Replacing the DVD drive in an XBox360

Microsoft realised after the original XBox that folks would find ways around the games' DRM and so in the case of the 360 they make it as hard as possible to use anything other than the stock optical drive that came with the machine. Every motherboard and DVD drive pair each have half of an AES key pair and so if you install another drive it'll play video DVDs but not games. They hoped this would stop people sticking in non-stock drives that could (for example) read home-burned disks. However, the hacking scene around XBox is extensive and so in pretty short-order there were hacker tools to read the drive's key and then flash it into a replacement drive.
Microsoft got wise to this pretty quickly and the summer 2008 update to XBox requires not only the key halves to work together but the drive ID strings to match. So - if you had a machine with an Hitachi drive and replaced it with a BenQ drive (for example), even if you extracted the key from the Hitachi and re-flashed the BenQ the XBox's OS would now query the drive ID and stop it working if that came back wrong.
Hackers are clever people and since v4.5 of Firmware Toolbox it's been possible to include the old drive's ID in the firmware for the new drive. This is what they refer to as 'spoofing'. It turns out that the drive ID is just that - a string that has no bearing on the drive's operation. So - your BenQ drive can now report it's an Hitachi 79 with this key and the XBox is happy.
Well, it's spy vs spy and the rumor is that the next update to XBox will include routines to test the ballistics and responses of the DVD drive to ensure it's the model it claims it is...!

So - if you have an XBox with a DVD drive that is on the way out (and it's almost always the laser) then you have three options which may/may not work;

1. Open the machine, remove the DVD drive, open it and clean the lens with some IPA or some such. Seems to work for lots of people.
   
2. Buy an identical model DVD drive on eBay (there are plenty of all four kinds for sale sub £20 from broken machines or around £30 for brand new ones). Then swap the controller cards between the drives. This means you have the old electronics but new mechanics/optics.
3. Extract your old drive and using the right tools read-out the key and drive IDs, save them and then write them into a replacement drive (which can be another brand and model). This is potentially the most risky as anyone who has flashed firmware into any device will tell you. Browsing the forums reveals many folks complaining about having bricked their newly acquired drives. Also - if the XBox detects what you've done you'll be kicked off XBox-Live (both your machine and your account).

Anyway, if you're any kind of engineer and have any experience opening up equipment the first two are trivial. If you choose the third way (Mr Blair!) then it's worth giving some guidelines.
Whichever way you proceed you'll need to open the thing up and it's mostly held together with fragile plastic clips, and so here is the best tear-down instructions I have found.
Also remember - the XBox DVD drives have a standard SATA connector but a proprietary power connector. For all these tests I left the drive in the XBox (which powered the drive) and I used a long SATA cable to go to the eSATA port on the back of the PC. Now then - the XBox has a class-two (double-insulated) design and so the internal metalwork is floating at some undefined DC voltage. I suggest an earthing lead from the XBox's internal chassis to the PC's metalwork.

Extracting that precious key from the broken DVD drive

1. Connect the "Original/Broken DVD drive" to your PC via SATA or USB-SATA adaptor.
2. Place the DVD drive into MODE B with SLAX - SLAX is a live Linux CD that allows you to issue SATA commands directly. A good tutorial is here
   
3. Please Note: Once you have the drive in MODE B you will notice it will take 3 presses on the eject button to close the drive.
4. With the Original/Broken drive now in MODE B restart your PC and make sure that the new drive has been identified by Windows. Once the new hardware has been found and installed it will be shown in the my computer/explorer area on your PC as a additional DVD drive.
5. Insert a DVD Movie or an XBOX 360 game into the "Original/Broken DVD drive". Even if the laser is nearly dead it may read a DVD movie just fine so try it.
6. Open Firmware Toolbox (at least v. 4.5.1.6) and choose 'Tools -> Direct Drive Dump (GDR ONLY)
7. On the next screen choose 'RAW DUMP' and save the file as "original.bin". If you have problems with 'RAW DUMP' try 'CLASSIC DUMP', eg. c:/xbox360/hitachi0047/606HG324277-may2006/original.bin
8. Make sure you can identify the backup firmware in future by placing it in a directory that matches the serial number which is located on the sticker of the DVD drive. This will make it much easier to identify in the future.

