How to flash the TSOP of ANY version xbox using ANY LPC modchip


first thing first, make sure your xbox can boot with the modchip disabled, if you cant youll need to fix it so you can boot with it disabled (this might include checking the d0 soldering, locking the HD and making sure your MS dashbaord files are intact, but i wont get into those details as that is not the focus of this tutorial)

once you have confirmed your xbox will boot with the chip disabled you will need the following items:

Hardware:

an XBOX (duh)
an LPC modchip (double duh)
a sodlering iron (or window defogger repair kit or conductive ink pen)


Software:

MS 4920 dashboard (run a Live game to upgrade, or grab it off a SlaYers installer)
A dashboard font exploit
Evolution-X dashboard
xbeDump.exe
007savewithraincoat.zip
Raincoat .7 (get it Here)
a compatible bios (suggested: evox M7 or x2 4981)





ok, now on with the tutorial

extract the evoxdashboard and put the xbe file into the same directory as xbedump, now open the command prompt and type



substituting the correct path to xbedump on your computer

rename out.xbe to default.xbe (or whatever your font exploit loads) and put it in a different folder, then do the same with the default.xbe out of the 007savewithraincoat.zip, putting the default.xbe (renamed from out.xbe) back into the UDATA\4541000d\000000000000\ folder

put raincoat and raincoat.conf from raincoat .7 into the Udata\4541000d\000000000000\raincoat folder

in evox.ini put this into the menu section:




now, open up your xbox,
youll have to determine whether you have a version 1.0/1.1 or 1.2+ (if you already know you can skip this part)

look for where the power supply connects to the motherboard, if it looks like this

then you have a 1.0/1.1

if it looks like this

then you have a 1.2+

for 1.0s and 1.1s you need to remove th emotherboard and solder these points on the top, just put a drop of solder between the 2 points in the circle and these on the bottom, same thing, put a drop of solder between the 2 points


Note: if you have a 1.1 with a sharp TSOP you need some extra steps
Tutorial Here

if you have a 1.2+ you dont need to remove the motherboard, and just solder these 2 sets on top

inside the circles


now boot your xbox with the chip enabled to load evox (or any dashboard that allows FTP access) backup C:\Fonts to your PC and FTP the eploit .xtf files to that folder, overwriting the existing files

FTP the evox default.xbe and evox.ini to wherever your exploit loads it from (usually C:\default.xbe or C:\Fonts\default.xbe)

FTP the Udata folder from the 007save to E:\ confirm any overwrites

FTP whatever bios you want to use to C:\Bios (or C:\Fonts\Bios)

WITHOUT UNPLUGGING THE XBOX OR REMOVING THE MODCHIP reboot the xbox with the chip disabled, it should load into evox, select Flash Bios and select the bios you FTP'd to C:\Bios it will bring up another screen, if it says Manf 0x09 Dev 0x00 you need to check your soldering, anything else hit Y to flash

it will flash, then shut down, and your all done

if it hangs on Erasing youll need to FTP the bios to E:\Udata\4541000d\000000000000\raincoat\ and select raincoat from the evox menu

now you can either connect with Telnet, or if you have a USB keybaord you can use with your xbox that will work as well

for Telnet make sure your PC is ont eh 192.168.0.* IP range and type Telnet 192.168.0.64 at the Run command, it will connect to the xbox

Login: root
Password: xbox

for keyboard simply plug it in and hit any key to bring up the Linux command prompt

now type cd ../../media/E/UDATA/4541000d/000000000000/raincoat

and then ./raincoat -p <<bios name>>.bin (where <<bios name>> is the name of the bios you FTP'd)

and now your done




Special Thanks: sharpie00, Exobex, A@ron, Team Xecuter, Team Evox, Xbox-Linux, all the other exploit teams/groups and all the scene members who pics i jacked

To all: feel free to post any comments and suggestions here, if anything isn't clear I'll try my best to expand on that area of the tutorial


*EDIT by StrictPuppet* updated some bad image links

Very Nice Buddy.......

