Flash xell to the box, glitch it and get the key. Then build a donor nand.

Rename to $$ystemupdate. Make sure you got the latest dashlaunch.

You can use nandpro for remapping. See cory1492's post for more detailed info: http://www.xboxhacker.org/index.php?topic=17411.msg131235#msg131235

Seems the B2 block is not recognized as bad block. Null it out in the new image and remap to 3FE and you should be fine.

edit: Remap before nulling out of course 

That is true. Maybe he could try to build the nand using settings extracted using mobileExtract.exe retrieved data from a donor nand? If I recall correctly, that was used before to extract and import settings from and to the nand right? I don't know if xebuild supports mobileExtract files, but I guess it will.

Have you checked write enabling of the nand? Might be that the xbox is not able to write to the nand and therefore is not saving your settings, causing it to stay in a continuous loop.

Have you optimized boottimings on this xbox? I got a slim which had the exact same problem. First couple of times booting great. Then slower and after a while not anymore at all and giving me the ta-ta-ta sound. Changing the 270 pF cap to 220 solved the not booting, but if i shorten the cpu_rst wire from 45 to around 30 it gives me the ta-ta-ta sound while most say the sweet spot should be around 30 cm. cpu_rst signal fluctuates a lot in strength (measured with multimeter). Where you able to shorten the length of cpu_rst wire?

It is probably usb to serial. Just buy a usb to serial with 5 v output and update the thing yourself. Pinout it easy, you just need to connect ground tx and rx. Then power the device and let flashmagic do the rest. If you can handle the xbox nand you should definitely be able to update the nand-x without buying a cable. The ck3 is only used for its usb to serial port.

Thanks for the quick reply. Guess I'm out of luck then and have to buy a new one. Lesson learned on microcontrollers and of to updating the new one with the right hardware this time...

If the lpc2148 is connected directly to the serial port, what can happen? Will the chip be destroyed? I tried to connect it without a converter (stupid i know). Now i have made a rs232 level converter (http://picprojects.org/projects/simpleSIO/ssio.htm), but flash magic gives me the failed to autabaud error. Is it gone because of the high voltages from the serial port or is there something that i can do?

I think you misunderstood miragui. He is not talking about going online with a SMC hacked console. He is talking about flashing modified firmware to dvd-drives using a SMC hacked console (using the commands that microsoft used in their update 13146 to flash drives).

Quickest solution is to create a fbbuild image using your original nand. As xell runs, fbbuild should also run. Extract the needed files from your nand backup using ibuild or 360 Flash Dump Tool and create a working 12611 fbbuild image. If extracting them from your nand is not possible you should use donor files. First however, try to use your own files as they contain data that is specific for your console like temperature profiles. Make sure to use the right smc (change your own smc (you extract it using ibuild or 360 Flash Dump Tool) using Blackaddr's smc utility 1.2) to the right wiring. Recommended wiring for hdmi models is aud_clamp and db1f1 (or ft1u2/ft2r2). Another point for db1f1 (or ft1u2/ft2r2) is given in this image by boxxdr: http://boxxdr.com/boxxdr_jtag.jpg. Make sure you have the right soldering skills before attempting this. Practice on old stuff first before messing with the xbox to make sure you don't have a problem with your soldering. Buy a small tip soldering machine if you don't have one or let someone else do it for you. If you did not successfully solder to db1f1 you will have problems soldering to any other point.

From your post I suppose you have already flashed your nand. What I would try is to erase the nand completely. Then write your fbbuild image. If that goes without write errors you are fine. If you get write errors then you need to remap those blocks that give you an error to the end of your nand file. First things first however: You need to get your fbbuild image and get it booting xell from the fbbuild image. That should be working without problems as you have no bad blocks in the first blocks of your nand chip.

