MCPX ROM - Revision history

JayFoxRox: /* References */

2017-07-05T10:41:48Z

‎References

2017-07-05T08:14:53Z

‎MCPX 1.1: typo FBL to 2BL "...to create a hash of the FBL and if that was correct..." and jump address lower to upper case HEX.

2017-07-05T08:11:41Z

‎MCPX 1.0: typo BL2 change to 2BL

2017-06-19T10:45:22Z

‎MCPX 1.1

2017-05-28T16:58:54Z

‎Dumping the MCPX ROM

2017-05-25T17:39:57Z

2017-05-15T21:05:36Z

‎Dumping the MCPX ROM

2017-05-14T20:04:07Z

‎References

2017-03-28T20:55:43Z

2017-03-28T20:48:02Z

← Older revision		Revision as of 10:41, 5 July 2017
Line 42:		Line 42:

	* [https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Xbox Boot ROM]		* [https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Xbox Boot ROM]
−	* [https://github.com/JayFoxRox/~~xqemu~~-tools/~~blob/master/disassemble-~~mcpx~~.sh disassemble~~-~~mcpx.sh~~: A bash-script to disassemble/annotate MCPX ~~1.0~~ dumps]	+	* [https://github.com/JayFoxRox/xbox-tools/ mcpx-tool: A bash-script to disassemble/annotate MCPX dumps]

@@ Line 29: / Line 29: @@
 == MCPX 1.1 ==
-Because of the flaws of the previous method, Microsoft changed the way the 2BL was decrypted. Microsoft implemented a TEA algorithm to create a hash of the FBL and if that was correct, it would jump to 0xffffd400. This isn't in Memory, but rather in the BIOS. Otherwise it would error.
+Because of the flaws of the previous method, Microsoft changed the way the 2BL was decrypted. Microsoft implemented a TEA algorithm to create a hash of the FBL and if that was correct, it would jump to 0xFFFFD400. This isn't in Memory, but rather in the BIOS. Otherwise it would error.
 == Error Handling ==

@@ Line 25: / Line 25: @@
 == MCPX 1.0 ==
-The 1.0 ROM runs an RC4 algorithm to decrypt the BL2 from flash (starting at 0xFFFF9E00) and load the unencrypted 2BL to memory (0x90000). It checks the signature of the decrypted 2BL and if it is correct, starts executing code at 0x90000. Otherwise it errors.
+The 1.0 ROM runs an RC4 algorithm to decrypt the 2BL from flash (starting at 0xFFFF9E00) and load the unencrypted 2BL to memory (0x90000). It checks the signature of the decrypted 2BL and if it is correct, starts executing code at 0x90000. Otherwise it errors.
 == MCPX 1.1 ==

@@ Line 29: / Line 29: @@
 == MCPX 1.1 ==
-Because of the flaws of the previous method, Microsoft changed the way the 2BL was decrypted. From what I can tell, Microsoft implemented a TEA algorithm to create a hash of a particular section of the BIOS (many times), and if that was correct, it would jump to 0xffffd600. This isn't in Memory, but rather in the BIOS. Otherwise it would error.
+Because of the flaws of the previous method, Microsoft changed the way the 2BL was decrypted. Microsoft implemented a TEA algorithm to create a hash of the FBL and if that was correct, it would jump to 0xffffd400. This isn't in Memory, but rather in the BIOS. Otherwise it would error.
 == Error Handling ==

@@ Line 15: / Line 15: @@
 </pre>
-This turns off the MCPX ROM, making it invisible to anything trying to read it. See [[MCPX ROM Dumping]] for more details.
+This turns off the MCPX ROM, making it invisible to anything trying to read it.
 == MCPX Common ==

← Older revision		Revision as of 17:39, 25 May 2017
Line 1:		Line 1:
−	The purpose of the MCPX ROM is to setup the GPT table, enter 32 bit mode, Enable caching, decrypt the second bootloader (2BL) and then transfer control over to it. It has a fair few things to do, so also contains an interpreter to read instructions from the BIOS (known as xcodes). There are two known versions of the MCPX ROM, 1.0 and 1.1. 1.0 was found in the 1.0 Xbox and used an RC4 algorithm to decrypt the 2BL. ~~After~~ Microsoft ~~found this out, they changed the algorithm~~ to a TEA algorithm. The code on the chips is largely the same, but for those two differences.	+	The purpose of the MCPX ROM is to setup the GPT table, enter 32 bit mode, Enable caching, decrypt the second bootloader (2BL) and then transfer control over to it. It has a fair few things to do, so also contains an interpreter to read instructions from the BIOS (known as xcodes). There are two known versions of the MCPX ROM, 1.0 and 1.1.
		+
		+	1.0 was found in the 1.0 Xbox and used an RC4 algorithm to decrypt the 2BL.
		+	For 1.1 Microsoft switched to a TEA algorithm.
		+	The code on the chips is largely the same, but for those two differences{{citation needed}}.

	== Dumping the MCPX ROM ==		== Dumping the MCPX ROM ==

← Older revision		Revision as of 20:04, 14 May 2017
Line 36:		Line 36:

	* [https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Xbox Boot ROM]		* [https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Xbox Boot ROM]
		+	* [https://github.com/JayFoxRox/xqemu-tools/blob/master/disassemble-mcpx.sh disassemble-mcpx.sh: A bash-script to disassemble/annotate MCPX 1.0 dumps]

@@ Line 31: / Line 31: @@
 == See Also ==
-* [[MCPX 1.0]]
+* [[MCPX HLE]]
 == References ==
 * [https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Xbox Boot ROM]