Media checks

[MrPhunkee]

So, they only do the backup check on live? Cuz its legal here, so I understand if they ban me from live with backups, no problem, is that the right assumption I got from FL's tests? Is it even legal for them to ban me if i play backups offline?

A friend of mine played a non stelthed game on live after 2 days he still wasnt banned, told him not to but ok, he then played for a couple hours with an original disk and eventually got banned, but why after couple hours? Weird

[Fallchild]

So.. does this mean that even those of us NOT banned are still basically screwed and WILL inevitably get banned even if you dont use our 360's till the next fw update?  I have an Ms28 that is about 2 months old, flashed before going on live.. then flashed before the spring update and im not banned.  I also have an MS25 that i flashed after going on live and have never updated its still running v1 xtreme and its not banned as well.. another thing the ms25 was my original 360 that i had my live account on then i got a new one and gave it to my GF and she got her own new XBL account.. so i dont know if that has anything to do with it.  Another thing is my brother has played halo 3 and gow many hours a day since the bannings occured and hes not banned (also has an ms28 flashed before going on live) so that "heavy users" first idea is shot.. he plays gow every single day 

[giglife]

still running here
SAMSUNG / MS25 / 5.3A / LIVE / NOT BANNED / ONLY DISCS WITH ALL FILES

- video files that are questionable are bad dumps of images
- all video files need to say VAILD if not then throw the image away
- most images on the web are bad with QUESTIONABLE video files
- if you check your IMAGES you will see the reason for your ban

[Cobra.uK]

So.. does this mean that even those of us NOT banned are still basically screwed and WILL inevitably get banned even if you dont use our 360's till the next fw update?  I have an Ms28 that is about 2 months old, flashed before going on live.. then flashed before the spring update and im not banned.  I also have an MS25 that i flashed after going on live and have never updated its still running v1 xtreme and its not banned as well.. another thing the ms25 was my original 360 that i had my live account on then i got a new one and gave it to my GF and she got her own new XBL account.. so i dont know if that has anything to do with it.  Another thing is my brother has played halo 3 and gow many hours a day since the bannings occured and hes not banned (also has an ms28 flashed before going on live) so that "heavy users" first idea is shot.. he plays gow every single day 

Not necessarily, as said if you stop playing Backups on and offline as well you may be in for a chance, but if you keep playing them your more and more likely to go past the "acceptable" stage and you'll be flagged and banned.
Is that right what II'm saying? It's really early in the morning lol.

[Iriez]

still running here
SAMSUNG / MS25 / 5.3A / LIVE / NOT BANNED / ONLY DISCS WITH ALL FILES

- video files that are questionable are bad dumps of images
- all video files need to say VAILD if not then throw the image away
- most images on the web are bad with QUESTIONABLE video files
- if you check your IMAGES you will see the reason for your ban

Yes, im also still not banned, but thats because i only ever play *one* backup, which is stealth. I've played table tennis (which is not stealth) offline, and no ban yet.

[cHaZZ]

Just wondering, as stated in previous post about data possibly being collected and stored on a flash chip and not the hard drive. This is the reason for NOT playing back-ups on or off line. Then my question is, just how big is this flash chip and would it be possible to overwrite saved collected data of all loaded back-ups by playing/loading all original games of the same back ups that were loaded during this time. Or just playing nothing but originals to the point where you end up flooding the flash chip with all collected data of original game info. Therefore preventing any possibilities of being banned because there would be no back up data to report back to MS.

[elocnala]

Ok Going back to your original statement...I use xbox backup creator 2.3 (think 2.4 is out correct me if I'm wrong). Is this still the correct way to back up your games or should I start using something else?

[didineedthis]

i am banned ,and the only two games i have played for ages are.

gears of war witch has all 3 boxes ticked in xdvd mulleter

pirates of the carribbean only two boxes ticked

video partition present
 
security sectors present

stealth sectors NOT present

if this helps.

[Fallchild]

if the DMI and stuff isnt right.. whats the point of even using the stealth games.. you still have the same chance to get banned.   My bro has played GOW and crackdown/halo 3 beta only since the bans. .and i think the crackdown-rant wasnt even stealth but i dont remember exactly

[regeli]

Fallchild: Crackdown (RANT release) wasn't stealth patched, but they added a fix for it I remember.

[bourke]

Looks like they may be able to detect ALL backups!

I'm willing to sacrifice two virgin consoles and a new Live account to beta test new stealth firmwares lads.  Just give the word.

Cheers,
Bourkie

[Spies]

MS might have added a trigger for these Challenges, any response below (for example) 50-100ms would raise a flag. As it is impossible to seek this fast for the DVD-ROM drive.
Originals will pass this test, but currently all Drive firmwares will send the response immediately (as it is stored in a table, already loaded from the SS) and fail this test.

Bad lasers will not make any difference, as the seek time only increases not decreases.

If I understand this correctly, you are saying that even if originals are used on a drive with altered firmware, it will still do the c/r too quickly and potentially trigger MS's detection systems? Is there anything to indicate that the firmware is being read from the drive at bootup?

