Post by: Angerwound on October 19, 2004, 12:14:00 PM
http://www.xbox-scene.com/xbox1data/sep/EE...ZFpAuUjEVQQ.php
If you want to be 100% LIVE Compatible, be sure to have nothing on the hard drive that the box wouldn't put their on it's own. (Hacked Gamesaves, Dashboards, Applications, Games, Exploits....). Also, don't be dumb and connect with a modified kernel/bios.
It seems that ever since the leak of Halo 2, MS have been doing some things to attack us modders. As we are unsure on the exact nature of these 'scans'; hundreds of people have been banned for reasons that wouldn't have warranted a ban previously.
Some theories that have been come up with involve the scanning of the 'C' and possibly 'E' parition of the drive. I'm unsure on what they are looking for exactly otherwise I'd specify. Another possible solution would be those people that have a swapped out 'xboxdash.xbe' file on 'C'. There is more than likely a checksum being done on the file. This is extremely dangerous to UDE/UXE users that use retail games for live purposes.
I don't believe them to be 'banning' large hard drives at the moment, otherwise there would have been a large amount more of people that would have encountered these bans already.
Anyhow, the purpose of this post is to inform and for users to take caution with what resides on their hard drive when they are communicating with the Live Network. If you have been banned or had your account terminated for reasons beyond your knowledge, look into the contents of your hard drive. If you desire more answers I invite you to contact '1-800-4MY-XBOX'. Let them know that you have been banned/terminated and want some answers. A few people that have been terminated have contacted tech support and have been told they are on a list that was sent down. This is about the most of the info they would provide. You will more than likely not get anywhere with it but you may uncover some info regarding this.
Good Luck!
This post has been edited by Angerwound on Nov 18 2004, 05:36 AM
Post by: EthanHunt_IMF on October 19, 2004, 01:48:00 PM
Post by: DaddyJ on October 19, 2004, 02:13:00 PM
| QUOTE (EthanHunt_IMF @ Oct 19 2004, 02:48 PM) |
| so MS can go to hell. |
Amen.
Post by: thatboywade on October 19, 2004, 01:51:00 PM
HAHA I WOULD LIKE TO SECOND THAT HAHA
Post by: thehunter1320 on October 19, 2004, 04:20:00 PM
(i have UDE, planning on uninstalling it later when Halo 2 comes out to play on a shiny new XBL starter kit)
EDIT: i have a theory... maybe they are banning XBL accounts on IPs that were reported to MS as downloaders of Halo 2?
This post has been edited by thehunter1320 on Oct 19 2004, 11:27 PM
Post by: mckenn88 on October 19, 2004, 06:07:00 PM
This post has been edited by mckenn88 on Oct 20 2004, 01:14 AM
Post by: heinrich on October 19, 2004, 06:09:00 PM
| QUOTE |
| Everytime they attempt to connect to the live network it will give a NETWORK ERROR rather than a "Modified XBOX Error". The network is definately not a problem on his end either. |
this is not unusual or new.. the xbox is banned..
Post by: Angerwound on October 19, 2004, 06:19:00 PM
Post by: mckenn88 on October 19, 2004, 06:23:00 PM
Post by: Kthulu on October 19, 2004, 06:49:00 PM
make sure that's gone, then try another new epprom...??? or better still, format all partitions, reload from pre-ban/pre-halo2 backup, flash a new eeprom, release/renew a new IP from ISP, create a new account...???
this is why i said to myself 'stupid f*cker' as soon as saw the headline that Halo2 was leaked. even if they aren't banning based on halo2 files being on the xbox, the halo2 leak was like your little brother poking a bee's nest...it doesn't matter who did it, those bees are pissed and they will sting anyone they suspect had anything to do with it...
P.S. maybe the day that 'Hulkdash' becomes useful has gotten a little closer...
This post has been edited by Kthulu on Oct 20 2004, 01:57 AM
Post by: DaddyJ on October 19, 2004, 07:32:00 PM
MAC Address = The Unique Serial # of the Network Card.
Post by: Angerwound on October 19, 2004, 07:36:00 PM
Post by: JimmyGoon on October 19, 2004, 06:52:00 PM
Apparently somehow people were getting past the bios checks?
Post by: The_Truth on October 19, 2004, 07:04:00 PM
and i quote from the gamespot article..."Worse, users whose GamerTag user name is listed in their user profile "risk having your Xbox Live account's ability to play Halo 2 crippled "
gamespot article
Edit: couldnt a mac address be changed through linux?
Post by: Thehebrewhammer on October 19, 2004, 10:29:00 PM
Post by: Kthulu on October 19, 2004, 09:58:00 PM
| QUOTE (Angerwound @ Oct 19 2004, 08:36 PM) |
| The MAC Address is actually stored inside the eeprom. This is what is 'normally' banned. That is why people can easily unban themselves with a new eeprom. |
based on your original description of the banning, they must be banning the account and the xbox, but no longer banning the xbox by MAC address...since we all know that gets replaced with a new eeprom. how could they ban the box itself without using the MAC address? does a new eeprom change the box's serial number? it's a little strange to me that ever used MAC address and not the serial number to begin with...anyways, the ban must be based on a value stored in hardware somewhere or stored in a file on the hdd...or perhaps it's based on the hdd itself (i.e. non-stock hdd = banned)...very interesting...
the M$ war on xbox terrorism has begun!
Post by: Kthulu on October 19, 2004, 10:10:00 PM
http://forums.xbox-s...dpost&p=1915307
the old account info could still be there somewhere, so when the new account is created, they still scan for other accounts on the xbox and ban the new account based on the old ones...???
Post by: EthanHunt_IMF on October 19, 2004, 11:48:00 PM
| QUOTE (Kthulu @ Oct 19 2004, 07:49 PM) |
| this is why i said to myself 'stupid f*cker' as soon as saw the headline that Halo2 was leaked. even if they aren't banning based on halo2 files being on the xbox, the halo2 leak was like your little brother poking a bee's nest...it doesn't matter who did it, those bees are pissed and they will sting anyone they suspect had anything to do with it... |
I LOVE BEES!!!!
Post by: triggernum5 on October 20, 2004, 07:05:00 AM
I know lots of sites including this one use IP bans, but I'm thinking MS has to take valid subscriptions into consideration.. Then again, I personally hope they go on a banning rampage, and end up in court over it.. I love watching a god legal battle
Post by: xb0xb0y on October 20, 2004, 08:47:00 AM
I haven't subscribed to xbox live, and I've owned an xbox for several years. But my green xbox I bought recently, and a game I purchased, both came with a free trial subscription, which I've been holding off using until Halo 2 comes out. Hmm, I wonder if there's any expiration date on those trials? ne1 know?
Hmm ... guess I will be putting back the original hard drive back into my xbox if and when I decide to activate xbox live.
Post by: DaddyJ on October 20, 2004, 09:55:00 AM
| QUOTE (bikr @ Oct 20 2004, 11:29 AM) |
Welcome to the rebirth of IDE switches  |
the ultimate hack
Post by: eh. on October 20, 2004, 10:10:00 AM
| QUOTE (xb0xb0y @ Oct 20 2004, 08:50 AM - 1st line) |
| Are the recent increase in banning of modded xboxes mainly been targeting softmod? or does it apply to chipped xboxes as well? |
If these forums are a good indicator then it's predominantly been chipped boxes ... but most modded boxes are eh. (Folks with HaloDEUX or XBL hacks seem to have been the main target eh...
)
Post by: bikr on October 20, 2004, 10:33:00 AM
| QUOTE (brainscan1975 @ Oct 20 2004, 06:21 PM) |
| My chipped box was banned a couple of days ago and I was attempting to sign on from the MS bios. Not sure what happened really. I had been using it for the last 5 months with no issues. Then I tried to sign on the other night and *poof* Im banned. |
did you run halo2 ? before being banned.
Post by: brainscan1975 on October 20, 2004, 10:45:00 AM
See this thread
http://forums.xbox-s...opic=289697&hl=
Post by: xb0xb0y on October 20, 2004, 10:48:00 AM
| QUOTE (eh. @ Oct 20 2004, 12:13 PM) |
| If these forums are a good indicator then it's predominantly been chipped boxes ... but most modded boxes are eh. (Folks with HaloDEUX or XBL hacks seem to have been the main target eh... ) |
so has any softmod only ppl here been banned at all?
and will running the x2 4981 bios that has the xbl disable code completely protect from being banned if one were to accidently try to log on to xbl?
Post by: eh. on October 20, 2004, 11:11:00 AM
Post by: mckenn88 on October 20, 2004, 12:19:00 PM
| QUOTE (xb0xb0y @ Oct 20 2004, 12:51 PM) |
| so has any softmod only ppl here been banned at all? |
i had the UDE on my box and X2 4981.06 and i still got banned. i think it has to do with something about replacing the xboxdash.xbe
Post by: eh. on October 20, 2004, 12:38:00 PM
Post by: mckenn88 on October 20, 2004, 12:43:00 PM
P.S. still got stock hdd
Post by: eh. on October 20, 2004, 12:49:00 PM
Post by: mckenn88 on October 20, 2004, 12:51:00 PM
Post by: eh. on October 20, 2004, 01:11:00 PM
Post by: eh. on October 20, 2004, 01:25:00 PM
| QUOTE (bikr @ Oct 20 2004, 01:02 PM - last part) |
| ... then I'd say that they are doing harddrive scans.. =\ |
His setup was easily detectable as modded by a game or the XBL connection applet just "peeking" at the certificate version of the xboxdash.xbe (which isn't really a "harddrive scan" as such) eh.
Post by: DaddyJ on October 20, 2004, 01:31:00 PM
Post by: EthanHunt_IMF on October 20, 2004, 02:00:00 PM
| QUOTE (DaddyJ @ Oct 20 2004, 03:34 PM) |
| We just need to make our own "LIVE" server software, and then tell m$ where they can go |
would just be the same as xlink kai or xbc, we can't offer d/l content like MS can...
seems like we need a cheap way of switching hd's for softmod. Maybe a BFM bios that disables networking all together to play our backups. who knows if game xbes will now have a call to the live servers.
Post by: PedrosPad on October 20, 2004, 02:14:00 PM
| QUOTE (Angerwound @ Oct 19 2004, 07:14 PM) |
| Some theories that have been come up with involve the scanning of the 'C' and possibly 'E' parition of the drive. |
Hmmmm.
Scanning drive 'C' would certainly be possibly, as this is the operating system drive, and all the files that reside on drive 'C' originate from M$.
Scanning the other drives ('E' 'X','Y','Z') isn't really practical as a lot of files on these drives are generated from XBOX games (save game files, etc.), many of which allow you to enter your own usernames so there is no way M$ could know what the file contents should be.
(Sure they could check theres no files on the root of E:\ - but thats two seconds to correct.)
Post by: PedrosPad on October 20, 2004, 02:22:00 PM
| QUOTE (EthanHunt_IMF @ Oct 20 2004, 10:03 PM) |
| would just be the same as xlink kai or xbc, we can't offer d/l content like MS can... |
Why can't it simply host previously downloaded XBL content, that can be FTPed onto the XBOX HDD? Not legal, but is any of it?
| QUOTE (EthanHunt_IMF @ Oct 20 2004, 10:03 PM) |
| Maybe a BFM bios that disables networking all together to play our backups. |
Er, simply unplug the cable?
