Print

[XBoxgeek]

WOW thanks for the link. That's a nice app. It stripped the skin.xzp in a few seconds where it took me about 10 minutes by hand LOL.

May just buy that so I can get rid of the 30 file limit.  

[skyypunk]

well i quick made an app that will extract pngs from the files (though slow at the moment, as it goes through the file byte-by-byte...)

Feel free to use it...maybe i can work on making it faster

Requires .net 1.1
Img Extractor



let me know if you have any problems with it

[psychstar]

I have put together a trial at a Theme file. But I am to cheap to by a memory card. Is there someone that knows how to configure the hwdb.ini file and add be able to take pics if possible of them on the guide. If so let me know and I can email you the file. I will only be sending it to a couple of people that are respectibale in what they have put toward the disk effort. If so let me know.

PsychoStar

[skyypunk]

well i have a version thats running *significantly* faster now...however i have a few more things to do to it (instead of reading the file byte by byte, i am taking big chunks of it...however that causes data to be split, so i have to piece it back together)  probably by tomorrow night i should have it to you

[Chris_F]

QUOTE(skyypunk @ Jan 2 2006, 09:19 PM)

well i quick made an app that will extract pngs from the files (though slow at the moment, as it goes through the file byte-by-byte...)

Feel free to use it...maybe i can work on making it faster

Requires .net 1.1
Img Extractor



let me know if you have any problems with it

Yeah, it's extremely slow, even on my 3.8GHz PC...  

I take it you programmed this in VB .NET because only VB is this god awful slow when it comes to file I/O.

I once did a test to compare VB to C++ in speed so I made a program that simply XORed every byte in a file. My C++ app was at least 20x faster.

If you'd like, you could send me your source and I could translate it into a super fast command-line based C++ program. EDIT: N/M, it would be faster to write it from scratch.

[skyypunk]

try downloading it again...new version 1.2...MUCH faster (about a minute it takes now for the skin file)...i havent had problems with it...but let me know if it runs faster for you all too

Version 1.2:
ImgExtractor (requires .Net 1.1)

Change log:
*Speed improvements

Bugs:
*problem with end of file (i think i might be cutting off a byte or so)  will work on that tomorrow...it only effects the image if its the last data in the file...

[jizmo]

QUOTE(skyypunk @ Jan 3 2006, 08:28 AM)

try downloading it again...new version 1.2...MUCH faster (about a minute it takes now for the skin file)

Terrific work, man.

Now just make it remember the exact places and lenghts of files extracted and add an option to replace the PNGs with modified ones.

[RadiatedAnt]

I forsee this disc is yet another coaster

[Caballero2005]

QUOTE(skyypunk @ Jan 3 2006, 07:28 AM)

try downloading it again...new version 1.2...MUCH faster (about a minute it takes now for the skin file)...i havent had problems with it...but let me know if it runs faster for you all too

very nice work man, soon we have customized Kiosk Discs

Btw: here are the Filenames for the 12 extracted files from skin.xzp:

CODE

A-Button-32x32.png
A-Button.png
B-Button.png
disabled-Button.png
X-Button.png
Y-Button.png
img-br-Games.png
img-br-Hardware.png
img-br-Media.png
img-br-XboxLive.png
ico_32x_error.png
glass.png

you can use it in the .ini files referencing like this (gamedb.ini):

CODE

IconPath=app:\ico_32x_error.png
BannerPath=app:\img-br-Hardware.png
ImagePath=app:\img-br-XboxLive.png

or in the kiosk.ini everywhere for imageX, XXX_ImagePath, XXX_IconPath= app:\...

And there is a hell lot more to play with for example the scene-files which are set by the path-command in kiosk.ini like this:

CODE

[Pictures]
; section to configure a generic scene
Path=generic2.xur

And here are the .xur´s available:

CODE

skin.xur
202_GameDetails.xur
206_GameSearchGenre.xur
208_GameSearchResults.xur
210_GameInfo.xur
212_LegalDisclaimer.xur
214_FamilySettingsMenu.xur
216_LegalDisclaimer.xur
218_DownloadProgress.xur
402_HardwareDetails.xur
230_HealthWarning.xur
Generic1.xur
Generic2.xur
Generic3.xur
SystemSpecs.xur
WhichSystem.xur
kioskmain.xur
video.xur
errorscene.xur

have Phun playing...

[Caballero2005]

QUOTE(psychstar @ Jan 3 2006, 03:52 AM)

I have put together a trial at a Theme file. But I am to cheap to by a memory card. Is there someone that knows how to configure the hwdb.ini file and add be able to take pics if possible of them on the guide. If so let me know and I can email you the file...

It should be no problem to replace this in the hwdb.ini-file :

CODE

[Entry]
Category=2
Title=MyTheme
Description=My personal Theme\n\n(Press the Y-Key on the controller, to download this theme.)
IconPath=game:\images\htn-fpwoodie.png
ImagePath=game:\images\mta-hw-fpwoodie.png
DownloadItemPath=game:\items\mytheme

But i am not sure if the theme-files in the itemsfolder are really unsigned or without some hash to prevent tampering on them... the five orginal themes (flames, hotrod, silver, sun, woody) work as expected and after copying to the memorycard the can be moved to the harddisk via Dashboard. The new ImgExtractor Tool here extracts some of the pngs but not all correctly. Only the first seems to be a png (guidetile.png) the others (wallpaper1-4) extracted do not work. Since it is a PIRS File as mentioned on another post maybe this simply doesnt work anyway...

