Freeboot V.0.01

[EugenDrago 0]

__ ____ ___ ___ _____

/ _|_ __ ___ ___| __ ) / _ \ / _ \_ _|

| |_| '__/ _ \/ _ \ _ \| | | | | | || |

| _| | | __/ __/ |_) | |_| | |_| || |

|_| |_| \___|\___|____/ \___/ \___/ |_|

[v0.01 - coded by ikari]

 

 

 

I. Introduction

================

 

Finally, here it is - freeBOOT, a rebooter for the Microsoft Xbox 360. This

version of freeBOOT allows you to reboot into kernel 2.0.8498 on a Xenon

or Falcon console, which can be exploited by the JTAG hack. Support for

Zephyr, Opus, and Jasper consoles will follow shortly.

 

As freeBOOT needs a second flash memory to store kernel 2.0.8498 and

associated data, a Cygnos360 is required at the moment.

 

Read through the following instructions carefully. Building your own images

is yet a complicated task involving many steps. Future versions of freeBOOT

will be easier to build.

 

 

 

II. Instructions

================

 

1. Extract the contents of this archive to a directory of your choice. All

file and directory names in the proceeding steps will be given relative

to that directory.

 

2. Update your Xbox 360 to kernel 2.0.7371 (Fall 08 Update). If your Xbox 360

has already been updated to a newer kernel, you can proceed to the next

step.

 

You can download the update from:

 

http://www.xbox.com/en-us/support/systemus...stemupdates.htm

 

Follow the instructions on this site on how to apply the update. The

update process will not succeed with resistor R6T3 desoldered. Resolder

resistor R6T3 in that case before starting the update process.

 

3. If present, desolder resistor R6T3 to prevent any accidentally applied

update fixing the JTAG hack vulnerability.

 

4. Save an image of your flash memory to the file "bin\7371.bin".

 

5. In case you don't already know your Xbox 360's CPU key, retrieve it now.

There are various ways to accomplish this, but they will not be covered

here.

 

6. Launch the 360 Flash Tool included in this archive. It incorporates the

fixes proposed by arnezami and thus works with newer dashboard versions.

Aside from that, it can also extract the SMC configuration block.

 

Click on the "Keys" button and enter the generic 1BL key and the CPU key

matching your "bin\7371.bin" image. Once you have entered the keys, close

the application and launch it again.

 

Open your "bin\7371.bin" image next and click on the "Extract" button.

Select the options "Cx Sections", "Key Vault", and "Raw File System

(No Unpacking)" from the "Extract Flash" dialog. Choose "data" as output

directory.

 

7. Delete all files from the "data" directory except:

 

- crl.bin

- extended.bin

- kv.bin

- odd.bin

- secdata.bin

- smc.bin

- smc_config.bin

 

8. The remaining files necessary to build an image with kernel 2.0.8498 must

be extracted from an image of an updated Xbox 360, further on referred to

as "bin\other8498.bin". Please do *NOT* update your Xbox 360 to kernel

2.0.8498, otherwise you will loose the ability to run the JTAG hack and

freeBOOT.

 

Launch 360 Flash Tool included in this archive and click on the "Keys"

button again. Now enter the CPU key corresponding to the "bin\other8498.bin"

image. Afterwards, close the application and launch it again.

 

Open the "bin\other8498.bin" image next and click on the "Extract" button.

Select the options "Cx Sections", and "Raw File System (No Unpacking)"

from the "Extract Flash" dialog. Choose "tmp" as output directory.

