Topic: Possible Efuse Faker? (Read 503 times)

bifnewman · « **on:** June 13, 2010, 07:59:00 PM »

I'm no expert on this but I was trying to understand more about the IBM eFUSE and how it works and I came across an xbox 360 cpu datasheet with the eFUSE pinouts. I was thinking about how when you install 8948 and it blows eFUSES or if you have an updated CB and it would blow the eFUSES, would it be possible to take the efuse enable and the efuse vcc pinouts and wire them to a modchip and cut the tracks for the efuses and rewire them so you could send back a different signal and boot an older kernel? Would something of the sort be possible? Why or why not?

Thanks,
bifnewman

supersdude1691 · « **Reply #1 on:** June 13, 2010, 08:51:00 PM »

The efuses are completely contained inside the CPU chip itself, it does not have a trace leading outside the motherboard.

bifnewman · « **Reply #2 on:** June 13, 2010, 11:20:00 PM »

How does the southbridge know wether to boot the system or not? Also if you were to desolder the cpu from the mobo and wire it or put a chip between the two, would this sort of thing be possible?

No_Name · « **Reply #3 on:** June 14, 2010, 10:30:00 AM »

bifnewman · « **Reply #4 on:** June 14, 2010, 02:31:00 PM »

QUOTE(No_Name @ Jun 14 2010, 12:30 PM)

No.

Care to explain? thanks for response

No_Name · « **Reply #5 on:** June 14, 2010, 03:10:00 PM »

QUOTE(bifnewman @ Jun 14 2010, 01:31 PM)

Care to explain? thanks for response

There is really not anything to explain. just that what you want to do is just not possible.

The reason is the Efuses are inside the CPU.. Unless you happen to have a fab plant capable of reproducing the same CPU as in the 360 with the Efuses unburnt then there is no way to bypass them once they are burnt.

Even then unless you know what fuses to burn to start with and how to burn the right sequence its pointless.

Not to mention you will end up with IBMs law team coming after you for fabricating their intellectual property.

See No was a nice simple answer that is not super complicated.

bifnewman · « **Reply #6 on:** June 14, 2010, 05:21:00 PM »

QUOTE(No_Name @ Jun 14 2010, 05:10 PM)

There is really not anything to explain. just that what you want to do is just not possible.

The reason is the Efuses are inside the CPU.. Unless you happen to have a fab plant capable of reproducing the same CPU as in the 360 with the Efuses unburnt then there is no way to bypass them once they are burnt.

Even then unless you know what fuses to burn to start with and how to burn the right sequence its pointless.

Not to mention you will end up with IBMs law team coming after you for fabricating their intellectual property.

See No was a nice simple answer that is not super complicated.

ok sorry

Syn201 · « **Reply #7 on:** June 18, 2010, 04:28:00 AM »

unblowing efuses is not financially viable ..

inspuration · « **Reply #8 on:** July 27, 2010, 09:49:00 PM »

QUOTE(Syn201 @ Jun 18 2010, 11:28 AM)

unblowing efuses is not financially viable ..

There is a team of people looking at this right now. http://www.xboxhacker.org/index.php?topic=15456.0

freeloader247 · « **Reply #9 on:** August 07, 2010, 11:18:00 PM »

Ok I understand that the eFuses are located in side the cpu, but they must send some type of signal out telling the xbox to boot? Or how would the xbox know what kernals to blacklist and not boot?

majinsoftware · « **Reply #10 on:** August 08, 2010, 12:11:00 AM »

Theres no external comuncation of it. You ask how it knows it doesnt.
It just eather boots (when has right fuses burnt) or it doesnt boot.

Sort of think of it like a door the lock is the efuses, the kernal is the key. Stick the wrong key in and nothings going to happen the door will stay locked and not open.

Then the xbox will relise and give you a error.

slasherking823 · « **Reply #11 on:** August 26, 2010, 06:23:00 PM »

the southbridge doesent decide to boot, the cpu does...

juggahax0r · « **Reply #12 on:** September 02, 2010, 11:54:00 AM »

Efuse Document

This is a very good short document on Efuses. Won't give you any hope in faking them, but it will show you that once they are blown they are indeed gone for good, At least in most cases certainly in the case of the Xbox360.

lehbel · « **Reply #13 on:** October 27, 2010, 01:13:00 PM »

I have an idea - to make off for the bus address 0x8000 0200 0000 0104 on the data bus of the processor to set the 15th bit to 1, and the processor receives an address for the transition is shifted to 0x8000.
At 0x8000 0200 0000 8000 to connect the 32 bit ROM with an alternative 1BL. Solder wires have a lot of ...
In the performance of the program from the ROM, the processor must operate at a reduced rate because ROM is slow.

Grandmaster56 · « **Reply #14 on:** October 30, 2010, 03:22:00 AM »

Your not taking into consideration the LDV.Also changing those values would break the signature of the bootloader and the console would not boot.Its not possible.

Author Topic: Possible Efuse Faker? (Read 503 times)