| Frieko's guide to the Uber XBE Exploit via EvoX gamesave exploit (MA, 007, SC) and FTP
As always, I AM NOT RESPONSIBLE FOR YOUR ACTIONS AS A RESULT OF THIS DOCUMENT! ALL XBOX MODDING RISKS VOIDING YOUR WARRANTY, BANISHMENT FROM XBOX LIVE, OR DESTRUCTION OF YOUR XBOX SYSTEM!
Thanks to pedrospad, rmenhal, devz3ro, angerwound, and others for creating this awesome mod and for helping me install it.
Idots has done some great work with his ltools UDE installer. If your XBOX is compatible, go ahead and grab that off the usual places and use it. However as of writing it doesn't work well with NTSC-J, PAL or new boxen with Xcalibur video encoders. If this is true, or like me you just like to be difficult, never fear, you can still install UXE on your XBOX with a plain old EvoX-loaded gamesave exploit, which is what I will show you now. This operation SHOULD be compatible with all known xbox from version 1.0 - 1.6. I didn't QUITE write a noob guide, but if you've done any modding in the past and you have a reasonable grasp on the lingo, or you're a clever and brave noob, by all means proceed.
You will need:
> A Free-X compatible game (an original disc) and exploit gamesave loaded with EvoX. Currently hacked games are 007 Agent Under Fire, MechAssault, and Splinter Cell. The gamesaves are available on the usual places.
> An ethernet setup from your xbox to a computer with FlashFXP or other FTP client installed.
> Make a note of your Kernel and Dashboard versions. They can be found in the dashboard, at settings->system info.
> Xbox Kernel 3944 4034 4627 4817 5101 5530 5713 or 5838 (pretty much all known kernels)
> Xbox dashboard with an "Xbox Live' tab. Preferably 4920 or higher. You can get D:4920 from Slayer's (you don't need to install it, just grab update.xbe for step 8), or try popping in a game cd and clicking on 'Xbox Live' which should update.
or alternately the command line version s1994752.zip
(1994752 is the magic number for uxe, it comes from the byte size of the .xbe used)
NOTE: A LOT of people including myself have trouble getting uberpatcher to load. I's probably some .net crap, so you can try upgrading your .net but it's probably easier to just use the command line version.
> metoo-m8plus-v1.4.1.zip [usual places]
> EvolutionX dashboard. [It's either in your gamesave, or grab it off the usual places]
> Idot's dashboard font patcher [usual places, xbe-xip-xbx-tools in PC section]WARNING:
If you have to stop in the middle of this operation, you should first use the backup from Step 6 to restore your xbox to factory spec before you walk away. Although this exploit does NOT suffer from the clock bug after it is installed, leaving the xbox without power while it doesn't have a working hard disk boot sequence (custom or original) will cause your xbox to frag.
Quick technical analysis: PedrosPad found a way to font-hack xboxen without risk of the clock bug. Instead of hacking xboxdash.xbe where the clock bug lives, they find another craptacular .xbe file that's free of the bug but still exploitable, name it xboxdash and hack it instead. Very clever. Basically after that you throw some crafty files into the fonts folder and wait for the magic to happen. xboxdash.xbe gets tricked into loading the Phoenix BIOS Loader, which in essence is the software version of a modchip. It injects a new custom BIOS-kernel into the system.
Devz3ro's original thread can be found here.
If you have everything you need, let's begin:Step 1.
Boot up a temporary EvoX dashboard using a game save exploit like 007:AUF, MechAssault, or Splinter Cell
Here's a guide by jsrlepage:
This is how I succeeded in installing a software modification under an Xbox with the Splinter Cell exploit.
What you will need :
- Unmodded, unopened, under extended warranty Xbox :-D (that's mine - no wonder I didn't want to do a machine-open)
- Splinter Cell (Tested with a non-platinium)
- Memory Card (I used a MadCatz. meow.)
- A friend with a modded, or someone who made THAT/a hack and can lend you a card with the Splinter Cell hack/copy the savegame hack to your card.
- Home network (or anything, as long as you can FTP to your Xbox).
- Hack 1 : Splinter Cell Exploit (usual place)
Steps BEFORE exploiting your Xbox
Unpack every archive you downloaded. You should unpack them in different directories, but as subdirectories of the same directory.
Steps to get your savegame on a memory card.
1- Ask a friend to upload them to a clean/without-Splinter-Cell-saves memory Card
1- Ask a friend who has a memory card to copy the savegame to it (backuping his SC saves and deleting them before copying the exploited ones.
Steps AFTER you got a Memory Card with the savegame.
0- Before anything, double and triple-check that your Xbox is accurately plugged (power cord, audio-video output) and plug your Box on your private network.
1- Access your box's current dashboard, go in Memory>Hard Disk and delete any Splinter Cell savegame you currently have - the hack must be the ONLY Splinter Cell savegame present on your Xbox.
2- Still in the original dash, go in your memory card, and copy the two save slots (Linux Installer and the Splinter Cell Savegame) to your hard drive.
3- When you have sucessfully copied the two savegames (the Linux Installer should have a "Debian" logo, and maybe even the Splinter Cell Savegame), insert your "Splinter Cell" game like if you were going to play.
4- Get into the menu, choose "Play", then take the "Linux" profile, and select "Checkpoints" with the "A" or "Start" button of your control pad. Don't worry, there isn't supposed to be any checkpoint entry.
5- BAM! You have sucessfully loaded EvoX! Which means you now have a FTP server. Advice : take down your IP address. You can get it in "System Utils" > "Settings" > "IP" (the first one you see).
In EvoX, go to Settings and make sure the network settings are correct, save and reboot if you have to change anything.Step 3.
Use the EvoX "Backup BIOS and EEPROM" function.Step 4.
Use an FTP client to access your XBOX.Step 5.
Pull the "backup" folder created in step 3 onto your computer for safe keeping. It will be in e:\UDATA, use FTP search if you can't find it.Step 6.
Pull the entire contents of your XBOX's 'C' drive onto a folder on your computer.Step 7.
SWEAR TO ME YOU REALLY DID STEPS 5 AND 6! ;-) You will need them if something goes wrong.Step 8.
Make a new folder on your computer and copy the file c:\xodash\update.xbe from your XBOX into it. (On a side note, update.xbe can also be found in Slayer's.)Step 9.
Run Uberpatcher and select the update.xbe from step 8 and click patch. This will create a file xboxdash.xbe. Alternately, use the appropriate command-line patcher and name the output xboxdash.xbe.Step 10.
Right click on this file, hit properties, and verify that it is 1,994,752 bytes in size.Step 11.
Now the fun begins. Go back to your FTP client, and copy the following files from metoo-m8plus into the root of your E: drive to install the BIOS loader:
Install EvoX dashboard to your xbox C drive. Your game save should have an "Install EvolutionX" tab, otherwise just put an evoxdash.xbe, evox.ini and 'skins' folder into your C. You will probably want to edit evox.ini later, or put your other dash of choice in C: (Just be sure to rename the new dash evoxdash.xbe)Step 13.
In your XBOX C: drive, rename xboxdash.xbe to msdash.xbe. Then take the new uber-patched xboxdash.xbe from Step 9 and put it in the xbox C:Step 14.
Rename the folder c:\fonts to f0nts. (notice the zero) You can leave C:\xbox.xtf and c:\xbox book.xtf alone.
[NOTICE: Steps 15A-15C must be done all at once and in the order I show. The reason for this is that update.xbe must find bert before it finds ernie. Technical details here
, otherwise just trust me. If for any reason you end up with the wrong files, remove the fonts folder and make a new one.]Step 15 A.
Make a fresh new folder on your xbox C: drive called fonts. B.
Copy bert-xxxx-01.xtf (where xxxx is your xbox's original kernel version) from the s1994752 folder of the updatefonts71 package to your xbox C:\fonts folder C.
Copy ernie.xtf from updatefonts71 into c:\fonts
Your xbox directory tree will now look like this:
| +-- Xbox.xtf
| +-- Xbox Book.xtf
| +-- bert-xxxx-01.xtf
| +-- ernie.xtf
+-- msdash.xbe (your original dashboard)
+-- xboxdash.xbe (the exploited .xbe made from update.xbe)
+-- (some other files/folders like audio, xboxdashdata, xodash, xbox.xtf)
+-- default.xbe (metoo BIOS loader, it is signed with the habibi key)
+-- Metoo-M8plus_16-06.bin (metoo looks here by default, otherwise edit boot.cfg)
+-- (maybe some other stuff, shouldn't matter
Step 16. Take out the game DVD and your memcard, power off the xbox and turn it on.
Step 17. Within 15 seconds you will be looking at one of two things:
|Thing A: The EvolutionX dashboard. If so, congrats! The exploit is installed. You will want to edit your msdash.xbe to get your original dashboard working again. Put Idot's patcher.exe and your original msdash.xbe in a folder together. Go to cmd prompt, change dir to your folder, and run the patcher. For example if your files are in c:\patcher, type:|
patcher msdash.xbe -f0nts
Then name the output file msdash.xbe and put it in xbox C. Call it from Evox or other dash and it will access the f0nts folder and load as the regular MS dash. From evox.ini that looks like:
That's it, install your apps and enjoy
|Thing B: The X screen, nothing, a greenish screen, or something, but whatever it is it's frozen or otherwise not Thing A. If so, reinsert the exploited game CD and go back to EvoX, a la Step 1.|
Skip to Step 15, but with one of the following changes:
Try adding the s.xtf file to c:\fonts
Try using bert-generic instead of bert-xxxx
Remember to delete the fonts folder and make a fresh one.
Try using the updatefonts61 package instead of 71.
Try UDE1 or UDE2 instead, if they are supported by your xbox type.
If you still haven't succesfully booted, restore your xboxdash.xbe and normal fonts folder using your backup copies from Step 6. Your xbox should boot into MSDash normally. Reread this tutorial, browse the forums, get help.
Some extra customization notes:
*The M8plus bios boot order is DVD, evoxdash.xbe, avadash.xbe, nexgen.xbe
*M8plus supports large hard drives via LBA48 and F:
*If you don't like M8, m8plus can be used to load any BFM bios simply by changing the Romfile line of the boot.cfg file. No need to change the RC4 keys or anything. Other bios are available in /XBOX/bios/bootable from media/hacked/ in usual places. I tested this with X2_4983_BFM.rar and it worked fine for me.
Good luck and happy modding!
This post has been edited by frieko: Nov 28 2004, 07:30 PM