Print

[Sord_Fish]

QUOTE (mgillaus @ Sep 23 2004, 02:22 AM)

i was wondering how this disk would be made being both video and xbox data, and interestingly enough, i popped the disc into my pc's dvd drive to have a look at the easter egg on there and you can see the default.xbe and the dashupdate.xbe files on there, in your normal pc dvd drive. now i wonder why that is? it'll be signed with the ms code but i wonder since it can be read in the pc if there would be a way to rip it off the disk and reburn it without losing the digital signature.. (kinda pointless seeing as how its like only a demo and all, but still interesting)

You need to copy it 1:1 and see if it boots  

[HSDEMONZ]

Interesting.. as we could be on the threshold of yet another modchipless exploit?

Anyone got those flags yet?

[Angerwound]

If I'm not mistaken, the xbox boots it's TOC from the 2nd layer of the disc rather than the first as a normal dvd movie would. Therefore, this either has TOC's on both layers allowing it to be read within both a DVD Player and XBOX, or the xbox can boot even games from the 1st layer TOC. If anyone actually owns this send me an email or PM.

[Rickz0rz]

QUOTE (Angerwound @ Sep 23 2004, 02:52 AM)

If I'm not mistaken, the xbox boots it's TOC from the 2nd layer of the disc rather than the first as a normal dvd movie would. Therefore, this either has TOC's on both layers allowing it to be read within both a DVD Player and XBOX, or the xbox can boot even games from the 1st layer TOC. If anyone actually owns this send me an email or PM.

Even if it can only boot from the second layer, with the influx of new DVD recorders entering into the market that can record dual-layer discs, I feel we might have something very very interesting on our hands here.

[Gumba]

[Kthulu]

QUOTE (Sord_Fish @ Sep 22 2004, 08:25 PM)

You need to copy it 1:1 and see if it boots

i don't see why you'd have to make a 1 to 1 copy of the disc.  stick it in you PC dvd drive.  copy the xbe on to you PC hdd.  burn that xbe onto UDF formatted dvd.  it should boot, depending on which media flag(s) was embedded into the xbe.

someone please! find out what the media flag(s) are!  this could be really big opportunity for soft-modding.  is there a scan tool we can use to find out what the media flags are?  if so, please post a link.

i've got the LD-rips, but i was tempted to buy the Official dvds anyway just to see how much Luc-ass changed...this news tempts me even further

what is the media flag for retail, dvd9 (2 layer discs)?  doesn't it equate to the DVD-ROM book type that you can set in your burner's firmware?  god, this is exciting!

[Sord_Fish]

QUOTE (Kthulu @ Sep 23 2004, 03:54 AM)

i don't see why you'd have to make a 1 to 1 copy of the disc.  stick it in you PC dvd drive.  copy the xbe on to you PC hdd.  burn that xbe onto UDF formatted dvd.  it should boot, depending on which media flag(s) was embedded into the xbe. someone please! find out what the media flag(s) are!  this could be really big opportunity for soft-modding.  is there a scan tool we can use to find out what the media flags are?  if so, please post a link. i've got the LD-rips, but i was tempted to buy the Official dvds anyway just to see how much Luc-ass changed...this news tempts me even further what is the media flag for retail, dvd9 (2 layer discs)?  doesn't it equate to the DVD-ROM book type that you can set in your burner's firmware?  god, this is exciting!

i was thinking the dvd it self might be signed some way that when the files are extracted the sign is lost.

i could be wrong but it just checks one off the list of possiblities.

[Kthulu]

QUOTE (jonny_eh @ Sep 22 2004, 08:34 PM)

Didn't Ang Lee's HULK conatin an xbox demo on the 2nd disc? Is this not as new as some may think?

i just checked and the 2nd disc of The Hulk (the dvd movie) does indeed have a default.xbe sitting on a UDF formatted disc.  so, whatever possibilities are opened here, they've actually be sitting there waiting for us for a long time

here are the contents on The Hulk (dvd movie disc 2)

default.xbe...size=124,624kb
\xboxdash\
...default.xip...1509kb
...dvd.xip...164kb
...jkeyboard.xip...716kb
...keyboard.xip...643kb
...message.xip...783kb
...settings3.xip...2743kb
...settings_clock.xip...1645kb
...settings_language.xip...1397kb
...settings_list.xip...2861kb
...settings_panel.xip...2669kb
...settings_parental.xip...985kb
...settings_timezone.xip...1340kb
...settings_video.xip...1932kb
...xboxdash.xbe...1532kb

comparing to my 'backups' of the 4034, 4920, and 5960 dashes, this is neither...
it would seem like the stuff on Hulk has a greater possibility for exploitation since it's older, but perhaps wouldn't work on boxes where kernel >= 5713

[jimmsta]

This could be a major breakthrough... I have had a feeling that there was some way to hack a dvd-video disc, to get an xbe to load up off of it... just never tried it.

I've often wondered if the DVD-Player portion of the xbox dashboard was... protected, to say the least. What I mean is, perhaps the DVD-Player portion of the program allows for all data to be read..

Actually, now that I think about it, If you play a dvd, and eject it, while using a font exploit, and the MSDASH-DVD player, (with remote, IR thingy), and then place a game dvd in it, I believe the xbox, despite the exploit, reads the game, and loads up whatever is on the dvd.

This is a great experiment to try out... just don't use the Star Wars DVD!!!

>> EDIT> I must add, that the Xbox bios naturally looks for a default.xbe before loading up anything else from a dvd. If it fails to find the xbe, it'll attempt to find other usable data, and load up the appropriate application.

