Jump to content
RealModScene

devilhunter

Members
  • Content Count

    132
  • Joined

  • Last visited

  • Days Won

    3

Posts posted by devilhunter


  1. I would visually inspect the area, could be some residue on the rams or GPU die. Just blow the dust and clean the paste if there is nothing. You can also create a hack image or adjust fan speed % with respect to ram temperatures; meaning you set temp thresholds.

    • Like 1

  2. Where were they found on the drive? They could just be temporary files, that werent dealt with because of the improper unmount of the drive.

    Found them at "Found.000" Files type is FILExxxx.CHK


  3. Greetings, 

     

    My external hard drive was accidentally pulled while reading, I found that there are 1000+ of CLK files ranging in sizes (up to 2.5Gb).  I tried to look for recovery tools online and nothing useful was found. The funny thing is Aurora can still read these files! they were originally Arcade games + my account! .  I lost my account and managed to recover a fragment of it. 

     

    If you have any recommendation please provide.  Why Aurora can read CLK files? Can Aurora extract those files? 


  4. I do believe the latest "J-Runner" is not being updated for the newest dash, use XE build GUI. Get your hack information (Jtag,RGH,RGH2 or R-Jtag) from DashLaunch. 

    You can get your CPU key from Xell or Dashlaunch if required. Its really hard to spoil your hacked xbox. 


  5. Not quite, that patch is primarily for slim consoles to not use the fcrt (Firmware Challenge Response Table) which allows the drives to function properly, but it doesn't make any drive work, it's primarily that it doesn't care what the firmware actually says about anything...

    I see, thanks a lot once again, I remember swapping a hitachi drive with Benq two years ago. It worked. Never mind. I removed the "Dvd" mount from the hex editor and its working now.

    https://www.mediafire.com/?ju3zxsabdztf4e2


  6. You dont spoof the drive, you change the drive in the nand.. from hitachi to benq.. just make sure dvd is the same on both.. you can even create a new dvd key if youd like.. spoofing would be the wrong way to change it.. lol.. as you are still stuck with hitachi in the nand..

    No need to reflash the xbox, Ive fixed it  :sorcerer:

    Its working on Hitachi now. 

    By the way, if you can patch the nand by clicking on "nofcrt", you can use any drive on that. 

     

    Chao. 


  7. You need to get rid of that spoof data, it's not normal to have on LT+3.0 and probably breaks it...

     

    You dont spoof the drive, you change the drive in the nand.. from hitachi to benq.. just make sure dvd is the same on both.. you can even create a new dvd key if youd like.. spoofing would be the wrong way to change it.. lol.. as you are still stuck with hitachi in the nand..

     

    You may also want to double check the SATA and Power cables, if they're bad or poorly connected, this would be a possible scenario...

    ok sorry. My bad. 


  8. felida, on 09 May 2016 - 2:54 PM, said:

    Well you can always get a new dvd drive and pair it with your rgh.. problem solved right?? Thats the good thing about having a rgh.. no more problems.. ;-)

    All that would really be required is changing a setting in the nand.. to match the new drive.. you can use same dvd key.. if youd like..

    I do have a spare Benq, I flashed it with LT+ 1.1 and the 04220 one, and spoofed the Key only then I flashed it to stock with the Hitachi Key spoofed. The drive runs @ max speed, spins really loud then the dashboard says "Eject Disk". Here is the JF log.

    JungleFlasher 0.1.96 Beta (323) Log:

    ------------------------

    Requesting Device ID

    Manufacturer ID: 0xC2

    Device ID: 0x11

    Flash Name: MXIC(MX25L2005)

    Flash Size: 262144 bytes

    Getting Status from port 0x01F0

    Serial flash found with Status 0x73

    Reading Bank 0: ................

    Reading Bank 1: ................

    Reading Bank 2: ................

    Reading Bank 3: ................

