Difference between revisions of "Xbox DVD Movie Playback Kit"

From xboxdevwiki
Jump to: navigation, search
Line 1: Line 1:
{{retrieved|http://www.xbox-linux.org/wiki/DVD-IR_Internals}}
 
 
 
 
by ''Rob Reilink'', 3 Mar 2003
 
 
 
 
 
==Introduction==
 
==Introduction==
  
The DVD-IR remote receiver is a part of the DVD kit which allows you to view DVDs on your Xbox. It comes together with a remote controller. Although it may seem just a simple microcontroller device with a receiver module, there is something more inside which could make it even more interesting.
+
The DVD Movie Playback Kit contains 2 parts: A remote and a dongle for the Xbox.
  
 +
== Remote Control ==
  
==Pictures==
+
== Dongle ==
  
Ok, let's start with the pictures from the internals:
+
The dongle contains a ROM with an XBE which provides some functions for the DVD playback application. However, the XBE is not standalone.
 
+
Additionally the Dongle contains an IR receiver to receive commands from the Remote control
'''Missing image'''<br />''Dvdirfront.jpg'' <br />Image:Dvdirfront.jpg<br /><br />
 
'''Missing image'''<br />''Dvdirback.jpg'' <br />Image:Dvdirback.jpg<br /><br />
 
 
 
 
 
==IC's==
 
 
 
So, what is inside and what does it do?
 
  
 +
=== Components ===
  
 
* U1 92163 [https://web.archive.org/web/20100617020513/http://www.st.com/ STMicroelectronics] &lt;[https://web.archive.org/web/20100617020513/http://www.st.com/stonline/books/pdf/docs/5521.pdf Datasheet]&gt;
 
* U1 92163 [https://web.archive.org/web/20100617020513/http://www.st.com/ STMicroelectronics] &lt;[https://web.archive.org/web/20100617020513/http://www.st.com/stonline/books/pdf/docs/5521.pdf Datasheet]&gt;
 
: This big square IC on the backside is the microcontroller. STMicroelectronics describes it as "8/16-BIT FULL SPEED USB MCU FOR COMPOSITE DEVICES WITH 16 ENDPOINTS, 20K ROM, 2K RAM, I 2 C, SCI, &amp; MFT". Since the program resides inside in its ROM, it is almost impossible to extract the program from inside.
 
: This big square IC on the backside is the microcontroller. STMicroelectronics describes it as "8/16-BIT FULL SPEED USB MCU FOR COMPOSITE DEVICES WITH 16 ENDPOINTS, 20K ROM, 2K RAM, I 2 C, SCI, &amp; MFT". Since the program resides inside in its ROM, it is almost impossible to extract the program from inside.
 
 
  
 
* U2 TSOP-1556 [https://web.archive.org/web/20100617020513/http://www.vishay.com/ Vishay Telefunken] &lt;[https://web.archive.org/web/20100617020513/http://www.vishay.com/docs/82029/82029.pdf Datasheet]&gt;
 
* U2 TSOP-1556 [https://web.archive.org/web/20100617020513/http://www.vishay.com/ Vishay Telefunken] &lt;[https://web.archive.org/web/20100617020513/http://www.vishay.com/docs/82029/82029.pdf Datasheet]&gt;
 
: This black box on the middle of the frontside is an integrated IR receiver. It filters the received infrared pulses and demodulates them. Its filter frequency is 56kHz, while 38kHz is standard for most remote controls. Therefore, chances are few other remotes will work with the Xbox receiver.
 
: This black box on the middle of the frontside is an integrated IR receiver. It filters the received infrared pulses and demodulates them. Its filter frequency is 56kHz, while 38kHz is standard for most remote controls. Therefore, chances are few other remotes will work with the Xbox receiver.
 
 
  
 
* U3 MX23C4000TC-10 [https://web.archive.org/web/20100617020513/http://www.macronix.com/ Macronix] &lt;[https://web.archive.org/web/20100617020513/http://www.macronix.com/QuickPlace/hq/PageLibrary48256D9D002BA613.nsf/h_6057FA6682A90C3948256DCE0052D2D3/67DCB124F1BE4E7D48256DC50039AC31/$File/MX23C4000-4.2.pdf/?OpenElement Datasheet]&gt;
 
* U3 MX23C4000TC-10 [https://web.archive.org/web/20100617020513/http://www.macronix.com/ Macronix] &lt;[https://web.archive.org/web/20100617020513/http://www.macronix.com/QuickPlace/hq/PageLibrary48256D9D002BA613.nsf/h_6057FA6682A90C3948256DCE0052D2D3/67DCB124F1BE4E7D48256DC50039AC31/$File/MX23C4000-4.2.pdf/?OpenElement Datasheet]&gt;
 
: This wide TSOP IC on the frontside could be the most interesting of all. It is a 4MBit mask ROM. It is assumed that it contains the DVD player application. WHY? Why would they not just put this little 512kb max. application on the harddisk? Why another ROM which contains the program?
 
