First i would like to thank TX for the excellent Nand-X and CoolRunner products that make this RGH so easy to do, CoolShrimp for his excellent Jtag Tool app and all the other authors whose software we are using here.
Long story short I did my first Slim yesterday and upon reading the nand I had no less then 6 bad blocks that were being remapped to the end of the nand and two of those were below the 0x050 region where the ECC and Xell are being written to.
What you need for this tutorial:
1. Jtag tool
2. 360 Flash Dump Tool (comes with Jtag tool)
3. Hex Editor, I use Hex Workshop
I assume at this stage you already have two or more identical nand dumps and have encountered bad blocks in the ECC region 0x000 - 0x050 You can check the bad blocks and their remapped location in 360 Flash Dump Tool. In the following picture you can see I circled the problematic blocks.
The next stage I use Jtag Tool to UnMap my original nand, for example the actual data from 0x3FA will be placed in 0x35F and so on. Dont close Jtag Tool just yet so you dont have to re enter all the bad blocks info again later.
Now you can use Jtag Tools create ECC function or use any other tool to create your ECC file but you need to select your UnMapped nand bin file we just saved earlier. At the end you have your ECC bin file which should be approximately 1320kb however if you go and flash this into your console you will discover (at least in my case) that console never boots into Xell, all I get is a black screen. the problem is that two blocks, 0x02A and 0x02B are mapped to the end of the nand and when the Xbox tries to read them they don't contain the correct data because we never flashed them and therefore Xell probably crashes etc.
And now for the solution, open Hex Workshop and open our ECC bin file then click Ctrl+A to select all of the data and then Ctrl+C to copy it into the clipboard.
Scroll down all the way and note the last file offset, in my case it is 0014A000 and should be the same although there is no guarantee on that.
Close the ecc file and open our UnMapped nand image from before in Hex Workshop Click the 00000000 offset to make sure our start marker is at the beginning of the file then click the Edit menu and choose select blocks.
Make sure its set to Hex and Size of Block and input the offset we got from the end of the ECC file.
Now hit Ctrl+V to paste our ECC image into the beginning of the nand note you might receive and error regarding undo simply click OK, scroll up a bit and you should see red hex code, this means Hex Workshop managed to inject our ECC image now save the nand file under a name such as unamapped_ECC_FullNandimage.bin
Go back to Jtag Tool and the remap window select the umapped ecc nand we just created and click ReMap then save the new bin under a different name.
Note that if you closed Jtag Tool in the mean time you will need to re input the bad block info from 360 Flash Dump Tool.
Now we have a working ECC bin image with the correct blocks for 0x02A and 0x02B remapped to the end of the nand. simply write this bin to your nand and you should be booting Xell in no time, I know I have.
After booting Xell and getting your CPU key its pretty straight forward, ggBuild knows how to remap bad blocks automatically so you need to feed it your original untouched nand and your CPU key and you should be in business booting Freeboot in no time.
Good Luck.
Edit: Martin C posted a tutorial that does not require a Hex Editor.
Long story short I did my first Slim yesterday and upon reading the nand I had no less then 6 bad blocks that were being remapped to the end of the nand and two of those were below the 0x050 region where the ECC and Xell are being written to.
What you need for this tutorial:
1. Jtag tool
2. 360 Flash Dump Tool (comes with Jtag tool)
3. Hex Editor, I use Hex Workshop
I assume at this stage you already have two or more identical nand dumps and have encountered bad blocks in the ECC region 0x000 - 0x050 You can check the bad blocks and their remapped location in 360 Flash Dump Tool. In the following picture you can see I circled the problematic blocks.
The next stage I use Jtag Tool to UnMap my original nand, for example the actual data from 0x3FA will be placed in 0x35F and so on. Dont close Jtag Tool just yet so you dont have to re enter all the bad blocks info again later.
Now you can use Jtag Tools create ECC function or use any other tool to create your ECC file but you need to select your UnMapped nand bin file we just saved earlier. At the end you have your ECC bin file which should be approximately 1320kb however if you go and flash this into your console you will discover (at least in my case) that console never boots into Xell, all I get is a black screen. the problem is that two blocks, 0x02A and 0x02B are mapped to the end of the nand and when the Xbox tries to read them they don't contain the correct data because we never flashed them and therefore Xell probably crashes etc.
And now for the solution, open Hex Workshop and open our ECC bin file then click Ctrl+A to select all of the data and then Ctrl+C to copy it into the clipboard.
Scroll down all the way and note the last file offset, in my case it is 0014A000 and should be the same although there is no guarantee on that.
Close the ecc file and open our UnMapped nand image from before in Hex Workshop Click the 00000000 offset to make sure our start marker is at the beginning of the file then click the Edit menu and choose select blocks.
Make sure its set to Hex and Size of Block and input the offset we got from the end of the ECC file.
Now hit Ctrl+V to paste our ECC image into the beginning of the nand note you might receive and error regarding undo simply click OK, scroll up a bit and you should see red hex code, this means Hex Workshop managed to inject our ECC image now save the nand file under a name such as unamapped_ECC_FullNandimage.bin
Go back to Jtag Tool and the remap window select the umapped ecc nand we just created and click ReMap then save the new bin under a different name.
Note that if you closed Jtag Tool in the mean time you will need to re input the bad block info from 360 Flash Dump Tool.
Now we have a working ECC bin image with the correct blocks for 0x02A and 0x02B remapped to the end of the nand. simply write this bin to your nand and you should be booting Xell in no time, I know I have.
After booting Xell and getting your CPU key its pretty straight forward, ggBuild knows how to remap bad blocks automatically so you need to feed it your original untouched nand and your CPU key and you should be in business booting Freeboot in no time.
Good Luck.
Edit: Martin C posted a tutorial that does not require a Hex Editor.
Last edited:
