hacking DVD firmware ?

[Pec]

Wow, thats great. If you can get your 360 to work with these adapters, its much more easier to sniff the cmds sent to the device... Hope it works....

[svenhag]

I just received a couple of PATA-SATA converters. i'm soldering them together right now. Will first test with converters in place, then i'll hookup my LA.

Nice, I really hope that it works.

TheSpecialist:
What firmware did you look at when reversing the xbox1 dvd stuff? I would like to look at it since it might help understand the one that's in the 360 drives.

[TheSpecialist]

Some very interesting info: http://layouts.xbox-scene.com/main/docs/optimize.htm ->

Also, the space near the edge of the disc is not used since Microsoft believes kids would broke that space easily . 

Wow, thank you Microsoft ! Leaving some empty space at the edge of the disc, that's just perfect to place some info we have to remap For example, we could place the challenge response table in that section. Also interesting ->

Space is reserved for both security placeholders and for the video that is played when the game disc is placed in a standard DVD player. Also, the space near the edge of the disc is not used since Microsoft believes kids would broke that space easily . This leaves a total of 6.4 GB (3.2 GB per layer) available on the DVD for a title.

People reported disc sizes > 6.4 GB after unlocking, which probably means that the 'security placeholders' are inside the xbox game partition, which might explain why some software is reporting bad blocks (they're probably part of the 'security placeholders'.

[TheSpecialist]

TheSpecialist:
What firmware did you look at when reversing the xbox1 dvd stuff? I would like to look at it since it might help understand the one that's in the 360 drives.

I extracted most info from reversing the kernel. Takires did the the FW. The information on the kernel is now 100% complete, but there are still some things unknown about the FW routines. He used the Philips. I tried RE-ing the Samsung FW, but I had a hard time understanding this FW. After Takires' post I tried RE-ing the Philips FW (dl it from xbins) and this FW is MUCH easier to understand (in my opinion at least, hehe), I already found the routines that do the state changing in the drive and the handling of the mode sense/mode select. I want to look some more into this soon, to see if I can find the 'response calculation' part, shouldn't be too hard to find hopefully. However, I'm quite busy the next few days, don't have much time for hacking unfortunately ...

[TheSpecialist]

BTW, had anyone already tried getting the 360's drive to work under Linux ?

[thecheekymonkey]

BTW, had anyone already tried getting the 360's drive to work under Linux ?

ive tried with knoppix bootable live linux dvd from a different drive, couldnt get it to see the drive at all, this could be a limitation of knoppix though.

only version of linux i hand to hand to quickly try.

[j005u]

BTW, had anyone already tried getting the 360's drive to work under Linux ?

IVE TRIED UNDER KNOPPIX BOOTABLE LIVE LINUX, ONLY VERSION I HAD TO HAND, NO JOY GETTING IT DETECTED THOUGH.

to what extent did you test it? did it just not show up as a device or did you actually do anything more?
did you dig in proc to see if the device is actually there? maybe it's just not mounted...

you could try connecting the drive inserting something (maybe an original 360 disk) and seeing if there's anything in /dev
ls -al | grep hd
hda and is your first ide device (first master) hdb the second (first slave) etc..

if there's an actually entry (lets say it's the slave on your first sata controller then it'd probably be hdb) then the device is there.
but the device id's may differ depending on any ide devices etc.
basicly type "mount" to see what you have mounted and then look for something that isn't mounted and which could be an ide device (hd**)

i wish i still had linux installed on my desktop. gonna be hard to hook up the 360 dvd drive to my laptop.
maybe i can pull an old 10 gig hdd from my server and install linux on that to mess around with.

.. my other two replies to this thread were deleted, hope this one doesn't suffer the same fate. atleast this isn't pointless

[cja100]

use slax live cd

http://slax.linux-live.org/

http://ftp://ftp.linux.cz/pub/linux/slax/SLAX-5.0.x/slax-5.0.6.iso

then u dont need to install it, just boot from the disk

[k0ldfusi0n]

use slax live cd

http://slax.linux-live.org/

http://ftp://ftp.linux.cz/pub/linux/slax/SLAX-5.0.x/slax-5.0.6.iso

then u dont need to install it, just boot from the disk

 i have said disc on cdr how do i boot this cd. many thanks

*EDIT* i got the cd to boot all it took was to reboot and boot from the cd drive

[amadeus]

Here is a more in depth Linux howto for those who will try their XBox/XBox360 drives on Linux.

