Also included is FREE shipping for orders of $150 or over (selected countries only).

Foundmy.com have decided to create a Coolrunner/NAND-X Monster Bundle for $59.95 and a Parallel bundle for $33.95,    Both sets will include the Jasper 68nf cap fix for FREE!

                      Coolrunner Nand-X Monster Bundle

1x Coolrunner PCB
1x Nand-X Complete Kit
1x Nand-X updated to latest v3 firmware
1x Nand-X to Coolrunner Update Cable
1x Coolrunner QSB PCB (Phat or Slim) Version
1x Solder

Info/Purchase:  Here

Coolrunner Parallel Bundle

1x Coolrunner PCB
1x Coolrunner LPT Parallel Update Cable
1x Coolrunner power adapter for ck3.
1x Coolrunner QSB PCB (Phat or Slim) Version
1x Solder

Info/Purchase:  Here

Related posts:

1. Xecuter CoolRunner Now In Production and Nand-X Update From team-xecuter.com (http://team-xecuter.com/xecuter-coolrunner-now-in-production/ ): [QUOTE] As many of you are...
2. Xecuter CoolRunner ? Now Shipping and Installation Images From team-xecuter.com (http://team-xecuter.com/xecuter-coolrunner-final-production-images/?utm_source=rss&utm_medium=rss&utm_campaign=xecuter-coolrunner-final-production-images ): [QUOTE] Here are the final production...
3. Team Xecuter CoolRunner: New Nand-X Addon for Reset Glitch Hack From team-xecuter.com (http://team-xecuter.com/forums/showthread.php?t=69758 ): [QUOTE] Due to the new reset...

Related posts brought to you by Yet Another Related Posts Plugin.

A new FW and a new version of XBC will be released to get you up and running again in no time.

We can also confirm that C4E has finished the Hitachi LT 2.0 fw (not affected by DAE/AP25) and will be releasing that as soon as its gone through final testing.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

The drives are stock from the manufacturer/factory Liteon iHAS124 Rev B.  The drive can have its firmware upgraded by using an X360USB PRO or compatible SATA card.

Buy from Foundmy.com

Related posts:

1. Wasabi360 x360S (slim) In stock @ Foundmy.com The Wasabi360 x360S (slim) Optical Drive Emulator is now in...
2. C4E’s iXtreme Burner Max in association with Team Jungle and Team Xecuter From team-xecuter.com (http://team-xecuter.com/c4e%E2%80%99s-ixtreme-burner-max-in-association-with-team-jungle-team-xecuter/?utm_source=rss&utm_medium=rss&utm_campaign=c4e%25e2%2580%2599s-ixtreme-burner-max-in-association-with-team-jungle-team-xecuter ): [QUOTE] As you may or may...
3. XECUTER X360USB PRO HDD Hacker Tool Released From team-xecuter.com (http://team-xecuter.com/xecuter-x360usb-pro-hdd-hacker-tool-released/ ): [QUOTE] The last four weeks have...

Related posts brought to you by Yet Another Related Posts Plugin.

• Unique, intuitive on-screen user interface – navigate the ISO list directly from the Xbox 360 dashboard using your controller. No need to interact with a small remote/LCD for feedback or navigation. No need to ever leave the sofa.

• Solderless installation
• Support for XGD3 games
• Support for AP25 protected games, without needing to patch ISO’s
• ESATA interface is used in place of USB providing superior performance, since data is transferred directly between the ESATA HDD and Xbox 360 resulting in impressively high bandwidth, many times faster than reading from a real DVD disc. See our speed comparison!
• Elegant and streamlined console inspired case design
• Versions available for both fat and slim consoles
• NTFS file system natively supported
• Multi-disc games fully supported
• Powerful embedded CPU running performance tuned Real Time Operating System
• Regular firmware updates available free for download
• Fully updatable hardware (MCU and FPGA’s) from ESATA HDD including a failsafe recovery mode
• No need to flash or in any way modify your original ODD
• Hardware selectable pass through mode – allowing games to be played from the original disc drive in a 100% Xbox Live safe manner
• Latest supported Xbox 360 dashboard version: 2.0.13599.0
— More features to come!
• Limited Stock in hand!

