DARKFiB3R

FiB3R’s Glitch Guide

stainedfuture — Sun, 15 Jan 2012 13:20:36 +0000

Guide currently based on Dashbaord 2.0.14699.0

Required Hardware

Exploitable Xbox 360 (infographic)
NAND-X (with v3 code)
Device to update the NAND-X to v3 if needed (info)
NAND-X to CoolRunner JTAG Cable
TX CoolRunner
USB key (Formatted to FAT32)
Case opening tools
Fine tip soldering iron
Solder
Flux

Recommended

Tweezers
Wire cutters
Magnifying Glass
Bright Light/torch/lamp
Heat resistant tape/Hot Glue
Sticky back plastic
Cardboard tube
Safety scissors
Pritt-Stick
Glitter
A responsible adult

Required Applications/Files

NAND-X drivers (included with NandPro v2.0d / v3.0a)
NandPro v3.0a (Download)
DLPortIO (Download)
FlashMagic (for updating the NAND-X if needed) (Download)
Xecuter CoolRunner XSVF/JED Timing Files (Download)
360 Multi Builder (Download)
Rawflash v4 or later (Download)
360 flash dump tool 0.97 (Download)
Official 2.0.14699.0 dashboard update (Download)
(scroll down on those pages for the real links)

Prepare your EnvironmentInstall the NAND-X drivers (info)Update your NAND-X to v3 if needed (info)Create a new folder on your C: drive called nandpro3Extract the following files/folder to C:\nandpro3

Nandpro30.rar
DLPortIO.rar
coolrunner_xsvf_jed.rar
360_Multi_Builder_vX.X.rar
360_flash_tool_v0.97.rar
2.0.XXXXX.0_USB.zip

(Just so I don’t have to keep editing this guide so much, rename 360_Multi_Bulider_vX.X to 360_Multi_Builder)

Replace xenon.elf in 360_Multi_Builder\Data with the one from Rawflash v4 or later.

**Note** Only the .xsvf files from coolrunner_xsvf_jed.rar are required for the TX Coolrunner. The .jed files are for other devices.

Dump/Read the NANDBefore dumping your NAND, it’s probably a good idea to update your xbox to the latest dashboard version. You can do this via Xbox Live, USB key or CD. This is not needed, but it’s probably quicker to get it out of the way now, and will save you and extra step at the end of the guide.DO NOTupdate to any higher version than this guide is based on, just in case MS release and update that can disable this hack. Apparently, that isn’t something they can actually do with the Reset Glitch Hack (unlike the JTAG hack) But you never know.So, with that out of the way, on to the good stuff…Take the console apart and remove the motherboard from the metal cage (info)Connect your NAND-X to the 360 motherboard by soldering your QSB’s, Pin Headers, or direct cable connections to the correct points on your motherboard.NAND-X Install Guides

Once you have your NAND-X wires installed, connect it to your PC via the USB cable…

*Note* The pins you see connected to the motherboard in the above picture, are the “legs” cut from resistors, soldered to the cables and covered in heat-shrink tubing. For me personally, I find this the best method for doing multiple installs. Clean, fast, resilient and should last forever.

Make sure that the mains power is connected to the xbox, but do not turn the xbox on.
(while the power is connected, the xbox is in Standby mode, giving power to various components. This is needed in order to be able to communicate with the NAND)

Now, on your computer, open a command prompt and navigate to…

C:\nandpro3

Do that by hitting the start button, typing cmd and hitting Enter. Then type cd \nandpro3 and hit Enter.

Or.., hold the Shift key, and Right Click on a blank space inside the nandpro3 folder, then click “Open Command window here“

Now type (or Copy and Paste) the following commands, into the command window (same command for Phats or Slims, see Note)
This will dump/read your entire 16MB NAND twice, and save the dumps/files in the nandpro3 folder.

nandpro usb: -r16 nanddump.bin
nandpro usb: -r16 nanddump2.bin

*Note: for BB (Big Block) Jaspers (Jaspers with internal memory units of 256MB or 512MB) Change the commands to…

nandpro usb: -r64 nanddump.bin
nandpro usb: -r64 nanddump2.bin

(The full 256MB or 512MB is not required)

Quote:

**PRO TIP**Once nandpro has found the USB interface device (the NAND-X) it will tell you the size of the NAND/internal memoryFlash Config: 00023010 = 16MB
Flash Config: 008A3020 = 256MB
Flash Config: 00AA3020 = 512MB

Now compare dumps by typing…

fc /b nanddump.bin nanddump2.bin

You should see…

FC: no differences found

If there are differences, check your soldering and try again until you have matching dumps.