    Dumped in 2480mS

    Benq Dump file saved to BENQcfw.bin

    Loading firmware from buffer

    Inquiry string found

    Identify string found

    Drive key @ 0xE040 8BA17172C296A26C9EB8A348DEF49184

    Firmware Osig: [PBDS VAD6038-64930C ]

    Spoofed As: [sATA DVD-ROM 6243]

    Firmware is: LT-Plus 1.1

    Key database updated

    Auto-Loading firmware file C:\Users\Asus\Desktop\JungleFlasher v0.1.96 Beta (323)\Firmware\LTPlus-benq-v1.1.bin

    MD5 hash: c45d60fbd68cc642b2235ba12e5aad7d

    Genuine LT plus v1.1

    Inquiry string found

    Identify string found

    Drive key @ 0xE040 77777777777777777777777777777777

    Firmware Osig: [PBDS VAD6038-64930C ]

    Firmware is: LT-Plus 1.1

    Spoofing Target

    DVD Key copied to target

    Inquiry string copied to Target

    Identify string copied to Target

    Loading MTK_Flash source file

    Loading firmware file G:\BenQ backup1\BENQ-OFW.bin

    MD5 hash: 3868bc328b85360082d5ba3ac4e0b46d

    Inquiry string found

    Identify string found

    Drive key @ 0xC030 E5CFDCF5B11CE746066D2899B82ED3C1

    Firmware Osig: [sATA DVD-ROM 6243]

    Firmware is: Stock

    Spoofing Target

    DVD Key copied to target

    ID strings already match

    Serial data already matches

    Loading firmware file C:\Users\Asus\Desktop\LTPlus-0442-v3.0.bin

    MD5 hash: 8784e0f4ce27941a2a3293c8a5ac85e4

    Genuine LT plus v3.0

    Inquiry string found

    Identify string found

    Drive key @ 0xA020 FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

    Firmware Osig: [PBDS VAD6038 0442]

    Firmware is: LT-Plus 3.0

    Spoofing Target

    DVD Key copied to target

    Target is LT - ID strings not copied to Target

    DVD Key copied to target

    ID strings already match

    Getting Status from port 0x01F0

    SPi flash found with Status 0x73

    Sending Chip Erase to Port 0x01F0

    Erasing:

    Writing target buffer to flash

    Writing Bank 0: ................

    Writing Bank 1: ................

    Writing Bank 2: ................

    Writing Bank 3: ................

    Flash Verification Test !

    Reading Bank 0: ................

    Reading Bank 1: ................

    Reading Bank 2: ................

    Reading Bank 3: ................

    Write verified OK !

    Loading firmware file G:\BenQ backup1\BENQ-OFW.bin

    MD5 hash: 3868bc328b85360082d5ba3ac4e0b46d

    Inquiry string found

    Identify string found

    Drive key @ 0xC030 E5CFDCF5B11CE746066D2899B82ED3C1

    Firmware Osig: [sATA DVD-ROM 6243]

    Firmware is: Stock

    Spoofing Target

    DVD Key already matches

    ID strings already match

    Serial data already matches

    DVD Key copied to target

    ID strings already match

    Drive is Benq..

    Drive is Benq..

    Sending Magic Keys to Drive on port 0x01F0

    .................................................

    Done!

    Sending Vendor Intro

    Requesting Device ID

    Manufacturer ID: 0xC2

    Device ID: 0x11

    Flash Name: MXIC(MX25L2005)

    Flash Size: 262144 bytes

    Getting Status from port 0x01F0

    SPi flash found with Status 0x73

    Sending Chip Erase to Port 0x01F0

    Erasing:

    Writing target buffer to flash

    Writing Bank 0: ................

    Writing Bank 1: ................

    Writing Bank 2: ................

    Writing Bank 3: ................

    Flash Verification Test !

    Reading Bank 0: ................

    Reading Bank 1: ................

    Reading Bank 2: ................

    Reading Bank 3: ................

    Write verified OK !

    Getting Status from port 0x01F0

    Serial flash found with Status 0x73

    Reading Bank 0: ................

    Reading Bank 1: ................

    Reading Bank 2: ................

