diff --git a/.gitignore b/.gitignore index 46742b6f..6fb4f568 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,10 @@ Thumbs.db # mkdocs build dir site/ venv + +# venv +include +lib +lib64 +bin +pyvenv.cfg \ No newline at end of file diff --git a/docs/!Pages_with_missing_images.md b/docs/!Pages_with_missing_images.md index 9568b695..9a9f4635 100644 --- a/docs/!Pages_with_missing_images.md +++ b/docs/!Pages_with_missing_images.md @@ -1,5 +1,5 @@ # Pages with missing images - [DVD Drive](./Hardware/Console/DVD_Drive.md) -- [NAND](./Hardware/Console/NAND/index.md) "Atmel2.jpg" +- [NAND](./Hardware/Console/NAND.md) "Atmel2.jpg" - [Wifi Adapter](./Hardware/Accessories/Wifi_Adapter.md) diff --git a/docs/Hacks/SMC_Hack.md b/docs/Hacks/SMC_Hack.md index 9eab6830..2b4cd4c7 100644 --- a/docs/Hacks/SMC_Hack.md +++ b/docs/Hacks/SMC_Hack.md @@ -21,7 +21,7 @@ Technical details are available [here](http://free60.git.sourceforge.net/git/git The SMC Hack requires bridging 3 points on the motherboard (for trigger the exploit by JTAG), as well as having a way to read and write with -your Nand [Flash](../Hardware/Console/NAND/index.md) +your Nand [Flash](../Hardware/NAND/Reading.md) The JTAG points are available for a number of consoles @@ -34,8 +34,7 @@ The JTAG points are available for a number of consoles #### Reverse Jtag ![Reverse JTAG](images/Reverse_JTAG.jpg) -- To read and write the Nand Flash (using SPI protocol by LPT and a -printer cable), there is a friendly tutorial at [NAND Reading](./NAND_Reading.md) +- To read and write the Nand Flash, there is a friendly tutorial at [NAND Reading](../Hardware/NAND/Reading.md) There are other ways to read and write the Nand Flash that are valid (such as infectus modchip) diff --git a/docs/Hacks/SPI_Programmer.md b/docs/Hacks/SPI_Programmer.md deleted file mode 100644 index cdc3660a..00000000 --- a/docs/Hacks/SPI_Programmer.md +++ /dev/null @@ -1,55 +0,0 @@ -# General - -To communicate with the Flash Controller you need a device which -is capable of the [Xbox 360's SPI Protocol](../Hardware/Console/SPI.md). There are -ready-to-use devices you can buy or, if you aren't afraid of soldering -your own hardware, DIY homebrew devices. Basically: Get the device -programmed (if needed) and solder it according to the -[Diagram](../Hardware/Console/SPI.md) to your Xbox's mainboard - you can start -reading/writing to your NAND after installing the needed drivers. - -# DIY / Homebrew - -## LPT SPI Programmer - -This type of programmer isn't really recommended as it's awfully slow -and can probably cause high failure rates. - -Description coming later... - -## USB SPI Programmer - -Needed material: - - - 1x 50X100 PCB - - 1x 12 MHz Resonator - - 1x 220nF Capacitor - - 1x 100nF Capacitor - - 1x 10 kOhm Resistor - - 6x 100 Ohm Resistor - - 1x 1 Row x 10 Pin - 2,54mm Pin Headers (male) - - 1x 1 Row x 10 Pin - 2,54mm Pin Headers (female) - - 1x PIC 18F2455-I/SP - - 1x USB Conector (female) - - 1x Matching USB Cable - - Wire - -Program the PIC with your favorite PIC Programmer (Can be build or -bought - for building one yourself the "ART2003" is recommended) with -the latest "Picflash" HEX file. -![USB SPI Programmer Diagram](images/USB_SPI_Programmer.png) - -## LPC2148 - -Description coming later... - -## AT90USB162 Programmer - -Description coming later... - -# Ready to use - -There are several ready-to-use professional products like: Team Xecuter -NAND-X, Maximus 360NandFlasher, Matrix SPI Programmer etc. They arrive -preprogrammed and can be used directly with Software like -[NANDPro](../Homebrew/PC-Software/NANDPro.md) to interact with the NAND Flash. diff --git a/docs/Hardware/Console/NAND/index.md b/docs/Hardware/Console/NAND.md similarity index 75% rename from docs/Hardware/Console/NAND/index.md rename to docs/Hardware/Console/NAND.md index a10ba6cc..f4bea2fa 100644 --- a/docs/Hardware/Console/NAND/index.md +++ b/docs/Hardware/Console/NAND.md @@ -12,7 +12,7 @@ - SMT socket that should work if you choose to remove yours: https://web.archive.org/web/20111206034431/http://www.emulation.com:80/cgi-cfm/insert_quantity.cfm?part_number=S%2DTSO%2DSM%2D048%2DA -Attached to [Southbridge](../Southbridge.md) +Attached to [Southbridge](./Southbridge.md) ## NAND Points on Motherboard for FAT @@ -25,13 +25,16 @@ coming soon... ## Different Sizes On different Motherboard Revision also different NANDs were used. -[Xenon](../Xenon_(Motherboard).md)-, [Zephyr](../Revisions/Zephyr.md)-, -[Falcon](../Revisions/Falcon.md)-, [Opus](../Revisions/Falcon.md#opus)- and some -[Jasper](../Revisions/Jasper.md)-Consoles (Retails) are using 16MB NANDs, -other [Jasper](../Revisions/Jasper.md)-Consoles (Retail),Arcade Bundles which -came