Quote:

**PRO TIP**If you copy and paste the following 4 lines (including the blank line at the end), nandpro will perform all 3 operations automatically…nandpro usb: -r16 nanddump.bin
nandpro usb: -r16 nanddump2.bin
fc /b nanddump.bin nanddump2.binornandpro usb: -r64 nanddump.bin
nandpro usb: -r64 nanddump2.bin
fc /b nanddump.bin nanddump2.bin

Bad Blocks?If bad blockswere found while dumping your NAND…Open one of your NAND dumps in 360 flash dump tool 0.97Don’t worry if it says BADKV all over the place, this is normal because you haven’t entered the CPU Keyyet. (We will get to that later).Check for a bad blocks tab, next to the file system tab.If there is no bad blocks tab, you have no bad blocks.

If there IS a bad blocks tab, click on the tab and verify that it looks like this:

Note: Bad Block ID 0×0349 [Offset: 0x00D8D200]

-> Block ID 0×0349 found @ 0x3FD [Offset: 01073A00]

You should see the above 2 lines of text, for each bad block you have.

The numbers may be different of course, depending on which blocks are bad, but the point is, for each bad block, you should see that the block was found @ another block.

This means that you did have bad blocks, but they have been corrected by the NANDs error correction, so they are legit bad blocks, and not just read errors due to dodgy soldering.

Example of 3 corrected bad blocks…

If the errors are at block 0×050 or above, no further action needs to be taken, because…

“Many user reports indicate that using Xell-Reloaded/Rawflash v3 to flash the Dashboard image, has a much better result over flashing with hardware flashers. This is because it helps to auto-remap the bad blocks in case they exist.”

As we will be booting into Xell-Reloaded, which will use Rawflash v3 to flash the NAND later on, the bad blocks will be auto remapped for us.

But…

If you see:
Note: Bad Block ID 0×0349 [Offset: 0x00D8D200]

But NO found @ location for the block, that means this bad block was the result of a read error with the NAND reader. Check your soldering and try again.

If you have Bad Blocks at 0×050 or below, check out Martin C’s guide on how to manually remap them. (Info)

If all checks out, you now have 2 good NAND dumps.

KEEP THEM SAFE. FOREVER.

Create your XeLL/ECC Glitch imageCopy your nanddump.bin file from the nandpro3folder, to …360_Multi_Builder\Data\my360Launch Run.exe from the 360_Multi_BuilderfolderPress the number corresponding to your motherboard revision, and hit EnterYou will get a warning saying The file “cpukey.txt” is missing.

This is normal as we haven’t created it yet. Press any key to continue.

Sit back and watch 360 Multi Bulider do it’s stuff…

Press any key to close 360 Mulit Builder

Your Image_00000000.ecc file has now been created in 360_Multi_Builder\Data

Flash the Reset Glitch Hack v1.1 .ecc file to the NANDMove the image_000000000.ecc file into the nandpro3folderEnter the following command for slim consoles and non BB Phatsnandpro usb: +w16 image_00000000.eccOr for BB Jaspers…nandpro usb: +w64 image_00000000.ecc*Note: it must be +w16 NOT -w16

Programming the TX CoolRunnerDisconnect the cables from the NAND-X (not sure if that’s actually needed, but probably for the best) (the wires can stay soldered for now)Make sure the switch on the CoolRunner is set to PRG(program)Connect the CoolRunner to your NAND-X using the NAND-X to CoolRunner JTAG CableEnter one of the following commands (corresponding to your motherboard revision) (info) into the command prompt window, and hit Enter.

NandPro xsvf: Trinity.xsvf
NandPro xsvf: Jasper.xsvf
NandPro xsvf: Falcon.xsvf
NandPro xsvf: Opus.xsvf
NandPro xsvf: Zephyr.xsvf

Once the CoolRunner is programmed, it will say “Successfully executed file“, in the command prompt window, and the Green LED will turn off.

Now disconnect the CoolRunner from the NAND-X, and move switch to NOR (Normal)

Also make sure that the other switch is now set to the correct position for your console type (Phat or Slim)

Install the TX CoolRunner
Now that you have good/matching NAND dumps, you have programmed the CoolRunner, and have created the Xell/ECC Glitch image, this is probably the best time to install the chip.Printer friendly, quick install guides (A4 paper, 300dpi) (LINK)Various other install methods and tips (LINK)

Retrieve your CPU KeyNow that your CoolRunner is fully programmed/installed, it’s time to boot the console and retrieve the CPU Key.At this point you only need to connect…

Power
Video
RF board/Power button
Fan and Shroud (recommended for phats)
Network cable (optional, recommended)

Once you have the above items connected, turn on the console.
(you do not need to boot with the eject button, because the console will only boot into XeLL (Xenon Linux Loader) at this time)

You should see a constant Red LED on the CoolRunner as soon as you connect power to the console, joined by a flashing Green LED when you turn it on.