I have had a somewhat similar problem (http://www.xboxhacker.org/index.php?topic=16512.0). However, my problem was different from yours as there had been an attempt at jtagging. Rebuilding the nand lead me to a e71 mostly, but also sometimes a e79 error (when I changed a lot in the nand). To understand your problem you need to tell what you have done in more detail. There are multiple possible reasons for this error. In my problem it was obvious that the data on the nand was broken. From what you write I understand that you have not done anything to the nand, therefore I assume that this is not your problem. The e79/e71 error can also be caused by bad connections to the southbridge as far as I know. If you did do something to the nand or soldered to the motherboard you need to tell it as it can be of influence to the solution of your problem.

As I see it right now, with the information you are giving, there are two possibilities:

1. Your nand went bad during the update and data was not properly remapped, causing boot problems.
2. Your southbridge is not making a proper connection to the motherboard.

You need to narrow your problems down, but not all at the same time. You need to find your problem, so you change one variable at each try, starting with the solution that takes the least amount of time. I would try the following steps (one after another of course):

1. Press on the southbridge during booting. This might be enough for the solder balls to make good contact with the motherboard. If it boots --> reflow the southbridge. If it does not boot --> go to option 2.
2. Read your nand. Only do this if you have soldering skills as you might damage more in the process than was broken first. If you can not solder, get someone to do it for you. Open the nand in 360 Flash Dump Tool and see if you have bad blocks that are not remapped. If you have bad blocks that are not remapped --> find the location of the bad data and replace it with correct data (see my topic on the e71 error for a read on how to do this). If no bad blocks that are not remapped are found --> the nand is good, the problem will most likely be in the southbridge. Go to 3.
3. Reflow the southbridge. Succes? --> hooray! No succes --> go to 4.
4. Reball or replace the southbridge. Succes? --> hooray! No succes --> sell the console as faulty and buy a new console.

Reflowing and reballing are not easy to do and need proper equipment. Therefore these options are mentioned as last.

If the red ring appears after 30 seconds or so and the error code is 0022, then the problem is most likely still the bad blocks in your flash and not the solderballs of the cpu/gpu.

Finally succes! I read your post again and this is what I did. I used the nand.bin that came with the console. Extracted block 54 and 55 (which showed ECC errors) without saving the ECC data. I opened the two files with a hex editor. In another window I opened dash.xex in a hex editor. I searched for the hex values of the first line of block 54 inside dash.xex. After that I selected the data for as far as block 54 would go (without ecc data). I then did the same to block 55. Now I had 2 blocks without ecc, so these needed to be written using nandpro to block 54 and 55 while adding ecc. This I used:


Tested the console and it is booting! I now also understand what I did wrong. I thought of just replacing the entire dash.xex, where I just had to replace the bad data (which cory1492 was telling all the time, but I was not seeing it or just stubborn). Thanks a lot for the help cory1492! Really appreciate that you wanted to look at it!

I have read about those problems with 360 Flash Dump Tool before I believe. It is not a big deal actually, as I know where my dash.xex begins. Lets just assume that my FAT/LBA table is correct, otherwise this is absolutely not possible

I just saw that I made a (stupid) mistake previously. It turns out that the dashboard version that is installed is not 12416, but 12413. All this time I was trying to inject the 12416 dash.xex in the nand, where it needed the 12413 dash.xex. This version is a BETA dashboard version. I have tried to download it, but using LeFlufie I am not able to find the dash.xex in the update (probably because it is a BETA version ripped from microsofts server.



Tried it, but freezes on this nand file.


Thanks, did not know that. That makes it indeed almost impossible to use donor FS. I guess my best bet at the moment is to find an extracted dash.xex from the 12413 dashboard update and inject that using nandpro at block a3. Any tips on how to find 12413 dash.xex? I do have another regular xbox and multiple jtag xboxes that can be used. I think I will update the regular xbox to dashboard 12413. Take out the nand. Extract dash.xex using 360 flash dump tool (or xtsynth if flash dump tool is giving problems). Compare the extracted file with data in the original nand (size and position) and then inject the dash.xex in the damaged nand file using nandpro. Let's hope the dash.xex is one consecutive file in the nand. It's gonna be an interesting evening

I did not find that option in 360 Flash Dump Tool, but I would say it would be possible using some other program, considering that the nand is made up of blocks of data (like for example dash.xex) and patches. If these blocks of data are not encrypted with the CPU key, it would be possible to replace them using nandpro for example. The start block and length are found using Flash Dump Tool. Nandpro can then replace the files and add ECC data.