Replacement Xbox 360 DVD Drive

1. Connect the replacement DVD drive to your PC via SATA connection.
2. Place the DVD drive into MODE B with SLAX
   
3. Please Note: Once you have the drive in MODE B you will notice it will take 3 presses on the eject button to close the drive.
4. With the replacement drive now in MODE B restart your PC and make sure that the new drive has been identified by Windows. Once the new hardware has been found and installed it will be shown in the my computer/explorer area on your PC as a additional DVD drive.
5. Insert a DVD Movie or an XBOX 360 game into the Replacement DVD drive.
6. Open Firmware Toolbox and choose 'Tools -> Direct Drive Dump (GDR ONLY)
7. On the next screen choose 'RAW DUMP' and save the file as "original.bin". If you have problems with 'RAW DUMP' try 'CLASSIC DUMP'. eg. c:/xbox360/hitachi0046/606HG324240-may2006/original.bin
8. Make sure you can identify the backup firmware in future by placing it in a directory that matches the serial number which is located on the sticker of the DVD drive. This will make it much easier to identify in the future.
9. When the firmware is backed up it will ask you if you want to open it. Choose"yes". Now select "Tools->Spoof Firmware" from the Firmware Toolbox 4.5 menus.
10. Choose the version that you would like the fw to report back as. Leave all other options as they are.
11. Please note: - Spoofing a drive as itself has the effect of UNSPOOFING it
12. Now Click "APPLY SPOOF"
13. Choose "Tools->Smart Hack Patcher", a window warning will appear, choose OK.
14. Choose the output file name, I suggest calling it "final.bin" and save it at the same location as the original. The ruleset option should be automatically selected for you so leave it alone. eg. c:/xbox360/hitachi0046/606HG324240-may2006/final.bin
15. Push the "Generate File" button, if everything goes fine the file will be generated almost instantly
16. Once the file has been generated it will ask you if you want to open it. Choose "Yes". The Main Window will show the generated file (final.bin). You will notice that the spoofed information is shown in bold.

Original/Broken Firmware Key

1. Open the old original/broken DVD drive firmware which you backed up in step 1. Choose the Browse for file button "..." to load the original/broken DVD firmware.
2. With the old broken DVD firmware now loaded you will notice the "Key Information @" area in the center of the 360 Firmware Toolbox application.
3. Highlight the entire key and copy it by right clicking your mouse and selecting copy or press Ctrl + C so you can paste it into our new replacement drive.
4. Open the replacement DVD drive firmware named "final.bin" which you created in step 2. Choose the Browse for file button "..." to load the firmware.
5. Paste the Key into the "Key Information
6. Click on "Replace Key" and it will update the firmware with the new key you have just pasted.
   

Check Firmware Differences

Before flashing the drive I suggest re-opening the old firmware from step 1. Then open the final.bin firmware you just created in step 3 and make sure keys and other information match just to be safe. If you're happy that your keys etc match then move onto flashing the drive.

1. Choose "Tools->Direct Drive Flash->Differential Flash Patch". Make sure the DVD drive you want to flash is selected
2. Click the "Read Drive and Detect Differences" button, after a few seconds the sectors list below the button should be populated.
3. It will now ask you if you would like to keep the keys from the drive.. Choose 'No'.
4. Click the "Start Flashing" button and choose the flash mode.. I suggest using the 0047 flasher for 47 drives etc etc..
5. After a few seconds the flashing is complete.

Replace the DVD drive into the XBox and test - you don't need to re-build the case and re-attach the hard drive.


Resources;
SLAX Linux live CD
Firmware Toolbox

Clarke on Channel 9

Dr Sneath visits James Clarke, one of the program managers on the Expression team to see an amazing end-to-end demo that shows the power of Expression Media Encoder and Silverlight working together.