The flashing Green LED indicates that Glitch attempts are taking place.

If you do not see this happening, turn the console off, and refer to the FAQ at the bottom of this guide.

Once the Glitch is successful, you will be greeted on screen with the awesomeness that is XeLL-Reloaded

You may now retrieve your CPU Key, either by copying it from the screen

Or by connecting the Xbox to your LAN via an Ethernet cable, and downloading the info from XeLL-Reloaded via it’s http web interface.

Using your web browser, connect to the IP address shown next to network config: For example: http://192.168.1.47

From XeLL-Reloaded’s web interface…

Download your keyvault
Copy and paste the info from fuses into a .txt file
Copy and Paste your CPU Key and DVD key at the bottom of that .txt file, and save as fuses.txt
Copy ONLY the numbers/letters from your cpu key, and past them into a new .txt file
Save this file as cpukey.txt

As you can see above, your CPU Key is made up of two fuseset lines, i.e 03 + 05, or 03 +06, ect.

Your LDV (Lock Down Value) starts on line 07, the amount of f’s = the value, so in the above image, the LDV value is 2

For more info regarding LDV, check out Martin C’s post (info)

Create your NAND ImageMove cpukey.txtto…360_Multi_Builder\Data\my360Launch 360 Multi Builder again and press the number corresponding your motherboard revision.You may get a message informing you that “No fcrt.bin found in this nand.“
This is not uncommon, and is nothing to worry about, so just continue.Just for completeness, here is what it looks like if your NAND does contain fcrt.bin

Again, just press Enter to continue.

You are now given the option to create a Glitch image, or a stock NAND image (Retail MS). For the purpose of this guide, you want to choose 1

Press 1 again, choosing to build the image with DashLaunch patches included (highly recommended), and hit Enter

Now that Multi Builder has your NAND dump and CPU Key, it will use xeBuild to create your new “hacked” NAND image (nandflash.bin) and save it in 360_Multi_Builder\Data

(image – xeBuild Finished. Have a nice day)

(image – recommended flashing method)

DashLaunch Optinons

*****COMING SOON*****

Flash your NANDCopy nandflash.bin and xenon.elf from 360_Multi_Builder\Datato a USB keyIf the console is still running, with XeLL on screen, insert the USB key now.XeLL-Reloaded will find xenon.elf and use it to flash nandflash.binto your NAND. (if not, turn the console off, and on again)(again, still no need to boot with the eject button at this time)Once you see “Image written, shut down now!” on your screen, turn off the console and remover the power for at least 30 seconds, and remove the USB key.

You can use this time to put the motherboard back in the cage, and reconnect your HDD, and DVD drive.

Replace the power, and boot the console. You are now running a hacked dash

If all is well, fully reassemble the console.

Finishing UpDepending on the dashboard version you were on before you started, you may need to perform an update in order to get Avatars/Kinectworking correctly.If that is the case, put the USB key back in your PC, and delete the files from it.Now place the $systemupdate folder from the official 2.0.14699.0update, on the USB KeyIf you chose to create your NAND image with DashLaunch patches included (as you should have), then rename$systemupdate to $$ystemupdateotherwise the update wont install, because DashLaunch is configured to block updates by default.Make sure your xbox has some storage space for the update files, like a HDD or internal memory

Insert the USB key into the 360, and allow it to perform the update.

You are now ready to start installing all sorts of homebrew win, but before you do that, make backup copies of the following files, and put them somewhere safe.

nanddump.bin
nanddump2.bin
image_00000000.ecc
keyvault.bin
Fuses.txt
cpukey.txt
nandflash.bin
nandflash.bin.log
If created, also backup fcrt.bin and fcrt.bin.meta

Add them to a .zip/.rar file, and then email them to yourself, so that they are stored online, as well as locally.

After making your backup, delete the original files, so that you have clean working folders for any future Glitches you may do.

Updating

If your console is already Glitched and running a hacked Dashboard, and you just want to update to the latest, follow this guide, starting from the Create your NAND Image section.

