Post by: maddy2005 on December 16, 2005, 02:06:00 PM
Post by: t_mac_ca on December 16, 2005, 02:11:00 PM
QUOTE(maddy2005 @ Dec 16 2005, 05:13 PM) 
people says that it isent working :S read at the forum youre linking to...
yea i just read that, i posted this before people reported it not working srry
Post by: maddy2005 on December 16, 2005, 02:19:00 PM
Post by: jameswalter on December 16, 2005, 10:58:00 PM
Edit1: Damn....error at 880MB...Downloaded CloneCD....trying it now....probably something to do with error correction.
Edit2: CloneCD is going further than the 880MB mark...though it did slow down, but it is slowly making progress.
Post by: jameswalter on December 16, 2005, 11:21:00 PM
QUOTE(kday @ Dec 16 2005, 10:27 PM)
The dump worked fine with my NEC ND-3500A.
I assume it may not work with some DVD drives depending on the make and firmware and such.... just speculation.
Wow....coincidence...I also have a 3500A.
Edit: I was able to complete the dump. Qwix won't open the file, but UltraISO will. It shows the Video_TS folder but all of the data off the disc was dumped. I tried the program they had on that website but it may only work for 360 ISOs.
Post by: Gerjan on December 17, 2005, 08:22:00 AM
http://gueux-forum.n...21
Post by: kday on December 17, 2005, 02:44:00 PM
Now what I am thinking is could we use a hotswap method to get a game backup to run? For starters, could we make a copy of an original XBOX 360 game, and try to force the 360 to run the backup after the disk check and launch of the .xex file is made.
I know it's pointless to run a XBOX 360 backup of a game you already legally own, but it would be good research.
I do not have a 360 yet, and have been using my roomates. I am not going to try this myself because it's not my XBOX.
Somebody correct me if I'm wrong. No flaming.
Post by: bowser22 on December 17, 2005, 05:27:00 PM
Post by: t_mac_ca on December 17, 2005, 09:01:00 PM
Post by: Monoxboogie on December 17, 2005, 09:17:00 PM
QUOTE(Arakon @ Dec 18 2005, 02:14 AM)
hotswapping is not and never will be possible, since the executable is checked for a valid signature before running. since the signature is actually part of the executable, there's no way to swap.
that only works for protections like the ps1 and ps2 has, a single check on boot time.
Hmmm...I like. It's an insane venue of attack...
Boot a game. Wait for the spin down to occur at a place prior to the loading of media. Insert a malformed disk with a similar TOC, only pointing to some sort of bad data. When the Xbox finishes what it has in RAM, and pages the DVD for the media to play, BAM! Malformed media file causing nasty things to happen.
Chances of successful exploitation: Low.
Modification to Xbox required to execute: High.
Chance MS would have considered such a venue of exploitation: Low.
If I were absolutely insane, and owned an Xbox, I'd give it a whirl. Of course, it'd take a deep understanding of the flow of execution of the 360. One would have to know what routine handled the loading of the media, as well as what (if any) garbage data made it do it's bidding.
I've read a few hundred piss poor ideas as of lately. This idea may only seem "good" to me by comparison. At least I'm trying to do a bit better than 90% of the ideas.
Post by: cjack on December 18, 2005, 08:35:00 AM
Post by: Tiros on December 18, 2005, 10:50:00 AM
Maybe just put a little switch on TrayIn/TrayOut so the drive can't detect the drawer has been opened.
Post by: MaTiAz on December 18, 2005, 01:06:00 PM
QUOTE(Tiros @ Dec 18 2005, 06:23 PM)
If the signature is indeed part of the executable, than why is the signature not copied when the executable is extracted?
It is copied, but since media checks prevent it to run on other media than genuine X360 disks we need to patch the media checks thus invalidating the signature. The media checks involve the part of the file which is signed and changing the media checks would break the signature resulting in Xbox not executing the code.
Post by: DivyX on December 18, 2005, 04:44:00 PM
I was going to try this dump method with linux, fedoracore 4 to be exact.
If someone has done it with "readcd" "cdrecorder" "xcdroast" or whatever you could post some insight a.k.a command lines and additional tricks.
Preferred way would be just to use linux own command line tools.
