TX COOLRUNNER REV C *NEW* ONLY $19.99

Xecuter CoolRunner Rev C – In production and shipping next week to all major Xecuter resellers.

Xecuter Liteon DG-16D4S Unlocked PCB updated to version 1.1

After many requests from resellers and customers we have added a small upgrade to the next batch of Unlocked PCB's

Known as version 1.1, the new TX Liteon DG-16D4S Unlocked Replacement PCB now has the unlock switch moved to the outside of the DVD drive so you can easily lock/unlock the write enable without having to take the drive apart.

We have also included LED's to indicate the boards WE status.

Due to it's huge success and ability to buy larger quantities of IC, we have also been able to lower the price by a massive $10 so the MSRP is now only $59.95.

Stock has already started to arrive at resellers so you don't have to wait to buy one

Click here for more pictures and install guides

Xecuter Fusion v1.0.6 Beta Released To Testers

We are happy to announce that the first version of the Xecuter Fusion project has been released to beta testers.

We have created a new forum to get support and also discuss features and offer your own input: CLICK HERE

While we have tried to make this as solid as possible for the first release, remember this is in beta so there may be bugs and other issues. We will not be held responsible for any damage that you may do to your Xbox by using these files. Everything you do is at your own risk. If you mess up don't cry, we are not your Mom and will not hold your hand.

Features of Xecuter Fusion as of v1.0.6

Requirements:
RGH/RGH2 Console (JTAG Not Supported)

+ Turns console into full devkit
– Console has full devkit functionality
– Test kits have debugging and memory editing capabilities
– Partnernet has been blocked
– Slim devs that show up as test kits now show up as full devs

+ XEX security checks removed
– Region checks removed
– Bounding path checks removed
– Library version checks removed
– Module import version checks removed
– Media id checks removed
– Module hash checks removed

+ XGD security removed
– Bypass xgd authentication, loads retail game disks
– AP2.5 checks removed

+ Run retail executables
– Executables checked with devkit rsa key, if signature fails it
is loaded with retail encryption keys

+ Container security checks removed
– Rsa signature check removed
– License checks removed
– Arcade games run as full, even when extracted

+ Xbdm.xex
– Mounts all internal drives
– Mounts Firmware folder

+ Hud.xex
– "Family Settings" changed to "Firmware Settings", runs config manager on press

+ Dash.xex
– Games copied to the hard drive via the dashboard no longer require the disk to be in the drive to be played

+ Fusion added features
– Boot in safe mode by pressing eject to boot (dev only)
– Loads alternate system files from Firmware\Kernel\
– Both devkit and retail hardware/accessories work
– Switch between retail or devkit system link encryption
– Switch between retail or devkit system encryption
– Bypass booting to dev launcher
– Pair any dvd drive to console
– Display cpukey, dvdkey and other important information
– Both retail and devkit profiles can be used simultaneously
– Multi disk games can be ran from hdd without problems
– Trainer launcher accessible through hot-key launch

Notes

– The custom boot animation has a small side effect where the console will take a bit longer to boot. The reason for this is that the animation does not start playing at first boot, rather it plays once the console is fully booted. It is being worked on and will be fixed soon.

– Multi-Disk Games
Multi disk games can now be run from the hard drive and still function properly when the game requests to switch disks. In order for Fusion to auto detect and switch to the next disk of a game, the game must be put into a special folder structure. Every disk for the game needs to be ripped to its own folder named disc1, disc2, etc. Each disk folder must be placed inside a folder just for that game.

Here is an example folder hierarchy:

\Battlefield 3\
\Battlefield 3\disc1\
\Battlefield 3\disc1\…
\Battlefield 3\disc2\
\Battlefield 3\disc2\…

Main Advantages & Features

– Retail Keys added in to allow use of anything that would work on a retail console. This includes hardware and software. Games like rockband require the retail keys to work.
This was a problem in the past and therefore rockband was unable to be "backed up".This also allows the user to use retail and XDK user profiles. Making it convenient instead of having to resign a profile to work with dev or vice versa. Your profiles will also get resigned but its resigned with retail keys.