Buy now from: Foundmy.com

Related posts:

1. Wasabi X360 and X360S From wasabi360.com (http://www.wasabi360.com ): [QUOTE] The ultimate ODDE (Optical Disc...
2. 0225 Liteon PCB’s (MCIX) $55 at Foundmy.com Foundmy.com has got some 0225 (MXIC) replacement PCB’s in stock...
3. C4E iXtreme Slim LT+ Firmware for LiteOn DG-16D4S 9504 C4Eva (in association with Team Jungle & Team Xecuter) released...

Related posts brought to you by Yet Another Related Posts Plugin.

[2011-09-25 02:52AM UTC] #c4e <c4eva> Successful testing of LT 2.0 with new LT-MAX feature for DVD R DL. XGD3 ixtreme isos playing fine from DVD R DL disc and/or install to HD
[2011-09-25 02:57AM UTC] #c4e <EnigmaFX> does this Mean we can use or regular dual layer media / burners and layer break 1913760? Or has that changed ?
[2011-09-25 02:58AM UTC] #c4e <c4eva> regular DL media, yes!
[2011-09-25 02:59AM UTC] #c4e <supakilla> c4eva is the layer break still the same
[2011-09-25 03:00AM UTC] #c4e <c4eva> more details soon!
[2011-09-25 03:01AM UTC] #c4e <c4eva> normal blanks, normal burner!
[2011-09-25 03:03AM UTC] #c4e <c4eva> XGD3=defeated!

Related posts:

1. More about New Disc Format (xgd3) and C4Eva Comments From eurogamer.net (http://www.eurogamer.net/articles/digitalfoundry-1gb-360-disc-upgrade ): [QUOTE] A highly placed development source...
2. C4Eva: 0225 progress – LT2.0 with XGD3 Support, x360key Some updates from C4Eva about the Slim 0225 CFW that...
3. LT+ 1.91 Soon & AP2.6 Defeated, No need to reburn! Looks like C4eva has worked his magic again.   LT+ 1.91...

Related posts brought to you by Yet Another Related Posts Plugin.

SeedboxSolutions.com are giving a 10% recurring discount to xblog readers on their shared slots 1-3 by using promo code XBLOG10

Enjoy!

Related posts:

1. SeedboxSolutions.Com FREE INSTALL CODE!!! SeedboxSolutions.com have removed installations costs for there French dedicated servers...
2. SeedboxSolutions.com New Site/Products! An affiliate our ours has just redesigned their site and...
3. Cased x360 USB Pro’s now in stock!! Been waiting for the cased version of the X360 USB...

Related posts brought to you by Yet Another Related Posts Plugin.

Foundmy.com has got some 0225 (MXIC) replacement PCB’s in stock for $55 so if you have been looking for a replacement board to repair/unlock your liteon head on over.

http://www.foundmy.com/oscom/xbox360-slim-liteon-16d4s-replacement-pcb-spi-p-445.html

Related posts:

1. Lite-On 0225/0401 Unlock Kit (Pre-Order $19.99/$54.95) This is also known as the Solderless 0225 / 0401...
2. New system update 13599 disabling writing of fw!! Looks like the new system update that is been rolled...
3. Team Xecuter Liteon DG-16D4S 0225/0401 Write Solutions Team Xecuter released more information about the solutions to flash...

Related posts brought to you by Yet Another Related Posts Plugin.

GliGli & Tiros are proving the opposite! They developed a Hack which glitches all recent Xbox360 Kernels to run unsigned Code on:

Here is the detailed technical explanation…….

**********************************
* The Xbox 360 reset glitch hack *
**********************************

Introduction / some important facts
===================================

tmbinc said it himself, software based approaches of running unsigned code on the 360 mostly don’t work, it was designed to be secure from a software point of view.

The processor starts running code from ROM (1bl) , which then starts loading a RSA signed and RC4 crypted piece of code from NAND (CB).

CB then initialises the processor security engine, its task will be to do real time encryption and hash check of physical DRAM memory. From what we found, it’s using AES128 for crypto and strong (Toeplitz ?) hashing. The crypto is different each boot because it is seeded at least from:
- A hash of the entire fuseset.
- The timebase counter value.
- A truly random value that comes from the hardware random number generator the processor embeds. on fats, that RNG could be electronically deactivated, but there’s a check for “apparent randomness” (merely a count of 1 bits) in CB, it just waits for a seemingly proper random number.

CB can then run some kind of simple bytecode based software engine whose task will mainly be to initialise DRAM, CB can then load the next bootloader (CD) from NAND into it, and run it.

Basically, CD will load a base kernel from NAND, patch it and run it.

