[RGH] Blank screen after flashing with multibuilder nand

[ol' dirty ewok]

Hey guys, i need to pick your brains a little.

Dont have original trinity nand that was dumped from my slim. (long story short, overwrote them with nand w/ ECC) during a nand-x dump.

I was able to boot into Xell and grab my CPU key.

I acquired a donor Trinity Nand so that I can rebuild my original nand. Followed these instructions:
http://www.xboxmb.com/forum/39-jtag-tutorials/40-how-rebuild-your-original-nand.html

I used this now supposedly rebuilt nanddump.bin to use in my multibuilder with cpukey.txt and the nandflash.bin was created.

Copied over the xenon.elf and nandflash.bin over to a usb. Booted into Xell and immediately flashed the Nand from USB.

Turned off console, removed power cable and waited.
PLugged back in power, and pressed power button.

CR did its job, but xbox would not boot into dash.
Would get blank screen, and just the power light on on the power button of xbox.

I can boot into xell by pressing eject button.

In my fuses.txt file, lines 7,8 contain 2 x "f".

Nandflash.bin file multibuilder created had CF LDV : 5
I'm assuming it's 5 because of the donor nand?

If i change the cfldv to "2" in options.ini and rebuild the nandflash.bin, flash thru xell and reboot, Xbox would give me flashing RROD. But still nothing on the screen.

I've tried changing the cfldv value using 2,3,4, but all would result in the flashing RROD. Only if i set to 5 would it not RROD, but still would not give me any image on TV.

I'm not sure what to do with the FCRT.bin. I believe the donor nand has this info contained in it, and multibuilder automatically extracts it.

If you guys see anything suspicious, please let me know! Appreciate all the help.

Latest multibuilder log:

---------------------------------------------------------------
ggBuild v0.33.273
---------------------------------------------------------------
data directory overridden from command line to '13604'
per build directory overridden from command line to 'my360'
file name overridden from command line to 'nandflash.bin'

------ parsing user ini at '.\my360\options.ini' ------
loading file...done!
pre-parsing and sanitizing
done!
User options.ini loaded, 0xe7 bytes in memory
loading cpukey.txt from .\my360\cpukey.txt
CPU Key set to: 0xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
setting 1blkey from ini: 0xxxxxxxxxxxxxxxxxxxxxxxxxxxx
1BL Key set to: 0xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx sum: 0x983 (expects: 0x983)
Using nonandmu option (ini file)
Using patchsmc option (ini file)

------ Checking .\my360\nanddump.bin ------
Loading NAND dump...done!
NAND dump is from a small block machine
NAND dump uses big block controller
parsing dump into user and spare...
done!
decrypting KeyVault at address 0x4000 of size 0x4000
keyvault decrypted OK, will use if no kv.bin is provided
decrypting SMC at address 0x1000 of size 0x3000
SMC decrypted OK, will use if no external smc.bin is provided
seeking smc config in dump...found at offset 0xf7c000! Using if no smc config is provided.
MobileB.dat found at page 0x35a4, size 2048 (0x800) bytes
MobileC.dat found at page 0x4e0, size 512 (0x200) bytes
MobileD.dat found at page 0x4d40, size 2048 (0x800) bytes
MobileE.dat found at page 0x3a60, size 2048 (0x800) bytes

------ parsing ini at '.\13604\filelist.ini' ------
ini version 13604

ini: label [trinitybl] found
found (1) 'cba_9188.bin' crc: 0x3661a9d6
found (2) 'cbb_9188.bin' crc: 0xb7cfc17c
found (3) 'cd_9452.bin' crc: 0xb6959549
found (4) 'ce_1888.bin' crc: 0xff9b60df
found (5) 'cf_13604.bin' crc: 0x639a4cd7
found (6) 'cg_13604.bin' crc: 0x7e9f5364

