Print

[devz3ro]

It appears our friends (hopefully if it looks for its fonts somewhere on d:\) at M¡crosoft have left us with a present. The following information was taken from the dvd movie disc "The Hulk". Xboxdash.xbe, built in july of 2003 is what we are hoping can be our possible 'bootstrap' if you will. The default.xbe was used in a proof of concept to achieve a working backup on a unmodified bios. If you are lucky enough (use original xboxdash.xbe from dashboard 4920) to find this xbe, to launch it on your xbox you must use DVD+R / +RW media and have a compatible dvd writer in your PC to be able to change your book type as shown here from DVD+R / +RW to DVD-ROM

Sorry Pioneer owners, none work as of yet.

Taken from disc 2:

xboxdash.xbe (1,568,768 bytes & found in xboxdash)

CODE

Certificate ~~~~~~~~~~~ Size of certificate                 : 0x000001EC Certificate timestamp               : 0x3F205497 Thu Jul 24 17:50:15 2003 Title ID                            : 0xFFFE0000 Title name                          : "Xbox Dashboard" Alternate title ID's                : none Allowed media types                 : 0x00000030                                     : XBE_MEDIA_1LAYER_DVDROM                                     : XBE_MEDIA_2LAYER_DVDROM Allowed game regions                : 0x7FFFFFFF                                     : XBE_REGION_US_CANADA                                     : XBE_REGION_JAPAN                                     : XBE_REGION_ELSEWHERE Allowed game rating                 : 0xFFFFFFFF Disk number                         : 0x00000000 Version                             : 0x10202100

default.xbe (127,614,976 bytes & found in root)

CODE

Certificate ~~~~~~~~~~~ Size of certificate                 : 0x000001EC Certificate timestamp               : 0x3F205409 Thu Jul 24 17:47:53 2003 Title ID                            : 0x56550011 Title name                          : "The Hulk" Alternate title ID's                : none Allowed media types                 : 0x00000030                                     : XBE_MEDIA_1LAYER_DVDROM                                     : XBE_MEDIA_2LAYER_DVDROM Allowed game regions                : 0x00000001                                     : XBE_REGION_US_CANADA Allowed game rating                 : 0x00000004 Disk number                         : 0x00000000 Version                             : 0x00000001

-devz3ro

This post has been edited by devz3ro: Oct 10 2004, 08:20 AM

[devz3ro]

default.xbe (4,063,232 bytes & found in cache drive Z)

CODE

Certificate ~~~~~~~~~~~ Size of certificate                 : 0x000001EC Certificate timestamp               : 0x3F205409 Thu Jul 24 17:47:53 2003 Title ID                            : 0x56550011 Title name                          : "The Hulk" Alternate title ID's                : none Allowed media types                 : 0x00000001                                     : XBE_MEDIA_HDD Allowed game regions                : 0x00000001                                     : XBE_REGION_US_CANADA Allowed game rating                 : 0x00000004 Disk number                         : 0x00000000 Version                             : 0x00000001

[knight_of_flowers]

***Lesser than Great anticipation***
Hope these xbes can be exploited...thanks IDOTS..didn't see the HDD flag    

This post has been edited by knight_of_flowers: Sep 23 2004, 10:52 AM

[ldots]

Good to see some new xbe finds.

QUOTE

***Great anticipation*** Hope these xbes can be exploited...no more region changes needed!

Only the xboxdash.xbe from disc 2 is multi-region but it is not HDD media flagged. The HDD flagged default.xbe is region 1 only.
But a PAL version of the game could have the same files...

[devz3ro]

Thanks LDOTS? I didn't use his scanner to find the xbe if that's what you meant. I just opened all the cache drives and manually looked.

-devz3ro

[ldots]

I know you didn't
I think knight_of_flowers just edited his post because he didn't see the lack of the HDD media flag in the multi-region xbe. Dont think he was trying to give me any credit I don't deserve  (though I some times get that)

[Kthulu]

hi, angerwound and i have been looking at the dash files on Hulk disc2 as well (see the following thread)
http://forums.xbox-scene.com/index.php?sho...ic=278283&st=50

anyway, what we were wondering is we can burn those dash files to a dvd+r with book type set to DVD-ROM and if it would present us with a 'homemade' boot disc that boots on unmodded xboxes.  my tests/failures are in that thread.  should i repost here since this is the most appropriate thread for discussion?

anyway, once we prove that we can make this boot disc work, then we can start looking at how to perform an exploit on the boot disc.  angerwound opened the xboxdash.xbe in a hex editor and he thinks it might look for fonts on the dvd if it is run from dvd and there are fonts present.  this seems like a very promising potential exploit.  am i barking up the wrong tree?

i can't change the book type with my burner, so i can't test any further.  if this has potential, can somebody try burning a UDF disc with the contents of the \xboxdash\ folder from Hulk disc2...with a book type of DVD-ROM?

