xXBASStiXx,index.php?page=Thread&postID=90858#post90858' schrieb:Das heutige Xbox Dashboard Update 2.0.8498.0 überschreibt den ersten Bootloader der Konsole.
Obwohl es bereits viele Xbox360-Updates gab ist dies das erste, das in den "Boot Sector" schreibt. Falls dieses Update fehlschlägt ist die Konsole definitiv reparaturbedürftig.

also da hast du recht! ich denke einfach mal das die sich einfach nur bescheuert ausgedrückt haben! ( vielleicht hat man es auch falsch übersetzt )
Denn ich habe auch noch nix gehört von einer Konsole die durch ein MS Update geschrottet wurde!

MatzeJ,index.php?page=Thread&postID=90947#post90947' schrieb:also ich werde erstmal kein update machen.
wenn homebrew wirklich möglich ist und das der einzige weg ist währe das echt hammer.
also dann lasst uns abwarten... :-)

xXBASStiXx,index.php?page=Thread&postID=90858#post90858' schrieb:Es bringt die Xbox360 im "Hack-Status" (vorraussichtlich) nun endlich auf das Niveau der Classic Xbox.

Zitat:On Tuesday, Microsoft has released an Xbox 360 software update that overwrites the first stage bootloader of the system. Although there have been numerous software updates for Microsoft's gaming console in the past, this is the first one to overwrite the vital boot block. Any failure while updating this will break the Xbox 360 beyond repair. Statistics from other systems have shown that about one in a thousand bootloader updates goes wrong, and unless Microsoft has a novel solution to this problem, this puts tens of thousands of Xboxes at risk.

It seems that this update is being done to fix a vulnerability already known to the Free60 Project. This vulnerability has been successfully exploited to run arbitrary code, and a complete end user compatible hack has been in development for some time and is planned to be released on free60.org shortly. It will allow users to take back control of their Xboxes and run arbitrary code like homebrew applications or Linux right after turning on the console and without the need of a modchip, finally opening up the Xbox 360 to a level of hacking as the original Xbox.

Because of the dangerousness of the update and the homebrew lockout, the Free60 Project advises all Xbox 360 users to not update their systems to the latest software version. The Project website at http://free60.org/ will provide the latest information on this ongoing topic, including the final hack software.

Free60 (http://www.free60.org) is a project that aims to enable Xbox 360 users to run homebrew applications and operating systems like Linux on their consoles. The effort is headed by Felix Domke and Michael Steil, who have a background in dbox2, Xbox and GameCube hacking, and who have spoken at various conferences about their findings. Two years ago, Free60 released a hack that allowed arbitrary code execution using a game ("King Kong Hack") as well as an adapted version of Linux, but this possibility has been disabled by Microsoft in subsequent updates of the Xbox 360 software.

Felix and Michael have repeatedly argued that game console manufacturers should open up their platforms to Linux and homebrew, similar to what Sony has done with the PlayStation 3.

x-scene

Zitat:So, some quick news:

We kept on working on this idea, and it worked out. pretty well. We use JTAG to program the DMA target addr, and then SMC to trigger the DMA read. The exploit itself is based on the old 4532 exploit.

The magic is how we launch 4532 - there is a "backdoor" for manufacturing since CB 1920. We have been able to restore the newer CD versions for all hardware types.

This means:
- We can boot own code in HV context ~5s after boot, before any video output, right after the kernel runs.
- we need to reflash the flash, and add 3 resistors for the JTAG (no modchip required! but you might want a dual-nand modchip),
- 8498 kills this by updating the bootloader - it blacklists 4532/4548. it also does hw init stuff which might interefere with the jtag hack, we don't know yet.
- we have a proof of concept hack, we will release it SOON (a matter of hours/days, not more - promised.).
- DON'T UPDATE to summer 09. Did i already say this?
- you don't need to know your cpu key. You can update to all BUT summer '09. you don't need a dvdrom.
- It works on all xenon, zephyr, falcon, opus, jasper. Unless you have updated to 849x. Then you're screwed.


- It's possible to recover DVD keys. In fact, no DVD-ROM is required to run the hack, so it's possible to run own code, dump cpu key, decrypt HV, inject key, flash back. Note that I personally don't like games, so I won't be of much help here.
- No, even if you know your CPU key, it's not possible to downgrade back from 8498.
- Right now, the only way to support both gaming and hacking would be a dual-nand modchip, which switches between nand contents. Note that you still couldn't update to 8498, as it likely (haven't tried) doesn't run without R6T3.


you don't need a "jtag adapter". What you need is a way to reprogram the NAND flash. This can be an external programmer, a linux tool (if it already runs), or a yet-to-be-announced project which uses a special southbridge mode (details will be coming soon) with just an LPT port. Or a nand-modchip.

So, some more details:

CB1920 and up allow to boot into any kernel version, including 4532, but only in "mfgbootlauncher" mode, which is used in manufacturing. This mode (also called "zero pairing", because you need to zero out the CB pairing data) has been known before, however, previous to CD1920, it was useless, because you could only boot into 1888, not into 4532. It was *also* useless because you couldn't run a game.

Now, we developed a way that uses JTAG+SMC to write into physical memory at any time. I think the idea came even from this thread. Basically a flash sector will be prepared to contain the exploit buffer and the code we want to run. JTAG will be used to program the DMA target address (the only thing you can't do from SMC), and SMC will be used to kick off the read (remember, SMC code can access the nand controller as well - just not the dma addr.).

SMC will be patched so that it kick off the DMA read right when the kernel is loaded. We are using the "read rtc" command for that, which happens pretty early in the kernel, way before GPU init, for example. It also happens before nand controller init, which is important, as that would overwrite the dma addr again.

XBH / tmbinc

xXBASStiXx,index.php?page=Thread&postID=90961#post90961' schrieb:Moin,
Sorry für meine beschissene Übersetzung. Habe es gestern schnell von X-scene übersetzt damit die Info so schnell wie möglich hier in Deutsch für jeden verständlich (oder wie schon oft gesagt wurde komplett unverständlich) zur Verfügung steht.

1. der 1BL, erste bootloader, ist in der CPU integriert und ist das allererste "Programm" das beim Start der Xbox arbeitet und so jeden nachfolgenden Prozess startet. Dieser Bootloader wird definitiv mit dem Dashboard-Update geupdatet, wodurch der, für diesen Exploit anfällige Kernel, auf die Blacklist kommt und so nichtmehr über JTAG gestartet werden kann. Es gibt eine Statistik das 1 von 1000 Bootloader Updates schief geht, so hätte man bei MS ein riesiges Problem bei der Anzahl Boxen die im Umlauf sind.

2. Das es sich bei diesem Hack um einen Fake handelt ist sehr unwahrscheinlich. Die Entwickler sind Felix Domke (tmbinc) und Michael Steil vom Chaos Computer Club. Sie haben bereits die dbox2 linux fähig gemacht, den Gamecube gehackt und sind auch die Entwickler des "ersten" King Kong Hacks.

3. Damit sich niemand mehr über meine Übersetzung beschwert hier die originalen englischen Texte von x-scene und aus dem XBH Forum.