LITEON 9504 Slim 9504 swapped with Benq update problem, what are my options?

[snk64]

Hello
somebody brought me a Slim which had its original 9504 drive swapped with a Benq from a phat.He tried to update the console from Live (like a year ago), and the console is stuck on the update error screen with the status code 23EF-351F-B800-0601-C000-001E. I tried to finish the system update from a USB stick but the xbox doesnt read the stick (tried with different usb sticks also different usb ports).

When i turn on the console the green middle led blinks, the eject doesnt work, and it takes about a half minute until the error screen shows up on the tv. The drive does not show up in JF, but i managed to get the DVDkey from it using Intro Device.

So the question is what are my options with the console? I dont have a spare 9504 lying around, but can i attempt RGH on it? I mean is the nand readable if the update has not finished?

Any help would be appreciated.

Oh i forgot to mention that he doesnt have the original dvd drive nor the original firmware from it.

 

[Martin C]

Yep, you can RGH it and build a clean image. For now, you'll need to keep it as an RGH console. Once RGH'd, you can put whatever drive you want in there. Just remember to choose the NOFCRT patch when building it.

 

[[AD]]

Or you can wait for the LT Ultimate PCBs to come out get the FCRT.bin and dvd key and away you go...

But do as Martin suggest for now if hes impatient.

 

[Martin C]

Or you can wait for the LT Ultimate PCBs to come out get the FCRT.bin and dvd key and away you go...

But do as Martin suggest for now if hes impatient.

I was going to mention that, but since it's not released and no ETA, it would be fruitless to suggest at this time...

 

[voojoo]

When i turn on the console the green middle led blinks, the eject doesnt work, and it takes about a half minute until the error screen shows up on the tv. The drive does not show up in JF, but i managed to get the DVDkey from it using Intro Device.

You sure about that ? Eject doesnot work that's mean all key has been deleted from the drive by M$ update. (Happen only benq spoof drive). If you sure you have the right key. Then just use another unlocked 9504/0225 drive and spoof with your key. about the error screen, you can put the 13599 system update on usb stick and all ready to go without doing any rgh'thing.

 

[Martin C]

You sure about that ? Eject doesnot work that's mean all key has been deleted from the drive by M$ update. (Happen only benq spoof drive). If you sure you have the right key. Then just use another unlocked 9504/0225 drive and spoof with your key. about the error screen, you can put the 13599 system update on usb stick and all ready to go without doing any rgh'thing.

And how is he going to get round the fact that his FCRT.bin will not authenticate against a 'spoofed' firmware as he doesn't have a dummy.bin?

 

[snk64]

Thank you guys for the responses, will RGH the console!

 

[voojoo]

And how is he going to get round the fact that his FCRT.bin will not authenticate against a 'spoofed' firmware as he doesn't have a dummy.bin?

as OP said he has slim 9504 swapped with benq, am i mission something ?

 

[Martin C]

as OP said he has slim 9504 swapped with benq, am i mission something ?

Yes - loads.

 

[voojoo]

if OP has just only the correct key from BenQ spoofed drive (9504 console of course). He can use the that key without any problem. Take a look at this. Work like a charm for me.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

JungleFlasher 0.1.92 Beta (304)

Session Started Mon Nov 05 11:00:50 2012



This is a 32 bit process running on 2 x 32 bit CPUs

X360USB PRO detected, Version 0.18



Found 1 I/O Ports.

Found 1 Com Ports.

Found 5 windows drives C: D: E: F: G:

Found 2 CD/DVD drives F: G:



Loading firmware file D:\_Backup_Firmware-server\BENQ\Slim-081205503108\BENQ-OFW.bin

MD5 hash: ab36d8ab3ec100da59acb3d6faa1b845

Inquiry string found

Identify string found

Drive key @ 0xE040 B5396D7250A1B828876DE1B6AC187E1E

Firmware Osig: [PBDS VAD6038-64930C ]

Firmware is: iXtreme LT 1.2

Loading firmware file D:\_Backup_Firmware-server\Slim\_350570102305_Max\OK\Lite-OFW.bin

MD5 hash: 854115b1f5ee231f0112de66cc74e2ff

Drive key @ n/a 0985797D6329337B6C0776E73A2745BB

Firmware Osig: [PLDS DG-16D4S 9504]

Firmware is: Stock

Spoofing Target

DVD Key copied to target

Key Sector copied from Source to Target

Target is LT - ID strings not copied to Target



Sending Vendor Intro to port 0x0000

Status 0x51

Re-sending Vendor Intro:

.

