Print

[frieko]

Frieko's guide to the Uber XBE Exploit via EvoX gamesave exploit (MA, 007, SC) and FTP



As always, I AM NOT RESPONSIBLE FOR YOUR ACTIONS AS A RESULT OF THIS DOCUMENT! ALL XBOX MODDING RISKS VOIDING YOUR WARRANTY, BANISHMENT FROM XBOX LIVE, OR DESTRUCTION OF YOUR XBOX SYSTEM!

Thanks to pedrospad, rmenhal, devz3ro, angerwound, and others for creating this awesome mod and for helping me install it.

Idots has done some great work with his ltools UDE installer. If your XBOX is compatible, go ahead and grab that off the usual places and use it. However as of writing it doesn't work well with NTSC-J, PAL or new boxen with Xcalibur video encoders. If this is true, or like me you just like to be difficult, never fear, you can still install UXE on your XBOX with a plain old EvoX-loaded gamesave exploit, which is what I will show you now. This operation SHOULD be compatible with all known xbox from version 1.0 - 1.6. I didn't QUITE write a noob guide, but if you've done any modding in the past and you have a reasonable grasp on the lingo, or you're a clever and brave noob, by all means proceed.

You will need:
> A Free-X compatible game (an original disc) and exploit gamesave loaded with EvoX. Currently hacked games are 007 Agent Under Fire, MechAssault, and Splinter Cell. The gamesaves are available on the usual places.
> An ethernet setup from your xbox to a computer with FlashFXP or other FTP client installed.
> Make a note of your Kernel and Dashboard versions. They can be found in the dashboard, at settings->system info.
> Xbox Kernel 3944 4034 4627 4817 5101 5530 5713 or 5838 (pretty much all known kernels)
> Xbox dashboard with an "Xbox Live' tab. Preferably 4920 or higher. You can get D:4920 from Slayer's (you don't need to install it, just grab update.xbe for step , or try popping in a game cd and clicking on 'Xbox Live' which should update.
> fonts6171.zip
> uberpatcher.rar   or alternately the command line version s1994752.zip     (1994752 is the magic number for uxe, it comes from the byte size of the .xbe used)
NOTE: A LOT of people including myself have trouble getting uberpatcher to load. I's probably some .net crap, so you can try upgrading your .net but it's probably easier to just use the command line version.
> metoo-m8plus-v1.4.1.zip [usual places]
> EvolutionX dashboard. [It's either in your gamesave, or grab it off the usual places]
> Idot's dashboard font patcher [usual places, xbe-xip-xbx-tools in PC section]

WARNING: If you have to stop in the middle of this operation, you should first use the backup from Step 6 to restore your xbox to factory spec before you walk away. Although this exploit does NOT suffer from the clock bug after it is installed, leaving the xbox without power while it doesn't have a working hard disk boot sequence (custom or original) will cause your xbox to frag.

Quick technical analysis: PedrosPad found a way to font-hack xboxen without risk of the clock bug. Instead of hacking xboxdash.xbe where the clock bug lives, they find another craptacular .xbe file that's free of the bug but still exploitable, name it xboxdash and hack it instead. Very clever. Basically after that you throw some crafty files into the fonts folder and wait for the magic to happen. xboxdash.xbe gets tricked into loading the Phoenix BIOS Loader, which in essence is the software version of a modchip. It injects a new custom BIOS-kernel into the system.

Devz3ro's original thread can be found here.

If you have everything you need, let's begin:




Step 1. Boot up a temporary EvoX dashboard using a game save exploit like 007:AUF, MechAssault, or Splinter Cell

Here's a guide by jsrlepage:

QUOTE

This is how I succeeded in installing a software modification under an Xbox with the Splinter Cell exploit. What you will need : - Unmodded, unopened, under extended warranty Xbox :-D (that's mine - no wonder I didn't want to do a machine-open) - Splinter Cell (Tested with a non-platinium) - Memory Card (I used a MadCatz. meow.) - A friend with a modded, or someone who made THAT/a hack and can lend you a card with the Splinter Cell hack/copy the savegame hack to your card. - Home network (or anything, as long as you can FTP to your Xbox). - Hack 1 : Splinter Cell Exploit (usual place) Steps BEFORE exploiting your Xbox Unpack every archive you downloaded. You should unpack them in different directories, but as subdirectories of the same directory. Steps to get your savegame on a memory card. 1- Ask a friend to upload them to a clean/without-Splinter-Cell-saves memory Card OR 1- Ask a friend who has a memory card to copy the savegame to it (backuping his SC saves and deleting them before copying the exploited ones. Steps AFTER you got a Memory Card with the savegame. 0- Before anything, double and triple-check that your Xbox is accurately plugged (power cord, audio-video output) and plug your Box on your private network. 1- Access your box's current dashboard, go in Memory>Hard Disk and delete any Splinter Cell savegame you currently have - the hack must be the ONLY Splinter Cell savegame present on your Xbox. 2- Still in the original dash, go in your memory card, and copy the two save slots (Linux Installer and the Splinter Cell Savegame) to your hard drive. 3- When you have sucessfully copied the two savegames (the Linux Installer should have a "Debian" logo, and maybe even the Splinter Cell Savegame), insert your "Splinter Cell" game like if you were going to play. 4- Get into the menu, choose "Play", then take the "Linux" profile, and select "Checkpoints" with the "A" or "Start" button of your control pad. Don't worry, there isn't supposed to be any checkpoint entry. 5- BAM! You have sucessfully loaded EvoX! Which means you now have a FTP server. Advice : take down your IP address. You can get it in "System Utils" > "Settings" > "IP" (the first one you see).