 

9. Copy the following files from the "tmp" to the "data" directory:

 

- aac.xexp[1,2]

- bootanim.xex

- bootanim.xexp[1,2]

- cb_1940.bin

- cd_8453.bin

- ce_1888.bin

- cf_8498.bin

- cg_8498.bin

- createprofile.xex

- createprofile.xexp[1,2]

- dash.xex

- deviceselector.xex

- deviceselector.xexp[1,2]

- gamerprofile.xex

- gamerprofile.xexp[1,2]

- hud.xex

- hud.xexp[1,2]

- huduiskin.xex

- mfgbootlauncher.xex

- mfgbootlauncher.xexp[1,2]

- minimediaplayer.xex

- minimediaplayer.xexp[1,2]

- signin.xex

- signin.xexp[1,2]

- updater.xex

- updater.xexp[1,2]

- vk.xex

- vk.xexp[1,2]

- xam.xex

- xam.xexp[1,2]

- xenonclatin.xtt

- xenonclatin.xttp[1,2]

- xenonjklatin.xtt

- xenonjklatin.xttp[1,2]

- ximecore.xex

- ximedic.xex

- ximedic.xexp[1,2]

 

"[1,2]" means the file name contains either "1" or "2" at that position.

 

10. Rename the following files in your "data" directory:

 

- aac.xexp[1,2] --] aac.xexp

- bootanim.xexp[1,2] --] bootanim.xexp

- createprofile.xexp[1,2] --] createprofile.xexp

- deviceselector.xexp[1,2] --] deviceselector.xexp

- gamerprofile.xexp[1,2] --] gamerprofile.xexp

- hud.xexp[1,2] --] hud.xexp

- mfgbootlauncher.xexp[1,2] --] mfgbootlauncher.xexp

- minimediaplayer.xexp[1,2] --] minimediaplayer.xexp

- signin.xexp[1,2] --] signin.xexp

- updater.xexp[1,2] --] updater.xexp

- vk.xexp[1,2] --] vk.xexp

- xam.xexp[1,2] --] xam.xexp

- xenonclatin.xttp[1,2] --] xenonclatin.xttp

- xenonjklatin.xttp[1,2] --] xenonjklatin.xttp

- ximedic.xexp[1,2] --] ximedic.xexp

 

You can easily rename the files by entering "ren *p1 *p" or "ren *p2 *p"

at the command prompt.

 

11. Now you can build your kernel 2.0.8498 image with ibuild. To do so,

launch ibuild with the following parameters:

 

Xenon:

 

ibuild -console xenon -dir data\ -1blkey [1BL key]

-cpukey [CPU key] bin\my8498.bin bin\fuses.bin

 

Falcon:

 

ibuild -console falcon -dir data\ -1blkey [1BL key]

-cpukey [CPU key] bin\my8498.bin bin\fuses.bin

 

Enter both 16 byte keys as hexadecimal numbers without leading "0x". The

CPU key in this case is the one matching your "bin\7371.bin" image. When

ibuild completes successfully, you will find two new files in the "bin"

directory. The file "bin\my8498.bin" contains your newly build kernel

2.0.8498 image, that will be booted by freeBOOT. The file "bin\fuses.bin"

contains the virtual fuse settings used by freeBOOT. Please do not mix

images and virtual fuses of different ibuild runs, it won't work

otherwise.

 

12. In order to build the freeBOOT image, Python is needed. If you already

have Python installed, you can proceed to step 13.

 

The easiest way to run Python scripts under Windows is to install Cygwin.

You can download the Cygwin setup from here:

 

http://www.cygwin.org/cygwin/

 

Install Cygwin to any directory of your choice along with the these

packages:

 

- python

- python-crypto

 

13. Open "build.py" with a text editor and look for these two lines:

 

# you need to fill in this

secret_1BL = None

 

Replace "None" with the 1BL key. This example shows you the format

in which the key has to be entered. The key itself is wrong.

 

secret_1BL = "\x01\x0F\x0E\x0C\x0E\xD6\x69\xE7\xB5\x67\x94\xFB\x68\x56\x3E\xFA"

 

14. The freeBOOT image can now be built. Open a Cygwin shell and change to the

directory where you extracted the contents of this archive into. Launch

the Python build script with the following parameters:

 

Xenon:

 

python build.py bin/xenon_hack.bin

 

Falcon:

 

python build.py bin/falcon_hack.bin

 

The "bin\xenon_hack.bin" and "bin\falcon_hack.bin" images are standard

JTAG hack images and can be found at the usual places.

