Print

[Xbox-Scene]

Samsung DVD Firmware Hack for Original Xbox Out in the Wild, Xbox360 WIP-- Posted by XanTium on April 25 23:52 EST
In fact, Commodore4Eva released it a few days ago already, but I was waiting for the smart guys on the xboxhacker.net forums to confirm the hack as real. The hack seems to be done a bit differently than the original (unreleased) Xbox1 hack by TheSpecialist (which was for the Hitachi-LG GDR-8050L drive) and as this modified Samsung SDG-605B firmware requires raw dumps, some patching and expensive DVD-DL recordable discs it took some time to be confirmed working. Commodore4Eva already released a firmware for this drive before, but it wasn't working correctly... this 2nd version however has now been tested and it looks like it's working.
From Commodore4Eva on xboxhacker.net[keep thread clean - technical posts only plz]:

Cracked Samsung SDG-605B/616T/616F Firmware for Xbox 1 v2
What's New:
* Totaly re-done to read security sector from image, will now work with all games and xbox live.
* Security sector moved to image
* Security sector now read from  PSN $fd021e (originals) AND  PSN $f9fa00 (backups. This is the next sector after end of xbox game data.)
* Patched read sector routine to work with originals and backups
* Patched debug cdb command (FF 66 05 or FF 06 05) for bank 0 rom checksum check to return original bank 0 rom checksum. Possible xbox live checker
* Extra debug cdb command found to unlock drive without any challenge response (FF 08 01)

Tested with unmodified xbox with copy of Halo 2 made using hot swap technique, clonecd, original dvd size was psn 30000-FCxxxxx. Added security sector to image with hex editor at psn f9fa00
Don't forget to include per game security sector into image. If need be, will post firmware to easily return security sector data
This will be similar to our soon to be released xbox 360 firmware.

*Update* I released a firmware for reading the security sector data. Use only to obtain SS data from games which is $0800 in length. Send custom cdb command (from dvdinfo pro: AD 00 FF 02 FD FF FE 00 08 00 00 C0). Save data as bin file.

*Update* Status Update for the 360
Things are moving quickly, patched security sector routine. Security sector now also read from $FB04E0, this is the next sector after xbox 360 game data.
Many debug cdb commands found including the firmware checksum routine which will be patched for xbox live checker, other debug commands will be patched as they return values from disk.
Interesting that the firmware checks for version of security sector data at $065f in SS data, being 01 (xbox) or 02 (360)
Read sector routine patched to read from originals and copies. I am working on it and should be complete soon.

DVD Firmware Hack?
The hack is a modified firmware of the (original) Xbox Samsung SDG-605B/616T/616F DVD-ROM drive.
As you (should) know, all Xbox executables (XBE files) are signed by Microsoft (with a private key only MS has). This means that if you try to change anything to the XBE file, the signature will be wrong and the file will not boot.
To protect from booting raw copies of a game from a DVD-R or other recordable media, microsoft gave each XBE file a 'mediaflag'. This mediaflag tells the Xbox from which media (cd-r, dvd-r, dvd+r, dvd-rw, hdd, dvdxbox, dvdxbox360, ...) the XBE is allowed to boot. Changing this mediaflag in the XBE header is not an option as it'll break the signature of the file (see above), so ... what's done in this firmware hack is 'break' the detection of the disc.
Retail games usually get a mediaflag where they only allow 'dvdxbox' (Xbox discs - different than a normal DVD because it has some specific bad sectors etc). The modified firmware will trick the DVD drive into reporting a DVD-R (or other) as a DVDXBOX to the Xbox.

So... how does this work?
First of all you need a Samsung SDG-605B/616T/616F drive, this firmware release will only work with these drives.
Flash the firmware on the drive is easy: you'd have to open your Xbox (void warranty), connect the DVD drive to your PC (via IDE) and use the windows flasher software (MTK Win flash) to flash your drive with this modified firmware.
You also need a 'RAW' dump of an original game of your gameregion... images with ripped/moved stuff or XBE files with modified media, debug or regionflags etc. will NOT work. You can do a real raw dump by hotswapping a full DVD (a burned DL with 8,5GB of data for example) with an Xbox game after your PC drive loaded the first disc, then use clonecd and/or isobuster (for example) to dump the full data of the Xbox disc.
Then you'll have to add the SS (security sector) to the image (with a hex tool like hexworkshop for example). The SS is different for each game ... a few examples were included with the firmware release (Commodore4Eva now also released a special 2nd firmware to get this SS data yourself from an original Xbox disc by sending a special command with the drive connected to your PC). The exact position inside the image where you have to add this SS can be calculated. This SS is required and is on the 2nd layer, that's why you need to burn it on a DVD-DL. The unreleased Hitachi-LG GDR-8050L firmware by TheSpecialist works with DVD5 discs, but this modified Samsung firmware will not work with DVD5, even if the game is small enough to fit on it, it needs this SS data on the 2nd layer to work.
How to calculate the exact position of the SS is best explained by Geremia on the XBH forums:
"My big dvd (disc you used to swap with the original Xbox disc) has last sector = FCFFEF
FCFFEF-F9FA00=305EF, each sector is 2048byte(0x800 hex), so 305EF*800=182F7800 this is in hex the distance backward of the PSN F9FA00 from the end of the image file, use hexworkshop to find the right place.
BTW, it seems that this is the distance of the end of the F9FA00 sector, so the sector begins 0x800 bytes back, anyway in doubt i pasted the SS in both places."

