If i were you i would wait and see. lots of people have destroyed/damaged their drives trying to remove this thing. i would spend some time reading all the forums. reading the links. I am just learning alot of things myself. if you do wish to learn about the firmware then get a disassembler and start looking at the toshiba-samsung firmware. links to this stuff are on the forum and doesn't require you f***ing up your dvd drive. learn learn learn and then do.

where is the input buffer? how to you insert some kind of payload?

how exactly can we exploit a buffer oveflow when a game freezes seemly randomly. it a bug not a exploit

hitachi because that is the one firmcrypt is used for.

if you don't mind pm me the values of the first key. i think the second key is the valid one.

i don't think the first one is a key.

addition: thanks. that is strange indeed. let us know which key works

control it how? what specific funtions do you wish to control? on/off?

I don't know of a way to control it. I think it support upnp

Thanks Tiros looking forward to trying out the commad when i get home.

robinsod: could you help me for a second? in your code you set bit P1.5 but i don't know what function this serves. i know it will send a high level to a pin on the processor but what is it really doing for us in the code. sorry if this is elementary but any help is appreciated.

is it the write enable pin or something? thanks for the responses. i think i understand the code now that i have commented it and run it through a simulator. I am slow with assembly

I am going to test out my modifications in Simulator2003 because it has a terminal emulation window.

The Hitachi drives key is dumpable via software already. It uses some debug commands that were left in by the manufactorer

edit: sorry ethier i missed part of your post or you edited or somethign because now you posted about the TS and stuff. sorry if im repeating

zerodefect: MacDennis ponted you to the thread.

The way i understand it is that the drive will seek accross the bad sectors and it is records the amount of time taken to do so. This is then sent to the box and somehow verifies that security placeholders are correct because it would be variable depending on how and where the bad sectors were writen.

go read http://www.xboxhacker.net/index.php?option=com_smf&Itemid=33&topic=455.0 like macdennis suggested.

RAID: this might not be a good firmware to use. the only way i could get it recognized in windows was to start the 360 with just the power cable connected to the dvd rom. when the 360 finished starting i would plug the cable from my computers sata controller into the drive. Windows would then recognize the device. This was the only way i got it to recognize. if i started with the cable from my computer pluged into the drive then it would just freeze my computer.

The key space in the firmware at 401A is FF'd out. This seems to be just a beta firmware and probably won't be of much use to anyone. i just wanted to upload for the sake that it might be usefull. sorry i am not more of an assistance.

I attempted to write my key from my orginal ms25 to the ms07 then attempted to get it working in the 360 and it did not work with my xbox 1 games. it just played the video part of the disc.

why are you posting this all over? what do you mean glitches? the only glitches i know anything about are for smartcards.

no you don't have to get a samsung again. you will have to be able to read the contents of your flash out to get the key for your samsung though. you can then write this key into the firmware of the hitachi drive and it will work with your 360

which 2 pads?

darkfly kindly provided a picture he links to in this post
http://www.xboxhacker.net/forums/index.php?topic=76.msg1864#msg1864
with alternate solder points for pins.

here is a direct link to the picture
http://img456.imageshack.us/my.php?image=pinouts2mf.jpg

i extracted the pin out from the datasheet at http://www.sst.com/products.xhtml/parallel_flash/39/x8/SST39SF020A
hope this helps

Also i made a ppf3 patch one can apply to their extracted firmware if anyone is interested. remove the jpg from the file name. you can use any ppf-o-matic 3 or similar to patch. i noticed you metioned you might do this earlier. i hope i am not steping on toes by posting it. if so i can remove

robinsod: thanks for the patches. i successfully dumped my halo 2 security sector.

I am going to attempt to modifying your code to output the security sector over the serial port because i wanted a way to quickly dump several discs with out having to readout the flash each time. Plus i wanted to try some to see if the serial port even works.

no problem. good luck with removing the chip. try not to damage the board. don't force it. i would try to bridging tip by robinsod i posted above

you will have to be able to read/write the flash chip in some fashion. be it desoldering and programing for the toshiba-samsung.

If it is the hitachi there is a software solution to read/write the flash on that drive.

do you know what drive your friend has? have you taken the box apart yet to look closer at the dvd-rom? perhaps it is just a cord that melted or something similar

i bought a $45 willem from sivava.com (link to one i bought http://www.sivava.com/Product_A04.htm). the core $45 package has a PLCC socket that can read/write the 39SF020A without problem.

I got several adapters with mine as well for various other projects that required them.

also they are located in thailand so it took about 10 days for it to arrive to me in the states.

i have been able to get my replacement to work by extracting my orginal firmware from my drive and writing it to the new one.