That kernel contains a small privileged piece of code (hypervisor), when the console runs, this is the only code that would have enough rights to run unsigned code.
In kernel versions 4532/4548, a critical flaw in it appeared, and all known 360 hacks needed to run one of those kernels and exploit that flaw to run unsigned code.
On current 360s, CD contains a hash of those 2 kernels and will stop the boot process if you try to load them.
The hypervisor is a relatively small piece of code to check for flaws and apparently no newer ones has any flaws that could allow running unsigned code.

On the other hand, tmbinc said the 360 wasn’t designed to withstand certain hardware attacks such as the timing attack and “glitching”.

Glitching here is basically the process of triggering processor bugs by electronical means.

This is the way we used to be able to run unsigned code.

The reset glitch in a few words
===============================

We found that by sending a tiny reset pulse to the processor while it is slowed down does not reset it but instead changes the way the code runs, it seems it’s very efficient at making bootloaders memcmp functions always return “no differences”. memcmp is often used to check the next bootloader SHA hash against a stored one, allowing it to run if they are the same. So we can put a bootloader that would fail hash check in NAND, glitch the previous one and that bootloader will run, allowing almost any code to run.

Details for the fat hack
========================

On fats, the bootloader we glitch is CB, so we can run the CD we want.

cjak found that by asserting the CPU_PLL_BYPASS signal, the CPU clock is slowed down a lot, there’s a test point on the motherboard that’s a fraction of CPU speed, it’s 200Mhz when the dash runs, 66.6Mhz when the console boots, and 520Khz when that signal is asserted.

So it goes like that:
- We assert CPU_PLL_BYPASS around POST code 36 (hex).
- We wait for POST 39 start (POST 39 is the memcmp between stored hash and image hash), and start a counter.
- When that counter has reached a precise value (it’s often around 62% of entire POST 39 length), we send a 100ns pulse on CPU_RESET.
- We wait some time and then we deassert CPU_PLL_BYPASS.
- The cpu speed goes back to normal, and with a bit of luck, instead of getting POST error AD, the boot process continues and CB runs our custom CD.

The NAND contains a zero-paired CB, our payload in a custom CD, and a modified SMC image.
A glitch being unreliable by nature, we use a modified SMC image that reboots infinitely (ie stock images reboot 5 times and then go RROD) until the console has booted properly.
In most cases, the glitch succeeds in less than 30 seconds from power on that way.

Details for the slim hack
=========================

The bootloader we glitch is CB_A, so we can run the CB_B we want.

On slims, we weren’t able to find a motherboard track for CPU_PLL_BYPASS.
Our first idea was to remove the 27Mhz master 360 crystal and generate our own clock instead but it was a difficult modification and it didn’t yield good results.
We then looked for other ways to slow the CPU clock down and found that the HANA chip had configurable PLL registers for the 100Mhz clock that feeds CPU and GPU differential pairs.
Apparently those registers are written by the SMC through an I2C bus.
I2C bus can be freely accessed, it’s even available on a header (J2C3).
So the HANA chip will now become our weapon of choice to slow the CPU down (sorry tmbinc, you can’t always be right, it isn’t boring and it does sit on an interesting bus

So it goes like that:
- We send an i2c command to the HANA to slow down the CPU at POST code D8 .
- We wait for POST DA start (POST DA is the memcmp between stored hash and image hash), and start a counter.
- When that counter has reached a precise value, we send a 20ns pulse on CPU_RESET.
- We wait some time and then we send an i2c command to the HANA to restore regular CPU clock.
- The cpu speed goes back to normal, and with a bit of luck, instead of getting POST error F2, the boot process continues and CB_A runs our custom CB_B.

When CB_B starts, DRAM isn’t initialised so we chose to only apply a few patches to it so that it can run any CD, the patches are:
- Always activate zero-paired mode, so that we can use a modified SMC image.
- Don’t decrypt CD, instead expect a plaintext CD in NAND.
- Don’t stop the boot process if CD hash isn’t good.

CB_B is RC4 crypted, the key comes from the CPU key, so how do we patch CB_B without knowing the CPU key?
RC4 is basically:
crypted = plaintext xor pseudo-random-keystream
So if we know plaintext and crypted, we can get the keystream, and with the keystream, we can encrypt our own code. It goes like that:
guessed-pseudo-random-keystream = crypted xor plaintext
new-crypted = guessed-pseudo-random-keystream xor plaintext-patch
You could think there’s a chicken and egg problem, how did we get plaintext in the first place?
Easy: we had plaintext CBs from fat consoles, and we thought the first few bytes of code would be the same as the new CB_B, so we could encrypt a tiny piece of code to dump the CPU key and decrypt CB_B!

