xboxscene.org forums

Xbox360 Forums => Xbox 360 Hacking Forums => General Technical Hacking Discussion => Topic started by: alan_poh on December 07, 2009, 01:16:00 PM

Title: 360 Elite 2009,01,04 Exploitable?
Post by: alan_poh on December 07, 2009, 01:16:00 PM
MFD 1st April 2009 ?

YES, you can dump the key from that....

you will run in problems if you buy a MFD august 2009....

there is a method of dumping that too now, but if you dont want (and dont know how) to solder and cut traces then its good to buy some older then august 2009....

and of course, its a Jasper.... you really are a noob right :-) no offense... :-)
Title: 360 Elite 2009,01,04 Exploitable?
Post by: Bukmop on December 07, 2009, 01:43:00 PM
QUOTE
If it is hackable ,

    Check the dashboard\kernel version. If its less than 8xxx that its hackable.
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SoloStyl on December 07, 2009, 03:43:00 PM
Thanks for the replies fellas.  smile.gif

(But NOT the Noob insult !!  dry.gif

Actually, I've dumped my Falcon NAND,(for HDD unbanning Mod), and I'm really good with soldering skills.

Damn, didn't expect to hear it might be a Jasper though, Bummer.

I havent looked into "cutting traces" on those boards since I dont have one, but I'm sure with the Awsome tuts that are posted here, it wont be hard to find whick ones to cut. BTW, I also have a Trace Recovery Soldering kit and a MicroScope, "NOOB".  LOL  biggrin.gif   j/k

If its a Jasper, (I bet your right Bukmop) , definitely gonna need USB Dumping. It takes 48 mins. per dump on my Falcon. Read somewhere it can take 8 hours on a 512 Meg Jasper! AARGH

Thanks again Fellas, I'll keep ya posted.
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SoloStyl on December 08, 2009, 09:12:00 PM
Okay, Bought a new one.

256 Meg Arcade that was made 2009-04-28.

getting ready to take apart and start soldering.

heres a quick question: should I dump the NAND BEFORE I ever turn on the 360 for the first time??

or would it matter if I turn it on and then Dump the NAND?

Im just guessing here, but if the NAND has never been used or written to- by turning on the 360, it would be better right? sort of having an "untouched" Nand Dump.

what do you guys think?
Title: 360 Elite 2009,01,04 Exploitable?
Post by: under420dog on December 08, 2009, 11:38:00 PM
wo0000, slow down there speedy...first yes fire it up and look what dash version you have in system info....it's gota be 7173 or lower i think i am tired now,sorry
then you will be able to see if it can do the jtag hack...if not just hook it up for the nand dump...just to save for the future...
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SoloStyl on December 09, 2009, 03:29:00 AM
Wait, now im more confused.

quote  "jhnblckwood"   said  

check the manufacturing date: and if that dont help you then your gonna have to try to dump and see...
as long as you dont have a new xbox than 7371 and below is fine..

wondering if its worth the waiting a few hours and doing the NAND on this board....

edit: seems the kernel is ok, but I have to Dump it regardless to find out the CB values , double DAMN  lol
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SoloStyl on December 09, 2009, 01:15:00 PM
dumped a 2meg NAND
dumped a 16meg NAND

my Box says it has 256MB onboard memory, but when dumping with NandPro20 , it says "512 Flash detected".

so what is it a 256 or a 512 Jasper? (havent done the Full NAND Dump yet) until im sure waht size it really is.

Also, how do I check the "CB/CD" versions?

i ran 'em through xbox 360 flash tool, and of course it says  "not supported".
I also changed "M$ 2004-2008"  TO  "M$ 2004-2005"

any other tools that can show "CB" values, or just need to install  Jasper256/512_hack.bin?

the more posts I read, the more confusing its getting.  been at this for days now.


Title: 360 Elite 2009,01,04 Exploitable?
Post by: SoloStyl on December 09, 2009, 02:06:00 PM
well i was able to read the 16Meg file with 360Flash Tool.