Post by: chilin_dude on October 20, 2004, 02:36:00 PM
Post by: mckenn88 on October 20, 2004, 02:45:00 PM
| QUOTE (bikr @ Oct 20 2004, 03:02 PM) |
| If you get a new eeprom , don't try live unless you spoof your mac at the router |
how do u do that
Post by: Kthulu on October 20, 2004, 03:54:00 PM
| QUOTE (chilin_dude @ Oct 20 2004, 04:39 PM) |
| I think they're just scanning game-saves, and if any of them aren't from retail games you're banned. Seems simple enough! |
actually, scanning 'xboxdash.xbe' and the font files seems alot simpler
Post by: Kthulu on October 20, 2004, 04:08:00 PM
| QUOTE (EthanHunt_IMF @ Oct 20 2004, 04:03 PM) |
| 1. seems like we need a cheap way of switching hd's for softmod. 2. Maybe a BFM bios that disables networking all together to play our backups. 3. who knows if game xbes will now have a call to the live servers. |
1. not a very 'soft' mod at that point, but sounds like a good precaution for any Live-loving modder to take...no matter which mod method they use...
2. uh, x2-4980 and above come in BFM varieties. 4980 and above block XBL, even the BFM varieties in a soft-mod scenario, but the problem is...
3. (see Pedro's solution) or never play from retail disc...always play from modded-state, using an XBL-blocking bios
of course, the REAL problem is that you actually do want to access XBL, but not get banned...your no. 1 is the best answer.
QUESTION: are 8-10gb laptop hdds lockable?
Post by: EthanHunt_IMF on October 20, 2004, 05:49:00 PM
| QUOTE (PedrosPad @ Oct 20 2004, 04:25 PM) |
| Er, simply unplug the cable? |
That would get really old really fast... I was just tossing some idea's out there...
According to an old Xbox Nation (the mag) article, an anonymous expert Xbox modder, who has tinkered with more than 2,000 consoles, says. Still, it is possible MS could trace your use of the mod chip, since each Xbox is uniquely encoded with its own serial ID. If, by chance, some bored Live technician ran a diagnostics check, a foreign objectlike a mod chipwould pop up, along with any bootlegged software you might have.
is this true? and is that where these bans are coming from?
| QUOTE |
| 2. uh, x2-4980 and above come in BFM varieties. 4980 and above block XBL, even the BFM varieties in a soft-mod scenario, but the problem is... 3. (see Pedro's solution) or never play from retail disc...always play from modded-state, using an XBL-blocking bios |
I don't know much about how the XBL blocking works so the following hypothesis could be wrong...
While it does in fact block Live, the network connection still works. So couldn't an xbe just contact another one of MS's server? You go to run a system link game or even launch it, and the xbe says "Let me just upload my path 'f:\games\' and these 256 bytes (the eeprom)"
Post by: Kthulu on October 20, 2004, 06:17:00 PM
| QUOTE (EthanHunt_IMF @ Oct 20 2004, 07:52 PM) |
| 1. According to an old Xbox Nation (the mag) article, an anonymous expert Xbox modder, who has tinkered with more than 2,000 consoles, says. Still, it is possible MS could trace your use of the mod chip, since each Xbox is uniquely encoded with its own serial ID. If, by chance, some bored Live technician ran a diagnostics check, a foreign objectlike a mod chipwould pop up, along with any bootlegged software you might have. is this true? and is that where these bans are coming from? 2. I don't know much about how the XBL blocking works so the following hypothesis could be wrong... While it does in fact block Live, the network connection still works. So couldn't an xbe just contact another one of MS's server? You go to run a system link game or even launch it, and the xbe says "Let me just upload my path 'f:\games\' and these 256 bytes (the eeprom)" |
1. i don't see what serialID and the mod-chip have to do with each other if the mod-chip is off. this sounds like a load of bs/anti-mod propaganda...except for the part about detecting bootlegged software...if they scan the hdd.
2. i don't know much about the blocking either, but from my reading and personal testing observations, it is not simply blocking access to a particular server or IP address. i believe XBL comms are initiated with a system/api call. when the bios detects this system/api call, it reboots the xbox. of course, a game developer could opt not to use this system/api call and write the code that handles XBL comms themselves, but i don't think there's enough piracy-paranoia there to motivate them to do that...in fact, i bet M$ would refuse to certify their game unless they used the M$ system/api call for XBL comms...
making a game that refuses to run unless it can at least say 'hello' to XBL isn't a viable anti-mod option. if they did that, people without broadband or networked xboxes would be rather pissy...not good for the already bad M$ PR...
Post by: EthanHunt_IMF on October 20, 2004, 09:22:00 PM
Post by: John Hoek on October 21, 2004, 03:18:00 AM
- Just use a x2 live blocked bios.
- get a networksniffer (example ethereal for instance www.ethereal.com) and look at all xbox traffic on the networkinterface.
- start a Live game, but NOT use xbox live with it (the modchip in ON!).
play single player for e few minutes.
- If at this stage there IS networkactivity from the XBOX, it is sure that there is a problem. the game uses undocumented calls which bypasses the protection..
You can also try live then with a live blocked bios . In principle NO activity musty be seen. If there is, then Yes, there's a problem.
Post by: chilin_dude on October 21, 2004, 07:14:00 AM
| QUOTE (Kthulu @ Oct 20 2004, 10:57 PM) |
| actually, scanning 'xboxdash.xbe' and the font files seems alot simpler |
Yes but its already been proven it's not just font people that are being banned, so they can't be doing that
Post by: lordz on October 21, 2004, 08:14:00 AM
. But I just find this strange.
Post by: bikr on October 21, 2004, 08:23:00 AM
| QUOTE (lordz @ Oct 21 2004, 04:17 PM) |
| The theory of them banning IPs from halo 2 downloading, doesn't quite work because I wasn't downloading it "at the time. " |
ROFFFFFLLLEEE LOLZZZZ Sorry , I found that amuzing , anyone packet catching live connections now?
Post by: PedrosPad on October 21, 2004, 08:59:00 AM
| QUOTE (bikr @ Oct 21 2004, 04:26 PM) |
| anyone packet catching live connections now? |
Encountered the XBL logon packet with "[email protected]" packet yet? The XBOXs serial number is used to log it on, using MS's Passport security engine, IIRC.
To enforce a ban, this is the simplest place to do it (and kind'a what the security/passport engine is for).
Post by: xb0xb0y on October 21, 2004, 09:35:00 AM
There's only a limited amount of original M$ files and directories that reside on C for a STOCK hard drive. And on E, there should be only TDATA and UDATA directories (if memory serves me correct). And how many modded xboxes are in violation of that? I would say almost 100% of them, if not all. A simple scan like that would be easy as pie to do and quick. And it's not like M$ can't find info on all the directories/files used in several softmod and dashboards that they could target so they would know what to look for.
Combine that with gametag flagging for ppl that have already been banned previously. And maybe even add in the measures of harddrive hardware (serial number/model number) scan. This could explain the ppl who try to get them unbanned by changing config/hardware, and being banned again after a day or less back on XBL.
I think if and when I decide to go on XBL when Halo 2 comes out, it's with my stock xbox hard drive with STOCK directories/files.
Post by: BloodGulch v2.0 on October 21, 2004, 09:51:00 AM
Post by: PedrosPad on October 21, 2004, 09:59:00 AM
| QUOTE (xb0xb0y @ Oct 21 2004, 05:38 PM) |
| And it's not like M$ can't find info on all the directories/files used in several softmod and dashboards that they could target so they would know what to look for. |
There's two ways to perform the scan:
- Compare against a list of files that should be there, and look for exceptions
- or, target and check for specific files that shouldn't be there (evoxdash.xbe,etc.)
Targeting specific files, like evoxdash.xbe, is too weak - The programs can very simply be moved and hidden under Game Sav folders, and recomplied to change their length, checksum, etc.
The file that can't be moved is c:\xboxdash.xbe, of course
Post by: total_ass on October 21, 2004, 10:04:00 AM
Post by: BloodGulch v2.0 on October 21, 2004, 10:07:00 AM
Post by: xb0xb0y on October 21, 2004, 10:37:00 AM
| QUOTE (PedrosPad @ Oct 21 2004, 12:02 PM) |
There's two ways to perform the scan:
Targeting specific files, like evoxdash.xbe, is too weak - The programs can very simply be moved and hidden under Game Sav folders, and recomplied to change their length, checksum, etc. The file that can't be moved is c:\xboxdash.xbe, of course |
i would say it's a combination of both.
going by memory, haven't modified much on the xbox lately. for C ... there are only suppose to be dashboard files, and xbl files and any associated directories with files as well, depending on of course the version of the dashboard and xbl. a quick and dirty way of checking is the NUMBER of files and directories that SHOULD be there, assuming the OS has the capabilities of doing that type of listing, which it should.
pre-live dash would have X number of dash files in root of C and then post-live dashes put these support files in a directory, or vice versa ...
so root of C should have X amount of files if pre-live dash, and Y amount of files in root if post-live dash. Also should have W number of directories for pre-live and Z number of directories for post-live.
if they even went further and elaborated on this, they could cross reference the file names and directory names.
why they could implement this easily? cuz the xbox is suppose to be a closed system and from the factory, there's only suppose to be a limited amount of files on C drive. And I don't think M$ allowed one single game out there to do anything to the contrary. Dashboard and XBL updates that effect the C drive would be done strictly to the file structure M$ has laid out.
all this could be easily embedded in the XBL sign in, so no info about your files are sent to M$ ... all M$ needs is to know if you should be banned or not. and for ppl using XBL, this new version of XBL with this check would be updated on your xbox, like a trojan horse! hmm ... i wanna play this game on XBL, so M$ forces you to update your XBL, that includes this check and ... BAM your caught!
this search could also be applied to E for the root directory, ie if you have files or directories on E that you shouldn't. but if you were to hide all your files in the UDATA/TDATA directories, you'd be safer since there's so much more stuff to check for in there that I don't think it be feasible for M$ to check. but i could be very well wrong.
and why would this work ... like i asked before, who doesn't have extra files/directories on C and in the root of E???
