEXTUREMODES_PROJECT2D<br />
|tex<br />
|TEXTURE_2D<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x02<br />
|PS_TEXTUREMODES_PROJECT3D<br />
|tex<br />
|TEXTURE_3D<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x03<br />
|PS_TEXTUREMODES_CUBEMAP<br />
|tex<br />
|TEXTURE_CUBE_MAP_ARB<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x04<br />
|PS_TEXTUREMODES_PASSTHRU<br />
|texcoord<br />
|PASS_THROUGH_NV<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x05<br />
|PS_TEXTUREMODES_CLIPPLANE<br />
|texkill<br />
|CULL_FRAGMENT_NV<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x06<br />
|PS_TEXTUREMODES_BUMPENVMAP<br />
|texbem<br />
|OFFSET_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x07<br />
|PS_TEXTUREMODES_BUMPENVMAP_LUM<br />
|texbeml<br />
|OFFSET_TEXTURE_2D_SCALE_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x08<br />
|PS_TEXTUREMODES_BRDF<br />
|texbrdf<br />
|<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x09<br />
|PS_TEXTUREMODES_DOT_ST<br />
|texm3x2tex<br />
|DOT_PRODUCT_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0A<br />
|PS_TEXTUREMODES_DOT_ZW<br />
|texm3x2depth<br />
|DOT_PRODUCT_DEPTH_REPLACE_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0B<br />
|PS_TEXTUREMODES_DOT_RFLCT_DIFF<br />
|texm3x3diff<br />
|DOT_PRODUCT_DIFFUSE_CUBE_MAP_NV{{citation needed}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{no}}<br />
|<br />
|-<br />
|0x0C<br />
|PS_TEXTUREMODES_DOT_RFLCT_SPEC<br />
|texm3x3vspec<br />
|DOT_PRODUCT_CONST_EYE_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0D<br />
|PS_TEXTUREMODES_DOT_STR_3D<br />
|texm3x3tex<br />
|DOT_PRODUCT_TEXTURE_3D_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0E<br />
|PS_TEXTUREMODES_DOT_STR_CUBE<br />
|texm3x3vspec<br />
|DOT_PRODUCT_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0F<br />
|PS_TEXTUREMODES_DPNDNT_AR<br />
|texreg2ar<br />
|DEPENDENT_AR_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x10<br />
|PS_TEXTUREMODES_DPNDNT_GB<br />
|texreg2gb<br />
|DEPENDENT_GB_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x11<br />
|PS_TEXTUREMODES_DOTPRODUCT<br />
|texm3x3pad<br>texm3x2pad<br />
|DOT_PRODUCT_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{no}}<br />
|<br />
|-<br />
|0x12<br />
|PS_TEXTUREMODES_DOT_RFLCT_SPEC_CONST<br />
|texm3x3spec<br />
|DOT_PRODUCT_CONST_EYE_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|}<br />
<br />
=== 0x08: PS_TEXTUREMODES_BRDF / texbrdf ===<br />
<br />
The BRDF texture shader is probably only exposed on original Xbox, but not in standard OpenGL or D3D drivers.<br />
<br />
These are some generic resources about BRDFs:<br />
<br />
* [http://www.disneyanimation.com/technology/brdf.html Walt Disney BRDF Explorer]<br />
* [https://disney-animation.s3.amazonaws.com/library/s2012_pbs_disney_brdf_notes_v2.pdf Walt Disney BRDF Paper]<br />
* [https://math.nist.gov/~FHunt/appearance/brdf.html Collection of BRDF information]<br />
* [http://www-graphics.stanford.edu/~smr/brdf/bv/ BRDF viewer]{{FIXME|reason=Find alternative; this one is hard to compile}}<br />
* [https://www.merl.com/brdf/ BRDF Database by Mitsubishi]<br />
<br />
* nvidia resources ''(The code and technique is probably not using the texture shader that is described here)'':<br />
<br />
** [https://web.archive.org/web/20200506033455/http://developer.download.nvidia.com/assets/gamedev/docs/BRDFs.pdf BRDFs.pdf] / [http://www.nvidia.in/attach/6669 BRDFs.ppt]{{FIXME|reason=URL dead; not in archive.org!}}<br />
** [https://web.archive.org/web/20191214200801/https://www.nvidia.com/attach/6568 BRDFIntro.pdf] / [https://web.archive.org/web/20191214200809/https://www.nvidia.com/attach/6569 BRDFIntro.doc]<br />
** [https://web.archive.org/web/20191214200757/https://www.nvidia.com/attach/6567 BRDFSeparable.pdf] / [https://web.archive.org/web/20191214200753/https://www.nvidia.com/attach/6566 BRDFSeparable.doc]<br />
** [https://web.archive.org/web/20191214200813/https://www.nvidia.com/attach/6570 brdfseparate.zip]<br />
** [https://web.archive.org/web/20191214200819/https://www.nvidia.com/attach/6571 brdfview.zip]<br />
<br />
{{FIXME|reason=Describe Xbox specific BRDF texture shader}}<br />
<br />
== Register combiners ==<br />
<br />
The NV2A implements at least parts of the following OpenGL extensions:<br />
<br />
* [https://www.opengl.org/registry/specs/NV/register_combiners.txt NV_register_combiners]<br />
* [https://www.opengl.org/registry/specs/NV/register_combiners2.txt NV_register_combiners2]<br />
<br />
There's some additional features and oddities.<br />
<br />
=== DISCARD and ZERO are the same register ===<br />
<br />
On NV2A the DISCARD and ZERO register are the same index: writes are discarded / reads return zero.<br />
<br />
This is different from NV_register_combiners where 2 different constants are used.<br />
<br />
=== Encoding of input swizzle ===<br />
<br />
NV2A uses a single ALPHA flag to specify the swizzle of inputs:<br />
* 0 for <code>.rgb</code> (RGB portion only) and <code>.b</code> (ALPHA portion only).<br />
* 1 for <code>.aaa</code> (RGB portion only) and <code>.a</code> (ALPHA portion only).<br />
<br />
This is different from NV_register_combiners where each swizzle has its own constant.<br />
<br />
=== Per stage constant-colors ===<br />
<br />
The combiner setup switches between using the same <code>const0</code> and <code>const1</code> for all stages (<code>FACTOR#_SAME_FACTOR_ALL</code>), or using different constant-colors per stage (<code>FACTOR#_EACH_STAGE</code>).<br />
<br />
On NV2A, the final-combiner does always have unique constants (even using <code>FACTOR#_SAME_FACTOR_ALL</code>) from all other stages.<br />
If <code>FACTOR#_SAME_FACTOR_ALL</code> is used, the constant-colors for all other stages are taken from the very first stage.<br />
This setting can be controlled independently for <code>const0</code> and <code>const1</code>.<br />
<br />
This is different from NV_register_combiners2. If that GL extension isn't available / enabled, then the constants are shared between general combiner stages and the final combiner (which doesn't have unique colors then). Additionally, the GL extension can only control this for both constant-colors at the same time.<br />
<br />
=== Encoding of constant-colors ===<br />
<br />
On NV2A, the constant-colors are encoded as 8-bit unsigned int values, packed into a 32-bit ARGB value (<code>(a<<24 | r<<16 | g<<8 | b)</code>).<br />
<br />
This is different from NV_register_combiners where constant-colors are specified as floats in RGBA format.<br />
<br />
=== BLUETOALPHA in RGB portion ===<br />
<br />
NV2A has a special flag to write the blue result (RGB portion) of the A/B and C/D computations to the alpha channel of the RGB portion output register. There's no such option for the AB/CD result.<br />
{{FIXME|reason=Document specifics, tests proposed on https://github.com/JayFoxRox/nxdk/pull/33}}<br />
<br />
This feature isn't available in GL, probably.<br />
This is different from NV_register_combiners where the RGB portion always writes to <code>.rgb</code> of the output.<br />
<br />
=== Special "or" operation (MUX) modifier ===<br />
<br />
NV2A has a special flag to switch between MSB and LSB{{FIXME|reason=Unconfirmed / untested - doesn't make a lot of sense}} for the special "or" operation (MUX).<br />
{{FIXME|reason=Check the comparison type}}<br />
<br />
This feature isn't available in GL, probably.<br />
This is different from NV_register_combiners where the special "or" operation (MUX) is always doing: <code>spare0_alpha >= 0.5 ? C*D : A*B</code>.<br />
<br />
== Debugging ==<br />
<br />
PIX from the Microsoft XDK provides great debugging capabilities.<br />
<br />
=== References and links ===<br />
<br />
* [http://developer.download.nvidia.com/assets/gamedev/docs/ProgrammableTextureBlending.pdf Overview about programmable texture blending] <!-- Mirror: https://www.nvidia.com/object/programmable_texture_blending.html --><br />
* [http://developer.download.nvidia.com/assets/gamedev/docs/combiners.pdf Overview of register combiners]<br />
* [https://github.com/XboxDev/nxdk/blob/77b5de45f0c64e70f2ff68248873448d5edccc71/tools/fp20compiler/ps1.0_program.cpp#L227 Code from nvparse (NVIDIA SDK 9.52) in nxdk, which handles shader to OpenGL conversion]<br />
* http://developer.download.nvidia.com/assets/gamedev/docs/GDC2K1_DX8_Pixel_Shaders.pdf<br />
<br />
[[Category:NV2A]]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=NV2A/Vertex_Shader&diff=6852NV2A/Vertex Shader2020-05-04T23:42:50Z<p>JayFoxRox: nvidia is having issues or taking files down; using archive.org links where possible</p>
<hr />
<div>The Xbox implements the 2 GL extensions [https://www.opengl.org/registry/specs/NV/vertex_program.txt NV_vertex_program] and [https://www.opengl.org/registry/specs/NV/vertex_program1_1.txt NV_vertex_program1_1] (with some modifications).<br />
This article will mainly focus on actual encoding on hardware as the behaviour is mostly outlined in those GL extensions already.<br />
<br />
== Operating modes ==<br />
<br />
* Fixed / Programmable<br />
* Writeable / Read-Only constants<br />
* Low-constants only / all constants<br />
* Vertex processing / State program<br />
<br />
== Registers ==<br />
<br />
=== Input registers ===<br />
<br />
There are 16 input registers v[0] to v[15].<br />
<br />
They normally [[NV2A/Vertex attributes|map to the vertex attributes]]. However, in the case of vertex state programs, v[0] is fed from LAUNCH_DATA (PGRAPH Methods 0x1E80, 0x1E84, 0x1E88, 0x1E8C for XYZW respectively) instead.<br />
<br />
=== Output registers ===<br />
<br />
11 output registers o[<RegName>] (initialized to XYZ=0x00000000 W=0x3F800000).<br />
<br />
{|class="wikitable"<br />
|+Output registers<br />
|-<br />
!Index<br />
!GL Name<br />
!D3D Name<br />
!Meaning<br />
|-<br />
|0<br />
|HPOS<br />
|oPos<br />
|Homogeneous clip space position<br />
|-<br />
|3<br />
|COL0<br />
|oD0<br />
|Primary color (front-facing)<br />
|-<br />
|4<br />
|COL1<br />
|oD1<br />
|Secondary color (front-facing)<br />
|-<br />
|5<br />
|FOGC<br />
|oFog<br />
|Fog coordinate<br />
|-<br />
|6<br />
|PSIZ<br />
|oPts<br />
|Point size<br />
|-<br />
|7<br />
|BFC0<br />
|oB0<br />
|Back-facing primary color<br />
|-<br />
|8<br />
|BFC1<br />
|oB1<br />
|Back-facing secondary color<br />
|-<br />
|9<br />
|TEX0<br />
|oT0<br />
|Texture coordinate set 0<br />
|-<br />
|10<br />
|TEX1<br />
|oT1<br />
|Texture coordinate set 1<br />
|-<br />
|11<br />
|TEX2<br />
|oT2<br />
|Texture coordinate set 2<br />
|-<br />
|12<br />
|TEX3<br />
|oT3<br />
|Texture coordinate set 3<br />
|}<br />
<br />
=== Address register ===<br />
<br />
A0.x exists as documented in the GL extension.<br />
<br />
=== Temporary registers ===<br />
<br />
There are 12 temporary registers: R0 to R11 (initialized to XYZW=0x00000000), as documented in the GL extension.<br />
Additionally, o[HPOS] is mirrored as R12 and can be used as source operand; so effectively you have 13 temporaries<br />
<br />
=== Constant space ===<br />
<br />
There are 192 constant registers in two seperate blocks with 96 constants each.<br />
They can be accessed through the PGRAPH RDI: select=0x17. Each constant slot is 4x DWORD, ordered as WZYX.<br />
Alternatively they can be uploaded through PGRAPH method [FIXME], with 4x DWORD, ordered XYZW.<br />
<br />
In nvidia vertex programs only 96 constants are normally accessible. Microsoft exposed the 96 additional constant registers in D3D shaders through c[-96] to c[-1].<br />
This documentation uses the GL terminology instead and expose the new registers as c[96] to c[191]. This means c[0] to c[191] valid.<br />
<br />
== Instructions ==<br />
<br />
In total, there are 136 instruction slots.<br />
<br />
Each slot consists of 16 bytes, we consider those as 4 seperate little-endian DWORDS describing the operation. Word 0 is inused.<br />
<br />
{| class="wikitable"<br />
|+Fields<br />
|-<br />
!Meaning<br />
!Word<br />
!Offset (bits)<br />
!Size (bits)<br />
|-<br />
|ILU Operation<br />
|1<br />
|25<br />
|3<br />
|-<br />
|MAC Operation<br />
|1<br />
|21<br />
|4<br />
|-<br />
|Constant index<br />
|1<br />
|13<br />
|8<br />
|-<br />
|Input index<br />
|1<br />
|9<br />
|4<br />
|-<br />
|Source 1 negate<br />
|1<br />
|8<br />
|1<br />
|-<br />
|Source 1 swizzle X<br />
|1<br />
|6<br />
|2<br />
|-<br />
|Source 1 swizzle Y<br />
|1<br />
|4<br />
|2<br />
|-<br />
|Source 1 swizzle Z<br />
|1<br />
|2<br />
|2<br />
|-<br />
|Source 1 swizzle W<br />
|1<br />
|0<br />
|2<br />
|-<br />
|Source 1 register<br />
|2<br />
|28<br />
|4<br />
|-<br />
|Source 1 mux<br />
|2<br />
|26<br />
|2<br />
|-<br />
|Source 2 negate<br />
|2<br />
|25<br />
|1<br />
|-<br />
|Source 2 swizzle X<br />
|2<br />
|23<br />
|2<br />
|-<br />
|Source 2 swizzle Y<br />
|2<br />
|21<br />
|2<br />
|-<br />
|Source 2 swizzle Z<br />
|2<br />
|19<br />
|2<br />
|-<br />
|Source 2 swizzle W<br />
|2<br />
|17<br />
|2<br />
|-<br />
|Source 2 register<br />
|2<br />
|13<br />
|4<br />
|-<br />
|Source 2 mux<br />
|2<br />
|11<br />
|2<br />
|-<br />
|Source 3 negate<br />
|2<br />
|10<br />
|1<br />
|-<br />
|Source 3 swizzle X<br />
|2<br />
|8<br />
|2<br />
|-<br />
|Source 3 swizzle Y<br />
|2<br />
|6<br />
|2<br />
|-<br />
|Source 3 swizzle Z<br />
|2<br />
|4<br />
|2<br />
|-<br />
|Source 3 swizzle W<br />
|2<br />
|2<br />
|2<br />
|-<br />
|Source 3 register (Hi)<br />
|2<br />
|0<br />
|2<br />
|-<br />
|Source 3 register (Lo)<br />
|3<br />
|30<br />
|2<br />
|-<br />
|Source 3 mux<br />
|3<br />
|28<br />
|2<br />
|-<br />
|Destination MAC mask<br />
|3<br />
|24<br />
|4<br />
|-<br />
|Destination temporary register<br />
|3<br />
|20<br />
|4<br />
|-<br />
|Destination ILU mask<br />
|3<br />
|16<br />
|4<br />
|-<br />
|Destination overall mask<br />
|3<br />
|12<br />
|4<br />
|-<br />
|Destination select<br />
|3<br />
|11<br />
|1<br />
|-<br />
|Destination output register<br />
|3<br />
|3<br />
|8<br />
|-<br />
|Destination mux<br />
|3<br />
|2<br />
|1<br />
|-<br />
|Relative constant addressing<br />
|3<br />
|1<br />
|1<br />
|-<br />
|Final instruction marker (EOF)<br />
|3<br />
|0<br />
|1<br />
|}<br />
<br />
{| class="wikitable"<br />
|+Swizzle table<br />
|-<br />
!Value<br />
!Meaning<br />
|-<br />
|0<br />
|X<br />
|-<br />
|1<br />
|Y<br />
|-<br />
|2<br />
|Z<br />
|-<br />
|3<br />
|W<br />
|}<br />
<br />
=== Functional units ===<br />
<br />
<br />
==== Inverse Logic Unit (ILU) ====<br />
<br />
{| class="wikitable"<br />
|+ILU Operations<br />
|-<br />
!Value<br />
!Meaning<br />
|-<br />
|0<br />
|NOP<br />
|-<br />
|1<br />
|MOV<br />
|-<br />
|2<br />
|RCP<br />
|-<br />
|3<br />
|RCC<br />
|-<br />
|4<br />
|RSQ<br />
|-<br />
|5<br />
|EXP<br />
|-<br />
|6<br />
|LOG<br />
|-<br />
|7<br />
|LIT<br />
|}<br />
<br />
==== Multiply-Accumulate (MAC) ====<br />
<br />
{| class="wikitable"<br />
|+MAC Operations<br />
|-<br />
!Value<br />
!Meaning<br />
|-<br />
|0<br />
|NOP<br />
|-<br />
|1<br />
|MOV<br />
|-<br />
|2<br />
|MUL<br />
|-<br />
|3<br />
|ADD<br />
|-<br />
|4<br />
|MAD<br />
|-<br />
|5<br />
|DP3<br />
|-<br />
|6<br />
|DPH<br />
|-<br />
|7<br />
|DP4<br />
|-<br />
|8<br />
|DST<br />
|-<br />
|9<br />
|MIN<br />
|-<br />
|10<br />
|MAX<br />
|-<br />
|11<br />
|SLT<br />
|-<br />
|12<br />
|SGE<br />
|-<br />
|13<br />
|ARL<br />
|}<br />
<br />
== Related links ==<br />
<br />
* nvidia resources<br />
** [https://web.archive.org/web/20191214200729/https://www.nvidia.com/attach/6559 WhereIsThatVertexShaderInstruction.pdf] / [https://web.archive.org/web/20191214200738/https://www.nvidia.com/attach/6560 WhereIsThatVertexShaderInstruction.doc]<br />
* [https://github.com/envytools/envytools/blob/master/nvhw/pgraph_celsius_xfrm.c Code which appears to implement bit-accurate emulation of some instructions]{{FIXME|reason=Unconfirmed, needs testing}}<br />
<br />
[[Category:NV2A]]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=NV2A/Pixel_Combiner&diff=6851NV2A/Pixel Combiner2020-05-04T23:38:37Z<p>JayFoxRox: nvidia is having issues or taking files down; using archive.org links where possible</p>
<hr />
<div>== Data types ==<br />
<br />
NV_texture_shader suggests that: ''"The 8-bit and 16-bit signed fixed-point types are used for signed internal texture formats, while the 9-bit signed fixed-point type is used for register combiners computations."''<br />
Here is a table from the GL extension:<br />
<br />
{| class="wikitable"<br />
! floating-point !! 8-bit fixed-point !! 9-bit fixed-point !! 16-bit fixed-point<br />
|-<br />
| 1.0 || n/a || 255 || n/a <br />
|-<br />
| 0.99996... || n/a || n/a || 32767<br />
|-<br />
| 0.99218... || 127 || n/a || n/a <br />
|-<br />
| 0.0 || 0 || 0 || 0<br />
|-<br />
| -1.0 || -128 || -255 || -32768<br />
|-<br />
| -1.00392... || n/a || -256 || n/a<br />
|}<br />
<br />
This means:<br />
<br />
* 8-bit fixed-point: [-128, 127] &rarr; [-128/128, 127/128] &rarr; [-1.0, 0.99218...]<br />
* 9-bit fixed-point: [-256, 255] &rarr; [-256/255, 255/255] &rarr; [-1.00392..., 1.0]<br />
* 16-bit fixed-point: [-32768, 32767] &rarr; [-32768/32768, 32767/32768] &rarr; [-1.0, 0.99996...]<br />
<br />
It is not known if the NV2A really implements these 3 datatypes.<br />
It is also not yet known how exactly conversion or negation of these types would work.<br />
<br />
== Texture Shaders ==<br />
<br />
The NV2A implements at least parts of the following OpenGL extensions:<br />
<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader.txt NV_texture_shader]<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader2.txt NV_texture_shader2]<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader3.txt NV_texture_shader3]{{citation needed}}<br />
<br />
=== Texturing modes ===<br />
<br />
{|class="wikitable"<br />
!ID<br />
!Name<br />
!D3D name<br />
!GL Name<br />
!Stage 1<br />
!Stage 2<br />
!Stage 3<br />
!Stage 4<br />
!Notes<br />
|-<br />
|0x00<br />
|PS_TEXTUREMODES_NONE<br />
|<br />
|NONE<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x01<br />
|PS_TEXTUREMODES_PROJECT2D<br />
|tex<br />
|TEXTURE_2D<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x02<br />
|PS_TEXTUREMODES_PROJECT3D<br />
|tex<br />
|TEXTURE_3D<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x03<br />
|PS_TEXTUREMODES_CUBEMAP<br />
|tex<br />
|TEXTURE_CUBE_MAP_ARB<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x04<br />
|PS_TEXTUREMODES_PASSTHRU<br />
|texcoord<br />
|PASS_THROUGH_NV<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x05<br />
|PS_TEXTUREMODES_CLIPPLANE<br />
|texkill<br />
|CULL_FRAGMENT_NV<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x06<br />
|PS_TEXTUREMODES_BUMPENVMAP<br />
|texbem<br />
|OFFSET_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x07<br />
|PS_TEXTUREMODES_BUMPENVMAP_LUM<br />
|texbeml<br />
|OFFSET_TEXTURE_2D_SCALE_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x08<br />
|PS_TEXTUREMODES_BRDF<br />
|texbrdf<br />
|<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x09<br />
|PS_TEXTUREMODES_DOT_ST<br />
|texm3x2tex<br />
|DOT_PRODUCT_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0A<br />
|PS_TEXTUREMODES_DOT_ZW<br />
|texm3x2depth<br />
|DOT_PRODUCT_DEPTH_REPLACE_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0B<br />
|PS_TEXTUREMODES_DOT_RFLCT_DIFF<br />
|texm3x3diff<br />
|DOT_PRODUCT_DIFFUSE_CUBE_MAP_NV{{citation needed}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{no}}<br />
|<br />
|-<br />
|0x0C<br />
|PS_TEXTUREMODES_DOT_RFLCT_SPEC<br />
|texm3x3vspec<br />
|DOT_PRODUCT_CONST_EYE_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0D<br />
|PS_TEXTUREMODES_DOT_STR_3D<br />
|texm3x3tex<br />
|DOT_PRODUCT_TEXTURE_3D_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0E<br />
|PS_TEXTUREMODES_DOT_STR_CUBE<br />
|texm3x3vspec<br />
|DOT_PRODUCT_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0F<br />
|PS_TEXTUREMODES_DPNDNT_AR<br />
|texreg2ar<br />
|DEPENDENT_AR_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x10<br />
|PS_TEXTUREMODES_DPNDNT_GB<br />
|texreg2gb<br />
|DEPENDENT_GB_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x11<br />
|PS_TEXTUREMODES_DOTPRODUCT<br />
|texm3x3pad<br>texm3x2pad<br />
|DOT_PRODUCT_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{no}}<br />
|<br />
|-<br />
|0x12<br />
|PS_TEXTUREMODES_DOT_RFLCT_SPEC_CONST<br />
|texm3x3spec<br />
|DOT_PRODUCT_CONST_EYE_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|}<br />
<br />
=== 0x08: PS_TEXTUREMODES_BRDF / texbrdf ===<br />
<br />
The BRDF texture shader is probably only exposed on original Xbox, but not in standard OpenGL or D3D drivers.<br />
<br />
These are some generic resources about BRDFs:<br />
<br />
* [http://www.disneyanimation.com/technology/brdf.html Walt Disney BRDF Explorer]<br />
* [https://disney-animation.s3.amazonaws.com/library/s2012_pbs_disney_brdf_notes_v2.pdf Walt Disney BRDF Paper]<br />
* [https://math.nist.gov/~FHunt/appearance/brdf.html Collection of BRDF information]<br />
* [http://www-graphics.stanford.edu/~smr/brdf/bv/ BRDF viewer]{{FIXME|reason=Find alternative; this one is hard to compile}}<br />
* [https://www.merl.com/brdf/ BRDF Database by Mitsubishi]<br />
<br />
* nvidia resources ''(The code and technique is probably not using the texture shader that is described here)'':<br />
<br />
** [http://www.nvidia.in/attach/6670 BRDFs.pdf]{{FIXME|reason=URL dead; not in archive.org!}} / [http://www.nvidia.in/attach/6669 BRDFs.ppt]{{FIXME|reason=URL dead; not in archive.org!}}<br />
** [https://web.archive.org/web/20191214200801/https://www.nvidia.com/attach/6568 BRDFIntro.pdf] / [https://web.archive.org/web/20191214200809/https://www.nvidia.com/attach/6569 BRDFIntro.doc]<br />
** [https://web.archive.org/web/20191214200757/https://www.nvidia.com/attach/6567 BRDFSeparable.pdf] / [https://web.archive.org/web/20191214200753/https://www.nvidia.com/attach/6566 BRDFSeparable.doc]<br />
** [https://web.archive.org/web/20191214200813/https://www.nvidia.com/attach/6570 brdfseparate.zip]<br />
** [https://web.archive.org/web/20191214200819/https://www.nvidia.com/attach/6571 brdfview.zip]<br />
<br />
{{FIXME|reason=Describe Xbox specific BRDF texture shader}}<br />
<br />
== Register combiners ==<br />
<br />
The NV2A implements at least parts of the following OpenGL extensions:<br />
<br />
* [https://www.opengl.org/registry/specs/NV/register_combiners.txt NV_register_combiners]<br />
* [https://www.opengl.org/registry/specs/NV/register_combiners2.txt NV_register_combiners2]<br />
<br />
There's some additional features and oddities.<br />
<br />
=== DISCARD and ZERO are the same register ===<br />
<br />
On NV2A the DISCARD and ZERO register are the same index: writes are discarded / reads return zero.<br />
<br />
This is different from NV_register_combiners where 2 different constants are used.<br />
<br />
=== Encoding of input swizzle ===<br />
<br />
NV2A uses a single ALPHA flag to specify the swizzle of inputs:<br />
* 0 for <code>.rgb</code> (RGB portion only) and <code>.b</code> (ALPHA portion only).<br />
* 1 for <code>.aaa</code> (RGB portion only) and <code>.a</code> (ALPHA portion only).<br />
<br />
This is different from NV_register_combiners where each swizzle has its own constant.<br />
<br />
=== Per stage constant-colors ===<br />
<br />
The combiner setup switches between using the same <code>const0</code> and <code>const1</code> for all stages (<code>FACTOR#_SAME_FACTOR_ALL</code>), or using different constant-colors per stage (<code>FACTOR#_EACH_STAGE</code>).<br />
<br />
On NV2A, the final-combiner does always have unique constants (even using <code>FACTOR#_SAME_FACTOR_ALL</code>) from all other stages.<br />
If <code>FACTOR#_SAME_FACTOR_ALL</code> is used, the constant-colors for all other stages are taken from the very first stage.<br />
This setting can be controlled independently for <code>const0</code> and <code>const1</code>.<br />
<br />
This is different from NV_register_combiners2. If that GL extension isn't available / enabled, then the constants are shared between general combiner stages and the final combiner (which doesn't have unique colors then). Additionally, the GL extension can only control this for both constant-colors at the same time.<br />
<br />
=== Encoding of constant-colors ===<br />
<br />
On NV2A, the constant-colors are encoded as 8-bit unsigned int values, packed into a 32-bit ARGB value (<code>(a<<24 | r<<16 | g<<8 | b)</code>).<br />
<br />
This is different from NV_register_combiners where constant-colors are specified as floats in RGBA format.<br />
<br />
=== BLUETOALPHA in RGB portion ===<br />
<br />
NV2A has a special flag to write the blue result (RGB portion) of the A/B and C/D computations to the alpha channel of the RGB portion output register. There's no such option for the AB/CD result.<br />
{{FIXME|reason=Document specifics, tests proposed on https://github.com/JayFoxRox/nxdk/pull/33}}<br />
<br />
This feature isn't available in GL, probably.<br />
This is different from NV_register_combiners where the RGB portion always writes to <code>.rgb</code> of the output.<br />
<br />
=== Special "or" operation (MUX) modifier ===<br />
<br />
NV2A has a special flag to switch between MSB and LSB{{FIXME|reason=Unconfirmed / untested - doesn't make a lot of sense}} for the special "or" operation (MUX).<br />
{{FIXME|reason=Check the comparison type}}<br />
<br />
This feature isn't available in GL, probably.<br />
This is different from NV_register_combiners where the special "or" operation (MUX) is always doing: <code>spare0_alpha >= 0.5 ? C*D : A*B</code>.<br />
<br />
== Debugging ==<br />
<br />
PIX from the Microsoft XDK provides great debugging capabilities.<br />
<br />
=== References and links ===<br />
<br />
* [http://developer.download.nvidia.com/assets/gamedev/docs/ProgrammableTextureBlending.pdf Overview about programmable texture blending] <!-- Mirror: https://www.nvidia.com/object/programmable_texture_blending.html --><br />
* [http://developer.download.nvidia.com/assets/gamedev/docs/combiners.pdf Overview of register combiners]<br />
* [https://github.com/XboxDev/nxdk/blob/77b5de45f0c64e70f2ff68248873448d5edccc71/tools/fp20compiler/ps1.0_program.cpp#L227 Code from nvparse (NVIDIA SDK 9.52) in nxdk, which handles shader to OpenGL conversion]<br />
* http://developer.download.nvidia.com/assets/gamedev/docs/GDC2K1_DX8_Pixel_Shaders.pdf<br />
<br />
[[Category:NV2A]]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=User:JayFoxRox&diff=6849User:JayFoxRox2020-04-16T12:50:36Z<p>JayFoxRox: /* Savegame notes */</p>
<hr />
<div>For contact details, see http://jannikvogel.de/<br />
<br />
= Unfinished information =<br />
<br />
== Savegame notes ==<br />
<br />
''Most of this had already been documented in [[Xbox Savegame System]]''<br />
<br />
There's no database or anything for savegames - the directory-listing APIs are used to enumerate all savegames.<br />
The data is obviously in E:/UDATA/.<br />
Each XBE has a subdirectory for it's title-id.<br />
Then each save is a subdirectory (I'm not sure about the name; but it's some 48-bit hex value).<br />
<br />
XAPI would normally initialize title-images before `main()` of the XBE.<br />
The data is copied from sections "$$XTIMAGE" (TitleImage.xbx) and "$XSIMAGE" (saveimage.xbx in savegame folder).<br />
I believe the saveimage can differ for different save-games, which implies that they probably have another API.<br />
I'm also not sure where it would put saveimages, because no savegame exists then.<br />
The images are [[XPR]], and could theoretically be any format supported by the GPU.<br />
The dashboard expects them to be swizzled (checks on load imply this), but linear textures might still work.<br />
<br />
Metadata is stored in TitleMeta.xbx and SaveMeta.xbx (in savegame folder).<br />
I'm not sure when / how they are initialized.<br />
I'm not sure if they are already shown in the dashboard, even if metadata is missing.<br />
<br />
Metadata are INI files, which are implicitly prefixed with `[default]`.<br />
I don't think there's any comments allowed.<br />
I believe that XAPI has a hardcoded emitter. Whereas the dashboard has some INI parser.<br />
I'm not sure about the parser in XAPI (or if it even has one).<br />
<br />
I believe metadata also supports keys without values.<br />
<br />
When reading, it will try to read a localized version first, before reading from the `[default]` section.<br />
I have looked at many savegames, but had never seen this. I'm not sure if this was ever used.<br />
<br />
I believe the metadata files can be ASCII or Unicode (using [https://en.wikipedia.org/wiki/Byte_order_mark Unicode BOM prefix])<br />
<br />
Titledata in E:/TDATA is similar.<br />
The user soundtrack / music collection is using a database file. See [[Soundtracks]].<br />
<br />
=== NoCopy flag ===<br />
<br />
https://www.reddit.com/r/originalxbox/comments/c6pvi2/modify_xbox_game_saves/esb7omf/<br />
<br />
=== TitleMeta.xbx locales ===<br />
<br />
Put this into a file and move it to "E:/UDATA/13371337/TitleMeta.xbx" and check which languages your MS dashboard supports.<br />
I have dumped the locales from a list in xboxdash.xbe in dashboard version 1.00.5960.01 from Germany.<br />
I've then tried all languages that my Xbox dashboard supported in NTSC mode.<br />
<br />
<pre><br />
TitleName=#Known locale - (fallback, same as [default])<br />
<br />
[ZW]<br />
TitleName=#Unknown locale [zw]<br />
[ZA]<br />
TitleName=#Unknown locale [za]<br />
[YE]<br />
TitleName=#Unknown locale [ye]<br />
[VN]<br />
TitleName=#Unknown locale [vn]<br />
[VE]<br />
TitleName=#Unknown locale [ve]<br />
[UZ]<br />
TitleName=#Unknown locale [uz]<br />
[UY]<br />
TitleName=#Unknown locale [uy]<br />
[US]<br />
TitleName=#Unknown locale [us]<br />
[UA]<br />
TitleName=#Unknown locale [ua]<br />
[TW]<br />
TitleName=#Unknown locale [tw]<br />
[TT]<br />
TitleName=#Unknown locale [tt]<br />
[TR]<br />
TitleName=#Unknown locale [tr]<br />
[TN]<br />
TitleName=#Unknown locale [tn]<br />
[TH]<br />
TitleName=#Unknown locale [th]<br />
[SY]<br />
TitleName=#Unknown locale [sy]<br />
[SV]<br />
TitleName=#Unknown locale [sv]<br />
[SK]<br />
TitleName=#Unknown locale [sk]<br />
[SI]<br />
TitleName=#Unknown locale [si]<br />
[SG]<br />
TitleName=#Unknown locale [sg]<br />
[SE]<br />
TitleName=#Unknown locale [se]<br />
[SA]<br />
TitleName=#Unknown locale [sa]<br />
[RU]<br />
TitleName=#Unknown locale [ru]<br />
[RO]<br />
TitleName=#Unknown locale [ro]<br />
[QA]<br />
TitleName=#Unknown locale [qa]<br />
[PY]<br />
TitleName=#Unknown locale [py]<br />
[PT]<br />
TitleName=#Unknown locale [pt]<br />
[PR]<br />
TitleName=#Unknown locale [pr]<br />
[PL]<br />
TitleName=#Unknown locale [pl]<br />
[PK]<br />
TitleName=#Unknown locale [pk]<br />
[PH]<br />
TitleName=#Unknown locale [ph]<br />
[PE]<br />
TitleName=#Unknown locale [pe]<br />
[PA]<br />
TitleName=#Unknown locale [pa]<br />
[OM]<br />
TitleName=#Unknown locale [om]<br />
[NZ]<br />
TitleName=#Unknown locale [nz]<br />
[NO]<br />
TitleName=#Unknown locale [no]<br />
[NL]<br />
TitleName=#Unknown locale [nl]<br />
[NI]<br />
TitleName=#Unknown locale [ni]<br />
[MY]<br />
TitleName=#Unknown locale [my]<br />
[MX]<br />
TitleName=#Unknown locale [mx]<br />
[MV]<br />
TitleName=#Unknown locale [mv]<br />
[MO]<br />
TitleName=#Unknown locale [mo]<br />
[MN]<br />
TitleName=#Unknown locale [mn]<br />
[MK]<br />
TitleName=#Unknown locale [mk]<br />
[MC]<br />
TitleName=#Unknown locale [mc]<br />
[MA]<br />
TitleName=#Unknown locale [ma]<br />
[LY]<br />
TitleName=#Unknown locale [ly]<br />
[LV]<br />
TitleName=#Unknown locale [lv]<br />
[LU]<br />
TitleName=#Unknown locale [lu]<br />
[LT]<br />
TitleName=#Unknown locale [lt]<br />
[LI]<br />
TitleName=#Unknown locale [li]<br />
[LB]<br />
TitleName=#Unknown locale [lb]<br />
[KZ]<br />
TitleName=#Unknown locale [kz]<br />
[KW]<br />
TitleName=#Unknown locale [kw]<br />
[KR]<br />
TitleName=#Unknown locale [kr]<br />
[KG]<br />
TitleName=#Unknown locale [kg]<br />
[KE]<br />
TitleName=#Unknown locale [ke]<br />
[JP]<br />
TitleName=#Unknown locale [jp]<br />
[JO]<br />
TitleName=#Unknown locale [jo]<br />
[JM]<br />
TitleName=#Unknown locale [jm]<br />
[IT]<br />
TitleName=#Unknown locale [it]<br />
[IS]<br />
TitleName=#Unknown locale [is]<br />
[IR]<br />
TitleName=#Unknown locale [ir]<br />
[IQ]<br />
TitleName=#Unknown locale [iq]<br />
[IN]<br />
TitleName=#Unknown locale [in]<br />
[IL]<br />
TitleName=#Unknown locale [il]<br />
[IE]<br />
TitleName=#Unknown locale [ie]<br />
[ID]<br />
TitleName=#Unknown locale [id]<br />
[HU]<br />
TitleName=#Unknown locale [hu]<br />
[HR]<br />
TitleName=#Unknown locale [hr]<br />
[HN]<br />
TitleName=#Unknown locale [hn]<br />
[HK]<br />
TitleName=#Unknown locale [hk]<br />
[GT]<br />
TitleName=#Unknown locale [gt]<br />
[GR]<br />
TitleName=#Unknown locale [gr]<br />
[GE]<br />
TitleName=#Unknown locale [ge]<br />
[GB]<br />
TitleName=#Unknown locale [gb]<br />
[FR]<br />
TitleName=#Unknown locale [fr]<br />
[FO]<br />
TitleName=#Unknown locale [fo]<br />
[FI]<br />
TitleName=#Unknown locale [fi]<br />
[ES]<br />
TitleName=#Unknown locale [es]<br />
[EG]<br />
TitleName=#Unknown locale [eg]<br />
[EE]<br />
TitleName=#Unknown locale [ee]<br />
[EC]<br />
TitleName=#Unknown locale [ec]<br />
[DZ]<br />
TitleName=#Unknown locale [dz]<br />
[DO]<br />
TitleName=#Unknown locale [do]<br />
[DK]<br />
TitleName=#Unknown locale [dk]<br />
[DE]<br />
TitleName=#Unknown locale [de]<br />
[CZ]<br />
TitleName=#Unknown locale [cz]<br />
[CR]<br />
TitleName=#Unknown locale [cr]<br />
[CO]<br />
TitleName=#Unknown locale [co]<br />
[CN]<br />
TitleName=#Unknown locale [cn]<br />
[CL]<br />
TitleName=#Unknown locale [cl]<br />
[CH]<br />
TitleName=#Unknown locale [ch]<br />
[CA]<br />
TitleName=#Unknown locale [ca]<br />
[BZ]<br />
TitleName=#Unknown locale [bz]<br />
[BY]<br />
TitleName=#Unknown locale [by]<br />
[BR]<br />
TitleName=#Unknown locale [br]<br />
[BO]<br />
TitleName=#Unknown locale [bo]<br />
[BN]<br />
TitleName=#Unknown locale [bn]<br />
[BH]<br />
TitleName=#Unknown locale [bh]<br />
[BG]<br />
TitleName=#Unknown locale [bg]<br />
[BE]<br />
TitleName=#Unknown locale [be]<br />
[AZ]<br />
TitleName=#Unknown locale [az]<br />
[AU]<br />
TitleName=#Unknown locale [au]<br />
[AT]<br />
TitleName=#Unknown locale [at]<br />
[AR]<br />
TitleName=#Unknown locale [ar]<br />
[AM]<br />
TitleName=#Unknown locale [am]<br />
[AL]<br />
TitleName=#Unknown locale [al]<br />
[AE]<br />
TitleName=#Unknown locale [ae]<br />
<br />
[default]<br />
TitleName=#Known locale [default] - (fallback)<br />
[EN]<br />
TitleName=#Known locale [EN] - english<br />
[JA]<br />
TitleName=#Known locale [JA] - (japanese)<br />
[DE]<br />
TitleName=#Known locale [DE] - deutsch<br />
[FR]<br />
TitleName=#Known locale [FR] - francais<br />
[ES]<br />
TitleName=#Known locale [ES] - espanol<br />
[IT]<br />
TitleName=#Known locale [IT] - italiano<br />
[KO]<br />
TitleName=#Known locale [KO] - (korean)<br />
[TW]<br />
TitleName=#Known locale [TW] - (taiwanese)<br />
[BR]<br />
TitleName=#Known locale [BR] - portugues<br />
</pre><br />
<br />
== THPS2X Syslink crash ==<br />
<br />
Happens if too many servers are present (this is where data is written to driver?):<br />
<br />
<pre><br />
Hardware watchpoint 1: *(int*)0xD004D048<br />
<br />
Old value = 1065353216<br />
New value = 1500647462<br />
0x00215adf in ?? ()<br />
(gdb) pint $eip<br />
Undefined command: "pint". Try "help".<br />
(gdb) print $eip<br />
$1 = (void (*)()) 0x215adf<br />
</pre><br />
<br />
And this seems to copy server to database (this in particular copied string?):<br />
<br />
<pre><br />
Hardware watchpoint 1: *(int*)0xf47944<br />
<br />
Old value = 926102321<br />
New value = 858992984<br />
0x00156cc3 in ?? ()<br />
(gdb) print $eip<br />
$2 = (void (*)()) 0x156cc3<br />
(gdb) info reg<br />
eax 0xd0043260 -805031328<br />
ecx 0x1d 29<br />
edx 0x0 0<br />
ebx 0xf20ce0 15863008<br />
esp 0xd004324c 0xd004324c<br />
ebp 0xf20ce0 0xf20ce0<br />
esi 0xd00432a0 -805031264<br />
edi 0xf47948 16021832<br />
eip 0x156cc3 0x156cc3<br />
eflags 0x246 [ PF ZF IF ]<br />
cs 0x8 8<br />
ss 0x10 16<br />
ds 0x10 16<br />
es 0x10 16<br />
fs 0x20 32<br />
gs 0x0 0<br />
(gdb) x/10i $eip<br />
=> 0x156cc3: rep movsl %ds:(%esi),%es:(%edi)<br />
0x156cc5: call 0x1b9db6<br />
0x156cca: mov 0x29b44(%ebx),%ecx<br />
0x156cd0: mov 0x10(%esp),%edx<br />
0x156cd4: imul $0x78,%ecx,%ecx<br />
0x156cd7: mov %edx,0x26ca8(%ecx,%ebx,1)<br />
0x156cde: mov 0x14(%esp),%eax<br />
0x156ce2: mov %eax,0x26cac(%ecx,%ebx,1)<br />
0x156ce9: mov 0x29b44(%ebx),%eax<br />
0x156cef: mov (%ebx),%edx<br />
</pre><br />
<br />
== Reset ==<br />
<br />
There are various methods to reset an Xbox or major parts of it (successfully or not).<br />
<br />
=== SMC Cold Reboot ===<br />
<br />
* CPU cycles: X > 0<br />
<br />
=== SMC Warm Reboot ===<br />
<br />
* CPU cycles: X > 0<br />
<br />
=== PM26 ===<br />
<br />
* CPU cycles: X > 0<br />
<br />
=== RST_CNT (RST_CPU) === <br />
[https://www.intel.com/content/dam/doc/datasheet/82801ba-i-o-controller-hub-2-82801bam-i-o-controller-hub-2-mobile-datasheet.pdf equivalent docs?]<br />
=== RST_CNT (RST_CPU + SYS_RST) === <br />
=== RST_CNT (RST_CPU + FULL_RST) === <br />
=== RST_CNT (RST_CPU + SYS_RST + FULL_RST) ===<br />
<br />
* CPU cycles: 0<br />
<br />
=== Triple fault ===<br />
<br />
* CPU cycles: 0{{FIXME|reason=untested}}<br />
<br />
=== PCI-to-PCI bridge secondary bus reset ===<br />
<br />
* CPU cycles: X > 0<br />
<br />
----</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Xbox_Game_Disc&diff=6831Xbox Game Disc2020-01-24T18:19:19Z<p>JayFoxRox: Add TSDNDOS link and fix typo</p>
<hr />
<div>Xbox games are shipped on DVDs. They are commonly referred to as Xbox Game Discs (XGD).<br />
<br />
== Visible information on ring ==<br />
<br />
'''The DVD inner ring usually contains:'''<br />
<br />
(The examples are from a German [[FIFA Soccer 2003]] disc)<br />
<br />
An outer portion with labels:<br />
* Outer ring Layer 1<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L1*)<br />
** Text for Mastering code ("EA02302E L1 02 0MM", where "02" is a smaller font and slightly higher than the previous baseline, followed by "0MM" on the original baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
* Inner ring for Layer 0<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L0*)<br />
** Text for Mastering code ("EA02302E L0 06", where "06" is a smaller font and slightly higher than the previous baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
<br />
An inner porition with Xbox logo:<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* 1 time "XBOX" text with blank background<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* Another tiny pattern segmented into 7 portions in alternating position,(opposite of the "XBOX" text without logo)<br />
** 4 times a Xbox logo <br />
** 2 times the word "genuine"<br />
** and in the middle the word ASPnnnn where n is a number{{citation needed}} <br />
<br />
''' ASP code '''<br />
[[File:Asp demodisk.jpg|thumb|right|Detail of the DVD hologram, reflecting the ASP5080 by the flash of the camera. found on a demodisk (IM00113E-IM)]]<br />
The following table lists known ASPnnnn numbers found on Xbox dvd disks, they are also on 360 disks but we dont list those in this wiki.<br />
The games listed are examples, its known for sure more disks can have these numbers and further research can be done, to determine the meaning.<br />
It is rumoured it might be a version string of some sorts slowly raising in xbox years old. {{citation needed}}<br />
{| class="wikitable"<br />
|-<br />
! ASP number<br />
! found on<br />
! game serial<br />
|-<br />
| ASP0180<br />
| Xbox Hardware Refresh Disc<br />
| XB01101W<br />
|-<br />
| ASP0380<br />
| Tom Clancy's Splinter Cell Exclusive Playable Demo<br />
| US01251E<br />
|-<br />
| ASP0980<br />
| Tom Clancy's Rainbow Six 3 DEMO DISC<br />
| US03152E-US<br />
|-<br />
| ASP5080<br />
| The official xbox 50 best games (Demo disk)<br />
| IM00113E-IM<br />
|-<br />
| ASP5180<br />
| Rayman 3 hoodlum havoc<br />
| <br />
|-<br />
| ASP5280<br />
| Xbox Music Mixer<br />
| MS09005A-MS<br />
|}<br />
<br />
== Dumps ==<br />
<br />
=== Files ===<br />
<br />
===== Example timestamps =====<br />
<br />
Timestamps for [[Petit Copter]]:<br />
<pre><br />
126779196239020000ULL, // XDVDFS timestamp<br />
126956823480700000ULL, // SS timestamp<br />
126957328439576418ULL, // SS unk3 timestamp<br />
126957649743869476ULL, // DMI Timestamp<br />
126961143392830592ULL, // SS unk4 timestamp<br />
</pre><br />
<br />
==== Disc Manufacturing Information (DMI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x04<br />
<br />
DMI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u32? || Unknown || Always 1?<br />
|-<br />
|4 || u32? || Unknown || Always zero?<br />
|-<br />
|8 || ascii_char[8] || Mastering Code || Example: EA02302E <br> Also see [[Xbe#Title_ID]]<br />
|-<br />
|16 || u64 || || Some timestamp?<br />
|-<br />
|24 || u32? || Unknown || Always 2?<br />
|}<br />
<br />
==== Physical Format Information (PFI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x00<br />
<br />
Read from the Lead-In.<br />
<br />
PFI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || <code>booktype << 4 <nowiki>|</nowiki> part_version</code> || 4 bit each<br />
|-<br />
|1 || u8 || <code>disc_size << 4 <nowiki>|</nowiki> maximum_rate</code> || 4 bit each<br />
|-<br />
|2 || u8 || <code>number_of_layers << 5 <nowiki>|</nowiki> track_path << 4 <nowiki>|</nowiki> layer_type</code> || 1 bit padding, 2 bit, 1 bit, 4 bit<br />
|-<br />
|3 || u8 || <code>linear_density << 4 <nowiki>|</nowiki> track_density</code> || 4 bit each<br />
|-<br />
|4 || u8 || || Always zero<br />
|-<br />
|5 || u24 || Starting Physical Sector Number of Data Area ||<br />
|-<br />
|8 || u8 || || Always zero<br />
|-<br />
|9 || u24 || End Physical Sector Number of Data Area ||<br />
|-<br />
|12 || u8 || || Always zero<br />
|-<br />
|13 || u24 || End Sector Number in Layer 0 || Always 0x2033AF for original Xbox discs<br />
|}<br />
<br />
From [ftp://ftp.avc-pioneer.com/Mtfuji_5/Proposal/Jan01/RDVDSTRC.pdf] (page 4)<br />
<br />
==== Security Sectors (SS.bin) ====<br />
<br />
Challenge entry (11 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || Valid || Always 1 if the challenge is valid, else the challenge is ignored<br />
|-<br />
|1 || u8 || Challenge id ||<br />
|-<br />
|2 || u32 || Challenge value ||<br />
|-<br />
|6 || u8 || Response modifier || multimedia.cx says this might be a Response id. However, it's always 0 anyway?!<br />
|-<br />
|7 || u32 || Response value ||<br />
|}<br />
<br />
Security sector range (9 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|3 || u24 || Start PSN ||<br />
|-<br />
|6 || u24 || End PSN ||<br />
|}<br />
<br />
Unknown1 (44 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u64 || || Yet another timestamp?! (Similar to 1183 in complete format)<br />
|-<br />
|8 || u32 || || Unknown<br />
|-<br />
|27 || u8 || || Unknown<br />
|-<br />
|28 || u8[16] || || Unknown<br />
|}<br />
<br />
Complete format (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || PFI || Physical Format Information || PFI for the actual data, unknown size<br />
|-<br />
|720 || u32 || Unknown ||<br />
|-<br />
|768 || u8 || Version of challenge table || Always 1<br />
|-<br />
|769 || u8 || Number of challenge entries || Always 23<br />
|-<br />
|770 || Challenge entry[] || Encrypted challenge entries ||<br />
|-<br />
|1055 || u64 || || Some large number timestamp?<br />
|-<br />
|1083 || u8[16] || || Unknown<br />
|-<br />
|1183 || Unknown1 || || Unknown, this structure is SHA-1 hashed, to generate a RC4 key to decrypt challenge entries<br />
|-<br />
|1227 || u8[20] || SHA-1 hash A || Hash until here (of the complete format)<br />
|-<br />
|1247 || u8[256] || Signature A || For hash in previous field<br />
|-<br />
|1503 || Unknown1 || || Unknown<br />
|-<br />
|1547 || u8[20] || SHA-1 hash B || Hash until here (of the complete format)<br />
|-<br />
|1567 || u8[64] || Signature B || For hash in previous field (note that this is somewhat shorter than the other signature?!)<br />
|-<br />
! colspan="4" | End of data readable by a stock Xbox drive (1632 Bytes)<br />
|-<br />
|1632 || u8 || Number of security sector ranges || Always 23<br />
|-<br />
|1633 || Security sector range[] || Security sector ranges || Only 16 of which are used.<br />
|-<br />
|1840 || Security sector range[] || Security sector ranges || Only 16 of which are used. <br> ''(Copy from Offset 1633)''<br />
|}<br />
<br />
All other fields are assumed to be zero!<br />
<br />
===== Decryption of challenge entries =====<br />
<br />
Starting at offset 1183, a 44 byte SHA-1 hash is generated.<br />
The first 7 byte of the resulting hash are used as the key in RC4 decryption. The 253 Bytes of the challenge entries (Offset 770) will be decrypted.<br />
<br />
There'll only be a handful of valid entries in the challenge entries.<br />
However there'll be at least 2.<br />
<br />
=== Dumping ===<br />
<br />
To dump Xbox Game Discs you need one of the following drives / firmwares:<br />
<br />
{| class="wikitable"<br />
!Drive<br />
!Standard<br />
!Original Firmware download<br />
!Name of modified Firmware for dumping<br />
|-<br />
|{{FIXME|reason=Which drives?}}<br />
|<br />
|<br />
|<br />
* 0800{{citation needed}}<br />
|-<br />
|Toshiba SD-M2012C<br />
|IDE<br />
|<br />
|<br />
* Kreon{{citation needed}}<br />
|-<br />
|Samsung SH-D162C<br />
|IDE<br />
|[https://web.archive.org/web/20091206023615/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200506021808200872_SH-D162C_TS02.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ TS02] <br> [https://web.archive.org/web/20090604123608/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200509161625477201_SH-D162C_TS03.bin&path=/UploadFiles/FW/FWDOWNLOAD/KOR/ TS03<sup>Korean</sup>] <br> [https://web.archive.org/web/20091105003814/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200509261128121531_SH-D162C_TS03.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ TS03] <br> [https://web.archive.org/web/20100217012245/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200512221448334972_SH-D162C_TS04.bin&path=/UploadFiles/FW/FWDOWNLOAD/KOR/ TS04<sup>Korean</sup>] <br> [https://web.archive.org/web/20110920084807/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200701091709466301_SH-D162C_TS05.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ TS05]<br />
<br />
|rowspan=2 |<br />
* TS04 Kreon 0.5 (June 23rd 2006)<br />
* TS04 Kreon 0.60 (July 30th 2006)<br />
* TS04 Kreon 0.80 (September 9th 2006)<br />
* TS04{{FIXME|reason=README claims SB00}} Kreon 0.81 (October 4th 2006)<br />
* TS05{{FIXME|reason=README claims SB01}} Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Toshiba TS-H352C<br />
|IDE<br />
|[https://web.archive.org/web/20110921065924/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200505121909111802_TS-H352C_SC00.bin&path=/UploadFiles/FW/FWDOWNLOAD/KOR/ SC00<sup>Korean</sup>]<br />
|-<br />
|Samsung SH-D162D<br />
|IDE<br />
|[https://web.archive.org/web/20090601193905/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200706281644411972_SH-D162D_SB00.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB00] <br> [https://web.archive.org/web/20090916202345/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200811051941150901_SH-D162D_SB01.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01] <br> SB02{{citation needed}}[http://www.firmwarehq.com/download_995-file_SH-D162D_SB02.exe.html unknown if safe or legit] <br> [https://web.archive.org/web/20090402052613/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191825218171_SH-D162D_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] <br> [https://web.archive.org/web/20120123040117/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200909281412336931_SH-D162D_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]<br />
|rowspan=2 |<br />
* SB00 Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H352D<br />
|IDE<br />
|CH01{{FIXME|reason=http://samsungodd.com/korLib/download.asp?no=200904281542399901_TS-H352D_CH01.exe&fname=200904281542399901_TS-H352D_CH01.exe&path=/chn/UploadFiles/FW/FWDOWNLOAD/ dead}} <br> CM01{{FIXME|reason=https://web.archive.org/web/20100105225621/http://samsungodd.com/korLib/download.asp?no=200904281539184301_TS-H352D_CM01.exe&fname=200904281539184301_TS-H352D_CM01.exe&path=/chn/UploadFiles/FW/FWDOWNLOAD/ dead}} <br> [https://web.archive.org/web/20100105234118/http://samsungodd.com/korLib/download.asp?no=200910081442017201_TS-H352D_CM02.exe&fname=200910081442017201_TS-H352D_CM02.exe&path=/chn/UploadFiles/FW/FWDOWNLOAD/ CM02]<br />
<br />
|-<br />
|Samsung SH-D163A<br />
|SATA<br />
|[http://web.archive.org/web/20090601191704/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200701031704489471_SH-D163A_SB01.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01]<br />
<br />
|rowspan=2 |<br />
* Kreon 0.80 (October 17th 2006)<br />
* SB01 Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Toshiba TS-H353A<br />
|SATA<br />
|<br />
|-<br />
|Samsung SH-D163B<br />
|SATA<br />
