New 2.0.14717 Dashboard - Security Changes

[KingMike_OS]

The new 2.0.14717 dashboard is being rolled out globally this week and so far we have seen possible changes to the CB that may affect RGH consoles.

As always we suggest that you do NOT update until it has been investigated further.

[whitetop]

i hope it don't mess the rgh up good thing im waiting on demon to come out but micro$oft needs to understand they lost the war on the xbox 360 like the normal xbox

[Rodent]

Aslong as you dont update the console , the Rgh will be fine, 

Jtags and Rgh consoles will always be wanted and needed.

[magic_man185]

Correct me if I am wrong, but at least on the slims even if they do update to block the RGH, you should be able to downgrade or something, per the RGH writeup, "CB_A contains no checks on revocation fuses, so it's an unpatchable hack ! " Of course, on a fat xbox you would have to have removed the resistor that powers the e-fuse in order to downgrade.

[Rodent]

Correct me if I am wrong, but at least on the slims even if they do update to block the RGH, you should be able to downgrade or something, per the RGH writeup, "CB_A contains no checks on revocation fuses, so it's an unpatchable hack ! " Of course, on a fat xbox you would have to have removed the resistor that powers the e-fuse in order to downgrade.

If the console is already RGH or your going to RGH one, you should use a lower dashboard, as they say 13599 or 13604 dashboard....

I have RGHed a 14699 dashboard and seem to work fine.

[magic_man185]

That was my point, even if the new dashboard blocks the glitch, you could run an older dash to glitch, because you can downgrade (i think). Have you ever downgraded the dash on a slim Rodent?

[Rodent]

I havent downgraded, and FSD uses the older Nxe dashboard... as for Freeboot i think you can put any dashboard style you want on it.

[rafaliyo86]

The guys from xteam are working and there are good news for the slims

http://www.team-xecuter.com/forums/showthread.php?s=6326b3a26391894aff3326e5ceb87909&t=82142

[Rodent]

rafaliyo86 and I (Rodent) think the best bet ... to do is

DO NOT UPDATE!!!!

[rafaliyo86]

rafaliyo86 and I (Rodent) think the best bet ... to do is

DO NOT UPDATE!!!!

agreee man!! lol

[magic_man185]

Hmm, I will have to keep my eye on this.  I have an old Jasper that I eventually want to RGH, it hasn't even been online since Oct. 2010 (I think it is flagged for ban, never got back online). I will have to keep an eye on if they can bypass the update to RGH the system (granted I could always just update to the last dash to do the RGH, then use freeboot or whatever).

[Rodent]

if your system is already RGHed? how will this affect the console?  and if the console is flagged for banned, then and your going to RGH it?

. does it matter ???

[magic_man185]

System is not RGHed yet, just saying for the future when I eventually RGH it, I will have to make sure I don't update it too far if the new dash is not RGH capable.  No, it really doesn't matter in the case of my console, I am most just talking theoretical stuff here.  BTW, I have read some on the TX forum, it appears the fat console has been updated to a two-stage bootloader like the slim, but with the e-fuse checks it can block the RGH permanently.  From what I can tell, if you have removed the e-fuse resistor then it is theoretically possible to downgrade, but not a lot of information on it yet.

[Rodent]

Here is the best thing to do, Update by usb , if its 8955 dashboard, to 13604 dashboard Rgh it , if its under 7371 Jtag that !

 after that Have a Nice day and enjoy Jtagging and Rgh consoles

[magic_man185]

I don't know what dash it it but I know it isn't Jtaggable, so I know it would be the RGH.  I will just have to check at that time what version of dash to update to to glitch. Of course I will have to figure all the dashboard/freeboot stuff out when I actually do it, which will be a while.  Thanks Rodent.

[Rodent]

I don't know what dash it it but I know it isn't Jtaggable, so I know it would be the RGH.  I will just have to check at that time what version of dash to update to to glitch. Of course I will have to figure all the dashboard/freeboot stuff out when I actually do it, which will be a while.  Thanks Rodent.

Let me know i will help you out,  when your ready to do it... if you can code you can do this with ease.


Edit: your welcome

[Anonamous]

All you would have to do is run an earlier dash and it will boot RGH just fine (I have not tested though) The RGH is unpatchable by any software update. They need a hardware update to fix it. I would love to see Microsoft take everybody's console to do so lol.