Post by: PedrosPad on October 21, 2004, 12:16:00 PM
| QUOTE (PedrosPad @ Oct 21 2004, 05:02 PM) |
| Encountered the XBL logon packet with "[email protected]" packet yet? The XBOXs serial number is used to log it on, using MS's Passport security engine, IIRC. To enforce a ban, this is the simplest place to do it (and kind'a what the security/passport engine is for). |
This is the packet I was refering to (see red ink), packet 9, the Kerberos challenge, login packet.
| QUOTE |
No. Time Source Destination Protocol Info 9 23.027468 ???.???.?.? ???.??.???.? KRB5 AS-REQ Frame 9 (455 bytes on wire, 455 bytes captured) Arrival Time: Jul 19, 2004 23:25:28.041981000 Time delta from previous packet: 3.045735000 seconds Time since reference or first frame: 23.027468000 seconds Frame Number: 9 Packet Length: 455 bytes Capture Length: 455 bytes Ethernet II, Src: ??:??:??:??:??:??, Dst: ??:??:??:??:??:?? Destination: ??:??:??:??:??:?? (192.168.0.1) Source: ??:??:??:??:??:?? (???.???.?.?) Type: IP (0x0800) Internet Protocol, Src Addr: ???.???.?.? (???.???.?.?), Dst Addr: ???.??.???.? (???.??.???.?) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 441 Identification: 0xaa60 (43616) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0x47f4 (correct) Source: ???.???.?.? (???.???.?.?) Destination: ???.??.???.? (???.??.???.?) User Datagram Protocol, Src Port: 1257 (1257), Dst Port: kerberos (88) Source port: 1257 (1257) Destination port: kerberos (88) Length: 421 Checksum: 0x15a3 (correct) Kerberos Pvno: 5 MSG Type: AS-REQ (10) padata: Unknown:204 Unknown:206 PA-ENC-TIMESTAMP Unknown:131 Type: Unknown (204) Value: 3AAF6F48DF6DC4017757319B2490EE17... Type: Unknown (206) Value: AFC2CE67F9294FD106F8F329BB2F4913... Type: PA-ENC-TIMESTAMP (2) Value: 303DA003020117A23604348AA1D730E1... rc4-hmac Encryption type: rc4-hmac (23) enc PA_ENC_TIMESTAMP: 8AA1D730E1A47F4E5F61A328C7DF4366... Type: Unknown (131) Value: 300FA0030101FFA108300602010D0201... KDC_REQ_BODY Padding: 0 KDCOptions: 00010000 (Canonicalize) .0.. .... .... .... .... .... .... .... = Forwardable: Do NOT use forwardable tickets ..0. .... .... .... .... .... .... .... = Forwarded: This is NOT a forwarded ticket ...0 .... .... .... .... .... .... .... = Proxyable: Do NOT use proxiable tickets .... 0... .... .... .... .... .... .... = Proxy: This ticket has NOT been proxied .... .0.. .... .... .... .... .... .... = Allow Postdate: We do NOT allow the ticket to be postdated .... ..0. .... .... .... .... .... .... = Postdated: This ticket is NOT postdated .... .... 0... .... .... .... .... .... = Renewable: This ticket is NOT renewable .... .... ...0 .... .... .... .... .... = Opt HW Auth: False .... .... .... ...1 .... .... .... .... = Canonicalize: This is a request for a CANONICALIZED ticket .... .... .... .... .... .... ..0. .... = Disable Transited Check: Transited checking is NOT disabled .... .... .... .... .... .... ...0 .... = Renewable OK: We do NOT accept renewed tickets .... .... .... .... .... .... .... 0... = Enc-Tkt-in-Skey: Do NOT encrypt the tkt inside the skey .... .... .... .... .... .... .... ..0. = Renew: This is NOT a request to renew a ticket .... .... .... .... .... .... .... ...0 = Validate: This is NOT a request to validate a postdated ticket Client Name (Enterprise Name): [email protected] Name-type: Enterprise Name (10) Name: [email protected] Realm: PASSPORT.NET Server Name (Service and Instance): krbtgt XBOX.COM Name-type: Service and Instance (2) Name: krbtgt Name: XBOX.COM till: 2037-09-13 02:48:05 (Z) Nonce: 1712355469 Encryption Types: rc4-hmac Encryption type: rc4-hmac (23) 0000 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? .......P [email protected]. 0010 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ...`..@. G....... 0020 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? .....X.. ..j...0. 0030 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ........ ........ 0040 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0..0:... ....2.0: 0050 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? .oH.m..w W1.$.... 0060 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ;..p...; ...;z... 0070 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? .f....u9 <......0 0080 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? X....... P.N...g. 0090 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? )O....). /I.72..X 00a0 62 6f 78 20 56 65 72 73 69 6f 6e 3d 31 2e 30 30 box Vers ion=1.00 00b0 2e 34 39 32 38 2e 34 20 54 69 74 6c 65 3d 30 78 .4928.4 Title=0x 00c0 35 35 35 33 30 30 30 43 20 54 69 74 6c 65 56 65 5553000C TitleVe 00d0 72 73 69 6f 6e 3d 31 30 00 30 48 a1 03 02 01 02 rsion=10 .0H..... 00e0 a2 41 04 3f 30 3d a0 03 02 01 17 a2 36 04 34 8a .A.?0=.. ....6.4. 00f0 a1 d7 30 e1 a4 7f 4e 5f 61 a3 28 c7 df 43 66 f1 ..0...N_ a.(..Cf. 0100 74 b6 1a 66 e6 e8 af 35 5d 6b d6 c6 b3 50 c7 46 t..f...5 ]k...P.F 0110 00 ca 10 9d b3 43 c0 8b 54 f6 81 4d 43 ff 6b d4 .....C.. T..MC.k. 0120 14 80 51 30 1b a1 04 02 02 00 83 a2 13 04 11 30 ..Q0.... .......0 0130 0f a0 03 01 01 ff a1 08 30 06 02 01 0d 02 01 0e ........ 0....... 0140 a4 81 84 30 81 81 a0 07 03 05 00 00 01 00 00 a1 ...0.... ........ 0150 25 30 23 a0 03 02 01 0a a1 1c 30 1a 1b 18 53 4e %0#..... ..0...SN 0160 2e ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 40 78 62 .??????? ?????@xb 0170 6f 78 2e 63 6f 6d a2 0e 1b 0c 50 41 53 53 50 4f ox.com.. ..PASSPO 0180 52 54 2e 4e 45 54 a3 1d 30 1b a0 03 02 01 02 a1 RT.NET.. 0....... 0190 14 30 12 1b 06 6b 72 62 74 67 74 1b 08 58 42 4f .0...krb tgt..XBO 01a0 58 2e 43 4f 4d a5 11 18 0f ?? ?? ?? ?? ?? ?? ?? X.COM... .??????? 01b0 ?? ?? ?? ?? ?? ?? ?? 5a a7 06 02 04 66 10 78 8d ???????Z ....f.x. 01c0 a8 05 30 03 02 01 17 |
Also, this capture was from an SC1PAL game, and the titleID, in blue ink, reveals this. Presumably the HALO2 game would of too. (Your XBOX Serial number, and the HALO2 titleID in the same network packet - convenient for M$.)
PS. Just to dispel a myth, the serial number in the captured packet matches the serial number on the sticker under my XBOX, and I replaced my HDD long ago - so it's not calculated, based on the HDD serial number, etc. - The HDD locking key is, the serial number isn't!.
Post by: Kthulu on October 21, 2004, 12:43:00 PM
| QUOTE (chilin_dude @ Oct 21 2004, 09:17 AM) |
| Yes but its already been proven it's not just font people that are being banned, so they can't be doing that |
i don't think anything has been proven
..at least not when we orignially posted these comments.
Post by: total_ass on October 21, 2004, 12:59:00 PM
Post by: xb0xb0y on October 21, 2004, 01:29:00 PM
| QUOTE (PedrosPad @ Oct 21 2004, 02:19 PM) |
| (Your XBOX Serial number, and the HALO2 titleID in the same network packet - convenient for M$.) PS. Just to dispel a myth, the serial number in the captured packet matches the serial number on the sticker under my XBOX, and I replaced my HDD long ago - so it's not calculated, based on the HDD serial number, etc. - The HDD locking key is, the serial number isn't!. |
isn't that like a "no no" ... something on the lines of when Intel put unique IDs on there CPUs???
Post by: southbark on October 21, 2004, 01:36:00 PM
My advice is to for anyone who has not been banned to wait until after Nov 9 to go on XBL.we all know why there banning because only people with modded xboxes can use the info that was downloaded and played. so technically M$ can say anyone with a modded xbox has downloaded the game and used cause as far as they are concerned there is no reason for you to mod an xbox.
Post by: chilin_dude on October 21, 2004, 01:58:00 PM
| QUOTE (Kthulu @ Oct 21 2004, 07:46 PM) |
| i don't think anything has been proven ..at least not when we orignially posted these comments. |
Well, if you read in xbox-live forum it has been confirmed its not just soft exploiters
Post by: mckenn88 on October 21, 2004, 08:10:00 PM
Post by: EthanHunt_IMF on October 21, 2004, 09:13:00 PM
Post by: southbark on October 21, 2004, 11:59:00 PM
| QUOTE (EthanHunt_IMF @ Oct 21 2004, 09:16 PM) |
| If you are running UDE/UXE and don't have a live account on the system. Can your eeprom be banned simply by running D: 4920 or any Live/Live Aware game? |
At this time it is possible,after NOV 9 this crap may stop,besides if you have no reason to go on live why would you even connect your xbox to an internet connection.
Post by: PedrosPad on October 22, 2004, 05:58:00 AM
| QUOTE (PedrosPad @ Oct 21 2004, 05:02 PM) |
| The XBOXs serial number is used to log it on, using MS's Passport security engine, IIRC. |
| QUOTE |
| Xbox Live Users Link your Gamertag to your .Net Passport and get access to all kinds of cool stuff, including developer interviews, music videos, fan profiles, exclusive game invitations, and more! |
That explains the M$ .NET Passport connection.
Post by: bikr on October 22, 2004, 10:15:00 AM
| QUOTE (xb0xb0y @ Oct 21 2004, 09:32 PM) |
| isn't that like a "no no" ... something on the lines of when Intel put unique IDs on there CPUs??? |
It was found to be legal in the intel case I believe. Xbox has every right to track which boxes are connecting , they can use the excuse for marketing analysis etc..
They can't however scan your drive or make changes to your drive without your concent , if you run live , they have your concent..
Post by: EthanHunt_IMF on October 22, 2004, 11:55:00 AM
| QUOTE (southbark @ Oct 22 2004, 02:02 AM) |
| At this time it is possible,after NOV 9 this crap may stop,besides if you have no reason to go on live why would you even connect your xbox to an internet connection. |
XBC, XBMC, FTP are reasons for having my xbox connected to my router.
Post by: garyopa on October 22, 2004, 04:01:00 PM
are coming back BANNED, and some are soft-modded and others
have the TSOP with a switch and even others have the fancy shit
like Xenium ICE, one with X3, etc.
The common factor in all the BANNED machines is the use of
homebrew software. Even see a machine with no files changed
on the C: drive, that was BANNED.
My theory is XBOX live new updates are BANNING machines with
"invalid" SAVE entrys on the E: drive, even from PAL games or
unreleased games or "HOMEBREW" software like DVD2XBOX, UnleashX, etc.
Any thoughts on this theory?
Post by: Kthulu on October 22, 2004, 04:10:00 PM
what is the titleID (game-save dir) for halo2? perhaps a piece of homebrew software is using the same titleID? therefore, when they scan, they (ms) think you've got a halo2 game-save = ban
i know that's really hopeful thinking on my part, but i hate to think they are banning for having homebrew...that would just suck...but it's starting to sound like it's true.
Post by: JimmyGoon on October 22, 2004, 04:49:00 PM
just curious about something. thanks.
Post by: EthanHunt_IMF on October 22, 2004, 06:26:00 PM
| QUOTE (garyopa @ Oct 22 2004, 06:04 PM) |
| I run a modding shop in Canada, and alot of my machines I modded are coming back BANNED, and some are soft-modded and others have the TSOP with a switch and even others have the fancy shit like Xenium ICE, one with X3, etc. The common factor in all the BANNED machines is the use of homebrew software. Even see a machine with no files changed on the C: drive, that was BANNED. My theory is XBOX live new updates are BANNING machines with "invalid" SAVE entrys on the E: drive, even from PAL games or unreleased games or "HOMEBREW" software like DVD2XBOX, UnleashX, etc. Any thoughts on this theory? |
Looking at some of the posts in the XBL forum, some people are reporting sucess on changing the HD when they change the EEPROM. The current theory is that XBL is keeping track of the HD serial that was in the system the first time it signed up to XBL (or whenever they might have started keeping track of this info). And if it varies from what their record says, BANNED.
