SlimKey + Orig Dump are 2 different keys

Status
Not open for further replies.

skatermike21988

Full Member
Nov 24, 2010
44
0
Which key works?

7512C709005E8C99E9*********

or

E638AE392AA2EE1E8D*********

See that's just It, I don't really know. Because when I load the OFW into the target it shows this key:

E638AE392AA2EE1E8D*********

I tried it with LT+ and no go. Now with the stock fw flashed to the drive and I do a slimkey I get the other key:

7512C709005E8C99E9*********

Which also does not work with LT+

Other things I have tried are taking a stock firmware that's included in the FW pack and spoofing the key to it I tried both 0225.bin and 0225u.bin stock fw. I tried both keys and that also didn't work. The only thing that seems to work is the Lite-OFW.bin

Edit: I hope you can see why I'm so confused. I did another 0225 drive before and didn't have anything like this. Just had to figure out 0225.bin or 0225u.bin and then I was up and going.
 
Last edited:

skatermike21988

Full Member
Nov 24, 2010
44
0
But Lite-OFW works only with auth failed, yes?

Load the dummy.bin into your source and flash LT+ based on that. Post the log.
Right everytime I flash Lite-OFW.bin I get the authorisation failed. The only time I didn't was when I was flashing the ones I created using the FW pack.

Here's the log you asked for:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
JungleFlasher 0.1.91 Beta (300)
Session Started Fri Jan 01 22:07:31 2010

This is a Wow 64 process running on 2 x 64 bit CPUs
X360USB PRO detected, Version 0.18

Found 1 I/O Ports.
Found 1 Com Ports.
Found 5 windows drives A: C: D: E: G:
Found 2 CD/DVD drives D: E:

Loading firmware file C:\Xbox Mods\Firmware\Backups\********\Dummy.bin
MD5 hash: deb3d19c6aaa5ceaac4ef46283a0ea6d
Inquiry string found
Identify string found
Drive key @ 0xA030 7512C709005E8C99E9**********
Firmware Osig: [PLDS DG-16D4S 0225]
Firmware is: SlimKey Extract
Auto-Loading firmware file C:\Xbox Mods\Firmware\Tools\JungleFlasher\firmware\LTPlus-0225-v2.0.bin
MD5 hash: 1012021472620cad9adf1f838497668e
Genuine LT plus v2.0
Drive key @ n/a FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
Firmware Osig: [PLDS DG-16D4S 0225]
Firmware is: LT-Plus 2.0
Spoofing Target
DVD Key copied to target
Key Sector copied from Source to Target
Target is LT - ID strings not copied to Target

Sending Vendor Intro to port 0x0000
Status 0x51
Re-sending Vendor Intro:
.

Serial flash found with Status 0x72

Sending Device ID request to port 0x0000
Spi Status: 0x00
Manufacturer ID: 0xEF
Device ID: 0x11
Flash Name: Winbond/NEX(W25P20/NX25P20)
Flash Size: 262144 bytes

Getting Status from port 0x0000
SPi flash found with Status 0x72

Sending Chip Erase to Port 0x0000
Erasing:
Writing target buffer to flash
Writing Bank 0: ................
Writing Bank 1: ................
Writing Bank 2: ................
Writing Bank 3: ................
............
Flash Verification Test !
Reading Bank 0: ................
Reading Bank 1: ................
Reading Bank 2: ................
Reading Bank 3: ................
Dumped in 12119mS

Write verified OK !

Restoring sector 0x3E000.

Sending Sector Erase to Port 0x0000
Erasing: 0x3E000
Writing: 0x3E000
............
Authorised !
................
Restore verified OK !
Drive is Slim Lite-On..

Key found in KeyDB at record (1 - **********)
Key is: 7512C709005E8C99E**************
Key has been tested and verified, thanks C4eva !
Going to go pop the drive in the console real quick to see if anything might have changed....
 

skatermike21988

Full Member
Nov 24, 2010
44
0
ok - that looks better.

Well I'm glad it does because it just started working. Any Idea as to why I would be getting 2 different keys from slimkey and the OFW?

Edit: Also wanted to say thanks for your help. This is my first Kamikazee hack. Whille doing the hack wasn't that hard I had thought I had messed up the drive. Apparently I didn't it was just a Issue with getting the keys figured out. Thanks alot for help. I've done plenty of phat consoles but only 2 slims including this one and the first one I just replaced the pcb.
 
Last edited:

Martin C

VIP Member
Jan 10, 2004
35,981
0
Scotland, UK
www.team-xecuter.com
Yeah - you basically had a bad read of the OFW. Either to do with the Kamikaze or just one of those things. Your OFW was corrupt, which is why it failed auth and the data was throwing out the key.

Try this now - re-dump an OFW based on this working drive and try again with the NEW OFW.
 

skatermike21988

Full Member
Nov 24, 2010
44
0
Yeah - you basically had a bad read of the OFW. Either to do with the Kamikaze or just one of those things. Your OFW was corrupt, which is why it failed auth and the data was throwing out the key.

Try this now - re-dump an OFW based on this working drive and try again with the NEW OFW.
Ok will do now.
 

skatermike21988

Full Member
Nov 24, 2010
44
0
Yeah - you basically had a bad read of the OFW. Either to do with the Kamikaze or just one of those things. Your OFW was corrupt, which is why it failed auth and the data was throwing out the key.

Try this now - re-dump an OFW based on this working drive and try again with the NEW OFW.
Ok so here's what I just did:

I did a read of the drive in it's current state which had LT+ 2.0 on it and working. I then manually loaded Orig-0225.bin from the FW pack and clicked spoof to target. I then flashed this new Orig.bin to the drive, but it doesn't work.

Here's a log:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
JungleFlasher 0.1.91 Beta (300)
Session Started Sun Jan 08 07:57:29 2012

This is a Wow 64 process running on 2 x 64 bit CPUs
X360USB PRO detected, Version 0.18

Found 1 I/O Ports.
Found 1 Com Ports.
Found 5 windows drives A: C: D: E: G:
Found 2 CD/DVD drives D: E:

Sending Vendor Intro to port 0x0000
Status 0x90
Re-sending Vendor Intro:
............
Serial flash found with Status 0x72

Sending Device ID request to port 0x0000
Spi Status: 0x00
Manufacturer ID: 0xEF
Device ID: 0x11
Flash Name: Winbond/NEX(W25P20/NX25P20)
Flash Size: 262144 bytes

Getting Status from port 0x0000
Serial flash found with Status 0x72
Reading Drive Key.
............
Authorised !
Grabbing sector 0x3E000.
................
Blank 3E000 sector detected!
Known f/w confirmed !
Sending Vendor Intro to port 0x0000
Status 0x51
Re-sending Vendor Intro:
.................
Serial flash found with Status 0x72

Sending Device ID request to port 0x0000
Manufacturer ID: 0xEF
Device ID: 0x11
Flash Name: Winbond/NEX(W25P20/NX25P20)
Flash Size: 262144 bytes

Updating flash for on-line dump.

Sending Sector Erase to Port 0x0000
Erasing: 0x3E000
Writing: 0x3E000
............
Reading Bank 0: ................
Reading Bank 1: ................
Reading Bank 2: ................
Reading Bank 3: ................
Dumped in 11936mS

Restoring sector 0x3E000.

Sending Sector Erase to Port 0x0000
Erasing: 0x3E000
Writing: 0x3E000
............
Authorised !
................
Restore 0x3E000 verified !

Lite-On Dump file saved to Lite-CFW.bin
Loading firmware from buffer
Drive key @ n/a 7512C709005E8C99E9*********
Firmware Osig: [PLDS DG-16D4S 0225]
Firmware is: LT-Plus 2.0
Key database updated

Drive is Slim Lite-On..