Step 2. In EvoX, go to Settings and make sure the network settings are correct, save and reboot if you have to change anything.

Step 3. Use the EvoX "Backup BIOS and EEPROM" function.

Step 4. Use an FTP client to access your XBOX.

Step 5. Pull the "backup" folder created in step 3 onto your computer for safe keeping. It will be in e:\UDATA, use FTP search if you can't find it.

Step 6. Pull the entire contents of your XBOX's 'C' drive onto a folder on your computer.

Step 7. SWEAR TO ME YOU REALLY DID STEPS 5 AND 6! ;-) You will need them if something goes wrong.

Step 8. Make a new folder on your computer and copy the file c:\xodash\update.xbe from your XBOX into it. (On a side note, update.xbe can also be found in Slayer's.)

Step 9. Run Uberpatcher and select the update.xbe from step 8 and click patch. This will create a file xboxdash.xbe. Alternately, use the appropriate command-line patcher and name the output xboxdash.xbe.

Step 10. Right click on this file, hit properties, and verify that it is 1,994,752 bytes in size.

Step 11. Now the fun begins. Go back to your FTP client, and copy the following files from metoo-m8plus into the root of your E: drive to install the BIOS loader:
 default.xbe
 boot.cfg
 Metoo-M8plus_16-06.bin

Step 12. Install EvoX dashboard to your xbox C drive. Your game save should have an "Install EvolutionX" tab, otherwise just put an evoxdash.xbe, evox.ini and 'skins' folder into your C. You will probably want to edit evox.ini later, or put your other dash of choice in C: (Just be sure to rename the new dash evoxdash.xbe)

Step 13. In your XBOX C: drive, rename xboxdash.xbe to msdash.xbe. Then take the new uber-patched xboxdash.xbe from Step 9 and put it in the xbox C:

Step 14. Rename the folder c:\fonts to f0nts. (notice the zero) You can leave C:\xbox.xtf and c:\xbox book.xtf alone.


[NOTICE: Steps 15A-15C must be done all at once and in the order I show. The reason for this is that update.xbe must find bert before it finds ernie. Technical details here, otherwise just trust me. If for any reason you end up with the wrong files, remove the fonts folder and make a new one.]


Step 15 A. Make a fresh new folder on your xbox C: drive called fonts.

       B. Copy bert-xxxx-01.xtf (where xxxx is your xbox's original kernel version) from the s1994752 folder of the updatefonts71 package to your xbox C:\fonts folder

       C. Copy ernie.xtf from updatefonts71 into c:\fonts



Your xbox directory tree will now look like this:

CODE

C: | +-- evox.ini +-- evoxdash.xbe +-- [f0nts] |       | |       +-- Xbox.xtf |       +-- Xbox Book.xtf | +-- [fonts] |       | |       +-- bert-xxxx-01.xtf |       +-- ernie.xtf | +-- msdash.xbe  (your original dashboard) +-- xboxdash.xbe  (the exploited .xbe made from update.xbe) +-- (some other files/folders like audio, xboxdashdata, xodash, xbox.xtf) E: | +-- [TDATA] +-- [UDATA] +-- default.xbe   (metoo BIOS loader, it is signed with the habibi key) +-- boot.cfg +-- Metoo-M8plus_16-06.bin (metoo looks here by default, otherwise edit boot.cfg) +-- (maybe some other stuff, shouldn't matter

Step 16. Take out the game DVD and your memcard, power off the xbox and turn it on.

