Monday, March 27, 2006

Extracting the HD password from an XBox hard drive

Extracting the HD password from an XBox hard driveThe XBox harddrive uses a fairly old but relatively unused set of security commands to prevent easy access to it's built in drive. However, since the password system does not specify any form of challenge/reply system the password is transmitted in "clear" form. Thus with the right equipment and a little bit of patience you can easilly read the values.The ATA spec provides a command labeled SECURITY UNLOCK (command code 0xF2) which provides a means for passing a 32 byte password to an IDE drive in order to unlock it. There are two passwords, a master and a user password. The xbox uses the user passord.To get to the password you need at least 22 (preferrably 23) probes.DD(15:0) -- data pinsCS(1:0)- -- Chip SelectDA(2:0) -- Device AddressDIOW- -- Device I/O WriteDIOR- -- Device I/O Read (optional)When dealing with hardware you need to realise that there is a difference in the voltage level of a line and the line's meaning. For the "standard" wire the low voltage condition (usually 0V) corresponds to binary 0 and the high voltage condition (2.7V, 3.3V, 5V, 12V, or whatever) is binary 1. There are signals that are "negative logic" in which case the oposite is true: 0V == binary 1, +xV == binary 0. The ata spec uses the symbol 'A' (for asserted) to indicate the high voltage condition, and the symbol 'N' (for negated) for the low voltage condition.The CS0-1, DIOW, and DIOR lines are negative logic, which is indicated by the '-' mark after their names (above and in the spec).There are several registers in the ATA spec, they are addressed by the combination of the CS and DA lines. Several of these registers have different meanings depending on whether they are read or written, the write meaning is shown first. The values for these registers are:cs1- CS0- DA2 DA1 DA bits Name0(A) 1(N) 1(A) 1(A) 0(N) 8 Device Control Reg./Alt. Status Reg.1(N) 1(N) X X X 16 Data Port1(N) 0(A) 1(A) 1(A) 1(A) 8 Command Reg./Status Reg.1(N) 0(A) 1(A) 1(A) 0(N) 8 Device Reg.1(N) 0(A) 1(A) 0(N) 1(A) 8 LBA High Reg.1(N) 0(A) 1(A) 0(N) 0(N) 8 LBA Mid Reg.1(N) 0(A) 0(N) 1(A) 1(A) 8 LBA Low Reg.1(N) 0(A) 0(N) 1(A) 0(N) 8 Sector Count Reg.1(N) 0(A) 0(N) 0(N) 1(A) 8 Feature Reg./Error Reg.1(N) 0(A) 0(N) 0(N) 0(N) 16 Data Reg.The value to be placed in the register is passed on the DD lines (the data lines). When setting an 8 bit register the low bits in the data lines (0-7) are used.The XBox appears to use a standard method for sending ata commands to it's drives. The SECURITY UNLOCK command doesn't require the use of the sector count, LBA low/mid/high, or features registers, but they get cleared anyway. The only register that we are really interested in, to begin with, is the command register. What we need to do it setup our logic analyzer to trigger (start capturing) when the command register is written to with a value of 0xF2. The method for doing this is dependant on your analyzer, RTFM. So, trigger when:CS1 == 1CS0 == 0DA2 == 1DA1 == 1DA0 == 1DIOW == 1DD(7:0) == 0xF2At this point the XBox has written the command 0xF2 (SECURITY UNLOCK) to the drive, which is now expecting the recieve the password over the data lines in subsequent writes. The mode used to transfer the data is called "PIO data-out" and transfers 512 bytes of data (that's 256 16 bit writes) over the data lines, controlled by bits in the Status register. There is a good diagram in the ATA spec showing the transfer process, and you are encouraged to have it on hand when going through this the first time (the latest ATA specs can be found at data to be transferred is:word #0: bit 0 == 1->Master password, 0->User passwordbits 15-1 == reserved (these were 0 in my case)so the whole data word was 0x0000word #1: first two bytes of passwordword #2: second two bytes of password...word #16: last two bytes of passwordwords #17-255: reserved (these were all zero in my case)The transfer does not begin immediately. The device (the ide drive in the xbox) must first signal that it is read to recieve the data. In the PIO modes this flow control is done through the Status Register. The bits in the 8 bit status register are:bit 7: BSY Busy (the device is busy)bit 6: DRDY Device Ready (the device is accepting commands)bit 5: DF Device Fault (device is unable to complete the command)bit 4: # (Command Specific)bit 3: DRQ Data Request (device is ready to transfer data)bit 2: --- Unused (Obsolete)bit 1: --- Unused (Obsolete)bit 0: ERR Error (an error ocurred while processing a command)The transfer of data to the drive cannot occur until BSY == 0. You will see (if you are watching the DIOR line) that the xbox is polling that register waiting for the bit to clear. When it does the xbox will begin transferring the data bytes to the drive.It is worth while for me to note that on high speed analyzers you will see the logic lines drift from their previous value to the new value. This is *normal* and is due to the capacitance of the data bus. You need to be looking at the stable signal, not at the (possibly multiple) transient values which occur during the change. This is the reason for the DIOW- line, to tell the device when the data lines are stable. Slower measurement devices will (probably) not see these transient results. If you are unfamiliar with such highspeed devices this can be confusing :)Options for those without a logic analyzerI have had a bunch of questions centered mainly on how to do this without the analyzer or some other specialized equipment. Generally my answer is: you probably can't. I *seriously* doubt that any generic input device on a PC can be read at anywhere near the speed required.If someone really wants to try, my suggestion is to start with the parallel port. I do not know that much about the parallel port, but you may be able to program it to read the data at a sufficiently fast rate. It appears to have at least 9 input lines, (though some are inverted) which can be used to read the pins on the ide cable. You would have to dedicate 6 of these pins to the control signals (CS(1:0)-, DA(2:0), and DIOW-), and could use the other 3 to gather data from the DD pins. This would, of course, require multiple runs to gather all of the 16 bits for each word in the password.The two primary questions I can't answer are the capacitance of the input pins on the parallel port, and the speed with which they can be polled. If the capacitance is too high you will be ruining the ide signals, and the xbox will almost certainly not be able to communicate with the drive at all. If that is the case it may never get to the stage of trying to transfer the password to the drive (worst case is it could overheat the IDE controller chipset). If the read speed is too low then you will not be able to get all of the state changes, and will probably not be able to read anything of use. My *guess* as to the lowest possible read rate is somewhere around 25MHz. At this rate you will probably miss some of the DIOW line changes, but should be able to see all of the actual data bus changes.If you decide to try this, verify it works on some other drive before using your xbox drive, as I have no idea what kinds of problems might come up if it fails.Good luck, and happy hacking.-SpeedBump
Imaging Your Xbox HD using dd (in QNX OS)
by xbill
A method for imaging your Xbox hd to a file, or set of files, including a procedure for imaging directly from one disk to another (cloning) using dd in the QNX OS.
This is one method for imaging/cloning your Xbox hd. It is by no means the only method.