ini: label [flashfs] found
found (1) 'aac.xexp' crc: 0xdaed8bc7
found (2) 'bootanim.xex' crc: 0x8a7ab1b4
found (3) 'createprofile.xex' crc: 0xe19ca8c4
found (4) 'dash.xex' crc: 0xecdaf6c0
found (5) 'deviceselector.xex' crc: 0xaa4579d1
found (6) 'gamerprofile.xex' crc: 0xebc5fec3
found (7) 'hud.xex' crc: 0xe2410ee1
found (8) 'huduiskin.xex' crc: 0x390eac39
found (9) 'mfgbootlauncher.xex' crc: 0xf3637ed9
found (10) 'minimediaplayer.xex' crc: 0x23d28bb8
found (11) 'nomni.xexp' crc: 0xed7cd3f5
found (12) 'nomnifwk.xexp' crc: 0x2c6fd7e8
found (13) 'nomnifwm.xexp' crc: 0xaa978831
found (14) 'signin.xex' crc: 0xf7436a62
found (15) 'updater.xex' crc: 0xd0cd6753
found (16) 'vk.xex' crc: 0x65f4eec0
found (17) 'xam.xex' crc: 0x2a74ee0f
found (18) 'xenonclatin.xtt' crc: 0xd5d17ff5
found (19) 'xenonclatin.xttp' crc: 0x7a507ad1
found (20) 'xenonjklatin.xtt' crc: 0xdde4a14c
found (21) 'xenonjklatin.xttp' crc: 0x945b7092
found (22) 'ximecore.xex' crc: 0xccb87938
found (23) 'ximedic.xex' crc: 0x1d992bfb
found (24) 'ximedic.xexp' crc: 0x47a55af9
found (25) 'launch.xex' crc: 0x00000000
found (26) 'lhelper.xex' crc: 0x00000000

ini: label [security] found
found (1) 'crl.bin' crc: 0x00000000
found (2) 'dae.bin' crc: 0x00000000
found (3) 'extended.bin' crc: 0x00000000
found (4) 'fcrt.bin' crc: 0x00000000
found (5) 'secdata.bin' crc: 0x00000000
------ ini parsing completed ------

output name overridden to: nandflash.bin

Writing initial header to flash image

------ Loading bootloaders and required security files ------
reading .\my360\smc.bin failed, using smc.bin from nand dump
reading .\my360\kv.bin failed, using kv.bin from nand dump
reading .\13604\cba_9188.bin (0x1ac0 bytes) (crc32: 0x3661a9d6 ini: 0x3661a9d6)
reading .\13604\cbb_9188.bin (0x7800 bytes) (crc32: 0xb7cfc17c ini: 0xb7cfc17c)
reading .\13604\cd_9452.bin (0x4f20 bytes) (crc32: 0xb6959549 ini: 0xb6959549)
reading .\13604\ce_1888.bin (0x5606a b pad 0x56070 b) (crc32: 0xff9b60df ini: 0xff9b60df)
reading .\my360\xell-gggggg.bin (0x40000 bytes)
reading .\13604\cf_13604.bin (0x4450 bytes) (crc32: 0x639a4cd7 ini: 0x639a4cd7)
reading .\13604\cg_13604.bin (0x659e0 bytes) (crc32: 0x7e9f5364 ini: 0x7e9f5364)
reading .\13604\bin\patches_trinity.bin (0x6d8 bytes)
reading .\my360\smc_config.bin failed, using smc_config.bin from nand dump
-------------------
checking smc_config
-------------------
extracting config
------------------
SMC config info:
------------------
Target temps: Cpu: 82øC Gpu: 78øC Edram: 76øC
Max temps : Cpu: 89øC Gpu: 82øC Edram: 82øC
Cpu Fan : (auto)
Gpu Fan : (auto)
MAC Address : 00:25:ae:f7:43:23
AVRegion : 0x00000100 (NTSC-M)
GameRegion : 0x00ff (NTSC/US)
DVDRegion : 1
resetKey : LRLA
---------------------
Checking ini for smc config data patches
smc was not patched
---------------------
done!

------ Encrypting and finalizing bootloaders ------
SMC checksum: f9c96639
clean SMC found, type: Trinity 3.1
patching clean smc, type: Trinity 3.1 offset: 0x13b3
clean SMC hacked successfully
done!

------ Adding bootloaders to flash image ------
adding smc.bin to 0x00001000 len 0x3000
adding kv.bin to 0x00004000 len 0x4000
adding cba_9188.bin to 0x00008000 len 0x1ac0
adding cbb_9188.bin to 0x00009ac0 len 0x7800
adding cd_9452.bin to 0x000112c0 len 0x51e0
adding ce_1888.bin to 0x000164a0 len 0x56070
adding xell-gggggg.bin to 0x00070000 len 0x40000
adding cf_13604.bin to 0x000b0000 len 0x4450
adding cg_13604.bin to 0x000b4450 len 0x659e0
adding patches_trinity.bin to 0x000c0010 len 0x3e4
Fixing up FS table...done!
Writing CG patch slot overflow data to sysupdate.xexp1...done!

