Print

[theurn15]

Some news from Geremia over at XBOXHacker.

Got a drive as gift for testing (thanks Raiden)

Some small update:

it's an embedded spi flash, exactly an MX25L2005 and dosflash1.6 can write it.
The bad is that you can access it only if it's completely erased, this seems to be the "check module" mentioned into the patent

About reading the fw, i can just get 3-4 256bytes chunks in a tricky way, but can't have a complete dump this way.

reading dvdkey: ok
reading unique drive data: ok
erasing flash: ok
writing flash: ok
reading flash: missing

[darkshadow2k8]

thats good take your time no rush its always good to move one step at a time im sure very soon we will be flashing this drive in no time

[m3kal]

i cant find the update info on there site?

*** ok found it!***



This post has been edited by chorizo1: Sep 17 2008, 02:26 AM

[sha]

No Dump of Firmware = no hacked firmware.  Its nice to know you can write it.  Now we just need to figure out how to dump the firmware.  We can read the keys but not the firmware.  So the question is how do you get a full dump on the firmware.

[moreniu]

Well, still a huge progress, if it is flasheable we won't need to replace the drive or wait for some kind of modchip, geremia ftw!

[vcs1988]

i think this is awesome news.. i just hope they can actually get a full dump.

i'm new at this... but i have been reading and this is really big..

now we just need a firmware.

no rush.. take your time.. i would like to have it already... but its not like that, so.. take your time.

[Bazdoctor]

Liteon Drive Is Flashable Update = Very misleading topic name

[Antman1]

true I dont think this needed it's own topic since we knew if we erased the flash it could be written.  According to the patent.  but we cant dump the drive so we cant do anything to the firmware.

[devz3ro]

To make this work right now you should only need one dump of the same version firmware via an external programmer. If this drive is anything like the benq & you are able to grab the key and drive serial information, you are already golden.

Take Johnny's dumped firmware, hack it, replace Johnny's key & drive serial information with Bob's, and then erase and flash the newly created firmware to Bob's box. I don't see why this wouldn't work but I've been away from the scene for quite some time...


-devz3ro

[Antman1]

QUOTE(devz3ro @ Sep 17 2008, 03:01 PM)

To make this work right now you should only need one dump of the same version firmware via an external programmer. If this drive is anything like the benq & you are able to grab the key and drive serial information, you are already golden.

Take Johnny's dumped firmware, hack it, replace Johnny's key & drive serial information with Bob's, and then erase and flash the newly created firmware to Bob's box. I don't see why this wouldn't work but I've been away from the scene for quite some time...
-devz3ro

problem is what we get for spoof info and key dumps is not the full firmware.  it is only snips.  Only key and spoof info.  No one has been able to dump the drive yet.

[ghost_recon88]

QUOTE(Antman1 @ Sep 17 2008, 04:38 PM)

problem is what we get for spoof info and key dumps is not the full firmware.  it is only snips.  Only key and spoof info.  No one has been able to dump the drive yet.

Right but what he's saying is we only need 1 valid bump, then everyone else is set. Everyone can download that copy of the dump, insert their own key and spoof info, then flash their drive.

[XmodsUK]

That only works till Lite_on tweak the FW, then everyone will erase their FW v1.2 and flash over it with V1.1...dead drive.

[ghost_recon88]

QUOTE(XmodsUK @ Sep 17 2008, 06:33 PM)

That only works till Lite_on tweak the FW, then everyone will erase their FW v1.2 and flash over it with V1.1...dead drive.

Well then they'll dump that the same way they dump v1.1  (IMG:style_emoticons/default/wink.gif)  Only time a whole new dump method has to be developed is when its a completely different model drive, and even sometimes then old methods work. It all depends on where the flash ROM is stored and how it is accessed.

[mondoman22]

Hey all,
   I am new to this forum but i am not new to computers and security...
I have read about this Liteon drive.. watched all the posts and you know
it went from being unhackable to dumping the key and now being able to write
to the rom. A bunch of people said it is not flashable well looks like it is..
My point is that There are no levels of security only levels of Insecurity.
It just takes time... There are alot of talented people here that are working on this
it seems and believe me if it is engineered it can be reverse engineered if not
why would they cut the soldered traces for the tx and rx why would they put epoxy around the
chip.. to all the people that said it can't be done I think you need to re evaluate what you have said...
They would not have gone to all that trouble if there wasn't a weakness... I applaud the guys doing this
i wish them luck and if wasn't for the few working on this we would not be we were are with this system
 I am off my soapbox now...

                     Have a good one
                        Mondo

[theurn15]

QUOTE(Bazdoctor @ Sep 17 2008, 05:37 PM)

Liteon Drive Is Flashable Update = Very misleading topic name

(Liteon Drive Is Flashable Update = Very misleading topic name)=you didn't read about the hackabillity
of liteon drive in the internet.
if you enter the following line in google: "liteon xbox  masked rom"
the results will be many essays written by experts who say that the liteon drive is not flashable because it's not writable at all, thats because it has a masked rom that cannot be accessed or written at all.
so when geremia says he can write,erase and partially read the flash I think it's agreat progress