* A Disassembled Xbox
* A fairly recent PC system with an available standard IDE interface.
* A bootable QNX ( OS.
I used QNX because it installs quickly from CD ROM, and has a tiny footprint, but this should be possible with Linux as well. Free OSes rule!
* A spare IDE/ATA hd of equal or greater capacity than the Xbox hd, and/or equivalent free space on an existing file system.

* Networking components (NIC, drivers, cables, hubs, switches, etc.)
* LAN with server(s) featuring disks with file sytems such as NTFS that support large file sizes, and networking drivers, protocols installed necessary to share files on the LAN.
* SMB network file system manager/client (CIFS.) This is included with QNX.

Running the Xbox with the cover off, and the power supply exposed presents a safety hazard. Be extremely careful when working around the open Xbox with the power on.
A serious or fatal electrical shock could ruin your day.
Swapping cables, and working near live circuits can also potentially cause damage to the electronics if not handled carefully. If a metal part or a tool falls onto live circuits, you could roast something.
Watch out for static electricity. Prior to handling components, or swapping cables, touch the chassis of your PC with the back of your hand to discharge any built-up static charge on your body.
I, and the publisher, SiliconIce, assume no responsibility for any damage to you or your stuff. This is provided for informational purposes only.
Just watch yerself, OK?

Since the Xbox hd has the ATA Security feature enabled, you'll need to unlock it before you attempt to image it.
This is the cable swap method.
Setup your Xbox and your PC right next to each other, such that the PCs available IDE drive cable, and power connector can reach the Xbox HD.
Connect an available power connector from the PCs power supply to the Xbox hd.
Connect the IDE cable from Xbox to the the Xbox hd.
Power up the PC and hit the "Pause" key before it autotypes the drives.
Power up the Xbox to the idle Dashboard.
*During the Xbox startup, the Xbox transmits the password via the ATA Unlock Command, and the drive is unlocked.
Now, carefully disconnect the Xbox IDE cable from the Xbox hd.
Plug the PC IDE cable into the Xbox hd.
Hit any key on the PC keyboard to let it continue to boot.
Now the drive is unlocked and reconnected to the PC, ready for read(/write?) operations.

As with many Unix/Linux OSes, there is a 2GB file size limit with QNX due to it’s use of the minix filsystem, which kinda sucks. This means breaking the image in to smaller chunks. However, I decided that during analysis, smaller files would be easier to handle than one huge file. So, breaking the image into eight 1GB files makes some sense. I have the 8GB Western Digital hd.
For Linux, it probably depends on the distribution, the file system, and the processor. However, I think tweaking, and relinking the kernel in Linux for larger file support (LFS) is probably easier than it is in QNX.
Be aware that there may be a file size limit on some file systems.
If your OS can handle large file sizes, then you can adjust your dd options to read/write larger images.

To make images of the Xbox hd, you can use the standard dd util in a shell script.
When using dd, you must use the raw block device.
With QNX, the first IDE hd is /dev/hd0. If you connected the Xbox hd to the secondary IDE then it’s /dev/hd1.
Use df to display the total blocks on the disks.
This display is for the Western Digital 8GB, yours may look different.
# df -P
Filesystem 512-blocks Used Available Capacity Mounted on
/dev/fd0 0 0 0 100%
/dev/hd1 15633073 15633073 0 100%
/dev/hd0t79 156344517 16213159 140131358 11% /
/dev/hd0 156355585 156355585 0 100%

/dev/hd1 shows 15633073 blocks (512 byte sectors.)
15633073 is not evenly divisible, but 15633072 is.
15633072 / 8 = 1954134
Just include the odd sector in the last file. So, the first seven files will be 1954134 blocks each, and the last will be 1954135.
dd can take bytes or blocks, I just kept it as blocks.
The "skip" parameter is for skipping past the previously imaged sectors.
I created eight image files of roughly 1 GB each.
Create the script using the vi editor:
# vi getxboxhd
Type the letter "i", for insert mode, and type, or cut & paste these lines in:
# Western Digital 8GB
dd if=/dev/hd1 of=/xbx/xfile1 ibs=512 obs=512 count=1954134
dd if=/dev/hd1 of=/xbx/xfile2 ibs=512 obs=512 skip=1954134 count=1954134
dd if=/dev/hd1 of=/xbx/xfile3 ibs=512 obs=512 skip=3908268 count=1954134
dd if=/dev/hd1 of=/xbx/xfile4 ibs=512 obs=512 skip=5862402 count=1954134
dd if=/dev/hd1 of=/xbx/xfile5 ibs=512 obs=512 skip=7816536 count=1954134
dd if=/dev/hd1 of=/xbx/xfile6 ibs=512 obs=512 skip=9770670 count=1954134
dd if=/dev/hd1 of=/xbx/xfile7 ibs=512 obs=512 skip=11724804 count=1954134
dd if=/dev/hd1 of=/xbx/xfile8 ibs=512 obs=512 skip=13678938 count=1954135

