RGH Rebuilt NAND Won't Read Games

G

gokussj5okazu

Junior Member
Mar 12, 2005
21
0
Southeast Missouri
Ok, since no one was probably seeing this in my other thread, here goes again.


I rebuilt a new NAND for this Zepyhr that I have, after a failed RGH.

http://www.mediafire.com/?iijc2jc4uhbn10k


The Xbox boots perfectly, and does everything fine, except play games. Now the old BenQ drive was dieing, so I grabbed another one I had, swapped the key, and popped it in.

I get "This Disc is not supported" error on retail games and burnt games.

This makes no damn sense as the Xbox has not been on Live, and was only just updated to 13604 right before I attempted the RGH.


Soo, I tried spoofing a Sammy, and a Hitachi drive as BenQ and putting them in. Same damn error!

I've tried with stock firmware, and with LT+2.0 and it won't work!

My only thought is that the AP25 data in the NAND is botched to hell, but 360 Flash Tool shows there is no AP25 data in the NAND, no is there a "odd.bin" file.

Any suggestions?

If someone could take a look at that NAND and offer some suggestions I would greatly appreciate it.
 
G

gokussj5okazu

Junior Member
Mar 12, 2005
21
0
Southeast Missouri
Technically it's retail now, but it is one I was trying to get to glitch, but it was being horribly stubborn.

The original NAND dump was lost while trying to glitch it, but I managed to rebuild a stock one by extracting the KV, LDV, and Config from the NAND that had been patched with the Xell ECC.

I got hold of a clean 4558 NAND, and used Multi Builder to rebuild it to 4578, which is what the Xbox needed. Then I injected the KV, LDV, and Config. It boots this NAND, but I get the aforementioned DVD error.
 
G

gokussj5okazu

Junior Member
Mar 12, 2005
21
0
Southeast Missouri
Correct, which is why my first attempt to replace it was with another BenQ, althought the original firmware was different on it, it was still a VAD6038.


Anyhow, here's a detailed description.



First, I tool my XellNAND dump. It would not load in 360 Flash Tool, and I figured this was because it was ECC patched. I WAS able to open it in BinCrypt 2, and used it to dump the KV, all Generic Files including the AP25 data, and Config.

Then, by pure luck, I was able to get the console to boot to Xell once. This gave me the chance to take a picture of the FuseSets, giving me the LDV values.



So then I took a donor Zephyr NAND. It was a CB 4558.

I ran this NAND, along with it's CPU Key, though Multi Builder, and had it rebuild it as a CB 4578.

Then, I opened it in 360 Flash Tool, and patched the LDV values. They were CB 2, CF 10.

Then I imported the KV, Generic Files, and Config. HOWEVER, I was unable to import the AP25 because it was grayed out. I assumed this meant that the NAND I was patching had no spot for this information to reside.



So I took this NAND, flashed it, and it worked, aside from it not reading games.
 
Martin C

Martin C

VIP Member
Jan 10, 2004
35,981
0
Scotland, UK
www.team-xecuter.com
Run your rebuilt nand through multi_build 0.4 and make a retail NAND from here.

link for tut in my sig (same as unflag console).

The issue is that crl.bin and secdata.bin have LDV specific values in them too, which you cannot easily edit. Multi_build does it for you.
 
G

gokussj5okazu

Junior Member
Mar 12, 2005
21
0
Southeast Missouri
Ok, great, thanks! I hope it works.

Just ran it, getting ready to test it. I get an error though, should this be a problem?

 
Martin C

Martin C

VIP Member
Jan 10, 2004
35,981
0
Scotland, UK
www.team-xecuter.com
If you used the nand which you have currently flashed to your console, you should be ok.

Post the nandflash.log file just to be on the safe side.
 
G

gokussj5okazu

Junior Member
Mar 12, 2005
21
0
Southeast Missouri
Ok. Well here's the log.