: This wide TSOP IC on the frontside could be the most interesting of all. It is a 4MBit mask ROM. It is assumed that it contains the DVD player application. WHY? Why would they not just put this little 512kb max. application on the harddisk? Why another ROM which contains the program?
 
  
 
: One could think it is to allow them to upgrade the application easily, but the real reason seems to be different: licensing. As the label on the back notes: "Made under license from Dolby Laboratories". By including the software in the DVD Remote kit, they don't have to pay Dolby for every Xbox sold, but just for every DVD Remote kit sold. This allows them to keep the cost of the Xbox down.
 
: One could think it is to allow them to upgrade the application easily, but the real reason seems to be different: licensing. As the label on the back notes: "Made under license from Dolby Laboratories". By including the software in the DVD Remote kit, they don't have to pay Dolby for every Xbox sold, but just for every DVD Remote kit sold. This allows them to keep the cost of the Xbox down.
  
 +
* U4 HC574 [https://web.archive.org/web/20100617020513/http://www.ti.com/ Texas Instruments] &lt;[https://web.archive.org/web/20100617020513/http://focus.ti.com/lit/ds/symlink/sn74hc574.pdf Datasheet]&gt;
 +
: This 20-pin standard logic IC is an octal D-flipflop, which splits the databus from the 92163 to 8 adress bits. This technique is very well known from the 8051 and other microcontrollers.
  
  
* U4 HC574 [https://web.archive.org/web/20100617020513/http://www.ti.com/ Texas Instruments] &lt;[https://web.archive.org/web/20100617020513/http://focus.ti.com/lit/ds/symlink/sn74hc574.pdf Datasheet]&gt;
 
: This 20-pin standard logic IC is an octal D-flipflop, which splits the databus from the 92163 to 8 adress bits. This technique is very well known from the 8051 and other microcontrollers.
 
  
 +
=== Hacking ===
  
 +
As the dashboard presumably downloads the code from the ROM into the memory of the Xbox, this could be a hardware hack requiring no hardware modifications. The XBE loader for the DVD image is different from the usual XBE loader. However, the XBE is still signed and checked for security.
  
==Hacking!==
+
== References ==
  
As the dashboard presumably downloads the code from the ROM into the memory of the Xbox, this could be a hardware hack requiring no hardware modifications. It should be noted though, that the ROM is probably scrambled. Also, the microcontroller could encrypt the data even more. As the mask ROM is not a proprietary device, it is known not to contain any encryption hardware. On the other hand is it quite reasonable to assume Microsoft also signed this piece of code, and the dashboard might refuse to run it if it is not signed.
+
* [https://github.com/JayFoxRox/xbox-tools/tree/master/dump-dvd-kit Tool to dump DVD Dongle ROM]

Revision as of 20:16, 20 August 2017

Introduction

The DVD Movie Playback Kit contains 2 parts: A remote and a dongle for the Xbox.

Remote Control

Dongle

The dongle contains a ROM with an XBE which provides some functions for the DVD playback application. However, the XBE is not standalone. Additionally the Dongle contains an IR receiver to receive commands from the Remote control

Components

This big square IC on the backside is the microcontroller. STMicroelectronics describes it as "8/16-BIT FULL SPEED USB MCU FOR COMPOSITE DEVICES WITH 16 ENDPOINTS, 20K ROM, 2K RAM, I 2 C, SCI, & MFT". Since the program resides inside in its ROM, it is almost impossible to extract the program from inside.
This black box on the middle of the frontside is an integrated IR receiver. It filters the received infrared pulses and demodulates them. Its filter frequency is 56kHz, while 38kHz is standard for most remote controls. Therefore, chances are few other remotes will work with the Xbox receiver.
This wide TSOP IC on the frontside could be the most interesting of all. It is a 4MBit mask ROM. It is assumed that it contains the DVD player application. WHY? Why would they not just put this little 512kb max. application on the harddisk? Why another ROM which contains the program?
One could think it is to allow them to upgrade the application easily, but the real reason seems to be different: licensing. As the label on the back notes: "Made under license from Dolby Laboratories". By including the software in the DVD Remote kit, they don't have to pay Dolby for every Xbox sold, but just for every DVD Remote kit sold. This allows them to keep the cost of the Xbox down.
This 20-pin standard logic IC is an octal D-flipflop, which splits the databus from the 92163 to 8 adress bits. This technique is very well known from the 8051 and other microcontrollers.


Hacking

As the dashboard presumably downloads the code from the ROM into the memory of the Xbox, this could be a hardware hack requiring no hardware modifications. The XBE loader for the DVD image is different from the usual XBE loader. However, the XBE is still signed and checked for security.

References