Press the key to exit insert mode.
Press to save and exit the vi editor.
Chmod it for executable:
# chmod 744 getxboxhd
Run it:
# getxboxhd
Go find something else to do, this will take a long time to run.
I’m sure there is a cleaner way to do this, like a speedy C program, but the script here requires no compliation/linking.
While the script is running, after each dd line is done you’ll see the Records in/Records Out telling you that it copied the sectors to a file.
When it is finished, you’ll be back at the command prompt.
Type ls to see the files:
# ls -al /xbx
total 15633084
drwxrwxr-x 2 root root 2048 Jan 08 17:48 .
drwxrwxr-x 13 root root 4096 Jan 08 17:48 ..
-r--r--r-- 1 root root 1000516608 Dec 15 17:23 xfile1
-r--r--r-- 1 root root 1000516608 Dec 15 22:56 xfile2
-r--r--r-- 1 root root 1000516608 Dec 15 23:28 xfile3
-r--r--r-- 1 root root 1000516608 Dec 16 00:10 xfile4
-r--r--r-- 1 root root 1000516608 Dec 16 01:00 xfile5
-r--r--r-- 1 root root 1000516608 Dec 16 02:00 xfile6
-r--r--r-- 1 root root 1000516608 Dec 16 03:09 xfile7
-r--r--r-- 1 root root 1000517120 Dec 16 04:28 xfile8
Now you can use spatch to browse the files.
# spatch –b /xbx/xfile3
You should be able to use one of the file dumper utils that are out there to extract the actual xbox disk files from the images.

Also, you can modify the script and add the date and time to the filename so if you image additional files, they will be unique:
filedate=`date "+%m%d%y.%H%M"`
dd if=/dev/hd1 of=/xbx/xfile1.$filedate ibs=512 obs=512 …… ……
dd if=/dev/hd1 of=/xbx/xfile2.$filedate ibs=512 obs=512 …… ……

Now that you have the image files, you may want to copy/move them to other systems for analysis.
If you have an NT or Win2K system with large NTFS disks, you can copy the files there and use your favorite Windows tools.
I used QNX’s fs-cifs SMB manager/client. This allows the QNX system to communicate with and use SMB network shares.
First, I created a share on my Win2k system called XBSHARE.
Then, on the QNX system, I launched fs-cifs to mount that share:
# fs-cifs –a //win2kbox: /xshare username password
I’m not sure why, but fs-cifs requires both Netbios name and IP.
The –a option spoofs POSIX calls to get rid of error messages that occur when apps attempt to chmod/chown the files on the share. This option is not required.
The /XBSHARE is the share I created on the win2k system.
The /xshare is the local QNX mountpoint for the share.
Username and password must be any valid user account on the win2k system that has permissions to read & write the shared directory.
Now copy the files to /xshare:
# cp /xbx/xfile? /xshare
This will take a long time, too.
You could dd the files directly to the share, but this is really really slow.

Another option is to dd the files to another local disk that is formatted FAT16.
When dd script is complete, shutdown, and move the FAT16 drive to another system.

I have not cloned the Xbox hd to another hd, yet. However, I believe the cloning procedure should be much the same as imaging to a file, or files using dd.
You can dd from one disk to another, but I suggest that the disks be on different IDE channels. Put the Xbox hd on as a secondary IDE master, and the spare disk on as primary IDE slave.

Make sure you know which drives are which before doing the dd.
The primary master should be /dev/hd0.
The primary slave should be /dev/hd1.
The secondary master (Xbox hd) should be /dev/hd2
Again, with file size limits, the blocks/sectors may need to be copied in chunks.
You could dd something like this:
dd if=/dev/hd2 of=/dev/hd1 ibs=512 obs=512 count=n
dd if=/dev/hd2 of=/dev/hd1 ibs=512 obs=512 skip=n count=n
dd if=/dev/hd2 of=/dev/hd1 ibs=512 obs=512 skip=n*2 count=n
dd if=/dev/hd2 of=/dev/hd1 ibs=512 obs=512 skip=n*3 count=n
: :
: :
Replace n for the count and skip options with the correct block numbers similar to the image script.

Once you have cloned the drive you could use spatch, or your favorite sector editor.

I hope this guide is useful to you.
Happy hacking.


