Topic: Double dashboard exploit (Read 1025 times)

Angerwound · « **on:** May 03, 2004, 07:02:00 PM »

The Double-Dash Font Exploit:
*M$'s Newest Dash UPDATE was an attempt at killing this exploit.(An update just for us, don't we feel special) Don't run Live with this exploit unless you want a pretty ERROR 21 on boot.*

OVERVIEW:

Up till now all font exploits suffered from the clock-loop problem. In short, the font hacks try to take control of the xbox on boot by having the dashboard load hacked fonts. Problem comes if the xbox has lost power and therefore lost the time. The xbox will see this on boot and try to reach the clock-setting screen. This requires the fonts to be loaded -> these have been hacked to not let xboxdash load normally -> this will in some cases cause a reboot -> clock loop! See the official clock loop thread for more information.

The audio exploit doesn't have this problem since it boots to an unmodded state and therefore can access the clock setting screen if needed. The double-dash fonts exploit tries to do the same - boot to an unmodded state. This exploit takes advantage of the fact that live-enabled xbox dashes have the 'live tab', that when pressed will launch xonlinedash.xbe from C:\xodash. Moreover, it exploits the fact that live-enabled dashboards loads its fonts from the C:\fonts folder while older dash version loaded the fonts from the root of C: Thanks MS!

By replacing xonlinedash.xbe with an old 'pre-live' dashboard's xboxdash.xbe we can therefore boot to an unmodded state by having the original fonts in C:\fonts.We then launch the font exploit by launching the old dashboard via the 'live-tab' and having hacked fonts in the root of C. If the clock needs setting we will reach the clock-setting screen, just like with the audio exploit.

The hacked fonts needed are not the same as the usual hacked fonts, since these were designed to work on boot. New fonts were needed for this new scenario, and such fonts have now cleverly been designed by rmenhal. On occasion, some users have reported that around 1 out of 10 tries they will have their xbox reboot. This is caused by thier individual kernel/dash setups and can easily be solved by following the readme file included in the package below. The tuning of the bert/ernie files is not necessary if you do not experience this however.

For those of you having trouble extracting:

1. Copy the code into a .txt file.
2. Rename to "doubledash.b64".
3. Install ICEOWS.
4. Open "doubledash.b64" within ICEOWS.
5. You should see "Unknown.001".
6. Open this file with WinRar.
7. You should now see a file named "Unknown".
8. Once again, open this file with WinRar, just as before.
9. You should now see your files.

Complete Package Available in Usual Places thanks to devz3ro!

================================================

INSTALL INSTRUCTIONS:
(Please Read Above before attempting to Install)
(All Files Needed for Install Are Located Within devz3ro's Package)

WORKING KERNEL AND DASHBOARDS.

K: This exploit will not work if your kernel version is higher than 5713. The reason for this is because this kernel will not allow for your old dash to be booted.

D: 4920 is recommended for this exploit, it MAY work with your current dash as long as it supports the 'Live Tab' and is not the newest dash supplied by MS. The very newest Dash versions will not work. If you are having problems or are unsure if your dash is compatible please downgrade to 4920.(Tons of downgrading information throughout the forums, use the Search Button.)

You are going to need a way to access your XBOX's HD. Use your preferred method or just boot a gamesave exploit of your liking. I recommend leaving it saved to your HD for future use in case you screw something up.

1. First off, when you click on the live tab it will boot xonlinedash.xbe within the c:\xodash\ directory. So let's replace it with the default.xbe from a Pre-Live dash. (already named xonlinedash within the package.) Just delete or rename the current xonlinedash.xbe and copy over your new one.

2. Next, in order for this dash to boot when the 'Live Tab' is selected it's gonna need a few support files; mainly, default.xip and mainmenu5.xip. These are needed from a pre-live dash. Again, look in the 'c' folder within the package or grab from your pre-live dash backup. Place them within c:\ on your XBOX. (NOTE: These files will only allow the dash to load far enough to boot the font files. Do not try and load the dash currently for it will give you an error 21. )

3. Enough of the dash has been copied to your HD now to boot far enough in that it will load the hacked font files. (NOTE: Pre-live dashes boot font files from c:\ - All other's boot from c:\fonts ) Your hacked font files will need to be placed within the c:\ directory within your XBOX. They are called bert.xtf and ernie.xtf. Original font hack files will not work for this. You must get them from the above mentioned package or CODE below. If XBOX.xtf and XBOX BOOK.xtf currently exist in c:\ on your XBOX, remove them or rename them to something else for backup purposes.