|[https://web.archive.org/web/20090402052540/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191824214901_SH-D163B_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] <br> [https://web.archive.org/web/20091204131429/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200910081448023301_SH-D163B_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]<br />
|rowspan=2 |<br />
* Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H353B<br />
|SATA<br />
|CH01{{FIXME|reason=https://web.archive.org/web/*/http://samsungodd.com/chn/globalLib/Download.asp?path=Info_FWDownload&fname=200904281544595271_TS-H353B_CH01.exe dead}}<br />
|}<br />
<br />
Please note that the modified firmwares are based on copyrighted material and can therefore not be legally shared here.<br />
Patch files to patch original firmwares into dumping-firmwares would be appreciated. <br />
<br />
Flashing software:<br />
<br />
* [https://web.archive.org/web/20160904080433/http://www.tsstodd.com:80/TotalLib/popup/Download.asp?path=program&lang=eng&fname=TSDNMAC.ZIP TSDNMAC] for MacOS<br />
* [http://web.archive.org/web/20070301000000/http://www.samsungodd.com/KorLib/File/sfdnwin.exe SFDNWIN] for Microsoft Windows 2000 and XP<br />
* [https://web.archive.org/web/20100105230358/http://samsungodd.com/KorLib/File/Tsdnwin.exe TSDNWIN] for Microsoft Windows Vista and 7<br />
* [https://web.archive.org/web/20060328075340/http://www.samsungodd.com/eng/information/Application/Files/sfdndos.exe SFDNDOS] [https://web.archive.org/web/20060328072528/http://www.samsungodd.com/eng/information/Application/Files/Sfdndosm.exe SFDNDOSM] and the newer TSDNDOS ([https://www.dell.com/support/home/de/de/debsdt1/drivers/driversdetails?driverid=r205571 included here]) for Microsoft DOS<br />
<br />
For current dumping instructions see [http://forum.redump.org/topic/6073/xbox-1-360-dumping-instructions/ the Dumping Guide by the Redump Project].<br />
<br />
==== USB Adapters ====<br />
<br />
There are many USB-IDE/SATA adapters on the market. The following have been known to work well with the Kreon-compatible drives.<br />
<br />
{|class="wikitable"<br />
! Adapter Model / USB VID:DID<br />
! Drive Model<br />
! Notes<br />
|-<br />
| [https://www.amazon.de/gp/product/B016UBXH3O UGREEN USB 3.0 to SATA Adapter]<br />
<code>174c:55aa ASMedia Technology Inc.</code><br />
| SH-D163B/BEBE<br />
<code>H/W:A Ver.B SEPTEMBER 2008</code><br />
| Windows 10. No extra drivers required. Drive flashed. Works with DiscImageCreator.<br />
|-<br />
| [https://www.amazon.com/Sabrent-5-25-INCH-Converter-Activity-USB-DSC9/dp/B00DQJME7Y Sabrent USB-DSC9]<br />
<code>1f75:0611 Innostor Technology Corporation</code><br />
| SH-D162D/BEWE<br />
<code>H/W:A Ver.D JULY 2007</code><br />
| Ubuntu 18.04 host with VirtualBox WinXP VM. USB pass-thru of adapter. No extra drivers required. Drive flashed. Works with Xbox Backup Creator.<br />
|}<br />
<br />
=== Xbox related commands ===<br />
<br />
==== Enable Unlock 1 (xtreme) state ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 01</pre><br />
<br />
Enable Unlock 1 (xtreme) state' as we already know it from the 360 xtreme modded drives. <br />
This command is supported for legacy reasons only. Custom applications should use the new 'Set Lock State' instead.<br />
<br />
==== Set Lock State ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 11 xx</pre><br />
<br />
* <code>xx=00</code> - Drive locked (no unlock state)<br />
* <code>xx=01</code> - Unlock State 1 (xtreme) enabled<br />
* <code>xx=02</code> - Unlock state 2 (wxripper) enabled<br />
<br />
==== SS extract command ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>AD 00 FF 02 FD FF FE 00 08 00 xx C0</pre><br />
<br />
This is the well known from the xtreme firmware.<br />
<br />
==== Get Feature List ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 10</pre><br />
<br />
This command will return a list of the additional features supported by the drive.<br />
All values returned are 16 bit values, and the list is terminated with null (<code>0x0000</code>).<br />
The two first words of the returned list always reads as <code>0xA55A 0X5AA5</code> in order to guarantee that a reply from a drive not supporting this command correctly isn't mistaken for a feature list.<br />
<br />
An example feature list could be: <code>0xA55A, 0x5AA5, 0x0100, 0xF000, 0xF001, 0x0000</code><br />
<br />
This list would indicate that the drive supports XBOX360 Unlock 1, Lock and Error Skip, as it can be seen from the values defined below:<br />
<br />
XBOX 360 related features:<br />
<br />
* <code>0x0100</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0101</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0120</code> : The drive can read and decrypt the SS<br />
* <code>0x0121</code> : The drive has full challenge response functionality<br />
<br />
XBOX related features:<br />
<br />
* <code>0x0200</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0201</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0220</code> : The drive can read and decrypt the SS<br />
* <code>0x0221</code> : The drive has full challenge response functionality<br />
<br />
General drive features:<br />
<br />
* <code>0xF000</code> : The drive supports the lock (cancel any unlock state) command<br />
* <code>0xF001</code> : The drive supports error skipping<br />
<br />
This is the complete list of defined features at the moment. If you're working on a custom application you might want to contact me in order to get the latest list.<br />
<br />
== References and links == <br />
* [https://web.archive.org/web/20150616131202/http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf]<br />
* [https://multimedia.cx/eggs/xbox-sphinx-protocol/ Overview of the challenge/response security protocol]<br />
* [http://redump.org/discs/system/xbox/ Xbox Game Discs preserved by the Redump Project]<br />
* [http://wiki.redump.org/index.php?title=Discs_not_yet_dumped#Microsoft_Xbox Missing Xbox Game Disc dumps at Redump Project]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Hardware_Revisions&diff=6830Hardware Revisions2020-01-21T22:36:36Z<p>JayFoxRox: Add note about Commodore4Eva firmwares</p>
<hr />
<div>There were several different retail Xbox hardware revisions, which include the following:<br />
<br />
* Xbox 1.0<br />
** USB controller is on a separate [[Motherboard#USB_Daughterboard|PCB]]<br />
** GPU has a fan on the heat sink<br />
* Xbox 1.1<br />
** USB controller moved onto the motherboard<br />
** Fan removed from the GPU heat sink<br />
* Xbox 1.2<br />
** TSOP Size now 256k (Initial Size 1024k)<br />
** Updated Board Layout<br />
** Switched to ATX Power connector<br />
* Xbox 1.3<br />
** Removed LFrame signal from LPC Port<br />
* Xbox 1.4<br />
** Updated Board Layout<br />
** Switched to the "Focus" Video Encoder<br />
* Xbox 1.5 <br />
** 3.3v and GND removed from LPC<br />
* Xbox 1.6<br />
** New Board Layout with additional RAM Pads removed<br />
** Removed data and power lines from LPC port<br />
** Xyclops chip (includes ROM instead of flash = BIOS no longer flashable)<br />
** Switched to the "XCalibur" Video Encoder<br />
** Microsoft later switched to lower quality Hynix RAM. These Xboxes with non-Samsung RAM are sometimes referred to as 1.6b by the modding community.<br />
<br />
You can find more information about the hardware used in each revision below.<br />
<br />
== History of Xbox 1.5 ==<br />
<br />
There has been no conclusive evidence pointing to their existence, and all 1.5 sightings to date have turned out to be 1.4 boards.<br />
They possibly never existed{{citation needed}}, but will otherwise be very rare. Production was halted and 1.4 was produced again{{citation needed|reason=Sooo.. do these exist or not?!}}.<br />
<br />
== Identifying ==<br />
<br />
While not definitive, here are some ways to help identify the revision of your Xbox.<br />
<br />
=== Manufacturing Details ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Date Range<br />
! scope="col" | Revision<br />
! scope="col" | Location<br />
|-<br />
| 01/2001–07/2002 || 1.0 || Hungary, Mexico<br />
|-<br />
| 08/2002-01/2003 || 1.1 || China, Mexico<br />
|-<br />
| 01/2003-03/2003 || 1.2 || China<br />
|-<br />
| 04/2003-07/2003 || 1.3 || China<br />
|- <br />
| 09/2003-03/2004 || 1.4,1.5 || China<br />
|-<br />
| 04/2004-09/2004 || 1.6 || China, Taiwan<br />
|- <br />
| 09/2004-08/2005 || 1.6b || China, Taiwan<br />
|}<br />
<br />
=== Serial Number ===<br />
<br />
The serial number looks like this:<br />
<br />
LNNNNNN YWWFF<br />
<br />
* L is the production line<br />
* NNNNNN is the number produced that week<br />
* Y is the last digit of the production year<br />
* WW is the number of the week<br />
* FF is the factory code<br />
<br />
Note, this table contradicts the previous table.<br />
<br />
{| class="wikitable"<br />
! scope="col" | Factory<br />
! scope="col" | Location<br />
! scope="col" | Revision<br />
|-<br />
| 02 || Mexico || 1.0 or 1.1<br />
|-<br />
| 03 || Hungary || 1.0<br />
|-<br />
| 05 || China || 1.1 or later<br />
|-<br />
| 06 || Taiwan || 1.2 or later<br />
|}<br />
<br />
{| class="wikitable"<br />
! scope="col" | Serial Number<br />
! scope="col" | Revision<br />
|-<br />
| LNNNNNN 20WFF || 1.0<br />
|-<br />
| LNNNNNN 21WFF || 1.0<br />
|-<br />
| LNNNNNN 23WFF || 1.0 or 1.1<br />
|-<br />
| LNNNNNN 24WFF || 1.1<br />
|-<br />
| LNNNNNN 25WFF || 1.1<br />
|-<br />
| LNNNNNN 30WFF || 1.2<br />
|-<br />
| LNNNNNN 31WFF || 1.3<br />
|-<br />
| LNNNNNN 32WFF || 1.3<br />
|-<br />
| LNNNNNN 33WFF || 1.4 or 1.5<br />
|-<br />
| LNNNNNN 42WFF || 1.6<br />
|-<br />
| LNNNNNN 43WFF || 1.6b<br />
|}<br />
<br />
=== DVD Drive ===<br />
<br />
There are four retail drives known to be used by Microsoft in the retail version of the console.<br />
Any Xbox DVD drive can be used in any retail Xbox.<br />
<br />
List of Xbox DVD Drive manufacturers<br />
* Thomson (Xbox 1.0, 1.1)<br />
* Philips (Xbox 1.1 and above)<br />
* Samsung (Any)<br />
* Hitachi-LG (8050L)(mainly 1.6?)<br />
<br />
[[File:Xbox_drivedetermination.png|Xbox DVD Drive determination]]<br />
<br />
==== THOMSON TGM600 ====<br />
<br />
The first manufacture is sadly also the worst of all Dvdrom drives manufactured for the original xbox.<br />
It has a Cirrus Logic CL-CR3710-60EC-F as its main controller and a 8/3062 HD 64F3062F25 16bit H8/300H secondary samller MPU,at 25Mhz <br />
Unkown sofar if there is external flash or if its inside the Cirrus Logic IC.<br />
<br />
==== SAMSUNG SDG605 ====<br />
<br />
The Samsung drive is a very popular DVDrom drive for its compatibility for most media types and better quality laser. There are 2 mayor revisions found for this manufacturer<br />
* X00603-005 Plays CDR <br />
* X00603-006 Wont play CDR<br />
<br />
The DVDrom drive is using the MT1358E (MT1359E is the 360 Sata version) from Mediatek, and has a 39SF020A flashrom.<br />
If the firmware from this drive is applied to a SAMSUNG 616T or 616F PC dvd drive it will behave as a Xbox one, modified hardware will allow for tray state and eject to work.<br />
<br />
Commodore4Eva released a hacked firmware for this drive which enables modified backups to work. There is also a "0800" firmware for this drive which allows to dump the entire SS. The firmwares are not linked here for legal reasons.<br />
<br />
[https://web.archive.org/web/20060707104502/http://www.samsungodd.com:80/UploadFiles/FW/FWDOWNLOAD/ENG/200212101112342331_SD-616F_F105.ZIP Original firmware for the similar PC drive SD-616F (F105)].<br />
<br />
==== PHILLIPS VAD6053 ====<br />
<br />
Also named: VAD6011/21 apear to have no brand or partnumber on its large main controller,might be Cirrus Logic based on its size and use of a Philips secondary smaller mcu. flash might be a 39SF020A from SST. The laser ribbon cable connector is different for its various revisions, a detail one must take into account when swapping controller boards.<br />
<br />
There should be a tutorial on how to convert a PC dvdrom drive Pioneer 500M with the Philips firmware to be a Xbox dvdrom drive.<br />
<br />
==== HITACHI-LG GDR-8050L ====<br />
<br />
This DVD-rom drive, most commonly found in Xbox 1.6 and 1.6b is capable of reading DVD-+R, DVD-RW and CDRW media, but fails to boot most CD-R discs source: [http://www.xbox-hq.com/html/article1535.html xbox-hq.com Hitachi-LG GDR-8050L DVD Drive In Xbox].<br />
<br />
The latest manufacture for the DVDrom drive probably used a Panasonic MN103S89FDA for its main controler, appears to have no external flashrom.<br />
with this firmware and modified hardware for Eject and traystate, a LG GDR-8163B or LG DRD-8160B might act as a drop in replacement after altering either case.<br />
<br />
On 30 January 2006 TheSpecialist posted at xboxhacker.net that he successfully flashed a Hitachi drive to boot a copied game on an unmodded xbox: [https://web.archive.org/web/20080316154615/http://www.xboxhacker.net/index.php?option=com_smf&Itemid=33&topic=285.0 breakthrough: XBOX 1 firmware hacked !]<br />
<br />
There is also [https://gist.github.com/JayFoxRox/2d51a8fabe0531897a4bf2903ee14335 an IDC Script and information about the firmware] which was recovered from xboxhacker.net / old forum posts.<br />
<br />
=== Hard Drive ===<br />
<br />
{| class="wikitable<br />
|-<br />
! Revision<br />
! Drive Manufacturer<br />
! Drive Model Number<br />
! Capacity<br />
|-<br />
| 1.0<br />
| Seagate<br />
| ST310211A<br />
| 10G<br />
|-<br />
| 1.0 (XB:2001-10-26 FF=02)<br />
| Western Digital<br />
| WD80EB-00CGH0<br />
| 8G<br />
|-<br />
| 1.1 (XB:2001-10-29 FF=03)<br />
| Western Digital<br />
| WD80EB-28CGH1<br />
| 8G<br />
|-<br />
| 1.2<br />
| Western Digital<br />
| WD80EB-28DFH2<br />
| 8G<br />
|-<br />
| 1.3+<br />
| Seagate<br />
| ST10014ACE<br />
| 10G<br />
|}<br />
<br />
=== Video encoder ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Video Chip<br />
! scope="col" | Revision<br />
|-<br />
| Conexant || 1.0, 1.1, 1.2, 1.3<br />
|-<br />
| Focus || 1.4, 1.5<br />
|-<br />
| Xcalibur || 1.6<br />
|}<br />
<br />
=== EEPROM ===<br />
<br />
{| class="wikitable"<br />
! Xbox Model<br />
! Manufacturer<br />
! Model<br />
|-<br />
| 1.4 (Others?)<br />
| Catalyst<br />
| CAT24WC02J<br />
|}<br />
<br />
=== MCPX Version ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | MCPX Version<br />
! scope="col" | Revision<br />
|-<br />
| 1.0 || 1.0<br />
|-<br />
| 1.1 || 1.1 - 1.6<br />
|}<br />
<br />
=== BIOS Version ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Kernel Version<br />
! scope="col" | Revision<br />
|-<br />
| 3944, 4034, 4036, 4627 || 1.0<br />
|-<br />
| 4817, 4972 || 1.1<br />
|-<br />
| 5101, 5713 || 1.2 - 1.5<br />
|-<br />
| 5838 || 1.6<br />
|}<br />
<br />
== References ==<br />
<br />
* [http://www.informit.com/articles/article.aspx?p=367210&seqNum=2 InformIT Methods of Identification]<br />
* [http://www.informit.com/articles/article.aspx?p=367210 InformIT Identifying your Xbox Revision]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Hardware_Revisions&diff=6829Hardware Revisions2020-01-21T21:51:17Z<p>JayFoxRox: Add link to "djhuevo script"</p>
<hr />
<div>There were several different retail Xbox hardware revisions, which include the following:<br />
<br />
* Xbox 1.0<br />
** USB controller is on a separate [[Motherboard#USB_Daughterboard|PCB]]<br />
** GPU has a fan on the heat sink<br />
* Xbox 1.1<br />
** USB controller moved onto the motherboard<br />
** Fan removed from the GPU heat sink<br />
* Xbox 1.2<br />
** TSOP Size now 256k (Initial Size 1024k)<br />
** Updated Board Layout<br />
** Switched to ATX Power connector<br />
* Xbox 1.3<br />
** Removed LFrame signal from LPC Port<br />
* Xbox 1.4<br />
** Updated Board Layout<br />
** Switched to the "Focus" Video Encoder<br />
* Xbox 1.5 <br />
** 3.3v and GND removed from LPC<br />
* Xbox 1.6<br />
** New Board Layout with additional RAM Pads removed<br />
** Removed data and power lines from LPC port<br />
** Xyclops chip (includes ROM instead of flash = BIOS no longer flashable)<br />
** Switched to the "XCalibur" Video Encoder<br />
** Microsoft later switched to lower quality Hynix RAM. These Xboxes with non-Samsung RAM are sometimes referred to as 1.6b by the modding community.<br />
<br />
You can find more information about the hardware used in each revision below.<br />
<br />
== History of Xbox 1.5 ==<br />
<br />
There has been no conclusive evidence pointing to their existence, and all 1.5 sightings to date have turned out to be 1.4 boards.<br />
They possibly never existed{{citation needed}}, but will otherwise be very rare. Production was halted and 1.4 was produced again{{citation needed|reason=Sooo.. do these exist or not?!}}.<br />
<br />
== Identifying ==<br />
<br />
While not definitive, here are some ways to help identify the revision of your Xbox.<br />
<br />
=== Manufacturing Details ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Date Range<br />
! scope="col" | Revision<br />
! scope="col" | Location<br />
|-<br />
| 01/2001–07/2002 || 1.0 || Hungary, Mexico<br />
|-<br />
| 08/2002-01/2003 || 1.1 || China, Mexico<br />
|-<br />
| 01/2003-03/2003 || 1.2 || China<br />
|-<br />
| 04/2003-07/2003 || 1.3 || China<br />
|- <br />
| 09/2003-03/2004 || 1.4,1.5 || China<br />
|-<br />
| 04/2004-09/2004 || 1.6 || China, Taiwan<br />
|- <br />
| 09/2004-08/2005 || 1.6b || China, Taiwan<br />
|}<br />
<br />
=== Serial Number ===<br />
<br />
The serial number looks like this:<br />
<br />
LNNNNNN YWWFF<br />
<br />
* L is the production line<br />
* NNNNNN is the number produced that week<br />
* Y is the last digit of the production year<br />
* WW is the number of the week<br />
* FF is the factory code<br />
<br />
Note, this table contradicts the previous table.<br />
<br />
{| class="wikitable"<br />
! scope="col" | Factory<br />
! scope="col" | Location<br />
! scope="col" | Revision<br />
|-<br />
| 02 || Mexico || 1.0 or 1.1<br />
|-<br />
| 03 || Hungary || 1.0<br />
|-<br />
| 05 || China || 1.1 or later<br />
|-<br />
| 06 || Taiwan || 1.2 or later<br />
|}<br />
<br />
{| class="wikitable"<br />
! scope="col" | Serial Number<br />
! scope="col" | Revision<br />
|-<br />
| LNNNNNN 20WFF || 1.0<br />
|-<br />
| LNNNNNN 21WFF || 1.0<br />
|-<br />
| LNNNNNN 23WFF || 1.0 or 1.1<br />
|-<br />
| LNNNNNN 24WFF || 1.1<br />
|-<br />
| LNNNNNN 25WFF || 1.1<br />
|-<br />
| LNNNNNN 30WFF || 1.2<br />
|-<br />
| LNNNNNN 31WFF || 1.3<br />
|-<br />
| LNNNNNN 32WFF || 1.3<br />
|-<br />
| LNNNNNN 33WFF || 1.4 or 1.5<br />
|-<br />
| LNNNNNN 42WFF || 1.6<br />
|-<br />
| LNNNNNN 43WFF || 1.6b<br />
|}<br />
<br />
=== DVD Drive ===<br />
<br />
There are four retail drives known to be used by Microsoft in the retail version of the console.<br />
Any Xbox DVD drive can be used in any retail Xbox.<br />
<br />
List of Xbox DVD Drive manufacturers<br />
* Thomson (Xbox 1.0, 1.1)<br />
* Philips (Xbox 1.1 and above)<br />
* Samsung (Any)<br />
* Hitachi-LG (8050L)(mainly 1.6?)<br />
<br />
[[File:Xbox_drivedetermination.png|Xbox DVD Drive determination]]<br />
<br />
==== THOMSON TGM600 ====<br />
<br />
The first manufacture is sadly also the worst of all Dvdrom drives manufactured for the original xbox.<br />
It has a Cirrus Logic CL-CR3710-60EC-F as its main controller and a 8/3062 HD 64F3062F25 16bit H8/300H secondary samller MPU,at 25Mhz <br />
Unkown sofar if there is external flash or if its inside the Cirrus Logic IC.<br />
<br />
==== SAMSUNG SDG605 ====<br />
<br />
The Samsung drive is a very popular DVDrom drive for its compatibility for most media types and better quality laser. There are 2 mayor revisions found for this manufacturer<br />
* X00603-005 Plays CDR <br />
* X00603-006 Wont play CDR<br />
<br />
The DVDrom drive is using the MT1358E (MT1359E is the 360 Sata version) from Mediatek, and has a 39SF020A flashrom.<br />
If the firmware from this drive is applied to a SAMSUNG 616T or 616F PC dvd drive it will behave as a Xbox one, modified hardware will allow for tray state and eject to work.<br />
<br />
==== PHILLIPS VAD6053 ====<br />
<br />
Also named: VAD6011/21 apear to have no brand or partnumber on its large main controller,might be Cirrus Logic based on its size and use of a Philips secondary smaller mcu. flash might be a 39SF020A from SST. The laser ribbon cable connector is different for its various revisions, a detail one must take into account when swapping controller boards.<br />
<br />
There should be a tutorial on how to convert a PC dvdrom drive Pioneer 500M with the Philips firmware to be a Xbox dvdrom drive.<br />
<br />
==== HITACHI-LG GDR-8050L ====<br />
<br />
This DVD-rom drive, most commonly found in Xbox 1.6 and 1.6b is capable of reading DVD-+R, DVD-RW and CDRW media, but fails to boot most CD-R discs source: [http://www.xbox-hq.com/html/article1535.html xbox-hq.com Hitachi-LG GDR-8050L DVD Drive In Xbox].<br />
<br />
The latest manufacture for the DVDrom drive probably used a Panasonic MN103S89FDA for its main controler, appears to have no external flashrom.<br />
with this firmware and modified hardware for Eject and traystate, a LG GDR-8163B or LG DRD-8160B might act as a drop in replacement after altering either case.<br />
<br />
On 30 January 2006 TheSpecialist posted at xboxhacker.net that he successfully flashed a Hitachi drive to boot a copied game on an unmodded xbox: [https://web.archive.org/web/20080316154615/http://www.xboxhacker.net/index.php?option=com_smf&Itemid=33&topic=285.0 breakthrough: XBOX 1 firmware hacked !]<br />
<br />
There is also [https://gist.github.com/JayFoxRox/2d51a8fabe0531897a4bf2903ee14335 an IDC Script and information about the firmware] which was recovered from xboxhacker.net / old forum posts.<br />
<br />
=== Hard Drive ===<br />
<br />
{| class="wikitable<br />
|-<br />
! Revision<br />
! Drive Manufacturer<br />
! Drive Model Number<br />
! Capacity<br />
|-<br />
| 1.0<br />
| Seagate<br />
| ST310211A<br />
| 10G<br />
|-<br />
| 1.0 (XB:2001-10-26 FF=02)<br />
| Western Digital<br />
| WD80EB-00CGH0<br />
| 8G<br />
|-<br />
| 1.1 (XB:2001-10-29 FF=03)<br />
| Western Digital<br />
| WD80EB-28CGH1<br />
| 8G<br />
|-<br />
| 1.2<br />
| Western Digital<br />
| WD80EB-28DFH2<br />
| 8G<br />
|-<br />
| 1.3+<br />
| Seagate<br />
| ST10014ACE<br />
| 10G<br />
|}<br />
<br />
=== Video encoder ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Video Chip<br />
! scope="col" | Revision<br />
|-<br />
| Conexant || 1.0, 1.1, 1.2, 1.3<br />
|-<br />
| Focus || 1.4, 1.5<br />
|-<br />
| Xcalibur || 1.6<br />
|}<br />
<br />
=== EEPROM ===<br />
<br />
{| class="wikitable"<br />
! Xbox Model<br />
! Manufacturer<br />
! Model<br />
|-<br />
| 1.4 (Others?)<br />
| Catalyst<br />
| CAT24WC02J<br />
|}<br />
<br />
=== MCPX Version ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | MCPX Version<br />
! scope="col" | Revision<br />
|-<br />
| 1.0 || 1.0<br />
|-<br />
| 1.1 || 1.1 - 1.6<br />
|}<br />
<br />
=== BIOS Version ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Kernel Version<br />
! scope="col" | Revision<br />
|-<br />
| 3944, 4034, 4036, 4627 || 1.0<br />
|-<br />
| 4817, 4972 || 1.1<br />
|-<br />
| 5101, 5713 || 1.2 - 1.5<br />
|-<br />
| 5838 || 1.6<br />
|}<br />
<br />
== References ==<br />
<br />
* [http://www.informit.com/articles/article.aspx?p=367210&seqNum=2 InformIT Methods of Identification]<br />
* [http://www.informit.com/articles/article.aspx?p=367210 InformIT Identifying your Xbox Revision]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Hardware_Revisions&diff=6828Hardware Revisions2020-01-21T20:03:48Z<p>JayFoxRox: Combine existing GDR-8050L DVD drive sections (also fixes structure of article)</p>
<hr />
<div>There were several different retail Xbox hardware revisions, which include the following:<br />
<br />
* Xbox 1.0<br />
** USB controller is on a separate [[Motherboard#USB_Daughterboard|PCB]]<br />
** GPU has a fan on the heat sink<br />
* Xbox 1.1<br />
** USB controller moved onto the motherboard<br />
** Fan removed from the GPU heat sink<br />
* Xbox 1.2<br />
** TSOP Size now 256k (Initial Size 1024k)<br />
** Updated Board Layout<br />
** Switched to ATX Power connector<br />
* Xbox 1.3<br />
** Removed LFrame signal from LPC Port<br />
* Xbox 1.4<br />
** Updated Board Layout<br />
** Switched to the "Focus" Video Encoder<br />
* Xbox 1.5 <br />
** 3.3v and GND removed from LPC<br />
* Xbox 1.6<br />
** New Board Layout with additional RAM Pads removed<br />
** Removed data and power lines from LPC port<br />
** Xyclops chip (includes ROM instead of flash = BIOS no longer flashable)<br />
** Switched to the "XCalibur" Video Encoder<br />
** Microsoft later switched to lower quality Hynix RAM. These Xboxes with non-Samsung RAM are sometimes referred to as 1.6b by the modding community.<br />
<br />
You can find more information about the hardware used in each revision below.<br />
<br />
== History of Xbox 1.5 ==<br />
<br />
There has been no conclusive evidence pointing to their existence, and all 1.5 sightings to date have turned out to be 1.4 boards.<br />
They possibly never existed{{citation needed}}, but will otherwise be very rare. Production was halted and 1.4 was produced again{{citation needed|reason=Sooo.. do these exist or not?!}}.<br />
<br />
== Identifying ==<br />
<br />
While not definitive, here are some ways to help identify the revision of your Xbox.<br />
<br />
=== Manufacturing Details ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Date Range<br />
! scope="col" | Revision<br />
! scope="col" | Location<br />
|-<br />
| 01/2001–07/2002 || 1.0 || Hungary, Mexico<br />
|-<br />
| 08/2002-01/2003 || 1.1 || China, Mexico<br />
|-<br />
| 01/2003-03/2003 || 1.2 || China<br />
|-<br />
| 04/2003-07/2003 || 1.3 || China<br />
|- <br />
| 09/2003-03/2004 || 1.4,1.5 || China<br />
|-<br />
| 04/2004-09/2004 || 1.6 || China, Taiwan<br />
|- <br />
| 09/2004-08/2005 || 1.6b || China, Taiwan<br />
|}<br />
<br />
=== Serial Number ===<br />
<br />
The serial number looks like this:<br />
<br />
LNNNNNN YWWFF<br />
<br />
* L is the production line<br />
* NNNNNN is the number produced that week<br />
* Y is the last digit of the production year<br />
* WW is the number of the week<br />
* FF is the factory code<br />
<br />
Note, this table contradicts the previous table.<br />
<br />
{| class="wikitable"<br />
! scope="col" | Factory<br />
! scope="col" | Location<br />
! scope="col" | Revision<br />
|-<br />
| 02 || Mexico || 1.0 or 1.1<br />
|-<br />
| 03 || Hungary || 1.0<br />
|-<br />
| 05 || China || 1.1 or later<br />
|-<br />
| 06 || Taiwan || 1.2 or later<br />
|}<br />
<br />
{| class="wikitable"<br />
! scope="col" | Serial Number<br />
! scope="col" | Revision<br />
|-<br />
| LNNNNNN 20WFF || 1.0<br />
|-<br />
| LNNNNNN 21WFF || 1.0<br />
|-<br />
| LNNNNNN 23WFF || 1.0 or 1.1<br />
|-<br />
| LNNNNNN 24WFF || 1.1<br />
|-<br />
| LNNNNNN 25WFF || 1.1<br />
|-<br />
| LNNNNNN 30WFF || 1.2<br />
|-<br />
| LNNNNNN 31WFF || 1.3<br />
|-<br />
| LNNNNNN 32WFF || 1.3<br />
|-<br />
| LNNNNNN 33WFF || 1.4 or 1.5<br />
|-<br />
| LNNNNNN 42WFF || 1.6<br />
|-<br />
| LNNNNNN 43WFF || 1.6b<br />
|}<br />
<br />
=== DVD Drive ===<br />
<br />
There are four retail drives known to be used by Microsoft in the retail version of the console.<br />
Any Xbox DVD drive can be used in any retail Xbox.<br />
<br />
List of Xbox DVD Drive manufacturers<br />
* Thomson (Xbox 1.0, 1.1)<br />
* Philips (Xbox 1.1 and above)<br />
* Samsung (Any)<br />
* Hitachi-LG (8050L)(mainly 1.6?)<br />
<br />
[[File:Xbox_drivedetermination.png|Xbox DVD Drive determination]]<br />
<br />
==== THOMSON TGM600 ====<br />
<br />
The first manufacture is sadly also the worst of all Dvdrom drives manufactured for the original xbox.<br />
It has a Cirrus Logic CL-CR3710-60EC-F as its main controller and a 8/3062 HD 64F3062F25 16bit H8/300H secondary samller MPU,at 25Mhz <br />
Unkown sofar if there is external flash or if its inside the Cirrus Logic IC.<br />
<br />
==== SAMSUNG SDG605 ====<br />
<br />
The Samsung drive is a very popular DVDrom drive for its compatibility for most media types and better quality laser. There are 2 mayor revisions found for this manufacturer<br />
* X00603-005 Plays CDR <br />
* X00603-006 Wont play CDR<br />
<br />
The DVDrom drive is using the MT1358E (MT1359E is the 360 Sata version) from Mediatek, and has a 39SF020A flashrom.<br />
If the firmware from this drive is applied to a SAMSUNG 616T or 616F PC dvd drive it will behave as a Xbox one, modified hardware will allow for tray state and eject to work.<br />
<br />
==== PHILLIPS VAD6053 ====<br />
<br />
Also named: VAD6011/21 apear to have no brand or partnumber on its large main controller,might be Cirrus Logic based on its size and use of a Philips secondary smaller mcu. flash might be a 39SF020A from SST. The laser ribbon cable connector is different for its various revisions, a detail one must take into account when swapping controller boards.<br />
<br />
There should be a tutorial on how to convert a PC dvdrom drive Pioneer 500M with the Philips firmware to be a Xbox dvdrom drive.<br />
<br />
==== HITACHI-LG GDR-8050L ====<br />
<br />
This DVD-rom drive, most commonly found in Xbox 1.6 and 1.6b is capable of reading DVD-+R, DVD-RW and CDRW media, but fails to boot most CD-R discs source: [http://www.xbox-hq.com/html/article1535.html xbox-hq.com Hitachi-LG GDR-8050L DVD Drive In Xbox].<br />
<br />
The latest manufacture for the DVDrom drive probably used a Panasonic MN103S89FDA for its main controler, appears to have no external flashrom.<br />
with this firmware and modified hardware for Eject and traystate, a LG GDR-8163B or LG DRD-8160B might act as a drop in replacement after altering either case.<br />
<br />
On 30 January 2006 TheSpecialist posted at Xboxhacker.net that he successfully flashed a Hitachi drive to boot a copied game on an unmodded xbox: [https://web.archive.org/web/20080316154615/http://www.xboxhacker.net/index.php?option=com_smf&Itemid=33&topic=285.0 breakthrough: XBOX 1 firmware hacked !]<br />
<br />
=== Hard Drive ===<br />
<br />
{| class="wikitable<br />
|-<br />
! Revision<br />
! Drive Manufacturer<br />
! Drive Model Number<br />
! Capacity<br />
|-<br />
| 1.0<br />
| Seagate<br />
| ST310211A<br />
| 10G<br />
|-<br />
| 1.0 (XB:2001-10-26 FF=02)<br />
| Western Digital<br />
| WD80EB-00CGH0<br />
| 8G<br />
|-<br />
| 1.1 (XB:2001-10-29 FF=03)<br />
| Western Digital<br />
| WD80EB-28CGH1<br />
| 8G<br />
|-<br />
| 1.2<br />
| Western Digital<br />
| WD80EB-28DFH2<br />
| 8G<br />
|-<br />
| 1.3+<br />
| Seagate<br />
| ST10014ACE<br />
| 10G<br />
|}<br />
<br />
=== Video encoder ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Video Chip<br />
! scope="col" | Revision<br />
|-<br />
| Conexant || 1.0, 1.1, 1.2, 1.3<br />
|-<br />
| Focus || 1.4, 1.5<br />
|-<br />
| Xcalibur || 1.6<br />
|}<br />
<br />
=== EEPROM ===<br />
<br />
{| class="wikitable"<br />
! Xbox Model<br />
! Manufacturer<br />
! Model<br />
|-<br />
| 1.4 (Others?)<br />
| Catalyst<br />
| CAT24WC02J<br />
|}<br />
<br />
=== MCPX Version ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | MCPX Version<br />
! scope="col" | Revision<br />
|-<br />
| 1.0 || 1.0<br />
|-<br />
| 1.1 || 1.1 - 1.6<br />
|}<br />
<br />
=== BIOS Version ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Kernel Version<br />
! scope="col" | Revision<br />
|-<br />
| 3944, 4034, 4036, 4627 || 1.0<br />
|-<br />
| 4817, 4972 || 1.1<br />
|-<br />
| 5101, 5713 || 1.2 - 1.5<br />
|-<br />
| 5838 || 1.6<br />
|}<br />
<br />
== References ==<br />
<br />
* [http://www.informit.com/articles/article.aspx?p=367210&seqNum=2 InformIT Methods of Identification]<br />
* [http://www.informit.com/articles/article.aspx?p=367210 InformIT Identifying your Xbox Revision]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Xbox_Game_Disc&diff=6827Xbox Game Disc2020-01-20T19:30:19Z<p>JayFoxRox: Add more flashing software</p>
<hr />
<div>Xbox games are shipped on DVDs. They are commonly referred to as Xbox Game Discs (XGD).<br />
<br />
== Visible information on ring ==<br />
<br />
'''The DVD inner ring usually contains:'''<br />
<br />
(The examples are from a German [[FIFA Soccer 2003]] disc)<br />
<br />
An outer portion with labels:<br />
* Outer ring Layer 1<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L1*)<br />
** Text for Mastering code ("EA02302E L1 02 0MM", where "02" is a smaller font and slightly higher than the previous baseline, followed by "0MM" on the original baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
* Inner ring for Layer 0<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L0*)<br />
** Text for Mastering code ("EA02302E L0 06", where "06" is a smaller font and slightly higher than the previous baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
<br />
An inner porition with Xbox logo:<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* 1 time "XBOX" text with blank background<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* Another tiny pattern segmented into 7 portions in alternating position,(opposite of the "XBOX" text without logo)<br />
** 4 times a Xbox logo <br />
** 2 times the word "genuine"<br />
** and in the middle the word ASPnnnn where n is a number{{citation needed}} <br />
<br />
''' ASP code '''<br />
[[File:Asp demodisk.jpg|thumb|right|Detail of the DVD hologram, reflecting the ASP5080 by the flash of the camera. found on a demodisk (IM00113E-IM)]]<br />
The following table lists known ASPnnnn numbers found on Xbox dvd disks, they are also on 360 disks but we dont list those in this wiki.<br />
The games listed are examples, its known for sure more disks can have these numbers and further research can be done, to determine the meaning.<br />
It is rumoured it might be a version string of some sorts slowly raising in xbox years old. {{citation needed}}<br />
{| class="wikitable"<br />
|-<br />
! ASP number<br />
! found on<br />
! game serial<br />
|-<br />
| ASP0180<br />
| Xbox Hardware Refresh Disc<br />
| XB01101W<br />
|-<br />
| ASP0380<br />
| Tom Clancy's Splinter Cell Exclusive Playable Demo<br />
| US01251E<br />
|-<br />
| ASP0980<br />
| Tom Clancy's Rainbow Six 3 DEMO DISC<br />
| US03152E-US<br />
|-<br />
| ASP5080<br />
| The official xbox 50 best games (Demo disk)<br />
| IM00113E-IM<br />
|-<br />
| ASP5180<br />
| Rayman 3 hoodlum havoc<br />
| <br />
|-<br />
| ASP5280<br />
| Xbox Music Mixer<br />
| MS09005A-MS<br />
|}<br />
<br />
== Dumps ==<br />
<br />
=== Files ===<br />
<br />
===== Example timestamps =====<br />
<br />
Timestamps for [[Petit Copter]]:<br />
<pre><br />
126779196239020000ULL, // XDVDFS timestamp<br />
126956823480700000ULL, // SS timestamp<br />
126957328439576418ULL, // SS unk3 timestamp<br />
126957649743869476ULL, // DMI Timestamp<br />
126961143392830592ULL, // SS unk4 timestamp<br />
</pre><br />
<br />
==== Disc Manufacturing Information (DMI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x04<br />
<br />
DMI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u32? || Unknown || Always 1?<br />
|-<br />
|4 || u32? || Unknown || Always zero?<br />
|-<br />
|8 || ascii_char[8] || Mastering Code || Example: EA02302E <br> Also see [[Xbe#Title_ID]]<br />
|-<br />
|16 || u64 || || Some timestamp?<br />
|-<br />
|24 || u32? || Unknown || Always 2?<br />
|}<br />
<br />
==== Physical Format Information (PFI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x00<br />
<br />
Read from the Lead-In.<br />
<br />
PFI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || <code>booktype << 4 <nowiki>|</nowiki> part_version</code> || 4 bit each<br />
|-<br />
|1 || u8 || <code>disc_size << 4 <nowiki>|</nowiki> maximum_rate</code> || 4 bit each<br />
|-<br />
|2 || u8 || <code>number_of_layers << 5 <nowiki>|</nowiki> track_path << 4 <nowiki>|</nowiki> layer_type</code> || 1 bit padding, 2 bit, 1 bit, 4 bit<br />
|-<br />
|3 || u8 || <code>linear_density << 4 <nowiki>|</nowiki> track_density</code> || 4 bit each<br />
|-<br />
|4 || u8 || || Always zero<br />
|-<br />
|5 || u24 || Starting Physical Sector Number of Data Area ||<br />
|-<br />
|8 || u8 || || Always zero<br />
|-<br />
|9 || u24 || End Physical Sector Number of Data Area ||<br />
|-<br />
|12 || u8 || || Always zero<br />
|-<br />
|13 || u24 || End Sector Number in Layer 0 || Always 0x2033AF for original Xbox discs<br />
|}<br />
<br />
From [ftp://ftp.avc-pioneer.com/Mtfuji_5/Proposal/Jan01/RDVDSTRC.pdf] (page 4)<br />
<br />
==== Security Sectors (SS.bin) ====<br />
<br />
Challenge entry (11 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || Valid || Always 1 if the challenge is valid, else the challenge is ignored<br />
|-<br />
|1 || u8 || Challenge id ||<br />
|-<br />
|2 || u32 || Challenge value ||<br />
|-<br />
|6 || u8 || Response modifier || multimedia.cx says this might be a Response id. However, it's always 0 anyway?!<br />
|-<br />
|7 || u32 || Response value ||<br />
|}<br />
<br />
Security sector range (9 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|3 || u24 || Start PSN ||<br />
|-<br />
|6 || u24 || End PSN ||<br />
|}<br />
<br />
Unknown1 (44 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u64 || || Yet another timestamp?! (Similar to 1183 in complete format)<br />
|-<br />
|8 || u32 || || Unknown<br />
|-<br />
|27 || u8 || || Unknown<br />
|-<br />
|28 || u8[16] || || Unknown<br />
|}<br />
<br />
Complete format (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || PFI || Physical Format Information || PFI for the actual data, unknown size<br />
|-<br />
|720 || u32 || Unknown ||<br />
|-<br />
|768 || u8 || Version of challenge table || Always 1<br />
|-<br />
|769 || u8 || Number of challenge entries || Always 23<br />
|-<br />
|770 || Challenge entry[] || Encrypted challenge entries ||<br />
|-<br />
|1055 || u64 || || Some large number timestamp?<br />
|-<br />
|1083 || u8[16] || || Unknown<br />
|-<br />
|1183 || Unknown1 || || Unknown, this structure is SHA-1 hashed, to generate a RC4 key to decrypt challenge entries<br />
|-<br />
|1227 || u8[20] || SHA-1 hash A || Hash until here (of the complete format)<br />
|-<br />
|1247 || u8[256] || Signature A || For hash in previous field<br />
|-<br />
|1503 || Unknown1 || || Unknown<br />
|-<br />
|1547 || u8[20] || SHA-1 hash B || Hash until here (of the complete format)<br />
|-<br />
|1567 || u8[64] || Signature B || For hash in previous field (note that this is somewhat shorter than the other signature?!)<br />
|-<br />
! colspan="4" | End of data readable by a stock Xbox drive (1632 Bytes)<br />
|-<br />
|1632 || u8 || Number of security sector ranges || Always 23<br />
|-<br />
|1633 || Security sector range[] || Security sector ranges || Only 16 of which are used.<br />
|-<br />
|1840 || Security sector range[] || Security sector ranges || Only 16 of which are used. <br> ''(Copy from Offset 1633)''<br />
|}<br />
<br />
All other fields are assumed to be zero!<br />
<br />
===== Decryption of challenge entries =====<br />
<br />
Starting at offset 1183, a 44 byte SHA-1 hash is generated.<br />
The first 7 byte of the resulting hash are used as the key in RC4 decryption. The 253 Bytes of the challenge entries (Offset 770) will be decrypted.<br />
<br />
There'll only be a handful of valid entries in the challenge entries.<br />
However there'll be at least 2.<br />
<br />
=== Dumping ===<br />
<br />
To dump Xbox Game Discs you need one of the following drives / firmwares:<br />
<br />
{| class="wikitable"<br />
!Drive<br />
!Standard<br />
!Original Firmware download<br />
!Name of modified Firmware for dumping<br />
|-<br />
|{{FIXME|reason=Which drives?}}<br />
|<br />
|<br />
|<br />
* 0800{{citation needed}}<br />
|-<br />
|Toshiba SD-M2012C<br />
|IDE<br />
|<br />
|<br />
* Kreon{{citation needed}}<br />
|-<br />
|Samsung SH-D162C<br />
|IDE<br />
|[https://web.archive.org/web/20091206023615/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200506021808200872_SH-D162C_TS02.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ TS02] <br> [https://web.archive.org/web/20090604123608/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200509161625477201_SH-D162C_TS03.bin&path=/UploadFiles/FW/FWDOWNLOAD/KOR/ TS03<sup>Korean</sup>] <br> [https://web.archive.org/web/20091105003814/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200509261128121531_SH-D162C_TS03.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ TS03] <br> [https://web.archive.org/web/20100217012245/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200512221448334972_SH-D162C_TS04.bin&path=/UploadFiles/FW/FWDOWNLOAD/KOR/ TS04<sup>Korean</sup>] <br> [https://web.archive.org/web/20110920084807/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200701091709466301_SH-D162C_TS05.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ TS05]<br />
<br />
|rowspan=2 |<br />
* TS04 Kreon 0.5 (June 23rd 2006)<br />
* TS04 Kreon 0.60 (July 30th 2006)<br />
* TS04 Kreon 0.80 (September 9th 2006)<br />
* TS04{{FIXME|reason=README claims SB00}} Kreon 0.81 (October 4th 2006)<br />
* TS05{{FIXME|reason=README claims SB01}} Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Toshiba TS-H352C<br />
|IDE<br />
|[https://web.archive.org/web/20110921065924/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200505121909111802_TS-H352C_SC00.bin&path=/UploadFiles/FW/FWDOWNLOAD/KOR/ SC00<sup>Korean</sup>]<br />
|-<br />
|Samsung SH-D162D<br />
|IDE<br />
|[https://web.archive.org/web/20090601193905/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200706281644411972_SH-D162D_SB00.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB00] <br> [https://web.archive.org/web/20090916202345/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200811051941150901_SH-D162D_SB01.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01] <br> SB02{{citation needed}}[http://www.firmwarehq.com/download_995-file_SH-D162D_SB02.exe.html unknown if safe or legit] <br> [https://web.archive.org/web/20090402052613/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191825218171_SH-D162D_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] <br> [https://web.archive.org/web/20120123040117/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200909281412336931_SH-D162D_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]<br />
|rowspan=2 |<br />
* SB00 Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H352D<br />
|IDE<br />
|CH01{{FIXME|reason=http://samsungodd.com/korLib/download.asp?no=200904281542399901_TS-H352D_CH01.exe&fname=200904281542399901_TS-H352D_CH01.exe&path=/chn/UploadFiles/FW/FWDOWNLOAD/ dead}} <br> CM01{{FIXME|reason=https://web.archive.org/web/20100105225621/http://samsungodd.com/korLib/download.asp?no=200904281539184301_TS-H352D_CM01.exe&fname=200904281539184301_TS-H352D_CM01.exe&path=/chn/UploadFiles/FW/FWDOWNLOAD/ dead}} <br> [https://web.archive.org/web/20100105234118/http://samsungodd.com/korLib/download.asp?no=200910081442017201_TS-H352D_CM02.exe&fname=200910081442017201_TS-H352D_CM02.exe&path=/chn/UploadFiles/FW/FWDOWNLOAD/ CM02]<br />
<br />
|-<br />
|Samsung SH-D163A<br />
|SATA<br />
|[http://web.archive.org/web/20090601191704/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200701031704489471_SH-D163A_SB01.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01]<br />
<br />
|rowspan=2 |<br />
* Kreon 0.80 (October 17th 2006)<br />
* SB01 Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Toshiba TS-H353A<br />
|SATA<br />
|<br />
|-<br />
|Samsung SH-D163B<br />
|SATA<br />
|[https://web.archive.org/web/20090402052540/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191824214901_SH-D163B_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] <br> [https://web.archive.org/web/20091204131429/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200910081448023301_SH-D163B_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]<br />
|rowspan=2 |<br />
* Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H353B<br />
|SATA<br />
|CH01{{FIXME|reason=https://web.archive.org/web/*/http://samsungodd.com/chn/globalLib/Download.asp?path=Info_FWDownload&fname=200904281544595271_TS-H353B_CH01.exe dead}}<br />
|}<br />
<br />
Please note that the modified firmwares are based on copyrighted material and can therefore not be legally shared here.<br />
Patch files to patch original firmwares into dumping-firmwares would be appreciated. <br />
<br />
Flashing software:<br />
<br />
* [https://web.archive.org/web/20160904080433/http://www.tsstodd.com:80/TotalLib/popup/Download.asp?path=program&lang=eng&fname=TSDNMAC.ZIP TSDNMAC] for MacOS<br />
* [http://web.archive.org/web/20070301000000/http://www.samsungodd.com/KorLib/File/sfdnwin.exe SFDNWIN] for Microsoft Windows 2000 and XP<br />
* [https://web.archive.org/web/20100105230358/http://samsungodd.com/KorLib/File/Tsdnwin.exe TSDNWIN] for Microsoft Windows Vista and 7<br />
* [https://web.archive.org/web/20060328075340/http://www.samsungodd.com/eng/information/Application/Files/sfdndos.exe SFDNDOS] [https://web.archive.org/web/20060328072528/http://www.samsungodd.com/eng/information/Application/Files/Sfdndosm.exe SNFDOSM] and the newer TSDNDOS for Microsoft DOS<br />
<br />
For current dumping instructions see [http://forum.redump.org/topic/6073/xbox-1-360-dumping-instructions/ the Dumping Guide by the Redump Project].<br />
<br />
==== USB Adapters ====<br />
<br />
There are many USB-IDE/SATA adapters on the market. The following have been known to work well with the Kreon-compatible drives.<br />
<br />
{|class="wikitable"<br />
! Adapter Model / USB VID:DID<br />
! Drive Model<br />
! Notes<br />
|-<br />
| [https://www.amazon.de/gp/product/B016UBXH3O UGREEN USB 3.0 to SATA Adapter]<br />
<code>174c:55aa ASMedia Technology Inc.</code><br />
| SH-D163B/BEBE<br />
<code>H/W:A Ver.B SEPTEMBER 2008</code><br />
| Windows 10. No extra drivers required. Drive flashed. Works with DiscImageCreator.<br />
|-<br />
| [https://www.amazon.com/Sabrent-5-25-INCH-Converter-Activity-USB-DSC9/dp/B00DQJME7Y Sabrent USB-DSC9]<br />
<code>1f75:0611 Innostor Technology Corporation</code><br />
| SH-D162D/BEWE<br />
<code>H/W:A Ver.D JULY 2007</code><br />
| Ubuntu 18.04 host with VirtualBox WinXP VM. USB pass-thru of adapter. No extra drivers required. Drive flashed. Works with Xbox Backup Creator.<br />
|}<br />
<br />
=== Xbox related commands ===<br />
<br />
==== Enable Unlock 1 (xtreme) state ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 01</pre><br />
<br />
Enable Unlock 1 (xtreme) state' as we already know it from the 360 xtreme modded drives. <br />
This command is supported for legacy reasons only. Custom applications should use the new 'Set Lock State' instead.<br />
<br />
==== Set Lock State ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 11 xx</pre><br />
<br />
* <code>xx=00</code> - Drive locked (no unlock state)<br />
* <code>xx=01</code> - Unlock State 1 (xtreme) enabled<br />
* <code>xx=02</code> - Unlock state 2 (wxripper) enabled<br />
<br />
==== SS extract command ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>AD 00 FF 02 FD FF FE 00 08 00 xx C0</pre><br />
<br />
This is the well known from the xtreme firmware.<br />
<br />
==== Get Feature List ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 10</pre><br />
<br />
This command will return a list of the additional features supported by the drive.<br />
All values returned are 16 bit values, and the list is terminated with null (<code>0x0000</code>).<br />
The two first words of the returned list always reads as <code>0xA55A 0X5AA5</code> in order to guarantee that a reply from a drive not supporting this command correctly isn't mistaken for a feature list.<br />
<br />
An example feature list could be: <code>0xA55A, 0x5AA5, 0x0100, 0xF000, 0xF001, 0x0000</code><br />
<br />
This list would indicate that the drive supports XBOX360 Unlock 1, Lock and Error Skip, as it can be seen from the values defined below:<br />
<br />
XBOX 360 related features:<br />
<br />
* <code>0x0100</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0101</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0120</code> : The drive can read and decrypt the SS<br />
* <code>0x0121</code> : The drive has full challenge response functionality<br />
<br />
XBOX related features:<br />
<br />
* <code>0x0200</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0201</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0220</code> : The drive can read and decrypt the SS<br />
* <code>0x0221</code> : The drive has full challenge response functionality<br />
<br />
General drive features:<br />
<br />
* <code>0xF000</code> : The drive supports the lock (cancel any unlock state) command<br />
* <code>0xF001</code> : The drive supports error skipping<br />
<br />
This is the complete list of defined features at the moment. If you're working on a custom application you might want to contact me in order to get the latest list.<br />
<br />
== References and links == <br />
* [https://web.archive.org/web/20150616131202/http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf]<br />
* [https://multimedia.cx/eggs/xbox-sphinx-protocol/ Overview of the challenge/response security protocol]<br />
* [http://redump.org/discs/system/xbox/ Xbox Game Discs preserved by the Redump Project]<br />
* [http://wiki.redump.org/index.php?title=Discs_not_yet_dumped#Microsoft_Xbox Missing Xbox Game Disc dumps at Redump Project]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Xbox_Game_Disc&diff=6826Xbox Game Disc2020-01-20T05:23:14Z<p>JayFoxRox: Listed more Kreon versions for SH-D162C</p>
