Xbox360 Devkit Nand Dump?

Discussion in 'Xbox 360 Development' started by sarx, Nov 1, 2017.

  1. sarx

    sarx Member

    Joined:
    Nov 1, 2017
    Messages:
    21
    Likes Received:
    3
    Posted in this section too since im not sure which section, sorry.
    Anyone got a Xbox360 Devkit Nand Dump?
    Specifically of the version 21256.18
    It will be much Appreciated thanks
    also need a matching cpukey too

    Nand dump can be done by running a nand dumper, example: simple 360 nand flasher
    cpu key is a per box key, used for encrypting/decrypting nand etc it is fuses 3+5 or 4+6

    even just a HvxDump would be fine, thanks :)
     
    Last edited: Nov 2, 2017
    Di4blo likes this.
  2. just1n

    just1n Member

    Joined:
    Oct 18, 2017
    Messages:
    12
    Likes Received:
    4
    IIRC the CPU key isn't needed on devkits besides crypto with keyvault. The bootprocess doesn't need it for decryption like some loaders on retails. So not too sure what you want the key for?

    I would supply you with a dump but I'm not home until Monday. If no one provides you with one I will when I get home
     
    acabey and sarx like this.
  3. sarx

    sarx Member

    Joined:
    Nov 1, 2017
    Messages:
    21
    Likes Received:
    3
    ok thank you. the reason i wanted the key is im looking into the bootloaders. and you can easily extract them with 360 flash tool. i heard that you can't dump higher recoveries easily though so HvxDump is fine as it dumps what im looking for :) and i wouldn't need the key then
     
  4. just1n

    just1n Member

    Joined:
    Oct 18, 2017
    Messages:
    12
    Likes Received:
    4
    I just bought another xdk since I haven't had one in a few years so my knowledge is a little aged. But you can load the image in RGBuild and it will decrypt the bootloaders and decompress SE.

    Correct me if I'm wrong but I don't think the CPU key is used to decrypt any bootloader on XDK. I don't even think they contain code for the XeCryptMemDiff or whatever xecrypt function is used for comparing hashes. I think they simply decrypt and load the next bootloader. Again I could be totally off and I won't know for sure until I get home and look at it again.

    As for HvxDump, I believe you couldn't use it past a certain recovery. (Probably because the syscall table or something updated). Just guessing.

    To get the CPU key you can flash an older recover that works with hvxdump and then flash to the newer recovery to dump the nand. Sorry I couldn't help you, but on Monday I got you! Btw, what are you planning on doing exactly?
     
  5. sarx

    sarx Member

    Joined:
    Nov 1, 2017
    Messages:
    21
    Likes Received:
    3
    i need the bootloaders for 21256.18 (the latest leaked recovery).
    all the links i have found are dead.

    i don't need the cpukey or nand i thought you needed the cpukey+nand to extract the nand and get the bootloaders but i guess not. the cpukey is just for kv etc.

    im trying to update RGLoader it looks pretty simple as long as i have the bootloaders
    all you have to do is update the Kernel/HV patches etc and boom :) not sure about HvxDump but im sure it will work.
     
  6. just1n

    just1n Member

    Joined:
    Oct 18, 2017
    Messages:
    12
    Likes Received:
    4
    Oh I see. Well hopefully someone can supply you with it before I do but if you couldn't find any iso recoveries, maybe you can extract the update rom from a remote recovery? Could be a hassle unless you were familiar with x86 (I think it's 32 bit app.)
     
  7. sarx

    sarx Member

    Joined:
    Nov 1, 2017
    Messages:
    21
    Likes Received:
    3
  8. Liniseda

    Liniseda For the Horde!!

    Joined:
    Sep 30, 2017
    Messages:
    18
    Likes Received:
    3
    sarx likes this.
  9. sarx

    sarx Member

    Joined:
    Nov 1, 2017
    Messages:
    21
    Likes Received:
    3
    Done.
     