As said above the hack will allow you to run raw dumps with MS-signed and unmodified XBE files only, so that also means the game must be of right region (as changing the regionflag in the XBE header would break the signature). Unsigned, homebrew executables would of course not work, again because signature check would fail. This hack could however help you boot a disc with the gamesave exploit which would then allow you to install an XBE exploit or flash your TSOP (Xbox v1.0-v1.5).

Microsoft and Xbox LIVE?
Can Microsoft check for this firmware? Probably (even if firmware could probably be changed to make it invisible again ... starting a cat&mouse game with MS)
Does MS check it already? Unlikely, but just like when they detect a modified bios, they will probably ban your Xbox from LIVE once the check is in place.

(Note that all info above is based on all stuff I read ... if I made any mistakes, let me know)

Download: n/a, firmwares contains copyrighted code (don't ask for it here or on XBH, we can't help you)
News-Source: xboxhacker.net[keep thread clean - technical posts only plz]

[Mr_Milenko]

Bout damn time.. now for a 360 hack... (yeah the 360 bit was sarcasm ) Good work guys seriously..

[NitroShot]

QUOTE(brywalker @ Apr 25 2006, 11:19 PM)

That's neat and all. Really, I appreciate the effort and it's great that we can still find an exploit or 2 on the original XBOX. Potentially for the 360.

But hotswapping games? No thanks. We did that with the PS2 back in the day (and some people still do it ) and it's a freaking mess. It is a step, and that's great, but I don't think that there will ever be a way to do this in a way that makes sense.

We will see.

The swapping is only required to make a RAW dump of the disc in a image which is then burned onto a DVD-DL disc patched with the correct SS (security sector).  Swapping isn't needed to boot the disc

[trigga71]

can we get this from the usual places?

[Base8]

damn, until i read the posts i missed the point and thought it was for the 360, soon i hope.  Good news though!  hope this helps with the 360.

[Lamer123]

Cool nice work  

[Probizzle]

good work guys

[trigga71]

i dont think they will bother with it as wal-mart and bestbuy arnt selling them any more so they will probley stop production on them in the next few months

[italianiceag]

I'm a bit surprised this was released on xboxhacker.net

it's funny, I was messin around with unleashx and the tap noted xbox 1 security broken, and I was like, "wtf???"

anyway, I don't get the point of saying nice job to someone who isn't going to read this...but nice job.

[running_wild]

QUOTE(italianiceag @ Apr 26 2006, 05:49 AM)

I'm a bit surprised this was released on xboxhacker.net

Why? It would seem like the most obvious place to me.

[italianiceag]

I actually stumbled across this on usenet a few days ago and thought it was just a replacement that's been posted forever now.

anyway, it came with .bin dumps of games like halo 2, gta, lotr, and mech assault.

And those asking, as of this writing, no its not on the "usual places"

the file name I have is: sdg605bv2.rar

[SniperKilla]

QUOTE(xboxexpert @ Apr 26 2006, 12:55 AM)

This is interesting.  I have a few samsung's at home...I wonder if I should flash them all

Also a question....Would there be any advantage in flashing the samsung in my modded (X3) xbox?

-xboxexpert

besides being able to play a backup on live with the x3 disabled.. no

[italianiceag]

QUOTE(running_wild @ Apr 26 2006, 05:54 AM)

Why? It would seem like the most obvious place to me.

just because all of the commotion about TS not releasing it and all the legal BS.

I figured they would report it, but not a forum member create it and release it; and recognize it was them.

QUOTE(SniperKilla @ Apr 26 2006, 05:57 AM)

able to play a backup on live

wow, it must be late, i forgot this is now possible.

how long until xbox live sucks balls?

[SniperKilla]

QUOTE(italianiceag @ Apr 26 2006, 12:58 AM)

how long until xbox live sucks balls?

i sure hope people dont post premade images.. then it will be too much work for your average halo 2 cheater

[DaddyO21]

good work , now lets work on XBox360 , then find an exploit in one of the games using the firmware hack to modify the data so everybody can run homebrew.