Thanks for answer.
Grabbed key via xell, builded 16202 image using orginal nand dump 7371.
Flashed using demon, also tried dashlaunches patches and without.
It's boot xell using eject button, but when power on it still freeze in logo...
Reason why used Advanced demon write is i thought that it needs to be used at the all time.
Tested with normal write but it doesn't help, yes it is remapped.
LOGS:
---------------------------------------------------------------
xeBuild v1.06.555
---------------------------------------------------------------
building glitch image
<enter> key on completion suppressed
data directory overridden from command line to '.\xeBuild\16202\'
per build directory overridden from command line to 'xeBuild\data'
file name overridden from command line to 'D:\Sälät\Kirjasto\Tietokokone & konsolit\Xbox360\RGH Mod\J-Runner v02 Beta (283) Core Pack\518875183205\updflash.bin'
------ parsing user ini at '.\xeBuild\data\options.ini' ------
loading file...done!
pre-parsing and sanitizing
done!
User options.ini loaded, 0x1b1 bytes in memory
loading cpukey.txt from .\xeBuild\data\cpukey.txt
CPU Key set to: 0x0BD0C4574342CE748F46FCAED5617889
setting 1blkey from ini: 0xDD88AD0C9ED669E7B56794FB68563EFA
1BL Key set to: 0xDD88AD0C9ED669E7B56794FB68563EFA sum: 0x983 (expects: 0x983)
xex Key set to: 0x20B185A59D28FDC340583FBB0896BF91 sum: 0x800 (expects: 0x800)
Using patchsmc option (ini file)
------ parsing ini at '.\xeBuild\16202\_glitch.ini' ------
ini version 16202
ini: label [falconbl] found
found (1) 'cb_5771.bin' crc: 0x859140f0
found (2) 'none' crc: 0x00000000
found (3) 'cd_8453.bin' crc: 0x25e0acd0
found (4) 'ce_1888.bin' crc: 0xff9b60df
found (5) 'cf_16202.bin' crc: 0x752bdf18
found (6) 'cg_16202.bin' crc: 0xd8bfe2ff
ini: label [flashfs] found
found (1) 'aac.xexp' crc: 0x280c416a
found (2) 'bootanim.xex' crc: 0x0817ebbe
found (3) 'createprofile.xex' crc: 0x29823ae3
found (4) 'dash.xex' crc: 0x40bbd9ab
found (5) 'deviceselector.xex' crc: 0xb982a6d4
found (6) 'gamerprofile.xex' crc: 0xd02321c0
found (7) 'hud.xex' crc: 0xa5493707
found (8) 'huduiskin.xex' crc: 0x77318862
found (9) 'mfgbootlauncher.xex' crc: 0x5ffbc69b
found (10) 'minimediaplayer.xex' crc: 0x38b0f35e
found (11) 'nomni.xexp' crc: 0xe71f0d4c
found (12) 'nomnifwk.xexp' crc: 0x1839b40e
found (13) 'nomnifwm.xexp' crc: 0x761e6e55
found (14) 'SegoeXbox-Light.xtt' crc: 0xe0ee6049
found (15) 'signin.xex' crc: 0x6ab06853
found (16) 'updater.xex' crc: 0x836a0696
found (17) 'vk.xex' crc: 0xbc79c266
found (18) 'xam.xex' crc: 0x2bbd918a
found (19) 'xenonclatin.xtt' crc: 0xd5d17ff5
found (20) 'xenonclatin.xttp' crc: 0x7a507ad1
found (21) 'xenonjklatin.xtt' crc: 0xdde4a14c
found (22) 'xenonjklatin.xttp' crc: 0xe2adddfb
found (23) 'ximecore.xex' crc: 0x52eee832
found (24) 'ximedic.xex' crc: 0x1d992bfb
found (25) 'ximedic.xexp' crc: 0xeb032195
ini: label [security] found
found (1) 'crl.bin' crc: 0x00000000
found (2) 'dae.bin' crc: 0x00000000
found (3) 'extended.bin' crc: 0x00000000
found (4) 'fcrt.bin' crc: 0x00000000
found (5) 'secdata.bin' crc: 0x00000000
------ ini parsing completed ------
output name overridden to: D:\Sälät\Kirjasto\Tietokokone & konsolit\Xbox360\RGH Mod\J-Runner v02 Beta (283) Core Pack\518875183205\updflash.bin
------ Checking .\xeBuild\data\nanddump.bin ------
.\xeBuild\data\nanddump.bin file size: 0x1080000
nanddump header checks passed OK!
Loading NAND dump (0x1080000 bytes)...done!
Detecting NAND controller type from dump data...
NAND dump is from a small block machine
NAND dump uses small block controller
parsing dump into user and spare...
done!
decrypting KeyVault at address 0x4000 of size 0x4000
keyvault decrypted OK, will use if no kv.bin is provided
decrypting SMC at address 0x1000 of size 0x3000
SMC decrypted OK, will use if no external smc.bin is provided
seeking smc config in dump...found at offset 0xf7c000! Using if no smc config is provided.
CF slot 0 decrypted ok LDV 0x05 Pairing: 0x333d58
CF slot 1 decrypted ok LDV 0x04 Pairing: 0x333d58
setting pairing data from image to 0x333d58
LDV was already set to 6
MobileB.dat found at page 0x6960, size 2048 (0x800) bytes
MobileC.dat found at page 0x68c0, size 512 (0x200) bytes
MobileD.dat found at page 0x2cc0, size 2048 (0x800) bytes
MobileE.dat found at page 0x3760, size 1536 (0x600) bytes
Statistics.settings found at page 0x7bc0, size 4096 (0x1000) bytes
seeking FSRoot...fsroot found at page 0x2a20 raw offset 0x56e200
seeking security files...
crl.bin found in sector 0x37e size 0x9e0...verified! Will use if external file not found.
extended.bin found in sector 0x34d size 0x4000...verified! Will use if external file not found.
secdata.bin found in sector 0x37c size 0x400...verified! Will use if external file not found.
done!
Writing initial header to flash image
------ loading system update container ------
.\xeBuild\16202\su20076000_00000000 found, loading...done!
Read 0xb2f000 bytes to memory
checking container integrity...
header seems valid, version 2.0.16202.00
header hash is OK, checking content hashes...
content hashes seem OK, everything looks good!
extracted SUPD\xboxupd.bin (0x79a50 bytes)
decrypting SUPD\xboxupd.bin\CF_16202.bin (0x4560 bytes)...done!
decrypting SUPD\xboxupd.bin\CG_16202.bin (0x754f0 bytes)...done!
------ Loading bootloaders and required security files ------
reading .\xeBuild\data\smc.bin failed, using smc.bin from nand dump
reset smc load address to 0x1000 size 0x3000
reading .\xeBuild\data\kv.bin failed, using kv.bin from nand dump
reading .\common\cb_5771.bin (0x9340 bytes)
reading .\common\cd_8453.bin (0x5780 bytes)
reading .\common\ce_1888.bin (0x5606a b pad 0x56070 b)
reading .\xeBuild\data\xell-gggggg.bin (0x40000 bytes)
extracted SUPD\xboxupd.bin\CF_16202.bin (0x4560 bytes)
extracted SUPD\xboxupd.bin\CG_16202.bin (0x754f0 bytes)
reading .\xeBuild\16202\bin\patches_fat.bin (0x858 bytes)
reading .\xeBuild\data\smc_config.bin failed, using smc_config.bin from nand dump
-------------------
checking smc_config
-------------------
extracting config
------------------
SMC config info:
------------------
Target temps: Cpu: 80øC Gpu: 75øC Edram: 78øC
Max temps : Cpu: 100øC Gpu: 100øC Edram: 102øC
Cpu Fan : (auto)
Gpu Fan : (auto)
MAC Address : 00:1d:d8:76:b1:37
AVRegion : 0x00000300 (PAL50)
GameRegion : 0x02fe (PAL/EU)
DVDRegion : 2
resetKey : LRAA
---------------------
Checking for smc config data patches
smc config was not patched
---------------------
done!
patch slot offset reset to: 0xb0000
------ Patching BLs and modifying patches ------
Patching header for xell power reason
Patching BLs...Done!