 

15. Program "bin\my8498.bin" to the Cygnos360 flash memory and "bin\hack.bin"

to the Xbox 360 flash memory.

 

16. Power on your Xbox 360. If everything went correctly, you should see the

blue LED light up a few seconds later, followed by the usual boot

animation. If you power on your Xbox 360 with the DVD tray eject button,

XeLL will be loaded instead.

 

 

 

III. Credits

============

 

Writing freeBOOT would not have been possible without the great work done by

many hackers. Kudoz to arnezami, Redline99, Robinsod, SeventhSon, Tiros,

tmbinc, xorloser, and anyone else I may have missed.

 

 

 

IV. What's next

===============

 

Features planned for the next release(s):

 

- support for all consoles

- update to the latest kernel

 

 

 

-----

ikari, 2009/10/15

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

ктонибудь пробовал?

[Portgas 0]

и нафига оно нада? чего делает?)

[klipkin 0]

А для 2.0.8507.0 еще нет ?)

Как знал даш зря обновил (

[Coca 0]

Хороший вопрос, по идее это первый прорыв во взломе бокса 360. Если и дальше у них все получится то можно будет тварить такие штуки как на хбокс1.

[klipkin 0]

Щас прочитал всё. Они вон в пишут, что и дальше будут под даш обновлять и процесс упростят в следующих версиях.

[Dinamikus 0]

я вот думаю что не все знаю хорошо английский, поэтому не мог кто нить перевести это всё?

[RichY 0]

Единственная проблема это где взять переключатель чтоб две нанды сразу работали. А так прога норм

[ldraculal 0]

2 Richy: Держи =)

http://www.xboxhacker.net/index.php?topic=...g77698#msg77698

[NaV 0]

2 Richy: Держи =)

http://www.xboxhacker.net/index.php?topic=...g77698#msg77698

 

 

И оно работает... O_o

xD xD

 

тогда нах этот Cygnos360 за 50€ если есть xD ????

Изменено 24 октября 2009 пользователем NaV

[NaV 0]

И оно работает... O_o

xD xD

 

тогда нах этот Cygnos360 за 50? если есть xD ????

 

 

А тут видео на yuOTube:

 

http://www.youtube.com/watch?v=fKXSACLBF8M

 

xD рулит!!!!

[Dinamikus 0]

А тут видео на yuOTube:

 

http://www.youtube.com/watch?v=fKXSACLBF8M

 

xD рулит!!!!

объясните мне кто нить смысл происходящего на видео

[Stasinyhka 0]

объясните мне кто нить смысл происходящего на видео

 

если я сам правильно понял то на с помощью замены флешек он менял регион приставки, а на последней флешке лежал старый даш

[klipkin 0]

Именно, флешками менял регионы и даш.

Там же видно подписано на флехах J (japan) US (usa) и версия даша на третьей (4532)

Изменено 24 октября 2009 пользователем klipkin

[Stasinyhka 0]

что безусловно радует, лишь стоит представить себе как можно игры в ntsc новинки...

[Dinamikus 0]

а кто нить расскажет как такое замутить?

[alfer 0]

Впаивать в мать хбокса контроллер, и нанд прошивать

[NaV 0]

а кто нить расскажет как такое замутить?

 

 

xDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxD

 

http://img150.imageshack.us/img150/851/xd4.jpg

 

http://www.allpinouts.org/images/2/2e/Conn_mem_xd_picture_card_18pin.png

Pin Name Dir description

1 XD_CD# - presence detect

2 R/B# OUT Ready / Busy (open-drain)

3 RE# IN Read Enable

4 CE# IN Card Enable

5 CLE IN Command Latch Enable

6 ALE# IN Address Latch Enable

7 WE# IN Write Enable

8 WP# IN Write Protect

9 GND - Ground

10 SD0 IN/OUT data bit 0

11 SD1 IN/OUT data bit 1

12 SD2 IN/OUT data bit 2

13 SD3 IN/OUT data bit 3

14 SD4 IN/OUT data bit 4

15 SD5 IN/OUT data bit 5

16 SD6 IN/OUT data bit 6

17 SD7 IN/OUT data bit 7

18 VCC - 3.3V power

 

http://img44.imageshack.us/img44/8116/dualwithxdbl4.png http://img44.imageshack.us/img44/dualwithxdbl4.png/1/w840.png