Code: 
---------------------------------------------------------------
     ggBuild v0.33.273
---------------------------------------------------------------
building a retail image
data directory overridden from command line to '13604'
per build directory overridden from command line to 'my360'
file name overridden from command line to 'retail_image.bin'

------ parsing user ini at '.\my360\options.ini' ------
loading file...done!
pre-parsing and sanitizing
done!
User options.ini loaded, 0xe6 bytes in memory
loading cpukey.txt from .\my360\cpukey.txt
CPU Key set to: 0x********************************
setting 1blkey from ini: 0xDD88AD0C9ED669E7B56794FB68563EFA
1BL Key set to: 0xDD88AD0C9ED669E7B56794FB68563EFA sum: 0x983 (expects: 0x983)
Using nonandmu option (ini file)
Using patchsmc option (ini file)

------ Checking .\my360\nanddump.bin ------
Loading NAND dump...done!
NAND dump is from a small block machine
NAND dump uses small block controller
parsing dump into user and spare...
done!
KeyVault cannot be 0x0 bytes, using 0x4000
decrypting KeyVault at address 0x4000 of size 0x4000
keyvault decrypted OK, will use if no kv.bin is provided
decrypting SMC at address 0x1000 of size 0x3000
SMC decrypted OK, will use if no external smc.bin is provided
seeking smc config in dump...found at offset 0xf7c000! Using if no smc config is provided.
CF slot 0 decrypted ok LDV 0x0a Pairing: 0x905431
setting LDV from image to 10
setting pairing data from image to 0x905431
MobileB.dat found at page 0x6da0, size 2048 (0x800) bytes
MobileC.dat found at page 0x6dc0, size 512 (0x200) bytes
MobileD.dat found at page 0x6de0, size 2048 (0x800) bytes
MobileE.dat found at page 0x6e14, size 2048 (0x800) bytes

------ parsing ini at '.\13604\filelist.ini' ------
ini version 13604

ini: label [zephyrbl] found
found (1) 'cb_4578.bin' crc: 0x317bf38f
found (2) 'cb_bnone.bin' crc: 0x00000000
found (3) 'cd_8453.bin' crc: 0x25e0acd0
found (4) 'ce_1888.bin' crc: 0xff9b60df
found (5) 'cf_13604.bin' crc: 0x639a4cd7
found (6) 'cg_13604.bin' crc: 0x7e9f5364

ini: label [flashfs] found
found (1) 'aac.xexp' crc: 0xdaed8bc7
found (2) 'bootanim.xex' crc: 0x8a7ab1b4
found (3) 'createprofile.xex' crc: 0xe19ca8c4
found (4) 'dash.xex' crc: 0xecdaf6c0
found (5) 'deviceselector.xex' crc: 0xaa4579d1
found (6) 'gamerprofile.xex' crc: 0xebc5fec3
found (7) 'hud.xex' crc: 0xe2410ee1
found (8) 'huduiskin.xex' crc: 0x390eac39
found (9) 'mfgbootlauncher.xex' crc: 0xf3637ed9
found (10) 'minimediaplayer.xex' crc: 0x23d28bb8
found (11) 'nomni.xexp' crc: 0xed7cd3f5
found (12) 'nomnifwk.xexp' crc: 0x2c6fd7e8
found (13) 'nomnifwm.xexp' crc: 0xaa978831
found (14) 'signin.xex' crc: 0xf7436a62
found (15) 'updater.xex' crc: 0xd0cd6753
found (16) 'vk.xex' crc: 0x65f4eec0
found (17) 'xam.xex' crc: 0x2a74ee0f
found (18) 'xenonclatin.xtt' crc: 0xd5d17ff5
found (19) 'xenonclatin.xttp' crc: 0x7a507ad1
found (20) 'xenonjklatin.xtt' crc: 0xdde4a14c
found (21) 'xenonjklatin.xttp' crc: 0x945b7092
found (22) 'ximecore.xex' crc: 0xccb87938
found (23) 'ximedic.xex' crc: 0x1d992bfb
found (24) 'ximedic.xexp' crc: 0x47a55af9
found (25) '..\launch.xex' crc: 0x00000000
found (26) '..\lhelper.xex' crc: 0x00000000