<hr />
<div>Xbox games are shipped on DVDs. They are commonly referred to as Xbox Game Discs (XGD).<br />
<br />
== Visible information on ring ==<br />
<br />
'''The DVD inner ring usually contains:'''<br />
<br />
(The examples are from a German [[FIFA Soccer 2003]] disc)<br />
<br />
An outer portion with labels:<br />
* Outer ring Layer 1<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L1*)<br />
** Text for Mastering code ("EA02302E L1 02 0MM", where "02" is a smaller font and slightly higher than the previous baseline, followed by "0MM" on the original baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
* Inner ring for Layer 0<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L0*)<br />
** Text for Mastering code ("EA02302E L0 06", where "06" is a smaller font and slightly higher than the previous baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
<br />
An inner porition with Xbox logo:<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* 1 time "XBOX" text with blank background<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* Another tiny pattern segmented into 7 portions in alternating position,(opposite of the "XBOX" text without logo)<br />
** 4 times a Xbox logo <br />
** 2 times the word "genuine"<br />
** and in the middle the word ASPnnnn where n is a number{{citation needed}} <br />
<br />
''' ASP code '''<br />
[[File:Asp demodisk.jpg|thumb|right|Detail of the DVD hologram, reflecting the ASP5080 by the flash of the camera. found on a demodisk (IM00113E-IM)]]<br />
The following table lists known ASPnnnn numbers found on Xbox dvd disks, they are also on 360 disks but we dont list those in this wiki.<br />
The games listed are examples, its known for sure more disks can have these numbers and further research can be done, to determine the meaning.<br />
It is rumoured it might be a version string of some sorts slowly raising in xbox years old. {{citation needed}}<br />
{| class="wikitable"<br />
|-<br />
! ASP number<br />
! found on<br />
! game serial<br />
|-<br />
| ASP0180<br />
| Xbox Hardware Refresh Disc<br />
| XB01101W<br />
|-<br />
| ASP0380<br />
| Tom Clancy's Splinter Cell Exclusive Playable Demo<br />
| US01251E<br />
|-<br />
| ASP0980<br />
| Tom Clancy's Rainbow Six 3 DEMO DISC<br />
| US03152E-US<br />
|-<br />
| ASP5080<br />
| The official xbox 50 best games (Demo disk)<br />
| IM00113E-IM<br />
|-<br />
| ASP5180<br />
| Rayman 3 hoodlum havoc<br />
| <br />
|-<br />
| ASP5280<br />
| Xbox Music Mixer<br />
| MS09005A-MS<br />
|}<br />
<br />
== Dumps ==<br />
<br />
=== Files ===<br />
<br />
===== Example timestamps =====<br />
<br />
Timestamps for [[Petit Copter]]:<br />
<pre><br />
126779196239020000ULL, // XDVDFS timestamp<br />
126956823480700000ULL, // SS timestamp<br />
126957328439576418ULL, // SS unk3 timestamp<br />
126957649743869476ULL, // DMI Timestamp<br />
126961143392830592ULL, // SS unk4 timestamp<br />
</pre><br />
<br />
==== Disc Manufacturing Information (DMI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x04<br />
<br />
DMI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u32? || Unknown || Always 1?<br />
|-<br />
|4 || u32? || Unknown || Always zero?<br />
|-<br />
|8 || ascii_char[8] || Mastering Code || Example: EA02302E <br> Also see [[Xbe#Title_ID]]<br />
|-<br />
|16 || u64 || || Some timestamp?<br />
|-<br />
|24 || u32? || Unknown || Always 2?<br />
|}<br />
<br />
==== Physical Format Information (PFI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x00<br />
<br />
Read from the Lead-In.<br />
<br />
PFI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || <code>booktype << 4 <nowiki>|</nowiki> part_version</code> || 4 bit each<br />
|-<br />
|1 || u8 || <code>disc_size << 4 <nowiki>|</nowiki> maximum_rate</code> || 4 bit each<br />
|-<br />
|2 || u8 || <code>number_of_layers << 5 <nowiki>|</nowiki> track_path << 4 <nowiki>|</nowiki> layer_type</code> || 1 bit padding, 2 bit, 1 bit, 4 bit<br />
|-<br />
|3 || u8 || <code>linear_density << 4 <nowiki>|</nowiki> track_density</code> || 4 bit each<br />
|-<br />
|4 || u8 || || Always zero<br />
|-<br />
|5 || u24 || Starting Physical Sector Number of Data Area ||<br />
|-<br />
|8 || u8 || || Always zero<br />
|-<br />
|9 || u24 || End Physical Sector Number of Data Area ||<br />
|-<br />
|12 || u8 || || Always zero<br />
|-<br />
|13 || u24 || End Sector Number in Layer 0 || Always 0x2033AF for original Xbox discs<br />
|}<br />
<br />
From [ftp://ftp.avc-pioneer.com/Mtfuji_5/Proposal/Jan01/RDVDSTRC.pdf] (page 4)<br />
<br />
==== Security Sectors (SS.bin) ====<br />
<br />
Challenge entry (11 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || Valid || Always 1 if the challenge is valid, else the challenge is ignored<br />
|-<br />
|1 || u8 || Challenge id ||<br />
|-<br />
|2 || u32 || Challenge value ||<br />
|-<br />
|6 || u8 || Response modifier || multimedia.cx says this might be a Response id. However, it's always 0 anyway?!<br />
|-<br />
|7 || u32 || Response value ||<br />
|}<br />
<br />
Security sector range (9 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|3 || u24 || Start PSN ||<br />
|-<br />
|6 || u24 || End PSN ||<br />
|}<br />
<br />
Unknown1 (44 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u64 || || Yet another timestamp?! (Similar to 1183 in complete format)<br />
|-<br />
|8 || u32 || || Unknown<br />
|-<br />
|27 || u8 || || Unknown<br />
|-<br />
|28 || u8[16] || || Unknown<br />
|}<br />
<br />
Complete format (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || PFI || Physical Format Information || PFI for the actual data, unknown size<br />
|-<br />
|720 || u32 || Unknown ||<br />
|-<br />
|768 || u8 || Version of challenge table || Always 1<br />
|-<br />
|769 || u8 || Number of challenge entries || Always 23<br />
|-<br />
|770 || Challenge entry[] || Encrypted challenge entries ||<br />
|-<br />
|1055 || u64 || || Some large number timestamp?<br />
|-<br />
|1083 || u8[16] || || Unknown<br />
|-<br />
|1183 || Unknown1 || || Unknown, this structure is SHA-1 hashed, to generate a RC4 key to decrypt challenge entries<br />
|-<br />
|1227 || u8[20] || SHA-1 hash A || Hash until here (of the complete format)<br />
|-<br />
|1247 || u8[256] || Signature A || For hash in previous field<br />
|-<br />
|1503 || Unknown1 || || Unknown<br />
|-<br />
|1547 || u8[20] || SHA-1 hash B || Hash until here (of the complete format)<br />
|-<br />
|1567 || u8[64] || Signature B || For hash in previous field (note that this is somewhat shorter than the other signature?!)<br />
|-<br />
! colspan="4" | End of data readable by a stock Xbox drive (1632 Bytes)<br />
|-<br />
|1632 || u8 || Number of security sector ranges || Always 23<br />
|-<br />
|1633 || Security sector range[] || Security sector ranges || Only 16 of which are used.<br />
|-<br />
|1840 || Security sector range[] || Security sector ranges || Only 16 of which are used. <br> ''(Copy from Offset 1633)''<br />
|}<br />
<br />
All other fields are assumed to be zero!<br />
<br />
===== Decryption of challenge entries =====<br />
<br />
Starting at offset 1183, a 44 byte SHA-1 hash is generated.<br />
The first 7 byte of the resulting hash are used as the key in RC4 decryption. The 253 Bytes of the challenge entries (Offset 770) will be decrypted.<br />
<br />
There'll only be a handful of valid entries in the challenge entries.<br />
However there'll be at least 2.<br />
<br />
=== Dumping ===<br />
<br />
To dump Xbox Game Discs you need one of the following drives / firmwares:<br />
<br />
{| class="wikitable"<br />
!Drive<br />
!Standard<br />
!Original Firmware download<br />
!Name of modified Firmware for dumping<br />
|-<br />
|{{FIXME|reason=Which drives?}}<br />
|<br />
|<br />
|<br />
* 0800{{citation needed}}<br />
|-<br />
|Toshiba SD-M2012C<br />
|IDE<br />
|<br />
|<br />
* Kreon{{citation needed}}<br />
|-<br />
|Samsung SH-D162C<br />
|IDE<br />
|[https://web.archive.org/web/20091206023615/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200506021808200872_SH-D162C_TS02.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ TS02] <br> [https://web.archive.org/web/20090604123608/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200509161625477201_SH-D162C_TS03.bin&path=/UploadFiles/FW/FWDOWNLOAD/KOR/ TS03<sup>Korean</sup>] <br> [https://web.archive.org/web/20091105003814/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200509261128121531_SH-D162C_TS03.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ TS03] <br> [https://web.archive.org/web/20100217012245/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200512221448334972_SH-D162C_TS04.bin&path=/UploadFiles/FW/FWDOWNLOAD/KOR/ TS04<sup>Korean</sup>] <br> [https://web.archive.org/web/20110920084807/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200701091709466301_SH-D162C_TS05.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ TS05]<br />
<br />
|rowspan=2 |<br />
* TS04 Kreon 0.5 (June 23rd 2006)<br />
* TS04 Kreon 0.60 (July 30th 2006)<br />
* TS04 Kreon 0.80 (September 9th 2006)<br />
* TS04{{FIXME|reason=README claims SB00}} Kreon 0.81 (October 4th 2006)<br />
* TS05{{FIXME|reason=README claims SB01}} Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Toshiba TS-H352C<br />
|IDE<br />
|[https://web.archive.org/web/20110921065924/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200505121909111802_TS-H352C_SC00.bin&path=/UploadFiles/FW/FWDOWNLOAD/KOR/ SC00<sup>Korean</sup>]<br />
|-<br />
|Samsung SH-D162D<br />
|IDE<br />
|[https://web.archive.org/web/20090601193905/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200706281644411972_SH-D162D_SB00.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB00] <br> [https://web.archive.org/web/20090916202345/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200811051941150901_SH-D162D_SB01.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01] <br> SB02{{citation needed}}[http://www.firmwarehq.com/download_995-file_SH-D162D_SB02.exe.html unknown if safe or legit] <br> [https://web.archive.org/web/20090402052613/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191825218171_SH-D162D_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] <br> [https://web.archive.org/web/20120123040117/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200909281412336931_SH-D162D_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]<br />
|rowspan=2 |<br />
* SB00 Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H352D<br />
|IDE<br />
|CH01{{FIXME|reason=http://samsungodd.com/korLib/download.asp?no=200904281542399901_TS-H352D_CH01.exe&fname=200904281542399901_TS-H352D_CH01.exe&path=/chn/UploadFiles/FW/FWDOWNLOAD/ dead}} <br> CM01{{FIXME|reason=https://web.archive.org/web/20100105225621/http://samsungodd.com/korLib/download.asp?no=200904281539184301_TS-H352D_CM01.exe&fname=200904281539184301_TS-H352D_CM01.exe&path=/chn/UploadFiles/FW/FWDOWNLOAD/ dead}} <br> [https://web.archive.org/web/20100105234118/http://samsungodd.com/korLib/download.asp?no=200910081442017201_TS-H352D_CM02.exe&fname=200910081442017201_TS-H352D_CM02.exe&path=/chn/UploadFiles/FW/FWDOWNLOAD/ CM02]<br />
<br />
|-<br />
|Samsung SH-D163A<br />
|SATA<br />
|[http://web.archive.org/web/20090601191704/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200701031704489471_SH-D163A_SB01.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01]<br />
<br />
|rowspan=2 |<br />
* Kreon 0.80 (October 17th 2006)<br />
* SB01 Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Toshiba TS-H353A<br />
|SATA<br />
|<br />
|-<br />
|Samsung SH-D163B<br />
|SATA<br />
|[https://web.archive.org/web/20090402052540/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191824214901_SH-D163B_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] <br> [https://web.archive.org/web/20091204131429/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200910081448023301_SH-D163B_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]<br />
|rowspan=2 |<br />
* Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H353B<br />
|SATA<br />
|CH01{{FIXME|reason=https://web.archive.org/web/*/http://samsungodd.com/chn/globalLib/Download.asp?path=Info_FWDownload&fname=200904281544595271_TS-H353B_CH01.exe dead}}<br />
|}<br />
<br />
Please note that the modified firmwares are based on copyrighted material and can therefore not be legally shared here.<br />
Patch files to patch original firmwares into dumping-firmwares would be appreciated. <br />
<br />
Flashing software:<br />
<br />
* TSDNMAC for MacOS<br />
* [http://web.archive.org/web/20070301000000/http://www.samsungodd.com/KorLib/File/sfdnwin.exe SFDNWIN] for Microsoft Windows 2000 and XP<br />
* TSDNWIN for Microsoft Windows Vista and 7<br />
* Dell SFDNDOS and the newer TSDNDOS for Microsoft DOS<br />
<br />
For current dumping instructions see [http://forum.redump.org/topic/6073/xbox-1-360-dumping-instructions/ the Dumping Guide by the Redump Project].<br />
<br />
==== USB Adapters ====<br />
<br />
There are many USB-IDE/SATA adapters on the market. The following have been known to work well with the Kreon-compatible drives.<br />
<br />
{|class="wikitable"<br />
! Adapter Model / USB VID:DID<br />
! Drive Model<br />
! Notes<br />
|-<br />
| [https://www.amazon.de/gp/product/B016UBXH3O UGREEN USB 3.0 to SATA Adapter]<br />
<code>174c:55aa ASMedia Technology Inc.</code><br />
| SH-D163B/BEBE<br />
<code>H/W:A Ver.B SEPTEMBER 2008</code><br />
| Windows 10. No extra drivers required. Drive flashed. Works with DiscImageCreator.<br />
|-<br />
| [https://www.amazon.com/Sabrent-5-25-INCH-Converter-Activity-USB-DSC9/dp/B00DQJME7Y Sabrent USB-DSC9]<br />
<code>1f75:0611 Innostor Technology Corporation</code><br />
| SH-D162D/BEWE<br />
<code>H/W:A Ver.D JULY 2007</code><br />
| Ubuntu 18.04 host with VirtualBox WinXP VM. USB pass-thru of adapter. No extra drivers required. Drive flashed. Works with Xbox Backup Creator.<br />
|}<br />
<br />
=== Xbox related commands ===<br />
<br />
==== Enable Unlock 1 (xtreme) state ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 01</pre><br />
<br />
Enable Unlock 1 (xtreme) state' as we already know it from the 360 xtreme modded drives. <br />
This command is supported for legacy reasons only. Custom applications should use the new 'Set Lock State' instead.<br />
<br />
==== Set Lock State ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 11 xx</pre><br />
<br />
* <code>xx=00</code> - Drive locked (no unlock state)<br />
* <code>xx=01</code> - Unlock State 1 (xtreme) enabled<br />
* <code>xx=02</code> - Unlock state 2 (wxripper) enabled<br />
<br />
==== SS extract command ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>AD 00 FF 02 FD FF FE 00 08 00 xx C0</pre><br />
<br />
This is the well known from the xtreme firmware.<br />
<br />
==== Get Feature List ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 10</pre><br />
<br />
This command will return a list of the additional features supported by the drive.<br />
All values returned are 16 bit values, and the list is terminated with null (<code>0x0000</code>).<br />
The two first words of the returned list always reads as <code>0xA55A 0X5AA5</code> in order to guarantee that a reply from a drive not supporting this command correctly isn't mistaken for a feature list.<br />
<br />
An example feature list could be: <code>0xA55A, 0x5AA5, 0x0100, 0xF000, 0xF001, 0x0000</code><br />
<br />
This list would indicate that the drive supports XBOX360 Unlock 1, Lock and Error Skip, as it can be seen from the values defined below:<br />
<br />
XBOX 360 related features:<br />
<br />
* <code>0x0100</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0101</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0120</code> : The drive can read and decrypt the SS<br />
* <code>0x0121</code> : The drive has full challenge response functionality<br />
<br />
XBOX related features:<br />
<br />
* <code>0x0200</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0201</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0220</code> : The drive can read and decrypt the SS<br />
* <code>0x0221</code> : The drive has full challenge response functionality<br />
<br />
General drive features:<br />
<br />
* <code>0xF000</code> : The drive supports the lock (cancel any unlock state) command<br />
* <code>0xF001</code> : The drive supports error skipping<br />
<br />
This is the complete list of defined features at the moment. If you're working on a custom application you might want to contact me in order to get the latest list.<br />
<br />
== References and links == <br />
* [https://web.archive.org/web/20150616131202/http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf]<br />
* [https://multimedia.cx/eggs/xbox-sphinx-protocol/ Overview of the challenge/response security protocol]<br />
* [http://redump.org/discs/system/xbox/ Xbox Game Discs preserved by the Redump Project]<br />
* [http://wiki.redump.org/index.php?title=Discs_not_yet_dumped#Microsoft_Xbox Missing Xbox Game Disc dumps at Redump Project]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Xbox_Game_Disc&diff=6825Xbox Game Disc2020-01-20T04:16:09Z<p>JayFoxRox: TS-H353B CH01 link is dead</p>
<hr />
<div>Xbox games are shipped on DVDs. They are commonly referred to as Xbox Game Discs (XGD).<br />
<br />
== Visible information on ring ==<br />
<br />
'''The DVD inner ring usually contains:'''<br />
<br />
(The examples are from a German [[FIFA Soccer 2003]] disc)<br />
<br />
An outer portion with labels:<br />
* Outer ring Layer 1<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L1*)<br />
** Text for Mastering code ("EA02302E L1 02 0MM", where "02" is a smaller font and slightly higher than the previous baseline, followed by "0MM" on the original baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
* Inner ring for Layer 0<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L0*)<br />
** Text for Mastering code ("EA02302E L0 06", where "06" is a smaller font and slightly higher than the previous baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
<br />
An inner porition with Xbox logo:<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* 1 time "XBOX" text with blank background<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* Another tiny pattern segmented into 7 portions in alternating position,(opposite of the "XBOX" text without logo)<br />
** 4 times a Xbox logo <br />
** 2 times the word "genuine"<br />
** and in the middle the word ASPnnnn where n is a number{{citation needed}} <br />
<br />
''' ASP code '''<br />
[[File:Asp demodisk.jpg|thumb|right|Detail of the DVD hologram, reflecting the ASP5080 by the flash of the camera. found on a demodisk (IM00113E-IM)]]<br />
The following table lists known ASPnnnn numbers found on Xbox dvd disks, they are also on 360 disks but we dont list those in this wiki.<br />
The games listed are examples, its known for sure more disks can have these numbers and further research can be done, to determine the meaning.<br />
It is rumoured it might be a version string of some sorts slowly raising in xbox years old. {{citation needed}}<br />
{| class="wikitable"<br />
|-<br />
! ASP number<br />
! found on<br />
! game serial<br />
|-<br />
| ASP0180<br />
| Xbox Hardware Refresh Disc<br />
| XB01101W<br />
|-<br />
| ASP0380<br />
| Tom Clancy's Splinter Cell Exclusive Playable Demo<br />
| US01251E<br />
|-<br />
| ASP0980<br />
| Tom Clancy's Rainbow Six 3 DEMO DISC<br />
| US03152E-US<br />
|-<br />
| ASP5080<br />
| The official xbox 50 best games (Demo disk)<br />
| IM00113E-IM<br />
|-<br />
| ASP5180<br />
| Rayman 3 hoodlum havoc<br />
| <br />
|-<br />
| ASP5280<br />
| Xbox Music Mixer<br />
| MS09005A-MS<br />
|}<br />
<br />
== Dumps ==<br />
<br />
=== Files ===<br />
<br />
===== Example timestamps =====<br />
<br />
Timestamps for [[Petit Copter]]:<br />
<pre><br />
126779196239020000ULL, // XDVDFS timestamp<br />
126956823480700000ULL, // SS timestamp<br />
126957328439576418ULL, // SS unk3 timestamp<br />
126957649743869476ULL, // DMI Timestamp<br />
126961143392830592ULL, // SS unk4 timestamp<br />
</pre><br />
<br />
==== Disc Manufacturing Information (DMI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x04<br />
<br />
DMI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u32? || Unknown || Always 1?<br />
|-<br />
|4 || u32? || Unknown || Always zero?<br />
|-<br />
|8 || ascii_char[8] || Mastering Code || Example: EA02302E <br> Also see [[Xbe#Title_ID]]<br />
|-<br />
|16 || u64 || || Some timestamp?<br />
|-<br />
|24 || u32? || Unknown || Always 2?<br />
|}<br />
<br />
==== Physical Format Information (PFI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x00<br />
<br />
Read from the Lead-In.<br />
<br />
PFI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || <code>booktype << 4 <nowiki>|</nowiki> part_version</code> || 4 bit each<br />
|-<br />
|1 || u8 || <code>disc_size << 4 <nowiki>|</nowiki> maximum_rate</code> || 4 bit each<br />
|-<br />
|2 || u8 || <code>number_of_layers << 5 <nowiki>|</nowiki> track_path << 4 <nowiki>|</nowiki> layer_type</code> || 1 bit padding, 2 bit, 1 bit, 4 bit<br />
|-<br />
|3 || u8 || <code>linear_density << 4 <nowiki>|</nowiki> track_density</code> || 4 bit each<br />
|-<br />
|4 || u8 || || Always zero<br />
|-<br />
|5 || u24 || Starting Physical Sector Number of Data Area ||<br />
|-<br />
|8 || u8 || || Always zero<br />
|-<br />
|9 || u24 || End Physical Sector Number of Data Area ||<br />
|-<br />
|12 || u8 || || Always zero<br />
|-<br />
|13 || u24 || End Sector Number in Layer 0 || Always 0x2033AF for original Xbox discs<br />
|}<br />
<br />
From [ftp://ftp.avc-pioneer.com/Mtfuji_5/Proposal/Jan01/RDVDSTRC.pdf] (page 4)<br />
<br />
==== Security Sectors (SS.bin) ====<br />
<br />
Challenge entry (11 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || Valid || Always 1 if the challenge is valid, else the challenge is ignored<br />
|-<br />
|1 || u8 || Challenge id ||<br />
|-<br />
|2 || u32 || Challenge value ||<br />
|-<br />
|6 || u8 || Response modifier || multimedia.cx says this might be a Response id. However, it's always 0 anyway?!<br />
|-<br />
|7 || u32 || Response value ||<br />
|}<br />
<br />
Security sector range (9 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|3 || u24 || Start PSN ||<br />
|-<br />
|6 || u24 || End PSN ||<br />
|}<br />
<br />
Unknown1 (44 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u64 || || Yet another timestamp?! (Similar to 1183 in complete format)<br />
|-<br />
|8 || u32 || || Unknown<br />
|-<br />
|27 || u8 || || Unknown<br />
|-<br />
|28 || u8[16] || || Unknown<br />
|}<br />
<br />
Complete format (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || PFI || Physical Format Information || PFI for the actual data, unknown size<br />
|-<br />
|720 || u32 || Unknown ||<br />
|-<br />
|768 || u8 || Version of challenge table || Always 1<br />
|-<br />
|769 || u8 || Number of challenge entries || Always 23<br />
|-<br />
|770 || Challenge entry[] || Encrypted challenge entries ||<br />
|-<br />
|1055 || u64 || || Some large number timestamp?<br />
|-<br />
|1083 || u8[16] || || Unknown<br />
|-<br />
|1183 || Unknown1 || || Unknown, this structure is SHA-1 hashed, to generate a RC4 key to decrypt challenge entries<br />
|-<br />
|1227 || u8[20] || SHA-1 hash A || Hash until here (of the complete format)<br />
|-<br />
|1247 || u8[256] || Signature A || For hash in previous field<br />
|-<br />
|1503 || Unknown1 || || Unknown<br />
|-<br />
|1547 || u8[20] || SHA-1 hash B || Hash until here (of the complete format)<br />
|-<br />
|1567 || u8[64] || Signature B || For hash in previous field (note that this is somewhat shorter than the other signature?!)<br />
|-<br />
! colspan="4" | End of data readable by a stock Xbox drive (1632 Bytes)<br />
|-<br />
|1632 || u8 || Number of security sector ranges || Always 23<br />
|-<br />
|1633 || Security sector range[] || Security sector ranges || Only 16 of which are used.<br />
|-<br />
|1840 || Security sector range[] || Security sector ranges || Only 16 of which are used. <br> ''(Copy from Offset 1633)''<br />
|}<br />
<br />
All other fields are assumed to be zero!<br />
<br />
===== Decryption of challenge entries =====<br />
<br />
Starting at offset 1183, a 44 byte SHA-1 hash is generated.<br />
The first 7 byte of the resulting hash are used as the key in RC4 decryption. The 253 Bytes of the challenge entries (Offset 770) will be decrypted.<br />
<br />
There'll only be a handful of valid entries in the challenge entries.<br />
However there'll be at least 2.<br />
<br />
=== Dumping ===<br />
<br />
To dump Xbox Game Discs you need one of the following drives / firmwares:<br />
<br />
{| class="wikitable"<br />
!Drive<br />
!Standard<br />
!Original Firmware download<br />
!Name of modified Firmware for dumping<br />
|-<br />
|{{FIXME|reason=Which drives?}}<br />
|<br />
|<br />
|<br />
* 0800{{citation needed}}<br />
|-<br />
|Toshiba SD-M2012C<br />
|IDE<br />
|<br />
|<br />
* Kreon{{citation needed}}<br />
|-<br />
|Samsung SH-D162C<br />
|IDE<br />
|[https://web.archive.org/web/20091206023615/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200506021808200872_SH-D162C_TS02.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ TS02] <br> [https://web.archive.org/web/20090604123608/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200509161625477201_SH-D162C_TS03.bin&path=/UploadFiles/FW/FWDOWNLOAD/KOR/ TS03<sup>Korean</sup>] <br> [https://web.archive.org/web/20091105003814/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200509261128121531_SH-D162C_TS03.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ TS03] <br> [https://web.archive.org/web/20100217012245/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200512221448334972_SH-D162C_TS04.bin&path=/UploadFiles/FW/FWDOWNLOAD/KOR/ TS04<sup>Korean</sup>] <br> [https://web.archive.org/web/20110920084807/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200701091709466301_SH-D162C_TS05.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ TS05]<br />
<br />
|rowspan=2 |<br />
* SB00 Kreon 0.60 (July 30th 2006)<br />
* SB00 Kreon 0.80 (September 9th 2006)<br />
* SB01 Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Toshiba TS-H352C<br />
|IDE<br />
|[https://web.archive.org/web/20110921065924/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200505121909111802_TS-H352C_SC00.bin&path=/UploadFiles/FW/FWDOWNLOAD/KOR/ SC00<sup>Korean</sup>]<br />
|-<br />
|Samsung SH-D162D<br />
|IDE<br />
|[https://web.archive.org/web/20090601193905/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200706281644411972_SH-D162D_SB00.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB00] <br> [https://web.archive.org/web/20090916202345/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200811051941150901_SH-D162D_SB01.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01] <br> SB02{{citation needed}}[http://www.firmwarehq.com/download_995-file_SH-D162D_SB02.exe.html unknown if safe or legit] <br> [https://web.archive.org/web/20090402052613/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191825218171_SH-D162D_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] <br> [https://web.archive.org/web/20120123040117/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200909281412336931_SH-D162D_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]<br />
|rowspan=2 |<br />
* SB00 Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H352D<br />
|IDE<br />
|CH01{{FIXME|reason=http://samsungodd.com/korLib/download.asp?no=200904281542399901_TS-H352D_CH01.exe&fname=200904281542399901_TS-H352D_CH01.exe&path=/chn/UploadFiles/FW/FWDOWNLOAD/ dead}} <br> CM01{{FIXME|reason=https://web.archive.org/web/20100105225621/http://samsungodd.com/korLib/download.asp?no=200904281539184301_TS-H352D_CM01.exe&fname=200904281539184301_TS-H352D_CM01.exe&path=/chn/UploadFiles/FW/FWDOWNLOAD/ dead}} <br> [https://web.archive.org/web/20100105234118/http://samsungodd.com/korLib/download.asp?no=200910081442017201_TS-H352D_CM02.exe&fname=200910081442017201_TS-H352D_CM02.exe&path=/chn/UploadFiles/FW/FWDOWNLOAD/ CM02]<br />
<br />
|-<br />
|Samsung SH-D163A<br />
|SATA<br />
|[http://web.archive.org/web/20090601191704/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200701031704489471_SH-D163A_SB01.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01]<br />
<br />
|rowspan=2 |<br />
* Kreon 0.80 (October 17th 2006)<br />
* SB01 Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Toshiba TS-H353A<br />
|SATA<br />
|<br />
|-<br />
|Samsung SH-D163B<br />
|SATA<br />
|[https://web.archive.org/web/20090402052540/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191824214901_SH-D163B_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] <br> [https://web.archive.org/web/20091204131429/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200910081448023301_SH-D163B_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]<br />
|rowspan=2 |<br />
* Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H353B<br />
|SATA<br />
|CH01{{FIXME|reason=https://web.archive.org/web/*/http://samsungodd.com/chn/globalLib/Download.asp?path=Info_FWDownload&fname=200904281544595271_TS-H353B_CH01.exe dead}}<br />
|}<br />
<br />
Please note that the modified firmwares are based on copyrighted material and can therefore not be legally shared here.<br />
Patch files to patch original firmwares into dumping-firmwares would be appreciated. <br />
<br />
Flashing software:<br />
<br />
* TSDNMAC for MacOS<br />
* [http://web.archive.org/web/20070301000000/http://www.samsungodd.com/KorLib/File/sfdnwin.exe SFDNWIN] for Microsoft Windows 2000 and XP<br />
* TSDNWIN for Microsoft Windows Vista and 7<br />
* Dell SFDNDOS and the newer TSDNDOS for Microsoft DOS<br />
<br />
For current dumping instructions see [http://forum.redump.org/topic/6073/xbox-1-360-dumping-instructions/ the Dumping Guide by the Redump Project].<br />
<br />
==== USB Adapters ====<br />
<br />
There are many USB-IDE/SATA adapters on the market. The following have been known to work well with the Kreon-compatible drives.<br />
<br />
{|class="wikitable"<br />
! Adapter Model / USB VID:DID<br />
! Drive Model<br />
! Notes<br />
|-<br />
| [https://www.amazon.de/gp/product/B016UBXH3O UGREEN USB 3.0 to SATA Adapter]<br />
<code>174c:55aa ASMedia Technology Inc.</code><br />
| SH-D163B/BEBE<br />
<code>H/W:A Ver.B SEPTEMBER 2008</code><br />
| Windows 10. No extra drivers required. Drive flashed. Works with DiscImageCreator.<br />
|-<br />
| [https://www.amazon.com/Sabrent-5-25-INCH-Converter-Activity-USB-DSC9/dp/B00DQJME7Y Sabrent USB-DSC9]<br />
<code>1f75:0611 Innostor Technology Corporation</code><br />
| SH-D162D/BEWE<br />
<code>H/W:A Ver.D JULY 2007</code><br />
| Ubuntu 18.04 host with VirtualBox WinXP VM. USB pass-thru of adapter. No extra drivers required. Drive flashed. Works with Xbox Backup Creator.<br />
|}<br />
<br />
=== Xbox related commands ===<br />
<br />
==== Enable Unlock 1 (xtreme) state ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 01</pre><br />
<br />
Enable Unlock 1 (xtreme) state' as we already know it from the 360 xtreme modded drives. <br />
This command is supported for legacy reasons only. Custom applications should use the new 'Set Lock State' instead.<br />
<br />
==== Set Lock State ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 11 xx</pre><br />
<br />
* <code>xx=00</code> - Drive locked (no unlock state)<br />
* <code>xx=01</code> - Unlock State 1 (xtreme) enabled<br />
* <code>xx=02</code> - Unlock state 2 (wxripper) enabled<br />
<br />
==== SS extract command ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>AD 00 FF 02 FD FF FE 00 08 00 xx C0</pre><br />
<br />
This is the well known from the xtreme firmware.<br />
<br />
==== Get Feature List ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 10</pre><br />
<br />
This command will return a list of the additional features supported by the drive.<br />
All values returned are 16 bit values, and the list is terminated with null (<code>0x0000</code>).<br />
The two first words of the returned list always reads as <code>0xA55A 0X5AA5</code> in order to guarantee that a reply from a drive not supporting this command correctly isn't mistaken for a feature list.<br />
<br />
An example feature list could be: <code>0xA55A, 0x5AA5, 0x0100, 0xF000, 0xF001, 0x0000</code><br />
<br />
This list would indicate that the drive supports XBOX360 Unlock 1, Lock and Error Skip, as it can be seen from the values defined below:<br />
<br />
XBOX 360 related features:<br />
<br />
* <code>0x0100</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0101</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0120</code> : The drive can read and decrypt the SS<br />
* <code>0x0121</code> : The drive has full challenge response functionality<br />
<br />
XBOX related features:<br />
<br />
* <code>0x0200</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0201</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0220</code> : The drive can read and decrypt the SS<br />
* <code>0x0221</code> : The drive has full challenge response functionality<br />
<br />
General drive features:<br />
<br />
* <code>0xF000</code> : The drive supports the lock (cancel any unlock state) command<br />
* <code>0xF001</code> : The drive supports error skipping<br />
<br />
This is the complete list of defined features at the moment. If you're working on a custom application you might want to contact me in order to get the latest list.<br />
<br />
== References and links == <br />
* [https://web.archive.org/web/20150616131202/http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf]<br />
* [https://multimedia.cx/eggs/xbox-sphinx-protocol/ Overview of the challenge/response security protocol]<br />
* [http://redump.org/discs/system/xbox/ Xbox Game Discs preserved by the Redump Project]<br />
* [http://wiki.redump.org/index.php?title=Discs_not_yet_dumped#Microsoft_Xbox Missing Xbox Game Disc dumps at Redump Project]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Xbox_Game_Disc&diff=6824Xbox Game Disc2020-01-20T03:53:25Z<p>JayFoxRox: Add more firmwares via https://web.archive.org/web/*/http://www.samsungodd.com/*</p>
<hr />
<div>Xbox games are shipped on DVDs. They are commonly referred to as Xbox Game Discs (XGD).<br />
<br />
== Visible information on ring ==<br />
<br />
'''The DVD inner ring usually contains:'''<br />
<br />
(The examples are from a German [[FIFA Soccer 2003]] disc)<br />
<br />
An outer portion with labels:<br />
* Outer ring Layer 1<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L1*)<br />
** Text for Mastering code ("EA02302E L1 02 0MM", where "02" is a smaller font and slightly higher than the previous baseline, followed by "0MM" on the original baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
* Inner ring for Layer 0<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L0*)<br />
** Text for Mastering code ("EA02302E L0 06", where "06" is a smaller font and slightly higher than the previous baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
<br />
An inner porition with Xbox logo:<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* 1 time "XBOX" text with blank background<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* Another tiny pattern segmented into 7 portions in alternating position,(opposite of the "XBOX" text without logo)<br />
** 4 times a Xbox logo <br />
** 2 times the word "genuine"<br />
** and in the middle the word ASPnnnn where n is a number{{citation needed}} <br />
<br />
''' ASP code '''<br />
[[File:Asp demodisk.jpg|thumb|right|Detail of the DVD hologram, reflecting the ASP5080 by the flash of the camera. found on a demodisk (IM00113E-IM)]]<br />
The following table lists known ASPnnnn numbers found on Xbox dvd disks, they are also on 360 disks but we dont list those in this wiki.<br />
The games listed are examples, its known for sure more disks can have these numbers and further research can be done, to determine the meaning.<br />
It is rumoured it might be a version string of some sorts slowly raising in xbox years old. {{citation needed}}<br />
{| class="wikitable"<br />
|-<br />
! ASP number<br />
! found on<br />
! game serial<br />
|-<br />
| ASP0180<br />
| Xbox Hardware Refresh Disc<br />
| XB01101W<br />
|-<br />
| ASP0380<br />
| Tom Clancy's Splinter Cell Exclusive Playable Demo<br />
| US01251E<br />
|-<br />
| ASP0980<br />
| Tom Clancy's Rainbow Six 3 DEMO DISC<br />
| US03152E-US<br />
|-<br />
| ASP5080<br />
| The official xbox 50 best games (Demo disk)<br />
| IM00113E-IM<br />
|-<br />
| ASP5180<br />
| Rayman 3 hoodlum havoc<br />
| <br />
|-<br />
| ASP5280<br />
| Xbox Music Mixer<br />
| MS09005A-MS<br />
|}<br />
<br />
== Dumps ==<br />
<br />
=== Files ===<br />
<br />
===== Example timestamps =====<br />
<br />
Timestamps for [[Petit Copter]]:<br />
<pre><br />
126779196239020000ULL, // XDVDFS timestamp<br />
126956823480700000ULL, // SS timestamp<br />
126957328439576418ULL, // SS unk3 timestamp<br />
126957649743869476ULL, // DMI Timestamp<br />
126961143392830592ULL, // SS unk4 timestamp<br />
</pre><br />
<br />
==== Disc Manufacturing Information (DMI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x04<br />
<br />
DMI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u32? || Unknown || Always 1?<br />
|-<br />
|4 || u32? || Unknown || Always zero?<br />
|-<br />
|8 || ascii_char[8] || Mastering Code || Example: EA02302E <br> Also see [[Xbe#Title_ID]]<br />
|-<br />
|16 || u64 || || Some timestamp?<br />
|-<br />
|24 || u32? || Unknown || Always 2?<br />
|}<br />
<br />
==== Physical Format Information (PFI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x00<br />
<br />
Read from the Lead-In.<br />
<br />
PFI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || <code>booktype << 4 <nowiki>|</nowiki> part_version</code> || 4 bit each<br />
|-<br />
|1 || u8 || <code>disc_size << 4 <nowiki>|</nowiki> maximum_rate</code> || 4 bit each<br />
|-<br />
|2 || u8 || <code>number_of_layers << 5 <nowiki>|</nowiki> track_path << 4 <nowiki>|</nowiki> layer_type</code> || 1 bit padding, 2 bit, 1 bit, 4 bit<br />
|-<br />
|3 || u8 || <code>linear_density << 4 <nowiki>|</nowiki> track_density</code> || 4 bit each<br />
|-<br />
|4 || u8 || || Always zero<br />
|-<br />
|5 || u24 || Starting Physical Sector Number of Data Area ||<br />
|-<br />
|8 || u8 || || Always zero<br />
|-<br />
|9 || u24 || End Physical Sector Number of Data Area ||<br />
|-<br />
|12 || u8 || || Always zero<br />
|-<br />
|13 || u24 || End Sector Number in Layer 0 || Always 0x2033AF for original Xbox discs<br />
|}<br />
<br />
From [ftp://ftp.avc-pioneer.com/Mtfuji_5/Proposal/Jan01/RDVDSTRC.pdf] (page 4)<br />
<br />
==== Security Sectors (SS.bin) ====<br />
<br />
Challenge entry (11 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || Valid || Always 1 if the challenge is valid, else the challenge is ignored<br />
|-<br />
|1 || u8 || Challenge id ||<br />
|-<br />
|2 || u32 || Challenge value ||<br />
|-<br />
|6 || u8 || Response modifier || multimedia.cx says this might be a Response id. However, it's always 0 anyway?!<br />
|-<br />
|7 || u32 || Response value ||<br />
|}<br />
<br />
Security sector range (9 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|3 || u24 || Start PSN ||<br />
|-<br />
|6 || u24 || End PSN ||<br />
|}<br />
<br />
Unknown1 (44 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u64 || || Yet another timestamp?! (Similar to 1183 in complete format)<br />
|-<br />
|8 || u32 || || Unknown<br />
|-<br />
|27 || u8 || || Unknown<br />
|-<br />
|28 || u8[16] || || Unknown<br />
|}<br />
<br />
Complete format (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || PFI || Physical Format Information || PFI for the actual data, unknown size<br />
|-<br />
|720 || u32 || Unknown ||<br />
|-<br />
|768 || u8 || Version of challenge table || Always 1<br />
|-<br />
|769 || u8 || Number of challenge entries || Always 23<br />
|-<br />
|770 || Challenge entry[] || Encrypted challenge entries ||<br />
|-<br />
|1055 || u64 || || Some large number timestamp?<br />
|-<br />
|1083 || u8[16] || || Unknown<br />
|-<br />
|1183 || Unknown1 || || Unknown, this structure is SHA-1 hashed, to generate a RC4 key to decrypt challenge entries<br />
|-<br />
|1227 || u8[20] || SHA-1 hash A || Hash until here (of the complete format)<br />
|-<br />
|1247 || u8[256] || Signature A || For hash in previous field<br />
|-<br />
|1503 || Unknown1 || || Unknown<br />
|-<br />
|1547 || u8[20] || SHA-1 hash B || Hash until here (of the complete format)<br />
|-<br />
|1567 || u8[64] || Signature B || For hash in previous field (note that this is somewhat shorter than the other signature?!)<br />
|-<br />
! colspan="4" | End of data readable by a stock Xbox drive (1632 Bytes)<br />
|-<br />
|1632 || u8 || Number of security sector ranges || Always 23<br />
|-<br />
|1633 || Security sector range[] || Security sector ranges || Only 16 of which are used.<br />
|-<br />
|1840 || Security sector range[] || Security sector ranges || Only 16 of which are used. <br> ''(Copy from Offset 1633)''<br />
|}<br />
<br />
All other fields are assumed to be zero!<br />
<br />
===== Decryption of challenge entries =====<br />
<br />
Starting at offset 1183, a 44 byte SHA-1 hash is generated.<br />
The first 7 byte of the resulting hash are used as the key in RC4 decryption. The 253 Bytes of the challenge entries (Offset 770) will be decrypted.<br />
<br />
There'll only be a handful of valid entries in the challenge entries.<br />
However there'll be at least 2.<br />
<br />
=== Dumping ===<br />
<br />
To dump Xbox Game Discs you need one of the following drives / firmwares:<br />
<br />
{| class="wikitable"<br />
!Drive<br />
!Standard<br />
!Original Firmware download<br />
!Name of modified Firmware for dumping<br />
|-<br />
|{{FIXME|reason=Which drives?}}<br />
|<br />
|<br />
|<br />
* 0800{{citation needed}}<br />
|-<br />
|Toshiba SD-M2012C<br />
|IDE<br />
|<br />
|<br />
* Kreon{{citation needed}}<br />
|-<br />
|Samsung SH-D162C<br />
|IDE<br />
|[https://web.archive.org/web/20091206023615/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200506021808200872_SH-D162C_TS02.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ TS02] <br> [https://web.archive.org/web/20090604123608/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200509161625477201_SH-D162C_TS03.bin&path=/UploadFiles/FW/FWDOWNLOAD/KOR/ TS03<sup>Korean</sup>] <br> [https://web.archive.org/web/20091105003814/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200509261128121531_SH-D162C_TS03.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ TS03] <br> [https://web.archive.org/web/20100217012245/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200512221448334972_SH-D162C_TS04.bin&path=/UploadFiles/FW/FWDOWNLOAD/KOR/ TS04<sup>Korean</sup>] <br> [https://web.archive.org/web/20110920084807/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200701091709466301_SH-D162C_TS05.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ TS05]<br />
<br />
|rowspan=2 |<br />
* SB00 Kreon 0.60 (July 30th 2006)<br />
* SB00 Kreon 0.80 (September 9th 2006)<br />
* SB01 Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Toshiba TS-H352C<br />
|IDE<br />
|[https://web.archive.org/web/20110921065924/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200505121909111802_TS-H352C_SC00.bin&path=/UploadFiles/FW/FWDOWNLOAD/KOR/ SC00<sup>Korean</sup>]<br />
|-<br />
|Samsung SH-D162D<br />
|IDE<br />
|[https://web.archive.org/web/20090601193905/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200706281644411972_SH-D162D_SB00.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB00] <br> [https://web.archive.org/web/20090916202345/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200811051941150901_SH-D162D_SB01.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01] <br> SB02{{citation needed}}[http://www.firmwarehq.com/download_995-file_SH-D162D_SB02.exe.html unknown if safe or legit] <br> [https://web.archive.org/web/20090402052613/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191825218171_SH-D162D_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] <br> [https://web.archive.org/web/20120123040117/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200909281412336931_SH-D162D_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]<br />
|rowspan=2 |<br />
* SB00 Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H352D<br />
|IDE<br />
|CH01{{FIXME|reason=http://samsungodd.com/korLib/download.asp?no=200904281542399901_TS-H352D_CH01.exe&fname=200904281542399901_TS-H352D_CH01.exe&path=/chn/UploadFiles/FW/FWDOWNLOAD/ dead}} <br> CM01{{FIXME|reason=https://web.archive.org/web/20100105225621/http://samsungodd.com/korLib/download.asp?no=200904281539184301_TS-H352D_CM01.exe&fname=200904281539184301_TS-H352D_CM01.exe&path=/chn/UploadFiles/FW/FWDOWNLOAD/ dead}} <br> [https://web.archive.org/web/20100105234118/http://samsungodd.com/korLib/download.asp?no=200910081442017201_TS-H352D_CM02.exe&fname=200910081442017201_TS-H352D_CM02.exe&path=/chn/UploadFiles/FW/FWDOWNLOAD/ CM02]<br />
<br />
|-<br />
|Samsung SH-D163A<br />
|SATA<br />
|[http://web.archive.org/web/20090601191704/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200701031704489471_SH-D163A_SB01.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01]<br />
<br />
|rowspan=2 |<br />
* Kreon 0.80 (October 17th 2006)<br />
* SB01 Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Toshiba TS-H353A<br />
|SATA<br />
|<br />
|-<br />
|Samsung SH-D163B<br />
|SATA<br />
|[https://web.archive.org/web/20090402052540/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191824214901_SH-D163B_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] <br> [https://web.archive.org/web/20091204131429/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200910081448023301_SH-D163B_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]<br />
|rowspan=2 |<br />
* Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H353B<br />
|SATA<br />
|[https://web.archive.org/web/*/http://samsungodd.com/chn/globalLib/Download.asp?path=Info_FWDownload&fname=200904281544595271_TS-H353B_CH01.exe CH01]<br />
|}<br />
<br />
Please note that the modified firmwares are based on copyrighted material and can therefore not be legally shared here.<br />
Patch files to patch original firmwares into dumping-firmwares would be appreciated. <br />
<br />
Flashing software:<br />
<br />
* TSDNMAC for MacOS<br />
* [http://web.archive.org/web/20070301000000/http://www.samsungodd.com/KorLib/File/sfdnwin.exe SFDNWIN] for Microsoft Windows 2000 and XP<br />
* TSDNWIN for Microsoft Windows Vista and 7<br />
* Dell SFDNDOS and the newer TSDNDOS for Microsoft DOS<br />
<br />
For current dumping instructions see [http://forum.redump.org/topic/6073/xbox-1-360-dumping-instructions/ the Dumping Guide by the Redump Project].<br />
<br />
==== USB Adapters ====<br />
<br />
There are many USB-IDE/SATA adapters on the market. The following have been known to work well with the Kreon-compatible drives.<br />
<br />
{|class="wikitable"<br />
! Adapter Model / USB VID:DID<br />
! Drive Model<br />
! Notes<br />
|-<br />
| [https://www.amazon.de/gp/product/B016UBXH3O UGREEN USB 3.0 to SATA Adapter]<br />
<code>174c:55aa ASMedia Technology Inc.</code><br />
| SH-D163B/BEBE<br />
<code>H/W:A Ver.B SEPTEMBER 2008</code><br />
| Windows 10. No extra drivers required. Drive flashed. Works with DiscImageCreator.<br />
|-<br />
| [https://www.amazon.com/Sabrent-5-25-INCH-Converter-Activity-USB-DSC9/dp/B00DQJME7Y Sabrent USB-DSC9]<br />
<code>1f75:0611 Innostor Technology Corporation</code><br />
| SH-D162D/BEWE<br />
<code>H/W:A Ver.D JULY 2007</code><br />
| Ubuntu 18.04 host with VirtualBox WinXP VM. USB pass-thru of adapter. No extra drivers required. Drive flashed. Works with Xbox Backup Creator.<br />
|}<br />
<br />
=== Xbox related commands ===<br />
<br />
==== Enable Unlock 1 (xtreme) state ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 01</pre><br />
<br />
Enable Unlock 1 (xtreme) state' as we already know it from the 360 xtreme modded drives. <br />
This command is supported for legacy reasons only. Custom applications should use the new 'Set Lock State' instead.<br />
<br />
==== Set Lock State ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 11 xx</pre><br />
<br />
* <code>xx=00</code> - Drive locked (no unlock state)<br />
* <code>xx=01</code> - Unlock State 1 (xtreme) enabled<br />
* <code>xx=02</code> - Unlock state 2 (wxripper) enabled<br />
<br />
==== SS extract command ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>AD 00 FF 02 FD FF FE 00 08 00 xx C0</pre><br />
<br />
This is the well known from the xtreme firmware.<br />
<br />
==== Get Feature List ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 10</pre><br />
<br />
This command will return a list of the additional features supported by the drive.<br />
All values returned are 16 bit values, and the list is terminated with null (<code>0x0000</code>).<br />
The two first words of the returned list always reads as <code>0xA55A 0X5AA5</code> in order to guarantee that a reply from a drive not supporting this command correctly isn't mistaken for a feature list.<br />
<br />
An example feature list could be: <code>0xA55A, 0x5AA5, 0x0100, 0xF000, 0xF001, 0x0000</code><br />
<br />
This list would indicate that the drive supports XBOX360 Unlock 1, Lock and Error Skip, as it can be seen from the values defined below:<br />