CB,CD = 6723
CE = 1888
Patch 0 = 7357

So, what do you guys think, "exploitable"?  even though its CB/6723 and not 6712, should I keep this thing or get rid of it?

thanks in advance
Title: 360 Elite 2009,01,04 Exploitable?
Post by: Zheez on December 10, 2009, 02:31:00 AM
Yes Jasper CB 6723 is exploitable so I would keep it.
Title: 360 Elite 2009,01,04 Exploitable?
Post by: arielzadi on December 10, 2009, 03:44:00 AM
i have a question...
Just got a new arcade with a 93 lite on and the kernel is 73 or 76 something i dont remember.... Is there any chanse that i could find out the cb so icould know if its exploitable?
Thanks

Title: 360 Elite 2009,01,04 Exploitable?
Post by: torne on December 10, 2009, 05:05:00 AM
The only way to tell for sure is to dump the NAND and look at the dump. The manufacturing date is only a clue sad.gif
Title: 360 Elite 2009,01,04 Exploitable?
Post by: arielzadi on December 10, 2009, 05:19:00 AM
so lets say that i dumped the nand...
How do i check?
Title: 360 Elite 2009,01,04 Exploitable?
Post by: torne on December 10, 2009, 07:29:00 AM
Load it up in the flash dump tool and it will tell you the version of each section. There's also a tool around somewhere which literally just displays the CB version..
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SoloStyl on December 10, 2009, 02:46:00 PM
WTF!!

Everytime i solder the JTAG wires, my power brick light turns RED!!

i already checked the welds, ran through continuity tests, even soldered a
330ohm resistor on J2D2.4<->J2D2.7 as another user suggested.

as I stated before , DB1F1 solder came off , so I scraped arround it and added some solder and welded Diode onto there. all diodes are lined up properly too.

All im trying to do is use nandPro to write the "hacked_jasper_256/512.bin" so I can get my KV/CPU Key.

Title: 360 Elite 2009,01,04 Exploitable?
Post by: SpIdErXeN on December 11, 2009, 05:22:00 PM
Hey Solo, I feel all your pain bro. I just bought an arcade unit today that has a mfg. date of 2009-04-17. Mine also has a Dash Value of 2.0.7363.0 and Kernel Value of 2.0.1888.0. After setting up the unit, creating an avatar, setting the initial settings, I checked the "Memory" section, it said I had 322mb left of writable space.

So, I'm thinking I have a 512mb Jasper, right? I'm not really sure since I'm an ultra noob to the NAND side of things, I was mostly into the drive firmware side of things. Anyways, I believe it's the power connectors on the power supply cable that tell you which version of the console you have, right?

I imagine my console is nearly identical to yours, in terms of mobo versions, etc. My question is, are our consoles Jtag-able? I'd kill to get homebrew running on this thing man, that's all I want for Christmas. lol
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SoloStyl on December 12, 2009, 03:39:00 PM
SpIdErXeN,
here's a tip also. DONT FORMAT your onboard memory device on the XBOX settings.

if you format your memory device, you'll lose LOSE the Avatars and maybe some other important things as well. If you format , you'll get a message asking you to connect to live and says you an "UPDATE"

DONT, NO WAY, DONT

I also wonder what version MoBo I have  , box says 256meg Xbox 360,   but memory device says 322megs, and  466megs If you  decide to format  which I think would be a mistake

if anyone does format, there might be a way to re-install 7363 kernel on Jaspers so far, but i dont know if thats gonna burn any "Efuses"

I plan to make a circuit board with mini swithes for the RT63 resistor and a switch for the "grounding the NAND" to avoid access to it

first i need the LPC-H2148 USB Jtag baord ,  looking for 1 now

keep in touch
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SpIdErXeN on December 12, 2009, 10:40:00 PM
Hey bro, I actually lucked out. I remembered buying the jtag lpt adapter/connector a while back when xell was originally announced and running on xenon boards only. I think I got it for around 15 bucks on ebay if i remember correctly. I didn't know that it would take around 9-10 hours to read the nand over that thing for us though lol. If you run across one that has a usb connector, definitely let me know, I'd love to get my hands on one of those as well.