ini: label [security] found
found (1) 'crl.bin' crc: 0x00000000
found (2) 'dae.bin' crc: 0x00000000
found (3) 'extended.bin' crc: 0x00000000
found (4) 'fcrt.bin' crc: 0x00000000
found (5) 'secdata.bin' crc: 0x00000000
------ ini parsing completed ------

output name overridden to: retail_image.bin

Writing initial header to flash image

------ Loading bootloaders and required security files ------
reading .\my360\smc.bin failed, using smc.bin from nand dump
reading .\my360\kv.bin failed, using kv.bin from nand dump
reading .\13604\cb_4578.bin (0x7f20 bytes) (crc32: 0x317bf38f ini: 0x317bf38f)
reading .\13604\cd_8453.bin (0x5780 bytes) (crc32: 0x25e0acd0 ini: 0x25e0acd0)
reading .\13604\ce_1888.bin (0x5606a b pad 0x56070 b) (crc32: 0xff9b60df ini: 0xff9b60df)
reading .\13604\cf_13604.bin (0x4450 bytes) (crc32: 0x639a4cd7 ini: 0x639a4cd7)
reading .\13604\cg_13604.bin (0x659e0 bytes) (crc32: 0x7e9f5364 ini: 0x7e9f5364)
reading .\my360\smc_config.bin failed, using smc_config.bin from nand dump
-------------------
checking smc_config
-------------------
extracting config
------------------
SMC config info:
------------------
Target temps: Cpu:  80øC Gpu:  75øC Edram:  78øC
Max temps   : Cpu: 100øC Gpu: 100øC Edram: 102øC
Cpu Fan     : (auto)
Gpu Fan     : (auto)
MAC Address : 00:17:fa:76:49:da
AVRegion    : 0x00000100 (NTSC-M)
GameRegion  : 0x00ff (NTSC/US)
DVDRegion   : 1
resetKey    : AARX
---------------------
Checking ini for smc config data patches
smc was not patched
---------------------
done!
retail image, patches skipped

------ Encrypting and finalizing bootloaders ------
SMC checksum: b244034e

******* ERROR: hacked SMC found? you need a clean smc for a retail image!
  NOTE: this may not be accurate as not all smc are listed

done!

------ Adding bootloaders to flash image ------
adding smc.bin to 0x00001000 len 0x3000
adding kv.bin to 0x00004000 len 0x4000
adding cb_4578.bin to 0x00008000 len 0x7f20
adding cb_bnone.bin to 0x0000ff20 len 0x0
adding cd_8453.bin to 0x0000ff20 len 0x5780
adding ce_1888.bin to 0x000156a0 len 0x56070
retail image, skipping xell-gggggg.bin
adding cf_13604.bin to 0x00070000 len 0x4450
adding cg_13604.bin to 0x00074450 len 0x659e0
retail image, skipping patches_fat.bin
Fixing up FS table...done!
Writing CG patch slot overflow data to sysupdate.xexp1...done!