<br />
XBOX 360 related features:<br />
<br />
* <code>0x0100</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0101</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0120</code> : The drive can read and decrypt the SS<br />
* <code>0x0121</code> : The drive has full challenge response functionality<br />
<br />
XBOX related features:<br />
<br />
* <code>0x0200</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0201</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0220</code> : The drive can read and decrypt the SS<br />
* <code>0x0221</code> : The drive has full challenge response functionality<br />
<br />
General drive features:<br />
<br />
* <code>0xF000</code> : The drive supports the lock (cancel any unlock state) command<br />
* <code>0xF001</code> : The drive supports error skipping<br />
<br />
This is the complete list of defined features at the moment. If you're working on a custom application you might want to contact me in order to get the latest list.<br />
<br />
== References and links == <br />
* [https://web.archive.org/web/20150616131202/http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf]<br />
* [https://multimedia.cx/eggs/xbox-sphinx-protocol/ Overview of the challenge/response security protocol]<br />
* [http://redump.org/discs/system/xbox/ Xbox Game Discs preserved by the Redump Project]<br />
* [http://wiki.redump.org/index.php?title=Discs_not_yet_dumped#Microsoft_Xbox Missing Xbox Game Disc dumps at Redump Project]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Xbox_Game_Disc&diff=6823Xbox Game Disc2020-01-20T03:30:04Z<p>JayFoxRox: Undo previous change - those were SH-D162D links</p>
<hr />
<div>Xbox games are shipped on DVDs. They are commonly referred to as Xbox Game Discs (XGD).<br />
<br />
== Visible information on ring ==<br />
<br />
'''The DVD inner ring usually contains:'''<br />
<br />
(The examples are from a German [[FIFA Soccer 2003]] disc)<br />
<br />
An outer portion with labels:<br />
* Outer ring Layer 1<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L1*)<br />
** Text for Mastering code ("EA02302E L1 02 0MM", where "02" is a smaller font and slightly higher than the previous baseline, followed by "0MM" on the original baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
* Inner ring for Layer 0<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L0*)<br />
** Text for Mastering code ("EA02302E L0 06", where "06" is a smaller font and slightly higher than the previous baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
<br />
An inner porition with Xbox logo:<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* 1 time "XBOX" text with blank background<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* Another tiny pattern segmented into 7 portions in alternating position,(opposite of the "XBOX" text without logo)<br />
** 4 times a Xbox logo <br />
** 2 times the word "genuine"<br />
** and in the middle the word ASPnnnn where n is a number{{citation needed}} <br />
<br />
''' ASP code '''<br />
[[File:Asp demodisk.jpg|thumb|right|Detail of the DVD hologram, reflecting the ASP5080 by the flash of the camera. found on a demodisk (IM00113E-IM)]]<br />
The following table lists known ASPnnnn numbers found on Xbox dvd disks, they are also on 360 disks but we dont list those in this wiki.<br />
The games listed are examples, its known for sure more disks can have these numbers and further research can be done, to determine the meaning.<br />
It is rumoured it might be a version string of some sorts slowly raising in xbox years old. {{citation needed}}<br />
{| class="wikitable"<br />
|-<br />
! ASP number<br />
! found on<br />
! game serial<br />
|-<br />
| ASP0180<br />
| Xbox Hardware Refresh Disc<br />
| XB01101W<br />
|-<br />
| ASP0380<br />
| Tom Clancy's Splinter Cell Exclusive Playable Demo<br />
| US01251E<br />
|-<br />
| ASP0980<br />
| Tom Clancy's Rainbow Six 3 DEMO DISC<br />
| US03152E-US<br />
|-<br />
| ASP5080<br />
| The official xbox 50 best games (Demo disk)<br />
| IM00113E-IM<br />
|-<br />
| ASP5180<br />
| Rayman 3 hoodlum havoc<br />
| <br />
|-<br />
| ASP5280<br />
| Xbox Music Mixer<br />
| MS09005A-MS<br />
|}<br />
<br />
== Dumps ==<br />
<br />
=== Files ===<br />
<br />
===== Example timestamps =====<br />
<br />
Timestamps for [[Petit Copter]]:<br />
<pre><br />
126779196239020000ULL, // XDVDFS timestamp<br />
126956823480700000ULL, // SS timestamp<br />
126957328439576418ULL, // SS unk3 timestamp<br />
126957649743869476ULL, // DMI Timestamp<br />
126961143392830592ULL, // SS unk4 timestamp<br />
</pre><br />
<br />
==== Disc Manufacturing Information (DMI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x04<br />
<br />
DMI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u32? || Unknown || Always 1?<br />
|-<br />
|4 || u32? || Unknown || Always zero?<br />
|-<br />
|8 || ascii_char[8] || Mastering Code || Example: EA02302E <br> Also see [[Xbe#Title_ID]]<br />
|-<br />
|16 || u64 || || Some timestamp?<br />
|-<br />
|24 || u32? || Unknown || Always 2?<br />
|}<br />
<br />
==== Physical Format Information (PFI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x00<br />
<br />
Read from the Lead-In.<br />
<br />
PFI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || <code>booktype << 4 <nowiki>|</nowiki> part_version</code> || 4 bit each<br />
|-<br />
|1 || u8 || <code>disc_size << 4 <nowiki>|</nowiki> maximum_rate</code> || 4 bit each<br />
|-<br />
|2 || u8 || <code>number_of_layers << 5 <nowiki>|</nowiki> track_path << 4 <nowiki>|</nowiki> layer_type</code> || 1 bit padding, 2 bit, 1 bit, 4 bit<br />
|-<br />
|3 || u8 || <code>linear_density << 4 <nowiki>|</nowiki> track_density</code> || 4 bit each<br />
|-<br />
|4 || u8 || || Always zero<br />
|-<br />
|5 || u24 || Starting Physical Sector Number of Data Area ||<br />
|-<br />
|8 || u8 || || Always zero<br />
|-<br />
|9 || u24 || End Physical Sector Number of Data Area ||<br />
|-<br />
|12 || u8 || || Always zero<br />
|-<br />
|13 || u24 || End Sector Number in Layer 0 || Always 0x2033AF for original Xbox discs<br />
|}<br />
<br />
From [ftp://ftp.avc-pioneer.com/Mtfuji_5/Proposal/Jan01/RDVDSTRC.pdf] (page 4)<br />
<br />
==== Security Sectors (SS.bin) ====<br />
<br />
Challenge entry (11 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || Valid || Always 1 if the challenge is valid, else the challenge is ignored<br />
|-<br />
|1 || u8 || Challenge id ||<br />
|-<br />
|2 || u32 || Challenge value ||<br />
|-<br />
|6 || u8 || Response modifier || multimedia.cx says this might be a Response id. However, it's always 0 anyway?!<br />
|-<br />
|7 || u32 || Response value ||<br />
|}<br />
<br />
Security sector range (9 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|3 || u24 || Start PSN ||<br />
|-<br />
|6 || u24 || End PSN ||<br />
|}<br />
<br />
Unknown1 (44 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u64 || || Yet another timestamp?! (Similar to 1183 in complete format)<br />
|-<br />
|8 || u32 || || Unknown<br />
|-<br />
|27 || u8 || || Unknown<br />
|-<br />
|28 || u8[16] || || Unknown<br />
|}<br />
<br />
Complete format (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || PFI || Physical Format Information || PFI for the actual data, unknown size<br />
|-<br />
|720 || u32 || Unknown ||<br />
|-<br />
|768 || u8 || Version of challenge table || Always 1<br />
|-<br />
|769 || u8 || Number of challenge entries || Always 23<br />
|-<br />
|770 || Challenge entry[] || Encrypted challenge entries ||<br />
|-<br />
|1055 || u64 || || Some large number timestamp?<br />
|-<br />
|1083 || u8[16] || || Unknown<br />
|-<br />
|1183 || Unknown1 || || Unknown, this structure is SHA-1 hashed, to generate a RC4 key to decrypt challenge entries<br />
|-<br />
|1227 || u8[20] || SHA-1 hash A || Hash until here (of the complete format)<br />
|-<br />
|1247 || u8[256] || Signature A || For hash in previous field<br />
|-<br />
|1503 || Unknown1 || || Unknown<br />
|-<br />
|1547 || u8[20] || SHA-1 hash B || Hash until here (of the complete format)<br />
|-<br />
|1567 || u8[64] || Signature B || For hash in previous field (note that this is somewhat shorter than the other signature?!)<br />
|-<br />
! colspan="4" | End of data readable by a stock Xbox drive (1632 Bytes)<br />
|-<br />
|1632 || u8 || Number of security sector ranges || Always 23<br />
|-<br />
|1633 || Security sector range[] || Security sector ranges || Only 16 of which are used.<br />
|-<br />
|1840 || Security sector range[] || Security sector ranges || Only 16 of which are used. <br> ''(Copy from Offset 1633)''<br />
|}<br />
<br />
All other fields are assumed to be zero!<br />
<br />
===== Decryption of challenge entries =====<br />
<br />
Starting at offset 1183, a 44 byte SHA-1 hash is generated.<br />
The first 7 byte of the resulting hash are used as the key in RC4 decryption. The 253 Bytes of the challenge entries (Offset 770) will be decrypted.<br />
<br />
There'll only be a handful of valid entries in the challenge entries.<br />
However there'll be at least 2.<br />
<br />
=== Dumping ===<br />
<br />
To dump Xbox Game Discs you need one of the following drives / firmwares:<br />
<br />
{| class="wikitable"<br />
!Drive<br />
!Standard<br />
!Original Firmware download<br />
!Name of modified Firmware for dumping<br />
|-<br />
|{{FIXME|reason=Which drives?}}<br />
|<br />
|<br />
|<br />
* 0800{{citation needed}}<br />
|-<br />
|Toshiba SD-M2012C<br />
|IDE<br />
|<br />
|<br />
* Kreon{{citation needed}}<br />
|-<br />
|Samsung SH-D162C<br />
|IDE<br />
|<br />
|rowspan=2 |<br />
* SB00 Kreon 0.60 (July 30th 2006)<br />
* SB00 Kreon 0.80 (September 9th 2006)<br />
* SB01 Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Toshiba TS-H352C<br />
|IDE<br />
|<br />
|-<br />
|Samsung SH-D162D<br />
|IDE<br />
|[https://web.archive.org/web/20090601193905/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200706281644411972_SH-D162D_SB00.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB00] <br> [https://web.archive.org/web/20090916202345/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200811051941150901_SH-D162D_SB01.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01] <br> SB02{{citation needed}}[http://www.firmwarehq.com/download_995-file_SH-D162D_SB02.exe.html unknown if safe or legit] <br> [https://web.archive.org/web/20090402052613/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191825218171_SH-D162D_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] <br> [https://web.archive.org/web/20120123040117/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200909281412336931_SH-D162D_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]<br />
|rowspan=2 |<br />
* SB00 Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H352D<br />
|IDE<br />
|<br />
|-<br />
|Samsung SH-D163A<br />
|SATA<br />
|[http://web.archive.org/web/20090601191704/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200701031704489471_SH-D163A_SB01.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01]<br />
|rowspan=2 |<br />
* Kreon 0.80 (October 17th 2006)<br />
* SB01 Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Toshiba TS-H353A<br />
|SATA<br />
|<br />
|-<br />
|Samsung SH-D163B<br />
|SATA<br />
|<br />
|rowspan=2 |<br />
* Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H353B<br />
|SATA<br />
|<br />
|}<br />
<br />
Please note that the modified firmwares are based on copyrighted material and can therefore not be legally shared here.<br />
Patch files to patch original firmwares into dumping-firmwares would be appreciated. <br />
<br />
Flashing software:<br />
<br />
* TSDNMAC for MacOS<br />
* [http://web.archive.org/web/20070301000000/http://www.samsungodd.com/KorLib/File/sfdnwin.exe SFDNWIN] for Microsoft Windows 2000 and XP<br />
* TSDNWIN for Microsoft Windows Vista and 7<br />
* Dell SFDNDOS and the newer TSDNDOS for Microsoft DOS<br />
<br />
For current dumping instructions see [http://forum.redump.org/topic/6073/xbox-1-360-dumping-instructions/ the Dumping Guide by the Redump Project].<br />
<br />
==== USB Adapters ====<br />
<br />
There are many USB-IDE/SATA adapters on the market. The following have been known to work well with the Kreon-compatible drives.<br />
<br />
{|class="wikitable"<br />
! Adapter Model / USB VID:DID<br />
! Drive Model<br />
! Notes<br />
|-<br />
| [https://www.amazon.de/gp/product/B016UBXH3O UGREEN USB 3.0 to SATA Adapter]<br />
<code>174c:55aa ASMedia Technology Inc.</code><br />
| SH-D163B/BEBE<br />
<code>H/W:A Ver.B SEPTEMBER 2008</code><br />
| Windows 10. No extra drivers required. Drive flashed. Works with DiscImageCreator.<br />
|-<br />
| [https://www.amazon.com/Sabrent-5-25-INCH-Converter-Activity-USB-DSC9/dp/B00DQJME7Y Sabrent USB-DSC9]<br />
<code>1f75:0611 Innostor Technology Corporation</code><br />
| SH-D162D/BEWE<br />
<code>H/W:A Ver.D JULY 2007</code><br />
| Ubuntu 18.04 host with VirtualBox WinXP VM. USB pass-thru of adapter. No extra drivers required. Drive flashed. Works with Xbox Backup Creator.<br />
|}<br />
<br />
=== Xbox related commands ===<br />
<br />
==== Enable Unlock 1 (xtreme) state ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 01</pre><br />
<br />
Enable Unlock 1 (xtreme) state' as we already know it from the 360 xtreme modded drives. <br />
This command is supported for legacy reasons only. Custom applications should use the new 'Set Lock State' instead.<br />
<br />
==== Set Lock State ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 11 xx</pre><br />
<br />
* <code>xx=00</code> - Drive locked (no unlock state)<br />
* <code>xx=01</code> - Unlock State 1 (xtreme) enabled<br />
* <code>xx=02</code> - Unlock state 2 (wxripper) enabled<br />
<br />
==== SS extract command ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>AD 00 FF 02 FD FF FE 00 08 00 xx C0</pre><br />
<br />
This is the well known from the xtreme firmware.<br />
<br />
==== Get Feature List ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 10</pre><br />
<br />
This command will return a list of the additional features supported by the drive.<br />
All values returned are 16 bit values, and the list is terminated with null (<code>0x0000</code>).<br />
The two first words of the returned list always reads as <code>0xA55A 0X5AA5</code> in order to guarantee that a reply from a drive not supporting this command correctly isn't mistaken for a feature list.<br />
<br />
An example feature list could be: <code>0xA55A, 0x5AA5, 0x0100, 0xF000, 0xF001, 0x0000</code><br />
<br />
This list would indicate that the drive supports XBOX360 Unlock 1, Lock and Error Skip, as it can be seen from the values defined below:<br />
<br />
XBOX 360 related features:<br />
<br />
* <code>0x0100</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0101</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0120</code> : The drive can read and decrypt the SS<br />
* <code>0x0121</code> : The drive has full challenge response functionality<br />
<br />
XBOX related features:<br />
<br />
* <code>0x0200</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0201</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0220</code> : The drive can read and decrypt the SS<br />
* <code>0x0221</code> : The drive has full challenge response functionality<br />
<br />
General drive features:<br />
<br />
* <code>0xF000</code> : The drive supports the lock (cancel any unlock state) command<br />
* <code>0xF001</code> : The drive supports error skipping<br />
<br />
This is the complete list of defined features at the moment. If you're working on a custom application you might want to contact me in order to get the latest list.<br />
<br />
== References and links == <br />
* [https://web.archive.org/web/20150616131202/http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf]<br />
* [https://multimedia.cx/eggs/xbox-sphinx-protocol/ Overview of the challenge/response security protocol]<br />
* [http://redump.org/discs/system/xbox/ Xbox Game Discs preserved by the Redump Project]<br />
* [http://wiki.redump.org/index.php?title=Discs_not_yet_dumped#Microsoft_Xbox Missing Xbox Game Disc dumps at Redump Project]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Xbox_Game_Disc&diff=6822Xbox Game Disc2020-01-20T03:28:57Z<p>JayFoxRox: Add Samsung SH-D162C stock links</p>
<hr />
<div>Xbox games are shipped on DVDs. They are commonly referred to as Xbox Game Discs (XGD).<br />
<br />
== Visible information on ring ==<br />
<br />
'''The DVD inner ring usually contains:'''<br />
<br />
(The examples are from a German [[FIFA Soccer 2003]] disc)<br />
<br />
An outer portion with labels:<br />
* Outer ring Layer 1<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L1*)<br />
** Text for Mastering code ("EA02302E L1 02 0MM", where "02" is a smaller font and slightly higher than the previous baseline, followed by "0MM" on the original baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
* Inner ring for Layer 0<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L0*)<br />
** Text for Mastering code ("EA02302E L0 06", where "06" is a smaller font and slightly higher than the previous baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
<br />
An inner porition with Xbox logo:<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* 1 time "XBOX" text with blank background<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* Another tiny pattern segmented into 7 portions in alternating position,(opposite of the "XBOX" text without logo)<br />
** 4 times a Xbox logo <br />
** 2 times the word "genuine"<br />
** and in the middle the word ASPnnnn where n is a number{{citation needed}} <br />
<br />
''' ASP code '''<br />
[[File:Asp demodisk.jpg|thumb|right|Detail of the DVD hologram, reflecting the ASP5080 by the flash of the camera. found on a demodisk (IM00113E-IM)]]<br />
The following table lists known ASPnnnn numbers found on Xbox dvd disks, they are also on 360 disks but we dont list those in this wiki.<br />
The games listed are examples, its known for sure more disks can have these numbers and further research can be done, to determine the meaning.<br />
It is rumoured it might be a version string of some sorts slowly raising in xbox years old. {{citation needed}}<br />
{| class="wikitable"<br />
|-<br />
! ASP number<br />
! found on<br />
! game serial<br />
|-<br />
| ASP0180<br />
| Xbox Hardware Refresh Disc<br />
| XB01101W<br />
|-<br />
| ASP0380<br />
| Tom Clancy's Splinter Cell Exclusive Playable Demo<br />
| US01251E<br />
|-<br />
| ASP0980<br />
| Tom Clancy's Rainbow Six 3 DEMO DISC<br />
| US03152E-US<br />
|-<br />
| ASP5080<br />
| The official xbox 50 best games (Demo disk)<br />
| IM00113E-IM<br />
|-<br />
| ASP5180<br />
| Rayman 3 hoodlum havoc<br />
| <br />
|-<br />
| ASP5280<br />
| Xbox Music Mixer<br />
| MS09005A-MS<br />
|}<br />
<br />
== Dumps ==<br />
<br />
=== Files ===<br />
<br />
===== Example timestamps =====<br />
<br />
Timestamps for [[Petit Copter]]:<br />
<pre><br />
126779196239020000ULL, // XDVDFS timestamp<br />
126956823480700000ULL, // SS timestamp<br />
126957328439576418ULL, // SS unk3 timestamp<br />
126957649743869476ULL, // DMI Timestamp<br />
126961143392830592ULL, // SS unk4 timestamp<br />
</pre><br />
<br />
==== Disc Manufacturing Information (DMI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x04<br />
<br />
DMI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u32? || Unknown || Always 1?<br />
|-<br />
|4 || u32? || Unknown || Always zero?<br />
|-<br />
|8 || ascii_char[8] || Mastering Code || Example: EA02302E <br> Also see [[Xbe#Title_ID]]<br />
|-<br />
|16 || u64 || || Some timestamp?<br />
|-<br />
|24 || u32? || Unknown || Always 2?<br />
|}<br />
<br />
==== Physical Format Information (PFI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x00<br />
<br />
Read from the Lead-In.<br />
<br />
PFI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || <code>booktype << 4 <nowiki>|</nowiki> part_version</code> || 4 bit each<br />
|-<br />
|1 || u8 || <code>disc_size << 4 <nowiki>|</nowiki> maximum_rate</code> || 4 bit each<br />
|-<br />
|2 || u8 || <code>number_of_layers << 5 <nowiki>|</nowiki> track_path << 4 <nowiki>|</nowiki> layer_type</code> || 1 bit padding, 2 bit, 1 bit, 4 bit<br />
|-<br />
|3 || u8 || <code>linear_density << 4 <nowiki>|</nowiki> track_density</code> || 4 bit each<br />
|-<br />
|4 || u8 || || Always zero<br />
|-<br />
|5 || u24 || Starting Physical Sector Number of Data Area ||<br />
|-<br />
|8 || u8 || || Always zero<br />
|-<br />
|9 || u24 || End Physical Sector Number of Data Area ||<br />
|-<br />
|12 || u8 || || Always zero<br />
|-<br />
|13 || u24 || End Sector Number in Layer 0 || Always 0x2033AF for original Xbox discs<br />
|}<br />
<br />
From [ftp://ftp.avc-pioneer.com/Mtfuji_5/Proposal/Jan01/RDVDSTRC.pdf] (page 4)<br />
<br />
==== Security Sectors (SS.bin) ====<br />
<br />
Challenge entry (11 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || Valid || Always 1 if the challenge is valid, else the challenge is ignored<br />
|-<br />
|1 || u8 || Challenge id ||<br />
|-<br />
|2 || u32 || Challenge value ||<br />
|-<br />
|6 || u8 || Response modifier || multimedia.cx says this might be a Response id. However, it's always 0 anyway?!<br />
|-<br />
|7 || u32 || Response value ||<br />
|}<br />
<br />
Security sector range (9 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|3 || u24 || Start PSN ||<br />
|-<br />
|6 || u24 || End PSN ||<br />
|}<br />
<br />
Unknown1 (44 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u64 || || Yet another timestamp?! (Similar to 1183 in complete format)<br />
|-<br />
|8 || u32 || || Unknown<br />
|-<br />
|27 || u8 || || Unknown<br />
|-<br />
|28 || u8[16] || || Unknown<br />
|}<br />
<br />
Complete format (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || PFI || Physical Format Information || PFI for the actual data, unknown size<br />
|-<br />
|720 || u32 || Unknown ||<br />
|-<br />
|768 || u8 || Version of challenge table || Always 1<br />
|-<br />
|769 || u8 || Number of challenge entries || Always 23<br />
|-<br />
|770 || Challenge entry[] || Encrypted challenge entries ||<br />
|-<br />
|1055 || u64 || || Some large number timestamp?<br />
|-<br />
|1083 || u8[16] || || Unknown<br />
|-<br />
|1183 || Unknown1 || || Unknown, this structure is SHA-1 hashed, to generate a RC4 key to decrypt challenge entries<br />
|-<br />
|1227 || u8[20] || SHA-1 hash A || Hash until here (of the complete format)<br />
|-<br />
|1247 || u8[256] || Signature A || For hash in previous field<br />
|-<br />
|1503 || Unknown1 || || Unknown<br />
|-<br />
|1547 || u8[20] || SHA-1 hash B || Hash until here (of the complete format)<br />
|-<br />
|1567 || u8[64] || Signature B || For hash in previous field (note that this is somewhat shorter than the other signature?!)<br />
|-<br />
! colspan="4" | End of data readable by a stock Xbox drive (1632 Bytes)<br />
|-<br />
|1632 || u8 || Number of security sector ranges || Always 23<br />
|-<br />
|1633 || Security sector range[] || Security sector ranges || Only 16 of which are used.<br />
|-<br />
|1840 || Security sector range[] || Security sector ranges || Only 16 of which are used. <br> ''(Copy from Offset 1633)''<br />
|}<br />
<br />
All other fields are assumed to be zero!<br />
<br />
===== Decryption of challenge entries =====<br />
<br />
Starting at offset 1183, a 44 byte SHA-1 hash is generated.<br />
The first 7 byte of the resulting hash are used as the key in RC4 decryption. The 253 Bytes of the challenge entries (Offset 770) will be decrypted.<br />
<br />
There'll only be a handful of valid entries in the challenge entries.<br />
However there'll be at least 2.<br />
<br />
=== Dumping ===<br />
<br />
To dump Xbox Game Discs you need one of the following drives / firmwares:<br />
<br />
{| class="wikitable"<br />
!Drive<br />
!Standard<br />
!Original Firmware download<br />
!Name of modified Firmware for dumping<br />
|-<br />
|{{FIXME|reason=Which drives?}}<br />
|<br />
|<br />
|<br />
* 0800{{citation needed}}<br />
|-<br />
|Toshiba SD-M2012C<br />
|IDE<br />
|<br />
|<br />
* Kreon{{citation needed}}<br />
|-<br />
|Samsung SH-D162C<br />
|IDE<br />
|[https://web.archive.org/web/20090601193905/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200706281644411972_SH-D162D_SB00.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB00] <br> [https://web.archive.org/web/20090916202345/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200811051941150901_SH-D162D_SB01.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01] <br> SB02{{FIXME|reason=Link missing}} <br> [https://web.archive.org/web/20090402052613/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191825218171_SH-D162D_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] <br> [https://web.archive.org/web/20120123082109/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200909281412336931_SH-D162D_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]<br />
|rowspan=2 |<br />
* SB00 Kreon 0.60 (July 30th 2006)<br />
* SB00 Kreon 0.80 (September 9th 2006)<br />
* SB01 Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Toshiba TS-H352C<br />
|IDE<br />
|<br />
|-<br />
|Samsung SH-D162D<br />
|IDE<br />
|[https://web.archive.org/web/20090601193905/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200706281644411972_SH-D162D_SB00.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB00] <br> [https://web.archive.org/web/20090916202345/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200811051941150901_SH-D162D_SB01.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01] <br> SB02{{citation needed}}[http://www.firmwarehq.com/download_995-file_SH-D162D_SB02.exe.html unknown if safe or legit] <br> [https://web.archive.org/web/20090402052613/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191825218171_SH-D162D_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] <br> [https://web.archive.org/web/20120123040117/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200909281412336931_SH-D162D_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]<br />
|rowspan=2 |<br />
* SB00 Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H352D<br />
|IDE<br />
|<br />
|-<br />
|Samsung SH-D163A<br />
|SATA<br />
|[http://web.archive.org/web/20090601191704/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200701031704489471_SH-D163A_SB01.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01]<br />
|rowspan=2 |<br />
* Kreon 0.80 (October 17th 2006)<br />
* SB01 Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Toshiba TS-H353A<br />
|SATA<br />
|<br />
|-<br />
|Samsung SH-D163B<br />
|SATA<br />
|<br />
|rowspan=2 |<br />
* Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H353B<br />
|SATA<br />
|<br />
|}<br />
<br />
Please note that the modified firmwares are based on copyrighted material and can therefore not be legally shared here.<br />
Patch files to patch original firmwares into dumping-firmwares would be appreciated. <br />
<br />
Flashing software:<br />
<br />
* TSDNMAC for MacOS<br />
* [http://web.archive.org/web/20070301000000/http://www.samsungodd.com/KorLib/File/sfdnwin.exe SFDNWIN] for Microsoft Windows 2000 and XP<br />
* TSDNWIN for Microsoft Windows Vista and 7<br />
* Dell SFDNDOS and the newer TSDNDOS for Microsoft DOS<br />
<br />
For current dumping instructions see [http://forum.redump.org/topic/6073/xbox-1-360-dumping-instructions/ the Dumping Guide by the Redump Project].<br />
<br />
==== USB Adapters ====<br />
<br />
There are many USB-IDE/SATA adapters on the market. The following have been known to work well with the Kreon-compatible drives.<br />
<br />
{|class="wikitable"<br />
! Adapter Model / USB VID:DID<br />
! Drive Model<br />
! Notes<br />
|-<br />
| [https://www.amazon.de/gp/product/B016UBXH3O UGREEN USB 3.0 to SATA Adapter]<br />
<code>174c:55aa ASMedia Technology Inc.</code><br />
| SH-D163B/BEBE<br />
<code>H/W:A Ver.B SEPTEMBER 2008</code><br />
| Windows 10. No extra drivers required. Drive flashed. Works with DiscImageCreator.<br />
|-<br />
| [https://www.amazon.com/Sabrent-5-25-INCH-Converter-Activity-USB-DSC9/dp/B00DQJME7Y Sabrent USB-DSC9]<br />
<code>1f75:0611 Innostor Technology Corporation</code><br />
| SH-D162D/BEWE<br />
<code>H/W:A Ver.D JULY 2007</code><br />
| Ubuntu 18.04 host with VirtualBox WinXP VM. USB pass-thru of adapter. No extra drivers required. Drive flashed. Works with Xbox Backup Creator.<br />
|}<br />
<br />
=== Xbox related commands ===<br />
<br />
==== Enable Unlock 1 (xtreme) state ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 01</pre><br />
<br />
Enable Unlock 1 (xtreme) state' as we already know it from the 360 xtreme modded drives. <br />
This command is supported for legacy reasons only. Custom applications should use the new 'Set Lock State' instead.<br />
<br />
==== Set Lock State ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 11 xx</pre><br />
<br />
* <code>xx=00</code> - Drive locked (no unlock state)<br />
* <code>xx=01</code> - Unlock State 1 (xtreme) enabled<br />
* <code>xx=02</code> - Unlock state 2 (wxripper) enabled<br />
<br />
==== SS extract command ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>AD 00 FF 02 FD FF FE 00 08 00 xx C0</pre><br />
<br />
This is the well known from the xtreme firmware.<br />
<br />
==== Get Feature List ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 10</pre><br />
<br />
This command will return a list of the additional features supported by the drive.<br />
All values returned are 16 bit values, and the list is terminated with null (<code>0x0000</code>).<br />
The two first words of the returned list always reads as <code>0xA55A 0X5AA5</code> in order to guarantee that a reply from a drive not supporting this command correctly isn't mistaken for a feature list.<br />
<br />
An example feature list could be: <code>0xA55A, 0x5AA5, 0x0100, 0xF000, 0xF001, 0x0000</code><br />
<br />
This list would indicate that the drive supports XBOX360 Unlock 1, Lock and Error Skip, as it can be seen from the values defined below:<br />
<br />
XBOX 360 related features:<br />
<br />
* <code>0x0100</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0101</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0120</code> : The drive can read and decrypt the SS<br />
* <code>0x0121</code> : The drive has full challenge response functionality<br />
<br />
XBOX related features:<br />
<br />
* <code>0x0200</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0201</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0220</code> : The drive can read and decrypt the SS<br />
* <code>0x0221</code> : The drive has full challenge response functionality<br />
<br />
General drive features:<br />
<br />
* <code>0xF000</code> : The drive supports the lock (cancel any unlock state) command<br />
* <code>0xF001</code> : The drive supports error skipping<br />
<br />
This is the complete list of defined features at the moment. If you're working on a custom application you might want to contact me in order to get the latest list.<br />
<br />
== References and links == <br />
* [https://web.archive.org/web/20150616131202/http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf]<br />
* [https://multimedia.cx/eggs/xbox-sphinx-protocol/ Overview of the challenge/response security protocol]<br />
* [http://redump.org/discs/system/xbox/ Xbox Game Discs preserved by the Redump Project]<br />
* [http://wiki.redump.org/index.php?title=Discs_not_yet_dumped#Microsoft_Xbox Missing Xbox Game Disc dumps at Redump Project]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Resources&diff=6820Resources2020-01-04T02:14:27Z<p>JayFoxRox: Add AMD CubeMapGen link</p>
<hr />
<div>== Xbox Post-Mortems by developers ==<br />
<br />
=== Xbox Launch ===<br />
<br />
* GDC2002: [https://www.powershow.com/download/6f1ff7-NmE2O/Xbox_Launch_Lessons_Learned_powerpoint_ppt_presentation Xbox Launch: Lessons Learned] ([https://www.gdcvault.com/play/1022522/Xbox-Launch-Lessons Audio])<br />
<br />
=== Post processing ===<br />
<br />
* CEDEC2002: [https://web.archive.org/web/20031212044938/http://www.daionet.gr.jp/~masa/column/2002-09-22.html DOUBLE-S.T.E.A.L techniques] ''(Japanese)''<br />
* GDC2003: [https://web.archive.org/web/20031212140633/http://www.daionet.gr.jp/~masa/column/2003-03-21.html Frame Buffer Postprocessing Effects in DOUBLE-S.T.E.A.L (Wreckless)] ''(English)''<br />
<br />
=== HDR rendering ===<br />
<br />
* GDC2004: [https://web.archive.org/web/20060404103630/http://www.daionet.gr.jp/~masa/column/2004-04-04.html Practical Implementation of High Dynamic Range Rendering]<br />
<br />
=== Deferred Shading ===<br />
<br />
* https://sites.google.com/site/richgel99/index#TOC-Shrek-Xbox-and-Deferred-Shading<br />
* https://sites.google.com/site/richgel99/home<br />
* https://sites.google.com/site/richgel99/home/xbox-1-g-buffer-attribute-packing-pixel-shader<br />
* https://web.archive.org/web/20171008031141/http://www.tenacioussoftware.com/gdc_2004_deferred_shading.ppt<br />
<br />
== Random resources about Xbox hacking ==<br />
* [https://events.ccc.de/congress/2005/fahrplan/attachments/591-paper_xbox.pdf Michael Steils Xbox Presentation from C3 in 2005]<br />
* https://media.ccc.de/v/19C3-399-xbox-linux<br />
* https://media.ccc.de/v/22C3-559-en-xbox_hacking<br />
* https://www.youtube.com/watch?v=6fOjGLCctEY<br />
* [http://www.bunniestudios.com/bunnie/proj/anatak/xboxmod.html Bunnies original Xbox page]<br />
* [https://www.nostarch.com/xboxfree Bunnies "Hacking the Xbox" e-book for free]<br />
* [http://web.archive.org/web/20010417064218/ddj.com/articles/2000/0008/0008a/0008a.htm?topic=graphics Article about Xbox Graphics (before release) from Dr. Dobbs]<br />
* [http://www.anandtech.com/show/853 Technical article about the Xbox by AnandTech]<br />
<br />
== History ==<br />
* [https://www.youtube.com/watch?v=rUODlNffWmU 3 Xbox Bosses Share Secrets of the Console's Past (Video)]<br />
* [https://www.youtube.com/watch?v=iWQb7LGH71s Xbox Assembly Line Tour (Video)]<br />
* [https://www.youtube.com/watch?v=_gOoI57q72M XBox Oral History Panel with Nick Baker, Todd Holmdahl, and Albert Penello (Video)]<br />
* [https://www.youtube.com/watch?v=2VCb-y7MC5U?t=1248 Behind the Code - Interview with Nick Baker (Video) intresting xbox part starts 20:48]<br />
<br />
== Background knowledge about related topics ==<br />
<br />
=== Graphics programming ===<br />
<br />
* Meltdown 2001 (Microsoft Game development conference): [https://web.archive.org/web/20060203201117/https://www.microsoft.com/mscorp/corpevents/meltdown2001/presentations.asp Presentation slides]<br />
* GDC2001: [http://developer.download.nvidia.com/assets/gamedev/docs/GDC2K1_DX8_Pixel_Shaders.pdf DirectX8 Pixel Shaders]<br />
* [http://download.nvidia.com/developer/Papers/ Papers by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/presentations/ Presentation slides by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/movies/ Presentation recordings by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/NVTextureSuite/ Texturing tools by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/Tools/ Tools by nvidia from Xbox era]<br />
* http://download.nvidia.com/developer/Third_Party/<br />
* http://iquilezles.org/www/index.htm<br />
* https://web.archive.org/web/20150408045127/http://freespace.virgin.net/hugo.elias/<br />
* http://www.mvps.org/directx/indexes/<br />
* https://www.gdcvault.com/play/247/CRYSIS-Next-Gen ''(Contains some parts which are also applicable to original Xbox)''<br />
* [https://www.valvesoftware.com/en/publications Publications by Valve Software]<br />
* http://graphics.uni-konstanz.de/publikationen/Luft2006ImageEnhancementUnsharp/Luft2006ImageEnhancementUnsharp.pdf<br />
* [https://web.archive.org/web/20090518092325/http://www.daionet.gr.jp:80/~masa/column/index.html Masa's Column (DOUBLE-S.T.E.A.L / Wrecked developer)]<br />
* [https://fgiesen.wordpress.com/ Blog by ryg]<br />
* [http://filmicworlds.com/blog/ Filmic Worlds]<br />
* [https://gpuopen.com/archive/gamescgi/cubemapgen/ AMD CubeMapGen tool for mipmapping cubemaps]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=NV2A/Pixel_Combiner&diff=6819NV2A/Pixel Combiner2020-01-04T02:12:33Z<p>JayFoxRox: Add works by Disney</p>
<hr />
<div>== Data types ==<br />
<br />
NV_texture_shader suggests that: ''"The 8-bit and 16-bit signed fixed-point types are used for signed internal texture formats, while the 9-bit signed fixed-point type is used for register combiners computations."''<br />
Here is a table from the GL extension:<br />
<br />
{| class="wikitable"<br />
! floating-point !! 8-bit fixed-point !! 9-bit fixed-point !! 16-bit fixed-point<br />
|-<br />
| 1.0 || n/a || 255 || n/a <br />
|-<br />
| 0.99996... || n/a || n/a || 32767<br />
|-<br />
| 0.99218... || 127 || n/a || n/a <br />
|-<br />
| 0.0 || 0 || 0 || 0<br />
|-<br />
| -1.0 || -128 || -255 || -32768<br />
|-<br />
| -1.00392... || n/a || -256 || n/a<br />
|}<br />
<br />
This means:<br />
<br />
* 8-bit fixed-point: [-128, 127] &rarr; [-128/128, 127/128] &rarr; [-1.0, 0.99218...]<br />
* 9-bit fixed-point: [-256, 255] &rarr; [-256/255, 255/255] &rarr; [-1.00392..., 1.0]<br />
* 16-bit fixed-point: [-32768, 32767] &rarr; [-32768/32768, 32767/32768] &rarr; [-1.0, 0.99996...]<br />
<br />
It is not known if the NV2A really implements these 3 datatypes.<br />
It is also not yet known how exactly conversion or negation of these types would work.<br />
<br />
== Texture Shaders ==<br />
<br />
The NV2A implements at least parts of the following OpenGL extensions:<br />
<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader.txt NV_texture_shader]<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader2.txt NV_texture_shader2]<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader3.txt NV_texture_shader3]{{citation needed}}<br />
<br />
=== Texturing modes ===<br />
<br />
{|class="wikitable"<br />
!ID<br />
!Name<br />
!D3D name<br />
!GL Name<br />
!Stage 1<br />
!Stage 2<br />
!Stage 3<br />
!Stage 4<br />
!Notes<br />
|-<br />
|0x00<br />
|PS_TEXTUREMODES_NONE<br />
|<br />
|NONE<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x01<br />
|PS_TEXTUREMODES_PROJECT2D<br />
|tex<br />
|TEXTURE_2D<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x02<br />
|PS_TEXTUREMODES_PROJECT3D<br />
|tex<br />
|TEXTURE_3D<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x03<br />
|PS_TEXTUREMODES_CUBEMAP<br />
|tex<br />
|TEXTURE_CUBE_MAP_ARB<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x04<br />
|PS_TEXTUREMODES_PASSTHRU<br />
|texcoord<br />
|PASS_THROUGH_NV<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x05<br />
|PS_TEXTUREMODES_CLIPPLANE<br />
|texkill<br />
|CULL_FRAGMENT_NV<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x06<br />
|PS_TEXTUREMODES_BUMPENVMAP<br />
|texbem<br />
|OFFSET_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x07<br />
|PS_TEXTUREMODES_BUMPENVMAP_LUM<br />
|texbeml<br />
|OFFSET_TEXTURE_2D_SCALE_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x08<br />
|PS_TEXTUREMODES_BRDF<br />
|texbrdf<br />
|<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x09<br />
|PS_TEXTUREMODES_DOT_ST<br />
|texm3x2tex<br />
|DOT_PRODUCT_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0A<br />
|PS_TEXTUREMODES_DOT_ZW<br />
|texm3x2depth<br />
|DOT_PRODUCT_DEPTH_REPLACE_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0B<br />
|PS_TEXTUREMODES_DOT_RFLCT_DIFF<br />
|texm3x3diff<br />
|DOT_PRODUCT_DIFFUSE_CUBE_MAP_NV{{citation needed}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{no}}<br />
|<br />
|-<br />
|0x0C<br />
|PS_TEXTUREMODES_DOT_RFLCT_SPEC<br />
|texm3x3vspec<br />
|DOT_PRODUCT_CONST_EYE_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0D<br />
|PS_TEXTUREMODES_DOT_STR_3D<br />
|texm3x3tex<br />
|DOT_PRODUCT_TEXTURE_3D_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0E<br />
|PS_TEXTUREMODES_DOT_STR_CUBE<br />
|texm3x3vspec<br />
|DOT_PRODUCT_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0F<br />
|PS_TEXTUREMODES_DPNDNT_AR<br />
|texreg2ar<br />
|DEPENDENT_AR_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x10<br />
|PS_TEXTUREMODES_DPNDNT_GB<br />
|texreg2gb<br />
|DEPENDENT_GB_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x11<br />
|PS_TEXTUREMODES_DOTPRODUCT<br />
|texm3x3pad<br>texm3x2pad<br />
|DOT_PRODUCT_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{no}}<br />
|<br />
|-<br />
|0x12<br />
|PS_TEXTUREMODES_DOT_RFLCT_SPEC_CONST<br />
|texm3x3spec<br />
|DOT_PRODUCT_CONST_EYE_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|}<br />
<br />
=== 0x08: PS_TEXTUREMODES_BRDF / texbrdf ===<br />
<br />
The BRDF texture shader is probably only exposed on original Xbox, but not in standard OpenGL or D3D drivers.<br />
<br />
These are some generic resources about BRDFs:<br />
<br />
* [http://www.disneyanimation.com/technology/brdf.html Walt Disney BRDF Explorer]<br />
* [https://disney-animation.s3.amazonaws.com/library/s2012_pbs_disney_brdf_notes_v2.pdf Walt Disney BRDF Paper]<br />
* [https://math.nist.gov/~FHunt/appearance/brdf.html Collection of BRDF information]<br />
* [http://www-graphics.stanford.edu/~smr/brdf/bv/ BRDF viewer]{{FIXME|reason=Find alternative; this one is hard to compile}}<br />
* [https://www.merl.com/brdf/ BRDF Database by Mitsubishi]<br />
<br />
* nvidia resources ''(The code and technique is probably not using the texture shader that is described here)'':<br />
** [http://www.nvidia.in/attach/6670 BRDFs.pdf] / [http://www.nvidia.in/attach/6669 BRDFs.ppt]<br />
** [https://www.nvidia.com/attach/6568 BRDFIntro.pdf] / [https://www.nvidia.com/attach/6569 BRDFIntro.doc]<br />
** [https://www.nvidia.co.uk/attach/6567 BRDFSeparable.pdf] / [https://www.nvidia.com/attach/6566 BRDFSeparable.doc]<br />
** [https://www.nvidia.com/attach/6570 brdfseparate.zip]<br />
** [https://www.nvidia.com/attach/6571 brdfview.zip]<br />
<br />
{{FIXME|reason=Describe Xbox specific BRDF texture shader}}<br />
<br />
== Register combiners ==<br />
<br />
The NV2A implements at least parts of the following OpenGL extensions:<br />
<br />
* [https://www.opengl.org/registry/specs/NV/register_combiners.txt NV_register_combiners]<br />
* [https://www.opengl.org/registry/specs/NV/register_combiners2.txt NV_register_combiners2]<br />
<br />
There's some additional features and oddities.<br />
<br />
=== DISCARD and ZERO are the same register ===<br />
<br />
On NV2A the DISCARD and ZERO register are the same index: writes are discarded / reads return zero.<br />
<br />
This is different from NV_register_combiners where 2 different constants are used.<br />
<br />
=== Encoding of input swizzle ===<br />
<br />
NV2A uses a single ALPHA flag to specify the swizzle of inputs:<br />
* 0 for <code>.rgb</code> (RGB portion only) and <code>.b</code> (ALPHA portion only).<br />
* 1 for <code>.aaa</code> (RGB portion only) and <code>.a</code> (ALPHA portion only).<br />
<br />
This is different from NV_register_combiners where each swizzle has its own constant.<br />
<br />
=== Per stage constant-colors ===<br />
<br />
The combiner setup switches between using the same <code>const0</code> and <code>const1</code> for all stages (<code>FACTOR#_SAME_FACTOR_ALL</code>), or using different constant-colors per stage (<code>FACTOR#_EACH_STAGE</code>).<br />
<br />
On NV2A, the final-combiner does always have unique constants (even using <code>FACTOR#_SAME_FACTOR_ALL</code>) from all other stages.<br />
If <code>FACTOR#_SAME_FACTOR_ALL</code> is used, the constant-colors for all other stages are taken from the very first stage.<br />
This setting can be controlled independently for <code>const0</code> and <code>const1</code>.<br />
<br />
This is different from NV_register_combiners2. If that GL extension isn't available / enabled, then the constants are shared between general combiner stages and the final combiner (which doesn't have unique colors then). Additionally, the GL extension can only control this for both constant-colors at the same time.<br />
<br />
=== Encoding of constant-colors ===<br />
<br />
On NV2A, the constant-colors are encoded as 8-bit unsigned int values, packed into a 32-bit ARGB value (<code>(a<<24 | r<<16 | g<<8 | b)</code>).<br />
<br />
This is different from NV_register_combiners where constant-colors are specified as floats in RGBA format.<br />
<br />
=== BLUETOALPHA in RGB portion ===<br />
<br />
NV2A has a special flag to write the blue result (RGB portion) of the A/B and C/D computations to the alpha channel of the RGB portion output register. There's no such option for the AB/CD result.<br />
{{FIXME|reason=Document specifics, tests proposed on https://github.com/JayFoxRox/nxdk/pull/33}}<br />
<br />
This feature isn't available in GL, probably.<br />
This is different from NV_register_combiners where the RGB portion always writes to <code>.rgb</code> of the output.<br />
<br />
=== Special "or" operation (MUX) modifier ===<br />
<br />
NV2A has a special flag to switch between MSB and LSB{{FIXME|reason=Unconfirmed / untested - doesn't make a lot of sense}} for the special "or" operation (MUX).<br />
{{FIXME|reason=Check the comparison type}}<br />
<br />
This feature isn't available in GL, probably.<br />
This is different from NV_register_combiners where the special "or" operation (MUX) is always doing: <code>spare0_alpha >= 0.5 ? C*D : A*B</code>.<br />
<br />
== Debugging ==<br />
<br />
PIX from the Microsoft XDK provides great debugging capabilities.<br />
<br />
=== References and links ===<br />
<br />
* [http://developer.download.nvidia.com/assets/gamedev/docs/ProgrammableTextureBlending.pdf Overview about programmable texture blending] <!-- Mirror: https://www.nvidia.com/object/programmable_texture_blending.html --><br />
* [http://developer.download.nvidia.com/assets/gamedev/docs/combiners.pdf Overview of register combiners]<br />
* [https://github.com/XboxDev/nxdk/blob/77b5de45f0c64e70f2ff68248873448d5edccc71/tools/fp20compiler/ps1.0_program.cpp#L227 Code from nvparse (NVIDIA SDK 9.52) in nxdk, which handles shader to OpenGL conversion]<br />
* http://developer.download.nvidia.com/assets/gamedev/docs/GDC2K1_DX8_Pixel_Shaders.pdf<br />
<br />
[[Category:NV2A]]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Resources&diff=6818Resources2020-01-03T21:49:11Z<p>JayFoxRox: Add Filmic Worlds as graphics resource</p>
<hr />
<div>== Xbox Post-Mortems by developers ==<br />
<br />
=== Xbox Launch ===<br />
<br />
* GDC2002: [https://www.powershow.com/download/6f1ff7-NmE2O/Xbox_Launch_Lessons_Learned_powerpoint_ppt_presentation Xbox Launch: Lessons Learned] ([https://www.gdcvault.com/play/1022522/Xbox-Launch-Lessons Audio])<br />
<br />
=== Post processing ===<br />
<br />
* CEDEC2002: [https://web.archive.org/web/20031212044938/http://www.daionet.gr.jp/~masa/column/2002-09-22.html DOUBLE-S.T.E.A.L techniques] ''(Japanese)''<br />
* GDC2003: [https://web.archive.org/web/20031212140633/http://www.daionet.gr.jp/~masa/column/2003-03-21.html Frame Buffer Postprocessing Effects in DOUBLE-S.T.E.A.L (Wreckless)] ''(English)''<br />
<br />
=== HDR rendering ===<br />
<br />
* GDC2004: [https://web.archive.org/web/20060404103630/http://www.daionet.gr.jp/~masa/column/2004-04-04.html Practical Implementation of High Dynamic Range Rendering]<br />
<br />
=== Deferred Shading ===<br />
<br />
* https://sites.google.com/site/richgel99/index#TOC-Shrek-Xbox-and-Deferred-Shading<br />
* https://sites.google.com/site/richgel99/home<br />
* https://sites.google.com/site/richgel99/home/xbox-1-g-buffer-attribute-packing-pixel-shader<br />
* https://web.archive.org/web/20171008031141/http://www.tenacioussoftware.com/gdc_2004_deferred_shading.ppt<br />
<br />
== Random resources about Xbox hacking ==<br />
* [https://events.ccc.de/congress/2005/fahrplan/attachments/591-paper_xbox.pdf Michael Steils Xbox Presentation from C3 in 2005]<br />
* https://media.ccc.de/v/19C3-399-xbox-linux<br />
* https://media.ccc.de/v/22C3-559-en-xbox_hacking<br />
* https://www.youtube.com/watch?v=6fOjGLCctEY<br />
* [http://www.bunniestudios.com/bunnie/proj/anatak/xboxmod.html Bunnies original Xbox page]<br />
* [https://www.nostarch.com/xboxfree Bunnies "Hacking the Xbox" e-book for free]<br />
* [http://web.archive.org/web/20010417064218/ddj.com/articles/2000/0008/0008a/0008a.htm?topic=graphics Article about Xbox Graphics (before release) from Dr. Dobbs]<br />
* [http://www.anandtech.com/show/853 Technical article about the Xbox by AnandTech]<br />
<br />
== History ==<br />
* [https://www.youtube.com/watch?v=rUODlNffWmU 3 Xbox Bosses Share Secrets of the Console's Past (Video)]<br />
* [https://www.youtube.com/watch?v=iWQb7LGH71s Xbox Assembly Line Tour (Video)]<br />
* [https://www.youtube.com/watch?v=_gOoI57q72M XBox Oral History Panel with Nick Baker, Todd Holmdahl, and Albert Penello (Video)]<br />
* [https://www.youtube.com/watch?v=2VCb-y7MC5U?t=1248 Behind the Code - Interview with Nick Baker (Video) intresting xbox part starts 20:48]<br />
<br />
== Background knowledge about related topics ==<br />
<br />
=== Graphics programming ===<br />
<br />
* Meltdown 2001 (Microsoft Game development conference): [https://web.archive.org/web/20060203201117/https://www.microsoft.com/mscorp/corpevents/meltdown2001/presentations.asp Presentation slides]<br />
* GDC2001: [http://developer.download.nvidia.com/assets/gamedev/docs/GDC2K1_DX8_Pixel_Shaders.pdf DirectX8 Pixel Shaders]<br />
