DISCLAIMER: THESE PROGRAMS ARE RELEASED AS IS. USING THESE TOOLS MAY DAMAGE
YOUR COMPUTER AND/OR XBOX 360 DRIVE. I TAKE NO RESPONSIBILITY WHATSOEVER.
Steps needed to flash your Xbox 360 Liteon drive:
1) Connect the Liteon drive to your computer and power it up using your 360 or
a connectivity kit.
2) Extract the drive key.
You might have to eject your drive tray and leave it half way out for this to
work on drives with original firmware.
host:~>./liteon_keyext -h
liteon_keyext v1.0 by ddl.
Key extractor for the Xbox 360 LiteOn drive (PLDS DG-16D2S).
Usage: ./liteon_keyext [options] <ATA command base> <serial device> [output dir]
Options:
-h Displays this text.
-n <times> Times to extract the key. (default: 6)
This program needs to be run as root since we are going to do port I/O with
outb(), outw(), inb() and inw().
BE SURE TO ENTER THE CORRECT ATA COMMAND BASE FOR YOUR DRIVE!
host:~>sudo ./liteon_keyext 170 /dev/ttyUSB0 drive1
liteon_keyext v1.0 by ddl.
Key extractor for the Xbox 360 LiteOn drive (PLDS DG-16D2S).
Using ATA command base: 0x0170
Using serial device: /dev/ttyUSB0
Attempting to extract the key 6 times...
Attempt 1: EE B6 XX XX XX XX XX XX XX XX XX XX XX XX C6 C6
Attempt 2: EE B6 XX XX XX XX XX XX XX XX XX XX XX XX C6 C6
Attempt 3: EE B6 XX XX XX XX XX XX XX XX XX XX XX XX C6 C6
Attempt 4: EE B6 XX XX XX XX XX XX XX XX XX XX XX XX C6 C6
Attempt 5: EE B6 XX XX XX XX XX XX XX XX XX XX XX XX C6 C6
Attempt 6: EE B6 XX XX XX XX XX XX XX XX XX XX XX XX C6 C6
Sending identify request to drive...
Sending inquiry request to drive...
Extracting serial information from drive...
DVD Label: D60XXXXXXXXXXXXA1
OPT Label: 8F2XXXXXXXXXX4XX
PCB Label: S4P8XXXXXXXXXXXX82
HW Ver : A0A1
Wrote file: drive1/key.bin
Wrote file: drive1/identify.bin
Wrote file: drive1/inquiry.bin
Wrote file: drive1/dummy.bin
host:~>
3) Patch iXtreme firmware.
host:~>./ixfw_patch
ixfw_patch v0.1b by ddl.
iXtreme (LiteOn) firmware patcher.
WARNING!! THIS PROGRAM DOES NOT PERFORM ANY VALIDITY CHECKS
AND HAS ONLY BEEN TESTED WITH IXTREME 1.51 LITEON FIRMWARE.
Usage: ./ixfw_patch <dummy file> <ixtreme file> <output file>
host:~>./ixfw_patch drive1/dummy.bin fw/ix151-liteon.bin drive1/patched_ix151.bin
ixfw_patch v0.1b by ddl.
iXtreme (LiteOn) firmware patcher.
WARNING!! THIS PROGRAM DOES NOT PERFORM ANY VALIDITY CHECKS
AND HAS ONLY BEEN TESTED WITH IXTREME 1.51 LITEON FIRMWARE.
Writing patched firmware: drive1/patched_ix151.bin
Success!
host:~>
4) Erase drive firmware.
BEFORE YOU DO THIS YOU HAVE TO BE SURE YOU HAVE YOUR DRIVE KEY SAVED SOMEWHERE.
host:~>./liteon_erase -h
Usage: ./liteon_erase [options] <ATA command base>
Options:
-h Displays this text.
host:~>
host:~>sudo ./liteon_erase 170
liteon_erase v1.0 by ddl.
Firmware eraser for the Xbox 360 LiteOn drive (PLDS DG-16D2S).
Status: 0xD0
host:~>
You should be okay if you get status 0xD0, 0x72, 0x80, 0xD1 or 0xF2.
No matter what status you get you should power cycle your drive and try to
flash it. If mtflash fails to enter vendor mode you should repeat the the
erase procedure.
5) Flash the patched firmware.
host:~>./mtflash -h
mtflash v0.1b by ddl.
Firmware flasher for drives with MT13x9 chips.
Usage: ./mtflash [options] <r|R> <ATA command base> <output file>
./mtflash [options] <w|W> <ATA command base> <input file>
./mtflash [options] <e|E> <ATA command base>
Options:
-h Displays this text.
-p <0|1> Drive position. 0 for master, 1 for slave.
(default: 0)
-d <usec> Delay (usec) before each status reg read.
(default: 50)
-l List supported flash chip types.
host:~>
Currently only writing is implemented!
host:~>./mtflash -l
Name Vendor ID Device ID Size Type
--------------------------------------------------------------------------------
MXIC/Macronix(MX25L2005) 0xC2 0x11 262144 Serial
Winbond/NEX(W25P20/W25X20/NX25P20) 0xEF 0x11 262144 Serial
host:~>
These are the two flash chips found in the PLDS DG-16D2S drive.
host:~>sudo ./mtflash w 170 drive1/patched_ix151.bin
mtflash v0.1b by ddl.
Firmware flasher for drives with MT13x9 chips.
Sending MTK vendor intro... OK!
Reading flash vendor and device ID... OK!
Name: MXIC/Macronix(MX25L2005)
Vendor ID: 0xC2
Device ID: 0x11
Size: 4 banks (262144 bytes)
Type: Serial
Writing bank 0 ................ OK!
Writing bank 1 ................ OK!
Writing bank 2 ................ OK!
Writing bank 3 ................ OK!
Flash read-back checksum (datasum): 0xEAD4
Flash write successful!
Sending MTK vendor outro... OK!
host:~>
mtflash will verify that all bytes has been written correctly. This is done
in the writing procedure.
If mtflash fails to enter vendor mode you should try to erase the drive again
and power cycle it. If flashing fails during writing you could try adjusting
the delay before status register reads (-d option).
What about other drives?
BenQ
----
mtflash could probably be adapted to support the Xbox 360 BenQ drive quite
easily since it also has an embedded SPI flash chip. Though, I would need a
BenQ drive to do that...
Samsung
-------
Implementing support for the Samsung drive would require some more time since
it has an embedded Parallel flash chip instead of a serial flash. Anyway...
Nothing is impossible...
Hitachi
-------
The Hitachi drives would require completely different methods. I think
SeventhSon has done some work in this area...
Feel free to contact me if you have any questions, comments or a spare drive
laying around that you would like to donate to science
--
irc: #xbox360tools @ efnet
Author
Topic: LiteOn flash tool for Linux (Read 184 times)