Print

[heinrich]

QUOTE (Pope-X @ May 2 2004, 07:54 PM)

and then make the bios available.. so we can make a compare with the old bioses.

both 5530 and 5713 support all 3 known video encoders, and both kernels have been on xbins for a while.

[bcforn64]

I'm hoping the BIOS hasn't changed. If the motherboard design is radically different, there might be a chance that NONE of the previous BIOS's will work as the firmware is for the other design.

[DaShiZNiT]

trust me, it would say
UNKNOWN DEVICE

[hippo]

I kinda looks like xyclops is replacing the tsop flash rom and the smt pic chip with some custom read only device, that would pretty much explain it's 63 or so connections to the mobo and the lack of those chips on the board. Of course combining 2 chips into 1 makes it cheaper to manufacture and you'd have to surmise the data and address lines that used to be associated with the tsop flashrom will be moved to the new chip.  It looks like pin #6 of the LPC bus is still a 5v power rail. And it looks like there isn't anything connecting to pin #3 of the LPC bus where Mr Lframe used to live.

[Psilocybe]

the lframe has been gone

[Exobex]

QUOTE (Pope-X @ May 2 2004, 11:06 PM)

its also to see what raincoat says the bios chip id is and who knows for shure that the bios is the same... dump the bios.. and then try to flash the bios with that dumped bios .. (should not hurt...) then we will know if the chip is write disabled.. mayb m$ made it easyer AGAIN... so no more soldering is needed to flash the bios ... (this would b hillarious) Regards, Pope-X

Raincoat is likely to report INVALID MANUFACTURER ID: 0x09
At least one of the TSOP flashing jumpers will need to be located in order to read the chip.  Both will be needed in order to write the chip.

I assume the TSOP connects to the MCPX.
Therefore if the pins from, say, a 1.4 machine's TSOP can be traced to the little vias that are visible on the 1.4 MCPX, the same vias on a 1.6 MCPX can then be traced back, revealing which chip is the new BIOS chip.
We already know the pinout of a 1.4 TSOP (it's standard!), by doing this we will reveal at least a partial pinout of the MCPX, and from there a partial pinout of the 1.6's BIOS chip.
This can be compared with existing "off-the-shelf" memory devices.  If the data and address lines correspond with one of these, we can guess that the rest of the pins match up, too.
The TSOP write-enable jumpers go to two pins on the TSOP.  These pins on the 1.6 BIOS can be traced back to see if they go to anything resembling write-enable jumpers.

On a different note, M$ don't need to own chip foundries to get their logo on chips.  Look at SmartXX!

[Yoshihiro]

Hi all ppl i've found in kernal 5530 & 5713 retail the Xcalibur encoder  For make new bios hack

Info Encoder ID : 8A=Conexant  , 0D4=Focus & 0E0=Xcalibur    

you need to make a new init table to be able to launch this bios



Support Xcalibur in kernal 5530 extract by Yoshihiro


.text:80014899 ; ---------------------------------------------------------------------------
.text:80014899
.text:80014899 loc_80014899:                           ; DATA XREF: sub_800148F0+8o
.text:80014899                 mov     eax, ds:xboxkrnl_322
.text:8001489E                 test    ah, 4
.text:800148A1                 mov     dword_800377F0, offset loc_8001487F
.text:800148AB                 jz      short loc_800148BA
.text:800148AD                 push    0Fh
.text:800148AF                 push    4
.text:800148B1                 push    4
.text:800148B3                 push    0E0h             ;ID ENCODER XCALIBUR IN 5530
.text:800148B8                 jmp     short loc_800148E6
.text:800148BA ; ---------------------------------------------------------------------------
.text:800148BA
.text:800148BA loc_800148BA:                           ; CODE XREF: .text:800148ABj
.text:800148BA                 test    al, 20h
.text:800148BC                 jz      short loc_800148D1
.text:800148BE                 push    20Fh
.text:800148C3                 push    2
.text:800148C5                 push    0A0h
.text:800148CA                 push    0D4h             ;ID ENCODER FOCUS IN 5530
.text:800148CF                 jmp     short loc_800148E6
.text:800148D1 ; ---------------------------------------------------------------------------
.text:800148D1
.text:800148D1 loc_800148D1:                           ; CODE XREF: .text:800148BCj
.text:800148D1                 push    3Fh
.text:800148D3                 push    1
.text:800148D5                 mov     dx, 80D3h
.text:800148D9                 mov     al, 5
.text:800148DB                 push    0BAh
.text:800148E0                 out     dx, al
.text:800148E1                 push    8Ah              ;ID ENCODER CONEXANT IN 5530
.text:800148E6
.text:800148E6 loc_800148E6:                           ; CODE XREF: .text:800148B8j
.text:800148E6                                         ; .text:800148CFj
.text:800148E6                 call    sub_800146D1
.text:800148EB                 mov     al, 1
.text:800148ED                 retn    4
.text:800148F0

Work in progress ......... wait & see

Sorry for my english very bad  


GueuX'NeT French Team  Web Site

[derived]

QUOTE (busbyjon @ May 2 2004, 09:14 PM)

they can screen their logo onto the chips. This might be no more than a PR stunt to us modders...