* [http://download.nvidia.com/developer/Papers/ Papers by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/presentations/ Presentation slides by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/movies/ Presentation recordings by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/NVTextureSuite/ Texturing tools by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/Tools/ Tools by nvidia from Xbox era]<br />
* http://download.nvidia.com/developer/Third_Party/<br />
* http://iquilezles.org/www/index.htm<br />
* https://web.archive.org/web/20150408045127/http://freespace.virgin.net/hugo.elias/<br />
* http://www.mvps.org/directx/indexes/<br />
* https://www.gdcvault.com/play/247/CRYSIS-Next-Gen ''(Contains some parts which are also applicable to original Xbox)''<br />
* [https://www.valvesoftware.com/en/publications Publications by Valve Software]<br />
* http://graphics.uni-konstanz.de/publikationen/Luft2006ImageEnhancementUnsharp/Luft2006ImageEnhancementUnsharp.pdf<br />
* [https://web.archive.org/web/20090518092325/http://www.daionet.gr.jp:80/~masa/column/index.html Masa's Column (DOUBLE-S.T.E.A.L / Wrecked developer)]<br />
* [https://fgiesen.wordpress.com/ Blog by ryg]<br />
* [http://filmicworlds.com/blog/ Filmic Worlds]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=NV2A/Pixel_Combiner&diff=6817NV2A/Pixel Combiner2020-01-01T20:58:59Z<p>JayFoxRox: BRDFSeparable.pdf currently not available through nvidia.com; use nvidia.co.uk</p>
<hr />
<div>== Data types ==<br />
<br />
NV_texture_shader suggests that: ''"The 8-bit and 16-bit signed fixed-point types are used for signed internal texture formats, while the 9-bit signed fixed-point type is used for register combiners computations."''<br />
Here is a table from the GL extension:<br />
<br />
{| class="wikitable"<br />
! floating-point !! 8-bit fixed-point !! 9-bit fixed-point !! 16-bit fixed-point<br />
|-<br />
| 1.0 || n/a || 255 || n/a <br />
|-<br />
| 0.99996... || n/a || n/a || 32767<br />
|-<br />
| 0.99218... || 127 || n/a || n/a <br />
|-<br />
| 0.0 || 0 || 0 || 0<br />
|-<br />
| -1.0 || -128 || -255 || -32768<br />
|-<br />
| -1.00392... || n/a || -256 || n/a<br />
|}<br />
<br />
This means:<br />
<br />
* 8-bit fixed-point: [-128, 127] &rarr; [-128/128, 127/128] &rarr; [-1.0, 0.99218...]<br />
* 9-bit fixed-point: [-256, 255] &rarr; [-256/255, 255/255] &rarr; [-1.00392..., 1.0]<br />
* 16-bit fixed-point: [-32768, 32767] &rarr; [-32768/32768, 32767/32768] &rarr; [-1.0, 0.99996...]<br />
<br />
It is not known if the NV2A really implements these 3 datatypes.<br />
It is also not yet known how exactly conversion or negation of these types would work.<br />
<br />
== Texture Shaders ==<br />
<br />
The NV2A implements at least parts of the following OpenGL extensions:<br />
<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader.txt NV_texture_shader]<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader2.txt NV_texture_shader2]<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader3.txt NV_texture_shader3]{{citation needed}}<br />
<br />
=== Texturing modes ===<br />
<br />
{|class="wikitable"<br />
!ID<br />
!Name<br />
!D3D name<br />
!GL Name<br />
!Stage 1<br />
!Stage 2<br />
!Stage 3<br />
!Stage 4<br />
!Notes<br />
|-<br />
|0x00<br />
|PS_TEXTUREMODES_NONE<br />
|<br />
|NONE<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x01<br />
|PS_TEXTUREMODES_PROJECT2D<br />
|tex<br />
|TEXTURE_2D<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x02<br />
|PS_TEXTUREMODES_PROJECT3D<br />
|tex<br />
|TEXTURE_3D<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x03<br />
|PS_TEXTUREMODES_CUBEMAP<br />
|tex<br />
|TEXTURE_CUBE_MAP_ARB<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x04<br />
|PS_TEXTUREMODES_PASSTHRU<br />
|texcoord<br />
|PASS_THROUGH_NV<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x05<br />
|PS_TEXTUREMODES_CLIPPLANE<br />
|texkill<br />
|CULL_FRAGMENT_NV<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x06<br />
|PS_TEXTUREMODES_BUMPENVMAP<br />
|texbem<br />
|OFFSET_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x07<br />
|PS_TEXTUREMODES_BUMPENVMAP_LUM<br />
|texbeml<br />
|OFFSET_TEXTURE_2D_SCALE_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x08<br />
|PS_TEXTUREMODES_BRDF<br />
|texbrdf<br />
|<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x09<br />
|PS_TEXTUREMODES_DOT_ST<br />
|texm3x2tex<br />
|DOT_PRODUCT_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0A<br />
|PS_TEXTUREMODES_DOT_ZW<br />
|texm3x2depth<br />
|DOT_PRODUCT_DEPTH_REPLACE_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0B<br />
|PS_TEXTUREMODES_DOT_RFLCT_DIFF<br />
|texm3x3diff<br />
|DOT_PRODUCT_DIFFUSE_CUBE_MAP_NV{{citation needed}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{no}}<br />
|<br />
|-<br />
|0x0C<br />
|PS_TEXTUREMODES_DOT_RFLCT_SPEC<br />
|texm3x3vspec<br />
|DOT_PRODUCT_CONST_EYE_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0D<br />
|PS_TEXTUREMODES_DOT_STR_3D<br />
|texm3x3tex<br />
|DOT_PRODUCT_TEXTURE_3D_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0E<br />
|PS_TEXTUREMODES_DOT_STR_CUBE<br />
|texm3x3vspec<br />
|DOT_PRODUCT_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0F<br />
|PS_TEXTUREMODES_DPNDNT_AR<br />
|texreg2ar<br />
|DEPENDENT_AR_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x10<br />
|PS_TEXTUREMODES_DPNDNT_GB<br />
|texreg2gb<br />
|DEPENDENT_GB_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x11<br />
|PS_TEXTUREMODES_DOTPRODUCT<br />
|texm3x3pad<br>texm3x2pad<br />
|DOT_PRODUCT_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{no}}<br />
|<br />
|-<br />
|0x12<br />
|PS_TEXTUREMODES_DOT_RFLCT_SPEC_CONST<br />
|texm3x3spec<br />
|DOT_PRODUCT_CONST_EYE_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|}<br />
<br />
=== 0x08: PS_TEXTUREMODES_BRDF / texbrdf ===<br />
<br />
The BRDF texture shader is probably only exposed on original Xbox, but not in standard OpenGL or D3D drivers.<br />
<br />
These are some generic resources about BRDFs:<br />
<br />
* [https://math.nist.gov/~FHunt/appearance/brdf.html Collection of BRDF information]<br />
* [http://www-graphics.stanford.edu/~smr/brdf/bv/ BRDF viewer]{{FIXME|reason=Find alternative; this one is hard to compile}}<br />
* [https://www.merl.com/brdf/ BRDF Database by Mitsubishi]<br />
<br />
* nvidia resources ''(The code and technique is probably not using the texture shader that is described here)'':<br />
** [http://www.nvidia.in/attach/6670 BRDFs.pdf] / [http://www.nvidia.in/attach/6669 BRDFs.ppt]<br />
** [https://www.nvidia.com/attach/6568 BRDFIntro.pdf] / [https://www.nvidia.com/attach/6569 BRDFIntro.doc]<br />
** [https://www.nvidia.co.uk/attach/6567 BRDFSeparable.pdf] / [https://www.nvidia.com/attach/6566 BRDFSeparable.doc]<br />
** [https://www.nvidia.com/attach/6570 brdfseparate.zip]<br />
** [https://www.nvidia.com/attach/6571 brdfview.zip]<br />
<br />
{{FIXME|reason=Describe Xbox specific BRDF texture shader}}<br />
<br />
== Register combiners ==<br />
<br />
The NV2A implements at least parts of the following OpenGL extensions:<br />
<br />
* [https://www.opengl.org/registry/specs/NV/register_combiners.txt NV_register_combiners]<br />
* [https://www.opengl.org/registry/specs/NV/register_combiners2.txt NV_register_combiners2]<br />
<br />
There's some additional features and oddities.<br />
<br />
=== DISCARD and ZERO are the same register ===<br />
<br />
On NV2A the DISCARD and ZERO register are the same index: writes are discarded / reads return zero.<br />
<br />
This is different from NV_register_combiners where 2 different constants are used.<br />
<br />
=== Encoding of input swizzle ===<br />
<br />
NV2A uses a single ALPHA flag to specify the swizzle of inputs:<br />
* 0 for <code>.rgb</code> (RGB portion only) and <code>.b</code> (ALPHA portion only).<br />
* 1 for <code>.aaa</code> (RGB portion only) and <code>.a</code> (ALPHA portion only).<br />
<br />
This is different from NV_register_combiners where each swizzle has its own constant.<br />
<br />
=== Per stage constant-colors ===<br />
<br />
The combiner setup switches between using the same <code>const0</code> and <code>const1</code> for all stages (<code>FACTOR#_SAME_FACTOR_ALL</code>), or using different constant-colors per stage (<code>FACTOR#_EACH_STAGE</code>).<br />
<br />
On NV2A, the final-combiner does always have unique constants (even using <code>FACTOR#_SAME_FACTOR_ALL</code>) from all other stages.<br />
If <code>FACTOR#_SAME_FACTOR_ALL</code> is used, the constant-colors for all other stages are taken from the very first stage.<br />
This setting can be controlled independently for <code>const0</code> and <code>const1</code>.<br />
<br />
This is different from NV_register_combiners2. If that GL extension isn't available / enabled, then the constants are shared between general combiner stages and the final combiner (which doesn't have unique colors then). Additionally, the GL extension can only control this for both constant-colors at the same time.<br />
<br />
=== Encoding of constant-colors ===<br />
<br />
On NV2A, the constant-colors are encoded as 8-bit unsigned int values, packed into a 32-bit ARGB value (<code>(a<<24 | r<<16 | g<<8 | b)</code>).<br />
<br />
This is different from NV_register_combiners where constant-colors are specified as floats in RGBA format.<br />
<br />
=== BLUETOALPHA in RGB portion ===<br />
<br />
NV2A has a special flag to write the blue result (RGB portion) of the A/B and C/D computations to the alpha channel of the RGB portion output register. There's no such option for the AB/CD result.<br />
{{FIXME|reason=Document specifics, tests proposed on https://github.com/JayFoxRox/nxdk/pull/33}}<br />
<br />
This feature isn't available in GL, probably.<br />
This is different from NV_register_combiners where the RGB portion always writes to <code>.rgb</code> of the output.<br />
<br />
=== Special "or" operation (MUX) modifier ===<br />
<br />
NV2A has a special flag to switch between MSB and LSB{{FIXME|reason=Unconfirmed / untested - doesn't make a lot of sense}} for the special "or" operation (MUX).<br />
{{FIXME|reason=Check the comparison type}}<br />
<br />
This feature isn't available in GL, probably.<br />
This is different from NV_register_combiners where the special "or" operation (MUX) is always doing: <code>spare0_alpha >= 0.5 ? C*D : A*B</code>.<br />
<br />
== Debugging ==<br />
<br />
PIX from the Microsoft XDK provides great debugging capabilities.<br />
<br />
=== References and links ===<br />
<br />
* [http://developer.download.nvidia.com/assets/gamedev/docs/ProgrammableTextureBlending.pdf Overview about programmable texture blending] <!-- Mirror: https://www.nvidia.com/object/programmable_texture_blending.html --><br />
* [http://developer.download.nvidia.com/assets/gamedev/docs/combiners.pdf Overview of register combiners]<br />
* [https://github.com/XboxDev/nxdk/blob/77b5de45f0c64e70f2ff68248873448d5edccc71/tools/fp20compiler/ps1.0_program.cpp#L227 Code from nvparse (NVIDIA SDK 9.52) in nxdk, which handles shader to OpenGL conversion]<br />
* http://developer.download.nvidia.com/assets/gamedev/docs/GDC2K1_DX8_Pixel_Shaders.pdf<br />
<br />
[[Category:NV2A]]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Resources&diff=6816Resources2019-12-30T19:07:22Z<p>JayFoxRox: Add more links and categorize background knowledge</p>
<hr />
<div>== Xbox Post-Mortems by developers ==<br />
<br />
=== Xbox Launch ===<br />
<br />
* GDC2002: [https://www.powershow.com/download/6f1ff7-NmE2O/Xbox_Launch_Lessons_Learned_powerpoint_ppt_presentation Xbox Launch: Lessons Learned] ([https://www.gdcvault.com/play/1022522/Xbox-Launch-Lessons Audio])<br />
<br />
=== Post processing ===<br />
<br />
* CEDEC2002: [https://web.archive.org/web/20031212044938/http://www.daionet.gr.jp/~masa/column/2002-09-22.html DOUBLE-S.T.E.A.L techniques] ''(Japanese)''<br />
* GDC2003: [https://web.archive.org/web/20031212140633/http://www.daionet.gr.jp/~masa/column/2003-03-21.html Frame Buffer Postprocessing Effects in DOUBLE-S.T.E.A.L (Wreckless)] ''(English)''<br />
<br />
=== HDR rendering ===<br />
<br />
* GDC2004: [https://web.archive.org/web/20060404103630/http://www.daionet.gr.jp/~masa/column/2004-04-04.html Practical Implementation of High Dynamic Range Rendering]<br />
<br />
=== Deferred Shading ===<br />
<br />
* https://sites.google.com/site/richgel99/index#TOC-Shrek-Xbox-and-Deferred-Shading<br />
* https://sites.google.com/site/richgel99/home<br />
* https://sites.google.com/site/richgel99/home/xbox-1-g-buffer-attribute-packing-pixel-shader<br />
* https://web.archive.org/web/20171008031141/http://www.tenacioussoftware.com/gdc_2004_deferred_shading.ppt<br />
<br />
== Random resources about Xbox hacking ==<br />
* [https://events.ccc.de/congress/2005/fahrplan/attachments/591-paper_xbox.pdf Michael Steils Xbox Presentation from C3 in 2005]<br />
* https://media.ccc.de/v/19C3-399-xbox-linux<br />
* https://media.ccc.de/v/22C3-559-en-xbox_hacking<br />
* https://www.youtube.com/watch?v=6fOjGLCctEY<br />
* [http://www.bunniestudios.com/bunnie/proj/anatak/xboxmod.html Bunnies original Xbox page]<br />
* [https://www.nostarch.com/xboxfree Bunnies "Hacking the Xbox" e-book for free]<br />
* [http://web.archive.org/web/20010417064218/ddj.com/articles/2000/0008/0008a/0008a.htm?topic=graphics Article about Xbox Graphics (before release) from Dr. Dobbs]<br />
* [http://www.anandtech.com/show/853 Technical article about the Xbox by AnandTech]<br />
<br />
== History ==<br />
* [https://www.youtube.com/watch?v=rUODlNffWmU 3 Xbox Bosses Share Secrets of the Console's Past (Video)]<br />
* [https://www.youtube.com/watch?v=iWQb7LGH71s Xbox Assembly Line Tour (Video)]<br />
* [https://www.youtube.com/watch?v=_gOoI57q72M XBox Oral History Panel with Nick Baker, Todd Holmdahl, and Albert Penello (Video)]<br />
* [https://www.youtube.com/watch?v=2VCb-y7MC5U?t=1248 Behind the Code - Interview with Nick Baker (Video) intresting xbox part starts 20:48]<br />
<br />
== Background knowledge about related topics ==<br />
<br />
=== Graphics programming ===<br />
<br />
* Meltdown 2001 (Microsoft Game development conference): [https://web.archive.org/web/20060203201117/https://www.microsoft.com/mscorp/corpevents/meltdown2001/presentations.asp Presentation slides]<br />
* GDC2001: [http://developer.download.nvidia.com/assets/gamedev/docs/GDC2K1_DX8_Pixel_Shaders.pdf DirectX8 Pixel Shaders]<br />
* [http://download.nvidia.com/developer/Papers/ Papers by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/presentations/ Presentation slides by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/movies/ Presentation recordings by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/NVTextureSuite/ Texturing tools by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/Tools/ Tools by nvidia from Xbox era]<br />
* http://download.nvidia.com/developer/Third_Party/<br />
* http://iquilezles.org/www/index.htm<br />
* https://web.archive.org/web/20150408045127/http://freespace.virgin.net/hugo.elias/<br />
* http://www.mvps.org/directx/indexes/<br />
* https://www.gdcvault.com/play/247/CRYSIS-Next-Gen ''(Contains some parts which are also applicable to original Xbox)''<br />
* [https://www.valvesoftware.com/en/publications Publications by Valve Software]<br />
* http://graphics.uni-konstanz.de/publikationen/Luft2006ImageEnhancementUnsharp/Luft2006ImageEnhancementUnsharp.pdf<br />
* [https://web.archive.org/web/20090518092325/http://www.daionet.gr.jp:80/~masa/column/index.html Masa's Column (DOUBLE-S.T.E.A.L / Wrecked developer)]<br />
* [https://fgiesen.wordpress.com/ Blog by ryg]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Resources&diff=6815Resources2019-12-30T19:04:18Z<p>JayFoxRox: Add Wrecked links</p>
<hr />
<div>== Xbox Post-Mortems by developers ==<br />
<br />
=== Xbox Launch ===<br />
<br />
* GDC2002: [https://www.powershow.com/download/6f1ff7-NmE2O/Xbox_Launch_Lessons_Learned_powerpoint_ppt_presentation Xbox Launch: Lessons Learned] ([https://www.gdcvault.com/play/1022522/Xbox-Launch-Lessons Audio])<br />
<br />
=== Post processing ===<br />
<br />
* CEDEC2002: [https://web.archive.org/web/20031212044938/http://www.daionet.gr.jp/~masa/column/2002-09-22.html DOUBLE-S.T.E.A.L techniques] ''(Japanese)''<br />
* GDC2003: [https://web.archive.org/web/20031212140633/http://www.daionet.gr.jp/~masa/column/2003-03-21.html Frame Buffer Postprocessing Effects in DOUBLE-S.T.E.A.L (Wreckless)] ''(English)''<br />
<br />
=== HDR rendering ===<br />
<br />
* GDC2004: [https://web.archive.org/web/20060404103630/http://www.daionet.gr.jp/~masa/column/2004-04-04.html Practical Implementation of High Dynamic Range Rendering]<br />
<br />
=== Deferred Shading ===<br />
<br />
* https://sites.google.com/site/richgel99/index#TOC-Shrek-Xbox-and-Deferred-Shading<br />
* https://sites.google.com/site/richgel99/home<br />
* https://sites.google.com/site/richgel99/home/xbox-1-g-buffer-attribute-packing-pixel-shader<br />
* https://web.archive.org/web/20171008031141/http://www.tenacioussoftware.com/gdc_2004_deferred_shading.ppt<br />
<br />
== Random resources about Xbox hacking ==<br />
* [https://events.ccc.de/congress/2005/fahrplan/attachments/591-paper_xbox.pdf Michael Steils Xbox Presentation from C3 in 2005]<br />
* https://media.ccc.de/v/19C3-399-xbox-linux<br />
* https://media.ccc.de/v/22C3-559-en-xbox_hacking<br />
* https://www.youtube.com/watch?v=6fOjGLCctEY<br />
* [http://www.bunniestudios.com/bunnie/proj/anatak/xboxmod.html Bunnies original Xbox page]<br />
* [https://www.nostarch.com/xboxfree Bunnies "Hacking the Xbox" e-book for free]<br />
* [http://web.archive.org/web/20010417064218/ddj.com/articles/2000/0008/0008a/0008a.htm?topic=graphics Article about Xbox Graphics (before release) from Dr. Dobbs]<br />
* [http://www.anandtech.com/show/853 Technical article about the Xbox by AnandTech]<br />
<br />
== History ==<br />
* [https://www.youtube.com/watch?v=rUODlNffWmU 3 Xbox Bosses Share Secrets of the Console's Past (Video)]<br />
* [https://www.youtube.com/watch?v=iWQb7LGH71s Xbox Assembly Line Tour (Video)]<br />
* [https://www.youtube.com/watch?v=_gOoI57q72M XBox Oral History Panel with Nick Baker, Todd Holmdahl, and Albert Penello (Video)]<br />
* [https://www.youtube.com/watch?v=2VCb-y7MC5U?t=1248 Behind the Code - Interview with Nick Baker (Video) intresting xbox part starts 20:48]<br />
<br />
== Background knowledge about related topics and interesting effects ==<br />
<br />
* Meltdown 2001 (Microsoft Game development conference): [https://web.archive.org/web/20060203201117/https://www.microsoft.com/mscorp/corpevents/meltdown2001/presentations.asp Presentation slides]<br />
* GDC2001: [http://developer.download.nvidia.com/assets/gamedev/docs/GDC2K1_DX8_Pixel_Shaders.pdf DirectX8 Pixel Shaders]<br />
* [http://download.nvidia.com/developer/Papers/ Papers by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/presentations/ Presentation slides by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/movies/ Presentation recordings by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/NVTextureSuite/ Texturing tools by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/Tools/ Tools by nvidia from Xbox era]<br />
* http://download.nvidia.com/developer/Third_Party/<br />
* http://iquilezles.org/www/index.htm<br />
* https://web.archive.org/web/20150408045127/http://freespace.virgin.net/hugo.elias/<br />
* http://www.mvps.org/directx/indexes/<br />
* https://www.gdcvault.com/play/247/CRYSIS-Next-Gen ''(Contains some parts which are also applicable to original Xbox)''<br />
* [https://www.valvesoftware.com/en/publications Publications by Valve Software]<br />
* http://graphics.uni-konstanz.de/publikationen/Luft2006ImageEnhancementUnsharp/Luft2006ImageEnhancementUnsharp.pdf</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Resources&diff=6814Resources2019-12-30T19:00:10Z<p>JayFoxRox: Add more links about graphics programming</p>
<hr />
<div>== Xbox Post-Mortems by developers ==<br />
<br />
=== Xbox Launch ===<br />
<br />
* GDC2002: [https://www.powershow.com/download/6f1ff7-NmE2O/Xbox_Launch_Lessons_Learned_powerpoint_ppt_presentation Xbox Launch: Lessons Learned] ([https://www.gdcvault.com/play/1022522/Xbox-Launch-Lessons Audio])<br />
<br />
=== Deferred Shading ===<br />
<br />
* https://sites.google.com/site/richgel99/index#TOC-Shrek-Xbox-and-Deferred-Shading<br />
* https://sites.google.com/site/richgel99/home<br />
* https://sites.google.com/site/richgel99/home/xbox-1-g-buffer-attribute-packing-pixel-shader<br />
* https://web.archive.org/web/20171008031141/http://www.tenacioussoftware.com/gdc_2004_deferred_shading.ppt<br />
<br />
== Random resources about Xbox hacking ==<br />
* [https://events.ccc.de/congress/2005/fahrplan/attachments/591-paper_xbox.pdf Michael Steils Xbox Presentation from C3 in 2005]<br />
* https://media.ccc.de/v/19C3-399-xbox-linux<br />
* https://media.ccc.de/v/22C3-559-en-xbox_hacking<br />
* https://www.youtube.com/watch?v=6fOjGLCctEY<br />
* [http://www.bunniestudios.com/bunnie/proj/anatak/xboxmod.html Bunnies original Xbox page]<br />
* [https://www.nostarch.com/xboxfree Bunnies "Hacking the Xbox" e-book for free]<br />
* [http://web.archive.org/web/20010417064218/ddj.com/articles/2000/0008/0008a/0008a.htm?topic=graphics Article about Xbox Graphics (before release) from Dr. Dobbs]<br />
* [http://www.anandtech.com/show/853 Technical article about the Xbox by AnandTech]<br />
<br />
== History ==<br />
* [https://www.youtube.com/watch?v=rUODlNffWmU 3 Xbox Bosses Share Secrets of the Console's Past (Video)]<br />
* [https://www.youtube.com/watch?v=iWQb7LGH71s Xbox Assembly Line Tour (Video)]<br />
* [https://www.youtube.com/watch?v=_gOoI57q72M XBox Oral History Panel with Nick Baker, Todd Holmdahl, and Albert Penello (Video)]<br />
* [https://www.youtube.com/watch?v=2VCb-y7MC5U?t=1248 Behind the Code - Interview with Nick Baker (Video) intresting xbox part starts 20:48]<br />
<br />
== Background knowledge about related topics and interesting effects ==<br />
<br />
* Meltdown 2001 (Microsoft Game development conference): [https://web.archive.org/web/20060203201117/https://www.microsoft.com/mscorp/corpevents/meltdown2001/presentations.asp Presentation slides]<br />
* GDC2001: [http://developer.download.nvidia.com/assets/gamedev/docs/GDC2K1_DX8_Pixel_Shaders.pdf DirectX8 Pixel Shaders]<br />
* [http://download.nvidia.com/developer/Papers/ Papers by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/presentations/ Presentation slides by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/movies/ Presentation recordings by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/NVTextureSuite/ Texturing tools by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/Tools/ Tools by nvidia from Xbox era]<br />
* http://download.nvidia.com/developer/Third_Party/<br />
* http://iquilezles.org/www/index.htm<br />
* https://web.archive.org/web/20150408045127/http://freespace.virgin.net/hugo.elias/<br />
* http://www.mvps.org/directx/indexes/<br />
* https://www.gdcvault.com/play/247/CRYSIS-Next-Gen ''(Contains some parts which are also applicable to original Xbox)''<br />
* [https://www.valvesoftware.com/en/publications Publications by Valve Software]<br />
* http://graphics.uni-konstanz.de/publikationen/Luft2006ImageEnhancementUnsharp/Luft2006ImageEnhancementUnsharp.pdf</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=NV2A/Vertex_Shader&diff=6813NV2A/Vertex Shader2019-12-30T18:51:10Z<p>JayFoxRox: Add an interesting nvidia paper which describes some vertex shader tricks</p>
<hr />
<div>The Xbox implements the 2 GL extensions [https://www.opengl.org/registry/specs/NV/vertex_program.txt NV_vertex_program] and [https://www.opengl.org/registry/specs/NV/vertex_program1_1.txt NV_vertex_program1_1] (with some modifications).<br />
This article will mainly focus on actual encoding on hardware as the behaviour is mostly outlined in those GL extensions already.<br />
<br />
== Operating modes ==<br />
<br />
* Fixed / Programmable<br />
* Writeable / Read-Only constants<br />
* Low-constants only / all constants<br />
* Vertex processing / State program<br />
<br />
== Registers ==<br />
<br />
=== Input registers ===<br />
<br />
There are 16 input registers v[0] to v[15].<br />
<br />
They normally [[NV2A/Vertex attributes|map to the vertex attributes]]. However, in the case of vertex state programs, v[0] is fed from LAUNCH_DATA (PGRAPH Methods 0x1E80, 0x1E84, 0x1E88, 0x1E8C for XYZW respectively) instead.<br />
<br />
=== Output registers ===<br />
<br />
11 output registers o[<RegName>] (initialized to XYZ=0x00000000 W=0x3F800000).<br />
<br />
{|class="wikitable"<br />
|+Output registers<br />
|-<br />
!Index<br />
!GL Name<br />
!D3D Name<br />
!Meaning<br />
|-<br />
|0<br />
|HPOS<br />
|oPos<br />
|Homogeneous clip space position<br />
|-<br />
|3<br />
|COL0<br />
|oD0<br />
|Primary color (front-facing)<br />
|-<br />
|4<br />
|COL1<br />
|oD1<br />
|Secondary color (front-facing)<br />
|-<br />
|5<br />
|FOGC<br />
|oFog<br />
|Fog coordinate<br />
|-<br />
|6<br />
|PSIZ<br />
|oPts<br />
|Point size<br />
|-<br />
|7<br />
|BFC0<br />
|oB0<br />
|Back-facing primary color<br />
|-<br />
|8<br />
|BFC1<br />
|oB1<br />
|Back-facing secondary color<br />
|-<br />
|9<br />
|TEX0<br />
|oT0<br />
|Texture coordinate set 0<br />
|-<br />
|10<br />
|TEX1<br />
|oT1<br />
|Texture coordinate set 1<br />
|-<br />
|11<br />
|TEX2<br />
|oT2<br />
|Texture coordinate set 2<br />
|-<br />
|12<br />
|TEX3<br />
|oT3<br />
|Texture coordinate set 3<br />
|}<br />
<br />
=== Address register ===<br />
<br />
A0.x exists as documented in the GL extension.<br />
<br />
=== Temporary registers ===<br />
<br />
There are 12 temporary registers: R0 to R11 (initialized to XYZW=0x00000000), as documented in the GL extension.<br />
Additionally, o[HPOS] is mirrored as R12 and can be used as source operand; so effectively you have 13 temporaries<br />
<br />
=== Constant space ===<br />
<br />
There are 192 constant registers in two seperate blocks with 96 constants each.<br />
They can be accessed through the PGRAPH RDI: select=0x17. Each constant slot is 4x DWORD, ordered as WZYX.<br />
Alternatively they can be uploaded through PGRAPH method [FIXME], with 4x DWORD, ordered XYZW.<br />
<br />
In nvidia vertex programs only 96 constants are normally accessible. Microsoft exposed the 96 additional constant registers in D3D shaders through c[-96] to c[-1].<br />
This documentation uses the GL terminology instead and expose the new registers as c[96] to c[191]. This means c[0] to c[191] valid.<br />
<br />
== Instructions ==<br />
<br />
In total, there are 136 instruction slots.<br />
<br />
Each slot consists of 16 bytes, we consider those as 4 seperate little-endian DWORDS describing the operation. Word 0 is inused.<br />
<br />
{| class="wikitable"<br />
|+Fields<br />
|-<br />
!Meaning<br />
!Word<br />
!Offset (bits)<br />
!Size (bits)<br />
|-<br />
|ILU Operation<br />
|1<br />
|25<br />
|3<br />
|-<br />
|MAC Operation<br />
|1<br />
|21<br />
|4<br />
|-<br />
|Constant index<br />
|1<br />
|13<br />
|8<br />
|-<br />
|Input index<br />
|1<br />
|9<br />
|4<br />
|-<br />
|Source 1 negate<br />
|1<br />
|8<br />
|1<br />
|-<br />
|Source 1 swizzle X<br />
|1<br />
|6<br />
|2<br />
|-<br />
|Source 1 swizzle Y<br />
|1<br />
|4<br />
|2<br />
|-<br />
|Source 1 swizzle Z<br />
|1<br />
|2<br />
|2<br />
|-<br />
|Source 1 swizzle W<br />
|1<br />
|0<br />
|2<br />
|-<br />
|Source 1 register<br />
|2<br />
|28<br />
|4<br />
|-<br />
|Source 1 mux<br />
|2<br />
|26<br />
|2<br />
|-<br />
|Source 2 negate<br />
|2<br />
|25<br />
|1<br />
|-<br />
|Source 2 swizzle X<br />
|2<br />
|23<br />
|2<br />
|-<br />
|Source 2 swizzle Y<br />
|2<br />
|21<br />
|2<br />
|-<br />
|Source 2 swizzle Z<br />
|2<br />
|19<br />
|2<br />
|-<br />
|Source 2 swizzle W<br />
|2<br />
|17<br />
|2<br />
|-<br />
|Source 2 register<br />
|2<br />
|13<br />
|4<br />
|-<br />
|Source 2 mux<br />
|2<br />
|11<br />
|2<br />
|-<br />
|Source 3 negate<br />
|2<br />
|10<br />
|1<br />
|-<br />
|Source 3 swizzle X<br />
|2<br />
|8<br />
|2<br />
|-<br />
|Source 3 swizzle Y<br />
|2<br />
|6<br />
|2<br />
|-<br />
|Source 3 swizzle Z<br />
|2<br />
|4<br />
|2<br />
|-<br />
|Source 3 swizzle W<br />
|2<br />
|2<br />
|2<br />
|-<br />
|Source 3 register (Hi)<br />
|2<br />
|0<br />
|2<br />
|-<br />
|Source 3 register (Lo)<br />
|3<br />
|30<br />
|2<br />
|-<br />
|Source 3 mux<br />
|3<br />
|28<br />
|2<br />
|-<br />
|Destination MAC mask<br />
|3<br />
|24<br />
|4<br />
|-<br />
|Destination temporary register<br />
|3<br />
|20<br />
|4<br />
|-<br />
|Destination ILU mask<br />
|3<br />
|16<br />
|4<br />
|-<br />
|Destination overall mask<br />
|3<br />
|12<br />
|4<br />
|-<br />
|Destination select<br />
|3<br />
|11<br />
|1<br />
|-<br />
|Destination output register<br />
|3<br />
|3<br />
|8<br />
|-<br />
|Destination mux<br />
|3<br />
|2<br />
|1<br />
|-<br />
|Relative constant addressing<br />
|3<br />
|1<br />
|1<br />
|-<br />
|Final instruction marker (EOF)<br />
|3<br />
|0<br />
|1<br />
|}<br />
<br />
{| class="wikitable"<br />
|+Swizzle table<br />
|-<br />
!Value<br />
!Meaning<br />
|-<br />
|0<br />
|X<br />
|-<br />
|1<br />
|Y<br />
|-<br />
|2<br />
|Z<br />
|-<br />
|3<br />
|W<br />
|}<br />
<br />
=== Functional units ===<br />
<br />
<br />
==== Inverse Logic Unit (ILU) ====<br />
<br />
{| class="wikitable"<br />
|+ILU Operations<br />
|-<br />
!Value<br />
!Meaning<br />
|-<br />
|0<br />
|NOP<br />
|-<br />
|1<br />
|MOV<br />
|-<br />
|2<br />
|RCP<br />
|-<br />
|3<br />
|RCC<br />
|-<br />
|4<br />
|RSQ<br />
|-<br />
|5<br />
|EXP<br />
|-<br />
|6<br />
|LOG<br />
|-<br />
|7<br />
|LIT<br />
|}<br />
<br />
==== Multiply-Accumulate (MAC) ====<br />
<br />
{| class="wikitable"<br />
|+MAC Operations<br />
|-<br />
!Value<br />
!Meaning<br />
|-<br />
|0<br />
|NOP<br />
|-<br />
|1<br />
|MOV<br />
|-<br />
|2<br />
|MUL<br />
|-<br />
|3<br />
|ADD<br />
|-<br />
|4<br />
|MAD<br />
|-<br />
|5<br />
|DP3<br />
|-<br />
|6<br />
|DPH<br />
|-<br />
|7<br />
|DP4<br />
|-<br />
|8<br />
|DST<br />
|-<br />
|9<br />
|MIN<br />
|-<br />
|10<br />
|MAX<br />
|-<br />
|11<br />
|SLT<br />
|-<br />
|12<br />
|SGE<br />
|-<br />
|13<br />
|ARL<br />
|}<br />
<br />
== Related links ==<br />
<br />
* nvidia resources<br />
** [https://www.nvidia.com/attach/6559 WhereIsThatVertexShaderInstruction.pdf] / [https://www.nvidia.com/attach/6560 WhereIsThatVertexShaderInstruction.doc]<br />
* [https://github.com/envytools/envytools/blob/master/nvhw/pgraph_celsius_xfrm.c Code which appears to implement bit-accurate emulation of some instructions]{{FIXME|reason=Unconfirmed, needs testing}}<br />
<br />
[[Category:NV2A]]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=NV2A/Pixel_Combiner&diff=6812NV2A/Pixel Combiner2019-12-30T18:29:15Z<p>JayFoxRox: Add more nvidia BRDF links</p>
<hr />
<div>== Data types ==<br />
<br />
NV_texture_shader suggests that: ''"The 8-bit and 16-bit signed fixed-point types are used for signed internal texture formats, while the 9-bit signed fixed-point type is used for register combiners computations."''<br />
Here is a table from the GL extension:<br />
<br />
{| class="wikitable"<br />
! floating-point !! 8-bit fixed-point !! 9-bit fixed-point !! 16-bit fixed-point<br />
|-<br />
| 1.0 || n/a || 255 || n/a <br />
|-<br />
| 0.99996... || n/a || n/a || 32767<br />
|-<br />
| 0.99218... || 127 || n/a || n/a <br />
|-<br />
| 0.0 || 0 || 0 || 0<br />
|-<br />
| -1.0 || -128 || -255 || -32768<br />
|-<br />
| -1.00392... || n/a || -256 || n/a<br />
|}<br />
<br />
This means:<br />
<br />
* 8-bit fixed-point: [-128, 127] &rarr; [-128/128, 127/128] &rarr; [-1.0, 0.99218...]<br />
* 9-bit fixed-point: [-256, 255] &rarr; [-256/255, 255/255] &rarr; [-1.00392..., 1.0]<br />
* 16-bit fixed-point: [-32768, 32767] &rarr; [-32768/32768, 32767/32768] &rarr; [-1.0, 0.99996...]<br />
<br />
It is not known if the NV2A really implements these 3 datatypes.<br />
It is also not yet known how exactly conversion or negation of these types would work.<br />
<br />
== Texture Shaders ==<br />
<br />
The NV2A implements at least parts of the following OpenGL extensions:<br />
<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader.txt NV_texture_shader]<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader2.txt NV_texture_shader2]<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader3.txt NV_texture_shader3]{{citation needed}}<br />
<br />
=== Texturing modes ===<br />
<br />
{|class="wikitable"<br />
!ID<br />
!Name<br />
!D3D name<br />
!GL Name<br />
!Stage 1<br />
!Stage 2<br />
!Stage 3<br />
!Stage 4<br />
!Notes<br />
|-<br />
|0x00<br />
|PS_TEXTUREMODES_NONE<br />
|<br />
|NONE<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x01<br />
|PS_TEXTUREMODES_PROJECT2D<br />
|tex<br />
|TEXTURE_2D<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x02<br />
|PS_TEXTUREMODES_PROJECT3D<br />
|tex<br />
|TEXTURE_3D<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x03<br />
|PS_TEXTUREMODES_CUBEMAP<br />
|tex<br />
|TEXTURE_CUBE_MAP_ARB<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x04<br />
|PS_TEXTUREMODES_PASSTHRU<br />
|texcoord<br />
|PASS_THROUGH_NV<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x05<br />
|PS_TEXTUREMODES_CLIPPLANE<br />
|texkill<br />
|CULL_FRAGMENT_NV<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x06<br />
|PS_TEXTUREMODES_BUMPENVMAP<br />
|texbem<br />
|OFFSET_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x07<br />
|PS_TEXTUREMODES_BUMPENVMAP_LUM<br />
|texbeml<br />
|OFFSET_TEXTURE_2D_SCALE_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x08<br />
|PS_TEXTUREMODES_BRDF<br />
|texbrdf<br />
|<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x09<br />
|PS_TEXTUREMODES_DOT_ST<br />
|texm3x2tex<br />
|DOT_PRODUCT_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0A<br />
|PS_TEXTUREMODES_DOT_ZW<br />
|texm3x2depth<br />
|DOT_PRODUCT_DEPTH_REPLACE_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0B<br />
|PS_TEXTUREMODES_DOT_RFLCT_DIFF<br />
|texm3x3diff<br />
|DOT_PRODUCT_DIFFUSE_CUBE_MAP_NV{{citation needed}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{no}}<br />
|<br />
|-<br />
|0x0C<br />
|PS_TEXTUREMODES_DOT_RFLCT_SPEC<br />
|texm3x3vspec<br />
|DOT_PRODUCT_CONST_EYE_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0D<br />
|PS_TEXTUREMODES_DOT_STR_3D<br />
|texm3x3tex<br />
|DOT_PRODUCT_TEXTURE_3D_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0E<br />
|PS_TEXTUREMODES_DOT_STR_CUBE<br />
|texm3x3vspec<br />
|DOT_PRODUCT_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0F<br />
|PS_TEXTUREMODES_DPNDNT_AR<br />
|texreg2ar<br />
|DEPENDENT_AR_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x10<br />
|PS_TEXTUREMODES_DPNDNT_GB<br />
|texreg2gb<br />
|DEPENDENT_GB_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x11<br />
|PS_TEXTUREMODES_DOTPRODUCT<br />
|texm3x3pad<br>texm3x2pad<br />
|DOT_PRODUCT_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{no}}<br />
|<br />
|-<br />
|0x12<br />
|PS_TEXTUREMODES_DOT_RFLCT_SPEC_CONST<br />
|texm3x3spec<br />
|DOT_PRODUCT_CONST_EYE_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|}<br />
<br />
=== 0x08: PS_TEXTUREMODES_BRDF / texbrdf ===<br />
<br />
The BRDF texture shader is probably only exposed on original Xbox, but not in standard OpenGL or D3D drivers.<br />
<br />
These are some generic resources about BRDFs:<br />
<br />
* [https://math.nist.gov/~FHunt/appearance/brdf.html Collection of BRDF information]<br />
* [http://www-graphics.stanford.edu/~smr/brdf/bv/ BRDF viewer]{{FIXME|reason=Find alternative; this one is hard to compile}}<br />
* [https://www.merl.com/brdf/ BRDF Database by Mitsubishi]<br />
<br />
* nvidia resources ''(The code and technique is probably not using the texture shader that is described here)'':<br />
** [http://www.nvidia.in/attach/6670 BRDFs.pdf] / [http://www.nvidia.in/attach/6669 BRDFs.ppt]<br />
** [https://www.nvidia.com/attach/6568 BRDFIntro.pdf] / [https://www.nvidia.com/attach/6569 BRDFIntro.doc]<br />
** [https://www.nvidia.com/attach/6567 BRDFSeparable.pdf] / [https://www.nvidia.com/attach/6566 BRDFSeparable.doc]<br />
** [https://www.nvidia.com/attach/6570 brdfseparate.zip]<br />
** [https://www.nvidia.com/attach/6571 brdfview.zip]<br />
<br />
{{FIXME|reason=Describe Xbox specific BRDF texture shader}}<br />
<br />
== Register combiners ==<br />
<br />
The NV2A implements at least parts of the following OpenGL extensions:<br />
<br />
* [https://www.opengl.org/registry/specs/NV/register_combiners.txt NV_register_combiners]<br />
* [https://www.opengl.org/registry/specs/NV/register_combiners2.txt NV_register_combiners2]<br />
<br />
There's some additional features and oddities.<br />
<br />
=== DISCARD and ZERO are the same register ===<br />
<br />
On NV2A the DISCARD and ZERO register are the same index: writes are discarded / reads return zero.<br />
<br />
This is different from NV_register_combiners where 2 different constants are used.<br />
<br />
=== Encoding of input swizzle ===<br />
<br />
NV2A uses a single ALPHA flag to specify the swizzle of inputs:<br />
* 0 for <code>.rgb</code> (RGB portion only) and <code>.b</code> (ALPHA portion only).<br />
* 1 for <code>.aaa</code> (RGB portion only) and <code>.a</code> (ALPHA portion only).<br />
<br />
This is different from NV_register_combiners where each swizzle has its own constant.<br />
<br />
=== Per stage constant-colors ===<br />
<br />
The combiner setup switches between using the same <code>const0</code> and <code>const1</code> for all stages (<code>FACTOR#_SAME_FACTOR_ALL</code>), or using different constant-colors per stage (<code>FACTOR#_EACH_STAGE</code>).<br />
<br />
On NV2A, the final-combiner does always have unique constants (even using <code>FACTOR#_SAME_FACTOR_ALL</code>) from all other stages.<br />
If <code>FACTOR#_SAME_FACTOR_ALL</code> is used, the constant-colors for all other stages are taken from the very first stage.<br />
This setting can be controlled independently for <code>const0</code> and <code>const1</code>.<br />
<br />
This is different from NV_register_combiners2. If that GL extension isn't available / enabled, then the constants are shared between general combiner stages and the final combiner (which doesn't have unique colors then). Additionally, the GL extension can only control this for both constant-colors at the same time.<br />
<br />
=== Encoding of constant-colors ===<br />
<br />
On NV2A, the constant-colors are encoded as 8-bit unsigned int values, packed into a 32-bit ARGB value (<code>(a<<24 | r<<16 | g<<8 | b)</code>).<br />
<br />
This is different from NV_register_combiners where constant-colors are specified as floats in RGBA format.<br />
<br />
=== BLUETOALPHA in RGB portion ===<br />
<br />
NV2A has a special flag to write the blue result (RGB portion) of the A/B and C/D computations to the alpha channel of the RGB portion output register. There's no such option for the AB/CD result.<br />
{{FIXME|reason=Document specifics, tests proposed on https://github.com/JayFoxRox/nxdk/pull/33}}<br />
<br />
This feature isn't available in GL, probably.<br />
This is different from NV_register_combiners where the RGB portion always writes to <code>.rgb</code> of the output.<br />
<br />
=== Special "or" operation (MUX) modifier ===<br />
<br />
NV2A has a special flag to switch between MSB and LSB{{FIXME|reason=Unconfirmed / untested - doesn't make a lot of sense}} for the special "or" operation (MUX).<br />
{{FIXME|reason=Check the comparison type}}<br />
<br />
This feature isn't available in GL, probably.<br />
This is different from NV_register_combiners where the special "or" operation (MUX) is always doing: <code>spare0_alpha >= 0.5 ? C*D : A*B</code>.<br />
<br />
== Debugging ==<br />
<br />
PIX from the Microsoft XDK provides great debugging capabilities.<br />
<br />
=== References and links ===<br />
<br />
* [http://developer.download.nvidia.com/assets/gamedev/docs/ProgrammableTextureBlending.pdf Overview about programmable texture blending] <!-- Mirror: https://www.nvidia.com/object/programmable_texture_blending.html --><br />
* [http://developer.download.nvidia.com/assets/gamedev/docs/combiners.pdf Overview of register combiners]<br />
* [https://github.com/XboxDev/nxdk/blob/77b5de45f0c64e70f2ff68248873448d5edccc71/tools/fp20compiler/ps1.0_program.cpp#L227 Code from nvparse (NVIDIA SDK 9.52) in nxdk, which handles shader to OpenGL conversion]<br />
* http://developer.download.nvidia.com/assets/gamedev/docs/GDC2K1_DX8_Pixel_Shaders.pdf<br />
<br />
[[Category:NV2A]]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Resources&diff=6811Resources2019-12-30T18:18:05Z<p>JayFoxRox: Add some more talks / links</p>
<hr />
<div>== Xbox Post-Mortems by developers ==<br />
<br />
=== Xbox Launch ===<br />
<br />
* GDC2002: [https://www.powershow.com/download/6f1ff7-NmE2O/Xbox_Launch_Lessons_Learned_powerpoint_ppt_presentation Xbox Launch: Lessons Learned] ([https://www.gdcvault.com/play/1022522/Xbox-Launch-Lessons Audio])<br />
<br />
=== Deferred Shading ===<br />
<br />
* https://sites.google.com/site/richgel99/index#TOC-Shrek-Xbox-and-Deferred-Shading<br />
* https://sites.google.com/site/richgel99/home<br />
* https://sites.google.com/site/richgel99/home/xbox-1-g-buffer-attribute-packing-pixel-shader<br />
* https://web.archive.org/web/20171008031141/http://www.tenacioussoftware.com/gdc_2004_deferred_shading.ppt<br />
<br />
== Random resources about Xbox hacking ==<br />
* [https://events.ccc.de/congress/2005/fahrplan/attachments/591-paper_xbox.pdf Michael Steils Xbox Presentation from C3 in 2005]<br />
* https://media.ccc.de/v/19C3-399-xbox-linux<br />
* https://media.ccc.de/v/22C3-559-en-xbox_hacking<br />
* https://www.youtube.com/watch?v=6fOjGLCctEY<br />
* [http://www.bunniestudios.com/bunnie/proj/anatak/xboxmod.html Bunnies original Xbox page]<br />
* [https://www.nostarch.com/xboxfree Bunnies "Hacking the Xbox" e-book for free]<br />
* [http://web.archive.org/web/20010417064218/ddj.com/articles/2000/0008/0008a/0008a.htm?topic=graphics Article about Xbox Graphics (before release) from Dr. Dobbs]<br />
* [http://www.anandtech.com/show/853 Technical article about the Xbox by AnandTech]<br />
<br />
== History ==<br />
* [https://www.youtube.com/watch?v=rUODlNffWmU 3 Xbox Bosses Share Secrets of the Console's Past (Video)]<br />
* [https://www.youtube.com/watch?v=iWQb7LGH71s Xbox Assembly Line Tour (Video)]<br />
* [https://www.youtube.com/watch?v=_gOoI57q72M XBox Oral History Panel with Nick Baker, Todd Holmdahl, and Albert Penello (Video)]<br />
* [https://www.youtube.com/watch?v=2VCb-y7MC5U?t=1248 Behind the Code - Interview with Nick Baker (Video) intresting xbox part starts 20:48]<br />
<br />
== Background knowledge about related topics ==<br />
<br />
* GDC2001: [http://developer.download.nvidia.com/assets/gamedev/docs/GDC2K1_DX8_Pixel_Shaders.pdf DirectX8 Pixel Shaders]<br />
* [http://download.nvidia.com/developer/Papers/ Papers by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/presentations/ Presentation slides by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/movies/ Presentation recordings by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/NVTextureSuite/ Texturing tools by nvidia from Xbox era]<br />
* [http://download.nvidia.com/developer/Tools/ Tools by nvidia from Xbox era]<br />
* http://download.nvidia.com/developer/Third_Party/</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=NV2A/Pixel_Combiner&diff=6810NV2A/Pixel Combiner2019-12-30T18:05:59Z<p>JayFoxRox: Add some BRDF links</p>
<hr />
<div>== Data types ==<br />
<br />
NV_texture_shader suggests that: ''"The 8-bit and 16-bit signed fixed-point types are used for signed internal texture formats, while the 9-bit signed fixed-point type is used for register combiners computations."''<br />
Here is a table from the GL extension:<br />
<br />
{| class="wikitable"<br />
! floating-point !! 8-bit fixed-point !! 9-bit fixed-point !! 16-bit fixed-point<br />
|-<br />
| 1.0 || n/a || 255 || n/a <br />
|-<br />
| 0.99996... || n/a || n/a || 32767<br />
|-<br />
| 0.99218... || 127 || n/a || n/a <br />
|-<br />
| 0.0 || 0 || 0 || 0<br />
|-<br />
| -1.0 || -128 || -255 || -32768<br />
|-<br />
| -1.00392... || n/a || -256 || n/a<br />
|}<br />
<br />
This means:<br />
<br />
* 8-bit fixed-point: [-128, 127] &rarr; [-128/128, 127/128] &rarr; [-1.0, 0.99218...]<br />
* 9-bit fixed-point: [-256, 255] &rarr; [-256/255, 255/255] &rarr; [-1.00392..., 1.0]<br />
* 16-bit fixed-point: [-32768, 32767] &rarr; [-32768/32768, 32767/32768] &rarr; [-1.0, 0.99996...]<br />
<br />
It is not known if the NV2A really implements these 3 datatypes.<br />
It is also not yet known how exactly conversion or negation of these types would work.<br />
<br />
== Texture Shaders ==<br />
<br />
The NV2A implements at least parts of the following OpenGL extensions:<br />
<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader.txt NV_texture_shader]<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader2.txt NV_texture_shader2]<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader3.txt NV_texture_shader3]{{citation needed}}<br />
<br />
=== Texturing modes ===<br />
<br />
{|class="wikitable"<br />
!ID<br />
!Name<br />
!D3D name<br />
!GL Name<br />
!Stage 1<br />
!Stage 2<br />
!Stage 3<br />
!Stage 4<br />
!Notes<br />
|-<br />
|0x00<br />
|PS_TEXTUREMODES_NONE<br />
|<br />
|NONE<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x01<br />
|PS_TEXTUREMODES_PROJECT2D<br />
|tex<br />
|TEXTURE_2D<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x02<br />
|PS_TEXTUREMODES_PROJECT3D<br />
|tex<br />
|TEXTURE_3D<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x03<br />
|PS_TEXTUREMODES_CUBEMAP<br />
|tex<br />
|TEXTURE_CUBE_MAP_ARB<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x04<br />
|PS_TEXTUREMODES_PASSTHRU<br />
|texcoord<br />
|PASS_THROUGH_NV<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x05<br />
|PS_TEXTUREMODES_CLIPPLANE<br />
|texkill<br />
|CULL_FRAGMENT_NV<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x06<br />
|PS_TEXTUREMODES_BUMPENVMAP<br />
|texbem<br />
|OFFSET_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x07<br />
|PS_TEXTUREMODES_BUMPENVMAP_LUM<br />
|texbeml<br />
|OFFSET_TEXTURE_2D_SCALE_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x08<br />
|PS_TEXTUREMODES_BRDF<br />
|texbrdf<br />
|<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x09<br />
|PS_TEXTUREMODES_DOT_ST<br />
|texm3x2tex<br />
|DOT_PRODUCT_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0A<br />
|PS_TEXTUREMODES_DOT_ZW<br />
|texm3x2depth<br />
|DOT_PRODUCT_DEPTH_REPLACE_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0B<br />
|PS_TEXTUREMODES_DOT_RFLCT_DIFF<br />
|texm3x3diff<br />
|DOT_PRODUCT_DIFFUSE_CUBE_MAP_NV{{citation needed}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{no}}<br />
|<br />
|-<br />
|0x0C<br />
|PS_TEXTUREMODES_DOT_RFLCT_SPEC<br />
|texm3x3vspec<br />
|DOT_PRODUCT_CONST_EYE_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0D<br />
|PS_TEXTUREMODES_DOT_STR_3D<br />
|texm3x3tex<br />
|DOT_PRODUCT_TEXTURE_3D_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0E<br />
|PS_TEXTUREMODES_DOT_STR_CUBE<br />
|texm3x3vspec<br />
|DOT_PRODUCT_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0F<br />
|PS_TEXTUREMODES_DPNDNT_AR<br />
|texreg2ar<br />
|DEPENDENT_AR_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x10<br />
|PS_TEXTUREMODES_DPNDNT_GB<br />
|texreg2gb<br />
|DEPENDENT_GB_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x11<br />
|PS_TEXTUREMODES_DOTPRODUCT<br />
|texm3x3pad<br>texm3x2pad<br />
|DOT_PRODUCT_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{no}}<br />
|<br />
|-<br />
|0x12<br />
|PS_TEXTUREMODES_DOT_RFLCT_SPEC_CONST<br />
|texm3x3spec<br />
|DOT_PRODUCT_CONST_EYE_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|}<br />
<br />
=== 0x08: PS_TEXTUREMODES_BRDF / texbrdf ===<br />
<br />
The BRDF texture shader is probably only exposed on original Xbox, but not in standard OpenGL or D3D drivers.<br />
<br />
These are some generic resources about BRDFs:<br />
<br />
* [https://math.nist.gov/~FHunt/appearance/brdf.html Collection of BRDF information]<br />
* [http://www-graphics.stanford.edu/~smr/brdf/bv/ BRDF viewer]{{FIXME|reason=Find alternative; this one is hard to compile}}<br />
* [https://www.merl.com/brdf/ BRDF Database by Mitsubishi]<br />
<br />
{{FIXME|reason=Describe Xbox specific BRDF texture shader}}<br />
{{FIXME|reason=Describe Xbox specific BRDF texture shader}}<br />
<br />
== Register combiners ==<br />
<br />
The NV2A implements at least parts of the following OpenGL extensions:<br />
<br />
* [https://www.opengl.org/registry/specs/NV/register_combiners.txt NV_register_combiners]<br />
* [https://www.opengl.org/registry/specs/NV/register_combiners2.txt NV_register_combiners2]<br />
<br />
There's some additional features and oddities.<br />
<br />
=== DISCARD and ZERO are the same register ===<br />
<br />
On NV2A the DISCARD and ZERO register are the same index: writes are discarded / reads return zero.<br />
<br />
This is different from NV_register_combiners where 2 different constants are used.<br />
<br />
=== Encoding of input swizzle ===<br />
<br />
NV2A uses a single ALPHA flag to specify the swizzle of inputs:<br />