Post by: BloodGulch v2.0 on October 22, 2004, 07:02:00 PM
Post by: garyopa on October 22, 2004, 07:18:00 PM
same account for years on tons of machines for updating them,
testing them, and many machines with changed XBOX's, and
I never been BANNED, the only thing is I have NEVER copy the
LIVE file to a XBOX hard drive!
And it has always been on the SAME memory card, many they
track the "serial number" of the device where the XBOX live
account was CREATED on:
Maybe in the future, when people change their hard drive they
should use the RECOVERY feature to restore their LIVE account?
We have WAY to MANY IF's at the moment, we need more real
FACTS and some type of solid testing bed of series of tests.
Post by: triggernum5 on October 22, 2004, 10:54:00 PM
I'm highly doubting anybody on this site would pay them to do that though when you can get a 120GB for the same price as they charge to install a new 8GB.. BTW, hdd model# alone is enough to ban... To my knowledge, there have only been 2 diff Seagates, and I dunno if there is more than 1 WD.. (In about 40-50 xboxes I've only ever come across one WD hdd.. Actually, I've never even seen an xbox with a Phillips DVD either.. 95% have been Thomsons)
Post by: RiceCake on October 22, 2004, 11:35:00 PM
It's not scanning the HD because thats simply invasion of privacy.
Its probably just checking the xboxdash.xbe, then if its bad, take some uniquely unchangeable information not in the EEPROM and ban that.
Since I just connected to Live and recieved no dashboard update - I'd say it would be the HD serial number, keys, etc.
Post by: JimmyGoon on October 23, 2004, 06:31:00 AM
Post by: total_ass on October 23, 2004, 01:43:00 PM
Post by: Dai_UK on October 23, 2004, 01:52:00 PM
after all, even using an AR breaks your agreement for live as it could be used to put a cheating save on !
Post by: total_ass on October 23, 2004, 03:32:00 PM
that would explain it.
Post by: AE6689 on October 23, 2004, 05:04:00 PM
Post by: mkjones on October 23, 2004, 05:15:00 PM
| QUOTE (AE6689 @ Oct 24 2004, 01:07 AM) |
| I'm pretty sure that the original bios can't see the F:/ partition at all. If the bios can't see it then M$ can't use Live to check for it's presense. (Correct me if I'm wrong) |
This ^ is true
Post by: RcbUK on October 23, 2004, 06:13:00 PM
| QUOTE (DaddyJ @ Oct 19 2004, 09:13 PM) |
| Amen. |
Post by: RiceCake on October 23, 2004, 08:28:00 PM
They can't be hashing, or checking saves, because thats an invasion of privacy and due to the Action Replay existing its a stupid idea and would probably get innocent people banned.
MS has, and still is, banning anyone running a modified BIOS. This could be avoided by simply rebooting the system with an original disc, avoiding running the exploit and modifying the BIOS.
Most likely there checking the hash of the dashboard XBE (xboxdash.xbe) and then banning the HD serial number or the DVD serial number, because the DVD and the HD serial number are pretty much the only unchangeable codes in the XBox (Live ID's, MAC addresses, etc, can all be swapped with an EEPROM change and this has been proven not to work).
MS could be banning IP's but then our dynamically IP'ed friends could just grab another and get back on, or get their entire ISP banned which is also a stupid thing for MS to do.
So, for now, please let anyone you know running an exploit know.
Connect to Live like this and your probably getting in some serious new shit.
As for MS employees that will probably read this, bravo. Your finally proving some competence in your ability to secure people off your network. Too bad you suddenly decided to up and fuck exploiters over though.
Post by: total_ass on October 24, 2004, 06:11:00 AM
i reckon M$ looks at the hard drive serial number and says "this aint one of ours" and bans you from that serial number. and because the only way to get another stock xbox hard drive would be to buy another xbox, they have successfully banned you permanently.
same would go for dvd drive too.
combined with the xboxdash.xbe checking, they can ban you for life.
Post by: JimmyGoon on October 24, 2004, 07:02:00 AM
THIS SUCKS MONKEY BALLS!
Post by: DaddyJ on October 24, 2004, 07:04:00 AM
Post by: triggernum5 on October 24, 2004, 09:25:00 AM
Post by: RiceCake on October 24, 2004, 10:09:00 AM
They aren't checking the HD models and sizes yet. I still strongly believe that there checking the xboxdash.xbe, and then banning some uniquely identifiable code.
Since XBox'es roll off the line all identical it can't be in the motherboard. In fact the only uniquely identifiable data besides whats in the drives is stored in the EEPROM, and changing this doesnt work.
Most likely its either a ban related to your Live account, HD serial number, or the DVD serial number...or some other codes. But I agree with DaddyJ here, what about refurbished Xboxes?
Dunno. Anyone who is banned might wanna give changing the DVD drive and the HD a shot, just to narrow it down a bit further.
Post by: garyopa on October 24, 2004, 12:02:00 PM
Scanning the titleID's on your E: drive is NOT an invasion of privacy. The hard
drive in your XBOX is part of the LIVE system.
I know for a fact that MS is banning users with hacked SAVE files, so they have
to be able to scan your drive to detect the invalid signing of your titleID's content.
Remember all DOWNLOADed content is signed for your machine, and transfering
of changing the content is break in your LIVE agreement.
Action replay users are NOT INNOCENT, they ARE CHEATERS, so therefore NOT ALLOW ON LIVE, any break in your LIVE agreement is a REASON for a BAN.
Post by: JimmyGoon on October 24, 2004, 12:09:00 PM
Post by: ipodder2003 on October 24, 2004, 01:14:00 PM
| QUOTE (garyopa @ Oct 24 2004, 01:05 PM) |
| >QUOTE< They can't be hashing, or checking saves, because thats an invasion of privacy and due to the Action Replay existing its a stupid idea and would probably get innocent people banned. Scanning the titleID's on your E: drive is NOT an invasion of privacy. The hard drive in your XBOX is part of the LIVE system. I know for a fact that MS is banning users with hacked SAVE files, so they have to be able to scan your drive to detect the invalid signing of your titleID's content. Remember all DOWNLOADed content is signed for your machine, and transfering of changing the content is break in your LIVE agreement. Action replay users are NOT INNOCENT, they ARE CHEATERS, so therefore NOT ALLOW ON LIVE, any break in your LIVE agreement is a REASON for a BAN. |
So I'm not innocent for backing up my completed campaign and custom controller settings for Halo on my computer? There are legitmate uses.
Post by: ipodder2003 on October 24, 2004, 01:29:00 PM
| QUOTE (syoes @ Oct 24 2004, 02:24 PM) |
It seems that i might be banned from xb live .the trouble shooting tool goes all the way through the too connect to xbl. then says network error  I have all apps and other storred on the f: partion. but the C: has the evox on it. I was on pg2 last night no (no hacks) for this game on the xb. and im sure that the mod was off ..this sucks..Please help ..What is my next step, insall original HD???? re flash the eprom??or both.. or remove the modd software?? |
You could test out the theory of the DVD drive or Hard drive, if you want.
Post by: ssj4android on October 24, 2004, 02:26:00 PM
Post by: nikeskateboarding.net on October 24, 2004, 02:55:00 PM
Post by: RiceCake on October 24, 2004, 03:46:00 PM
| QUOTE |
| I know for a fact that MS is banning users with hacked SAVE files, so they have to be able to scan your drive to detect the invalid signing of your titleID's content. |
You know for a fact?
Hmm. No offence, but your an idiot.
I've used my Action Replay with retail and hacked gamesaves before - not banned.
I've hacked MechAssault and Splinter Cell saves that they'd probably be checking - no problems.
And just a second ago I uploaded a buncha saves from things like boXplorer, XBMC, Linksboks, etc, etc...no problems.
Banning people because of gamesaves is a stupid idea, so don't be the stupid ass who "Knows for a fact". If you wanna be a smartass go work for MS.
Besides that, MS can't scan your HD. If they could that would be like, HP being able to scan their customers computers to make sure they aren't installing warranty-voiding programs. Its just not gonna happen.
Post by: ipodder2003 on October 24, 2004, 04:24:00 PM
| QUOTE (RiceCake @ Oct 24 2004, 04:49 PM) |
| You know for a fact? Hmm. No offence, but your an idiot. I've used my Action Replay with retail and hacked gamesaves before - not banned. I've hacked MechAssault and Splinter Cell saves that they'd probably be checking - no problems. And just a second ago I uploaded a buncha saves from things like boXplorer, XBMC, Linksboks, etc, etc...no problems. Banning people because of gamesaves is a stupid idea, so don't be the stupid ass who "Knows for a fact". If you wanna be a smartass go work for MS. Besides that, MS can't scan your HD. If they could that would be like, HP being able to scan their customers computers to make sure they aren't installing warranty-voiding programs. Its just not gonna happen. |
Ah CRAP! I have an HP, I'm screwed.
Post by: mckenn88 on October 24, 2004, 04:26:00 PM
Post by: syoes on October 24, 2004, 04:36:00 PM
| QUOTE (ssj4android @ Oct 24 2004, 10:29 PM) |
| You're not banned. Xbox live is down. Anyway, I've used UDE and gotten on live fine. In Burnout 3 at least. |
Thanks your right the xbl service was down ??? no need too start a panic hdd swap and file dump!!!
Post by: triggernum5 on October 24, 2004, 05:46:00 PM
Post by: RiceCake on October 24, 2004, 08:13:00 PM
Was XBL just down or is this Live thing still an issue?
Cause I can see apparently Live was down at one time...
Post by: Kthulu on October 24, 2004, 08:26:00 PM
| QUOTE (RiceCake @ Oct 24 2004, 12:12 PM) |
| * Side note. They could be banning upgraded HD's, but if they were why aren't our chipped friends getting hit? |
according to chillin_dude, our chipped friends are getting hit.
i think it's interesting to note that most of the people posting that they were banned have a low post count
Post by: Angerwound on October 24, 2004, 08:43:00 PM
Yes, people were abusing live by cheating with modified files. This was accomplished by a change in the xboxdash.xbe file on the 'C' partition. Therefore, this fix is probably going to be looking at this file very closely. I don't believe this to have anything to do with 'Halo 2' or any Gamesave Scanning.... This means that if you must use live on your modified console be sure to have the original system files in place and you should be fine. I myself suggest using an untouched virgin console as a live option that way MS has no reason to Ban/Terminate you.
Post by: jawuelln on October 24, 2004, 10:04:00 PM
Post by: luther349 on October 24, 2004, 10:10:00 PM
i knoe for a fact they do scan gamesavs but not in the fasion you beleve they do no they do not scan the entire drive for any odd saves that would hit to many iccent users that use a acton replay or a simple system running homebrew or linux. they do however look for saves that are indeed banned from live and you first saw this in phantisy star when people started cheating with hacked saves and got banned. what there doing with halo 2 is looking for that saves and banning you.
the easest way is not downloading that game couse your a faggit if you do go buy it. and on a side note i have a aduio expolited system and i am not banned from live and my frends system is chiped and has a 40 gig hd and hes also not banned if he was he would told me almost instantly couse hes addectid to splintercell 2. but we also both didnt download the halo 2 leak couse we like that game to mutch to steal it 50$ is defently worth every dime for halo 2 when it comes out in fact i have aruldy payed for it and got it on resverv.
the people who did get banned for having the leak got excaly what they desverd and i dont fell sorry for them.