 

 

Взято

 

http://www.xboxhacker.net/index.php?topic=...g77698#msg77698

http://www.allpinouts.org/index.php/XD-Picture_Card

 

xDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxDxD

Изменено 24 октября 2009 пользователем NaV

[Dinamikus 0]

а что там такое к плате припаяно? :)

[alfer 0]

Сделал, на ксеноне, задолбался до ужаса (((, в итоге накосячил с xD, чуток.... буду перепаивать... сделаю фото-отчёт как оттестю =)

[chamlay 0]

Где искать NAND? Я имею ввиду со старым дашем, как его подогнать под конкретную материнку (или привязки нет)? И будет ли это работать на других материнках, Falkon, Jasper? Заранее спасибо. Ждем фотоотчета.

 

И по схеме: как я понимаю, ребята режут дорожку от южного моста к флешке которая ее активирует, а все пины данных просто параллелят?

[Stasinyhka 0]

Сделал, на ксеноне, задолбался до ужаса (((, в итоге накосячил с xD, чуток.... буду перепаивать... сделаю фото-отчёт как оттестю =)

 

с тебя гайд :)

[PagaN 0]

here comes freeBOOT-0.02

 

http://www.mediafire.com/?ytmgjzdgmo2

http://www.mediafire.com/file/ytmgjzdgmo2/freeBOOT-0.02.zip

 

__ ____ ___ ___ _____

/ _|_ __ ___ ___| __ ) / _ \ / _ \_ _|

| |_| '__/ _ \/ _ \ _ \| | | | | | || |

| _| | | __/ __/ |_) | |_| | |_| || |

|_| |_| \___|\___|____/ \___/ \___/ |_|

[v0.02 - coded by ikari]

 

 

 

I. Introduction

================

 

freeBOOT is a rebooter for the Microsoft Xbox 360. This version of freeBOOT

allows you to reboot into kernel 2.0.8955 on all Xenon, Zephyr, Falcon, and

Jasper consoles with 16MB flashes, which are vulnerable to the JTAG hack.

Support for Opus and Jasper consoles with larger flashes will follow soon.

 

As freeBOOT needs a second flash memory to store kernel 2.0.8955 and

associated data, either a Cygnos360 or an xD card mod is required at the

moment.

 

 

 

II. Bug Fixes

=============

 

- Harddisk installation and save game/profile issues have been fixed

 

 

 

III. New Features

=================

 

- updated to kernel 8955

 

- additional support for Zephyr and Jasper consoles with 16MB flashes

 

- support for xD card mod and Cygnos360 V1 added

 

- Harddisk authentication disabled

 

The Xbox 360 will now accept any SATA harddisk.

 

- removed XEX signature checks

 

Execution of unsigned devkit and retail XEXes is now possible. Encrypted

devkit XEXes must be decrypted with XexTool prior to use.

 

- removed LIVE/PIRS signature checks

 

The dashboard will now run applications from unsigned LIVE/PIRS

containers.

 

- extendable patch system

 

Researchers/hackers can now try new patches easily. Please refer to

"src\patches_kernel_8955.S" for more information.

 

 

 

IV. Instructions

================

 

Read these instructions carefully and follow them exactly. Failing to do so

may render your Xbox 360 unusable!

 

1. Extract the contents of this archive to a directory of your choice. All

file and directory names in the proceeding steps will be given relative

to that directory.

 

2. Update your Xbox 360 to kernel 2.0.7371 (Fall 08 Update). If your Xbox 360

has already been updated to a newer kernel, you can proceed to the next

step. The update process will not succeed with resistor R6T3 desoldered.