– System link. Our system link in fusion will allow you to system link between dev and retail with no problems. Ping limit also removed out of the box so no need to run an app to do this.

– DVD Pairing. Tired of manually pairing your drive to the console? all you have to do once fusion is installed is pop the drive in and hit "Pair Drive".You do not even need
your dvd key from the keyvault or from the drive to perform this.

– Custom Boot Animations. The current Animation is hardcoded at the moment. For future releases the end user will be able to fully customize the stock boot animation

– Trainer Launcher. An SDK is being built for this. However, its currently ready and in place for use. Once the SDK is ready itll make it easier for users to make their own trainers
and game hacks.

– Multi Disc Game Support. Unlike previous rebooters and other hacked kernels. Our multidisc support works much better. Once finished with the first disc the console will automatically
find the next disc and load it as long as its in the proper file structure.

– Debug XEXs. Our kernel will run both retail and debug xexs. Even if the retail flag is not set in place. For example the leaked Forza 2 dev build on usenet and other developer beta games and apps.

– Arcade Patch. This was previously attempted in rebooters and such like freeboot. However, it was never 100% perfect and didnt work for every game. This patch was redone for full compatibility.

– Easier Access to DVD and CPU key. Tired of having to run xell every time you needed a cpukey? All you have to do now is go into Firmware Settings and you now have easy access to this info.

– HDD Load. RGLoader uses something similar to this by loading the flash files from HDD. However, ours loads 10x faster. This means no lag or choppiness when running anything.

– ISO Install of HDD files. Nuff said. Absolutely no need to install files to hdd manually. Once you install the flash image just run the iso in the console and itll install those files for you. This also means there is no need to go hunting for files.

– Re-purposed Family Settings to "Firmware Settings". Since we hackers most likely do not care much about family settings and restrictions… We went ahead and changed that over to our firmware settings tab. This is the option where you go to get your cpukey and other unique information that Xell or Xellous used to give you. All in all xell and xellous are no longer needed unless you plan to boot linux. Future release of fusion will allow linux booting.

– XGD Auth bypassed. Load retail game discs on a XDK kernel. Aswell as all AP2.5 checks removed. No need for FCRT.BIN or any extra files for this.

Changelog

v1.0.6 (File Pack Size – 71MB)
+ Ported to retail consoles
+ Added XeKeys status to ConfigManager console info screen
+ Trainer launcher added, accessible through hot-key launch

v1.0.5
+ Hdd load redone, now works 10x better
+ Arcade license patch fixed to work with all arcade games
+ Hud.xex button remaps now work when in dashboard
+ Kernel folder has been changed to Firmware
+ Neighborhood now maps a few more drives
+ Major code/patch revamp and clean up
+ Retail and devkit profiles can be used, all profiles written as dev
+ Games ripped to the hdd no longer need the disc in drive to play
+ Minimum version check on module imports removed
+ Removed hdd authentication checks, retail and dev hdds now work
+ Multi disk games can be ran from the hdd without problems

v1.0.4
+ Changed hdd loader to be dynamic
+ Fixed a bug with HvxPeekPoke
+ Repurposed "Family Settings" in hud.xex to "Firmware Settings"
+ Added Config Manager to change fw settings
+ Xbdm.xex patched to show all drives in explorer
+ Xbdm.xex now mounts Kernel
+ Xex module hash checks removed
+ Fixed a dvd drive pairing bug in ConfigManager
+ Fixed a bug in xbdm.xex with mapping KERNEL:\\

v1.0.3
+ Hv extensions re-enabled
+ All XeKeys values unblocked
+ Syscall 0x75 is HvxPeekPoke(ULONGLONG Dst, ULONGLONG Src, DWORD Size)
+ Loads retail xex files
+ Loads retail game disc's
+ Bypass xex version/media/bounding path/region checks
+ Xam/xbdm/bootanim.xex are loaded from Hdd:\Kernel\
+ Boot into recovery mode by eject press
+ Unsigned containers allowed
+ Unlicensed/unpackaged arcade games are full
+ Slim testkit bug fixed
+ Internal drive map always enabled