* 0 for <code>.rgb</code> (RGB portion only) and <code>.b</code> (ALPHA portion only).<br />
* 1 for <code>.aaa</code> (RGB portion only) and <code>.a</code> (ALPHA portion only).<br />
<br />
This is different from NV_register_combiners where each swizzle has its own constant.<br />
<br />
=== Per stage constant-colors ===<br />
<br />
The combiner setup switches between using the same <code>const0</code> and <code>const1</code> for all stages (<code>FACTOR#_SAME_FACTOR_ALL</code>), or using different constant-colors per stage (<code>FACTOR#_EACH_STAGE</code>).<br />
<br />
On NV2A, the final-combiner does always have unique constants (even using <code>FACTOR#_SAME_FACTOR_ALL</code>) from all other stages.<br />
If <code>FACTOR#_SAME_FACTOR_ALL</code> is used, the constant-colors for all other stages are taken from the very first stage.<br />
This setting can be controlled independently for <code>const0</code> and <code>const1</code>.<br />
<br />
This is different from NV_register_combiners2. If that GL extension isn't available / enabled, then the constants are shared between general combiner stages and the final combiner (which doesn't have unique colors then). Additionally, the GL extension can only control this for both constant-colors at the same time.<br />
<br />
=== Encoding of constant-colors ===<br />
<br />
On NV2A, the constant-colors are encoded as 8-bit unsigned int values, packed into a 32-bit ARGB value (<code>(a<<24 | r<<16 | g<<8 | b)</code>).<br />
<br />
This is different from NV_register_combiners where constant-colors are specified as floats in RGBA format.<br />
<br />
=== BLUETOALPHA in RGB portion ===<br />
<br />
NV2A has a special flag to write the blue result (RGB portion) of the A/B and C/D computations to the alpha channel of the RGB portion output register. There's no such option for the AB/CD result.<br />
{{FIXME|reason=Document specifics, tests proposed on https://github.com/JayFoxRox/nxdk/pull/33}}<br />
<br />
This feature isn't available in GL, probably.<br />
This is different from NV_register_combiners where the RGB portion always writes to <code>.rgb</code> of the output.<br />
<br />
=== Special "or" operation (MUX) modifier ===<br />
<br />
NV2A has a special flag to switch between MSB and LSB{{FIXME|reason=Unconfirmed / untested - doesn't make a lot of sense}} for the special "or" operation (MUX).<br />
{{FIXME|reason=Check the comparison type}}<br />
<br />
This feature isn't available in GL, probably.<br />
This is different from NV_register_combiners where the special "or" operation (MUX) is always doing: <code>spare0_alpha >= 0.5 ? C*D : A*B</code>.<br />
<br />
== Debugging ==<br />
<br />
PIX from the Microsoft XDK provides great debugging capabilities.<br />
<br />
=== References and links ===<br />
<br />
* [http://developer.download.nvidia.com/assets/gamedev/docs/ProgrammableTextureBlending.pdf Overview about programmable texture blending] <!-- Mirror: https://www.nvidia.com/object/programmable_texture_blending.html --><br />
* [http://developer.download.nvidia.com/assets/gamedev/docs/combiners.pdf Overview of register combiners]<br />
* [https://github.com/XboxDev/nxdk/blob/77b5de45f0c64e70f2ff68248873448d5edccc71/tools/fp20compiler/ps1.0_program.cpp#L227 Code from nvparse (NVIDIA SDK 9.52) in nxdk, which handles shader to OpenGL conversion]<br />
* http://developer.download.nvidia.com/assets/gamedev/docs/GDC2K1_DX8_Pixel_Shaders.pdf<br />
<br />
[[Category:NV2A]]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Exploits&diff=6809Exploits2019-12-23T22:21:04Z<p>JayFoxRox: Add analysis of 007 savegame exploit</p>
<hr />
<div>== MCPX ==<br />
<br />
=== LDT (Hypertransport) bus tap ===<br />
<br />
See [http://www.xenatera.com/bunnie/proj/anatak/xboxmod.html#ldt bunnie's adventures hacking the Xbox].<br />
<br />
=== Visor hack ===<br />
<br />
Exploits incorrect rollover of memory address.<br />
<br />
=== MIST hack ===<br />
<br />
Exploits error in xcode interpreter security check.<br />
There are at least 2 variations of this hack.<br />
<br />
=== A20M# hack ===<br />
<br />
[[File:Haxar-a20m.jpg|thumb|200px|A jumper wire hack to enable A20]]<br />
<br />
Uses a legacy x86 feature.<br />
<br />
=== RC4 attack (MCPX 1.0 only) ===<br />
<br />
Microsoft uses the last bytes of the decrypted 2BL to check the integrity of the 2BL.<br />
However, RC4 does not have any feedback which means changes in the 2BL will not reflect in the last couple of bytes which are checked.<br />
As such, the 2BL can be freely modified, as long as the last couple of bytes still match what the MCPX ROM expects.<br />
<br />
This can be used to take over the 2BL entry point.<br />
<br />
When the attack happens, the MCPX ROM is still visible, making this a very powerful attack.<br />
<br />
''This attack is described by Michael Steil in his Google talk.''<br />
<br />
=== TEA attack (MCPX 1.1 only) ===<br />
<br />
TEA, which is only used in MCPX 1.1, can not be used as a hash in Davies-Meyer mode [http://www.tayloredge.com/reference/Mathematics/VRAndem.pdf][https://www.schneier.com/academic/paperfiles/paper-key-schedule.pdf]. And yet, Microsoft used it that way.<br />
<br />
The original attack uses the 5 bytes at 0xffffd400 (FBL entry point) which are <code>E9 83 01 00 00</code>.<br />
This is <code>jmp 0xffffd588</code> (which is a jump within the flash region).<br />
<br />
When flipping the highest bit of the operand DWORD (at 0xffffd400, mind your endianess) this will become: <code>E9 83 01 80 00</code>.<br />
This is <code>jmp 0x7fd588</code> (which is a jump into the RAM region).<br />
For the attack to be successful, the highest bit in the DWORD at 0xffffd404 also has to be flipped.<br />
<br />
The RAM can be controlled using the x-code command to write to RAM.<br />
So the idea is to copy a program from Flash to RAM using x-codes.<br />
Then the FBL / 2BL is modified to jump into said RAM region by flipping a bit of a jump operand (as described above).<br />
The 2 bit flips will not change the hash of FBL / 2BL as TEA is broken.<br />
<br />
As such, the FBL verification will succeed, the MCPX ROM will hand control to the FBL which will then jump into the attacker controlled RAM.<br />
<br />
When the attack happens, the MCPX ROM is still visible, making this a very powerful attack.<br />
<br />
''The TEA algorithm and exploit are also described in more detail in Bunnnies book (Page 109 and Page 142).''<br />
<br />
== Dashboard ==<br />
<br />
=== Audio hacks ===<br />
=== Font hacks ===<br />
<br />
[http://archiv.sega-dc.de/phoenix.maxconsole.net/docs/berternie.inc.htm Analysis of "Bert & Ernie" font-exploit].<br />
<br />
==== Easter-egg exploit ====<br />
<br />
== Savegames ==<br />
Savedgames can be used as an exploit method, but care must be taken for most games are verifying digital signatures of savedgames {{citation needed}} [http://bunniefoo.com/nostarch/HackingTheXbox_Free.pdf]<br />
=== [[007: Agent Under Fire]] ===<br />
<br />
[https://web.archive.org/web/20031003093240/http://xbox-linux.sourceforge.net:80/docs/007analysis.html Analysis of this savegame-exploit].<br />
<br />
=== [[Frogger Beyond]] ===<br />
Not much is known why this game was in the list, [https://events.ccc.de/congress/2005/fahrplan/attachments/674-slides_xbox.pdf 22C3, page 85]<br />
The game isnt shown in the final presentation at 22C3 (neither are Mechassault nor SplinterCell).<br />
<br />
=== [[MechAssault]] ===<br />
=== [[Tom Clancy's Splinter Cell]] ===<br />
=== [[Tony Hawk's Pro Skater 4]] ===<br />
Grimdoomer discovered a savegame exploit in THPS4, shared it on Discord and was later included with the Rocky5 softmod installer.<br />
[https://drive.google.com/file/d/0B9WVULxHOmNkQVBCMHMtVGhqVVU/view a video demonstrating the game trigger (custom skatepark)]<br />
<br />
''10-4-2017 it's just shell code I injected into the game save/ granted this save is slightly more complicated than the others and requires a small "loader" that is just a memcpy basically it's literally as simple as a buffer overflow...I just looked for null terminated strings and fuzzed them then when I got a crash I looked in teh xbe to figure out what was going on. yeah it's literally just a stack overflow'' - grimdoomer<br />
<br />
another website talking about his exploit.<br />
[https://www.xbmc4xbox.org.uk/forum/viewtopic.php?t=7310 xbmc4xbox.org.uk]<br />
<br />
== Attack ideas ==<br />
<br />
{| class="wikitable"<br />
! Purpose || Author || Description || Status<br />
|-<br />
|Xbox DVD Movie Playback Kit Dongle ROM manipulation || Xbox-Linux wiki<br />
|As the dashboard presumably downloads the code from the ROM into the memory of the Xbox, this could be a hardware hack requiring no hardware modifications. The XBE loader for the DVD image is different from the usual XBE loader. However, the XBE is still signed and checked for security.<br />
| XBE loader seems to be secured, although no full analysis has been done.<br />
|-<br />
| Preserving memory across boot || JayFoxRox<br />
| Confirm behaviour described in the coldboot paper (https://jhalderm.com/pub/papers/coldboot-cacm09.pdf). This can be used to transfer code / setups for other exploits across a boot (such as preparing memory for A20 attack).<br />
| Success: We have marked memory and rebooted the Xbox (through SMC warm and cold, and manual reboot using power switch). At room temperature, and the Xbox pre-heated, hundreds of markers can still be found after 10 seconds. Within the first 5 seconds, no loss of data was measured at all (although not many bits have been marked to begin with). We have confirmed the memory persistence not only for the main RAM, but also MCPX APU DSP memory banks. Other memory or register banks were not tested yet.<br />
|-<br />
| Early boot control || JayFoxRox<br />
| Xcodes allow writing PCI config space. This can be used to set PCI BARs to random page-aligned addresses. Some devices like the NV2A or MCPX APU contain large register banks which can be read and written like RAM. So effectively we can probably overlay the flash memory or MCPX ROM with a temporary PCI mapping. To fill the memory, the PCI device can be mapped to a lower region, and be filled through Xcode memory writes.<br />
This can be used to take control over code contained in RAM (FBL / 2BL), flash or possibly even the MCPX ROM during boot. This attack could be used to avoid unmapping the MCPX ROM and is therefore quite powerful. However, it requires knowledge of the Xcodes.<br />
| This has not been tested during real-mode or early boot yet, but is assumed to work. It was tested from protected mode by mapping USB1 over the Flash and MCPX ROM region (main RAM has not been tested yet). Mapping the overlay pages without caching resulted in crashes. However, the PD was not reviewed at the time and might have been broken (through unconventional use of MmMapIoSpace).<br />
|-<br />
| Dumping the MCPX ROM || JayFoxRox<br />
| Trying to find problems with the SMC reset chain:<br />
* Map PCI devices over the MCPX ROM region<br />
* Schedule a reset<br />
* Keep reading MCPX ROM memory with CPU to persistent page<br />
* If we are lucky, the CPU would now copies the MCPX ROM to RAM in it's last cycles with a broken LDT (this depends on how LDTs work and if they can recover)<br />
| Failed: I've tried reading MCPX ROM memory for as long as possible using the CPU. I've tried resets using PM26 (assumed PWRBTN), SMC Soft (0x01) and SMC Hard (0x40).<br />
Memory was read based on observing value changes (in PCI regions, signalling reset), and timing alone (X cycles after starting reset).<br />
The MCPX ROM region access always crashed. Shadowing the MCPX ROM with a PCI device does not help: The CPU never observed the PCI devices being remapped / lost.<br />
As MCPX and CPU are both reset by the SMC directly, this is not surprising.<br />
|-<br />
| Dumping the MCPX ROM || JayFoxRox<br />
| Trying to find problems with the SMC reset chain:<br />
* Map PCI devices over the MCPX ROM region<br />
* Check if NV2A can access the mapped PCI device<br />
* Configure NV2A to continously stream from MCPX ROM region to RAM - Reset system using SMC (idea: this resets the PCI device mappings in the MCPX and should re-enable the MCPX ROM)<br />
* If we are lucky, the NV2A would now stream the MCPX ROM to RAM in it's last cycles with a broken LDT (this depends on how LDTs work and if they can recover)<br />
| Concept only: No interest in experimenting with NV2A DMA.<br />
|-<br />
| Dumping the MCPX ROM || JayFoxRox<br />
| Trying to find problems with the SMC reset chain: On a warm boot, the x86 might do a bad boot (the following is a theory, someone please measure pins). Theroy: PWRGD is provided, but CPURST is still high from the previous run; CPURST might only go low once NV2A reboots:<br />
* Map device in NV2A to MCPX ROM region (note: mapping MCPX device would not work, because that gets reset with PWRGD)<br />
* Warm reset using SMC<br />
* Code in NV2A device should now jump to lower memory and unmap the MCPX ROM region (by moving itself for example)<br />
* Delay by X cycles [probably in the range from 1ns to idk.. 500ms] to avoid reading the MCPX ROM before MCPX reset<br />
* Code in lower region should copy MCPX ROM region to persisting pages<br />
| Concept only: Someone should measure the pins and possibly look into the memory signals. This is too time consuming for me.<br />
|-<br />
| Unknown || JayFoxRox<br />
| Partial system reset using 0xCF9 I/O register<br />
| Resetting through 0xCF9 lands us on a black screen and the LED flashes as if the DVD tray was being opened. It's currently assumed that 0xCF9 only resets peripherals and NV2A / CPU, but it does not seem to reset the MCPX itself (hence issues booting and PCI activity which causes LED to flash). This has not been tested yet. An idea to confirm this, might be to map a device at 0xFFFFFFF0 which places an x86 jump to a good memory page. If the MCPX really isn't reset, then the CPU would boot from the MMIO / known page.<br />
|-<br />
| Dumping the MCPX ROM || JayFoxRox<br />
| Trying to find problems with the SMC reset chain. The SMC takes a couple of milliseconds to reset the system. Parts of the peripherals might stay alive for long enough. So chances (extremly unlikely) are, the peripherals could be programmed to do DMA where the DMA is only executed after the reboot.<br />
| Failed: An attempt was made to use the APU GP DSP DMA to continuously store x86 code where 2BL would unpack. The system was then reset using the SMC. It booted normally. It is assumed that the DMA is probably long dead by the time that the 2BL is being unpacked / ran.<br />
|-<br />
| Unknown || JayFoxRox<br />
| Resetting from wrong address. The errata for the CPU states that a warm-reset might occur from the wrong address.<br />
| Concept only: Needs more research<br />
|-<br />
| Dumping the MCPX ROM || JayFoxRox<br />
| Trying to access MCPX ROM through peripherals in the southbridge. If the address logic is broken, parts like the OHCI, APU or AC97 might be able to access it still.<br />
|<br />
* AC97: Lots of crashes / hangs. Sometimes crackling noise. Sometimes does not crash. Also can access some non-existing memory regions without any crashes. Data read from invalid addresses seemed to be 300 Hz square wave. While crashing the hardware output will have exponential falloff (measured on PCM line-out).<br />
* APU: Mapping GP DSP Scratch memory from 0x00000000 to 0x7FFFFFFF reveals mirrors of physical RAM. Setting the highest bit (addresses over 0x80000000) will result in a crash of the Xbox.<br />
* OHCI: Untested<br />
* Others: Untested<br />
|-<br />
| Dumping Kernel INIT || JayFoxRox<br />
| INIT is free'd right before passing execution to the first XBE. Depending on what the XBE allocates, the INIT section might still be in memory when a dumper is run.<br />
| Probably doesn't work. Would need the dumper to directly run after cold-boot. Softmods unfortunately reboot the Xbox and during this warm-boot the INIT section is (in at least most cases) lost.<br />
|-<br />
| Dumping Kernel INIT || DaveX || An extension to JayFoxRox dumping idea. Instead of running a dumper-XBE through a softmod, the softmod itself could do the dumping. This means creation of a custom softmod, just for dumping. This depends on the used softmod entry-point (font-exploit (signed target xbe), audio-exploit, ..) to gain execution as early as possible. This strategy might be slightly risky as harddisk contents have to be modified for the temporary softmod.<br />
| WIP as of 2018-09-12<br />
|-<br />
| rowspan="13" | Homebrew entry point || rowspan="13" | Community<br />
| rowspan="13" | Some movie DVDs contain default XBEs signed to run on original Xbox from DVD-R{{FIXME|reason=Add region / product codes and other DVDs you know of}}. If we can find an exploit in one of them (loaded files), we could possibly take over the entire system and run homebrew from DVD-R.<br />
|-<br />
|'''Star Wars: Clone Wars - Volume Two'''<br />
[[Battlefront II]]<br />
<br />
Untested<br />
|-<br />
|'''Star Wars: Episode III - Revenge of the Sith (Widescreen Edition)'''<br />
[[Battlefront II]]<br />
<br />
Untested<br />
|-<br />
|'''Star Wars Trilogy (Widescreen Edition with Bonus Disc)'''<br />
[[Battlefront]]<br />
<br />
Untested<br />
|-<br />
|'''Star Wars Trilogy DVD with Demo'''<br />
[[Lego Star Wars 2]]<br />
<br />
Untested<br />
|-<br />
|'''Star Wars: Clone Wars - Volume One'''<br />
[[Battlefront]]<br />
<br />
Untested<br />
|-<br />
|'''The Chronicles of Riddick (Widescreen Unrated Director's Cut)'''<br />
[[Chronicles of Riddick]]<br />
<br />
Untested<br />
|-<br />
|'''Doom (Unrated Widescreen Edition)'''<br />
[[Doom 3]]<br />
<br />
Untested<br />
|-<br />
|'''Hulk (Special Edition)'''<br />
[[Hulk]]<br />
<br />
Untested<br />
|-<br />
|'''King Arthur - The Director's Cut (Widescreen Edition)'''<br />
[[King Arthur]]<br />
<br />
Untested<br />
|-<br />
|'''Robots (Widescreen Edition)'''<br />
[[Robots]]<br />
<br />
Untested<br />
|-<br />
|'''Van Helsing (Widescreen Edition)'''<br />
[[Van Helsing]]<br />
<br />
Untested<br />
|-<br />
|'''Clone Wars Volume 1'''<br />
[[Republic Commando]]<br />
<br />
Untested<br />
|}<br />
<br />
== Notes ==<br />
<br />
* [https://events.ccc.de/congress/2005/fahrplan/attachments/591-paper_xbox.pdf 17 Mistakes Microsoft Made in the Xbox Security System]<br />
* [http://toogam.bespin.org/xboxmod/site/xbehacks.htm A list of some exploit implementations]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Motherboard&diff=6808Motherboard2019-12-23T17:51:38Z<p>JayFoxRox: Add links to existing PCB information</p>
<hr />
<div>For a list of differences between these mainboards, also see [[Hardware Revisions]].<br />
<br />
== Xbox 1.0 ==<br />
<br />
* [https://docs.google.com/spreadsheets/d/1oT4OtE95sguxA5KZrlwC_XEF3nlpzrql1ESycBGPtDA/edit#gid=0 Some measurements of passive components by Redherring32 (The Fish)]{{FIXME|reason=Taken from https://discordapp.com/channels/428359196719972353/428359434230693899/592363537343447040}}<br />
<br />
[[File:Xbox-Motherboard-BR.jpg|400px|thumb|right|Xbox Version 1.0 Motherboard]]<br />
<br />
The following table is based on an Xbox 1.0{{citation needed}} retail board.<br />
<br />
{| class="wikitable"<br />
!| Device<br />
! Loc.<br />
! Part Number<br />
! Manufacture<br />
! Description<br />
|- <br />
| U2D1 <br />
| D-2<br />
| Pentium III (Coppermine)<br />
| Intel <br />
| 733MHz CPU 133MHz FSB 16Kb L1 cache 128Kb L2 cache<br />
|- <br />
| U2T1<br />
| T-2 <br />
| SC1186<br />
| Semtech<br />
| Programmable Synchronous DC/DC Converter<br />
|-<br />
| U3B1<br />
| B-3<br />
| LM358D<br />
| Phillips<br />
| Dual Operational Amplifier<br />
|-<br />
| U3B2<br />
| B-4<br />
| XGPU<br />
| nVidia<br />
| Graphics Processing Unit<br />
|-<br />
| U3R1<br />
| R-3<br />
| CY23S05<br />
| Cypress<br />
| Low-Cost 3.3V Spread Aware Zero Delay Buffer<br />
|-<br />
| U3T1<br />
| T-3<br />
| K4D263238M<br />
| Samsung<br />
| 1Mx32Bitx4 DDR Synchronous RAM<br />
|-<br />
| U4B1<br />
| B-4<br />
| CX25871<br />
| Conexant<br />
| Digital Video Encoder (same pinout as Bt868/869)<br />
|-<br />
| U4G1<br />
| G-5<br />
| SC1110CS<br />
| Semtech<br />
| Sink and Source DC/DC Controller for Termination Power Supply<br />
|-<br />
| U5F1<br />
| F-5<br />
| K4D263238M<br />
| Samsung<br />
| 1Mx32Bitx4 DDR Synchronous RAM<br />
|-<br />
| U6A1<br />
| A-6<br />
| LF353<br />
| Texas Instruments<br />
| Dual General-Purpose JFET-input Operational Amplifier<br />
|-<br />
| U6B1<br />
| B-6<br />
| WM9709<br />
| Wolfson Micro<br />
| High-quality stereo audio DAC (Digital to Analog converter)<br />
|-<br />
| U6D1<br />
| D-6<br />
| K4D263238M<br />
| Samsung<br />
| 1Mx32Bitx4 DDR Synchronous RAM<br />
|-<br />
| U6E1<br />
| E-6<br />
| MCPX<br />
| nVidia<br />
| Media and Communications Processor<br />
|-<br />
| U6F1<br />
| F-6<br />
| ADM1032<br />
| Analog Devices<br />
| +-1°C Remote and Local System Temperature Monitor<br />
|-<br />
| U6N1 <br />
| N-6<br />
| K4D263238M<br />
| Samsung<br />
| 1Mx32Bitx4 DDR Synchronous RAM<br />
|-<br />
| U7B1<br />
| B-7<br />
| 1893AF<br />
| Integrated Circuit Systems<br />
| 3.3V 10Base-T/100Base-TX Integrated PHYceiver<br />
|-<br />
| U7B2<br />
| B-7<br />
| PIC16LC63A-04/S0 <br />
| Microchip<br />
| Low voltage 8bit CMOS microcontroller with A/D converter<br />
|-<br />
| U7C1<br />
| C-7<br />
| 388R<br />
| Integrated Circuit Systems<br />
| Quad PLL Quick Turn Clock Synthesizer<br />
|-<br />
| U7C2 <br />
| C-7<br />
| BR24C02<br />
| Rohm<br />
| I2C BUS compatible Serial EEPROM<br />
|-<br />
| U7C3<br />
| C-7<br />
| 331M<br />
| Integrated Circuit Systems<br />
| Single Output Clock<br />
|-<br />
| U7D1<br />
| D-7<br />
| M29F080A<br />
| ST Microelectronics<br />
| 8 MBit (1MB X8, Uniform block) single supply flash memory<br />
|-<br />
| U7P1<br />
| P-7 <br />
| <empty><br />
| <n/a> <br />
| <n/a><br />
|}<br />
<br />
=== USB Daughterboard ===<br />
<br />
* [https://github.com/Teufelchen1/XBOX-USB-HUB Homemade PCB remake by Teufelchen]<br />
<br />
[[File:USB_Daughterboard_front.png|100px|thumb|right|Xbox Version 1.0 USB Daughterboard]]<br />
<br />
{| class="wikitable"<br />
!| Device<br />
! Part Number<br />
! Manufacture<br />
! Description<br />
|- <br />
| U2 <br />
| TUSB2046B<br />
| Texas Instruments<br />
| 4-Port Hub for USB w/Optional Serial EEPROM Interface<br />
|}<br />
<br />
== Xbox 1.1 ==<br />
<br />
* [https://web.archive.org/web/20180210173816/http://diy.sickmods.net/Tutorials/Xbox1/Hi-Res_Scans/ PCB scan by SICKmods]{{FIXME|reason=Should live in some repo or something; we also have permission to this; https://discordapp.com/channels/428359196719972353/428359434230693899/561462101214756876 / https://media.discordapp.net/attachments/428359434230693899/561462101214756874/image0.png}}<br />
<br />
{{FIXME}}<br />
<br />
== Xbox 1.2 ==<br />
<br />
{{FIXME}}<br />
<br />
== Xbox 1.3 ==<br />
<br />
{{FIXME}}<br />
<br />
== Xbox 1.4 ==<br />
<br />
* [https://drive.google.com/drive/folders/17s6jIVTE3YztuqDr-ZxkhhXRutcDdY9O PCB scan by LoveMHz]{{FIXME|reason=Should live in some repo or something}}<br />
<br />
{{FIXME}}<br />
<br />
== Xbox 1.5 ==<br />
<br />
{{FIXME}}<br />
<br />
== Xbox 1.6 ==<br />
<br />
* [https://web.archive.org/web/20180210173816/http://diy.sickmods.net/Tutorials/Xbox1/Hi-Res_Scans/ PCB scan by SICKmods]{{FIXME|reason=Should live in some repo or something; we also have permission to this; https://discordapp.com/channels/428359196719972353/428359434230693899/561462101214756876 / https://media.discordapp.net/attachments/428359434230693899/561462101214756874/image0.png}}<br />
<br />
{{FIXME}}<br />
<br />
== References ==<br />
* [https://web.archive.org/web/20040826151041/http://console-dev.com:80/IC.htm http://console-dev.com:80/IC.htm Documentation by PiXEL8]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Shrek&diff=6807Shrek2019-12-22T23:47:26Z<p>JayFoxRox: Add note about tweet which discusses Shrek</p>
<hr />
<div>{{Game}}<br />
<br />
=== Deferred Rendering ===<br />
<br />
[[File:shrek-albedo.png|thumb|Albedo]]<br />
[[File:shrek-normals.png|thumb|Normals]]<br />
[[File:shrek-unk0.png|thumb|Lighting pass{{FIXME|reason=Might be something else}}]]<br />
[[File:shrek-unk1.png|thumb|Lighting pass{{FIXME|reason=Might be something else}}]]<br />
[[File:shrek-final.png|thumb|Final composition]]<br />
<br />
Shrek uses [[wikipedia:Deferred Rendering|Deferred Rendering]]. Rich Geldreich, a developer of the game, has written multiple articles about the topic[https://sites.google.com/site/richgel99/home].<br />
<br />
=== Notes ===<br />
<br />
* [https://twitter.com/richgel999/status/1208238264240361472 Tweet by Rich Geldreich about development in preparation for E3 demo of Shrek]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Xbox_DVD_Movie_Playback_Kit&diff=6806Xbox DVD Movie Playback Kit2019-12-19T08:01:09Z<p>JayFoxRox: Add source for dongle having to do with licensing</p>
<hr />
<div>[[File:Xbox-Remote-and-Receiver.jpg|thumb|200px|Remote and Receiver]]<br />
==Introduction==<br />
<br />
The DVD Movie Playback Kit contains 2 parts: A remote and a dongle for the Xbox{{FIXME|reason=One of these parts, or both, seem to have a model number PG8012?}}.<br />
<br />
== Remote Control ==<br />
<br />
=== Infrared interface ===<br />
<br />
{{FIXME|reason=Missing info about light frequency, timing, possible preamble and more}}<br />
<br />
{{FIXME|reason=The following information has been derived from http://lirc.sourceforge.net/remotes/microsoft/Xbox and all logic was extrapolated; it's entirely unconfirmed}}<br />
<br />
<pre><br />
struct {<br />
uint8_t check_high; // 8 bit check<br />
uint8_t check_low__data_high; // 4 bit check, 4 bit data<br />
uint8_t data_low; // 8 bit data<br />
};<br />
</pre><br />
<br />
The first part of the transfer consists of the negated data signal (<code>check</code>).<br />
<br />
The data integrity can be confirmed by XOR-ing both parts:<br />
<br />
<pre><br />
check = (check_high << 4) | check_low<br />
data = (data_high << 8) | data_low<br />
check ^ data = 0xFFF<br />
</pre><br />
<br />
The <code>check</code>, which marks the start of the transfer{{FIXME|reason=There might be a preamble}}, always starts with 0b0101, therefore the <code>data</code> always starts with 0b1010.<br />
<br />
== Dongle ==<br />
<br />
The dongle contains a ROM with an XBE which provides some functions for the DVD playback application. However, the XBE is not standalone.<br />
<br />
Why would they not just put this little < 512kiB library on the harddisk? Why another ROM which contains the program?<br />
One could think it is to allow them to upgrade the application easily, but the real reason seems to be different: licensing. As the label on the back notes: "Made under license from Dolby Laboratories". By including the software in the DVD Remote kit, they didn't have to pay the [[wikipedia:DVD Forum|DVD Forum]] (and apparently also Dolby) for every Xbox sold, but just for every DVD Remote kit sold[https://www.youtube.com/watch?v=gquAV8f7OAY&t=2059]. This allowed them to keep the cost of the Xbox down.<br />
<br />
Additionally the dongle contains an IR receiver to receive commands from the Remote control.<br />
<br />
=== Known versions ===<br />
<br />
{| class="wikitable" <!-- Version is: "%X.%X" % (version >> 8, version & 0xFF) --><br />
! Part No. !! Manufactured in !! Version !! DVD Region !! ROM Size !! ROM SHA1 !! Notes<br />
|-<br />
| X08-25402 || Indonesia || 1.1 || 2 || 229790 Bytes || <code>70d4b5f8e073b05610fba9e9617d7356196b61ff</code> || <br />
|-<br />
| X08-25402-002 || Indonesia || 1.1 ||2 || 229790 Bytes || <code>70d4b5f8e073b05610fba9e9617d7356196b61ff</code> || <br />
|-<br />
| X08-25387 || Indonesia || || || || ||<br />
|-<br />
| X08-25387-002 || Indonesia || 1.1 || 1 || 229790 Bytes || <code>73814aa736d83d636380f5c6b1c291441b35354d</code> || Sticker: "2341P" on PCB<br />
|}<br />
<br />
=== USB Protocol ===<br />
<br />
==== Infrared signals ====<br />
<br />
<!-- The following information has been derived from http://lirc.sourceforge.net/remotes/microsoft/lircd.conf.xbox + own research --><br />
<br />
When infrared signals are received from the Remote Control, they can be read using an interrupt transfer {{FIXME|reason=What interface etc?}}. Each USB payload is 6 bytes long:<br />
<br />
<pre><br />
struct {<br />
uint8_t unk; // always 0x00 (These could be length high bits?)<br />
uint8_t length_low; // always 0x06<br />
uint8_t data_low;<br />
uint8_t data_high; // only lower 4 bit are used<br />
// Milliseconds since last press (will clamp to 0xFFFF when no button was pressed in a long time).<br />
// A value close to 0x0040 is returned for continously holding a button.<br />
// When holding, the value often goes back and forth between 0x0040 / 0x0041.<br />
// It is unknown if the receiver / remote intentionally does this.<br />
uint8_t timer_low;<br />
uint8_t timer_high;<br />
};<br />
</pre><br />
<br />
==== Firmware download ====<br />
<br />
See https://github.com/XboxDev/dump-dvd-kit {{FIXME|reason=Document the protocol here}}<br />
<br />
=== Components ===<br />
<br />
Different versions of the dongle seem to use different hardware internally.<br />
<br />
==== X08-25387-002 (PCB: "X01469-100") ====<br />
<br />
* U1 ATMEL AT43USB352M-AC{{FIXME|reason=Can't find datasheet.. only for AT43USB351M-AC and AT43USB353M-AC; both of which have various differences}}<br />
* U2 TSOP-1556<br />
* U3 X393121C{{FIXME|reason=What is this? a ROM? how large?}}<br />
<br />
==== X08-25387 (PCB: "IR DONGLE REV B") ====<br />
[[File:X08-25387-Sticker.jpeg|thumb|200px|X08-25387 Rev B Sticker]]<br />
[[File:IR_DONGLEREVB-FRNT.jpeg|thumb|200px|Front PCB of X08-25387]]<br />
<br />
* U3 MX23C4000TC-10<br />
<br />
{{FIXME|reason=Didn't get rear components photographed yet}}73814aa736d83d636380f5c6b1c291441b35354d<br />
<br />
==== Unknown version (PCB: "REV C.") ====<br />
<br />
[[File:Xbox-linux-dvd-dongle-front.jpg|thumb|200px|Frontside]]<br />
[[File:Xbox-linux-dvd-dongle-back.jpg|thumb|200px|Backside]]<br />
<br />
* U1 92163 [https://web.archive.org/web/20100617020513/http://www.st.com/ STMicroelectronics] &lt;[https://web.archive.org/web/20100617020513/http://www.st.com/stonline/books/pdf/docs/5521.pdf Datasheet]&gt;<br />
: This big square IC on the backside is the microcontroller. STMicroelectronics describes it as "8/16-BIT FULL SPEED USB MCU FOR COMPOSITE DEVICES WITH 16 ENDPOINTS, 20K ROM, 2K RAM, I 2 C, SCI, &amp; MFT". Since the program resides inside in its ROM, it is almost impossible to extract the program from inside.<br />
<br />
* U2 TSOP-1556 [https://web.archive.org/web/20100617020513/http://www.vishay.com/ Vishay Telefunken] &lt;[https://web.archive.org/web/20100617020513/http://www.vishay.com/docs/82029/82029.pdf Datasheet]&gt;<br />
: This black box on the middle of the frontside is an integrated IR receiver. It filters the received infrared pulses and demodulates them. Its filter frequency is 56kHz, while 38kHz is standard for most remote controls. Therefore, chances are few other remotes will work with the Xbox receiver.<br />
<br />
* U3 MX23C4000TC-10 [https://web.archive.org/web/20100617020513/http://www.macronix.com/ Macronix] &lt;[https://web.archive.org/web/20100617020513/http://www.macronix.com/QuickPlace/hq/PageLibrary48256D9D002BA613.nsf/h_6057FA6682A90C3948256DCE0052D2D3/67DCB124F1BE4E7D48256DC50039AC31/$File/MX23C4000-4.2.pdf/?OpenElement Datasheet]&gt;<br />
: This wide TSOP IC on the frontside could be the most interesting of all. It is a 4MBit mask ROM.<br />
<br />
* U4 HC574 [https://web.archive.org/web/20100617020513/http://www.ti.com/ Texas Instruments] &lt;[https://web.archive.org/web/20100617020513/http://focus.ti.com/lit/ds/symlink/sn74hc574.pdf Datasheet]&gt;<br />
: This 20-pin standard logic IC is an octal D-flipflop, which splits the databus from the 92163 to 8 adress bits. This technique is very well known from the 8051 and other microcontrollers.<br />
<br />
== References ==<br />
<br />
* [https://ibb.co/album/cmr5rF Pictures of X08-25387-002 including internals]<br />
* [https://web.archive.org/web/20100617020513/http://www.xbox-linux.org/wiki/DVD-IR_Internals DVD-IR Internals]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=XPR&diff=6795XPR2019-10-24T16:32:44Z<p>JayFoxRox: Add some rough information about XPRs</p>
<hr />
<div>'''XPR''' probably stands for '''Xbox Packed Resource'''. It's a structure and file-format used by the [[Microsoft XDK]].<br />
It is being used in parts of [[XAPI]].<br />
<br />
XPRs can store a variety of different data types that are useful for Xbox D3D.<br />
XPRs are storing data similar to internal structures in the D3D driver. So D3D has mechanisms to simply load such resources into D3D objects (by moving them into GPU accessible memory).<br />
<br />
The structure is something like this{{FIXME|Untested pseudo-code}}:<br />
<br />
<pre><br />
struct {<br />
char magic[4]; // Always "XPR0" / 0x30525058<br />
uint32_t size; // Size of XPR (including magic and this field)<br />
uint32_t header_size; // Size of the following header (always 2048?)<br />
} XPR;<br />
</pre><br />
<br />
This is followed by:<br />
<br />
<pre><br />
union {<br />
struct {<br />
union {<br />
uint32_t flags; // Type information and who "owns" this resource<br />
struct {<br />
uint32_t ref_count:16; // (lowest bits)<br />
uint32_t type:3;<br />
uint32_t unk3:13; // (highest bits)<br />
};<br />
};<br />
union { // Vertexbuffer (type 0x0)<br />
...<br />
} vertexbuffer;<br />
union { // Indexbuffer (type 0x1)<br />
...<br />
} indexbuffer;<br />
union { // Unknown (type 0x2)<br />
...<br />
} ...;<br />
union { // Unknown (type 0x3)<br />
...<br />
} ...;<br />
union { // Texture (type 0x4)<br />
uint32_t unk0; // Always 0?<br />
uint32_t unk1; // Always 0?<br />
uint32_t format; // GPU register<br />
uint32_t unk2; // Always 0?<br />
uint32_t end; // Always 0xFFFFFFFF<br />
} texture;<br />
union { // Unknown (type 0x5)<br />
...<br />
} ...;<br />
union { // Unknown (type 0x6)<br />
...<br />
} ...;<br />
union { // Unknown (type 0x7)<br />
...<br />
} ...;<br />
};<br />
uint8_t pad[2048]; // Padded with 0xAD bytes<br />
} XPR_header;<br />
</pre><br />
<br />
{{FIXME|one of the unknowns in the texture is probably offset into data}}<br />
<br />
The headers are then followed by the resource data.</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=User:JayFoxRox&diff=6794User:JayFoxRox2019-10-24T15:53:11Z<p>JayFoxRox: Add more savegame notes</p>
<hr />
<div>For contact details, see http://jannikvogel.de/<br />
<br />
= Unfinished information =<br />
<br />
== Savegame notes ==<br />
<br />
There's no database or anything for savegames - the directory-listing APIs are used to enumerate all savegames.<br />
The data is obviously in E:/UDATA/.<br />
Each XBE has a subdirectory for it's title-id.<br />
Then each save is a subdirectory (I'm not sure about the name; but it's some 48-bit hex value).<br />
<br />
XAPI would normally initialize title-images before `main()` of the XBE.<br />
The data is copied from sections "$$XTIMAGE" (TitleImage.xbx) and "$XSIMAGE" (saveimage.xbx in savegame folder).<br />
I believe the saveimage can differ for different save-games, which implies that they probably have another API.<br />
I'm also not sure where it would put saveimages, because no savegame exists then.<br />
The images are [[XPR]], and could theoretically be any format supported by the GPU.<br />
The dashboard expects them to be swizzled (checks on load imply this), but linear textures might still work.<br />
<br />
Metadata is stored in TitleMeta.xbx and SaveMeta.xbx (in savegame folder).<br />
I'm not sure when / how they are initialized.<br />
I'm not sure if they are already shown in the dashboard, even if metadata is missing.<br />
<br />
Metadata are INI files, which are implicitly prefixed with `[default]`.<br />
I don't think there's any comments allowed.<br />
I believe that XAPI has a hardcoded emitter. Whereas the dashboard has some INI parser.<br />
I'm not sure about the parser in XAPI (or if it even has one).<br />
<br />
I believe metadata also supports keys without values.<br />
<br />
When reading, it will try to read a localized version first, before reading from the `[default]` section.<br />
I have looked at many savegames, but had never seen this. I'm not sure if this was ever used.<br />
<br />
I believe the metadata files can be ASCII or Unicode (using [Unicode BOM prefix](https://en.wikipedia.org/wiki/Byte_order_mark))<br />
<br />
Titledata in E:/TDATA is similar.<br />
The user soundtrack / music collection is using a database file. See [[Soundtracks]].<br />
<br />
=== TitleMeta.xbx locales ===<br />
<br />
Put this into a file and move it to "E:/UDATA/13371337/TitleMeta.xbx" and check which languages your MS dashboard supports.<br />
I have dumped the locales from a list in xboxdash.xbe in dashboard version 1.00.5960.01 from Germany.<br />
I've then tried all languages that my Xbox dashboard supported in NTSC mode.<br />
<br />
<pre><br />
TitleName=#Known locale - (fallback, same as [default])<br />
<br />
[ZW]<br />
TitleName=#Unknown locale [zw]<br />
[ZA]<br />
TitleName=#Unknown locale [za]<br />
[YE]<br />
TitleName=#Unknown locale [ye]<br />
[VN]<br />
TitleName=#Unknown locale [vn]<br />
[VE]<br />
TitleName=#Unknown locale [ve]<br />
[UZ]<br />
TitleName=#Unknown locale [uz]<br />
[UY]<br />
TitleName=#Unknown locale [uy]<br />
[US]<br />
TitleName=#Unknown locale [us]<br />
[UA]<br />
TitleName=#Unknown locale [ua]<br />
[TW]<br />
TitleName=#Unknown locale [tw]<br />
[TT]<br />
TitleName=#Unknown locale [tt]<br />
[TR]<br />
TitleName=#Unknown locale [tr]<br />
[TN]<br />
TitleName=#Unknown locale [tn]<br />
[TH]<br />
TitleName=#Unknown locale [th]<br />
[SY]<br />
TitleName=#Unknown locale [sy]<br />
[SV]<br />
TitleName=#Unknown locale [sv]<br />
[SK]<br />
TitleName=#Unknown locale [sk]<br />
[SI]<br />
TitleName=#Unknown locale [si]<br />
[SG]<br />
TitleName=#Unknown locale [sg]<br />
[SE]<br />
TitleName=#Unknown locale [se]<br />
[SA]<br />
TitleName=#Unknown locale [sa]<br />
[RU]<br />
TitleName=#Unknown locale [ru]<br />
[RO]<br />
TitleName=#Unknown locale [ro]<br />
[QA]<br />
TitleName=#Unknown locale [qa]<br />
[PY]<br />
TitleName=#Unknown locale [py]<br />
[PT]<br />
TitleName=#Unknown locale [pt]<br />
[PR]<br />
TitleName=#Unknown locale [pr]<br />
[PL]<br />
TitleName=#Unknown locale [pl]<br />
[PK]<br />
TitleName=#Unknown locale [pk]<br />
[PH]<br />
TitleName=#Unknown locale [ph]<br />
[PE]<br />
TitleName=#Unknown locale [pe]<br />
[PA]<br />
TitleName=#Unknown locale [pa]<br />
[OM]<br />
TitleName=#Unknown locale [om]<br />
[NZ]<br />
TitleName=#Unknown locale [nz]<br />
[NO]<br />
TitleName=#Unknown locale [no]<br />
[NL]<br />
TitleName=#Unknown locale [nl]<br />
[NI]<br />
TitleName=#Unknown locale [ni]<br />
[MY]<br />
TitleName=#Unknown locale [my]<br />
[MX]<br />
TitleName=#Unknown locale [mx]<br />
[MV]<br />
TitleName=#Unknown locale [mv]<br />
[MO]<br />
TitleName=#Unknown locale [mo]<br />
[MN]<br />
TitleName=#Unknown locale [mn]<br />
[MK]<br />
TitleName=#Unknown locale [mk]<br />
[MC]<br />
TitleName=#Unknown locale [mc]<br />
[MA]<br />
TitleName=#Unknown locale [ma]<br />
[LY]<br />
TitleName=#Unknown locale [ly]<br />
[LV]<br />
TitleName=#Unknown locale [lv]<br />
[LU]<br />
TitleName=#Unknown locale [lu]<br />
[LT]<br />
TitleName=#Unknown locale [lt]<br />
[LI]<br />
TitleName=#Unknown locale [li]<br />
[LB]<br />
TitleName=#Unknown locale [lb]<br />
[KZ]<br />
TitleName=#Unknown locale [kz]<br />
[KW]<br />
TitleName=#Unknown locale [kw]<br />
[KR]<br />
TitleName=#Unknown locale [kr]<br />
[KG]<br />
TitleName=#Unknown locale [kg]<br />
[KE]<br />
TitleName=#Unknown locale [ke]<br />
[JP]<br />
TitleName=#Unknown locale [jp]<br />
[JO]<br />
TitleName=#Unknown locale [jo]<br />
[JM]<br />
TitleName=#Unknown locale [jm]<br />
[IT]<br />
TitleName=#Unknown locale [it]<br />
[IS]<br />
TitleName=#Unknown locale [is]<br />
[IR]<br />
TitleName=#Unknown locale [ir]<br />
[IQ]<br />
TitleName=#Unknown locale [iq]<br />
[IN]<br />
TitleName=#Unknown locale [in]<br />
[IL]<br />
TitleName=#Unknown locale [il]<br />
[IE]<br />
TitleName=#Unknown locale [ie]<br />
[ID]<br />
TitleName=#Unknown locale [id]<br />
[HU]<br />
TitleName=#Unknown locale [hu]<br />
[HR]<br />
TitleName=#Unknown locale [hr]<br />
[HN]<br />
TitleName=#Unknown locale [hn]<br />
[HK]<br />
TitleName=#Unknown locale [hk]<br />
[GT]<br />
TitleName=#Unknown locale [gt]<br />
[GR]<br />
TitleName=#Unknown locale [gr]<br />
[GE]<br />
TitleName=#Unknown locale [ge]<br />
[GB]<br />
TitleName=#Unknown locale [gb]<br />
[FR]<br />
TitleName=#Unknown locale [fr]<br />
[FO]<br />
TitleName=#Unknown locale [fo]<br />
[FI]<br />
TitleName=#Unknown locale [fi]<br />
[ES]<br />
TitleName=#Unknown locale [es]<br />
[EG]<br />
TitleName=#Unknown locale [eg]<br />
[EE]<br />
TitleName=#Unknown locale [ee]<br />
[EC]<br />
TitleName=#Unknown locale [ec]<br />
[DZ]<br />
TitleName=#Unknown locale [dz]<br />
[DO]<br />
TitleName=#Unknown locale [do]<br />
[DK]<br />
TitleName=#Unknown locale [dk]<br />
[DE]<br />
TitleName=#Unknown locale [de]<br />
[CZ]<br />
TitleName=#Unknown locale [cz]<br />
[CR]<br />
TitleName=#Unknown locale [cr]<br />
[CO]<br />
TitleName=#Unknown locale [co]<br />
[CN]<br />
TitleName=#Unknown locale [cn]<br />
[CL]<br />
TitleName=#Unknown locale [cl]<br />
[CH]<br />
TitleName=#Unknown locale [ch]<br />
[CA]<br />
TitleName=#Unknown locale [ca]<br />
[BZ]<br />
TitleName=#Unknown locale [bz]<br />
[BY]<br />
TitleName=#Unknown locale [by]<br />
[BR]<br />
TitleName=#Unknown locale [br]<br />
[BO]<br />
TitleName=#Unknown locale [bo]<br />
[BN]<br />
TitleName=#Unknown locale [bn]<br />
[BH]<br />
TitleName=#Unknown locale [bh]<br />
[BG]<br />
TitleName=#Unknown locale [bg]<br />
[BE]<br />
TitleName=#Unknown locale [be]<br />
[AZ]<br />
TitleName=#Unknown locale [az]<br />
[AU]<br />
TitleName=#Unknown locale [au]<br />
[AT]<br />
TitleName=#Unknown locale [at]<br />
[AR]<br />
TitleName=#Unknown locale [ar]<br />
[AM]<br />
TitleName=#Unknown locale [am]<br />
[AL]<br />
TitleName=#Unknown locale [al]<br />
[AE]<br />
TitleName=#Unknown locale [ae]<br />
<br />
[default]<br />
TitleName=#Known locale [default] - (fallback)<br />
[EN]<br />
TitleName=#Known locale [EN] - english<br />
[JA]<br />
TitleName=#Known locale [JA] - (japanese)<br />
[DE]<br />
TitleName=#Known locale [DE] - deutsch<br />
[FR]<br />
TitleName=#Known locale [FR] - francais<br />
[ES]<br />
TitleName=#Known locale [ES] - espanol<br />
[IT]<br />
TitleName=#Known locale [IT] - italiano<br />
[KO]<br />
TitleName=#Known locale [KO] - (korean)<br />
[TW]<br />
TitleName=#Known locale [TW] - (taiwanese)<br />
[BR]<br />
TitleName=#Known locale [BR] - portugues<br />
</pre><br />
<br />
== THPS2X Syslink crash ==<br />
<br />
Happens if too many servers are present (this is where data is written to driver?):<br />
<br />
<pre><br />
Hardware watchpoint 1: *(int*)0xD004D048<br />
<br />
Old value = 1065353216<br />
New value = 1500647462<br />
0x00215adf in ?? ()<br />
(gdb) pint $eip<br />
Undefined command: "pint". Try "help".<br />
(gdb) print $eip<br />
$1 = (void (*)()) 0x215adf<br />
</pre><br />
<br />
And this seems to copy server to database (this in particular copied string?):<br />
<br />
<pre><br />
Hardware watchpoint 1: *(int*)0xf47944<br />
<br />
Old value = 926102321<br />
New value = 858992984<br />
0x00156cc3 in ?? ()<br />
(gdb) print $eip<br />
$2 = (void (*)()) 0x156cc3<br />
(gdb) info reg<br />
eax 0xd0043260 -805031328<br />
ecx 0x1d 29<br />
edx 0x0 0<br />
ebx 0xf20ce0 15863008<br />
esp 0xd004324c 0xd004324c<br />
ebp 0xf20ce0 0xf20ce0<br />
esi 0xd00432a0 -805031264<br />
edi 0xf47948 16021832<br />
eip 0x156cc3 0x156cc3<br />
eflags 0x246 [ PF ZF IF ]<br />
cs 0x8 8<br />
ss 0x10 16<br />
ds 0x10 16<br />
es 0x10 16<br />
fs 0x20 32<br />
gs 0x0 0<br />
(gdb) x/10i $eip<br />
=> 0x156cc3: rep movsl %ds:(%esi),%es:(%edi)<br />
0x156cc5: call 0x1b9db6<br />
0x156cca: mov 0x29b44(%ebx),%ecx<br />
0x156cd0: mov 0x10(%esp),%edx<br />
0x156cd4: imul $0x78,%ecx,%ecx<br />
0x156cd7: mov %edx,0x26ca8(%ecx,%ebx,1)<br />
0x156cde: mov 0x14(%esp),%eax<br />
0x156ce2: mov %eax,0x26cac(%ecx,%ebx,1)<br />
0x156ce9: mov 0x29b44(%ebx),%eax<br />
0x156cef: mov (%ebx),%edx<br />
</pre><br />
<br />
== Reset ==<br />
<br />
There are various methods to reset an Xbox or major parts of it (successfully or not).<br />
<br />
=== SMC Cold Reboot ===<br />
<br />
* CPU cycles: X > 0<br />
<br />
=== SMC Warm Reboot ===<br />
<br />
* CPU cycles: X > 0<br />
<br />
=== PM26 ===<br />
<br />
* CPU cycles: X > 0<br />
<br />
=== RST_CNT (RST_CPU) === <br />
[https://www.intel.com/content/dam/doc/datasheet/82801ba-i-o-controller-hub-2-82801bam-i-o-controller-hub-2-mobile-datasheet.pdf equivalent docs?]<br />
=== RST_CNT (RST_CPU + SYS_RST) === <br />
=== RST_CNT (RST_CPU + FULL_RST) === <br />
=== RST_CNT (RST_CPU + SYS_RST + FULL_RST) ===<br />
<br />
* CPU cycles: 0<br />
<br />
=== Triple fault ===<br />
<br />
* CPU cycles: 0{{FIXME|reason=untested}}<br />
<br />
=== PCI-to-PCI bridge secondary bus reset ===<br />
<br />
* CPU cycles: X > 0<br />
<br />
----</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=XQEMU&diff=6793XQEMU2019-10-23T16:38:13Z<p>JayFoxRox: Remove full compatiblity list and clarify the state of the existing list</p>
<hr />
<div>xqemu is a low-level Xbox / Chihiro Emulator started in mid-late 2012 by espes[https://github.com/espes/xqemu/commit/d823f5802e7c4c84163aea8b4d924044951c705e].<br />
<br />
The official homepage can be found at [http://xqemu.com xqemu.com]<br />
<br />
== Compatiblity list ==<br />
<br />
There is a temporary compatibility list that was almost entirely created by [https://www.youtube.com/user/pcmaker2 pcmaker (also known as John Godgames)] since 2015. The [https://docs.google.com/spreadsheets/d/1sVtQ9SNPathKAMCqfYtvJQP0bs0UeLzP9otPHvZDMwE/edit#gid=709879345 newest compatibility list from 2018] still has some problems though. You should not blindly trust these reports.<br />
<br />
A major issue is that the version information for some reports is incorrect.<br />
This means that some games are reported as working, when they don't work in official versions (yet).<br />
They were tested with development versions build by developers, using incomplete features.<br />
Some of those features might also not be public anymore, so you can't even repeat those tests.<br />
XQEMU is also under development, new features in the official versions might have resolved some issues, or caused new ones.<br />
<br />
You should only use these compatibility reports to get a rough idea about the state of XQEMU and where development is heading.<br />
You can also search for XQEMU videos on YouTube (like "XQEMU Halo") and you'll usually find something.<br />
Note that many of those videos are also made using development builds that aren't always public.<br />
Typically, the video descriptions contain more information about the used builds.<br />
<br />
== XQEMU-JFR ==<br />
<br />
XQEMU-JFR is a now defunct fork of XQEMU by JayFoxRox.<br />
Most of the changes have since been integrated back into the official version of XQEMU.<br />
The archived version can be found at https://github.com/JayFoxRox/xqemu-jfr</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=User:JayFoxRox&diff=6792User:JayFoxRox2019-10-21T00:12:22Z<p>JayFoxRox: Add more info about locales</p>
<hr />
<div>For contact details, see http://jannikvogel.de/<br />
<br />
= Unfinished information =<br />
<br />
== TitleMeta.xbx locales ==<br />
<br />
Put this into a file and move it to "E:/UDATA/13371337/TitleMeta.xbx" and check which languages your MS dashboard supports.<br />
I have dumped the locales from a list in xboxdash.xbe in dashboard version 1.00.5960.01 from Germany.<br />
I've then tried all languages that my Xbox dashboard supported in NTSC mode.<br />
<br />
<pre><br />
TitleName=#Known locale - (fallback, same as [default])<br />
<br />
[ZW]<br />
TitleName=#Unknown locale [zw]<br />
[ZA]<br />
TitleName=#Unknown locale [za]<br />
[YE]<br />
TitleName=#Unknown locale [ye]<br />
[VN]<br />
TitleName=#Unknown locale [vn]<br />
[VE]<br />
TitleName=#Unknown locale [ve]<br />
[UZ]<br />
TitleName=#Unknown locale [uz]<br />
[UY]<br />
TitleName=#Unknown locale [uy]<br />
[US]<br />
TitleName=#Unknown locale [us]<br />
[UA]<br />
TitleName=#Unknown locale [ua]<br />
[TW]<br />
TitleName=#Unknown locale [tw]<br />
[TT]<br />
TitleName=#Unknown locale [tt]<br />
[TR]<br />
TitleName=#Unknown locale [tr]<br />
[TN]<br />
TitleName=#Unknown locale [tn]<br />
[TH]<br />
TitleName=#Unknown locale [th]<br />
[SY]<br />
TitleName=#Unknown locale [sy]<br />
[SV]<br />
TitleName=#Unknown locale [sv]<br />
[SK]<br />
TitleName=#Unknown locale [sk]<br />
[SI]<br />
TitleName=#Unknown locale [si]<br />
[SG]<br />
TitleName=#Unknown locale [sg]<br />
[SE]<br />
TitleName=#Unknown locale [se]<br />
[SA]<br />
TitleName=#Unknown locale [sa]<br />
[RU]<br />
TitleName=#Unknown locale [ru]<br />
[RO]<br />
TitleName=#Unknown locale [ro]<br />
[QA]<br />
TitleName=#Unknown locale [qa]<br />
[PY]<br />
TitleName=#Unknown locale [py]<br />
[PT]<br />
TitleName=#Unknown locale [pt]<br />
[PR]<br />
