Wondering how recoveries work

Discussion in 'Xbox 360 Development' started by kingkat, Jun 5, 2013.

  1. kingkat

    kingkat Robust Member

    Joined:
    Nov 16, 2012
    Messages:
    299
    Likes Received:
    8
    I'm back on the scene, I haven't really been here for about 3 weeks, been too focused on school :disgust:

    Anyway I've just been wondering how recoveries actually work. Do Dev kits have E-fuses in the CPU that are blown with each new update? I'm guessing no, allowing them to downgrade. When you apply a new recovery, does the update delete the current NAND except for key files required to carry out the recovery process? Or does it just overwrite/add new files on top of the existing ones? I also read somewhere that when you recover, the recovery will generate a new KV, is this true? If so, couldn't one just generate infinite KV's dump them and sell them?Going back to the recoveries, if the remote recovery program deletes the existing NAND, in theory, couldn't one make a program to write hacked JTAG/ RGH images to the console remotely while the console is running either Xshell, or just a modified Xell image that includes the XDRPC plugin so it would be seen by the recovery program, or just said required files for the recovery proccess to run? This would make performing the two exploits a bit easier, and would also be pretty cool :cool-new:

    These are just my thoughts, if anyone has any info, please inform me :)
     
  2. InnocentSam

    InnocentSam Spirited Member

    Joined:
    Sep 26, 2012
    Messages:
    187
    Likes Received:
    2
    As far as I know, retail 360's do not blow efuses every update. They blow them occasionally.

    http://www.se7ensins.com/forums/thr...xboxs-from-being-jtagged.455982/#post-3331623

    As for KVs, I wouldn't think they generate new keyvaults every time due to PartnerNet whitelisting. But I don't know how the whitelist works, as it could be IP-based or KV-based or even both.
     
  3. kingkat

    kingkat Robust Member

    Joined:
    Nov 16, 2012
    Messages:
    299
    Likes Received:
    8
    EDIT: Not Allowed to discuss or MS and/or Assembler will have to kill you

    Sorry about that LEo
     
    Last edited: Jun 5, 2013
  4. LEo

    LEo Fiery Member

    Joined:
    Jan 19, 2008
    Messages:
    845
    Likes Received:
    16
    We don't discuss this here. No Pnet talk.
     
  5. kingkat

    kingkat Robust Member

    Joined:
    Nov 16, 2012
    Messages:
    299
    Likes Received:
    8
    I removed my reply if that was all that's necessary, the initial post doesn't have to do with Pnet.

    Sorry about that LEo, my bad
     
  6. l_oliveira

    l_oliveira Officer at Arms

    Joined:
    Nov 24, 2007
    Messages:
    3,879
    Likes Received:
    245
    Talking about retail consoles shouldn't be any issue, I suppose. They're not restricted with NDA.

    there's a section of the CPU EFUSES which are dedicated to the boot loader exclusion mask and a larger one for the LDV (lock down value) for the OS kernel.

    Since kernel 4xxx MS has been blowing FOUR bits of efuses each time the box OS is updated at the LDV region. The bootloader section was updated at least four times now. First time being August 2009 (to block the notorious SMC injection/JTAG hack). Subsequent updates were meant to make Reset Glitch Hack harder.
     
sonicdude10
Draft saved Draft deleted
Insert every image as a...
  1.  0%

Share This Page