------ Encrypting and finalizing bootloaders ------
encoding smc.bin size 0x3000
SMC checksum: 1d0c613e
known clean SMC found, type: Falcon v3.1(1.06)
patching smc at offset: 0x12a3
SMC glitch hacked successfully!
encoding kv.bin size 0x4000
decrypted keyvault has been set for reference
encoding cb_5771.bin size 0x9340
CB 5771 seq 0x01070058 type: 0x01 cseq: 0x07 allow: 0x0058
expected fuses:
fuseset 00: C0FFFFFFFFFFFFFF
fuseset 01: 0F0F0F0F0F0F0FF0
fuseset 02: 000000F000000000 (sequence)
fuseset 02: 000F000000000000 (allow cseq 4)
fuseset 02: 0000F00000000000 (allow cseq 5)
fuseset 02: 000000F000000000 (allow cseq 7)
encoding cd_8453.bin size 0x5b00
encoding ce_1888.bin size 0x56070
encoding xell-gggggg.bin size 0x40000
encoding cf_16202.bin size 0x4560
encoding cg_16202.bin size 0x754f0
encoding patches_fat.bin size 0x49c
done!
------ Adding bootloaders to flash image ------
adding smc.bin at raw offset 0x00001000 len 0x3000 (end 0x4000)
adding kv.bin at raw offset 0x00004000 len 0x4000 (end 0x8000)
adding cb_5771.bin at raw offset 0x00008000 len 0x9340 (end 0x11340)
adding cd_8453.bin at raw offset 0x00011340 len 0x5b00 (end 0x16e40)
adding ce_1888.bin at raw offset 0x00016e40 len 0x56070 (end 0x6ceb0)
adding xell-gggggg.bin at raw offset 0x00070000 len 0x40000 (end 0xb0000)
adding cf_16202.bin at raw offset 0x000b0000 len 0x4560 (end 0xb4560)
adding cg_16202.bin at raw offset 0x000b4560 len 0x754f0 (end 0xc0000, rest in fs)
adding patches_fat.bin at raw offset 0x000c0010 len 0x49c (end 0xc04ac)
Fixing up FS table...done!
Writing zeropair CG patch slot overflow data to sysupdate.xexp1
at raw offset 0xd0000 len 0x00069a50 (end: 0x00139a50)...done!
------ adding 25 firmware files ------
extracted SUPD\aac.xexp (0x14000 bytes) (crc32: 0x280c416a ini: 0x280c416a)
adding as aac.xexp1 at raw offset 0x139a50 len 0x00014000 (end 0x0014da50)
extracted SUPD\bootanim.xex (0x61000 bytes) (crc32: 0x0817ebbe ini: 0x0817ebbe)
adding as bootanim.xex at raw offset 0x150000 len 0x00061000 (end 0x001b1000)
extracted SUPD\createprofile.xex (0xc000 bytes) (crc32: 0x29823ae3 ini: 0x29823ae3)
adding as createprofile.xex at raw offset 0x1b1000 len 0x0000c000 (end 0x001bd000)
extracted SUPD\dash.xex (0x59b000 bytes) (crc32: 0x40bbd9ab ini: 0x40bbd9ab)
adding as dash.xex at raw offset 0x1c0000 len 0x0059b000 (end 0x0075b000)
extracted SUPD\deviceselector.xex (0xa000 bytes) (crc32: 0xb982a6d4 ini: 0xb982a6d4)
adding as deviceselector.xex at raw offset 0x75b000 len 0x0000a000 (end 0x00765000)
extracted SUPD\gamerprofile.xex (0x1b000 bytes) (crc32: 0xd02321c0 ini: 0xd02321c0)
adding as gamerprofile.xex at raw offset 0x766000 len 0x0001b000 (end 0x00781000)
extracted SUPD\hud.xex (0x1d000 bytes) (crc32: 0xa5493707 ini: 0xa5493707)
adding as hud.xex at raw offset 0x783000 len 0x0001d000 (end 0x007a0000)
extracted SUPD\huduiskin.xex (0x14000 bytes) (crc32: 0x77318862 ini: 0x77318862)
adding as huduiskin.xex at raw offset 0x7a1000 len 0x00014000 (end 0x007b5000)