Serial flash found with Status 0x72



Sending Device ID request to port 0x0000

Spi Status: 0x00

Manufacturer ID: 0xC2

Device ID: 0x11

Flash Name: MXIC(MX25L2005)

Flash Size: 262144 bytes



Getting Status from port 0x0000

SPi flash found with Status 0x72



Sending Chip Erase to Port 0x0000

Erasing:

Writing target buffer to flash

Writing Bank 0: ................

Writing Bank 1: ................

Writing Bank 2: ................

Writing Bank 3: ................

............

Flash Verification Test !

Reading Bank 0: ................

Reading Bank 1: ................

Reading Bank 2: ................

Reading Bank 3: ................

Dumped in 4813mS



Write verified OK !



Restoring sector 0x3E000.



Sending Sector Erase to Port 0x0000

Erasing: 0x3E000

Writing: 0x3E000

............

Authorisation Failed!

Restore Verify Failed !

Stage 1, Complete!

Stage 2, Complete!

Done!

Sending Vendor Outro to port 0x0000

Drive is Slim Lite-On..

Sending Vendor Outro to port 0x0000

Drive is Slim Lite-On..

Sending Vendor Outro to port 0x0000

Drive is Slim Lite-On..

Drive is Slim Lite-On..

Drive is Slim Lite-On..





0000: 05 80 00 32 5B 00 00 00 - 50 4C 44 53 20 20 20 20 ...2[...PLDS

0010: 44 47 2D 31 36 44 34 53 - 20 20 20 20 20 20 20 20 DG-16D4S

0020: 39 35 30 34 00 00 00 00 - 00 00 00 00 00 00 00 00 9504............

0030: 00 00 00 00 41 30 41 30 - 00 00 00 00 00 00 00 00 ....A0A0........

0040: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................

0050: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................

0060: 44 37 31 31 43 47 30 31 - 36 38 31 30 30 30 45 55 D711CG01681000EU

0070: 47 00 00 00 G...



Sending Password to Drive on port 0x0000

Done!

Sending Vendor Intro to port 0x0000



Serial flash found with Status 0x72



Sending Device ID request to port 0x0000

Manufacturer ID: 0xC2

Device ID: 0x11

Flash Name: MXIC(MX25L2005)

Flash Size: 262144 bytes



Getting Status from port 0x0000

Serial flash found with Status 0x72

Reading Drive Key.

............

Authorised !

Grabbing sector 0x3E000.

................

Known f/w confirmed !

Drive is Slim Lite-On..





0000: 05 80 00 32 5B 00 00 00 - 50 4C 44 53 20 20 20 20 ...2[...PLDS

0010: 44 47 2D 31 36 44 34 53 - 20 20 20 20 20 20 20 20 DG-16D4S

0020: 39 35 30 34 00 00 00 00 - 00 00 00 00 00 00 00 00 9504............

0030: 00 00 00 00 41 30 41 30 - 00 00 00 00 00 00 00 00 ....A0A0........

0040: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................

0050: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................

0060: 44 37 31 31 43 47 30 31 - 36 38 31 30 30 30 45 55 D711CG01681000EU

0070: 47 00 00 00 G...



Sending Password to Drive on port 0x0000

Done!

Sending Vendor Intro to port 0x0000



Serial flash found with Status 0x72



Sending Device ID request to port 0x0000

Manufacturer ID: 0xC2

Device ID: 0x11

Flash Name: MXIC(MX25L2005)

Flash Size: 262144 bytes



Updating flash for on-line dump.



Sending Sector Erase to Port 0x0000

Erasing: 0x3E000

Writing: 0x3E000

............

Reading Bank 0: ................

Reading Bank 1: ................

Reading Bank 2: ................

Reading Bank 3: ................

Dumped in 4688mS



Restoring sector 0x3E000.



Sending Sector Erase to Port 0x0000

Erasing: 0x3E000

Writing: 0x3E000

............

Authorised !

................

Restore 0x3E000 verified !



