https://xboxdevwiki.net/api.php?action=feedcontributions&user=KaosEngineer&feedformat=atomxboxdevwiki - User contributions [en]2024-03-28T22:46:07ZUser contributionsMediaWiki 1.28.0https://xboxdevwiki.net/index.php?title=AV_Cables&diff=7364AV Cables2024-03-04T06:05:45Z<p>KaosEngineer: </p>
<hr />
<div>Microsoft has released a handful of '''Audio Video Cables''' for the [[Xbox]], which they refer to internally as '''AV Packs'''. They are connected to the port labelled "Audio Video Input/Output" on the backside of the console.<br />
<br />
== Connector ==<br />
<br />
{{FIXME|reason=Describe the connector here - is it a standard part? add an image, add the pinout graphics (didn't copy from elsewhere because clearly microsoft copyright)}}<br />
<br />
=== Pinout ===<br />
The following table gives the pinout in the way it is arranged on the '''XBOX AVIP''' cables, or '''AV Packs'''. The other end is reversed and on the console.<br />
<br />
{| class="wikitable"<br />
!Description<br />
|Audio Right <br />
|Audio Right GND <br />
|SPDIF Digital Audio <br />
|V-Sync (VGA Mode) <br />
|Mode GND <br />
|Mode GND <br />
|Mode GND <br />
|GND<br />
|Variable<br />
|9 GND<br />
|Variable<br />
|11 GND<br />
|-<br />
!Pin<br />
!1<br />
!2<br />
!3<br />
!4<br />
!5<br />
!6<br />
!7<br />
!8<br />
!9<br />
!10<br />
!11<br />
!12<br />
|-<br />
!Pin<br />
!13<br />
!14<br />
!15<br />
!16<br />
!17<br />
!18<br />
!19<br />
!20<br />
!21<br />
!22<br />
!23<br />
!24<br />
|-<br />
!Description<br />
|Vcc<br />
|Audio Left<br />
|Audio Left GND<br />
|H Sync (VGA Mode)<br />
|Mode Select 1<br />
|Mode Select 2<br />
|Mode Select 3<br />
|(+12V)<br />
|22 GND<br />
|Variable<br />
|24 GND<br />
|Variable<br />
|}<br />
<br />
== Supported signals / AV cables ==<br />
<br />
Below is a table which lists all known officially '''AV cables''' released by Microsoft and their respective signal.<br />
The constants used in the av-prefixed Kernel-functions are also listed.<br />
<br />
{| class="wikitable"<br />
! Pin 19 || Pin 18 || Pin 17 || SMC Constant || Region || Official Microsoft product name<br />
! Signal || Pin 24 || Pin 22 || Pin 11 || Pin 9 || Kernel av-Constant<br />
|-<br />
| 0 || 0 || 0 || 0 || PAL || [https://web.archive.org/web/20040216131316/http://www.xbox.com:80/en-gb/hardware/scartcable.htm Advanced SCART Cable]<br />
| SCART (15 kHz RGB) Stereo || V || R || G || B || AV_PACK_SCART = 3<br />
|-<br />
| 0 || 0 || 1 || 1 || NTSC || [https://web.archive.org/web/20040210040422/http://www.xbox.com:80/en-US/hardware/highdefinitionavpack.htm High Definition AV Pack]<br />
| Component SPDIF || - || Pr || Y || Pb || AV_PACK_HDTV = 4<br />
|-<br />
| 0 || 1 || 0 || 2 || - || ''Not officially available / supported''<br />
| VGA (31 kHz RGB) Stereo || - || R || G || B || AV_PACK_VGA = 5<br />
|-<br />
| 0 || 1 || 1 || 3 || NTSC / PAL || [https://web.archive.org/web/20040319001330/http://www.xbox.com:80/en-us/hardware/rfadapter.htm RF Adapter]<br />
| RF Mono || V || C || Y || - || AV_PACK_RFU = 2<br />
|-<br />
| 1 || 0 || 0 || 4 || NTSC || [https://web.archive.org/web/20040319001247/http://www.xbox.com:80/en-us/hardware/advancedavpack.htm Advanced AV Pack]<br />
| S-Video Stereo || V || C || Y || - || AV_PACK_SVIDEO = 6<br />
|-<br />
| 1 || 0 || 1 || 5 || - || ''Not officially available / supported''<br />
| Unknown Mono || V || C || Y || - || AV_PACK_NONE = 0<br />
|-<br />
| 1 || 1 || 0 || 6 || NTSC / PAL || [https://web.archive.org/web/20040216130745/http://www.xbox.com:80/en-gb/hardware/avcable.htm Standard AV Cable]<br />
| Composite Stereo || V || C || Y || - || AV_PACK_STANDARD = 1<br />
|-<br />
| 1 || 1 || 1 || 7 || - || ''No cable connected''<br />
| - || - || - || - || - || AV_PACK_NONE = 0<br />
|}<br />
<br />
A signal value of 0 means connection to ground (Pins 7, 6, 5), whereas a value of 1 means an open-connection{{citation needed|reason=Are these still connected to Vcc maybe?}}<br />
<br />
The region only identifies which territory the cable was originally available / intended for. The kernel still might support other video-standards (NTSC / PAL / SECAM) using the same cable.<br />
<br />
{{FIXME|reason=Add a list of AV cables with pictures and their supported video modes using the official kernel}}<br />
<br />
== Related links ==<br />
<br />
* [http://www.gamesx.com/avpinouts/xbox.htm GamesX List of signals and pinout]<br />
* [https://assemblergames.com/attachments/xboxavippinouttr0-png.13081/ ASSEMBLERgames XBOX AV pinout] [https://web.archive.org/web/20190404080051/https://assemblergames.com/attachments/xboxavippinouttr0-png.13081/ Archived image on the Wayback Machine]<br />
* [http://ucon64.sourceforge.net/ucon64misc/conn.html uCON64 Connectors]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=AV_Cables&diff=7363AV Cables2024-03-04T06:04:06Z<p>KaosEngineer: assemblergames.com no longer exists. Added link to the image archived on the Wayback Machine - web.archive.org in Related links.</p>
<hr />
<div>Microsoft has released a handful of '''Audio Video Cables''' for the [[Xbox]], which they refer to internally as '''AV Packs'''. They are connected to the port labelled "Audio Video Input/Output" on the backside of the console.<br />
<br />
== Connector ==<br />
<br />
{{FIXME|reason=Describe the connector here - is it a standard part? add an image, add the pinout graphics (didn't copy from elsewhere because clearly microsoft copyright)}}<br />
<br />
=== Pinout ===<br />
The following table gives the pinout in the way it is arranged on the '''XBOX AVIP''' cables, or '''AV Packs'''. The other end is reversed and on the console.<br />
<br />
{| class="wikitable"<br />
!Description<br />
|Audio Right <br />
|Audio Right GND <br />
|SPDIF Digital Audio <br />
|V-Sync (VGA Mode) <br />
|Mode GND <br />
|Mode GND <br />
|Mode GND <br />
|GND<br />
|Variable<br />
|9 GND<br />
|Variable<br />
|11 GND<br />
|-<br />
!Pin<br />
!1<br />
!2<br />
!3<br />
!4<br />
!5<br />
!6<br />
!7<br />
!8<br />
!9<br />
!10<br />
!11<br />
!12<br />
|-<br />
!Pin<br />
!13<br />
!14<br />
!15<br />
!16<br />
!17<br />
!18<br />
!19<br />
!20<br />
!21<br />
!22<br />
!23<br />
!24<br />
|-<br />
!Description<br />
|Vcc<br />
|Audio Left<br />
|Audio Left GND<br />
|H Sync (VGA Mode)<br />
|Mode Select 1<br />
|Mode Select 2<br />
|Mode Select 3<br />
|(+12V)<br />
|22 GND<br />
|Variable<br />
|24 GND<br />
|Variable<br />
|}<br />
<br />
== Supported signals / AV cables ==<br />
<br />
Below is a table which lists all known officially '''AV cables''' released by Microsoft and their respective signal.<br />
The constants used in the av-prefixed Kernel-functions are also listed.<br />
<br />
{| class="wikitable"<br />
! Pin 19 || Pin 18 || Pin 17 || SMC Constant || Region || Official Microsoft product name<br />
! Signal || Pin 24 || Pin 22 || Pin 11 || Pin 9 || Kernel av-Constant<br />
|-<br />
| 0 || 0 || 0 || 0 || PAL || [https://web.archive.org/web/20040216131316/http://www.xbox.com:80/en-gb/hardware/scartcable.htm Advanced SCART Cable]<br />
| SCART (15 kHz RGB) Stereo || V || R || G || B || AV_PACK_SCART = 3<br />
|-<br />
| 0 || 0 || 1 || 1 || NTSC || [https://web.archive.org/web/20040210040422/http://www.xbox.com:80/en-US/hardware/highdefinitionavpack.htm High Definition AV Pack]<br />
| Component SPDIF || - || Pr || Y || Pb || AV_PACK_HDTV = 4<br />
|-<br />
| 0 || 1 || 0 || 2 || - || ''Not officially available / supported''<br />
| VGA (31 kHz RGB) Stereo || - || R || G || B || AV_PACK_VGA = 5<br />
|-<br />
| 0 || 1 || 1 || 3 || NTSC / PAL || [https://web.archive.org/web/20040319001330/http://www.xbox.com:80/en-us/hardware/rfadapter.htm RF Adapter]<br />
| RF Mono || V || C || Y || - || AV_PACK_RFU = 2<br />
|-<br />
| 1 || 0 || 0 || 4 || NTSC || [https://web.archive.org/web/20040319001247/http://www.xbox.com:80/en-us/hardware/advancedavpack.htm Advanced AV Pack]<br />
| S-Video Stereo || V || C || Y || - || AV_PACK_SVIDEO = 6<br />
|-<br />
| 1 || 0 || 1 || 5 || - || ''Not officially available / supported''<br />
| Unknown Mono || V || C || Y || - || AV_PACK_NONE = 0<br />
|-<br />
| 1 || 1 || 0 || 6 || NTSC / PAL || [https://web.archive.org/web/20040216130745/http://www.xbox.com:80/en-gb/hardware/avcable.htm Standard AV Cable]<br />
| Composite Stereo || V || C || Y || - || AV_PACK_STANDARD = 1<br />
|-<br />
| 1 || 1 || 1 || 7 || - || ''No cable connected''<br />
| - || - || - || - || - || AV_PACK_NONE = 0<br />
|}<br />
<br />
A signal value of 0 means connection to ground (Pins 7, 6, 5), whereas a value of 1 means an open-connection{{citation needed|reason=Are these still connected to Vcc maybe?}}<br />
<br />
The region only identifies which territory the cable was originally available / intended for. The kernel still might support other video-standards (NTSC / PAL / SECAM) using the same cable.<br />
<br />
{{FIXME|reason=Add a list of AV cables with pictures and their supported video modes using the official kernel}}<br />
<br />
== Related links ==<br />
<br />
* [http://www.gamesx.com/avpinouts/xbox.htm GamesX List of signals and pinout]<br />
* [https://assemblergames.com/attachments/xboxavippinouttr0-png.13081/ ASSEMBLERgames XBOX AV pinout] [https://web.archive.org/web/20190404080051/https://assemblergames.com/attachments/xboxavippinouttr0-png.13081/ Archived at Wayback Machine]<br />
* [http://ucon64.sourceforge.net/ucon64misc/conn.html uCON64 Connectors]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=AV_Cables&diff=7362AV Cables2024-03-04T05:59:12Z<p>KaosEngineer: Standard Definition is both NTSC and PAL, not just PAL region</p>
<hr />
<div>Microsoft has released a handful of '''Audio Video Cables''' for the [[Xbox]], which they refer to internally as '''AV Packs'''. They are connected to the port labelled "Audio Video Input/Output" on the backside of the console.<br />
<br />
== Connector ==<br />
<br />
{{FIXME|reason=Describe the connector here - is it a standard part? add an image, add the pinout graphics (didn't copy from elsewhere because clearly microsoft copyright)}}<br />
<br />
=== Pinout ===<br />
The following table gives the pinout in the way it is arranged on the '''XBOX AVIP''' cables, or '''AV Packs'''. The other end is reversed and on the console.<br />
<br />
{| class="wikitable"<br />
!Description<br />
|Audio Right <br />
|Audio Right GND <br />
|SPDIF Digital Audio <br />
|V-Sync (VGA Mode) <br />
|Mode GND <br />
|Mode GND <br />
|Mode GND <br />
|GND<br />
|Variable<br />
|9 GND<br />
|Variable<br />
|11 GND<br />
|-<br />
!Pin<br />
!1<br />
!2<br />
!3<br />
!4<br />
!5<br />
!6<br />
!7<br />
!8<br />
!9<br />
!10<br />
!11<br />
!12<br />
|-<br />
!Pin<br />
!13<br />
!14<br />
!15<br />
!16<br />
!17<br />
!18<br />
!19<br />
!20<br />
!21<br />
!22<br />
!23<br />
!24<br />
|-<br />
!Description<br />
|Vcc<br />
|Audio Left<br />
|Audio Left GND<br />
|H Sync (VGA Mode)<br />
|Mode Select 1<br />
|Mode Select 2<br />
|Mode Select 3<br />
|(+12V)<br />
|22 GND<br />
|Variable<br />
|24 GND<br />
|Variable<br />
|}<br />
<br />
== Supported signals / AV cables ==<br />
<br />
Below is a table which lists all known officially '''AV cables''' released by Microsoft and their respective signal.<br />
The constants used in the av-prefixed Kernel-functions are also listed.<br />
<br />
{| class="wikitable"<br />
! Pin 19 || Pin 18 || Pin 17 || SMC Constant || Region || Official Microsoft product name<br />
! Signal || Pin 24 || Pin 22 || Pin 11 || Pin 9 || Kernel av-Constant<br />
|-<br />
| 0 || 0 || 0 || 0 || PAL || [https://web.archive.org/web/20040216131316/http://www.xbox.com:80/en-gb/hardware/scartcable.htm Advanced SCART Cable]<br />
| SCART (15 kHz RGB) Stereo || V || R || G || B || AV_PACK_SCART = 3<br />
|-<br />
| 0 || 0 || 1 || 1 || NTSC || [https://web.archive.org/web/20040210040422/http://www.xbox.com:80/en-US/hardware/highdefinitionavpack.htm High Definition AV Pack]<br />
| Component SPDIF || - || Pr || Y || Pb || AV_PACK_HDTV = 4<br />
|-<br />
| 0 || 1 || 0 || 2 || - || ''Not officially available / supported''<br />
| VGA (31 kHz RGB) Stereo || - || R || G || B || AV_PACK_VGA = 5<br />
|-<br />
| 0 || 1 || 1 || 3 || NTSC / PAL || [https://web.archive.org/web/20040319001330/http://www.xbox.com:80/en-us/hardware/rfadapter.htm RF Adapter]<br />
| RF Mono || V || C || Y || - || AV_PACK_RFU = 2<br />
|-<br />
| 1 || 0 || 0 || 4 || NTSC || [https://web.archive.org/web/20040319001247/http://www.xbox.com:80/en-us/hardware/advancedavpack.htm Advanced AV Pack]<br />
| S-Video Stereo || V || C || Y || - || AV_PACK_SVIDEO = 6<br />
|-<br />
| 1 || 0 || 1 || 5 || - || ''Not officially available / supported''<br />
| Unknown Mono || V || C || Y || - || AV_PACK_NONE = 0<br />
|-<br />
| 1 || 1 || 0 || 6 || NTSC / PAL || [https://web.archive.org/web/20040216130745/http://www.xbox.com:80/en-gb/hardware/avcable.htm Standard AV Cable]<br />
| Composite Stereo || V || C || Y || - || AV_PACK_STANDARD = 1<br />
|-<br />
| 1 || 1 || 1 || 7 || - || ''No cable connected''<br />
| - || - || - || - || - || AV_PACK_NONE = 0<br />
|}<br />
<br />
A signal value of 0 means connection to ground (Pins 7, 6, 5), whereas a value of 1 means an open-connection{{citation needed|reason=Are these still connected to Vcc maybe?}}<br />
<br />
The region only identifies which territory the cable was originally available / intended for. The kernel still might support other video-standards (NTSC / PAL / SECAM) using the same cable.<br />
<br />
{{FIXME|reason=Add a list of AV cables with pictures and their supported video modes using the official kernel}}<br />
<br />
== Related links ==<br />
<br />
* [http://www.gamesx.com/avpinouts/xbox.htm GamesX List of signals and pinout]<br />
* [https://assemblergames.com/attachments/xboxavippinouttr0-png.13081/ ASSEMBLERgames XBOX AV pinout]<br />
* [http://ucon64.sourceforge.net/ucon64misc/conn.html uCON64 Connectors]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=NForce&diff=7291NForce2022-08-27T13:34:38Z<p>KaosEngineer: fixed typo under AMD Heritage section - bee -> been</p>
<hr />
<div>{{retrieved|http://www.xbox-linux.org/wiki/NForce}}<br />
<br />
<br />
This documents collects information about the Xbox chipset and its sibling, the nVidia nForce chipset, as well as further relatives.<br />
<br />
<br />
<br />
== nForce ==<br />
<br />
The nForce chipset consists of the IGP (Integrated Graphics Processor) Northbridge and the MCP (Media and Communications Processor) Southbridge. Both are available in different flavours:<br />
<br />
<br />
* IGP-64: 64 bit memory bus<br />
* IGP-128: 128 bit memory bus (TwinBank), requires two DIMM modules for 128 bit operation<br />
* MCP-D: includes Dolby Digital encoder<br />
* MCP: Dolby Digital encoder disabled<br />
<br />
So these are the four possible combinations:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| <br />
| MCP<br />
| MCP-D<br />
|-<br />
| IGP-64<br />
| nForce 220<br />
| nForce 220D<br />
|-<br />
| IGP-128<br />
| nForce 420<br />
| nForce 420D<br />
|}<br />
[https://web.archive.org/web/20100617023830/http://www.theregister.co.uk/2001/05/31/nvidia_crush_chipset_named_nforce/]<br />
[https://web.archive.org/web/20100617023830/http://www.theregister.co.uk/2001/06/01/nvidia_crush_is_called_nforce/]<br />
<br />
The VGA controller inside the IGP is a "GeForce2 MX Integrated Graphics" (PCI ID:10de/01a0). Its internal name is NV1A.<br />
<br />
[https://web.archive.org/web/20100617023830/http://pciids.sourceforge.net/iii/?i=10de]<br />
[https://web.archive.org/web/20100617023830/http://www.nvitalia.com/articoli/editoriali/produzione_nvidia_2001.htm]<br />
<br />
Although IGP-64 and IGP-128 are different and their respective chipsets have different codenames (Crush11 and Crush12, see below), there seems to be no difference from the software side:<br />
<br />
<br />
* The VGA BIOS of the MS-6367 mainboard (nForce 420D configuration, i.e. Crush12) has the internal name "CR11BT.ROM". It also includes the strings "NVIDIA GeForce2 Integrated GPU", "CR11 Board" and "Chip Rev B2".<br />
* The PCI IDs seem to be the same for the GPUs inside IGP-64 and IGP-128.<br />
<br />
== Crush ==<br />
<br />
"Crush" was the codename of the nForce chipset. Crush11 is the nForce 220/220D/230/230-T, Crush12 is the nForce 420/420D/430/430-T, and Crush18 is the nForce2. The "11" probably derives from "NV11", the internal name of the GeForce2 MX.<br />
<br />
[https://web.archive.org/web/20100617023830/http://users.erols.com/chare/chipsets.htm]<br />
[https://web.archive.org/web/20100617023830/http://www.theregister.co.uk/2000/11/17/nvidias_super_secret_crush_spec/]<br />
<br />
<br />
== nForce &amp; Xbox ==<br />
<br />
The Xbox has an IGP-128 that uses an NV2A video core (PCI ID:10de/02a5), which is between the GeForce3 (NV20) and the GeForce4 (NV25). The Southbridge is called "MCP-X" and lacks the PCI card bus (PCI bus #1).<br />
<br />
[https://web.archive.org/web/20100617023830/http://www.digit-life.com/articles/nvidianforce/]<br />
[https://web.archive.org/web/20100617023830/http://www.anandtech.com/showdoc.html?i=1484]<br />
[https://web.archive.org/web/20100617023830/http://www.anandtech.com/cpuchipsets/showdoc.aspx?i=1535]<br />
[https://web.archive.org/web/20100617023830/http://www.anandtech.com/systems/showdoc.aspx?i=1561&amp;p=3]<br />
<br />
<br />
== AMD Heritage ==<br />
<br />
There is the following rumour, which is not fully verified yet:<br />
<br />
<br />
* Microsoft wanted AMD to make the CPU and the chipset for the Xbox, and nVidia to make the video hardware.<br />
* When alpha hardware had already been built, Intel made a better deal<br />
* Microsoft agreed to have Intel CPUs; Intel had to modify AMD's chipset to support an Intel CPU<br />
* Intel insisted that the brand name AMD could not be associated with the Xbox, so nVidia licensed the AMD chipset. Now the Xbox chipset was by nVidia.<br />
* nVidia sold the same chipset for PCs, calling it "nForce".<br />
<br />
This is the reason why<br />
<br />
<br />
* the Xbox is the only nForce chipset with an Intel CPU<br />
* the AMD chipset and the nForce chipset are so similar<br />
<br />
Evidence:<br />
<br />
<br />
* The AMD and nForce AMD IDE controllers are fully compatible. (Linux kernel: "AMD 755/756/766/8111 and nVidia nForce/2/2s/3/3s/CK804/MCP04 IDE driver for Linux." [https://web.archive.org/web/20100617023830/http://lxr.linux.no/source/drivers/ide/pci/amd74xx.c])<br />
* The I2C/SMBus controller on the nForce is fully AMD-756/766/68 compatible. [https://web.archive.org/web/20100617023830/http://lxr.linux.no/source/drivers/i2c/busses/i2c-amd756.c]<br />
* The audio controller is i810 compatible - as is the audio controller of the AMD-768 and the AMD-8111.<br />
* The nForce and AMD-768 modems are compatible.<br />
* At least one register ("VGA_en") in the nForce PCI-to-AGP bridge is compatible with the AMD chipset (AMD-761, 24081.pdf, page 136).<br />
* The nForce uses HyperTransport.<br />
* [https://web.archive.org/web/20100617023830/http://www.uwsg.iu.edu/hypermail/linux/kernel/0307.3/0922.html], [https://web.archive.org/web/20100617023830/http://www.uwsg.iu.edu/hypermail/linux/kernel/0301.3/0305.html]<br />
* ''"One man's guess, the silicon is not a major factor. Because the nForce and 760 MP have a similar pin count, they are going to be cost comparable."'' [https://web.archive.org/web/20100617023830/http://overclockers.com/articles446/]<br />
<br />
{| class="wikitable"<br />
|-<br />
| <br />
| Northbridge<br />
| Southbridge<br />
|-<br />
| AMD-760<br />
| AMD-761<br />
| AMD-766<br />
|-<br />
| AMD-760MP<br />
| AMD-762<br />
| AMD-766<br />
|-<br />
| AMD-760MPX<br />
| AMD-762<br />
| AMD-768<br />
|}<br />
[https://web.archive.org/web/20100617023830/http://www.amd.com/us-en/Processors/TechnicalResources/0,,30_182_873_1133,00.html AMD-760™ Chipset Tech Docs]<br />
[https://web.archive.org/web/20100617023830/http://www.amd.com/us-en/Processors/TechnicalResources/0,,30_182_739_1130,00.html AMD-760™ MP Chipset Tech Docs]<br />
[https://web.archive.org/web/20100617023830/http://www.amd.com/us-en/Processors/TechnicalResources/0,,30_182_873_4296,00.html AMD-760™ MPX Chipset Tech Docs]<br />
<br /><br />
The nForce chipset might be based on the AMD-760 chipset.<br />
<br />
== More Links ==<br />
<br />
[https://web.archive.org/web/20100617023830/http://www.duxcw.com/digest/guides/mb_chip/nforce/print.htm]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Xbox_Linux_Issues&diff=7162Xbox Linux Issues2022-07-03T04:02:44Z<p>KaosEngineer: link to MBR layout information was not working, extraneous | character removed</p>
<hr />
<div>Here is a list of issues that are blocking general functionality on [[Linux|Xbox Linux]].<br />
<br />
==Native Boot Partition Filesystem Compatibility with Cromwell==<br />
When booting a "native" install, Cromwell scans the MBR and looks for partitions that are flagged as bootable. If the partition is bootable, Cromwell attempts to determine the filesystem, and load linuxboot.cfg. If the user launches that instance, the kernel and the initrd will then be loaded from that partition. (The presence of initrd and kernel is not checked until launching)<br />
<br />
When setting up a native install, a boot partition formatted with ext2 worked fine as formatted by historical X-DSL. The linuxboot.cfg was detected, and Cromwell presented a hard drive icon to load the native install.<br />
<br />
When formatting the same partition using a modern distro, Cromwell does not detect the linuxboot.cfg, but it does detect the ext2 filesystem and attempts to read it without errors. (This has been tested by formatting on Gentoo, Debian, and from a Gentoo liveCD on the Xbox.)<br />
<br />
Something about the way these ext2 partitions are being formatted by modern tools is preventing the Xbox from reading files on them. Turning off the new ext2 features using mkfs.ext2 /dev/sdb1 -O ^resize_inode,^dir_index,^large_file,^ext_attr did not make a difference.<br />
<br />
Formatting this partition from modern Linux with vfat and no options also did not work.<br />
<br />
Formatting as Fat32 in Windows with EaseUs Partition Master did work.<br />
<br />
Note that Cromwell is able to read the root partition and get linuxboot.cfg from there even for larger root partitions (tested up to 80GB); a reserved boot partition is not strictly needed, but Cromwell still needs to be able to load the kernel and initrd.<br />
<br />
So the main question here is, what kind of partitions does Cromwell support? How can at least one kind of these partitions be reliably formatted using a terminal command in Linux?<br />
<br />
Or, can Cromwell be easily updated to support new filesystem developments? Since a boot partition is only needed for Cromwell to load the kernel and initrd, it would be acceptable for a more archaic filesystem configuration to be used as the boot partition, which would still give users the freedom to format the root partition with the kernel-supported filesystem of their choice (which is basically the point of a boot partition.) Ext2 is not necessarily the only option here either.<br />
<br />
==XBPartitioner Table and MBR Incompatibility==<br />
<br />
This issue is relevant to native Linux installs. In a native Linux install, the user formats empty regions of their hard drive and adds an MBR to the hard drive, which is used by Cromwell to access the Linux boot partition and subsequently load linuxboot.cfg, the kernel, and the initrd. The way that Cromwell is currently set up, it can't find Linux partitions without the MBR.<br />
<br />
The MBR partitioning/boot scheme uses a 512 byte record at the beginning of the drive. Since the actual boot data isn't needed on Xbox, the first 440 bytes are filled with zeroes when using fdisk, and can be considered unused here. [[http://www.sharetechnote.com/html/Linux_MBR.html MBR layout information]]<br />
<br />
The [[FATX]] filesystem has a config area of 1024 bytes starting at the beginning of the drive. Only 48 bytes are officially used; the rest are zeroes. On a stock-formatted Xbox hard drive, the contents of this config area don't seem to matter much to ind-BIOS (tested), although Insignia may use it in the future. If a stock FATX config area has its first 512 bytes overwritten by an MBR, it is not known to cause problems with any other Xbox functionality. (based on the fact that native Linux installs have been run in this way for years)<br />
<br />
The problem arises with the XBPartitioner table, a custom partitioning scheme for Xbox hard drives that was never officially supported by Xbox Linux. It is common on Xboxes with larger hard drives. The XBPartitioner table provides 14 partition "slots" for FATX partitions, and it allows users to format their Xbox hard drive with additional FATX partitions. The partition table is written into unused space in the FATX config area, immediately after the stock data. XBPartitioner wipes the remaining bytes of the config area when writing a partition table including any MBR contents; other tools are untested so far. And fdisk overwrites the first 512 bytes of the FATX config area with an MBR, replacing the first 440 bytes with zeroes. <br />
<br />
Another issue arises in that the two partitioning schemes overlap, even if only the necessary data were written for both XBPartitioner table and MBR; that is if they didn't write the zeroes.<br />
<br />
This struct shows the layout of the config area, followed by the partition entry struct. From the unofficial XBPartitioner patches for the old Xbox kernel:<br />
<br />
<syntaxhighlight lang="c"><br />
// Temporary struct used to load XBPartitioner data directly from disk.<br />
typedef struct {<br />
char magic[16];<br />
char reserved[32];<br />
XBPartitionerTableEntry partitions[FATX_XBPARTITIONER_PARTITIONS_MAX];<br />
} XBPartitionerTable;<br />
<br />
// Temporary struct used to load XBPartitioner data directly from disk.<br />
typedef struct<br />
{<br />
char name[16];<br />
u32 flags;<br />
u32 start;<br />
u32 size;<br />
u32 reserved;<br />
} XBPartitionerTableEntry;<br />
</syntaxhighlight><br />
<br />
The XBPartitioner table entries start at 48 bytes, and each partition's entry is 32 bytes in size. With 14 partitions, the XBPartitioner table ends at 496 bytes, and overwrites a good chunk of the relevant MBR content, which starts at 440 bytes. So tool modification alone can't make these schemes compatible.<br />
<br />
The XBPartitioner table has no metadata, only partition entries, and has no known way of redefining the number of available partitions. However, if the XBPartitioner table only had 12 partitions, the partition table would end at 432 bytes and the two schemes could coexist.<br />
<br />
===Possible Solutions===<br />
====F Takes All====<br />
This was the typical scheme used by historical Xbox Linux. The area after E would be used for Linux partitions. With larger hard drives available, there is a need for Xbox Linux to coexist with other content on the user's drive. This is okay when the user doesn't want to later modify the partition layout of their hard drive using XBPartitioner, and they want to reserve that hard drive primarily for Linux.<br />
<br />
====A 12 partition XBPartitioner Table====<br />
This would involve attempting to get general acceptance of changing the XBPartitioner spec to 12 partitions, so it doesn't overlap with MBR. Or providing a custom set of tools and bioses that support this.<br />
'''Pros'''<br />
* Cromwell would not need to be modified significantly<br />
* The 512 byte boundary could be considered the starting point for future config area modifications<br />
* Very few users have more than 7, much less 14 partitions on their Xbox which provide little practical use<br />
* Any Linux PC can easily mount the Linux partitions<br />
<br />
'''Cons'''<br />
* Lots of software would need to be updated, including BIOSes, partitioning tools, and disk formatting tools in Xbox Linux and on PC. There might be a more elegant solution.<br />
<br />
====Using the XBPartitioner Table To Define Linux Partitions====<br />
<br />
'''Pros'''<br />
* No partitioning scheme incompatiblity management<br />
* No dual partitioning scheme; both Linux and Xbox tools would have awareness of the full drive partition table, to avoid accidentally creating overlapping partitions<br />
* Unused per-partition flags in the XBPartitioner table could be used to mark partitions as Linux as a future standard<br />
* Scripts utilizing dd to read the XBPartitioner table could be used as a stopgap before full kernel support is developed<br />
<br />
'''Cons'''<br />
* The Cromwell Grub code would need to be modified to use the XBPartitioner table in place of MBR (this may not be overly complicated)<br />
* Scripts, tools, or kernel support will be needed in order to mount these partitions in Linux, both on the Xbox and on other PCs<br />
* Any tools used to mount Linux partitions and edit their characteristics would have to be updated to support it, primarily apps that mount non-FATX partitions. This could be simple<br />
* FATX kernel support would need to be ported for a long term performant solution. (fatxfs performance still needs to be evaluated on Xbox, as an alterative option)<br />
* The user is limited to 14 total partitions; with F and G they have 7 partitions which is enough for 3 Linux installs (3 boot partitions, 3 data partitions, and shared swap). It would be workable though for most use cases.<br />
<br />
====Using Contiguous Files Allocated on FATX as a Filesystem====<br />
This was proposed by mborgerson, as an option to avoid dealing with partition tables at all. Since coexistence of Linux filesystems with FATX is desired, and there are incompatibilities in the current partition table schemes, and correcting this would take a great deal of effort, it was suggested to contain the raw partition data on FATX partitions. A FATX Linux utility could scan a FATX partition for contiguous available space. It could then allocate several 4GB files (the FATX file size limit) across that range of space. Then, the entire range of sectors could be formatted a Linux partition or group of partitions by sector range, and a distribution installed there.<br />
<br />
'''Pros'''<br />
* This avoids modifying partition tables at all, so we don't have to worry about changing existing standards.<br />
* The tool fatxfs provides a starting point for interacting with the FATX filesystem without kernel FATX support. FATX partitions only need to be temporarily accessed as such, and once the contiguous files are created and their sector range is known, Linux can work with that area of the disk directly. After starting up and mounting any partitions, Linux does not strictly need any knowledge of FATX.<br />
* Contiguous files can be checked for contiguity before mounting to avoid overwriting other data<br />
* Users could reserve a FATX partition for Linux in XBPartitioner and then use Linux to fill it with contiguous files, the end result should be equivalent to formatting a partition and using MBR to access it, although the mounting process would differ.<br />
* Swap could be shared between Linux installs as long as some kind of common file/directory name or other method is used to detect shared swap on a FATX partition.<br />
* Users can place the kernel and intitrd on FATX partitions and launch using existing Cromwell functionality for loading from FATX, so no boot partitions are needed here<br />
* This could also address the issue of [[Xbox Linux Issues#Lack of FATX Kernel Support|kernel support being needed to mount loop devices]]. But see the "cons" section about FTP-ing images to the hard drive<br />
<br />
'''Cons'''<br />
* A custom tool would be needed to access and mount these partitions, both on the Xbox and outside of it. This is still much simpler to address than the issues in the previous proposals.<br />
* The user's filesystem may be fragmented in about the same manner as a FAT filesystem. In order to create space for contiguous files, defragmentation may be needed, especially on partitions which have seen a lot of use and re-use.<br />
* If a user downloads these contiguous files and FTPs them to their Xbox, these files may become fragmented. (It is not fully understood in what situations the BIOS decides to fragment a file.) In order for FTP to work for sharing these files, a utility would have to be able to "defragment" an image and place the data in the right order on the hard drive, without gaps. This could take some time for larger images. One option would be to defragment the drive first and then have Linux handle the FTP part to make sure it gets transferred correctly.<br />
<br />
==Lack of FATX Kernel Support==<br />
<br />
Loop devices are a common method of packaging Xbox Linux installations, in order to avoid modifying the partition table on the Xbox hard drive. A loop device is a filesystem image that can be mounted from within another filesystem. When put on a FATX partition, they allow Xbox Linux to be run from the hard drive without modifying the user's partition table at all. These setups can be used to bundle Linux builds and other apps for easy distribution. (XMugen, for instance.)<br />
<br />
The current Xbox Linux patches don't port over the support for mounting the FATX filesystem in Linux. This is because the underlying code has changed significantly in a few places since then. [[User:VannevarKush]] is working on porting the old FATX code to the kernel for native support, but it is a work in progress.<br />
<br />
The lack of native FATX support means that mounting loop devices can't be done. Right now, native install and live CDs are the current available boot options for Xbox Linux.<br />
<br />
The FUSE based fatxfs [https://github.com/mborgerson/fatx code by mborgerson] may be usable as a stopgap, although its performance hasn't been evaluated yet on an Xbox.<br />
<br />
==Advanced Video Support==<br />
The Xbox Linux kernel currently only uses the most basic video support available (defined by CONFIG_FRAMEBUFFER_SIMPLE in the kernel config). More advanced support may be needed to run desktop environments and to run graphical applications with better performance. Does code need to be merged over from the original sources for xbox video?<br />
<br />
==See Also==<br />
*[[Xbox Linux Tips and Tricks]]<br />
*[[Xbox Linux]]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Soundtracks&diff=6972Soundtracks2021-11-03T03:08:29Z<p>KaosEngineer: /* Folder Structure */ soundtrack NNNN named subfolders are created in E:\TDATA\fffe0000\music\.</p>
<hr />
<div>The Xbox allows for soundstracks to be stored on the harddrive and played in-game. Music is copied from audio CDs using the dashboard and converted to WMA audio files. The notes gathered here are from decompiling StDB.dll from ''Xbox Soundtrack Manager''.<br />
<br />
== Folder Structure ==<br />
All soundtrack related data is stored in E:\TDATA\fffe0000\. Songs are organized into groups of folders containing up to 6 WMA files. Zero-padded 4 decimal integers are used for the folder names stored in a subfolder named music, and zero-padded 8 decimal integers are used for the WMA file names. Metadata such as song title and which soundtrack a song belongs to is stored in the ST.DB file<br />
<br />
== ST.DB ==<br />
The ST.DB file contains information about soundtracks loaded on the Xbox. Up to 100 soundtracks with 500 songs each can be used. Each header and struct described below is padded to 512 bytes, and all values are stored as little-endian.<br />
<br />
'''File Layout:'''<br />
<br />
<pre>(start of file)<br />
0000 Main Header<br />
0200 Soundtrack Struct 1<br />
0400 [Soundtrack Struct 2]<br />
... (Zero-filled)<br />
CA00 Song Group 1<br />
CC00 [Song Group 2]<br />
...<br />
(end of file)<br />
</pre><br />
=== Main Header ===<br />
{| class="wikitable"<br />
! Type<br />
! Description<br />
! Comment<br />
|-<br />
| int32<br />
| magic<br />
| always 0x00000001<br />
|-<br />
| int32<br />
| numSoundtracks<br />
|<br />
|-<br />
| int32<br />
| nextSoundtrackId<br />
|<br />
|-<br />
| int32<br />
| soundtrackIds[100]<br />
|<br />
|-<br />
| int32<br />
| nextSongId<br />
|<br />
|-<br />
| char<br />
| padding[96]<br />
|<br />
|}<br />
<br />
=== Soundtrack Struct ===<br />
{| class="wikitable"<br />
! Type<br />
! Description<br />
! Comment<br />
|-<br />
| int32<br />
| magic<br />
| always 0x00021371<br />
|-<br />
| int32<br />
| id<br />
|<br />
|-<br />
| uint32<br />
| numSongs<br />
|<br />
|-<br />
| int32<br />
| songGroupIds[84]<br />
|<br />
|-<br />
| int32<br />
| totalTimeMilliseconds<br />
|<br />
|-<br />
| wchar<br />
| name[64]<br />
| Unicode{{FIXME|reason=Encoding? UCS-2?}} string<br />
|-<br />
| char<br />
| padding[64]<br />
|<br />
|}<br />
<br />
=== Song Group Struct ===<br />
{| class="wikitable"<br />
! Type<br />
! Description<br />
! Comment<br />
|-<br />
| int32<br />
| magic<br />
| always 0x00031073<br />
|-<br />
| int32<br />
| soundtrackId<br />
|<br />
|-<br />
| int32<br />
| id<br />
|<br />
|-<br />
| int32<br />
| padding<br />
|<br />
|-<br />
| int32<br />
| songId[6]<br />
|<br />
|-<br />
| int32<br />
| songTimeMilliseconds[6]<br />
|<br />
|-<br />
| wchar<br />
| songName[192]<br />
| 6 Unicode{{FIXME|reason=Encoding? UCS-2?}} strings, each padded to 64 characters<br />
|-<br />
| char<br />
| padding[64]<br />
|<br />
|}<br />
<br />
== Default Encoding Settings ==<br />
These are the encoding settings used by the dashboard when encoding WMA files:<br />
<br />
{| class="wikitable"<br />
! Key<br />
! Value<br />
|-<br />
| Format<br />
| WMA Version 2<br />
|-<br />
| Codec Description<br />
| Windows Media Audio V8<br />
|-<br />
| Encoding Tool<br />
| Windows Media Encoding Utility 8.0.0.403<br />
|-<br />
| Bit Rate<br />
| 128 kbps<br />
|-<br />
| Channels<br />
| 2<br />
|-<br />
| Sampling Rate<br />
| 44.1 kHz<br />
|-<br />
| Bit Depth<br />
| 16 bit<br />
|}<br />
<br />
The track number is added to the metadata.</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Manufacturing_Process&diff=6971Manufacturing Process2021-10-23T02:13:48Z<p>KaosEngineer: Fixed link to show more than [1] but the article title.</p>
<hr />
<div>[[File:Manufacturing26.jpg|thumb|Sárvár, Hungary factory]]<br />
<br />
The Xbox was manufactured by Flextronics in four locations throughout its lifetime: Guadalajara, Mexico; Sárvár, Hungary; Doumen, China; and Taiwan{{FIXME|reason=City?}}.<br />
<br />
== Serial Number ==<br />
<br />
[[File:Serial-sticker.jpg|frame|An example of a serial number sticker]]<br />
<br />
Every Xbox has a sticker on the bottom with a manufacturing date and a 12-digit serial number. The serial number encodes information about where and when the hardware was manufactured.<br />
<br />
Using the pictured serial number as an example:<br />
<br />
{| class="wikitable" style="text-align:center"<br />
! Line !! Number !! Year !! Week !! Factory<br />
|-<br />
| 1 || 166356 || 2 || 09 || 03<br />
|}<br />
<br />
The first field is the factory production line number. The second field is the Xbox's number for the week (for the whole factory, not just the one line). The third field is the last digit of the year. The fourth field is the week of the year. Finally, the fifth field is the factory number. Mexico is 02, Hungary is 03, China is 05, and Taiwan is 06.<br />
<br />
So this Xbox was the 166,356<sup>th</sup> to be manufactured in week 9 of the year 2002 on production line 1 in Sárvár, Hungary.<br />
<br />
The bar code is the 12-digit serial number in standard [https://en.wikipedia.org/wiki/Code_39 Code 39] format.<br />
<br />
== Timeline ==<br />
<br />
{| class="wikitable"<br />
! scope="col" |<br />
! scope="col" | Mexico<br />
! scope="col" | Hungary<br />
! scope="col" | China<br />
|-<br />
! colspan=4 scope="col" | 2001<br />
|-<br />
! scope="row" | October<br />
| colspan=2 | Production of 110V 1.0 Xboxes with Thomson DVD drives begins for USA/Canada.<br />
| style="background:white" |<br />
|-<br />
! colspan=4 scope="col" | 2002<br />
|-<br />
! scope="row" | January<br />
| Production begins for Japan.<br />
| Production switches to 220V 1.0 models for Europe/Australia.<br />
| style="background:white" |<br />
|-<br />
! scope="row" | April<br />
| Production lines 1 and 6 are moved to China. 50% of new units now produced with Philips DVD drives.<br />
|<br />
| {{FIXME|reason=Which markets did China take up production for?}}<br />
|-<br />
! scope="row" | May<br />
|<br />
| Production stops after ~3 million units. All four production lines moved to China.<br />
|<br />
|-<br />
! scope="row" | August<br />
|<br />
| style="background:white" |<br />
| Production of the 220V 1.1 Xbox for Europe/Australia begins, with mostly Philips and sometimes Thomson DVD drives.<br />
|-<br />
! scope="row" | September<br />
| <br />
| style="background:white" |<br />
| Most units now use Samsung DVD drives.<br />
|-<br />
! scope="row" | October<br />
| Remaining four lines switched to version 1.1.<br />
| style="background:white" |<br />
|<br />
|-<br />
! scope="row" | November<br />
| <br />
| style="background:white" |<br />
| Production extended to 110V USA/Canada/Japan models.<br />
|-<br />
! scope="row" | December<br />
| Production ends after ~7 million units.<br />
| style="background:white" |<br />
| First line changes to version 1.2.<br />
|-<br />
! colspan=4 scope="col" | 2003<br />
|-<br />
! scope="row" | February<br />
| style="background:white" |<br />
| style="background:white" |<br />
| Last line changes to version 1.2.<br />
|-<br />
! scope="row" | March<br />
| style="background:white" |<br />
| style="background:white" |<br />
| First line changes to version 1.3.<br />
|-<br />
! scope="row" | April<br />
| style="background:white" |<br />
| style="background:white" |<br />
| Last line changes to version 1.3.<br />
|-<br />
! scope="row" | July<br />
| style="background:white" |<br />
| style="background:white" |<br />
| First line changes to version 1.4.<br />
|-<br />
! scope="row" | August<br />
| style="background:white" |<br />
| style="background:white" |<br />
| First line changes to version 1.5.<br />
|-<br />
! colspan=4 scope="col" | 2004 {{FIXME|reason=Need timeline for 1.6 models.}}<br />
|-<br />
! scope="row" | ?<br />
| style="background:white" |<br />
| style="background:white" |<br />
| ?<br />
|}<br />
<br />
== Hardware assembly ==<br />
<br />
The Xbox was manufactured just like many other mass-produced electronic products. Printed circuit boards were made in bulk and populated by pick-and-place machines, the plastic case was formed by injection molding, and finally all of the pieces were assembled by hand on production lines.<br />
<br />
The overall process didn't vary much between hardware revisions. The only notable change was related to the BIOS ROM. Up until version 1.6, the BIOS was flashed onto a TSOP ROM before being soldered to the motherboard. Revision 1.6 introduced the Xyclops chip, which integrated both the [[System Management Controller]] and the BIOS ROM on a single die. This meant the BIOS had to be flashed by the chip manufacturer instead of on the Xbox production line.<br />