------ adding 26 firmware files ------
reading .\13604\aac.xexp (0x4800 bytes) (crc32: 0xdaed8bc7 ini: 0xdaed8bc7)
reading .\13604\bootanim.xex (0x55000 bytes) (crc32: 0x8a7ab1b4 ini: 0x8a7ab1b4)
reading .\13604\createprofile.xex (0xc000 bytes) (crc32: 0xe19ca8c4 ini: 0xe19ca8c4)
reading .\13604\dash.xex (0x5e7000 bytes) (crc32: 0xecdaf6c0 ini: 0xecdaf6c0)
reading .\13604\deviceselector.xex (0x9000 bytes) (crc32: 0xaa4579d1 ini: 0xaa4579d1)
reading .\13604\gamerprofile.xex (0x1a000 bytes) (crc32: 0xebc5fec3 ini: 0xebc5fec3)
reading .\13604\hud.xex (0x1f000 bytes) (crc32: 0xe2410ee1 ini: 0xe2410ee1)
reading .\13604\huduiskin.xex (0x11000 bytes) (crc32: 0x390eac39 ini: 0x390eac39)
reading .\13604\mfgbootlauncher.xex (0x8000 bytes) (crc32: 0xf3637ed9 ini: 0xf3637ed9)
reading .\13604\minimediaplayer.xex (0xc000 bytes) (crc32: 0x23d28bb8 ini: 0x23d28bb8)
reading .\13604\nomni.xexp (0xd000 bytes) (crc32: 0xed7cd3f5 ini: 0xed7cd3f5)
reading .\13604\nomnifwk.xexp (0x2000 bytes) (crc32: 0x2c6fd7e8 ini: 0x2c6fd7e8)
reading .\13604\nomnifwm.xexp (0x5000 bytes) (crc32: 0xaa978831 ini: 0xaa978831)
reading .\13604\signin.xex (0x12000 bytes) (crc32: 0xf7436a62 ini: 0xf7436a62)
reading .\13604\updater.xex (0x8000 bytes) (crc32: 0xd0cd6753 ini: 0xd0cd6753)
reading .\13604\vk.xex (0x9000 bytes) (crc32: 0x65f4eec0 ini: 0x65f4eec0)
reading .\13604\xam.xex (0x218000 bytes) (crc32: 0x2a74ee0f ini: 0x2a74ee0f)
reading .\13604\xenonclatin.xtt (0x11b000 bytes) (crc32: 0xd5d17ff5 ini: 0xd5d17ff5)
reading .\13604\xenonclatin.xttp (0x18000 bytes) (crc32: 0x7a507ad1 ini: 0x7a507ad1)
reading .\13604\xenonjklatin.xtt (0x1a8000 bytes) (crc32: 0xdde4a14c ini: 0xdde4a14c)
reading .\13604\xenonjklatin.xttp (0x7000 bytes) (crc32: 0x945b7092 ini: 0x945b7092)
reading .\13604\ximecore.xex (0x15000 bytes) (crc32: 0xccb87938 ini: 0xccb87938)
reading .\13604\ximedic.xex (0x90000 bytes) (crc32: 0x1d992bfb ini: 0x1d992bfb)
reading .\13604\ximedic.xexp (0x2800 bytes) (crc32: 0x47a55af9 ini: 0x47a55af9)

***** could not read .\13604\..\launch.xex, skipping *****

***** could not read .\13604\..\lhelper.xex, skipping *****

------ adding 5 security files ------
reading .\my360\crl.bin (0x9e0 bytes)
writing as crl.bin to flash
reading .\my360\dae.bin (0xad30 bytes)
writing as dae.bin to flash
reading .\my360\extended.bin (0x4000 bytes)
writing as extended.bin to flash
***** could not read fcrt.bin, skipping *****
reading .\my360\secdata.bin (0x400 bytes)
writing as secdata.bin to flash

------ checking for Mobile*.dat ------
MobileB.dat was found in dump, 0x800 bytes, adding type 0x31
MobileC.dat was found in dump, 0x200 bytes, adding type 0x32
MobileD.dat was found in dump, 0x800 bytes, adding type 0x33
MobileE.dat was found in dump, 0x800 bytes, adding type 0x34

------ adding smc_config.bin ------

------ finalizing image ------
Fixing up empty FS block entries...done!
Writing FS table to image...done!
calculating ECD bytes and assembling raw image...done!
writing file 'retail_image.bin' to disk...done!
retail_image.bin written OK

---------------------------------------------------------------
retail_image.bin retail image built, info:
---------------------------------------------------------------
console  : zephyr
NAND size: 16MiB
CPU Key  : ********************************
1BL Key  : DD88AD0C9ED669E7B56794FB68563EFA
CF LDV   : 10
---------------------------------------------------------------
    ggBuild Finished. Have a nice day.
---------------------------------------------------------------
 
Last edited:
G

gokussj5okazu

Junior Member
Mar 12, 2005
21
0
Southeast Missouri
It worked! Thanks a ton! I've struggled with this console since Thursday, and it's finally complete. Thanks again!
 
You must log in or register to reply here.