Xellous JTAG Noob Friendlyi
Total Page:16
File Type:pdf, Size:1020Kb
Notes: Although I have personally tested this on a 5 XENON,1 ZEPHYR, AND 2 JASPER use this at your own risk, because I can not guarantee how well you read,or your level a patience, now matter what tutorial you use don't panic and don't rush. Hi-cups are a part of life, and you will run into trouble sooner or later, so PM me(Looouky on X-S). If you run into something that has not be covered in the is document and or if any clarifications are needed then ask before proceeding. BAD BLOCKS: When Flashing through XeLLous it will move the bad blocks for you so you don't have worry about it. The only time it is of any concern is if when reading the first 2MB of your nand you encounter blocks between blocks 0 and 50. Please refer read here. If you encounter any Badblocks between 0x00 - 0x90, you can use this tutorial and my Badblock document to get Xell working, but don't update to XeLLous. Also it will have to be flashed with xbr-flash for linux, it is the only solution at the moment. See this thread for a user with a similar issue and the solution we came up with and read here for my explanation on the issue. What I wrote here is based a lot on the following topics and threads. Actually a lot is plagiarized from there, so thanks go out to those guys. http://forums.xbox-scene.com/index.php?showtopic=698328 http://forums.xbox-scene.com/index.php?showtopic=698328 START HERE: STEP 1: Confirm your dashboard is exploitable The very first thing you need to check, is your xbox kernel and that your XBOX is manufacture before June 18, 2009. · Turn on your xbox and go to console settings. · Go to system info, the kernel version is on top right. If you have kernel 2.0.7371.0 or lower, there is one more check to do, which requires you to read the nand chip with a homemade lpt nand reader or a usb spi flasher. There is no other 100% way of knowing your CB version without reading the nand. To make a Homemade LPT reader follow the following threads and schematics: http://i.imgur.com/U93J1.jpg http://i12.photobucket.com/albums/a246/Grim187/SPI__JTAG_diagram_zephyr-falcon--1.jpg New CAT5 tutorial to be added. To make a USB SPI flasher follow the following threads and schematics: USB SPI Flasher mini how to XBOX360 SPI/USB Flasher by DarkstarTM v0.3 XBOX360 SPI/USB Flasher by threesixtyuser Technical Discussion on USB SPI FLASHER -Find updated Drivers Released January 25, 2010 and PIC software (PICFLASH_v3b_plus2.zip at the time of writing) Requirements: Software : · free60 version of XELL from xbins, file size should be about 1.4 MB and there is one fore each motherboard · XeLLous, at the of writing this it is a 1.0 from xbins · Latest release of XBR, specific for you motherboard from xbins. · Nandpro20b, 64 bit Nandpro USP SPI Driver And 64 Bit Port95 Alternative · FireFox · Hex Workshop Hardware: · A way of reading/writing NAND, LPT or USB SPI. · Router, or Cross Over Cable or Switch · PC with LPT port · XBOX, and XBOX component cables, HDMI doesn't work for installation, composite and vga are untested by me personally. If other cables work please report them here and I will update. Step 2: Read and Backup first 2MB of NAND a. Download nandpro 2.0b. b. If using an x86 make sure port95nt.exe is installed, if it's not, install it (from nandpro20b folder) you might need to reboot. c. If using a 64bit system then follow the directions in this thread to install equivalent 64bit drivers. If using Windows 7 or Vista 64 bit you will need to disable driver signing d. Plug your 360, but don't power it on. e. Plug the lpt cable or your usb spi into PC and XBOX. f. Open a CMD prompt window within the Nandpro folder, if using Windows 7 or Vista run as Administrator: nandpro lpt: -r2 c1.bin or nandpro usb: -r2 c1.bin (From here to the end I will use lpt, so adjust accordingly) g. Read your nand a second time, so type: nandpro lpt: -r2 c2.bin h. Compare your dumps by typing the following command: fc c1.bin c2.bin /b i. If differances where found type the following command: nandpro lpt: -r2 c3.bin j. Then compare your second and thrid dump: fc c2.bin c3.bin /b k. Use the 2 that match, if c2 and c3 match rename c3.bin to c1.bin. Do not proceed whatsoever or under any circumstances if you can not get two matching dumps. Note: No read errors should be encountered with the commands above, if for whatever reason you do