<br />
<gallery><br />
File:Manufacturing19.jpg|Plastic case molding & assembly.<br />
File:Manufacturing18.jpg|Lids<br />
File:Manufacturing9.jpg|Green jewels<br />
File:Manufacturing10.jpg|Green jewels<br />
File:Manufacturing16.jpg|Jewels are dispensed from hoppers.<br />
File:Manufacturing7.jpg|Lid shield is positioned.<br />
File:Manufacturing3.jpg|Lid is placed over shield.<br />
File:Manufacturing5.jpg|Jewel is aligned...<br />
File:Manufacturing4.jpg|...and then applied.<br />
File:Manufacturing6.jpg|The tape is left on to prevent scratches.<br />
File:Manufacturing15.jpg|Shield and drive caddies are installed in the bottom half.<br />
File:Manufacturing20.jpg|Assembled cases are placed on pallets.<br />
File:Manufacturing11.jpg<br />
File:Manufacturing12.jpg<br />
File:Manufacturing13.jpg<br />
File:Manufacturing14.jpg|Cases ready for their electronics.<br />
File:Manufacturing25.jpg|Components arrive in bulk at the assembly line.<br />
File:Manufacturing26.jpg<br />
File:Manufacturing24.jpg|Technicians assemble components.<br />
File:Manufacturing23.jpg<br />
File:Manufacturing22.jpg<br />
File:Manufacturing27.jpg<br />
File:Manufacturing28.jpg<br />
File:Manufacturing21.jpg|Fully assembled consoles are placed on carts, ready for initialization.<br />
</gallery><br />
<br />
== Software initialization ==<br />
<br />
When a fully-assembled Xbox reached the end of the production line, it had a:<br />
<br />
* valid BIOS image<br />
* blank EEPROM<br />
* blank, unlocked hard disk<br />
<br />
To initialize the EEPROM and hard disk in the final stage of production, a technician would insert a DVD containing a setup program. The setup program, named default.xbe just like any other primary Xbox executable, was built by the XDK with the "allow eject" flag set and the region code set to 0x80000000 ("DEBUG").<br />
<br />
When the Xbox kernel initializes, it checksums the EEPROM. If it fails, the Xbox will be in DEBUG mode, i.e. the region code is set to 0x80000000. With the region code set to this value, the kernel ignores it if the hard disk is not locked. Because the region code matches, the kernel will run the executable from the DVD, which does the following:<br />
<br />
# Format the three swap partitions<br />
# Copy XMTAXBOX.XBE from the DVD to the first cache partition and run it <br />
<br />
Then the DVD can be ejected and put into the next Xbox.<br />
<br />
=== XMTAXBOX.XBE ===<br />
<br />
This XMTAXBOX.XBE is an XBE retail-signed for hard disk, also with the region code set to 0x80000000, that does the following:<br />
<br />
# Retrieve the EEPROM contents from a network server<br />
# Retrieve the contents of the system and data partitions from a network server<br />
# Lock the hard disk<br />
# Run some self tests and send a report to the server<br />
<br />
A new Xbox still contains the file XMTAXBOX.XBE on the first cache partition, as well as some temporary files on the third one.<br />
<br />
Xbox kernels since version 4034 have another backdoor that even works if the EEPROM check succeeds: If bit 30 of the media flag of an XBE is set, the condition of the hard disk is ignored as well. This change allows Microsoft to replace broken hard disks without replacing a valid EEPROM on an Xbox sent in for repair. Before this change, they had to rewrite the EEPROM whenever they replaced the drive.<br />
<br />
<gallery><br />
File:Manufacturing30.jpg|Consoles are initialized by setup program.<br />
File:Manufacturing33.jpg|Initialized consoles undergo final integration testing.<br />
File:Manufacturing34.jpg<br />
File:Manufacturing2.jpg<br />
</gallery><br />
<br />
== Packing and shipping ==<br />
<br />
<gallery><br />
File:Manufacturing17.jpg|Styrofoam inserts are prepared.<br />
File:Manufacturing31.jpg|Consoles are packed into boxes.<br />
File:Manufacturing32.jpg|Boxes are sealed...<br />
File:Manufacturing29.jpg|...and loaded on pallets, ready for shipping.<br />
</gallery><br />
<br />
== Videos ==<br />
<br />
* [https://www.youtube.com/watch?v=iWQb7LGH71s Xbox Factory Tour Video (Sárvár, Hungary; 2002)] - Demonstrates almost the entire assembly process from start to finish (not including case manufacturing).<br />
* [https://www.youtube.com/watch?v=_iR0eNuyUKI Flextronics Advertisement] - Contains still photos of the PCB manufacturing and testing processes.<br />
<br />
== Further Reading ==<br />
<br />
* [https://web.archive.org/web/20100617013616/http://www.ifm.eng.cam.ac.uk/ctm/idm/cases/xbox.html Case study - Microsoft Xbox], Innovation and Design Management, University of Cambridge<br />
* O'Brien, J. [https://web.archive.org/web/20100617013616/http://www.wired.com/wired/archive/9.11/flex_pr.html The making of the Xbox], Wired, Issue 9.11, November 2001<br />
* Shah, J. and Serant, C. [https://web.archive.org/web/20100617013616/http://www.ebnonline.com/story/OEG20020311S0076 Microsoft's Xbox sets supply chain standard], EBN Online, 11 March 2002<br />
* Olavsrud, T. [https://web.archive.org/web/20100617013616/http://www.internetnews.com/bus-news/article.php/1129171 Flextronics relocates Xbox manufacturing facility], Internetnews.com, 15 May 2002<br />
* Penz, B. [https://web.archive.org/web/20100617013616/http://www.amcham.hu/BusinessHungary/16-06/articles/16-06_27.asp Game Over? Xbox production heads east], Business Hungary, Vol 16 No 6, June 2002<br />
* Carbone, J. [https://web.archive.org/web/20100617013616/http://manufacturing.net/pur/article/CA237778?stt=001&pubdate=08%2F15%2F02 Outsourcing the Xbox], Purchasing Magazine Online, 15 August 2002<br />
* Neilley, R. [https://www.plasticstoday.com/molding-big-man-campus Molding is big man on this campus], PlasticsToday, 1 December 2001<br />
<br />
== Credits ==<br />
<br />
This article is adapted from [https://web.archive.org/web/20100617013616/http://www.xbox-linux.org/wiki/Xbox_Manufacturing_Process Xbox Manufacturing Process] by Michael Steil. Its content is reproduced here under the [https://www.gnu.org/licenses/old-licenses/fdl-1.2.en.html GNU Free Documentation License 1.2].<br />
<br />
Production line photos are from [https://web.archive.org/web/20100608022830/http://andy.saturn9.ws:80/Photo%20Albums/Xbox%20Manufacturing%20Facility/ Andy Rostad's gallery].</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Manufacturing_Process&diff=6970Manufacturing Process2021-10-23T02:10:16Z<p>KaosEngineer: Updated PlasticsToday URL to one that has the pictures and not 3 redirects on the Wayback Machine to access it.</p>
<hr />
<div>[[File:Manufacturing26.jpg|thumb|Sárvár, Hungary factory]]<br />
<br />
The Xbox was manufactured by Flextronics in four locations throughout its lifetime: Guadalajara, Mexico; Sárvár, Hungary; Doumen, China; and Taiwan{{FIXME|reason=City?}}.<br />
<br />
== Serial Number ==<br />
<br />
[[File:Serial-sticker.jpg|frame|An example of a serial number sticker]]<br />
<br />
Every Xbox has a sticker on the bottom with a manufacturing date and a 12-digit serial number. The serial number encodes information about where and when the hardware was manufactured.<br />
<br />
Using the pictured serial number as an example:<br />
<br />
{| class="wikitable" style="text-align:center"<br />
! Line !! Number !! Year !! Week !! Factory<br />
|-<br />
| 1 || 166356 || 2 || 09 || 03<br />
|}<br />
<br />
The first field is the factory production line number. The second field is the Xbox's number for the week (for the whole factory, not just the one line). The third field is the last digit of the year. The fourth field is the week of the year. Finally, the fifth field is the factory number. Mexico is 02, Hungary is 03, China is 05, and Taiwan is 06.<br />
<br />
So this Xbox was the 166,356<sup>th</sup> to be manufactured in week 9 of the year 2002 on production line 1 in Sárvár, Hungary.<br />
<br />
The bar code is the 12-digit serial number in standard [https://en.wikipedia.org/wiki/Code_39 Code 39] format.<br />
<br />
== Timeline ==<br />
<br />
{| class="wikitable"<br />
! scope="col" |<br />
! scope="col" | Mexico<br />
! scope="col" | Hungary<br />
! scope="col" | China<br />
|-<br />
! colspan=4 scope="col" | 2001<br />
|-<br />
! scope="row" | October<br />
| colspan=2 | Production of 110V 1.0 Xboxes with Thomson DVD drives begins for USA/Canada.<br />
| style="background:white" |<br />
|-<br />
! colspan=4 scope="col" | 2002<br />
|-<br />
! scope="row" | January<br />
| Production begins for Japan.<br />
| Production switches to 220V 1.0 models for Europe/Australia.<br />
| style="background:white" |<br />
|-<br />
! scope="row" | April<br />
| Production lines 1 and 6 are moved to China. 50% of new units now produced with Philips DVD drives.<br />
|<br />
| {{FIXME|reason=Which markets did China take up production for?}}<br />
|-<br />
! scope="row" | May<br />
|<br />
| Production stops after ~3 million units. All four production lines moved to China.<br />
|<br />
|-<br />
! scope="row" | August<br />
|<br />
| style="background:white" |<br />
| Production of the 220V 1.1 Xbox for Europe/Australia begins, with mostly Philips and sometimes Thomson DVD drives.<br />
|-<br />
! scope="row" | September<br />
| <br />
| style="background:white" |<br />
| Most units now use Samsung DVD drives.<br />
|-<br />
! scope="row" | October<br />
| Remaining four lines switched to version 1.1.<br />
| style="background:white" |<br />
|<br />
|-<br />
! scope="row" | November<br />
| <br />
| style="background:white" |<br />
| Production extended to 110V USA/Canada/Japan models.<br />
|-<br />
! scope="row" | December<br />
| Production ends after ~7 million units.<br />
| style="background:white" |<br />
| First line changes to version 1.2.<br />
|-<br />
! colspan=4 scope="col" | 2003<br />
|-<br />
! scope="row" | February<br />
| style="background:white" |<br />
| style="background:white" |<br />
| Last line changes to version 1.2.<br />
|-<br />
! scope="row" | March<br />
| style="background:white" |<br />
| style="background:white" |<br />
| First line changes to version 1.3.<br />
|-<br />
! scope="row" | April<br />
| style="background:white" |<br />
| style="background:white" |<br />
| Last line changes to version 1.3.<br />
|-<br />
! scope="row" | July<br />
| style="background:white" |<br />
| style="background:white" |<br />
| First line changes to version 1.4.<br />
|-<br />
! scope="row" | August<br />
| style="background:white" |<br />
| style="background:white" |<br />
| First line changes to version 1.5.<br />
|-<br />
! colspan=4 scope="col" | 2004 {{FIXME|reason=Need timeline for 1.6 models.}}<br />
|-<br />
! scope="row" | ?<br />
| style="background:white" |<br />
| style="background:white" |<br />
| ?<br />
|}<br />
<br />
== Hardware assembly ==<br />
<br />
The Xbox was manufactured just like many other mass-produced electronic products. Printed circuit boards were made in bulk and populated by pick-and-place machines, the plastic case was formed by injection molding, and finally all of the pieces were assembled by hand on production lines.<br />
<br />
The overall process didn't vary much between hardware revisions. The only notable change was related to the BIOS ROM. Up until version 1.6, the BIOS was flashed onto a TSOP ROM before being soldered to the motherboard. Revision 1.6 introduced the Xyclops chip, which integrated both the [[System Management Controller]] and the BIOS ROM on a single die. This meant the BIOS had to be flashed by the chip manufacturer instead of on the Xbox production line.<br />
<br />
<gallery><br />
File:Manufacturing19.jpg|Plastic case molding & assembly.<br />
File:Manufacturing18.jpg|Lids<br />
File:Manufacturing9.jpg|Green jewels<br />
File:Manufacturing10.jpg|Green jewels<br />
File:Manufacturing16.jpg|Jewels are dispensed from hoppers.<br />
File:Manufacturing7.jpg|Lid shield is positioned.<br />
File:Manufacturing3.jpg|Lid is placed over shield.<br />
File:Manufacturing5.jpg|Jewel is aligned...<br />
File:Manufacturing4.jpg|...and then applied.<br />
File:Manufacturing6.jpg|The tape is left on to prevent scratches.<br />
File:Manufacturing15.jpg|Shield and drive caddies are installed in the bottom half.<br />
File:Manufacturing20.jpg|Assembled cases are placed on pallets.<br />
File:Manufacturing11.jpg<br />
File:Manufacturing12.jpg<br />
File:Manufacturing13.jpg<br />
File:Manufacturing14.jpg|Cases ready for their electronics.<br />
File:Manufacturing25.jpg|Components arrive in bulk at the assembly line.<br />
File:Manufacturing26.jpg<br />
File:Manufacturing24.jpg|Technicians assemble components.<br />
File:Manufacturing23.jpg<br />
File:Manufacturing22.jpg<br />
File:Manufacturing27.jpg<br />
File:Manufacturing28.jpg<br />
File:Manufacturing21.jpg|Fully assembled consoles are placed on carts, ready for initialization.<br />
</gallery><br />
<br />
== Software initialization ==<br />
<br />
When a fully-assembled Xbox reached the end of the production line, it had a:<br />
<br />
* valid BIOS image<br />
* blank EEPROM<br />
* blank, unlocked hard disk<br />
<br />
To initialize the EEPROM and hard disk in the final stage of production, a technician would insert a DVD containing a setup program. The setup program, named default.xbe just like any other primary Xbox executable, was built by the XDK with the "allow eject" flag set and the region code set to 0x80000000 ("DEBUG").<br />
<br />
When the Xbox kernel initializes, it checksums the EEPROM. If it fails, the Xbox will be in DEBUG mode, i.e. the region code is set to 0x80000000. With the region code set to this value, the kernel ignores it if the hard disk is not locked. Because the region code matches, the kernel will run the executable from the DVD, which does the following:<br />
<br />
# Format the three swap partitions<br />
# Copy XMTAXBOX.XBE from the DVD to the first cache partition and run it <br />
<br />
Then the DVD can be ejected and put into the next Xbox.<br />
<br />
=== XMTAXBOX.XBE ===<br />
<br />
This XMTAXBOX.XBE is an XBE retail-signed for hard disk, also with the region code set to 0x80000000, that does the following:<br />
<br />
# Retrieve the EEPROM contents from a network server<br />
# Retrieve the contents of the system and data partitions from a network server<br />
# Lock the hard disk<br />
# Run some self tests and send a report to the server<br />
<br />
A new Xbox still contains the file XMTAXBOX.XBE on the first cache partition, as well as some temporary files on the third one.<br />
<br />
Xbox kernels since version 4034 have another backdoor that even works if the EEPROM check succeeds: If bit 30 of the media flag of an XBE is set, the condition of the hard disk is ignored as well. This change allows Microsoft to replace broken hard disks without replacing a valid EEPROM on an Xbox sent in for repair. Before this change, they had to rewrite the EEPROM whenever they replaced the drive.<br />
<br />
<gallery><br />
File:Manufacturing30.jpg|Consoles are initialized by setup program.<br />
File:Manufacturing33.jpg|Initialized consoles undergo final integration testing.<br />
File:Manufacturing34.jpg<br />
File:Manufacturing2.jpg<br />
</gallery><br />
<br />
== Packing and shipping ==<br />
<br />
<gallery><br />
File:Manufacturing17.jpg|Styrofoam inserts are prepared.<br />
File:Manufacturing31.jpg|Consoles are packed into boxes.<br />
File:Manufacturing32.jpg|Boxes are sealed...<br />
File:Manufacturing29.jpg|...and loaded on pallets, ready for shipping.<br />
</gallery><br />
<br />
== Videos ==<br />
<br />
* [https://www.youtube.com/watch?v=iWQb7LGH71s Xbox Factory Tour Video (Sárvár, Hungary; 2002)] - Demonstrates almost the entire assembly process from start to finish (not including case manufacturing).<br />
* [https://www.youtube.com/watch?v=_iR0eNuyUKI Flextronics Advertisement] - Contains still photos of the PCB manufacturing and testing processes.<br />
<br />
== Further Reading ==<br />
<br />
* [https://web.archive.org/web/20100617013616/http://www.ifm.eng.cam.ac.uk/ctm/idm/cases/xbox.html Case study - Microsoft Xbox], Innovation and Design Management, University of Cambridge<br />
* O'Brien, J. [https://web.archive.org/web/20100617013616/http://www.wired.com/wired/archive/9.11/flex_pr.html The making of the Xbox], Wired, Issue 9.11, November 2001<br />
* Shah, J. and Serant, C. [https://web.archive.org/web/20100617013616/http://www.ebnonline.com/story/OEG20020311S0076 Microsoft's Xbox sets supply chain standard], EBN Online, 11 March 2002<br />
* Olavsrud, T. [https://web.archive.org/web/20100617013616/http://www.internetnews.com/bus-news/article.php/1129171 Flextronics relocates Xbox manufacturing facility], Internetnews.com, 15 May 2002<br />
* Penz, B. [https://web.archive.org/web/20100617013616/http://www.amcham.hu/BusinessHungary/16-06/articles/16-06_27.asp Game Over? Xbox production heads east], Business Hungary, Vol 16 No 6, June 2002<br />
* Carbone, J. [https://web.archive.org/web/20100617013616/http://manufacturing.net/pur/article/CA237778?stt=001&pubdate=08%2F15%2F02 Outsourcing the Xbox], Purchasing Magazine Online, 15 August 2002<br />
* Neilley, R. [https://www.plasticstoday.com/molding-big-man-campus], PlasticsToday, 1 December 2001<br />
<br />
== Credits ==<br />
<br />
This article is adapted from [https://web.archive.org/web/20100617013616/http://www.xbox-linux.org/wiki/Xbox_Manufacturing_Process Xbox Manufacturing Process] by Michael Steil. Its content is reproduced here under the [https://www.gnu.org/licenses/old-licenses/fdl-1.2.en.html GNU Free Documentation License 1.2].<br />
<br />
Production line photos are from [https://web.archive.org/web/20100608022830/http://andy.saturn9.ws:80/Photo%20Albums/Xbox%20Manufacturing%20Facility/ Andy Rostad's gallery].</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Hardware_Revisions&diff=6882Hardware Revisions2020-09-17T05:14:58Z<p>KaosEngineer: /* PHILIPS VAD6035 */ 6035 not 6053, and fixed some typos.</p>
<hr />
<div>There were several different retail Xbox hardware revisions, which include the following:<br />
<br />
* Xbox 1.0<br />
** USB controller is on a separate [[Motherboard#USB_Daughterboard|PCB]]<br />
** GPU has a fan on the heat sink<br />
* Xbox 1.1<br />
** USB controller moved onto the motherboard<br />
** Fan removed from the GPU heat sink<br />
* Xbox 1.2<br />
** TSOP Size now 256k (Initial Size 1024k)<br />
** Updated Board Layout<br />
** Switched to ATX Power connector<br />
* Xbox 1.3<br />
** Removed LFrame signal from LPC Port<br />
* Xbox 1.4<br />
** Updated Board Layout<br />
** Switched to the "Focus" Video Encoder<br />
* Xbox 1.5 <br />
** 3.3v and GND removed from LPC<br />
* Xbox 1.6<br />
** New Board Layout with additional RAM Pads removed<br />
** Removed data and power lines from LPC port<br />
** Xyclops chip (includes ROM instead of flash = BIOS no longer flashable)<br />
** Switched to the "XCalibur" Video Encoder<br />
** Microsoft later switched to lower quality Hynix RAM. These Xboxes with non-Samsung RAM are sometimes referred to as 1.6b by the modding community.<br />
<br />
You can find more information about the hardware used in each revision below.<br />
<br />
== History of Xbox 1.5 ==<br />
<br />
There has been no conclusive evidence pointing to their existence, and all 1.5 sightings to date have turned out to be 1.4 boards.<br />
They possibly never existed{{citation needed}}, but will otherwise be very rare. Production was halted and 1.4 was produced again{{citation needed|reason=Sooo.. do these exist or not?!}}.<br />
<br />
== Identifying ==<br />
<br />
While not definitive, here are some ways to help identify the revision of your Xbox.<br />
<br />
=== Manufacturing Details ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Date Range<br />
! scope="col" | Revision<br />
! scope="col" | Location<br />
|-<br />
| 01/2001–07/2002 || 1.0 || Hungary, Mexico<br />
|-<br />
| 08/2002-01/2003 || 1.1 || China, Mexico<br />
|-<br />
| 01/2003-03/2003 || 1.2 || China<br />
|-<br />
| 04/2003-07/2003 || 1.3 || China<br />
|- <br />
| 09/2003-03/2004 || 1.4,1.5 || China<br />
|-<br />
| 04/2004-09/2004 || 1.6 || China, Taiwan<br />
|- <br />
| 09/2004-08/2005 || 1.6b || China, Taiwan<br />
|}<br />
<br />
=== Serial Number ===<br />
<br />
The serial number looks like this:<br />
<br />
LNNNNNN YWWFF<br />
<br />
* L is the production line<br />
* NNNNNN is the number produced that week<br />
* Y is the last digit of the production year<br />
* WW is the number of the week<br />
* FF is the factory code<br />
<br />
Note, this table contradicts the previous table.<br />
<br />
{| class="wikitable"<br />
! scope="col" | Factory<br />
! scope="col" | Location<br />
! scope="col" | Revision<br />
|-<br />
| 02 || Mexico || 1.0 or 1.1<br />
|-<br />
| 03 || Hungary || 1.0<br />
|-<br />
| 05 || China || 1.1 or later<br />
|-<br />
| 06 || Taiwan || 1.2 or later<br />
|}<br />
<br />
{| class="wikitable"<br />
! scope="col" | Serial Number<br />
! scope="col" | Revision<br />
|-<br />
| LNNNNNN 20WFF || 1.0<br />
|-<br />
| LNNNNNN 21WFF || 1.0<br />
|-<br />
| LNNNNNN 23WFF || 1.0 or 1.1<br />
|-<br />
| LNNNNNN 24WFF || 1.1<br />
|-<br />
| LNNNNNN 25WFF || 1.1<br />
|-<br />
| LNNNNNN 30WFF || 1.2<br />
|-<br />
| LNNNNNN 31WFF || 1.3<br />
|-<br />
| LNNNNNN 32WFF || 1.3<br />
|-<br />
| LNNNNNN 33WFF || 1.4 or 1.5<br />
|-<br />
| LNNNNNN 42WFF || 1.6<br />
|-<br />
| LNNNNNN 43WFF || 1.6b<br />
|}<br />
<br />
=== DVD Drive ===<br />
<br />
There are four retail drives known to be used by Microsoft in the retail version of the console.<br />
Any Xbox DVD drive can be used in any retail Xbox.<br />
<br />
List of Xbox DVD Drive manufacturers<br />
* Thomson (Xbox 1.0, 1.1)<br />
* Philips (Xbox 1.1 and above)<br />
* Samsung (Any)<br />
* Hitachi-LG (8050L)(mainly 1.6?)<br />
<br />
[[File:Xbox_drivedetermination.png|Xbox DVD Drive determination]]<br />
<br />
==== THOMSON TGM600 ====<br />
<br />
The first manufacture is sadly also the worst of all Dvdrom drives manufactured for the original xbox.<br />
It has a Cirrus Logic CL-CR3710-60EC-F as its main controller and a 8/3062 HD 64F3062F25 16bit H8/300H secondary samller MPU,at 25Mhz <br />
Unkown sofar if there is external flash or if its inside the Cirrus Logic IC.<br />
<br />
==== SAMSUNG SDG605 ====<br />
<br />
The Samsung drive is a very popular DVDrom drive for its compatibility for most media types and better quality laser. There are 2 mayor revisions found for this manufacturer<br />
* X00603-005 Plays CDR <br />
* X00603-006 Wont play CDR<br />
<br />
The DVDrom drive is using the MT1358E (MT1359E is the 360 Sata version) from Mediatek, and has a 39SF020A flashrom.<br />
If the firmware from this drive is applied to a SAMSUNG 616T or 616F PC dvd drive it will behave as a Xbox one, modified hardware will allow for tray state and eject to work.<br />
<br />
Commodore4Eva released a hacked firmware for this drive which enables modified backups to work. There is also a "0800" firmware for this drive which allows to dump the entire SS. The firmwares are not linked here for legal reasons.<br />
<br />
[https://web.archive.org/web/20060707104502/http://www.samsungodd.com:80/UploadFiles/FW/FWDOWNLOAD/ENG/200212101112342331_SD-616F_F105.ZIP Original firmware for the similar PC drive SD-616F (F105)].<br />
<br />
==== PHILIPS VAD6035/21 ====<br />
<br />
Also named: VAD6011/21 appears to have no brand or part number on its large main controller, might be Cirrus Logic based on its size and use of a Philips secondary smaller MCU. flash might be a 39SF020A from SST. The laser ribbon cable connector is different for its various revisions, a detail one must take into account when swapping controller boards.<br />
<br />
There should be a tutorial on how to convert a PC DVD-ROM drive Pioneer 500M with the Philips firmware to be an Xbox DVD-ROM drive.<br />
<br />
==== HITACHI-LG GDR-8050L ====<br />
<br />
This DVD-rom drive, most commonly found in Xbox 1.6 and 1.6b is capable of reading DVD-+R, DVD-RW and CDRW media, but fails to boot most CD-R discs source: [http://www.xbox-hq.com/html/article1535.html xbox-hq.com Hitachi-LG GDR-8050L DVD Drive In Xbox].<br />
<br />
The latest manufacture for the DVDrom drive probably used a Panasonic MN103S89FDA for its main controler, appears to have no external flashrom.<br />
with this firmware and modified hardware for Eject and traystate, a LG GDR-8163B or LG DRD-8160B might act as a drop in replacement after altering either case.<br />
<br />
On 30 January 2006 TheSpecialist posted at xboxhacker.net that he successfully flashed a Hitachi drive to boot a copied game on an unmodded xbox: [https://web.archive.org/web/20080316154615/http://www.xboxhacker.net/index.php?option=com_smf&Itemid=33&topic=285.0 breakthrough: XBOX 1 firmware hacked !]<br />
<br />
There is also [https://gist.github.com/JayFoxRox/2d51a8fabe0531897a4bf2903ee14335 an IDC Script and information about the firmware] which was recovered from xboxhacker.net / old forum posts.<br />
<br />
=== Hard Drive ===<br />
<br />
{| class="wikitable<br />
|-<br />
! Revision<br />
! Drive Manufacturer<br />
! Drive Model Number<br />
! Capacity<br />
|-<br />
| 1.0<br />
| Seagate<br />
| ST310211A<br />
| 10G<br />
|-<br />
| 1.0 (XB:2001-10-26 FF=02)<br />
| Western Digital<br />
| WD80EB-00CGH0<br />
| 8G<br />
|-<br />
| 1.1 (XB:2001-10-29 FF=03)<br />
| Western Digital<br />
| WD80EB-28CGH1<br />
| 8G<br />
|-<br />
| 1.2<br />
| Western Digital<br />
| WD80EB-28DFH2<br />
| 8G<br />
|-<br />
| 1.3+<br />
| Seagate<br />
| ST10014ACE<br />
| 10G<br />
|}<br />
<br />
=== Video encoder ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Video Chip<br />
! scope="col" | Revision<br />
|-<br />
| Conexant || 1.0, 1.1, 1.2, 1.3<br />
|-<br />
| Focus || 1.4, 1.5<br />
|-<br />
| Xcalibur || 1.6<br />
|}<br />
<br />
=== EEPROM ===<br />
<br />
{| class="wikitable"<br />
! Xbox Model<br />
! Manufacturer<br />
! Model<br />
|-<br />
| 1.4 (Others?)<br />
| Catalyst<br />
| CAT24WC02J<br />
|}<br />
<br />
=== MCPX Version ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | MCPX Version<br />
! scope="col" | Revision<br />
|-<br />
| 1.0 || 1.0<br />
|-<br />
| 1.1 || 1.1 - 1.6<br />
|}<br />
<br />
=== BIOS Version ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Kernel Version<br />
! scope="col" | Revision<br />
|-<br />
| 3944, 4034, 4036, 4627 || 1.0<br />
|-<br />
| 4817, 4972 || 1.1<br />
|-<br />
| 5101, 5713 || 1.2 - 1.5<br />
|-<br />
| 5838 || 1.6<br />
|}<br />
<br />
== References ==<br />
<br />
* [http://www.informit.com/articles/article.aspx?p=367210&seqNum=2 InformIT Methods of Identification]<br />
* [http://www.informit.com/articles/article.aspx?p=367210 InformIT Identifying your Xbox Revision]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Hardware_Revisions&diff=6881Hardware Revisions2020-09-17T05:12:16Z<p>KaosEngineer: /* PHILIPS VAD6053 */ Only 1 L in this brand name - Philips, not 2.</p>
<hr />
<div>There were several different retail Xbox hardware revisions, which include the following:<br />
<br />
* Xbox 1.0<br />
** USB controller is on a separate [[Motherboard#USB_Daughterboard|PCB]]<br />
** GPU has a fan on the heat sink<br />
* Xbox 1.1<br />
** USB controller moved onto the motherboard<br />
** Fan removed from the GPU heat sink<br />
* Xbox 1.2<br />
** TSOP Size now 256k (Initial Size 1024k)<br />
** Updated Board Layout<br />
** Switched to ATX Power connector<br />
* Xbox 1.3<br />
** Removed LFrame signal from LPC Port<br />
* Xbox 1.4<br />
** Updated Board Layout<br />
** Switched to the "Focus" Video Encoder<br />
* Xbox 1.5 <br />
** 3.3v and GND removed from LPC<br />
* Xbox 1.6<br />
** New Board Layout with additional RAM Pads removed<br />
** Removed data and power lines from LPC port<br />
** Xyclops chip (includes ROM instead of flash = BIOS no longer flashable)<br />
** Switched to the "XCalibur" Video Encoder<br />
** Microsoft later switched to lower quality Hynix RAM. These Xboxes with non-Samsung RAM are sometimes referred to as 1.6b by the modding community.<br />
<br />
You can find more information about the hardware used in each revision below.<br />
<br />
== History of Xbox 1.5 ==<br />
<br />
There has been no conclusive evidence pointing to their existence, and all 1.5 sightings to date have turned out to be 1.4 boards.<br />
They possibly never existed{{citation needed}}, but will otherwise be very rare. Production was halted and 1.4 was produced again{{citation needed|reason=Sooo.. do these exist or not?!}}.<br />
<br />
== Identifying ==<br />
<br />
While not definitive, here are some ways to help identify the revision of your Xbox.<br />
<br />
=== Manufacturing Details ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Date Range<br />
! scope="col" | Revision<br />
! scope="col" | Location<br />
|-<br />
| 01/2001–07/2002 || 1.0 || Hungary, Mexico<br />
|-<br />
| 08/2002-01/2003 || 1.1 || China, Mexico<br />
|-<br />
| 01/2003-03/2003 || 1.2 || China<br />
|-<br />
| 04/2003-07/2003 || 1.3 || China<br />
|- <br />
| 09/2003-03/2004 || 1.4,1.5 || China<br />
|-<br />
| 04/2004-09/2004 || 1.6 || China, Taiwan<br />
|- <br />
| 09/2004-08/2005 || 1.6b || China, Taiwan<br />
|}<br />
<br />
=== Serial Number ===<br />
<br />
The serial number looks like this:<br />
<br />
LNNNNNN YWWFF<br />
<br />
* L is the production line<br />
* NNNNNN is the number produced that week<br />
* Y is the last digit of the production year<br />
* WW is the number of the week<br />
* FF is the factory code<br />
<br />
Note, this table contradicts the previous table.<br />
<br />
{| class="wikitable"<br />
! scope="col" | Factory<br />
! scope="col" | Location<br />
! scope="col" | Revision<br />
|-<br />
| 02 || Mexico || 1.0 or 1.1<br />
|-<br />
| 03 || Hungary || 1.0<br />
|-<br />
| 05 || China || 1.1 or later<br />
|-<br />
| 06 || Taiwan || 1.2 or later<br />
|}<br />
<br />
{| class="wikitable"<br />
! scope="col" | Serial Number<br />
! scope="col" | Revision<br />
|-<br />
| LNNNNNN 20WFF || 1.0<br />
|-<br />
| LNNNNNN 21WFF || 1.0<br />
|-<br />
| LNNNNNN 23WFF || 1.0 or 1.1<br />
|-<br />
| LNNNNNN 24WFF || 1.1<br />
|-<br />
| LNNNNNN 25WFF || 1.1<br />
|-<br />
| LNNNNNN 30WFF || 1.2<br />
|-<br />
| LNNNNNN 31WFF || 1.3<br />
|-<br />
| LNNNNNN 32WFF || 1.3<br />
|-<br />
| LNNNNNN 33WFF || 1.4 or 1.5<br />
|-<br />
| LNNNNNN 42WFF || 1.6<br />
|-<br />
| LNNNNNN 43WFF || 1.6b<br />
|}<br />
<br />
=== DVD Drive ===<br />
<br />
There are four retail drives known to be used by Microsoft in the retail version of the console.<br />
Any Xbox DVD drive can be used in any retail Xbox.<br />
<br />
List of Xbox DVD Drive manufacturers<br />
* Thomson (Xbox 1.0, 1.1)<br />
* Philips (Xbox 1.1 and above)<br />
* Samsung (Any)<br />
* Hitachi-LG (8050L)(mainly 1.6?)<br />
<br />
[[File:Xbox_drivedetermination.png|Xbox DVD Drive determination]]<br />
<br />
==== THOMSON TGM600 ====<br />
<br />
The first manufacture is sadly also the worst of all Dvdrom drives manufactured for the original xbox.<br />
It has a Cirrus Logic CL-CR3710-60EC-F as its main controller and a 8/3062 HD 64F3062F25 16bit H8/300H secondary samller MPU,at 25Mhz <br />
Unkown sofar if there is external flash or if its inside the Cirrus Logic IC.<br />
<br />
==== SAMSUNG SDG605 ====<br />
<br />
The Samsung drive is a very popular DVDrom drive for its compatibility for most media types and better quality laser. There are 2 mayor revisions found for this manufacturer<br />
* X00603-005 Plays CDR <br />
* X00603-006 Wont play CDR<br />
<br />
The DVDrom drive is using the MT1358E (MT1359E is the 360 Sata version) from Mediatek, and has a 39SF020A flashrom.<br />
If the firmware from this drive is applied to a SAMSUNG 616T or 616F PC dvd drive it will behave as a Xbox one, modified hardware will allow for tray state and eject to work.<br />
<br />
Commodore4Eva released a hacked firmware for this drive which enables modified backups to work. There is also a "0800" firmware for this drive which allows to dump the entire SS. The firmwares are not linked here for legal reasons.<br />
<br />
[https://web.archive.org/web/20060707104502/http://www.samsungodd.com:80/UploadFiles/FW/FWDOWNLOAD/ENG/200212101112342331_SD-616F_F105.ZIP Original firmware for the similar PC drive SD-616F (F105)].<br />
<br />
==== PHILIPS VAD6053 ====<br />
<br />
Also named: VAD6011/21 apear to have no brand or partnumber on its large main controller,might be Cirrus Logic based on its size and use of a Philips secondary smaller mcu. flash might be a 39SF020A from SST. The laser ribbon cable connector is different for its various revisions, a detail one must take into account when swapping controller boards.<br />
<br />
There should be a tutorial on how to convert a PC dvdrom drive Pioneer 500M with the Philips firmware to be a Xbox dvdrom drive.<br />
<br />
==== HITACHI-LG GDR-8050L ====<br />
<br />
This DVD-rom drive, most commonly found in Xbox 1.6 and 1.6b is capable of reading DVD-+R, DVD-RW and CDRW media, but fails to boot most CD-R discs source: [http://www.xbox-hq.com/html/article1535.html xbox-hq.com Hitachi-LG GDR-8050L DVD Drive In Xbox].<br />
<br />
The latest manufacture for the DVDrom drive probably used a Panasonic MN103S89FDA for its main controler, appears to have no external flashrom.<br />
with this firmware and modified hardware for Eject and traystate, a LG GDR-8163B or LG DRD-8160B might act as a drop in replacement after altering either case.<br />
<br />
On 30 January 2006 TheSpecialist posted at xboxhacker.net that he successfully flashed a Hitachi drive to boot a copied game on an unmodded xbox: [https://web.archive.org/web/20080316154615/http://www.xboxhacker.net/index.php?option=com_smf&Itemid=33&topic=285.0 breakthrough: XBOX 1 firmware hacked !]<br />
<br />
There is also [https://gist.github.com/JayFoxRox/2d51a8fabe0531897a4bf2903ee14335 an IDC Script and information about the firmware] which was recovered from xboxhacker.net / old forum posts.<br />
<br />
=== Hard Drive ===<br />
<br />
{| class="wikitable<br />
|-<br />
! Revision<br />
! Drive Manufacturer<br />
! Drive Model Number<br />
! Capacity<br />
|-<br />
| 1.0<br />
| Seagate<br />
| ST310211A<br />
| 10G<br />
|-<br />
| 1.0 (XB:2001-10-26 FF=02)<br />
| Western Digital<br />
| WD80EB-00CGH0<br />
| 8G<br />
|-<br />
| 1.1 (XB:2001-10-29 FF=03)<br />
| Western Digital<br />
| WD80EB-28CGH1<br />
| 8G<br />
|-<br />
| 1.2<br />
| Western Digital<br />
| WD80EB-28DFH2<br />
| 8G<br />
|-<br />
| 1.3+<br />
| Seagate<br />
| ST10014ACE<br />
| 10G<br />
|}<br />
<br />
=== Video encoder ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Video Chip<br />
! scope="col" | Revision<br />
|-<br />
| Conexant || 1.0, 1.1, 1.2, 1.3<br />
|-<br />
| Focus || 1.4, 1.5<br />
|-<br />
| Xcalibur || 1.6<br />
|}<br />
<br />
=== EEPROM ===<br />
<br />
{| class="wikitable"<br />
! Xbox Model<br />
! Manufacturer<br />
! Model<br />
|-<br />
| 1.4 (Others?)<br />
| Catalyst<br />
| CAT24WC02J<br />
|}<br />
<br />
=== MCPX Version ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | MCPX Version<br />
! scope="col" | Revision<br />
|-<br />
| 1.0 || 1.0<br />
|-<br />
| 1.1 || 1.1 - 1.6<br />
|}<br />
<br />
=== BIOS Version ===<br />
<br />
{| class="wikitable"<br />
! scope="col" | Kernel Version<br />
! scope="col" | Revision<br />
|-<br />
| 3944, 4034, 4036, 4627 || 1.0<br />
|-<br />
| 4817, 4972 || 1.1<br />
|-<br />
| 5101, 5713 || 1.2 - 1.5<br />
|-<br />
| 5838 || 1.6<br />
|}<br />
<br />
== References ==<br />
<br />
* [http://www.informit.com/articles/article.aspx?p=367210&seqNum=2 InformIT Methods of Identification]<br />
* [http://www.informit.com/articles/article.aspx?p=367210 InformIT Identifying your Xbox Revision]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=EEPROM&diff=6877EEPROM2020-08-20T01:22:37Z<p>KaosEngineer: /* The HMAC SHA1 Hash */ It's not the HMAC HDD Key but the HMAC SHA1 Hash computed across the first 48 bytes which includes the RC4 encrypted HDD Key, etc.</p>
<hr />
<div>The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.<br />
Parts of the EEPROM are encrypted using [[Kernel/XboxEEPROMKey]].<br />
<br />
== Contents ==<br />
<br />
{| class="wikitable"<br />
! Start !! End !! Notes<br />
|-<br />
| 0x00<br />
| 0x13<br />
| HMAC_SHA1 Hash<br />
|-<br />
| 0x14<br />
| 0x1B<br />
| RC4 Encrypted Confounder ??<br />
|-<br />
| 0x1C<br />
| 0x2B<br />
| RC4 Encrypted HDD key<br />
|-<br />
| 0x2C<br />
| 0x2F<br />
| RC4 Encrypted Region code<br />
* 0x00000001 = North America<br />
* 0x00000002 = Japan<br />
* 0x00000004 = Europe & Australia<br />
* 0x80000000 = Manufacturing plant<br />
|-<br />
| 0x30<br />
| 0x33<br />
| Checksum2 - Checksum of next 44 (0x2C) bytes (0x34 - 0x5F)<sup>*</sup><br />
|-<br />
| 0x34<br />
| 0x3F<br />
| Xbox serial number - (ASCII chars 0x30 - 0x39 to match each digit in SN)<br />
|-<br />
| 0x40<br />
| 0x45<br />
| Ethernet MAC address (Microsoft Xbox - 00:50:F2:xx:xx:xx)<br />
This is the MAC address of the Ethernet hardware, which has been [https://web.archive.org/web/20100617020733/http://standards.ieee.org/regauth/oui/oui_public.txt issued by the IEEE].<br />
|-<br />
| 0x46<br />
| 0x47<br />
| Unknown Padding ?<br />
|-<br />
| 0x48<br />
| 0x57<br />
| Online Key ?<br />
|-<br />
| 0x58<br />
| 0x5B<br />
| Video Standard<br />
* 0x00000000 = not set (INVALID)<br />
* 0x00400100 = NTSC-M<br />
* 0x00400200 = NTSC-J<br />
* 0x00800300 = PAL-I<br />
* 0x00400400 = PAL-M<br />
|-<br />
| 0x5C<br />
| 0x5F<br />
| Unknown Padding ?<br />
|-<br />
| 0x60<br />
| 0x63<br />
| Checksum3 - Checksum of the next 92 (0x5C) bytes (0x64 - 0xBF)<sup>*</sup><br />
|-<br />
| 0x64<br />
| 0x67<br />
| Zone Bias - Offset in # minutes to subtract from GMT time <br />
(e.g., for GMT-06 Central; 6hr = 360min = 0x00000168)<br />
|-<br />
| 0x68<br />
| 0x6B<br />
| Standard Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CST\0, ACST)<br />
|-<br />
| 0x6C<br />
| 0x6F<br />
| Daylight Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CDT\0, ACDT)<br />
|-<br />
| 0x70<br />
| 0x77<br />
| Unknown Padding ?<br />
|-<br />
| 0x78<br />
| 0x7B<br />
| Standard Time Starts 10-05-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x7C<br />
| 0x7F<br />
| Daylight Savings Time Starts 04-01-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x80<br />
| 0x87<br />
| Unknown Padding ?<br />
|-<br />
| 0x88<br />
| 0x8B<br />
| Standard Timezone Bias; if not DST, 0 (0x00000000) minute time adjust<br />
|-<br />
| 0x8C<br />
| 0x8F<br />
| Daylight Savings Time Bias; if DST, -60 (0xFFFFFFC4) minute time adjust<br />
|-<br />
| 0x90<br />
| 0x93<br />
| Language ID (0 = not set)<br />
* 0x00000001 = English<br />
* 0x00000002 = Japanese<br />
* 0x00000003 = German<br />
* 0x00000004 = French<br />
* 0x00000005 = Spanish<br />
* 0x00000006 = Italian<br />
* 0x00000007 = Korean<br />
* 0x00000008 = Chinese<br />
* 0x00000009 = Portuguese<br />
|-<br />
| 0x94<br />
| 0x97<br />
| Video Settings<br />
* 0x00080000 = 480p<br />
* 0x00020000 = 720p<br />
* 0x00040000 = 1080i<br />
<br />
* 0x00010000 = Widescreen{{FIXME|reason=What happens if Widescreen and letterbox are enabled at the same time? Can this happen?}}<br />
* 0x00100000 = Letterbox{{FIXME|reason=What happens if Widescreen and letterbox are enabled at the same time? Can this happen?}}<br />
<br />
* 0x00400000 = 60Hz{{FIXME|reason=Unconfirmed; Also, what happens if both refresh rates are disabled?}}<br />
* 0x00800000 = 50Hz{{FIXME|reason=Unconfirmed; Also, what happens if both refresh rates are disabled?}}<br />
|-<br />
| 0x98<br />
| 0x9B<br />
| Audio Settings<br />
* 0x00000000 = Stereo<br />
* 0x00000001 = Mono<br />
* 0x00000002 = Surround<br />
* 0x00010000 = Enable AC3<br />
* 0x00020000 = Enable DTS<br />
|-<br />
| 0x9C<br />
| 0x9F<br />
| Games Parental Control (0 = Max rating)<br />
* 0x00000000 = Rating Pending (RP)<br />
* 0x00000001 = Adults Only (AO)<br />
* 0x00000002 = Mature (M)<br />
* 0x00000003 = Teen (T)<br />
* 0x00000004 = Everyone (E)<br />
* 0x00000005 = Kids to Adults (K-A)<br />
* 0x00000006 = Early Childhood (EC)<br />
|-<br />
| 0xA0<br />
| 0xA3<br />
| Parental Control Passcode; 4 button sequence (each key stored in a nibble)<br />
* 0x1 = {{input-dy+}} or {{input-ly+}}<br />
* 0x2 = {{input-dy-}} or {{input-ly-}}<br />
* 0x3 = {{input-dx-}} or {{input-lx-}}<br />
* 0x4 = {{input-dx+}} or {{input-lx+}}<br />
* 0x5 = {{input-a}}<br />
* 0x6 = {{input-b}}<br />
* 0x7 = {{input-x}}<br />
* 0x8 = {{input-y}}<br />
* 0xB = {{input-lt}}<br />
* 0xC = {{input-rt}}<br />
* 0x0 = Disabled{{FIXME|reason=Is this 0x00000000 only, or are shorter codes possible? can a middle section be 0x00 or would that end the sequence?}}<br />
<br />
''Note'':<br />
* A passcode 0x00001423 is D-pad directions up (0x1), right (0x4), down (0x2), left (0x3). <br />
* Pass code only uses the lower 16 bits; each button is stored as a nibble in the word. First button in the most significant nibble and last in the least significant nibble.<br />
|-<br />
| 0xA4<br />
| 0xA7<br />
| Movies Parental Control (0 = Max rating)<br />
* 0x00000001 = Adults Only (NC-17)<br />
* 0x00000002 = Restricted (R)<br />
* 0x00000004 = Parents Strongly Cautioned (PG-13)<br />
* 0x00000005 = Parental Guidance Suggested (PG)<br />
* 0x00000007 = General Audiences (G)<br />
|- <br />
| 0xA8<br />
| 0xAB<br />
| XBOX Live IP Address..<br />
|-<br />
| 0xAC<br />
| 0xAF<br />
| XBOX Live DNS Server..<br />
|-<br />
| 0xB0<br />
| 0xB3<br />
| XBOX Live Gateway Address..<br />
|-<br />
| 0xB4<br />
| 0xB7<br />
| XBOX Live Subnet Mask..<br />
|-<br />
| 0xB8<br />
| 0xBB<br />
| Other XBLive settings ?<br />
|-<br />
| 0xBC<br />
| 0xBF<br />
| DVD Playback Kit Zone<br />
* 0x00000000 = None<br />
* 0x00000001 = Region 1<br />
* ...<br />
* 0x00000006 = Region 6{{FIXME|reason=We should document which regions were actually sold in stores}}<br />
|-<br />
| 0xC0<br />
| 0xFF<br />
| Unknown Codes / History ? do not change any values in this range<br />
|-<br />
|}<br />
<br />
Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].<br />
<br />
<sup>*</sup>Configmagic-FINAL-1.6 uses the wrong size when computing Checksum2 (40 instead of 44 bytes) and Checksum3 (96 instead of 92 bytes). Checksum2 value computed was correct only because the extra 4 bytes not used in the CRC computation were all 0's which does not change the CRC value. However, a similiar problem with computation of Checksum3 is present. The CRC computed for v1.6 Xbox's is incorrect as the 4 extra bytes are not 0's as on earlier versions.<br />
<br />
== Reading/Writing the EEPROM ==<br />
<br />
=== Software Method ===<br />
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.<br />
<br />
=== Hardware Method ===<br />
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see [http://dangerousprototypes.com/blog/bus-pirate-manual/ here]<br />
or [https://www.totalphase.com/products/aardvark-i2cspi/ here]), build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. Then use the corresponding software to read/write the EEPROM.<br />
<br />
== The HMAC SHA1 Hash ==<br />
<br />