Post by: bourke on October 24, 2004, 10:29:00 PM
Now anyone can return their Xbox to a shop for a replacement after 11 months because XBL banned them!
All you have to do is remove your softmod and format the drive back to normal!
Then MS have to honour their warranty :-P
cheers,
Bourkie
Post by: eh. on October 24, 2004, 10:58:00 PM
| QUOTE (luther349 @ Oct 24 2004, 10:13 PM) |
| on a side note i have a aduio expolited system and i am not banned from live |
This is the second post I've seen today mentioning that; I (mistakenly?) thought XBL required a dashboard version that has the audio flaw fixed eh?
Post by: H4v0K on October 25, 2004, 12:15:00 AM
Post by: bourke on October 25, 2004, 12:28:00 AM
| QUOTE (H4v0K @ Oct 25 2004, 08:18 AM) |
| I was banned 10 minutes after changing eeproms, then i switched to a different 120gb left the C and E stock and i havent been banned yet. |
This finally confirms all of my suspicions; suspicions I had two years ago mind you!
Suspicions that putting stuff on your E drive was not a very smart idea!
It now seems EXTREEMLY LIKELY that M$ are examining everything on E drive and if its either:
a) something they have in their list of 'naughties'
b) something not on their list of 'valid' content
Then you will be banned _via EEPROM as always_.
I.e. people think it is something other that the EEPROM that is being banned simply because they are leaving the offending files on the their E drive.
I.e. M$ just rescans your E drive every time you log onto LIVE, thus people are incorrectly assuming that something other than their EEPROM is being banned.
cheers,
Bourkie
P.S. luckily I never put any of my software on the E drive and delete gamesave exploits prior to going online :-P
Post by: garyopa on October 25, 2004, 12:50:00 AM
for banning, as FACT, because of this TEST:
I took two BRAND-NEW systems, with the free 2 month trial, and
using just a original XBOX memory card, transfer a small MechAssult
gamesave hack.
I then configed the LIVE accounts.
First machine banned within 10 hours of playing time.
Second machine banned within 30 hours of playing time.
These machines were never modded in anyway. I never even use
the MechAssault gamesave hack, all I did was transfer it from an
orginal XBOX memory card.
----------------------------------
The new security update for XBOX live is I think based on many
tests I have been doing, banning systems which have HACKED
save from an XBOX LIVE GAME!
That means, my second batch of test machines with an 007 hack
file has not been banned after 48 hours of playing time.
The scanning of titleID's, I think is limited to only LIVE aware/enabled
XBOX games, if matched then check for VALID sgined file inside.
Post by: mkjones on October 25, 2004, 01:55:00 AM
I would like to know however, they are banning (they claim anyway) "cheaters" with modded cars etc, I assume these hacks are stored in E:\ as well.
Thing is, does this only include Live! games? 007 and Splinter Cell arnt Live! games? Whereas MA IS, therefore would you get banned using a 007 hack...
Post by: thatboywade on October 25, 2004, 02:58:00 AM
HAHA check this out , sumthin is not right ...... I baught a virgin xbox from best buy , and recoverd my live info on it. Played some CS on it for about a hour , turned of the good old box for a lil , eat dinner logged on and banned . This is now starting to look like a bunch of crap. Cause this is a fresh xbox hmmmmm am I being watched cause if so and M$ ran up in my house I would be going to jail for a long time hahaha PIRATE ..................... hahaha SCREW LIVE XBC for now
Post by: PedrosPad on October 25, 2004, 03:33:00 AM
| QUOTE (thatboywade @ Oct 25 2004, 11:01 AM) |
| I baught a virgin xbox from best buy , and recoverd my live info on it. Played some CS on it for about a hour , turned of the good old box for a lil , eat dinner logged on and banned . |
This is an interesting finding.
In this post I showed how the XBOX Serial Number is used as the M$ Passport login, for the XBL service. I also speculated that any banning is being enforced by the M$ Passport authentication engine. Your new XBOX has its own serial number which would have been used to sign in to M$ Passport. The Recover account route must have granted you access (since your using a new serial number), then re-associated your (banned) XBL subscription to the new XBOXs Serial Number resulting in a ban next login.
I'm not an XBL user, but I understand it is possible to store your XBL account on a memory card - for use in different XBOXs
- I'm curious how this logs into XBL - as each XBOX would have it's own serial number.....
Post by: JimmyGoon on October 25, 2004, 06:55:00 AM
| QUOTE (garyopa @ Oct 25 2004, 08:53 AM) |
| I stated earlier regarding the scanning of E: drive as the reason for banning, as FACT, because of this TEST: I took two BRAND-NEW systems, with the free 2 month trial, and using just a original XBOX memory card, transfer a small MechAssult gamesave hack. I then configed the LIVE accounts. First machine banned within 10 hours of playing time. Second machine banned within 30 hours of playing time. These machines were never modded in anyway. I never even use the MechAssault gamesave hack, all I did was transfer it from an orginal XBOX memory card. ---------------------------------- The new security update for XBOX live is I think based on many tests I have been doing, banning systems which have HACKED save from an XBOX LIVE GAME! That means, my second batch of test machines with an 007 hack file has not been banned after 48 hours of playing time. The scanning of titleID's, I think is limited to only LIVE aware/enabled XBOX games, if matched then check for VALID sgined file inside. |
This is not good at all.... not good one single damn bit....BTW: Anyone wanna sell me an xbox?
Post by: total_ass on October 25, 2004, 07:08:00 AM
Post by: eh. on October 25, 2004, 08:12:00 AM
| QUOTE (thatboywade @ Oct 25 2004, 03:01 AM - ban part) |
| I baught a virgin xbox from best buy , and recoverd my live info on it. Played some CS on it for about a hour , turned of the good old box for a lil , eat dinner logged on and banned . |
Have you (like some) received an email from M$ too, stating that your account has been suspended eh?
Post by: walker51985 on October 25, 2004, 09:23:00 AM
Lets face it, we all know about XB-S and i'm sure M$ does too, I bet they don't even think about ways to ban you on live, they just wait for you guys to come up with a theory so they can use it.
I have an Xbox, not modded in anyway. For the first time i'm not ripping M$ off... man its sooo tempting! is Live really worth the money i can save?
BTW, how do the xbox tunneling software compare to Live? Which one is the best?
regards, Scott
Post by: triggernum5 on October 25, 2004, 10:26:00 AM
| QUOTE |
| I have an Xbox, not modded in anyway. For the first time i'm not ripping M$ off... man its sooo tempting! is Live really worth the money i can save? |
To quote Jesus on South Park, "My son, I'm not touching that with a 60 foot pole.."
-
Title: Xbox Live Alert!
Post by: Flame2k on November 02, 2004, 12:46:00 PM
-
hmm, this is really confusing...
maybe m$ screwed up the code at their end or something?? - and its banning random people?
-
Title: Xbox Live Alert!
Post by: RiceCake on November 02, 2004, 02:25:00 PM
-
I'd say this is the most likely situation...
1) Logon to Live.
2) A modified dashboard is detected.
3) The EEPROM is banned.
4?) The Live account is banned.
4?) The HD serial number is banned.
5) Your ejected from Live.
Number 4 I'd say is the HD serial number. If there banning the Live account's console-unique information maybe people are just leaving it on their HD as they swap EEPROM's? Whatever.
I don't think there checking saves because they can't "detect" modified saves (Memory cards and the Action Replay system let you legitimately inject these saves so, its a poor idea). That and I have a whole crack of hacked saves and such with no current issues.
I don't think their banning large HD's either, as I haven't seen any notable problems from chipped large-hard-drive users on IRC going on Live.
-
Title: Xbox Live Alert!
Post by: mckenn88 on November 02, 2004, 05:18:00 PM
-
i always keep my GT on a mem card and when i got banned, i got a new 10 gig hd and a brand new eeprom and i was back on live. (still have the tag on a mem card tho)
-
Title: Xbox Live Alert!
Post by: chimpanzee on November 02, 2004, 06:06:00 PM
-
Just curious, do they have any legal ground to ban a box running all MS signed apps ? Can those get banned ask for refund or even compensation ? One of the big thing they advertise is Xbox has Xbox Live and then they ban a all legal box from using that feature ?
-
Title: Xbox Live Alert!
Post by: JimmyGoon on November 02, 2004, 06:25:00 PM
-
Post by: Flame2k on November 02, 2004, 12:46:00 PM
maybe m$ screwed up the code at their end or something?? - and its banning random people?
Post by: RiceCake on November 02, 2004, 02:25:00 PM
1) Logon to Live.
2) A modified dashboard is detected.
3) The EEPROM is banned.
4?) The Live account is banned.
4?) The HD serial number is banned.
5) Your ejected from Live.
Number 4 I'd say is the HD serial number. If there banning the Live account's console-unique information maybe people are just leaving it on their HD as they swap EEPROM's? Whatever.
I don't think there checking saves because they can't "detect" modified saves (Memory cards and the Action Replay system let you legitimately inject these saves so, its a poor idea). That and I have a whole crack of hacked saves and such with no current issues.
I don't think their banning large HD's either, as I haven't seen any notable problems from chipped large-hard-drive users on IRC going on Live.
Post by: mckenn88 on November 02, 2004, 05:18:00 PM
Post by: chimpanzee on November 02, 2004, 06:06:00 PM
Post by: JimmyGoon on November 02, 2004, 06:25:00 PM
| QUOTE (chimpanzee @ Nov 3 2004, 03:09 AM) |
| Just curious, do they have any legal ground to ban a box running all MS signed apps ? Can those get banned ask for refund or even compensation ? One of the big thing they advertise is Xbox has Xbox Live and then they ban a all legal box from using that feature ? |
yes. MS has lots of money and lots of smart people and lots of guarentees that say things like basically...
using XBL ... connecting anything to the xbox (power,memcard,AR) ... internet... gamesaves... means all bets are off.....
That MS for ya.
Post by: ferrari_rulz_02 on November 03, 2004, 01:31:00 AM
Post by: mkjones on November 03, 2004, 03:35:00 AM
| QUOTE (lufc2684 @ Nov 3 2004, 12:21 PM) |
| Forgive my ignorance, but if you are behind a firewall and have NAT on, surely they cannot scan your xbox |
If that was the case, you couldnt use live either
Ports would need to be opend etc...
Post by: eh. on November 03, 2004, 08:34:00 AM
| QUOTE (lufc2684 @ Nov 3 2004, 04:21 AM) |
| Forgive my ignorance, but if you are behind a firewall and have NAT on, surely they cannot scan your xbox |
They could via games, which in turn would leave something for XBL to peek at (next time it's connected) eh...
Post by: triggernum5 on November 03, 2004, 11:14:00 AM
Post by: AE6689 on November 03, 2004, 02:10:00 PM
| QUOTE |
| Could someone post or send me a listing of orginal c and e drives. so I can put back my original hd back to his original state. I will use the hd to go on live with my chip disable so they will not ban me. thanks |
Slayer's anyone?