IE: vob/DVD-video id = MSDash-DVD Player.
no useable data = /nothing...

A possible solution for those who want to play the Star Wars DVD on their modded xboxes....
If an xbox's bios was modified to NOT search the DVD drive for a default.xbe, then you could probably watch the Star Wars dvd on your xbox, without any ill side-effects.

-- use XBTool!!!! --

[Kthulu]

i'm using xbedump to look at the header info of the default.xbe contained on The Hulk (movie dvd).  where in all these hex numbers is the media flag located?

[Master Reefed]

* This file works like a setup.exe file kinda...unpacking and installing parts of the game,wouldnt be cool if ya could just run an XBOX app such as UnleashX straight from a DVD disc on an unmodded XBOX. no actually that would suck, its gettin too easy now, I actually had to work to figure out my Exploits ("Back in my Day, we didnt wear condems.""We SKINNED a Rabbit!""Then tied it on with barbed wire.")  
Now we got all these easy install exploits, and even now a possibly easier Xploit.

Think the boys @ Micro$oft are watching this thread? lol  

[Angerwound]

To find the media flags, grab XBEDUMP and do a 'xbedump default.xbe -dc'

[Kthulu]

thanks angerwound!

default.xbe from The Hulk; media types are...
Allowed media types       : 0x00000030
                                   : XBE_MEDIA_1LAYER_DVDROM
                                   : XBE_MEDIA_2LAYER_DVDROM

i'd be surprised if the media types for Star Wars is all that different.  i'm trying to reference these media flags with the xdk documentation and i'm not sure what they mean.

XBE_MEDIA_1LAYER_DVDROM...i assume this means any layer1 media (DVD- or +R) that was burned with a book type set to DVD-ROM

XBE_MEDIA_2LAYER_DVDROM...same thing but for DVD9 (dual-layer) media

0x00000030...is that hard-drive or what?

EDIT: ok, i think 0x00000030 is the actual media flag, but it is a mask that covers both layer1 and layer2 media.  am i right?
EDIT2: ah, thanks again angerwound (answer below). you answered same time i did my last my edit

[Angerwound]

0x00000030 is just the hex value of the bits set.

These are a few known values.

#define XBEIMAGE_MEDIA_TYPE_HARD_DISK           0x00000001
#define XBEIMAGE_MEDIA_TYPE_DVD_X2              0x00000002
#define XBEIMAGE_MEDIA_TYPE_DVD_CD              0x00000004
#define XBEIMAGE_MEDIA_TYPE_CD                  0x00000008
#define XBEIMAGE_MEDIA_TYPE_DVD_5_RO            0x00000010
#define XBEIMAGE_MEDIA_TYPE_DVD_9_RO            0x00000020
#define XBEIMAGE_MEDIA_TYPE_DVD_5_RW            0x00000040
#define XBEIMAGE_MEDIA_TYPE_DVD_9_RW            0x00000080
#define XBEIMAGE_MEDIA_TYPE_DONGLE              0x00000100
#define XBEIMAGE_MEDIA_TYPE_MEDIA_BOARD         0x00000200
#define XBEIMAGE_MEDIA_TYPE_NONSECURE_HARD_DISK 0x40000000
#define XBEIMAGE_MEDIA_TYPE_NONSECURE_MODE      0x80000000
#define XBEIMAGE_MEDIA_TYPE_MEDIA_MASK          0x00FFFFFF

[Kthulu]

so, if we took the default.xbe off of Hulk (prolly Star Wars too) and burned it onto a DVD-R with the book type set to DVD-ROM, the sucker would boot in an unmodded xbox, correct?

only problem is that default.xbe prolly doesn't load any external resources into memory (like fonts); therefore, it doesn't have any attackable/exploitable 'surface area'

hmm...here is the whole header? info from default.xbe(Hulk):
Certificate
~~~~~~~~~~~
Size of certificate                 : 0x000001EC
Certificate timestamp               : 0x3F205409 Thu Jul 24 16:47:53 2003
Title ID                            : 0x56550011
Title name                          : "The Hulk"
Alternate title ID's                :
       none
Allowed media types                 : 0x00000030
                                   : XBE_MEDIA_1LAYER_DVDROM
                                   : XBE_MEDIA_2LAYER_DVDROM
Allowed game regions                : 0x00000001
                                   : XBE_REGION_US_CANADA
Allowed game rating                 : 0x00000004
Disk number                         : 0x00000000
Version                             : 0x00000001

and here is the info for the xboxdash.xbe also contained on the Hulk (disc2):
Certificate
~~~~~~~~~~~
Size of certificate                 : 0x000001EC
Certificate timestamp               : 0x3F205497 Thu Jul 24 16:50:15 2003
Title ID                            : 0xFFFE0000
Title name                          : "Xbox Dashboard"
Alternate title ID's                :
       none
Allowed media types                 : 0x00000030
                                   : XBE_MEDIA_1LAYER_DVDROM
                                   : XBE_MEDIA_2LAYER_DVDROM
Allowed game regions                : 0x7FFFFFFF
                                   : XBE_REGION_US_CANADA
                                   : XBE_REGION_JAPAN
                                   : XBE_REGION_ELSEWHERE
Allowed game rating                 : 0xFFFFFFFF
Disk number                         : 0x00000000
Version                             : 0x10202100

is it just me, or does the stuff in red look very interesting?

doesn't this mean that this particular version of xboxdash is bootable from dvd-r with book type set to DVD-ROM...and that it would be bootable in any region?  of course, there are no font files on the Hulk, so it is still looking for those on the C drive...which would be the last obstacle to a home-made dvd that boots on unmodded xboxes and could be used to install soft-mods...