The Xbox Serial EEPROM contents

@xbox

Published in 

xbox

 · 10 months ago

written by Franz Lehner and Jeff Mears, 25 September 2002

struct eeprom { 
/* 256 Bytes */ 

unsigned char data_hash[20]; // 0x00 - 0x13 HMAC_SHA1 hash of next two fields 
unsigned char crypted_confounder[8]; // 0x14 - 0x1B see HMAC docs 
unsigned char crypted_hddkey[20]; // 0x1C - 0x2F encrypted hard disk key 

unsigned char region[4]; // 0x30 - 0x33 encrypted region code 

unsigned char serial[12]; // 0x34 - 0x39 Xbox serial number in ASCII 
unsigned char mac_address[6]; // 0x40 - 0x45 Ethernet MAC address 

unsigned char pad_1[2]; // 0x46 - 0x47 always zero? 

unsigned char unknown_2[16]; // 0x48 - 0x57 some checksum? 

unsigned char pad_2[1]; // 0x58 always zero? 

unsigned char dvd_region[1]; // 0x59 0x01 = Region 1, 0x03 = Region 2 
unsigned char tv_standard[1]; // 0x5A 0x40 = NTSC, 0x80 = PAL 

unsigned char pad_3[5]; // 0x5B - 0x5F always zero? 

unsigned char unknown_3[8]; // 0x60 - 0x67 

unsigned char time_zone1[4]; // 0x68 - 0x6B standard timezone 
unsigned char time_zone2[4]; // 0x5C - 0x6F daylight timezone 

unsigned char unknown_3[0x90]; // 0x70 - 0xFF 
};

The HMAC HDD Key

The HMAC HDD Key is generated out of the first 48 bytes. This section has been identified clearly.

The Region Code

This DWORD is encrypted. It corresponds to the region code in the XBE header:

The MAC address

This is the MAC address of the Ethernet hardware, which has been issued by the IEEE.

The Serial Number

Currently we know:

serial_id[10] serial_id[11]: manufacture location

It's assumed that when corrupting unknown_2, the the identification of the Xbox will no longer work.

Regarding the size, it could be an MD5 checksum, as MD5 generates a byte[16] output, an SHA-1 produces byte[20].

I tried every combination, and RC4 coding, but it didn't work. Maybe there is also a processor serial included or something else.