I came across something else that I thought is strange. When I extract the 12416 FileSystem Raw in Flash Dump Tool and open the dash.xex with a hex editor, I find the text string "2004-2008 Microsoft Corporation. All rights reserved". Should this be in dash.xex?

Is there a possibility to take the nand from another xbox with the same dashboardversion. Strip it from its cpu encrypted data and place inside my (most likely bad) nand? This way, all non cpu key encrypted data should be inside my nand right? Or does anyone know an easier method to restore this nand?

That is very good to hear! I am gonna try to replace the dash.xex. I never thought of extracting it from a dashboard update directly. Should be possible using LeFluffie I would say. Will keep you informed on progress! Thanks for the fast reply!

Update: Le Fluffie works excellent for extracting the dash.xex file. Overwriting the complete file looked like the easiest, as the extracted dash.xex has no ECC data. Comparing this dash.xex to the nands dash.xex is difficult when ecc data is missing on one of the two. The dash.xex file will have no ECC data I thought, so I tried:


That should write dash.xex to block 3a while adding ECC data. Doing this gives the same result as the nand was doing before, but does not show bad blocks anymore in 360 Flash Dump Tool. The console still boots after a short time at the bootanimation to E71 however. I have tried a lot of other stuff. Removing ECC from the original nand, then find the start of dash.xex in hex. Copy paste dash.xex from the lefluffie extracted file into the nand with ECC removed. Write nand back to xbox while adding ECC data. No results. I have tried many more things, too much to write down here, as they all were unsuccessfull. I seem to be doing something wrong, but I can not figure out what is going wrong.

Update: Remapping block 54 and 55 did not work.

A while ago someone came to me with a Xbox360 he had tried to jtag. He followed a tutorial (of course) and found that his version was below 7371 because the version on his xbox started with a 1. You can guess what happened next. He soldered up some wires to a LPT port and made 3 backups of his nand, from which 2 backups are wrong for certain (wrong size and most likely also wrong data). Fed up with attempts to get the jtag working, he brought it to me. Taking a look at his nand with the good size told me that he had no dashboard below 7371, but 12416 (which indeed starts with a 1). Also his cables for the LPT connection were way too long.

The nand backup he made can be opened in 360 Flash Dump Tool and shows 2 bad blocks at block 54 and 55. These bad blocks however are not remapped to the end of the nand. When opening the nand in XNandHealerGUI_0.6 (hever used that program before, as I don't trust it to 'fix' nand files), it showed no bad blocks, but ECC error blocks at block 54 and 55. A little search on the web told me that this is caused by faulty data in the block. I think it is due to his poor wiring. He however flashed the nand file back to his console (after trying to flash xell to it) and when I read it with a USB reader, I got a exact copy when compared in Hex Comparison.

Booting up the console takes the console to the xbox splash screen (where the logo comes up, don't know if it is called splash screen, but that used to be in the xbox 1 days, old I know ). Directly when the xbox logo appears, the xbox freezes and spits out a E71, which indicates problems in flash. As block 54 and 55 have bad ecc data, I think that the problem lies within dash.xex (start block 0x003A and length 0x005c6000 according to 360 Flash Dump Tool).

What I want to ask is whether it is possible or not to take the dash.xex from another nand file (12416 of course) and replace it with this nand files dash.xex. For as far as I know, dash.xex is not encrypted with the cpu key, because it can be extracted from the nand without knowing the cpu key, is that correct? If so, I would say it would be possible to repair this xbox by inserting the dash.xex using nandpro (hoping that this is the only problem with his nand backup). Can somebody comment on this thought? Furthermore, if this turns out to be possible, is there someone who has a 12416 nand for me to get the file from? CPU key is not needed ofcourse, as I don't need to extract any files encrypted by the CPU key.