I used to work with him!

Kumala, kumala, kumala VISTA!

After trying to carve out a half-day to repave my Macbook with Vista I eventually got the chance. So, I threw in a new 160gig drive, re-loaded Tiger and used BootCamp v1.2 (which now comes with all the Vista drivers) and installed the copy of Vista Ultimate that James Clarke sent me straight from Microsoft!
Given that I have really enjoyed using this little MacBook for the last six months - it's been the fastest PC I've ever had for work purposes - I was interested to see how well Vista would run. I haven't been disappointed - I shall review my experiences with Vista soon, but here are a few thoughts about BootCamp 1.2 as it applies to the v.1 MacBook (white, dirty-white!);

• Although BootCamp includes a proper keyboard layout it doesn't install it as default. Go to the Language Bar and install it as the primary keyboard layout.


• The mouse-pad is a load more usable - including a very neat right-click feature and two-finger scrolling (as under OS-X)


• The remote works with MediaPlayer - very good, I now need to retrieve that unused gadget from the depths of my rucksack!


• The eyesight camera works (even thought the release notes say it won't).

Mark Russinovich: From Winternals to Microsoft

All Windows users owe Russinovich a huge debt;

• He discovered Sony's root-kit shenanigans
• He used to run SysInternals - a great resource for admins and power-users. Thankfully Microsoft have maintained it as part of TechNet.
• He's now part of the Windows Core team - watch the 55min clip on Channel 9 - I feel better about Vista already! (AND - thanks to Mr James Clarke) I'll be installing Ultimate Edition on my MacBook in the next few days.

More Vista thoughts

One of the biggest challenges... is to fight that perception that old versions of software are good enough,

- Chris Capossela, Microsoft.

I'll leave you to draw your own conclusions and how you might paraphrase that particularly insidious bit of marketing speak! Anyhow - having decided I'd lay off Vista until at least SP1 (good advice with any Microsoft product!) I heard Paul Thurrott's most recent Windows Weekly podcast where he put to rest some of the fears over licensing and even suggested that on most hardware the Vista experience was a good one. My five month old MacBook seemed too under-powered (having motherboard graphics) to be a candidate but he reckons he's tried it and it's all good. Then I caught last week's Security Now! with Steve Gibson who had a totally different take on things. Oh well - I don't anyone who has build 6000 (the final RTM version) and so I can't get any real advice.

Vista's virgin stack

Microsoft Windows Vista (now in beta testing) and Windows Server "Longhorn" (now in beta testing) include a new implementation of the TCP/IP protocol suite known as the Next Generation TCP/IP stack.

So runs the blurb on Microsoft.com - it seems that they have started again (much in the way they did with XP and Windows 95 before it). Now I'm a big fan of writing something that is clean and not a hack'ed, patched version of something but as Steve Gibson points out the TCP/IP stack is the one thing you want to be hardened by sustained hacker attack - the stack in XP showed none of it's vulnerabilities in beta but as we know it was a security nightmare until SP2 (and even now we haven't had a quiet patch Tuesday for more than eighteen months!). The same was true of 95/98/ME - the only version of Windows that had a relatively secure IP stack from launch was Windows 2000 - and it inherited NetBSD's stack!
Now Symantec have been hammering Vista with malformed packets and have some very alarming results here - I suppose it's in their interest to portray Vista as insecure and needing of additional software (theirs!) to make it safe to use. Still - makes for interesting reading.
Like all OSes I'll be waiting a year before I install it on any machines I rely on...

As an aside I was chatting to someone I met on a campsite - he writes embedded applications for industrial machines - not Windows Embedded but proper assembler code for 80186 chips (and the like) - low power processors that can run off batteries etc. He is currently working on an IP stack for the x86 and has implemented stacks for Z80 etc. His observation was that there are no good quality "free" (as in free software - open source) code implementing an IP stack on those chips - today people are keen to save the time and implement using embedded Win2K (but not XP interestingly - probably for the reasons above). But, you only get the best performance with the economy of assembler code.
Reminded me of the little NetIOM board is was playing with just after Christmas - see here and here. It had a very rudimentary web server on chip and support of ICMP etc.

