Just An Interesting Idea...
Posted 23 September 2011 - 02:07 AM
Though I can't say whether this idea could apply to the slims or not it is likely based on how they handle old dashboard revisions.
Basically, These are my thoughts.
From research, I believe the "Freeboot" application is designed to emulate the correct sequences of blown E-Fuses for each dashboard revision in order to prevent kernel panics and allow booting of newer dashboards over older ones.
As such, if we can emulate a new fuse set,can we not also emulate an old one?
If Freeboot is coded in LibXenon, could we not boot it through Xell?
Assuming it is coded in LibXenon, Through that emulation, could we not boot an older, exploitable kernel over-top of our new kernel?
If so, could we not patch that exploitable kernel and run the JTAG based applications from it?
So the process would be more like this:
RGH Loads Xell
Xell Loads Patched Freeboot
Patched Freeboot loads Exploitable Kernel
Exploitable Kernel loads New 13599 Patched Freeboot
13599 Patched Freeboot loads JTAG patched 13599 Kernel
Patched 13599 Kernel loads Homebrew.
Of course, looking at it now, If Xell can load Freeboot, couldn't it just straight boot to the patched 13599 kernel?
I wish I knew enough about the 360 to code for it but I'm unfamiliar with it so I can't try this theory myself.
anyways, as before, just my 2 cents. not sure where things are gonna go from here so yeah best of luck to whoever figures out how to break open the 360s loading system and give us all RxE Dashes xD
Posted 23 September 2011 - 02:17 AM
Applications such as FSD and others aren't coded specifically for exploited consoles. They're coded for 360s using the Xbox 360 SDK. They can run on dev units and exploited consoles, and don't require any special modifications aside from the signing requirements being removed.
Edited by Aldanga, 23 September 2011 - 02:18 AM.
Posted 23 September 2011 - 02:26 AM
Please, correct me if I'm wrong as I'm interested in how this whole boot process works and what would be necessary to implement into a program if I choose to try to build it myself for when my coolrunner comes in.
As such, what would be involved in this?
That's what I want to know
Posted 23 September 2011 - 02:38 AM
If you want to learn about the 360 boot process, head over to free60.org and read the wiki. There's a ton of good information there. You know virtually nothing about how the console boots and what is involved in the exploit/hack (not a fault of yours; just a fact), so you need to read up quite a bit before considering attempting such a thing. That'll lay a good foundation for any further questions you might have.
Posted 23 September 2011 - 02:47 AM
I'll be back with more questions when I've read up some more. Expect me back within the next week
Just one more question spree for verification, Does there not already exist modified dashboards being used for the JTAG based hack?
What differs in the launching of the system to a patched kernel between the two methods of JTAG and RBH?
Is it just that the JTAG hack uses the hyperviser bug to load everything, and therefore is based in a fully booted software environment which means that the patched dashboard would need to be patched to boot from an already launched kernel?
As such, the JTAG would work through a Kernel < Old Dash < New Kernel < New Dash idea and thus the new kernel for the RGH would require it to be patched as the original dashboard (13599) through the booting process, then just accept the new permissions overall?
Seems tricky to impliment but if patched dashes already exist that remove the permissions based around the JTAG hack, would it not be simple for the one who made them to just repatch the dash again?
From reading up on the RGH a bit earlier, I also wondered how the patched CD loads Xell. Also, if there is a decrypted source code available or information on how to make modifications to it in order to make it load something other than Xell, like a Dual-Booter that can either boot Xell or the main dash (for now while waiting for a hacked dash) as I can see that being fairly straight forward to code as it could be like:
If [Sync Button] held in, Boot Xell (As the sync button and DVD Eject button both report key presses prior to a nand boot (I think) and therefore have easily retrievable software signals)
If [Sync Button] is not held in, Boot next process to begin Xbox 360 boot sequence.
Just an Idea. I'm going to try to get myself familiar with LibXenon so I can make this as well.
That way we could still use our boxes while waiting for the patched dash to load anything.
And afterwards, It could be a triple boot with a GUI that I'll have to implement but I'm starting with a simple, no-gui solution for now when I figure it out.
Also, does Xell interfere with the normal boot process just by being installed?
If so, what would be necessary to bypass this restriction without removing Xell?
If not, I assume what I'm reading about the boot process should let me load the next sequence of the normal 360 Boot which, in turn, should load the next and so on and so forth, as M$ intended.
If these questions can be answered and in a favorable way, perhaps we can get of on a good foot for the appearance of patched dash, or at least a more accessible Homebrew menu, as I'd like to load more than one app and switch back and fourth out of them without a reboot If I'm only running emulators based on LibXenon with this exploit and a dash isn't released >_<
Anyways, I'd love some informed answers while I make myself informed xD
Edited by Gadorach, 23 September 2011 - 03:19 AM.
Posted 23 September 2011 - 04:09 AM
From the description of how the CB works, with the patched CB, it could be re-directed to the multiboot program that stores an original copy of the real CB and also the run string for Xell.
With the multi-boot program running first, all it would need to do it say either 1, [RUN XELL] or 2, [RUN CB]
To my knowledge, the original CB takes care of the booting process so all I need to so is have the real one run and it will boot into the normal kernel without me having to code a HV bootstrapper to make everything boot correctly.
As such, it appears to be easier than I thought [Assuming I'm correct in my judgement of the series of events leading to the boot].
As such, that should take care of problem 1.
What I need to do now is figure out how to load a licenced, M$ application from a LibXenon based application.
If this isn't possible, directly, would it be possible to copy the whole CB to RAM and then send an instruction from the LibXenon app to the cpu to tell it to run the file starting at 0xXXXX in ram which would push the loading responsibility to the native hardware, thus bypassing the need to load it from LibXenon entirely?
From my viewpoint it seems possible, and not all that complicated if coded correctly, thus making it much more painless to work with.
Any thoughts or comments on my ideas are entirely welcome and encouraged!
I really want to make this happen so we can start actually using our soon-to-be glitched boxes to play Zelda without Lag and glitching, like on the old xbox emulator, while switching back to retail OS for normal gaming without having to flash the NAND back and forth.
Of course, I'm not even considering Xbox Live Safety at this point so I don't care if any methods used are traceable/detectable (which they probably are seeing as, after a processing hand-off, the program I make no longer controls the items in RAM, IE, the CB is still there, where it isn't supposed to be, and I can't remove it after booting signed code into an unpatched hypervisor which would probably do a RAM Flush anyways, like it seems to do at SC03 during the boot process. As M$ could add a check before the Flush for the CB in RAM, any new revision would instantly detect it. More research will need to be done to see how to either FAKE the RAM location as the intended (where the previously patched CB will be) or patch all future HV's to always report a "Yes" to said check.)
Gees, Now I'm making and attempting to solve nonexistent problems. xD
I think I'll have to clean up my post soon at this rate
I'll be updating this again after I pull my thoughts together!
Also, as before, Please comment and give suggestions!
No one person can think up everything!
Thanks to anyone who takes their time to read this and comment!
Moving on, It seems that, After the patched CB makes the hand off to my program, I can unload that CB and replace it with the original CB in RAM, in it's original spot, thus eliminating the problem of HV Pre-boot detection on that front, not that it matters as later on in the boot chain the HV can send a execution hand-off to a new M$ app that scans the NAND for the hack-related files and returns either a yes or no statement as to mark for an exploited console. as such, I don't think M$ will have any problem finding out if our 360s are RGH'd unless a NAND patch is placed which edits the scan permissions of the NAND to only a specially-privileged application for certain NAND sectors. Though this could probably be detected as well (I see another upcomming "Cat and Mouse" game here...) but anyways. Of course, Multi-Nand setups would probably be safe on this so no problem there. It's just the Single-Nand setups that are going to be detectable easily. Unless M$ decides to do a NAND Manufacturer + Serial check to make sure no un-registered NAND chips are being used. Though I'm rather sure that the default NAND chips are reasonably easy to come by so it wouldn't stop us for long.
Anyways, Just trying to unravel some theories here so yeah, I'll post again after reading up more, BBL!
As before, please post your thoughts as well!
If two heads are better than one, 500 heads should get the job done
Edited by Gadorach, 23 September 2011 - 04:25 AM.
Posted 23 September 2011 - 04:21 AM
Posted 23 September 2011 - 04:33 AM
My next project will be to build a multi-boot LibXenon menu for the Xell Loader that lets me load and unload Emulators and applications based in LibXenon by loading them as a virtual machine or something along those lines that can be controlled by a reset button combination,like the SoftReset built into the original Xbox's Homebrew menus.
Posted 23 September 2011 - 04:37 AM
Posted 23 September 2011 - 05:04 AM
I figure that it should be a stock for now, until someone figures out how to patch and boot a new one, hopefully based on another modified CB for specific use with the patched Dash.
After which, it should be easy to add another CB into the program and have a modifiable config file for setting the button combos for booting the specific dashes.
Anyways,as I have to work in the morning, I'll be back on around 1pm-2pm.
I'll get started on learning LibXenon at that point.
Also, any suggestions as to where the best place to read up on LibXenon and it's functions is or is free60.org the best place right now?
Thanks as usual!
Edited by Gadorach, 23 September 2011 - 05:08 AM.
Posted 23 September 2011 - 05:09 AM
Posted 23 September 2011 - 05:37 AM
As such, until such developments are made, It's likely that this would just be a nice way to avoid having to re-flash the NAND and turn off the Coolrunner (or any other solution) just to play stock 360 games.
Seeing as the NAND is built to store backups of all the Kernels, there should be enough room to add a simple, very small app for achieving this setup. And even if some of the backed-up kernels are deleted to make room, I doubt the 360 would kernel panic unless either the BK kernel (Original) or the current kernel (2.0.13599) were deleted as, to my knowledge the Xbox 360 only checks the original and the highest revision number in NAND for the kernel check on boot.
This would mean removing anything in-between that was unnecessary for the boot process and normal operation of the Xbox.
Yet again, another Theory. I'll get right to work on debunking everything once I get my Coolrunner in on around the 4th.
... Not that I'm waiting that long to start coding
Anyways, Just to summarize the plan a bit:
1) Modify CB to launch a patched CD with my MultiBoot Code inside instead of Xell.
2) Have the MultiBoot app detect the presence of the desired button being held in (Likely Sync).
3) If held, execute the CD with the Xell Patch. If not held, execute the original CD with the M$ Boot Code
I just need to know now If I require Xell to load the drivers for LibXenon before I can boot even a simple LibXenon app, or not.
If I do, what version of assembly do I need to code it in order to execute the program natively?
Better yet, what is Xell Reloaded coded in? That'll probably be my next target for finding out what I need to code.
Anyways, I'm thinking too much and I have to work in 7 hours so yeah, more posts when I get back!
Edited by Gadorach, 23 September 2011 - 05:56 AM.
Posted 23 September 2011 - 05:56 AM
I think you're duplicating efforts for something that has a very small market. If someone can implement the reset glitch hack, they can definitely implement a dual-NAND setup. The simplicity of doing things similarly to how it's been done with the rebooters is much greater than what you're hypothesizing. The simplicity rule applies here, and I think it would be wise to heed it.
Posted 23 September 2011 - 06:06 AM
If I can dissect a rebooter, I'm sure I can figure out how it works and then build a program that achieves this based around that method. Also, from what you're saying, It seems like it's a near definite that something will come out from an expert that will achieve the necessary requirements for a modified dash, as it should be much simpler to just straight boot the dash then to have to patch the underlying kernel to think that a certain number or efuses are blown in order for it to boot.
Even still, I'd like to do this for a learning experience on Xbox 360 programming. I'm sure you'll see some homebrew from me in the near future once I get familiar with it
[Gotta force myself off this computer and get too sleep xD ]
Posted 23 September 2011 - 06:16 AM
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users