xb360 jtag exploit - Discussion

[skygames]

Hello staff where I find flash_hack for falcon, thanks for the help.

[parasven]

not yet released

[Zakwarrior]

Hi everyone (sorry for my english I'm french)

I'm new on this forum but I wanted to share something probably intresting that I found out after messing around with my xenon and my jasper motherboard.

The actuall problem to run the hack on other motherboards then xenon (zephyr, falcon, jasper) is that we don't have the J1F1 to connect the resistors to J2D2.

So I looked for alternative points and there is many and here is where they go (sorry I don't have any better looking picture, this is from the french forum http://gueux-forum.net)



So I found out that J1F1.3 is connected to the point FT1V2 that you can find behind the motherboard and can also be found on jasper motherboard.

I also found out that J1F1.5 is connected to the point R2B19 that you can ALSO find on the jasper motherboard.

And the last point J1F1.4 is connected to the point R2B18, this one isn't on jasper motherboard but I'm sure there is another alternative point, with a little help it could be found quickly ... 

 

[slasherking823]

and we need smc for those machines

[l0w0utput]

Looking at how the three tracks ( J1F1 3-5 ) enter the southbridge on  a Xenon board, I noticed that this area seems to be quite identical on Jasper boards. Presuming these 3 tracks on a Jasper board really are  J1F1 3-5 (sorry but I'm not capable of providing proof that this is actually the case) this would lead to following soldering points for Jasper:

J1F1 -3-  < a solderpad close to FT2R2, backside of mainboard, close to one of the 'holes' of the southbridge >
              or  < solderpad at R2B16, frontside, but different one as for Xenon! >
J1F1 -4-  < resistor under the -V- of R4V3, backside, close to the small ADP1823 chip >
J1F1 -5-  < solderpad named FT4P4, on the backside of the HANA chip >

Maybe this helps..

[l_oliveira]

We still need the SMC (System Management Controller) firmware with the patch to send the JTAG commands through the GPIO for this to work. Because Jasper SMC program is different from Xenon, flashing a Xenon image will cause serious problems.

Figuring out where the wires must go is nice, but without the hacked SMC program the hack just won't happen on Jasper or Falcon boards...

[Zakwarrior]

Anyway hope this helped

[bucksie]

thers not enough gpio's on the smc anyways. they had to use one that controls one of the led's on the rol but this is cumbersome hence the reason why they are looking for better gpio's to steal from.

[Badger101]

I tried that image on a keyless board (no dvdrom or anything) with the resistors in place and all I get is constantly flashing center light, no RROD or anything at all. if I unplug the av cable, it responds properly with 4 reds.

Hey Arakon.

How did you manage to sort this problem out?

I have the same issue with one of my boards.

CB 1921
CD 1921
CE 1888
CF(0) 7371
CF(1) 7363

Thanks.

[Arakon]

The problem was simply that I didn't have a VGA cable.. the center flashing came from the lack of dvd rom.

[Badger101]

Thanks.

I had taken out the dvd rom so I had somewhere to sit my programmer.

Stil doesn't work though. The power switch is very unresponsive, and when turned on it will sit there for around 15 secs and then give a 3red rings.

Flashing back to the dash to see if everything is O.K.

Dash works fine. The unresponsive power switch was me being a girl and not pressing it hard enough  .

But it still won't boot into Xell 

This is my second box, the first went well after building a buffer for the programmer (and will be to play with linux etc.)
This one is my games machine which I only wanted the cpu key before updating to the new dash.

Has anyone got any ideas?

[Badger101]

The secondary error code is 0022.

Quote from tmbinc:

'The box switched on, so your SMC code works, but the CPU stopped booting at some point, but without signaling an errorcode (like 010x broken memory etc.)  to the SMC. This is likely a corrupted image, or an image which doesn't work on your hardware. For example, trying to use the hack on an updated box would cause this error, but just flashing half of an image, or a broken image, will do the same.'

I've flashed the image to the nand, read it back and fc'd it. O.K. (used the same image on my other box which works fine).
I've flashed the dash back, and it works fine.
Buzzed all the connections out, there all good.

Could it be the hardware revision? (it's a refurb from around a year ago with different heatsinks)

[gadget78]

<-- snip -->

CB 1921
CD 1921
CE 1888
CF(0) 7371
CF(1) 7363

Thanks.

flash back you original again, so thats its booting fine ...
then get the xenon_1921_hack.rar file from the 'usual places'
and write that (DO NOT erase before hand) .... see if that works

(you have to have a suitable CB version to match what the Fuses are at )

Mick ..

[Badger101]

Thanks gadget78!

Just figured that out when you posted, but why no erase?

Personally I don't see a point in erasing when you are programming the whole nand anyway.

Pls tell me if I'm wrong?

[l_oliveira]

He mean that the new image is only 1.3mb (80 blocks) SO DON'T ERASE YOUR FLASH....


backup only the beginning of your flash with this command:

nandpro lpt: -r16 backup.bin 0 55  (backing up a few blocks more as safety measure)

then flash 1921 hack image:

nandpro lpt: -w16 xenon_1921hack.bin

This does the job.


To restore later on:

nandpro lpt: -w16 backup.bin   (this will overwrite the nand with the 55 blocks you saved earlier replacing  the 0x50 from hack plus refreshing 5)

[duggyuk]

Thanks gadget78!

Just figured that out when you posted, but why no erase?

Personally I don't see a point in erasing when you are programming the whole nand anyway.

Pls tell me if I'm wrong?

If you erase, you lose your config area iirc. you program around 1.3MB (of a total of 17MB) available space.

[Xexman]

Hi,
I am wondering if you can possibly modify an Xex file to decrypt an encrypted audio file on a game?  Or is this something that would take 1 or more clever programs to do after this hack is well distributed?
Thanks

[B1N4RY]

modifying a xex will break the signature, making the xbox rejecting to run

[slasherking823]

Hi,
I am wondering if you can possibly modify an Xex file to decrypt an encrypted audio file on a game?  Or is this something that would take 1 or more clever programs to do after this hack is well distributed?
Thanks

if you want to make a rebooter to run a custom xex then go ahead

[CaNNa]

I imagine the file "$SystemUpdate_Fall08_7371" will hold relevance for some users 

  Yes just dont download the fall 08 from here its actually 8498 and it fuked me up bigg