TitleName=#Unknown locale [pr]<br />
[PL]<br />
TitleName=#Unknown locale [pl]<br />
[PK]<br />
TitleName=#Unknown locale [pk]<br />
[PH]<br />
TitleName=#Unknown locale [ph]<br />
[PE]<br />
TitleName=#Unknown locale [pe]<br />
[PA]<br />
TitleName=#Unknown locale [pa]<br />
[OM]<br />
TitleName=#Unknown locale [om]<br />
[NZ]<br />
TitleName=#Unknown locale [nz]<br />
[NO]<br />
TitleName=#Unknown locale [no]<br />
[NL]<br />
TitleName=#Unknown locale [nl]<br />
[NI]<br />
TitleName=#Unknown locale [ni]<br />
[MY]<br />
TitleName=#Unknown locale [my]<br />
[MX]<br />
TitleName=#Unknown locale [mx]<br />
[MV]<br />
TitleName=#Unknown locale [mv]<br />
[MO]<br />
TitleName=#Unknown locale [mo]<br />
[MN]<br />
TitleName=#Unknown locale [mn]<br />
[MK]<br />
TitleName=#Unknown locale [mk]<br />
[MC]<br />
TitleName=#Unknown locale [mc]<br />
[MA]<br />
TitleName=#Unknown locale [ma]<br />
[LY]<br />
TitleName=#Unknown locale [ly]<br />
[LV]<br />
TitleName=#Unknown locale [lv]<br />
[LU]<br />
TitleName=#Unknown locale [lu]<br />
[LT]<br />
TitleName=#Unknown locale [lt]<br />
[LI]<br />
TitleName=#Unknown locale [li]<br />
[LB]<br />
TitleName=#Unknown locale [lb]<br />
[KZ]<br />
TitleName=#Unknown locale [kz]<br />
[KW]<br />
TitleName=#Unknown locale [kw]<br />
[KR]<br />
TitleName=#Unknown locale [kr]<br />
[KG]<br />
TitleName=#Unknown locale [kg]<br />
[KE]<br />
TitleName=#Unknown locale [ke]<br />
[JP]<br />
TitleName=#Unknown locale [jp]<br />
[JO]<br />
TitleName=#Unknown locale [jo]<br />
[JM]<br />
TitleName=#Unknown locale [jm]<br />
[IT]<br />
TitleName=#Unknown locale [it]<br />
[IS]<br />
TitleName=#Unknown locale [is]<br />
[IR]<br />
TitleName=#Unknown locale [ir]<br />
[IQ]<br />
TitleName=#Unknown locale [iq]<br />
[IN]<br />
TitleName=#Unknown locale [in]<br />
[IL]<br />
TitleName=#Unknown locale [il]<br />
[IE]<br />
TitleName=#Unknown locale [ie]<br />
[ID]<br />
TitleName=#Unknown locale [id]<br />
[HU]<br />
TitleName=#Unknown locale [hu]<br />
[HR]<br />
TitleName=#Unknown locale [hr]<br />
[HN]<br />
TitleName=#Unknown locale [hn]<br />
[HK]<br />
TitleName=#Unknown locale [hk]<br />
[GT]<br />
TitleName=#Unknown locale [gt]<br />
[GR]<br />
TitleName=#Unknown locale [gr]<br />
[GE]<br />
TitleName=#Unknown locale [ge]<br />
[GB]<br />
TitleName=#Unknown locale [gb]<br />
[FR]<br />
TitleName=#Unknown locale [fr]<br />
[FO]<br />
TitleName=#Unknown locale [fo]<br />
[FI]<br />
TitleName=#Unknown locale [fi]<br />
[ES]<br />
TitleName=#Unknown locale [es]<br />
[EG]<br />
TitleName=#Unknown locale [eg]<br />
[EE]<br />
TitleName=#Unknown locale [ee]<br />
[EC]<br />
TitleName=#Unknown locale [ec]<br />
[DZ]<br />
TitleName=#Unknown locale [dz]<br />
[DO]<br />
TitleName=#Unknown locale [do]<br />
[DK]<br />
TitleName=#Unknown locale [dk]<br />
[DE]<br />
TitleName=#Unknown locale [de]<br />
[CZ]<br />
TitleName=#Unknown locale [cz]<br />
[CR]<br />
TitleName=#Unknown locale [cr]<br />
[CO]<br />
TitleName=#Unknown locale [co]<br />
[CN]<br />
TitleName=#Unknown locale [cn]<br />
[CL]<br />
TitleName=#Unknown locale [cl]<br />
[CH]<br />
TitleName=#Unknown locale [ch]<br />
[CA]<br />
TitleName=#Unknown locale [ca]<br />
[BZ]<br />
TitleName=#Unknown locale [bz]<br />
[BY]<br />
TitleName=#Unknown locale [by]<br />
[BR]<br />
TitleName=#Unknown locale [br]<br />
[BO]<br />
TitleName=#Unknown locale [bo]<br />
[BN]<br />
TitleName=#Unknown locale [bn]<br />
[BH]<br />
TitleName=#Unknown locale [bh]<br />
[BG]<br />
TitleName=#Unknown locale [bg]<br />
[BE]<br />
TitleName=#Unknown locale [be]<br />
[AZ]<br />
TitleName=#Unknown locale [az]<br />
[AU]<br />
TitleName=#Unknown locale [au]<br />
[AT]<br />
TitleName=#Unknown locale [at]<br />
[AR]<br />
TitleName=#Unknown locale [ar]<br />
[AM]<br />
TitleName=#Unknown locale [am]<br />
[AL]<br />
TitleName=#Unknown locale [al]<br />
[AE]<br />
TitleName=#Unknown locale [ae]<br />
<br />
[default]<br />
TitleName=#Known locale [default] - (fallback)<br />
[EN]<br />
TitleName=#Known locale [EN] - english<br />
[JA]<br />
TitleName=#Known locale [JA] - (japanese)<br />
[DE]<br />
TitleName=#Known locale [DE] - deutsch<br />
[FR]<br />
TitleName=#Known locale [FR] - francais<br />
[ES]<br />
TitleName=#Known locale [ES] - espanol<br />
[IT]<br />
TitleName=#Known locale [IT] - italiano<br />
[KO]<br />
TitleName=#Known locale [KO] - (korean)<br />
[TW]<br />
TitleName=#Known locale [TW] - (taiwanese)<br />
[BR]<br />
TitleName=#Known locale [BR] - portugues<br />
</pre><br />
<br />
== THPS2X Syslink crash ==<br />
<br />
Happens if too many servers are present (this is where data is written to driver?):<br />
<br />
<pre><br />
Hardware watchpoint 1: *(int*)0xD004D048<br />
<br />
Old value = 1065353216<br />
New value = 1500647462<br />
0x00215adf in ?? ()<br />
(gdb) pint $eip<br />
Undefined command: "pint". Try "help".<br />
(gdb) print $eip<br />
$1 = (void (*)()) 0x215adf<br />
</pre><br />
<br />
And this seems to copy server to database (this in particular copied string?):<br />
<br />
<pre><br />
Hardware watchpoint 1: *(int*)0xf47944<br />
<br />
Old value = 926102321<br />
New value = 858992984<br />
0x00156cc3 in ?? ()<br />
(gdb) print $eip<br />
$2 = (void (*)()) 0x156cc3<br />
(gdb) info reg<br />
eax 0xd0043260 -805031328<br />
ecx 0x1d 29<br />
edx 0x0 0<br />
ebx 0xf20ce0 15863008<br />
esp 0xd004324c 0xd004324c<br />
ebp 0xf20ce0 0xf20ce0<br />
esi 0xd00432a0 -805031264<br />
edi 0xf47948 16021832<br />
eip 0x156cc3 0x156cc3<br />
eflags 0x246 [ PF ZF IF ]<br />
cs 0x8 8<br />
ss 0x10 16<br />
ds 0x10 16<br />
es 0x10 16<br />
fs 0x20 32<br />
gs 0x0 0<br />
(gdb) x/10i $eip<br />
=> 0x156cc3: rep movsl %ds:(%esi),%es:(%edi)<br />
0x156cc5: call 0x1b9db6<br />
0x156cca: mov 0x29b44(%ebx),%ecx<br />
0x156cd0: mov 0x10(%esp),%edx<br />
0x156cd4: imul $0x78,%ecx,%ecx<br />
0x156cd7: mov %edx,0x26ca8(%ecx,%ebx,1)<br />
0x156cde: mov 0x14(%esp),%eax<br />
0x156ce2: mov %eax,0x26cac(%ecx,%ebx,1)<br />
0x156ce9: mov 0x29b44(%ebx),%eax<br />
0x156cef: mov (%ebx),%edx<br />
</pre><br />
<br />
== Reset ==<br />
<br />
There are various methods to reset an Xbox or major parts of it (successfully or not).<br />
<br />
=== SMC Cold Reboot ===<br />
<br />
* CPU cycles: X > 0<br />
<br />
=== SMC Warm Reboot ===<br />
<br />
* CPU cycles: X > 0<br />
<br />
=== PM26 ===<br />
<br />
* CPU cycles: X > 0<br />
<br />
=== RST_CNT (RST_CPU) === <br />
[https://www.intel.com/content/dam/doc/datasheet/82801ba-i-o-controller-hub-2-82801bam-i-o-controller-hub-2-mobile-datasheet.pdf equivalent docs?]<br />
=== RST_CNT (RST_CPU + SYS_RST) === <br />
=== RST_CNT (RST_CPU + FULL_RST) === <br />
=== RST_CNT (RST_CPU + SYS_RST + FULL_RST) ===<br />
<br />
* CPU cycles: 0<br />
<br />
=== Triple fault ===<br />
<br />
* CPU cycles: 0{{FIXME|reason=untested}}<br />
<br />
=== PCI-to-PCI bridge secondary bus reset ===<br />
<br />
* CPU cycles: X > 0<br />
<br />
----</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=User:JayFoxRox&diff=6791User:JayFoxRox2019-10-21T00:08:57Z<p>JayFoxRox: </p>
<hr />
<div>For contact details, see http://jannikvogel.de/<br />
<br />
= Unfinished information =<br />
<br />
== TitleMeta.xbx locales ==<br />
<br />
Put this into a file and move it to "E:/UDATA/13371337/TitleMeta.xbx" and check which languages your MS dashboard supports (my results are from 1.00.5960.01 from Germany in NTSC mode):<br />
<br />
<pre><br />
TitleName=#Known locale - (fallback, same as [default])<br />
<br />
[ZW]<br />
TitleName=#Unknown locale [zw]<br />
[ZA]<br />
TitleName=#Unknown locale [za]<br />
[YE]<br />
TitleName=#Unknown locale [ye]<br />
[VN]<br />
TitleName=#Unknown locale [vn]<br />
[VE]<br />
TitleName=#Unknown locale [ve]<br />
[UZ]<br />
TitleName=#Unknown locale [uz]<br />
[UY]<br />
TitleName=#Unknown locale [uy]<br />
[US]<br />
TitleName=#Unknown locale [us]<br />
[UA]<br />
TitleName=#Unknown locale [ua]<br />
[TW]<br />
TitleName=#Unknown locale [tw]<br />
[TT]<br />
TitleName=#Unknown locale [tt]<br />
[TR]<br />
TitleName=#Unknown locale [tr]<br />
[TN]<br />
TitleName=#Unknown locale [tn]<br />
[TH]<br />
TitleName=#Unknown locale [th]<br />
[SY]<br />
TitleName=#Unknown locale [sy]<br />
[SV]<br />
TitleName=#Unknown locale [sv]<br />
[SK]<br />
TitleName=#Unknown locale [sk]<br />
[SI]<br />
TitleName=#Unknown locale [si]<br />
[SG]<br />
TitleName=#Unknown locale [sg]<br />
[SE]<br />
TitleName=#Unknown locale [se]<br />
[SA]<br />
TitleName=#Unknown locale [sa]<br />
[RU]<br />
TitleName=#Unknown locale [ru]<br />
[RO]<br />
TitleName=#Unknown locale [ro]<br />
[QA]<br />
TitleName=#Unknown locale [qa]<br />
[PY]<br />
TitleName=#Unknown locale [py]<br />
[PT]<br />
TitleName=#Unknown locale [pt]<br />
[PR]<br />
TitleName=#Unknown locale [pr]<br />
[PL]<br />
TitleName=#Unknown locale [pl]<br />
[PK]<br />
TitleName=#Unknown locale [pk]<br />
[PH]<br />
TitleName=#Unknown locale [ph]<br />
[PE]<br />
TitleName=#Unknown locale [pe]<br />
[PA]<br />
TitleName=#Unknown locale [pa]<br />
[OM]<br />
TitleName=#Unknown locale [om]<br />
[NZ]<br />
TitleName=#Unknown locale [nz]<br />
[NO]<br />
TitleName=#Unknown locale [no]<br />
[NL]<br />
TitleName=#Unknown locale [nl]<br />
[NI]<br />
TitleName=#Unknown locale [ni]<br />
[MY]<br />
TitleName=#Unknown locale [my]<br />
[MX]<br />
TitleName=#Unknown locale [mx]<br />
[MV]<br />
TitleName=#Unknown locale [mv]<br />
[MO]<br />
TitleName=#Unknown locale [mo]<br />
[MN]<br />
TitleName=#Unknown locale [mn]<br />
[MK]<br />
TitleName=#Unknown locale [mk]<br />
[MC]<br />
TitleName=#Unknown locale [mc]<br />
[MA]<br />
TitleName=#Unknown locale [ma]<br />
[LY]<br />
TitleName=#Unknown locale [ly]<br />
[LV]<br />
TitleName=#Unknown locale [lv]<br />
[LU]<br />
TitleName=#Unknown locale [lu]<br />
[LT]<br />
TitleName=#Unknown locale [lt]<br />
[LI]<br />
TitleName=#Unknown locale [li]<br />
[LB]<br />
TitleName=#Unknown locale [lb]<br />
[KZ]<br />
TitleName=#Unknown locale [kz]<br />
[KW]<br />
TitleName=#Unknown locale [kw]<br />
[KR]<br />
TitleName=#Unknown locale [kr]<br />
[KG]<br />
TitleName=#Unknown locale [kg]<br />
[KE]<br />
TitleName=#Unknown locale [ke]<br />
[JP]<br />
TitleName=#Unknown locale [jp]<br />
[JO]<br />
TitleName=#Unknown locale [jo]<br />
[JM]<br />
TitleName=#Unknown locale [jm]<br />
[IT]<br />
TitleName=#Unknown locale [it]<br />
[IS]<br />
TitleName=#Unknown locale [is]<br />
[IR]<br />
TitleName=#Unknown locale [ir]<br />
[IQ]<br />
TitleName=#Unknown locale [iq]<br />
[IN]<br />
TitleName=#Unknown locale [in]<br />
[IL]<br />
TitleName=#Unknown locale [il]<br />
[IE]<br />
TitleName=#Unknown locale [ie]<br />
[ID]<br />
TitleName=#Unknown locale [id]<br />
[HU]<br />
TitleName=#Unknown locale [hu]<br />
[HR]<br />
TitleName=#Unknown locale [hr]<br />
[HN]<br />
TitleName=#Unknown locale [hn]<br />
[HK]<br />
TitleName=#Unknown locale [hk]<br />
[GT]<br />
TitleName=#Unknown locale [gt]<br />
[GR]<br />
TitleName=#Unknown locale [gr]<br />
[GE]<br />
TitleName=#Unknown locale [ge]<br />
[GB]<br />
TitleName=#Unknown locale [gb]<br />
[FR]<br />
TitleName=#Unknown locale [fr]<br />
[FO]<br />
TitleName=#Unknown locale [fo]<br />
[FI]<br />
TitleName=#Unknown locale [fi]<br />
[ES]<br />
TitleName=#Unknown locale [es]<br />
[EG]<br />
TitleName=#Unknown locale [eg]<br />
[EE]<br />
TitleName=#Unknown locale [ee]<br />
[EC]<br />
TitleName=#Unknown locale [ec]<br />
[DZ]<br />
TitleName=#Unknown locale [dz]<br />
[DO]<br />
TitleName=#Unknown locale [do]<br />
[DK]<br />
TitleName=#Unknown locale [dk]<br />
[DE]<br />
TitleName=#Unknown locale [de]<br />
[CZ]<br />
TitleName=#Unknown locale [cz]<br />
[CR]<br />
TitleName=#Unknown locale [cr]<br />
[CO]<br />
TitleName=#Unknown locale [co]<br />
[CN]<br />
TitleName=#Unknown locale [cn]<br />
[CL]<br />
TitleName=#Unknown locale [cl]<br />
[CH]<br />
TitleName=#Unknown locale [ch]<br />
[CA]<br />
TitleName=#Unknown locale [ca]<br />
[BZ]<br />
TitleName=#Unknown locale [bz]<br />
[BY]<br />
TitleName=#Unknown locale [by]<br />
[BR]<br />
TitleName=#Unknown locale [br]<br />
[BO]<br />
TitleName=#Unknown locale [bo]<br />
[BN]<br />
TitleName=#Unknown locale [bn]<br />
[BH]<br />
TitleName=#Unknown locale [bh]<br />
[BG]<br />
TitleName=#Unknown locale [bg]<br />
[BE]<br />
TitleName=#Unknown locale [be]<br />
[AZ]<br />
TitleName=#Unknown locale [az]<br />
[AU]<br />
TitleName=#Unknown locale [au]<br />
[AT]<br />
TitleName=#Unknown locale [at]<br />
[AR]<br />
TitleName=#Unknown locale [ar]<br />
[AM]<br />
TitleName=#Unknown locale [am]<br />
[AL]<br />
TitleName=#Unknown locale [al]<br />
[AE]<br />
TitleName=#Unknown locale [ae]<br />
<br />
[default]<br />
TitleName=#Known locale [default] - (fallback)<br />
[EN]<br />
TitleName=#Known locale [EN] - english<br />
[JA]<br />
TitleName=#Known locale [JA] - (japanese)<br />
[DE]<br />
TitleName=#Known locale [DE] - deutsch<br />
[FR]<br />
TitleName=#Known locale [FR] - francais<br />
[ES]<br />
TitleName=#Known locale [ES] - espanol<br />
[IT]<br />
TitleName=#Known locale [IT] - italiano<br />
[KO]<br />
TitleName=#Known locale [KO] - (korean)<br />
[TW]<br />
TitleName=#Known locale [TW] - (taiwanese)<br />
[BR]<br />
TitleName=#Known locale [BR] - portugues<br />
</pre><br />
<br />
== THPS2X Syslink crash ==<br />
<br />
Happens if too many servers are present (this is where data is written to driver?):<br />
<br />
<pre><br />
Hardware watchpoint 1: *(int*)0xD004D048<br />
<br />
Old value = 1065353216<br />
New value = 1500647462<br />
0x00215adf in ?? ()<br />
(gdb) pint $eip<br />
Undefined command: "pint". Try "help".<br />
(gdb) print $eip<br />
$1 = (void (*)()) 0x215adf<br />
</pre><br />
<br />
And this seems to copy server to database (this in particular copied string?):<br />
<br />
<pre><br />
Hardware watchpoint 1: *(int*)0xf47944<br />
<br />
Old value = 926102321<br />
New value = 858992984<br />
0x00156cc3 in ?? ()<br />
(gdb) print $eip<br />
$2 = (void (*)()) 0x156cc3<br />
(gdb) info reg<br />
eax 0xd0043260 -805031328<br />
ecx 0x1d 29<br />
edx 0x0 0<br />
ebx 0xf20ce0 15863008<br />
esp 0xd004324c 0xd004324c<br />
ebp 0xf20ce0 0xf20ce0<br />
esi 0xd00432a0 -805031264<br />
edi 0xf47948 16021832<br />
eip 0x156cc3 0x156cc3<br />
eflags 0x246 [ PF ZF IF ]<br />
cs 0x8 8<br />
ss 0x10 16<br />
ds 0x10 16<br />
es 0x10 16<br />
fs 0x20 32<br />
gs 0x0 0<br />
(gdb) x/10i $eip<br />
=> 0x156cc3: rep movsl %ds:(%esi),%es:(%edi)<br />
0x156cc5: call 0x1b9db6<br />
0x156cca: mov 0x29b44(%ebx),%ecx<br />
0x156cd0: mov 0x10(%esp),%edx<br />
0x156cd4: imul $0x78,%ecx,%ecx<br />
0x156cd7: mov %edx,0x26ca8(%ecx,%ebx,1)<br />
0x156cde: mov 0x14(%esp),%eax<br />
0x156ce2: mov %eax,0x26cac(%ecx,%ebx,1)<br />
0x156ce9: mov 0x29b44(%ebx),%eax<br />
0x156cef: mov (%ebx),%edx<br />
</pre><br />
<br />
== Reset ==<br />
<br />
There are various methods to reset an Xbox or major parts of it (successfully or not).<br />
<br />
=== SMC Cold Reboot ===<br />
<br />
* CPU cycles: X > 0<br />
<br />
=== SMC Warm Reboot ===<br />
<br />
* CPU cycles: X > 0<br />
<br />
=== PM26 ===<br />
<br />
* CPU cycles: X > 0<br />
<br />
=== RST_CNT (RST_CPU) === <br />
[https://www.intel.com/content/dam/doc/datasheet/82801ba-i-o-controller-hub-2-82801bam-i-o-controller-hub-2-mobile-datasheet.pdf equivalent docs?]<br />
=== RST_CNT (RST_CPU + SYS_RST) === <br />
=== RST_CNT (RST_CPU + FULL_RST) === <br />
=== RST_CNT (RST_CPU + SYS_RST + FULL_RST) ===<br />
<br />
* CPU cycles: 0<br />
<br />
=== Triple fault ===<br />
<br />
* CPU cycles: 0{{FIXME|reason=untested}}<br />
<br />
=== PCI-to-PCI bridge secondary bus reset ===<br />
<br />
* CPU cycles: X > 0<br />
<br />
----</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=User:JayFoxRox&diff=6790User:JayFoxRox2019-10-21T00:08:04Z<p>JayFoxRox: Add file which can be used to debug savegame localization</p>
<hr />
<div>For contact details, see http://jannikvogel.de/<br />
<br />
= Unfinished information =<br />
<br />
== TitleMeta.xbx locales ==<br />
<br />
Put this into a file and move it to "E:/UDATA/13371337/TitleMeta.xbx" and check which languages your MS dashboard supports (my results are from 1.00.5960.01 from Germany in NTSC mode):<br />
<br />
<pre><br />
TitleName=#Known locale - (fallback, same as [default])<br />
<br />
[ZW]<br />
TitleName=#Unknown locale [zw]<br />
[ZA]<br />
TitleName=#Unknown locale [za]<br />
[YE]<br />
TitleName=#Unknown locale [ye]<br />
[VN]<br />
TitleName=#Unknown locale [vn]<br />
[VE]<br />
TitleName=#Unknown locale [ve]<br />
[UZ]<br />
TitleName=#Unknown locale [uz]<br />
[UY]<br />
TitleName=#Unknown locale [uy]<br />
[US]<br />
TitleName=#Unknown locale [us]<br />
[UA]<br />
TitleName=#Unknown locale [ua]<br />
[TW]<br />
TitleName=#Unknown locale [tw]<br />
[TT]<br />
TitleName=#Unknown locale [tt]<br />
[TR]<br />
TitleName=#Unknown locale [tr]<br />
[TN]<br />
TitleName=#Unknown locale [tn]<br />
[TH]<br />
TitleName=#Unknown locale [th]<br />
[SY]<br />
TitleName=#Unknown locale [sy]<br />
[SV]<br />
TitleName=#Unknown locale [sv]<br />
[SK]<br />
TitleName=#Unknown locale [sk]<br />
[SI]<br />
TitleName=#Unknown locale [si]<br />
[SG]<br />
TitleName=#Unknown locale [sg]<br />
[SE]<br />
TitleName=#Unknown locale [se]<br />
[SA]<br />
TitleName=#Unknown locale [sa]<br />
[RU]<br />
TitleName=#Unknown locale [ru]<br />
[RO]<br />
TitleName=#Unknown locale [ro]<br />
[QA]<br />
TitleName=#Unknown locale [qa]<br />
[PY]<br />
TitleName=#Unknown locale [py]<br />
[PT]<br />
TitleName=#Unknown locale [pt]<br />
[PR]<br />
TitleName=#Unknown locale [pr]<br />
[PL]<br />
TitleName=#Unknown locale [pl]<br />
[PK]<br />
TitleName=#Unknown locale [pk]<br />
[PH]<br />
TitleName=#Unknown locale [ph]<br />
[PE]<br />
TitleName=#Unknown locale [pe]<br />
[PA]<br />
TitleName=#Unknown locale [pa]<br />
[OM]<br />
TitleName=#Unknown locale [om]<br />
[NZ]<br />
TitleName=#Unknown locale [nz]<br />
[NO]<br />
TitleName=#Unknown locale [no]<br />
[NL]<br />
TitleName=#Unknown locale [nl]<br />
[NI]<br />
TitleName=#Unknown locale [ni]<br />
[MY]<br />
TitleName=#Unknown locale [my]<br />
[MX]<br />
TitleName=#Unknown locale [mx]<br />
[MV]<br />
TitleName=#Unknown locale [mv]<br />
[MO]<br />
TitleName=#Unknown locale [mo]<br />
[MN]<br />
TitleName=#Unknown locale [mn]<br />
[MK]<br />
TitleName=#Unknown locale [mk]<br />
[MC]<br />
TitleName=#Unknown locale [mc]<br />
[MA]<br />
TitleName=#Unknown locale [ma]<br />
[LY]<br />
TitleName=#Unknown locale [ly]<br />
[LV]<br />
TitleName=#Unknown locale [lv]<br />
[LU]<br />
TitleName=#Unknown locale [lu]<br />
[LT]<br />
TitleName=#Unknown locale [lt]<br />
[LI]<br />
TitleName=#Unknown locale [li]<br />
[LB]<br />
TitleName=#Unknown locale [lb]<br />
[KZ]<br />
TitleName=#Unknown locale [kz]<br />
[KW]<br />
TitleName=#Unknown locale [kw]<br />
[KR]<br />
TitleName=#Unknown locale [kr]<br />
[KG]<br />
TitleName=#Unknown locale [kg]<br />
[KE]<br />
TitleName=#Unknown locale [ke]<br />
[JP]<br />
TitleName=#Unknown locale [jp]<br />
[JO]<br />
TitleName=#Unknown locale [jo]<br />
[JM]<br />
TitleName=#Unknown locale [jm]<br />
[IT]<br />
TitleName=#Unknown locale [it]<br />
[IS]<br />
TitleName=#Unknown locale [is]<br />
[IR]<br />
TitleName=#Unknown locale [ir]<br />
[IQ]<br />
TitleName=#Unknown locale [iq]<br />
[IN]<br />
TitleName=#Unknown locale [in]<br />
[IL]<br />
TitleName=#Unknown locale [il]<br />
[IE]<br />
TitleName=#Unknown locale [ie]<br />
[ID]<br />
TitleName=#Unknown locale [id]<br />
[HU]<br />
TitleName=#Unknown locale [hu]<br />
[HR]<br />
TitleName=#Unknown locale [hr]<br />
[HN]<br />
TitleName=#Unknown locale [hn]<br />
[HK]<br />
TitleName=#Unknown locale [hk]<br />
[GT]<br />
TitleName=#Unknown locale [gt]<br />
[GR]<br />
TitleName=#Unknown locale [gr]<br />
[GE]<br />
TitleName=#Unknown locale [ge]<br />
[GB]<br />
TitleName=#Unknown locale [gb]<br />
[FR]<br />
TitleName=#Unknown locale [fr]<br />
[FO]<br />
TitleName=#Unknown locale [fo]<br />
[FI]<br />
TitleName=#Unknown locale [fi]<br />
[ES]<br />
TitleName=#Unknown locale [es]<br />
[EG]<br />
TitleName=#Unknown locale [eg]<br />
[EE]<br />
TitleName=#Unknown locale [ee]<br />
[EC]<br />
TitleName=#Unknown locale [ec]<br />
[DZ]<br />
TitleName=#Unknown locale [dz]<br />
[DO]<br />
TitleName=#Unknown locale [do]<br />
[DK]<br />
TitleName=#Unknown locale [dk]<br />
[DE]<br />
TitleName=#Unknown locale [de]<br />
[CZ]<br />
TitleName=#Unknown locale [cz]<br />
[CR]<br />
TitleName=#Unknown locale [cr]<br />
[CO]<br />
TitleName=#Unknown locale [co]<br />
[CN]<br />
TitleName=#Unknown locale [cn]<br />
[CL]<br />
TitleName=#Unknown locale [cl]<br />
[CH]<br />
TitleName=#Unknown locale [ch]<br />
[CA]<br />
TitleName=#Unknown locale [ca]<br />
[BZ]<br />
TitleName=#Unknown locale [bz]<br />
[BY]<br />
TitleName=#Unknown locale [by]<br />
[BR]<br />
TitleName=#Unknown locale [br]<br />
[BO]<br />
TitleName=#Unknown locale [bo]<br />
[BN]<br />
TitleName=#Unknown locale [bn]<br />
[BH]<br />
TitleName=#Unknown locale [bh]<br />
[BG]<br />
TitleName=#Unknown locale [bg]<br />
[BE]<br />
TitleName=#Unknown locale [be]<br />
[AZ]<br />
TitleName=#Unknown locale [az]<br />
[AU]<br />
TitleName=#Unknown locale [au]<br />
[AT]<br />
TitleName=#Unknown locale [at]<br />
[AR]<br />
TitleName=#Unknown locale [ar]<br />
[AM]<br />
TitleName=#Unknown locale [am]<br />
[AL]<br />
TitleName=#Unknown locale [al]<br />
[AE]<br />
TitleName=#Unknown locale [ae]<br />
<br />
[default]<br />
TitleName=#Known locale [default] - (fallback)<br />
[EN]<br />
TitleName=#Known locale [EN] - english<br />
[JA]<br />
TitleName=#Known locale [JA] - (japanese)<br />
[DE]<br />
TitleName=#Known locale [DE] - deutsch<br />
[FR]<br />
TitleName=#Known locale [FR] - francais<br />
[ES]<br />
TitleName=#Known locale [ES] - espanol<br />
[IT]<br />
TitleName=#Known locale [IT] - italiano<br />
[KO]<br />
TitleName=#Known locale [KO] - (korean)<br />
[TW]<br />
TitleName=#Known locale [TW] - (taiwanese)<br />
[BR]<br />
TitleName=#Known locale [BR] - (portugues)<br />
</pre><br />
<br />
== THPS2X Syslink crash ==<br />
<br />
Happens if too many servers are present (this is where data is written to driver?):<br />
<br />
<pre><br />
Hardware watchpoint 1: *(int*)0xD004D048<br />
<br />
Old value = 1065353216<br />
New value = 1500647462<br />
0x00215adf in ?? ()<br />
(gdb) pint $eip<br />
Undefined command: "pint". Try "help".<br />
(gdb) print $eip<br />
$1 = (void (*)()) 0x215adf<br />
</pre><br />
<br />
And this seems to copy server to database (this in particular copied string?):<br />
<br />
<pre><br />
Hardware watchpoint 1: *(int*)0xf47944<br />
<br />
Old value = 926102321<br />
New value = 858992984<br />
0x00156cc3 in ?? ()<br />
(gdb) print $eip<br />
$2 = (void (*)()) 0x156cc3<br />
(gdb) info reg<br />
eax 0xd0043260 -805031328<br />
ecx 0x1d 29<br />
edx 0x0 0<br />
ebx 0xf20ce0 15863008<br />
esp 0xd004324c 0xd004324c<br />
ebp 0xf20ce0 0xf20ce0<br />
esi 0xd00432a0 -805031264<br />
edi 0xf47948 16021832<br />
eip 0x156cc3 0x156cc3<br />
eflags 0x246 [ PF ZF IF ]<br />
cs 0x8 8<br />
ss 0x10 16<br />
ds 0x10 16<br />
es 0x10 16<br />
fs 0x20 32<br />
gs 0x0 0<br />
(gdb) x/10i $eip<br />
=> 0x156cc3: rep movsl %ds:(%esi),%es:(%edi)<br />
0x156cc5: call 0x1b9db6<br />
0x156cca: mov 0x29b44(%ebx),%ecx<br />
0x156cd0: mov 0x10(%esp),%edx<br />
0x156cd4: imul $0x78,%ecx,%ecx<br />
0x156cd7: mov %edx,0x26ca8(%ecx,%ebx,1)<br />
0x156cde: mov 0x14(%esp),%eax<br />
0x156ce2: mov %eax,0x26cac(%ecx,%ebx,1)<br />
0x156ce9: mov 0x29b44(%ebx),%eax<br />
0x156cef: mov (%ebx),%edx<br />
</pre><br />
<br />
== Reset ==<br />
<br />
There are various methods to reset an Xbox or major parts of it (successfully or not).<br />
<br />
=== SMC Cold Reboot ===<br />
<br />
* CPU cycles: X > 0<br />
<br />
=== SMC Warm Reboot ===<br />
<br />
* CPU cycles: X > 0<br />
<br />
=== PM26 ===<br />
<br />
* CPU cycles: X > 0<br />
<br />
=== RST_CNT (RST_CPU) === <br />
[https://www.intel.com/content/dam/doc/datasheet/82801ba-i-o-controller-hub-2-82801bam-i-o-controller-hub-2-mobile-datasheet.pdf equivalent docs?]<br />
=== RST_CNT (RST_CPU + SYS_RST) === <br />
=== RST_CNT (RST_CPU + FULL_RST) === <br />
=== RST_CNT (RST_CPU + SYS_RST + FULL_RST) ===<br />
<br />
* CPU cycles: 0<br />
<br />
=== Triple fault ===<br />
<br />
* CPU cycles: 0{{FIXME|reason=untested}}<br />
<br />
=== PCI-to-PCI bridge secondary bus reset ===<br />
<br />
* CPU cycles: X > 0<br />
<br />
----</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Talk:NV2A/Pixel_Combiner&diff=6789Talk:NV2A/Pixel Combiner2019-10-07T13:39:23Z<p>JayFoxRox: I was wrong, MS and nvidia names are really close.</p>
<hr />
<div>== Move data from cxbx ==<br />
<br />
https://github.com/Echelon9/cxbx-shogun/blob/master/src/CxbxKrnl/EmuD3D8/PixelShader.cpp#L467 uses the nvidia names<br />
<br />
Those are MS names, not nvidia (edit: although they are very similar); I believe most of them are already in the article.<br />
<del>I actually want to remove them in the future to focus on the GL spec (which is much closer to hw + explicit).</del> (edit: GL is a bit more limited actually).<br />
--[[User:JayFoxRox|JayFoxRox]] ([[User talk:JayFoxRox|talk]]) 06:20, 7 October 2019 (PDT)</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=NV2A/Pixel_Combiner&diff=6788NV2A/Pixel Combiner2019-10-07T13:34:32Z<p>JayFoxRox: PS_TEXTUREMODES_DOT_ZW is DOT_PRODUCT_DEPTH_REPLACE_NV</p>
<hr />
<div>== Data types ==<br />
<br />
NV_texture_shader suggests that: ''"The 8-bit and 16-bit signed fixed-point types are used for signed internal texture formats, while the 9-bit signed fixed-point type is used for register combiners computations."''<br />
Here is a table from the GL extension:<br />
<br />
{| class="wikitable"<br />
! floating-point !! 8-bit fixed-point !! 9-bit fixed-point !! 16-bit fixed-point<br />
|-<br />
| 1.0 || n/a || 255 || n/a <br />
|-<br />
| 0.99996... || n/a || n/a || 32767<br />
|-<br />
| 0.99218... || 127 || n/a || n/a <br />
|-<br />
| 0.0 || 0 || 0 || 0<br />
|-<br />
| -1.0 || -128 || -255 || -32768<br />
|-<br />
| -1.00392... || n/a || -256 || n/a<br />
|}<br />
<br />
This means:<br />
<br />
* 8-bit fixed-point: [-128, 127] &rarr; [-128/128, 127/128] &rarr; [-1.0, 0.99218...]<br />
* 9-bit fixed-point: [-256, 255] &rarr; [-256/255, 255/255] &rarr; [-1.00392..., 1.0]<br />
* 16-bit fixed-point: [-32768, 32767] &rarr; [-32768/32768, 32767/32768] &rarr; [-1.0, 0.99996...]<br />
<br />
It is not known if the NV2A really implements these 3 datatypes.<br />
It is also not yet known how exactly conversion or negation of these types would work.<br />
<br />
== Texture Shaders ==<br />
<br />
The NV2A implements at least parts of the following OpenGL extensions:<br />
<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader.txt NV_texture_shader]<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader2.txt NV_texture_shader2]<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader3.txt NV_texture_shader3]{{citation needed}}<br />
<br />
=== Texturing modes ===<br />
<br />
{|class="wikitable"<br />
!ID<br />
!Name<br />
!D3D name<br />
!GL Name<br />
!Stage 1<br />
!Stage 2<br />
!Stage 3<br />
!Stage 4<br />
!Notes<br />
|-<br />
|0x00<br />
|PS_TEXTUREMODES_NONE<br />
|<br />
|NONE<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x01<br />
|PS_TEXTUREMODES_PROJECT2D<br />
|tex<br />
|TEXTURE_2D<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x02<br />
|PS_TEXTUREMODES_PROJECT3D<br />
|tex<br />
|TEXTURE_3D<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x03<br />
|PS_TEXTUREMODES_CUBEMAP<br />
|tex<br />
|TEXTURE_CUBE_MAP_ARB<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x04<br />
|PS_TEXTUREMODES_PASSTHRU<br />
|texcoord<br />
|PASS_THROUGH_NV<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x05<br />
|PS_TEXTUREMODES_CLIPPLANE<br />
|texkill<br />
|CULL_FRAGMENT_NV<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x06<br />
|PS_TEXTUREMODES_BUMPENVMAP<br />
|texbem<br />
|OFFSET_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x07<br />
|PS_TEXTUREMODES_BUMPENVMAP_LUM<br />
|texbeml<br />
|OFFSET_TEXTURE_2D_SCALE_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x08<br />
|PS_TEXTUREMODES_BRDF<br />
|texbrdf<br />
|<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x09<br />
|PS_TEXTUREMODES_DOT_ST<br />
|texm3x2tex<br />
|DOT_PRODUCT_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0A<br />
|PS_TEXTUREMODES_DOT_ZW<br />
|texm3x2depth<br />
|DOT_PRODUCT_DEPTH_REPLACE_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0B<br />
|PS_TEXTUREMODES_DOT_RFLCT_DIFF<br />
|texm3x3diff<br />
|DOT_PRODUCT_DIFFUSE_CUBE_MAP_NV{{citation needed}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{no}}<br />
|<br />
|-<br />
|0x0C<br />
|PS_TEXTUREMODES_DOT_RFLCT_SPEC<br />
|texm3x3vspec<br />
|DOT_PRODUCT_CONST_EYE_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0D<br />
|PS_TEXTUREMODES_DOT_STR_3D<br />
|texm3x3tex<br />
|DOT_PRODUCT_TEXTURE_3D_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0E<br />
|PS_TEXTUREMODES_DOT_STR_CUBE<br />
|texm3x3vspec<br />
|DOT_PRODUCT_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0F<br />
|PS_TEXTUREMODES_DPNDNT_AR<br />
|texreg2ar<br />
|DEPENDENT_AR_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x10<br />
|PS_TEXTUREMODES_DPNDNT_GB<br />
|texreg2gb<br />
|DEPENDENT_GB_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x11<br />
|PS_TEXTUREMODES_DOTPRODUCT<br />
|texm3x3pad<br>texm3x2pad<br />
|DOT_PRODUCT_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{no}}<br />
|<br />
|-<br />
|0x12<br />
|PS_TEXTUREMODES_DOT_RFLCT_SPEC_CONST<br />
|texm3x3spec<br />
|DOT_PRODUCT_CONST_EYE_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|}<br />
<br />
== Register combiners ==<br />
<br />
The NV2A implements at least parts of the following OpenGL extensions:<br />
<br />
* [https://www.opengl.org/registry/specs/NV/register_combiners.txt NV_register_combiners]<br />
* [https://www.opengl.org/registry/specs/NV/register_combiners2.txt NV_register_combiners2]<br />
<br />
There's some additional features and oddities.<br />
<br />
=== DISCARD and ZERO are the same register ===<br />
<br />
On NV2A the DISCARD and ZERO register are the same index: writes are discarded / reads return zero.<br />
<br />
This is different from NV_register_combiners where 2 different constants are used.<br />
<br />
=== Encoding of input swizzle ===<br />
<br />
NV2A uses a single ALPHA flag to specify the swizzle of inputs:<br />
* 0 for <code>.rgb</code> (RGB portion only) and <code>.b</code> (ALPHA portion only).<br />
* 1 for <code>.aaa</code> (RGB portion only) and <code>.a</code> (ALPHA portion only).<br />
<br />
This is different from NV_register_combiners where each swizzle has its own constant.<br />
<br />
=== Per stage constant-colors ===<br />
<br />
The combiner setup switches between using the same <code>const0</code> and <code>const1</code> for all stages (<code>FACTOR#_SAME_FACTOR_ALL</code>), or using different constant-colors per stage (<code>FACTOR#_EACH_STAGE</code>).<br />
<br />
On NV2A, the final-combiner does always have unique constants (even using <code>FACTOR#_SAME_FACTOR_ALL</code>) from all other stages.<br />
If <code>FACTOR#_SAME_FACTOR_ALL</code> is used, the constant-colors for all other stages are taken from the very first stage.<br />
This setting can be controlled independently for <code>const0</code> and <code>const1</code>.<br />
<br />
This is different from NV_register_combiners2. If that GL extension isn't available / enabled, then the constants are shared between general combiner stages and the final combiner (which doesn't have unique colors then). Additionally, the GL extension can only control this for both constant-colors at the same time.<br />
<br />
=== Encoding of constant-colors ===<br />
<br />
On NV2A, the constant-colors are encoded as 8-bit unsigned int values, packed into a 32-bit ARGB value (<code>(a<<24 | r<<16 | g<<8 | b)</code>).<br />
<br />
This is different from NV_register_combiners where constant-colors are specified as floats in RGBA format.<br />
<br />
=== BLUETOALPHA in RGB portion ===<br />
<br />
NV2A has a special flag to write the blue result (RGB portion) of the A/B and C/D computations to the alpha channel of the RGB portion output register. There's no such option for the AB/CD result.<br />
{{FIXME|reason=Document specifics, tests proposed on https://github.com/JayFoxRox/nxdk/pull/33}}<br />
<br />
This feature isn't available in GL, probably.<br />
This is different from NV_register_combiners where the RGB portion always writes to <code>.rgb</code> of the output.<br />
<br />
=== Special "or" operation (MUX) modifier ===<br />
<br />
NV2A has a special flag to switch between MSB and LSB{{FIXME|reason=Unconfirmed / untested - doesn't make a lot of sense}} for the special "or" operation (MUX).<br />
{{FIXME|reason=Check the comparison type}}<br />
<br />
This feature isn't available in GL, probably.<br />
This is different from NV_register_combiners where the special "or" operation (MUX) is always doing: <code>spare0_alpha >= 0.5 ? C*D : A*B</code>.<br />
<br />
== Debugging ==<br />
<br />
PIX from the Microsoft XDK provides great debugging capabilities.<br />
<br />
=== References and links ===<br />
<br />
* [http://developer.download.nvidia.com/assets/gamedev/docs/ProgrammableTextureBlending.pdf Overview about programmable texture blending] <!-- Mirror: https://www.nvidia.com/object/programmable_texture_blending.html --><br />
* [http://developer.download.nvidia.com/assets/gamedev/docs/combiners.pdf Overview of register combiners]<br />
* [https://github.com/XboxDev/nxdk/blob/77b5de45f0c64e70f2ff68248873448d5edccc71/tools/fp20compiler/ps1.0_program.cpp#L227 Code from nvparse (NVIDIA SDK 9.52) in nxdk, which handles shader to OpenGL conversion]<br />
* http://developer.download.nvidia.com/assets/gamedev/docs/GDC2K1_DX8_Pixel_Shaders.pdf<br />
<br />
[[Category:NV2A]]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=NV2A/Pixel_Combiner&diff=6787NV2A/Pixel Combiner2019-10-07T13:23:00Z<p>JayFoxRox: Swap register names to make it consistent + fix typo</p>
<hr />
<div>== Data types ==<br />
<br />
NV_texture_shader suggests that: ''"The 8-bit and 16-bit signed fixed-point types are used for signed internal texture formats, while the 9-bit signed fixed-point type is used for register combiners computations."''<br />
Here is a table from the GL extension:<br />
<br />
{| class="wikitable"<br />
! floating-point !! 8-bit fixed-point !! 9-bit fixed-point !! 16-bit fixed-point<br />
|-<br />
| 1.0 || n/a || 255 || n/a <br />
|-<br />
| 0.99996... || n/a || n/a || 32767<br />
|-<br />
| 0.99218... || 127 || n/a || n/a <br />
|-<br />
| 0.0 || 0 || 0 || 0<br />
|-<br />
| -1.0 || -128 || -255 || -32768<br />
|-<br />
| -1.00392... || n/a || -256 || n/a<br />
|}<br />
<br />
This means:<br />
<br />
* 8-bit fixed-point: [-128, 127] &rarr; [-128/128, 127/128] &rarr; [-1.0, 0.99218...]<br />
* 9-bit fixed-point: [-256, 255] &rarr; [-256/255, 255/255] &rarr; [-1.00392..., 1.0]<br />
* 16-bit fixed-point: [-32768, 32767] &rarr; [-32768/32768, 32767/32768] &rarr; [-1.0, 0.99996...]<br />
<br />
It is not known if the NV2A really implements these 3 datatypes.<br />
It is also not yet known how exactly conversion or negation of these types would work.<br />
<br />
== Texture Shaders ==<br />
<br />
The NV2A implements at least parts of the following OpenGL extensions:<br />
<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader.txt NV_texture_shader]<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader2.txt NV_texture_shader2]<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader3.txt NV_texture_shader3]{{citation needed}}<br />
<br />
=== Texturing modes ===<br />
<br />
{|class="wikitable"<br />
!ID<br />
!Name<br />
!D3D name<br />
!GL Name<br />
!Stage 1<br />
!Stage 2<br />
!Stage 3<br />
!Stage 4<br />
!Notes<br />
|-<br />
|0x00<br />
|PS_TEXTUREMODES_NONE<br />
|<br />
|NONE<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x01<br />
|PS_TEXTUREMODES_PROJECT2D<br />
|tex<br />
|TEXTURE_2D<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x02<br />
|PS_TEXTUREMODES_PROJECT3D<br />
|tex<br />
|TEXTURE_3D<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x03<br />
|PS_TEXTUREMODES_CUBEMAP<br />
|tex<br />
|TEXTURE_CUBE_MAP_ARB<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x04<br />
|PS_TEXTUREMODES_PASSTHRU<br />
|texcoord<br />
|PASS_THROUGH_NV<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x05<br />
|PS_TEXTUREMODES_CLIPPLANE<br />
|texkill<br />
|CULL_FRAGMENT_NV<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x06<br />
|PS_TEXTUREMODES_BUMPENVMAP<br />
|texbem<br />
|OFFSET_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x07<br />
|PS_TEXTUREMODES_BUMPENVMAP_LUM<br />
|texbeml<br />
|OFFSET_TEXTURE_2D_SCALE_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x08<br />
|PS_TEXTUREMODES_BRDF<br />
|texbrdf<br />
|<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x09<br />
|PS_TEXTUREMODES_DOT_ST<br />
|texm3x2tex<br />
|DOT_PRODUCT_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0A<br />
|PS_TEXTUREMODES_DOT_ZW<br />
|texm3x2depth<br />
|<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0B<br />
|PS_TEXTUREMODES_DOT_RFLCT_DIFF<br />
|texm3x3diff<br />
|DOT_PRODUCT_DIFFUSE_CUBE_MAP_NV{{citation needed}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{no}}<br />
|<br />
|-<br />
|0x0C<br />
|PS_TEXTUREMODES_DOT_RFLCT_SPEC<br />
|texm3x3vspec<br />
|DOT_PRODUCT_CONST_EYE_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0D<br />
|PS_TEXTUREMODES_DOT_STR_3D<br />
|texm3x3tex<br />
|DOT_PRODUCT_TEXTURE_3D_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0E<br />
|PS_TEXTUREMODES_DOT_STR_CUBE<br />
|texm3x3vspec<br />
|DOT_PRODUCT_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0F<br />
|PS_TEXTUREMODES_DPNDNT_AR<br />
|texreg2ar<br />
|DEPENDENT_AR_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x10<br />
|PS_TEXTUREMODES_DPNDNT_GB<br />
|texreg2gb<br />
|DEPENDENT_GB_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x11<br />
|PS_TEXTUREMODES_DOTPRODUCT<br />
|texm3x3pad<br>texm3x2pad<br />
|DOT_PRODUCT_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{no}}<br />
|<br />
|-<br />
|0x12<br />
|PS_TEXTUREMODES_DOT_RFLCT_SPEC_CONST<br />
|texm3x3spec<br />
|DOT_PRODUCT_CONST_EYE_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|}<br />
<br />
== Register combiners ==<br />
<br />
The NV2A implements at least parts of the following OpenGL extensions:<br />
<br />
* [https://www.opengl.org/registry/specs/NV/register_combiners.txt NV_register_combiners]<br />
* [https://www.opengl.org/registry/specs/NV/register_combiners2.txt NV_register_combiners2]<br />
<br />
There's some additional features and oddities.<br />
<br />
=== DISCARD and ZERO are the same register ===<br />
<br />
On NV2A the DISCARD and ZERO register are the same index: writes are discarded / reads return zero.<br />
<br />
This is different from NV_register_combiners where 2 different constants are used.<br />
<br />
=== Encoding of input swizzle ===<br />
<br />
NV2A uses a single ALPHA flag to specify the swizzle of inputs:<br />
* 0 for <code>.rgb</code> (RGB portion only) and <code>.b</code> (ALPHA portion only).<br />
* 1 for <code>.aaa</code> (RGB portion only) and <code>.a</code> (ALPHA portion only).<br />
<br />
This is different from NV_register_combiners where each swizzle has its own constant.<br />
<br />
=== Per stage constant-colors ===<br />
<br />
The combiner setup switches between using the same <code>const0</code> and <code>const1</code> for all stages (<code>FACTOR#_SAME_FACTOR_ALL</code>), or using different constant-colors per stage (<code>FACTOR#_EACH_STAGE</code>).<br />
<br />
On NV2A, the final-combiner does always have unique constants (even using <code>FACTOR#_SAME_FACTOR_ALL</code>) from all other stages.<br />
If <code>FACTOR#_SAME_FACTOR_ALL</code> is used, the constant-colors for all other stages are taken from the very first stage.<br />
This setting can be controlled independently for <code>const0</code> and <code>const1</code>.<br />
<br />
This is different from NV_register_combiners2. If that GL extension isn't available / enabled, then the constants are shared between general combiner stages and the final combiner (which doesn't have unique colors then). Additionally, the GL extension can only control this for both constant-colors at the same time.<br />
<br />
=== Encoding of constant-colors ===<br />
<br />
On NV2A, the constant-colors are encoded as 8-bit unsigned int values, packed into a 32-bit ARGB value (<code>(a<<24 | r<<16 | g<<8 | b)</code>).<br />
<br />
This is different from NV_register_combiners where constant-colors are specified as floats in RGBA format.<br />
<br />
=== BLUETOALPHA in RGB portion ===<br />
<br />
NV2A has a special flag to write the blue result (RGB portion) of the A/B and C/D computations to the alpha channel of the RGB portion output register. There's no such option for the AB/CD result.<br />
{{FIXME|reason=Document specifics, tests proposed on https://github.com/JayFoxRox/nxdk/pull/33}}<br />
<br />
This feature isn't available in GL, probably.<br />
This is different from NV_register_combiners where the RGB portion always writes to <code>.rgb</code> of the output.<br />
<br />
=== Special "or" operation (MUX) modifier ===<br />
<br />
NV2A has a special flag to switch between MSB and LSB{{FIXME|reason=Unconfirmed / untested - doesn't make a lot of sense}} for the special "or" operation (MUX).<br />
{{FIXME|reason=Check the comparison type}}<br />
<br />
This feature isn't available in GL, probably.<br />
This is different from NV_register_combiners where the special "or" operation (MUX) is always doing: <code>spare0_alpha >= 0.5 ? C*D : A*B</code>.<br />
<br />
== Debugging ==<br />
<br />
PIX from the Microsoft XDK provides great debugging capabilities.<br />
<br />
=== References and links ===<br />
<br />
* [http://developer.download.nvidia.com/assets/gamedev/docs/ProgrammableTextureBlending.pdf Overview about programmable texture blending] <!-- Mirror: https://www.nvidia.com/object/programmable_texture_blending.html --><br />
* [http://developer.download.nvidia.com/assets/gamedev/docs/combiners.pdf Overview of register combiners]<br />
* [https://github.com/XboxDev/nxdk/blob/77b5de45f0c64e70f2ff68248873448d5edccc71/tools/fp20compiler/ps1.0_program.cpp#L227 Code from nvparse (NVIDIA SDK 9.52) in nxdk, which handles shader to OpenGL conversion]<br />
* http://developer.download.nvidia.com/assets/gamedev/docs/GDC2K1_DX8_Pixel_Shaders.pdf<br />
<br />
[[Category:NV2A]]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Talk:NV2A/Pixel_Combiner&diff=6786Talk:NV2A/Pixel Combiner2019-10-07T13:20:55Z<p>JayFoxRox: Response about nvidia names</p>
<hr />
<div>== Move data from cxbx ==<br />
<br />
https://github.com/Echelon9/cxbx-shogun/blob/master/src/CxbxKrnl/EmuD3D8/PixelShader.cpp#L467 uses the nvidia names<br />
<br />
Those are MS names, not nvidia; I believe most of them are already in the article.<br />
I actually want to remove them in the future to focus on the GL spec (which is much closer to hw + explicit).<br />
--[[User:JayFoxRox|JayFoxRox]] ([[User talk:JayFoxRox|talk]]) 06:20, 7 October 2019 (PDT)</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=NV2A/Pixel_Combiner&diff=6785NV2A/Pixel Combiner2019-10-07T13:10:32Z<p>JayFoxRox: Documenting register-combiner differences between NV2A and GL</p>
<hr />
<div>== Data types ==<br />
<br />
NV_texture_shader suggests that: ''"The 8-bit and 16-bit signed fixed-point types are used for signed internal texture formats, while the 9-bit signed fixed-point type is used for register combiners computations."''<br />
Here is a table from the GL extension:<br />
<br />
{| class="wikitable"<br />
! floating-point !! 8-bit fixed-point !! 9-bit fixed-point !! 16-bit fixed-point<br />
|-<br />
| 1.0 || n/a || 255 || n/a <br />
|-<br />
| 0.99996... || n/a || n/a || 32767<br />
|-<br />
| 0.99218... || 127 || n/a || n/a <br />
|-<br />
| 0.0 || 0 || 0 || 0<br />
|-<br />
| -1.0 || -128 || -255 || -32768<br />
|-<br />
| -1.00392... || n/a || -256 || n/a<br />
|}<br />
<br />
This means:<br />
<br />
* 8-bit fixed-point: [-128, 127] &rarr; [-128/128, 127/128] &rarr; [-1.0, 0.99218...]<br />
* 9-bit fixed-point: [-256, 255] &rarr; [-256/255, 255/255] &rarr; [-1.00392..., 1.0]<br />
* 16-bit fixed-point: [-32768, 32767] &rarr; [-32768/32768, 32767/32768] &rarr; [-1.0, 0.99996...]<br />
<br />
It is not known if the NV2A really implements these 3 datatypes.<br />
It is also not yet known how exactly conversion or negation of these types would work.<br />
<br />
== Texture Shaders ==<br />
<br />
The NV2A implements at least parts of the following OpenGL extensions:<br />
<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader.txt NV_texture_shader]<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader2.txt NV_texture_shader2]<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader3.txt NV_texture_shader3]{{citation needed}}<br />
<br />
=== Texturing modes ===<br />
<br />
{|class="wikitable"<br />
!ID<br />
!Name<br />
!D3D name<br />
!GL Name<br />
!Stage 1<br />
!Stage 2<br />
!Stage 3<br />
!Stage 4<br />
!Notes<br />
|-<br />
|0x00<br />
|PS_TEXTUREMODES_NONE<br />
|<br />
|NONE<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x01<br />
|PS_TEXTUREMODES_PROJECT2D<br />
|tex<br />
|TEXTURE_2D<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x02<br />
|PS_TEXTUREMODES_PROJECT3D<br />
|tex<br />
|TEXTURE_3D<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x03<br />
|PS_TEXTUREMODES_CUBEMAP<br />
|tex<br />
|TEXTURE_CUBE_MAP_ARB<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x04<br />
|PS_TEXTUREMODES_PASSTHRU<br />
|texcoord<br />
|PASS_THROUGH_NV<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x05<br />
|PS_TEXTUREMODES_CLIPPLANE<br />
|texkill<br />
|CULL_FRAGMENT_NV<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x06<br />
|PS_TEXTUREMODES_BUMPENVMAP<br />
|texbem<br />
|OFFSET_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x07<br />
|PS_TEXTUREMODES_BUMPENVMAP_LUM<br />
|texbeml<br />
|OFFSET_TEXTURE_2D_SCALE_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x08<br />
|PS_TEXTUREMODES_BRDF<br />
|texbrdf<br />
|<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x09<br />
|PS_TEXTUREMODES_DOT_ST<br />
|texm3x2tex<br />
|DOT_PRODUCT_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0A<br />
|PS_TEXTUREMODES_DOT_ZW<br />
|texm3x2depth<br />
|<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0B<br />
|PS_TEXTUREMODES_DOT_RFLCT_DIFF<br />
|texm3x3diff<br />
|DOT_PRODUCT_DIFFUSE_CUBE_MAP_NV{{citation needed}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{no}}<br />
|<br />
|-<br />
|0x0C<br />
|PS_TEXTUREMODES_DOT_RFLCT_SPEC<br />
|texm3x3vspec<br />
|DOT_PRODUCT_CONST_EYE_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0D<br />
|PS_TEXTUREMODES_DOT_STR_3D<br />
|texm3x3tex<br />
|DOT_PRODUCT_TEXTURE_3D_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0E<br />
|PS_TEXTUREMODES_DOT_STR_CUBE<br />
|texm3x3vspec<br />
|DOT_PRODUCT_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0F<br />
|PS_TEXTUREMODES_DPNDNT_AR<br />
|texreg2ar<br />
|DEPENDENT_AR_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x10<br />
|PS_TEXTUREMODES_DPNDNT_GB<br />
|texreg2gb<br />
|DEPENDENT_GB_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x11<br />
|PS_TEXTUREMODES_DOTPRODUCT<br />
|texm3x3pad<br>texm3x2pad<br />
|DOT_PRODUCT_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{no}}<br />
|<br />
|-<br />
|0x12<br />
|PS_TEXTUREMODES_DOT_RFLCT_SPEC_CONST<br />
|texm3x3spec<br />
|DOT_PRODUCT_CONST_EYE_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|}<br />
<br />
== Register combiners ==<br />
<br />
The NV2A implements at least parts of the following OpenGL extensions:<br />
<br />
* [https://www.opengl.org/registry/specs/NV/register_combiners.txt NV_register_combiners]<br />
* [https://www.opengl.org/registry/specs/NV/register_combiners2.txt NV_register_combiners2]<br />
<br />
There's some additional features and oddities.<br />
<br />
=== DISCARD and ZERO are the same register ===<br />
<br />
On NV2A the ZERO and DISCARD register are the same index: writes are discard / reads return zero.<br />
<br />
This is different from NV_register_combiners where 2 different constants are used.<br />
<br />
=== Encoding of input swizzle ===<br />
<br />
NV2A uses a single ALPHA flag to specify the swizzle of inputs:<br />
* 0 for <code>.rgb</code> (RGB portion only) and <code>.b</code> (ALPHA portion only).<br />
* 1 for <code>.aaa</code> (RGB portion only) and <code>.a</code> (ALPHA portion only).<br />
<br />
This is different from NV_register_combiners where each swizzle has its own constant.<br />
<br />
=== Per stage constant-colors ===<br />
<br />
The combiner setup switches between using the same <code>const0</code> and <code>const1</code> for all stages (<code>FACTOR#_SAME_FACTOR_ALL</code>), or using different constant-colors per stage (<code>FACTOR#_EACH_STAGE</code>).<br />
<br />
On NV2A, the final-combiner does always have unique constants (even using <code>FACTOR#_SAME_FACTOR_ALL</code>) from all other stages.<br />
If <code>FACTOR#_SAME_FACTOR_ALL</code> is used, the constant-colors for all other stages are taken from the very first stage.<br />