without a HDD, got a 256MB or 512MB NAND onboard. Only 64MB of +[Xenon](./Xenon_(Motherboard).md)-, [Zephyr](./Revisions/Zephyr.md)-, +[Falcon](./Revisions/Falcon.md)-, [Trinity](./Revisions/Trinity.md)-, and some +[Jasper](./Revisions/Jasper.md)-Consoles (Retails) use 16MB NANDs. + +Other [Jasper](./Revisions/Jasper.md)-Consoles (Retail), Arcade Bundles which +came without a HDD, got a 256MB or 512MB Big Block NAND onboard. Only 64MB of these 256/512MB NAND are used for system files, the rest is used as an -internal Memory Unit. All Development-/Demo-/Reviewer-/Test-Kits got at +internal FATX Memory Unit. + +All Development-/Demo-/Reviewer-/Test-Kits got at least a 64MB NAND. Depending on the NAND Size either Small- or Large-Block Flash Controllers get used. @@ -102,20 +105,13 @@ This also works in reverse: ## Reading/Writing -The Flash can be written or read using a number of methods. If you have -the old shader hack running the easiest is using [lflash](../../../Linux/Lflash.md). +The Flash can be written or read using a number of methods. -You can also wire LPT directly to the flash using this -[diagram](http://img19.imageshack.us/img19/5198/wiringforxenondiagram.jpg). -As well, you can build your own USB SPI Flasher with [this -diagram](http://img35.imageshack.us/img35/8949/xbox360usbflasher.png) -and use [these binaries](https://sourceforge.net/projects/free60/files/PicFlash/PICFLASH_v3b_plus2.zip). -Flash the PicXboot.hex to your PIC, then use the programmer from this picflash to flash the -picflash.hex to the PIC through USB in bootloader mode. Once the device is flashed, +- If you are on a retail flash, the easiest is using a [SPI Programmer](../NAND/SPI_Programmer.md) +- If you have the old KK hack, the easiest is using [lflash](../../Linux/Lflash.md). -Once wired you can read/write to the chip using software such as -[NandPro](../../../Homebrew/PC-Software/NANDPro.md). +- If you are on RGH / JTAG, the easiest is using [XeLL-Reloaded](../../Homebrew/Tools/XeLL.md) In software the NAND is mapped to memory address 0x80000200C8000000. @@ -133,12 +129,12 @@ In software the NAND is mapped to memory address 0x80000200C8000000. ## NAND File System Informations about the Filesystem on the Xbox 360 NAND Flash can be found -[here](../../.././System-Software/NAND_File_System.md) +[here](../../System-Software/NAND/Image.md) ## Bad Blocks Its possible that bad blocks appears when reading/writing to the NAND. -For solving these look at the following page: [Bad Blocks](../../../Hacks/NAND_Bad_Blocks.md) +For solving these look at the following page: [Bad Blocks](../NAND/Bad_Blocks.md) ## Small flash chip close to CPU @@ -178,7 +174,7 @@ datasheet. There is another Atmel chip on the front panel: -![Atmel2](../../../images/Noimage.png) +![Atmel2](../../images/Noimage.png) Atmel 528 serial EEPROM @@ -198,8 +194,10 @@ datasheet. ## Tools +- [J-Runner with Extras](https://github.com/J-Runner-With-Extras/J-Runner-with-Extras), AIO NAND Builder and Flasher - 360 Flash Tool, which is not easy to find -- [Xbox 360 NAND Editor](http://www.megaupload.com/?d=LGF518J0) by stoker25, - open source and semi-complete, has code to do with bootloaders/keyvault/filesystem + [Category: Hardware](../../index.md) + +[Category: Pages That Need Updating](../../%21Pages_That_Need_Updates.md) \ No newline at end of file diff --git a/docs/Hardware/Console/Revisions/Jasper.md b/docs/Hardware/Console/Revisions/Jasper.md index 11c65590..1714d0fa 100644 --- a/docs/Hardware/Console/Revisions/Jasper.md +++ b/docs/Hardware/Console/Revisions/Jasper.md @@ -6,7 +6,7 @@ Xbox 360. On Jasper motherboards found within Arcade SKUs, this Xbox 360 [memory unit](../../Accessories/Memory_Unit.md) to facilitate the NXE Dashboard. -The connections required to [dump/flash the NAND](../../../Hacks/NAND_Reading.md) +The connections required to [dump/flash the NAND](../../NAND/Reading.md) are the **same** as all previous models. Performing the [SMC Hack](../../../Hacks/SMC_Hack.md) requires the same wiring diff --git a/docs/Hardware/Console/SPI.md b/docs/Hardware/Console/SPI.md index 8b824108..c1c3f878 100644 --- a/docs/Hardware/Console/SPI.md +++ b/docs/Hardware/Console/SPI.md @@ -2,7 +2,7 @@ The SPI bus (Serial Peripheral Interface) on the Xbox 360 is mainly used for communicating with the [NAND-Flash Controller (SFCX)](../../System-Software/SFCX.md), -an [SPI Programmer](../../Hacks/SPI_Programmer.md) is needed for this. The bus +an [SPI Programmer](../NAND/Reading.md) is needed for this. The bus consists of the following signals: | Name | Description | diff --git a/docs/Hardware/Console/NAND/images/Eeprom.jpg b/docs/Hardware/Console/images/Eeprom.jpg similarity index 100% rename from docs/Hardware/Console/NAND/images/Eeprom.jpg rename to docs/Hardware/Console/images/Eeprom.jpg diff --git a/docs/Hardware/Console/NAND/images/Flash.jpg b/docs/Hardware/Console/images/Flash.jpg similarity index 100% rename from docs/Hardware/Console/NAND/images/Flash.jpg rename to docs/Hardware/Console/images/Flash.jpg diff --git a/docs/Hardware/Console/NAND/images/Nandpinout.png b/docs/Hardware/Console/images/Nandpinout.png similarity index 100% rename from docs/Hardware/Console/NAND/images/Nandpinout.png rename to docs/Hardware/Console/images/Nandpinout.png diff --git a/docs/Hardware/Console/NAND/images/Nandreadpins.jpg b/docs/Hardware/Console/images/Nandreadpins.jpg similarity index 100% rename from docs/Hardware/Console/NAND/images/Nandreadpins.jpg rename to docs/Hardware/Console/images/Nandreadpins.jpg diff --git a/docs/Hardware/Console/NAND/images/X360Pro_noeeprom.jpg b/docs/Hardware/Console/images/X360Pro_noeeprom.jpg similarity index 100% rename from docs/Hardware/Console/NAND/images/X360Pro_noeeprom.jpg rename to docs/Hardware/Console/images/X360Pro_noeeprom.jpg diff --git a/docs/Hacks/NAND_Bad_Blocks.md b/docs/Hardware/NAND/Bad_Blocks.md similarity index 99% rename from docs/Hacks/NAND_Bad_Blocks.md rename to docs/Hardware/NAND/Bad_Blocks.md index 32736754..a96d6c32 100644 --- a/docs/Hacks/NAND_Bad_Blocks.md +++ b/docs/Hardware/NAND/Bad_Blocks.md @@ -281,5 +281,5 @@ Source: [google-docs](https://web.archive.org/web/20100713001647/https://docs.google.com/View?id=dnfmv5h_23gw47ddgs) \(archive.org mirror\) & [XBH, posted by trancy](http://www.xboxhacker.org/index.php?topic=13618.0) -[Category: Hardware](../Hardware/index.md) +[Category: Hardware](../../Hardware/index.md) diff --git a/docs/Hacks/NAND_Reading.md b/docs/Hardware/NAND/LPT_Programmer.md similarity index 96% rename from docs/Hacks/NAND_Reading.md rename to docs/Hardware/NAND/LPT_Programmer.md index 67321902..90327c04 100644 --- a/docs/Hacks/NAND_Reading.md +++ b/docs/Hardware/NAND/LPT_Programmer.md @@ -1,11 +1,15 @@ +# NOTE + +In 2026 it is not reccomended to read your NAND with an LPT cable / port. It takes much longer then [Other Flashers](./Reading.md) and requires old hardware with LPT access. + # NAND reading This tutorial explains how to read the Xbox360's -[NAND](../Hardware/Console/NAND/index.md)/Flash via a PC's parallel/"printer" port in as +[NAND](../../Hardware/Console/NAND.md)/Flash via a PC's parallel/"printer" port in as clean and easy as possible a way. The same method is used to dump all -models of the Xbox 360 ([Xenon](../Hardware/Console/Xenon_(Motherboard).md), -[Zephyr](../Hardware/Console/Revisions/Zephyr.md), [Falcon](../Hardware/Console/Revisions/Falcon.md), -[Opus](../Hardware/Console/Revisions/Falcon.md#opus), [Jasper](../Hardware/Console/Revisions/Jasper.md)). +models of the Xbox 360 ([Xenon](../../Hardware/Console/Xenon_(Motherboard).md), +[Zephyr](../../Hardware/Console/Revisions/Zephyr.md), [Falcon](../../Hardware/Console/Revisions/Falcon.md), +[Opus](../../Hardware/Console/Revisions/Falcon.md#opus), [Jasper](../../Hardware/Console/Revisions/Jasper.md)). Please keep quick & dirty setups and speculation out or, in case some guesswork is really needed, flag them, so this article and the whole @@ -76,12 +80,13 @@ V0.88a CD FIXED \[22/08/2009\]) ::\*NAND Compare and Reconstruction Tool - (compare 2 nand images or reconstruct image from 3 bad reads) + ## Steps: ### Preparing the cable @@ -110,7 +115,9 @@ unneeded pin (e.g., 15) to the needed one (e.g., 14). I (some11) bought a LPT Cable (Nikkai LPT Parallel Printer Cable \[L79BT\]) from Maplins. + Here is the wire color map output: diff --git a/docs/Hardware/NAND/PicoFlasher.md b/docs/Hardware/NAND/PicoFlasher.md new file mode 100644 index 00000000..d6efb774 --- /dev/null +++ b/docs/Hardware/NAND/PicoFlasher.md @@ -0,0 +1,35 @@ +# PicoFlasher v4 + +Needed material: + + - 1x Raspberry Pi Pico + - 1x Micro-USB to USB-A Cable + - Wire + +Program the Pico with the latest [PicoFlasher](https://codeberg.org/hax360/PicoFlasher) firmware. + +| Pico | Xbox | +| ----- | -------------- | +| GP16 | SPI_MISO | +| GP17 | SPI_SS_N | +| GP18 | SPI_CLK | +| GP19 | SPI_MOSI | +| GP20 | SMC_DBG_EN | +| GP21 | SMC_RST_XDK_N | +| GND | GND | + +![Phat PicoFlasher Pinout](images/PhatPicoFlasherWiringDiagram.png) + +![Slim PicoFlasher Pinout](images/SlimPicoFlasherWiringDiagram.png) + + +## Software + +PicoFlasher works natively on Windows via J-Runner-with-Extras. After programming with the latest firmware +and soldering in the headers to your Xbox 360, connect your PicoFlasher to your PC and start J-Runner. + +If succesfully connected, a PicoFlasher logo will appear on the main