[Caballero2005]

QUOTE(skyypunk @ Jan 3 2006, 04:53 PM)

it appears to be grabbing parts of the images, then messing up the remainder for larger images

True i was testing imgextractor on the theme-files in the items folder... but as mentioned before, we can extract the images and maybe inject modified ones back... but to get the whole thing working theres a lot more to do, and since its a PIRS-File it has a signed hash in the headers of the file which most likely dosnt allow us to change the files and copy them to the memorycard via the copy-command in hwdb.ini (DownloadItemPath=game:\mytheme).

Btw. you can init the copyprocess by changing a button in the kiosk.ini to:
Button1_Action=DisplayScene
Button1_ActionParams=DownloadProgress
and inserting a new command like this:
[DownloadProgress]
Path=218_DownloadProgress.xur but since there´s no path to copy from it says "Can not copy to memcard..."

maybe someone can try a little more in this...

[PedrosPad]

QUOTE(XBoxgeek @ Jan 3 2006, 06:28 PM)

Yeah I saw this issue when I extracted by hand (So it is not skypunk's code )

The best skin to test is Hot Rod. Out of the 7 images in that theme the first 6 extract okay and the 7th has the bottom cut off.

Now I am not sure why this is as the whole image is extracted. I get a filter error when trying to open the corrupt images. I would post screen shots but if you extract thme you will see what I mean.

The free60 article  also says "The hash entry in each struct is an SHA-1 hash of 4096 bytes starting at 0xc000.

If there is not enough room between 0xb000 and 0xc000 for the entire table, the table continues at a different place in the file. The mechanics of how this relocation is stored is not yet known. "

This could be causing the contamination of the 7th image - the furthest down the file!

It could be
| SHA1 hash | 12x4k blocks | SHA1 hash | 12x4k blocks |, etc.  Could be the first 6 images all fit within the first segment, and the 7th spans into a new segment.  (all actual numbers made up for illustration).

[XBoxgeek]

Okay I have been looking at the images that I extracted from skin.xzp and just having a general nose around and I am sure there are functions available to us on this kiosk disc that we have not found.

I think that MS made a general purpose demo xex that can do a lot more than we have found out. What I mean by that is there are images for:-
DownloadTrailer.png
copyvideo_64.png

Also in the string section regarding the mem unit where it says download Item, Copy this item to your memory unit, Your memory unit is full etc. There is a string called Copy Video.

Now it may mean nothing but I would not be surprised if there was an ini file entry that allows small video clips to be copied to the mem unit.

Not sure how to find out what that command is mind you or even if it exists, but nevertheless I found it interesting that there was an image and string reference to it.

Cheers

[Caballero2005]

QUOTE(XBoxgeek @ Jan 5 2006, 12:03 AM)

Now it may mean nothing but I would not be surprised if there was an ini file entry that allows small video clips to be copied to the mem unit.

As far as i could see in all the strings in default.xex, kioskmain.xzp and skin.xzp i think are only theme-related for copiing them to the memcard. As mentioned in a post earlier there are some more scenes which can be activated by the DisplayScene-command in the kiosk.ini. Sometimes this works, sometimes you receive the "Disc is dirt or wrong region" message. You can reference all demos, videos, and images by game:\ or d:\ and the integrated ones in kioskmain.xzp and skin.xzp by using app:\ and the corresponding names found via stringparse with a hexeditor (you have to filter all the x00s between the characters). That seems more or less everything thats possible with the kioskdashboard. I have tried mostly all combinations of other pathnames (a through z, hd, hdd, usb, flash and others), but they either dont work or getting you to the "Disc is dirt or wrong region" message...

so by now all you can do is a nice little KioskDemo which is showing various selfmade images, texts and playing wmv/wmv-hd videos.. playing the kingkong, hexic, kameo and Cod2 demos, showing some simple flashanimations... and copiing the five available themes to your memcard... thats it!!!

Maybe the shaderprogramming leads to somewhere new... (bit frustrated right now after burning a hell lot of cds/dvds...)

[ymgve]

QUOTE(Caballero2005 @ Jan 5 2006, 02:24 AM)

As far as i could see in all the strings in default.xex

How do you see strings in the xex files? All I've seen is a few at the start of the file, the rest seems to be encrypted.

There is now documentation for the .xzp file format up at http://www.free60.org/wiki/XZP - I'm able to extract all files from kioskmain.xzp and skin.xzp. They have no signatures, so they are an easy target for experimentation. So far I've found the .xur files inside to be a bit interesting. They seem to contain the layout for the system in some flash-like vector format.

Through a bit of shotgun editing I've so far been able to create two effects - one where seconds after I boot the disc it returns to the dashbord, but without any of the standard messages. The other is that I've managed to push a lot text and button icons on one screen into the top right corner.

Since the format is probably quite limited I don't think there's much of a possibility for direct exploits, but it's a start.

Also, to those of you who have experimented with downloading the themes, have you tried pointing the DownloadItemPath to something else than the theme files? Would be nice if that command could be used to dump any file, maybe even flash memory?