Dumping your Xbox HD under Win32
By Adam Branom (aka RustyBall)
FATX Explorer by opcode

WinHex (all you need is demo but, you can buy it if you want) Get it here
FATX Explorer (ported to Win32 by opcode from Andy + Luke’s Xbox HD dumper)
Available at XboxHacker Downloads
Note: This process will not work on a fat32 drive because of its file size limit.
First issue is the Xbox HD password lock. There are two ways of bypassing this. Either spend a lot of money and get a logic analyzer or have access to one, or, the much easier route of the "cable switch" method. To do the cable switch, plug a power plug from your pc into your xbox hd and fire up your computer. Right when it starts booting up, start pressing the Pause Break key and do not let it detect your drives. Then, make sure the IDE cable is going from the xbox to the HD and turn on the xbox. After it gets to the dashboard, unplug the ribbon cable that is going from the Xbox to the hd and replace it with one that is connected to your computer. Now, press a key to allow your computer to continue booting.
Once into windows, run WinHex. Go to tools > disk editor. Find the xbox hard disk in the list and hit ok. Then, hit ctrl+a and go to Edit > Copy Block > Into new file. Save the file somewhere and leave your comp alone for a while.
Once it is done, the next process begins. Working with the image file you just made.
To dump a file, load the image file and select the partition you want to see. Next select a directory from the left pane, any files in that directory will be shown in the list on the right. To dump one or more files, select the files in the list, then right-click and select "Dump Files..." this will show a Save dialog for each file you selected with the XFAT filename put in as the default name. To save the file simply press save and it will be saved to the directory/name you selected.

Xbox Video Connector Pinout Information
Signal Name
The output of this pin provides a current-limited DC power supply for active AV Pack circuitry.
This pin outputs line-level Right channel linear audio.
This pin outputs line-level Left channel linear audio.
This ground is provided for connection to the Right channel audio cable shield.
This ground is provided for connection to the Left channel audio cable shield.
This pin is the SP-DIF logic-level output.
HSYNC (???)
Horizontal Sync Signal used for VGA output mode
VSYNC (???)
Vertical Sync Signal used for VGA output mode
Video output mode select pin 1
This pin provides a convenient grounding point for the MODE1 input if needed.
Video output mode select pin 2
This pin provides a convenient grounding point for the MODE2 inputs if needed.
Video output mode select pin 3
This pin provides a convenient grounding point for the MODE3 inputs if needed.
SCART Status Pin
Ground connection for pin 18 (Pb)
Ground connection for pin 19 (C/Pr)
This pin outputs the Pb component signal in HDTV mode, and the BLUE component signal in RGB SCART mode.
This pin outputs the Chroma signal in SDTV mode, and the Pr component signal in HDTV mode, and the RED component signal in RGB SCART mode.
Ground connection for pin 22 (Y)
Ground connection for pin 23 (CVBS)
This pin outputs the Luma signal in both SDTV and HDTV modes, and the GREEN component signal in RGB SCART mode.
This pin is dedicated to the Composite Video Out (CVBS) in SDTV mode. In HDTV mode, this pin is not used.
This pin is specifically designated to carry the DC return current.
AVIP connector pin out: _______________________ 24 22 20 18 16 14 12 10 8 6 4 2_ 23 21 19 17 15 13 11 9 7 5 3 1
The AVIP supports several output configurations. The MODE inputs to the AVIP are provided to identify the type of signals expected by the AV Pack. The output mode is identified by jumper wires between the mode select pins (MODE1, MODE2, and MODE3) and GND pins on the AVIP connector as shown in the table below. The state of these inputs is continuously monitored by the system management controller, and communicated to the Xbox OS. Changes in the state trigger notification to the OS that the AV mode has changed. The state of these pins does not directly control the video or audio mode; the OS configures the CRT controller of the GPU and the TV Encoder through software. It is possible to configure these independently of the MODE state pins, as may be required for test purposes.
AVIP Mode Input (Pin)
Video Mode
AVIP Video Output (Pin)

M[0] (9)
M[1] (11)
M[2] (13)