Fusion added features
– Boot in safe mode by pressing eject to boot (dev only)
– Loads alternate system files from Firmware\Kernel\
– Both devkit and retail hardware/accessories work
– Switch between retail or devkit system link encryption
– Switch between retail or devkit system encryption
– Bypass booting to dev launcher
– Pair any dvd drive to console
– Display cpukey, dvdkey and other important information
– Both retail and devkit profiles can be used simultaneously
– Multi disk games can be ran from hdd without problems
– Trainer launcher accessible through hot-key launch

Thanks & Greetz go out to who were directly or indirectly involved in the Fusion project.

TheFallen93, Sonic-Iso, Xenon.7, Redline99, Tiros, c0z, l_oliveira, MODFREAKz, xorloser, k3rn3l, Podger, RF1911, tydye81 & RickyB82.

Xecuter Defeats Corona !

As promised we have defeated Corona. Full decrypted bootchain achieved and CPU key retrieved.

Xecuter does it again – 10 years and still rockin'. Greets to the haters.

More news soon – here's some screen shots of the NAND Dump – the box is still live so a few portions of info were blocked. However if you doubt this is real you should go to the back of the noob line.

Xecuter RGH2.0 – Jasper Fix Release

Xecuter J-R Programmer *NOW SHIPPING*

The new Xecuter J-R programmer has been created to cater to the budget conscious and coded to work hand in hand with the latest version of the J-Runner app.

A third of the size of the Xecuter NAND-X and optimized to run faster than any other USB-SPI based tool (Example Speeds: Others average 16M read 7m 20s, JRP average 16M read 5mins 40 secs), this nifty tool can fully read/write NAND over SPI and can also program the Xilinx CoolRunner Dev Boards over USB !

Complete with a CoolRunner JTAG cable so you simply plug 'n program without any soldering using the latest J-Runner App (needs to be at least Build 268). Also comes with NAND installation wires that have the connectors that are compatible with the NAND-X QSB boards. If you don't use the QSB's you can simply cut off the connectors and do a normal wires only install.

The J-R programmer is also fully upgradeable and can be programmed using the Xecuter X360USB PRO Update app. Onboard LED's indicate Power and Bootloader Mode .

RED LED: Bootloader Mode (Switch to the left)
GREEN LED: J-R Programmer Mode (Switch to the right)

Features:

• Fast NAND Programming
• Fast XILINX CoolRunner JTAG Programming
• Compatible with both Phat and Slim
• Onboard LED's indicate Power & Data
• Easy Install System
• Compatible with All NAND-X QSB's
• Includes Cable For QSB or Wires Install (QSB Sold Separately)
• Includes Cable For Xilinx CoolRunner JTAG
• Includes KIOSK option for Remote Reset
• Built-in Programmer For Future Firmware Upgrades
• Designed for the latest J-Runner App (Build 270+)
• Rock Solid Design – Tested by the J-Runner Team
• Supports New CoolRunner/NAND-X QSB Kits (Solder Separately)
• Affordable – We Provide You With More For Less !
• High Quality & Trusted Xecuter Design

What's In The Kit:

• J-R Programmer
• NAND Cable Set (Can fit to optional QSB or cut use as wires install)
• CoolRunner JTAG Cable Set

Download:

• Latest J-Runner
• Windows Drivers
• Update App

On sale from May 1st at all good Xecuter stockists only $24.95

EDIT: Updated average read speeds. Some setups will be faster, some may be slower.

Xecuter X360USB PRO V2 Now In Production !

Xecuter RGH2.0 JED Files & Other Updates

Here are the JED and XSVF files for the Xecuter RGH2.0 Release – http://www.qfpost.com/file/d?g=22gaEK4p6

A few questions were raised that we should clarify.

If you are on 14699 or below with no DVD Drive and no Drive Key you can still use original RGH to get your CPU Key if you are on CB 6750
If you are on 14699 or below with no DVD Drive and no Drive Key you can still use the Xecuter RGH2.0 to get your CPU Key if you are on CB 5772/6752
If you are on 14717 or above with no DVD Drive and no Drive Key you can still use the Xecuter RGH2.0 to get your CPU Key if you are on CB 6752/6753

Simply use our RGH2.0 builder and the TX CoolRunner instructions and you will be able to run Xell and get your CPU/DVD Key.

The fact is we do not use the XOR hack on 5772/6752 – we use the rc4/keystream trick so no XOR hack at all is required or used below 14717. Of course we can give you this info as it's our code in the first place. Funny how that works……

We appreciate any feedback and results from your own tests. All input is welcome.

Also thanks to Juvenal in #libxenon for pointing out some linux corrections in the build.py

<@Juvenal>your build.py from rgh2.0 does not work on linux because of the way you did paths :/
<@Juvenal> instead of using double backslashes for path delims you should do: os.path.join('common', 'CB', 'file.bin')
<@Juvenal> that will make it platform independent

Here is our updated RGH2.0 build.py script for Xell to make it cross platform compatible: http://pastie.org/3804506

Xecuter RGH2.0 Official Release

Team Xecuter RGH2.0 For CoolRunner Rev A and B

We were not quite ready to release this due to it's unstable boot times on older glitch hardware, but as our code was leaked from a team member AGAIN we had to release this due to another team stealing the code and claiming as their own work. They were even too lazy to change any of the patches to make it look like their own – they are 1:1 same as our original sources. Super lame. It seems some teams think this is the Wii or PlayStation scene and you can act like this. They don't even give credits to cOz for his SMC patcher – because they didn't even know that code was from him of course.

We don't want to get dragged down into bullshit scene politics – most of you won't care anyway, but a lot of guys work very hard on this stuff only to have it stolen with no effort and no credits is just sad. Anyway……

The Xecuter RGH Development Team are pleased to announce the official release of the RGH2.0 hack for all CoolRunner Rev A and Rev B dev boards. All Phat consoles have now been defeated and are totally glitch-able without having a previous NAND dump or CPU KEY (the same applies to Slim Trinity that have been updated to 14717/14719).

We have included all of the build.py and xebuild scripts for your convenience. Please give the correct credits if you use our work.

Xecuter RGH2.0 Features introduced:

• Hack now works on new CB's (14717/14719 update)
• Hack now works with all Refurbished Split CB's (4577, 5772, 6752)
• Zephyr CB 4578, 4575, 4577
• Falcon/Opus CB 5771, 5772, 5773
• Jasper CB 6750, 6752, 6753
• Trinity (Slim) CB 9188, 9230

To confirm, we can now glitch Phats with any kernel and any bootloader. As soon as you have your CPU KEY, and you are using an Xecuter DemoN you will ALWAYS be able to switch to a fully hacked NAND and it can never be stopped no matter what update you apply and no matter which efuses are blown !

Technical Info

In the slim boot chain the 2nd bootloader (CB) is split into two pieces. The first part simply starts encryption and loads the second part, which does fuse checks and all the things that the old single CB did. By glitching the first part (CBA), we take control of the system before the fuse checks occur and can patch them out. The slim bootchain has always used this layout and some groups have even tried bringing the slim CBA to phat and using the old single phat (RGH1) CB as CBB. Glitching this way will work if you set it up right, but there are actually phat xboxes that already have their own split CB boot chain which were mostly ones that had been refurbished (CB 5772, 6752, 4577).

What we have done is simultaneously find glitch timings for these refurbs, dump their cpu_key, decrypt the boot chain, and port it to run on every other phat! This means that on phats we can now glitch before the fuse check and thus have an unpatchable hack just like trinity!