page. + +![J-Runner-PicoFlasher](images/J-Runner-Picoflasher.jpg) + +Simply click "Read NAND" to read, and "Write NAND" to write. \ No newline at end of file diff --git a/docs/Hardware/NAND/Reading.md b/docs/Hardware/NAND/Reading.md new file mode 100644 index 00000000..39e7996c --- /dev/null +++ b/docs/Hardware/NAND/Reading.md @@ -0,0 +1,48 @@ +# General + +To communicate with the Flash Controller you need a device which +is capable of the [Xbox 360's SPI Protocol](../../Hardware/Console/SPI.md). There are +ready-to-use devices you can buy or, if you aren't afraid of soldering +your own hardware, DIY homebrew devices. Basically: Get the device +programmed (if needed) and solder it according to the +[Diagram](../../Hardware/Console/SPI.md) to your Xbox's mainboard - you can start +reading/writing to your NAND after installing the needed drivers. + + +# [PicoFlasher](./PicoFlasher.md) + +Recommended SPI Programmer in 2026. Only requires a Pi Pico and soldering skills. +Fast reads and writes. + +# [DIY SPI Programmer](./SPI_Programmer.md) + +Legacy method to build your own SPI Programmer. Slow reads and writes. + +# [LPT Programmer](./LPT_Programmer.md) + +Legacy method to read the NAND flash directly using a Parallel Port. +Extremely slow reads and writes. + + +# Other Methods + +Many pre-built pre-flashed existing programmers exist. can be used directly with Software like **J-Runner with Extras** and [NANDPro](../../Homebrew/PC-Software/NANDPro.md) to interact with the NAND Flash. + +In order of most recommended to least recommended, they are: + +## [xFlasher360](https://github.com/Element18592/xFlasher-360) (Open Source) + +- NAND and eMMC, Fast +- ISD Flashing +- CPLD Timing Flashing + +## TX JR-Programmer (Proprietary) + +- NAND, no eMMC, Slow +- ISD Flashing +- CPLD Timing Flashing + +## TX NAND-X (Proprietary) + +- NAND, no eMMC, Slow +- CPLD Timing Flashing \ No newline at end of file diff --git a/docs/Hardware/NAND/SPI_Programmer.md b/docs/Hardware/NAND/SPI_Programmer.md new file mode 100644 index 00000000..2be45762 --- /dev/null +++ b/docs/Hardware/NAND/SPI_Programmer.md @@ -0,0 +1,21 @@ +# DIY / Homebrew SPI Programmer + +Needed material: + + - 1x 50X100 PCB + - 1x 12 MHz Resonator + - 1x 220nF Capacitor + - 1x 100nF Capacitor + - 1x 10 kOhm Resistor + - 6x 100 Ohm Resistor + - 1x 1 Row x 10 Pin - 2,54mm Pin Headers (male) + - 1x 1 Row x 10 Pin - 2,54mm Pin Headers (female) + - 1x PIC 18F2455-I/SP + - 1x USB Conector (female) + - 1x Matching USB Cable + - Wire + +Program the PIC with your favorite PIC Programmer (Can be build or +bought - for building one yourself the "ART2003" is recommended) with +the latest "Picflash" HEX file. +![USB SPI Programmer Diagram](images/USB_SPI_Programmer.png) \ No newline at end of file diff --git a/docs/Hacks/images/16MB.png b/docs/Hardware/NAND/images/16MB.png similarity index 100% rename from docs/Hacks/images/16MB.png rename to docs/Hardware/NAND/images/16MB.png diff --git a/docs/Hacks/images/256-512MB.png b/docs/Hardware/NAND/images/256-512MB.png similarity index 100% rename from docs/Hacks/images/256-512MB.png rename to docs/Hardware/NAND/images/256-512MB.png diff --git a/docs/Hardware/NAND/images/J-Runner-Picoflasher.jpg b/docs/Hardware/NAND/images/J-Runner-Picoflasher.jpg new file mode 100644 index 00000000..94a98948 Binary files /dev/null and b/docs/Hardware/NAND/images/J-Runner-Picoflasher.jpg differ diff --git a/docs/Hardware/NAND/images/PhatPicoFlasherWiringDiagram.png b/docs/Hardware/NAND/images/PhatPicoFlasherWiringDiagram.png new file mode 100644 index 00000000..bc46808a Binary files /dev/null and b/docs/Hardware/NAND/images/PhatPicoFlasherWiringDiagram.png differ diff --git a/docs/Hardware/NAND/images/SlimPicoFlasherWiringDiagram.png b/docs/Hardware/NAND/images/SlimPicoFlasherWiringDiagram.png new file mode 100644 index 00000000..662482c4 Binary files /dev/null and b/docs/Hardware/NAND/images/SlimPicoFlasherWiringDiagram.png differ diff --git a/docs/Hacks/images/USB_SPI_Programmer.png b/docs/Hardware/NAND/images/USB_SPI_Programmer.png similarity index 100% rename from docs/Hacks/images/USB_SPI_Programmer.png rename to docs/Hardware/NAND/images/USB_SPI_Programmer.png diff --git a/docs/Pre-release_differences.md b/docs/Pre-release_differences.md index 1572111a..79b82f27 100644 --- a/docs/Pre-release_differences.md +++ b/docs/Pre-release_differences.md @@ -35,7 +35,7 @@ it, XOR that byte with 0xF0 to get true number - Doesn't seem to have bad block management... probably does though Uses a whole different file system for storing the dashboard files, -instead of [SFCX](./System-Software/NAND_File_System.md) it uses [FATX](./System-Software/Systems/FATX.md) +instead of [SFCX](./System-Software/NAND/File_System.md) it uses [FATX](./System-Software/Systems/FATX.md) Loads more files inside FATX NANDs: * drivers.xex * xnet.xex diff --git a/docs/System-Software/360_System_Software.md b/docs/System-Software/360_System_Software.md index 3608ce39..0535c629 100644 --- a/docs/System-Software/360_System_Software.md +++ b/docs/System-Software/360_System_Software.md @@ -65,9 +65,9 @@ signed with a different header. **[(SFCX](./SFCX.md)** **S**ecure **F**ile **C**ache for **X**box) :is used for cache storage for games. -**[NAND File System](./NAND_File_System.md)** is used to store the -bootloaders, kernel, keyvault and other files on the -[NAND](../Hardware/Console/NAND/index.md). +**[NAND File System](./NAND/File_System.md)** is used to store the +system files (XAM, Dashboard, etc) on the +[NAND](../Hardware/Console/NAND.md). # File Formats diff --git a/docs/System-Software/NAND/File_System.md b/docs/System-Software/NAND/File_System.md new file mode 100644 index 00000000..33edd343 --- /dev/null +++ b/docs/System-Software/NAND/File_System.md @@ -0,0 +1,97 @@ +# NAND Flash Filesystem + +Recommended Reading: + +* [NAND Hardware](../../Hardware/Console/NAND.md) +* [NAND Spare Data](./Spare_Data.md) + +The Xbox 360 NAND FlashFS is a custom proprietary format, very similar to FAT12 / FAT16. + +## Internal Structure + +Inside a 16 KB FlashFS block, pages use a 50/50 interleaved page layout: + +- Even Pages -> Blockmap / File Allocation Table +- Odd Pages -> Directory Entries + + +### Blockmap / File Allocation Table + +An array of big-endian 16-bit unsigned integers, 256 entries per 512-byte page. Maps every 16 KB block in the NAND filesystem area to the next block in a file's cluster chain. + +Special Blockmap Values: + +| Value | Alias | Description | +| ------------- | --------------- | ------------------------------------------ | +| 0x0000 – 0x1FFA | | Next block index in the file cluster chain | +| 0x1FFB | FS_RESERVED | Reserved block marker | +| 0x1FFE | FS_FREE | Free/unallocated block. | +| 0x1FFF | FS_END_OF_CHAIN | End-of-file chain marker. | + + +### Directory Entries + +Fixed 32 bytes (0x20), yielding 16 file entries per 512-byte page. + +| Offset | Size | Description | +|--------|------| ----------------------------------------------- | +| 0x00 | 0x16 | Filename (ASCII, null-terminated, max 22 chars) | +| 0x16 | 0x02 | Start Block Index (uint16_be) | +| 0x18 | 0x04 | File Length in bytes (uint32_be) | +| 0x1C | 0x04 | Timestamp (DOS DateTime format, uint32_be) | + +Deletion Flag: If filename[0] == 0x05, the file is flagged as deleted (conventionally displayed with an underscore _ prefix). + + +## Handling Small vs Big Block + +Big-block NANDs (2048+64 per page) are actually viewed by the SFC as 4x 512+16 per page. Most modern NAND readers (2026) already split the BB pages into SB pages, and reconstruct them on reflashing. This makes dealing with small and big block nands mostly the same. + + +## Small / Big Block Metadata + +On Small / Big Block NANDs, the FlashFS metadata is stored in the spare data. + +| Spare byte(s) | Meaning | +|---|---| +| `[0]` or `[5]` | Bad block marker (0xFF = good) | +| `[1..2]` | Block index in blockmap chain | +| `[0..4,6]` | Sequence number (packed, varies by type) | +| `[7..8]` | FlashFS size field | +| `[9]` | Page count | +| `[C]` | Block type (`0x30`=FlashFS root, `0x31-0x39`=mobile data, etc.) | +| `[C..F]` | ECC (26-bit computed CRC) | + +The FlashFS root block is identified by scanning spare data for blocks with +`block_type == 0x30` and a non-zero sequence number, the highest sequence wins. + +The FlashFS block chain is linked purely through the **blockmap** stored in the root block's +data pages (even pages = blockmap, odd pages = file entries). Each `uint16_t` entry in the +blockmap is a forward pointer to the next block in a chain, with `0x1fff` = end, `0x1ffe` = free, +`0x1ffb` = reserved. + + +## eMMC Metadata + +On eMMC NANDs, there is no spare data, and the eMMC controller does not support out-of-band storage. + +Considering Small and Big block NANDs store the FlashFS metadata in the spare data, you obviously have to change the methodology when parsing and building eMMC images. + +### The config block + +As deffective / dead / bad blocks dont exist on eMMC NANDs, part of the reserve area is repurposed as a FlashFS config block. + +```c +Offset Size Field +0x00 0x14 section_digest (SHA1 hash of all data in this struct) +0x14 0x04 unknown1 +0x18 0x04 fs_version (FlashFS sequence number → replaces spare seq) +0x1C 0x02 fs_block_idx (FlashFS root block index → replaces spare detection) +0x1E 0x02 unknown2 +0x20 0x02 mobile1_block_idx (first mobile data block) +0x22 0x02 mobile1_length (mobile data 1 length) +0x24 0x08 unknown3 +0x2C 0x02 mobile2_block_idx +0x2E 0x02 mobile2_length +0x30 0x1D0 reserved +``` diff --git a/docs/System-Software/NAND/Image.md b/docs/System-Software/NAND/Image.md new file mode 100644 index 00000000..0968a773 --- /dev/null +++ b/docs/System-Software/NAND/Image.md @@ -0,0 +1,149 @@ +# NAND Image + +Reccomended Reading: + +* [NAND Hardware](../../Hardware/Console/NAND.md) +* [NAND Spare Data](./Spare_Data.md) +* [NAND File System](./File_System.md) +* [Bootloaders](../Bootloaders.md) + +## Introduction + +The Xbox 360 NAND uses a proprietary format created by Microsoft. The +format is used to store console-specific data (keyvault, config blocks, +etc) and system data (bootloaders, kernel/hypervisor, dashboard files). +The NAND is split into two sections - one for storing the keyvault, +bootloaders and config blocks and one for storing the dashboard files. +The file are stored using a format which is designed to be transactional +(each change can be reverted). + +## NAND Header + +The NAND Header is stored at the beginning and sets key values for reading / executing the image. + +xconfig_offset is never used by the Xbox 360 system, despite being set.. + +| Offset | Size | Description | Common Value | +| ------ | ---- | ----------------- | ------------ | +| 0x0 | 0x1 | magic | 0xFF | +| 0x2 | 0x2 | version | 1888 | +| 0x4 | 0x2 | pairing | | +| 0x6 | 0x2 | flags | | +| 0x8 | 0x4 | entrypoint | 0x00008000 | +| 0xC | 0x4 | size | | +| 0x10 | 0x40 | reserved | | +| 0x50 | 0x4 | payload_indicator | | +| 0x54 | 0xC | reserved | | +| 0x60 | 0x4 | kv_size | 0x00004000 | +| 0x64 | 0x4 | cf1_offset | | +| 0x68 | 0x2 | patch_slots | | +| 0x6A | 0x2 | kv_version | | +| 0x6C | 0x4 | kv_offset | 0x00004000 | +| 0x70 | 0x4 | fs_offset | 0x00008000 | +| 0x74 | 0x4 | xconfig_offset | 0x00000400 | +| 0x78 | 0x4 | smc_size | 0x00003000 | +| 0x7C | 0x4 | smc_offset | 0x00001000 | + +## Image Layout + +All NAND images use the same initial layout and design: + +| Offset | Size | Description | +| ------ | ------ | ------------------ | +| 0x0 | 0x80 | Header | +| 0x1000 | 0x3000 | SMC | +| 0x4000 | 0x4000 | Keyvault | +| 0x8000 | | Initial BL Chain | +| | | Late BL Chain | +| | | [NAND FlashFS](./File_System.md) | + +## Initial Bootloader Chain + +The initial bootloader chain can change greatly between motherboard types, versions, and retail vs developer hardware. + +**Phat consoles <= Kernel 14699** + +| Slot | Bootloader | +| ---- | ---------- | +| 2BL | CB | +| 3BL | N/A | +| 4BL | CD | + +**Phat consoles > Kernel 14699, ** +**All slim consoles** + +| Slot | Bootloader | +| ---- | ---------- | +| 2BL_A | CB_A | +| 2BL_B | CB_B | +| 3BL | N/A | +| 4BL | CD | + +**Devkit consoles** + +| Slot | Bootloader | +| ---- | ---------- | +| 2BL | SB | +| 3BL | SC | +| 4BL | SD | + +## Late Bootloader Chain + +The late bootloader chain mostly stays the same between hardware but changes based on the image type. + +**Retail Flash Image** + +| Slot | Bootloader | +| ---- | ---------- | +| 5BL | CE | +| 6BL_A | CF 0 | +| 7BL_A | CG 0 | +| 6BL_B | CF 1 | +| 7BL_B | CG 1 | + +**Retail XeLL Image** + +| Slot | Bootloader | +| ---- | ---------- | +| 5BL | XeLL | + +**Devkit Flash Image** + +| Slot | Bootloader | +| ---- | ---------- | +| 5BL | SE | + +### JTAG XeLL Image Layout + +The whole XeLL Image is pretty small with 1,3 MB compared to an original +Xbox360 NAND-Image which is normally 16 MB or 64 MB. + +0x00000000..0x000001ff (0x00000200 bytes) Header +0x00000200..0x000003ff (0x00000200 bytes) Exploit +0x00000400..0x00000fff (0x00000c00 bytes) Padding +0x00001000..0x00003fff (0x00003000 bytes) SMC +0x00004000..0x00007fff (0x00004000 bytes) Keyvault +0x00008000..0x000117ff (0x00009800 bytes) CB 1921 +0x00011800..0x00016ebf (0x000056c0 bytes) CD 1921 +0x00016ec0..0x0006cf2f (0x00056070 bytes) CE 1888 +0x0006cf30..0x0006ffff (0x000030d0 bytes) Padding +0x00070000..0x000744bf (0x000044c0 bytes) CF 4532 +0x000744c0..0x000a33ff (0x0002ef40 bytes) CG 4532 +0x000a3400..0x000bffff (0x0001cc00 bytes) Padding +0x000c0000..0x000fffff (0x00040000 bytes) Xell (backup) +0x00100000..0x0013ffff (0x00040000 bytes) Xell (main) + +- The (hacked) SMC Code is usually seen as Header + Exploit + Padding + + the actual SMC, so 0x0000 - 0x3FFF. +- The Keyvault is the unique "System Information" which holds stuff + like DVDKey, Console Region, Console Serial and other things. Whole + keyvault is crypted with CPUKey. +- After that exploitable CB (2BL) and CD (4BL), matching the console + revision, follows. +- After padding CB/CD theres CE (Base-Kernel 1888) followed by + exploitable Patchslots CF/CG (4532 or 4548) and again some padding. +- At