[magic_man185]

Not true, the SLIM is not patchable in software, the phat is by blowing e-fuse.  If you protect your e-fuse, then I think you are ok.  BTW, it appears TeamXecuter is coming out with a program called J-Runner which will be like an all-in-one program for JTAG/RGH, it does NAND reading/writing, NAND image building, ECC building/writing, coolrunner programming.  Once it comes out it looks like the process might get a lot easier.

[Rodent]

The guys from xteam are working and there are good news for the slims

http://www.team-xecuter.com/forums/showthread.php?s=6326b3a26391894aff3326e5ceb87909&t=82142

I believe that is what was mentioned here earlier in the thread

[magic_man185]

Yes, that thread does talk about the new dash and the slim being fixed to be patchable, but it doesn't really mention much about the J-Runner application, you can check that out at http://team-xecuter.com/j-runner-coming-soon-more-xecuter-demon-details/.

[Rodent]

The problem with this will be more towards the dual nand consoles, rather then just a RGH console.

[Anonamous]

Not true, the SLIM is not patchable in software, the phat is by blowing e-fuse.  If you protect your e-fuse, then I think you are ok.  BTW, it appears TeamXecuter is coming out with a program called J-Runner which will be like an all-in-one program for JTAG/RGH, it does NAND reading/writing, NAND image building, ECC building/writing, coolrunner programming.  Once it comes out it looks like the process might get a lot easier.

The cpld (coolrunner or whatever you have) gives the xbox 360 a false verification to boot. It tricks the xbox into thinking that the nand image is signed and it then boots. It does not matter if the efuse is blown or not, because when you build your rgh image, you have to change the ldv setting in the builder which bypasses the efuse. Changing the ldv basically says you are on a higher version (or same version) than the previously blown efuse, so everything boots ok.

[magic_man185]

Thanks anonamous, that is good information.  The issue though is that the new dashboard updates the fat console to a dual stage boot, like the slim, and it is unclear yet if it can be bypassed.  My point was that if you wanted to downgrade to an earlier dash in order to do the RGH, the efuse cannot be blown.  Of course, do the the fact that they are updating the actual boot procedure, similar to when the blocked the JTAG, downgrading probably wouldn't help anyway.  So the real question is whether or not they will be able to RGH the fat box after the new dashboard update.  The TX forums make it sound like they are making some progress, but we shall see.

[Modded Matt]

this is Proof Of Concept that the RGH can and will eventually be stopped by a software update. 

We were able to dodge this one..... when will the shoe fall just like stopping the jtag, MS never gets it right on the first try, but they will.

[Anonamous]

I will find out for sure later once I get back from work. I highly doubt the update will have stopped anything though.

[Modded Matt]

As you know the CB on Phat and Slim were updated with the recent 14717 update, disabling the RGH Glitch mod.

While the Phat solution is a much more in-depth problem (work on CB_B has been ongoing for several weeks in anticipation of this so we are well placed to have news very soon), we have already been able to patch the Slim RGH to be fully functional again. Didn't take long

The fix has been confirmed by a number of team members and we are waiting for feedback from some European testers too and will get the files packed up for release asap.

I'd just like to say what a sweet tool J-Runner was for doing all this

source: (thanks rodent)
http://www.team-xecuter.com/forums/showthread.php?s=6326b3a26391894aff3326e5ceb87909&t=82142

[KingMike_OS]

The new update 2.0.14717.0 updates the CB of the Phats and the Dual CB of the Slim also bowing an efuse which updates the CB LDV. These new CB's have the POST disabled, for the RGH to work the CPLD has to know the XBOX’s current POST. This is because the CPLD uses the POST so it can time the glitch correctly and reset the CPU at the correct time, plus know when the console has restarted. This is so if the glitch fails the CPLD will know when to try and glitch again.

So why slims still work

This is because the slim has a dual CB, CB_A and CB_B this is different to the Phats consoles which only have CB. (But some Phats have dual CB's as well so I will come back to that in a bit this is for the slim)

Now what is the CB anyway why are we glitching it for the RGH, the CB is a boot loader that is encrypted with the 1BL key. So we don't need the CPU key to decrypt it, but it is still signed by the private key so we can't just go and edit it to do what we want. There is not much information on this boot loader apart from it is stored in the NAND and it checks, decrypts then loads the next boot loader, which for Phats it is CD for slims it is CB_B.