please post them on the related thread and ask for assistance before proceeding. If for whatever reason you can't get two matching NAND dumps, then please do as follows: If you're getting no errors in NandPro, but when you compare your dumps they never match, you need to ground the LPT cable.The un-shielded wire on the LPT cable (ie no plastic sleeve) is the ground, or if you've built your own cable from scratch, attach a wire from the metal chassis of the DB-25 connector. Attach this to the metal shielding of the 360 or one of the copper grnd points around the screw holes in the mobo and that should sort the problem. Step 3: Verify your CB is exploitable from 2MB backup: a. Now open up c1.bin in a hex editor (free hex editor) and you should see: © 2004-200X Microsoft Corporation. All rights reserved. X = 5, 6, 7, 8 or 9 (depending on what dash you have/when your console was made). b. Now search in hex for "CB" (without quotes) your looking for the one at or around 8400 in hex (it has to be in caps). c. Copy the 4 hex digits after it and convert it from hex to dec with this Conveter and Like This and verify your CB is exploitable. Exploitable CBs: Xenon: 1921 or lower is Exploitable (exception: 8192 IS EXPLOITABLE) Zephyr: 4558 or lower is Exploitable (exception: 4580 IS EXPLOITABLE this needs falcon version of Free60) Falcon: 5770 or lower is Exploitable Jasper 16mb: 6712 or lower is Exploitable Jasper Arcade (256/512): 6723 or lower is Exploitable Step 4: Installing JTAG The XENON soldering can be found here: http://i.imgur.com/Fdjmi.png For Zephyr, Falcon, Opus & Jasper here: http://pictures.xbox-scene.com/xbox360/free60/diagram.jpg General Falcon Troubleshooting: Review this http://forums.xbox-scene.com/index.php?showtopic=698195. This might be applicable to all XBOX, success has been reported by various people with the various revisions. Step 5: Protecting fuses and JTAG(optional): To protect your CPU fuses it is recommended you do as depicted in the following images: You don't have to remove R6T3, you just bridge the points depicted in the images. If U6T1 is installed http://img121.imageshack.us/img121/7542/r6t3alternate.jpg If U6T2 is installed http://img705.imageshack.us/img705/4139/jasperefuse.jpg For more info refer to the following topic: http://www.xboxhacker.org/index.php?topic=13658.0 The reason for doing this step is if and when Microsoft releases a new kernel, and you decide to accept an update from a game, your fuses will be blown. Blown fuses will eliminate your ability to run XBReboot and unsigned code. Step 6: Injecting XeLLous into Free60 Xell and Flashing. Now with the jtag installed we are going to proceed on flashing and getting XeLLous up and running. a. First you need to download the right version of XELL and the latest release of XELLOUS otherwise this will not work.For XELL you need the free60 versions that are specific to each motherboard and are about 1.4 MB in size, review the table below. You will need one of these files depending on the revision of your XBOX: xenon_1921_hack-20090911.rar This is good for all XENON zephyr_hack_updxell.rar Good for most Zephyr (CB 4580 requires Falcon one) falcon_opus_hack.rar Good for Falcon and Opus, and Zephyr with CB 4580 jasper_6723_hack.rar Good for all 16MB Jaspers jasper_6723_hack_256MB_512MB.rar Good for 256MB and 512MB Jaspers Zephyrs with CB 4580: Success with these XBOXs are hit and miss, please refer to the bottom of the tutorial for troubleshooting tips, and information on the XBR version you require. b. Download the latest release of XeLLous from the usual places, at the time of writing this was version 1.0. c. Extract XeLLous and your version of Free60 Xell. Copy them to your nandpro20b folder. d. Rename your version of Free60 Xell to free60.bin. For example: ren zephyr_hack_updxell.bin free60.bin e. Connect XBOX to LPT port again, and do the following to backup your key vault and configuration blocks. Dump everything multiple times and always compare them using either Hex Workshop or fc from CMD prompt. To dump your keyvault from nand (This is the same for all motherboard versions): nandpro lpt: -r16 kv1.bin 1 1 Dump this a couple times and compare them. To dump your Config from nand: nandpro lpt: -r16 config1.bin 3de 2 Dump this a couple times and compare them. For 256/512 Jaspers its: nandpro lpt: -r256 config1.bin ef7 2 Dump this a couple times and compare them.