Thanks for the tip on not formatting, the "what if I format, how much space would I have?" thought actually crossed my mind last night, but luckily I didn't. lol, thank god, that'd have been a real boneheaded maneuver on my part, heh heh. I'll let you know how my efforts to xell this thing goes. Take it easy Solo, thanks for all your help so far, have a good rest of the weekend.   beerchug.gif
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SoloStyl on December 13, 2009, 06:08:00 AM
yeah bro, no problem

learning myself and helping as I can

the 256meg Jasper takes about 9-10 hours on LPT, 20+ hours for a full 512meg  huh.gif

...and thats just for one NAND dump! i like to get 3-4 NAND Dumps just in case
thats why im going the USB LPC-h2148 route

it should only take 30-45 mins for the 256meg Jasper  and 1-2 hours for the 512meg Jasper

LPC-h2148 reads:
16megs in 2 mins   FULL NAND Dump 256/16*2mins = 32 mins(PC dependent)  compare 9-10 hours on LPT
16megs in 2 mins   FULL NAND Dump 512/16*2mins = 64 mins(PC dependent)  compare 20+ hours on LPT

someone already posted write speeds somewhere
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SoloStyl on December 13, 2009, 06:56:00 AM
Just order my LPC-h2148 and RS-232 SMD Shifter

SparkFun   total: $64.00 US (including Shipping)

takes 3-5 buisness days to get here from FedEx

WOOT  biggrin.gif
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SpIdErXeN on December 13, 2009, 06:13:00 PM
Sweet, hell yeah! You're the man Solo! I'm gonna grab one of these as soon as I get paid. Definitely the 3-4 nand dumps are the way to go, for sure, I totally agree. Aww crap, it looks like their website is down currently. Wonder when that happened.
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SoloStyl on December 13, 2009, 10:01:00 PM
im the man? lol  nah i just love all this stuff

all credits go to xbox community for sharing their knowledge

btw  did you try sparkfun? site should be up

dude i quit trying to type on this PSP    lol

going back to my Pc
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SoloStyl on December 18, 2009, 12:35:00 PM
UPDATE: Dec 18,2009

XbRebooter is now available for 256/512 Jaspers.
You can find what you need at "the usual places"

Thanx Go To The Entire Xbox360 Scene (you know who you are  wink.gif )
We Appreciate all your hard work fellas
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SpIdErXeN on December 19, 2009, 09:04:00 PM
QUOTE(SoloStyl @ Dec 18 2009, 08:35 PM) View Post

UPDATE: Dec 18,2009

XbRebooter is now available for 256/512 Jaspers.
You can find what you need at "the usual places"

Thanx Go To The Entire Xbox360 Scene (you know who you are  wink.gif )
We Appreciate all your hard work fellas


Oh HELL YEAH! Thanks Solo, best news I've heard all week!  biggrin.gif

Crap...sparkfun is out of the Header board for LPC2148. >_<


Well, I believe I found them on a couple of different sites, a little more expensive, but they look the same. Solo can you please look at this one for me and verify if its the right one before I buy. Thanks a bunch bro.

http://microcontroll...roducts_id=1393
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SoloStyl on December 20, 2009, 02:45:00 AM
yup, thats the one   smile.gif

dont forget you still need the RS232 Shifter SMD board to be able to flash the lpc-h2148
(some use other types, but this is easier i think)

its about $14 US  http://www.sparkfun....products_id=449

I received my boards on friday so gonna get started on wiring and programming later

i did a 256meg Jasper earlier on LPT and it works great, just took forever getting orig.bin

