Project started: rebooting into an(y) unsigned kernel + hypervisor

[B1N4RY]

Soldering, not welding.

Also arnezami, are you interested in trying to make the first *non-retail* dashboard to run on a retail console, using a decrypted xedk dump?

[arnezami]

Ok. I would like to clear up some things before it gets "out of hand".

The first goal of the rebooter project is to get a full reboot into an unaltered kernel. Until now only a partial reboot into an unaltered kernel has been achieved (using the KK exploit).

In order to get the xbox to fully reboot into an unaltered kernel one has to

(1) figure out where the kernel "hangs" and why
(2) as best as possible recreate the exact state of the xbox (hardware aswell as software wise) just before jumping into the (patched) CB/CD section.

To achieve (1) you need kernel debuggers that are capable of finding out why a kernel doesn't do what it is supposed to do. That means some serious time spending (with IDA) to get acquainted with the workings of the hv/kernel. Also being able to make small patches to the kernel will help figure out what's going on aswell as having some (serial) feeback.

From the results of (1) you need hardware/system programmers that can make sure the problem (hardware or software) is solved by changing the state of the xbox before jumping to CB/CD. Also RE-ing CB and the stuff that is done (to the hardware) upto POST 6C has to be figured out so that the damage that has been done can be reversed/repaired.

(btw: I am currently working on making the rebooter work with the jtag exploit using (only) an elf file. This will take a while.)

In the mean time: does anyone have any (crazy/original) ideas on how to achieve the above? And how to involve more ppl without putting more strain on a few/one? What kind of methods/techniques/tools could be made (and/or used) to get the job done? And how to get more ppl contributing that do not need help every time but can/will actually contribute towards reaching this first goal?

Keep in mind: the rebooter idea is quite simple: just recreate the right state/circumstances and jump to CB/CD. And I expect the (fully working) rebooter to be very small and simple. The catch is in the details though and getting to know them.

If the above is Spanish to you don't even bother.

Regards,

arnezami

[Acton1]

has anybody sorted out the falcon MB yet ?

As i have a MB with no drive key

[fratslop]

has anybody sorted out the falcon MB yet ?

As i have a MB with no drive key

I wasn't aware we were having issues with falcon and the JTAG HACK!!!!
You do realize you dug up the wrong thread right?

[growlley]

Any chance of a playback vector, set the hardware and the software up and hook just before before the call to cb?