The NAND contains CB_A, a patched CB_B, our payload in a custom plaintext CD, and a modified SMC image.
The SMC image is modified to have infinite reboot, and to prevent it from periodically sending I2C commands while we send ours.

Now, maybe you haven’t realised yet, but CB_A contains no checks on revocation fuses, so it’s an unpatchable hack !

Caveats
=======

Nothing is ever perfect, so there are a few caveats to that hack:
- Even in the glitch we found is pretty reliable (25% success rate per try on average), it can take up to a few minutes to boot to unsigned code.
- That success rate seems to depend on something like the hash of the modified bootloader we want to run (CD for fats and CB_B for slims).
- It requires precise and fast hardware to be able to send the reset pulse.

Our current implementation
==========================

We used a Xilinx CoolRunner II CPLD (xc2c64a) board, because it’s fast, precise, updatable, cheap and can work with 2 different voltage levels at the same time.
We use the 48Mhz standby clock from the 360 for the glitch counter. For the slim hack, the counter even runs at 96Mhz (incremented on rising and falling edges of clock)
The cpld code is written in VHDL.
We need it to be aware of the current POST code, our first implementations used the whole 8 bits POST port for this, but we are now able to detect the changes of only 1 POST bit, making wiring easier.

Conclusion
==========

We tried not to include any MS copyrighted code in the released hack tools.
The purpose of this hack is to run Xell and other free software, I (GliGli) did NOT do it to promote piracy or anything related, I just want to be able to do whatever I want with the hardware I bought, including running my own native code on it.

Credits
=======

GliGli, Tiros: Reverse engineering and hack development.
cOz: Reverse engineering, beta testing.
Razkar, tuxuser: beta testing.
cjak, Redline99, SeventhSon, tmbinc, anyone I forgot… : Prior reverse engineering and/or hacking work on the 360.

Download
Tutorial

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

Via Team Jungle Twitter:

LT+ 1.91 completed testing, to be released with new JF – AP2.6 defeated, no need to reburn current AP2.5 titles

Source:  Team Jungle

Related posts:

1. iXtreme LT v1.9 for Samsung ,Benq and Phat Liteon Coming Today The new C4E iXtreme LT+ v1.9 for Samsung ,Benq and...
2. C4E iXtreme Slim LT+ Firmware for LiteOn DG-16D4S 9504 C4Eva (in association with Team Jungle & Team Xecuter) released...
3. Team Xecuter: New Jungle Flasher, New Firmware, New SPUTNIK Unlock From team-xecuter.com (http://team-xecuter.com/new-jungle-flasher-new-firmware-new-sputnick-unlock/?utm_source=rss&utm_medium=rss&utm_campaign=new-jungle-flasher-new-firmware-new-sputnick-unlock ): [QUOTE] A busy week ! *...

Related posts brought to you by Yet Another Related Posts Plugin.

black ops backup booting successfully on 13599 dash!

Whether or not this means on current LT 1.9 firmware is yet to be seen but at least we know they have successfully grabbed the new AP2.5 relays.

Related posts:

1. New Beta Dash 2.0.13141.0 Stops All Non AP2.5 Games From Booting From team-xecuter.com (http://team-xecuter.com/new-beta-dash-2-0-13141-0-stops-all-non-ap2-5-games-from-booting/?utm_source=rss&utm_medium=rss&utm_campaign=new-beta-dash-2-0-13141-0-stops-all-non-ap2-5-games-from-booting ): [QUOTE] We tested the new Beta...
2. Team Xecuter: New Jungle Flasher, New Firmware, New SPUTNIK Unlock From team-xecuter.com (http://team-xecuter.com/new-jungle-flasher-new-firmware-new-sputnick-unlock/?utm_source=rss&utm_medium=rss&utm_campaign=new-jungle-flasher-new-firmware-new-sputnick-unlock ): [QUOTE] A busy week ! *...
3. Team Xecuter: New Dash Update Info and 0225 Unlock Update From team-xecuter.com (http://team-xecuter.com/new-dash-update-info-0225-unlock-update/?utm_source=rss&utm_medium=rss&utm_campaign=new-dash-update-info-0225-unlock-update ): [QUOTE] For many weeks a dedicated...

Related posts brought to you by Yet Another Related Posts Plugin.