Posts Tagged ‘Gamebox Hacking’

Just saw this at spanish site and did a translation on it

http://www.zonadepruebas.com

http://www.zonadepruebas.com/modules/newbb/viewtopic.php?topic_id=11418&forum=8&post_id=112975#forumpost112975

Capcom Shin_akuma said:

I Researched about NAND, Wii, Xbox 360 and Other consoles Have a unique key for the console, Without You Can not read it nand Without memory errors, and Others do These Programs made to correct errors, i try downloading this and i see a very limited use.

So I did my Programs, I made two, if the first byte compare Are Same three files on 2 of 3 this is considered validated, and Create a file Theoretically That Would Not Have the errors, after I made this a more complex reading is 5 files the byte is equal to 3 or more it is considered validated, if you make 5 of the memory dump to use this program, will generate a new file save it, do it 4 more times, check mds / crc this five, if two Are copies or more equal nand this a perfect copy, if none is equal to 5 in five try run program, one time you will get a perfect copy, the Difference between the 3 files That Are 5, 3 is less Accurate Are But Which Is faster for less gbs to read and write.

Are command-line program

Version 3 files
comparefiles.exe
Version 5 files
comparefiles.exe

I tested with a 350MB file, i made 5 copys, open with hexeditor, i replace files with zeros Each on one part, first in offset 400, second in offset in offset 072713328.3 270597216.5 175507968.4 in offset in offset 356601696 .
After this one closed windows make this file everytime i selected this rsrsrsr
After i run my program, this 5 defected chosse files, and this one good output file, after i run mds fsum and original video is equal to this Are perfect copy.

This take 5 ~ 6 hours with my computer and 350MB, 2GB files here is about one hour, this will depend pc memory, pc cpu, and hd, my pc is a pentium 4 3GHZ, 768MB DDR1 400mhz, and hd is sansumg 500GB Increase hds old will much time.

Files in megaupload
http://www.megaupload.com/?d=NLZKYJJ0
No error only 10k Are small programs.

This has led to ….

gamebox

First, get two gigs correctly read, and then learn how to record them back without error. And then we can build whatever we want.

For now, reading is becoming difficult. Ovan and Utopian , look at a comparison of the end of the file RES.BIN both have sent me. They are the last rocibidos for both, and we all thought that would be great, but …..

As shown in the image, the end of both is different. Al ovan, missing a few bytes that leads Utopian: What is good?

A pity, because we are near, but not successful. ECC failure of all all, and read a few bytes of more or less continuously.

Edit: I get the feeling that they are the ECC bytes, which one has read as RAW (without control of ECC) and one with it enabled. Ovan think that of ECC is enabled, it simply fills the void left by the ECC and calculated as zeros. In contrast, the Utopian is read as RAW (as it exits the NAND) without ECC and therefore appear porĂ³pios ECC data. Interestingly, in all that I get false readings, always puts me error “OobSize 0xDA ECC error” and is 218 0xDA (Besides, I usually accompanies a “Status 0xB” or “0×8″ that are 11 and 8 (ECC could they be?)

Therefore, I conclude that the OobSize IS 224 (as illustrated in the NAND PDF), but 218, as shown on pages 61 and 62 of the NAND. If you have read with other values, you could try with the 218, to see such.

 

 

Well done so far to all hackers and people involved , hopefully this info can help someone in opening the gamebox up some more

This console has only been out for a few weeks but already hackers are looking into it heres the latest .

Received mine yesterday, too. I don’t regard it as useable with the current software though, frameskip is just too annoying.

Time to get this thing open :-) Just started investigating. PT4 on the board is the JZ4755′s UART_TX pin. On starting the unit, it gives us the following at 57600 bps:

DMCR=09AA7B3A

Prepare to Download MINIOS.

Ingenic Semiconductor Co., Ltd. Loader Version V1.0
00000080
Jump to 0×80800000

Next step: Getting PIN93 (BOOT_SEL1) to GND, this should trigger SD Card booting. Unfortunately, this pin doesn’t seem to be easily accessible. It’s not connected on the board at all, just put to VCC (leads to NAND boot) by the CPUs internal pullup, so it will need to be soldered directly to the cpu pin. Any other ideas are welcome :-)