USB is best so far for these big blocks until CygnosV? if ever its made

have you verified your CB's on your 360 2meg or 16meg NAND? dont want you to waste your cash if it cant be Jtaged you know

i found a bunch of Jaspers with Good Dash Versions, but they were 6750(un-exploitable Kernels) after a quick Nand Check
Title: 360 Elite 2009,01,04 Exploitable?
Post by: supes on December 20, 2009, 03:19:00 AM
guys I just have quick question I have a arcade manufactured october 2008.  I have no way of doing a nand dump, but is that most likely exploitable?
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SpIdErXeN on December 20, 2009, 08:48:00 AM
QUOTE(SoloStyl @ Dec 20 2009, 10:45 AM) View Post

yup, thats the one   smile.gif

dont forget you still need the RS232 Shifter SMD board to be able to flash the lpc-h2148
(some use other types, but this is easier i think)

its about $14 US  http://www.sparkfun....products_id=449

I received my boards on friday so gonna get started on wiring and programming later

i did a 256meg Jasper earlier on LPT and it works great, just took forever getting orig.bin

USB is best so far for these big blocks until CygnosV? if ever its made

have you verified your CB's on your 360 2meg or 16meg NAND? dont want you to waste your cash if it cant be Jtaged you know

i found a bunch of Jaspers with Good Dash Versions, but they were 6750(un-exploitable Kernels) after a quick Nand Check



Ehh crap, I havent verified the CB's yet. Damn, kinda scared now. My box had the same kernel and dash version as yours though...man, I hope it's doable. I gotta call this friend of mine for some soldering help.
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SoloStyl on December 20, 2009, 09:09:00 PM

SpIdErXeN
supes
anyone else ....

solder 5 wires(diodes and resistors may vary) on a LPT port
dump 2-3 megs of your NAND with NandPro20b
then check your CB's etc with this:

http://ep-comps.com/...CD_Info_v1b.rar

Good luck
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SpIdErXeN on December 21, 2009, 11:42:00 AM
Hey Solo, a few quick questions man, I apologize.

0. If I build the db25/printer cable with the 100ohm resistors, and the diode switch, is that enough to read the NAND, obtain my CB value, and if the CB value is good, install/flash Xell to the NAND?

1. How do I install/flash XBR/Freeboot from, or to Xell?

2. Do I need the RS232 Shifter SMD for this process if I use the db25/printer cable?

3. I believe I have a cable that has a RS232 Shifter SMD built into it. 6 wires are attached to it, each of them are labeled, (RTS, GND, CTS, RXD, VCC, and the last wire is blank with no label). I bought it when the jtag xploit originally came out. Think I can use it?

4. Also, do I plug the 6 wires from my RS232 Shifter SMD cable into the corresponding points on the LPC2148 Header Board if I buy one? Is that for flashing XRB, or freeboot to the NAND from Xell?

5. What are the points on the LPC2148 Header Board that I connect the rs232 cable's wires to when I want to flash XBR/Freeboot?

6. If I use the LPC2148 Header Board, the same one you've got, what are the points on the Jasper motherboard that I connect the wires that run from the LPC2148 to?

7. After I have the wires connected to the Jasper motherboard, do I just plug the LPC2148 into a usb port on my pc?

8. Can I run a usb cable from the LPC2148 to the 360's usb port, then from the LPC2148 to a usb port on my pc? (Kind of like connecting the 360 to my pc via usb cable with the LPC2148 in between the two. Not sure if that's possible because I havent receive the LPC2148 yet lol.)

9. Will I still need the 100ohm resistors, and the switching diode, if I have the LPC2148 Header Board?

Sorry man, I'm a n00b at this, but I'm trying hard to figure this out. I have somebody that can help with the soldering, I'm trying to get the directions down first though. I really appreciate all your help man.
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SoloStyl on December 22, 2009, 02:30:00 AM
sorry i haven't replied sooner, I was dumping the Nands with the new LPC-H2148 smile.gif

answers:

0: yes. and you can install Xell, but dont need to. install XBR instead. it contains Xell already and you can start using homebrew
1: extract your KeyVault and then inject it to XBR.bin using nandpro. freeboot only works with dual Nands
2: No, SMD Shifter is for programming *.hex file to the LPC-H2148
3: I think so, but you have to solder the wires to the LPC-H2148 to be sure
4: yes. make sure you solder correctly(Rx,Tx, VCC,Grnd) or you can burn out the LPC-H2148 or lock it. dont forget to Ground pin0.14(Ext1 If i remember) hold the reset button, THEN plug in USB.
5:  http://img188.images...2shiftersmd.jpg
6:  http://img188.images...2shiftersmd.jpg smile.gif
7: No. Dont plug in the USB UNTIL you flash the "xspiflash.hex"(its in Nandpro directory folder)
8: No. Might even damage something
9: Nope. Not needed

it was a pain in the ass for me too(got it running today finally, ITS FAST), once you get your LPC-H2148, I'll run it thru with you step by step, just be carefull or you can totally mess those boards up,and the 360

i modded my 360 too, i'll try to post pics and make a Tutorial.  lemme know when you get your board
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SpIdErXeN on December 22, 2009, 11:01:00 AM
Thanks so much for all the help bro, I'm still a novice at soldering, but I'm working on it. You have really helped me out, this seemed very confusing, but I think I'm getting it now. I'm itching to crack open my 360 and do it myself. I know I probably can, but I don't want to end up frying something lol. Since I've got nearly an identical arcade unit to the ones you have, what would you say are my chances of having a CB value that isn't 6750? I'm crossing my fingers here lol.
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SoloStyl on December 22, 2009, 02:03:00 PM
well, if you bought it at G*meStop, most of those USED 360s get refurbished at M$, so it might be 6750 and un-exploitable.

I bought 3, and I returned all 3, (from 3 different GS stores). all had 6750 even though they had Pre NXE 7xxx dashboards. 1 of them was even made back in March 2008 AND still no good.

but who knows, sometimes we get lucky  smile.gif

if you bought it at BB, your chances are better since I got mine there Brand New. I found 4 with my exact dates   biggrin.gif , and they all have 6723 which is awsome.

dude before you continue and waiting on the LPC-H2148, you can just use 7 wires,  a few diodes and resistors. solder them up to the board and pull a quick 2meg NAND Dump.
open the Nand and make sure it has good CBs. THEN, if its exploitable, we can do the LPC-H2148 for the 512meg NAND Dumps.

otherwise your wasting time waiting on your shipments, when you could be looking for a exploitable 360.

but if you still decide to go by MFG date and wait for the LPC-H2148, i guess its ok too  smile.gif
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SpIdErXeN on December 22, 2009, 05:16:00 PM
I'm thinking tomorrow night might be the night I can take a look at the CB's. My friend should be ready and home to help w/the soldering. I got my 360 at regular Target (a small one, not a Super Target, figured that would up my chances lol), they had about 3 of them which all had 2009/04/17 mfg dates. I think the 360 is brand new, not a refurb because when I fired it up, it made me set all the system settings...well, and there's not even a scratch on it or anything lol. I guess they probably format the internal 512 storage before shipping out a refurb anyways, but...if i recall correctly, not a lot of jaspers rrod'd right? So hoping it's good and hasn't revisited microsoft at some point lol.

Dude, wished you lived here, you're a pro at the Jaspers, where you from man? In Orlando, FL there's like 2-3 modders, you guys are hard to find. lol
Title: 360 Elite 2009,01,04 Exploitable?
Post by: SoloStyl on December 22, 2009, 11:19:00 PM
hehe, take a trip , only a few hours away.

I was just up there about 3 weeks ago.

we love the Coasters, and Busch Gardens.

and we pay less than other States do(*hint*)    smile.gif
Title: 360 Elite 2009,01,04 Exploitable?
Post by: firebuddie on December 30, 2009, 07:25:00 AM
Fellas, beats the crud out of me why u are bothering to dump more than 1st 64mbs of ur big jasper nand.  64mbs is all u need for backup recovery purposes.  The rest of the nand is just acts as an internal MU for storage so what's point in dumping that - will be blank, i.e. all FFFFs for new box.

Also, XBR is only 64mb so all you need to repace is the overwritten 1st 64.

Hope this helps.