Difference between revisions of "EEPROM"

Revision as of 21:55, 29 August 2017

The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54. Parts of the EEPROM are encrypted using Kernel/XboxEEPROMKey.

Chip Models

Contents

Note:[FIXME]
* EEPROM offset 0xA0: 23 14 00 00 
* Little Endian value 0x00001423.
* The pass code is D-pad directions up (0x01), right (0x04), down (0x02), left (0x03). 
* Pass code is only 2 bytes not 4, each button is stored as a nibble in the word.  First button in the most significant nibble and last in the least significant nibble.  
* Data in the EEPROM is aligned to double word (4-byte) boundaries. Thus, the two extra bytes at 0xA2 and 0xA3 of 0x00.

Note: Info in above table comes from XKUtils XKEEPROM.h.

^*Configmagic-FINAL-1.6 uses the wrong size when computing Checksum2 (40 instead of 44 bytes) and Checksum3 (96 instead of 92 bytes). Checksum2 value computed was correct only because the extra 4 bytes not used in the CRC computation were all 0's which does not change the CRC value. However, a similiar problem with computation of Checksum3 is present. The CRC computed for v1.6 Xbox's is incorrect as the 4 extra bytes are not 0's as on earlier versions.

Reading/Writing the EEPROM

Software Method

This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.

Hardware Method

If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see here or here), build an I2C-Serial cable, or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See here for pinout information. Then use the corresponding software to read/write the EEPROM.

The HMAC HDD Key

The HMAC HDD Key is generated out of the first 48 bytes. This section has been identified clearly.

The Region Code

This DWORD is encrypted. It corresponds to the region code in the XBE header:

The Serial Number

     1166356 20903
     ||    | |||||__
     ||    | ||||___ factory number
     ||    | |||____
     ||    | ||_____ week of year (starting Mondays)
     ||    | |______ last digit of year
     ||    |________
     ||_____________ number of Xbox within week and factory
     |______________ production line within factory 
   

The MAC address

This is the MAC address of the Ethernet hardware, which has been issued by the IEEE.

DVD Region

This DWORD corresponds to the region code for playback of DVD movies:

Checksum Algorithm

Checksum2 and Checksum3 values can be calculated by running the following code snippet over the area the checksum covers:

 /* The EepromCRC algorithm was obtained from the XKUtils 0.2 source released by
  * TeamAssembly under the GNU GPL.
  * Specifically, from XKCRC.cpp
  *
  * Rewritten to ANSI C by David Pye (dmp@davidmpye.dyndns.org)
  *
  * Thanks! */
 void EepromCRC(unsigned char *crc, unsigned char *data, long dataLen) {
         unsigned char* CRC_Data = (unsigned char *)malloc(dataLen+4);
         int pos=0;
         memset(crc,0x00,4);
 
         memset(CRC_Data,0x00, dataLen+4);
         //Circle shift input data one byte right
         memcpy(CRC_Data + 0x01 , data, dataLen-1);
         memcpy(CRC_Data, data + dataLen-1, 0x01);
 
         for (pos=0; pos<4; ++pos) {
                 unsigned short CRCPosVal = 0xFFFF;
                 unsigned long l;
                 for (l=pos; l<dataLen; l+=4) {
                         CRCPosVal -= *(unsigned short*)(&CRC_Data[l]);
                 }
                 CRCPosVal &= 0xFF00;
                 crc[pos] = (unsigned char) (CRCPosVal >> 8);
         }
         free(CRC_Data);
 }

Further Reading

• Information about EEPROM contents
• Read/Write an original Xbox EEPROM chip with a Raspberry Pi
• How To Make Xbox EEPROM Reader / Write (Video)
• How To Extract Xbox EEPROM Easy (Video)