Resolder resistor R6T3 in that case before starting the update process.

 

*************************************************************************

*** Make sure you do *NOT* update to kernel 2.0.8xxx, since this will ***

*** fix the JTAG hack vulnerability. Check the update before! ***

*************************************************************************

 

3. *************************************************************************

*** If present, desolder resistor R6T3 to prevent any accidentally ***

*** applied update fixing the JTAG hack vulnerability. ***

*************************************************************************

 

4. Save an image of your flash memory to the file "bin\7371.bin".

 

5. In case you don't already know your Xbox 360's CPU key, retrieve it now.

There are various ways to accomplish this, but they will not be covered

here.

 

6. Extract the contents of your "bin\7371.bin" image with ibuild now. Launch

ibuild with the following parameters:

 

> ibuild x -d data\ -b <1BL key> -p <CPU key> bin\7371.bin

 

Replace <1BL key> with the 1BL key and <CPU key> with the CPU key matching

your "bin/7371.bin" image. Enter both 16 byte keys as hexadecimal numbers

without leading "0x". Data previously extracted with 360 Flash Tool can

no longer be used.

 

7. Delete all files from the "data" directory except:

 

- crl.bin

- crl.bin.meta

- extended.bin

- extended.bin.meta

- kv.bin

- odd.bin

- odd.bin.meta

- secdata.bin

- secdata.bin.meta

- smc.bin

- smc_config.bin

 

8. The remaining files necessary to build an image with kernel 2.0.8955 must

be extracted from an image of an updated Xbox 360, further on referred to

as "bin\other8955.bin". Please do *NOT* update your Xbox 360 to kernel

2.0.8955, otherwise you will loose the ability to run the JTAG hack and

freeBOOT.

 

Launch ibuild with the following parameters:

 

> ibuild x -d tmp\ -b <1BL key> -p <CPU key> bin\other8955.bin

 

Replace <1BL key> with the 1BL key and <CPU key> with the CPU key matching

the "bin/other8955.bin" image.

 

9. Copy the following files from the "tmp" to the "data" directory:

 

- aac.xexp[1,2]

- aac.xexp[1,2].meta

- bootanim.xex

- bootanim.xex.meta

- bootanim.xexp[1,2]

- bootanim.xexp[1,2].meta

- cb_[1940, 4579, 5771, 6750].bin

- cd_8453.bin

- ce_1888.bin

- cf_8498.bin

- cg_8498.bin

- createprofile.xex

- createprofile.xex.meta

- createprofile.xexp[1,2]

- createprofile.xexp[1,2].meta

- dash.xex

- dash.xex.meta

- deviceselector.xex

- deviceselector.xex.meta

- deviceselector.xexp[1,2]

- deviceselector.xexp[1,2].meta

- gamerprofile.xex

- gamerprofile.xex.meta

- gamerprofile.xexp[1,2]

- gamerprofile.xexp[1,2].meta

- hud.xex

- hud.xex.meta

- hud.xexp[1,2]

- hud.xexp[1,2].meta

- huduiskin.xex

- huduiskin.xex.meta

- mfgbootlauncher.xex

- mfgbootlauncher.xex.meta

- mfgbootlauncher.xexp[1,2]

- mfgbootlauncher.xexp[1,2].meta

- minimediaplayer.xex

- minimediaplayer.xex.meta

- minimediaplayer.xexp[1,2]

- minimediaplayer.xexp[1,2].meta

- nomni.xexp1

- nomni.xexp1.meta

- nomnifwm.xexp1

- nomnifwm.xexp1.meta

- signin.xex

- signin.xex.meta

- signin.xexp[1,2]

- signin.xexp[1,2].meta

- updater.xex

- updater.xex.meta

- updater.xexp[1,2]

- updater.xexp[1,2].meta

- vk.xex

- vk.xex.meta

- vk.xexp[1,2]