The HMAC SHA1 Hash is generated{{FIXME|reason=Stored? Derived? At factory?}} out of the first 48 bytes{{FIXME|reason=..first 48 EEPROM bytes? Encrypted / Decrypted?}}. This section has been identified clearly{{FIXME|reason=What does this mean?}}.<br />
<br />
== Checksum Algorithm ==<br />
<br />
Checksum2 and Checksum3 values can be calculated by running the following code snippet over the area the checksum covers:<br />
<br />
<pre> /* The EepromCRC algorithm was obtained from the XKUtils 0.2 source released by<br />
* TeamAssembly under the GNU GPL.<br />
* Specifically, from XKCRC.cpp<br />
*<br />
* Rewritten to ANSI C by David Pye (dmp@davidmpye.dyndns.org)<br />
*<br />
* Adapted for XboxDevWiki<br />
*/<br />
uint32_t EepromCRC(unsigned char *data, long dataLen) {<br />
<br />
// Initialize result to zero<br />
uint8_t crc[4] = { 0x00, 0x00, 0x00, 0x00 };<br />
<br />
//Circle shift input data one byte right<br />
unsigned char* CRC_Data = (unsigned char *)malloc(dataLen + 4);<br />
memset(CRC_Data, 0x00, dataLen + 4);<br />
memcpy(CRC_Data + 0x01 , data, dataLen - 1);<br />
memcpy(CRC_Data, data + dataLen - 1, 0x01);<br />
<br />
// Calculate checksum<br />
for (unsigned int i = 0; i < 4; i++) {<br />
unsigned short CRCPosVal = 0xFFFF;<br />
for (unsigned long l = i; l < dataLen; l += 4) {<br />
CRCPosVal -= *(unsigned short*)(&amp;CRC_Data[l]);<br />
}<br />
CRCPosVal &= 0xFF00;<br />
crc[i] = (unsigned char) (CRCPosVal >> 8);<br />
}<br />
<br />
free(CRC_Data);<br />
<br />
return *(uint32_t*)&crc;<br />
}<br />
</pre><br />
<br />
== Read Checksum Algorithm ==<br />
<br />
When the Xbox reads from the FACTORY_SETTINGS or the USER_SETTINGS section of the EEPROM, this algorithm is ran over the entire section accessed (including the CRC checksum mentioned above) to ensure that the data is valid. If the result of the checksum algorithm does not equal 0xFFFFFFFF, STATUS_DEVICE_DATA_ERROR is returned from the Kernel.<br />
<br />
<pre>static uint32_t eeprom_section_checksum(<br />
const uint32_t* section_data,<br />
uint32_t section_data_length<br />
)<br />
{<br />
const uint32_t bitmask = 0xFFFFFFFF;<br />
uint64_t checksum = 0;<br />
uint32_t carry_count = 0;<br />
<br />
// Process the data in 32 bit steps<br />
for(unsigned int i = 0; i < section_data_length / 4; i++) {<br />
checksum += *section_data;<br />
if(checksum > bitmask) {<br />
carry_count++;<br />
checksum &= bitmask;<br />
}<br />
section_data++;<br />
}<br />
checksum += carry_count;<br />
if(checksum > bitmask) {<br />
checksum += 1;<br />
}<br />
return (uint32_t)(checksum & bitmask);<br />
}<br />
</pre><br />
<br />
== Further Reading ==<br />
<br />
* [https://web.archive.org/web/20040604013125/http://console-dev.com:80/eeprom.htm Information about EEPROM contents]<br />
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip using a Raspberry Pi]<br />
* [https://mehmedbasic.dk/post/xbox-eeprom/ Read/Write an original Xbox EEPROM using a VGA port]<br />
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]<br />
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Network&diff=6875Network2020-08-08T13:56:00Z<p>KaosEngineer: /* Hardware */</p>
<hr />
<div>The Xbox contains an Ethernet module and one RJ45 connector. Additionally, separate modem and wireless accessories were considered when developing the console. Eventually, an official wireless adapter was released based on a "D-Link 108AG Gaming Adapter" in the end of 2003.<br />
<br />
The XDK provides a TCP/IP protocol stack complete with a DNS PPTP, DHCP clients.<br />
The IANA registered port 3074 (UDP / TCP) is reserved for Xbox communications (See [[System Link]] and [[Xbox Live]]).<br />
<br />
== Integrated network adapter ==<br />
<br />
Integrated in the Nvidia Southbridge MCPX chip which is similar to the nForce chips.<br />
<br />
The Xbox MAC address is stored in the [[EEPROM]].<br />
The network driver, including the protocol stack is contained in the XDK.<br />
The kernel only contains a small number of exports to reset and get the state of the NIC.<br />
<br />
The Xbox Linux team used the binary drivers from Nvidia{{citation needed}}{{FIXME|reason=Wasn't the open-source forcedeth driver used?}}.<br />
<br />
==== Heartbeat ====<br />
<br />
Ethernet II, Src: Microsof_f2:00:00 (00:50:f2:f2:00:00), Dst: Broadcast (ff:ff:ff:ff:ff:ff)<br />
MS Network Load Balancing<br />
Signature: Unknown (0x584f4258)<br />
Version: 1.1<br />
Unique Host ID: 3118682055<br />
Cluster IP: 167.102.81.132 (167.102.81.132)<br />
Host IP: 4.89.169.109 (4.89.169.109)<br />
Signature Data - Unknown (1481589336)<br />
<br />
== Wireless adapter ==<br />
<br />
based on the "D-Link 108AG Gaming Adapter", the Xbox MN-740 Wireless Bridge bundled with an Xbox setup disc (which would update the dashboard if necessary).<br />
It was also [https://web.archive.org/web/20040508051958/http://www.xbox.com/en-US/live/connect/msmn740.htm described on Microsoft's website].<br />
<br />
==== Hardware ====<br />
<br />
* AR5312 CPU (MIPS 4Kc core?{{citation needed}}) <br />
* AR5212 RoC (Radio on Chip){{citation needed}} for 2.4 Ghz 802.11b/g{{citation needed}}. <br />
* KS8721B physical layer transciever<br />
* some EEPROM which hold the MAC address (based of FCC pictures and Firmware analysis){{citation needed}} <br />
* IC42S16400 8Mb ram<br />
* SST39LF0?0A (1 or 2 Mb) (the FCC picture is unclear on the size part due to writing) {{citation needed}} <br />
<br />
The onboard 3 LEDs are Power, Wireless and Xbox (called Ethernet on the PCB).<br />
The board seems to have Jtag and what appears to be Serial test pins exposed. <br />
<br />
===== Firmware =====<br />
<br />
This wireless bridge runs a closed source version of the "ThreadX JADE/Green Hills Version G4.0.4.0" RTOS. <br />
The firmware contains a copyright string of: "Copyright (c) Microsoft Corporation All Rights Reserved Device is Xbox Compatible"<br />
<br />
The latest firmware is separated by a boot and runtime firmware {{citation needed}} : <br />
* MN740_01.03.00.0005_BOOT.bin, "Xbox Wireless Adapter (MN-740) boot firmware"<br />
* MN740_01.00.02.0022_RUNTIME.bin, "Xbox Wireless Adapter (MN-740) runtime firmware"<br />
<br />
There were at least 2 firmware updates for download:<br />
<br />
* [https://web.archive.org/web/20031210155952/http://www.microsoft.com/hardware/broadbandnetworking/readme/readme_mn740_101.htm MN740 1.01]<br />
* [https://web.archive.org/web/20040602231929/http://www.microsoft.com/hardware/broadbandnetworking/readme/readme_mn740_102.htm MN740 1.02]<br />
<br />
Judging by the firmware filenames above, there should also be an MN-740 1.00 and MN740 1.03.<br />
<br />
====== WPA2 support ======<br />
<br />
The shipped firmware does not support WPA or WPA2.<br />
A "firmware" hack based on the D-Link firmware adds WPA support, rendering Dashboard support unfunctional and changing settings require connecting to the LAN port using a PC (or web browser capable application).<br />
<br />
==== Software (Xbox setup disc) ====<br />
<br />
The setup disc is a CD[http://redump.org/disc/53586/]. It contains an XISO filesystem that contains only a "default.xbe" which contains a dashboard updater.<br />
<br />
== References and links ==<br />
<br />
* [https://xboxlivehacking.blogspot.de/ https://xboxlivehacking.blogspot.de/]<br />
* [https://www.google.com/patents/US20040009815 Patent: Managing access to content]<br />
* [https://www.google.com/patents/US20030093669 Patent: Network architecture for secure communications between two console-based gaming systems]<br />
* [https://www.google.com/patents/US20030093668 Patent: Architecture for manufacturing authenticatable gaming systems ]<br />
* [https://www.google.com/patents/US7803052 Patent: Discovery and distribution of game session information ]<br />
* [https://www.google.com/patents/US20030229779 Patent: Security gateway for online console-based gaming ]<br />
* [https://www.google.com/patents/US20030233537 Patent: Presence and notification system for maintaining and communicating information ]<br />
* [https://www.google.com/patents/US7218739 Patent: Multiple user authentication for online console-based gaming ]<br />
* [https://web.archive.org/web/20040831091347/http://www.xbox.com:80/assets/en-us/HardwareManuals/Xnewt.pdf Xbox Wireless adapter manual]<br />
* [https://www.hanselman.com/blog/FlashingTheFirmwareOfAnXboxMN740WirelessAdapterToADLink108AGToSupportWPASecurity.aspx Flashing the Firmware of an Xbox MN-740 Wireless Adapter to a D-Link 108AG to support WPA Security ]<br />
* [https://fccid.io/C3KMN740/Internal-Photos/Internal-Photos-360373.iframe FCC entry of Xbox MN-740 Wireless Adapter (with IC writing intact) ]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Network&diff=6874Network2020-08-08T13:53:58Z<p>KaosEngineer: /* Firmware */</p>
<hr />
<div>The Xbox contains an Ethernet module and one RJ45 connector. Additionally, separate modem and wireless accessories were considered when developing the console. Eventually, an official wireless adapter was released based on a "D-Link 108AG Gaming Adapter" in the end of 2003.<br />
<br />
The XDK provides a TCP/IP protocol stack complete with a DNS PPTP, DHCP clients.<br />
The IANA registered port 3074 (UDP / TCP) is reserved for Xbox communications (See [[System Link]] and [[Xbox Live]]).<br />
<br />
== Integrated network adapter ==<br />
<br />
Integrated in the Nvidia Southbridge MCPX chip which is similar to the nForce chips.<br />
<br />
The Xbox MAC address is stored in the [[EEPROM]].<br />
The network driver, including the protocol stack is contained in the XDK.<br />
The kernel only contains a small number of exports to reset and get the state of the NIC.<br />
<br />
The Xbox Linux team used the binary drivers from Nvidia{{citation needed}}{{FIXME|reason=Wasn't the open-source forcedeth driver used?}}.<br />
<br />
==== Heartbeat ====<br />
<br />
Ethernet II, Src: Microsof_f2:00:00 (00:50:f2:f2:00:00), Dst: Broadcast (ff:ff:ff:ff:ff:ff)<br />
MS Network Load Balancing<br />
Signature: Unknown (0x584f4258)<br />
Version: 1.1<br />
Unique Host ID: 3118682055<br />
Cluster IP: 167.102.81.132 (167.102.81.132)<br />
Host IP: 4.89.169.109 (4.89.169.109)<br />
Signature Data - Unknown (1481589336)<br />
<br />
== Wireless adapter ==<br />
<br />
based on the "D-Link 108AG Gaming Adapter", the Xbox MN-740 Wireless Bridge bundled with an Xbox setup disc (which would update the dashboard if necessary).<br />
It was also [https://web.archive.org/web/20040508051958/http://www.xbox.com/en-US/live/connect/msmn740.htm described on Microsoft's website].<br />
<br />
==== Hardware ====<br />
<br />
* AR5312 CPU (MIPS 4Kc core?{{citation needed}}) <br />
* AR5212 RoC (Radio on Chip){{citation needed}} for 2.4 Ghz 802.11b/g{{citation needed}}. <br />
* KS8721B physical layer transciever<br />
* some EEPROM which hold the MAC address (based of FCC pictures and Firmware analysis){{citation needed}} <br />
* IC42S16400 8Mb ram<br />
* SST39LF0?0A (1 or 2 Mb) (the FCC picture is unclear on the size part due to writing) {{citation needed}} <br />
<br />
The onboard 3 LEDs are Power, Wireless and Xbox(called Ethernet on the PCB).<br />
The board seems to have Jtag and what appears to be Serial test pins exposed. <br />
<br />
===== Firmware =====<br />
<br />
This wireless bridge runs a closed source version of the "ThreadX JADE/Green Hills Version G4.0.4.0" RTOS. <br />
The firmware contains a copyright string of: "Copyright (c) Microsoft Corporation All Rights Reserved Device is Xbox Compatible"<br />
<br />
The latest firmware is separated by a boot and runtime firmware {{citation needed}} : <br />
* MN740_01.03.00.0005_BOOT.bin, "Xbox Wireless Adapter (MN-740) boot firmware"<br />
* MN740_01.00.02.0022_RUNTIME.bin, "Xbox Wireless Adapter (MN-740) runtime firmware"<br />
<br />
There were at least 2 firmware updates for download:<br />
<br />
* [https://web.archive.org/web/20031210155952/http://www.microsoft.com/hardware/broadbandnetworking/readme/readme_mn740_101.htm MN740 1.01]<br />
* [https://web.archive.org/web/20040602231929/http://www.microsoft.com/hardware/broadbandnetworking/readme/readme_mn740_102.htm MN740 1.02]<br />
<br />
Judging by the firmware filenames above, there should also be an MN-740 1.00 and MN740 1.03.<br />
<br />
====== WPA2 support ======<br />
<br />
The shipped firmware does not support WPA or WPA2.<br />
A "firmware" hack based on the D-Link firmware adds WPA support, rendering Dashboard support unfunctional and changing settings require connecting to the LAN port using a PC (or web browser capable application).<br />
<br />
==== Software (Xbox setup disc) ====<br />
<br />
The setup disc is a CD[http://redump.org/disc/53586/]. It contains an XISO filesystem that contains only a "default.xbe" which contains a dashboard updater.<br />
<br />
== References and links ==<br />
<br />
* [https://xboxlivehacking.blogspot.de/ https://xboxlivehacking.blogspot.de/]<br />
* [https://www.google.com/patents/US20040009815 Patent: Managing access to content]<br />
* [https://www.google.com/patents/US20030093669 Patent: Network architecture for secure communications between two console-based gaming systems]<br />
* [https://www.google.com/patents/US20030093668 Patent: Architecture for manufacturing authenticatable gaming systems ]<br />
* [https://www.google.com/patents/US7803052 Patent: Discovery and distribution of game session information ]<br />
* [https://www.google.com/patents/US20030229779 Patent: Security gateway for online console-based gaming ]<br />
* [https://www.google.com/patents/US20030233537 Patent: Presence and notification system for maintaining and communicating information ]<br />
* [https://www.google.com/patents/US7218739 Patent: Multiple user authentication for online console-based gaming ]<br />
* [https://web.archive.org/web/20040831091347/http://www.xbox.com:80/assets/en-us/HardwareManuals/Xnewt.pdf Xbox Wireless adapter manual]<br />
* [https://www.hanselman.com/blog/FlashingTheFirmwareOfAnXboxMN740WirelessAdapterToADLink108AGToSupportWPASecurity.aspx Flashing the Firmware of an Xbox MN-740 Wireless Adapter to a D-Link 108AG to support WPA Security ]<br />
* [https://fccid.io/C3KMN740/Internal-Photos/Internal-Photos-360373.iframe FCC entry of Xbox MN-740 Wireless Adapter (with IC writing intact) ]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Network&diff=6873Network2020-08-08T13:49:43Z<p>KaosEngineer: /* Wireless adapter */ missed a typo Micosofts > Microsoft's</p>
<hr />
<div>The Xbox contains an Ethernet module and one RJ45 connector. Additionally, separate modem and wireless accessories were considered when developing the console. Eventually, an official wireless adapter was released based on a "D-Link 108AG Gaming Adapter" in the end of 2003.<br />
<br />
The XDK provides a TCP/IP protocol stack complete with a DNS PPTP, DHCP clients.<br />
The IANA registered port 3074 (UDP / TCP) is reserved for Xbox communications (See [[System Link]] and [[Xbox Live]]).<br />
<br />
== Integrated network adapter ==<br />
<br />
Integrated in the Nvidia Southbridge MCPX chip which is similar to the nForce chips.<br />
<br />
The Xbox MAC address is stored in the [[EEPROM]].<br />
The network driver, including the protocol stack is contained in the XDK.<br />
The kernel only contains a small number of exports to reset and get the state of the NIC.<br />
<br />
The Xbox Linux team used the binary drivers from Nvidia{{citation needed}}{{FIXME|reason=Wasn't the open-source forcedeth driver used?}}.<br />
<br />
==== Heartbeat ====<br />
<br />
Ethernet II, Src: Microsof_f2:00:00 (00:50:f2:f2:00:00), Dst: Broadcast (ff:ff:ff:ff:ff:ff)<br />
MS Network Load Balancing<br />
Signature: Unknown (0x584f4258)<br />
Version: 1.1<br />
Unique Host ID: 3118682055<br />
Cluster IP: 167.102.81.132 (167.102.81.132)<br />
Host IP: 4.89.169.109 (4.89.169.109)<br />
Signature Data - Unknown (1481589336)<br />
<br />
== Wireless adapter ==<br />
<br />
based on the "D-Link 108AG Gaming Adapter", the Xbox MN-740 Wireless Bridge bundled with an Xbox setup disc (which would update the dashboard if necessary).<br />
It was also [https://web.archive.org/web/20040508051958/http://www.xbox.com/en-US/live/connect/msmn740.htm described on Microsoft's website].<br />
<br />
==== Hardware ====<br />
<br />
* AR5312 CPU (MIPS 4Kc core?{{citation needed}}) <br />
* AR5212 RoC (Radio on Chip){{citation needed}} for 2.4 Ghz 802.11b/g{{citation needed}}. <br />
* KS8721B physical layer transciever<br />
* some EEPROM which hold the MAC address (based of FCC pictures and Firmware analysis){{citation needed}} <br />
* IC42S16400 8Mb ram<br />
* SST39LF0?0A (1 or 2 Mb) (the FCC picture is unclear on the size part due to writing) {{citation needed}} <br />
<br />
The onboard 3 LEDs are Power, Wireless and Xbox(called Ethernet on the PCB).<br />
The board seems to have Jtag and what appears to be Serial test pins exposed. <br />
<br />
===== Firmware =====<br />
<br />
This wireless bridge runs a closed source version of the"ThreadX JADE/Green Hills Version G4.0.4.0" RTOS. <br />
The firmware contains a copyright string of: "Copyright (c) Microsoft Corporation All Rights Reserved Device is Xbox Compatible"<br />
<br />
The latest firmware is separated by a boot and runtime firmware {{citation needed}} : <br />
* MN740_01.03.00.0005_BOOT.bin, "Xbox Wireless Adapter (MN-740) boot firmware"<br />
* MN740_01.00.02.0022_RUNTIME.bin, "Xbox Wireless Adapter (MN-740) runtime firmware"<br />
<br />
There were at least 2 firmware updates for download:<br />
<br />
* [https://web.archive.org/web/20031210155952/http://www.microsoft.com/hardware/broadbandnetworking/readme/readme_mn740_101.htm MN740 1.01]<br />
* [https://web.archive.org/web/20040602231929/http://www.microsoft.com/hardware/broadbandnetworking/readme/readme_mn740_102.htm MN740 1.02]<br />
<br />
Judging by the firmware filenames above, there should also be an MN-740 1.00 and MN740 1.03.<br />
<br />
====== WPA2 support ======<br />
<br />
The shipped firmware does not support WPA or WPA2.<br />
A "firmware" hack based on the D-Link firmware adds WPA support, rendering Dashboard support unfunctional and changing settings require connecting to the LAN port using a PC (or web browser capable application).<br />
<br />
==== Software (Xbox setup disc) ====<br />
<br />
The setup disc is a CD[http://redump.org/disc/53586/]. It contains an XISO filesystem that contains only a "default.xbe" which contains a dashboard updater.<br />
<br />
== References and links ==<br />
<br />
* [https://xboxlivehacking.blogspot.de/ https://xboxlivehacking.blogspot.de/]<br />
* [https://www.google.com/patents/US20040009815 Patent: Managing access to content]<br />
* [https://www.google.com/patents/US20030093669 Patent: Network architecture for secure communications between two console-based gaming systems]<br />
* [https://www.google.com/patents/US20030093668 Patent: Architecture for manufacturing authenticatable gaming systems ]<br />
* [https://www.google.com/patents/US7803052 Patent: Discovery and distribution of game session information ]<br />
* [https://www.google.com/patents/US20030229779 Patent: Security gateway for online console-based gaming ]<br />
* [https://www.google.com/patents/US20030233537 Patent: Presence and notification system for maintaining and communicating information ]<br />
* [https://www.google.com/patents/US7218739 Patent: Multiple user authentication for online console-based gaming ]<br />
* [https://web.archive.org/web/20040831091347/http://www.xbox.com:80/assets/en-us/HardwareManuals/Xnewt.pdf Xbox Wireless adapter manual]<br />
* [https://www.hanselman.com/blog/FlashingTheFirmwareOfAnXboxMN740WirelessAdapterToADLink108AGToSupportWPASecurity.aspx Flashing the Firmware of an Xbox MN-740 Wireless Adapter to a D-Link 108AG to support WPA Security ]<br />
* [https://fccid.io/C3KMN740/Internal-Photos/Internal-Photos-360373.iframe FCC entry of Xbox MN-740 Wireless Adapter (with IC writing intact) ]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Network&diff=6872Network2020-08-08T13:45:57Z<p>KaosEngineer: many misspelled words corrected and a couple of punctuation changes made</p>
<hr />
<div>The Xbox contains an Ethernet module and one RJ45 connector. Additionally, separate modem and wireless accessories were considered when developing the console. Eventually, an official wireless adapter was released based on a "D-Link 108AG Gaming Adapter" in the end of 2003.<br />
<br />
The XDK provides a TCP/IP protocol stack complete with a DNS PPTP, DHCP clients.<br />
The IANA registered port 3074 (UDP / TCP) is reserved for Xbox communications (See [[System Link]] and [[Xbox Live]]).<br />
<br />
== Integrated network adapter ==<br />
<br />
Integrated in the Nvidia Southbridge MCPX chip which is similar to the nForce chips.<br />
<br />
The Xbox MAC address is stored in the [[EEPROM]].<br />
The network driver, including the protocol stack is contained in the XDK.<br />
The kernel only contains a small number of exports to reset and get the state of the NIC.<br />
<br />
The Xbox Linux team used the binary drivers from Nvidia{{citation needed}}{{FIXME|reason=Wasn't the open-source forcedeth driver used?}}.<br />
<br />
==== Heartbeat ====<br />
<br />
Ethernet II, Src: Microsof_f2:00:00 (00:50:f2:f2:00:00), Dst: Broadcast (ff:ff:ff:ff:ff:ff)<br />
MS Network Load Balancing<br />
Signature: Unknown (0x584f4258)<br />
Version: 1.1<br />
Unique Host ID: 3118682055<br />
Cluster IP: 167.102.81.132 (167.102.81.132)<br />
Host IP: 4.89.169.109 (4.89.169.109)<br />
Signature Data - Unknown (1481589336)<br />
<br />
== Wireless adapter ==<br />
<br />
based on the "D-Link 108AG Gaming Adapter", the Xbox MN-740 Wireless Bridge bundled with an Xbox setup disc (which would update the dashboard if necessary).<br />
It was also [https://web.archive.org/web/20040508051958/http://www.xbox.com/en-US/live/connect/msmn740.htm described on Micosofts website].<br />
<br />
==== Hardware ====<br />
<br />
* AR5312 CPU (MIPS 4Kc core?{{citation needed}}) <br />
* AR5212 RoC (Radio on Chip){{citation needed}} for 2.4 Ghz 802.11b/g{{citation needed}}. <br />
* KS8721B physical layer transciever<br />
* some EEPROM which hold the MAC address (based of FCC pictures and Firmware analysis){{citation needed}} <br />
* IC42S16400 8Mb ram<br />
* SST39LF0?0A (1 or 2 Mb) (the FCC picture is unclear on the size part due to writing) {{citation needed}} <br />
<br />
The onboard 3 LEDs are Power, Wireless and Xbox(called Ethernet on the PCB).<br />
The board seems to have Jtag and what appears to be Serial test pins exposed. <br />
<br />
===== Firmware =====<br />
<br />
This wireless bridge runs a closed source version of the"ThreadX JADE/Green Hills Version G4.0.4.0" RTOS. <br />
The firmware contains a copyright string of: "Copyright (c) Microsoft Corporation All Rights Reserved Device is Xbox Compatible"<br />
<br />
The latest firmware is separated by a boot and runtime firmware {{citation needed}} : <br />
* MN740_01.03.00.0005_BOOT.bin, "Xbox Wireless Adapter (MN-740) boot firmware"<br />
* MN740_01.00.02.0022_RUNTIME.bin, "Xbox Wireless Adapter (MN-740) runtime firmware"<br />
<br />
There were at least 2 firmware updates for download:<br />
<br />
* [https://web.archive.org/web/20031210155952/http://www.microsoft.com/hardware/broadbandnetworking/readme/readme_mn740_101.htm MN740 1.01]<br />
* [https://web.archive.org/web/20040602231929/http://www.microsoft.com/hardware/broadbandnetworking/readme/readme_mn740_102.htm MN740 1.02]<br />
<br />
Judging by the firmware filenames above, there should also be an MN-740 1.00 and MN740 1.03.<br />
<br />
====== WPA2 support ======<br />
<br />
The shipped firmware does not support WPA or WPA2.<br />
A "firmware" hack based on the D-Link firmware adds WPA support, rendering Dashboard support unfunctional and changing settings require connecting to the LAN port using a PC (or web browser capable application).<br />
<br />
==== Software (Xbox setup disc) ====<br />
<br />
The setup disc is a CD[http://redump.org/disc/53586/]. It contains an XISO filesystem that contains only a "default.xbe" which contains a dashboard updater.<br />
<br />
== References and links ==<br />
<br />
* [https://xboxlivehacking.blogspot.de/ https://xboxlivehacking.blogspot.de/]<br />
* [https://www.google.com/patents/US20040009815 Patent: Managing access to content]<br />
* [https://www.google.com/patents/US20030093669 Patent: Network architecture for secure communications between two console-based gaming systems]<br />
* [https://www.google.com/patents/US20030093668 Patent: Architecture for manufacturing authenticatable gaming systems ]<br />
* [https://www.google.com/patents/US7803052 Patent: Discovery and distribution of game session information ]<br />
* [https://www.google.com/patents/US20030229779 Patent: Security gateway for online console-based gaming ]<br />
* [https://www.google.com/patents/US20030233537 Patent: Presence and notification system for maintaining and communicating information ]<br />
* [https://www.google.com/patents/US7218739 Patent: Multiple user authentication for online console-based gaming ]<br />
* [https://web.archive.org/web/20040831091347/http://www.xbox.com:80/assets/en-us/HardwareManuals/Xnewt.pdf Xbox Wireless adapter manual]<br />
* [https://www.hanselman.com/blog/FlashingTheFirmwareOfAnXboxMN740WirelessAdapterToADLink108AGToSupportWPASecurity.aspx Flashing the Firmware of an Xbox MN-740 Wireless Adapter to a D-Link 108AG to support WPA Security ]<br />
* [https://fccid.io/C3KMN740/Internal-Photos/Internal-Photos-360373.iframe FCC entry of Xbox MN-740 Wireless Adapter (with IC writing intact) ]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=LPC_Debug_Port&diff=6610LPC Debug Port2018-12-24T05:49:43Z<p>KaosEngineer: On v1.6 hardware, added "pin 9 is" for clarity of what's disconnected. Though it is what is being written about</p>
<hr />
<div>{|class="wikitable" style="float:right;margin-left:10px;"<br />
|+ Pin Layout<br />
|-<br />
! style="text-align:right" | Name !! style="text-align:right" | Pin !! Pin !! Name<br />
|-<br />
| style="text-align:right" | SERIRQ (v1.0) || style="text-align:right" | 16 || 15 || 3.3V<br />
|-<br />
| style="text-align:right" | SDA || style="text-align:right" | 14 || 13 || SCL<br />
|-<br />
| style="text-align:right" | GND || style="text-align:right" | 12 || 11 || LAD0<br />
|-<br />
| style="text-align:right" | LAD1 || style="text-align:right" | 10 || 9 || 3.3V<br />
|-<br />
| style="text-align:right" | LAD2 || style="text-align:right" | 8 || 7 || LAD3<br />
|-<br />
| style="text-align:right" | 5V || style="text-align:right" | 6 || 5 || LRESET#<br />
|-<br />
| style="text-align:right" | PWR (v1.6) || style="text-align:right" | 4 || 3 || LFRAME#<br />
|-<br />
| style="text-align:right" | GND || style="text-align:right" | 2 || 1 || LCLK<br />
|}<br />
<br />
The '''LPC Debug Port''' is an unpopulated 2x8 2.54mm (0.1") footprint on the Xbox motherboard that provides access to the system's [https://en.wikipedia.org/wiki/Low_Pin_Count Low Pin Count] Bus, as well as the [[SMBus]]. Throughout the Xbox's lifetime, Microsoft modified the LPC port in an attempt to prevent modding and, in some cases, it must be "rebuilt" to restore the port's full functionality. Rebuilding the LPC debug port involves soldering wires between it and very small vias on the motherboard.<br />
<br />
The LPC bus is controlled by the [[MCPX|MCPX southbridge]], which conforms to the Intel Low Pin Count Specification 1.0.<br />
<br />
== Pins ==<br />
<br />
* '''3.3V''' (15 & 9) - Provides 3.3V while the Xbox is powered on. On 1.6 hardware, pin 9 is disconnected. Reconnect to pin 15 to restore the supply voltage.<br />
* '''SDA''' (14) - [[SMBus]] data and address signal.<br />
* '''SCL''' (13) - [[SMBus]] clock signal.<br />
* '''GND''' (12 & 2) - Ground.<br />
* '''LAD[3:0]''' (11, 10, 8, 7) - LPC address and data signals.<br />
* '''5V''' (6) - Provides 5V while the Xbox is powered on or v1.6 always on when AC plugged in.<br />
* '''LRESET#''' (5) - LPC reset signal; same as PCIRST#.<br />
* '''PWR''' (4) - On pre-1.6 hardware, this pin does not physically exist. On 1.6 hardware, this pin is connected to the power button. Shorting it to ground will turn the Xbox on and off.<br />
* '''LFRAME#''' (3) - LPC start-of-cycle signal. On 1.3-1.5 hardware, disconnected.<br />
* '''LCLK''' (1) - 33MHz LPC clock signal; same as PCICLK.<br />
<br />
The debug port lacks the optional LDRQ#, SERIRQ, CLKRUN#, PME#, LPCPD#, and LSMI# signals. This means peripherals connected to the debug port cannot utilize interrupt, DMA, bus mastering, or power management features.</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=EEPROM&diff=6588EEPROM2018-10-19T20:03:07Z<p>KaosEngineer: Added A and B button values stored in the Parental Passcode at offset 0xA0-0xA3</p>
<hr />
<div>The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.<br />
Parts of the EEPROM are encrypted using [[Kernel/XboxEEPROMKey]].<br />
<br />
== Contents ==<br />
<br />
{| class="wikitable"<br />
! Start !! End !! Notes<br />
|-<br />
| 0x00<br />
| 0x13<br />
| HMAC_SHA1 Hash<br />
|-<br />
| 0x14<br />
| 0x1B<br />
| RC4 Encrypted Confounder ??<br />
|-<br />
| 0x1C<br />
| 0x2B<br />
| RC4 Encrypted HDD key<br />
|-<br />
| 0x2C<br />
| 0x2F<br />
| RC4 Encrypted Region code<br />
* 0x01 = North America<br />
* 0x02 = Japan<br />
* 0x04 = Europe & Australia<br />
|-<br />
| 0x30<br />
| 0x33<br />
| Checksum2 - Checksum of next 44 (0x2C) bytes (0x34 - 0x5F)<sup>*</sup><br />
|-<br />
| 0x34<br />
| 0x3F<br />
| Xbox serial number - (ASCII chars 0x30 - 0x39 to match each digit in SN)<br />
|-<br />
| 0x40<br />
| 0x45<br />
| Ethernet MAC address (Microsoft Xbox - 00:50:F2:xx:xx:xx)<br />
|-<br />
| 0x46<br />
| 0x47<br />
| Unknown Padding ?<br />
|-<br />
| 0x48<br />
| 0x57<br />
| Online Key ?<br />
|-<br />
| 0x58<br />
| 0x5B<br />
| Video Standard<br />
* 0x00000000 = not set (INVALID)<br />
* 0x00400100 = NTSC-M<br />
* 0x00400200 = NTSC-J<br />
* 0x00800300 = PAL-I<br />
* 0x00400400 = PAL-M<br />
|-<br />
| 0x5C<br />
| 0x5F<br />
| Unknown Padding ?<br />
|-<br />
| 0x60<br />
| 0x63<br />
| Checksum3 - Checksum of the next 92 (0x5C) bytes (0x64 - 0xBF)<sup>*</sup><br />
|-<br />
| 0x64<br />
| 0x67<br />
| Zone Bias - Offset in # minutes to subtract from GMT time <br />
(e.g., for GMT-06 Central; 6hr = 360min = 0x00000168)<br />
|-<br />
| 0x68<br />
| 0x6B<br />
| Standard Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CST\0, ACST)<br />
|-<br />
| 0x6C<br />
| 0x6F<br />
| Daylight Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CDT\0, ACDT)<br />
|-<br />
| 0x70<br />
| 0x77<br />
| Unknown Padding ?<br />
|-<br />
| 0x78<br />
| 0x7B<br />
| Standard Time Starts 10-05-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x7C<br />
| 0x7F<br />
| Daylight Savings Time Starts 04-01-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x80<br />
| 0x87<br />
| Unknown Padding ?<br />
|-<br />
| 0x88<br />
| 0x8B<br />
| Standard Timezone Bias; if not DST, 0 (0x00000000) minute time adjust<br />
|-<br />
| 0x8C<br />
| 0x8F<br />
| Daylight Savings Time Bias; if DST, -60 (0xFFFFFFC4) minute time adjust<br />
|-<br />
| 0x90<br />
| 0x93<br />
| Language ID (0 = not set) 1 byte at offset 0x90 data 4-byte aligned adds the 3 remaining bytes of 0x00<br />
{| class="wikitable"<br />
! Language !! EEPROM Value @ 0x90<br />
|-<br />
| English<br />
| 0x01 <br />
|-<br />
| Japanese<br />
| 0x02<br />
|-<br />
| German<br />
| 0x03<br />
|-<br />
| French<br />
| 0x04<br />
|-<br />
| Spanish<br />
| 0x05<br />
|-<br />
| Italian<br />
| 0x06<br />
|-<br />
| Korean<br />
| 0x07<br />
|-<br />
| Chinese<br />
| 0x08<br />
|-<br />
| Portuguese<br />
| 0x09<br />
|}<br />
|-<br />
| 0x94<br />
| 0x97<br />
| Video Settings<br />
<br />
Offset 0x96:<br />
* 0x??=Normal{{FIXME}}<br />
* 0xB0=Widescreen<br />
* 0xB4=Letterbox<br />
|-<br />
| 0x98<br />
| 0x9B<br />
| Audio Settings<br />
|-<br />
| 0x9C<br />
| 0x9F<br />
| Games Parental Control (0 = Max rating) 1 byte at offset 0x9C data 4-byte aligned adds the 3 remaining bytes of 0x00<br />
{| class="wikitable"<br />
! Xbox Game Rating !! EEPROM Value @ 0x9C<br />
|-<br />
| (RP) Rating Pending (Max)<br />
| 0x00<br />
|-<br />
| (AO) Adults Only <br />
| 0x01<br />
|-<br />
| (M) Mature <br />
| 0x02<br />
|-<br />
| (T) Teen <br />
| 0x03<br />
|-<br />
| (E) Everyone <br />
| 0x04<br />
|-<br />
| (K-A) Kids to Adults <br />
| 0x05<br />
|-<br />
| (EC) Early Childhood <br />
| 0x06<br />
|}<br />
|-<br />
| 0xA0<br />
| 0xA3<br />
| Parental Control Passcode; 4 button sequence (each key stored in a nibble)<br />
* 0x1 = {{input-dy+}} or {{input-ly+}}<br />
* 0x2 = {{input-dy-}} or {{input-ly-}}<br />
* 0x3 = {{input-dx-}} or {{input-lx-}}<br />
* 0x4 = {{input-dx+}} or {{input-lx+}}<br />
* 0x5 = {{input-a}}<br />
* 0x6 = {{input-b}}<br />
* 0x7 = {{input-x}}<br />
* 0x8 = {{input-y}}<br />
* 0xB = {{input-lt}}<br />
* 0xC = {{input-rt}}<br />
* 0 = Disabled{{FIXME|reason=Is this 0x00000000 only, or are shorter codes possible? can a middle section be 0x00 or would that end the sequence?}}<br />
<br />
Note:{{FIXME|reason=Not sure this is the proper place to describe and formatting sucks not used mediawiki that much still learning}}<br />
* EEPROM offset 0xA0: <code>23 14 00 00</code><br />
* Little Endian value 0x00001423.<br />
* The pass code is D-pad directions up (0x1), right (0x4), down (0x2), left (0x3). <br />
* Pass code is only 2 bytes not 4, each button is stored as a nibble in the word. First button in the most significant nibble and last in the least significant nibble. <br />
* Data in the EEPROM is aligned to double word (4-byte) boundaries. Thus, the two extra bytes at 0xA2 and 0xA3 of 0x00.<br />
|-<br />
| 0xA4<br />
| 0xA7<br />
| Movies Parental Control (0 = Max rating) only 1 byte necessary, the 3 remaining bytes for multiple of 4-byte data alignment{{FIXME|reason=Re-word alignment description. The reason for the extra 3 bytes.}}<br />
{| class="wikitable"<br />
! Xbox Movie Rating !! EEPROM Value @ 0xA4<br />
|-<br />
| 8 (Max)<br />
| 0x00<br />
|-<br />
| 7 (NC-17) <br />
| 0x01<br />
|-<br />
| 6 (R)<br />
| 0x02 <br />
|-<br />
| 5<br />
| 0x03 <br />
|-<br />
| 4 (PG-13)<br />
| 0x04<br />
|-<br />
| 3 (PG)<br />
| 0x05<br />
|-<br />
| 2<br />
| 0x06 <br />
|-<br />
| 1 (G)<br />
| 0x07 <br />
|}<br />
|- <br />
| 0xA8<br />
| 0xAB<br />
| XBOX Live IP Address..<br />
|-<br />
| 0xAC<br />
| 0xAF<br />
| XBOX Live DNS Server..<br />
|-<br />
| 0xB0<br />
| 0xB3<br />
| XBOX Live Gateway Address..<br />
|-<br />
| 0xB4<br />
| 0xB7<br />
| XBOX Live Subnet Mask..<br />
|-<br />
| 0xB8<br />
| 0xBB<br />
| Other XBLive settings ?<br />
|-<br />
| 0xBC<br />
| 0xBF<br />
| DVD Playback Kit Zone<br />
|-<br />
| 0xC0<br />
| 0xFF<br />
| Unknown Codes / History ? do not change any values in this region <br />
|-<br />
|}<br />
<br />
Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].<br />
<br />
<sup>*</sup>Configmagic-FINAL-1.6 uses the wrong size when computing Checksum2 (40 instead of 44 bytes) and Checksum3 (96 instead of 92 bytes). Checksum2 value computed was correct only because the extra 4 bytes not used in the CRC computation were all 0's which does not change the CRC value. However, a similiar problem with computation of Checksum3 is present. The CRC computed for v1.6 Xbox's is incorrect as the 4 extra bytes are not 0's as on earlier versions.<br />
<br />
== Reading/Writing the EEPROM ==<br />
<br />
=== Software Method ===<br />
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.<br />
<br />
=== Hardware Method ===<br />
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see [http://dangerousprototypes.com/blog/bus-pirate-manual/ here]<br />
or [https://www.totalphase.com/products/aardvark-i2cspi/ here]), build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. Then use the corresponding software to read/write the EEPROM.<br />
<br />
<br />
==The HMAC HDD Key==<br />
<br />
The HMAC HDD Key is generated out of the first 48 bytes. This section has been identified clearly.<br />
<br />
<br />
==The Region Code==<br />
<br />
This DWORD is encrypted. It corresponds to the region code in the XBE header:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| 0x00000001<br />
| North America<br />
|-<br />
| 0x00000002<br />
| Japan<br />
|-<br />
| 0x00000004<br />
| Europe / Australia<br />
|-<br />
| 0x80000000<br />
| Manufacturing plant<br />
|}<br />
<br />
==The MAC address==<br />
<br />
This is the MAC address of the Ethernet hardware, which has been [https://web.archive.org/web/20100617020733/http://standards.ieee.org/regauth/oui/oui_public.txt issued by the IEEE].<br />
<br />
<br />
==DVD Region==<br />
<br />
This DWORD corresponds to the region code for playback of DVD movies:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| 0x00000000<br />
| None<br />
|-<br />
| 0x00000001<br />
| Region 1<br />
|-<br />
| ...<br />
| ...<br />
|-<br />
| 0x00000006<br />
| Region 6<br />
|}<br />
<br />
== Checksum Algorithm ==<br />
<br />
Checksum2 and Checksum3 values can be calculated by running the following code snippet over the area the checksum covers:<br />
<br />
<pre> /* The EepromCRC algorithm was obtained from the XKUtils 0.2 source released by<br />
* TeamAssembly under the GNU GPL.<br />
* Specifically, from XKCRC.cpp<br />
*<br />
* Rewritten to ANSI C by David Pye (dmp@davidmpye.dyndns.org)<br />
*<br />
* Thanks! */<br />
void EepromCRC(unsigned char *crc, unsigned char *data, long dataLen) {<br />
unsigned char* CRC_Data = (unsigned char *)malloc(dataLen+4);<br />
int pos=0;<br />
memset(crc,0x00,4);<br />
<br />
memset(CRC_Data,0x00, dataLen+4);<br />
//Circle shift input data one byte right<br />
memcpy(CRC_Data + 0x01 , data, dataLen-1);<br />
memcpy(CRC_Data, data + dataLen-1, 0x01);<br />
<br />
for (pos=0; pos&lt;4; ++pos) {<br />
unsigned short CRCPosVal = 0xFFFF;<br />
unsigned long l;<br />
for (l=pos; l&lt;dataLen; l+=4) {<br />
CRCPosVal -= *(unsigned short*)(&amp;CRC_Data[l]);<br />
}<br />
CRCPosVal &amp;= 0xFF00;<br />
crc[pos] = (unsigned char) (CRCPosVal &gt;&gt; 8);<br />
}<br />
free(CRC_Data);<br />
}<br />
</pre><br />
<br />
== Read Checksum Algorithm ==<br />
<br />
When the Xbox reads from the FACTORY_SETTINGS or the USER_SETTINGS section of the EEPROM, this algorithm is ran over the entire section accessed (including the CRC checksum mentioned above) to ensure that the data is valid. If the result of the checksum algorithm does not equal 0xFFFFFFFF, STATUS_DEVICE_DATA_ERROR is returned from the Kernel.<br />
<br />
<pre>static uint32_t eeprom_section_checksum(<br />
const uint32_t* section_data,<br />
uint32_t section_data_length<br />
)<br />
{<br />
const uint32_t bitmask = 0xFFFFFFFF;<br />
const uint32_t num_dwords = section_data_length >> 2;<br />
uint64_t checksum = 0;<br />
uint32_t carry_count = 0;<br />
<br />
for(uint32_t loop_count = num_dwords; loop_count > 0; loop_count--) {<br />
checksum += *section_data;<br />
if(checksum > bitmask) {<br />
carry_count++;<br />
checksum &= bitmask;<br />
}<br />
section_data++;<br />
}<br />
checksum += carry_count;<br />
if(checksum > bitmask) {<br />
checksum += 1;<br />
}<br />
return (uint32_t)(checksum & bitmask);<br />
}<br />
</pre><br />
<br />
== Further Reading ==<br />
<br />
* [https://web.archive.org/web/20040604013125/http://console-dev.com:80/eeprom.htm Information about EEPROM contents]<br />
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip with a Raspberry Pi]<br />
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]<br />
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=EEPROM&diff=6587EEPROM2018-10-19T19:57:58Z<p>KaosEngineer: 0x40-0x45 MAC address. Added info as they start with 00:50:F2 and another one I can't remember and data locked out on glitched FW HDD so can't look for it. :(</p>
<hr />
<div>The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.<br />
Parts of the EEPROM are encrypted using [[Kernel/XboxEEPROMKey]].<br />
<br />
== Contents ==<br />
<br />
{| class="wikitable"<br />
! Start !! End !! Notes<br />
|-<br />
| 0x00<br />
| 0x13<br />
| HMAC_SHA1 Hash<br />
|-<br />
| 0x14<br />
| 0x1B<br />
| RC4 Encrypted Confounder ??<br />
|-<br />
| 0x1C<br />
| 0x2B<br />
| RC4 Encrypted HDD key<br />
|-<br />
| 0x2C<br />
| 0x2F<br />
| RC4 Encrypted Region code<br />
* 0x01 = North America<br />
* 0x02 = Japan<br />
* 0x04 = Europe & Australia<br />
|-<br />
| 0x30<br />
| 0x33<br />
| Checksum2 - Checksum of next 44 (0x2C) bytes (0x34 - 0x5F)<sup>*</sup><br />
|-<br />
| 0x34<br />
| 0x3F<br />
| Xbox serial number - (ASCII chars 0x30 - 0x39 to match each digit in SN)<br />
|-<br />
| 0x40<br />
| 0x45<br />
| Ethernet MAC address (Microsoft Xbox - 00:50:F2:xx:xx:xx)<br />
|-<br />
| 0x46<br />
| 0x47<br />
| Unknown Padding ?<br />
|-<br />
| 0x48<br />
| 0x57<br />
| Online Key ?<br />
|-<br />
| 0x58<br />
| 0x5B<br />
| Video Standard<br />
* 0x00000000 = not set (INVALID)<br />
* 0x00400100 = NTSC-M<br />
* 0x00400200 = NTSC-J<br />
* 0x00800300 = PAL-I<br />
* 0x00400400 = PAL-M<br />
|-<br />
| 0x5C<br />
| 0x5F<br />
| Unknown Padding ?<br />
|-<br />
| 0x60<br />
| 0x63<br />
| Checksum3 - Checksum of the next 92 (0x5C) bytes (0x64 - 0xBF)<sup>*</sup><br />
|-<br />
| 0x64<br />
| 0x67<br />
| Zone Bias - Offset in # minutes to subtract from GMT time <br />
(e.g., for GMT-06 Central; 6hr = 360min = 0x00000168)<br />
|-<br />
| 0x68<br />
| 0x6B<br />
| Standard Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CST\0, ACST)<br />
|-<br />
| 0x6C<br />
| 0x6F<br />
| Daylight Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CDT\0, ACDT)<br />
|-<br />
| 0x70<br />
| 0x77<br />
| Unknown Padding ?<br />
|-<br />
| 0x78<br />
| 0x7B<br />
| Standard Time Starts 10-05-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x7C<br />
| 0x7F<br />
| Daylight Savings Time Starts 04-01-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x80<br />
| 0x87<br />
| Unknown Padding ?<br />
|-<br />
| 0x88<br />
| 0x8B<br />
| Standard Timezone Bias; if not DST, 0 (0x00000000) minute time adjust<br />
|-<br />
| 0x8C<br />
| 0x8F<br />
| Daylight Savings Time Bias; if DST, -60 (0xFFFFFFC4) minute time adjust<br />
|-<br />
| 0x90<br />
| 0x93<br />
| Language ID (0 = not set) 1 byte at offset 0x90 data 4-byte aligned adds the 3 remaining bytes of 0x00<br />
{| class="wikitable"<br />
! Language !! EEPROM Value @ 0x90<br />
|-<br />
| English<br />
| 0x01 <br />
|-<br />
| Japanese<br />
| 0x02<br />
|-<br />
| German<br />
| 0x03<br />
|-<br />
| French<br />
| 0x04<br />
|-<br />
| Spanish<br />
| 0x05<br />
|-<br />
| Italian<br />
| 0x06<br />
|-<br />
| Korean<br />
| 0x07<br />
|-<br />
| Chinese<br />
| 0x08<br />
|-<br />
| Portuguese<br />
| 0x09<br />
|}<br />
|-<br />
| 0x94<br />
| 0x97<br />
| Video Settings<br />
<br />
Offset 0x96:<br />
* 0x??=Normal{{FIXME}}<br />
* 0xB0=Widescreen<br />
* 0xB4=Letterbox<br />
|-<br />
| 0x98<br />
| 0x9B<br />
| Audio Settings<br />
|-<br />
| 0x9C<br />
| 0x9F<br />
| Games Parental Control (0 = Max rating) 1 byte at offset 0x9C data 4-byte aligned adds the 3 remaining bytes of 0x00<br />