It just seems like such a pathetic thing to do... within a minute a hacker can read the flash (assuming it is) ROM ID from the chip and the cover is blown.

[pROvIs]

ALL THREE OF MY XBOXS ARE NOW CONFIRMED 1.6

Two are going to the SmartXX team,  the last one is up for the best offer.

all have phillips drives and seagates all from 3-22-04

Email me @ [email protected] if interested


Also i appolagize for my pics i cant seem to get very good ones but i will post what i have shortly

[RoboChicken]

QUOTE (pROvIs @ May 3 2004, 03:44 AM)

ALL THREE OF MY XBOXS ARE NOW CONFIRMED 1.6 Two are going to the SmartXX team,  the last one is up for the best offer. all have phillips drives and seagates all from 3-22-04 Email me @ [email protected] if interested Also i appolagize for my pics i cant seem to get very good ones but i will post what i have shortly

I say donate the last one to Bunny!

Bottom pics please! This is driving me crazy!! I'm about to go out and buy five Xboxs

[pROvIs]

QUOTE (RoboChicken @ May 2 2004, 09:50 PM)

I say donate the last one to Bunny! Bottom pics please! This is driving me crazy!! I'm about to go out and buy five Xboxs

bunny?

[oz_paulb]

A couple of thoughts, based on comments made in previous posts:

 - getting custom silkscreening on a chip doesn't require a foundry

 - My understanding of MS's new deal with IBM for CPUs is that they get the 'core' design - which sounds like MS may be doing their own chip manufacturing in the future (for Xbox 2).  So, they could be setting up their own foundry (or have a close relationship with a foundry).  Given this, MS could be manufacturing custom chips right now.

 - Unless it's on the bottom of the board, the BIOS is probably inside another chip.  My guess is that it is now ROM (not Flash), as they have probably reached a point where they consider the kernel stable enough for mass production.  If a critical change is required, they'd have to discard some mask ROMs.  But, considering that games will have to work with Xbox's shipped with the kernel in today's 1.6 Xbox, there can't be a required kernel change unless there are hardware changes (like a new video encoder) in the future.

 - "d0" refers to the signal for the lowest data bit that happens to be connected to the TSOP chip on older Xbox's.  There is a separate 'bus' coming out of the MCPX (separate from SDRAM, for example) that's used for the TSOP.  The MCPX first tries reading the first address from this "TSOP bus".  If the low bit (d0) is "0", then it knows that it should boot from LPC (the first byte of a TSOP bios has a '1' in bit 'd0').  This would allow MS to remove the TSOP, permanently strap "d0" on the "TSOP bus" to "0", and build-in an LPC boot ROM instead.  It also (most likely) allows their factory test process to override the TSOP bios with a 'factory test bios' that does diagnostics/QC testing.  It's possible that they also load the TSOP Flash with the 'final' BIOS at the factory via LPC - but they could also just manufacture the motherboards with pre-programmed Flash chips.

 - Given the fact that v1.6 has an LPC connector, it's probably still used for factory testing, which means there's some hope for booting custom code via LPC.  It doesn't necessarily mean that the built-in BIOS is stored in a re-writable Flash - it could be masked ROM as I said above.

 - The physical location of "d0" on the motherboard is likely to change from one version of the motherboard to another.  There may be a factory requirement to keep it in the exact same spot (in relation to LPC, for example) if they use some sort of 'bed of nails' adapter to connect to "d0".  But, they could just use a different bed of nails configuration for a new motherboard.

 - If MS has changed the MCPX as well, then their method of detecting 'LPC boot' vs 'internal boot' could also have changed.  If there's no TSOP bios chip (example: they may use LPC internally), then there may be no need for the 'TSOP bus', so all of those signals (address/data lines/etc) could be re-assigned to different uses.  Maybe a specific combination of (formerly) address/data line signals needs to be held low/high in order to boot from the 'external' LPC port.  A factory bed of nails can hold any number of signals any way they need.

 - It still would be a good idea to try tracing "d0" back to the MCPX on earlier versions of the Xbox, then try strapping that signal low (at the MCPX) on the 1.6 Xbox, to see if it's still usable.  MS may not have made very drastic changes, so this could still be a simple way to force an external LPC boot.


- Paulb

[jimmsta]

Interesting find... It's rather odd that the board design changed almost completely, as the xbox is years old... it's surprising that this didn't happen sooner.

[Monoxide-Child]

QUOTE (jimmsta @ May 3 2004, 04:34 AM)

Interesting find... It's rather odd that the board design changed almost completely, as the xbox is years old... it's surprising that this didn't happen sooner.

Erm... we've been over this.  1.0/1.1 to 1.2-1.5ish was a significant change also.

[volcomman2003]

i dont know if anyone noticed or if it was just me but in the main picture of the board if you look at the power supply plug instead of clear plastic is it white platic and kinda looks cheap but i dont know if you have seen it just pointing sumthing out that might classify a 1.6


happy findings cant wait to see fi there is anyhting new for this baby