I'm not real familiar with the kernel that MS uses on the xbox 360, but I am however familiar with other kernel programming on operating systems. Based on the information I have read in this thread, it looks to me like if anything leading to the mod would be a strike factor. Not just one thing but maybe more than one? For instance it is logging when the xbox 360 is put into "Mode B", and it also only logs changes made to firmware on the drive, and uses a validation system to authenticate MD5 sums created by the dvd firmware. The kernel can read the dvd drive, disassemble the firmware of the dvd rom, create checksums and send them back to MS for validation, if it is a blacklisted code then you get banned. The people who haven't been banned probably hasn't had their dvd drive checksums analyzed yet, or they never was put in mode B, which would trigger off this entire process to begin with. I really don't see why everyone wants a theory to this, its Microsoft ffs!! They own the original firmware, they host xbox live, you agree to their terms and conditions when purchasing, and they can pretty much do anything under the son with it since it has remote authorization from xbox live to do so. Its just like running VNC the way I look at it. The best and most logical way I can find to avoid a ban would be some way to intervene the network traffic being sent to and from the 360, and to modify the packets so that log files containing data that could result in a ban can be automatically replaced with data that is known to be good. This would probably just mean hooking your 360 to a computer, the computer to a router, the router to the net. A simple program will run on the computer to detect packets with certain contents and then re-shape that packet so that it reaches Xbox Live or the 360 in a different manner. (i.e. Xbox Live requests Log A, Log A has a checksum that will result in a ban. The xbox sends back the packet to the computer, the computer sends back LogB to Xbox live. LogB being the log that has been modified to fool Xbox Live into thinking everything is running perfectly fine.. This would also work the opposite way around, shaping the packets going from Live to the 360. So if Live sends out a code that will force the 360 into performing a danger action that could result in a ban, then the packet can be re-shaped in a way that the 360 can receive no response, and the computer send a fake reply back saying that it was successfully completed and everything is fine. ) I hope this all didn't confuse everyone, i'm mostly just saying the only way to know for sure is to start sniffing the packets going to and from a xbox 360 and analyzing to see which specific packet resulted in a ban. This is probably too much work, because nobody wants go get banned. However, it also would be possible to read the eeprom off the chips inside the xbox and create some asm dumps to compare banned boxes with same specs to those of unbanned boxes with same specs. ---Very sorry for the long post, just 2cents take it for what its worth