{| class="wikitable"<br />
! Xbox Game Rating !! EEPROM Value @ 0x9C<br />
|-<br />
| (RP) Rating Pending (Max)<br />
| 0x00<br />
|-<br />
| (AO) Adults Only <br />
| 0x01<br />
|-<br />
| (M) Mature <br />
| 0x02<br />
|-<br />
| (T) Teen <br />
| 0x03<br />
|-<br />
| (E) Everyone <br />
| 0x04<br />
|-<br />
| (K-A) Kids to Adults <br />
| 0x05<br />
|-<br />
| (EC) Early Childhood <br />
| 0x06<br />
|}<br />
|-<br />
| 0xA0<br />
| 0xA3<br />
| Parental Control Passcode; 4 button sequence (each key stored in a nibble)<br />
* 0x1 = {{input-dy+}} or {{input-ly+}}<br />
* 0x2 = {{input-dy-}} or {{input-ly-}}<br />
* 0x3 = {{input-dx-}} or {{input-lx-}}<br />
* 0x4 = {{input-dx+}} or {{input-lx+}}<br />
* 0x7 = {{input-x}}<br />
* 0x8 = {{input-y}}<br />
* 0xB = {{input-lt}}<br />
* 0xC = {{input-rt}}<br />
* 0 = Disabled{{FIXME|reason=Is this 0x00000000 only, or are shorter codes possible? can a middle section be 0x00 or would that end the sequence?}}<br />
<br />
Note:{{FIXME|reason=Not sure this is the proper place to describe and formatting sucks not used mediawiki that much still learning}}<br />
* EEPROM offset 0xA0: <code>23 14 00 00</code><br />
* Little Endian value 0x00001423.<br />
* The pass code is D-pad directions up (0x1), right (0x4), down (0x2), left (0x3). <br />
* Pass code is only 2 bytes not 4, each button is stored as a nibble in the word. First button in the most significant nibble and last in the least significant nibble. <br />
* Data in the EEPROM is aligned to double word (4-byte) boundaries. Thus, the two extra bytes at 0xA2 and 0xA3 of 0x00.<br />
|-<br />
| 0xA4<br />
| 0xA7<br />
| Movies Parental Control (0 = Max rating) only 1 byte necessary, the 3 remaining bytes for multiple of 4-byte data alignment{{FIXME|reason=Re-word alignment description. The reason for the extra 3 bytes.}}<br />
{| class="wikitable"<br />
! Xbox Movie Rating !! EEPROM Value @ 0xA4<br />
|-<br />
| 8 (Max)<br />
| 0x00<br />
|-<br />
| 7 (NC-17) <br />
| 0x01<br />
|-<br />
| 6 (R)<br />
| 0x02 <br />
|-<br />
| 5<br />
| 0x03 <br />
|-<br />
| 4 (PG-13)<br />
| 0x04<br />
|-<br />
| 3 (PG)<br />
| 0x05<br />
|-<br />
| 2<br />
| 0x06 <br />
|-<br />
| 1 (G)<br />
| 0x07 <br />
|}<br />
|- <br />
| 0xA8<br />
| 0xAB<br />
| XBOX Live IP Address..<br />
|-<br />
| 0xAC<br />
| 0xAF<br />
| XBOX Live DNS Server..<br />
|-<br />
| 0xB0<br />
| 0xB3<br />
| XBOX Live Gateway Address..<br />
|-<br />
| 0xB4<br />
| 0xB7<br />
| XBOX Live Subnet Mask..<br />
|-<br />
| 0xB8<br />
| 0xBB<br />
| Other XBLive settings ?<br />
|-<br />
| 0xBC<br />
| 0xBF<br />
| DVD Playback Kit Zone<br />
|-<br />
| 0xC0<br />
| 0xFF<br />
| Unknown Codes / History ? do not change any values in this region <br />
|-<br />
|}<br />
<br />
Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].<br />
<br />
<sup>*</sup>Configmagic-FINAL-1.6 uses the wrong size when computing Checksum2 (40 instead of 44 bytes) and Checksum3 (96 instead of 92 bytes). Checksum2 value computed was correct only because the extra 4 bytes not used in the CRC computation were all 0's which does not change the CRC value. However, a similiar problem with computation of Checksum3 is present. The CRC computed for v1.6 Xbox's is incorrect as the 4 extra bytes are not 0's as on earlier versions.<br />
<br />
== Reading/Writing the EEPROM ==<br />
<br />
=== Software Method ===<br />
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.<br />
<br />
=== Hardware Method ===<br />
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see [http://dangerousprototypes.com/blog/bus-pirate-manual/ here]<br />
or [https://www.totalphase.com/products/aardvark-i2cspi/ here]), build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. Then use the corresponding software to read/write the EEPROM.<br />
<br />
<br />
==The HMAC HDD Key==<br />
<br />
The HMAC HDD Key is generated out of the first 48 bytes. This section has been identified clearly.<br />
<br />
<br />
==The Region Code==<br />
<br />
This DWORD is encrypted. It corresponds to the region code in the XBE header:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| 0x00000001<br />
| North America<br />
|-<br />
| 0x00000002<br />
| Japan<br />
|-<br />
| 0x00000004<br />
| Europe / Australia<br />
|-<br />
| 0x80000000<br />
| Manufacturing plant<br />
|}<br />
<br />
==The MAC address==<br />
<br />
This is the MAC address of the Ethernet hardware, which has been [https://web.archive.org/web/20100617020733/http://standards.ieee.org/regauth/oui/oui_public.txt issued by the IEEE].<br />
<br />
<br />
==DVD Region==<br />
<br />
This DWORD corresponds to the region code for playback of DVD movies:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| 0x00000000<br />
| None<br />
|-<br />
| 0x00000001<br />
| Region 1<br />
|-<br />
| ...<br />
| ...<br />
|-<br />
| 0x00000006<br />
| Region 6<br />
|}<br />
<br />
== Checksum Algorithm ==<br />
<br />
Checksum2 and Checksum3 values can be calculated by running the following code snippet over the area the checksum covers:<br />
<br />
<pre> /* The EepromCRC algorithm was obtained from the XKUtils 0.2 source released by<br />
* TeamAssembly under the GNU GPL.<br />
* Specifically, from XKCRC.cpp<br />
*<br />
* Rewritten to ANSI C by David Pye (dmp@davidmpye.dyndns.org)<br />
*<br />
* Thanks! */<br />
void EepromCRC(unsigned char *crc, unsigned char *data, long dataLen) {<br />
unsigned char* CRC_Data = (unsigned char *)malloc(dataLen+4);<br />
int pos=0;<br />
memset(crc,0x00,4);<br />
<br />
memset(CRC_Data,0x00, dataLen+4);<br />
//Circle shift input data one byte right<br />
memcpy(CRC_Data + 0x01 , data, dataLen-1);<br />
memcpy(CRC_Data, data + dataLen-1, 0x01);<br />
<br />
for (pos=0; pos&lt;4; ++pos) {<br />
unsigned short CRCPosVal = 0xFFFF;<br />
unsigned long l;<br />
for (l=pos; l&lt;dataLen; l+=4) {<br />
CRCPosVal -= *(unsigned short*)(&amp;CRC_Data[l]);<br />
}<br />
CRCPosVal &amp;= 0xFF00;<br />
crc[pos] = (unsigned char) (CRCPosVal &gt;&gt; 8);<br />
}<br />
free(CRC_Data);<br />
}<br />
</pre><br />
<br />
== Read Checksum Algorithm ==<br />
<br />
When the Xbox reads from the FACTORY_SETTINGS or the USER_SETTINGS section of the EEPROM, this algorithm is ran over the entire section accessed (including the CRC checksum mentioned above) to ensure that the data is valid. If the result of the checksum algorithm does not equal 0xFFFFFFFF, STATUS_DEVICE_DATA_ERROR is returned from the Kernel.<br />
<br />
<pre>static uint32_t eeprom_section_checksum(<br />
const uint32_t* section_data,<br />
uint32_t section_data_length<br />
)<br />
{<br />
const uint32_t bitmask = 0xFFFFFFFF;<br />
const uint32_t num_dwords = section_data_length >> 2;<br />
uint64_t checksum = 0;<br />
uint32_t carry_count = 0;<br />
<br />
for(uint32_t loop_count = num_dwords; loop_count > 0; loop_count--) {<br />
checksum += *section_data;<br />
if(checksum > bitmask) {<br />
carry_count++;<br />
checksum &= bitmask;<br />
}<br />
section_data++;<br />
}<br />
checksum += carry_count;<br />
if(checksum > bitmask) {<br />
checksum += 1;<br />
}<br />
return (uint32_t)(checksum & bitmask);<br />
}<br />
</pre><br />
<br />
== Further Reading ==<br />
<br />
* [https://web.archive.org/web/20040604013125/http://console-dev.com:80/eeprom.htm Information about EEPROM contents]<br />
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip with a Raspberry Pi]<br />
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]<br />
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=EEPROM&diff=6586EEPROM2018-10-19T19:52:20Z<p>KaosEngineer: 0x2C-0x2F region Europe also includes Australia for value 0x04 (noted in XBMC4Xbox source code updates in XKEEPROM.h file)</p>
<hr />
<div>The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.<br />
Parts of the EEPROM are encrypted using [[Kernel/XboxEEPROMKey]].<br />
<br />
== Contents ==<br />
<br />
{| class="wikitable"<br />
! Start !! End !! Notes<br />
|-<br />
| 0x00<br />
| 0x13<br />
| HMAC_SHA1 Hash<br />
|-<br />
| 0x14<br />
| 0x1B<br />
| RC4 Encrypted Confounder ??<br />
|-<br />
| 0x1C<br />
| 0x2B<br />
| RC4 Encrypted HDD key<br />
|-<br />
| 0x2C<br />
| 0x2F<br />
| RC4 Encrypted Region code<br />
* 0x01 = North America<br />
* 0x02 = Japan<br />
* 0x04 = Europe & Australia<br />
|-<br />
| 0x30<br />
| 0x33<br />
| Checksum2 - Checksum of next 44 (0x2C) bytes (0x34 - 0x5F)<sup>*</sup><br />
|-<br />
| 0x34<br />
| 0x3F<br />
| Xbox serial number - (ASCII chars 0x30 - 0x39 to match each digit in SN)<br />
|-<br />
| 0x40<br />
| 0x45<br />
| Ethernet MAC address<br />
|-<br />
| 0x46<br />
| 0x47<br />
| Unknown Padding ?<br />
|-<br />
| 0x48<br />
| 0x57<br />
| Online Key ?<br />
|-<br />
| 0x58<br />
| 0x5B<br />
| Video Standard<br />
* 0x00000000 = not set (INVALID)<br />
* 0x00400100 = NTSC-M<br />
* 0x00400200 = NTSC-J<br />
* 0x00800300 = PAL-I<br />
* 0x00400400 = PAL-M<br />
|-<br />
| 0x5C<br />
| 0x5F<br />
| Unknown Padding ?<br />
|-<br />
| 0x60<br />
| 0x63<br />
| Checksum3 - Checksum of the next 92 (0x5C) bytes (0x64 - 0xBF)<sup>*</sup><br />
|-<br />
| 0x64<br />
| 0x67<br />
| Zone Bias - Offset in # minutes to subtract from GMT time <br />
(e.g., for GMT-06 Central; 6hr = 360min = 0x00000168)<br />
|-<br />
| 0x68<br />
| 0x6B<br />
| Standard Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CST\0, ACST)<br />
|-<br />
| 0x6C<br />
| 0x6F<br />
| Daylight Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CDT\0, ACDT)<br />
|-<br />
| 0x70<br />
| 0x77<br />
| Unknown Padding ?<br />
|-<br />
| 0x78<br />
| 0x7B<br />
| Standard Time Starts 10-05-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x7C<br />
| 0x7F<br />
| Daylight Savings Time Starts 04-01-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x80<br />
| 0x87<br />
| Unknown Padding ?<br />
|-<br />
| 0x88<br />
| 0x8B<br />
| Standard Timezone Bias; if not DST, 0 (0x00000000) minute time adjust<br />
|-<br />
| 0x8C<br />
| 0x8F<br />
| Daylight Savings Time Bias; if DST, -60 (0xFFFFFFC4) minute time adjust<br />
|-<br />
| 0x90<br />
| 0x93<br />
| Language ID (0 = not set) 1 byte at offset 0x90 data 4-byte aligned adds the 3 remaining bytes of 0x00<br />
{| class="wikitable"<br />
! Language !! EEPROM Value @ 0x90<br />
|-<br />
| English<br />
| 0x01 <br />
|-<br />
| Japanese<br />
| 0x02<br />
|-<br />
| German<br />
| 0x03<br />
|-<br />
| French<br />
| 0x04<br />
|-<br />
| Spanish<br />
| 0x05<br />
|-<br />
| Italian<br />
| 0x06<br />
|-<br />
| Korean<br />
| 0x07<br />
|-<br />
| Chinese<br />
| 0x08<br />
|-<br />
| Portuguese<br />
| 0x09<br />
|}<br />
|-<br />
| 0x94<br />
| 0x97<br />
| Video Settings<br />
<br />
Offset 0x96:<br />
* 0x??=Normal{{FIXME}}<br />
* 0xB0=Widescreen<br />
* 0xB4=Letterbox<br />
|-<br />
| 0x98<br />
| 0x9B<br />
| Audio Settings<br />
|-<br />
| 0x9C<br />
| 0x9F<br />
| Games Parental Control (0 = Max rating) 1 byte at offset 0x9C data 4-byte aligned adds the 3 remaining bytes of 0x00<br />
{| class="wikitable"<br />
! Xbox Game Rating !! EEPROM Value @ 0x9C<br />
|-<br />
| (RP) Rating Pending (Max)<br />
| 0x00<br />
|-<br />
| (AO) Adults Only <br />
| 0x01<br />
|-<br />
| (M) Mature <br />
| 0x02<br />
|-<br />
| (T) Teen <br />
| 0x03<br />
|-<br />
| (E) Everyone <br />
| 0x04<br />
|-<br />
| (K-A) Kids to Adults <br />
| 0x05<br />
|-<br />
| (EC) Early Childhood <br />
| 0x06<br />
|}<br />
|-<br />
| 0xA0<br />
| 0xA3<br />
| Parental Control Passcode; 4 button sequence (each key stored in a nibble)<br />
* 0x1 = {{input-dy+}} or {{input-ly+}}<br />
* 0x2 = {{input-dy-}} or {{input-ly-}}<br />
* 0x3 = {{input-dx-}} or {{input-lx-}}<br />
* 0x4 = {{input-dx+}} or {{input-lx+}}<br />
* 0x7 = {{input-x}}<br />
* 0x8 = {{input-y}}<br />
* 0xB = {{input-lt}}<br />
* 0xC = {{input-rt}}<br />
* 0 = Disabled{{FIXME|reason=Is this 0x00000000 only, or are shorter codes possible? can a middle section be 0x00 or would that end the sequence?}}<br />
<br />
Note:{{FIXME|reason=Not sure this is the proper place to describe and formatting sucks not used mediawiki that much still learning}}<br />
* EEPROM offset 0xA0: <code>23 14 00 00</code><br />
* Little Endian value 0x00001423.<br />
* The pass code is D-pad directions up (0x1), right (0x4), down (0x2), left (0x3). <br />
* Pass code is only 2 bytes not 4, each button is stored as a nibble in the word. First button in the most significant nibble and last in the least significant nibble. <br />
* Data in the EEPROM is aligned to double word (4-byte) boundaries. Thus, the two extra bytes at 0xA2 and 0xA3 of 0x00.<br />
|-<br />
| 0xA4<br />
| 0xA7<br />
| Movies Parental Control (0 = Max rating) only 1 byte necessary, the 3 remaining bytes for multiple of 4-byte data alignment{{FIXME|reason=Re-word alignment description. The reason for the extra 3 bytes.}}<br />
{| class="wikitable"<br />
! Xbox Movie Rating !! EEPROM Value @ 0xA4<br />
|-<br />
| 8 (Max)<br />
| 0x00<br />
|-<br />
| 7 (NC-17) <br />
| 0x01<br />
|-<br />
| 6 (R)<br />
| 0x02 <br />
|-<br />
| 5<br />
| 0x03 <br />
|-<br />
| 4 (PG-13)<br />
| 0x04<br />
|-<br />
| 3 (PG)<br />
| 0x05<br />
|-<br />
| 2<br />
| 0x06 <br />
|-<br />
| 1 (G)<br />
| 0x07 <br />
|}<br />
|- <br />
| 0xA8<br />
| 0xAB<br />
| XBOX Live IP Address..<br />
|-<br />
| 0xAC<br />
| 0xAF<br />
| XBOX Live DNS Server..<br />
|-<br />
| 0xB0<br />
| 0xB3<br />
| XBOX Live Gateway Address..<br />
|-<br />
| 0xB4<br />
| 0xB7<br />
| XBOX Live Subnet Mask..<br />
|-<br />
| 0xB8<br />
| 0xBB<br />
| Other XBLive settings ?<br />
|-<br />
| 0xBC<br />
| 0xBF<br />
| DVD Playback Kit Zone<br />
|-<br />
| 0xC0<br />
| 0xFF<br />
| Unknown Codes / History ? do not change any values in this region <br />
|-<br />
|}<br />
<br />
Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].<br />
<br />
<sup>*</sup>Configmagic-FINAL-1.6 uses the wrong size when computing Checksum2 (40 instead of 44 bytes) and Checksum3 (96 instead of 92 bytes). Checksum2 value computed was correct only because the extra 4 bytes not used in the CRC computation were all 0's which does not change the CRC value. However, a similiar problem with computation of Checksum3 is present. The CRC computed for v1.6 Xbox's is incorrect as the 4 extra bytes are not 0's as on earlier versions.<br />
<br />
== Reading/Writing the EEPROM ==<br />
<br />
=== Software Method ===<br />
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.<br />
<br />
=== Hardware Method ===<br />
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see [http://dangerousprototypes.com/blog/bus-pirate-manual/ here]<br />
or [https://www.totalphase.com/products/aardvark-i2cspi/ here]), build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. Then use the corresponding software to read/write the EEPROM.<br />
<br />
<br />
==The HMAC HDD Key==<br />
<br />
The HMAC HDD Key is generated out of the first 48 bytes. This section has been identified clearly.<br />
<br />
<br />
==The Region Code==<br />
<br />
This DWORD is encrypted. It corresponds to the region code in the XBE header:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| 0x00000001<br />
| North America<br />
|-<br />
| 0x00000002<br />
| Japan<br />
|-<br />
| 0x00000004<br />
| Europe / Australia<br />
|-<br />
| 0x80000000<br />
| Manufacturing plant<br />
|}<br />
<br />
==The MAC address==<br />
<br />
This is the MAC address of the Ethernet hardware, which has been [https://web.archive.org/web/20100617020733/http://standards.ieee.org/regauth/oui/oui_public.txt issued by the IEEE].<br />
<br />
<br />
==DVD Region==<br />
<br />
This DWORD corresponds to the region code for playback of DVD movies:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| 0x00000000<br />
| None<br />
|-<br />
| 0x00000001<br />
| Region 1<br />
|-<br />
| ...<br />
| ...<br />
|-<br />
| 0x00000006<br />
| Region 6<br />
|}<br />
<br />
== Checksum Algorithm ==<br />
<br />
Checksum2 and Checksum3 values can be calculated by running the following code snippet over the area the checksum covers:<br />
<br />
<pre> /* The EepromCRC algorithm was obtained from the XKUtils 0.2 source released by<br />
* TeamAssembly under the GNU GPL.<br />
* Specifically, from XKCRC.cpp<br />
*<br />
* Rewritten to ANSI C by David Pye (dmp@davidmpye.dyndns.org)<br />
*<br />
* Thanks! */<br />
void EepromCRC(unsigned char *crc, unsigned char *data, long dataLen) {<br />
unsigned char* CRC_Data = (unsigned char *)malloc(dataLen+4);<br />
int pos=0;<br />
memset(crc,0x00,4);<br />
<br />
memset(CRC_Data,0x00, dataLen+4);<br />
//Circle shift input data one byte right<br />
memcpy(CRC_Data + 0x01 , data, dataLen-1);<br />
memcpy(CRC_Data, data + dataLen-1, 0x01);<br />
<br />
for (pos=0; pos&lt;4; ++pos) {<br />
unsigned short CRCPosVal = 0xFFFF;<br />
unsigned long l;<br />
for (l=pos; l&lt;dataLen; l+=4) {<br />
CRCPosVal -= *(unsigned short*)(&amp;CRC_Data[l]);<br />
}<br />
CRCPosVal &amp;= 0xFF00;<br />
crc[pos] = (unsigned char) (CRCPosVal &gt;&gt; 8);<br />
}<br />
free(CRC_Data);<br />
}<br />
</pre><br />
<br />
== Read Checksum Algorithm ==<br />
<br />
When the Xbox reads from the FACTORY_SETTINGS or the USER_SETTINGS section of the EEPROM, this algorithm is ran over the entire section accessed (including the CRC checksum mentioned above) to ensure that the data is valid. If the result of the checksum algorithm does not equal 0xFFFFFFFF, STATUS_DEVICE_DATA_ERROR is returned from the Kernel.<br />
<br />
<pre>static uint32_t eeprom_section_checksum(<br />
const uint32_t* section_data,<br />
uint32_t section_data_length<br />
)<br />
{<br />
const uint32_t bitmask = 0xFFFFFFFF;<br />
const uint32_t num_dwords = section_data_length >> 2;<br />
uint64_t checksum = 0;<br />
uint32_t carry_count = 0;<br />
<br />
for(uint32_t loop_count = num_dwords; loop_count > 0; loop_count--) {<br />
checksum += *section_data;<br />
if(checksum > bitmask) {<br />
carry_count++;<br />
checksum &= bitmask;<br />
}<br />
section_data++;<br />
}<br />
checksum += carry_count;<br />
if(checksum > bitmask) {<br />
checksum += 1;<br />
}<br />
return (uint32_t)(checksum & bitmask);<br />
}<br />
</pre><br />
<br />
== Further Reading ==<br />
<br />
* [https://web.archive.org/web/20040604013125/http://console-dev.com:80/eeprom.htm Information about EEPROM contents]<br />
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip with a Raspberry Pi]<br />
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]<br />
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=EEPROM&diff=6585EEPROM2018-10-19T19:43:20Z<p>KaosEngineer: Added info for video standard at offset 0x58-0x5B for not set and PAL-M</p>
<hr />
<div>The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.<br />
Parts of the EEPROM are encrypted using [[Kernel/XboxEEPROMKey]].<br />
<br />
== Contents ==<br />
<br />
{| class="wikitable"<br />
! Start !! End !! Notes<br />
|-<br />
| 0x00<br />
| 0x13<br />
| HMAC_SHA1 Hash<br />
|-<br />
| 0x14<br />
| 0x1B<br />
| RC4 Encrypted Confounder ??<br />
|-<br />
| 0x1C<br />
| 0x2B<br />
| RC4 Encrypted HDD key<br />
|-<br />
| 0x2C<br />
| 0x2F<br />
| RC4 Encrypted Region code<br />
* 0x01 = North America<br />
* 0x02 = Japan<br />
* 0x04 = Europe<br />
|-<br />
| 0x30<br />
| 0x33<br />
| Checksum2 - Checksum of next 44 (0x2C) bytes (0x34 - 0x5F)<sup>*</sup><br />
|-<br />
| 0x34<br />
| 0x3F<br />
| Xbox serial number - (ASCII chars 0x30 - 0x39 to match each digit in SN)<br />
|-<br />
| 0x40<br />
| 0x45<br />
| Ethernet MAC address<br />
|-<br />
| 0x46<br />
| 0x47<br />
| Unknown Padding ?<br />
|-<br />
| 0x48<br />
| 0x57<br />
| Online Key ?<br />
|-<br />
| 0x58<br />
| 0x5B<br />
| Video Standard<br />
* 0x00000000 = not set (INVALID)<br />
* 0x00400100 = NTSC-M<br />
* 0x00400200 = NTSC-J<br />
* 0x00800300 = PAL-I<br />
* 0x00400400 = PAL-M<br />
|-<br />
| 0x5C<br />
| 0x5F<br />
| Unknown Padding ?<br />
|-<br />
| 0x60<br />
| 0x63<br />
| Checksum3 - Checksum of the next 92 (0x5C) bytes (0x64 - 0xBF)<sup>*</sup><br />
|-<br />
| 0x64<br />
| 0x67<br />
| Zone Bias - Offset in # minutes to subtract from GMT time <br />
(e.g., for GMT-06 Central; 6hr = 360min = 0x00000168)<br />
|-<br />
| 0x68<br />
| 0x6B<br />
| Standard Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CST\0, ACST)<br />
|-<br />
| 0x6C<br />
| 0x6F<br />
| Daylight Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CDT\0, ACDT)<br />
|-<br />
| 0x70<br />
| 0x77<br />
| Unknown Padding ?<br />
|-<br />
| 0x78<br />
| 0x7B<br />
| Standard Time Starts 10-05-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x7C<br />
| 0x7F<br />
| Daylight Savings Time Starts 04-01-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x80<br />
| 0x87<br />
| Unknown Padding ?<br />
|-<br />
| 0x88<br />
| 0x8B<br />
| Standard Timezone Bias; if not DST, 0 (0x00000000) minute time adjust<br />
|-<br />
| 0x8C<br />
| 0x8F<br />
| Daylight Savings Time Bias; if DST, -60 (0xFFFFFFC4) minute time adjust<br />
|-<br />
| 0x90<br />
| 0x93<br />
| Language ID (0 = not set) 1 byte at offset 0x90 data 4-byte aligned adds the 3 remaining bytes of 0x00<br />
{| class="wikitable"<br />
! Language !! EEPROM Value @ 0x90<br />
|-<br />
| English<br />
| 0x01 <br />
|-<br />
| Japanese<br />
| 0x02<br />
|-<br />
| German<br />
| 0x03<br />
|-<br />
| French<br />
| 0x04<br />
|-<br />
| Spanish<br />
| 0x05<br />
|-<br />
| Italian<br />
| 0x06<br />
|-<br />
| Korean<br />
| 0x07<br />
|-<br />
| Chinese<br />
| 0x08<br />
|-<br />
| Portuguese<br />
| 0x09<br />
|}<br />
|-<br />
| 0x94<br />
| 0x97<br />
| Video Settings<br />
<br />
Offset 0x96:<br />
* 0x??=Normal{{FIXME}}<br />
* 0xB0=Widescreen<br />
* 0xB4=Letterbox<br />
|-<br />
| 0x98<br />
| 0x9B<br />
| Audio Settings<br />
|-<br />
| 0x9C<br />
| 0x9F<br />
| Games Parental Control (0 = Max rating) 1 byte at offset 0x9C data 4-byte aligned adds the 3 remaining bytes of 0x00<br />
{| class="wikitable"<br />
! Xbox Game Rating !! EEPROM Value @ 0x9C<br />
|-<br />
| (RP) Rating Pending (Max)<br />
| 0x00<br />
|-<br />
| (AO) Adults Only <br />
| 0x01<br />
|-<br />
| (M) Mature <br />
| 0x02<br />
|-<br />
| (T) Teen <br />
| 0x03<br />
|-<br />
| (E) Everyone <br />
| 0x04<br />
|-<br />
| (K-A) Kids to Adults <br />
| 0x05<br />
|-<br />
| (EC) Early Childhood <br />
| 0x06<br />
|}<br />
|-<br />
| 0xA0<br />
| 0xA3<br />
| Parental Control Passcode; 4 button sequence (each key stored in a nibble)<br />
* 0x1 = {{input-dy+}} or {{input-ly+}}<br />
* 0x2 = {{input-dy-}} or {{input-ly-}}<br />
* 0x3 = {{input-dx-}} or {{input-lx-}}<br />
* 0x4 = {{input-dx+}} or {{input-lx+}}<br />
* 0x7 = {{input-x}}<br />
* 0x8 = {{input-y}}<br />
* 0xB = {{input-lt}}<br />
* 0xC = {{input-rt}}<br />
* 0 = Disabled{{FIXME|reason=Is this 0x00000000 only, or are shorter codes possible? can a middle section be 0x00 or would that end the sequence?}}<br />
<br />
Note:{{FIXME|reason=Not sure this is the proper place to describe and formatting sucks not used mediawiki that much still learning}}<br />
* EEPROM offset 0xA0: <code>23 14 00 00</code><br />
* Little Endian value 0x00001423.<br />
* The pass code is D-pad directions up (0x1), right (0x4), down (0x2), left (0x3). <br />
* Pass code is only 2 bytes not 4, each button is stored as a nibble in the word. First button in the most significant nibble and last in the least significant nibble. <br />
* Data in the EEPROM is aligned to double word (4-byte) boundaries. Thus, the two extra bytes at 0xA2 and 0xA3 of 0x00.<br />
|-<br />
| 0xA4<br />
| 0xA7<br />
| Movies Parental Control (0 = Max rating) only 1 byte necessary, the 3 remaining bytes for multiple of 4-byte data alignment{{FIXME|reason=Re-word alignment description. The reason for the extra 3 bytes.}}<br />
{| class="wikitable"<br />
! Xbox Movie Rating !! EEPROM Value @ 0xA4<br />
|-<br />
| 8 (Max)<br />
| 0x00<br />
|-<br />
| 7 (NC-17) <br />
| 0x01<br />
|-<br />
| 6 (R)<br />
| 0x02 <br />
|-<br />
| 5<br />
| 0x03 <br />
|-<br />
| 4 (PG-13)<br />
| 0x04<br />
|-<br />
| 3 (PG)<br />
| 0x05<br />
|-<br />
| 2<br />
| 0x06 <br />
|-<br />
| 1 (G)<br />
| 0x07 <br />
|}<br />
|- <br />
| 0xA8<br />
| 0xAB<br />
| XBOX Live IP Address..<br />
|-<br />
| 0xAC<br />
| 0xAF<br />
| XBOX Live DNS Server..<br />
|-<br />
| 0xB0<br />
| 0xB3<br />
| XBOX Live Gateway Address..<br />
|-<br />
| 0xB4<br />
| 0xB7<br />
| XBOX Live Subnet Mask..<br />
|-<br />
| 0xB8<br />
| 0xBB<br />
| Other XBLive settings ?<br />
|-<br />
| 0xBC<br />
| 0xBF<br />
| DVD Playback Kit Zone<br />
|-<br />
| 0xC0<br />
| 0xFF<br />
| Unknown Codes / History ? do not change any values in this region <br />
|-<br />
|}<br />
<br />
Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].<br />
<br />
<sup>*</sup>Configmagic-FINAL-1.6 uses the wrong size when computing Checksum2 (40 instead of 44 bytes) and Checksum3 (96 instead of 92 bytes). Checksum2 value computed was correct only because the extra 4 bytes not used in the CRC computation were all 0's which does not change the CRC value. However, a similiar problem with computation of Checksum3 is present. The CRC computed for v1.6 Xbox's is incorrect as the 4 extra bytes are not 0's as on earlier versions.<br />
<br />
== Reading/Writing the EEPROM ==<br />
<br />
=== Software Method ===<br />
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.<br />
<br />
=== Hardware Method ===<br />
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see [http://dangerousprototypes.com/blog/bus-pirate-manual/ here]<br />
or [https://www.totalphase.com/products/aardvark-i2cspi/ here]), build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. Then use the corresponding software to read/write the EEPROM.<br />
<br />
<br />
==The HMAC HDD Key==<br />
<br />
The HMAC HDD Key is generated out of the first 48 bytes. This section has been identified clearly.<br />
<br />
<br />
==The Region Code==<br />
<br />
This DWORD is encrypted. It corresponds to the region code in the XBE header:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| 0x00000001<br />
| North America<br />
|-<br />
| 0x00000002<br />
| Japan<br />
|-<br />
| 0x00000004<br />
| Europe / Australia<br />
|-<br />
| 0x80000000<br />
| Manufacturing plant<br />
|}<br />
<br />
==The MAC address==<br />
<br />
This is the MAC address of the Ethernet hardware, which has been [https://web.archive.org/web/20100617020733/http://standards.ieee.org/regauth/oui/oui_public.txt issued by the IEEE].<br />
<br />
<br />
==DVD Region==<br />
<br />
This DWORD corresponds to the region code for playback of DVD movies:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| 0x00000000<br />
| None<br />
|-<br />
| 0x00000001<br />
| Region 1<br />
|-<br />
| ...<br />
| ...<br />
|-<br />
| 0x00000006<br />
| Region 6<br />
|}<br />
<br />
== Checksum Algorithm ==<br />
<br />
Checksum2 and Checksum3 values can be calculated by running the following code snippet over the area the checksum covers:<br />
<br />
<pre> /* The EepromCRC algorithm was obtained from the XKUtils 0.2 source released by<br />
* TeamAssembly under the GNU GPL.<br />
* Specifically, from XKCRC.cpp<br />
*<br />
* Rewritten to ANSI C by David Pye (dmp@davidmpye.dyndns.org)<br />
*<br />
* Thanks! */<br />
void EepromCRC(unsigned char *crc, unsigned char *data, long dataLen) {<br />
unsigned char* CRC_Data = (unsigned char *)malloc(dataLen+4);<br />
int pos=0;<br />
memset(crc,0x00,4);<br />
<br />
memset(CRC_Data,0x00, dataLen+4);<br />
//Circle shift input data one byte right<br />
memcpy(CRC_Data + 0x01 , data, dataLen-1);<br />
memcpy(CRC_Data, data + dataLen-1, 0x01);<br />
<br />
for (pos=0; pos&lt;4; ++pos) {<br />
unsigned short CRCPosVal = 0xFFFF;<br />
unsigned long l;<br />
for (l=pos; l&lt;dataLen; l+=4) {<br />
CRCPosVal -= *(unsigned short*)(&amp;CRC_Data[l]);<br />
}<br />
CRCPosVal &amp;= 0xFF00;<br />
crc[pos] = (unsigned char) (CRCPosVal &gt;&gt; 8);<br />
}<br />
free(CRC_Data);<br />
}<br />
</pre><br />
<br />
== Read Checksum Algorithm ==<br />
<br />
When the Xbox reads from the FACTORY_SETTINGS or the USER_SETTINGS section of the EEPROM, this algorithm is ran over the entire section accessed (including the CRC checksum mentioned above) to ensure that the data is valid. If the result of the checksum algorithm does not equal 0xFFFFFFFF, STATUS_DEVICE_DATA_ERROR is returned from the Kernel.<br />
<br />
<pre>static uint32_t eeprom_section_checksum(<br />
const uint32_t* section_data,<br />
uint32_t section_data_length<br />
)<br />
{<br />
const uint32_t bitmask = 0xFFFFFFFF;<br />
const uint32_t num_dwords = section_data_length >> 2;<br />
uint64_t checksum = 0;<br />
uint32_t carry_count = 0;<br />
<br />
for(uint32_t loop_count = num_dwords; loop_count > 0; loop_count--) {<br />
checksum += *section_data;<br />
if(checksum > bitmask) {<br />
carry_count++;<br />
checksum &= bitmask;<br />
}<br />
section_data++;<br />
}<br />
checksum += carry_count;<br />
if(checksum > bitmask) {<br />
checksum += 1;<br />
}<br />
return (uint32_t)(checksum & bitmask);<br />
}<br />
</pre><br />
<br />
== Further Reading ==<br />
<br />
* [https://web.archive.org/web/20040604013125/http://console-dev.com:80/eeprom.htm Information about EEPROM contents]<br />
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip with a Raspberry Pi]<br />
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]<br />
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=EEPROM&diff=6503EEPROM2018-09-02T07:41:15Z<p>KaosEngineer: Reformatted values into a table instead of bullet point list.</p>
<hr />
<div>The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.<br />
Parts of the EEPROM are encrypted using [[Kernel/XboxEEPROMKey]].<br />
<br />
== Contents ==<br />
<br />
{| class="wikitable"<br />
! Start !! End !! Notes<br />
|-<br />
| 0x00<br />
| 0x13<br />
| HMAC_SHA1 Hash<br />
|-<br />
| 0x14<br />
| 0x1B<br />
| RC4 Encrypted Confounder ??<br />
|-<br />
| 0x1C<br />
| 0x2B<br />
| RC4 Encrypted HDD key<br />
|-<br />
| 0x2C<br />
| 0x2F<br />
| RC4 Encrypted Region code<br />
* 0x01 = North America<br />
* 0x02 = Japan<br />
* 0x04 = Europe<br />
|-<br />
| 0x30<br />
| 0x33<br />
| Checksum2 - Checksum of next 44 (0x2C) bytes (0x34 - 0x5F)<sup>*</sup><br />
|-<br />
| 0x34<br />
| 0x3F<br />
| Xbox serial number - (ASCII chars 0x30 - 0x39 to match each digit in SN)<br />
|-<br />
| 0x40<br />
| 0x45<br />
| Ethernet MAC address<br />
|-<br />
| 0x46<br />
| 0x47<br />
| Unknown Padding ?<br />
|-<br />
| 0x48<br />
| 0x57<br />
| Online Key ?<br />
|-<br />
| 0x58<br />
| 0x5B<br />
| Video Standard<br />
* 0x00400100 = NTSC-M<br />
* 0x00400200 = NTSC-J<br />
* 0x00800300 = PAL<br />
|-<br />
| 0x5C<br />
| 0x5F<br />
| Unknown Padding ?<br />
|-<br />
| 0x60<br />
| 0x63<br />
| Checksum3 - Checksum of the next 92 (0x5C) bytes (0x64 - 0xBF)<sup>*</sup><br />
|-<br />
| 0x64<br />
| 0x67<br />
| Zone Bias - Offset in # minutes to subtract from GMT time <br />
(e.g., for GMT-06 Central; 6hr = 360min = 0x00000168)<br />
|-<br />
| 0x68<br />
| 0x6B<br />
| Standard Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CST\0, ACST)<br />
|-<br />
| 0x6C<br />
| 0x6F<br />
| Daylight Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CDT\0, ACDT)<br />
|-<br />
| 0x70<br />
| 0x77<br />
| Unknown Padding ?<br />
|-<br />
| 0x78<br />
| 0x7B<br />
| Standard Time Starts 10-05-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x7C<br />
| 0x7F<br />
| Daylight Savings Time Starts 04-01-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x80<br />
| 0x87<br />
| Unknown Padding ?<br />
|-<br />
| 0x88<br />
| 0x8B<br />
| Standard Timezone Bias; if not DST, 0 (0x00000000) minute time adjust<br />
|-<br />
| 0x8C<br />
| 0x8F<br />
| Daylight Savings Time Bias; if DST, -60 (0xFFFFFFC4) minute time adjust<br />
|-<br />
| 0x90<br />
| 0x93<br />
| Language ID (0 = not set) 1 byte at offset 0x90 data 4-byte aligned adds the 3 remaining bytes of 0x00<br />
{| class="wikitable"<br />
! Language !! EEPROM Value @ 0x90<br />
|-<br />
| English<br />
| 0x01 <br />
|-<br />
| Japanese<br />
| 0x02<br />
|-<br />
| German<br />
| 0x03<br />
|-<br />
| French<br />
| 0x04<br />
|-<br />
| Spanish<br />
| 0x05<br />
|-<br />
| Italian<br />
| 0x06<br />
|-<br />
| Korean<br />
| 0x07<br />
|-<br />
| Chinese<br />
| 0x08<br />
|-<br />
| Portuguese<br />
| 0x09<br />
|}<br />
|-<br />
| 0x94<br />
| 0x97<br />
| Video Settings<br />
<br />
Offset 0x96:<br />
* 0x??=Normal{{FIXME}}<br />
* 0xB0=Widescreen<br />
* 0xB4=Letterbox<br />
|-<br />
| 0x98<br />
| 0x9B<br />
| Audio Settings<br />
|-<br />
| 0x9C<br />
| 0x9F<br />
| Games Parental Control (0 = Max rating) 1 byte at offset 0x9C data 4-byte aligned adds the 3 remaining bytes of 0x00<br />
{| class="wikitable"<br />
! Xbox Game Rating !! EEPROM Value @ 0x9C<br />
|-<br />
| (RP) Rating Pending (Max)<br />
| 0x00<br />
|-<br />
| (AO) Adults Only <br />
| 0x01<br />
|-<br />
| (M) Mature <br />
| 0x02<br />
|-<br />
| (T) Teen <br />
| 0x03<br />
|-<br />
| (E) Everyone <br />
| 0x04<br />
|-<br />
| (K-A) Kids to Adults <br />
| 0x05<br />
|-<br />
| (EC) Early Childhood <br />
| 0x06<br />
|}<br />
|-<br />
| 0xA0<br />
| 0xA3<br />
| Parental Control Passcode; 4 button sequence (each key stored in a nibble)<br />
* 0x1 = {{input-dy+}} or {{input-ly+}}<br />
* 0x2 = {{input-dy-}} or {{input-ly-}}<br />
* 0x3 = {{input-dx-}} or {{input-lx-}}<br />
* 0x4 = {{input-dx+}} or {{input-lx+}}<br />
* 0x7 = {{input-x}}<br />
* 0x8 = {{input-y}}<br />
* 0xB = {{input-lt}}<br />
* 0xC = {{input-rt}}<br />
* 0 = Disabled{{FIXME|reason=Is this 0x00000000 only, or are shorter codes possible? can a middle section be 0x00 or would that end the sequence?}}<br />
<br />
Note:{{FIXME|reason=Not sure this is the proper place to describe and formatting sucks not used mediawiki that much still learning}}<br />
* EEPROM offset 0xA0: <code>23 14 00 00</code><br />
* Little Endian value 0x00001423.<br />
* The pass code is D-pad directions up (0x1), right (0x4), down (0x2), left (0x3). <br />
* Pass code is only 2 bytes not 4, each button is stored as a nibble in the word. First button in the most significant nibble and last in the least significant nibble. <br />
* Data in the EEPROM is aligned to double word (4-byte) boundaries. Thus, the two extra bytes at 0xA2 and 0xA3 of 0x00.<br />
|-<br />
| 0xA4<br />
| 0xA7<br />
| Movies Parental Control (0 = Max rating) only 1 byte necessary, the 3 remaining bytes for multiple of 4-byte data alignment{{FIXME|reason=Re-word alignment description. The reason for the extra 3 bytes.}}<br />
{| class="wikitable"<br />
! Xbox Movie Rating !! EEPROM Value @ 0xA4<br />
|-<br />
| 8 (Max)<br />
| 0x00<br />
|-<br />
| 7 (NC-17) <br />
| 0x01<br />
|-<br />
| 6 (R)<br />
| 0x02 <br />
|-<br />
| 5<br />
| 0x03 <br />
|-<br />
| 4 (PG-13)<br />
| 0x04<br />
|-<br />
| 3 (PG)<br />
| 0x05<br />
|-<br />
| 2<br />
| 0x06 <br />
|-<br />
| 1 (G)<br />
| 0x07 <br />
|}<br />
|- <br />
| 0xA8<br />
| 0xAB<br />
| XBOX Live IP Address..<br />
|-<br />
| 0xAC<br />
| 0xAF<br />
| XBOX Live DNS Server..<br />
|-<br />
| 0xB0<br />
| 0xB3<br />
| XBOX Live Gateway Address..<br />
|-<br />
| 0xB4<br />
| 0xB7<br />
| XBOX Live Subnet Mask..<br />
|-<br />
| 0xB8<br />
| 0xBB<br />
| Other XBLive settings ?<br />
|-<br />
| 0xBC<br />
| 0xBF<br />
| DVD Playback Kit Zone<br />
|-<br />
| 0xC0<br />
| 0xFF<br />
| Unknown Codes / History ? do not change any values in this region <br />
|-<br />
|}<br />
<br />
Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].<br />
<br />
<sup>*</sup>Configmagic-FINAL-1.6 uses the wrong size when computing Checksum2 (40 instead of 44 bytes) and Checksum3 (96 instead of 92 bytes). Checksum2 value computed was correct only because the extra 4 bytes not used in the CRC computation were all 0's which does not change the CRC value. However, a similiar problem with computation of Checksum3 is present. The CRC computed for v1.6 Xbox's is incorrect as the 4 extra bytes are not 0's as on earlier versions.<br />
<br />
== Reading/Writing the EEPROM ==<br />
<br />
=== Software Method ===<br />
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.<br />
<br />
=== Hardware Method ===<br />
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see [http://dangerousprototypes.com/blog/bus-pirate-manual/ here]<br />
or [https://www.totalphase.com/products/aardvark-i2cspi/ here]), build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. Then use the corresponding software to read/write the EEPROM.<br />
<br />
<br />
==The HMAC HDD Key==<br />
<br />
The HMAC HDD Key is generated out of the first 48 bytes. This section has been identified clearly.<br />
<br />
<br />
==The Region Code==<br />
<br />
This DWORD is encrypted. It corresponds to the region code in the XBE header:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| 0x00000001<br />
| North America<br />
|-<br />
| 0x00000002<br />
| Japan<br />
|-<br />
| 0x00000004<br />
| Europe / Australia<br />
|-<br />
| 0x80000000<br />
| Manufacturing plant<br />
|}<br />
<br />
==The MAC address==<br />
<br />
This is the MAC address of the Ethernet hardware, which has been [https://web.archive.org/web/20100617020733/http://standards.ieee.org/regauth/oui/oui_public.txt issued by the IEEE].<br />
<br />
<br />
==DVD Region==<br />
<br />
This DWORD corresponds to the region code for playback of DVD movies:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| 0x00000000<br />
| None<br />
|-<br />
| 0x00000001<br />
| Region 1<br />
|-<br />
| ...<br />
| ...<br />
|-<br />
| 0x00000006<br />
| Region 6<br />
|}<br />
<br />
== Checksum Algorithm ==<br />
<br />
Checksum2 and Checksum3 values can be calculated by running the following code snippet over the area the checksum covers:<br />
<br />
<pre> /* The EepromCRC algorithm was obtained from the XKUtils 0.2 source released by<br />
* TeamAssembly under the GNU GPL.<br />
* Specifically, from XKCRC.cpp<br />
*<br />
* Rewritten to ANSI C by David Pye (dmp@davidmpye.dyndns.org)<br />
*<br />
* Thanks! */<br />
void EepromCRC(unsigned char *crc, unsigned char *data, long dataLen) {<br />
unsigned char* CRC_Data = (unsigned char *)malloc(dataLen+4);<br />
int pos=0;<br />
memset(crc,0x00,4);<br />
<br />
memset(CRC_Data,0x00, dataLen+4);<br />
//Circle shift input data one byte right<br />
memcpy(CRC_Data + 0x01 , data, dataLen-1);<br />
memcpy(CRC_Data, data + dataLen-1, 0x01);<br />
<br />
for (pos=0; pos&lt;4; ++pos) {<br />
unsigned short CRCPosVal = 0xFFFF;<br />
unsigned long l;<br />
for (l=pos; l&lt;dataLen; l+=4) {<br />
CRCPosVal -= *(unsigned short*)(&amp;CRC_Data[l]);<br />
}<br />
CRCPosVal &amp;= 0xFF00;<br />
crc[pos] = (unsigned char) (CRCPosVal &gt;&gt; 8);<br />
}<br />
free(CRC_Data);<br />
}<br />
</pre><br />
<br />
== Read Checksum Algorithm ==<br />
<br />
When the Xbox reads from the FACTORY_SETTINGS or the USER_SETTINGS section of the EEPROM, this algorithm is ran over the entire section accessed (including the CRC checksum mentioned above) to ensure that the data is valid. If the result of the checksum algorithm does not equal 0xFFFFFFFF, STATUS_DEVICE_DATA_ERROR is returned from the Kernel.<br />
<br />
<pre>static uint32_t eeprom_section_checksum(<br />
const uint32_t* section_data,<br />
uint32_t section_data_length<br />
)<br />
{<br />
const uint32_t bitmask = 0xFFFFFFFF;<br />
const uint32_t num_dwords = section_data_length >> 2;<br />
uint64_t checksum = 0;<br />
uint32_t carry_count = 0;<br />
<br />
for(uint32_t loop_count = num_dwords; loop_count > 0; loop_count--) {<br />
checksum += *section_data;<br />
if(checksum > bitmask) {<br />
carry_count++;<br />
checksum &= bitmask;<br />
}<br />
section_data++;<br />
}<br />
checksum += carry_count;<br />
if(checksum > bitmask) {<br />
checksum += 1;<br />
}<br />
return (uint32_t)(checksum & bitmask);<br />
}<br />
</pre><br />
<br />
== Further Reading ==<br />
<br />
* [https://web.archive.org/web/20040604013125/http://console-dev.com:80/eeprom.htm Information about EEPROM contents]<br />
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip with a Raspberry Pi]<br />
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]<br />
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=EEPROM&diff=6502EEPROM2018-09-02T07:33:37Z<p>KaosEngineer: Language and value stored in the configuration EEPROM (little endian LeastSigByte at offset 0x90 is the only byte with a non-0x00 value).</p>
<hr />
<div>The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.<br />
Parts of the EEPROM are encrypted using [[Kernel/XboxEEPROMKey]].<br />
<br />
== Contents ==<br />
<br />
{| class="wikitable"<br />
! Start !! End !! Notes<br />
|-<br />
| 0x00<br />
| 0x13<br />
| HMAC_SHA1 Hash<br />
|-<br />
| 0x14<br />
| 0x1B<br />
| RC4 Encrypted Confounder ??<br />
|-<br />
| 0x1C<br />
| 0x2B<br />
| RC4 Encrypted HDD key<br />
|-<br />
| 0x2C<br />
| 0x2F<br />
| RC4 Encrypted Region code<br />
* 0x01 = North America<br />
* 0x02 = Japan<br />
* 0x04 = Europe<br />
|-<br />
| 0x30<br />
| 0x33<br />
| Checksum2 - Checksum of next 44 (0x2C) bytes (0x34 - 0x5F)<sup>*</sup><br />
|-<br />
| 0x34<br />
| 0x3F<br />
| Xbox serial number - (ASCII chars 0x30 - 0x39 to match each digit in SN)<br />
|-<br />
| 0x40<br />
| 0x45<br />
| Ethernet MAC address<br />
|-<br />
| 0x46<br />
| 0x47<br />
| Unknown Padding ?<br />
|-<br />
| 0x48<br />
| 0x57<br />
| Online Key ?<br />
|-<br />
| 0x58<br />
| 0x5B<br />
| Video Standard<br />
* 0x00400100 = NTSC-M<br />
* 0x00400200 = NTSC-J<br />
* 0x00800300 = PAL<br />
|-<br />
| 0x5C<br />
| 0x5F<br />
| Unknown Padding ?<br />
|-<br />
| 0x60<br />
| 0x63<br />
| Checksum3 - Checksum of the next 92 (0x5C) bytes (0x64 - 0xBF)<sup>*</sup><br />
|-<br />
| 0x64<br />
| 0x67<br />
| Zone Bias - Offset in # minutes to subtract from GMT time <br />
(e.g., for GMT-06 Central; 6hr = 360min = 0x00000168)<br />
|-<br />
| 0x68<br />
| 0x6B<br />
| Standard Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CST\0, ACST)<br />
|-<br />
| 0x6C<br />
| 0x6F<br />
| Daylight Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CDT\0, ACDT)<br />
|-<br />
| 0x70<br />
| 0x77<br />
| Unknown Padding ?<br />
|-<br />
| 0x78<br />
| 0x7B<br />
| Standard Time Starts 10-05-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x7C<br />
| 0x7F<br />
| Daylight Savings Time Starts 04-01-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x80<br />
| 0x87<br />
| Unknown Padding ?<br />
|-<br />
| 0x88<br />
| 0x8B<br />
| Standard Timezone Bias; if not DST, 0 (0x00000000) minute time adjust<br />
|-<br />
| 0x8C<br />
| 0x8F<br />
| Daylight Savings Time Bias; if DST, -60 (0xFFFFFFC4) minute time adjust<br />
|-<br />
| 0x90<br />
| 0x93<br />
| Language ID<br />
* English 0x01 0x00 0x00 0x00<br />
* Japanese 0x02 0x00 0x00 0x00<br />
* German 0x03 0x00 0x00 0x00<br />
* French 0x04 0x00 0x00 0x00<br />
* Spanish 0x05 0x00 0x00 0x00<br />
* Italian 0x06 0x00 0x00 0x00<br />
* Korean 0x07 0x00 0x00 0x00<br />
* Chinese 0x08 0x00 0x00 0x00<br />
* Portuguese 0x09 0x00 0x00 0x00<br />
|-<br />
| 0x94<br />
| 0x97<br />
| Video Settings<br />
<br />
Offset 0x96:<br />
* 0x??=Normal{{FIXME}}<br />
