Utter Chaos' Notes

My thougths on the recent XBL-banning (Part 1)

2007-05-21T10:08:00.000-07:00

Theory 1: The FW-change theory
This theory describes the possibility MS has to checksum the Firmware of the DVD-drive. At a certain moment the drives firmware gets checksummed and the value will be stored either locally or remotely. At a later moment (during each bootup and/or logging into XBL) the FW gets checksummed again. If the stored value is different from the newly obtained checksum the drives FW has been altered which results in a ban.

Possibility: VERY UNLIKELY

Although this theory is quite popular I believe it's a very unlikely scenario. A Firmware change can have other reasons than just modding a drive. A large number of drives are replaced during repair centers every day around the world with other brands/types (and therefore different chekcsums). I also like to add the fact I own a single box using different drives/firmwares (Hitachi/Samsung) and have not been banned (yet). Lastly: MS wants to block the use of backups on XBL, logging differences in FW-checksums is a long shot to accomplish such a thing. Just think of all the modders who flashed the DVD-firmware out of the box, there would be no changes recorded so every backup should still be playable online without the risk of getting banned!

Theory 2: Monitoring backup-usage over a period of time
This theory describes the possibility MS has to detect the use of backups and storing such information localy. When the user logs into XBL the locally stored information about backup-usage is sent to MS along with the unique console-id. Once the console-id is flagged as capable of running backups it will be added to the ban-list.

Possibility: UNLIKELY

I believe this is also an unlikely scenario. Keep in mind the statement MS has made on the subject: MS wants to block the use of backups on XBL. However when this theory would be fact it would mean people can get banned for XBL while they have never been on XBL using a backup. This looks like incosistent since MS would ban people for a mistake they could possibly make in the future but haven't made so far! I'd like to add my personal experience also: I've been using a number of backups offline and originals online. So far I have not been banned (yet).

Theory 3: Monitoring backup-usage on/logged into XBL
This theory describes the possibility MS has to detect the usage of backups once logged onto XBL. Once backup-usage has been confirmed when logged into XBL the unique console-id gets flagged and sent to MS to add to the BAN-list.

Possibility: LIKELY

I believe this is scenario is the most plausible as it does exactly what MS has in mind: Stop the usage of backups on XBL. If this theory holds up the main question remains when did MS start collecting data on backup-usage. Despite the "Stealth" Firmware and images there are a whole bunch of (documented) ways to differentiate an original from a backup. Since the first news of the bannings I've only used originals when logged in to XBL on an unaltered drive. So for I have not been banned (yet). Since it's unclear when the logging started (if all) my console-id could be flagged already and a ban could become reality in one of the following "ban-batches".

To wrap things up:
- Respect for the nicely executed action from MS. Especially the fact bannings have been done "randomly" kept us in the dark (and probably still does).
- Even if you're not banned NOW is no guarantee it won't happen in the (near) future, this is especially true if you're already flagged but the hammer has yet to fall!

And finally:
This is/was all just a game.. so don't whine when you're banned: YOU WIN SOME... YOU LOSE SOME! :)

Useful links:
http://www.majornelson.com/archive/2007/05/17/xbox-live-security-5-17.aspx
http://gamerscoreblog.com/team/archive/2007/05/17/545414.aspx
http://www.xboxhacker.net/index.php?topic=7566.0

-UC-

(As you may have guessed English is not my native language, sorry for all the mistakes!)

External drive experiences

2006-08-01T02:13:00.000-07:00

I took quite some time to play around with the external 360-drive hooked up to my console. I am running an unmodified original FW on the Hitachi drive. I took the PGR3 disc from the shelf after it's been collecting dust the last few months. And I gotta say: I love it again :)

Never had any problems playing until I downloaded the Style Pack and the Turbo Pack for PGR3. The problems started when I was playing one of the new type of games: "Cat and Mouse". The race would startup fine but after almost one round of driving the 360 would freeze and then reboot. I had the exact same thing with the "Team Cone Challenge" game.

All the other games (on- and offline), cars, tracks, challenges work fine using the external drive.

Since I wanted to get to the bottom of this I deceided it was time to hook up the drive directly to the console. The only difference in this situation is the power is coming from the 360-motherboard. I could play "Cat and Mouse" and "Team Cone Challenge" without a problem this way. Makes me really confused!

Any suggestions/comments would be welcome :)

External 360 drive finished

2006-07-20T23:41:00.000-07:00

After the thoughts I had earlier I deceided to build the external DVD-drive for the 360. However I didn't use the case I was planning on earlier. Since I couldn't use much of the components and had to cut the legs of the drive to fit in the housing I deceided to build the thing from scratch. So here's the result:

As you can see from the picture above the drive get's its own power. This means the drive can be hooked up to a notebook without the need to get power from the 360. In that case you have to use an USB<->SATA cable as discussed earlier.

Near the power-socket is the on/off switch. At the front you can see a red led (not burning in the picture) to indicate the on/off-state of the drive. Next to the led is the eject-switch. Here's another picture, this time from the front:

And yet antoher one from the top, this time with open drive:

Note the drive itself is totally unaltered. Meaning I can just unscrew it from the board it is placed on right now and put it back in the 360. If you're wondering how I would hook this up to a 360 please read my first post on that subject. Also note I'm using a USB<->SATA adapter to hook the drive up to my PC.

The power-adapter board is heavily based on the "PC power supply to 360 DVD power connector adapter" as described by Kevin East aka SeventhSon.

Another project finished :)

First look into the external 360 DVD-drive

2006-07-07T00:21:00.000-07:00

After my succesful attempt to use the Hitachi drive with my 360 it wasn't "married" to before I did my first careful step in creating an external 360 dvd-drive.

I'm planning on using the USB-casing I currently use for my DVD-writer. This casing makes it possible to transform an internal device into an external device by providing a power source and incorporating a IDE <-> USB adapter. This is what the casing looks like with the current DVD-writer installed:

Time to look into the 360 DVD-drive vs a "normal" DVD-drive to compare measures:

The 360 DVD-drive is higher due to the legs it's using

The 360 drive is a little less deep

Currently I'm facing these challenges:

Build a power-adapter for the 360 drive and incorporate this in the casing;
Build a custom-eject button since the button is not on the 360-drive itself;
Make a decision to either cut the legs from the 360 drive to make it fit in the casing or don't cut the legs and forget about closing the casing;
Make a hole or (use an existing one) to lead the SATA-cable from the back of the 360 drive to the outside of the casing.

Basically all I wil use from the casing is the casing itself, the power Adapter inside of the casing is of no good for this project and neither is the IDE <> USB adapter.

To be continued (that is if I go through with it)

Running the Hitachi in another 360

2006-07-04T01:07:00.000-07:00

After restoring my Hitachi to the original FW-state I had a crazy thought of building an external DVD-drive to use with my other 360. My idea is to enclose the Hitachi drive in an external USB-casing so I can easily hook it ip to either my PC (USB) or my 360 (SATA). In case you´re wondering how I would hook this up to my 360 without having to open it all the time read my earlier posting about the SATA-extension I made.

However as you possibly know you can´t just use the DVD-drive from one 360 in another 360 because each 360 drives firmware has it´s own unique 16-bytes key embedded. So to get the Hitachi-drive running on another machine I had to do at least the following:

Dump the unique 16-byte key from my other 360´s Samung-drive;
Flash the Hitachi with the obtained key from the Samsung.

Step 1 - Getting the key from the Samsung-drive
I used my earlier build bootable USB stick to boot my PC using DOS. I then used mtkflash to dump the FW of my Samsung-drive:

mtkflash r /m samsung.bin

After rebooting my PC to windows I used Keydrive Xtractor 1.5 to grab the 16-byte key from the FW like this:

Please Note: DVD Key shown is faka data

Step 2 - Preparing the FW-bin from the Hitachi
After copying the DVD-Key to the clipboard I opened the original FW from my Hitachi (orig.bin) and pasted the DVD-Key from the clipboard to the DVD-Key field. I then saved the firmware as "hits.bin".

As you probably know by now the Hitachi-FW has to be encrypted before flashing. Using a tool made by Loser named FirmCrypt I created a "ready to flash FW" using the following command:

firmcrypt e hits.bin hitse.bin

So there it is: the encrypted firmware hitse.bin ready to get flashed.

Step 3 - Flashing the Hitachi with the new key
After putting my Hitachi drive in ModeB using the SlaxVM solution I flashed the sector containing the drives key from windows XP (i being the drive-letter):

flashsec47_win i hitse.bin 90004000 1000

Please note there´s no need to flash the Master Checksum since the key is in an area of the FW not included in the checksum-calculation.

Step 4 - Attach the Hitachi to the new 360
After plugging in the power and the sata-cable (which leads to the motherboard of the new 360) and inserting COD2 it was time to fire up the new 360. And as expected: it works like a charm :)

So there it is: My Hitachi drive works in a 360 it wasn´t "married" to before. At least this part won´t stop me from building my external DVD-drive! Still not sure if I go through with it.

Restoring the Hitachi FW: The 4 bytes difference

2006-07-03T00:25:00.000-07:00

After playing around a bit with the Xtreme FW for the Hitachi 47D in my 360 I deceided to flash the FW back to it's original state. After using the SlaxVM-solution to put the drive in ModeB I used the restore.bat included with the Xtreme-package. No problems during the flashing-process, so I thought I was good to go.

I deceided to dump the new flashed FW to compare it against the FW-dump made before I flashed the Xtreme-FW. I didn't expect to find any differences: however there were! Using the fc (filecompare) command I found out 4 bytes were different between the two dumps:

0003E7FC: B6 00 (B6 = "original", 00 = "restored")
0003E7FD: 1C 00
0003E7FE: 68 00
0003E7FF: 33 00

Hmmm, I wanted to restore the FW to the original-state, not to the "almost" original-state. A quick look at the restore.bat file included in the Xtreme FW-package shows me the reason for not flashing back to the entire original situation. The very first flash-command was made a remark:

rem @echo Flashing sector 9003e000 (Master Checksum)...

Uncommenting the above line by removing the "rem" would be the solution to flash back the entire original FW. However the question remains (at least for me) why the 4 byte difference, and more: what do these 4 bytes do/mean?

So I went over to xboxhacker.net to see if my questions had been answered before. And as expected: They were :) Thanks to Garyopa at the xboxhacker BBS I learned what the 4 bytes indicated as "Master Checksum" were and why they were not flashed back:

"The reason the Master Checksum is not flashed back, is because incase one of the other restore flashes failed, or the backup was corrupt or a byte got changed somehow, and the user turned the power off, before checking all the flashes were OK, and the backup was 100% correct, the drive would be a BRICKed drive if the checksum does not match. "

My suggestion is for those of you who want to flash back the entire FW to alter the restore.bat from the Xtreme-package and move the line "@echo Flashing sector 9003e000 (Master Checksum)" to the end of the flashing process. Obviously don't forget to remove the "rem" at the begin of the line. By moving the flash of the "Master Checksum" to the end of the bat-file the checksum will not be set when one of the earlier sector flashes fail (and the batch-file gets aborted by the user!).

The Slax Live-CD in a VM Summary

2006-07-02T07:48:00.000-07:00

Here's my final(?) post on the Slax Live-CD running within a Virtual Machine to enable access to the hitachi's drive firmware using a USB<-> SATA Cable.

To reproduce my findings you need these three things:

An USB<->SATA cable. I used this one;
The free VMWare Player (link);
The Live-CD iso including the VMWare Virtual Disk and VMWare Configuration File (link).

Unzip the live-cd package to a location of choice and open the slax.vmx file using VMWare Player. This will fire up the Slax Live-CD within the player. Once fired up login using "root" for user and "toor" for password.

After logging in use the modprobe-command:
modprobe usb-storage fix_inq_vendor_id=0x152d fix_inq_prod_id=0x2338
Please Note: vendor_id and prod_id will differ if you're using another device.

Use dmesg to find out if and where your device is located (mine was at /dev/sda). Use the modeb command to get the Hitachi-drive in modeb:
modeb /dev/sda

That's it: You can either release the USB device from here and continue your work in Windows (without a need to reboot) or you can just use the linux-environment within the VMWare player.

Running the Virtual Machine with Live-CD

2006-07-01T11:16:00.000-07:00

First of all: Please don't attach the USB<->SATA cable to the PC yet. In this how-to I will clearly state when to connect the cable to the USB-port.

After installing the free VMWare Player (link) it's as easy as selecting the slax.vmx configuration file to get the Live-CD up and running within the VMWare Player:

When the login-screen is shown login as "root" with password "toor" as shown on screen:

The "dmesg" command is an important aid in the quest to get it all working so fire up this command after succesful login:

The output shown by dmesg (please note there is no reference to a USB Mass Storage driver):

Here comes the important part :) Enter the command as shown below. Be aware the values after the parameters "fix_inq_vendor_id" and "fix_inq_prod_id" may differ from your specific device! If you're not sure about yours use the lsusb command to find out.

Fire up the dmesg command once again. If all went fine the last section states the "USB Mass Storage support registered."

Now it's time to startup your 360-drive and after you've done so connect the USB-cable to your PC. After a few seconds the device will be picked up by VM-Player (mine shows up in the title-bar of VM Player as "Anonymous USB-device (Vendor:152d Product:2338)". Also: for the moment please be sure to have a disc in the 360-drive (I used a movie DVD).

When issueing the dmesg command again you should read someting in the end like "Attached scsi removable disk sda". This means the 360-drive is at /dev/sda:

Since you know the device the 360 has been hooked up by now you can play around with the 360 Hitachi drive, including reading/writing and dumping the firmware. Be adviced: it's always a good idea to remove a disc from the drive before attempting to do anything firmware-related.

If your goal is to get the drive recognized by windows just fire up the modeb command along with the device as a single parameter:

If you still have the disc in the drive when issueing the modeb command you will hear the drive spin loudly without slowing down. To get the drive picked up by Windows just "release" the device from the VMWare player by clicking on the device in the titlebar. Windows will pick it up right away and assign a drive-letter to the drive.

Well that's about it! I managed to use the Hitachi 360 drive through a SATA<->USB cable when using the Slax Live ISO within a Virtual Machine. I will write a summary later and post the summary here and over at the XboxHacker BBS.

Thanks: MacDennis, Probutus and SeventhSon for your ideas, thoughts and tools!

Creating the needed files for VMWare Player

2006-07-01T07:20:00.000-07:00

Using Qemu it's possible to create a VMWare Virtual Disk File. Just add a simple .vmx configuration file and the Slax-ISO is ready to be booted within a Virtual Machine using the free VM-Player. No need to use VMWare Workstation to setup this VM :)

These are the tools I used in creating and testing the Virtual Machine:

QEmu (link)
VMWare Player (link)

Building the VM files
After installing QEmu I build a virtual disk file using the following command at the DOS-commandline:
qemu-img.exe create -f vmdk slax.vmdk 100M

VMWare Player needs a configuration file in order to work. This is a simple text-file which can be created by the text-editor of choice. I created and saved as slax.vmx the following file:

config.version = "8"
virtualHW.version = "3"
scsi0.present = "TRUE"
memsize = "256"
MemAllowAutoScaleDown = "FALSE"
ide0:0.present = "TRUE"
ide0:0.fileName = "slax.vmdk"
ide1:0.present = "TRUE"
ide1:0.fileName = "live-cd.iso"
ide1:0.deviceType = "cdrom-image"
floppy0.present = "FALSE"
ethernet0.present = "TRUE"
usb.present = "TRUE"
displayName = "slax"
guestOS = "otherlinux"
nvram = "slax.nvram"

Put them all together
To get the VM up and running copy the three essential files to a single directory:

livd-cd.iso (the Slax Live-CD iso-image);
slax.vmdk (the VMWare virtual disk file);
slax.vmx (the VMWare configuration file).

And that's where step 2 ends. Everything is ready for the final step: Running the Live-CD in the VMWare Player.