4. Okay, the files copied so far will Boot the old dash, load the hacked fonts, which will in turn try and boot default.xbe from e:\. The default.xbe needs to be signed with the HABIBI Key so you may sign whatever .xbe you like and have it launched or use the PBL Files within the package (Already Signed). Just copy over the files, double checking they have correct signature and are named accordingly. The ones you are looking for are located with the E\ Directory in the package. If you have a newer XBOX that incorporates the Focus chip you must use PBL 1.4.1 located in the directory of the package of the same name. Insure you have a folder named 'Bioses' in the same DIR of your PBL files (E:\) and it has a file named xboxrom.bin within.(BFM Bios of your choice.)

5. Now, if you have used PBL before you know that it boots whichever file your bios is pointing towards. In the packages case, it boots a file within 'c:\'. (evoxdash.xbe, mxmdash.xbe, xboxdash.xbe etc....) Insure the XBE is named something of this nature. Don't forget to include the support files for whatever you are launching after PBL. (XML's, INI's, SKINS etc....). This is not included in the package for it's your choice on which dash you would like to run.

6. You are finished copying the necessary hack files to your XBOX. You may power down your XBOX and turn it back on. When you boot up you should see the 'LIVE' tab just waiting to be clicked. Go ahead and select it. You should no see PBL booting, then your dash of your choice. If you do not see any of this and just recieve an error screen or blank screen review the steps and insure you copied all the necessary files to your XBOX. If it does work correctly congratulations, exploit style without the clock loop or corrupted ST.DB. Don't forget the Reset-On-Eject is still enabled so if you want to play a game or use your DVD drive at all; open the drive at the original xbox dash screen, select the 'Live' tab and after the hack boots place your disc into the drive and then play away.

Thanks to RMENHAL once again for his excellant files and devz3ro for the package!

=============================================

RMENHAL's Original POST:

rmenhal · « **Reply #1 on:** May 03, 2004, 08:46:00 PM »

Some people reported stability issues on Dashboard 4034,but the bert.xtf included in doubledash.tgz worked otherwise right away. Updating bert using steps 4-14 in readme.txt won't fix it. Instead you need to make the "landingzone" in ernie bigger or play around with header.data1len or such and try to stabilize the location of the allocated memory block.

The code section below includes an ernie with a huge "landingzone". You could trim it down by running steps 4-14 several times. Keep two berts: the one with the smallest dword at offset 0x40 and the one with the highest dword. Then you need to make the "landingzone" big enough so that it touches both of these. Optimal would be to put the higher value to bert at offset 0x40 and then make NUMJUMPS in ernie.asm equal to (highvalue-lowvalue+2)/2, but you will probably want just a bit larger on both ends. In case the dwords at offset 0x44 are different from the others in some of the berts you saved, then you can't make it work stably.

Ok, on my setup: I now trimmed down the Dash 3944 install and ended up needing only the files default.xip and mainmenu5.xip in C:\ with xboxdash.xbe copied to C:\xodash\xonlinedash.xbe. The value in bert at offset 0x40 changed a bit, though. The 8 bytes are now 48 00 5A 00 40 1D 03 D0. Thus, the location of ernies memory block got a bit lower, which is reasonable.

mkjones · « **Reply #2 on:** May 04, 2004, 01:56:00 AM »

I love it when something like this happens in the scene

Well done everyone involved!

evil clone · « **Reply #3 on:** May 04, 2004, 02:14:00 AM »

this is alwsom.... now i just need to come back home and fig out how to extract it... i must be doing somthing wrong

peace

EC

mkjones · « **Reply #4 on:** May 04, 2004, 03:12:00 AM »

OK, wanna try this when I get home, I think I can get 4034 from Slayers 2.4 (confirm

) but what are the LEAST ammount of system files I need in my C root?

I have 490 so most of the system files are in the xboxdashxxx folder I belive its well known that I can just copy the needed files from this folder, therefore all I will need is the xboxdash.xbe from 4034 in my xodash folder...

Any help would be

ldots · « **Reply #5 on:** May 04, 2004, 04:45:00 AM »

ldots · « **Reply #6 on:** May 04, 2004, 05:03:00 AM »

OK - some more test results, and unfortunately not as positive as yesterdays results.

Yesterday I did some testing on an old 4034 kernel xbox, using dash 4034 as the xonlinedash.xbe replacement. The double-dash exploit worked fine using the font from the original post from rmenhal. A did get a few reboots however. As rmenhal suggested one should play with the size of the "landingzone" of ernie (the big block of jumps). Just using the big ernie from the post above did however work for this xbox. No reboots from 15 tests.