------ adding 26 firmware files ------
reading .\13604\aac.xexp (0x4800 bytes) (crc32: 0xdaed8bc7 ini: 0xdaed8bc7)
reading .\13604\bootanim.xex (0x55000 bytes) (crc32: 0x8a7ab1b4 ini: 0x8a7ab1b4)
reading .\13604\createprofile.xex (0xc000 bytes) (crc32: 0xe19ca8c4 ini: 0xe19ca8c4)
reading .\13604\dash.xex (0x5e7000 bytes) (crc32: 0xecdaf6c0 ini: 0xecdaf6c0)
reading .\13604\deviceselector.xex (0x9000 bytes) (crc32: 0xaa4579d1 ini: 0xaa4579d1)
reading .\13604\gamerprofile.xex (0x1a000 bytes) (crc32: 0xebc5fec3 ini: 0xebc5fec3)
reading .\13604\hud.xex (0x1f000 bytes) (crc32: 0xe2410ee1 ini: 0xe2410ee1)
reading .\13604\huduiskin.xex (0x11000 bytes) (crc32: 0x390eac39 ini: 0x390eac39)
reading .\13604\mfgbootlauncher.xex (0x8000 bytes) (crc32: 0xf3637ed9 ini: 0xf3637ed9)
reading .\13604\minimediaplayer.xex (0xc000 bytes) (crc32: 0x23d28bb8 ini: 0x23d28bb8)
reading .\13604\nomni.xexp (0xd000 bytes) (crc32: 0xed7cd3f5 ini: 0xed7cd3f5)
reading .\13604\nomnifwk.xexp (0x2000 bytes) (crc32: 0x2c6fd7e8 ini: 0x2c6fd7e8)
reading .\13604\nomnifwm.xexp (0x5000 bytes) (crc32: 0xaa978831 ini: 0xaa978831)
reading .\13604\signin.xex (0x12000 bytes) (crc32: 0xf7436a62 ini: 0xf7436a62)
reading .\13604\updater.xex (0x8000 bytes) (crc32: 0xd0cd6753 ini: 0xd0cd6753)
reading .\13604\vk.xex (0x9000 bytes) (crc32: 0x65f4eec0 ini: 0x65f4eec0)
reading .\13604\xam.xex (0x218000 bytes) (crc32: 0x2a74ee0f ini: 0x2a74ee0f)
reading .\13604\xenonclatin.xtt (0x11b000 bytes) (crc32: 0xd5d17ff5 ini: 0xd5d17ff5)
reading .\13604\xenonclatin.xttp (0x18000 bytes) (crc32: 0x7a507ad1 ini: 0x7a507ad1)
reading .\13604\xenonjklatin.xtt (0x1a8000 bytes) (crc32: 0xdde4a14c ini: 0xdde4a14c)
reading .\13604\xenonjklatin.xttp (0x7000 bytes) (crc32: 0x945b7092 ini: 0x945b7092)
reading .\13604\ximecore.xex (0x15000 bytes) (crc32: 0xccb87938 ini: 0xccb87938)
reading .\13604\ximedic.xex (0x90000 bytes) (crc32: 0x1d992bfb ini: 0x1d992bfb)
reading .\13604\ximedic.xexp (0x2800 bytes) (crc32: 0x47a55af9 ini: 0x47a55af9)
reading .\13604\launch.xex (0x9000 bytes)
reading .\13604\lhelper.xex (0x6000 bytes)

------ adding 5 security files ------
reading .\my360\crl.bin (0x9e0 bytes)
writing as crl.bin to flash
reading .\my360\dae.bin (0xad30 bytes)
writing as dae.bin to flash
reading .\my360\extended.bin (0x4000 bytes)
writing as extended.bin to flash
reading .\my360\fcrt.bin (0x4000 bytes)
**** .\my360\fcrt.bin.meta metadata found, not using system time *****

writing as fcrt.bin to flash
******* WARNING: writing .\my360\fcrt.bin as-is to NAND, if .meta was not included it may be invalid!
reading .\my360\secdata.bin (0x400 bytes)
writing as secdata.bin to flash

