Print

[cr0nick]

QUOTE(silvertyrant @ Dec 25 2007, 05:35 AM)

xbins isnt working for me i cant get ndure 3.1 any help would be appreciated [email protected] and my aim is o0SilverOo im always on

Same problem, anyone know when the FTP will be back up?

[slam007]

Greetings,

I'm planning to softmod my virgin Xbox to convert it into a media center using Xbmc. I have been reading numerous post about the best way of doing it and decided to go for the Ndure 3.1 PC installer using the XboxHdm installer and hotswap method.

After following the instructions in the manual I now have a xboxhdm\linux\ndure directory with the ndure.htm script file.

I have two questions on which I need a answer before doing the actual softmod

• Is it ok to use the standaard ndure.htm script file?
• Will it work with dashboard version 4920?

Can anybody help me?
Thanks.

[kingroach]

yes.. you should use the script that came with the 3.1 installer. Its highly recommended that you update the dashboard to latest (5960) . The files are designed to fit 5960 dashboard and will give you error if try to install over old dashboard.

[slam007]

QUOTE(slam007 @ Jan 16 2009, 10:11 PM)

Thanks for the fast reply kingroach.

I just update my dashboard to 5960 by connecting to Xbox Live. This means that I'm ready to do some hotswapping!

Which me luck   .

I just finished my first Xbox softmod with success!
I can recommend this software (Ndure 3.1 & Xboxhdm) to everybody. If you follow the instructions it should work without any problems.

I have one more question about backup. How can I backup the original xbox files and the eeprom?

Thanks.

[obcd]

the ndts folder on the E partition (run default.xbe from it) has an option to backup the xbox eeprom. After that, you can ftp the eeprom.bin file (256bytes) and the other files (unmodded M$dash) to your pc.

regards.

[slam007]

QUOTE(obcd @ Jan 18 2009, 04:54 PM)

the ndts folder on the E partition (run default.xbe from it) has an option to backup the xbox eeprom. After that, you can ftp the eeprom.bin file (256bytes) and the other files (unmodded M$dash) to your pc.

regards.

OBCD thanks for the answer.

I managed to create a backup of the eeprom using the Ndure toolset by following your instructions and found the eeprom.bin (1KB) on E:\NKP11. Next I made a backup of the entire C and E drives using FTP server from the Ndure toolset.

Should I be worried about the filesize of the eeprom.bin?

Regards,
Slam007.

[obcd]

Are you sure 1K is not the size it takes on the disk?

There exist a windows program for pc called liveinfo beta 3. You can load the eeprom.bin in that program, and it will show you all the relevant information of it. You can compare the serial number with the number on the sticker on the bottom of your xbox. If those matches, things should be fine.

regards.

[slam007]

QUOTE(obcd @ Jan 21 2009, 11:59 PM)

Are you sure 1K is not the size it takes on the disk?

There exist a windows program for pc called liveinfo beta 3. You can load the eeprom.bin in that program, and it will show you all the relevant information of it. You can compare the serial number with the number on the sticker on the bottom of your xbox. If those matches, things should be fine.

regards.

OBCD,

It was indeed a PEBCAC problem (problem exists between chair and computer). The actual size is 256 bytes.

I'm all set now.
I would like to thank all people who helped me out on this very responsive forum.

You guys are amazing.
Thanks for letting me resurrect my XBOX  

Slam007

[Carvo]

kingroach

I have an xbox modded with NDure 3.0 with the double boot option and UDDAE.

With power button, XBMC gets booted. When I UDDAE, I would like to boot into unleashX instead of XBL.

How can this be accomplished ?

[steveo1978]

there is a folder on the E:\ I think its called NTSF or something like that look in that folder and run the .xbe that will let you change some options for that solfmod I am not sure if it will let you boot unleashx and XBMC but it will let you change a bunch of stuff. Be careful in that folder cause the you can mess some stuff up if you dont watch what you are doing

[ldotsfan]

QUOTE(Carvo @ Feb 10 2010, 06:46 AM)

With power button, XBMC gets booted. When I UDDAE, I would like to boot into unleashX instead of XBL.

How can this be accomplished ?

http://forums.xbox-s...&...t&p=3066313 for the generic st.db.

ST.DB should be copied to E:\TDATA\fffe0000\music folder.

xbe should be habibi signed. Google for nkpatcher11_u04 for nasm and xbedump if you don't have them.

[ldotsfan]

QUOTE(ldotsfan @ Feb 10 2010, 10:09 PM)

http://forums.xbox-s...&...t&p=3066313 for the generic st.db.

Reconstructed from http://forums.xbox-s...&...t&p=2960681
and http://forums.xbox-s...&...t&p=2973832

CODE

;;;
;;; Compile: nasm -o ST.DB stdb.asm
;;;

 BITS 32

stdbmemofs equ 1498BCh     ; < fixed by 4920 dash

D5960_offset    equ 00001B000h ; eggsBox

mem_offset equ 0D004B694h - D5960_offset    ;

bin_start:

.HEAD0  dd 'BUFF'
.HEAD1  dd (mem_offset-1498C8h)/4
.HEAD2  dd .start-.HEAD0+stdbmemofs

;;;
;;; Summary:
;;; 1) Remove the subdirectory 1498c8 (HEAD2) that Dashboard created.
;;; 2) Rewrite ST.DB to disk (because Dashboard gobbles it.)
;;; 3) Change the MS public key in kernel to habibi-key.
;;; 4) Load and run a habibi-signed XBE.
;;;

.start:
call .base
.base: pop ebp
jmp short .continuecode
;----------------
.xbestring db 'default.xbe',0; To modify

.trnumstr db 'T:\music\1498c8',0
.trnum  dw $-.trnumstr-1, $-.trnumstr-1
.ptrnumstr dd .trnumstr-.HEAD0+stdbmemofs
.tmusicstdb dw 14, 14
 dd 17E10h; "T:\MUSIC\ST.DB"
.dispose db 1
;----------------
.continuecode:

; jmp short $; make it hang <<<<<<<<<<<<<<<<

dec dword [ebp+.HEAD1-.base]
dec dword [ebp+.HEAD2-.base]
push dword [ebp+.HEAD0-.base-4]
call dword [12034h]; NtClose

push byte 26
pop ecx
xor eax,eax
mov edi,stdbmemofs+416
rep stosd
inc eax
stosd
mov dword [edi-12],21371h

push eax
mov ebx,esp; File handle

push eax
push eax
mov esi,esp; IO status

lea eax,[ebp+.trnum-.base]
push byte 40h
push eax
push byte -3
mov edi,esp; Object attributes

push byte 1
push byte 4
push esi
 push edi
push dword 10000h
push ebx
call dword [12040h]; NtOpenFile

push byte 13; 13 = FileDispositionInformation
push byte 1
lea eax,[ebp+.dispose-.base]
push eax
push esi
push dword [ebx]
call dword [120A0h]; NtSetInformationFile

push dword [ebx]
call dword [12034h]; NtClose


lea eax,[ebp+.tmusicstdb-.base]
mov [edi+4],eax

push byte 22h
push byte 3
push esi
 push edi
push dword 40100000h
push ebx
call dword [12040h]; NtOpenFile

mov eax,512+12
lea edx,[ebp+.HEAD0-.base]
call .write

push byte 101
pop ecx
mov eax,512-12
.wl: push ecx
mov edx,10D70h; zeroes at 0x10D70
call .write
mov eax,512
pop ecx
loop .wl

push dword [ebx]
mov esi,dword [12034h]; NtClose
call esi

;  add esp,byte 12+8+4


.patchpublickey:
mov ebx,dword [121A8h]; XePublicKeyData
test ebx,ebx
jz short .badexport
cmp dword [ebx],31415352h
jne short .badexport
cmp dword [ebx+10h],10001h
je short .keyfound

.badexport:

and si,0F000h
.findkernel:
mov ax,[esi]
cmp ax,'ZM'
je short .check
cmp ax,'MZ'
je short .check
.retry: sub esi,1000h
jmp short .findkernel
.check:
mov eax,[esi+3Ch]
cmp eax,0FFFh
ja short .retry
cmp dword [esi+eax],'PE'
jne short .retry

mov ebx,esi
.searchkey:
inc ebx
cmp dword [ebx],31415352h
jne short .searchkey
cmp dword [ebx+10h],10001h
jne short .searchkey
.keyfound:

.searchkeyend:
inc ebx
cmp dword [ebx],0A44B1BBDh
jne short .searchkeyend

cli
mov ecx,cr0
push ecx
and ecx,0FFFEFFFFh
mov cr0,ecx

xor dword [ebx],2DD78BD6h

pop ecx
mov cr0,ecx
sti

.loadrunxbe:
push byte 0
push esp
push byte 0
push byte 2
push 127C8h; "\Device\Harddisk0\partition1" to modify?
lea eax,[ebp+.xbestring-.base]
push eax

mov esi,555A9h
call esi
.inf: jmp short .inf
;------------------------
.write:
xor ecx,ecx
push ecx
push eax
push edx
push esi
push ecx
push ecx
push ecx
push dword [ebx]
call dword [120D8h]; NtWriteFile
ret
;
%if $-.HEAD0 > 416
%error 416 bytes maximum!
%endif

times 512-$+.HEAD0 db 0

dd 21371h, 0, 1; An empty no-name track (for HD to HD copy)

times 52224-$+bin_start.HEAD0 db 0

[ldotsfan]

Uudecoded xman954's st.db for future reference:

CODE

;;;
;;; Compile example: nasm -o ST.DB stdb.asm
;;;

        BITS 32


NtOpenFile            equ 12040h
NtWriteFile            equ 120D8h
NtClose                equ 12034h
NtSetInformationFile        equ 120A0h
XePublicKeyData            equ 121A8h
LaunchDataPage            equ 12004h
MmAllocateContiguousMemory    equ 1213Ch
MmPersistContiguousMemory    equ 12138h
HalReturnToFirmware        equ 12008h


stdbmemofs    equ 1498BCh                ; < WAS fixed by 4920 dash
D5960_offset    equ 00001B000h          ; eggsBox
mem_offset    equ 0D004B694h - D5960_offset  ; adrress when launched from 4920 only


HEAD0        dd 'DDAE'
HEAD1        dd (mem_offset-1498C8h)/4; = $ CFEE6DCC / 4 = 33FB9B73
HEAD2        dd start-HEAD0+stdbmemofs; JMP TO > START

;;;
;;; Summary:
;;;    1) Remove the subdirectory 1498C8 (HEAD2) that Dashboard created.
;;;    2) Rewrite ST.DB to disk (because Dashboard gobbles it.)
;;;    3) Change the Microsoft public key in kernel to habibi-key.
;;;    4) Load and run a habibi-signed XBE.
;;;


start:
    call    base
base:    pop    ebp
    jmp    short continuecode


trnumstr    db 'T:\music\1498C8',0
trnum        dw $-trnumstr-1, $-trnumstr-1
ptrnumstr    dd trnumstr+stdbmemofs

tmusicstdb    dw 14, 14
        dd 17E10h

dispose        db 1

xbestr        db '\Device\Harddisk0\Partition1;default.xbe',0
XBESTRLEN    equ $-xbestr



continuecode:    

    dec    dword [ebp+HEAD1-base]
    dec    dword [ebp+HEAD2-base]
    push    dword [ebp+HEAD0-base-4]
    call    dword [NtClose]

    push    byte 26
    pop    ecx
    xor    eax,eax
    mov    edi,stdbmemofs+416
    rep    stosd
    inc    eax
    stosd
    mov    dword [edi-12],21371h

    push    eax
    mov    ebx,esp    ; File handle

    push    eax
    push    eax
    mov    esi,esp    ; IO status

    lea    eax,[ebp+trnum-base]
    push    byte 40h
    push    eax
    push    byte -3
    mov    edi,esp    ; Object attributes

    push    byte 1
    push    byte 4
    push    esi
     push    edi
    push    dword 10000h
    push    ebx
    call    dword [NtOpenFile]

    push    byte 13    ; 13 = FileDispositionInformation
    push    byte 1
    lea    eax,[ebp+dispose-base]
    push    eax
    push    esi
    push    dword [ebx]
    call    dword [NtSetInformationFile]

    push    dword [ebx]
    call    dword [NtClose]


    lea    eax,[ebp+tmusicstdb-base]
    mov    [edi+4],eax

    push    byte 22h
    push    byte 3
    push    esi
     push    edi
    push    dword 40100000h
    push    ebx
    call    dword [NtOpenFile]

    mov    eax,512+12
    lea    edx,[ebp+HEAD0-base]
    call    write

    push    byte 101
    pop    ecx
    mov    eax,512-12
wl:    push    ecx
    mov    edx,10D70h; zeroes at 0x10D70
    call    write
    mov    eax,512
    pop    ecx
    loop    wl
    
    push    dword [ebx]
    call    dword [NtClose]