the end of the Image theres a Backup-XeLL, which gets executed if + the original XeLL fails (Bad Update maybe) followed by the original + XeLL. + + diff --git a/docs/System-Software/NAND_File_System.md b/docs/System-Software/NAND/Spare_Data.md similarity index 59% rename from docs/System-Software/NAND_File_System.md rename to docs/System-Software/NAND/Spare_Data.md index e10d887d..a1f65272 100644 --- a/docs/System-Software/NAND_File_System.md +++ b/docs/System-Software/NAND/Spare_Data.md @@ -1,12 +1,8 @@ -# NAND Flash System +# NAND Spare Data -The Xbox 360 NAND uses a proprietary format created by Microsoft. The -format is used to store console-specific data (keyvault, config blocks, -etc) and system data (bootloaders, kernel/hypervisor, dashboard files). -The NAND is split into two sections - one for storing the keyvault, -bootloaders and config blocks and one for storing the dashboard files. -The file are stored using a format which is designed to be transactional -(each change can be reverted). +Reccomended Reading: + +* [NAND Hardware](../../Hardware/Console/NAND.md) ## NAND Basic Format @@ -133,61 +129,4 @@ if(((spare[0xC] & 0xC0) != edc[0])||(spare[0xD] != edc[1])||(spare[0xE] ! return ECC_CORRECT; } -``` - -## NAND Format - -The first byte of a NAND image should always be 0xFF. If it isn't 0xFF -this isn't a valid image. Another thing which should be checked is the -copyright header, which is located at 0x10 in the NAND. This string -should be read in two parts (skipping the year out, as it changes -depending when that xbox was made) and then checked against a control -string (although some valid images have this string changed to -zeropair). - -At 0x2 in the NAND the version of the flash is stored (2bytes). Further -on at 0x8 the offset of the CB is stored, followed by the CF1 offset -(4bytes each). - -At 0x6C the offset to the keyvault is located (4bytes). Up from that at -0x78 the length of the SMC and offset to the SMC are stored (4bytes -each). - -### System Management Controller - -finish later - -### XeLL Image Layout - -The whole XeLL Image is pretty small with 1,3 MB compared to an original -Xbox360 NAND-Image which is normally 16 MB or 64 MB. - -0x00000000..0x000001ff (0x00000200 bytes) Header -0x00000200..0x000003ff (0x00000200 bytes) Exploit -0x00000400..0x00000fff (0x00000c00 bytes) Padding -0x00001000..0x00003fff (0x00003000 bytes) SMC -0x00004000..0x00007fff (0x00004000 bytes) Keyvault -0x00008000..0x000117ff (0x00009800 bytes) CB 1921 -0x00011800..0x00016ebf (0x000056c0 bytes) CD 1921 -0x00016ec0..0x0006cf2f (0x00056070 bytes) CE 1888 -0x0006cf30..0x0006ffff (0x000030d0 bytes) Padding -0x00070000..0x000744bf (0x000044c0 bytes) CF 4532 -0x000744c0..0x000a33ff (0x0002ef40 bytes) CG 4532 -0x000a3400..0x000bffff (0x0001cc00 bytes) Padding -0x000c0000..0x000fffff (0x00040000 bytes) Xell (backup) -0x00100000..0x0013ffff (0x00040000 bytes) Xell (main) - -- The (hacked) SMC Code is usually seen as Header + Exploit + Padding - + the actual SMC, so 0x0000 - 0x3FFF. -- The Keyvault is the unique "System Information" which holds stuff - like DVDKey, Console Region, Console Serial and other things. Whole - keyvault is crypted with CPUKey. -- After that exploitable CB (2BL) and CD (4BL), matching the console - revision, follows. -- After padding CB/CD theres CE (Base-Kernel 1888) followed by - exploitable Patchslots CF/CG (4532 or 4548) and again some padding. -- At the end of the Image theres a Backup-XeLL, which gets executed if - the original XeLL fails (Bad Update maybe) followed by the original - XeLL. - - +``` \ No newline at end of file diff --git a/docs/System-Software/Shadowboot.md b/docs/System-Software/Shadowboot.md index 324b172b..ee0bf4a0 100644 --- a/docs/System-Software/Shadowboot.md +++ b/docs/System-Software/Shadowboot.md @@ -51,7 +51,7 @@ and boot from xboxromw2d.bin and test kits xboxromtw2d.bin. Shadowboot files are always 832KB (851,968 bytes). Structurally, shadowboot files are nearly identical to [flash -dumps](./NAND_File_System.md), but for obvious reasons they do not +dumps](./NAND/File_System.md), but for obvious reasons they do not contain mobiles or filesystems. | File Structure | diff --git a/docs/index.md b/docs/index.md index 54247778..d2f7a56f 100644 --- a/docs/index.md +++ b/docs/index.md @@ -32,16 +32,16 @@ Join us on [IRC](Support/IRC.md) or [Discord](Support/Discord.md)! |[Contribute](./Support/Contribute.md) | [Case](./Hardware/Console/Case.md) | [849x System Update](./System-Software/849x_System_Update.md) | |[Error Codes](./System-Software/Error_Codes.md) | [Chatpad](./Hardware/Accessories/Chatpad.md) | [Bootloader](./System-Software/Bootloaders.md) | |[FAQ](./Support/FAQ.md) | [DVD