This post has been edited by Kthulu: Sep 23 2004, 03:16 PM

[devz3ro]

QUOTE (Kthulu @ Sep 23 2004, 04:19 PM)

hi, angerwound and i have been looking at the dash files on Hulk disc2 as well (see the following thread) http://forums.xbox-s...ic=278283&st=50 anyway, what we were wondering is we can burn those dash files to a dvd+r with book type set to DVD-ROM and if it would present us with a 'homemade' boot disc that boots on unmodded xboxes.  my tests/failures are in that thread.  should i repost here since this is the most appropriate thread for discussion? anyway, once we prove that we can make this boot disc work, then we can start looking at how to perform an exploit on the boot disc.  angerwound opened the xboxdash.xbe in a hex editor and he thinks it might look for fonts on the dvd if it is run from dvd and there are fonts present.  this seems like a very promising potential exploit.  am i barking up the wrong tree? i can't change the book type with my burner, so i can't test any further.  if this has potential, can somebody try burning a UDF disc with the contents of the \xboxdash\ folder from Hulk disc2...with a book type of DVD-ROM?

Changing the DVD's book type is something I am unfamiliar with. Are you aware of how this is performed? I did a few UDF tests on DVD-R's last night with no positive results . Explain how to change the book type (with what program etc.) and I will gladly try it.

BTW: What writer do you have? I have a Pioneer A06 (FW 1.08).

This find is very interesting, I might rent the star wars disc to see if we can make a boot disc with that. If there is a forced dash update with it, there has to be a update.xbe on it. If we are lucky the date of this xbe could be during 2002 or early 2003 giving us alternative exploit if this hulk one doesn't work out. Of course this is only a exploit if the xbes look for their corresponding fonts on the DVD.

-devz3ro

[evil_inside]

Excuse my ignorance(I'm not a coder, so if any of my following suggestions are rubbish ignore them) but is it possible to take the Hulk Disc 2(or SWT Disc 4), rip an ISO, replace the update.xbe with the UDE exploited version and insert Fonts folder or f0nts and then burn the ISO as a DVDROM?

[PedrosPad]

QUOTE (evil_inside @ Sep 23 2004, 05:26 PM)

is it possible to take the Hulk Disc 2(or SWT Disc 4), rip an ISO, replace the update.xbe with the UDE exploited version and insert Fonts folder or f0nts and then burn the ISO as a DVDROM?

The UDE exploited version of update.xbe only has the HDD media flag, so it won't launch from any other media (e.g. DVD).

[devz3ro]

QUOTE (evil_inside @ Sep 23 2004, 05:26 PM)

Excuse my ignorance(I'm not a coder, so if any of my following suggestions are rubbish ignore them) but is it possible to take the Hulk Disc 2(or SWT Disc 4), rip an ISO, replace the update.xbe with the UDE exploited version and insert Fonts folder or f0nts and then burn the ISO as a DVDROM?

While a great idea, I have to sadly inform you this would not work. The media flag for the update.xbe used for UDE1 / 2 are HDD signed media *only*.

I believe the problem with making a 1:1 copy is the media and not the burner itself (I could be wrong). Keep in mind these xbes are still on "read only" pressed discs, while DVD-R and DVD+R's are certainly not.

-devz3ro

[PedrosPad]

And I've never seen a update.xbe (old or new) with a media of XBE_MEDIA_1LAYER_DVDROM .

Edit: Althrough the update.xbe on the SWT DVD may have! - but I bet it would be too recent for the font exploit to work.

[Angerwound]

I am told this HULK dvd contains not only a default.xbe but has an xboxdash.xbe as well as dashdata folder. I have already asked about there being a settings_adoc.xip within hulk and it doesn't exist. Can someone check the Star Wars disk and see if this file slipped in?

EDIT: If anyone has the Star Wars trilogy disc please contact me via PM or Email.

EDIT2: I am also told of Shrek's DVD containing a demo. Can anyone confirm this?

This post has been edited by Angerwound: Sep 23 2004, 04:48 PM

[PedrosPad]

QUOTE (Angerwound @ Sep 23 2004, 05:49 PM)

I am told this HULK dvd contains not only a default.xbe but has an xboxdash.xbe as well as dashdata folder. I have already asked about there being a settings_adoc.xip within hulk and it doesn't exist. Can someone check the Star Wars disk and see if this file slipped in?

The SWT DVD just has:

dashupdate,xbe - XBE self-extractor that puts D:5659.03 on C:\
default.xbe - 171 MBs - XBE self-extractor for STBF demo.
update.xbe - IIRC

and no other XBOX files.

[Kthulu]

i also have the Pioneer A06 (i think it's the same thing as the 106) and upgraded the firmware last night to 1.08 in an effort to be able to change the book type.

here is a link to info on setting the book type:
http://www.dvdplusrw...=0&sid=2&aid=44

as far as i can tell from the other thread, SW doesn't have the \xboxdash\ folder already on it for immediate exploit-consumption, but PedrosPad could tell for sure...

here are the results i had trying to burn a boot disc:

disc1: UDF format; DVD-R media; book type DVD-R; invalid media error
disc2: FATX(with gdfimage); DVD-R; book type DVD-R; invalid media error
disc3: UDF; DVD+R; book type DVD+R; invalid media error

here's what i'd like to try:
UDF format; DVD+R media; boot type DVD-ROM
with the contents of HulkDisc2\xboxdash\ in the root of the burnt DVD and the xboxdash.xbe renamed to default.xbe

if that works, we could attempt to include hacked fonts on the DVD and see what happens.  someone has said that the xboxdash.xbe on Hulk is an early version of 4920.  that doesn't make sense to me.  4919 would...anyway, i bet the hacked 4920 fonts would work with this puppy.  did the 4920 dash look for fonts specifically on C or wherever the xbe was launched from?