    Reading Bank 3: ................

    Dumped in 2465mS

    Benq Dump file saved to BENQ-OFW-fal key.bin

    Loading firmware from buffer

    Inquiry string found

    Identify string found

    Drive key @ 0xC030 8BA17172C296A26C9EB8A348DEF49184

    Firmware Osig: [sATA DVD-ROM 6243]

    Firmware is: Stock

    Key database updated

    Auto-Loading firmware file C:\Users\Asus\Desktop\JungleFlasher v0.1.96 Beta (323)\Firmware\LTPlus-benq-v1.1.bin

    MD5 hash: c45d60fbd68cc642b2235ba12e5aad7d

    Genuine LT plus v1.1

    Inquiry string found

    Identify string found

    Drive key @ 0xE040 77777777777777777777777777777777

    Firmware Osig: [PBDS VAD6038-64930C ]

    Firmware is: LT-Plus 1.1

    Spoofing Target

    DVD Key copied to target

    Inquiry string copied to Target

    Identify string copied to Target

    Loading MTK_Flash source file

    Loading firmware file G:\BenQ backup1\BENQ-OFW3.bin

    MD5 hash: 3868bc328b85360082d5ba3ac4e0b46d

    Inquiry string found

    Identify string found

    Drive key @ 0xC030 E5CFDCF5B11CE746066D2899B82ED3C1

    Firmware Osig: [sATA DVD-ROM 6243]

    Firmware is: Stock


  9. hmm.. have you tried to disconnect the dvd drive?? 

    and honestly.. i didnt think the dvd drive would cause a problem.. as it is being ran from USB right??.. 

    There is a known bug in LibXenon that causes to hang (or wait for dvd/usb infinitely) for toshiba drives. The bug was fixed by Swizzy in a patched version of 0.993 Xell. However, the latest Mupen uses that code. 

     

    If I disconnect the dvd, it will work as Xell worked for me. 


  10. Greetings, 

    I was looking for Mupen64 0.993 source, apparently its not there. I was trying to get it working on my xbox 360 with Hitachi Drive. The problem is it keeps getting stuck at "Fat Mount". Anyways, Ive edited Xenon.elf to bypass the DVD checkup and it loads to the emulator. 

    Now here is the problem, first thing I noticed is that the background image doesnt load, also when a game is selected, it loads briefly (2-3 secs) then reboots back to Xell ! 

    If you have a clue on whats going on, please let me know. 

    Please look in the attachment for the modified parts.

     

    This ver. works flawlessly on Hitache (Phat + Slim)

     

    https://www.mediafire.com/?ju3zxsabdztf4e2

    post-75799-0-90378100-1462786588_thumb.png

    post-75799-0-33401800-1462786592_thumb.png


  11. what they did was patch the kernel that allowed for the security issue, and then blew 1 efuse, that stops the console from downgrading. There are to types of fuses that can be blown, the ones that get blown with every update, and the ones that get blown when the cb(Boot loader) on the console changes. that is why if the kernel version is running the same CB as the console you can downgrade to that version, eg. current back down to 15537... so that is why you cant get the KK shader hack back. I guess you could, if your console were already JTAG/RGH, but it would be pointless at that point.

    Oh I see now, blowing complete row of Efuse set (prevent the console to downgrade to values less than the specified) and patch Syscall Dispatcher. One more thing to add. What really fucked the scene is the release of Timing Attack so early in the xbox 360 life! http://free60.org/wiki/Timing_Attack

    What a bummer.

    RGH was also considered "unpatchable" when it first came out... it's a hardware bug... they've fixed it... then we got hold of factory bootloaders (used during the process of creating the unique per-console data) and it actually allows us to run non-encrypted bootloaders (well, the first one is still encrypted, but all the others are not - allowing us to once again replace them with patched ones and glitching the signature checks)

    The only way to "fix" RGH is at this point in time to replace the CPU with a new one that doesn't have the original hardware bug, they've replaced the CPU in the new winchester board, but the bug is likely still there, it's just that we don't have data to analyze to find the correct timings for this board, and there's been some saying there's not even post_out data to be used (i've heard from other sources that it is there... just not enabled in all builds)

    Good to know, the question is why points life Post_out and CPU_PLL is on the board's surface? Why they do exist?

