Print

[maddy2005]

people says that it isent working :S read at the forum youre linking to...

[t_mac_ca]

QUOTE(maddy2005 @ Dec 16 2005, 05:13 PM)

people says that it isent working :S read at the forum youre linking to...

yea i just read that, i posted this before people reported it not working srry

[maddy2005]

ahh oki no prob m8

[jameswalter]

Well...I was skeptical at first....but I am trying it right now.  I'm using RecordNow Max instead of CloneCD.  I started with "The Longest Yard" (~7.7G) and swapped with my version of MechAssault (XBOX).  Currently at 260M and going....says it will go out to the 7.7G mark....I will update with progress.

Edit1: Damn....error at 880MB...Downloaded CloneCD....trying it now....probably something to do with error correction.

Edit2: CloneCD is going further than the 880MB mark...though it did slow down, but it is slowly making progress.

[jameswalter]

QUOTE(kday @ Dec 16 2005, 10:27 PM)

The dump worked fine with my NEC ND-3500A.

I assume it may not work with some DVD drives depending on the make and firmware and such.... just speculation.

Wow....coincidence...I also have a 3500A.


Edit: I was able to complete the dump.  Qwix won't open the file, but UltraISO will.  It shows the Video_TS folder but all of the data off the disc was dumped.  I tried the program they had on that website but it may only work for 360 ISOs.

[Gerjan]

here is the working link

http://gueux-forum.n...21

[kday]

Ok, so this hotswap method works.

Now what I am thinking is could we use a hotswap method to get a game backup to run?  For starters, could we make a copy of an original XBOX 360 game, and try to force the 360 to run the backup after the disk check and launch of the .xex file is made.

I know it's pointless to run a XBOX 360 backup of a game you already legally own, but it would be good research.

I do not have a 360 yet, and have been using my roomates.  I am not going to try this myself because it's not my XBOX.

Somebody correct me if I'm wrong.  No flaming.

[bowser22]

Has anyone tried this with a Hitachi-LG drive?

[t_mac_ca]

Sweet so this method of ripping the games actually works.

[Monoxboogie]

QUOTE(Arakon @ Dec 18 2005, 02:14 AM)

hotswapping is not and never will be possible, since the executable is checked for a valid signature before running. since the signature is actually part of the executable, there's no way to swap.
that only works for protections like the ps1 and ps2 has, a single check on boot time.

Hmmm...I like.  It's an insane venue of attack...

Boot a game.  Wait for the spin down to occur at a place prior to the loading of media.  Insert a malformed disk with a similar TOC, only pointing to some sort of bad data.  When the Xbox finishes what it has in RAM, and pages the DVD for the media to play, BAM!  Malformed media file causing nasty things to happen.

Chances of successful exploitation:  Low.
Modification to Xbox required to execute:  High.
Chance MS would have considered such a venue of exploitation:  Low.

If I were absolutely insane, and owned an Xbox, I'd give it a whirl.  Of course, it'd take a deep understanding of the flow of execution of the 360.  One would have to know what routine handled the loading of the media, as well as what (if any) garbage data made it do it's bidding.

I've read a few hundred piss poor ideas as of lately.  This idea may only seem "good" to me by comparison.  At least I'm trying to do a bit better than 90% of the ideas.

[cjack]

Mmmhh, just ripped KingKong with the swap method. CloneCD created a 7.61GB iso image. Checked the iso using an hexeditor and contains a lot of data. Opening the iso with DaemonTools or MagicISO i can see only the directories VIDEO_TS and AUDIO_TS....but I think that x360 data are really in the iso.... Will be nice to see if the rip works but no modchip yet to try  

[Tiros]

Here's an idea:

Maybe just put a little switch on TrayIn/TrayOut so the drive can't detect the drawer has been opened.

[MaTiAz]

QUOTE(Tiros @ Dec 18 2005, 06:23 PM)

If the signature is indeed part of the executable, than why is the signature not copied when the executable is extracted?

It is copied, but since media checks prevent it to run on other media than genuine X360 disks we need to patch the media checks thus invalidating the signature. The media checks involve the part of the file which is signed and changing the media checks would break the signature resulting in Xbox not executing the code.

[DivyX]

Hiya, Noob here posting for experts i guess, sorry about the super long post also.

I was going to try this dump method with linux, fedoracore 4 to be exact.
If someone has done it with "readcd" "cdrecorder" "xcdroast" or whatever you could post some insight a.k.a command lines and additional tricks.
Preferred way would be just to use linux own command line tools.

I played so far like this:

***********
[root@axx-xxx-xx-xxx ~]# readcd -noerror -nocorr retries=0 Read  speed: 11080 kB/s (CD  62x, DVD  8x).
Write speed:  2770 kB/s (CD  15x, DVD  2x).
0:read 1:veri   2:erase   3:read buffer 4:cache 5:ovtime 6:cap
7:wne  8:floppy 9:verify 10:checkcmds  11:read disk 12:write disk
13:scsireset 14:seektest 15: readda 16: reada 17: c2err
18:readcd 19: lin 20: full toc
Enter selection: 0 (0 - 20)/<cr>:11
Capacity: 87104 Blocks = 174208 kBytes = 170 MBytes = 178 prMB
Sectorsize: 2048 Bytes
Ignore disk size? yes
Copy from SCSI (0,0,0) disk to file
Enter filename [disk.out]: /mnt/dvd/mybackup.whateverextension
Enter starting sector for copy: 0 (0 - 9999999)/<cr>:0
Enter number of sectors to copy: 10000000 (1 - 10000000)/<cr>:
Enter number of sectors per copy: 64 (1 - 64)/<cr>:
************

My noob logic with these commands were:
-noerror so readcd won't stop when error is read ( obviously often past the normal dvd sectors? ).
-nocorr for no error correction which i'd imagine would be good option?
retries=0 so it won't try the default 128 times to retry when error occurs thus speeding the process vastly
that is still "very" slow.

"In program" options are obvious i'd guess, but whatabout sectors? I can check how many sectors the dvd video section takes and start after it or from the beginning. 10million sectors to copy with the current speed takes like a week very wildly guessed.
Well, with these options it creates a whatever file you have told it to create. I dumped 180mb from pdz disc or did I?
The good question is did it just write the whole file full of nothing, zeroes, air? I haven't been able to verify if there is written game data as the process is slow. The dvd video section data certainly seems to be there but past it i don't have a clue yet. I don't know from what sector forward the actual game might exist etc. Readcd's output still lists errors for every sector like theres no tomorrow but atleast it does something  

So as theres prolly many who have done this with linux somehow, let us know.
Please do note that the readcd example isn't taken when pdz is mounted.

[DivyX]

QUOTE

Can we shut this shit down already??

Hehe. you wish, i find all alternatives instresting.
FYI we also have many modchips to choose from these days, they actually differ even though doing same concepts.