ISO Recorder v2

ISO Recorder is a tool (power toy) for Windows XP, 2003 and now Windows Vista, that allows (depending on the Windows version) to burn CD and DVD images, copy disks, make images of the existing data CDs and DVDs and create ISO images from a content of a disk folder.
ISO Recorder has been conceived during Windows XP beta program, when Microsoft for the first time started distributing new OS builds as ISO images. Even though the new OS had CD-burning support (by Roxio), it did not have an ability to record an image. ISO Recorder has filled this need and has been one of the poular Windows downloads ever since.

My groovy MacBook has a combo-drive that not even the current release of Nero recognises. Initially I thought this would be a problem as I often make CDs at work and I'd never used the Windows CD burning wizzard (or whatever they call it!) - but since I only ever have to put files onto CDs (never audio or video CDs - but as it turns out the Windows wizzard will do audio somewhat clumsily) I figured I'd give it a go. It's fine, but won't burn the contents of ISO images directly - this little Windows add-on does the business - I needed something to burn the ISO of the Dapper Drake!

Microsoft buy SysInternals

Wow - the freeware site everyone who is serious about networks and security uses is being taken under the umbrella of the evil empire!
It reminded me to make sure all of their utilities I use are up to date - who knows how long before they are taken down. TCPView is particularly useful - it's a GUI front for netstat and amazingly it's only 87 kilobytes big!
Remember that obsolete measurement of file size? - the kilobyte!

Technologists always get it wrong!

I was going over some old BBC training manuals recently and inside the front cover of one was a quote from the chief engineer of the Beeb from the mid-50's - In relation to VERA (the BBC's experimental video recorder that pre-dated 2" Quadraplex - loads of stuff online if you're interested) he said some thing along the lines of;

we'll never need more than three VTRs because even with the second network (what was to become BBC2) we'd only need one per network and a spare

How wrong can you be! Anyhow - he's in good company as a quick trip around famous quotes relating to predicating the future of technology indicates;

There is no reason anyone would want a computer in their home.

Ken Olson, Digital Equipment Corporation (1977)

I think there is a world market for maybe five computers.

Thomas Watson, IBM (1943)

640k ought to be enough for anybody.

Bill Gates, Microsoft Corporation (1981)

Computers in the future may weigh no more than 1.5 tons.

Popular Mechanics (1949)

Why does it prove so hard to be realistic about the future? I think (in part) people find the implications of Moore's Law hard to believe - but it's been good for nearly half a century. In five years we will have the following;

• More than a terrabyte of storage in the PC you buy from PC World
  
• More than ten gigs of RAM in that PC
  
• A graphics card that can manipulate cinema resolution images in realtime
  
• 100BaseT internet connection at home
  
• An OS that crashes more often, requires ten times the resources of today and lets you word-process at roughly the level of efficiency as you could in the early nineties under Windows 3 on a '486!

How is it that the hardware guys give us so much more but the software boys don't do it better? What Mr Intel giveth Mr Microsoft taketh

The Seattle Times: Business & Technology: Plugged in to Microsoft's biggest rival - interesting article about Linux inside Microsoft. I get some negative reactions to Linux from some of my colleague - the principle objections are that you can't make a business model out of "free" software - I think that misses the point - ISPs, banks, Telcos & governments aren't worried they have to pay for Server 2003 - the money from Linux comes from the associated support services. The other objection seems more related to IT people who don't know/understand the OS (it differs from Windows in some fundamental ways!) and so are scared that they are ignorant - by ignoring Linux their ignorance becomes less threatening to them.
The fact that Microsoft are ploughing money into it is interesting - to quote from Microsoft's Leigh Day "My belief is that open-source software is going to help drive the acquisition cost of software down toward zero," he said, a shift that will require software companies to move "over to a maintenance and support model."
People who continue to dis Linux because they've bought into the Microsoft mindset may find themselves out in the cold!