* 0xB0=Widescreen<br />
* 0xB4=Letterbox<br />
|-<br />
| 0x98<br />
| 0x9B<br />
| Audio Settings<br />
|-<br />
| 0x9C<br />
| 0x9F<br />
| Games Parental Control (0 = Max rating) 1 byte at offset 0x9C data 4-byte aligned adds the 3 remaining bytes of 0x00<br />
{| class="wikitable"<br />
! Xbox Game Rating !! EEPROM Value @ 0x9C<br />
|-<br />
| (RP) Rating Pending (Max)<br />
| 0x00<br />
|-<br />
| (AO) Adults Only <br />
| 0x01<br />
|-<br />
| (M) Mature <br />
| 0x02<br />
|-<br />
| (T) Teen <br />
| 0x03<br />
|-<br />
| (E) Everyone <br />
| 0x04<br />
|-<br />
| (K-A) Kids to Adults <br />
| 0x05<br />
|-<br />
| (EC) Early Childhood <br />
| 0x06<br />
|}<br />
|-<br />
| 0xA0<br />
| 0xA3<br />
| Parental Control Passcode; 4 button sequence (each key stored in a nibble)<br />
* 0x1 = {{input-dy+}} or {{input-ly+}}<br />
* 0x2 = {{input-dy-}} or {{input-ly-}}<br />
* 0x3 = {{input-dx-}} or {{input-lx-}}<br />
* 0x4 = {{input-dx+}} or {{input-lx+}}<br />
* 0x7 = {{input-x}}<br />
* 0x8 = {{input-y}}<br />
* 0xB = {{input-lt}}<br />
* 0xC = {{input-rt}}<br />
* 0 = Disabled{{FIXME|reason=Is this 0x00000000 only, or are shorter codes possible? can a middle section be 0x00 or would that end the sequence?}}<br />
<br />
Note:{{FIXME|reason=Not sure this is the proper place to describe and formatting sucks not used mediawiki that much still learning}}<br />
* EEPROM offset 0xA0: <code>23 14 00 00</code><br />
* Little Endian value 0x00001423.<br />
* The pass code is D-pad directions up (0x1), right (0x4), down (0x2), left (0x3). <br />
* Pass code is only 2 bytes not 4, each button is stored as a nibble in the word. First button in the most significant nibble and last in the least significant nibble. <br />
* Data in the EEPROM is aligned to double word (4-byte) boundaries. Thus, the two extra bytes at 0xA2 and 0xA3 of 0x00.<br />
|-<br />
| 0xA4<br />
| 0xA7<br />
| Movies Parental Control (0 = Max rating) only 1 byte necessary, the 3 remaining bytes for multiple of 4-byte data alignment{{FIXME|reason=Re-word alignment description. The reason for the extra 3 bytes.}}<br />
{| class="wikitable"<br />
! Xbox Movie Rating !! EEPROM Value @ 0xA4<br />
|-<br />
| 8 (Max)<br />
| 0x00<br />
|-<br />
| 7 (NC-17) <br />
| 0x01<br />
|-<br />
| 6 (R)<br />
| 0x02 <br />
|-<br />
| 5<br />
| 0x03 <br />
|-<br />
| 4 (PG-13)<br />
| 0x04<br />
|-<br />
| 3 (PG)<br />
| 0x05<br />
|-<br />
| 2<br />
| 0x06 <br />
|-<br />
| 1 (G)<br />
| 0x07 <br />
|}<br />
|- <br />
| 0xA8<br />
| 0xAB<br />
| XBOX Live IP Address..<br />
|-<br />
| 0xAC<br />
| 0xAF<br />
| XBOX Live DNS Server..<br />
|-<br />
| 0xB0<br />
| 0xB3<br />
| XBOX Live Gateway Address..<br />
|-<br />
| 0xB4<br />
| 0xB7<br />
| XBOX Live Subnet Mask..<br />
|-<br />
| 0xB8<br />
| 0xBB<br />
| Other XBLive settings ?<br />
|-<br />
| 0xBC<br />
| 0xBF<br />
| DVD Playback Kit Zone<br />
|-<br />
| 0xC0<br />
| 0xFF<br />
| Unknown Codes / History ? do not change any values in this region <br />
|-<br />
|}<br />
<br />
Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].<br />
<br />
<sup>*</sup>Configmagic-FINAL-1.6 uses the wrong size when computing Checksum2 (40 instead of 44 bytes) and Checksum3 (96 instead of 92 bytes). Checksum2 value computed was correct only because the extra 4 bytes not used in the CRC computation were all 0's which does not change the CRC value. However, a similiar problem with computation of Checksum3 is present. The CRC computed for v1.6 Xbox's is incorrect as the 4 extra bytes are not 0's as on earlier versions.<br />
<br />
== Reading/Writing the EEPROM ==<br />
<br />
=== Software Method ===<br />
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.<br />
<br />
=== Hardware Method ===<br />
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see [http://dangerousprototypes.com/blog/bus-pirate-manual/ here]<br />
or [https://www.totalphase.com/products/aardvark-i2cspi/ here]), build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. Then use the corresponding software to read/write the EEPROM.<br />
<br />
<br />
==The HMAC HDD Key==<br />
<br />
The HMAC HDD Key is generated out of the first 48 bytes. This section has been identified clearly.<br />
<br />
<br />
==The Region Code==<br />
<br />
This DWORD is encrypted. It corresponds to the region code in the XBE header:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| 0x00000001<br />
| North America<br />
|-<br />
| 0x00000002<br />
| Japan<br />
|-<br />
| 0x00000004<br />
| Europe / Australia<br />
|-<br />
| 0x80000000<br />
| Manufacturing plant<br />
|}<br />
<br />
==The MAC address==<br />
<br />
This is the MAC address of the Ethernet hardware, which has been [https://web.archive.org/web/20100617020733/http://standards.ieee.org/regauth/oui/oui_public.txt issued by the IEEE].<br />
<br />
<br />
==DVD Region==<br />
<br />
This DWORD corresponds to the region code for playback of DVD movies:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| 0x00000000<br />
| None<br />
|-<br />
| 0x00000001<br />
| Region 1<br />
|-<br />
| ...<br />
| ...<br />
|-<br />
| 0x00000006<br />
| Region 6<br />
|}<br />
<br />
== Checksum Algorithm ==<br />
<br />
Checksum2 and Checksum3 values can be calculated by running the following code snippet over the area the checksum covers:<br />
<br />
<pre> /* The EepromCRC algorithm was obtained from the XKUtils 0.2 source released by<br />
* TeamAssembly under the GNU GPL.<br />
* Specifically, from XKCRC.cpp<br />
*<br />
* Rewritten to ANSI C by David Pye (dmp@davidmpye.dyndns.org)<br />
*<br />
* Thanks! */<br />
void EepromCRC(unsigned char *crc, unsigned char *data, long dataLen) {<br />
unsigned char* CRC_Data = (unsigned char *)malloc(dataLen+4);<br />
int pos=0;<br />
memset(crc,0x00,4);<br />
<br />
memset(CRC_Data,0x00, dataLen+4);<br />
//Circle shift input data one byte right<br />
memcpy(CRC_Data + 0x01 , data, dataLen-1);<br />
memcpy(CRC_Data, data + dataLen-1, 0x01);<br />
<br />
for (pos=0; pos&lt;4; ++pos) {<br />
unsigned short CRCPosVal = 0xFFFF;<br />
unsigned long l;<br />
for (l=pos; l&lt;dataLen; l+=4) {<br />
CRCPosVal -= *(unsigned short*)(&amp;CRC_Data[l]);<br />
}<br />
CRCPosVal &amp;= 0xFF00;<br />
crc[pos] = (unsigned char) (CRCPosVal &gt;&gt; 8);<br />
}<br />
free(CRC_Data);<br />
}<br />
</pre><br />
<br />
== Read Checksum Algorithm ==<br />
<br />
When the Xbox reads from the FACTORY_SETTINGS or the USER_SETTINGS section of the EEPROM, this algorithm is ran over the entire section accessed (including the CRC checksum mentioned above) to ensure that the data is valid. If the result of the checksum algorithm does not equal 0xFFFFFFFF, STATUS_DEVICE_DATA_ERROR is returned from the Kernel.<br />
<br />
<pre>static uint32_t eeprom_section_checksum(<br />
const uint32_t* section_data,<br />
uint32_t section_data_length<br />
)<br />
{<br />
const uint32_t bitmask = 0xFFFFFFFF;<br />
const uint32_t num_dwords = section_data_length >> 2;<br />
uint64_t checksum = 0;<br />
uint32_t carry_count = 0;<br />
<br />
for(uint32_t loop_count = num_dwords; loop_count > 0; loop_count--) {<br />
checksum += *section_data;<br />
if(checksum > bitmask) {<br />
carry_count++;<br />
checksum &= bitmask;<br />
}<br />
section_data++;<br />
}<br />
checksum += carry_count;<br />
if(checksum > bitmask) {<br />
checksum += 1;<br />
}<br />
return (uint32_t)(checksum & bitmask);<br />
}<br />
</pre><br />
<br />
== Further Reading ==<br />
<br />
* [https://web.archive.org/web/20040604013125/http://console-dev.com:80/eeprom.htm Information about EEPROM contents]<br />
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip with a Raspberry Pi]<br />
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]<br />
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=LPC_Debug_Port&diff=6387LPC Debug Port2018-04-11T20:09:29Z<p>KaosEngineer: removed parens to match other lines showing 1.6 hardware difference</p>
<hr />
<div>{|class="wikitable" style="float:right;margin-left:10px;"<br />
|+ Pin Layout<br />
|-<br />
! style="text-align:right" | Name !! style="text-align:right" | Pin !! Pin !! Name<br />
|-<br />
| style="text-align:right" | - || style="text-align:right" | 16 || 15 || 3.3V<br />
|-<br />
| style="text-align:right" | SDA || style="text-align:right" | 14 || 13 || SCL<br />
|-<br />
| style="text-align:right" | GND || style="text-align:right" | 12 || 11 || LAD0<br />
|-<br />
| style="text-align:right" | LAD1 || style="text-align:right" | 10 || 9 || 3.3V<br />
|-<br />
| style="text-align:right" | LAD2 || style="text-align:right" | 8 || 7 || LAD3<br />
|-<br />
| style="text-align:right" | 5V || style="text-align:right" | 6 || 5 || LRESET#<br />
|-<br />
| style="text-align:right" | PWR (v1.6) || style="text-align:right" | 4 || 3 || LFRAME#<br />
|-<br />
| style="text-align:right" | GND || style="text-align:right" | 2 || 1 || LCLK<br />
|}<br />
<br />
The '''LPC Debug Port''' is an unpopulated 2x8 2.54mm (0.1") footprint on the Xbox motherboard that provides access to the system's [https://en.wikipedia.org/wiki/Low_Pin_Count Low Pin Count] Bus, as well as the [[SMBus]]. Throughout the Xbox's lifetime, Microsoft modified the LPC port in an attempt to prevent modding and, in some cases, it must be "rebuilt" to restore the port's full functionality. Rebuilding the LPC debug port involves soldering wires between it and very small vias on the motherboard.<br />
<br />
The LPC bus is controlled by the [[MCPX|MCPX southbridge]], which conforms to the Intel Low Pin Count Specification 1.0.<br />
<br />
== Pins ==<br />
<br />
* '''3.3V''' (15 & 9) - Provides 3.3V while the Xbox is powered on. On 1.6 hardware, disconnected reconnect to pin 15 to restore supply voltage.<br />
* '''SDA''' (14) - [[SMBus]] data and address signal.<br />
* '''SCL''' (13) - [[SMBus]] clock signal.<br />
* '''GND''' (12 & 2) - Ground.<br />
* '''LAD[3:0]''' (11, 10, 8, 7) - LPC address and data signals.<br />
* '''5V''' (6) - Provides 5V while the Xbox is powered on or v1.6 always on when AC plugged in.<br />
* '''LRESET#''' (5) - LPC reset signal; same as PCIRST#.<br />
* '''PWR''' (4) - On pre-1.6 hardware, this pin does not physically exist. On 1.6 hardware, this pin is connected to the power button. Shorting it to ground will turn the Xbox on and off.<br />
* '''LFRAME#''' (3) - LPC start-of-cycle signal.<br />
* '''LCLK''' (1) - 33MHz LPC clock signal; same as PCICLK.<br />
<br />
The debug port lacks the optional LDRQ#, SERIRQ, CLKRUN#, PME#, LPCPD#, and LSMI# signals. This means peripherals connected to the debug port cannot utilize interrupt, DMA, bus mastering, or power management features.</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=LPC_Debug_Port&diff=6386LPC Debug Port2018-04-11T20:08:40Z<p>KaosEngineer: pin 9 on 1.6 difference noted ( n/c to 3.3Vdc supply voltage)</p>
<hr />
<div>{|class="wikitable" style="float:right;margin-left:10px;"<br />
|+ Pin Layout<br />
|-<br />
! style="text-align:right" | Name !! style="text-align:right" | Pin !! Pin !! Name<br />
|-<br />
| style="text-align:right" | - || style="text-align:right" | 16 || 15 || 3.3V<br />
|-<br />
| style="text-align:right" | SDA || style="text-align:right" | 14 || 13 || SCL<br />
|-<br />
| style="text-align:right" | GND || style="text-align:right" | 12 || 11 || LAD0<br />
|-<br />
| style="text-align:right" | LAD1 || style="text-align:right" | 10 || 9 || 3.3V<br />
|-<br />
| style="text-align:right" | LAD2 || style="text-align:right" | 8 || 7 || LAD3<br />
|-<br />
| style="text-align:right" | 5V || style="text-align:right" | 6 || 5 || LRESET#<br />
|-<br />
| style="text-align:right" | PWR (v1.6) || style="text-align:right" | 4 || 3 || LFRAME#<br />
|-<br />
| style="text-align:right" | GND || style="text-align:right" | 2 || 1 || LCLK<br />
|}<br />
<br />
The '''LPC Debug Port''' is an unpopulated 2x8 2.54mm (0.1") footprint on the Xbox motherboard that provides access to the system's [https://en.wikipedia.org/wiki/Low_Pin_Count Low Pin Count] Bus, as well as the [[SMBus]]. Throughout the Xbox's lifetime, Microsoft modified the LPC port in an attempt to prevent modding and, in some cases, it must be "rebuilt" to restore the port's full functionality. Rebuilding the LPC debug port involves soldering wires between it and very small vias on the motherboard.<br />
<br />
The LPC bus is controlled by the [[MCPX|MCPX southbridge]], which conforms to the Intel Low Pin Count Specification 1.0.<br />
<br />
== Pins ==<br />
<br />
* '''3.3V''' (15 & 9) - Provides 3.3V while the Xbox is powered on. (On 1.6 hardware, disconnected reconnect to pin 15 to restore supply voltage.)<br />
* '''SDA''' (14) - [[SMBus]] data and address signal.<br />
* '''SCL''' (13) - [[SMBus]] clock signal.<br />
* '''GND''' (12 & 2) - Ground.<br />
* '''LAD[3:0]''' (11, 10, 8, 7) - LPC address and data signals.<br />
* '''5V''' (6) - Provides 5V while the Xbox is powered on or v1.6 always on when AC plugged in.<br />
* '''LRESET#''' (5) - LPC reset signal; same as PCIRST#.<br />
* '''PWR''' (4) - On pre-1.6 hardware, this pin does not physically exist. On 1.6 hardware, this pin is connected to the power button. Shorting it to ground will turn the Xbox on and off.<br />
* '''LFRAME#''' (3) - LPC start-of-cycle signal.<br />
* '''LCLK''' (1) - 33MHz LPC clock signal; same as PCICLK.<br />
<br />
The debug port lacks the optional LDRQ#, SERIRQ, CLKRUN#, PME#, LPCPD#, and LSMI# signals. This means peripherals connected to the debug port cannot utilize interrupt, DMA, bus mastering, or power management features.</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=LPC_Debug_Port&diff=6385LPC Debug Port2018-04-11T20:06:04Z<p>KaosEngineer: LCLK (2) wrong pin changed to (1)</p>
<hr />
<div>{|class="wikitable" style="float:right;margin-left:10px;"<br />
|+ Pin Layout<br />
|-<br />
! style="text-align:right" | Name !! style="text-align:right" | Pin !! Pin !! Name<br />
|-<br />
| style="text-align:right" | - || style="text-align:right" | 16 || 15 || 3.3V<br />
|-<br />
| style="text-align:right" | SDA || style="text-align:right" | 14 || 13 || SCL<br />
|-<br />
| style="text-align:right" | GND || style="text-align:right" | 12 || 11 || LAD0<br />
|-<br />
| style="text-align:right" | LAD1 || style="text-align:right" | 10 || 9 || 3.3V<br />
|-<br />
| style="text-align:right" | LAD2 || style="text-align:right" | 8 || 7 || LAD3<br />
|-<br />
| style="text-align:right" | 5V || style="text-align:right" | 6 || 5 || LRESET#<br />
|-<br />
| style="text-align:right" | PWR (v1.6) || style="text-align:right" | 4 || 3 || LFRAME#<br />
|-<br />
| style="text-align:right" | GND || style="text-align:right" | 2 || 1 || LCLK<br />
|}<br />
<br />
The '''LPC Debug Port''' is an unpopulated 2x8 2.54mm (0.1") footprint on the Xbox motherboard that provides access to the system's [https://en.wikipedia.org/wiki/Low_Pin_Count Low Pin Count] Bus, as well as the [[SMBus]]. Throughout the Xbox's lifetime, Microsoft modified the LPC port in an attempt to prevent modding and, in some cases, it must be "rebuilt" to restore the port's full functionality. Rebuilding the LPC debug port involves soldering wires between it and very small vias on the motherboard.<br />
<br />
The LPC bus is controlled by the [[MCPX|MCPX southbridge]], which conforms to the Intel Low Pin Count Specification 1.0.<br />
<br />
== Pins ==<br />
<br />
* '''3.3V''' (15 & 9) - Provides 3.3V while the Xbox is powered on.<br />
* '''SDA''' (14) - [[SMBus]] data and address signal.<br />
* '''SCL''' (13) - [[SMBus]] clock signal.<br />
* '''GND''' (12 & 2) - Ground.<br />
* '''LAD[3:0]''' (11, 10, 8, 7) - LPC address and data signals.<br />
* '''5V''' (6) - Provides 5V while the Xbox is powered on or v1.6 always on when AC plugged in.<br />
* '''LRESET#''' (5) - LPC reset signal; same as PCIRST#.<br />
* '''PWR''' (4) - On pre-1.6 hardware, this pin does not physically exist. On 1.6 hardware, this pin is connected to the power button. Shorting it to ground will turn the Xbox on and off.<br />
* '''LFRAME#''' (3) - LPC start-of-cycle signal.<br />
* '''LCLK''' (1) - 33MHz LPC clock signal; same as PCICLK.<br />
<br />
The debug port lacks the optional LDRQ#, SERIRQ, CLKRUN#, PME#, LPCPD#, and LSMI# signals. This means peripherals connected to the debug port cannot utilize interrupt, DMA, bus mastering, or power management features.</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=LPC_Debug_Port&diff=6377LPC Debug Port2018-03-17T05:44:22Z<p>KaosEngineer: V1.6 5V always on when AC plugged in. Older revisions this supply voltage was turned on / off with console.</p>
<hr />
<div>{|class="wikitable" style="float:right;margin-left:10px;"<br />
|+ Pin Layout<br />
|-<br />
! style="text-align:right" | Name !! style="text-align:right" | Pin !! Pin !! Name<br />
|-<br />
| style="text-align:right" | - || style="text-align:right" | 16 || 15 || 3.3V<br />
|-<br />
| style="text-align:right" | SDA || style="text-align:right" | 14 || 13 || SCL<br />
|-<br />
| style="text-align:right" | GND || style="text-align:right" | 12 || 11 || LAD0<br />
|-<br />
| style="text-align:right" | LAD1 || style="text-align:right" | 10 || 9 || 3.3V<br />
|-<br />
| style="text-align:right" | LAD2 || style="text-align:right" | 8 || 7 || LAD3<br />
|-<br />
| style="text-align:right" | 5V || style="text-align:right" | 6 || 5 || LRESET#<br />
|-<br />
| style="text-align:right" | PWR (v1.6) || style="text-align:right" | 4 || 3 || LFRAME#<br />
|-<br />
| style="text-align:right" | GND || style="text-align:right" | 2 || 1 || LCLK<br />
|}<br />
<br />
The '''LPC Debug Port''' is an unpopulated 2x8 2.54mm (0.1") footprint on the Xbox motherboard that provides access to the system's [https://en.wikipedia.org/wiki/Low_Pin_Count Low Pin Count] Bus, as well as the [[SMBus]]. Throughout the Xbox's lifetime, Microsoft modified the LPC port in an attempt to prevent modding and, in some cases, it must be "rebuilt" to restore the port's full functionality. Rebuilding the LPC debug port involves soldering wires between it and very small vias on the motherboard.<br />
<br />
The LPC bus is controlled by the [[MCPX|MCPX southbridge]], which conforms to the Intel Low Pin Count Specification 1.0.<br />
<br />
== Pins ==<br />
<br />
* '''3.3V''' (15 & 9) - Provides 3.3V while the Xbox is powered on.<br />
* '''SDA''' (14) - [[SMBus]] data and address signal.<br />
* '''SCL''' (13) - [[SMBus]] clock signal.<br />
* '''GND''' (12 & 2) - Ground.<br />
* '''LAD[3:0]''' (11, 10, 8, 7) - LPC address and data signals.<br />
* '''5V''' (6) - Provides 5V while the Xbox is powered on or v1.6 always on when AC plugged in.<br />
* '''LRESET#''' (5) - LPC reset signal; same as PCIRST#.<br />
* '''PWR''' (4) - On pre-1.6 hardware, this pin does not physically exist. On 1.6 hardware, this pin is connected to the power button. Shorting it to ground will turn the Xbox on and off.<br />
* '''LFRAME#''' (3) - LPC start-of-cycle signal.<br />
* '''LCLK''' (2) - 33MHz LPC clock signal; same as PCICLK.<br />
<br />
The debug port lacks the optional LDRQ#, SERIRQ, CLKRUN#, PME#, LPCPD#, and LSMI# signals. This means peripherals connected to the debug port cannot utilize interrupt, DMA, bus mastering, or power management features.</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=NV2A&diff=6265NV2A2017-10-04T08:17:42Z<p>KaosEngineer: /* Notes */ Still not working. Trying to get the title of the PDF file printed in italics so added "</p>
<hr />
<div>The northbridge of the chipset, and is the GPU<br />
<br />
== GPU ==<br />
<br />
The GPU is part of the NV20 family (Kelvin)[https://nouveau.freedesktop.org/wiki/CodeNames/]:<br />
<br />
{| class="wikitable"<br />
! Code name !! Official Name<br />
|-<br />
|NV20 || GeForce3 (Ti)<br>Quadro DCC<br />
|-<br />
|NV25 || GeForce4 Ti 4200, Ti 4400, Ti 4600<br>Quadro4 700 XGL, 750 XGL, 900 XGL<br />
|-<br />
|NV28 || GeForce4 Ti 4200-8X, Ti 4800 (SE), 4200 Go<br>Quadro4 780 XGL, 980 XGL<br />
|-<br />
|NV2A || Xbox GPU <br />
|}<br />
<br />
== Notes ==<br />
<br />
* [https://web-beta.archive.org/web/20030207073141/http://developer.nvidia.com:80/view.asp?IO=nv30_emulation NV30 information and emulator]<br />
** [https://web.archive.org/web/20070105072020/http://www.cs.virginia.edu/~gfx/Courses/2002/RealTime.fall.02/Cg/nv30specs.pdf Backup of nv30specs: List of implemented GL extensions for NV10-NV30]<br />
** [https://developer.download.nvidia.com/opengl/specs/nv30specs.pdf NVIDIA OpenGL Extension Specifications for the CineFX Architecture (NV3x), pp. 368, nVidia Corporation, 13 Nov 2006.]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=NV2A&diff=6264NV2A2017-10-04T08:13:35Z<p>KaosEngineer: /* Notes */</p>
<hr />
<div>The northbridge of the chipset, and is the GPU<br />
<br />
== GPU ==<br />
<br />
The GPU is part of the NV20 family (Kelvin)[https://nouveau.freedesktop.org/wiki/CodeNames/]:<br />
<br />
{| class="wikitable"<br />
! Code name !! Official Name<br />
|-<br />
|NV20 || GeForce3 (Ti)<br>Quadro DCC<br />
|-<br />
|NV25 || GeForce4 Ti 4200, Ti 4400, Ti 4600<br>Quadro4 700 XGL, 750 XGL, 900 XGL<br />
|-<br />
|NV28 || GeForce4 Ti 4200-8X, Ti 4800 (SE), 4200 Go<br>Quadro4 780 XGL, 980 XGL<br />
|-<br />
|NV2A || Xbox GPU <br />
|}<br />
<br />
== Notes ==<br />
<br />
* [https://web-beta.archive.org/web/20030207073141/http://developer.nvidia.com:80/view.asp?IO=nv30_emulation NV30 information and emulator]<br />
** [https://web.archive.org/web/20070105072020/http://www.cs.virginia.edu/~gfx/Courses/2002/RealTime.fall.02/Cg/nv30specs.pdf Backup of nv30specs: List of implemented GL extensions for NV10-NV30]<br />
** [https://developer.download.nvidia.com/opengl/specs/nv30specs.pdf "NVIDIA OpenGL Extension Specifications for the CineFX Architecture (NV3x)", pp. 368, nVidia Corporation, 13 Nov 2006.]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=NV2A&diff=6263NV2A2017-10-04T08:10:39Z<p>KaosEngineer: /* Notes */</p>
<hr />
<div>The northbridge of the chipset, and is the GPU<br />
<br />
== GPU ==<br />
<br />
The GPU is part of the NV20 family (Kelvin)[https://nouveau.freedesktop.org/wiki/CodeNames/]:<br />
<br />
{| class="wikitable"<br />
! Code name !! Official Name<br />
|-<br />
|NV20 || GeForce3 (Ti)<br>Quadro DCC<br />
|-<br />
|NV25 || GeForce4 Ti 4200, Ti 4400, Ti 4600<br>Quadro4 700 XGL, 750 XGL, 900 XGL<br />
|-<br />
|NV28 || GeForce4 Ti 4200-8X, Ti 4800 (SE), 4200 Go<br>Quadro4 780 XGL, 980 XGL<br />
|-<br />
|NV2A || Xbox GPU <br />
|}<br />
<br />
== Notes ==<br />
<br />
* [https://web-beta.archive.org/web/20030207073141/http://developer.nvidia.com:80/view.asp?IO=nv30_emulation NV30 information and emulator]<br />
** [https://web.archive.org/web/20070105072020/http://www.cs.virginia.edu/~gfx/Courses/2002/RealTime.fall.02/Cg/nv30specs.pdf Backup of nv30specs: List of implemented GL extensions for NV10-NV30]<br />
** [https://developer.download.nvidia.com/opengl/specs/nv30specs.pdf *NVIDIA OpenGL Extension Specifications for the CineFX Architecture (NV3x)*, pp. 368, nVidia Corporation, 13 Nov 2006.]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=NV2A&diff=6262NV2A2017-10-04T08:02:05Z<p>KaosEngineer: /* Notes */ URL formatting fix. I hope!</p>
<hr />
<div>The northbridge of the chipset, and is the GPU<br />
<br />
== GPU ==<br />
<br />
The GPU is part of the NV20 family (Kelvin)[https://nouveau.freedesktop.org/wiki/CodeNames/]:<br />
<br />
{| class="wikitable"<br />
! Code name !! Official Name<br />
|-<br />
|NV20 || GeForce3 (Ti)<br>Quadro DCC<br />
|-<br />
|NV25 || GeForce4 Ti 4200, Ti 4400, Ti 4600<br>Quadro4 700 XGL, 750 XGL, 900 XGL<br />
|-<br />
|NV28 || GeForce4 Ti 4200-8X, Ti 4800 (SE), 4200 Go<br>Quadro4 780 XGL, 980 XGL<br />
|-<br />
|NV2A || Xbox GPU <br />
|}<br />
<br />
== Notes ==<br />
<br />
* [https://web-beta.archive.org/web/20030207073141/http://developer.nvidia.com:80/view.asp?IO=nv30_emulation NV30 information and emulator]<br />
** [https://web.archive.org/web/20070105072020/http://www.cs.virginia.edu/~gfx/Courses/2002/RealTime.fall.02/Cg/nv30specs.pdf Backup of nv30specs: List of implemented GL extensions for NV10-NV30]<br />
** [https://developer.download.nvidia.com/opengl/specs/nv30specs.pdf NVIDIA OpenGL Extension Specifications for the CineFX Architecture (NV3x), 13 Nov 2006, pp. 368.]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=NV2A&diff=6261NV2A2017-10-04T08:01:16Z<p>KaosEngineer: /* Notes */</p>
<hr />
<div>The northbridge of the chipset, and is the GPU<br />
<br />
== GPU ==<br />
<br />
The GPU is part of the NV20 family (Kelvin)[https://nouveau.freedesktop.org/wiki/CodeNames/]:<br />
<br />
{| class="wikitable"<br />
! Code name !! Official Name<br />
|-<br />
|NV20 || GeForce3 (Ti)<br>Quadro DCC<br />
|-<br />
|NV25 || GeForce4 Ti 4200, Ti 4400, Ti 4600<br>Quadro4 700 XGL, 750 XGL, 900 XGL<br />
|-<br />
|NV28 || GeForce4 Ti 4200-8X, Ti 4800 (SE), 4200 Go<br>Quadro4 780 XGL, 980 XGL<br />
|-<br />
|NV2A || Xbox GPU <br />
|}<br />
<br />
== Notes ==<br />
<br />
* [https://web-beta.archive.org/web/20030207073141/http://developer.nvidia.com:80/view.asp?IO=nv30_emulation NV30 information and emulator]<br />
** [https://web.archive.org/web/20070105072020/http://www.cs.virginia.edu/~gfx/Courses/2002/RealTime.fall.02/Cg/nv30specs.pdf Backup of nv30specs: List of implemented GL extensions for NV10-NV30]<br />
** [https://developer.download.nvidia.com/opengl/specs/nv30specs.pdf NVIDIA OpenGL<br />
Extension Specifications for the<br />
CineFX Architecture (NV3x), 13 Nov 2006, pp. 368.]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=NV2A&diff=6260NV2A2017-10-04T08:00:01Z<p>KaosEngineer: /* Notes */ Additional link to nv30specs.pdf from nVidia's web site as the first links first attachment gives 404 error.</p>
<hr />
<div>The northbridge of the chipset, and is the GPU<br />
<br />
== GPU ==<br />
<br />
The GPU is part of the NV20 family (Kelvin)[https://nouveau.freedesktop.org/wiki/CodeNames/]:<br />
<br />
{| class="wikitable"<br />
! Code name !! Official Name<br />
|-<br />
|NV20 || GeForce3 (Ti)<br>Quadro DCC<br />
|-<br />
|NV25 || GeForce4 Ti 4200, Ti 4400, Ti 4600<br>Quadro4 700 XGL, 750 XGL, 900 XGL<br />
|-<br />
|NV28 || GeForce4 Ti 4200-8X, Ti 4800 (SE), 4200 Go<br>Quadro4 780 XGL, 980 XGL<br />
|-<br />
|NV2A || Xbox GPU <br />
|}<br />
<br />
== Notes ==<br />
<br />
* [https://web-beta.archive.org/web/20030207073141/http://developer.nvidia.com:80/view.asp?IO=nv30_emulation NV30 information and emulator]<br />
** [https://web.archive.org/web/20070105072020/http://www.cs.virginia.edu/~gfx/Courses/2002/RealTime.fall.02/Cg/nv30specs.pdf Backup of nv30specs: List of implemented GL extensions for NV10-NV30]<br />
** [https://developer.download.nvidia.com/opengl/specs/nv30specs.pdf nv30specs.pdf, 13 Nov 2006, pp. 368.]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Xbox_Memory_Unit&diff=6210Xbox Memory Unit2017-09-11T05:26:16Z<p>KaosEngineer: /* Compatible USB sticks */ Added the USB Flash Drive I use to softmod. 64MB generic flash drive</p>
<hr />
<div>The memory units are typically formatted with [[FATX]].<br />
<br />
{| class="wikitable"<br />
! Product name !! VID !! PID !! Capacity !! Notes" <br />
|-<br />
| Microsoft Corp. Xbox Memory Unit (8MB) || 0x045e || 0x0280 || 8MB || Official one <br />
|-<br />
| ThrustMaster, Inc. || 0x044f || 0x0f0c || 8MB || Green logo Xbox and white "Trustmaster<br />
|}<br />
<br />
<br />
== Unlicensed Xbox Memory Units ==<br />
Some unlicensed Memory Units where made. <br />
<br />
{| class="wikitable"<br />
! Product name !! VID !! PID !! Capacity !! Notes<br />
|-<br />
| Weltrend Semiconductor XBOX Xploder || 0x040b || 0x6520 || 8MB || Green sticker "Gamesaves" <br />
|}<br />
<br />
== Compatible USB sticks ==<br />
<br />
Aside from the official licensed Memory Units, some standard USB storage devices can be reformatted as Xbox Memory Unit.<br />
However, not all devices are compatible, so the following table gives a list of known devices:<br />
<br />
{| class="wikitable"<br />
! Product name !! VID !! PID !! Capacity !! Notes<br />
|-<br />
|BESTRUNNER 256MB Speicherstick || 0xABCD || 0x1234 || 256MB || <br />
|-<br />
|USB Mass Storage Device || 0x058F || 0x9381 || 64MB || Generic Mass Storage Device<br />
|}<br />
<br />
== References ==<br />
<br />
* [http://imgur.com/a/8QmDA Thrustmaster XBOX Memory Unit images by DarkGabz]<br />
* [http://imgur.com/gallery/M0PZ6 3 XBOX memory units images by CodeAsm]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Xbox_Game_Disc&diff=6209Xbox Game Disc2017-09-11T05:01:55Z<p>KaosEngineer: /* Dumping */ typo unkown fixed unknown</p>
<hr />
<div>Xbox games are shipped on DVDs. They are commonly referred to as Xbox Game Discs (XGD).<br />
<br />
== Visible information on ring ==<br />
<br />
'''The DVD inner ring usually contains:'''<br />
<br />
(The examples are from a German [[FIFA Soccer 2003]] disc)<br />
<br />
An outer portion with labels:<br />
* Outer ring Layer 1<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L1*)<br />
** Text for Mastering code ("EA02302E L1 02 0MM", where "02" is a smaller font and slightly higher than the previous baseline, followed by "0MM" on the original baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
* Inner ring for Layer 0<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L0*)<br />
** Text for Mastering code ("EA02302E L0 06", where "06" is a smaller font and slightly higher than the previous baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
<br />
An inner porition with Xbox logo:<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* 1 time "XBOX" text with blank background<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* Another tiny pattern segmented into 7 portions in alternating position,(opposite of the "XBOX" text without logo)<br />
** 4 times a Xbox logo <br />
** 2 times the word "genuine"<br />
** and in the middle the word ASPnnnn where n is a number{{citation needed}} <br />
<br />
''' ASP code '''<br />
[[File:Asp demodisk.jpg|thumb|right|Detail of the DVD hologram, reflecting the ASP5080 by the flash of the camera. found on a demodisk (IM00113E-IM)]]<br />
The following table lists known ASPnnnn numbers found on Xbox dvd disks, they are also on 360 disks but we dont list those in this wiki.<br />
The games listed are examples, its known for sure more disks can have these numbers and further research can be done, to determine the meaning.<br />
It is rumoured it might be a version string of some sorts slowly raising in xbox years old. {{citation needed}}<br />
{| class="wikitable"<br />
|-<br />
! ASP number<br />
! found on<br />
! game serial<br />
|-<br />
| ASP0180<br />
| Xbox Hardware Refresh Disc<br />
| XB01101W<br />
|-<br />
| ASP0380<br />
| Tom Clancy's Splinter Cell Exclusive Playable Demo<br />
| US01251E<br />
|-<br />
| ASP0980<br />
| Tom Clancy's Rainbow Six 3 DEMO DISC<br />
| US03152E-US<br />
|-<br />
| ASP5080<br />
| The official xbox 50 best games (Demo disk)<br />
| IM00113E-IM<br />
|-<br />
| ASP5180<br />
| Rayman 3 hoodlum havoc<br />
| <br />
|-<br />
| ASP5280<br />
| Xbox Music Mixer<br />
| MS09005A-MS<br />
|}<br />
<br />
== Dumps ==<br />
<br />
=== Files ===<br />
<br />
==== Disc Manufacturing Information (DMI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x04<br />
<br />
DMI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u32? || Unknown || Always 1?<br />
|-<br />
|4 || u32? || Unknown || Always zero?<br />
|-<br />
|8 || ascii_char[8] || Mastering Code || Example: EA02302E <br> Also see [[Xbe#Title_ID]]<br />
|-<br />
|16 || u64 || || Some timestamp?<br />
|-<br />
|24 || u32? || Unknown || Always 2?<br />
|}<br />
<br />
==== Physical Format Information (PFI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x00<br />
<br />
Read from the Lead-In.<br />
<br />
PFI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || <code>booktype << 4 <nowiki>|</nowiki> part_version</code> || 4 bit each<br />
|-<br />
|1 || u8 || <code>disc_size << 4 <nowiki>|</nowiki> maximum_rate</code> || 4 bit each<br />
|-<br />
|2 || u8 || <code>number_of_layers << 5 <nowiki>|</nowiki> track_path << 4 <nowiki>|</nowiki> layer_type</code> || 1 bit padding, 2 bit, 1 bit, 4 bit<br />
|-<br />
|3 || u8 || <code>linear_density << 4 <nowiki>|</nowiki> track_density</code> || 4 bit each<br />
|-<br />
|4 || u8 || || Always zero<br />
|-<br />
|5 || u24 || Starting Physical Sector Number of Data Area ||<br />
|-<br />
|8 || u8 || || Always zero<br />
|-<br />
|9 || u24 || End Physical Sector Number of Data Area ||<br />
|-<br />
|12 || u8 || || Always zero<br />
|-<br />
|13 || u24 || End Sector Number in Layer 0 || Always 0x2033AF for original Xbox discs<br />
|}<br />
<br />
From [ftp://ftp.avc-pioneer.com/Mtfuji_5/Proposal/Jan01/RDVDSTRC.pdf] (page 4)<br />
<br />
==== Security Sectors (SS.bin) ====<br />
<br />
Challenge entry (11 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || Valid || Always 1 if the challenge is valid, else the challenge is ignored<br />
|-<br />
|1 || u8 || Challenge id ||<br />
|-<br />
|2 || u32 || Challenge value ||<br />
|-<br />
|6 || u8 || Response modifier || multimedia.cx says this might be a Response id. However, it's always 0 anyway?!<br />
|-<br />
|7 || u32 || Response value ||<br />
|}<br />
<br />
Security sector range (9 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|3 || u24 || Start PSN ||<br />
|-<br />
|6 || u24 || End PSN ||<br />
|}<br />
<br />
Unknown1 (44 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u64 || || Yet another timestamp?! (Similar to 1183 in complete format)<br />
|-<br />
|8 || u32 || || Unknown<br />
|-<br />
|27 || u8 || || Unknown<br />
|-<br />
|28 || u8[16] || || Unknown<br />
|}<br />
<br />
Complete format (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || PFI || Physical Format Information || PFI for the actual data, unknown size<br />
|-<br />
|720 || u32 || Unknown ||<br />
|-<br />
|768 || u8 || Version of challenge table || Always 1<br />
|-<br />
|769 || u8 || Number of challenge entries || Always 23<br />
|-<br />
|770 || Challenge entry[] || Encrypted challenge entries ||<br />
|-<br />
|1055 || u64 || || Some large number timestamp?<br />
|-<br />
|1083 || u8[16] || || Unknown<br />
|-<br />
|1183 || Unknown1 || || Unknown, this structure is SHA-1 hashed, to generate a RC4 key to decrypt challenge entries<br />
|-<br />
|1227 || u8[20] || SHA-1 hash A || Hash until here (of the complete format)<br />
|-<br />
|1247 || u8[256] || Signature A || For hash in previous field<br />
|-<br />
|1503 || Unknown1 || || Unknown<br />
|-<br />
|1547 || u8[20] || SHA-1 hash B || Hash until here (of the complete format)<br />
|-<br />
|1567 || u8[64] || Signature B || For hash in previous field (note that this is somewhat shorter than the other signature?!)<br />
|-<br />
! colspan="4" | End of data readable by a stock Xbox drive (1632 Bytes)<br />
|-<br />
|1632 || u8 || Number of security sector ranges || Always 23<br />
|-<br />
|1633 || Security sector range[] || Security sector ranges || Only 16 of which are used.<br />
|-<br />
|1840 || Security sector range[] || Security sector ranges || Only 16 of which are used. <br> ''(Copy from Offset 1633)''<br />
|}<br />
<br />
All other fields are assumed to be zero!<br />
<br />
===== Decryption of challenge entries =====<br />
<br />
Starting at offset 1183, a 44 byte SHA-1 hash is generated.<br />
The first 7 byte of the resulting hash are used as the key in RC4 decryption. The 253 Bytes of the challenge entries (Offset 770) will be decrypted.<br />
<br />
There'll only be a handful of valid entries in the challenge entries.<br />
However there'll be at least 2.<br />
<br />
=== Dumping ===<br />
<br />
To dump Xbox Game Discs you need one of the following drives / firmwares:<br />
<br />
{| class="wikitable"<br />
!Drive<br />
!Standard<br />
!Original Firmware download<br />
!Name of modified Firmware for dumping<br />
|-<br />
|{{citation needed}}<br />
|<br />
|<br />
|0800<br />
|-<br />
|Toshiba SD-M2012C<br />
|IDE<br />
|<br />
|Kreon{{citation needed}}<br />
|-<br />
|Samsung SH-D162C<br />
|IDE<br />
|<br />
|SB00 Kreon 0.60 (July 30th 2006) <br> SB00 Kreon 0.80 (September 9th 2006) <br> SB01 Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Samsung SH-D162D<br />
|IDE<br />
|[https://web.archive.org/web/20090601193905/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200706281644411972_SH-D162D_SB00.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB00] <br> [https://web.archive.org/web/20090916202345/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200811051941150901_SH-D162D_SB01.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01] <br> SB02{{citation needed}}[http://www.firmwarehq.com/download_995-file_SH-D162D_SB02.exe.html unknown if safe or legit] <br> [https://web.archive.org/web/20090402052613/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191825218171_SH-D162D_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] <br> [https://web.archive.org/web/20120123040117/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200909281412336931_SH-D162D_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]<br />
|SB00 Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H352C<br />
|IDE<br />
|<br />
|Kreon{{citation needed}}<br />
|-<br />
|Toshiba TS-H352D<br />
|IDE<br />
|<br />
|Kreon{{citation needed}}<br />
|-<br />
|Samsung SH-D163A<br />
|SATA<br />
|<br />
|SB01 Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Samsung SH-D163B<br />
|SATA<br />
|<br />
|Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H353A<br />
|SATA<br />
|<br />
|{{citation needed}}<br />
|-<br />
|Toshiba TS-H353B<br />
|SATA<br />
|<br />
|{{citation needed}}<br />
|}<br />
<br />
Please note that the modified firmwares are based on copyrighted material and can therefore not be legally shared here.<br />
Patch files to patch original firmwares into dumping-firmwares would be appreciated. <br />
<br />
Flashing software:<br />
<br />
* TSDNMAC for MacOS<br />
* [http://web.archive.org/web/20070301000000/http://www.samsungodd.com/KorLib/File/sfdnwin.exe SFDNWIN] for Microsoft Windows 2000 and XP<br />
* TSDNWIN for Microsoft Windows Vista and 7<br />
* Dell SFDNDOS and the newer TSDNDOS for Microsoft DOS<br />
<br />
For current dumping instructions see [http://forum.redump.org/topic/6073/xbox-1-360-dumping-instructions/ the Dumping Guide by the Redump Project].<br />
<br />
=== Xbox related commands ===<br />
<br />
==== Enable Unlock 1 (xtreme) state ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 01</pre><br />
<br />
Enable Unlock 1 (xtreme) state' as we already know it from the 360 xtreme modded drives. <br />
This command is supported for legacy reasons only. Custom applications should use the new 'Set Lock State' instead.<br />
<br />
==== Set Lock State ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 11 xx</pre><br />
<br />
* <code>xx=00</code> - Drive locked (no unlock state)<br />
* <code>xx=01</code> - Unlock State 1 (xtreme) enabled<br />
* <code>xx=02</code> - Unlock state 2 (wxripper) enabled<br />
<br />
==== SS extract command ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>AD 00 FF 02 FD FF FE 00 08 00 xx C0</pre><br />
<br />
This is the well known from the xtreme firmware.<br />
<br />
==== Get Feature List ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 10</pre><br />
<br />
This command will return a list of the additional features supported by the drive.<br />
All values returned are 16 bit values, and the list is terminated with null (<code>0x0000</code>).<br />
The two first words of the returned list always reads as <code>0xA55A 0X5AA5</code> in order to guarantee that a reply from a drive not supporting this command correctly isn't mistaken for a feature list.<br />
<br />
An example feature list could be: <code>0xA55A, 0x5AA5, 0x0100, 0xF000, 0xF001, 0x0000</code><br />
<br />
This list would indicate that the drive supports XBOX360 Unlock 1, Lock and Error Skip, as it can be seen from the values defined below:<br />
<br />
XBOX 360 related features:<br />
<br />
* <code>0x0100</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0101</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0120</code> : The drive can read and decrypt the SS<br />
* <code>0x0121</code> : The drive has full challenge response functionality<br />
<br />
XBOX related features:<br />
<br />
* <code>0x0200</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0201</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0220</code> : The drive can read and decrypt the SS<br />
* <code>0x0221</code> : The drive has full challenge response functionality<br />
<br />
General drive features:<br />
<br />
* <code>0xF000</code> : The drive supports the lock (cancel any unlock state) command<br />
* <code>0xF001</code> : The drive supports error skipping<br />
<br />
This is the complete list of defined features at the moment. If you're working on a custom application you might want to contact me in order to get the latest list.<br />
<br />
== References and links == <br />
* [https://web.archive.org/web/20150616131202/http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf]<br />
* [https://multimedia.cx/eggs/xbox-sphinx-protocol/ Overview of the challenge/response security protocol]<br />
* [http://redump.org/discs/system/xbox/ Xbox Game Discs preserved by the Redump Project]<br />
* [http://wiki.redump.org/index.php?title=Discs_not_yet_dumped#Microsoft_Xbox Missing Xbox Game Disc dumps at Redump Project]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Xbox_Game_Disc&diff=6208Xbox Game Disc2017-09-11T04:56:46Z<p>KaosEngineer: /* Visible information on ring */ typo middel changed to middle</p>
<hr />
<div>Xbox games are shipped on DVDs. They are commonly referred to as Xbox Game Discs (XGD).<br />
<br />
== Visible information on ring ==<br />
<br />
'''The DVD inner ring usually contains:'''<br />
<br />
(The examples are from a German [[FIFA Soccer 2003]] disc)<br />
<br />
An outer portion with labels:<br />
* Outer ring Layer 1<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L1*)<br />
** Text for Mastering code ("EA02302E L1 02 0MM", where "02" is a smaller font and slightly higher than the previous baseline, followed by "0MM" on the original baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
* Inner ring for Layer 0<br />
** Code 39 Barcode of the the Mastering Code (*EA02302E L0*)<br />
** Text for Mastering code ("EA02302E L0 06", where "06" is a smaller font and slightly higher than the previous baseline)<br />
** Mastering SID Code ("IFPI L126")<br />
<br />
An inner porition with Xbox logo:<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* 1 time "XBOX" text with blank background<br />
* 3 times "XBOX" text with "X Logo" in the background on each side<br />
* Another tiny pattern segmented into 7 portions in alternating position,(opposite of the "XBOX" text without logo)<br />
** 4 times a Xbox logo <br />
** 2 times the word "genuine"<br />
** and in the middle the word ASPnnnn where n is a number{{citation needed}} <br />
<br />
''' ASP code '''<br />
[[File:Asp demodisk.jpg|thumb|right|Detail of the DVD hologram, reflecting the ASP5080 by the flash of the camera. found on a demodisk (IM00113E-IM)]]<br />