Hope this gets put into the tutorial section......

According to another tutorial I read there is another jumper on the bottom of the board for 1.2+ xboxs that should be soldered, a friend of mine wanted to flash his TSOP but didn't want to do the soldering so I did it for him and gave him back the box, he then later decided to go with a chip but left the points soldered. I had this additional jumper on the underside soldered as well but his box behaves normally, do you know the significance of that jumper?

(BTW I'm refering to the tutorial on xbox-scene's tutorial section)

its identical to the second jumper on the top of the motherboard (the top one in the picture) so you dont need both, and its easier to not have to remove the motherboard, so i say just do the ones on top, lol

that jumper you speak of is the same as the one on top. They are vias (port holes through a motherboard) of the top points. If you would like to test this you can use a multimeter or even cover one of the back "points" and then hold the board up to a bright light and you'll see that no light comes through one hole, which is a via to the normal write enable points.

A@ron

So then why include the botton jumper in the tutorial?

because whoever wrote didnt realize they were the same points

for the second time today I reiterate my statement that I hate misinformation... its more destructive then no information and it misleads the masses and then we get several help threads.

A@ron

yeah, i PMed lookformeb about a week or 2 ago about how the write enable points for 1.2+ and the hsarp TSOP were the 2 biggest sources of misinformation in the TSOP forums, we really need to edit the uninformed or underinformed tutorials

I agree. Misinformation is definitely more dangerous than no information. How many clowns have added
Flash=0x0900,"Winbond W49F020",0x40000 to their raincoat.conf then wondered why they still can't flash, or worse why their box FRAGs after flashing?

Added to the pinned collection. Good job!

hi there...

im doing something wrong here.. ive been following this tut. but when i reboot the xbox with my mod chip turned off so i can flash the tsop i get a blank screen on my tv and a nice little disco light blinking orange-red-green. not sure what im doing wrong here..

can someone plz help me before i start trashing my place =)

this hole thing is making me feel stupid..

/peace out
corn3y

well, it could be that you have aSHarp TSOP (they dont boot with th pints bridged) or your modchip isnt installed right and d0 is grounding out

hmm well the modchip works fine when switched on.

and when i ftp back the orginal msdash and lock the hd the xbox boots fine into msdash with the modchip switched off (its a akira modchip .. tho that shouldnt really matter witch one it is)..

i checked the tsop and its a w 49F020T-90B so that makes it a winbound chip.
i think =)....

not sure what im doing wrong.. plz more help .. i beg ya =)

peace out
/corn3y

well now i got it to boot into evox.. i was using the "Bert_is_Cheating_on_Ernie" font exploit but that didnt work.. so now im using the "bigfonts25" and that got me onto evox.. i cant flash my chip from within evox.. so i have to load up raincoat..

ive checked the path in my evox.ini and its right.. but when i choose to launch raincoat from the evox menu it just locksup.. it comes as fare as the evox loading screen but then it stops there..

what am i doing wrong? ... man this has been a late night for me.. =/

EDIT: i checked to be sure that i hade used xbedump -font on the raincoat.xbe file. if i dont use the xbedump i just get error 21 (ofc)... and with the xbedump -font it locksup my xbox. ive been looking/reading in the forums all over the place.. but cant find anyone with the same problem.. or i just dont know what to look for.

plz people help if ya can.. im going mad here =)

I'm so lost... I've been trying for almost 4 hours now to figure this out.

Please let me tell you what I've done and maybe someone can tell me what I've done wrong....

I installed a header pin set for an Xenium modchip and put in the xenium, I've varified it works and already booted Evox with it. Then I soldered the 2 sets of points show in the picture for a 1.2+ xbox, I have a 1.4 btw.

Then I got the newest evox and extracted .xbe file into a folder with the xbe dump program and ran the command line "xbedump.exe evoxdash.xbe -font" which made an out.xbe file that i moved to another folder. Then I got the default.xbe out of the UDATE, raincoat folder and did it again, renaming that out.xbe to default.xbe and putting it back in the raincoat folder...