Post by: mightyshark on November 04, 2004, 08:00:00 AM
| QUOTE (mightyshark @ Nov 2 2004, 09:45 PM) |
| Strange thing... I have an Xbox softmodded with ldots UDE 1.75 that I play on LIVE with all the time and I have not yet been banned (although I probably just jinxed myself). Hell, I spent about 6 hours friday night playing Wolfenstein on LIVE. I even forgot to delete the save on my hard drive for the last game I completed (due out in a week) and still no ban! I always uninstall UDE first but that's all I do. I don't even delete the hacked gamesaves from my hard drive. I do have two LIVE accounts since I changed my gamertag so I always log into LIVE with the gamertag that I don't care about first (just in case)! Then I logout and log back in with my new tag and so far no problems. The reason I don't fear being banned is because I purchased my Xbox with a warranty (good until the end of the year) that will simply replace my unit no questions asked (it doesn't hurt that the store manager is my buddy also)! So if I did get banned I would just exchange my Xbox for a new one. I'm not trying to brag here but I have been following this thread and wanted to add my experiences to the mix in the hopes that a cause can be determined to this mystery... |
Well, played on LIVE again with no ban (Unreal for about 90 minutes).
Again, did nothing more than the UDE uninstall and deleted a completed save for the game with that space dude in it.
Doesn't seem like we're any closer to solving this puzzle does it?
Post by: h8raid on November 04, 2004, 08:22:00 AM
Post by: eh. on November 04, 2004, 09:53:00 AM
| QUOTE (mightyshark @ Nov 4 2004, 09:03 AM) |
| Well, played on LIVE again with no ban (Unreal for about 90 minutes). Again, did nothing more than the UDE uninstall and deleted a completed save for the game with that space dude in it. Doesn't seem like we're any closer to solving this puzzle does it? |
@mightyshark: sorry if I'm misunderstanding your posts about this, but...
(i) both of them seem to be indirectly suggesting the uninstall of UDE is what's preventing you from being banned. In terms of this thread that's not surprising (see the first post for example) eh;
(ii) in your original post you all but "volunteered" to be a tester ... would you like to try again, deleting the save but not uninstalling UDE (which potentially simulates the majority of softmodders that have been banned) eh?
Post by: EthanHunt_IMF on November 04, 2004, 10:32:00 AM
| QUOTE (mightyshark @ Nov 4 2004, 01:15 PM) |
| Do I risk having the gamertag I want banned? |
At this point I would say anything's possible.
Post by: eh. on November 04, 2004, 10:54:00 AM
| QUOTE (mightyshark @ Nov 4 2004, 11:15 AM) |
| As far as trying again, I curently have 2 LIVE accounts on my hard drive since I changed my gamertag. The one I don't really care about the other I do. Do I risk having the gamertag I want banned? |
The "findings" so far that I've read in the X-S forums are that the box gets banned and the GT gets flagged. If that's the case... doing it with the spare GT wouldn't have any affect on the good GT, provided that you didn't use the good GT on that box again until you felt very confident it hadn't been banned eh...
(If you have a memcard, it would be a very good idea to transfer your good GT to it and delete that GT from the box before performing the test though eh.)
Post by: ferrari_rulz_02 on November 04, 2004, 09:33:00 PM
| QUOTE (eh. @ Nov 5 2004, 04:57 AM) |
| If you have a memcard, it would be a very good idea to transfer your good GT to it and delete that GT from the box before performing the test though eh. |
thats a good idea, if theyre just bannign the gamertag. problem is, they might also be bannign teh hard drive or such as well, and then ur screwed.
they probably also ban the gamertag in their 'database' (if they have one)
Post by: PedrosPad on November 05, 2004, 01:31:00 AM
| QUOTE (Side Step @ Nov 5 2004, 09:50 AM) |
| It is now, and has been for awhile, 100000000000% legal to own a modified Xbox in Italy. <snip /> Anyway, the idea now is that MS can not legally ban an Xbox from accessing the Live service in Italy simply for being modded. <snip/> Comments? |
Using a modifed XBOX on XBOX!Live is simply in volation of the XBL terms of service - your welcome to have a modifed XBOX, but your not welcome to play on M$'s XBL.
M$ can let who they want into the XBL club, and deny others - it's their service.
Post by: JimmyGoon on November 05, 2004, 05:32:00 AM
| QUOTE (Side Step @ Nov 5 2004, 10:43 AM) |
| I'm afraid it's not as simple as that. Love what you may. Grounds must always be justifiable, on some level. |
man... its MS here.... a multi billion dollar company...
I'm sure they can make it justifiable.
Post by: Grendalf on November 05, 2004, 07:24:00 AM
Now, how they can be 100% sure we are using a retail game or not beside checking if the box is modified??
I do not agree with their way to fix the problem since I always use the retail game to go on xbox live so they do get my $$ in any point. The fact that I am using my upgraded hdd to cache the game so I have a faster gameplay is not a reason to get ban... Maybe an installation key for the game which can be played on live should be a great idea and very easy to confirm if the game was copied or bought.
I think I would send an email to them even if I know it is useless...
Post by: triggernum5 on November 05, 2004, 10:15:00 AM
Post by: triggernum5 on November 05, 2004, 10:31:00 AM
Post by: DaddyJ on November 05, 2004, 10:40:00 AM
Plain & simple.
Post by: Flame2k on November 05, 2004, 11:35:00 AM
| QUOTE (DaddyJ @ Nov 5 2004, 07:43 PM) |
| The fact of the matter is, that if your xbox is not in a virgin state, then your may be subject to a ban. Plain & simple. |
yes but i thought we were trying to find a way around it?
Post by: DaddyJ on November 05, 2004, 11:51:00 AM
Post by: chimpanzee on November 05, 2004, 12:02:00 PM
| QUOTE (triggernum5 @ Nov 5 2004, 07:34 PM) |
| Following that auto analogy, most racing circuits don't let you race if you have modifications other than visual mods.. I don't think anybody has been banned for putting a sticker on their case.. |
But having some extra files on the HD and bigger HD is technically no difference than a sticker on the auto.
Which is why I asked, what is their legal ground ? No one challenged them because of the deep pocket they have, that doesn't mean they have any ground. That is quite similar in world politics
Post by: triggernum5 on November 05, 2004, 01:04:00 PM
Post by: Flame2k on November 05, 2004, 01:13:00 PM
| QUOTE (DaddyJ @ Nov 5 2004, 08:54 PM) |
| It seems to me, you people arent trying to get around it, you'd rather just log onto live in a modded state, playing backed up games. |
i dont use live so it doesnt really apply to me but if i did id be testing stuff etc to see if i could get round it
Post by: Rabid1 on November 05, 2004, 02:02:00 PM
| QUOTE (Grendalf @ Nov 5 2004, 04:27 PM) |
| The fact that I am using my upgraded hdd to cache the game so I have a faster gameplay is not a reason to get ban... Maybe an installation key for the game which can be played on live should be a great idea and very easy to confirm if the game was copied or bought. |
Part of the issue is most people have many games that they do not have the retail copy for. (BTW - to cache a game - I love that.) So even if you are a person who only copies games he owns, the majority of users effect you. Do you really think the boom in online game rental services kind of coincides with the recent demand for mod chips by chance?
The idea of a reg key is good, but again then you have to look at the cost to MS to implement the system, getting all the companies that are licensed to create Xbox games to comply.
It is a problem that will never go away but fortunately there are always people who will find a way around it.
For me original disk, orignal bios and original dash have worked fine for 2 months since I modded my box. I even replaced my bios and dash with an older version and let Live update it just to see what would happen. I haven't read through the entire thread but scanning HD's sounds unlikely. No one reports(from what I have read) the system bogging down, locking up or unusual load times when .logging into live. I would bet on some kind if quick media check or CRC check to verify authenticity.
Post by: ferrari_rulz_02 on November 06, 2004, 02:04:00 AM
| QUOTE (Rabid1 @ Nov 6 2004, 08:05 AM) |
| I would bet on some kind if quick media check or CRC check to verify authenticity. |
well that wouldnt work, becasue to run a game without the media check, you would need to have an 'illegal' bios, and they would detect that first. my bet is still firmly of they scan the whoel box, and if anythign is out of line, then they ban everythign that tehy can (eeprom, mac address, hdd serial number, hdd model number, gamertag) the lot.
Post by: bourke on November 06, 2004, 02:19:00 AM
They definately have changed what GETS YOU BANNED, but not necessarily what actually IS BANNED.
Post by: ferrari_rulz_02 on November 06, 2004, 02:48:00 AM
Post by: bourke on November 06, 2004, 04:59:00 AM
| QUOTE (ferrari_rulz_02 @ Nov 6 2004, 11:51 AM) |
| well correct me if im wrong, but just changing ur eeprom wont get u bak on xbox live anymore. so there must be somethign else that theyre banning. and the only other thimgs they can ban are teh MAC address, and teh hard drive serial number |
If you read the posts above you will see that some people DID unban themselves simply by removing certain files from their E drive.
Where is your evidence that anything other than EEPROMs are banned?
I.e. please be aware that there are two separate things we are talking about here:
1. There is the reason or cause of Xbox bans.
2. There is the identifying ID of your Xbox.
In the past [1] was ONLY due to non-proprietry BIOS usage.
In the past [2] was the XBox EEPROM.
Now we know _for sure_ that [1] is NOT limited to the BIOS.
So think about this: If you had something 'dodgy' on your E drive and MS bans your EEPROM. And then you change your EEPROM.
Well as soon as you log in again they will ban you yet again because of the original stuff on you E drive [1].
Just think if you changed your EEPROM in the past and then went online with a modded BIOS again - you would be banned again!
It's exactly the same both ways!
Dodgy contents on E drive / modded BIOS / invalid dashboard, they're all causes for being banned [1] and not what is actually banned [2].
Are you following yet?
Post by: YoshiKool on November 06, 2004, 05:21:00 AM
Post by: mkjones on November 06, 2004, 10:59:00 AM
| QUOTE (YoshiKool @ Nov 6 2004, 02:24 PM) |
| MS could have a way around that too... they could make their own signed PBL-ish xbe to load a BIOS with F for them.. i hope i didnt give em any ideas |
Thats the most crazy paranoid idea I have ever heard
Looks like M$ did a good job of spooking everyone simply by banning a few people who thought they could out smart them with new EEPROMS
These people who are getting bannd just wernt carefull enuf, sure how were they to know M$ would start banning people using some kind of new system, but no one has been banned that hasnt been uber carefull in the past.
Go read the threads in the xbox-live section of the forums for more information. This thread is just getting way out of hand and getting no where.
Everyone should just take a chill pill and wait for the post-Halo 2 leak anger to die down, jeez I mean AS IF they would ban EVERYONE they has suspisions of silightly modded xboxes? Its M$ we are talking about here, think of the $$$ they would be losing banning this ammount of people "forever".
I plan on signing up for live! as soon as my copy of halo 2 arrives from play.com, i wont be going crazy and un-modding my xbox. Im just gonna make sure I have the latest M$ dash and that UXE is installed and I have no crap on my E drive that could be deemed "suspect" as I ALWAYS would have!
If I get banned, my views may change, for now I just think everyone is playing into M$s hands...
Post by: Rabid1 on November 06, 2004, 10:15:00 PM
Well another thing too is when you get banned, they are still greedy and happy enough to let you keep your account open and set it up on another Xbox.
Post by: Side Step on November 07, 2004, 12:38:00 PM
Post by: Aequitas ZERO on November 08, 2004, 06:49:00 AM
On another note, what are the grounds for a lawsuit? When you make a Live account you have to agree not to use the service with a modded box.
