Difference between revisions of "EEPROM"

Revision as of 19:28, 5 May 2019

The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54. Parts of the EEPROM are encrypted using Kernel/XboxEEPROMKey.

Contents

Note: Info in above table comes from XKUtils XKEEPROM.h.

^*Configmagic-FINAL-1.6 uses the wrong size when computing Checksum2 (40 instead of 44 bytes) and Checksum3 (96 instead of 92 bytes). Checksum2 value computed was correct only because the extra 4 bytes not used in the CRC computation were all 0's which does not change the CRC value. However, a similiar problem with computation of Checksum3 is present. The CRC computed for v1.6 Xbox's is incorrect as the 4 extra bytes are not 0's as on earlier versions.

Reading/Writing the EEPROM

Software Method

This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.

Hardware Method

If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see here or here), build an I2C-Serial cable, or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See here for pinout information. Then use the corresponding software to read/write the EEPROM.

The HMAC HDD Key

The HMAC HDD Key is generated^[FIXME] out of the first 48 bytes^[FIXME]. This section has been identified clearly^[FIXME].

Checksum Algorithm

Checksum2 and Checksum3 values can be calculated by running the following code snippet over the area the checksum covers:

 /* The EepromCRC algorithm was obtained from the XKUtils 0.2 source released by
  * TeamAssembly under the GNU GPL.
  * Specifically, from XKCRC.cpp
  *
  * Rewritten to ANSI C by David Pye (dmp@davidmpye.dyndns.org)
  *
  * Adapted for XboxDevWiki
  */
 uint32_t EepromCRC(unsigned char *data, long dataLen) {

         // Initialize result to zero
         uint8_t crc[4] = { 0x00, 0x00, 0x00, 0x00 };
 
         //Circle shift input data one byte right
         unsigned char* CRC_Data = (unsigned char *)malloc(dataLen + 4);
         memset(CRC_Data, 0x00, dataLen + 4);
         memcpy(CRC_Data + 0x01 , data, dataLen - 1);
         memcpy(CRC_Data, data + dataLen - 1, 0x01);
 
         // Calculate checksum
         for (unsigned int i = 0; i < 4; i++) {
                 unsigned short CRCPosVal = 0xFFFF;
                 for (unsigned long l = i; l < dataLen; l += 4) {
                         CRCPosVal -= *(unsigned short*)(&CRC_Data[l]);
                 }
                 CRCPosVal &= 0xFF00;
                 crc[i] = (unsigned char) (CRCPosVal << 8);
         }

         free(CRC_Data);

         return *(uint32_t*)&checksum;
 }

Read Checksum Algorithm

When the Xbox reads from the FACTORY_SETTINGS or the USER_SETTINGS section of the EEPROM, this algorithm is ran over the entire section accessed (including the CRC checksum mentioned above) to ensure that the data is valid. If the result of the checksum algorithm does not equal 0xFFFFFFFF, STATUS_DEVICE_DATA_ERROR is returned from the Kernel.

static uint32_t eeprom_section_checksum(
    const uint32_t* section_data,
    uint32_t section_data_length
)
{
    const uint32_t bitmask = 0xFFFFFFFF;
    uint64_t checksum = 0;
    uint32_t carry_count = 0;

    // Process the data in 32 bit steps
    for(unsigned int i = 0; i < section_data_length / 4; i++) {
        checksum += *section_data;
        if(checksum > bitmask) {
            carry_count++;
            checksum &= bitmask;
        }
        section_data++;
    }
    checksum += carry_count;
    if(checksum > bitmask) {
        checksum += 1;
    }
    return (uint32_t)(checksum & bitmask);
}

Further Reading

• Information about EEPROM contents
• Read/Write an original Xbox EEPROM chip with a Raspberry Pi
• How To Make Xbox EEPROM Reader / Write (Video)
• How To Extract Xbox EEPROM Easy (Video)