[FuzzyLogic]

MS might have added a trigger for these Challenges, any response below (for example) 50-100ms would raise a flag. As it is impossible to seek this fast for the DVD-ROM drive.
Originals will pass this test, but currently all Drive firmwares will send the response immediately (as it is stored in a table, already loaded from the SS) and fail this test.

Bad lasers will not make any difference, as the seek time only increases not decreases.

If I understand this correctly, you are saying that even if originals are used on a drive with altered firmware, it will still do the c/r too quickly and potentially trigger MS's detection systems? Is there anything to indicate that the firmware is being read from the drive at bootup?

No only for backups, original games booting from an altered firmware are not affected.
The firmware of the drive is not read, nor the checksum is read. At the moment these debug commands are not sent to the drive.

[FOOLVER]

still running here
SAMSUNG / MS25 / 5.3A / LIVE / NOT BANNED / ONLY DISCS WITH ALL FILES

- video files that are questionable are bad dumps of images
- all video files need to say VAILD if not then throw the image away
- most images on the web are bad with QUESTIONABLE video files
- if you check your IMAGES you will see the reason for your ban

Let's try xboxbackupcreator (build 0230) v2.5, in all my (sh-d162c with latest kreon) backups (from original games, not ones downloaded) it return always the video as questionable.

[delain]

I just logged the DMI/PFI requests.

Fuzzy, what was the difference between the two drive sessions that you posted in the two posts? Was it only DOA4 specifically that triggered the checks? Or was it only when it froze and on next reinsert did it check?

[quicksilv]

i've been reading up on how fw + backup-images work and hope someone can address some of my questions:
- video partition layer1 -> do any of the backup creation tools include layer1 or only layer0 atm?
  or are we not able to create 100% backups right now?
- bitsetting: DVD-ROM is suggested, but xtreme images with DVD+R DL boot just fine.
  Do both hitachi+samsung firmware report DVD-ROM back if queried? (and considering code upload with the hitachi this will be a problem, so the hacked fw should just reject these discs all together)
- physical properties of a disc ("pressed" as opposed to "ritek", etc), does the hitachi+samsung
  firmware return proper data?
- if an original disc is inserted does a modded fw act like an original fw? meaning does it get the desired sectors/requests using the nonhacked methods? just wondering if originals are safe offline
- "Most of my games have this on 1F1B1C or 1F1B1E instead - but all of them, including one that has zeroes there, passes the Stealth check in Xbox Backup Creator 2.5 when looking at the isos"
i am not liking this very much, shouldn't xbc fail here? i'll be checking my backups with all 4 methods just to be sure (xbox backup creator, xdvdmulleter, schtrom360extract and dvdinfo manually)
- spoofing a drive: when an ms25 is spoofed as ms28 wouldn't it be detected as the firmware now has firmguard which it normally woulnd't have (i'm not sure about this, don't have a sammy)


Fuzzylogic: when you checked doa4 were you signed in or had the lan cable connected? do the kernel itself run any checks offline?

[Badger101]

 Does anyone know if the PFI/DMI were implemented with the Spring update, or has it been around for some time?
Just for people (like myself) who havn't updated yet.
(If I do update it would be via a cached update on another hdd, not via Live).
 

[FuzzyLogic]

I just logged the DMI/PFI requests.

Fuzzy, what was the difference between the two drive sessions that you posted in the two posts? Was it only DOA4 specifically that triggered the checks? Or was it only when it froze and on next reinsert did it check?

It could have been coincedence, but after DOA4 froze, it started requesting the PFI/DMI/Capacity and drive inquiry.
And now, everytime i log in to live, it requests this data after a couple of seconds.

When i go back to the dashboard, all info is requested again.
I tried a silver account, same thing.

It seems the kernel currently doesn't request these checks offline. Although they might check for other stuff, like timing differences in the C-R sequence, which can not be detected on the drive side.

[e5frog]

I don't know how the layout of a Xbox360 disc looks, but if kernel reads 0x8000 (32kB) bytes from PFI/DMI and it's really just 0x0800 (2kB) bytes long for real (and on the backup), what are the rest 0x7800 (30kB) on an original disc?

If that data is already in the backup there needs to be a jump in the firmware after sending the first 0x0800 byte to the correct place of the backup to not send the wrong data. Or if it's a fixed value - answer with that. Or else the relocated SS and PFI needs to be relocated elsewhere perhaps the the end of the disc - but that would result in longer response time.

If it can't be faked, maybe it needs a chip solution, the SS and PFI are stored at the end of the backup image - then backed away in a ram when backup is inserted and sent upon request from the ram in appropriate speed.

I guess M$ will keep this up with further updates, they can read all this as well and probably knows exactly what i going on. Trying to stay on XBL is a cat and mouse game, as many people has said before me. Playing offline is already sorted out I guess, no more work needed there - unless kernel shuts down or something like that when detecting a large enough amount of copies...


But it's fun - and interesting!

;-)

Great work FuzzyLogic - is there a tutorial on how you log the data? Perhaps more of us can help?



Perhaps it starts checking after an error? Forever or for a certain amount of time.

[Arakon]

This explains why I am not banned.. once the banning started (a day after halo 3 beta), I never started another game with the flashed FW, although I had a backup in the drive (but not launched). then I flashed back to original FW. so far I am still unbanned.