I played so far like this:
***********
[root@axx-xxx-xx-xxx ~]# readcd -noerror -nocorr retries=0 Read speed: 11080 kB/s (CD 62x, DVD 8x).
Write speed: 2770 kB/s (CD 15x, DVD 2x).
0:read 1:veri 2:erase 3:read buffer 4:cache 5:ovtime 6:cap
7:wne 8:floppy 9:verify 10:checkcmds 11:read disk 12:write disk
13:scsireset 14:seektest 15: readda 16: reada 17: c2err
18:readcd 19: lin 20: full toc
Enter selection: 0 (0 - 20)/<cr>:11
Capacity: 87104 Blocks = 174208 kBytes = 170 MBytes = 178 prMB
Sectorsize: 2048 Bytes
Ignore disk size? yes
Copy from SCSI (0,0,0) disk to file
Enter filename [disk.out]: /mnt/dvd/mybackup.whateverextension
Enter starting sector for copy: 0 (0 - 9999999)/<cr>:0
Enter number of sectors to copy: 10000000 (1 - 10000000)/<cr>:
Enter number of sectors per copy: 64 (1 - 64)/<cr>:
************
My noob logic with these commands were:
-noerror so readcd won't stop when error is read ( obviously often past the normal dvd sectors? ).
-nocorr for no error correction which i'd imagine would be good option?
retries=0 so it won't try the default 128 times to retry when error occurs thus speeding the process vastly
that is still "very" slow.
"In program" options are obvious i'd guess, but whatabout sectors? I can check how many sectors the dvd video section takes and start after it or from the beginning. 10million sectors to copy with the current speed takes like a week very wildly guessed.
Well, with these options it creates a whatever file you have told it to create. I dumped 180mb from pdz disc or did I?
The good question is did it just write the whole file full of nothing, zeroes, air? I haven't been able to verify if there is written game data as the process is slow. The dvd video section data certainly seems to be there but past it i don't have a clue yet. I don't know from what sector forward the actual game might exist etc. Readcd's output still lists errors for every sector like theres no tomorrow but atleast it does something
So as theres prolly many who have done this with linux somehow, let us know.
Please do note that the readcd example isn't taken when pdz is mounted.
Post by: DivyX on December 18, 2005, 05:58:00 PM
QUOTE
Can we shut this shit down already??
Hehe. you wish, i find all alternatives instresting.
FYI we also have many modchips to choose from these days, they actually differ even though doing same concepts.
Post by: edit_text on December 18, 2005, 10:45:00 PM
e_t
Post by: Arakon on December 19, 2005, 04:08:00 AM
Post by: Gael360 on December 19, 2005, 04:15:00 AM
QUOTE(cjack @ Dec 18 2005, 04:42 PM)
Mmmhh, just ripped KingKong with the swap method. CloneCD created a 7.61GB iso image. Checked the iso using an hexeditor and contains a lot of data. Opening the iso with DaemonTools or MagicISO i can see only the directories VIDEO_TS and AUDIO_TS....but I think that x360 data are really in the iso.... Will be nice to see if the rip works but no modchip yet to try
Hi,
I'm the guy who released the procedure for hotswap dump.
First, sorry for my english, but I hope it's better than this horrible auto translation I saw...
This procedure has a problem concerning the second layer on a DVD9, because there is 2 way for putting data on a DVD-DL :
the PTP method, used for data DVDs, the layer 1 start from the center of the disc and go to the edge, and the seconed layer do the same. This shape is good for performances but at the end of the first layer you have to wait for the DVD player to go back to center of the DVD to start reading the second layer.
This is a problem while playing a movie DVD, because you can't wait one second during the movie ...
So there is a second way to write a DVD9 : the OTP method.
This time the data is from center to edge for the layer 1, and from edge to center for the layer 2.
All the movie DVD are in OTP desing, and data DVD are in PTP design, and I'm pretty sure the XBOX360 DVD are in PTP, so you have to use a data DVD for hotswap ... it SHOULD solve this issue, but I'm not really sure (I need to do more tests...)
But for KingKong, the entire game is only 2,3Go so you can (and must) do the hotswap with a DVD5, with only one layer. This time no matter if it is a movie or data DVD, because there is only one layer so no design problem.
So I hope I'm understandable with my bad school english, I'll send you an update after my second layer tests.