Post by: triggernum5 on November 08, 2004, 01:14:00 PM
Another factor is xbox-linux.. There may be alot to argue there.. When the gamesave exploit was first developed, the creators approached MS with an offer/ultimatum.. They would not release the exploit to the public if MS was willing to sign a linux loader.. MS refused, perhaps cause they're jerks, perhaps because they realized that this would open up easy access to the xbox hdd/eeprom.. Not everybody who knows linux is ethically sound, but some are.. I'm going to make a prediction, if a suit does come about, the winners will be.... The Lawyers:)
Post by: JimmyGoon on November 08, 2004, 07:10:00 PM
| QUOTE (ThrustinJ @ Nov 9 2004, 04:06 AM) |
| I was banned for replacing my CD-ROM. Nuff said. |
Post by: triggernum5 on November 08, 2004, 07:23:00 PM
Post by: eh. on November 09, 2004, 10:56:00 AM
Post by: krayzie on November 09, 2004, 12:18:00 PM
| QUOTE (eh. @ Nov 9 2004, 07:59 PM) |
| Possible Cause Of The Current Bannings... (disk drive change was tracked) eh. |
it could ofcourse be that ms was collecting hd info all the time and started banning lately but that still does not explain people getting banned with stock hd's. I asume it must be a combination of stuff. In another post a guy claims to be banned after an uninstalled ltools which doesn't leave a modified/replaced xboxdash.xbe/fonts folder. So a scan of E: files/gamesaves is still one of the posibilities
Post by: eh. on November 09, 2004, 12:47:00 PM
Post by: mkjones on November 09, 2004, 05:04:00 PM
Its also nothing to do with the french Halo 2. Really, its not, please lay this one to rest!
Until we have a list of all people that have been banned and for what reasons and an IQ test that relates to the fact that at one time or another they wernt stupid enuf to either play live! with there chip ON or even worse play a live! Aware game with there chip ON (Remember Halo 2 is live! Aware as well) then we will never know what is really going on.
What I say "chip ON" this relates to the booting of a softmod too.
And remember people have been banned for using "modded" gamesaves, i.e. sooped up cars, hacked guns etc. These people need counting too.
Post by: triggernum5 on November 09, 2004, 06:50:00 PM
Post by: DarkOnyx on November 09, 2004, 08:56:00 PM
Post by: eh. on November 09, 2004, 10:13:00 PM
| QUOTE (mkjones @ Nov 9 2004, 06:07 PM) |
| As far as I can see the SmartXX thing is VERY old, just look at the date of some of the threads in that post, I really dont think this is the case for the recent bannings. If it is then not in all cases, as we know stock HD users are being banned too. |
The age of the XanTium->hamtitampti post was the important aspect (of my linked post to it). For at least 8 months, M$ have possibly been building a history of the HDD on a box when it connected initially ... plus tracking those that subsequently changed disk drives eh.
(As posted on the previous page, I totally agree that "evidence" indicates this isn't the only possible ban cause; seems to be an explanation for the majority of chipped bans I've read about today though eh.
)____
Edit: included link and changed "also indicated" to "posted on the previous page".
Post by: Rayan on November 09, 2004, 11:08:00 PM
I remember that the last time I played Live (Rainbow Six: Black Arrow) just when I booted the game up, the M$ Live Update executed, then I started playing without any problems, but today I tried to boot on live (with my Xecutor2 disabled of course) I got banned.
I think it really easy for M$ to know if your box is not legit even with the disabled chip.... Simply they get in the HD to the E and F partitions and obviously that's where most of us store game backups, so M$ bans these boxes with illegal material in their hard drives...
BTW.. I didn't run an illegal Halo2 on my box...
Oh well... Back to XBConnect...
This post has been edited by Rayan: Nov 10 2004, 07:12 AM
Post by: ZeonZaku on November 09, 2004, 11:59:00 PM
thanks,
Post by: krayzie on November 10, 2004, 09:04:00 AM
| QUOTE (Angerwound @ Nov 10 2004, 05:54 PM) |
| Bit of Info for those attempting to create theories on what's going on. |
I say they are scanning fingerprints through the controller and pc keyboards and they blacklist anyone that comes to modding sites like X-S.
Post by: DaddyJ on November 10, 2004, 09:03:00 AM
| QUOTE (krayzie @ Nov 10 2004, 12:00 PM) |
| I say they are scanning fingerprints through the controller and pc keyboards and they blacklist anyone that comes to modding sites like X-S. |
Maybe the Eject button LED's are actually enviromental scanners, There banning people based on thier houses.
Post by: YoshiKool on November 10, 2004, 09:45:00 AM
| QUOTE (Angerwound @ Nov 10 2004, 06:38 PM) |
| I myself believe them to be using the Halo 2 Loading screen to read your mind and if anything in your mind has to do with Modding an xbox or playing backups. BANNED. |
LOL!
Post by: Angerwound on November 10, 2004, 10:10:00 AM
The reasoning behind the latest bans/terminations is not because of the HALO2 leak. It's mostly because of a certain live 'exploit' you could say that allowed users to connect to the service with a backup... Since this flaw is now fixed with the latest security updates Let me explain.
As most of you know there exists HDD-Flagged versions of game executables. These files are sent down by the MS service when a game engine needs updated or bugs need fixed. Users were taking these special XBE's and placing them on the hard drive as 'xboxdash.xbe' on the 'C' Partition. Now you might think to yourself, how is this going to allow them to run the game when only the XBE file is located on the drive. Well, turns out if you place a backup of the game in the dvd-rom and then place this XBE as 'xboxdash.xbe' the xbe will be launched due to the correct signatures and then the files willl be accessed from the DVD-Rom. In conclusion, what do you have? A backup running on live.
I wouldn't advise anyone to attempt this because it will result in a ban and will not connect to the service any longer because of what is being checked. You can verify this was working at one time via the link in the first post of this thread. This brings me to my next point. In order for them to detect this they have to be checking the xboxdash.xbe file on the /c/ partition. That would be the only way of detecting this besides scannign what partition your running the XBE file from when you connect to the service.
Furthermore, this could be what is *Mysteriously* causing these bans. People are leaving a modified xboxdash.xbe file on the drive and connecting to the service with what they thought to be a retail state.
Anyhow, I hope this provides some people with a bit more info on what is happening and how to prevent it.
Post by: krayzie on November 10, 2004, 11:09:00 AM
Post by: ZeonZaku on November 10, 2004, 01:01:00 PM
Am I banned?
Post by: BLACKHAWK_PILOT on November 10, 2004, 01:03:00 PM
Just got banned!!!!!!! I the "MODIFIED XBOX ERROR". Guy please, please how do i fix this, and please no dumb comments, straigh up gime an answer cause I just bought the last copy here of Halo 2 and cant play it!!!! OH MY GOD WHAT AM I GONNA DO NOW!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Post by: bigareolas on November 10, 2004, 03:27:00 PM
Post by: TexT on November 10, 2004, 03:39:00 PM
Post by: bigareolas on November 10, 2004, 04:54:00 PM
Post by: alarre1 on November 10, 2004, 09:18:00 PM
Think it would work if I try out my friends xbox at my house using my xbox live name?
Post by: Rayan on November 10, 2004, 09:35:00 PM
I managed to transfer my Live account to a memory card right after they banned me.
If I buy a new retail packaged xbox and use my actual Live account, will I be able to play again?
Some say they ban based on HD EEPROM instead than Serial, IP, or Account, is that true?
Post by: mkjones on November 11, 2004, 03:08:00 AM
Post by: PedrosPad on November 11, 2004, 05:12:00 AM
| QUOTE (mkjones @ Nov 11 2004, 12:11 PM) |
| If this really is true then EEE never looked so good |
EEE (in it's many forms) still requires *some* non-MS files (exploit fonts for the pre-live Dash, GameSav for EEE SC, etc.) - these could be spotted.
Post by: Angerwound on November 11, 2004, 06:55:00 AM
| QUOTE (crackh34d @ Nov 11 2004, 09:44 AM) |
| this conversation has gotten more interesting, starting with angerwounds recent post about using backups on live - neat hack, that was. i'm sure there are more ways, too, since there always are. anyway, right now i'm curious about EEE. whats EEE? |
The only reason I posted this information was because the hole was already patched. If it was still open, I would never have detailed the exploit.
Post by: eh. on November 11, 2004, 10:29:00 AM
| QUOTE (Angerwound @ Nov 10 2004, 11:13 AM - "XBL exploit") |
| Well, turns out if you place a backup of the game in the dvd-rom and then place this XBE as 'xboxdash.xbe' the xbe will be launched due to the correct signatures and then the files willl be accessed from the DVD-Rom. In conclusion, what do you have? A backup running on live. I wouldn't advise anyone to attempt this because it will result in a ban and will not connect to the service any longer because of what is being checked. You can verify this was working at one time via the link in the first post of this thread. |
That would have been a HDD media type XBE initiating the connection to XBL then (which is entirely different to the XBL connection's origin for almost everyone else) eh...
From what you're aware of, does it seem to be primarily those using this method that have had their account/s terminated (which has been rarely reported, compared to the more general box bans) eh?
Post by: Angerwound on November 11, 2004, 11:00:00 AM
I'm unsure on how the XBE is actually launched from the gamesave DIR however. Anyhow, it could just check for a default.xbe within the gamesave DIR on boot of the game, if it exists - launch it.
I know this because if you attempt to go live with the outdated XBE it will ask for the update. If you connect with the HDD-Flagged (Updated XBE) - it will not ask for this - even if the gamesave doesn't exist. I assume it detects the difference between the two based upon Version Numbers.
On to your other question. Yes, this is why users had their accounts terminated rather than banned. Anyone who was seen using this Flaw was flagged and terminated. They were flagging people for almost 2 months prior to the actual termination.
*EDIT* Someone might try placing another HDD Flagged *VALID* XBE within the gamesave DIR of a Live game that already has the updated engine downloaded. Rename whichever XBE you have chosen (settings_adoc.xip would be an excellent choice due to it's valid signature and lack of support files) and place it as the default.xbe within this DIR. Boot the retail copy of the game and see if it attempts to launch the default.xbe you have placed there. If it doesn't I need to look into exactly how these updated engines are being launched.
*EDIT2* If they are actually executing the XBE's in this manner, what would prevent one from placing a UXE Bootstrap here and launching your custom dashboard with a live game of your choice?
A setup valid even under the new security measures...
Post by: eh. on November 11, 2004, 11:27:00 AM
| QUOTE (Angerwound @ Nov 11 2004, 12:03 PM - launch mechanism) |
| I'm unsure on how the XBE is actually launched from the gamesave DIR however. Anyhow, it could just check for a default.xbe within the gamesave DIR on boot of the game, if it exists - launch it. |
I suspect it compares the certificate version of the default.xbe in the $u directory with that of the initiator (in memory, superceding if necessary) and the XBL connection thereafter peeks at the version in memory to see if an update's needed.
Also in memory, at least the non-secure state indicator would be different for HDD booted XBE's (compared to what XBL knows should be the case booted via DVD's) which I suspect would be easy for the connection applet to validate eh...
____
Edit: corrected re "booted".
