Xbox 360 Kernel - Revision history

Ivc at 16:25, 24 March 2026

2026-03-24T16:25:54Z

← Older revision		Revision as of 16:25, 24 March 2026
Line 64:		Line 64:

	Backup these files to another computer through SCP, USB pen, website upload, FTP transter, or similar. I used SCP to another Mac OS X machine:		Backup these files to another computer through SCP, USB pen, website upload, FTP transter, or similar. I used SCP to another Mac OS X machine:
	scp 1BL.BIN FUSES.TXT NAND.BIN ~~torsten~~@192.168.1.3:		scp 1BL.BIN FUSES.TXT NAND.BIN user@192.168.1.3:

	To SCP in from a Windows machine, download WinSCP and set a password for the root account with 'sudo passwd' and enter a password. Find the IP address of the 360 using the network tool from the menus.		To SCP in from a Windows machine, download WinSCP and set a password for the root account with 'sudo passwd' and enter a password. Find the IP address of the 360 using the network tool from the menus.

Ivc: /* tmbincdump */

2009-03-14T10:53:31Z

tmbincdump

← Older revision		Revision as of 10:53, 14 March 2009
Line 69:		Line 69:

	===== tmbincdump =====		===== tmbincdump =====
	Get the [http://www.xboxhacker.net/index.php?topic=7290.msg52510#msg52510 tmbinc code] ([http://~~home~~.~~x-pec~~.com~~/~ivc/sites/ivc~~/xbox360/files/tmbincdump.tgz mirror]) and save it to the desktop as tmbincdump.c. You have to change the writereg command from:		Get the [http://www.xboxhacker.net/index.php?topic=7290.msg52510#msg52510 tmbinc code] ([http://beta.ivancover.com/xbox360/files/tmbincdump.tgz mirror]) and save it to the desktop as tmbincdump.c. You have to change the writereg command from:
	writereg(COMMAND, 2);		writereg(COMMAND, 2);
	to:		to:
Line 82:		Line 82:
	sudo ./tmbincdump		sudo ./tmbincdump

	The complete dump will be saved to a file named tmbincdump.bin. Transfer this to a computer using one of the methods referred to ~~above.~~		The complete dump will be saved to a file named tmbincdump.bin. Transfer this to a computer using one of the methods referred to

	== View Content ==		== View Content ==

Ivc: /* dump32 */

2009-03-14T10:52:47Z

dump32

← Older revision		Revision as of 10:52, 14 March 2009
Line 50:		Line 50:
	===== dump32 =====		===== dump32 =====

	When Linux is loaded, start one of the webbrowsers (assuming you have a network cable plugged in) and browse to this page to download [http://www.xboxhacker.net/index.php?topic=7913.msg50090#msg50090 arnezami's dump32.c] ([http://~~home~~.~~x-pec~~.com~~/~ivc/sites/ivc~~/xbox360/files/arnezamidump32.tgz mirror]). Save it to the desktop.		When Linux is loaded, start one of the webbrowsers (assuming you have a network cable plugged in) and browse to this page to download [http://www.xboxhacker.net/index.php?topic=7913.msg50090#msg50090 arnezami's dump32.c] ([http://beta.ivancover.com/xbox360/files/arnezamidump32.tgz mirror]). Save it to the desktop.

	Open a new Terminal from the menus, and 'cd Desktop'. Now compile the dump32 using the following command:		Open a new Terminal from the menus, and 'cd Desktop'. Now compile the dump32 using the following command:

Ivc at 14:02, 2 November 2007

2007-11-02T14:02:48Z

← Older revision		Revision as of 14:02, 2 November 2007
Line 206:		Line 206:

	Apparently you need both the 1BL and CPU Key to perform this with 360 Flash Dump Tool v0.8.		Apparently you need both the 1BL and CPU Key to perform this with 360 Flash Dump Tool v0.8.

			Region codes [http://gueux-forum.net/index.php?showtopic=167835]:
			- PAL : il faut changer ces 4 chiffres en 02FE
			- NTSC/J : il faut changer ces 4 chiffres en 01FF
			- NTSC-U/C : il faut changer ces 4 chiffres en 00FF
			- NTSC/KOR : il faut changer ces 4 chiffres en 01FC

	== Future hacks ==		== Future hacks ==

Ivc at 14:01, 2 November 2007

2007-11-02T14:01:13Z

← Older revision		Revision as of 14:01, 2 November 2007
Line 230:		Line 230:
	* [http://www.eurasia.nu/wiki/index.php?pagename=Xbox360Info Eurasia Xbox 360 Wiki]		* [http://www.eurasia.nu/wiki/index.php?pagename=Xbox360Info Eurasia Xbox 360 Wiki]
	* [http://www.xboxhacker.net/index.php?topic=6674.0 Layout of the 16mb NAND]		* [http://www.xboxhacker.net/index.php?topic=6674.0 Layout of the 16mb NAND]
			* [http://gueux-forum.net/index.php?showtopic=167835 Change region code]

Ivc at 09:55, 14 October 2007

2007-10-14T09:55:29Z

← Older revision		Revision as of 09:55, 14 October 2007
Line 177:		Line 177:

	=== Counters ===		=== Counters ===
	While upgrading to ~~4543~~ or 4552, fuseset #07 is changed and the lockdown counter in the NAND is increase by 1, for each update. I.e.:		While upgrading to 4532 or 4552, fuseset #07 is changed and the lockdown counter in the NAND is increase by 1, for each update. I.e.:
	Stock 2241:		Stock 2241:
	Lockdown counter: 0		Lockdown counter: 0
Line 209:		Line 209:
	== Future hacks ==		== Future hacks ==
	# Downgrade allowed via timing attack for all current machines, as of 2007-08-19 / kernel 5766 [http://www.xboxhacker.net/index.php?topic=8319.msg52753#msg52753]		# Downgrade allowed via timing attack for all current machines, as of 2007-08-19 / kernel 5766 [http://www.xboxhacker.net/index.php?topic=8319.msg52753#msg52753]
	# Dual kernels via switches or xD cards, one for exploitable kernel (~~4543~~ or 4548), another for Xbox Live/latest kernel		# Dual kernels via switches or xD cards, one for exploitable kernel (4532 or 4548), another for Xbox Live/latest kernel
	# King Kong game required to boot homebrew		# King Kong game required to boot homebrew
	# Find kernel exploits in ~~4543~~ or 4548 to make an on-boot exploit to not require King Kong		# Find kernel exploits in 4532 or 4548 to make an on-boot exploit to not require King Kong

	== References ==		== References ==

Ivc at 16:54, 13 October 2007

2007-10-13T16:54:43Z

← Older revision		Revision as of 16:54, 13 October 2007
Line 27:		Line 27:
	- SHA1-HMAC authentication. This is done in CB and CF too (but your CPU has the key). This prevents you to		- SHA1-HMAC authentication. This is done in CB and CF too (but your CPU has the key). This prevents you to
	choose between released versions of the boot sections/dash etc. However this was time attackable.		choose between released versions of the boot sections/dash etc. However this was time attackable.


	== Dump Data ==		== Dump Data ==

Ivc at 14:11, 13 October 2007

2007-10-13T14:11:06Z

← Older revision		Revision as of 14:11, 13 October 2007
Line 14:		Line 14:

	Keyvault is decrypted by the Hypervisor using the CPU Key [http://www.xboxhacker.net/index.php?topic=7872.msg50718#msg50718].		Keyvault is decrypted by the Hypervisor using the CPU Key [http://www.xboxhacker.net/index.php?topic=7872.msg50718#msg50718].

			== Crypto structure ==
			Arnezami's summary of the different crypto hashes [http://www.xboxhacker.net/index.php?topic=8668.msg55035#msg55035]:

			There are 3 kinds of verification used during boot:

			- RSA signatures. CB and CF are RSA signed. No way to break this (MS has private key) basicly because it uses
			assymetric crypto. This prevents us from changing the boot code itself.
			- SHA1 hash: CD, CE, CG. These hashes are contained in the RSA signed part of the previous sections and we
			can therefore not break it (also not time attackable). These can essentially be seen as extentions of the RSA
			signatures in CB and CF. Again preventing us from modyfing the boot code itself.
			- SHA1-HMAC authentication. This is done in CB and CF too (but your CPU has the key). This prevents you to
			choose between released versions of the boot sections/dash etc. However this was time attackable.


	== Dump Data ==		== Dump Data ==

Ivc at 00:58, 2 September 2007

2007-09-02T00:58:57Z

← Older revision		Revision as of 00:58, 2 September 2007
Line 216:		Line 216:
	* [http://www.xboxhacker.net/index.php?topic=8319.20 Timing Attack - Stupid Question]		* [http://www.xboxhacker.net/index.php?topic=8319.20 Timing Attack - Stupid Question]
	* [http://www.eurasia.nu/wiki/index.php?pagename=Xbox360Info Eurasia Xbox 360 Wiki]		* [http://www.eurasia.nu/wiki/index.php?pagename=Xbox360Info Eurasia Xbox 360 Wiki]
			* [http://www.xboxhacker.net/index.php?topic=6674.0 Layout of the 16mb NAND]

Ivc at 19:21, 1 September 2007

2007-09-01T19:21:14Z

← Older revision		Revision as of 19:21, 1 September 2007
Line 105:		Line 105:
	Fuseset #11 - 0a: 0000000000000000		Fuseset #11 - 0a: 0000000000000000
	Fuseset #12 - 0b: 0000000000000000		Fuseset #12 - 0b: 0000000000000000

			For a description of what the purpose of each set, see this [http://www.xboxhacker.net/index.php?topic=7389.msg47673#msg47673 thread post].

	=== CPU / Per-Box Key ===		=== CPU / Per-Box Key ===