For those that are not familiar with Linux Live CDs/distributions, then is Linux installed on a CD. You boot and load Linux directly from the CD without any data is changed on your harddisk. If you like, you can take out the harddisk, and still run Linux from the CD 

So download any Linux Live CD from http://www.frozentech.com/content/livecd.php.

When booted up, open a terminal and type:

Code:

mount

You will now see a list of the hardware drives that are available, where

• /dev/hda* is primary master
• /dev/hdb* is primary slave
• /dev/hdc* is secondary master
• /dev/hdd* is seconary slave

If the XBox drive is not listed there where you expected it to be type:

Code:

ls -l /dev/hd*

If any hd* is listed there which was NOT listen when typed "mount" you need to mount the drive yourself.

Example: Let's say you put the drive on the secondary master and /dev/hdc did not show up when typing the mount command, but /dev/hdc showed up when doing the "ls -l /dev/hd*" command.

Inorder to mount the drive you type:

Code:

mkdir /mnt/xbox
mount -t iso9660 -o loop /dev/hdc /mnt/xbox

The drive is now mounted, and you can access the data from the desktop or by typing:

Code:

cd /mnt/xbox
ls -l

[j005u]

yeah, amadeus did post a friendlier guide of sorts..
there are some things to be noted however:
seeing the drive in /dev does not actually mean that we can mount it. the drive might not respond to default atapi commands. i'd also suggest a problem with the filesystem, but since the video partition is visible in windows this is most likely not the case.

so i guess what i'm trying to say is that if the drive doesn't automount then manually mounting it probably wouldn't work either.
this does not however mean that the drive might not appear under /dev or on some kernel level log. these should be checked.

linux is far more friendlier for debugging stuff like this.

but where to look i'm not certain. proc perhaps?

if you see the device in /dev then try to
"cd /proc/ide/hd*" (where * is the letter you need... namely the unmounted one)
"ls -al" to show files (they're not actually files but meh meh..) in this dir
"cat filename" to see the contents of the file. this might show us some information.

now all we need is someone to make sense of it all. i'm quite a linux noob. :/

but if someone does manage to actually find the drive in their system (unmounted and mounting fails) then pasting what you found in proc could aid us.

i keep forgetting what you needed to cat to see a $#!tload of info of all devices attached to the machine. damnit.

is there no linux nerd here? 

[Dark_Neo]

Can someone with an Xbox 360 drive connected to a Linux machine post their /var/log/messages file? This should contain all the details about IO devices found at boot.

[oddball]

Okey, got the live linux ide, does anyone know if all live Linux distrubutions
support SERIAL ATA. The post's above speak about paralell ata (primary master/slave 
secondary master/slave). Does Linux handel serial Ata the same way ??   

By the way, nice going so far. 

[Pec]

Most likely your linux pc will handle your sata drives as scsi drives, so use /dev/sda or /dev/sdb...

[amadeus]

Okey, got the live linux ide, does anyone know if all live Linux distrubutions
support SERIAL ATA. The post's above speak about paralell ata (primary master/slave 
secondary master/slave). Does Linux handel serial Ata the same way ??   

Yes, any Linux distribution with a Linux kernel 2.6.x supports sata(which all modern distributions have). You can check the kernel version by typing "uname -r".

The proceedure is almost the same as with pata devices, you just have to replace /dev/hd* with /dev/sd*. So:

• /dev/sda is controller A
• /dev/sdb is controller B
• /dev/sdc is controller C
• /dev/sdd is controller D

As a side note, if there are more than one partition on the device/DVD, the partition number must be written aswell. Example:

• /dev/sda1 is the frist physical partition on the disk on sata controller A
• /dev/sda2 is the second physical partition on the disk on sata controller B

It is likely that the live CDs also have hdparm installed, which is a program that can control every(?) possible device behaviour. E.g. power management, buffer flushing, DMA, time outs, eject and much much more!

Here is the parameters hdparm takes:

Code:

hdparm - get/set hard disk parameters - version v5.9

Usage:  hdparm  [options] [device] ..