Post by: eh. on November 11, 2004, 11:35:00 AM
| QUOTE (Angerwound @ Nov 11 2004, 12:03 PM) |
| *EDIT* Someone might try placing another HDD Flagged *VALID* XBE within the gamesave DIR of a Live game that already has the updated engine downloaded. Rename whichever XBE you have chosen (settings_adoc.xip would be an excellent choice due to it's valid signature and lack of support files) and place it as the default.xbe within this DIR. Boot the retail copy of the game and see if it attempts to launch the default.xbe you have placed there. If it doesn't I need to look into exactly how these updated engines are being launched. *EDIT2* If they are actually executing the XBE's in this manner, what would prevent one from placing a UXE Bootstrap here and launching your custom dashboard with a live game of your choice? A setup valid even under the new security measures... |
I've tried these kinds of things on more than one occasion before, without success. They no doubt validate things like the $u default.xbe's title id too, alas eh.
Post by: Angerwound on November 11, 2004, 11:58:00 AM
Post by: eh. on November 11, 2004, 12:12:00 PM
| QUOTE (Angerwound @ Nov 11 2004, 01:01 PM) |
| Ah, well that kills that idea. But it still would be of great interest to see exactly how these XBE's are being executed. In other words, what is needed for it to okay it to be launched. |
It doesn't kill the idea entirely though; someone with real skillz might be able to make something of it. For example, it potentially just validates via the associated contentmeta.xbx (such as a checksum) eh.
____
Edit: Hmm, by "real skillz" I just meant compared to my stare at it, think, try things, stare at it more, ponder, try other things (interative approach) ... so I should have said "any skillz" eh!
Post by: mkjones on November 11, 2004, 03:40:00 PM
Will it ever come true, who knows
Post by: DaddyJ on November 11, 2004, 06:45:00 PM
Post by: MasterChief B on November 12, 2004, 11:07:00 AM
| QUOTE (EthanHunt_IMF @ Oct 19 2004, 08:48 PM) |
| Thanks for the heads up... Fortunately I use a virgin box for live, so MS can go to hell. |
MS's counter measure arguably worked if you had to buy two boxes.
Post by: awal on November 12, 2004, 03:58:00 PM
| QUOTE (alarre1 @ Nov 10 2004, 11:21 PM) |
| I got banned today also trying to play Halo 2 with my mod chip off. Think it would work if I try out my friends xbox at my house using my xbox live name? |
i was banned, then i bought a "new" virgin xbox for $50 and i transfered the xbl account to a memory card. And i have been playing on Live for 3 days. I have just been leaving the memory card in when i want to use live, but i am almost positive it will work off the hdd, but i am not going to do that yet. ( if it isnt broke dont fix it
)
Post by: The_Truth on November 12, 2004, 05:37:00 PM
if it can be changed.. if we could find the specific "settings" for XBOX-DVD... anyone feel free to smack me down.. but neither eh nor I knew where to go with it...
Post by: EthanHunt_IMF on November 12, 2004, 09:00:00 PM
| QUOTE (MasterChief B @ Nov 12 2004, 02:10 PM) |
| MS's counter measure arguably worked if you had to buy two boxes. |
I got it way before this current live banning thing started. It would have cost me more out of pocket to get a mod chip then the 2nd box. I didn't "have" to buy another box, but now I'm sure glad I did.
Post by: Angerwound on November 12, 2004, 09:18:00 PM
Post by: shishtawoo on November 13, 2004, 09:54:00 AM
Post by: eh. on November 13, 2004, 12:27:00 PM
| QUOTE (The_Truth @ Nov 12 2004, 06:40 PM) |
| as for the "boot disk".. eh and I were discussing it in a post... and the idea came about... that a dvd+r disk's book type can be changed from dvd+r to DVD-ROM if it can be changed.. if we could find the specific "settings" for XBOX-DVD... anyone feel free to smack me down.. but neither eh nor I knew where to go with it... |
Dude, I guess you discussed that with someone else (re linked post) eh?
Post by: RiceCake on November 14, 2004, 07:11:00 PM
And if it did I'd like to sue MS for invasion of privacy. I never had to agree to anything when my friend plunked it into my system.
Post by: PedrosPad on November 15, 2004, 03:07:00 AM
| QUOTE (eh. @ Nov 11 2004, 08:38 PM) | ||
I've tried these kinds of things on more than one occasion before, without success. They no doubt validate things like the $u default.xbe's title id too, alas eh. |
IIRC the XBL downloaded, HDD flagged, updated XBEs, are put in E:\UDATA\[TitleID]\$u ('$u' for update?).
After read your posts, I happened to pop across to this post here. An access file dump for the SWBF Demo XBL title!
The line
| CODE |
| t:\$u\contentmeta.xbx |
caught my eye. (Assume that t: is mapped to "E:\UDATA\[TitleID]\".) It could be that the t:\$u\contentmeta.xbx files contains a flag that controls the launch of a sibling default.xbe, and may also control what XBE details are checked for.
-
Title: Xbox Live Alert!
Post by: eh. on November 15, 2004, 12:02:00 PM
-
Post by: eh. on November 15, 2004, 12:02:00 PM
| QUOTE (eh. @ Nov 11 2004, 01:15 PM) |
| It doesn't kill the idea entirely though; someone with real skillz might be able to make something of it. For example, it potentially just validates via the associated contentmeta.xbx (such as a checksum) eh. ____ Edit: Hmm, by "real skillz" I just meant compared to my stare at it, think, try things, stare at it more, ponder, try other things (interative approach) ... so I should have said "any skillz" eh! |
Even better, Pedro has UberSkillz eh!
Post by: eh. on November 15, 2004, 12:39:00 PM
| QUOTE (PedrosPad @ Nov 15 2004, 04:10 AM) |
| After read your posts, I happened to pop across to this post here. An access file dump for the SWBF Demo XBL title! |
Hmm, this linked post will probably be interest to you too eh...
Post by: Angerwound on November 15, 2004, 01:42:00 PM
BTW, Pedros contact me via Email or AIM. I have some things to speak with you about.
EDIT: If I'm not mistaken, aren't .xbx files some sort of image file for the xbox?
Post by: eh. on November 15, 2004, 02:13:00 PM
| QUOTE (Angerwound @ Nov 15 2004, 02:45 PM - question) |
| EDIT: If I'm not mistaken, aren't .xbx files some sort of image file for the xbox? |
At least TitleImage.xbx and SaveImage.xbx are, but at least TitleMeta.xbx, SaveMeta.xbx and ContentMeta.xbx aren't eh...
Post by: PedrosPad on November 15, 2004, 02:47:00 PM
Content Meta-information - information about the downloaded content.
I'd speculate that the boot code in the DVD based XBL game's XBE consults this file very early in the start sequence - in case a replacement, updated, default.xbe is, in fact, included in the manifest. Given the number of HDD flagged XBL XBE's, this would appear to be a standard XBL library routine built into all XBL games.
Angerwould,
I've not yet look into the contentmeta.xbx, but at it's simplest it could simply be a list of filenames, along with their checksums, you could try replacing the $u/default.xbe with one from another game, and HEX pasting it's checksum into the manifest. This wouldn't get anyone very far, but it'd confirm the theory.
Post by: spinr34 on November 15, 2004, 11:13:00 PM
note: this doesn't mean that the live software isn't part of the enforcement, the live software could very easily just collect information about the xbox and then send it to ms with every login to live. it just means that the live software doesn't enforce the bans.
Post by: bigfreak on November 16, 2004, 12:28:00 PM
1.) Has anyone done this and been banned anyway??
2.) I no longer have the EXACT HD that came with my xbox. I'm sure I could round up another xbox hd that I could lock with my eprom, but would this result in being banned?
Post by: oracle1118 on November 17, 2004, 06:56:00 AM
Good luck to you.
Post by: Agent Orange on November 17, 2004, 08:03:00 AM
Post by: Angerwound on November 17, 2004, 09:02:00 AM
| QUOTE (Agent Orange @ Nov 17 2004, 11:06 AM) |
| PacoSuave, did you consider the fact that they could take your IP and MAC adresses when banning you? It is completely impossible to change the MAC address, it is assigned when they make the NIC. |
The mac address is contained within the eeprom data. The mac address of your xbox can be changed to what ever you desire.
Post by: dabolikk on November 17, 2004, 01:18:00 PM
| QUOTE (PacoSuave @ Nov 16 2004, 01:20 PM) |
| ...Then just about a month ago I decided to buy a new eeprom and get on XBOX live. I did it and for about a month I played without problems.... ...EVERYTHING IN MY XBOX IS RETAIL!!! NO HACKS of any kind! NO FAKE GAME SAVES! NO UPGRADED HDD...and they still banned me. |
Hey PacoSuave,
Maybe the person who sold you the eeprom, wasn't honest enough and he/she sold it to someone else too. Just my opinion.
Post by: Angerwound on November 17, 2004, 08:32:00 PM
Post by: mkjones on November 18, 2004, 02:02:00 AM
| QUOTE (Angerwound @ Nov 18 2004, 05:35 AM) |
| http://www.xbox-scen...ZFpAuUjEVQQ.php |
Well done man
What would we do without ya man
Post by: ChRziz on November 18, 2004, 12:55:00 PM
Bottom line: Use a virgin xbox to play on live, it might cost $150, but it saves you a LOT of time and you don't ever have to worry about getting banned.
Post by: Australian Rat on November 19, 2004, 01:06:00 AM
Only thing is it is looking like it is going to involve some fairly extensive hardware modifications. It has been succeeded relatively easily for 1.2 boxes and above (might be 1.1 as well, i forget), because they use a heat sink which can be cut back to make room with no really bad impact. Only 1.0 boxes are looking like a bitch to mod...
Post by: PedrosPad on November 19, 2004, 01:51:00 AM
| QUOTE (zoomer777 @ Nov 18 2004, 06:16 PM) |
| Couple of things: first, moderators should make a sticky for your procedure that doesn't allow replies (except by you!) |
Angerwound is a moderator (see here) - The man is so hard working -
Post by: DaddyJ on November 22, 2004, 04:35:00 AM
WTG
Post by: tooling on November 25, 2004, 10:28:00 AM
2 if I need a new account can i set it up with the same credit info how do I know the first account is canceled I used a 2 month sub subscripion card to open th account so I hate to wast it then get a charge on my card in 2 months.
3 Is it cool to call 18004MYXBOX to explain my delama
Post by: PacoSuave on November 26, 2004, 02:20:00 PM
| QUOTE (tooling @ Nov 25 2004, 07:31 PM) |
| I got band yesterday I'm just going to buy a new box just for live. but have a few questions 1 is my accout still active and should I try to transfer it to the new box? 2 if I need a new account can i set it up with the same credit info how do I know the first account is canceled I used a 2 month sub subscripion card to open th account so I hate to wast it then get a charge on my card in 2 months. 3 Is it cool to call 18004MYXBOX to explain my delama |
Yeah Dude you should call 1-800-4MYXBOX and ask them if your account is still active and you have to call them to cancel a previous one anyway. So call them and someone will be happy to help you. I've called that number so many times.
It's what they get paid to do. You are a MS customer so you deserve to call without worrying.
Hope you get everything sorted out.
Post by: EthanHunt_IMF on November 27, 2004, 02:27:00 PM
You could try using the account recovery option on the new box. It seems the people who's accounts were closed were the ones on "Micro$oft's List". Probably the ones playing backups on Live.
Edit: spelling mistake
Post by: ipodder2003 on November 30, 2004, 05:45:00 PM
Post by: Angerwound on November 30, 2004, 08:04:00 PM
BTW, I'm going to unpin this thread. It seems to be dieing off and everyone seems to be aware of the situation. If you need more assistance feel free to visit the XBOX Live forum.