New Xecuter CoolRunner v2 Hardware

There have been many obstacles to cross with this because CBA glitching does not behave quite the same as CB glitching. The Coolrunner revisions A&B will glitch for RGH2.0 but results will vary and with some, boot times can be worse than trinity and with others they may be instant. These boot times are unacceptable and this is why we have spent the last few weeks designing a new glitch chip that will solve all these problems and will even help with trinity and corona boot times

New Xecuter CoolRunner v2 Upcoming Features:

• Corona support
• Much better glitch times for RGH1 and RGH2
• All-in-One code for all versions
• Demon integration
• Level shifted POST output
• …and much more

Development is almost complete – find an image of the CR v2 dev unit in this release pack.

Building an Image

With RGH2, a cpu_key is necessary for building the NAND image. The reason for this is because cpu_key encryption starts at CB, and in RGH1 there was only one CB which meant that CD was encrypted with cpu_key but CB could be "zero paired" which meant that the cpu_key would not be applied. When split-CB was added, they started the encryption at CBA and removed the zero pairing option, which means that cpukey encryption on CBB is mandatory. Because of a vulnerability in the way they use RC4, if you have a stock NAND image that already has a CBB encrypted on it, we can derive the keystream used in that image because we know what the CBB looks like decrypted (we have already decrypted that version before). Because of this, we can embed the older vulnerable CBB into the NAND image using the keystream.

Bottom line is, after the 14717 update they turned all phats into a split CB boot chain but using unglitchable bootloaders. We can still glitch these boxes even when we don't know the cpu_key because we can use the "XOR hack" to embed the RGH2 bootloaders. For older images (pre-14717) we need the cpu_key to encrypt the new loaders because there is not a CBB already in the image that we can derive a keystream from.

Once the cpu_key is retrieved, you can always build a NAND image for RGH2'ing your machine. You can flash back to stock, update, even burn all your fuses and you would still be able to run RGH2.

For building a xell image, read the readme in XECUTER_RGH2_Xell.

For an xebuild image (if you have your cpu_key already) browse to XECUTER_RGH2_Xebuild.

Instructions

First wire up your Xecuter CoolRunner according to the diagram provided. RGH2.0 Requires that you either already have your cpu_key or you are on dashboard 14717/14719. This means that if you do not have your cpu_key, you must run xell first to retrieve your fuses.

COOLRUNNER CPLD PROGRAMMING

The XSVF files are located in \xsvf folder. Start with the xsvf recommended below, however every xsvf should run on every motherboard, but one of them will work best for your setup.

Falcon/Opus: Program either TX_RGH2_B.xsvf, or TX_RGH2_C.xsvf

Jasper: Program either TX_RGH2_A.xsvf, or TX_RGH2_D.xsvf

Zephyr: Program either TX_RGH2_D.xsvf, or TX_RGH2_C.xsvf

Please enjoy this release and report any interesting tweaks you may find. Our forums at www.team-xecuter.com/forums offer excellent support and we would be glad to help and receive feedback from you.

CREDITS:

If you are going to use RGH2.0 please give credits to the Team Xecuter RGH development Team. Don't be lame and try to claim the work as your own.

Thanks to Tiros & GliGli for their original RGH work.
Thanks to cOz for his universal SMC patcher.
Thanks to all the Xecuter developers and official testers. You know who you are.
Thanks to Ubergeek for the diagram.
Thanks to the asshole who leaked our code for others to steal and claim as theirs. Super lame.

DOWNLOAD COMPLETE PACKAGE (NEW LINK WITH JASPER FIX HERE)

TX Fusion Update

Do not mistake our silence as no progress on the Fusion project.

Things are progressing nicely and we have seen major advancements in the roadmap.

Here's a little teaser, a piece of software that will become pretty famous in the coming months.

Note that this is an internal demo screenshot – the end result will be much different.