Post by: crosseye on December 19, 2005, 10:02:00 AM
Post by: jameswalter on December 19, 2005, 11:07:00 AM
Post by: Tidus_Beta on December 19, 2005, 06:19:00 PM
if you dont beleive me, fine, but if u do it with a xbox1 game, and then run it in dademon or anything like that, it starts up the *this is a xbox disc* video, which means it acts like a normal disc, even tho its a image.
once again, beleive me or not, but there the video!
Post by: H2290 on December 21, 2005, 10:52:00 AM
Also, if the 360 DOES use PTP then I have done something wrong because it seems the drive is heading back toward the middle trying to read it's way in from the outside like in UTP. It is possible I wrote the Data DVD with Nero using the wrong mode. I will go back and see if there is any way to tell.
Post by: jameswalter on December 21, 2005, 11:04:00 AM
QUOTE(H2290 @ Dec 21 2005, 09:59 AM)
Okay, I am posting a problem dealing with this Dual Layer thing. I can read the first layer of any game and extract the files and it works fine. Now I was using Lord of the Rings: Return of the King and found this problem to be true. So I made a DVD+R DL full of music. I used this with the swap method instead and now I am watching the laser right now having problems heading back toward the inside of the disc. Is this a problem with the way the DL DVD was written or because I used a +R? Has anyone done a dual layer disc successflly and what did you use nad see?
Also, if the 360 DOES use PTP then I have done something wrong because it seems the drive is heading back toward the middle trying to read it's way in from the outside like in UTP. It is possible I wrote the Data DVD with Nero using the wrong mode. I will go back and see if there is any way to tell.
It sounds like the same way a DVD Video does. There may be a special way the DVD needs burnt like you said.
Post by: H2290 on December 21, 2005, 12:33:00 PM
Post by: Gobelet on December 21, 2005, 02:28:00 PM
Post by: H2290 on December 21, 2005, 04:14:00 PM
Used T2EE PTP disc and no good. But I did do the swap and then look at the DiscInfo Tool in Nero and now it is showing this for COD2Capacity: 7.73GB - taken from T2EE disc apparently
Layers: 2 - that's right
Version: 1
Track Path: OTP - now this was PTP when I inserted the T2EE disc and now it has changed
Title: XBOX 360
And using a PTP disc as the original I can not get it to go past 50%, but with an OTP as the starting disc I have got finished ISOs that just seem to have some junk files. I think the XBOX360 discs are OTP due to this and the reporting from the Nero Tool. Maybe the junk files I am seeing after the extraction are encrypted files or signatures of some sort.
Post by: DivyX on December 22, 2005, 01:04:00 PM
Post by: DivyX on December 22, 2005, 05:48:00 PM
). It could also be nero thing, or relation between the discs being used or some sort of security "stuff" or you name the rest.
Can hopefully look this issue also tomorrow ( friday ).
Post by: H2290 on December 22, 2005, 08:23:00 PM
The DVD drive is still having real problems at the very outer edge of the disk which I find quite interesting, maybe there is something out there.
Well, maybe I am all wrong. This seemed like a good OTP copy but it appears all audio on Layer2 is clumped into one gigantic file and unreadable. So, is it PTP? Good question.
Post by: Gael360 on December 25, 2005, 07:25:00 AM
QUOTE(H2290 @ Dec 23 2005, 04:30 AM)
Okay, I meant they are definitely OTP if you read the above post. I just used an OTP disk (The Aviator) and got a good read on PGR3 with solid files throughout. Default.xex is there, unlike with COD2 and I've also got all audio and such from both layers. Seems like a good rip to me.
The DVD drive is still having real problems at the very outer edge of the disk which I find quite interesting, maybe there is something out there.
Well, maybe I am all wrong. This seemed like a good OTP copy but it appears all audio on Layer2 is clumped into one gigantic file and unreadable. So, is it PTP? Good question.
I'm agree with you, after many tests I think that Xbox DVDs are in OTP, but the first layer is smaller than the first layer of a 'normal' DVD. So when you are reading sectors at the end of the first layer, you should already be at the beginning of the second layer...
This is why you can see on the first layer a XDVDFS entry for the folder 'layer2' (in 'Game\Audio\Music'), but when you go to the address desribe by this entry, it's not in the good place. So there is a difference between the real second layer and the one you make with the hotswap method.