The following table lists known ASPnnnn numbers found on Xbox dvd disks, they are also on 360 disks but we dont list those in this wiki.<br />
The games listed are examples, its known for sure more disks can have these numbers and further research can be done, to determine the meaning.<br />
It is rumoured it might be a version string of some sorts slowly raising in xbox years old. {{citation needed}}<br />
{| class="wikitable"<br />
|-<br />
! ASP number<br />
! found on<br />
! game serial<br />
|-<br />
| ASP0180<br />
| Xbox Hardware Refresh Disc<br />
| XB01101W<br />
|-<br />
| ASP0380<br />
| Tom Clancy's Splinter Cell Exclusive Playable Demo<br />
| US01251E<br />
|-<br />
| ASP0980<br />
| Tom Clancy's Rainbow Six 3 DEMO DISC<br />
| US03152E-US<br />
|-<br />
| ASP5080<br />
| The official xbox 50 best games (Demo disk)<br />
| IM00113E-IM<br />
|-<br />
| ASP5180<br />
| Rayman 3 hoodlum havoc<br />
| <br />
|-<br />
| ASP5280<br />
| Xbox Music Mixer<br />
| MS09005A-MS<br />
|}<br />
<br />
== Dumps ==<br />
<br />
=== Files ===<br />
<br />
==== Disc Manufacturing Information (DMI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x04<br />
<br />
DMI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u32? || Unknown || Always 1?<br />
|-<br />
|4 || u32? || Unknown || Always zero?<br />
|-<br />
|8 || ascii_char[8] || Mastering Code || Example: EA02302E <br> Also see [[Xbe#Title_ID]]<br />
|-<br />
|16 || u64 || || Some timestamp?<br />
|-<br />
|24 || u32? || Unknown || Always 2?<br />
|}<br />
<br />
==== Physical Format Information (PFI.bin) ====<br />
<br />
READ DVD STRUCTURE with format 0x00<br />
<br />
Read from the Lead-In.<br />
<br />
PFI (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || <code>booktype << 4 <nowiki>|</nowiki> part_version</code> || 4 bit each<br />
|-<br />
|1 || u8 || <code>disc_size << 4 <nowiki>|</nowiki> maximum_rate</code> || 4 bit each<br />
|-<br />
|2 || u8 || <code>number_of_layers << 5 <nowiki>|</nowiki> track_path << 4 <nowiki>|</nowiki> layer_type</code> || 1 bit padding, 2 bit, 1 bit, 4 bit<br />
|-<br />
|3 || u8 || <code>linear_density << 4 <nowiki>|</nowiki> track_density</code> || 4 bit each<br />
|-<br />
|4 || u8 || || Always zero<br />
|-<br />
|5 || u24 || Starting Physical Sector Number of Data Area ||<br />
|-<br />
|8 || u8 || || Always zero<br />
|-<br />
|9 || u24 || End Physical Sector Number of Data Area ||<br />
|-<br />
|12 || u8 || || Always zero<br />
|-<br />
|13 || u24 || End Sector Number in Layer 0 || Always 0x2033AF for original Xbox discs<br />
|}<br />
<br />
From [ftp://ftp.avc-pioneer.com/Mtfuji_5/Proposal/Jan01/RDVDSTRC.pdf] (page 4)<br />
<br />
==== Security Sectors (SS.bin) ====<br />
<br />
Challenge entry (11 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u8 || Valid || Always 1 if the challenge is valid, else the challenge is ignored<br />
|-<br />
|1 || u8 || Challenge id ||<br />
|-<br />
|2 || u32 || Challenge value ||<br />
|-<br />
|6 || u8 || Response modifier || multimedia.cx says this might be a Response id. However, it's always 0 anyway?!<br />
|-<br />
|7 || u32 || Response value ||<br />
|}<br />
<br />
Security sector range (9 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|3 || u24 || Start PSN ||<br />
|-<br />
|6 || u24 || End PSN ||<br />
|}<br />
<br />
Unknown1 (44 Bytes)<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || u64 || || Yet another timestamp?! (Similar to 1183 in complete format)<br />
|-<br />
|8 || u32 || || Unknown<br />
|-<br />
|27 || u8 || || Unknown<br />
|-<br />
|28 || u8[16] || || Unknown<br />
|}<br />
<br />
Complete format (2048 Bytes):<br />
<br />
{| class="wikitable"<br />
! Offset !! Type !! Field !! Notes<br />
|-<br />
|0 || PFI || Physical Format Information || PFI for the actual data, unknown size<br />
|-<br />
|720 || u32 || Unknown ||<br />
|-<br />
|768 || u8 || Version of challenge table || Always 1<br />
|-<br />
|769 || u8 || Number of challenge entries || Always 23<br />
|-<br />
|770 || Challenge entry[] || Encrypted challenge entries ||<br />
|-<br />
|1055 || u64 || || Some large number timestamp?<br />
|-<br />
|1083 || u8[16] || || Unknown<br />
|-<br />
|1183 || Unknown1 || || Unknown, this structure is SHA-1 hashed, to generate a RC4 key to decrypt challenge entries<br />
|-<br />
|1227 || u8[20] || SHA-1 hash A || Hash until here (of the complete format)<br />
|-<br />
|1247 || u8[256] || Signature A || For hash in previous field<br />
|-<br />
|1503 || Unknown1 || || Unknown<br />
|-<br />
|1547 || u8[20] || SHA-1 hash B || Hash until here (of the complete format)<br />
|-<br />
|1567 || u8[64] || Signature B || For hash in previous field (note that this is somewhat shorter than the other signature?!)<br />
|-<br />
! colspan="4" | End of data readable by a stock Xbox drive (1632 Bytes)<br />
|-<br />
|1632 || u8 || Number of security sector ranges || Always 23<br />
|-<br />
|1633 || Security sector range[] || Security sector ranges || Only 16 of which are used.<br />
|-<br />
|1840 || Security sector range[] || Security sector ranges || Only 16 of which are used. <br> ''(Copy from Offset 1633)''<br />
|}<br />
<br />
All other fields are assumed to be zero!<br />
<br />
===== Decryption of challenge entries =====<br />
<br />
Starting at offset 1183, a 44 byte SHA-1 hash is generated.<br />
The first 7 byte of the resulting hash are used as the key in RC4 decryption. The 253 Bytes of the challenge entries (Offset 770) will be decrypted.<br />
<br />
There'll only be a handful of valid entries in the challenge entries.<br />
However there'll be at least 2.<br />
<br />
=== Dumping ===<br />
<br />
To dump Xbox Game Discs you need one of the following drives / firmwares:<br />
<br />
{| class="wikitable"<br />
!Drive<br />
!Standard<br />
!Original Firmware download<br />
!Name of modified Firmware for dumping<br />
|-<br />
|{{citation needed}}<br />
|<br />
|<br />
|0800<br />
|-<br />
|Toshiba SD-M2012C<br />
|IDE<br />
|<br />
|Kreon{{citation needed}}<br />
|-<br />
|Samsung SH-D162C<br />
|IDE<br />
|<br />
|SB00 Kreon 0.60 (July 30th 2006) <br> SB00 Kreon 0.80 (September 9th 2006) <br> SB01 Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Samsung SH-D162D<br />
|IDE<br />
|[https://web.archive.org/web/20090601193905/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200706281644411972_SH-D162D_SB00.bin&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB00] <br> [https://web.archive.org/web/20090916202345/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200811051941150901_SH-D162D_SB01.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB01] <br> SB02{{citation needed}}[http://www.firmwarehq.com/download_995-file_SH-D162D_SB02.exe.html unkown if safe or legit] <br> [https://web.archive.org/web/20090402052613/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200903191825218171_SH-D162D_SB03.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB03] <br> [https://web.archive.org/web/20120123040117/http://www.samsungodd.com:80/korlib/download.asp?no=&fname=200909281412336931_SH-D162D_SB04.exe&path=/UploadFiles/FW/FWDOWNLOAD/ENG/ SB04]<br />
|SB00 Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H352C<br />
|IDE<br />
|<br />
|Kreon{{citation needed}}<br />
|-<br />
|Toshiba TS-H352D<br />
|IDE<br />
|<br />
|Kreon{{citation needed}}<br />
|-<br />
|Samsung SH-D163A<br />
|SATA<br />
|<br />
|SB01 Kreon 1.00 (October 9th 2007)<br />
|-<br />
|Samsung SH-D163B<br />
|SATA<br />
|<br />
|Kreon 1.00 (November 18th 2007)<br />
|-<br />
|Toshiba TS-H353A<br />
|SATA<br />
|<br />
|{{citation needed}}<br />
|-<br />
|Toshiba TS-H353B<br />
|SATA<br />
|<br />
|{{citation needed}}<br />
|}<br />
<br />
Please note that the modified firmwares are based on copyrighted material and can therefore not be legally shared here.<br />
Patch files to patch original firmwares into dumping-firmwares would be appreciated. <br />
<br />
Flashing software:<br />
<br />
* TSDNMAC for MacOS<br />
* [http://web.archive.org/web/20070301000000/http://www.samsungodd.com/KorLib/File/sfdnwin.exe SFDNWIN] for Microsoft Windows 2000 and XP<br />
* TSDNWIN for Microsoft Windows Vista and 7<br />
* Dell SFDNDOS and the newer TSDNDOS for Microsoft DOS<br />
<br />
For current dumping instructions see [http://forum.redump.org/topic/6073/xbox-1-360-dumping-instructions/ the Dumping Guide by the Redump Project].<br />
<br />
=== Xbox related commands ===<br />
<br />
==== Enable Unlock 1 (xtreme) state ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 01</pre><br />
<br />
Enable Unlock 1 (xtreme) state' as we already know it from the 360 xtreme modded drives. <br />
This command is supported for legacy reasons only. Custom applications should use the new 'Set Lock State' instead.<br />
<br />
==== Set Lock State ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 11 xx</pre><br />
<br />
* <code>xx=00</code> - Drive locked (no unlock state)<br />
* <code>xx=01</code> - Unlock State 1 (xtreme) enabled<br />
* <code>xx=02</code> - Unlock state 2 (wxripper) enabled<br />
<br />
==== SS extract command ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>AD 00 FF 02 FD FF FE 00 08 00 xx C0</pre><br />
<br />
This is the well known from the xtreme firmware.<br />
<br />
==== Get Feature List ====<br />
<br />
Supported by: Kreon 1.00<br />
<pre>FF 08 01 10</pre><br />
<br />
This command will return a list of the additional features supported by the drive.<br />
All values returned are 16 bit values, and the list is terminated with null (<code>0x0000</code>).<br />
The two first words of the returned list always reads as <code>0xA55A 0X5AA5</code> in order to guarantee that a reply from a drive not supporting this command correctly isn't mistaken for a feature list.<br />
<br />
An example feature list could be: <code>0xA55A, 0x5AA5, 0x0100, 0xF000, 0xF001, 0x0000</code><br />
<br />
This list would indicate that the drive supports XBOX360 Unlock 1, Lock and Error Skip, as it can be seen from the values defined below:<br />
<br />
XBOX 360 related features:<br />
<br />
* <code>0x0100</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0101</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0120</code> : The drive can read and decrypt the SS<br />
* <code>0x0121</code> : The drive has full challenge response functionality<br />
<br />
XBOX related features:<br />
<br />
* <code>0x0200</code> : The drive supports the unlock 1 state (xtreme)<br />
* <code>0x0201</code> : The drive supports the unlock 2 state (wxripper)<br />
* <code>0x0220</code> : The drive can read and decrypt the SS<br />
* <code>0x0221</code> : The drive has full challenge response functionality<br />
<br />
General drive features:<br />
<br />
* <code>0xF000</code> : The drive supports the lock (cancel any unlock state) command<br />
* <code>0xF001</code> : The drive supports error skipping<br />
<br />
This is the complete list of defined features at the moment. If you're working on a custom application you might want to contact me in order to get the latest list.<br />
<br />
== References and links == <br />
* [https://web.archive.org/web/20150616131202/http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf http://dark.ellende.eu/public/360DVDfirmwareRelatedInfo.pdf]<br />
* [https://multimedia.cx/eggs/xbox-sphinx-protocol/ Overview of the challenge/response security protocol]<br />
* [http://redump.org/discs/system/xbox/ Xbox Game Discs preserved by the Redump Project]<br />
* [http://wiki.redump.org/index.php?title=Discs_not_yet_dumped#Microsoft_Xbox Missing Xbox Game Disc dumps at Redump Project]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Dashboard&diff=6202Dashboard2017-09-05T18:25:54Z<p>KaosEngineer: /* Traveling Menus */</p>
<hr />
<div>== Hidden features ==<br />
<br />
=== Hotkey to switch to HD modes ===<br />
<br />
Latest Xbox Dashboard (5960) force 480p display mode:<br />
<br />
Press and hold Left trigger, right trigger, and both analog stick buttons.<br />
<br />
The normally displayed 480i dashboard will switch to 480p output while using<br />
the Xbox High Definition AV Pack or cable.<br />
<br />
Repeat button combo to toggle between 480p and 480i.<br />
<br />
=== Music visualization in fullscreen ===<br />
Press "Y" then "X" while playing audio CDs or soundtracks stored on the HDD to display full-screen geiss-like music visualization. Or, press Info button on the DVD Playback Kit remote.<br />
<br />
But, wait there's more (only visible with DVD Playback Kit and Remote).<br />
<br />
Fullscreen Visualization Part 2:<br />
<br />
#Start playing a song using either the Xbox controller or playback kit remote.<br />
#Press "Y" then "X" on the controller or "INFO" on the remote to get the full screen visualization.<br />
#Here's the part that requires the DVD Playback Kit remote. Press "STOP" or "PAUSE" (you cannot use the controller to stop the music to see it as doing so goes back to the Music Playback menu with the small visualization area). Once the music visualization pattern dies down, a full-screen swirling starfield pattern appears. After some time passes, the screen will be filled with a changing burst of solid color where you can make out the wireframe spinning globe seen encompassing the main dashboard background. The burst of color fades to black leaving the swirling starfield. The cycle repeats with a random changing solid color burst which fades to the swirling starfield.<br />
<br />
Not quite true about needing the remote control, if playing a CD while full screen visualization is displayed, press the eject button on the front of the Xbox console.<br />
<br />
=== Soundtrack name Easter-Egg ("<<Eggs&beta;ox>>") ===<br />
<br />
Stored in settings_adoc.xip (which is actually an XBE file)<br />
<br />
==== Steps to activate Soundtrack Easter Egg: ====<br />
# Insert an audio CD and let it begin to play. <br />
# Stop the disk and step back (press B) in order to "Copy" selected tracks of the CD to the hard drive. <br />
# When the track list comes up, "Select All" and continue. <br />
# Choose "New Soundtrack" as the destination for your selection. <br />
# Enter the name of your soundtrack exactly as follows: <<Eggs&beta;ox>> including the less than, beta, and greater than symbols. <br />
# After you have entered the title, select "Done". A "Thank You" message starts which is followed by a scrolling list of the Xbox Team members.<br />
If you press a button on the controller or let the message play through to the end -- the Xbox reboots.<br />
<br />
=== Parental Control Bypass ===<br />
<br />
If Parental Control is enabled and the password set has been forgotten, all is not lost. Use the following sequence:<br />
* {{input-x}} {{input-y}} {{input-lt}} {{input-x}}<br />
SET PASS CODE, MOVIES and GAMES level can now be modified and the pass code removed if so desired.<br />
<br />
With SET PASS CODE selected, press {{input-a}} or {{input-start}} to change the current pass code and once more to be prompted, "Do you wish to delete the current pass code?". Select Yes or No then {{input-a}}.<br />
<br />
=== Format Admin Codes ===<br />
<br />
Secret Xbox format codes to format all drives except C. The code is different for all versions of the Xbox. If you find your code, please post it here along with your xbox version (at least the last 2 digits of the serial number - the factory code where it was manufactured).<br />
<br />
==== Different codes based on serial-number ====<br />
<br />
MS support techs under certain conditions would ask for your serial number and verify registration of your Xbox before giving you a code to clear/format your fouled Xbox's HDD.{{FIXME|reason=What part(s) of the serial number they used to determine the correct code is unknown?}}<br />
<br />
==== List of Xbox Format Admin Codes ====<br />
<br />
All of these codes are entered at the MS Dashboard's "System Info" screen. (UNTESTED here, codes posted as given at original source site.)<br />
<br />
* Xbox v1.0: {{input-y}} {{input-x}} {{input-ly+}} {{input-lx-}} {{input-a}}<br />
* Unknown version{{FIXME|reason=Which? This one seems to work with most Xbox sold in the United States}}: {{input-y}} {{input-ly+}} {{input-ly-}} {{input-x}} {{input-a}}<br />
* Unknown version{{FIXME|reason=Which? This one worked with the Xbox manufactured in Hungary, serial numbers ending in 03}}: {{input-y}} {{input-lx-}} {{input-x}} {{input-a}} {{input-lx-}}<br />
<br />
Source: [https://web.archive.org/web/20041010231137/http://unmodded.mine.nu:80/docs/FormatAdminCode unmodded.mine.nu/docs/FormatAdminCode]<br />
<br />
=== Traveling Menus ===<br />
<br />
Turn on your Xbox and go to the dashboard, press {{input-y}} {{ input-x}} on the main screen not from any sub-menu, the main menu will start to slowly move. Press {{input-y}} {{ input-x}} to return menu to locked position. All sub-menus will be moving about as well, you cannot return to locked position from sub-menus only from main menu.<br />
<br />
Source: Shaky Menu at https://www.gamefaqs.com/xbox/915780-xbox/cheats<br />
<br />
== See Also ==<br />
<br />
[[Hard Drive Files]]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Dashboard&diff=6201Dashboard2017-09-05T17:43:46Z<p>KaosEngineer: /* Traveling Menus */</p>
<hr />
<div>== Hidden features ==<br />
<br />
=== Hotkey to switch to HD modes ===<br />
<br />
Latest Xbox Dashboard (5960) force 480p display mode:<br />
<br />
Press and hold Left trigger, right trigger, and both analog stick buttons.<br />
<br />
The normally displayed 480i dashboard will switch to 480p output while using<br />
the Xbox High Definition AV Pack or cable.<br />
<br />
Repeat button combo to toggle between 480p and 480i.<br />
<br />
=== Music visualization in fullscreen ===<br />
Press "Y" then "X" while playing audio CDs or soundtracks stored on the HDD to display full-screen geiss-like music visualization. Or, press Info button on the DVD Playback Kit remote.<br />
<br />
But, wait there's more (only visible with DVD Playback Kit and Remote).<br />
<br />
Fullscreen Visualization Part 2:<br />
<br />
#Start playing a song using either the Xbox controller or playback kit remote.<br />
#Press "Y" then "X" on the controller or "INFO" on the remote to get the full screen visualization.<br />
#Here's the part that requires the DVD Playback Kit remote. Press "STOP" or "PAUSE" (you cannot use the controller to stop the music to see it as doing so goes back to the Music Playback menu with the small visualization area). Once the music visualization pattern dies down, a full-screen swirling starfield pattern appears. After some time passes, the screen will be filled with a changing burst of solid color where you can make out the wireframe spinning globe seen encompassing the main dashboard background. The burst of color fades to black leaving the swirling starfield. The cycle repeats with a random changing solid color burst which fades to the swirling starfield.<br />
<br />
Not quite true about needing the remote control, if playing a CD while full screen visualization is displayed, press the eject button on the front of the Xbox console.<br />
<br />
=== Soundtrack name Easter-Egg ("<<Eggs&beta;ox>>") ===<br />
<br />
Stored in settings_adoc.xip (which is actually an XBE file)<br />
<br />
==== Steps to activate Soundtrack Easter Egg: ====<br />
# Insert an audio CD and let it begin to play. <br />
# Stop the disk and step back (press B) in order to "Copy" selected tracks of the CD to the hard drive. <br />
# When the track list comes up, "Select All" and continue. <br />
# Choose "New Soundtrack" as the destination for your selection. <br />
# Enter the name of your soundtrack exactly as follows: <<Eggs&beta;ox>> including the less than, beta, and greater than symbols. <br />
# After you have entered the title, select "Done". A "Thank You" message starts which is followed by a scrolling list of the Xbox Team members.<br />
If you press a button on the controller or let the message play through to the end -- the Xbox reboots.<br />
<br />
=== Parental Control Bypass ===<br />
<br />
If Parental Control is enabled and the password set has been forgotten, all is not lost. Use the following sequence:<br />
* {{input-x}} {{input-y}} {{input-lt}} {{input-x}}<br />
SET PASS CODE, MOVIES and GAMES level can now be modified and the pass code removed if so desired.<br />
<br />
With SET PASS CODE selected, press {{input-a}} or {{input-start}} to change the current pass code and once more to be prompted, "Do you wish to delete the current pass code?". Select Yes or No then {{input-a}}.<br />
<br />
=== Format Admin Codes ===<br />
<br />
Secret Xbox format codes to format all drives except C. The code is different for all versions of the Xbox. If you find your code, please post it here along with your xbox version (at least the last 2 digits of the serial number - the factory code where it was manufactured).<br />
<br />
==== Different codes based on serial-number ====<br />
<br />
MS support techs under certain conditions would ask for your serial number and verify registration of your Xbox before giving you a code to clear/format your fouled Xbox's HDD.{{FIXME|reason=What part(s) of the serial number they used to determine the correct code is unknown?}}<br />
<br />
==== List of Xbox Format Admin Codes ====<br />
<br />
All of these codes are entered at the MS Dashboard's "System Info" screen. (UNTESTED here, codes posted as given at original source site.)<br />
<br />
* Xbox v1.0: {{input-y}} {{input-x}} {{input-ly+}} {{input-lx-}} {{input-a}}<br />
* Unknown version{{FIXME|reason=Which? This one seems to work with most Xbox sold in the United States}}: {{input-y}} {{input-ly+}} {{input-ly-}} {{input-x}} {{input-a}}<br />
* Unknown version{{FIXME|reason=Which? This one worked with the Xbox manufactured in Hungary, serial numbers ending in 03}}: {{input-y}} {{input-lx-}} {{input-x}} {{input-a}} {{input-lx-}}<br />
<br />
Source: [https://web.archive.org/web/20041010231137/http://unmodded.mine.nu:80/docs/FormatAdminCode unmodded.mine.nu/docs/FormatAdminCode]<br />
<br />
=== Traveling Menus ===<br />
<br />
Turn on your Xbox and go to the dashboard, Press {{input-y}} {{ input-x}} on the main screen not from any sub-menu, the main menu will start to slowly move. Press {{input-y}} {{ input-x}} to return menu to locked position. All sub-menus will be moving about as well, you cannot return to locked position from sub-menus only from main menu.<br />
<br />
Source: Shaky Menu at https://www.gamefaqs.com/xbox/915780-xbox/cheats<br />
<br />
== See Also ==<br />
<br />
[[Hard Drive Files]]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Dashboard&diff=6200Dashboard2017-09-05T17:41:13Z<p>KaosEngineer: /* Traveling Main Menu */</p>
<hr />
<div>== Hidden features ==<br />
<br />
=== Hotkey to switch to HD modes ===<br />
<br />
Latest Xbox Dashboard (5960) force 480p display mode:<br />
<br />
Press and hold Left trigger, right trigger, and both analog stick buttons.<br />
<br />
The normally displayed 480i dashboard will switch to 480p output while using<br />
the Xbox High Definition AV Pack or cable.<br />
<br />
Repeat button combo to toggle between 480p and 480i.<br />
<br />
=== Music visualization in fullscreen ===<br />
Press "Y" then "X" while playing audio CDs or soundtracks stored on the HDD to display full-screen geiss-like music visualization. Or, press Info button on the DVD Playback Kit remote.<br />
<br />
But, wait there's more (only visible with DVD Playback Kit and Remote).<br />
<br />
Fullscreen Visualization Part 2:<br />
<br />
#Start playing a song using either the Xbox controller or playback kit remote.<br />
#Press "Y" then "X" on the controller or "INFO" on the remote to get the full screen visualization.<br />
#Here's the part that requires the DVD Playback Kit remote. Press "STOP" or "PAUSE" (you cannot use the controller to stop the music to see it as doing so goes back to the Music Playback menu with the small visualization area). Once the music visualization pattern dies down, a full-screen swirling starfield pattern appears. After some time passes, the screen will be filled with a changing burst of solid color where you can make out the wireframe spinning globe seen encompassing the main dashboard background. The burst of color fades to black leaving the swirling starfield. The cycle repeats with a random changing solid color burst which fades to the swirling starfield.<br />
<br />
Not quite true about needing the remote control, if playing a CD while full screen visualization is displayed, press the eject button on the front of the Xbox console.<br />
<br />
=== Soundtrack name Easter-Egg ("<<Eggs&beta;ox>>") ===<br />
<br />
Stored in settings_adoc.xip (which is actually an XBE file)<br />
<br />
==== Steps to activate Soundtrack Easter Egg: ====<br />
# Insert an audio CD and let it begin to play. <br />
# Stop the disk and step back (press B) in order to "Copy" selected tracks of the CD to the hard drive. <br />
# When the track list comes up, "Select All" and continue. <br />
# Choose "New Soundtrack" as the destination for your selection. <br />
# Enter the name of your soundtrack exactly as follows: <<Eggs&beta;ox>> including the less than, beta, and greater than symbols. <br />
# After you have entered the title, select "Done". A "Thank You" message starts which is followed by a scrolling list of the Xbox Team members.<br />
If you press a button on the controller or let the message play through to the end -- the Xbox reboots.<br />
<br />
=== Parental Control Bypass ===<br />
<br />
If Parental Control is enabled and the password set has been forgotten, all is not lost. Use the following sequence:<br />
* {{input-x}} {{input-y}} {{input-lt}} {{input-x}}<br />
SET PASS CODE, MOVIES and GAMES level can now be modified and the pass code removed if so desired.<br />
<br />
With SET PASS CODE selected, press {{input-a}} or {{input-start}} to change the current pass code and once more to be prompted, "Do you wish to delete the current pass code?". Select Yes or No then {{input-a}}.<br />
<br />
=== Format Admin Codes ===<br />
<br />
Secret Xbox format codes to format all drives except C. The code is different for all versions of the Xbox. If you find your code, please post it here along with your xbox version (at least the last 2 digits of the serial number - the factory code where it was manufactured).<br />
<br />
==== Different codes based on serial-number ====<br />
<br />
MS support techs under certain conditions would ask for your serial number and verify registration of your Xbox before giving you a code to clear/format your fouled Xbox's HDD.{{FIXME|reason=What part(s) of the serial number they used to determine the correct code is unknown?}}<br />
<br />
==== List of Xbox Format Admin Codes ====<br />
<br />
All of these codes are entered at the MS Dashboard's "System Info" screen. (UNTESTED here, codes posted as given at original source site.)<br />
<br />
* Xbox v1.0: {{input-y}} {{input-x}} {{input-ly+}} {{input-lx-}} {{input-a}}<br />
* Unknown version{{FIXME|reason=Which? This one seems to work with most Xbox sold in the United States}}: {{input-y}} {{input-ly+}} {{input-ly-}} {{input-x}} {{input-a}}<br />
* Unknown version{{FIXME|reason=Which? This one worked with the Xbox manufactured in Hungary, serial numbers ending in 03}}: {{input-y}} {{input-lx-}} {{input-x}} {{input-a}} {{input-lx-}}<br />
<br />
Source: [https://web.archive.org/web/20041010231137/http://unmodded.mine.nu:80/docs/FormatAdminCode unmodded.mine.nu/docs/FormatAdminCode]<br />
<br />
=== Traveling Menus ===<br />
<br />
Turn on your Xbox and go to the dashboard, Press {{input-y}} {{ input-x}} at the main screen, the main menu will start to slowly move. Press {{input-y}} {{ input-x}} to return menu to locked position. All sub-menus will be moving about as well, you cannot return to locked position from sub-menus only from main menu.<br />
<br />
Source: Shaky Menu at https://www.gamefaqs.com/xbox/915780-xbox/cheats<br />
<br />
== See Also ==<br />
<br />
[[Hard Drive Files]]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Dashboard&diff=6199Dashboard2017-09-05T17:34:55Z<p>KaosEngineer: /* Hidden features */ New Traveling Main menu wrong depth (one too many ='s in header)</p>
<hr />
<div>== Hidden features ==<br />
<br />
=== Hotkey to switch to HD modes ===<br />
<br />
Latest Xbox Dashboard (5960) force 480p display mode:<br />
<br />
Press and hold Left trigger, right trigger, and both analog stick buttons.<br />
<br />
The normally displayed 480i dashboard will switch to 480p output while using<br />
the Xbox High Definition AV Pack or cable.<br />
<br />
Repeat button combo to toggle between 480p and 480i.<br />
<br />
=== Music visualization in fullscreen ===<br />
Press "Y" then "X" while playing audio CDs or soundtracks stored on the HDD to display full-screen geiss-like music visualization. Or, press Info button on the DVD Playback Kit remote.<br />
<br />
But, wait there's more (only visible with DVD Playback Kit and Remote).<br />
<br />
Fullscreen Visualization Part 2:<br />
<br />
#Start playing a song using either the Xbox controller or playback kit remote.<br />
#Press "Y" then "X" on the controller or "INFO" on the remote to get the full screen visualization.<br />
#Here's the part that requires the DVD Playback Kit remote. Press "STOP" or "PAUSE" (you cannot use the controller to stop the music to see it as doing so goes back to the Music Playback menu with the small visualization area). Once the music visualization pattern dies down, a full-screen swirling starfield pattern appears. After some time passes, the screen will be filled with a changing burst of solid color where you can make out the wireframe spinning globe seen encompassing the main dashboard background. The burst of color fades to black leaving the swirling starfield. The cycle repeats with a random changing solid color burst which fades to the swirling starfield.<br />
<br />
Not quite true about needing the remote control, if playing a CD while full screen visualization is displayed, press the eject button on the front of the Xbox console.<br />
<br />
=== Soundtrack name Easter-Egg ("<<Eggs&beta;ox>>") ===<br />
<br />
Stored in settings_adoc.xip (which is actually an XBE file)<br />
<br />
==== Steps to activate Soundtrack Easter Egg: ====<br />
# Insert an audio CD and let it begin to play. <br />
# Stop the disk and step back (press B) in order to "Copy" selected tracks of the CD to the hard drive. <br />
# When the track list comes up, "Select All" and continue. <br />
# Choose "New Soundtrack" as the destination for your selection. <br />
# Enter the name of your soundtrack exactly as follows: <<Eggs&beta;ox>> including the less than, beta, and greater than symbols. <br />
# After you have entered the title, select "Done". A "Thank You" message starts which is followed by a scrolling list of the Xbox Team members.<br />
If you press a button on the controller or let the message play through to the end -- the Xbox reboots.<br />
<br />
=== Parental Control Bypass ===<br />
<br />
If Parental Control is enabled and the password set has been forgotten, all is not lost. Use the following sequence:<br />
* {{input-x}} {{input-y}} {{input-lt}} {{input-x}}<br />
SET PASS CODE, MOVIES and GAMES level can now be modified and the pass code removed if so desired.<br />
<br />
With SET PASS CODE selected, press {{input-a}} or {{input-start}} to change the current pass code and once more to be prompted, "Do you wish to delete the current pass code?". Select Yes or No then {{input-a}}.<br />
<br />
=== Format Admin Codes ===<br />
<br />
Secret Xbox format codes to format all drives except C. The code is different for all versions of the Xbox. If you find your code, please post it here along with your xbox version (at least the last 2 digits of the serial number - the factory code where it was manufactured).<br />
<br />
==== Different codes based on serial-number ====<br />
<br />
MS support techs under certain conditions would ask for your serial number and verify registration of your Xbox before giving you a code to clear/format your fouled Xbox's HDD.{{FIXME|reason=What part(s) of the serial number they used to determine the correct code is unknown?}}<br />
<br />
==== List of Xbox Format Admin Codes ====<br />
<br />
All of these codes are entered at the MS Dashboard's "System Info" screen. (UNTESTED here, codes posted as given at original source site.)<br />
<br />
* Xbox v1.0: {{input-y}} {{input-x}} {{input-ly+}} {{input-lx-}} {{input-a}}<br />
* Unknown version{{FIXME|reason=Which? This one seems to work with most Xbox sold in the United States}}: {{input-y}} {{input-ly+}} {{input-ly-}} {{input-x}} {{input-a}}<br />
* Unknown version{{FIXME|reason=Which? This one worked with the Xbox manufactured in Hungary, serial numbers ending in 03}}: {{input-y}} {{input-lx-}} {{input-x}} {{input-a}} {{input-lx-}}<br />
<br />
Source: [https://web.archive.org/web/20041010231137/http://unmodded.mine.nu:80/docs/FormatAdminCode unmodded.mine.nu/docs/FormatAdminCode]<br />
<br />
=== Traveling Main Menu ===<br />
<br />
Turn on your Xbox and go to the dashboard, Press {{input-y}} {{ input-x}} at the main screen, the main menu will start to slowly move. Press {{input-y}} {{ input-x}} to return menu to locked position.<br />
<br />
Source: Shaky Menu at https://www.gamefaqs.com/xbox/915780-xbox/cheats<br />
<br />
== See Also ==<br />
<br />
[[Hard Drive Files]]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Dashboard&diff=6198Dashboard2017-09-05T17:33:56Z<p>KaosEngineer: Added Shaky Menu from gamefaqs.com - really a slowly moving menu I wouldn't really call it a SHAKY menu.</p>
<hr />
<div>== Hidden features ==<br />
<br />
=== Hotkey to switch to HD modes ===<br />
<br />
Latest Xbox Dashboard (5960) force 480p display mode:<br />
<br />
Press and hold Left trigger, right trigger, and both analog stick buttons.<br />
<br />
The normally displayed 480i dashboard will switch to 480p output while using<br />
the Xbox High Definition AV Pack or cable.<br />
<br />
Repeat button combo to toggle between 480p and 480i.<br />
<br />
=== Music visualization in fullscreen ===<br />
Press "Y" then "X" while playing audio CDs or soundtracks stored on the HDD to display full-screen geiss-like music visualization. Or, press Info button on the DVD Playback Kit remote.<br />
<br />
But, wait there's more (only visible with DVD Playback Kit and Remote).<br />
<br />
Fullscreen Visualization Part 2:<br />
<br />
#Start playing a song using either the Xbox controller or playback kit remote.<br />
#Press "Y" then "X" on the controller or "INFO" on the remote to get the full screen visualization.<br />
#Here's the part that requires the DVD Playback Kit remote. Press "STOP" or "PAUSE" (you cannot use the controller to stop the music to see it as doing so goes back to the Music Playback menu with the small visualization area). Once the music visualization pattern dies down, a full-screen swirling starfield pattern appears. After some time passes, the screen will be filled with a changing burst of solid color where you can make out the wireframe spinning globe seen encompassing the main dashboard background. The burst of color fades to black leaving the swirling starfield. The cycle repeats with a random changing solid color burst which fades to the swirling starfield.<br />
<br />
Not quite true about needing the remote control, if playing a CD while full screen visualization is displayed, press the eject button on the front of the Xbox console.<br />
<br />
=== Soundtrack name Easter-Egg ("<<Eggs&beta;ox>>") ===<br />
<br />
Stored in settings_adoc.xip (which is actually an XBE file)<br />
<br />
==== Steps to activate Soundtrack Easter Egg: ====<br />
# Insert an audio CD and let it begin to play. <br />
# Stop the disk and step back (press B) in order to "Copy" selected tracks of the CD to the hard drive. <br />
# When the track list comes up, "Select All" and continue. <br />
# Choose "New Soundtrack" as the destination for your selection. <br />
# Enter the name of your soundtrack exactly as follows: <<Eggs&beta;ox>> including the less than, beta, and greater than symbols. <br />
# After you have entered the title, select "Done". A "Thank You" message starts which is followed by a scrolling list of the Xbox Team members.<br />
If you press a button on the controller or let the message play through to the end -- the Xbox reboots.<br />
<br />
=== Parental Control Bypass ===<br />
<br />
If Parental Control is enabled and the password set has been forgotten, all is not lost. Use the following sequence:<br />
* {{input-x}} {{input-y}} {{input-lt}} {{input-x}}<br />
SET PASS CODE, MOVIES and GAMES level can now be modified and the pass code removed if so desired.<br />
<br />
With SET PASS CODE selected, press {{input-a}} or {{input-start}} to change the current pass code and once more to be prompted, "Do you wish to delete the current pass code?". Select Yes or No then {{input-a}}.<br />
<br />
=== Format Admin Codes ===<br />
<br />
Secret Xbox format codes to format all drives except C. The code is different for all versions of the Xbox. If you find your code, please post it here along with your xbox version (at least the last 2 digits of the serial number - the factory code where it was manufactured).<br />
<br />
==== Different codes based on serial-number ====<br />
<br />
MS support techs under certain conditions would ask for your serial number and verify registration of your Xbox before giving you a code to clear/format your fouled Xbox's HDD.{{FIXME|reason=What part(s) of the serial number they used to determine the correct code is unknown?}}<br />
<br />
==== List of Xbox Format Admin Codes ====<br />
<br />
All of these codes are entered at the MS Dashboard's "System Info" screen. (UNTESTED here, codes posted as given at original source site.)<br />
<br />
* Xbox v1.0: {{input-y}} {{input-x}} {{input-ly+}} {{input-lx-}} {{input-a}}<br />
* Unknown version{{FIXME|reason=Which? This one seems to work with most Xbox sold in the United States}}: {{input-y}} {{input-ly+}} {{input-ly-}} {{input-x}} {{input-a}}<br />
* Unknown version{{FIXME|reason=Which? This one worked with the Xbox manufactured in Hungary, serial numbers ending in 03}}: {{input-y}} {{input-lx-}} {{input-x}} {{input-a}} {{input-lx-}}<br />
<br />
Source: [https://web.archive.org/web/20041010231137/http://unmodded.mine.nu:80/docs/FormatAdminCode unmodded.mine.nu/docs/FormatAdminCode]<br />
<br />
==== Traveling Main Menu ====<br />
<br />
Turn on your Xbox and go to the dashboard, Press {{input-y}} {{ input-x}} at the main screen, the main menu will start to slowly move. Press {{input-y}} {{ input-x}} to return menu to locked position.<br />
<br />
Source: Shaky Menu at https://www.gamefaqs.com/xbox/915780-xbox/cheats<br />
<br />
== See Also ==<br />
<br />
[[Hard Drive Files]]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Dashboard&diff=6184Dashboard2017-09-02T08:33:19Z<p>KaosEngineer: /* Format Admin Codes */</p>
<hr />
<div>== Hidden features ==<br />
<br />
=== Hotkey to switch to HD modes ===<br />
<br />
Latest Xbox Dashboard (5960) force 480p display mode:<br />
<br />
Press and hold Left trigger, right trigger, and both analog stick buttons.<br />
<br />
The normally displayed 480i dashboard will switch to 480p output while using<br />
the Xbox High Definition AV Pack or cable.<br />
<br />
Repeat button combo to toggle between 480p and 480i.<br />
<br />
=== Music visualization in fullscreen ===<br />
Press "Y" then "X" while playing audio CDs or soundtracks stored on the HDD to display full-screen geiss-like music visualization. Or, press Info button on the DVD Playback Kit remote.<br />
<br />
But, wait there's more (only visible with DVD Playback Kit and Remote).<br />
<br />
Fullscreen Visualization Part 2:<br />
<br />
#Start playing a song using either the Xbox controller or playback kit remote.<br />
#Press "Y" then "X" on the controller or "INFO" on the remote to get the full screen visualization.<br />
#Here's the part that requires the DVD Playback Kit remote. Press "STOP" or "PAUSE" (you cannot use the controller to stop the music to see it as doing so goes back to the Music Playback menu with the small visualization area). Once the music visualization pattern dies down, a full-screen swirling starfield pattern appears. After some time passes, the screen will be filled with a changing burst of solid color where you can make out the wireframe spinning globe seen encompassing the main dashboard background. The burst of color fades to black leaving the swirling starfield. The cycle repeats with a random changing solid color burst which fades to the swirling starfield.<br />
<br />
Not quite true about needing the remote control, if playing a CD while full screen visualization is displayed, press the eject button on the front of the Xbox console.<br />
<br />
=== Soundtrack name Easter-Egg ("<<Eggs&beta;ox>>") ===<br />
<br />
Stored in settings_adoc.xip (which is actually an XBE file)<br />
<br />
==== Steps to activate Soundtrack Easter Egg: ====<br />
# Insert an audio CD and let it begin to play. <br />
# Stop the disk and step back (press B) in order to "Copy" selected tracks of the CD to the hard drive. <br />
# When the track list comes up, "Select All" and continue. <br />
# Choose "New Soundtrack" as the destination for your selection. <br />
# Enter the name of your soundtrack exactly as follows: <<Eggs&beta;ox>> including the less than, beta, and greater than symbols. <br />
# After you have entered the title, select "Done". A "Thank You" message starts which is followed by a scrolling list of the Xbox Team members.<br />
If you press a button on the controller or let the message play through to the end -- the Xbox reboots.<br />
<br />
=== Parental Control Bypass ===<br />
<br />
If Parental Control is enabled and the password set has been forgotten, all is not lost. Use the following sequence:<br />
* {{input-x}} {{input-y}} {{input-lt}} {{input-x}}<br />
SET PASS CODE, MOVIES and GAMES level can now be modified and the pass code removed if so desired.<br />
<br />
With SET PASS CODE selected, press {{input-a}} or {{input-start}} to change the current pass code and once more to be prompted, "Do you wish to delete the current pass code?". Select Yes or No then {{input-a}}.<br />
<br />
=== Format Admin Codes ===<br />
<br />
Secret Xbox format codes to format all drives except C. The code is different for all versions of the Xbox. If you find your code, please post it here along with your xbox version (at least the last 2 digits of the serial number - the factory code where it was manufactured).<br />
<br />
==== Different Xboxes Use Different Codes ====<br />
<br />
MS support techs under certain conditions would ask for your serial number and verify registration of your Xbox before giving you a code to clear/format your fouled Xbox's HDD. <br />
<br />
What part(s) of the serial number they used to determine the correct code is unknown?<br />
<br />