No AV Pack Present
525/60 RFU Mode (NTSC, mono audio)
625/50 RFU Mode (PAL/SECAM, with mono audio)
HDTV Mode (Y/Pr/Pb)
525/60 SDTV Mode (NTSC)
VGA (note by kgasper: This VGA mode is misleading. I have verified that the GRB signals really are still YPrPb signals but with a 31kHz H-sync which allows the VGA monitors to sync to it. But the reason it is so green is because it is YPrPb.)
625/50 SDTV Mode (PAL-I)
625/50 SDTV Mode(PAL-I) SCART

Xbox Video Connector to RGB SCART
Below is the scheme to connect the Xbox-Pins to the Scart-Pins.
Xbox A/V-Plug:(Looking from the front of the connector not the wire side) 1 1 1 1 2 3 4 5 6 7 8 9 0 1 2 ------------------------_ + + + + + + + + + + + +_ + + + + + + + + + + + + ---------------------------- 1 1 1 1 1 1 1 2 2 2 2 2 3 4 5 6 7 8 9 0 1 2 3 4RGB Pinout:1 - Right Audio Signal2 - Right Audio Ground3 - SP-DIF Signal4 - RGB Switching Signal5 - Jumper to 17 (all 3 Jumpers6 - Jumper to 18 need to be7 - Jumper to 19 set for RGB)8 - Blue Ground9 - Blue Signal10 - Green Ground11 - Green Signal12 - SP-DIF Ground13 - SP_DIF +514 - Left Audio Signal15 - Left Audio Ground16 - ???17 - Jumper to 518 - Jumper to 619 - Jumper to 720 - AV Select Signal21 - Red Ground22 - Red Signal23 - Composite Ground24 - Composite Signal (Sync for RGB)Xbox Pin-> Scart Pin1 -> 22 -> 43 -> -4 -> 165 -> -6 -> -7 -> -8 -> 59 -> 710 -> 911 -> 1112 -> -13 -> -14 -> 615 -> 416 -> -17 -> -18 -> -19 -> -20 -> 821 -> 1322 -> 1523 -> 1724 -> 20Scart Pin 21 (Shield) & Xbox-Plug Shield should be connected to all the Ground-Pins (like in the XBOX-Plug).If you want SP-DIF you need to extract a seperate cable.-------zer0neg-------
Expensive VGA for Xbox By: LiQiCE
Here's the information on the X-Box VGA Box that I "made":
I purchased:
1. X-Box HD-TV Pack $20.00
2. Audio Authority 9A62 - $189.00 MSRP
The Audio Authority 9A62 box is a converter from Component Video (Y Pb Pr) to HD15 VGA. If you set your X-Box to display in 480p (essentially 640x480 @ 60hz) the 9A62 box will convert the 480p signal to VGA for you!
All you need to do is plug the Component video outputs from the X-Box HD-TV Pack into the input for the 9A62 and then plug your VGA monitor into the RGB output of the 9A62! Its as simple as that.
There is one big problem though, you can't see the Dashboard! The X-Box dashboard for some reason does not work properly with this setup. To get games to play you need to use the dashboard to set the X-Box to 480p though! Here's how you do it:
Using audio queues (assuming you have speakers plugged into the audio output from the HD-TV Pack), you can "listen" to where you are in the menu. After you turn on your X-Box without any disc inside, here is how you set it to 480p.
1. Press down once (you will hear a noise confirming you pressed down) (This is to goto Settings)
2. Press A (another confirmation noise)
3. Press Down 3 times (you will hear a click for each time you press down) (This is to goto Video Settings)
4. Press A (another confirmation noise)
5. Press up until you stop hearing the confirmation noises so you know you are at the top of the list, and press down once (this is presumably to switch from 480i to 480p, I don't know because I can't actually see!)
6. Press A
7. Press Left once (this is presumably to select Normal 4:3 mode, instead of widescreen)
8. Press A
9. Keep pressing B until you stop hearing the audio confirmation noises
10. Turn off your X-Box, turn it back on, pop in a game, and enjoy!
The games I have tested the VGA setup with so far is: Dead or Alive 3, Halo, and NHL 2002
All work perfectly.


No comments: