X-Box: TSOP Flashing
Write enabling TSOP
This section is only for those who know what they are doing and know what may happen if the TSOP flash fails (Heavy 29-wire mod required to rescue, since Evox TSOP D6 bios requires a reworking bios. Or on 1.0 or 1.1 you might get lucky with switches.). I will show how to brigde the two points (top and bottom for v1.0-1.1 and two on top for v1.2-1.5) needed to enable write access for the onboard flash chip.
Xbox v1.0 - 1.1
Xbox v1.2 - 1.5
Flashing the TSOP
To flash the TSOP without installing a cheapmod is tricky because you need to use one of the exploits available. I prefer to use the MechAssualt savegame exploit (007: Agent Under Fire should work as well). You need to get the Mechassault_save_With_Evox and xlinux or xhdm package, and a retail version of Mech Assualt (the original disc). What the savegame exploit does it that it patches/replaces the public keys in memory thus allowing for self-signed xbe files, i.e Evox, since we know the private key and can sign the XBE. The MechAssualt savegame exploit is using the habibi public key.
- Method 1 - Evox
Extract the savegame and make sure the flash rom type that's on the Xbox motherboard is present in the evox.ini file (look at the ini file below). Put your prefered bios you want on your TSOP in the bios directory (create it if it doesn't exist). Don't worry about the bios size, Evox will resize the bios for you (1 MB for 1.0-1.1, 256K for 1.2-1.5). - Method 2 - Evox and Raincoat
If you want a proper configured evox.ini configuration file with almost every flash rom type, download this configuration file and overwrite the old. Create a "bios" directory and put the BIOS of your choice there. For Raincoat you need to put the BIOS in the raincoat directory and rename it to bios.bin.If you have a Winbond flash chip and/or want the best from both the Linux and Evox world, you should perform the following trick. Download xbedump, latest raincoat (0.7) and the 007_With_Raincoat package, extract them. Put the latest compiled Raincoat files (raincoat and raincoat.conf) into the raincoat directory within 007_With_Raincoat (replace the existing files).
Now you need to sign the Raincoat default.xbe file with the habibi private key using xbedump. If you don't sign it, the Xbox will exit with a error code.
Move the Raincoat default.xbe file to the xbedump directory. Open a command prompt (Start -> Run -> cmd or command), change dir to the xbedump folder, execute this command line: xbedump default.xbe -habibi . This will produce a out.xbe file, rename it to raincoat.xbe and move it to the 62D648EBF155 (MechAssault) directory. Also move the BOOT and raincoat directories from the 007_With_Raincoat directory as well.
The entire 62D648EBF155 directory might not fit on a 8 MB Xbox Memory Card (I don't have one).
You need to create some regular savegame directories and files before you can do anything. Just start a regular Mech Assualt campagn and exit.
Now for the part to get the hacked savegame into the Xbox.
- Method 1 - Hot swap Xbox harddrive
Burn the xlinux/xhdm ISO and on a another disc the MechAssault savegame files. Now put the CD/DVD-ROM as the secondary master and nothing on the primary IDE cable. Set the bios to boot from CD and insert the boot disc. Boot up the disc and press tab once when you see the Linux prompt. The PC is ready to mount unlocked hard drive you are going to swap now.Move your Xbox clos to the PC, connect the video and power cables. Pull out the DVD-ROM IDE cable, that way we know for sure that the Xbox will display an error message and not loading anything from the hard drive, but still unlocked. Power on and wait 10 seconds.
This step is new and I really causion you to do it. Connect a ground wire between the Xbox metal shield and the computer case. This create a common ground and not you're not risking damaging your PC. Someone measured a difference of 108 VAC between the Xbox and the PC, and you don't want to force that through the IDE cable.
This is the crusial part, now disconnect the IDE cable from the Xbox hard drive and put the free IDE cable from the computer into the drive. Don't disconnect the power cable from the drive. You should now have the unlocked hard drive connected to the PC and Linux is ready to detect and mount it. Press enter on the PC to continue.
You should see a lot of informative messages scroll over your screen. If you see many /dev/hda error codes you haven't successfully unlocked the hard drive, power off the Xbox, disconnect the hard drive and connect it to the Xbox again. Go back two steps.
If you see a command prompt you're ready to preceed. Type mkdir /xbox and then mount -t fatx /dev/hda50 /xbox . You have now mounted the savegame partition of the Xbox hard drive. Eject the Linux disc and insert the savegame disc, type mount /dev/hdc /cdrom and the CDROM should been mounted as read-only. Go into the disc by typing cd /cdrom and ls -l to see the files. Copy the subdirectory in 4d530017 to /xbox/UDATA/4d530017/ . This is typically done using this command; cp -R /cdrom/4d530017/62D648EBF155/ /xbox/UDATA/4d530017/ .
When you're done copying the savegame and everything went well, umount the cdrom and Xbox partition, umount /cdrom and umount /xbox . Power off the Xbox, disconnect the Xbox hard drive from the computer, and reconnect it to the Xbox. You can now shut down the computer.
Hook the Xbox up to the TV again.
- Method 2 - Memorycard (untested)
I haven't done this, but you essentially put the savegame on a modded Xbox, copy it over to a memorycard (USB pen of some supported kind or the original memory card), inserting it in the umodded Xbox, and copy it the the hard drive from the memorycard.
Insert the Mech Assault retail disc and wait for it to boot. Select Campaign and you'll see a Run Linux menu option, select it and Evox should start.
- Evox
When you're in Evox you should create a complete backup of the hard drive and eeprom before you proceed, go into Settings and select Backup. This will gather your current TSOP bios, EEPROM and HD key information (this is very valuable data). FTP to the Xbox with the IP address you'll find in Settings and user/pass xbox and copy the C: and E: partitions to your computer.You're now ready to flash the onboard flash rom. Woho! Select Flash BIOS / Flash BIOS using Evox and select the BIOS of your choice, press Y. The entire process shouldn't take more than 15 seconds on a v1.4-1.5 (245k), 30 seconds on a v1.0-1.1 (1024k).
Note: Evox can not flash Winbond flash rom's, they require a full erase. Evox only supports block erase. Raincoat can flash these rom's. Follow the "Method 2 - Evox and Raincoat" above to create a Raincoat savegame and select Flash BIOS using Raincoat and follow the instructions below.
- Raincoat
When you hear the sounds go to your computer and change IP address to 192.168.0.1. Telnet to your Xbox using IP 192.168.0.64 (Start -> Run -> telnet 192.168.0.64). Login with root and password xbox. To get the the raincoat directory, cd /media/E/UDATA/4d520017/62D648EBF155/raincoat , copy the raincoat config, cp raincoat.conf /etc/raincoat.conf , and backup the current/original bios, ./raincoat -r originalbios.bin .Now is a perfect time to backup the Xbox hardd rive to your computer. Open your FTP client and use IP 192.168.0.64 to connect (anonymously). Select the C: and E: partitions and transfer them to your local hard drive.
You're finally set to flash the onboard rom. In the Raincoat directory type, ./raincoat -p bios.bin , to start the flash process.
If you get a Flash not writeable message there's either a problem with the bridging points, check them with a multimeter, or resolder them. Or you miss the flash rom type in the evox.ini/raincoat.conf file. Since you can FTP to your Xbox you can easily edit the files.
Note: There's a Sharp rom that requires an extra wire that's needed to be soldered before you can flash (Picture below).
ini file
[Misc]
AutoLaunchGames = No
AutoLaunchDVD = No
#DVDPlayer = ""
AutoLaunchAudio = No
#AudioPlayer = "c:\xboxdash.xbe"
#MSDashBoard = "c:\xboxdash.xbe"
UseFDrive = Yes
UseGDrive = Yes
IGR = No
UseItems = Yes
SkinName = Max Blue
ScreenSaver = 15
Fahrenheit = No
ShadeLevel = 90
EnableSMART = Yes
HDD_Temp_ID = 194
DebugTSR = No
ChameleonLed = 15
[Network]
SetupNetwork = Yes
StaticIP = No
Ip = 192.168.0.2
Subnetmask = 255.255.255.0
Defaultgateway = 192.168.0.1
DNS1 = 0.0.0.0
DNS2 = 0.0.0.0
SkipIfNoLink = No
SetupDelay = 10
[IGR]
Start_Button = Yes
Back_Button = Yes
L_Trig = Yes
R_Trig = Yes
White_Button = No
Black_Button = No
A_Button = No
B_Button = No
X_Button = No
Y_Button = No
[Clock]
JumpToMsDash = No
JumpIfNoLink = Yes
Use24 = Yes
SwapDate = No
SNTP_Server = 18.26.4.105
[FTP]
Enable = Yes
Password = xbox
IGR = No
[Telnet]
Enable = Yes
[RDTOOLS]
Enable = Yes
Name = Xbox
IGR = No
[BIOS]
#
#ROM = "Name",0x542C62CB976A4993C8C5027DFF9638CE
#
Flash = 0x04d5,"FUJITSU - MBM29F080A",0x100000
Flash = 0x04a4,"FUJITSU - MBM29F040C",0x80000
Flash = 0xadd5,"Hynix - HY29F080",0x100000
Flash = 0xadb0,"Hynix - HY29F002",0x40000
Flash = 0x20f1,"ST - M29F080A",0x100000
Flash = 0x20B0,"ST - 29F020",0x40000
Flash = 0xbfb6,"SST - 39SF020",0x40000
Flash = 0xbfb7,"SST - 39SF040",0x80000
Flash = 0xbf61,"SST - 49LF020",0x40000
Flash = 0x04BA,"ALX2+ R3 FLASH",0x40000
Flash = 0x378c,"AMIC - A29002",0x40000
Flash = 0x01d5,"AMD - Am29F080B",0x100000
Flash = 0x01a4,"AMD - Am29F040B",0x80000
Flash = 0x015b,"AMD - Am29LV800B",0x100000
Flash = 0x01da,"AMD - Am29LV800B",0x100000
Flash = 0xda0b,"Winbond - W49F002U",0x40000
Flash = 0xda8c,"Winbond - W29f020",0x40000
Flash = 0xc236,"MACRONIX - MX29F022NTPC",0x40000
Flash = 0x89a6,"SHARP - LH28F008SCT",0x100000,0x20,0xd0,0x10
# for Chameleon
Flash = 0x015b,"Chameleon (AMD - Am29LV800B)",0x100000
Flash = 0x01da,"Chameleon (AMD - Am29LV800B)",0x100000
# for Matrix/Xodus
Flash = 0xbf61,"Matrix (SST - 49LF020)",0x40000
# for Xecuter2
Flash = 0x01d5,"Xecuter2 - (AMD - Am29F080B)",0x100000
[Skin_Original]
#
# <Time> =
# <IP> =
# <Name>
# <Version>
# <CD>
# <BIOSVer>
# <KernelVer>
# <RDName>
# <Temp1>
# <Temp2>
# <SpaceC>
# <SpaceE>
# <SpaceF>
# <SpaceX>
# <SpaceY>
# <SpaceZ>
#
Text = 30,37,0.5,0x000000,0,"<Time><CrLf>MB Temp <Temp1><CrLf>CPU <Temp2>"
Text = 28,39,0.5,0x808080,0,"<Time><CrLf>MB Temp <Temp1><CrLf>CPU <Temp2>"
Text = 620,420,0.5,0x000000,1,"<Name> V<Version>"
Text = 618,422,0.5,0x808080,1,"<Name> V<Version>"
Text = 620,37,0.5,0x000000,1,"<CD>"
Text = 618,39,0.5,0x808080,1,"<CD>"
Text = 30,420,0.5,0x000000,0,"RD Name : <RDName>"
Text = 28,422,0.5,0x808080,0,"RD Name : <RDName>"
LogoType= 0
[Menu]
Section "Root"
{
Item "Flash BIOS using Raincoat","E:\UDATA\4d530017\62D648EBF155\raincoat.xbe"
Item "Flash BIOS using Evox",ID_Flash_Bios
Section "System Utils"
{
Item "Backup",ID_Backup
Item "MS Dashboard",ID_MS_Dash
Item "Settings / Info",ID_Settings
}
Item "Reboot",ID_Quick_Reboot
Item "Power Off",ID_Power_Off
}
