Download: Please Subscribe for more videos. This Channel: www.Youtube.com/Slot1Gamer B. Shadow C meant the original xbox dash was left on it and some space was taken for a new 'C drive' to have the hacked/alternative dashes put on it. Virtual EEPROM is much along the same concept but for EEPROM (a chip that holds a small amount of data, data needed for the xbox to boot if you have just got a softmod on it).
The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.Parts of the EEPROM are encrypted using Kernel/XboxEEPROMKey.
- 2Reading/Writing the EEPROM
Contents
Start | End | Notes |
---|---|---|
0x00 | 0x13 | HMAC_SHA1 Hash |
0x14 | 0x1B | RC4 Encrypted Confounder ?? |
0x1C | 0x2B | RC4 Encrypted HDD key |
0x2C | 0x2F | RC4 Encrypted Region code
|
0x30 | 0x33 | Checksum2 - Checksum of next 44 (0x2C) bytes (0x34 - 0x5F)* |
0x34 | 0x3F | Xbox serial number - (ASCII chars 0x30 - 0x39 to match each digit in SN) |
0x40 | 0x45 | Ethernet MAC address (Microsoft Xbox - 00:50:F2:xx:xx:xx) This is the MAC address of the Ethernet hardware, which has been issued by the IEEE. |
0x46 | 0x47 | Unknown Padding ? |
0x48 | 0x57 | Online Key ? |
0x58 | 0x5B | Video Standard
|
0x5C | 0x5F | Unknown Padding ? |
0x60 | 0x63 | Checksum3 - Checksum of the next 92 (0x5C) bytes (0x64 - 0xBF)* |
0x64 | 0x67 | Zone Bias - Offset in # minutes to subtract from GMT time (e.g., for GMT-06 Central; 6hr = 360min = 0x00000168) |
0x68 | 0x6B | Standard Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CST0, ACST) |
0x6C | 0x6F | Daylight Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CDT0, ACDT) |
0x70 | 0x77 | Unknown Padding ? |
0x78 | 0x7B | Standard Time Starts 10-05-00-02 (Month-Day-DayOfWeek-Hour) |
0x7C | 0x7F | Daylight Savings Time Starts 04-01-00-02 (Month-Day-DayOfWeek-Hour) |
0x80 | 0x87 | Unknown Padding ? |
0x88 | 0x8B | Standard Timezone Bias; if not DST, 0 (0x00000000) minute time adjust |
0x8C | 0x8F | Daylight Savings Time Bias; if DST, -60 (0xFFFFFFC4) minute time adjust |
0x90 | 0x93 | Language ID (0 = not set)
|
0x94 | 0x97 | Video Settings
|
0x98 | 0x9B | Audio Settings
|
0x9C | 0x9F | Games Parental Control (0 = Max rating)
|
0xA0 | 0xA3 | Parental Control Passcode; 4 button sequence (each key stored in a nibble)
Note:
|
0xA4 | 0xA7 | Movies Parental Control (0 = Max rating)
|
0xA8 | 0xAB | XBOX Live IP Address.. |
0xAC | 0xAF | XBOX Live DNS Server.. |
0xB0 | 0xB3 | XBOX Live Gateway Address.. |
0xB4 | 0xB7 | XBOX Live Subnet Mask.. |
0xB8 | 0xBB | Other XBLive settings ? |
0xBC | 0xBF | DVD Playback Kit Zone
|
0xC0 | 0xFF | Unknown Codes / History ? do not change any values in this range |
Note: Info in above table comes from XKUtils XKEEPROM.h.
*Configmagic-FINAL-1.6 uses the wrong size when computing Checksum2 (40 instead of 44 bytes) and Checksum3 (96 instead of 92 bytes). Checksum2 value computed was correct only because the extra 4 bytes not used in the CRC computation were all 0's which does not change the CRC value. However, a similiar problem with computation of Checksum3 is present. The CRC computed for v1.6 Xbox's is incorrect as the 4 extra bytes are not 0's as on earlier versions.