Key found in KeyDB at record (1 - *****)
Key is: 7512C709005E8C99E9C9*********
Key has been tested and verified, thanks C4eva !
Loading firmware file C:\Xbox Mods\Firmware\Tools\JungleFlasher\firmware\Orig-0225.bin
MD5 hash: 450a16f4672662eb47b540323bc778a7
Drive key @ n/a FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
Firmware Osig: [PLDS DG-16D4S 0225]
Firmware is: Stock
Spoofing Target
DVD Key copied to target
Key Sector copied from Source to Target
Target is LT - ID strings not copied to Target

Sending Vendor Intro to port 0x0000
Status 0x51
Re-sending Vendor Intro:
.....................................
Serial flash found with Status 0x72

Sending Device ID request to port 0x0000
Spi Status: 0x00
Manufacturer ID: 0xEF
Device ID: 0x11
Flash Name: Winbond/NEX(W25P20/NX25P20)
Flash Size: 262144 bytes

Getting Status from port 0x0000
SPi flash found with Status 0x72

Sending Chip Erase to Port 0x0000
Erasing:
Writing target buffer to flash
Writing Bank 0: ................
Writing Bank 1: ................
Writing Bank 2: ................
Writing Bank 3: ................
............
Flash Verification Test !
Reading Bank 0: ................
Reading Bank 1: ................
Reading Bank 2: ................
Reading Bank 3: ................
Dumped in 11903mS

Write verified OK !

Restoring sector 0x3E000.

Sending Sector Erase to Port 0x0000
Erasing: 0x3E000
Writing: 0x3E000
............
Authorised !
................
Restore verified OK !
Drive is Slim Lite-On..

Key found in KeyDB at record (1 - ****)
Key is: 7512C709005E8C99E9C94*********
Key has been tested and verified, thanks C4eva !
Sending Vendor Outro to port 0x0000
Drive is Slim Lite-On..
 

Martin C

VIP Member
Jan 10, 2004
35,981
0
Scotland, UK
www.team-xecuter.com
ok - one more to try:

load your good dummy.bin, then manually load the stock 0225 as above and spoof source to target.

Write to the drive and test. Let me know what happens.
 

skatermike21988

Full Member
Nov 24, 2010
44
0
ok - one more to try:

load your good dummy.bin, then manually load the stock 0225 as above and spoof source to target.

Write to the drive and test. Let me know what happens.
Did just that and it was also a no go. Here's the log:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
JungleFlasher 0.1.91 Beta (300)
Session Started Sun Jan 08 08:14:52 2012

This is a Wow 64 process running on 2 x 64 bit CPUs
X360USB PRO detected, Version 0.18

Found 1 I/O Ports.
Found 1 Com Ports.
Found 5 windows drives A: C: D: E: G:
Found 2 CD/DVD drives D: E:

Loading firmware file C:\Xbox Mods\Firmware\Backups\*********\Dummy.bin
MD5 hash: deb3d19c6aaa5ceaac4ef46283a0ea6d
Inquiry string found
Identify string found
Drive key @ 0xA030 7512C709005E8C99***********
Firmware Osig: [PLDS DG-16D4S 0225]
Firmware is: SlimKey Extract
Loading firmware file C:\Xbox Mods\Firmware\Tools\JungleFlasher\firmware\Orig-0225.bin
MD5 hash: 450a16f4672662eb47b540323bc778a7
Drive key @ n/a FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
Firmware Osig: [PLDS DG-16D4S 0225]
Firmware is: Stock
Spoofing Target
DVD Key copied to target
Key Sector copied from Source to Target
Target is LT - ID strings not copied to Target

Sending Vendor Intro to port 0x0000
Status 0x51
Re-sending Vendor Intro:
.