Options:
 -a   get/set fs readahead
 -A   set drive read-lookahead flag (0/1)
 -b   get/set bus state (0 == off, 1 == on, 2 == tristate)
 -B   set Advanced Power Management setting (1-255)
 -c   get/set IDE 32-bit IO setting
 -C   check IDE power mode status
 -d   get/set using_dma flag
 --direct  use O_DIRECT to bypass page cache for timings
 -D   enable/disable drive defect management
 -E   set cd-rom drive speed
 -f   flush buffer cache for device on exit
 -g   display drive geometry
 -h   display terse usage information
 -i   display drive identification
 -I   detailed/current information directly from drive
 --Istdin  reads identify data from stdin as ASCII hex
 --Istdout writes identify data to stdout as ASCII hex
 -k   get/set keep_settings_over_reset flag (0/1)
 -K   set drive keep_features_over_reset flag (0/1)
 -L   set drive doorlock (0/1) (removable harddisks only)
 -M   get/set acoustic management (0-254, 128: quiet, 254: fast) (EXPERIMENTAL)
 -m   get/set multiple sector count
 -n   get/set ignore-write-errors flag (0/1)
 -p   set PIO mode on IDE interface chipset (0,1,2,3,4,...)
 -P   set drive prefetch count
 -q   change next setting quietly
 -Q   get/set DMA tagged-queuing depth (if supported)
 -r   get/set device  readonly flag (DANGEROUS to set)
 -R   register an IDE interface (DANGEROUS)
 -S   set standby (spindown) timeout
 -t   perform device read timings
 -T   perform cache read timings
 -u   get/set unmaskirq flag (0/1)
 -U   un-register an IDE interface (DANGEROUS)
 -v   defaults; same as -mcudkrag for IDE drives
 -V   display program version and exit immediately
 -w   perform device reset (DANGEROUS)
 -W   set drive write-caching flag (0/1) (DANGEROUS)
 -x   tristate device for hotswap (0/1) (DANGEROUS)
 -X   set IDE xfer mode (DANGEROUS)
 -y   put IDE drive in standby mode
 -Y   put IDE drive to sleep
 -Z   disable Seagate auto-powersaving mode
 -z   re-read partition table

By typing "man hdparm" you get a very detailed manual.

[Victor Von Doom]

Why not give the drive power, but not plug it in until Windows or Linux has fully initialised... Perhaps this would bypass the problems found in the BIOs.

i didnt know you could do that, how would you go about this?!?

How could that possibly work? In that case the BIOS can't detect the drive so it isn't available to the operating system. I haven't tried it yet but I doubt it would work. It would mean that a DVD-ROM drive is hot swapable right? Or are you talking about the xbox360 drive? The unlocker is currently meant to be only used with a xbox1 drive.

what about using a IDE to USB adapter. plugging in after windows is up and running

[cja100]

ok this is what i get when i try mount

oot@slax:~# mount
tmpfs on / type tmpfs (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
/dev/hda1 on /mnt/hda1 type ntfs (rw)
usbfs on /proc/bus/usb type usbfs (rw)
/dev/hdc on /mnt/xbox type iso9660 (ro,loop=/dev/loop9)
/dev/hdc on /mnt/hdc_cdrom type iso9660 (ro)
/dev/hdd on /mnt/hdd_cdrom type udf (ro)

but my 360 drive is on sda

so i tried

root@slax:~# ls -l /dev/sd*
/usr/bin/ls: /dev/sd*: No such file or directory
root@slax:~#

what now?

[svenhag]

Has anyone tried swapping the dvd drive yet? The best would of course be to swap with a drive of the same model and that has the same firmware.

From what I understand the swapping is not supposed to work. Do we know how the 360 detects that a drive has been swapped?

[amadeus]

/dev/hdc on /mnt/xbox type iso9660 (ro,loop=/dev/loop9)

Did you mount this? Is it the xbox1 drive?

root@slax:~# ls -l /dev/sd*
/usr/bin/ls: /dev/sd*: No such file or directory
root@slax:~#

Can you find any mention of the drive name or /dev/sd when typing "dmesg" and use SHIFT + PageUp/PageDown?

If not, try enforcing the device by typing

Code:

mknod /dev/sda b 1 2

If it works, then you should be able to mount the device by

Code:

mkdir /mnt/xboxx
mount -t iso9660 -o loop /dev/sda /mnt/xboxx

or perhaps by

Code:

mkdir /mnt/xboxx
mount /dev/sda /mnt/xboxx

Hopefully you now will be able to see all the files by typing

Code:

ls -l /mnt/xboxx

[amadeus]

I have been wondering; What would happen, if someone carefully cut out the BCA code with a knife on an original XBox360 DVD and glued it on a burned copy of the same game.

If that works; What happens if this BCA code is glued to another burned DVD?