------ checking for Mobile*.dat ------
MobileB.dat was found in dump, 0x800 bytes, adding type 0x31
MobileC.dat was found in dump, 0x200 bytes, adding type 0x32
MobileD.dat was found in dump, 0x800 bytes, adding type 0x33
MobileE.dat was found in dump, 0x800 bytes, adding type 0x34

------ adding smc_config.bin ------

------ finalizing image ------
Fixing up empty FS block entries...done!
Writing FS table to image...done!
fixing up big block controller on small block NAND LBA numbers...done!
calculating ECD bytes and assembling raw image...done!
writing file 'nandflash.bin' to disk...done!
nandflash.bin written OK

---------------------------------------------------------------
nandflash.bin glitch image built, info:
---------------------------------------------------------------
console : trinity
NAND size: 16MiB
CPU Key : xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1BL Key : xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
CF LDV : 4
---------------------------------------------------------------
ggBuild Finished. Have a nice day.
---------------------------------------------------------------

 

[Martin C]

In fairness, that guide is worthless.

It doesn't deal with any of the other information you need to have corrected, like secdata.bin, crl.bin or LDV values. It might have worked 12 months ago but not now.

Take your badly constructed nand and CPU key. run them through multi_builder but edit options.ini to reflect your PROPER LDV value from XeLL.

Choose the option to build a retail image. You may yet have issues with a donor fcrt.bin file but you'll find out soon enough.

 

[ol' dirty ewok]

In fairness, that guide is worthless.

It doesn't deal with any of the other information you need to have corrected, like secdata.bin, crl.bin or LDV values. It might have worked 12 months ago but not now.

Take your badly constructed nand and CPU key. run them through multi_builder but edit options.ini to reflect your PROPER LDV value from XeLL.

Choose the option to build a retail image. You may yet have issues with a donor fcrt.bin file but you'll find out soon enough.

Thanks for the help... But no go


Did as you said, used the rebuilt retail to recreate the glitched nand. flashed thru XeLL. This time no RROD, but just the power light.

Dvd drive i have is an 0225. Maybe like you said I have trouble with the FCRT.bin file. Not sure what else to do.

In the pic attached. Notice there's nothing in 6BL Patch1.

This unit has been updated once, to 13604 from stock thru USB, before attempting RGH. Can't remember what stock version was.

BTW: Is it possible to rebuild my original nand if I have the Nand dump of original w/ ECC? As I understand, the ECC only overwrites a the first 004F sectors of the nand right? Would it be possible to take the First 4F sectors of a clean donor nand and replace the ECC 004F data from my Original Nand/ECC?

 

[Martin C]

You haven't done as I suggested. Your LDV is wrong. Did you check it in XeLL like I advised?

 

[ol' dirty ewok]

Indeed I did change the ldv value in the options.ini file.

I counted the number of f's in fuseset lines 7-8. And he number of f's is 2. (2 f's in line 7, and 0 f's in line 8). I changed the options.ini cfldv = 2

Unless there's something else I'm missing from XeLL? Do i need to Change anything else in the options.ini file? And is there another method of getting the ldv value from XeLL?

 

[Martin C]

XeLL reports the fuses, so treat that as Gospel.

Did you flash this back using rawflash or nandpro ?

If you've not done it through rawflash, try this first.

 

[ol' dirty ewok]

Yes I have been using rawflash with the xenon.elf and my usb key w/ nandflash.bin that's been created.

Something weird happened though. I noticed that my fusesets line 7 has been augmented by 2. So instead of 2 when I originally pulled the fuseset data from xell via its webpage XeLL now shows 4? How is that possible?

I'll try rebuilding original with multibuilder, then use rawflash to dump rebuilt original just to see if it boots in original dash.

edit: got flashing red ring. No image on screen (HDMI). LDV = 4 now on glitched image.

 

[Martin C]

The ONLY way the LDV increments is if someone applies standard MS Dashboard updates to it. There you must have done this at some point in the process - it doesn't happen any other way.

You CANNOT mess about with dashboard updates once you have a good dump - you just end up having to mess about with patching and LDV values.

go back to the beginning with this console as I fear that due to you messing about with it at the very start (using donor NANDs etc) you may have already gone too far.

Did you keep the ORIGINAL NAND that you had with the first 50 blocks having ecc written on them?

 

[ol' dirty ewok]

I started off with a clean slim out of the box, Man. date of Aug 2010., updated thru USB to 13604.... then started the RGH process.

