Print

[Kthulu]

i work with a guy that has a sammy in his xbox and uses DVD+R media for backups and has a LiteOn burner.  he already has his setup to burn DVD+R media with a book type of DVD-ROM.  therefore, i just handed him disc3 from my trails and asked him to make a copy of it tonight with the DVD-ROM book type.

my fingers and toes are crossed.  i'll let you guys know tomorrow what happens.

[Kthulu]

perhaps a mod can rename this topic to something like...

Hulk DVD exploit
is it possible?

[Kthulu]

QUOTE (jonny_eh @ Sep 23 2004, 02:05 PM)

Hi, I just posted the following message to the Star Wars thread, it may be relevant here too. I apologise to anyone reading both threads  QUOTE (jonny_eh) I personally don't think an exploit has been found. For an exploit to work you need to run unsigned code (meaning, without an RSA key), I believe. MA and 007 do this by loading an RSA signed game, then loading a bad savegame that holds unsigned code. An unmodded xbox won't run a hacked xbe file from any DVD, even if it's on a Hulk DVD, because by hacking the xbe file, the rsa key won't be valid. Until someone cracks the RSA encryption algorithm, there won't be a simple exploit such as this. Sorry to burst everyone's bubble. If I'm not mistaken, the RSA key is taken from the pseudo-checksum of the xbe? If that's the case, the second you change any bit in the xbe file, it will no longer be able to load. Of course, I may be wrong, I haven't been on the scene that long. Plus, I'm sure people have looked at xbox games on DVDs long before this (Shrek and Hulk come to mind). Nothing to see here, move along.

i'm not proposing to hack (hex edit or alter in anyway) the xboxdash.xbe on the Hulk dvd.  it is a a version of the xboxdash that can be run from dvd (according to the media flags).  the objective (in my mind) is to create a boot disc that basically does on dvd what we've already been doing on the C drive.  no, that doesn't really accomplish anything that hasn't already been accomplished with gamesave hacks and other soft-mods, but perhaps along the way more useful things will be discovered.  as for myself, i'd love to be able to install soft-mods on an xbox with one boot cd instead of using a game cd, memory card, and special game-save.

feel free to move along at any time jonny_eh

[kingroach]

QUOTE (Disabled @ Sep 23 2004, 08:42 PM)

@Kthulu THE purpose for doing this is not installing some softmod without gamesaves or game discs and stuff. THE purpose for doing this is virtually removing the Xbox copy protection. Imagine exploited default.xbe boots a loader.xbe then boots the game.xbe! Run unsigned code on ANY - not hardmodded, not softmodded - Xbox. An multi purpose on-the-fly exploit. You could of course still use it to softmod your box, but you would not need to mod your box at all!

lol if this happen.. all the xbox modchip makers will be out of business.. But MS can always launch xbox with new kernel that somehow disables loading .xbe from dvd-vid.

[total_ass]

yeah but then that would stop the star wars and hulk dvds from booting in xbox, which i wouldn't think they would be allowed to do.

[b01]

QUOTE (kingroach @ Sep 23 2004, 08:50 PM)

lol if this happen.. all the xbox modchip makers will be out of business.. But MS can always launch xbox with new kernel that somehow disables loading .xbe from dvd-vid.

When you think about it, this is what is happening to the PS2 scene with the advent of the HDDLoader. No need for a Mod-chip, just buy PS2 hard drive hook up,  and ther you have it.

It's kinda like is selling a 40GB Modchip, thus Sony has defeated Mod-chip makers by jumpeing into the Mod-Chip scene.  

Can't beat them, then join da club,  become club president, then kick them out!

[kingroach]

[Kthulu]

QUOTE (Disabled @ Sep 23 2004, 02:42 PM)

@Kthulu THE purpose for doing this is not installing some softmod without gamesaves or game discs and stuff. THE purpose for doing this is virtually removing the Xbox copy protection. Imagine exploited default.xbe boots a loader.xbe then boots the game.xbe! Run unsigned code on ANY - not hardmodded, not softmodded - Xbox. An multi purpose on-the-fly exploit. You could of course still use it to softmod your box, but you would not need to mod your box at all!

you just described a soft-mod...which is exactly what i'm talking about

QUOTE

Imagine exploited default.xbe boots a loader.xbe then boots the game.xbe! Run unsigned code

is that not the definition of a soft-mod?