Just now, I tried the exploit on a 5101 kernel xbox. Same dash-files were used as on the old xbox. Usin the original (small) ernie the exploit did work occasionally, but wasn't as stabil as on the old xbox. Did the probing/tuning of bert as explained in the readme. Had no effect on bert. Tried using the huge ernie from the post above. This seemed to make the exploit more stabil, execution time is slower than on the old xbox (also using big ernie). The green web becomes visible before the hack executes PBL. What is the problem though is that everytime the exploit does work, and loads a hacked bios using PBL and reached my dash (xbmc in my case), the xbox resets on eject!. This is not due to the hacked bios not being configured correctly, because launching the audio exploit, using the same PBL and bios, the xbox doesn't reset on eject. I can only think of two explanations :
1) MS has foreseen the possibility of hackers using the xonlinedash for exploits, and have made these newer kernels set the "reset of eject" flag not only when launching games from DVD but also when launching xonlinedash.
2) Ernie is causing this and should be modified.

I dont see how 2) could be the explanation though???

Please, anyone else with a 5101 kernel try this exploit and report back.

rmenhal, any idea if this exploit will only work on pre 5101 kernels ?

Edit : Just tried skipping the PBL step and loading evox directly from the double-dash exploit. It still reboot on eject???
Also retried this on the old xbox (kernel 4034). Same thing - reboot on eject!!!
Please try ejecting when you have this exploit running somebody! If its not just my setups, this would be a blow to this exploit!!!

This post has been edited by ldots: May 4 2004, 04:56 PM

Chicken Scratch Boy · « **Reply #7 on:** May 04, 2004, 06:34:00 AM »

uh...did i miss somthing?

anyway why not 4920 dash?

edit: read some of the other thread, can you maybe explain the theory, and operation of said exploit?

This post has been edited by Chicken Scratch Boy: May 4 2004, 01:37 PM

{later} · « **Reply #8 on:** May 04, 2004, 06:42:00 AM »

sounds nice, but I dunno what to do after I get the file called unknown.001

I unpack that file with winrar and then I get a file called 'UNKNOWN'. Without any extension

What I think what happens:

Xbox starts with 4920 dashboard, so with the xbox live button.
When you choose xbox live, it will load the 4034 dashboard with the bert and ernie fonts, and so it will load phoenix+evox.

This way you will never have any clock loop again, cuz you load an original dashboard

Angerwound · « **Reply #9 on:** May 04, 2004, 07:12:00 AM »

Once again open that file with winrar and you should see the files.

Code-X · « **Reply #10 on:** May 04, 2004, 07:37:00 AM »

Amazing, Works like a charm

My Xbox Details
v1.4 - PBL 1.4
K:5101
D:4920

Exploit Dash is 4817, Had to do the config thing to reset ernie for it but it works.
Great work to those who made this.

zorxd · « **Reply #11 on:** May 04, 2004, 08:54:00 AM »

What I have :
1.3 Xbox
k:5101
d:4920
d2:4817
pbl 1.4.1
audio exploit that load an other pbl (for security reasons)

pbl 1.4.1 as e:\default.xbe habibi signed

After I load PBL with the audio exploit and then launch the MS dash 4920, the exploit seems to work (but the kernel is moded)

But when I click on "xbox live" BEFORE loading pbl with the audio exploit, it reboots
I've tried both big and small ernie.xtf

I did the trick to modify bert.xtf (but was modded when I did it)

Maybe my bert.xtf doesn't work?

edit: Dash 4817 loads if I disable bert and ernie on C (so it's MS signed)

This post has been edited by zorxd: May 4 2004, 04:24 PM

Grospolina · « **Reply #12 on:** May 04, 2004, 11:50:00 AM »

I'm glad someone was able to get the double-dash idea working. It's nice to see progress. However...

ldots · « **Reply #13 on:** May 04, 2004, 12:24:00 PM »

Oh boy! So indeed the "reset on eject" flag is set when launching xonlinedash. I expected that, but am glad you can confirm this Grospolina.

This is still a major progres though, and maybe it can be perfected by adding code to ernie as you suggest.

I would expect a reset when the tray is halfway out like you get when running PBL from xonlinedash. When running evox directly, without PBL, the xbox resets imidiately when pressing the eject button.

Though not perfect, this exploit can still be used for running backups though as the exploit can be executed with the tray left open before hitting the 'live-tab'.

Also as I suggested on the original double-dash thread, someone with a 5713 kernel should check if an older dash can be executed from the live-tab (just with original fonts initially). It's not entirely impossible the this new kernel only check for the right dash-version on bootup, but not on a subsequent lauch on xonlinedash.

Code-X · « **Reply #14 on:** May 04, 2004, 12:27:00 PM »

Halfway then reset.
Nice that the Author included the ASM Source to bert, ernie, st.db and the offset finder, should be much more simple to edit and fix reset on eject.

Author Topic: Double dashboard exploit (Read 1025 times)