Identify Xbox 360 DVDRom Drive(Firmware)
Published by forahobby on 2006-03-19
Models
- Hitachi-LG GDR-3120L
- Toshiba/Samsung TS-H943
- BenQ
- Lite-on
Images
Hitachi-LG GDR-3120L and Toshiba/Samsung TS-H943 Drive Trays
Front Panel Check
Use the image below to find out what brand drive you have. The Samsung has a small hole in the middle of the tray, closest to the bezel. The Hitachi has the larger hole on the right. And the BenQ or LiteOn has no holes. There are also different versions of each of these drives. There are two main types of Samsungs, MS25 and MS28. There are also quite a few different versions of the Hitachi drive. The only way to tell the exact version of your drive including firmware/rom version is by opening the Xbox 360.
Please note that the BenQ drive in this picture has a black tray, while the retail drive is grey in color. Also note that the BenQ and LiteOn drives both have the same tray, so the only way to know for sure is by opening the system.
Facts
Each x360 dvd-rom firmware contains an unique 16 byte key (stored at 0x4F00)
there is no overall dvdrom device verification/marriage
xbox1 and 360 games show the video, so unlock process failed and only the normal video part is accessible
In the Hitachi/LG FW, there are 5 calls made to the encryptor. They are:
Read Dvd Structure Phsyical
Mode sense PC = 3B (3B is probably used to check to see if the drive has the correct key)
Mode sense PC = 3E (our authentication related mode sense)
Mode select using 3B
Mode select using 3E
Speculation
It is believed believed the unique 16 bytes key is used in the following procedure:
At console start, console creates random data.
Console sends the random data to drive by using a mode select command.
Drive uses it’s own key and the random data to create a new session key.
Console sends a mode sense command to read this session key.
Both console and drive now use this session key to encrypt/decrypt further authentication related x360 communication.
Tools
FirmCrypt by loser Description: Tool to decrypt/encrypt dvd firmware files from the xbox360 dvd drive. This tool takes and existing input file and either encrypts or decrypts it and writes the output to a new file. v0.1 Windows Binary: Download Source Code: Download
mn103 Plugin for IDA and xextool Source for developers can be found in the 360-hq downloads PC Utilities/Developers category here:
https://www.360-hq.com/downloads-cat17.html
Firmware patch to dump Security Sector with H-943A drive Source:
Xbox Firmware Tutorial
Firmwares
- GDR-3120L SST39SF020A
- GDR-3120L X800475-008 (Rom: 0046DH)
- GDR-3120L X800475-009 (Rom: 0047DH)
|
|