Serial flash found with Status 0x72

Sending Device ID request to port 0x0000
Spi Status: 0x00
Manufacturer ID: 0xEF
Device ID: 0x11
Flash Name: Winbond/NEX(W25P20/NX25P20)
Flash Size: 262144 bytes

Getting Status from port 0x0000
SPi flash found with Status 0x72

Sending Chip Erase to Port 0x0000
Erasing:
Writing target buffer to flash
Writing Bank 0: ................
Writing Bank 1: ................
Writing Bank 2: ................
Writing Bank 3: ................
............
Flash Verification Test !
Reading Bank 0: ................
Reading Bank 1: ................
Reading Bank 2: ................
Reading Bank 3: ................
Dumped in 11953mS

Write verified OK !

Restoring sector 0x3E000.

Sending Sector Erase to Port 0x0000
Erasing: 0x3E000
Writing: 0x3E000
............
Authorised !
................
Restore verified OK !
Drive is Slim Lite-On..

Key found in KeyDB at record (1 - ***********)
Key is: 7512C709005E8C99E9C*********
Key has been tested and verified, thanks C4eva !
Sending Vendor Outro to port 0x0000
Drive is Slim Lite-On..
 

skatermike21988

Full Member
Nov 24, 2010
44
0
ok - was expecting that to work.

Just confirm that dummy.bin as source and autoload LT still works!
If it doesn't I did save a full read of the working LT on my PC so hopefully either one will work. Going to check now.

---------- Post added at 06:35 ---------- Previous post was at 06:26 ----------

ok - was expecting that to work.

Just confirm that dummy.bin as source and autoload LT still works!
OMG what is it with this drive that's making it such a pain.

Just tried to auto load LT+ from dummy and it didn't work again. Gonna try the dump i took of it when it was working and hopefully it's good again.
 

Martin C

VIP Member
Jan 10, 2004
35,981
0
Scotland, UK
www.team-xecuter.com
It could be the work you did to unlock it. You're getting bad writes to the drive.

Keep using dummy.bin as the source as it's the data you took before cutting into the chip.

Failing that, replace the chip or PCB.
 

skatermike21988

Full Member
Nov 24, 2010
44
0
Ok so I just tried the "working" LT+ dump I took and it's not working now either. I don't get it.

---------- Post added at 06:43 ---------- Previous post was at 06:40 ----------

It could be the work you did to unlock it. You're getting bad writes to the drive.

Keep using dummy.bin as the source as it's the data you took before cutting into the chip.

Failing that, replace the chip or PCB.
Alright, I'm just gonna wait on 3.0 and then mess with it to get it working again. Still doesn't make sense though, because every time I flash the Lite-Orig.bin it works with the exception of the failed authorisation. If I was getting the occasional bad writes, wouldn't it affect that as well.
 

Martin C

VIP Member
Jan 10, 2004
35,981
0
Scotland, UK
www.team-xecuter.com
As I said, load dummy.bin - let JF load the firmware.

(we know this works)

Write to your drive and test. If it doesn't, leave everything as is in JF and intro/write again.

Keep doing it until it works.

Once it works, leave it as is.

EDIT: I still reckon this is down to you cutting something in the chip. A replacement PCB/Drive would prove it.
 

skatermike21988

Full Member
Nov 24, 2010
44
0
As I said, load dummy.bin - let JF load the firmware.

(we know this works)

Write to your drive and test. If it doesn't, leave everything as is in JF and intro/write again.

Keep doing it until it works.

Once it works, leave it as is.

EDIT: I still reckon this is down to you cutting something in the chip. A replacement PCB/Drive would prove it.
I have a 0225 drive with a replacement pcb in it. I will try later today to flash it with the dummy as source and pop it into the other console and see how it goes.
 

skatermike21988

Full Member
Nov 24, 2010
44
0
Ok I just tried with my drive that has a replacement pcb. I also had mixed results using dummy.bin as source. It worked one minute and then I tried to make a new orig.bin and then it didn't work again. I'm just going to wait on 3.0 and get it working and leave it.
 
Status
Not open for further replies.