Well we do know XBL does scan for whats in the local memory.. Otherwise Virtual C would work just fine.. As for the Xboxdash just a thought.. What we need is some brave soles to run up the ole API logger to see what they are checking for.. That and good donations..
Just a question doesn't Api logger record calls to specific kernel functions? Doesn't live request functions from the kernal? Or does it only record things excuted by the kernal or live?
QUOTE(Keo-Keo @ Jan 23 2005, 03:36 AM)
Some say you can cold boot with a game and play live games.. Since the bios loader isn't in memory. But if your xboxdash.xbe is diffrent you will get flaged. I belive it also checks the default fonts too..

File level scanning has never been confirmed; FWIW(==nothing) I don't believe M$ does it for every connection (possible any) and personally I don't think they have in the past nor will in the future eh! Here's why...
they are checking the xboxdash.xbe couse there was a way of geting on live with backups by mesing with it. i whont go into detail on it couse you will now banned doing it. the xboxdash.xbe scan was officaly told to us by m$. they dont check the fonts or anything like that thats why older expolites dont have issues. in the case with uxe the dash isnt real so it would lead to a ban. i mean if you wanna still try thats your choice but the chances of getting baned with a uxe modded system even cold booted are pretty good. like i said uxe is easy to uninstall and reinstall with the installer package so its better to be safe then sorry.
QUOTE
the xboxdash.xbe scan was officaly told to us by m$
link please.
QUOTE(luther349 @ Jan 23 2005, 01:05 PM)
they are checking the xboxdash.xbe couse there was a way of geting on live with backups by mesing with it. i whont go into detail on it couse you will now banned doing it.

That was covered by this
part eh: 
QUOTE(eh. @ Jan 23 2005, 11:48 AM - Edit1: typos))
File level scanning has never been confirmed; FWIW(==nothing?) I don't believe M$ does it for every connection (possibly any) and personally I don't think they have in the past nor will in the future eh! Here's why...
In October some folks had their accounts terminated (not just a ban!) re. their xboxdash.xbe being a default.xbe they'd cold booted via. New memory checks could have easily identified this method; checksumming wouldn't have been necessary. (I'm sure a lot of "wtf I'm banned" posts would have appeared on this board if xboxdash.xbe was being validated; hardly any did.)
Also in October, boxes being used by previously "flagged" GT's were potentially scrutinized, resulting in the majority of bans at that time. There's no real evidence of this though, but still to this day there's occasionally a report of it apparently happening. (Lots of posts appeared in the Live and chip forums about this at the time, some of them confirmed that replacing their eeprom like they had before didn't work now...)
Since November, previously non-banned boxes have apparently been banned due to a HD change having been tracked since Live 3.0's release, or thereabouts (which has become known as the "Marriage theory"). This has been the only proven ban cause, other than going on live in a modded state (which now includes a modded xboxdash.xbe being in memory during the connection/validation).
The biggest risk to XBL'rs with modded components on their disks is that M$ may be doing random checks too, potentially including checksums of critical files. No one knows, so it will always be a gamble (and the stakes are higher with UDE2 I suspect) eh...
Edit2: I forgot to mention that I think human error or potentially package glitches are more likely causes of a ban than almost all exploit methods are eh! (The following linked thread reminded me eh: _
_)