Lite-On Dump file saved to Lite-OFW.bin

Loading firmware from buffer

Drive key @ n/a B5396D7250A1B828876DE1B6AC187E1E

Firmware Osig: [PLDS DG-16D4S 9504]

Firmware is: Stock

Key database updated



Auto-Loading firmware file D:\JungleFlasher.0.1.92.Beta(304)-3.0_Slim\firmware\LTPlus-9504.bin

MD5 hash: fb7b3d4487cc17c6518b14e57ae82cc2

Genuine Lite-On Slim 9504 LT

Drive key @ n/a FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

Firmware Osig: [PLDS DG-16D4S 9504]

Firmware is: LT-Plus

Spoofing Target

DVD Key copied to target

Key Sector copied from Source to Target

Target is LT - ID strings not copied to Target



Drive is Slim Lite-On..



Key found in KeyDB at record (234 -081205503108)

Key is: B5396D7250A1B828876DE1B6AC187E1E

Key has been tested and verified, thanks C4eva !



Target f/w saved as: Lite-CFW.bin

Sending Vendor Outro to port 0x0000

Drive is Slim Lite-On..



Key found in KeyDB at record (234 - 081205503108)

Key is: B5396D7250A1B828876DE1B6AC187E1E

Key has been tested and verified, thanks C4eva !

Sending Vendor Outro to port 0x0000

Drive is Slim Lite-On..



Key found in KeyDB at record (234 - 081205503108)

Key is: B5396D7250A1B828876DE1B6AC187E1E

Key has been tested and verified, thanks C4eva !

Loading firmware file D:\_Backup_Firmware-server\BENQ\Slim-081205503108\BENQ-OFW.bin

MD5 hash: ab36d8ab3ec100da59acb3d6faa1b845

Inquiry string found

Identify string found

Drive key @ 0xE040 B5396D7250A1B828876DE1B6AC187E1E

Firmware Osig: [PBDS VAD6038-64930C ]

Firmware is: iXtreme LT 1.2

Loading firmware file D:\Latest_iXtreme_and_Stock_Firmware_Pack-3.0\Firmware\LTPlus-0442-v3.0.bin

MD5 hash: 8784e0f4ce27941a2a3293c8a5ac85e4

Genuine LT plus v3.0

Inquiry string found

Identify string found

Drive key @ 0xA020 FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

Firmware Osig: [PBDS VAD6038 0442]

Firmware is: LT-Plus 3.0

Spoofing Target

DVD Key copied to target

Target is LT - ID strings not copied to Target





Target f/w saved as: Benq_CFW3.0.bin

Loading firmware file D:\_Backup_Firmware-server\Slim\081205503108\Benq_CFW3.0.bin

MD5 hash: ca0450b49324e7ea87cf8206af0801d1

Inquiry string found

Identify string found

Drive key @ 0xA020 B5396D7250A1B828876DE1B6AC187E1E

Firmware Osig: [PBDS VAD6038 0442]

Firmware is: LT-Plus 3.0

Auto-Loading firmware file D:\JungleFlasher.0.1.92.Beta(304)-3.0_Slim\firmware\LTPlus-0442-v3.0.bin

MD5 hash: 8784e0f4ce27941a2a3293c8a5ac85e4

Genuine LT plus v3.0

Inquiry string found

Identify string found

Drive key @ 0xA020 FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

Firmware Osig: [PBDS VAD6038 0442]

Firmware is: LT-Plus 3.0

Spoofing Target

DVD Key copied to target

Target is LT - ID strings not copied to Target

Serial data already matches



Sending Vendor Intro to port 0x0000

Status 0xD0

Re-sending Vendor Intro:

.

Serial flash found with Status 0x73



Sending Device ID request to port 0x0000

Manufacturer ID: 0xC2

Device ID: 0x11

Flash Name: MXIC(MX25L2005)

Flash Size: 262144 bytes



Getting Status from port 0x0000

SPi flash found with Status 0x73



Sending Chip Erase to Port 0x0000

Erasing:

Writing target buffer to flash

Writing Bank 0: ................

Writing Bank 1: ................

Writing Bank 2: ................

Writing Bank 3: ................



Flash Verification Test !

Reading Bank 0: ................

Reading Bank 1: ................

Reading Bank 2: ................

Reading Bank 3: ................

Write verified OK !



Sending Vendor Outro to port 0x0000

Drive is Benq..

Sending Vendor Outro to port 0x0000

Drive is Benq..

XECUTER X360USB PRO removed.

 

[Martin C]

no-one said spoofing the DVD key on a Benq was a problem.