More data is needed to sort out which Xbox a particular code works on, and what other codes exist.<br />
<br />
Is it based on Xbox scene version numbers? Most likely, NOT! Is it based on factory of production? Is it based on BIOS version? Does anyone know? <br />
<br />
==== List of Xbox Format Admin Codes ====<br />
<br />
All of these codes are entered at the MS Dashboard's "System Info" screen. (UNTESTED here, codes posted as given at original source site.)<br />
<br />
<br />
Xbox v1.0: {{input-y}} {{input-x}} {{input-ly+}} {{input-lx-}} {{input-a}}<br />
<br />
<br />
Unknown version: {{input-y}} {{input-ly+}} {{input-ly-}} {{input-x}} {{input-a}}.<br />
<br />
(This one seems to work with most XBOXes sold in the United States) <br />
<br />
<br />
Unknown version: {{input-y}} {{input-lx-}} {{input-x}} {{input-a}} {{input-lx-}} <br />
<br />
(This one worked with the XBOXes manufactured in Hungary, serial numbers ending in 03) <br />
<br />
<br />
Source: Wayback Machine [https://web.archive.org/web/20041010231137/http://unmodded.mine.nu:80/docs/FormatAdminCode unmodded.mine.nu/docs/FormatAdminCode]<br />
<br />
== See Also ==<br />
<br />
[[Hard Drive Files]]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Dashboard&diff=6183Dashboard2017-09-02T08:31:58Z<p>KaosEngineer: /* Different Xboxes Use Different Codes */ Made a sub heading for the list of Format Admin Codes</p>
<hr />
<div>== Hidden features ==<br />
<br />
=== Hotkey to switch to HD modes ===<br />
<br />
Latest Xbox Dashboard (5960) force 480p display mode:<br />
<br />
Press and hold Left trigger, right trigger, and both analog stick buttons.<br />
<br />
The normally displayed 480i dashboard will switch to 480p output while using<br />
the Xbox High Definition AV Pack or cable.<br />
<br />
Repeat button combo to toggle between 480p and 480i.<br />
<br />
=== Music visualization in fullscreen ===<br />
Press "Y" then "X" while playing audio CDs or soundtracks stored on the HDD to display full-screen geiss-like music visualization. Or, press Info button on the DVD Playback Kit remote.<br />
<br />
But, wait there's more (only visible with DVD Playback Kit and Remote).<br />
<br />
Fullscreen Visualization Part 2:<br />
<br />
#Start playing a song using either the Xbox controller or playback kit remote.<br />
#Press "Y" then "X" on the controller or "INFO" on the remote to get the full screen visualization.<br />
#Here's the part that requires the DVD Playback Kit remote. Press "STOP" or "PAUSE" (you cannot use the controller to stop the music to see it as doing so goes back to the Music Playback menu with the small visualization area). Once the music visualization pattern dies down, a full-screen swirling starfield pattern appears. After some time passes, the screen will be filled with a changing burst of solid color where you can make out the wireframe spinning globe seen encompassing the main dashboard background. The burst of color fades to black leaving the swirling starfield. The cycle repeats with a random changing solid color burst which fades to the swirling starfield.<br />
<br />
Not quite true about needing the remote control, if playing a CD while full screen visualization is displayed, press the eject button on the front of the Xbox console.<br />
<br />
=== Soundtrack name Easter-Egg ("<<Eggs&beta;ox>>") ===<br />
<br />
Stored in settings_adoc.xip (which is actually an XBE file)<br />
<br />
==== Steps to activate Soundtrack Easter Egg: ====<br />
# Insert an audio CD and let it begin to play. <br />
# Stop the disk and step back (press B) in order to "Copy" selected tracks of the CD to the hard drive. <br />
# When the track list comes up, "Select All" and continue. <br />
# Choose "New Soundtrack" as the destination for your selection. <br />
# Enter the name of your soundtrack exactly as follows: <<Eggs&beta;ox>> including the less than, beta, and greater than symbols. <br />
# After you have entered the title, select "Done". A "Thank You" message starts which is followed by a scrolling list of the Xbox Team members.<br />
If you press a button on the controller or let the message play through to the end -- the Xbox reboots.<br />
<br />
=== Parental Control Bypass ===<br />
<br />
If Parental Control is enabled and the password set has been forgotten, all is not lost. Use the following sequence:<br />
* {{input-x}} {{input-y}} {{input-lt}} {{input-x}}<br />
SET PASS CODE, MOVIES and GAMES level can now be modified and the pass code removed if so desired.<br />
<br />
With SET PASS CODE selected, press {{input-a}} or {{input-start}} to change the current pass code and once more to be prompted, "Do you wish to delete the current pass code?". Select Yes or No then {{input-a}}.<br />
<br />
=== Format Admin Codes ===<br />
<br />
Secret Xbox format codes to format all drives except C. The code is different for all versions of the Xbox. If you find your code, please post it here along with your xbox version (at least the last 2 digits of the serial number - the factory code where it was manufactured).<br />
<br />
==== Different Xboxes Use Different Codes ====<br />
<br />
MS support techs under certain conditions would ask for your serial number and verify registration of your Xbox before giving you a code to clear/format your fouled Xbox's HDD. <br />
<br />
What part(s) of the serial number they used to determine the correct code is unknown?<br />
<br />
More data is needed to sort out which Xbox a particular code works on, and what other codes exist.<br />
<br />
Is it based on Xbox scene version numbers? Most likely, NOT! Is it based on factory of production? Is it based on BIOS version? Does anyone know? <br />
<br />
===== List of Xbox Format Admin Codes =====<br />
<br />
All of these codes are entered at the MS Dashboard's "System Info" screen. (UNTESTED here, codes posted as given at original source site.)<br />
<br />
<br />
Xbox v1.0: {{input-y}} {{input-x}} {{input-ly+}} {{input-lx-}} {{input-a}}<br />
<br />
<br />
Unknown version: {{input-y}} {{input-ly+}} {{input-ly-}} {{input-x}} {{input-a}}.<br />
<br />
(This one seems to work with most XBOXes sold in the United States) <br />
<br />
<br />
Unknown version: {{input-y}} {{input-lx-}} {{input-x}} {{input-a}} {{input-lx-}} <br />
<br />
(This one worked with the XBOXes manufactured in Hungary, serial numbers ending in 03) <br />
<br />
<br />
Source: Wayback Machine [https://web.archive.org/web/20041010231137/http://unmodded.mine.nu:80/docs/FormatAdminCode unmodded.mine.nu/docs/FormatAdminCode]<br />
<br />
== See Also ==<br />
<br />
[[Hard Drive Files]]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Dashboard&diff=6172Dashboard2017-08-31T13:30:04Z<p>KaosEngineer: /* Different Xboxes Use Different Codes */ Typo UDD instead of HDD and reworded end of that sentence too</p>
<hr />
<div>== Hidden features ==<br />
<br />
=== Hotkey to switch to HD modes ===<br />
<br />
Latest Xbox Dashboard (5960) force 480p display mode:<br />
<br />
Press and hold Left trigger, right trigger, and both analog stick buttons.<br />
<br />
The normally displayed 480i dashboard will switch to 480p output while using<br />
the Xbox High Definition AV Pack or cable.<br />
<br />
Repeat button combo to toggle between 480p and 480i.<br />
<br />
=== Music visualization in fullscreen ===<br />
Press "Y" then "X" while playing audio CDs or soundtracks stored on the HDD to display full-screen geiss-like music visualization. Or, press Info button on the DVD Playback Kit remote.<br />
<br />
But, wait there's more (only visible with DVD Playback Kit and Remote).<br />
<br />
Fullscreen Visualization Part 2:<br />
<br />
#Start playing a song using either the Xbox controller or playback kit remote.<br />
#Press "Y" then "X" on the controller or "INFO" on the remote to get the full screen visualization.<br />
#Here's the part that requires the DVD Playback Kit remote. Press "STOP" or "PAUSE" (you cannot use the controller to stop the music to see it as doing so goes back to the Music Playback menu with the small visualization area). Once the music visualization pattern dies down, a full-screen swirling starfield pattern appears. After some time passes, the screen will be filled with a changing burst of solid color where you can make out the wireframe spinning globe seen encompassing the main dashboard background. The burst of color fades to black leaving the swirling starfield. The cycle repeats with a random changing solid color burst which fades to the swirling starfield.<br />
<br />
Not quite true about needing the remote control, if playing a CD while full screen visualization is displayed, press the eject button on the front of the Xbox console.<br />
<br />
=== Soundtrack name Easter-Egg ("<<Eggs&beta;ox>>") ===<br />
<br />
Stored in settings_adoc.xip (which is actually an XBE file)<br />
<br />
==== Steps to activate Soundtrack Easter Egg: ====<br />
# Insert an audio CD and let it begin to play. <br />
# Stop the disk and step back (press B) in order to "Copy" selected tracks of the CD to the hard drive. <br />
# When the track list comes up, "Select All" and continue. <br />
# Choose "New Soundtrack" as the destination for your selection. <br />
# Enter the name of your soundtrack exactly as follows: <<Eggs&beta;ox>> including the less than, beta, and greater than symbols. <br />
# After you have entered the title, select "Done". A "Thank You" message starts which is followed by a scrolling list of the Xbox Team members.<br />
If you press a button on the controller or let the message play through to the end -- the Xbox reboots.<br />
<br />
=== Parental Control Bypass ===<br />
<br />
If Parental Control is enabled and the password set has been forgotten, all is not lost. Use the following sequence:<br />
* {{input-x}} {{input-y}} {{input-lt}} {{input-x}}<br />
SET PASS CODE, MOVIES and GAMES level can now be modified and the pass code removed if so desired.<br />
<br />
With SET PASS CODE selected, press {{input-a}} or {{input-start}} to change the current pass code and once more to be prompted, "Do you wish to delete the current pass code?". Select Yes or No then {{input-a}}.<br />
<br />
=== Format Admin Codes ===<br />
<br />
Secret Xbox format codes to format all drives except C. The code is different for all versions of the Xbox. If you find your code, please post it here along with your xbox version (at least the last 2 digits of the serial number - the factory code where it was manufactured).<br />
<br />
==== Different Xboxes Use Different Codes ====<br />
<br />
MS support techs under certain conditions would ask for your serial number and verify registration of your Xbox before giving you a code to clear/format your fouled Xbox's HDD. <br />
<br />
What part(s) of the serial number they used to determine the correct code is unknown?<br />
<br />
More data is needed to sort out which Xbox a particular code works on, and what other codes exist.<br />
<br />
Is it based on Xbox scene version numbers? Most likely, NOT! Is it based on factory of production? Is it based on BIOS version? Does anyone know? <br />
<br />
<br />
All of these codes are entered at the MS Dashboard's "System Info" screen. (UNTESTED here, codes posted as given at original source site.)<br />
<br />
<br />
Xbox v1.0: {{input-y}} {{input-x}} {{input-ly+}} {{input-lx-}} {{input-a}}<br />
<br />
<br />
Unknown version: {{input-y}} {{input-ly+}} {{input-ly-}} {{input-x}} {{input-a}}.<br />
<br />
(This one seems to work with most XBOXes sold in the United States) <br />
<br />
<br />
Unknown version: {{input-y}} {{input-lx-}} {{input-x}} {{input-a}} {{input-lx-}} <br />
<br />
(This one worked with the XBOXes manufactured in Hungary, serial numbers ending in 03) <br />
<br />
<br />
Source: Wayback Machine [https://web.archive.org/web/20041010231137/http://unmodded.mine.nu:80/docs/FormatAdminCode unmodded.mine.nu/docs/FormatAdminCode]<br />
<br />
== See Also ==<br />
<br />
[[Hard Drive Files]]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Dashboard&diff=6171Dashboard2017-08-31T13:25:10Z<p>KaosEngineer: /* Different Xboxes Use Different Codes */ mixed 1.0 combo first two buttons backwards</p>
<hr />
<div>== Hidden features ==<br />
<br />
=== Hotkey to switch to HD modes ===<br />
<br />
Latest Xbox Dashboard (5960) force 480p display mode:<br />
<br />
Press and hold Left trigger, right trigger, and both analog stick buttons.<br />
<br />
The normally displayed 480i dashboard will switch to 480p output while using<br />
the Xbox High Definition AV Pack or cable.<br />
<br />
Repeat button combo to toggle between 480p and 480i.<br />
<br />
=== Music visualization in fullscreen ===<br />
Press "Y" then "X" while playing audio CDs or soundtracks stored on the HDD to display full-screen geiss-like music visualization. Or, press Info button on the DVD Playback Kit remote.<br />
<br />
But, wait there's more (only visible with DVD Playback Kit and Remote).<br />
<br />
Fullscreen Visualization Part 2:<br />
<br />
#Start playing a song using either the Xbox controller or playback kit remote.<br />
#Press "Y" then "X" on the controller or "INFO" on the remote to get the full screen visualization.<br />
#Here's the part that requires the DVD Playback Kit remote. Press "STOP" or "PAUSE" (you cannot use the controller to stop the music to see it as doing so goes back to the Music Playback menu with the small visualization area). Once the music visualization pattern dies down, a full-screen swirling starfield pattern appears. After some time passes, the screen will be filled with a changing burst of solid color where you can make out the wireframe spinning globe seen encompassing the main dashboard background. The burst of color fades to black leaving the swirling starfield. The cycle repeats with a random changing solid color burst which fades to the swirling starfield.<br />
<br />
Not quite true about needing the remote control, if playing a CD while full screen visualization is displayed, press the eject button on the front of the Xbox console.<br />
<br />
=== Soundtrack name Easter-Egg ("<<Eggs&beta;ox>>") ===<br />
<br />
Stored in settings_adoc.xip (which is actually an XBE file)<br />
<br />
==== Steps to activate Soundtrack Easter Egg: ====<br />
# Insert an audio CD and let it begin to play. <br />
# Stop the disk and step back (press B) in order to "Copy" selected tracks of the CD to the hard drive. <br />
# When the track list comes up, "Select All" and continue. <br />
# Choose "New Soundtrack" as the destination for your selection. <br />
# Enter the name of your soundtrack exactly as follows: <<Eggs&beta;ox>> including the less than, beta, and greater than symbols. <br />
# After you have entered the title, select "Done". A "Thank You" message starts which is followed by a scrolling list of the Xbox Team members.<br />
If you press a button on the controller or let the message play through to the end -- the Xbox reboots.<br />
<br />
=== Parental Control Bypass ===<br />
<br />
If Parental Control is enabled and the password set has been forgotten, all is not lost. Use the following sequence:<br />
* {{input-x}} {{input-y}} {{input-lt}} {{input-x}}<br />
SET PASS CODE, MOVIES and GAMES level can now be modified and the pass code removed if so desired.<br />
<br />
With SET PASS CODE selected, press {{input-a}} or {{input-start}} to change the current pass code and once more to be prompted, "Do you wish to delete the current pass code?". Select Yes or No then {{input-a}}.<br />
<br />
=== Format Admin Codes ===<br />
<br />
Secret Xbox format codes to format all drives except C. The code is different for all versions of the Xbox. If you find your code, please post it here along with your xbox version (at least the last 2 digits of the serial number - the factory code where it was manufactured).<br />
<br />
==== Different Xboxes Use Different Codes ====<br />
<br />
MS support techs under certain conditions would ask for your serial number and verify registration of your Xbox before giving you a code to clear/format your Xbox's UDD that was acting up. What part(s) of the serial number they used to determine the correct code is unknown?<br />
<br />
More data is needed to sort out which Xbox a particular code works on, and what other codes exist.<br />
<br />
Is it based on Xbox scene version numbers? Most likely, NOT! Is it based on factory of production? Is it based on BIOS version? Does anyone know? <br />
<br />
<br />
All of these codes are entered at the MS Dashboard's "System Info" screen. (UNTESTED here, codes posted as given at original source site.)<br />
<br />
<br />
Xbox v1.0: {{input-y}} {{input-x}} {{input-ly+}} {{input-lx-}} {{input-a}}<br />
<br />
<br />
Unknown version: {{input-y}} {{input-ly+}} {{input-ly-}} {{input-x}} {{input-a}}.<br />
<br />
(This one seems to work with most XBOXes sold in the United States) <br />
<br />
<br />
Unknown version: {{input-y}} {{input-lx-}} {{input-x}} {{input-a}} {{input-lx-}} <br />
<br />
(This one worked with the XBOXes manufactured in Hungary, serial numbers ending in 03) <br />
<br />
<br />
Source: Wayback Machine [https://web.archive.org/web/20041010231137/http://unmodded.mine.nu:80/docs/FormatAdminCode unmodded.mine.nu/docs/FormatAdminCode]<br />
<br />
== See Also ==<br />
<br />
[[Hard Drive Files]]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Dashboard&diff=6170Dashboard2017-08-31T13:22:11Z<p>KaosEngineer: /* Hidden features */ Updated Parental Pass Code to use templated buttons. FormatAdminCodes found trying to locate old xbox-linux.org/down/usb_src.zip file w/WBM (never found it) but did these secret key combos to format/clear HDD except for C drive.</p>
<hr />
<div>== Hidden features ==<br />
<br />
=== Hotkey to switch to HD modes ===<br />
<br />
Latest Xbox Dashboard (5960) force 480p display mode:<br />
<br />
Press and hold Left trigger, right trigger, and both analog stick buttons.<br />
<br />
The normally displayed 480i dashboard will switch to 480p output while using<br />
the Xbox High Definition AV Pack or cable.<br />
<br />
Repeat button combo to toggle between 480p and 480i.<br />
<br />
=== Music visualization in fullscreen ===<br />
Press "Y" then "X" while playing audio CDs or soundtracks stored on the HDD to display full-screen geiss-like music visualization. Or, press Info button on the DVD Playback Kit remote.<br />
<br />
But, wait there's more (only visible with DVD Playback Kit and Remote).<br />
<br />
Fullscreen Visualization Part 2:<br />
<br />
#Start playing a song using either the Xbox controller or playback kit remote.<br />
#Press "Y" then "X" on the controller or "INFO" on the remote to get the full screen visualization.<br />
#Here's the part that requires the DVD Playback Kit remote. Press "STOP" or "PAUSE" (you cannot use the controller to stop the music to see it as doing so goes back to the Music Playback menu with the small visualization area). Once the music visualization pattern dies down, a full-screen swirling starfield pattern appears. After some time passes, the screen will be filled with a changing burst of solid color where you can make out the wireframe spinning globe seen encompassing the main dashboard background. The burst of color fades to black leaving the swirling starfield. The cycle repeats with a random changing solid color burst which fades to the swirling starfield.<br />
<br />
Not quite true about needing the remote control, if playing a CD while full screen visualization is displayed, press the eject button on the front of the Xbox console.<br />
<br />
=== Soundtrack name Easter-Egg ("<<Eggs&beta;ox>>") ===<br />
<br />
Stored in settings_adoc.xip (which is actually an XBE file)<br />
<br />
==== Steps to activate Soundtrack Easter Egg: ====<br />
# Insert an audio CD and let it begin to play. <br />
# Stop the disk and step back (press B) in order to "Copy" selected tracks of the CD to the hard drive. <br />
# When the track list comes up, "Select All" and continue. <br />
# Choose "New Soundtrack" as the destination for your selection. <br />
# Enter the name of your soundtrack exactly as follows: <<Eggs&beta;ox>> including the less than, beta, and greater than symbols. <br />
# After you have entered the title, select "Done". A "Thank You" message starts which is followed by a scrolling list of the Xbox Team members.<br />
If you press a button on the controller or let the message play through to the end -- the Xbox reboots.<br />
<br />
=== Parental Control Bypass ===<br />
<br />
If Parental Control is enabled and the password set has been forgotten, all is not lost. Use the following sequence:<br />
* {{input-x}} {{input-y}} {{input-lt}} {{input-x}}<br />
SET PASS CODE, MOVIES and GAMES level can now be modified and the pass code removed if so desired.<br />
<br />
With SET PASS CODE selected, press {{input-a}} or {{input-start}} to change the current pass code and once more to be prompted, "Do you wish to delete the current pass code?". Select Yes or No then {{input-a}}.<br />
<br />
=== Format Admin Codes ===<br />
<br />
Secret Xbox format codes to format all drives except C. The code is different for all versions of the Xbox. If you find your code, please post it here along with your xbox version (at least the last 2 digits of the serial number - the factory code where it was manufactured).<br />
<br />
==== Different Xboxes Use Different Codes ====<br />
<br />
MS support techs under certain conditions would ask for your serial number and verify registration of your Xbox before giving you a code to clear/format your Xbox's UDD that was acting up. What part(s) of the serial number they used to determine the correct code is unknown?<br />
<br />
More data is needed to sort out which Xbox a particular code works on, and what other codes exist.<br />
<br />
Is it based on Xbox scene version numbers? Most likely, NOT! Is it based on factory of production? Is it based on BIOS version? Does anyone know? <br />
<br />
<br />
All of these codes are entered at the MS Dashboard's "System Info" screen. (UNTESTED here, codes posted as given at original source site.)<br />
<br />
<br />
Xbox v1.0: {{input-x}} {{input-y}} {{input-ly+}} {{input-lx-}} {{input-a}}<br />
<br />
<br />
Unknown version: {{input-y}} {{input-ly+}} {{input-ly-}} {{input-x}} {{input-a}}.<br />
<br />
(This one seems to work with most XBOXes sold in the United States) <br />
<br />
<br />
Unknown version: {{input-y}} {{input-lx-}} {{input-x}} {{input-a}} {{input-lx-}} <br />
<br />
(This one worked with the XBOXes manufactured in Hungary, serial numbers ending in 03) <br />
<br />
<br />
Source: Wayback Machine [https://web.archive.org/web/20041010231137/http://unmodded.mine.nu:80/docs/FormatAdminCode unmodded.mine.nu/docs/FormatAdminCode]<br />
<br />
== See Also ==<br />
<br />
[[Hard Drive Files]]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=EEPROM&diff=6112EEPROM2017-08-30T12:23:07Z<p>KaosEngineer: /* Contents */ Removed leading 0's in notes for example pass code values. Matches with nibble values format above the notes.</p>
<hr />
<div>The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.<br />
Parts of the EEPROM are encrypted using [[Kernel/XboxEEPROMKey]].<br />
<br />
== Chip Models ==<br />
<br />
{| class="wikitable"<br />
! Xbox Model<br />
! Manufacturer<br />
! Model<br />
|-<br />
| 1.4 (Others?)<br />
| Catalyst<br />
| CAT24WC02J<br />
|}<br />
<br />
== Contents ==<br />
<br />
{| class="wikitable"<br />
! Start !! End !! Notes<br />
|-<br />
| 0x00<br />
| 0x13<br />
| HMAC_SHA1 Hash<br />
|-<br />
| 0x14<br />
| 0x1B<br />
| RC4 Encrypted Confounder ??<br />
|-<br />
| 0x1C<br />
| 0x2B<br />
| RC4 Encrypted HDD key<br />
|-<br />
| 0x2C<br />
| 0x2F<br />
| RC4 Encrypted Region code<br />
* 0x01 = North America<br />
* 0x02 = Japan<br />
* 0x04 = Europe<br />
|-<br />
| 0x30<br />
| 0x33<br />
| Checksum2 - Checksum of next 44 (0x2C) bytes (0x34 - 0x5F)<sup>*</sup><br />
|-<br />
| 0x34<br />
| 0x3F<br />
| Xbox serial number - (ASCII chars 0x30 - 0x39 to match each digit in SN)<br />
|-<br />
| 0x40<br />
| 0x45<br />
| Ethernet MAC address<br />
|-<br />
| 0x46<br />
| 0x47<br />
| Unknown Padding ?<br />
|-<br />
| 0x48<br />
| 0x57<br />
| Online Key ?<br />
|-<br />
| 0x58<br />
| 0x5B<br />
| Video Standard<br />
* 0x00400100 = NTSC-M<br />
* 0x00400200 = NTSC-J<br />
* 0x00800300 = PAL<br />
|-<br />
| 0x5C<br />
| 0x5F<br />
| Unknown Padding ?<br />
|-<br />
| 0x60<br />
| 0x63<br />
| Checksum3 - Checksum of the next 92 (0x5C) bytes (0x64 - 0xBF)<sup>*</sup><br />
|-<br />
| 0x64<br />
| 0x67<br />
| Zone Bias - Offset in # minutes to subtract from GMT time <br />
(e.g., for GMT-06 Central; 6hr = 360min = 0x00000168)<br />
|-<br />
| 0x68<br />
| 0x6B<br />
| Standard Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CST\0, ACST)<br />
|-<br />
| 0x6C<br />
| 0x6F<br />
| Daylight Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CDT\0, ACDT)<br />
|-<br />
| 0x70<br />
| 0x77<br />
| Unknown Padding ?<br />
|-<br />
| 0x78<br />
| 0x7B<br />
| Standard Time Starts 10-05-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x7C<br />
| 0x7F<br />
| Daylight Savings Time Starts 04-01-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x80<br />
| 0x87<br />
| Unknown Padding ?<br />
|-<br />
| 0x88<br />
| 0x8B<br />
| Standard Timezone Bias; if not DST, 0 (0x00000000) minute time adjust<br />
|-<br />
| 0x8C<br />
| 0x8F<br />
| Daylight Savings Time Bias; if DST, -60 (0xFFFFFFC4) minute time adjust<br />
|-<br />
| 0x90<br />
| 0x93<br />
| Language ID<br />
|-<br />
| 0x94<br />
| 0x97<br />
| Video Settings<br />
<br />
Offset 0x96:<br />
* 0x??=Normal{{FIXME}}<br />
* 0xB0=Widescreen<br />
* 0xB4=Letterbox<br />
|-<br />
| 0x98<br />
| 0x9B<br />
| Audio Settings<br />
|-<br />
| 0x9C<br />
| 0x9F<br />
| Games Parental Control (0 = Max rating) 1 byte at offset 0x9C data 4-byte aligned adds the 3 remaining bytes of 0x00<br />
{| class="wikitable"<br />
! Xbox Game Rating !! EEPROM Value @ 0x9C<br />
|-<br />
| (RP) Rating Pending (Max)<br />
| 0x00<br />
|-<br />
| (AO) Adults Only <br />
| 0x01<br />
|-<br />
| (M) Mature <br />
| 0x02<br />
|-<br />
| (T) Teen <br />
| 0x03<br />
|-<br />
| (E) Everyone <br />
| 0x04<br />
|-<br />
| (K-A) Kids to Adults <br />
| 0x05<br />
|-<br />
| (EC) Early Childhood <br />
| 0x06<br />
|}<br />
|-<br />
| 0xA0<br />
| 0xA3<br />
| Parental Control Passcode; 4 button sequence (each key stored in a nibble)<br />
* 0x1 = {{input-dy+}} or {{input-ly+}}<br />
* 0x2 = {{input-dy-}} or {{input-ly-}}<br />
* 0x3 = {{input-dx-}} or {{input-lx-}}<br />
* 0x4 = {{input-dx+}} or {{input-lx+}}<br />
* 0x7 = {{input-x}}<br />
* 0x8 = {{input-y}}<br />
* 0xB = {{input-lt}}<br />
* 0xC = {{input-rt}}<br />
* 0 = Disabled{{FIXME|reason=Is this 0x00000000 only, or are shorter codes possible? can a middle section be 0x00 or would that end the sequence?}}<br />
<br />
Note:{{FIXME|reason=Not sure this is the proper place to describe and formatting sucks not used mediawiki that much still learning}}<br />
* EEPROM offset 0xA0: <code>23 14 00 00</code><br />
* Little Endian value 0x00001423.<br />
* The pass code is D-pad directions up (0x1), right (0x4), down (0x2), left (0x3). <br />
* Pass code is only 2 bytes not 4, each button is stored as a nibble in the word. First button in the most significant nibble and last in the least significant nibble. <br />
* Data in the EEPROM is aligned to double word (4-byte) boundaries. Thus, the two extra bytes at 0xA2 and 0xA3 of 0x00.<br />
|-<br />
| 0xA4<br />
| 0xA7<br />
| Movies Parental Control (0 = Max rating) only 1 byte necessary, the 3 remaining bytes for multiple of 4-byte data alignment{{FIXME|reason=Re-word alignment description. The reason for the extra 3 bytes.}}<br />
{| class="wikitable"<br />
! Xbox Movie Rating !! EEPROM Value @ 0xA4<br />
|-<br />
| 8 (Max)<br />
| 0x00<br />
|-<br />
| 7 (NC-17) <br />
| 0x01<br />
|-<br />
| 6 (R)<br />
| 0x02 <br />
|-<br />
| 5<br />
| 0x03 <br />
|-<br />
| 4 (PG-13)<br />
| 0x04<br />
|-<br />
| 3 (PG)<br />
| 0x05<br />
|-<br />
| 2<br />
| 0x06 <br />
|-<br />
| 1 (G)<br />
| 0x07 <br />
|}<br />
|- <br />
| 0xA8<br />
| 0xAB<br />
| XBOX Live IP Address..<br />
|-<br />
| 0xAC<br />
| 0xAF<br />
| XBOX Live DNS Server..<br />
|-<br />
| 0xB0<br />
| 0xB3<br />
| XBOX Live Gateway Address..<br />
|-<br />
| 0xB4<br />
| 0xB7<br />
| XBOX Live Subnet Mask..<br />
|-<br />
| 0xB8<br />
| 0xBB<br />
| Other XBLive settings ?<br />
|-<br />
| 0xBC<br />
| 0xBF<br />
| DVD Playback Kit Zone<br />
|-<br />
| 0xC0<br />
| 0xFF<br />
| Unknown Codes / History ? do not change any values in this region <br />
|-<br />
|}<br />
<br />
Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].<br />
<br />
<sup>*</sup>Configmagic-FINAL-1.6 uses the wrong size when computing Checksum2 (40 instead of 44 bytes) and Checksum3 (96 instead of 92 bytes). Checksum2 value computed was correct only because the extra 4 bytes not used in the CRC computation were all 0's which does not change the CRC value. However, a similiar problem with computation of Checksum3 is present. The CRC computed for v1.6 Xbox's is incorrect as the 4 extra bytes are not 0's as on earlier versions.<br />
<br />
== Reading/Writing the EEPROM ==<br />
<br />
=== Software Method ===<br />
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.<br />
<br />
=== Hardware Method ===<br />
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see [http://dangerousprototypes.com/blog/bus-pirate-manual/ here]<br />
or [https://www.totalphase.com/products/aardvark-i2cspi/ here]), build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. Then use the corresponding software to read/write the EEPROM.<br />
<br />
<br />
==The HMAC HDD Key==<br />
<br />
The HMAC HDD Key is generated out of the first 48 bytes. This section has been identified clearly.<br />
<br />
<br />
==The Region Code==<br />
<br />
This DWORD is encrypted. It corresponds to the region code in the XBE header:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| 0x00000001<br />
| North America<br />
|-<br />
| 0x00000002<br />
| Japan<br />
|-<br />
| 0x00000004<br />
| Europe / Australia<br />
|-<br />
| 0x80000000<br />
| Manufacturing plant<br />
|}<br />
<br />
==The Serial Number==<br />
<pre> 1166356 20903<br />
|| | |||||__<br />
|| | ||||___ factory number<br />
|| | |||____<br />
|| | ||_____ week of year (starting Mondays)<br />
|| | |______ last digit of year<br />
|| |________<br />
||_____________ number of Xbox within week and factory<br />
|______________ production line within factory <br />
<br />
</pre><br />
<br />
{| class="wikitable"<br />
! style="text-align: center;" | 1<br />
! style="text-align: center;" | 1<br />
! style="text-align: center;" | 6<br />
! style="text-align: center;" | 6<br />
! style="text-align: center;" | 3<br />
! style="text-align: center;" | 5<br />
! style="text-align: center;" | 6<br />
! style="text-align: center;" | <br />
! style="text-align: center;" | 2<br />
! style="text-align: center;" | 0<br />
! style="text-align: center;" | 9<br />
! style="text-align: center;" | 0<br />
! style="text-align: center;" | 3<br />
! style="text-align: center;" | <br />
! <br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | /<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| Factory Number (02=Mexico, 03=Hungary, 05=China, 06=Taiwan)<br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| <br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| week of year (starting Mondays)<br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| <br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| last digit of year (200Y)<br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| <br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| number of Xbox within week and factory<br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| <br />
|-<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| production line within factory<br />
|}<br />
<br />
==The MAC address==<br />
<br />
This is the MAC address of the Ethernet hardware, which has been [https://web.archive.org/web/20100617020733/http://standards.ieee.org/regauth/oui/oui_public.txt issued by the IEEE].<br />
<br />
<br />
==DVD Region==<br />
<br />
This DWORD corresponds to the region code for playback of DVD movies:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| 0x00000000<br />
| None<br />
|-<br />
| 0x00000001<br />
| Region 1<br />
|-<br />
| ...<br />
| ...<br />
|-<br />
| 0x00000006<br />
| Region 6<br />
|}<br />
<br />
== Checksum Algorithm ==<br />
<br />
Checksum2 and Checksum3 values can be calculated by running the following code snippet over the area the checksum covers:<br />
<br />
<pre> /* The EepromCRC algorithm was obtained from the XKUtils 0.2 source released by<br />
* TeamAssembly under the GNU GPL.<br />
* Specifically, from XKCRC.cpp<br />
*<br />
* Rewritten to ANSI C by David Pye (dmp@davidmpye.dyndns.org)<br />
*<br />
* Thanks! */<br />
void EepromCRC(unsigned char *crc, unsigned char *data, long dataLen) {<br />
unsigned char* CRC_Data = (unsigned char *)malloc(dataLen+4);<br />
int pos=0;<br />
memset(crc,0x00,4);<br />
<br />
memset(CRC_Data,0x00, dataLen+4);<br />
//Circle shift input data one byte right<br />
memcpy(CRC_Data + 0x01 , data, dataLen-1);<br />
memcpy(CRC_Data, data + dataLen-1, 0x01);<br />
<br />
for (pos=0; pos&lt;4; ++pos) {<br />
unsigned short CRCPosVal = 0xFFFF;<br />
unsigned long l;<br />
for (l=pos; l&lt;dataLen; l+=4) {<br />
CRCPosVal -= *(unsigned short*)(&amp;CRC_Data[l]);<br />
}<br />
CRCPosVal &amp;= 0xFF00;<br />
crc[pos] = (unsigned char) (CRCPosVal &gt;&gt; 8);<br />
}<br />
free(CRC_Data);<br />
}<br />
</pre><br />
<br />
<br />
== Further Reading ==<br />
<br />
* [https://web.archive.org/web/20040604013125/http://console-dev.com:80/eeprom.htm Information about EEPROM contents]<br />
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip with a Raspberry Pi]<br />
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]<br />
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=Boot_Process&diff=6105Boot Process2017-08-30T08:43:06Z<p>KaosEngineer: /* Stage 1: Key Scheduling */ Address range for s[] incorrect 0x8F000 to 0x850FF should be 0x8F000 to 0x8F0FF</p>
<hr />
<div>This article describes the boot sequence of the Xbox.<br />
A large portion of it is patended in [https://docs.google.com/viewer?url=patentimages.storage.googleapis.com/pdfs/US6907522.pdf Patent "US 6,907,522 B2"]<br />
<br />
== Overview ==<br />
<br />
The Xbox has a 256 kiB ROM containing the startup animation and sound, as well as the Xbox kernel, which contains a stripped down version of the Windows 2000 (NT 5.0) microkernel, the HAL, filesystems, as well as HDD and DVD drivers.<br />
<br />
When the Xbox is turned on, the software in ROM is decompressed into RAM, and the kernel initializes the hardware. Because there are no audio or video drivers in the kernel, the startup code plays the animation and sound by accessing the registers of the hardware directly. As soon as the Xbox logo is on the display, the kernel unlocks the hard disk and checks whether there is a valid game medium in the DVD drive. If not, the file xboxdash.xbe gets loaded from partition #3 (Typically the [[Dashboard]]). In either case, the Microsoft logo is shown below the Xbox logo and the executable is started. If an error occurs (no/wrong hard disk, wrong signature, ...), the boot loader shows a [[Fatal Error]] screen and halts.<br />
<br />
=== Chain of trust ===<br />
<br />
The Xbox uses a chain of trust during the boot process:<br />
<br />
* The MCPX ROM contains a key to decrypt the 2BL.<br />
* The 2BL is run. The MCPX ROM is hidden at this point. The 2BL decryption key is (overwritten with 0x00-Bytes){{FIXME|reason=Does this actually happen?}}. The 2BL contains a kernel decryption key.<br />
* Once the kernel is decrypted and initialized, the INIT section is discarded. The kernel decryption key is overwritten with 0x00-Bytes.<br />
* The kernel only runs signed [[XBE]] files from allowed media.<br />
<br />
There are also a handful of assumptions:<br />
<br />
* The CPU will start execution in the MCPX ROM.<br />
* The MCPX ROM can not be read or modified.<br />
* The decrpyted 2BL or Kernel can not be read entirely.<br />
* All parts of the software following the MCPX are not-attackable and signed.<br />
<br />
See [[Exploits]] for possible options to break the chain of trust.<br />
<br />
== MCPX ROM ==<br />
<br />
Certain things are still missing, for example, getting the CPU to 32 bit protected mode and enabling caching.{{FIXME}}<br />
<br />
=== Xcodes ===<br />
<br />
The xcode interpreter is common through both versions of the MCPX ROM. The high level interpretation of the MCPX ROM might look like this:<br />
<br />
<pre><br />
void xcode_interpreter() {<br />
<br />
// values are implied as x86 is just starting up<br />
register uint32_t pc = 0; // stored in ESI register<br />
register uint8_t opcode = 0; // stored in AL register<br />
register uint32_t operand_1 = 0; // stored in EBC register<br />
register uint32_t operand_2 = 0; // stored in ECX register<br />
register uint32_t result = 0; // stored in EDI register<br />
register uint32_t scratch = 0; // stored in EBP register<br />
<br />
// explicitly set startup point<br />
pc = 0xFF000080;<br />
<br />
while (1) {<br />
opcode = get_memory_byte(pc);<br />
operand_1 = get_memory_dword(pc+1);<br />
operand_2 = get_memory_dword(pc+5);<br />
<br />
if (opcode == 0x07) {<br />
opcode = operand_1;<br />
operand_1 = operand_2;<br />
operand_2 = result;<br />
}<br />
<br />
if (opcode == 0x02) {<br />
result = get_memory_dword(operand_1 & 0x0fffffff);<br />
} else if (opcode == 0x03) {<br />
set_memory_dword(operand_1) = operand_2;<br />
} else if (opcode == 0x06) {<br />
result = (result & operand_1) | operand_2;<br />
} else if (opcode == 0x04) {<br />
if (operand_1 == 0x80000880) {<br />
operand_2 &= 0xfffffffd;<br />
}<br />
outl(operand_1, 0xcf8);<br />
outl(operand_2, 0xcfc);<br />
} else if (opcode == 0x05) {<br />
outl(operand_1, 0xcf8);<br />
result = inl(0xcfc);<br />
} else if (opcode == 0x08) {<br />
if (result != operand_1) {<br />
pc += operand_2;<br />
}<br />
} else if (opcode == 0x09) {<br />
pc += operand_2;<br />
} else if (opcode == 0x10) {<br />
scratch = (scratch & operand_1) | operand_2;<br />
result = scratch;<br />
} else if (opcode == 0x11) {<br />
outb(operand_2, operand_1);<br />
} else if (opcode == 0x12) {<br />
result = inb(operand_1);<br />
} else if (opcode == 0xee) {<br />
break;<br />
}<br />
<br />
pc += 9;<br />
}<br />
}<br />
</pre><br />
<br />
=== RC4 Decryption of the 2BL (MCPX 1.0 only) ===<br />
<br />
Version 1.0 of the ROM uses RC4 to decrypt the 2BL.<br />
The RC4 algorithm was included as part of MCPX 1.0 and seems to work fine with BIOS versions 3944, 4034, and 4134.<br />
<br />
==== Stage 1: Key Scheduling ====<br />
<br />
The [https://en.wikipedia.org/wiki/RC4#Key-scheduling_algorithm_.28KSA.29 RC4 Key-Scheduling Algorithm] is used to initialize the RC4 “S” array, first initializing the identity permutation (writing 1, 2, ..., 255 to 0x8F000 to 0x8F0FF), then processed in a way similar to the PRGA to mix in the key.<br />
<br />
<pre><br />
uint8_t *s = (uint8_t *)0x8f000;<br />
uint32_t i;<br />
<br />
for (i = 0; i <= 255; i++) {<br />
s[i] = i;<br />
}<br />
<br />
uint8_t *key = (uint8_t *)0xffffffa5; /* ROM offset 0x1a5. */<br />
uint8_t j, t;<br />
<br />
/* It is unclear why values s[0x100..0x101] are being set to 0. They are<br />
* not modified by the code, but later these will be be used as the initial<br />
* i, j values in the PRGA.<br />
*/<br />
s[0x100] = 0x00;<br />
s[0x101] = 0x00;<br />
<br />
for (i = 0, j = 0; i <= 255; i++) {<br />
j = j + s[i] + key[i%16];<br />
<br />
/* Swap s[i] and s[j] */<br />
t = s[i];<br />
s[i] = s[j];<br />
s[j] = t;<br />
}<br />
</pre><br />
<br />
==== Stage 2: PRGA ====<br />
<br />
The [https://en.wikipedia.org/wiki/RC4#Pseudo-random_generation_algorithm_.28PRGA.29 RC4 Pseudo-random generation algorithm (PRGA)] is then used to decrypt the 2BL from 0xFFFF9E00, storing the decrypted 2BL at 0x00090000. It is 24KiB in size.<br />
<br />
<pre><br />
uint8_t *encrypted = (uint8_t*)0xFFFF9E00; /* 2bl */<br />
uint8_t *decrypted = (uint8_t*)0x90000; /* Decrypted 2bl Destination */<br />
uint32_t pos;<br />
<br />
/* As noted above, s[0x100..0x101] were set to 0 earlier, but have not been<br />
* modified since. The RC4 algorithm defines i and j both to be set to 0<br />
* before PRGA begins. */<br />
i = s[0x100];<br />
j = s[0x101];<br />
<br />
for (pos = 0; pos < 0x6000; pos++) {<br />
/* Update i, j. */<br />
i = (i + 1) & 0xff;<br />
j += s[i];<br />
<br />
/* Swap s[i] and s[j]. */<br />
t = s[i];<br />
s[i] = s[j];<br />
s[j] = t;<br />
<br />
/* Decrypt message and write output. */<br />
decrypted[pos] = encrypted[pos] ^ s[ s[i] + s[j] ];<br />
}<br />
</pre><br />
<br />
==== Stage 3: Signature Verification ====<br />
<br />
Now that the Second-Stage Bootloader has been loaded, a quick sanity-check is performed: a “magic” signature is verified. If the signature doesn’t match, control goes to the error handler. If the signature does match, the code will jump to the 2bl entry point, which is given by the first dword of the decrypted 2bl.<br />
<br />
<pre><br />
mov eax, [0x95fe4]<br />
cmp eax, MAGIC_NUMBER<br />
jne 0xffffff94 ; If signature check failed, jump to error handler<br />
mov eax, [0x90000]<br />
jmp eax ; Jump to 2BL entry point<br />
</pre><br />
<br />
=== TEA Decryption of the FBL (MCPX 1.1 only) ===<br />
<br />
{{FIXME}}<br />
<br />
== FBL (MCPX 1.1 only) ==<br />
<br />
The Flash Boot Loader was added in MCPX 1.1, it connects the MCPX ROM and the 2BL.{{FIXME}}<br />
It is not part of the MCPX ROM, but part of the flash.<br />
<br />
== 2BL ==<br />
<br />
{{FIXME|reason=Certain parts are still missing.}}<br />
<br />
=== MTRR Setup ===<br />
<br />
First, the cache is disabled.{{FIXME}}<br />
Then, the MTRR (Memory Type Range Register) will be setup (using <code>wrmsr</code>) in the following way:<br />
<br />
{| class="wikitable"<br />
! MTRR (ecx) !! High value (edx) !! Low value (eax) !! Notes<br />
|-<br />
|0x200 || 0x00000000 || 0x00000006 ||<br />
|-<br />
| rowspan = "2" | 0x201 || rowspan = "2" | 0x0000000F || 0xFC000800 || ''(For 64 MiB RAM BIOS)''<br />
|-<br />
|0xF8000800 || (''For 128 MiB RAM BIOS'')<br />
|-<br />
|0x202 || 0x00000000 || 0xFFF80005 ||<br />
|-<br />
|0x203 || 0x0000000F || 0xFFF80800 ||<br />
|-<br />
|0x204 || 0x00000000 || 0x00000000 || rowspan="3" | Clear all unused MTRR<br />
|-<br />
| colspan = "3" | ...<br />
|-<br />
|0x20F || 0x00000000 || 0x00000000<br />
|-<br />
|0x2FF || 0x00000000 || 0x00000800 ||<br />
|}<br />
<br />
Once the MTRR have been written, the cache is enabled.{{FIXME}}<br />
<br />
=== Register setup ===<br />
<br />
Now the 2BL will set up the segment registers{{FIXME|reason=why?!}} and stack:<br />
<br />
{| class="wikitable"<br />
! Register !! Value !! Notes<br />
|-<br />
|ds || 0x0010 || rowspan="3" | Data segment{{citation needed}}<br />
<br />
|-<br />
|es || 0x0010<br />
<br />
|-<br />