I've so far only dealt with 13604..., unit has never been on live, certainly never been updated in a traditional sense, and all it has is a local profile cause I needed to fill that out from the start since it's a never used console. The only thing I can think of that was used from an outside source was the donor nand. And maybe that what might have triggered the fuses.

Indeed I do have the original nand w/ ECC, but not the original stock dump.

But i havn't found a way to convert that nand w/ ecc to an original nand.

 

[Martin C]

So have you tried extracting the keyvault (nandpro nand.bin: -r16 kv.bin 1 1), decrypting with your CPU key and injecting into a donor NAND (with CPU key), reencrypting the whole NAND after this with your CPU key and using this to build a good retail dump in multi-builder?

 

[ol' dirty ewok]

I'll give that a go and report back. Hopefully this is the real deal.

 

[Martin C]

Don't forget to ensure options.ini has your correct LDV number!

 

[ol' dirty ewok]

one thing I noticed when building an original nand thru multibuilder is that even if you have the ldv value in the options.ini file, the LDV value stays the same as the nanddump.bin file used.

BUt if building a glitched image, it uses the correct LDV value from the options.ini file. Sorry my mistake on that. The options_r.ini is for the retail...

 

[ol' dirty ewok]

Not entirely sure on the process but i got stuck on the 2nd isntruction!

nandpro nand.bin: -r16 kv.bin 1 1
pulled my kv.bin file from the original nand w/ecc dump.

BUT weird thing is that my kv.bin file is 17kb instead of 16kb that was generated by multibuilder or some other process that i can't remember before.

When I tried loading the 17kb kv.bin into Keyvault editor it threw an error message "Error: Invalid data size"
So right off the bat I'm stuck there with this new process you recommended.

But i have other kv.bin files that are 16 KB.. which do load in keyvault, and are decrypted with my CPU key. Shows the correct info about KV type, mfr date, console id, serial #, region, OSIG and DVD key.

If I use that kv.bin then i can continue on with your instructions.
Save Decrypted, and saved Encrypted.

But now this is where i'm stuck. How do I inject the KV.bin and cpu key into the donor nand?

I previously used these instructions:

nandpro.exe nand.bin: -w16 kv.bin 1 1

but not sure about the CPU key.

So I used 360 Flash Dump tool to enter CPU key and open the donor nand

Then selected "import" and selected my 16KB sized kv.bin (had to use the encrypted file, otherwise it would jsut show bad key in 360flashdumptool) (if i tried the 17kb one, it would give me incorrect keyvault file, wrong size).

Which it showed the correct information with the imported encrypted KV.

But then was unsure what you meant by reencrypting it with my key. I see under the "patch" button there's a Rebuild Image option that allows you to enter in your CPU key.

And lastly once this is done, I entered in the CFLDV value (from xell) in the options.ini to rebuild retail.

NOticed again BTW, that in my Fuseset line 7, there's 5 F's... so it augmented again without actually doing an upgrade, so there's something i'm doing during flashing process or loading of the nand during bootup that's causing the LDV value to augment.

Not looking bright unfortunately

 

[Martin C]

The process is straightforward enough if you know what you're doing.

I'm not going to sit here and type it out step by step with pictures as I don't have the time.

You need the CPU key for the Donor NAND to inject and re-encrypt. Do you have it?

 

[ol' dirty ewok]

EUREKA!

Resolved my issue.

Solution was pretty simple.
I just so happen to look at xbox-scene.com before starting up the whole process again.
Saw that there was a new nandhealer 0.71 available.
Mentioned something about support for trinity "* Added support for trinity NAND image analysis". Said what the hell, things can't get worse than it already is, so I tried it out.

Opened the new nandhealer 0.71

selected "build glitch image" tab
Took my nand.bin w/ ecc image, and built a Trinity 13604 glitch image directly within the GUI. It used ggBuild with the correct options.ini file (cfldv = 5).

INstead of using rawflash with the newly glitched image, I used Nand-x and nandhealer to directly write to my nand.

Powered up and it booted into the dash! My eyes lit up like a Christmas tree instead of the xbox.

Mind you in nandhealer 0.70 whenever i tried to use the ecc nand dump it would throw an error and wouldn't go thru the glitch creation process.

So the question is now. Should I take this new good glitch image, and recreate my original retail nand thru multibuilder, and test it out?