[total_ass]

He is right ^^^^^^

That is indeed a softmod.

[Kthulu]

QUOTE

QUOTE (rmenhal @ May 19 2004, 09:17 AM) We know that kernels 5713 or higher won't allow dash downgrades. Actually - while I didn't bother to trace out the logic exactly - there's a new check in 5713's XBE loader. It checks the XBE certificate structure. If the title ID is 0xFFFE0000 (dash's ID), the kernel then checks the time and date field and anything prior to about Aug 5 2003 causes it to bail out. So dash 4920 and prior versions are out.

perhaps (if we are very lucky), the 5713 and above kernels make an exception for dashboard xbes with layer1 and layer2 dvd-rom media flags!  it would seem like a sensible thing for MS to do, in order to ensure compatibility with these files they have floating around on DVD movies...

[regress]

)

But a big downside is it can't be distributed for free (or at all really). I think looking for an exploit in the DVD-Playing software would be a nicer solution since everyone could legally download a modified DVD-Video disc with a linux installler . . . ah, but I get carried away ^^

anyways, let's keep going, see if there's any way to get it to work (though I tried to think of a way for teh starwars one, seemed impossible since it has close to no attackable surface area).

Regards,
regress

[Kthulu]

well, i've grown so obsessed with this that i went to bestbuy after work to look for a lite-on burner so i can set the book type when i burn the disc.  i think i got a great deal.  a liteon 832s...it's a dual-layer burner! that will burn to -R or +R and it was only $90.

anyways, i got home installed it. downloaded the booktype.exe and set the book type for all DVD+R burned with it to be DVD-ROM.  i then burned another boot disc proto-type.  i checked the book type after burning and it was shown as DVD-ROM instead of DVD+R.  i call this disc4.

disc 1-3: when inserted into an already booted xbox, they all gave the invalid media error.  they also gave this error when booting with the disc in the drive.

disc 4:  UDF format on DVD+R media with book-type set to DVD-ROM...
when inserted into an already booted xbox, gave the dirty disc error.  when the xbox was booted with the disc in the dvd drive, it gave the Error 21 screen that is quite familiar to anyone that has accidentally deleted files off their C drive or botched a softmod job.

This leads me to believe that the xbox is actually booting the disc, but this magic xboxdash.xbe (renamed to default.xbe) is looking for a file that it cannot find.  i feel like this is a break-thru, but now i'm stumped as to what file it is looking for.  any ideas on how to find out?

[Kthulu]

here are the contents on The Hulk (dvd movie disc 2)

default.xbe...size=124,624kb
\xboxdash\
...default.xip...1509kb
...dvd.xip...164kb
...jkeyboard.xip...716kb
...keyboard.xip...643kb
...message.xip...783kb
...settings3.xip...2743kb
...settings_clock.xip...1645kb
...settings_language.xip...1397kb
...settings_list.xip...2861kb
...settings_panel.xip...2669kb
...settings_parental.xip...985kb
...settings_timezone.xip...1340kb
...settings_video.xip...1932kb
...xboxdash.xbe...1532kb

i have taken the contents of \xboxdash\ from the Hulk and burned them to the root of every disc so far (after renaming xboxdash.xbe to default.xbe.

[Chicken Scratch Boy]

have you tried having the dash files in the folder and vice versa?

[Kthulu]

QUOTE (Chicken Scratch Boy @ Sep 23 2004, 08:52 PM)

have you tried having the dash files in the folder and vice versa?

here's what i've tried:

i put all the 4034 dash files in a folder on my PC.  i then copy the contents of Hulk,disc2\xboxdash\ (listed above) to that same folder on my PC.  when it asks if i want to over-write the files already there, i say yes.  then i rename the xboxdash.xbe to default.xbe and burn the contents of the PC-folder to disc.

now that i have the book type set, i don't get the invalid media error.  i get the MS Error 21 screen when trying to boot to the disc.

i've also tried this method starting with the 4920 dashboard files and get the same results...Error 21 screen.