extracted SUPD\mfgbootlauncher.xex (0x8000 bytes) (crc32: 0x5ffbc69b ini: 0x5ffbc69b)
adding as mfgbootlauncher.xex at raw offset 0x7b8000 len 0x00008000 (end 0x007c0000)
extracted SUPD\minimediaplayer.xex (0xb000 bytes) (crc32: 0x38b0f35e ini: 0x38b0f35e)
adding as minimediaplayer.xex at raw offset 0x7c0000 len 0x0000b000 (end 0x007cb000)
extracted SUPD\nomni.xexp (0xe000 bytes) (crc32: 0xe71f0d4c ini: 0xe71f0d4c)
adding as nomni.xexp1 at raw offset 0x7cb000 len 0x0000e000 (end 0x007d9000)
extracted SUPD\nomnifwk.xexp (0x2000 bytes) (crc32: 0x1839b40e ini: 0x1839b40e)
adding as nomnifwk.xexp1 at raw offset 0x7da000 len 0x00002000 (end 0x007dc000)
extracted SUPD\nomnifwm.xexp (0x5000 bytes) (crc32: 0x761e6e55 ini: 0x761e6e55)
adding as nomnifwm.xexp1 at raw offset 0x7de000 len 0x00005000 (end 0x007e3000)
extracted SUPD\SegoeXbox-Light.xtt (0x6000 bytes) (crc32: 0xe0ee6049 ini: 0xe0ee6049)
adding as SegoeXbox-Light.xtt at raw offset 0x7e5000 len 0x00006000 (end 0x007eb000)
extracted SUPD\signin.xex (0x16000 bytes) (crc32: 0x6ab06853 ini: 0x6ab06853)
adding as signin.xex at raw offset 0x7ee000 len 0x00016000 (end 0x00804000)
extracted SUPD\updater.xex (0x7000 bytes) (crc32: 0x836a0696 ini: 0x836a0696)
adding as updater.xex at raw offset 0x806000 len 0x00007000 (end 0x0080d000)
extracted SUPD\vk.xex (0xb000 bytes) (crc32: 0xbc79c266 ini: 0xbc79c266)
adding as vk.xex at raw offset 0x80f000 len 0x0000b000 (end 0x0081a000)
extracted SUPD\xam.xex (0x24e000 bytes) (crc32: 0x2bbd918a ini: 0x2bbd918a)
adding as xam.xex at raw offset 0x81b000 len 0x0024e000 (end 0x00a69000)
reading .\xeBuild\16202\xenonclatin.xtt (0x11b000 bytes) (crc32: 0xd5d17ff5 ini: 0xd5d17ff5)
adding as xenonclatin.xtt at raw offset 0xa6a000 len 0x0011b000 (end 0x00b85000)
extracted SUPD\xenonclatin.xttp (0x18000 bytes) (crc32: 0x7a507ad1 ini: 0x7a507ad1)
adding as xenonclatin.xttp1 at raw offset 0xb87000 len 0x00018000 (end 0x00b9f000)
reading .\xeBuild\16202\xenonjklatin.xtt (0x1a8000 bytes) (crc32: 0xdde4a14c ini: 0xdde4a14c)
adding as xenonjklatin.xtt at raw offset 0xba0000 len 0x001a8000 (end 0x00d48000)
extracted SUPD\xenonjklatin.xttp (0x7000 bytes) (crc32: 0xe2adddfb ini: 0xe2adddfb)
adding as xenonjklatin.xttp1 at raw offset 0xd48000 len 0x00007000 (end 0x00d4f000)
extracted SUPD\ximecore.xex (0x17000 bytes) (crc32: 0x52eee832 ini: 0x52eee832)
adding as ximecore.xex at raw offset 0xd4f000 len 0x00017000 (end 0x00d66000)
reading .\xeBuild\16202\ximedic.xex (0x90000 bytes) (crc32: 0x1d992bfb ini: 0x1d992bfb)
adding as ximedic.xex at raw offset 0xd67000 len 0x00090000 (end 0x00df7000)
extracted SUPD\ximedic.xexp (0x2800 bytes) (crc32: 0xeb032195 ini: 0xeb032195)
adding as ximedic.xexp1 at raw offset 0xdf8000 len 0x00002800 (end 0x00dfa800)
------ adding 5 security files ------
<- Processing crl.bin ->
reading .\xeBuild\data\crl.bin (0xa00 bytes)
crl appears crypted, attempting to decrypt with CPU key...failed! Trying alternate key...success!