Then i edited the lines about raincoat into the evox.ini file...

Then I ftp'ed to the xbox and backed up C:\Fonts to my PC, and replaced the XBox.xtf the XBox Book.xtf files with the ones from bigfonts25 making sure I renamed them...

Then I put the UDATA folder from the 007savewithraincoat.zip, which now has the new .xbe file made from xbedump.exe on the E: drive....

And last but not least I put the evoxdash.xbe that was made with xbedump.exe in C:\ and also put the new ini file there.... I was sure if I was suppose to leave it named evoxdash.xbe like it came in Evox or rename it default.xbe, I tried both and both ways the xbox wouldnt boot....

I unhooked the Xenium mod after I had everything uploaded and it just said Error 16......

Can anyone maybe tell me what I did wrong?

16 is the clock loop, you need to put the xenium back in, load up, set the clock (you may have to put the original xtf files back) the disable (no not remove yet) the xenium, load up and flash, once youve confirmed the flash went well then remove the xenium

Well I got the clock set and its still not working. When I disable the modchip, the ms bios starts to load, and you can JUST see the MS Dash start to load, the round globe thingy and before the MS Dash can load all the way the xbox resets and does it again.....


Help? =(

Ok i finally got Evox booting with the Xenium unplugged.....

It boots some screen that says like Flash Bios, Raincoat, blah blah and the eject leds flashing red but its loaded....

When I pick Flash Bios, then pick my x2 4981 bios, it says Unknown Flash Type...

Whats this error for and how do I correct it? The 2 connected sets of points have a nice health connection of solder...

Well you guys can ignore my other posts... I got it.. Ended up having to use Raincoat to flash it.

Thanks for all your help on aolim lordvader, dont think I woulda gotten it without your help =)

The Bert and Ernie Reloaded ended up doing the job... I'm not TSOP flashed with X2 4981....

Thanks again...

hey lordvader129..

u got any good ideas on how to help me? i see u help everyone all over =)

or just point me in the right direction to where i can read about it myself..

peace out
/corn3y

not sure, never seen your problem before, all i can siggest at the moment is downloading the raincoat save again, maybe the xbe got corrupted somehow




kdogg- good to hear all went well for you

now i got it working.

it didnt work with the evoxdash version i was using (V3921) so i had to swap to a older version V1_8_3752 and now it launches raincoat perfect. Dont know why i used V3921 when i had V3935 on my computer.. dont even know why i tried V1_8_3752 instead of V3935.. but who cares now.. it all works now =)

so this is what i found out (chould have found this in the forums if i looked harder)
this tutorial did not work with
1: "Bert_is_Cheating_on_Ernie" font exploit
2: Evox V3921

thx for a great tutorial.. learned alot doing this... keep up the good work ppl =)


peace out
/corn3y

good to hear you got it all cleared up, thats odd cux ive been able to launch raincoat form evox 3921 (but not under an exploit, maybe that has somethign to do with it) i need to do some research into the exploits and see which one is the best

and thanks for your input

its cool man

yeah one more thing.. when i used telnet to logon to raincoat the username and password didnt work.. its case sensitive.. i was using Root and Xbox everytime hehe but that didnt work... it had to be root and xbox ... not really that importent.. just me that was trying to follow everything exactly the way u wrote it =)

so it should be..
login: root
password: xbox

im not trying to be an ass here.. just saying ... not sure what im saying
i think it took me about 20 times before i even tried root and xbox... hehe how slow can i be? =)

anyway.. thx again.. all together it only takes me 30min to do the hole lot now.. from taking the xbox apart.. puting the chip inplace.. doing your tutorial and then swaping hd and installing a dash and some apps.. and then screwing it all together again.. this is gonna save me alot of chips ... beautiful .. =)

damn, i didnt realize i capitalized those, thanks again, lol

can you do this with a xecuter 2.3b lite plus? or is this not a real lpc modchiP?

yes!!
flashing my tsop will save me a lotta chips, too haha.
thanks for the great tutorial, can't wait to try it.
one question though, since someone had a problem with a particular font exploit, which would you recommend?
thanks again

FlashKick.. i use "bigfonts25" and that workes perfect for me.. but i think u can use any font exploit apart from "Bert_is_Cheating_on_Ernie".

