I have some dumps from a box where 4532 is upgraded to 4548.
Keyvault checker crash upgrade#
* I noticed an odd bug in the the upgrade process while developing this tool.
Keyvault checker crash Patch#
If 1 or both of the patch (CF/CG) slots are occupied they will be applied to the base kernel and the result is also written as a file - .įor example, if you have a base kernel (1888) and 2 patches (28) in your flash dump, load into the tool, right click on CE and choose kernel(s) you will get 3 files: Selecting Kernel(s) causes the application to extract the base (typically 1888) HV and Kernel as an uncompressed file - "". * As TheSpecialist said extraction of CE section is now working, and what a pig it was Wink, you may now right click and select 'Extract' and get just the raw, decrypted CE Section or Kernel(s). * Reverted CE.cab to single file (thanks Takires) * Fixed CG extraction (see NAND Layout thread for info) * Exported sections now include version number in the name cab file extracted from CE now contains 2 files, Hypervisor.bin and xboxkrnl.exe * Changed appearance for more read comfort * Updated config block logic with new info * Fixed application can now start without Administrator Rights or UAC enabled
* Fixed bug in kernel extract log with double slashes, more accurate extract log * Fixed bug in reading bootloaders that are smaller than 1 block * Fixed bug in reading 7BL (CG) that have more blocks than specified in 6BL (CF) * Added ability to display Bad Blocks with true image offsets * Added simple state indication via Progress Bar * Added Single CPU Key or Multiple CPU Key handling (max. * Added Support for XBR/ZeroPaired images (still in development) * Added Support for DevKit images + region for DevKit * Added Support for Large Block nands (Jasper 256MB and 512MB nands) * Added Option menu to enable/disable several features * Added ability to open 70MB images (dumped with nandpro "-r70") * Added ability to extract ibuild compatible files (.\freeBOOT\Data) * Added ability to extract/import encrypted KeyVault without known CPU Key * Added checksum calculation for static SMC Config Block (Thanks to cory1492) * Added ability to convert Xellous/NandPro(info) raw SMC Config to different Styles and vice versa, e.g. * Added support for single file "config.bin" editing/converting via Drag'n'Drop * Added static SMC Config editing (Thanks to q36) * Fixed bug, regarding to re-encrypting the SMC when the image is Zero Paired Image
* Fixed bug, no longer crashes if Bootloaders are small in size (in rare cases) * Fixed bug, patching KeyVault works again
* Added ability to view Advanced KeyVault Info
Keyvault checker crash code#
* Added ability to display SMC Code Version * Added ability to extract new 'fcrt.bin' file (encrypted only atm) * Added support for Trinity (XBOX360 Slim) dumps * Changed, more accurate file extraction, automatically create subfolders * Fixed bug, regarding to saving config block checksum at wrong offset (in rare cases) * Added option in Settings to allow cut short BigBlock Nand Images (64MB) * Added option in Settings to allow randomized encryption * Added option to rebuild an opened Nand Image with different CPU-Key (Bootloaders/HV and generic files) * Added support for "Alternate KeyVault" decrypting/extracting * Added ability to extract/import new 'dae.bin' file * Added ability to detect/convert Images without ECC data (made with Infectus device) * Added ability to detect/convert raw Images (made with external programmer) to proper read format * Added ability to extract/import Slot0/Slot1 of ZeroPaired Images * Added support for small XeLL Images (1,3MB) After all the fuss about AACS keys recently it seems risky to put the key in the exe Wink The Cx sections extracted from a dump will only decrypt correctly if the correct hex digits are inserted in the CxKey.txt file CxKey.txt is delivered with 32 '0's and they should be replaced with the key obtained from the 1BL. The tool consists of the exe and CxKey.txt. The ECC bytes are used to locate FS entries & identify the version. The tool expects a dump to contain the data (512 bytes) followed by the ECC (16 bytes).
The first 256K of xboxkrnl.img is the Hypervisor, the remainder is the Kernel. This can be opened with winrar and the content (xboxkrnl.img) extracted. The tool will extract and decrypt sections CB, CD, CE. The flash is devided into 2 major partsġ) The Cx sections (CB,CD,CE & 0,1 or 2 CF & CG sections).ĬE, contains the HV and Kernel in a. This tool will allow you to decrypt and extract various parts of a XBox360 flash dump. Browse All | Detailed Statistics | Browsing: 33
0 kommentar(er)