  10. stoker25

    stoker25 github.com/emoose

    Joined:
    Dec 20, 2009
    Messages:
    14
    Likes Received:
    14
    Shouldn't be too difficult as long as you have the KHV for the current patches, just go to the offset of each patch, copy some unique instruction-bytes from around there and search for those bytes in the new KHV, 9 times out of 10 you should be able to find a match, at least that's mainly how I used to update RGL before I stopped working on it anyway.

    I was actually going to make a tool that could automate this a while ago. Despite some people saying it'd be impossible, signature scanning really isn't that difficult :p The only hard part is when you have patches that you can't find any matching signature for, but luckily there's always symbols & strings you can fall back on.
     
    Last edited: Nov 3, 2017
    acabey and sarx like this.
  11. Liniseda

    Liniseda For the Horde!!

    Joined:
    Sep 30, 2017
    Messages:
    18
    Likes Received:
    3
    I gaved him the patches and still no boot :/
     
  12. sarx

    sarx Member

    Joined:
    Nov 1, 2017
    Messages:
    21
    Likes Received:
    3
    ye it would of been out along time ago but im sure ninja got people to keep it private ? lol
     
  13. stoker25

    stoker25 github.com/emoose

    Joined:
    Dec 20, 2009
    Messages:
    14
    Likes Received:
    14
    Eh I dunno really, don't think tydye is working on RGL anymore neither so that's probably why there hasn't been a public update, but yeah I'm sure someones already updated our patches in private. Kinda sad nobody released them already but that's the norm in the xbox scene I suppose :p

    You made sure to setup the filesystems and loaders etc properly right? Maybe just try getting the bare minimum patches working, then work on stuff like retail XEX decryption etc once it's booting, since it could just be a bug in one of those extra patches that's stopping it.

    You could try setting up KDNet (RGBuild can do this for you iirc) and see if you get any output from that, but that'll only work if it manages to load the kernel. If there's a bug in the loaders/HV you won't get anything from it, you'd need a POST code (http://free60.org/wiki/POST) logger for that but I can't really remember how we set that up. UART (http://free60.org/wiki/UART#Serial_Console) might give some loader/HV output though, you can buy a UART -> USB cable online pretty cheap too.
     
  14. Liniseda

    Liniseda For the Horde!!

    Joined:
    Sep 30, 2017
    Messages:
    18
    Likes Received:
    3
    I do have the loaders and filesystems, the kdnet is just idling when i boot it up
     
  15. Liniseda

    Liniseda For the Horde!!

    Joined:
    Sep 30, 2017
    Messages:
    18
    Likes Received:
    3
    I will try to set up a post logger
     
  16. ddxcb

    ddxcb Gota J.T.A.G. That Xbone Yo.

    Joined:
    Apr 17, 2008
    Messages:
    388
    Likes Received:
    45
    On the modded retail side the uart gives what xbwatson debugs out on the xdk.

    here is kernel patches.

    https://ufile.io/rhtsr
     
    Last edited: Nov 3, 2017
    stoker25 likes this.
  17. sarx

    sarx Member

    Joined:
    Nov 1, 2017
    Messages:
    21
    Likes Received:
    3
    yeah. boot process
    CB_A -> CB_B (glitched) -> modified CD -> SE.17489.bin -> patches.rglp
    CD + SE are verified fine so its the patches.
     
  18. Liniseda

    Liniseda For the Horde!!

    Joined:
    Sep 30, 2017
    Messages:
    18
    Likes Received:
    3
    where do i put it? khv patches are like "RGLoader-17489_ignoreHeapErr.S"
     
  19. Dwack

    Dwack Active Member

    Joined:
    Feb 5, 2011
    Messages:
    28
    Likes Received:
    18
    I gave @Liniseda the official KHV patches for 17489. So if he shared them with you then it might be a good idea to double check you have everything else set up properly.
     
    mb2010 likes this.
  20. sarx

    sarx Member

    Joined:
    Nov 1, 2017
    Messages:
    21
    Likes Received:
    3
    Yeah. thank you :)
     
sonicdude10
Draft saved Draft deleted
Insert every image as a...
  1.  0%

Share This Page