- vk.xexp[1,2].meta

- xam.xex

- xam.xex.meta

- xam.xexp[1,2]

- xam.xexp[1,2].meta

- xenonclatin.xtt

- xenonclatin.xtt.meta

- xenonclatin.xttp[1,2]

- xenonclatin.xttp[1,2].meta

- xenonjklatin.xtt

- xenonjklatin.xtt.meta

- xenonjklatin.xttp[1,2]

- xenonjklatin.xttp[1,2].meta

- ximecore.xex

- ximecore.xex.meta

- ximedic.xex

- ximedic.xex.meta

- ximedic.xexp[1,2]

- ximedic.xexp[1,2].meta

 

"[A, B]" means the file name contains either "A" or "B" at that position.

 

10. Now you can build your kernel 2.0.8955 image with ibuild. To do so,

launch ibuild with the following parameters:

 

> ibuild c -c <console> -d data/ -b <1BL key> -p <CPU key>

./bin/my8955.bin ./bin/fuses.bin

 

Replace <1BL key> with the 1BL key and <CPU key> with the CPU key

matching your "bin/7371.bin" image. Since ibuild currently does neither

support Opus consoles nor Jasper consoles with large flashes, valid

parameters for <console> at the moment are "xenon", "zephyr", "falcon",

and "jasper". When ibuild completes successfully, you will find two new

files in the "bin" directory. The file "bin\my8955.bin" contains your

newly built kernel 2.0.8955 image, that will be booted by freeBOOT. The

file "bin\fuses.bin" contains the virtual fuse settings used by freeBOOT.

 

11. In order to build the freeBOOT image, Python is needed. If you already

have Python installed, you can proceed to step 12.

 

The easiest way to run Python scripts under Windows is to install Cygwin.

You can download the Cygwin setup from here:

 

http://www.cygwin.org/cygwin/

 

Install Cygwin to any directory of your choice along with the these

packages:

 

- python

- python-crypto

 

12. Open "build.py" with a text editor and look for these two lines:

 

# you need to fill in this

secret_1BL = None

 

Replace "None" with the 1BL key. This example shows you the format

in which the key has to be entered. The key itself is wrong.

 

secret_1BL = "\x01\x0F\x0E\x0C\x0E\xD6\x69\xE7\xB5\x67\x94\xFB\x68\x56\x3E\xFA"

 

13. The freeBOOT image can now be built. Open a Cygwin shell and change to the

directory where you extracted the contents of this archive into. Launch

the Python build script with the following parameters:

 

> python build.py bin/<console>_hack.bin smc.bin

 

The "bin\<console>_hack.bin" image is a standard JTAG hack image and can

be found at the usual places. The "smc.bin" is a patched SMC generated

by the Cygnos toolbox. When the build process finishes successfully, a new

image "bin\hack.bin" can be found.

 

14. Program "bin\my8955.bin" to the Cygnos360 flash memory and "bin\hack.bin"

to the Xbox 360 flash memory.

 

15. Power on your Xbox 360. If everything went correctly, you should see the

blue LED light up a few seconds later, followed by the usual boot

animation. If you power on your Xbox 360 with the DVD tray eject button,

XeLL will be loaded instead.

 

 

 

VI. What's Next

===============

 

- support for Opus consoles and Jasper consoles with large flashes

- further removal of security system restrictions

- easier build process

 

 

 

VII. Credits

============

 

My gratitude goes to all those who helped me get this new release done.

 

 

 

-----

ikari, 2009/11/21

[alex706 0]

чот не совсем понял! последни даш чтоли ломанули?

[TrueDrago 0]

чот не совсем понял! последни даш чтоли ломанули?

Судя по всему нет, на 8х так и не работает это.

Раскрыть спойлер

*************************************************************************

*** Make sure you do *NOT* update to kernel 2.0.8xxx, since this will ***

*** fix the JTAG hack vulnerability. Check the update before! ***

*************************************************************************

[alex706 0]

TrueDrago, - updated to kernel 8955