This setting can be controlled independently for <code>const0</code> and <code>const1</code>.<br />
<br />
This is different from NV_register_combiners2. If that GL extension isn't available / enabled, then the constants are shared between general combiner stages and the final combiner (which doesn't have unique colors then). Additionally, the GL extension can only control this for both constant-colors at the same time.<br />
<br />
=== Encoding of constant-colors ===<br />
<br />
On NV2A, the constant-colors are encoded as 8-bit unsigned int values, packed into a 32-bit ARGB value (<code>(a<<24 | r<<16 | g<<8 | b)</code>).<br />
<br />
This is different from NV_register_combiners where constant-colors are specified as floats in RGBA format.<br />
<br />
=== BLUETOALPHA in RGB portion ===<br />
<br />
NV2A has a special flag to write the blue result (RGB portion) of the A/B and C/D computations to the alpha channel of the RGB portion output register. There's no such option for the AB/CD result.<br />
{{FIXME|reason=Document specifics, tests proposed on https://github.com/JayFoxRox/nxdk/pull/33}}<br />
<br />
This feature isn't available in GL, probably.<br />
This is different from NV_register_combiners where the RGB portion always writes to <code>.rgb</code> of the output.<br />
<br />
=== Special "or" operation (MUX) modifier ===<br />
<br />
NV2A has a special flag to switch between MSB and LSB{{FIXME|reason=Unconfirmed / untested - doesn't make a lot of sense}} for the special "or" operation (MUX).<br />
{{FIXME|reason=Check the comparison type}}<br />
<br />
This feature isn't available in GL, probably.<br />
This is different from NV_register_combiners where the special "or" operation (MUX) is always doing: <code>spare0_alpha >= 0.5 ? C*D : A*B</code>.<br />
<br />
== Debugging ==<br />
<br />
PIX from the Microsoft XDK provides great debugging capabilities.<br />
<br />
=== References and links ===<br />
<br />
* [http://developer.download.nvidia.com/assets/gamedev/docs/ProgrammableTextureBlending.pdf Overview about programmable texture blending] <!-- Mirror: https://www.nvidia.com/object/programmable_texture_blending.html --><br />
* [http://developer.download.nvidia.com/assets/gamedev/docs/combiners.pdf Overview of register combiners]<br />
* [https://github.com/XboxDev/nxdk/blob/77b5de45f0c64e70f2ff68248873448d5edccc71/tools/fp20compiler/ps1.0_program.cpp#L227 Code from nvparse (NVIDIA SDK 9.52) in nxdk, which handles shader to OpenGL conversion]<br />
* http://developer.download.nvidia.com/assets/gamedev/docs/GDC2K1_DX8_Pixel_Shaders.pdf<br />
<br />
[[Category:NV2A]]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=CPU&diff=6769CPU2019-08-23T15:08:41Z<p>JayFoxRox: Fix Wikipedia URL</p>
<hr />
<div>The CPU in the Xbox was a custom Pentium III running at 733MHz. The 'custom' part of this was that the Pentium III in the Xbox only had a 128KB L2 cache instead of the usual 256KB. This allowed Microsoft to buy them at a bit of a discount and Intel to shift a few more CPUs{{citation needed}}.<br />
<br />
== References ==<br />
<br />
* [http://www.intel.com/content/dam/support/us/en/documents/processors/mobile/celeron/sb/28365403.pdf Mobile Intel® Celeron® Processor (0.18μ) in BGA2 and Micro-PGA2 Packages] This datasheet is for the mobile version Coppermine with 256kB L2 cache. It does not contain the Xbox Coppermine-128 with 128kB L2 cache at 733MHz (S-Spec SL5SN). No such datasheet exists. Both differences are pin compatible.<br />
* [https://www.intel.com/content/dam/support/us/en/documents/processors/mobile/celeron/sb/24542154.pdf Mobile Intel® Celeron® Processor (0.18μ and 0.13μ) Specification Update] This document should contain the errata for the Xbox CPU.<br />
* [https://en.wikipedia.org/wiki/List_of_Intel_Pentium_III_microprocessors#&quot;Coppermine&quot;_(180_nm) Wikipedia - List of Intel Pentium III microprocessors: "Coppermine" (180 nm)]<br />
* [https://www.google.com/patents/US20050282621 CPU upgrading adapter for a Microsoft XboxTM game machine] US Patent Application 20050282621 by Friendtech, filed 2003-08-21.</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=APU&diff=6744APU2019-07-14T16:08:25Z<p>JayFoxRox: The 48kHz samplerate is a key-design feature. The 32 sample length is a key-design feature. The 1500Hz (~1/0.666ms) is derived from said features.</p>
<hr />
<div>The [[MCPX]] contains an APU (Audio Processing Unit).<br />
<br />
The APU consists of 3 main components for audio-processing:<br />
<br />
* VP: A fixed-function block, that generates 32 channel mono audio from voices; the audio is output to the GP MIXBUF.<br />
* GP: A programmable DSP, it is intended for general-purpose audio processing (programmable audio effects for example).<br />
* EP: A programmable DSP, it is intended for audio encoding (5.1 AC3 encoding for example).<br />
<br />
VP and GP are connected by the MIXBUF, but GP and EP are entirely independent, and no special-purpose memory area connects them.<br />
Therefore, the communication between the GP and EP typically happens through programmable DMA transfers (via FIFO or scratch memory).<br />
<br />
The GP and EP are based on the same DSP architecture, run at the same clockrate, and have the same functionality (the EP has less memory, and no direct access to the MIXBUF). So, theoretically, nothing prevents the GP from doing EP tasks or vice versa{{FIXME|reason=I have not seen counter-arguments}}.<br />
<br />
The APU does only audio-processing but no audio output. Hence, one of the DSPs typically uses programmable DMA to transfer the finished audio to system memory, where it can be read by other components (such as AC97).<br />
<br />
All audio processing by the APU is typically done in 24bit PCM at 48000Hz.<br />
An APU audio frame is 32 samples long. Therefore, there are 1500 frames per second, with a duration of 0.{{overline|6}}ms each.<br />
The MIXBUF holds 1024 samples (32 channels * 32 samples/channel).<br />
<br />
=== Glossary ===<br />
<br />
* PRD = Physical Resource Descriptor (Same thing as SGE?!)<br />
* SGE = Scatter Gather Entry<br />
* SSL = Stream Segment List<br />
<br />
== Frontend Engine (FE) ==<br />
<br />
== Voice Processor (VP) ==<br />
<br />
A powerful voice processor. There can be up to 256 voices [http://www.gamasutra.com/blogs/BrianSchmidt/20111117/90625/Designing_the_Boot_Sound_for_the_Original_Xbox.php][https://web.archive.org/web/20010410003338/http://www.nvnews.net/previews/mcpx/mcpx.shtml] and 64[http://www.nvidia.com/object/IO_20010530_6177.html] of those can be 3D.<br />
<br />
Per-voice settings:<br />
* Input type (8bit, 16bit, 24bit, ADPCM)<br />
* 8 target bins, each with controllable volume for this voice<br />
* [[wikipedia:Head-related transfer function|Head-related transfer function]] (HRTF)<br />
* [[wikipedia:Low-frequency oscillation|Low-frequency oscillation]] (LFO)<br />
* Pitch (~187.5 Hz to ~12285920.7 Hz)<br />
* Optionally one of the following filters modes:<br />
** For 2D Mono:<br />
*** DLS2 Low-Pass<br />
*** Parametric Equalizer<br />
*** DLS2 Low-Pass + Parametric Equalizer<br />
** For 2D Stereo:<br />
*** DLS2 Low-Pass<br />
*** Parametric Equalizer<br />
** For 3D:<br />
*** DLS2 Low-Pass + I3DL2 Reverb<br />
*** Parametric Equalizer + I3DL2 Reverb<br />
*** I3DL2 Reverb<br />
* 2 Envelopes (DAHDSR: Delay, Attack, Hold, Decay, Sustain, Release)<br />
** Amplitude Envelope<br />
** Pitch / DLS2 Low-Pass Cutoff Envelope<br />
* Tracking of certain parameters<br />
** Volume<br />
** LFO parameters<br />
** DLS2 Low-Pass parameters?{{FIXME|reason=Not 100% sure, also not sure if this also works for the other filters}}<br />
<br />
There are 32 bins which these voices will be mixed into.<br />
<br />
=== Related APU memory ===<br />
<br />
* VPV = VP Voices<br />
* VPHT = VP HRTF Target<br />
* VPHC = VP HRTF Current<br />
* VPSGE = VP SGEs<br />
* VPSSL = VP SSLs<br />
<br />
=== Voice lists ===<br />
<br />
The voices are kept in a single-linked list. There are 3 voice lists:<br />
<br />
* 2D<br />
* 3D<br />
* MP (Multipass?)<br />
<br />
=== Voice structure ===<br />
<br />
This is 0x80 bytes<br />
<br />
==== Pitch calculation ====<br />
<br />
The 16 bit signed pitch value (''p'') can be converted to and from a unsigned frequency in Hz (''f'') using the following formulas:<br />
<br />
<pre><br />
p = 4096 * log2(f / 48000)<br />
f = pow2(p / 4096) * 48000<br />
</pre><br />
<br />
=== LFO ===<br />
<br />
=== Tracking ===<br />
<br />
Some of the parameters of the VP can be controlled by setting timing parameters.<br />
New values will then be slowly be adapted over time.<br />
{{FIXME}}<br />
<br />
=== Envelopes ===<br />
<br />
There are seperate segments of the envelopes, 2 registers (CUR and COUNT) per envelope keeps track of this and control the envelopes level (LVL):<br />
<br />
* 0: Off = Envelope is not used<br />
* 1: Delay = Time where envelope stays at 0% until attack<br />
** COUNT register counts down from DELAYTIME.<br />
* 2: Attack = Rate at which the envelope goes from 0 to 100%<br />
** COUNT register counts up to ATTACKRATE.<br />
** LVL seems to be linear.<br />
* 3: Hold = Time the envelope stays at 100%<br />
** COUNT register counts down from HOLDTIME.<br />
* 4: Decay = Rate at which the envelope goes from 100% to 0%<br />
** COUNT register counts down from DECAYRATE.<br />
** The LVL is not linear, it's a curve which drops steep at first and then slowly becomes level[https://docs.google.com/spreadsheets/d/1fNsfkvBfnlRQ9XplNnTgmh8jBaWJ56bvh2AVWn8B_k0/edit?usp=sharing]<br />
** The best approximation I could come up with so far is: <code>255*pow(0.99988799,(DECAYRATE*16-COUNT)*4096/DECAYRATE)</code>.<br />
** When the output level (not LVL!) reaches the sustain level the decay section is over (In my example above, this happens when the output level is less than 0.2 away from the sustain level; so if sustain is 0, the voice would switch to the sustain segment when a value below 0.2 is reached)<br />
** Writes to the LVL register are ignored<br />
** Writes to count (any value?) impact the LVL<br />
** If the COUNT is larger than the decayrate the envelope will switch to the sustain state<br />
** If the COUNT results in a smaller output level than the sustainlevel the envelope will switch to the sustain state<br />
* 5: Sustain = Level at which the envelope stays while the voice is being played<br />
** COUNT register writes are ignored, it will stay at 0<br />
** LVL register writes are ignored, it will stay at the current sustain level<br />
* 6: Release = Rate at which the envelope goes from current level to 0%<br />
** Can start at any time{{FIXME|reason=the voice state PERSIST has to do with this. Voice is released using NV1BA0_PIO_VOICE_RELEASE ?}}<br />
** COUNT register starts at RELEASERATE, regardless of the current sustain level<br />
** COUNT register counts down{{FIXME|reason=What happens when it reaches 0? DirectSound seems to turn off voice - or is the hw doing that?}}<br />
** LVL is not updated during this phase (it will keep it's previous value)<br />
** Writes to LVL have an impact on the output volume<br />
** If the COUNT register is higher than the releaserate, the output will be silent and LVL will drop to zero<br />
** The actual output level is probably determined like: <code>int(COUNT * LVL / (RELEASERATE * 16))</code>{{FIXME|reason=Test..}}{{FIXME|reason=Unknown output shape}}<br />
** COUNT will keep counting until 0 even after the output level has hit 0<br />
* 7: Force Release = Unknown still{{FIXME}}<br />
** Seems to happen during invalid conditions? Happened to me when modifying ebo during playback{{citation needed|reason=Need to find out why this happens}}<br />
** LVL and COUNT seem to be ignored during this, but writes go through? Output level seems to stay at 100% ? (I only got repeating 32 samples during this and the whole Xbox crashed shortly after)<br />
<br />
All durations are described using unsigned 12-bit times/rates. The level of sustain is stored unsigned in 8-bit.<br />
The COUNT register is stored in unsigned 16-bit.<br />
<br />
The 12-bit times/rates are multiplied by 16 when loading them into the 16-bit COUNT register.<br />
The COUNT register counts at 1500 Hz[https://docs.google.com/spreadsheets/d/11jxeJ9aey_TVkyiMmmd6SKuow4j4GR9E9fRZ6HXc2WU/edit#gid=396423867].<br />
A unit in the COUNT register is therefore 0.{{overline|6}} ms.<br />
<br />
The 12-bit values of the envelope sections are given in units of 0.{{overline|6}} ms * 16 = 10.{{overline|6}} ms.<br />
This can also be written as 512 / (48000 Hz) = 10.{{overline|6}} ms.<br />
The maximum length of an envelope section is therefore 4095 * 10.{{overline|6}} ms = 43.68 seconds.<br />
<br />
As the envelope counter runs at a fixed clock speed, it is independent of the voice pitch and duration.<br />
<br />
If the Amplitude Envelope COUNT hits 0 during release, DirectSound{{FIXME|reason=Is this a hardware thing? I guess it makes sense..}} already deletes the voice, regardless of the Filter Envelope.<br />
<br />
The sustain level can be changed during playback.<br />
Also the attack register can be changed to a lower value while the counter is counting up, however, if the COUNTER does not compare equal to the set value, it will keep counting, even after an overflow. It will not leave the attack phase and keep counting until it sees value COUNTER / 16 in the attack register. If the attack register is set to a higher value while counting, the volume is going down again.<br />
Also, if the attack register value is zero while counting, there won't be any audio output during the attack phase.<br />
This indicates that the COUNT register is used to calculate the actual value from the current rates.<br />
<br />
The initial state of each envelope can be controlled by the NV1BA0_PIO_VOICE_ON command. It can either be: DISABLE, DELAY, ATTACK or HOLD.<br />
<br />
==== Amplitude Envelope ====<br />
<br />
The amplitude envelope is mixed with the volume during mixing. The volume registers are not modified.<br />
{{FIXME|reason=Is it multiplied on? Is it added? subtracted?}}<br />
It is not yet known how many bits of the envelope state are used.<br />
<br />
==== Filter Envelope ====<br />
<br />
{{FIXME|reason=Research}}<br />
<br />
The pitch scale is multiplied with the current envelope state and added to the current pitch during mixing. The pitch registers are not modified.<br />
<br />
<pre><br />
f = 2^((signed_pitch+signed_pitch_mod*32*envelope_state_float)/4096)*48000 # envelope_state_float: [0, 1]<br />
</pre><br />
<br />
It is not yet known how many bits of the envelope state are used.<br />
<br />
=== Filters ===<br />
<br />
==== DLS2 ====<br />
<br />
Formulas from DirectSound<br />
<br />
<pre><br />
FreqToHardwareCoeff(frequency): # Input in Hz<br />
if (frequency < 30) { return 0x8000 }<br />
if (frequency > 8000) { return 0x0000 }<br />
FC = 2 * sin(PI * frequency / 48000)<br />
octaves = 4096 * log2(FC)<br />
return octaves & 0xFFFF<br />
hardware_coefficient[0] = FreqToHardwareCoeff(frequency)<br />
</pre><br />
<br />
<pre><br />
dBToHardwareCoeff(resonance): # Input in dB<br />
resonance = min(resonance, 22.5)<br />
Q = pow(10, -0.05 * resonance)<br />
return min(0xFFFF)<br />
hardware_coefficient[1] = dBToHardwareCoeff(resonance_in_db)<br />
</pre><br />
<br />
<br />
Stuff from the DLS2 spec:{{FIXME|reason=Untested / unconfirmed. Most info comes from Merry of Citra}}<br />
<br />
There are 2 coeffiecents per channel:<br />
<br />
* F_c (Cutoff frequency)<br />
* resonance<br />
<br />
From Page 8 of "DLS 2.2 Version 1.0"[https://www.midi.org/specifications/item/dls-level-2-specification]<br />
<br />
* b_1 = -2 * r * cos(θ)<br />
* b_2 = r * r<br />
* K = g * (1 + b_1 + b_2)<br />
<br />
<pre><br />
y[i] = K * x[i] - b_1 * y[i-1] - b_2 * y[i-2]<br />
</pre><br />
<br />
Where y[i-2] and y[i-1] are the last two frames of the output and x[i] the current input.<br />
<br />
=== Operation ===<br />
<br />
Voices are stored in VPV.<br />
Input data (from the CPU) is loaded using VPSGE.<br />
Voices are then processed and written to the GP MIXBUF.<br />
<br />
== Global Processor (GP) ==<br />
<br />
The GP is a DSP to do programmable audio processing on the voice bins.<br />
<br />
The GP DSP seems to run at 160 MHz.<br />
<br />
=== MIXBUF ===<br />
<br />
The MIXBUF is a 0x400 word (24-Bit, stored as 32-Bit) section. It is split into 32 * 0x20 words.<br />
Each 0x20 word block represents one of the 32 voice bins of the VP.<br />
The 0x20 words are 24-Bit PCM mono samples to be played back at 48kHz. The duration of each frame is hence 0.{{overline|6}}ms.<br />
<br />
=== Memory map ===<br />
<br />
=== Related APU memory ===<br />
<br />
* GPS = GP Scratch (?)<br />
* GPF = GP FIFO<br />
<br />
== Encode Processor (EP) ==<br />
<br />
The EP is a DSP to encode the audio signal.<br />
<br />
=== Memory map ===<br />
<br />
=== Related APU memory ===<br />
<br />
* EPS = EP Scratch (?)<br />
* EPF = EP FIFO<br />
<br />
== Usage in DirectSound ==<br />
<br />
''This topic deserves it's own article{{FIXME}}''<br />
<br />
The bins are used {{FIXME|reason=How?}}<br />
DirectSound allows to load custom GP DSP code for a filter / effects chain.<br />
{{FIXME|reaon=Will GP DSP automatically download code or is code pushed to it?}}<br />
The GP waits for the frame interrupt which signals that MIXBUF data is available. It then goes through the filter chain.<br />
At the end of the chain, the GP DSP will verify that the execution didn't take longer than the frame duration.<br />
<br />
The GP will then issue 6 DMA requests to output the processed frames to a ringbuffer in scratch space.<br />
The frameformat will be the same format as the GP MIXBUF format (also 0x20 words per channel).<br />
Each ringbuffer is 0x200 words and therefore holds the last 16 frames.<br />
Therefore, the ringbuffer region is 6 * 0x800 Bytes = 0x3000 Bytes in physical memory.<br />
<br />
The order of the channels in the ringbuffer is (also DMA order):<br />
<br />
* 0: Front Left<br />
* 1: Center{{citation needed}}<br />
* 2: Front Right<br />
* 3: Rear Left{{citation needed}}<br />
* 4: Rear Right{{citation needed}}<br />
* 5: [[Wikipedia:Low-frequency effects|Low-frequency effects]] (LFE){{citation needed}}<br />
<br />
The EP maps the same data to its own scratch space. It is assumed that it will DMA this region to its own internal memory.<br />
The EP then AC3 encodes the audio data{{citation needed}} and writes it to the EP FIFO memory{{FIXME|How does this happen? DMA?}}.<br />
{{FIXME|reason=When does this happen and what happens to stereo? headphones? mono?}}<br />
The data is then send to the ACI AC97 using EP FIFO channels 0 (PCM) and 1 (SPDIF){{citation needed}}.<br />
The EP code is loaded by DirectSound. The EP is not programmable using DirectSound APIs.<br />
<br />
=== Modifications for Boot Animation ===<br />
<br />
During the [[Boot Animation]] a different version of DirectSound is used.<br />
The EP is disabled in this case.<br />
The data is send to the ACI AC97 using GP FIFO channel 0 (PCM).<br />
There is no AC3 / SPDIF during the boot animation[http://www.gamasutra.com/blogs/BrianSchmidt/20111117/90625/Designing_the_Boot_Sound_for_the_Original_Xbox.php]{{citation needed|reason=Link to brians gamasutra stuff}}.<br />
<br />
== Related notes ==<br />
<br />
* [[ACI]]<br />
* [[DSP]]<br />
* [[Xbox ADPCM]]<br />
* [http://www.nvidia.com/object/apu.html Information at NVIDIAs website]<br />
* [http://www.nvidia.com/attach/9004 "Technical Brief: NVIDIA nForce MCP Audio Processing Unit" by NVIDIA]<br />
* [https://github.com/JayFoxRox/xbox-tools/blob/master/python-scripts/ Scripts to inspect APU registers and voice buffers]<br />
* Filter information<br />
** [https://de.mathworks.com/help/audio/examples/parametric-equalizer-design.html Something about Parametric Equalizers]<br />
** [https://github.com/kcat/openal-soft/blob/master/Alc/effects/reverb.c Mentions I3DL2 Reverb]<br />
** [https://www.midi.org/specifications/item/dls-level-2-specification DLS2 low-pass filter with resonance and dynamic filter cutoff frequency]<br />
<br />
<br />
[[Category:APU]]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=NV2A/Surface_Formats&diff=6737NV2A/Surface Formats2019-06-27T20:28:11Z<p>JayFoxRox: Dummy info about O and Z fields, and list of formats (should link to nouveau or XQEMU instead in future)</p>
<hr />
<div><br />
<br />
== Texture formats ==<br />
<br />
* [http://download.nvidia.com/developer/OpenGL_Texture_Formats/nv_ogl_texture_formats.pdf List of implemented texture formats, according to NVIDIA]<br />
<br />
=== Texture decoding / sampling ===<br />
<br />
The textures are sampled by the texture shader portion of [[NV2A/Pixel_Combiner]].<br />
<br />
==== Texture signedness ====<br />
<br />
Each component of the texture can be either signed (two's-complement) or unsigned.[https://github.com/xqemu/xqemu/issues/75]{{FIXME|reason=Research and collect information here}}.<br />
<br />
==== Texture filtering ====<br />
<br />
The GPU implements the standard texture filters as known from OpenGL.<br />
In addition, it supports convolution filters[https://github.com/xqemu/xqemu/issues/238]{{FIXME|reason=Research and collect information here}}.<br />
<br />
== Framebuffer formats ==<br />
<br />
Surfaces are rendertargets of the GPU, they can be swizzled or linear.<br />
Additionally, they can be optimized using tiling{{FIXME|reason=Document tiling}}.<br />
<br />
{{FIXME|reason=Link to nouveau documentation instead; this section shouldn't be here}}<br />
<br />
=== Color ===<br />
<br />
Z and O stand for Zero and One respectively. These fields will always be cleared (Zero) or all bis will be set (One).<br />
<br />
* NV097_SET_SURFACE_FORMAT_COLOR_LE_X1R5G5B5_Z1R5G5B5<br />
* NV097_SET_SURFACE_FORMAT_COLOR_LE_X1R5G5B5_O1R5G5B5<br />
* NV097_SET_SURFACE_FORMAT_COLOR_LE_R5G6B5<br />
* NV097_SET_SURFACE_FORMAT_COLOR_LE_X8R8G8B8_Z8R8G8B8<br />
* NV097_SET_SURFACE_FORMAT_COLOR_LE_X8R8G8B8_O8R8G8B8<br />
* NV097_SET_SURFACE_FORMAT_COLOR_LE_X1A7R8G8B8_Z1A7R8G8B8<br />
* NV097_SET_SURFACE_FORMAT_COLOR_LE_X1A7R8G8B8_O1A7R8G8B8<br />
* NV097_SET_SURFACE_FORMAT_COLOR_LE_A8R8G8B8<br />
* NV097_SET_SURFACE_FORMAT_COLOR_LE_B8 (not suitable for displaying)<br />
* NV097_SET_SURFACE_FORMAT_COLOR_LE_G8B8 (not suitable for displaying)<br />
<br />
=== Depth ===<br />
<br />
The depth buffer can be configured to be fixed point or floating point.<br />
<br />
Additionally, the GPU allows hardware Z-Buffer compression{{FIXME|reason=Document compression}}.<br />
<br />
* NV097_SET_SURFACE_FORMAT_ZETA_Z16<br />
* NV097_SET_SURFACE_FORMAT_ZETA_Z24S8<br />
<br />
[[Category:NV2A]]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=NV2A/Surface_Formats&diff=6736NV2A/Surface Formats2019-06-25T22:12:43Z<p>JayFoxRox: Add link to NV texture fomat list, and XQEMU links for signedness and convolution</p>
<hr />
<div><br />
<br />
== Texture formats ==<br />
<br />
* [http://download.nvidia.com/developer/OpenGL_Texture_Formats/nv_ogl_texture_formats.pdf List of implemented texture formats, according to NVIDIA]<br />
<br />
=== Texture decoding / sampling ===<br />
<br />
The textures are sampled by the texture shader portion of [[NV2A/Pixel_Combiner]].<br />
<br />
==== Texture signedness ====<br />
<br />
Each component of the texture can be either signed (two's-complement) or unsigned.[https://github.com/xqemu/xqemu/issues/75]{{FIXME|reason=Research and collect information here}}.<br />
<br />
==== Texture filtering ====<br />
<br />
The GPU implements the standard texture filters as known from OpenGL.<br />
In addition, it supports convolution filters[https://github.com/xqemu/xqemu/issues/238]{{FIXME|reason=Research and collect information here}}.<br />
<br />
== Framebuffer formats ==<br />
<br />
[[Category:NV2A]]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=NV2A/Pixel_Combiner&diff=6735NV2A/Pixel Combiner2019-06-25T22:03:20Z<p>JayFoxRox: Some corrections based on https://github.com/XboxDev/nxdk/blob/master/tools/fp20compiler/ps1.0_program.cpp#L227</p>
<hr />
<div>The NV2A implements at least parts of the following OpenGL extensions:<br />
<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader.txt NV_texture_shader]<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader2.txt NV_texture_shader2]<br />
* [https://www.khronos.org/registry/OpenGL/extensions/NV/NV_texture_shader3.txt NV_texture_shader3]{{citation needed}}<br />
* [https://www.opengl.org/registry/specs/NV/register_combiners.txt NV_register_combiners]<br />
* [https://www.opengl.org/registry/specs/NV/register_combiners2.txt NV_register_combiners2]<br />
<br />
<br />
== Data types ==<br />
<br />
NV_texture_shader suggests that: ''"The 8-bit and 16-bit signed fixed-point types are used for signed internal texture formats, while the 9-bit signed fixed-point type is used for register combiners computations."''<br />
Here is a table from the GL extension:<br />
<br />
{| class="wikitable"<br />
! floating-point !! 8-bit fixed-point !! 9-bit fixed-point !! 16-bit fixed-point<br />
|-<br />
| 1.0 || n/a || 255 || n/a <br />
|-<br />
| 0.99996... || n/a || n/a || 32767<br />
|-<br />
| 0.99218... || 127 || n/a || n/a <br />
|-<br />
| 0.0 || 0 || 0 || 0<br />
|-<br />
| -1.0 || -128 || -255 || -32768<br />
|-<br />
| -1.00392... || n/a || -256 || n/a<br />
|}<br />
<br />
This means:<br />
<br />
* 8-bit fixed-point: [-128, 127] &rarr; [-128/128, 127/128] &rarr; [-1.0, 0.99218...]<br />
* 9-bit fixed-point: [-256, 255] &rarr; [-256/255, 255/255] &rarr; [-1.00392..., 1.0]<br />
* 16-bit fixed-point: [-32768, 32767] &rarr; [-32768/32768, 32767/32768] &rarr; [-1.0, 0.99996...]<br />
<br />
It is not known if the NV2A really implements these 3 datatypes.<br />
It is also not yet known how exactly conversion or negation of these types would work.<br />
<br />
== Texturing modes ==<br />
<br />
{|class="wikitable"<br />
!ID<br />
!Name<br />
!D3D name<br />
!GL Name<br />
!Stage 1<br />
!Stage 2<br />
!Stage 3<br />
!Stage 4<br />
!Notes<br />
|-<br />
|0x00<br />
|PS_TEXTUREMODES_NONE<br />
|<br />
|NONE<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x01<br />
|PS_TEXTUREMODES_PROJECT2D<br />
|tex<br />
|TEXTURE_2D<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x02<br />
|PS_TEXTUREMODES_PROJECT3D<br />
|tex<br />
|TEXTURE_3D<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x03<br />
|PS_TEXTUREMODES_CUBEMAP<br />
|tex<br />
|TEXTURE_CUBE_MAP_ARB<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x04<br />
|PS_TEXTUREMODES_PASSTHRU<br />
|texcoord<br />
|PASS_THROUGH_NV<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x05<br />
|PS_TEXTUREMODES_CLIPPLANE<br />
|texkill<br />
|CULL_FRAGMENT_NV<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x06<br />
|PS_TEXTUREMODES_BUMPENVMAP<br />
|texbem<br />
|OFFSET_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x07<br />
|PS_TEXTUREMODES_BUMPENVMAP_LUM<br />
|texbeml<br />
|OFFSET_TEXTURE_2D_SCALE_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x08<br />
|PS_TEXTUREMODES_BRDF<br />
|texbrdf<br />
|<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x09<br />
|PS_TEXTUREMODES_DOT_ST<br />
|texm3x2tex<br />
|DOT_PRODUCT_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0A<br />
|PS_TEXTUREMODES_DOT_ZW<br />
|texm3x2depth<br />
|<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0B<br />
|PS_TEXTUREMODES_DOT_RFLCT_DIFF<br />
|texm3x3diff<br />
|DOT_PRODUCT_DIFFUSE_CUBE_MAP_NV{{citation needed}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|{{no}}<br />
|<br />
|-<br />
|0x0C<br />
|PS_TEXTUREMODES_DOT_RFLCT_SPEC<br />
|texm3x3vspec<br />
|DOT_PRODUCT_CONST_EYE_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0D<br />
|PS_TEXTUREMODES_DOT_STR_3D<br />
|texm3x3tex<br />
|DOT_PRODUCT_TEXTURE_3D_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0E<br />
|PS_TEXTUREMODES_DOT_STR_CUBE<br />
|texm3x3vspec<br />
|DOT_PRODUCT_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x0F<br />
|PS_TEXTUREMODES_DPNDNT_AR<br />
|texreg2ar<br />
|DEPENDENT_AR_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x10<br />
|PS_TEXTUREMODES_DPNDNT_GB<br />
|texreg2gb<br />
|DEPENDENT_GB_TEXTURE_2D_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{yes}}<br />
|<br />
|-<br />
|0x11<br />
|PS_TEXTUREMODES_DOTPRODUCT<br />
|texm3x3pad<br>texm3x2pad<br />
|DOT_PRODUCT_NV<br />
|{{no}}<br />
|{{yes}}<br />
|{{yes}}<br />
|{{no}}<br />
|<br />
|-<br />
|0x12<br />
|PS_TEXTUREMODES_DOT_RFLCT_SPEC_CONST<br />
|texm3x3spec<br />
|DOT_PRODUCT_CONST_EYE_REFLECT_CUBE_MAP_NV<br />
|{{no}}<br />
|{{no}}<br />
|{{no}}<br />
|{{yes}}<br />
|<br />
|}<br />
<br />
== Debugging ==<br />
<br />
PIX from the Microsoft XDK provides great debugging capabilities.<br />
<br />
== References and links ==<br />
<br />
* [http://developer.download.nvidia.com/assets/gamedev/docs/ProgrammableTextureBlending.pdf Overview about programmable fragment shading] <!-- Mirror: https://www.nvidia.com/object/programmable_texture_blending.html --><br />
* [https://github.com/XboxDev/nxdk/blob/77b5de45f0c64e70f2ff68248873448d5edccc71/tools/fp20compiler/ps1.0_program.cpp#L227 Code from nvparse (NVIDIA SDK 9.52) in nxdk, which handles shader to OpenGL conversion]<br />
* http://developer.download.nvidia.com/assets/gamedev/docs/GDC2K1_DX8_Pixel_Shaders.pdf<br />
<br />
[[Category:NV2A]]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=EEPROM&diff=6729EEPROM2019-06-12T09:31:57Z<p>JayFoxRox: Add video setting information by LukeUsher and wutno</p>
<hr />
<div>The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.<br />
Parts of the EEPROM are encrypted using [[Kernel/XboxEEPROMKey]].<br />
<br />
== Contents ==<br />
<br />
{| class="wikitable"<br />
! Start !! End !! Notes<br />
|-<br />
| 0x00<br />
| 0x13<br />
| HMAC_SHA1 Hash<br />
|-<br />
| 0x14<br />
| 0x1B<br />
| RC4 Encrypted Confounder ??<br />
|-<br />
| 0x1C<br />
| 0x2B<br />
| RC4 Encrypted HDD key<br />
|-<br />
| 0x2C<br />
| 0x2F<br />
| RC4 Encrypted Region code<br />
* 0x00000001 = North America<br />
* 0x00000002 = Japan<br />
* 0x00000004 = Europe & Australia<br />
* 0x80000000 = Manufacturing plant<br />
|-<br />
| 0x30<br />
| 0x33<br />
| Checksum2 - Checksum of next 44 (0x2C) bytes (0x34 - 0x5F)<sup>*</sup><br />
|-<br />
| 0x34<br />
| 0x3F<br />
| Xbox serial number - (ASCII chars 0x30 - 0x39 to match each digit in SN)<br />
|-<br />
| 0x40<br />
| 0x45<br />
| Ethernet MAC address (Microsoft Xbox - 00:50:F2:xx:xx:xx)<br />
This is the MAC address of the Ethernet hardware, which has been [https://web.archive.org/web/20100617020733/http://standards.ieee.org/regauth/oui/oui_public.txt issued by the IEEE].<br />
|-<br />
| 0x46<br />
| 0x47<br />
| Unknown Padding ?<br />
|-<br />
| 0x48<br />
| 0x57<br />
| Online Key ?<br />
|-<br />
| 0x58<br />
| 0x5B<br />
| Video Standard<br />
* 0x00000000 = not set (INVALID)<br />
* 0x00400100 = NTSC-M<br />
* 0x00400200 = NTSC-J<br />
* 0x00800300 = PAL-I<br />
* 0x00400400 = PAL-M<br />
|-<br />
| 0x5C<br />
| 0x5F<br />
| Unknown Padding ?<br />
|-<br />
| 0x60<br />
| 0x63<br />
| Checksum3 - Checksum of the next 92 (0x5C) bytes (0x64 - 0xBF)<sup>*</sup><br />
|-<br />
| 0x64<br />
| 0x67<br />
| Zone Bias - Offset in # minutes to subtract from GMT time <br />
(e.g., for GMT-06 Central; 6hr = 360min = 0x00000168)<br />
|-<br />
| 0x68<br />
| 0x6B<br />
| Standard Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CST\0, ACST)<br />
|-<br />
| 0x6C<br />
| 0x6F<br />
| Daylight Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CDT\0, ACDT)<br />
|-<br />
| 0x70<br />
| 0x77<br />
| Unknown Padding ?<br />
|-<br />
| 0x78<br />
| 0x7B<br />
| Standard Time Starts 10-05-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x7C<br />
| 0x7F<br />
| Daylight Savings Time Starts 04-01-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x80<br />
| 0x87<br />
| Unknown Padding ?<br />
|-<br />
| 0x88<br />
| 0x8B<br />
| Standard Timezone Bias; if not DST, 0 (0x00000000) minute time adjust<br />
|-<br />
| 0x8C<br />
| 0x8F<br />
| Daylight Savings Time Bias; if DST, -60 (0xFFFFFFC4) minute time adjust<br />
|-<br />
| 0x90<br />
| 0x93<br />
| Language ID (0 = not set)<br />
* 0x00000001 = English<br />
* 0x00000002 = Japanese<br />
* 0x00000003 = German<br />
* 0x00000004 = French<br />
* 0x00000005 = Spanish<br />
* 0x00000006 = Italian<br />
* 0x00000007 = Korean<br />
* 0x00000008 = Chinese<br />
* 0x00000009 = Portuguese<br />
|-<br />
| 0x94<br />
| 0x97<br />
| Video Settings<br />
* 0x00080000 = 480p<br />
* 0x00020000 = 720p<br />
* 0x00040000 = 1080i<br />
<br />
* 0x00010000 = Widescreen{{FIXME|reason=What happens if Widescreen and letterbox are enabled at the same time? Can this happen?}}<br />
* 0x00100000 = Letterbox{{FIXME|reason=What happens if Widescreen and letterbox are enabled at the same time? Can this happen?}}<br />
<br />
* 0x00400000 = 60Hz{{FIXME|reason=Unconfirmed; Also, what happens if both refresh rates are disabled?}}<br />
* 0x00800000 = 50Hz{{FIXME|reason=Unconfirmed; Also, what happens if both refresh rates are disabled?}}<br />
|-<br />
| 0x98<br />
| 0x9B<br />
| Audio Settings<br />
|-<br />
| 0x9C<br />
| 0x9F<br />
| Games Parental Control (0 = Max rating)<br />
* 0x00000000 = Rating Pending (RP)<br />
* 0x00000001 = Adults Only (AO)<br />
* 0x00000002 = Mature (M)<br />
* 0x00000003 = Teen (T)<br />
* 0x00000004 = Everyone (E)<br />
* 0x00000005 = Kids to Adults (K-A)<br />
* 0x00000006 = Early Childhood (EC)<br />
|-<br />
| 0xA0<br />
| 0xA3<br />
| Parental Control Passcode; 4 button sequence (each key stored in a nibble)<br />
* 0x1 = {{input-dy+}} or {{input-ly+}}<br />
* 0x2 = {{input-dy-}} or {{input-ly-}}<br />
* 0x3 = {{input-dx-}} or {{input-lx-}}<br />
* 0x4 = {{input-dx+}} or {{input-lx+}}<br />
* 0x5 = {{input-a}}<br />
* 0x6 = {{input-b}}<br />
* 0x7 = {{input-x}}<br />
* 0x8 = {{input-y}}<br />
* 0xB = {{input-lt}}<br />
* 0xC = {{input-rt}}<br />
* 0x0 = Disabled{{FIXME|reason=Is this 0x00000000 only, or are shorter codes possible? can a middle section be 0x00 or would that end the sequence?}}<br />
<br />
''Note'':<br />
* A passcode 0x00001423 is D-pad directions up (0x1), right (0x4), down (0x2), left (0x3). <br />
* Pass code only uses the lower 16 bits; each button is stored as a nibble in the word. First button in the most significant nibble and last in the least significant nibble.<br />
|-<br />
| 0xA4<br />
| 0xA7<br />
| Movies Parental Control (0 = Max rating)<br />
* 0x00000001 = Adults Only (NC-17)<br />
* 0x00000002 = Restricted (R)<br />
* 0x00000004 = Parents Strongly Cautioned (PG-13)<br />
* 0x00000005 = Parental Guidance Suggested (PG)<br />
* 0x00000007 = General Audiences (G)<br />
|- <br />
| 0xA8<br />
| 0xAB<br />
| XBOX Live IP Address..<br />
|-<br />
| 0xAC<br />
| 0xAF<br />
| XBOX Live DNS Server..<br />
|-<br />
| 0xB0<br />
| 0xB3<br />
| XBOX Live Gateway Address..<br />
|-<br />
| 0xB4<br />
| 0xB7<br />
| XBOX Live Subnet Mask..<br />
|-<br />
| 0xB8<br />
| 0xBB<br />
| Other XBLive settings ?<br />
|-<br />
| 0xBC<br />
| 0xBF<br />
| DVD Playback Kit Zone<br />
* 0x00000000 = None<br />
* 0x00000001 = Region 1<br />
* ...<br />
* 0x00000006 = Region 6{{FIXME|reason=We should document which regions were actually sold in stores}}<br />
|-<br />
| 0xC0<br />
| 0xFF<br />
| Unknown Codes / History ? do not change any values in this range<br />
|-<br />
|}<br />
<br />
Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].<br />
<br />
<sup>*</sup>Configmagic-FINAL-1.6 uses the wrong size when computing Checksum2 (40 instead of 44 bytes) and Checksum3 (96 instead of 92 bytes). Checksum2 value computed was correct only because the extra 4 bytes not used in the CRC computation were all 0's which does not change the CRC value. However, a similiar problem with computation of Checksum3 is present. The CRC computed for v1.6 Xbox's is incorrect as the 4 extra bytes are not 0's as on earlier versions.<br />
<br />
== Reading/Writing the EEPROM ==<br />
<br />
=== Software Method ===<br />
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.<br />
<br />
=== Hardware Method ===<br />
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see [http://dangerousprototypes.com/blog/bus-pirate-manual/ here]<br />
or [https://www.totalphase.com/products/aardvark-i2cspi/ here]), build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. Then use the corresponding software to read/write the EEPROM.<br />
<br />
== The HMAC HDD Key ==<br />
<br />
The HMAC HDD Key is generated{{FIXME|reason=Stored? Derived? At factory?}} out of the first 48 bytes{{FIXME|reason=..first 48 EEPROM bytes? Encrypted / Decrypted?}}. This section has been identified clearly{{FIXME|reason=What does this mean?}}.<br />
<br />
== Checksum Algorithm ==<br />
<br />
Checksum2 and Checksum3 values can be calculated by running the following code snippet over the area the checksum covers:<br />
<br />
<pre> /* The EepromCRC algorithm was obtained from the XKUtils 0.2 source released by<br />
* TeamAssembly under the GNU GPL.<br />
* Specifically, from XKCRC.cpp<br />
*<br />
* Rewritten to ANSI C by David Pye (dmp@davidmpye.dyndns.org)<br />
*<br />
* Adapted for XboxDevWiki<br />
*/<br />
uint32_t EepromCRC(unsigned char *data, long dataLen) {<br />
<br />
// Initialize result to zero<br />
uint8_t crc[4] = { 0x00, 0x00, 0x00, 0x00 };<br />
<br />
//Circle shift input data one byte right<br />
unsigned char* CRC_Data = (unsigned char *)malloc(dataLen + 4);<br />
memset(CRC_Data, 0x00, dataLen + 4);<br />
memcpy(CRC_Data + 0x01 , data, dataLen - 1);<br />
memcpy(CRC_Data, data + dataLen - 1, 0x01);<br />
<br />
// Calculate checksum<br />
for (unsigned int i = 0; i < 4; i++) {<br />
unsigned short CRCPosVal = 0xFFFF;<br />
for (unsigned long l = i; l < dataLen; l += 4) {<br />
CRCPosVal -= *(unsigned short*)(&amp;CRC_Data[l]);<br />
}<br />
CRCPosVal &= 0xFF00;<br />
crc[i] = (unsigned char) (CRCPosVal << 8);<br />
}<br />
<br />
free(CRC_Data);<br />
<br />
return *(uint32_t*)&checksum;<br />
}<br />
</pre><br />
<br />
== Read Checksum Algorithm ==<br />
<br />
When the Xbox reads from the FACTORY_SETTINGS or the USER_SETTINGS section of the EEPROM, this algorithm is ran over the entire section accessed (including the CRC checksum mentioned above) to ensure that the data is valid. If the result of the checksum algorithm does not equal 0xFFFFFFFF, STATUS_DEVICE_DATA_ERROR is returned from the Kernel.<br />
<br />
<pre>static uint32_t eeprom_section_checksum(<br />
const uint32_t* section_data,<br />
uint32_t section_data_length<br />
)<br />
{<br />
const uint32_t bitmask = 0xFFFFFFFF;<br />
uint64_t checksum = 0;<br />
uint32_t carry_count = 0;<br />
<br />
// Process the data in 32 bit steps<br />
for(unsigned int i = 0; i < section_data_length / 4; i++) {<br />
checksum += *section_data;<br />
if(checksum > bitmask) {<br />
carry_count++;<br />
checksum &= bitmask;<br />
}<br />
section_data++;<br />
}<br />
checksum += carry_count;<br />
if(checksum > bitmask) {<br />
checksum += 1;<br />
}<br />
return (uint32_t)(checksum & bitmask);<br />
}<br />
</pre><br />
<br />
== Further Reading ==<br />
<br />
* [https://web.archive.org/web/20040604013125/http://console-dev.com:80/eeprom.htm Information about EEPROM contents]<br />
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip with a Raspberry Pi]<br />
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]<br />
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Hard_Drive&diff=6727Hard Drive2019-06-11T16:32:58Z<p>JayFoxRox: Link Config Area and add some FIXMEs</p>
<hr />
<div>The original Xbox hard disk drive was 8 GB in size. Later releases, 10 GB drives; however, only the first 8 GB of the drive was used. See [[Hardware Revisions]] for more information.<br />
<br />
== Partitions ==<br />
The Xbox hard disk contains multiple partitions. Unlike a PC, which typically contains either a [https://en.wikipedia.org/wiki/Master_boot_record Master Boot Record] or [https://en.wikipedia.org/wiki/GUID_Partition_Table GUID Partition Table] to specify the partition information, the Xbox kernel uses a fixed partition layout. The file system used on the Xbox is [[FATX]], a variant of FAT16/32 developed by Microsoft specifically for the Xbox.<br />
{{FIXME|reason=Is this the same for all HDD sizes? could the number of free blocks in the savegame menu be used to calculate what kind of HDD you have?}}<br />
<br />
{| class="wikitable"<br />
|-<br />
! Drive Letter{{FIXME|reason=This is under control of running application / variation even in official products?}}<br />
! Description<br />
! Offset (bytes)<br />
! Size (bytes)<br />
! Filesystem<br />
! Device Object (MS Retail Kernel)<br />
|-<br />
| N/A<br />
| [[Config Sector|Config Area]]<br />
| 0x00000000<br />
| 0x00080000<br />
| Fixed Structure<br />
| N/A<br />
|-<br />
| X<br />
| Game Cache<br />
| 0x00080000<br />
| 0x2ee00000<br />
| FATX<br />
| \Device\Harddisk0\Partition3<br />
|-<br />
| Y<br />
| Game Cache<br />
| 0x2ee80000<br />
| 0x2ee00000<br />
| FATX<br />
| \Device\Harddisk0\Partition4<br />
|-<br />
| Z<br />
| Game Cache<br />
| 0x5dc80000<br />
| 0x2ee00000<br />
| FATX<br />
| \Device\Harddisk0\Partition5<br />
|-<br />
| C<br />
| System<br />
| 0x8ca80000<br />
| 0x1f400000<br />
| FATX<br />
| \Device\Harddisk0\Partition2<br />
|-<br />
| E<br />
| Data<br />
| 0xabe80000<br />
| 0x131f00000<br />
| FATX<br />
| \Device\Harddisk0\Partition1<br />
|}<br />
<br />
::::::::::::::::::::::''side note: CD/DVD Drive "D:" <=> "\Device\CdRom0"''<br />
::::::::::::::::::::::''and usually: added Drive "F:" <=> "\Device\Harddisk0\Partition6"''{{FIXME|reason=Mark as unofficial / homebrew}}<br />
:::::::::::::::::::::::::&nbsp;&nbsp;&nbsp;''added Drive "G:" <=> "\Device\Harddisk0\Partition7"''{{FIXME|reason=Mark as unofficial / homebrew}}<br />
<br />
'''Debug/Devkit HDD:'''<br />
{| class="wikitable"<br />
|-<br />
! Drive Letter<br />
! Description<br />
! Offset (bytes)<br />
! Size (bytes)<br />
! Filesystem<br />
! Device Object (MS Retail Kernel)<br />
|-<br />
| [FIXME]<br />
| [FIXME]<br />
| [FIXME]<br />
| [FIXME]<br />
| [FIXME]<br />
| [FIXME]<br />
|-<br />
|}<br />
<br />
<br />
'''FIXME:'''<br />
* Add info on how extended partitions are added.<br />
<br />
== Locking ==<br />
The hard drives in the Xbox are locked with a key which is unique to the specific Xbox. The drive is unlocked by the kernel at boot.<br />
<br />
=== Unlocking for Backups ===<br />
Before connecting an Xbox HDD to a PC for a backup or modification, the drive must first be unlocked. This can be done with alternative dashboards (such as EvoX). But beware, once you unlock the disk you cannot use it with an official BIOS until you re-lock the disk! For this reason it is suggested to use a patched BIOS which does not require the disk to be locked. If you are unable to run unsigned code (needed to unlock the HDD before powering off), it is possible to hot-swap the drive after the Xbox has started. This is not a suggested method, but it has been known to work. The idea is that you start the Xbox and wait for the dashboard, at which point the drive will be unlocked. Then, while the Xbox is running, you disconnect the IDE cable (but not the power!), and then connect the drive to your PC. Then the drive can be mounted for read/write (using XboxHDM), or imaged directly.<br />
<br />
'''FIXME:'''<br />
* Provide more info on locking/unlocking procedure.<br />
* Provide details about the key and how it can be derived from the [[EEPROM]] data.<br />
<br />
== How To: Backup an HDD ==<br />
There are two general methods to back up your HDD: copying the files, or creating a byte-for-byte image of the drive.<br />
<br />
=== Method 1: File Copy ===<br />
This is an acceptable backup method, but it is not as accurate an exact copy. This method requires less work to create the backup, but more work to re-create a usable disk image. The dashboard files (found in C:) are the most essential part of a backup, and a complete disk image can be re-created (with some effort) with a copy of the dashboard files using a tool such as XboxHDM.<br />
<br />
==== Remote ====<br />
Simply run an XBE on your Xbox that provides an FTP server. This is a standard feature for alternative dashboards (such as EvoX). Then connect to your Xbox from another system and copy all files in '''C:''' and '''E:'''.<br />
<br />
==== Direct ====<br />
Unlock the HDD, connect it to your PC, mount the drive (see [[FATX]]), copy the files.<br />
<br />
=== Method 2: Exact Copy ===<br />
This is the most accurate method to backup your hard disk. This method requires more work to create the backup, but does not require any effort to create a usable disk image like the first method. There are multiple ways to implement this method, one is provided here.<br />
<br />
Unlock the HDD, connect it to your PC using a USB-IDE adapter ([https://www.amazon.com/Sabrent-USB-DSC9-SATA-Drive-Converter/dp/B00DQJME7Y available for ~$20USD]). In GNU/Linux and other *NIX variants, DD can be used to perform the block copy. For example: <code>sudo dd if=/dev/sdb of=xbox_hdd.raw bs=512</code>. append <code>status=progress</code> to see the progress during copying if you run a recent distro, like so: <code>sudo dd if=/dev/sdb of=xbox_hdd.raw bs=512 status=progress</code>.If you're dumping an original Xbox HDD (capacity 8G or 10G), this will finish pretty quickly. The files can be extracted by mounting the filesystems in the image (see [[FATX]]).<br />
<br />
== Further Reading ==<br />
* [http://hackipedia.org/Disk%20formats/Partition%20tables/X-Box/Xbox_Partitioning_and_Filesystem_Details.htm Xbox Partitioning and Filesystem Details]<br />
* [https://web.archive.org/web/20020617181617/http://www.tardis.ed.ac.uk:80/~lucien/computing/projects/xbox/XBOX-disk-layout.htm XBOX DISK LAYOUT v0.13]</div>JayFoxRoxhttps://xboxdevwiki.net/index.php?title=Xbox_Hard_Disk_Partitioning&diff=6726Xbox Hard Disk Partitioning2019-06-11T16:30:04Z<p>JayFoxRox: Add our own article</p>
<hr />
<div>{{retrieved|https://web.archive.org/web/20100617023145/http://www.xbox-linux.org/wiki/Xbox_Hard_Disk_Partitioning|ours=Hard Drive}}<br />
<br />
<br />
by ''Michael Steil'' (original version: 8 May 2002)<br />
<br />
The Xbox uses a hard disk partitioning scheme that is hardwired into the kernel. The hard disk consists of a header, 3 game cache partitions, a system partition and a data partition:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
! Offset<br />
! Size<br />
! Description<br />
|-<br />
| 0&nbsp;MB<br /><code>0x00000000</code><br />
| 0.5&nbsp;MB<br />
| '''Disk Config Area''' <br />This partition contains no filesystem. Various configuration data is stored on fixed offsets.<br />Linux device: <code>none</code><br />
|-<br />
| 0.5&nbsp;MB<br /><code>0x00000400</code><br />
| 750&nbsp;MB<br />
| '''Game Cache A''' (Drive X:)<br />FATX volume containing temporary data of a game for faster access.<br />Linux device: <code>/dev/hda52</code><br />
|-<br />
| 750.5&nbsp;MB<br /><code>0x00177400</code><br />
| 750&nbsp;MB<br />
| '''Game Cache B''' (Drive Y:)<br />Linux device: <code>/dev/hda53</code><br />
|-<br />
| 1500.5&nbsp;MB<br /><code>0x002EE400</code><br />
| 750&nbsp;MB<br />
| '''Game Cache C''' (Drive Z:)<br />Linux device: <code>/dev/hda54</code><br />
|-<br />
| 2250.5&nbsp;MB<br /><code>0x00465400</code><br />
| 500&nbsp;MB<br />
| '''System Files''' (Drive C:)<br />FATX volume containing menu code, graphics, sound, DVD player, music import,&nbsp;...<br />Linux device: <code>/dev/hda51</code><br />
|-<br />
| 2750.5&nbsp;MB<br /><code>0x0055F400</code><br />
| 4895&nbsp;MB<br />
| '''Data''' (Drive E:)<br />FATX volume containing saved games and imported CD audio tracks.<br />Linux device: <code>/dev/hda50</code><br />
|-<br />
! <br />
! <br />
! '''Non-Standard partitions on disks &gt;8GB'''<br />
|-<br />
| 7645.5&nbsp;MB<br /><code>0x00EE8AB0</code><br />
| 1896&nbsp;MB<br />- 130&nbsp;GB<br />
| '''Unused/Additional''' (Drive F:)<br />The first xboxes had a 8GB disk, later versions came with a 10GB disk. This the space difference between the two and not used. Some tools allow it to be used as additional FATX filesystem<br />Linux device: <code>/dev/hda55</code> (only present if signature of formatted FATX found)<br />Linux assumes that all remaining space on the disk belongs to this partition unless another FATX filesystem is detected at the LBA28 boundary. See below.<br />
|-<br />
| 137&nbsp;GB<br /><code>0x0FFFFFFF</code><br />
| remaining space<br />
| '''LBA28''' (Drive G:)<br />If you install a very big disk some tools are limited by the LBA24 boundary. The drive G allows this space to be used in a separate drive, only accessible to LBA48 capable tools and BIOS'es.<br />Linux device: <code>/dev/hda56</code> (only present if signature of formatted FATX found at LBA24 boundary)<br />Linux assumes that all remaining space on the disk belongs to this partition.<br />
|}<br />
<br />
This table has been completed by Markus Baertschi with lots of stuff. There might be errors and misconceptions, caveat emptor&nbsp;!<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
! '''Missing image'''<br />''Icon-admonition-tip.png'' <br />Tip<br /><br /> | For a more detailed description of the format and contents of the partitions see [https://web.archive.org/web/20100617023145/http://www.xbox-linux.org/wiki/Xbox_Partitioning_and_Filesystem_Details Xbox Partitioning and Filesystem Details].|}</div>JayFoxRox