Reading/Writing the EEPROM
Software Method
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.
Hardware Method
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see hereor here), build an I2C-Serial cable, or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See here for pinout information. Then use the corresponding software to read/write the EEPROM.
The HMAC SHA1 Hash
The HMAC SHA1 Hash is generated[FIXME] out of the first 48 bytes[FIXME]. This section has been identified clearly[FIXME].
Checksum Algorithm
Checksum2 and Checksum3 values can be calculated by running the following code snippet over the area the checksum covers:
Read Checksum Algorithm
When the Xbox reads from the FACTORY_SETTINGS or the USER_SETTINGS section of the EEPROM, this algorithm is ran over the entire section accessed (including the CRC checksum mentioned above) to ensure that the data is valid. If the result of the checksum algorithm does not equal 0xFFFFFFFF, STATUS_DEVICE_DATA_ERROR is returned from the Kernel.
Further Reading
Further to my post How NOT to upgrade your Xbox, I’m pleased to say I’ve got it working again. It’s taken a long time, a great deal of trial-and-error, and some head-scratching. To save at least one other person some hassle, here’s my ‘journey’ from a useless Xbox to one that runs Xbox Media Center, etc.
Eeprom File Xbox
I’ll cut to the chase: you don’t want to be reading this post unless you’ve had the same problems as I had. It’s information you could have gone to bed without knowing. Trust me.
Problem: Error code 21 on an Xbox v1.0 with an Xecuter2 modchip installed.
Solution (briefly stated): Using ConfigMagic (comes with Slayer’s Evox Autoinstaller) to manually enter MAC address (made-up) and unlock Xbox hard disk (using code from backed-up hddinfo.txt file). Transfer of backed-up copy of BIOS.bin to C: drive of Xbox via FTP. Re-flashing of EEPROM using ConfigMagic.
Moral of the story:Always have a copy of your Xbox’s EEPROM backed-up somewhere!
In the process of playing about with the BIOS, trying to get rid of the ‘flubber’ animation when the Xbox first boots, I was playing around with ConfigMagic. This program comes as part of the excellent Slayer’s Evox Autoinstaller and enables you to lock/unlock your hard disk and flash your EEPROM from a file on your hard disk.
Xbox Eeprom Download
Once I’d accidentally flashed it with basically and empty EEPROM file, I was fairly stuck. I couldn’t re-unlock the hard disk nor could I FTP into the Xbox due to not having the information that had been previously part of the EEPROM. This information contains things like a long string of numbers that is unique to your hard disk, etc. Pretty much every site that came up when I searched on Google documented how to unlock the hard disk by connecting it to the PC and running the Liveinfo Linux distribution. That’s not an option for me – we’re laptop-only in our house!
In the end, because I’d backed-up everything on the Xbox before tinkering (always good practice) I was OK. I ended up editing the EEPROM on-the-fly, making up the MAC address of the Xbox along the lines of one suggested on this page. The unique Xbox HD key I got from a file called hddinfo which I found in the C:Backup directory in the overall Xbox backup I’d previously created. I then used the ConfigMagic program to lock the hard disk. When I rebooted it showed that the Xbox had a proper IP address (instead of 0.0.0.0 which means it can’t connect).
This meant that all I needed to do was install a dashboard to allow XBMC to run. I thought this would be easy via Slayer’s Evox Autoinstaller, but it didn’t work. In the end, I simply formatted the disk, connected via FTP (with Slayer’s Evox Autoinstaller running) and transferred my backup over. Once I’d finished, I followed the instructions contained in the updated T3CH release of XBMC that I decided to install. This explains and easy way to create a shortcut from the default dashboard to the directory within which XBMC is situated (in my case, F:APPSXBMC)
So, with the xTV skin for XBMC documented at How To: Turn Your XBox Into An AppleTV I now have a wonderful home entertainment solution again! 🙂