|ss || 0x0010<br />
<br />
|-<br />
|esp || 0x00400000 ||<br />
<br />
|-<br />
|fs || 0x0000 ||<br />
<br />
|-<br />
|gs || 0x0000 ||<br />
|}<br />
<br />
=== Self-copy ===<br />
<br />
Now the 2BL copies itself (24 kiB) from 0x00900000 to memory address 0x00400000.<br />
<br />
=== Paging ===<br />
<br />
Now a PDE is prepared at address 0x0000F000:<br />
<br />
{| class="wikitable"<br />
! Offset in PDE !! Value !! Notes<br />
|-<br />
|0x000 || 0x000000E3 || rowspan="7" | Identity maps the first 256MiB of RAM: 0x00000000 and 0x80000000 will both map to physical page 0 <br><br> 0xE3: Flags: <br> * 0x80: 4 MiB page <br> * 0x40: Marked as previously written (Dirty) <br> * 0x20: Marked as previously accessed <br> * 0x02: Read/Write <br> * 0x01: Present<br />
|-<br />
|0x800 || 0x000000E3<br />
|-<br />
|0x004 || 0x004000E3<br />
|-<br />
|0x804 || 0x004000E3<br />
|-<br />
| colspan="2" | ...<br />
|-<br />
|0x8FC || 0x0FC000E3<br />
|-<br />
|0x0FC || 0x0FC000E3<br />
|-<br />
|0x900 || 0x00000000 || rowspan="5" | Unmapping the rest of the pages<br />
|-<br />
|0x100 || 0x00000000<br />
|-<br />
| colspan="2" | ...<br />
|-<br />
|0xFFC || 0x00000000<br />
|-<br />
|0x7FC || 0x00000000<br />
|-<br />
|0xC00 || 0x0000F063 || Maps the PDE (4 kiB page) to address 0xC0000000 <br><br> 0x63: Flags: <br> * 0x40: Marked as previously written (Dirty) <br> * 0x20: Marked as previously accessed <br> * 0x02: Read/Write <br> * 0x01: Present<br />
|-<br />
|0xFFC || 0xFFC000E3 || Identity maps the upper portion of the Flash (4 MiB page) to address 0xFFC00000 <br><br> 0xE3: Flags: <br> * 0x80: 4 MiB page <br> * 0x40: Marked as previously written (Dirty) <br> * 0x20: Marked as previously accessed <br> * 0x02: Read/Write <br> * 0x01: Present<br />
|-<br />
|0xFD0 || 0xFD0000FB || rowspan="4" | Maps 16 MiB for the GPU control registers <br><br> 0xFB: Flags: <br> * 0x80: 4 MiB page <br> * 0x40: Marked as previously written (Dirty) <br> * 0x20: Marked as previously accessed <br> * 0x10: Cache disabled <br> * 0x08: Write-Through caching <br> * 0x02: Read/Write <br> * 0x01: Present<br />
|-<br />
|0xFD4 || 0xFD4000FB<br />
|-<br />
|0xFD8 || 0xFD8000FB<br />
|-<br />
|0xFDC || 0xFDC000FB<br />
|}<br />
<br />
After setting up the PDE, the PAT is set up using <code>wrmsr</code>: {{FIXME}}<br />
<br />
CR4 is touched {{FIXME}}<br />
<br />
CR3 is touched {{FIXME}}<br />
<br />
Now paging is activated by enabling the PG and WP bits in CR0.<br />
Additionally, the same <code>or</code> instruction is used to enable the NE bit in cr0.<br />
<br />
=== 2BL main ===<br />
<br />
esp is now also reloaded to point at the relocated address. It will be set to 0x80400000 (absolute value, independent of previous esp value).<br />
The 2BL will now <code>call</code> into the relocated 2BL code somewhere near 0x00400000.<br />
<br />
==== Disabling of the MCPX ROM ====<br />
<br />
<pre><br />
out32(0xCF8, 0x80000880);<br />
out8(0xCFC, 0x02);<br />
</pre><br />
<br />
==== SMC handling ====<br />
<br />
The [[SMC]] has a watchdog functionality which must be turned off.<br />
This is done by querying the SMC registers 0x1C - 0x1F.<br />
If all of them are 0x00 the 2BL will shutdown the system{{FIXME}}.<br />
If this is not the case, the bootloader calculates the watchdog challenge response and sends it to SMC registers 0x20 and 0x21.<br />
<br />
Additionally, the 2BL will set SMC register 0x01 to 0 (which resets the cursor position for reading the SMC revision information).<br />
<br />
==== Enable IDE and NIC ====<br />
<br />
<pre><br />
out32(0xCF8, 0x8000088C);<br />
out32(0xCFC, 0x40000000);<br />
</pre><br />
<br />
==== Memory cleanup ====<br />
<br />
The 2BL fills memory with 0xCC from 0x80090000 to 0x80095FFF. These are the 24 kiB where the 2BL was stored previously.<br />
<br />
==== Setup RAM timing ====<br />
<br />
Not described yet, this is complicated{{FIXME}}.<br />
This got a lot more complicated when Microsoft started using different RAM sometime after [[Hardware Revisions#1.6|Hardware Revision 1.6]] was already out.<br />
<br />
==== Weird stuff 2 ====<br />
<br />
This does some PCI config, use unknown{{FIXME}}.<br />
<br />
<pre><br />
out32(0xCF8, 0x80000854);<br />
out32(0xCFC, in32(0xCFC) | 0x88000000);<br />
<br />
out32(0xCF8, 0x80000064);<br />
out32(0xCFC, in32(0xCFC) | 0x88000000);<br />
<br />
out32(0xCF8, 0x8000006C);<br />
uint32_t tmp = in32(0xCFC);<br />
out32(0xCFC, tmp & 0xFFFFFFFE);<br />
out32(0xCFC, tmp);<br />
<br />
out32(0xCF8, 0x80000080);<br />
out32(0xCFC, 0x00000100);<br />
</pre><br />
<br />
==== Weird stuff 3 ====<br />
<br />
{{FIXME|reason=Why?}}<br />
<br />
<pre><br />
out32(0xCF8, 0x80000808);<br />
uint8_t mcpx_revision = in8(0xCFC); <br />
<br />
if (mcpx_revision >= 0xD1) {<br />
out32(0xCF8, 0x800008C8);<br />
out32(0xCFC, 0x00008F00);<br />
}<br />
</pre><br />
<br />
==== Loading the kernel ====<br />
===== Kernel-copy =====<br />
<br />
The Kernel is now copied into RAM.<br />
<br />
===== Kernel decryption =====<br />
<br />
The 2BL will copy the kernel decryption key (16 bytes) from offset 32 of an array of 3 keys:<br />
<br />
{| class="wikitable"<br />
! Offset !! Use<br />
|-<br />
| 0 || EEPROM key<br />
|-<br />
| 16 || Certificate key<br />
|-<br />
| 32 || Kernel key<br />
|}<br />
<br />
The Kernel is then decrypted in-place using RC4.<br />
<br />
===== Kernel decompression =====<br />
<br />
The Kernel is decompressed directly to 0x80010000 where it will reside until a full system shutdown.<br />
<br />
==== Running the kernel ====<br />
<br />
The xboxkrnl.exe header at 0x8001000 is checked{{FIXME|reason=how?}}.<br />
If it is invalid, {{FIXME}}.<br />
If it is valid, the kernel entry point is looked up from the PE optional header. The hardcoded image base of 0x8001000 is added to the entry point.<br />
The entry-point is now being called. Argumnts are passed on the stack, from right to left.<br />
The first argument is a commandline string loaded from memory address 0x80400000. It is an empty string for retail BIOS{{FIXME|reason=Mention options for debug bioses here}}.<br />
A pointer to the previously mentioned array of 3 keys is passed as the second argument.<br />
<br />
== Kernel ==<br />
<br />
=== Initialization ===<br />
<br />
==== Stage 1 (Cold-boot only) ====<br />
<br />
The entry point to the kernel will first parse the arguments.{{FIXME}}<br />
At the end, the kernel will call the initialization routine for what we'll refer to as: Stage 2a.<br />
<br />
==== Stage 2 (Cold-boot only) ====<br />
<br />
The kernel initialization will only happen once on a cold-boot. It will not happen for reboots.<br />
<br />
* ebp is set to 0x00000000<br />
* esp is modified{{FIXME}}<br />
* GDT is prepared{{FIXME}} and loaded{{FIXME}}<br />
* cs and ds are reloaded<br />
* fs is set{{FIXME}}<br />
* TSS is loaded{{FIXME}}<br />
* cr3 is moved to 3 tasks{{FIXME}}<br />
* The CPU microcode is updated<br />
<br />
After this comes Stage 3 initialization which will also be repeated on kernel re-initialization.<br />
<br />
==== Stage 3 ====<br />
<br />
This is code which is duplicated in INIT and .text sections.<br />
* In the INIT section it directly follows the Stage 2 initialization.<br />
* In the .text section it follows the Kernel re-initialization code mentioned below.<br />
<br />
This code does the following:<br />
<br />
* IDT is prepared{{FIXME}} and loaded{{FIXME}}<br />
* {{FIXME|reason=a lot more happens here.. If you want to RE this: look into the HalReturnToFirmware code [last call is to Stage 2b]; the kernel entry point [last call is to Stage 2a]; or just search for lidt instructions}}<br />
<br />
=== Re-initialization ===<br />
<br />
On reboots, initialization Stage 1 and 2 are not in memory anymore (as the INIT section has been discarded), and can't be run anymore.<br />
Instead, a seperate function replaces their functionality and then jumps directly to Stage 3 initalization.<br />
<br />
This code is the partial kernel reinitialization, which will be ran on reboots using [[Kernel/HalReturnToFirmware]].<br />
<br />
* ebp is set to 0x00000000<br />
* esp is modified{{FIXME}}<br />
* Some memory stuff in a seperate function{{FIXME}}<br />
* The .data section from [[Flash]] is loaded and replaces the running .data<br />
* The byte infront of KeSystemTime is set to 0x01, indicating the system comes from a reboot.<br />
<br />
After this has completed, [[#Stage 3]] of the kernel initialization will take over.<br />
<br />
==== Skipped initialization ====<br />
<br />
When rebooting, certain parts are still initialized and assumed to be working:<br />
<br />
(This list is currently in no particular order and incomplete)<br />
<br />
* Anything already done by Stage 1 and Stage 2<br />
* PCI device setup<br />
* EEPROM decryption{{FIXME}}<br />
* Check for AV-Pack{{FIXME}}<br />
* Video mode setup (boot animation is not played again)<br />
* Some IDE stuff{{FIXME}}<br />
* Some SMC stuff{{FIXME}}<br />
* Memory allocator initialization{{FIXME}}<br />
* Kernel debugger (Super-I/O) initialization{{FIXME}} (This still seems to be in memory?!){{citation needed}}<br />
<br />
=== Startup animation ===<br />
<br />
== References ==<br />
<br />
* [http://hackspot.net/XboxBlog/?p=1 Understanding the Xbox boot process]<br />
* [https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Boot ROM]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=EEPROM&diff=6104EEPROM2017-08-30T03:32:59Z<p>KaosEngineer: /* Contents */ Zone Bias 0x64-0x67 example hex value was missing a leading 0 - 0x0000168 to 0x00000168 (not that it changes the value just show fill of all 4-bytes)</p>
<hr />
<div>The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.<br />
Parts of the EEPROM are encrypted using [[Kernel/XboxEEPROMKey]].<br />
<br />
== Chip Models ==<br />
<br />
{| class="wikitable"<br />
! Xbox Model<br />
! Manufacturer<br />
! Model<br />
|-<br />
| 1.4 (Others?)<br />
| Catalyst<br />
| CAT24WC02J<br />
|}<br />
<br />
== Contents ==<br />
<br />
{| class="wikitable"<br />
! Start !! End !! Notes<br />
|-<br />
| 0x00<br />
| 0x13<br />
| HMAC_SHA1 Hash<br />
|-<br />
| 0x14<br />
| 0x1B<br />
| RC4 Encrypted Confounder ??<br />
|-<br />
| 0x1C<br />
| 0x2B<br />
| RC4 Encrypted HDD key<br />
|-<br />
| 0x2C<br />
| 0x2F<br />
| RC4 Encrypted Region code<br />
* 0x01 = North America<br />
* 0x02 = Japan<br />
* 0x04 = Europe<br />
|-<br />
| 0x30<br />
| 0x33<br />
| Checksum2 - Checksum of next 44 (0x2C) bytes (0x34 - 0x5F)<sup>*</sup><br />
|-<br />
| 0x34<br />
| 0x3F<br />
| Xbox serial number - (ASCII chars 0x30 - 0x39 to match each digit in SN)<br />
|-<br />
| 0x40<br />
| 0x45<br />
| Ethernet MAC address<br />
|-<br />
| 0x46<br />
| 0x47<br />
| Unknown Padding ?<br />
|-<br />
| 0x48<br />
| 0x57<br />
| Online Key ?<br />
|-<br />
| 0x58<br />
| 0x5B<br />
| Video Standard<br />
* 0x00400100 = NTSC-M<br />
* 0x00400200 = NTSC-J<br />
* 0x00800300 = PAL<br />
|-<br />
| 0x5C<br />
| 0x5F<br />
| Unknown Padding ?<br />
|-<br />
| 0x60<br />
| 0x63<br />
| Checksum3 - Checksum of the next 92 (0x5C) bytes (0x64 - 0xBF)<sup>*</sup><br />
|-<br />
| 0x64<br />
| 0x67<br />
| Zone Bias - Offset in # minutes to subtract from GMT time <br />
(e.g., for GMT-06 Central; 6hr = 360min = 0x00000168)<br />
|-<br />
| 0x68<br />
| 0x6B<br />
| Standard Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CST\0, ACST)<br />
|-<br />
| 0x6C<br />
| 0x6F<br />
| Daylight Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CDT\0, ACDT)<br />
|-<br />
| 0x70<br />
| 0x77<br />
| Unknown Padding ?<br />
|-<br />
| 0x78<br />
| 0x7B<br />
| Standard Time Starts 10-05-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x7C<br />
| 0x7F<br />
| Daylight Savings Time Starts 04-01-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x80<br />
| 0x87<br />
| Unknown Padding ?<br />
|-<br />
| 0x88<br />
| 0x8B<br />
| Standard Timezone Bias; if not DST, 0 (0x00000000) minute time adjust<br />
|-<br />
| 0x8C<br />
| 0x8F<br />
| Daylight Savings Time Bias; if DST, -60 (0xFFFFFFC4) minute time adjust<br />
|-<br />
| 0x90<br />
| 0x93<br />
| Language ID<br />
|-<br />
| 0x94<br />
| 0x97<br />
| Video Settings<br />
<br />
Offset 0x96:<br />
* 0x??=Normal{{FIXME}}<br />
* 0xB0=Widescreen<br />
* 0xB4=Letterbox<br />
|-<br />
| 0x98<br />
| 0x9B<br />
| Audio Settings<br />
|-<br />
| 0x9C<br />
| 0x9F<br />
| Games Parental Control (0 = Max rating) 1 byte at offset 0x9C data 4-byte aligned adds the 3 remaining bytes of 0x00<br />
{| class="wikitable"<br />
! Xbox Game Rating !! EEPROM Value @ 0x9C<br />
|-<br />
| (RP) Rating Pending (Max)<br />
| 0x00<br />
|-<br />
| (AO) Adults Only <br />
| 0x01<br />
|-<br />
| (M) Mature <br />
| 0x02<br />
|-<br />
| (T) Teen <br />
| 0x03<br />
|-<br />
| (E) Everyone <br />
| 0x04<br />
|-<br />
| (K-A) Kids to Adults <br />
| 0x05<br />
|-<br />
| (EC) Early Childhood <br />
| 0x06<br />
|}<br />
|-<br />
| 0xA0<br />
| 0xA3<br />
| Parental Control Passcode; 4 button sequence (each key stored in a nibble)<br />
* 0x1 = {{input-dy+}} or {{input-ly+}}<br />
* 0x2 = {{input-dy-}} or {{input-ly-}}<br />
* 0x3 = {{input-dx-}} or {{input-lx-}}<br />
* 0x4 = {{input-dx+}} or {{input-lx+}}<br />
* 0x7 = {{input-x}}<br />
* 0x8 = {{input-y}}<br />
* 0xB = {{input-lt}}<br />
* 0xC = {{input-rt}}<br />
* 0 = Disabled{{FIXME|reason=Is this 0x00000000 only, or are shorter codes possible? can a middle section be 0x00 or would that end the sequence?}}<br />
<br />
Note:{{FIXME|reason=Not sure this is the proper place to describe and formatting sucks not used mediawiki that much still learning}}<br />
* EEPROM offset 0xA0: <code>23 14 00 00</code><br />
* Little Endian value 0x00001423.<br />
* The pass code is D-pad directions up (0x01), right (0x04), down (0x02), left (0x03). <br />
* Pass code is only 2 bytes not 4, each button is stored as a nibble in the word. First button in the most significant nibble and last in the least significant nibble. <br />
* Data in the EEPROM is aligned to double word (4-byte) boundaries. Thus, the two extra bytes at 0xA2 and 0xA3 of 0x00.<br />
|-<br />
| 0xA4<br />
| 0xA7<br />
| Movies Parental Control (0 = Max rating) only 1 byte necessary, the 3 remaining bytes for multiple of 4-byte data alignment{{FIXME|reason=Re-word alignment description. The reason for the extra 3 bytes.}}<br />
{| class="wikitable"<br />
! Xbox Movie Rating !! EEPROM Value @ 0xA4<br />
|-<br />
| 8 (Max)<br />
| 0x00<br />
|-<br />
| 7 (NC-17) <br />
| 0x01<br />
|-<br />
| 6 (R)<br />
| 0x02 <br />
|-<br />
| 5<br />
| 0x03 <br />
|-<br />
| 4 (PG-13)<br />
| 0x04<br />
|-<br />
| 3 (PG)<br />
| 0x05<br />
|-<br />
| 2<br />
| 0x06 <br />
|-<br />
| 1 (G)<br />
| 0x07 <br />
|}<br />
|- <br />
| 0xA8<br />
| 0xAB<br />
| XBOX Live IP Address..<br />
|-<br />
| 0xAC<br />
| 0xAF<br />
| XBOX Live DNS Server..<br />
|-<br />
| 0xB0<br />
| 0xB3<br />
| XBOX Live Gateway Address..<br />
|-<br />
| 0xB4<br />
| 0xB7<br />
| XBOX Live Subnet Mask..<br />
|-<br />
| 0xB8<br />
| 0xBB<br />
| Other XBLive settings ?<br />
|-<br />
| 0xBC<br />
| 0xBF<br />
| DVD Playback Kit Zone<br />
|-<br />
| 0xC0<br />
| 0xFF<br />
| Unknown Codes / History ? do not change any values in this region <br />
|-<br />
|}<br />
<br />
Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].<br />
<br />
<sup>*</sup>Configmagic-FINAL-1.6 uses the wrong size when computing Checksum2 (40 instead of 44 bytes) and Checksum3 (96 instead of 92 bytes). Checksum2 value computed was correct only because the extra 4 bytes not used in the CRC computation were all 0's which does not change the CRC value. However, a similiar problem with computation of Checksum3 is present. The CRC computed for v1.6 Xbox's is incorrect as the 4 extra bytes are not 0's as on earlier versions.<br />
<br />
== Reading/Writing the EEPROM ==<br />
<br />
=== Software Method ===<br />
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.<br />
<br />
=== Hardware Method ===<br />
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see [http://dangerousprototypes.com/blog/bus-pirate-manual/ here]<br />
or [https://www.totalphase.com/products/aardvark-i2cspi/ here]), build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. Then use the corresponding software to read/write the EEPROM.<br />
<br />
<br />
==The HMAC HDD Key==<br />
<br />
The HMAC HDD Key is generated out of the first 48 bytes. This section has been identified clearly.<br />
<br />
<br />
==The Region Code==<br />
<br />
This DWORD is encrypted. It corresponds to the region code in the XBE header:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| 0x00000001<br />
| North America<br />
|-<br />
| 0x00000002<br />
| Japan<br />
|-<br />
| 0x00000004<br />
| Europe / Australia<br />
|-<br />
| 0x80000000<br />
| Manufacturing plant<br />
|}<br />
<br />
==The Serial Number==<br />
<pre> 1166356 20903<br />
|| | |||||__<br />
|| | ||||___ factory number<br />
|| | |||____<br />
|| | ||_____ week of year (starting Mondays)<br />
|| | |______ last digit of year<br />
|| |________<br />
||_____________ number of Xbox within week and factory<br />
|______________ production line within factory <br />
<br />
</pre><br />
<br />
{| class="wikitable"<br />
! style="text-align: center;" | 1<br />
! style="text-align: center;" | 1<br />
! style="text-align: center;" | 6<br />
! style="text-align: center;" | 6<br />
! style="text-align: center;" | 3<br />
! style="text-align: center;" | 5<br />
! style="text-align: center;" | 6<br />
! style="text-align: center;" | <br />
! style="text-align: center;" | 2<br />
! style="text-align: center;" | 0<br />
! style="text-align: center;" | 9<br />
! style="text-align: center;" | 0<br />
! style="text-align: center;" | 3<br />
! style="text-align: center;" | <br />
! <br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | /<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| Factory Number (02=Mexico, 03=Hungary, 05=China, 06=Taiwan)<br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| <br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| week of year (starting Mondays)<br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| <br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| last digit of year (200Y)<br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| <br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| number of Xbox within week and factory<br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| <br />
|-<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| production line within factory<br />
|}<br />
<br />
==The MAC address==<br />
<br />
This is the MAC address of the Ethernet hardware, which has been [https://web.archive.org/web/20100617020733/http://standards.ieee.org/regauth/oui/oui_public.txt issued by the IEEE].<br />
<br />
<br />
==DVD Region==<br />
<br />
This DWORD corresponds to the region code for playback of DVD movies:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| 0x00000000<br />
| None<br />
|-<br />
| 0x00000001<br />
| Region 1<br />
|-<br />
| ...<br />
| ...<br />
|-<br />
| 0x00000006<br />
| Region 6<br />
|}<br />
<br />
== Checksum Algorithm ==<br />
<br />
Checksum2 and Checksum3 values can be calculated by running the following code snippet over the area the checksum covers:<br />
<br />
<pre> /* The EepromCRC algorithm was obtained from the XKUtils 0.2 source released by<br />
* TeamAssembly under the GNU GPL.<br />
* Specifically, from XKCRC.cpp<br />
*<br />
* Rewritten to ANSI C by David Pye (dmp@davidmpye.dyndns.org)<br />
*<br />
* Thanks! */<br />
void EepromCRC(unsigned char *crc, unsigned char *data, long dataLen) {<br />
unsigned char* CRC_Data = (unsigned char *)malloc(dataLen+4);<br />
int pos=0;<br />
memset(crc,0x00,4);<br />
<br />
memset(CRC_Data,0x00, dataLen+4);<br />
//Circle shift input data one byte right<br />
memcpy(CRC_Data + 0x01 , data, dataLen-1);<br />
memcpy(CRC_Data, data + dataLen-1, 0x01);<br />
<br />
for (pos=0; pos&lt;4; ++pos) {<br />
unsigned short CRCPosVal = 0xFFFF;<br />
unsigned long l;<br />
for (l=pos; l&lt;dataLen; l+=4) {<br />
CRCPosVal -= *(unsigned short*)(&amp;CRC_Data[l]);<br />
}<br />
CRCPosVal &amp;= 0xFF00;<br />
crc[pos] = (unsigned char) (CRCPosVal &gt;&gt; 8);<br />
}<br />
free(CRC_Data);<br />
}<br />
</pre><br />
<br />
<br />
== Further Reading ==<br />
<br />
* [https://web.archive.org/web/20040604013125/http://console-dev.com:80/eeprom.htm Information about EEPROM contents]<br />
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip with a Raspberry Pi]<br />
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]<br />
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=EEPROM&diff=6093EEPROM2017-08-29T17:03:01Z<p>KaosEngineer: /* Contents */ 0xA0 Note formatting still no quite right trying to get a list inside the Note box 1 space before each line but the * doesn't make a list inside</p>
<hr />
<div>The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.<br />
Parts of the EEPROM are encrypted using [[Kernel/XboxEEPROMKey]].<br />
<br />
== Chip Models ==<br />
<br />
{| class="wikitable"<br />
! Xbox Model<br />
! Manufacturer<br />
! Model<br />
|-<br />
| 1.4 (Others?)<br />
| Catalyst<br />
| CAT24WC02J<br />
|}<br />
<br />
== Contents ==<br />
<br />
{| class="wikitable"<br />
! Start !! End !! Notes<br />
|-<br />
| 0x00<br />
| 0x13<br />
| HMAC_SHA1 Hash<br />
|-<br />
| 0x14<br />
| 0x1B<br />
| RC4 Encrypted Confounder ??<br />
|-<br />
| 0x1C<br />
| 0x2B<br />
| RC4 Encrypted HDD key<br />
|-<br />
| 0x2C<br />
| 0x2F<br />
| RC4 Encrypted Region code<br />
* 0x01 = North America<br />
* 0x02 = Japan<br />
* 0x04 = Europe<br />
|-<br />
| 0x30<br />
| 0x33<br />
| Checksum2 - Checksum of next 44 (0x2C) bytes (0x34 - 0x5F)<sup>*</sup><br />
|-<br />
| 0x34<br />
| 0x3F<br />
| Xbox serial number - (ASCII chars 0x30 - 0x39 to match each digit in SN)<br />
|-<br />
| 0x40<br />
| 0x45<br />
| Ethernet MAC address<br />
|-<br />
| 0x46<br />
| 0x47<br />
| Unknown Padding ?<br />
|-<br />
| 0x48<br />
| 0x57<br />
| Online Key ?<br />
|-<br />
| 0x58<br />
| 0x5B<br />
| Video Standard<br />
* 0x00400100 = NTSC-M<br />
* 0x00400200 = NTSC-J<br />
* 0x00800300 = PAL<br />
|-<br />
| 0x5C<br />
| 0x5F<br />
| Unknown Padding ?<br />
|-<br />
| 0x60<br />
| 0x63<br />
| Checksum3 - Checksum of the next 92 (0x5C) bytes (0x64 - 0xBF)<sup>*</sup><br />
|-<br />
| 0x64<br />
| 0x67<br />
| Zone Bias - Offset in # minutes to subtract from GMT time <br />
(e.g., for GMT-06 Central; 6hr = 360min = 0x0000168)<br />
|-<br />
| 0x68<br />
| 0x6B<br />
| Standard Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CST\0, ACST)<br />
|-<br />
| 0x6C<br />
| 0x6F<br />
| Daylight Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CDT\0, ACDT)<br />
|-<br />
| 0x70<br />
| 0x77<br />
| Unknown Padding ?<br />
|-<br />
| 0x78<br />
| 0x7B<br />
| Standard Time Starts 10-05-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x7C<br />
| 0x7F<br />
| Daylight Savings Time Starts 04-01-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x80<br />
| 0x87<br />
| Unknown Padding ?<br />
|-<br />
| 0x88<br />
| 0x8B<br />
| Standard Timezone Bias; if not DST, 0 (0x00000000) minute time adjust<br />
|-<br />
| 0x8C<br />
| 0x8F<br />
| Daylight Savings Time Bias; if DST, -60 (0xFFFFFFC4) minute time adjust<br />
|-<br />
| 0x90<br />
| 0x93<br />
| Language ID<br />
|-<br />
| 0x94<br />
| 0x97<br />
| Video Settings<br />
<br />
Offset 0x96:<br />
* 0x??=Normal{{FIXME}}<br />
* 0xB0=Widescreen<br />
* 0xB4=Letterbox<br />
|-<br />
| 0x98<br />
| 0x9B<br />
| Audio Settings<br />
|-<br />
| 0x9C<br />
| 0x9F<br />
| Games Parental Control (0 = Max rating) 1 byte at offset 0x9C data 4-byte aligned adds the 3 remaining bytes of 0x00<br />
{| class="wikitable"<br />
! Xbox Game Rating !! EEPROM Value @ 0x9C<br />
|-<br />
| (RP) Rating Pending (Max)<br />
| 0x00<br />
|-<br />
| (AO) Adults Only <br />
| 0x01<br />
|-<br />
| (M) Mature <br />
| 0x02<br />
|-<br />
| (T) Teen <br />
| 0x03<br />
|-<br />
| (E) Everyone <br />
| 0x04<br />
|-<br />
| (K-A) Kids to Adults <br />
| 0x05<br />
|-<br />
| (EC) Early Childhood <br />
| 0x06<br />
|}<br />
|-<br />
| 0xA0<br />
| 0xA3<br />
| Parental Control Passcode; 4 button sequence (each key stored in a nibble not byte)<br />
* 0x01 = {{input-up}}<br />
* 0x02 = {{input-down}}<br />
* 0x03 = {{input-left}}<br />
* 0x04 = {{input-right}}<br />
* 0x07 = {{input-x}}<br />
* 0x08 = {{input-y}}<br />
* 0x0B = {{input-lt}}<br />
* 0x0C = {{input-rt}}<br />
* 0 = Disabled{{FIXME|reason=Is this 0x00000000 only, or are shorter codes possible? can a middle section be 0x00 or would that end the sequence?}}<br />
Note:{{FIXME|reason=Not sure this is the proper place to describe and formatting sucks not used mediawiki that much still learning}}<br />
* EEPROM offset 0xA0: 23 14 00 00 <br />
* Little Endian value 0x00001423.<br />
* The pass code is D-pad directions up (0x01), right (0x04), down (0x02), left (0x03). <br />
* Pass code is only 2 bytes not 4, each button is stored as a nibble in the word. First button in the most significant nibble and last in the least significant nibble. <br />
* Data in the EEPROM is aligned to double word (4-byte) boundaries. Thus, the two extra bytes at 0xA2 and 0xA3 of 0x00.<br />
|-<br />
| 0xA4<br />
| 0xA7<br />
| Movies Parental Control (0 = Max rating) only 1 byte necessary, the 3 remaining bytes for multiple of 4-byte data alignment{{FIXME|reason=Re-word alignment description. The reason for the extra 3 bytes.}}<br />
{| class="wikitable"<br />
! Xbox Movie Rating !! EEPROM Value @ 0xA4<br />
|-<br />
| 8 (Max)<br />
| 0x00<br />
|-<br />
| 7 (NC-17) <br />
| 0x01<br />
|-<br />
| 6 (R)<br />
| 0x02 <br />
|-<br />
| 5<br />
| 0x03 <br />
|-<br />
| 4 (PG-13)<br />
| 0x04<br />
|-<br />
| 3 (PG)<br />
| 0x05<br />
|-<br />
| 2<br />
| 0x06 <br />
|-<br />
| 1 (G)<br />
| 0x07 <br />
|}<br />
|- <br />
| 0xA8<br />
| 0xAB<br />
| XBOX Live IP Address..<br />
|-<br />
| 0xAC<br />
| 0xAF<br />
| XBOX Live DNS Server..<br />
|-<br />
| 0xB0<br />
| 0xB3<br />
| XBOX Live Gateway Address..<br />
|-<br />
| 0xB4<br />
| 0xB7<br />
| XBOX Live Subnet Mask..<br />
|-<br />
| 0xB8<br />
| 0xBB<br />
| Other XBLive settings ?<br />
|-<br />
| 0xBC<br />
| 0xBF<br />
| DVD Playback Kit Zone<br />
|-<br />
| 0xC0<br />
| 0xFF<br />
| Unknown Codes / History ? do not change any values in this region <br />
|-<br />
|}<br />
<br />
Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].<br />
<br />
<sup>*</sup>Configmagic-FINAL-1.6 uses the wrong size when computing Checksum2 (40 instead of 44 bytes) and Checksum3 (96 instead of 92 bytes). Checksum2 value computed was correct only because the extra 4 bytes not used in the CRC computation were all 0's which does not change the CRC value. However, a similiar problem with computation of Checksum3 is present. The CRC computed for v1.6 Xbox's is incorrect as the 4 extra bytes are not 0's as on earlier versions.<br />
<br />
== Reading/Writing the EEPROM ==<br />
<br />
=== Software Method ===<br />
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.<br />
<br />
=== Hardware Method ===<br />
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see [http://dangerousprototypes.com/blog/bus-pirate-manual/ here]<br />
or [https://www.totalphase.com/products/aardvark-i2cspi/ here]), build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. Then use the corresponding software to read/write the EEPROM.<br />
<br />
<br />
==The HMAC HDD Key==<br />
<br />
The HMAC HDD Key is generated out of the first 48 bytes. This section has been identified clearly.<br />
<br />
<br />
==The Region Code==<br />
<br />
This DWORD is encrypted. It corresponds to the region code in the XBE header:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| 1<br />
| North America<br />
|-<br />
| 2<br />
| Japan<br />
|-<br />
| 4<br />
| Europe/Australia<br />
|-<br />
| 0x80000000<br />
| Manufacturing plant<br />
|}<br />
<br />
==The Serial Number==<br />
<pre> 1166356 20903<br />
|| | |||||__<br />
|| | ||||___ factory number<br />
|| | |||____<br />
|| | ||_____ week of year (starting Mondays)<br />
|| | |______ last digit of year<br />
|| |________<br />
||_____________ number of Xbox within week and factory<br />
|______________ production line within factory <br />
<br />
</pre><br />
<br />
{| class="wikitable"<br />
! style="text-align: center;" | 1<br />
! style="text-align: center;" | 1<br />
! style="text-align: center;" | 6<br />
! style="text-align: center;" | 6<br />
! style="text-align: center;" | 3<br />
! style="text-align: center;" | 5<br />
! style="text-align: center;" | 6<br />
! style="text-align: center;" | <br />
! style="text-align: center;" | 2<br />
! style="text-align: center;" | 0<br />
! style="text-align: center;" | 9<br />
! style="text-align: center;" | 0<br />
! style="text-align: center;" | 3<br />
! style="text-align: center;" | <br />
! <br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | /<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| Factory Number (02=Mexico, 03=Hungary, 05=China, 06=Taiwan)<br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| <br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| week of year (starting Mondays)<br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| <br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| last digit of year (200Y)<br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| <br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| number of Xbox within week and factory<br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| <br />
|-<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| production line within factory<br />
|}<br />
<br />
==The MAC address==<br />
<br />
This is the MAC address of the Ethernet hardware, which has been [https://web.archive.org/web/20100617020733/http://standards.ieee.org/regauth/oui/oui_public.txt issued by the IEEE].<br />
<br />
<br />
==DVD Region==<br />
<br />
This DWORD corresponds to the region code for playback of DVD movies:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| 0x00<br />
| None<br />
|-<br />
| 0x01<br />
| Region 1<br />
|-<br />
| ...<br />
| ...<br />
|-<br />
| 0x06<br />
| Region 6<br />
|}<br />
<br />
== Checksum Algorithm ==<br />
<br />
Checksum2 and Checksum3 values can be calculated by running the following code snippet over the area the checksum covers:<br />
<br />
<pre> /* The EepromCRC algorithm was obtained from the XKUtils 0.2 source released by<br />
* TeamAssembly under the GNU GPL.<br />
* Specifically, from XKCRC.cpp<br />
*<br />
* Rewritten to ANSI C by David Pye (dmp@davidmpye.dyndns.org)<br />
*<br />
* Thanks! */<br />
void EepromCRC(unsigned char *crc, unsigned char *data, long dataLen) {<br />
unsigned char* CRC_Data = (unsigned char *)malloc(dataLen+4);<br />
int pos=0;<br />
memset(crc,0x00,4);<br />
<br />
memset(CRC_Data,0x00, dataLen+4);<br />
//Circle shift input data one byte right<br />
memcpy(CRC_Data + 0x01 , data, dataLen-1);<br />
memcpy(CRC_Data, data + dataLen-1, 0x01);<br />
<br />
for (pos=0; pos&lt;4; ++pos) {<br />
unsigned short CRCPosVal = 0xFFFF;<br />
unsigned long l;<br />
for (l=pos; l&lt;dataLen; l+=4) {<br />
CRCPosVal -= *(unsigned short*)(&amp;CRC_Data[l]);<br />
}<br />
CRCPosVal &amp;= 0xFF00;<br />
crc[pos] = (unsigned char) (CRCPosVal &gt;&gt; 8);<br />
}<br />
free(CRC_Data);<br />
}<br />
</pre><br />
<br />
<br />
== Further Reading ==<br />
<br />
* [https://web.archive.org/web/20040604013125/http://console-dev.com:80/eeprom.htm Information about EEPROM contents]<br />
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip with a Raspberry Pi]<br />
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]<br />
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]</div>KaosEngineerhttps://xboxdevwiki.net/index.php?title=EEPROM&diff=6092EEPROM2017-08-29T16:56:34Z<p>KaosEngineer: /* Contents */ formatting of Note on pass code storage in a word (2-bytes) not 4 (remaining 2 for even 32-bit data alignment)</p>
<hr />
<div>The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.<br />
Parts of the EEPROM are encrypted using [[Kernel/XboxEEPROMKey]].<br />
<br />
== Chip Models ==<br />
<br />
{| class="wikitable"<br />
! Xbox Model<br />
! Manufacturer<br />
! Model<br />
|-<br />
| 1.4 (Others?)<br />
| Catalyst<br />
| CAT24WC02J<br />
|}<br />
<br />
== Contents ==<br />
<br />
{| class="wikitable"<br />
! Start !! End !! Notes<br />
|-<br />
| 0x00<br />
| 0x13<br />
| HMAC_SHA1 Hash<br />
|-<br />
| 0x14<br />
| 0x1B<br />
| RC4 Encrypted Confounder ??<br />
|-<br />
| 0x1C<br />
| 0x2B<br />
| RC4 Encrypted HDD key<br />
|-<br />
| 0x2C<br />
| 0x2F<br />
| RC4 Encrypted Region code<br />
* 0x01 = North America<br />
* 0x02 = Japan<br />
* 0x04 = Europe<br />
|-<br />
| 0x30<br />
| 0x33<br />
| Checksum2 - Checksum of next 44 (0x2C) bytes (0x34 - 0x5F)<sup>*</sup><br />
|-<br />
| 0x34<br />
| 0x3F<br />
| Xbox serial number - (ASCII chars 0x30 - 0x39 to match each digit in SN)<br />
|-<br />
| 0x40<br />
| 0x45<br />
| Ethernet MAC address<br />
|-<br />
| 0x46<br />
| 0x47<br />
| Unknown Padding ?<br />
|-<br />
| 0x48<br />
| 0x57<br />
| Online Key ?<br />
|-<br />
| 0x58<br />
| 0x5B<br />
| Video Standard<br />
* 0x00400100 = NTSC-M<br />
* 0x00400200 = NTSC-J<br />
* 0x00800300 = PAL<br />
|-<br />
| 0x5C<br />
| 0x5F<br />
| Unknown Padding ?<br />
|-<br />
| 0x60<br />
| 0x63<br />
| Checksum3 - Checksum of the next 92 (0x5C) bytes (0x64 - 0xBF)<sup>*</sup><br />
|-<br />
| 0x64<br />
| 0x67<br />
| Zone Bias - Offset in # minutes to subtract from GMT time <br />
(e.g., for GMT-06 Central; 6hr = 360min = 0x0000168)<br />
|-<br />
| 0x68<br />
| 0x6B<br />
| Standard Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CST\0, ACST)<br />
|-<br />
| 0x6C<br />
| 0x6F<br />
| Daylight Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CDT\0, ACDT)<br />
|-<br />
| 0x70<br />
| 0x77<br />
| Unknown Padding ?<br />
|-<br />
| 0x78<br />
| 0x7B<br />
| Standard Time Starts 10-05-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x7C<br />
| 0x7F<br />
| Daylight Savings Time Starts 04-01-00-02 (Month-Day-DayOfWeek-Hour)<br />
|-<br />
| 0x80<br />
| 0x87<br />
| Unknown Padding ?<br />
|-<br />
| 0x88<br />
| 0x8B<br />
| Standard Timezone Bias; if not DST, 0 (0x00000000) minute time adjust<br />
|-<br />
| 0x8C<br />
| 0x8F<br />
| Daylight Savings Time Bias; if DST, -60 (0xFFFFFFC4) minute time adjust<br />
|-<br />
| 0x90<br />
| 0x93<br />
| Language ID<br />
|-<br />
| 0x94<br />
| 0x97<br />
| Video Settings<br />
<br />
Offset 0x96:<br />
* 0x??=Normal{{FIXME}}<br />
* 0xB0=Widescreen<br />
* 0xB4=Letterbox<br />
|-<br />
| 0x98<br />
| 0x9B<br />
| Audio Settings<br />
|-<br />
| 0x9C<br />
| 0x9F<br />
| Games Parental Control (0 = Max rating) 1 byte at offset 0x9C data 4-byte aligned adds the 3 remaining bytes of 0x00<br />
{| class="wikitable"<br />
! Xbox Game Rating !! EEPROM Value @ 0x9C<br />
|-<br />
| (RP) Rating Pending (Max)<br />
| 0x00<br />
|-<br />
| (AO) Adults Only <br />
| 0x01<br />
|-<br />
| (M) Mature <br />
| 0x02<br />
|-<br />
| (T) Teen <br />
| 0x03<br />
|-<br />
| (E) Everyone <br />
| 0x04<br />
|-<br />
| (K-A) Kids to Adults <br />
| 0x05<br />
|-<br />
| (EC) Early Childhood <br />
| 0x06<br />
|}<br />
|-<br />
| 0xA0<br />
| 0xA3<br />
| Parental Control Passcode; 4 button sequence (each key stored in a nibble not byte)<br />
* 0x01 = {{input-up}}<br />
* 0x02 = {{input-down}}<br />
* 0x03 = {{input-left}}<br />
* 0x04 = {{input-right}}<br />
* 0x07 = {{input-x}}<br />
* 0x08 = {{input-y}}<br />
* 0x0B = {{input-lt}}<br />
* 0x0C = {{input-rt}}<br />
* 0 = Disabled{{FIXME|reason=Is this 0x00000000 only, or are shorter codes possible? can a middle section be 0x00 or would that end the sequence?}}<br />
Note:{{FIXME|reason=Not sure this is the proper place to describe and formatting sucks not used mediawiki that much still learning}}<br />
* EEPROM offset 0xA0: 23 14 00 00 <br />
* Little Endian value 0x00001423.<br />
* The pass code is D-pad directions up (0x01), right (0x04), down (0x02), left (0x03). <br />
* Pass code is only 2 bytes not 4, each button is stored as a nibble in the word. First button in the most significant nibble and last in the least significant nibble. <br />
* Data in the EEPROM is aligned to double word (4-byte) boundaries. Thus, the two extra bytes at 0xA2 and 0xA3 of 0x00.<br />
|-<br />
| 0xA4<br />
| 0xA7<br />
| Movies Parental Control (0 = Max rating) only 1 byte necessary, the 3 remaining bytes for multiple of 4-byte data alignment{{FIXME|reason=Re-word alignment description. The reason for the extra 3 bytes.}}<br />
{| class="wikitable"<br />
! Xbox Movie Rating !! EEPROM Value @ 0xA4<br />
|-<br />
| 8 (Max)<br />
| 0x00<br />
|-<br />
| 7 (NC-17) <br />
| 0x01<br />
|-<br />
| 6 (R)<br />
| 0x02 <br />
|-<br />
| 5<br />
| 0x03 <br />
|-<br />
| 4 (PG-13)<br />
| 0x04<br />
|-<br />
| 3 (PG)<br />
| 0x05<br />
|-<br />
| 2<br />
| 0x06 <br />
|-<br />
| 1 (G)<br />
| 0x07 <br />
|}<br />
|- <br />
| 0xA8<br />
| 0xAB<br />
| XBOX Live IP Address..<br />
|-<br />
| 0xAC<br />
| 0xAF<br />
| XBOX Live DNS Server..<br />
|-<br />
| 0xB0<br />
| 0xB3<br />
| XBOX Live Gateway Address..<br />
|-<br />
| 0xB4<br />
| 0xB7<br />
| XBOX Live Subnet Mask..<br />
|-<br />
| 0xB8<br />
| 0xBB<br />
| Other XBLive settings ?<br />
|-<br />
| 0xBC<br />
| 0xBF<br />
| DVD Playback Kit Zone<br />
|-<br />
| 0xC0<br />
| 0xFF<br />
| Unknown Codes / History ? do not change any values in this region <br />
|-<br />
|}<br />
<br />
Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].<br />
<br />
<sup>*</sup>Configmagic-FINAL-1.6 uses the wrong size when computing Checksum2 (40 instead of 44 bytes) and Checksum3 (96 instead of 92 bytes). Checksum2 value computed was correct only because the extra 4 bytes not used in the CRC computation were all 0's which does not change the CRC value. However, a similiar problem with computation of Checksum3 is present. The CRC computed for v1.6 Xbox's is incorrect as the 4 extra bytes are not 0's as on earlier versions.<br />
<br />
== Reading/Writing the EEPROM ==<br />
<br />
=== Software Method ===<br />
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.<br />
<br />
=== Hardware Method ===<br />
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see [http://dangerousprototypes.com/blog/bus-pirate-manual/ here]<br />
or [https://www.totalphase.com/products/aardvark-i2cspi/ here]), build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. Then use the corresponding software to read/write the EEPROM.<br />
<br />
<br />
==The HMAC HDD Key==<br />
<br />
The HMAC HDD Key is generated out of the first 48 bytes. This section has been identified clearly.<br />
<br />
<br />
==The Region Code==<br />
<br />
This DWORD is encrypted. It corresponds to the region code in the XBE header:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| 1<br />
| North America<br />
|-<br />
| 2<br />
| Japan<br />
|-<br />
| 4<br />
| Europe/Australia<br />
|-<br />
| 0x80000000<br />
| Manufacturing plant<br />
|}<br />
<br />
==The Serial Number==<br />
<pre> 1166356 20903<br />
|| | |||||__<br />
|| | ||||___ factory number<br />
|| | |||____<br />
|| | ||_____ week of year (starting Mondays)<br />
|| | |______ last digit of year<br />
|| |________<br />
||_____________ number of Xbox within week and factory<br />
|______________ production line within factory <br />
<br />
</pre><br />
<br />
{| class="wikitable"<br />
! style="text-align: center;" | 1<br />
! style="text-align: center;" | 1<br />
! style="text-align: center;" | 6<br />
! style="text-align: center;" | 6<br />
! style="text-align: center;" | 3<br />
! style="text-align: center;" | 5<br />
! style="text-align: center;" | 6<br />
! style="text-align: center;" | <br />
! style="text-align: center;" | 2<br />
! style="text-align: center;" | 0<br />
! style="text-align: center;" | 9<br />
! style="text-align: center;" | 0<br />
! style="text-align: center;" | 3<br />
! style="text-align: center;" | <br />
! <br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | /<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| Factory Number (02=Mexico, 03=Hungary, 05=China, 06=Taiwan)<br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| <br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| week of year (starting Mondays)<br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| <br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| last digit of year (200Y)<br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| <br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| number of Xbox within week and factory<br />
|-<br />
| style="text-align: center;" | |<br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| style="text-align: center;" | <br />
| <br />
|-<br />
| style="text-align: center;" | \<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| style="text-align: center;" | _<br />
| production line within factory<br />
|}<br />
<br />
==The MAC address==<br />
<br />
This is the MAC address of the Ethernet hardware, which has been [https://web.archive.org/web/20100617020733/http://standards.ieee.org/regauth/oui/oui_public.txt issued by the IEEE].<br />
<br />
<br />
==DVD Region==<br />
<br />
This DWORD corresponds to the region code for playback of DVD movies:<br />
<br />
<br />
{| class="wikitable"<br />
|-<br />
| 0x00<br />
| None<br />
|-<br />
| 0x01<br />
| Region 1<br />
|-<br />
| ...<br />
| ...<br />
|-<br />
| 0x06<br />
| Region 6<br />
|}<br />
<br />
== Checksum Algorithm ==<br />
<br />
Checksum2 and Checksum3 values can be calculated by running the following code snippet over the area the checksum covers:<br />
<br />
<pre> /* The EepromCRC algorithm was obtained from the XKUtils 0.2 source released by<br />
* TeamAssembly under the GNU GPL.<br />
* Specifically, from XKCRC.cpp<br />
*<br />
* Rewritten to ANSI C by David Pye (dmp@davidmpye.dyndns.org)<br />
*<br />
* Thanks! */<br />
void EepromCRC(unsigned char *crc, unsigned char *data, long dataLen) {<br />
unsigned char* CRC_Data = (unsigned char *)malloc(dataLen+4);<br />
int pos=0;<br />
memset(crc,0x00,4);<br />
<br />
memset(CRC_Data,0x00, dataLen+4);<br />
//Circle shift input data one byte right<br />
memcpy(CRC_Data + 0x01 , data, dataLen-1);<br />
memcpy(CRC_Data, data + dataLen-1, 0x01);<br />
<br />
for (pos=0; pos&lt;4; ++pos) {<br />
unsigned short CRCPosVal = 0xFFFF;<br />
unsigned long l;<br />
for (l=pos; l&lt;dataLen; l+=4) {<br />
CRCPosVal -= *(unsigned short*)(&amp;CRC_Data[l]);<br />
}<br />
CRCPosVal &amp;= 0xFF00;<br />
crc[pos] = (unsigned char) (CRCPosVal &gt;&gt; 8);<br />
}<br />
free(CRC_Data);<br />
}<br />
</pre><br />
<br />
<br />
== Further Reading ==<br />
<br />
* [https://web.archive.org/web/20040604013125/http://console-dev.com:80/eeprom.htm Information about EEPROM contents]<br />
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip with a Raspberry Pi]<br />
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]<br />
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]</div>KaosEngineer