adding as crl.bin at raw offset 0xdfc000 len 0x00000a00 (end 0x00dfca00)
<- Processing dae.bin ->
reading .\xeBuild\data\dae.bin (0xad30 bytes)
dae appears encrypted, attempting to decrypt with CPU key...failed! Attempting to decrypt with alternate key...
success!
adding as dae.bin at raw offset 0xe00000 len 0x0000ad30 (end 0x00e0ad30)
<- Processing extended.bin ->
reading .\xeBuild\data\extended.bin (0x4000 bytes)
adding as extended.bin at raw offset 0xe0c000 len 0x00004000 (end 0x00e10000)
<- Processing fcrt.bin ->
fcrt.bin not found and not required by keyvault, skipped
<- Processing secdata.bin ->
reading .\xeBuild\data\secdata.bin (0x400 bytes)
adding as secdata.bin at raw offset 0xe10000 len 0x00000400 (end 0x00e10400)
------ checking for Mobile*.dat ------
MobileB.dat found, adding from nanddump.bin
adding MobileB.dat as type 0x31 at raw offset 0xe14000 len 0x800 (end 0xe14800)
MobileC.dat found, adding from nanddump.bin
adding MobileC.dat as type 0x32 at raw offset 0xe18000 len 0x200 (end 0xe18200)
MobileD.dat found, adding from nanddump.bin
adding MobileD.dat as type 0x33 at raw offset 0xe1c000 len 0x800 (end 0xe1c800)
MobileE.dat found, adding from nanddump.bin
adding MobileE.dat as type 0x34 at raw offset 0xe20000 len 0x600 (end 0xe20600)
Statistics.settings found, adding from nanddump.bin
adding Statistics.settings at raw offset 0xf78000 len 0x1000 (end 0xf79000)
------ adding smc_config.bin ------
adding smc config to offset 0x00f7c000, len 0x400
------ finalizing image ------
Fixing up empty FS block entries...done!
Writing FS table to image offset 0xe24000 len 0x4000 (end 0xe28000)...done!
calculating ECD bytes and assembling raw image...done!
writing file 'D:\Sälät\Kirjasto\Tietokokone & konsolit\Xbox360\RGH Mod\J-Runner v02 Beta (283) Core Pack\518875183205\updflash.bin' to disk...done!
D:\Sälät\Kirjasto\Tietokokone & konsolit\Xbox360\RGH Mod\J-Runner v02 Beta (283) Core Pack\518875183205\updflash.bin written OK
---------------------------------------------------------------
D:\Sälät\Kirjasto\Tietokokone & konsolit\Xbox360\RGH Mod\J-Runner v02 Beta (283) Core Pack\518875183205\updflash.bin image built, info:
---------------------------------------------------------------
Console : Falcon
NAND size : 16MiB
Build : Glitch
Xell : power on console with console eject button
Serial : 518875183205
ConsoleId : 022055939117
MoboSerial: 7578445115128325
Mfg Date : 08/06/2008
CPU Key : 0BD0C4574342CE748F46FCAED5617889
1BL Key : DD88AD0C9ED669E7B56794FB68563EFA
DVD Key : 860123B1F1FE9A0A1B13342861880C82
CF LDV : 6
KV type : type2 (hashed)
---------------------------------------------------------------
xeBuild Finished. Have a nice day.
---------------------------------------------------------------