Step 17. Within 15 seconds you will be looking at one of two things:

QUOTE

Thing A: The EvolutionX dashboard. If so, congrats! The exploit is installed. You will want to edit your msdash.xbe to get your original dashboard working again. Put Idot's patcher.exe and your original msdash.xbe in a folder together. Go to cmd prompt, change dir to your folder, and run the patcher. For example if your files are in c:\patcher, type: cd\patcher patcher msdash.xbe -f0nts Then name the output file msdash.xbe and put it in xbox C. Call it from Evox or other dash and it will access the f0nts folder and load as the regular MS dash. From evox.ini that looks like: Item "MSDash","c:\msdash.xbe" That's it, install your apps and enjoy

QUOTE

Thing B: The X screen, nothing, a greenish screen, or something, but whatever it is it's frozen or otherwise not Thing A. If so, reinsert the exploited game CD and go back to EvoX, a la Step 1. Skip to Step 15, but with one of the following changes:    Try adding the s.xtf file to c:\fonts                         -or-    Try using bert-generic instead of bert-xxxx    Remember to delete the fonts folder and make a fresh one.                         -or-    Try using the updatefonts61 package instead of 71.                         -or-    Try UDE1 or UDE2 instead, if they are supported by your xbox type. If you still haven't succesfully booted, restore your xboxdash.xbe and normal fonts folder using your backup copies from Step 6. Your xbox should boot into MSDash normally. Reread this tutorial, browse the forums, get help.

Some extra customization notes:

*The M8plus bios boot order is DVD, evoxdash.xbe, avadash.xbe, nexgen.xbe
*M8plus supports large hard drives via LBA48 and F:
*If you don't like M8, m8plus can be used to load any BFM bios simply by changing the Romfile line of the boot.cfg file. No need to change the RC4 keys or anything. Other bios are available in /XBOX/bios/bootable from media/hacked/ in usual places. I tested this with X2_4983_BFM.rar and it worked fine for me.


Good luck and happy modding!
-frieko

[adeingolf]

Please dont take this as an insult as its not meant to be but this could be exactly what we need until ldots releases his package.

Its great to see more people willing to share their knowledge/experience.

[m.e]

nice

[Angerwound]

Does the m8pack look for those specific bios file names or did you forget to make sure they are named 'xboxrom.bin'?

[frieko]

yeah i kinda wrote it for two reasons, for people that can't wait for idots, and people that like to know exactly what their auto-installer is doing inside their xbox.

when a New Modding Thing comes along,  i tend to just throw all the files into my existing xbox toolkit and add an evox script rather than have a bunch of different installers for everything. just a matter of personal preference. so admittedly i kinda wrote this for myself as much as i did for you guys...

[frieko]

QUOTE (Angerwound @ Oct 7 2004, 09:53 PM)

Does the m8pack look for those specific bios file names or did you forget to make sure they are named 'xboxrom.bin'?

i believe it already points to one or the other. i dont remember which and i'm not at home so i cant look. but so far i've just gotten away with unzipping the package right into E:


i'll verify tonight and post back if i'm wrong

[gronne]

So, I don't have to delete the xbox book.xtf xbox.xtf that are in the root of c:? I remember that was important and needed before.

[gronne]

QUOTE (Angerwound @ Oct 7 2004, 09:53 PM)

Does the m8pack look for those specific bios file names or did you forget to make sure they are named 'xboxrom.bin'?

I just checked the code and it looks for M8_LBA48_IGR_Q-06-BFM.bin. But I can't see why you should install both, except it goes faster to change.

[frieko]

QUOTE (gronne @ Oct 7 2004, 11:16 PM)

So, I don't have to delete the xbox book.xtf xbox.xtf that are in the root of c:? I remember that was important and needed before.

d'oh! yes, still need to. knew i forgot something. well thats why i asked for comments, thank you.

well the short answer to your other question is it doesn't hurt to have both.

[Angerwound]

Yep you can leave the ones in the root. The update.xbe used in UXE and checks the fonts folder first.

[gronne]

Aren't your answers contradictionary? To me I seems like Frieko says you still have to delete them. And Angerwound says you can leave them as is. Sounds like Angerwound knows the technical process of UXE, so I guess I'll just leave them.

[PedrosPad]

QUOTE (gronne @ Oct 8 2004, 01:25 PM)

Aren't your answers contradictionary? To me I seems like Frieko says you still have to delete them. And Angerwound says you can leave them as is.

The update.xbes used for UDE1/UDE2/UXE check the C:\fonts folder first, and if it can't find the fonts it's looking for, it then checks C:\ root.

So as long as all the necessary fonts are in c:\fonts, C:\ root isn't checked!, so leaving the legacy pre-live Dashboard fonts there is harmless.

This post has been edited by PedrosPad: Oct 8 2004, 01:20 PM

[frieko]

yeah sorry about the confusion, gronne. you can leave them alone.

[gronne]

I installed UXE. And it's working better than I thought. I don't know if it's got to do with the bios or not, but now I can do IGR in evox. Saves me a lot of time when the ftp-connection gets stuck. Really sweet.

ADD: Everyone probably understand it, but nr.14 should be that you shall upload the patched xboxdash.xbe to the box. I fortunately discovered I hadn't uploaded it before I restarted my box, but someone might not.

This post has been edited by gronne: Oct 8 2004, 07:22 PM

[frieko]

fixed, i put it in step 13 so i didnt have to renumber everything haha

yeah it's prolly that sweet sweet M8 bios hookin you up.