A little tip for u... allways use raincot when u flash your tsop... and use a 256Kb bios... if u do that u will never get any problems with wrong sized bios for the wrong tsop... raincot will allways fix the size for u... just a tip =)

peace out
/corn3y

Thanks for the reply and information

why use raincoat.07 and waste more time/effort by telneting to your pc when you can just use the eurasia flash 'disc' instead? you don't have to use it as a disc but since there's no download link for the actual files instead of the iso you're going to have to rip it someway and transfer the files to your computer(unless someone put the actaul files to this online somewhere).

after that, just sign the xbe of the ripped eurasia disc with the font exploit setting with xbedump and use this instead of raincoat 07.
only downside is it's based on raincoat 05 so i'm guessing you're going to have to make sure your bios sizes are correct, but that's no problem since that's how it is with evox anyway and still less of a hassle than hooking up your xbox to your machine to flash.

lordvader, which font exploit do you recommend, im looking in *the usual places' ftp* (heh) and theres several. im curious as to which i should pick and which you used.

i used bigfont25 or something and it works good all the time

k thnx

Quote:

"now boot your xbox with the chip enabled to load evox (or any dashboard that allows FTP access) backup C:\Fonts to your PC and FTP the eploit .xtf files to that folder, overwriting the existing files:



Ok, I back up the Fonts folder to my PC, then I copy my fonts over to the Fonts foolder on the XBOX, but what do I name the fonts, and what font package should I use on a 1.5 XBOX?



"FTP the evox default.xbe and evox.ini to wherever your exploit loads it from (usually C:\default.xbe or C:\Fonts\default.xbe)"

How do I know where my Font exploit wants the file default.xbe file?

What about the 5713 kernel? This trick won't work then Hotswap modchip won't work?

Nagh I got it. I'm going to put up a VERY simple tutorial on my page.

Buy Agent Under Fire (old version to be safe)
Download 007 hack with raincoat.
Download Raincoast 7, copy the raincoat and raincoat.config files over the old ones from the 007+Raincoat kit.
run XBEdump on the Raincoat XBE using the -habibi command.
Solder your two points according to which board you have (using LordVader's GUide).
Copy 007 save to your hard drive.
Boot 007, load game save, telnet in, back up BIOS, flash bios, reboot and your done.

No FONTS NEEDED!

that tutorial has already been written, mine is for epopel who cant find a working copy of any exploitable games in their area



@Tadango

hotswapping wont work (i assume you mean boot with modchip then remove it or disable it) because once the xbox boots the LPC it will always look to teh LPC for the bios, so youll only be able to flash your modchip, not the TSOP, if you have one of those shitty kernels youll need to use a gamesave exploit (or a 29-wire modchip)

I did not understand your tutorial in the least bit. No offence.
It did not tell me what FONT pack to use, because I read a lot of stuff in the forums about certain FONT packs not working with certain model XBOX's, also in your tutorial you stated that I would need to back up my fonts directory on the PC, then copy my hacked ones over and let them overwrite the old ones?

Well I downloaded all the Font packs I could find off XBINS and none of them shared a commen name with the fonts already in the directory.

Also if you are not using a copy of 007, then what is the point of having the 007 game save in place at all? Or are you just suggesting that so that the person has easy acess to the Raincoat Default.xbe?

Finanally, I don't understand how you could possibly boot into Evox after merely copying those files over unless that hacked Font trick is supposed to do it for you. I dunno, I'm not familiar at all with the Font exploit.
Perhaps if you could elaberate a bit more on the subject I may have a means to correct my apparently corrupted TSOP on my 3rd XBOX.

007 works perfect I used my own linux + raincoat pack which flashes directly afther booting, so no telnet required Signing with -audio worked fine on the 5713 kernel. I used a mod chip (X-B.i.t) to transfer the savegame to UDATA. 007auf from the classics series in the DVD drive and that's it

Just wanted to say that I flashed my first tsop with this tutorial today. I've done dozens of modchip installs, and had a spare xbox lying around. Thought i'd give it a go.

I used the bert and ernie reloaded and evox 3921. So anyone who said that these items were the cause of their problems would appear to have other issues.

Thanks again to everyone involved in getting this tutorial sorted.

ok here is what i have done.

downloaded the evox dashboard
downloaded a font exploit
downloaded the 007 with raincoat
downloaded the .7 raincoat
downloaded a bios X2.4983.BIOS

identified my xbox ( 1.0/1.1 )
soldered the 2 jumper points

moded the evox.ini
xbedumped the evox's evoxdash.xbe
xbedumped the 007+raincoar's DEFAULT.XBE

placed the raincoat and the raincoat.conf into ( Udata\4541000d\000000000000\raincoat folder )

ran xbox inserted the slayes cd to enable ftp support.

ftp'ed the Udata folder to e drive over written everything else
ftp'ed the bios to c:\bios
ftp'ed the evoxdash.xbe to c:\ along with the evox.ini

.xtf files were first entered in the font folder guessing that this is what u ment by "FTP the eploit .xtf files to that folder, overwriting the existing files
"
that didnt work. so i read some more and somome mentioned that they renamed the .xtf files to the existsing files. (2 files. )
after doing so i restarted the xbox it almost boots up the ms dash loads up for a split second then gives the service warning message

i downloaded the older version of the evoxdash and attempted this. left with the same results
attempted different font exploites such as bert and earnie reloaded, double dash and bigfont25.
am i interperting the instructions differently?
am i missing something ?
did i do something wrong?
help

A few things you might need to do (I have just follwed this exact method, works a treat)

REname the evoxdash to default.xbe in youre C:\ directory. from what I understand the exploits load default.xbe in you're C:\ root dir.

I used bigfonts25, put bert and ernie in C:\fonts, then renamed the original font files to .xft (left them in C:\fonts) I didn't bother backing up etc, but I have enough box's and chip's lying around to sort myself out (And I had already unlocked and relocked the HD with config magic so I new if worst came to worse I could figure something out).

From what I could tell it doesn't matter where you put raincoat , I tried it in a few diff places, so Long as you can get to it from evox (put the right path in the ini) From what I gather it needed to be in the udata/xxx/0000/xx whatever directory so it could be accessed by a memory card or some such thing, but since this method doesnt necessarily use the memcard technique at all then it;s ok.

From youre description it sounds like the hack is loading (almost loading msdahboard) , but then service warning , I'm fairly sure it's because of the evoxdash.xbe not being called default.xbe , but I could be mistaken - Make a copy of it and rename the copy default.xbe, won't hurt to have a signed evoxdash.xbe as well I guess)

*** THIS IS MY OPINION ONLY, IT MIGHT PAY TO WAIT FOR OTHERS TO COMMENT BEFORE YOU DAMAGE YOU'RE XBOX FURTHER *** If anyone sees flaw in what I've said please feel free to comment.

Ok Faramisimo.....just flashed 2 ..a hynix with 1mb and a winbond with 256

USED BERT AND ERNIE RELOADED

You place the bios.bin in the raincoat folder

i also put an evox.ini and evoxdash.xbe in the font folder for good measure

on the winbond fitted xbox i got an error 21 on reeboot with the chip disabled
so what i did was replace the 2 folders for xbox live with slayers from his disc
cant remember what folder they r located but if u browse the disc you will find them

after doing this i rebooted with the chip turned off and it went to the raicoat option
..did the rest of the tut and it worked


Folders that need replaced to fix error 21 are xodash and xboxdashdata

a tip when using telnet "make sure u type it exactly as seen"
i didnt leave a space between cd and the ../
started to panic lol

at any point do you remove the connection of those 2 jumper points

bumpity du da

Has anyone figured out a soldier point scheme for the v1.6 yet??