Resources/Tools

(auto) xbins
HDD Folder List
Title Updates
ISO2GOD
XBC
Party Buffalo Drive Explorer
QuickBoot v2.1

FAQCOMING SOON
(that’s what she said) LINK
LINK
LINK

Waffle

Thanks to blackwolf over at EMS for a large hunk of this guide, taken from here… http://www.elitemods…al-by-blackwolf and anybody else I may have nicked bits from, here and there And obviously a huge thanks to everybody involved in making all this even possible, not least of course, the legend that is gligli.

This was just compiled and edited to fit my own needs, but I thought If I padded it out a bit, it may be helpful to others who have the same TX based setup.

If there is anything I have left out, or something I have totally butchered (bad blocks section?), pull me on it, so I can fix it. Thanks.

Filed under: Rest Glitch Hack Tagged: GliGli, JTAG, Rest Glitch Hack, xbox 360

LT+ 3.0 Released for Slim Lite-On 0272(9504)/0225/0225u/0401/1071

stainedfuture — Sun, 15 Jan 2012 09:40:01 +0000

C4E’s iXtreme LT+ in association with Team Jungle & Team Xecuter
—————————————————————-

Official release of the iXtreme LT+ v3.0 for 0272/0225/0401/1071 slim Liteons

- Support for topology data on AP25 enabled titles. Will correctly answer any ap25 challenge eliminating need for dae.bin to create a backup.

- No need to make new backups everytime dae.bin is updated on console

- Extra support for rare firmwares

Topology Data
————-

When ap25 was first introduced I devised a way of calculating any challenge which I called the silver bullet which I made reference to along time ago.
This was withheld until it was absolutely necessary. It was easier to replay the fixed challenges.

With unique per console ap25 challenges it has become necessary to use the silver bullet.

A series of measurements are taken across the disk. This topology data is then used to calculate a response to any ap25 challenge.

It is very important that the drive used to create the topology data is reliable at reading discs as bad topology data equals bad ap25 responses.

Liteon drives using 0800 v3 seem to be more accurate for this purpose. Only ap25 enabled titles require topology data. Activation of ap25 on older non-ap25 games although technically possible is highly unlikely.

Currently topology data for xgd3 titles are similar and topology data from one xgd3 title will pass on another xgd3 title although this is not advisable.

Per title title topology data is best as there are slight differences between titles and newer titles could have different topology than existing ones.

One liteon to go and four Hitachis. Have a great year everyone.

Thanks go to Team Jungle and all testers for their hard work and efforts in the development process.
Thanks also go to Team Xecuter for their support to this project.

Latest Firmware Pack

JungleFlasher v0.1.92 (304S)B

Filed under: Latest News Tagged: c4e, firmwares, ixtreme, silver bullet, topology data

Reset Glitch, Jtag and Flashing services.

stainedfuture — Mon, 09 Jan 2012 21:29:47 +0000

Professional soldering
High quality work
Fast turnaround
Collection and delivery arranged
Won’t be beaten on price

If you’d like your console modded by a pro, don’t hesitate get in touch

CONTACT via email

Filed under: Latest News Tagged: firmware, flash, JTAG, Reset Glitch Hack, RGH, xbox 360

Brand New JTAG’s For Sale (UK)

stainedfuture — Wed, 21 Sep 2011 10:21:53 +0000

Got a couple of brand new Falcons for sale, freshly JTAG’d by my good self

Will post a sales pitch with pictures later, when I’ve got time

Let me know if you are interested. http://about.me/DARKFiB3R

Filed under: Bargain Basement

CoolRunner-II CPLD dev board (XC2C64A)

stainedfuture — Tue, 13 Sep 2011 03:52:44 +0000

Compatible with the Xbox 360 “Reset Glitch Hack” . There are only two of these available in the UK right now, so grab one while you can.

CoolRunner-II

The CoolRunner-II XC2C CPLD has two separate banks of pins that can operate at different voltages, internal pull-up resistors, and pin keepers.

This development board from Dangerous Prototypes will help you build your first custom logic chip using simple schematic entry, Verilog, or VHDL.

XC2C64A CPLD with 64 macrocells
On-board 1.8volt supply for the core
On-board 3.3volt supply for pins
Separate pin banks can be operated at different voltages (1.2volt to 3.3volt)
Selectable 1.8volt, 3.3volt, and external supply for each pin bank
LEDs for output
Push button for input
Populated JTAG header
Easy to program with the Bus Pirate and Bus Blaster
Open source (CC-BY-SA)

Filed under: Bargain Basement, Latest News Tagged: 360, CC-BY-SA, CoolRunner, CPLD, Dangerous Prototypes, for sale, JTAG, reset glitch, RGH, Seeed Studio, uk, xbox, xbox 360, XC2C64