Drive](./Hardware/Console/DVD_Drive.md) | [CB Code](./System-Software/CB_Code.md) | -| | [NAND_Reading](./Hacks/NAND_Reading.md) | [Toolchain](https://github.com/Free60Project/libxenon) | +| | [NAND_Reading](./Hardware/NAND/Reading.md) | [Toolchain](https://github.com/Free60Project/libxenon) | | | [Ethernet](./Hardware/Console/Ethernet.md) | [Console Security Certificate](./System-Software/Console_Security_Certificate.md) | | | [Falcon](./Hardware/Console/Revisions/Falcon.md) | [Cross Compiler](./Development/Cross_Compiler.md) | -| | [NAND](./Hardware/Console/NAND/index.md) | [Debian-etch](./Linux/Distros/Debian/etch.md) | +| | [NAND](./Hardware/Console/NAND.md) | [Debian-etch](./Linux/Distros/Debian/etch.md) | | | [Fusesets](./Hardware/Fusesets.md) | [Debian-lenny](./Linux/Distros/Debian/lenny.md) | | | [GamePad](./Hardware/Accessories/GamePad.md) | [Debian-squeeze](./Linux/Distros/Debian/squeeze.md) | | | [Chatpad](./Hardware/Accessories/Chatpad.md) | [Dumpana](./Development/Dumpana.md) | | | [GPU](./Hardware/Console/Xenos_(GPU).md) | [Emulators](./Homebrew/List_of_homebrew_emulators.md) | | | [Harddrive](./Hardware/Console/HDD.md) | [FATX](./System-Software/Systems/FATX.md) | -| | [Headset](./Hardware/Accessories/Headset.md) | [Flash Filesystem](./System-Software/NAND_File_System.md) | +| | [Headset](./Hardware/Accessories/Headset.md) | [Flash Filesystem](./System-Software/NAND/File_System.md) | | | [Motherboard](./Hardware/Console/Motherboard.md) | [GDFX](./System-Software/Systems/GDFX.md) | | | [Jasper](./Hardware/Console/Revisions/Jasper.md) | [GPD](./System-Software/Formats/GPD.md) | | | [Level Shifter](./Hardware/Level_Shifter.md) | | @@ -120,15 +120,15 @@ Join us on [IRC](Support/IRC.md) or [Discord](Support/Discord.md)! [Mupen64-360](./Homebrew/Emulators/Mupen64-360.md) -[NAND](./Hardware/Console/NAND/index.md) +[NAND](./Hardware/Console/NAND.md) -[NAND: Bad Blocks](./Hacks/NAND_Bad_Blocks.md) +[NAND: Bad Blocks](./Hardware/NAND/Bad_Blocks.md) [NANDPro](./Homebrew/PC-Software/NANDPro.md) -[NAND File System](./System-Software/NAND_File_System.md) +[NAND File System](./System-Software/NAND/File_System.md) -[NAND Reading](./Hacks/NAND_Reading.md) +[NAND Reading](./Hardware/NAND/Reading.md) [NFS Root](./NFS_Root.md) @@ -166,7 +166,7 @@ Join us on [IRC](Support/IRC.md) or [Discord](Support/Discord.md)! [Rawflash](./Rawflash.md) -[Reading Out nand](./Hacks/NAND_Reading.md) +[Reading Out nand](./Hardware/NAND/Reading.md) [Reset Glitch Hack](./Hacks/Reset_Glitch_Hack.md) @@ -194,7 +194,7 @@ Join us on [IRC](Support/IRC.md) or [Discord](Support/Discord.md)! [SPI](./Hardware/Console/SPI.md) -[SPI Programmer](./Hacks/SPI_Programmer.md) +[SPI Programmer](./Hardware/NAND/SPI_Programmer.md) [STFS](./System-Software/Formats/STFS.md) diff --git a/mkdocs.yml b/mkdocs.yml index 1e49ac19..9ebf44a5 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -81,9 +81,9 @@ nav: - 'Hardware/8051_8052.md' - Level Shifter: 'Hardware/Level_Shifter.md' - NAND: - - 'Hardware/index.md' - - Bad Blocks: 'Hacks/NAND_Bad_Blocks.md' - - Reading: 'Hacks/NAND_Reading.md' + - 'Hardware/Console/NAND.md' + - Bad Blocks: 'Hardware/NAND/Bad_Blocks.md' + - Reading: 'Hardware/NAND/Reading.md' - Pre-release Differences: 'Pre-release_differences.md' - System Software: - File Formats: @@ -98,6 +98,10 @@ nav: - File Systems: - FATX: 'System-Software/Systems/FATX.md' - GDFX: 'System-Software/Systems/GDFX.md' + - NAND: + - Image: 'System-Software/NAND/Image.md' + - Filesystem: 'System-Software/NAND/File_System.md' + - Spare Data: 'System-Software/NAND/Spare_Data.md' - Error Codes: 'System-Software/Error_Codes.md' - Kernel: 'System-Software/Kernel.md' - Pre-release Differences: 'Pre-release_differences.md' @@ -142,7 +146,7 @@ plugins: redirect_maps: # Original Wiki -> MkDocs Wiki 'wiki/Home_Page.md': 'index.md' - 'wiki/Reading_Out_nand.md': 'Hacks/NAND_Reading.md' + 'wiki/Reading_Out_nand.md': 'Hardware/NAND/LPT_Programmer.md' 'wiki/Secure_Transacted_File_System.md': 'System-Software/Formats/STFS.md' 'wiki/SMS_Plus.md': 'Homebrew/Emulators/Sega_Master_System_Plus.md' 'wiki/Toolchain.md': 'Development/Xenon_Toolchain.md' @@ -176,3 +180,9 @@ plugins: 'Hardware/Revisions/Valhalla.md': 'Hardware/Console/Revisions/Trinity.md' 'Toolchain.md': 'Development/Xenon_Toolchain.md' 'Hardware/Console/SFCX.md': 'Hardware/Console/Southbridge.md' + # NAND Cleanup + 'System-Software/NAND_File_System.md': 'System-Software/NAND/File_System.md' + 'Hacks/NAND_Bad_Blocks.md': 'Hardware/NAND/Bad_Blocks.md' + 'Hacks/NAND_Reading.md': 'Hardware/NAND/Reading.md' + 'Hacks/SPI_Programmer.md': 'Hardware/NAND/SPI_Programmer.md' + 'Hacks/LPT_Programmer.md': 'Hardware/NAND/LPT_Programmer.md'