Building the new Slax-ISO

2006-07-01T05:32:00.000-07:00

Building the new Slax-ISO
Since the original slax-iso is lacking the 360_dvd_base_v2 package which contains all the tools for FW reading and writing and the tool to set the hitachi-drive in ModeB my goal is to build a new ISO containing this package. Credit where credit is due: The Slax-ISO is the result of hard work by Probutus, the 360_dvd_base_v2 package contains tools made by SeventhSon.

Needed:

The Original ISO (link)
The 360_dvd_base_v2.mo package (link)
UltraISO (link)

I used UltraISO to add the 360_dvd_base_v2.mo package to the /modules directory inside of the original ISO. Since the free trial-version can be used with images up to 300 megs it's a free alternative which gets the job done fast and without the need for unpacking and/or burning the original ISO. After the adding of the package I saved the ISO to get my new ISO with the necessary package included.

Part 1 has been finished: The new ISO is ready. On to part 2: Creating the necessary files to boot the ISO within VMware Player!

Accessing the Hitachi-drive the fast way

2006-07-01T05:01:00.000-07:00

After reading (and applying) the excellent thread over on xboxhacker.net started by MacDennis I wondered if it would be possible to combine the best of two worlds: The VM-approach of MacDennis and the Live-CD approach of Probutus when using a USB<->SATA cable to connect the drive. As of five minutes ago I can confirm it's possible :)

The Pro's of this method:

Get your Hitachi-drive in ModeB and then release it to Windows *without* the need of rebooting;
No need for a dedicated Linux-machine. Use a VM-solution and the free VM-Player;
No need to burn a live-CD. Just use the ISO-image as a source to boot inside of the VM;
This is a safe solution! No need for the "cross-wire trick", the #1 DVD-drive bricker!;
Easy to setup using free-software, no need for linux kernel-compiling.

I will start documenting my findings and a how-to shortly. I made a new Slax-ISO and contacted Probutus to see if it's okay to distribute it. Anyhow, I will document the process of updating the new Slax-ISO to the old one.

Tired of opening my 360

2006-06-29T07:38:00.000-07:00

Since opening the Xbox 360 is not the easiest thing to do I deceided to a little modification to my console today. My main goal was to be able to use the 360 normally and add the feature to connect it to my PC without opening the case. I did all of this in three easy steps:

Step 1: Looking for the right tool
One big advantage of having a lot of stuff flying around is the fact that you sometimes find something usable :) I was going through the stuff Asus was kind enough to provide me with when I bought the A8N32-SLI motherboard a few months ago. One of the unused items I found was a bracket intended for installing two external sata-devices. Just what I needed! On the "inside" of the adapter I inserted two SATA-cables, one to go to the SATA-connector on the motherboard of the 360 and one to go to the DVD-drive in the 360. Finally I used the tiny original SATA-cable from the 360 to connect the two connectors together on the front-side of the adapter (and thus building a "pass-through". A picture is word a thousand words (sorry English in not my native language):

Step 2: Opening up the 360 for the last(?) time
To be able to remove the existing tiny SATA-cable from the Xbox 360 and to connect the two new ones leading to the SATA-bracket I had to open my box once again. I first removed the tiny SATA-cable which connects the Xbox drive to the motherboard. After that I could easily plug in one of the longer (red) SATA-Cables in the motherboard and the other one into the DVD-drive. The last thing for me to do was to re-use the tiny cable from the 360 to create a loop-through (as shown in the picture above).

It's allways a good idea to see if things work you expected before closing the case again. So that's what I did: Plugged in the cables and fed a game to the 360-drive. It all worked like expected. On to closing the case!

Step 3: Closing it all up again
Since I had to bring two new SATA cable to the outside of the 360 closing the box wasn't as easy as just putting all the pieces together again. I deceided to let the two new cables stick out of the box on the HDD-side. To do so I only had to fold back a small piece of the inside metal-casing to let the cables out. Once done it was as simple as putting the box back together. It took me a few tries on the outside to connect the HDD once again. The finished result:

Two red SATA-cables brought to the outside

My intended goals for this modification
I did this modification to be a able to do the following things to my 360 and/or 360 drive without the need to open the 360 case:

Hook up the 360 DVD-drive to my PC;
Hook up another DVD-drive to my 360;
Disable the 360 DVD-drive completely.