Topic: Dumping The Eeprom On A Debugger? (Read 161 times)

programmingace · « **on:** May 17, 2006, 06:11:00 PM »

I have a couple of prototype xbox debuggers (see pics here: http://gamerhistory.com/hardware/XboxProto.html ). Most behave as normal debug consoles would, but one is a "true" prototype, with a custom hardware, bios, and eeprom. The case for this one lists it as a DVT-4, but it is not. Nor is it a DVT-3. It's sort of a transitional console that could be called a DVT-3.5.

My problem i have is that i can't view or dump the eeprom data for this console. The hard drive is locked and it has a custom fat table, it is not the same as a DVT-3, DVT-4, or DVT-6, as was the standard with all xbox prototypes. I would like to make a forensic backup of the hard drive, and i need the hard drive lock code to do that.

Does anyone know of any software that can read an eeprom with the debug RC4?

(just a note, not all of the information on that page is up to date, i'll correct it when i get a chance)

Pikkon · « **Reply #1 on:** May 17, 2006, 11:50:00 PM »

Can you boot up Avalaunch on your proto,I know it works fine on a DVT4 as long as the default.xbe for Avalunch is patched to debug,if it boots up it should be able to see the hdd lock code.

This post has been edited by Pikkon: May 18 2006, 06:51 AM

deadparrot · « **Reply #2 on:** May 18, 2006, 09:28:00 AM »

Use an EEProm reader to dump it if software isn't going to cut it. Then unlock it with XboxHDM.

Also, according to a link on the site you linked to, the XDK can show you the codes in the EEProm details:

(IMG:http://gamerhistory.com/images/xbox/XDK15.jpg)

This post has been edited by deadparrot: May 18 2006, 04:30 PM

programmingace · « **Reply #3 on:** May 18, 2006, 10:10:00 AM »

Avalaunch isn't returning the correct information on a standard debugger, so i have my doubts as to the accuracy it would have with prototype hardware. Either way, i can't convert the avalaunch xbe to use a debug header anyway, dexbe keeps flaking out on it.

As for the screen shots on the site, i've been able to prove that they aren't accurate. The hard drive is infact locked, the eeprom is encrypted (although i don't know if it uses the standard debug RC4 key or not), and the game reigon is actually 0x80000007. So even the xdk launcher can't read the eeprom right.

I could pull the chip and dump it, but i don't have any guarantees that i'll be able to decrypt the dump, so its not worth the risk to the hardware.

It's an odd beast from both a hardware and software point of view...

programmingace · « **Reply #4 on:** May 18, 2006, 11:17:00 PM »

Alright, i got avalaunch working on the proto... with some odd results.

It ran fine for about a minute, in which time i took a screen shot of each of the settings screens.

Then the machine rebooted on me, flashed the led orange 3 times, and threw the system fan to 100%. Basicly it went into overheat mode.

Since this system was originally designed to run a burn-in test, this seems odd. I've run the burn-in app on this system for 4 days straight without issue. I let the system cool for a half hour just in case, then ran the burn-in app for 45 mins. It ran without crashing.

I'm guessing that avalaunch did some sort of polling request on the hardware, but since the hardware isn't standard, they probably hit the overheat routine, shutting down the system. Odd, but whatever.

Good thing is, i do have the unlock code for the HD. Now to dump it. Thanks pikkon!

Pikkon · « **Reply #5 on:** May 19, 2006, 12:04:00 AM »

Also Ace,if you get that other program working and it dumps your eeprom successfully,
it will give you a text file contaning your hdd passowrd,just get the first 40 digits,dont worry
about the rest.

hargle · « **Reply #6 on:** May 19, 2006, 07:46:00 AM »

For what it's worth, I have a small app that scans through the entire smbus address range and dumps the contents of any device it finds out to a text file. With it, you should get a full dump of the eeprom, video encoder, monitor part, etc.

I can easily send it your way, just PM me if you'd like it.

atomiX · « **Reply #7 on:** May 19, 2006, 01:27:00 PM »

Glad you finally got it done ace. Be sure to let me know of anything you find out that hasn't been dumped already. I'll ask when I see you on IRC anyway (IMG:style_emoticons/default/wink.gif) . I'm sure this is far more interesting for you than the "other project".

programmingace · « **Reply #8 on:** May 19, 2006, 02:00:00 PM »

I'm still amazed by the fact that the XDK launcher is lying to me.

Actually now that i have the HD key, i'm probably going to shelf this proto until i can build myself a new desktop. Not much i can do with a laptop anyway. Plus i've seen some cool overclocking reciently... (IMG:style_emoticons/default/biggrin.gif)

Which, of course, leaves me open for other projects...

(IMG:style_emoticons/default/ph34r.gif)

hargle · « **Reply #9 on:** May 23, 2006, 08:22:00 AM »

Any news on this?

I sent you a link to my smbus scanner/dumper app, but haven't heard back from you as to if it worked or if I destroyed your machine. (IMG:style_emoticons/default/tongue.gif)

programmingace · « **Reply #10 on:** May 25, 2006, 04:17:00 PM »

To be honest, i haven't had time to try it out yet. It's not exactly something i want to play with when i'm half asleep (IMG:style_emoticons/default/tongue.gif)

I've finally learned my lesson in that respect, never play with prototype hardware after midnight.

I should have some time to play over the weekend tho. (IMG:style_emoticons/default/pop.gif)

Author Topic: Dumping The Eeprom On A Debugger? (Read 161 times)