    At this point, there is no need for microsoft to invest in 360 security, there are almost 40 millions sold word wide, no body would care about the winchester anyways.


  12.  

    Xell was made by the german Hacker Felix Domke (a.k.a tmbinc). He has worked along with other people (among others Michael Steil, he is a kernel developer), on the spotting of the Xbox 360 security system. For Felix Domke I have to say, that he is a real talent. In the past, he had  all reverse engineering & hacked, what he got into his hands (consoles, set, top boxes, car firmware, and so on. He is well established in the Scene.

     

    I guess hes still active ( not in xbox scene), good for him. Still to this day, I wonder why there is an unsigned shaders in King Kong  :unsure:. As if it was intentionally left. Its always the shit game that have hacking potential, the irony. 

    From whateve I understood is the SMC hack was patched by" replacing two memcmp instances with a memdiff function" my question is ( I know guys this is getting off hand and you simply close the thread) How did microsoft patch 2BL? They blew the fuse row to prevent downgrading as far as I understood. The hack appears impatchable as it requires re-coding the cpu. I know Im wrong but hope you guys can explain. 

     

    Anyways, Im really sorry for bothering you guys. It really feels bad when you use other's product and you dont provide the scene on the other hand. 

    Thank you all. 

    • Like 1

  13. http://free60.org/wiki/LibXenon <--- This is where you can read about what Libxenon is and a quick one for how to install it... for a more detailed description: http://free60.org/wiki/Compiling_the_Toolchain

    You'll find the Libxenon code here: https://github.com/Free60Project/libxenon and various projects using it here: https://github.com/LibXenonProject Xell is available here: https://github.com/Free60Project/xell

    I wrote a install script that downloads and installs Libxenon and various support libraries on debian (and possibly ubuntu, i only really tested it on debian) you can find that here: http://pastebin.com/QhMj9eXF

    I was checking these two pages, and what I was looking for is function list; for example, get_controller_data(struct controller_data_s ,0 ), what I found in sample code. 

    I intend to edit existing code for my personnel use. 


  14.  

    Wrong, they all use the same library (libxenon) which xell also uses...

    They're all statically linked with the library as there is no mechanics for dynamically loading libraries as there is no kernel, libxenon homebrew rums in a mode referred to as "bare metal" meaning they run directly on the cpu, there's nothing in between such as a kernel... they have direct access to everything...


    Sent from my SM-G903F

    Wow! Thanks for the answer, I was asking my friend (programmer) on the possiblity to make a linux district on ~4 mb, I thought Xell is an Os. 

     

    Direct CPU code to get cpu keys and nand dumps, who the fuck came up with these ideas? I bet hes having a great job by now. 

     

    Thanks a lot for the answers, if there is any place to donate to the site? 


  15. Greetings, 

     

    I have been messing around with LibXenon homebrews with a hex editor, I found that they have to contain Xell code in it. Im sorry if my question is bad, If xell is in memory why the hell it has to be reloaded from usb/dvd again? 

     

    Ive noticed some apps not working on certain models because of simply they are using old or updated xell.  

    Its way too late to ask these questions, Im just curious. 

     

    Wish I become a good coder one day. 

     

    Regards. 


  16. It should be WMV9, And Expression Blend i think it was does that... some microsoft software...

    Sent from my SM-G903F

    Not trying to be rude, this is the Expression blend description: 

     

    "Introducing Microsoft Expression Blend 2—a full-featured professional design tool for creating engaging and sophisticated user interfaces for Microsoft Windows-based and Microsoft Silverlight 1.0-based applications. Expression Blend lets designers focus on creativity while letting developers focus on programming."

    Im trying microsoft Encoder. Will report back. 

    Regards.

×
×
  • Create New...