patchpublickey:    
    mov    eax,[XePublicKeyData]

    pushf
    cli
    mov    ecx,cr0
    push    ecx
    and    ecx,0FFFEFFFFh
    mov    cr0,ecx

    xor    dword [eax+110h],2DD78BD6h

    pop    ecx
    mov    cr0,ecx
    popf


launchxbe:    
    mov    esi,[LaunchDataPage]
    mov    edi,1000h
    mov    ebx,[esi]
    test    ebx,ebx
    jnz    .memok

    push    edi
    call    dword [MmAllocateContiguousMemory]
    mov    ebx,eax
    mov    [esi],eax
.memok:    

    push    byte 1
    push    edi
    push    ebx
    call    dword [MmPersistContiguousMemory]

    mov    edi,ebx
    xor    eax,eax
    mov    ecx,400h
    rep    stosd

    or    dword [ebx],byte -1
;     mov    [ebx+4],eax

    lea    edi,[ebx+8]
    lea    esi,[ebp+xbestr-base]
    push    byte XBESTRLEN
    pop    ecx
    rep    movsb

    push    byte 2
    call    dword [HalReturnToFirmware]
.inf:    jmp    short .inf


    
write:
    xor    ecx,ecx
    push    ecx
    push    eax
    push    edx
    push    esi
    push    ecx
    push    ecx
    push    ecx
    push    dword [ebx]
    call    dword [NtWriteFile]
    ret



%if $-HEAD0 > 412
    %error 412 bytes maximum!
%endif

    times 512-$+HEAD0 db 0

    dd 21371h, 0, 1    ; An empty no-name track (for HD to HD copy)

    times 52224-$+HEAD0 db 0

[LittleRabbit]

Hi guys!

I'm a newby from the newbies on Xbox : I bought my first Xbox a few weeks ago, to make it a Mame, Kawax and other emulators machine :-). I’m writing from France : sorry if my English is not perfect, I hope you will be able to understand what I’m trying to say ;-).

So, it’s a PAL Xbox, version 1.6, with a kernel 5838, it was already softmoded, never opened with the original 8 GB hard disk in it.

I’m replacing the original hard disk with a 120 GB Maxtor one.

I read a lot of the topics found on this amazing forum and got XboxHDM v1.9, Ndure 3.1, and of course, my EEPROM files.

Here are my tries and what is working / not working.

1) Basic Xbox HDM 1.9:
If I make a standard XboxHDM image, burn it, boot it and format the 120 GB disk, everything goes right. Then I lock the HD, place it back on the Xbox and switch it on : the Xbox boots, and I get the standard MS dash.

2) Ndure 3.1 build for XboxHDM:
I select the following options :
- Core files (Install Ndur Basic, Boot XBL dash with Ekect
- Kernel selection 5838
- Create XboxHDM installer
     
It works fine and it creates the C and E folders. I copy those folders to the Linux folder of XboxHDM and make my iso image, and then burn it.

I eventually unlock the HD if locked and select option 1) from XboxHDM boot menu. Then I type xboxhd and select option 1). XboxHDM detect my 120 GB HD, create the partitions and format them.

Then I get the first problem : when XboxHDM tries to copy files to C and E partitions, he can’t find the files. I get the message “Searching for files : C/xboxdash.xbe : unknown operand,  cannot find system files”. The weird thing is that the mentioned file is actually present on the CD…

Since the files can’t be found here, I launch xbrowser and copy the files by myself with F5.
I copy all the files from C and E folders to PriMas/C and /E.

I reboot XboxHDM and lock the hard drive with the command “lockhd –a”. I place it back on the Xbox and switch it on : the Xbox boots, and I get the Unleash dash ! :-) Not too bad so ;-).

However, it seems that some parts are not working : if I boot with Eject button, or if I select MS Dash in the menu, he can’t find any files. As a matter of fact, if I browse the files from the Unleash menu, the C partition is empty ! With a ftp client, I succeed in copying files to E or F, but I can’t copy to C either (C looks empty from ftp too).
Have you any clue why I get the copy error while XboxHDM 1.9 is running ? Would you know why the C partition is empty and how I could get the standard MS dash too ?

Thanks a bunch in advance for your help.

Kind regards,

Little Rabbit

[steveo1978]

You real C is hidden my by something called shadowC

try this thread http://forums.xbox-scene.com/index.php?showtopic=664143

that should get you up and running