Now because the slim’s changed the boot chain and added an extra boot loader, by splitting the CB in to two parts. They gave us a place in the boot chain to glitch that has a boot loader that is writable because it’s stored in the nand it can be decrypted with the 1BL key which they didn’t change, when they know that we still have it from the last exploit. Also now doesn’t have a Lock Down Value because it has been moved to CB_B so it doesn’t matter what the efuse values are this boot loader will always load. This is why the RGH is not patchable on trinity boards at least.

Now for the slim RGH we glitch the CB_A check of the CB_B SHA hash to return true when the hash is wrong because we have a patched CB_B. This CB_B has been patched so we can run own CD which loads the CE which is the base kernel and hypervisor, so we can do anything from there. So to some up you can just go and update the slim’s to the newest dash it doesn’t matter. All you will have to do is change the CF Lock Down Value because even in the hacked kernel it still has to match fuse line 7.

So why do Phats get patched

Because the Phats only have the CB boot loader which does have a Lock Down Value they can’t still run the old 6750 CB. Now we still can edit the CB because it is stored in the nand we do it for the RGH any way by making the CB zero-paired, this is so we can use a modified SMC image. But doing this doesn’t break the signature if we edited the LDV to match the new CB LDV it would break the signature. So the old CB 6750 CB won’t run anymore because the Lock Down Value isn’t going to match the fuse line 2 anymore because it was updated when the efuse was blown. And if were run the new CB that matches the efuses POST is disabled.

Now for Phat dual CB’s, there is the 6751 and the 6752 CB now there isn’t much information on these CB’s and I have never had a console with one. So I haven’t seen or looked at them but there are some reports of some XBOX’s with the 6751 CB’s being downgraded, to the 6750 CB and glitching. So that means the LDV wasn’t updated for the 6751 CB and it is the same as the 6750 CB, but there aren’t any reports of the 6752 being downgraded to the 6750 CB. But anyway the dual CB for Phats would have mean updated as well. Hell the new CB on all the Phats could be dual now I haven’t seen one only read that the POST has been disabled. (Will update when I get more information on this)

But it isn’t over for Phats

Gligli said himself that apparently CB 9188 can run on fats, so we could still glitch the Phats using the slim’s dual CB. Plus the glitch would work better on the Phats because we wouldn’t have to use the HANA to slow down the CPU we can use CPU_PLL_BYPASS. Which slows the CPU more than HANA PLL’s can do. And the slower the CPU the better the CPLD can time the glitch and reset the CPU. So we will just have to wait and see what happens for Phats.
Thx to nitramb for the Info.

[Anonamous]

The new update 2.0.14717.0 updates the CB of the Phats and the Dual CB of the Slim also bowing an efuse which updates the CB LDV. These new CB's have the POST disabled, for the RGH to work the CPLD has to know the XBOX’s current POST. This is because the CPLD uses the POST so it can time the glitch correctly and reset the CPU at the correct time, plus know when the console has restarted. This is so if the glitch fails the CPLD will know when to try and glitch again.

Yes, I read this last night and was going to post this in the morning (that would be now.) Unfortunately that means it is patched.

Microsoft may have won the battle, but the war is not over.

[magic_man185]

The new update 2.0.14717.0 updates the CB of the Phats and the Dual CB of the Slim also bowing an efuse which updates the CB LDV. These new CB's have the POST disabled, for the RGH to work the CPLD has to know the XBOX’s current POST. This is because the CPLD uses the POST so it can time the glitch correctly and reset the CPU at the correct time, plus know when the console has restarted. This is so if the glitch fails the CPLD will know when to try and glitch again.

So why slims still work

This is because the slim has a dual CB, CB_A and CB_B this is different to the Phats consoles which only have CB. (But some Phats have dual CB's as well so I will come back to that in a bit this is for the slim)

Now what is the CB anyway why are we glitching it for the RGH, the CB is a boot loader that is encrypted with the 1BL key. So we don't need the CPU key to decrypt it, but it is still signed by the private key so we can't just go and edit it to do what we want. There is not much information on this boot loader apart from it is stored in the NAND and it checks, decrypts then loads the next boot loader, which for Phats it is CD for slims it is CB_B.

Now because the slim’s changed the boot chain and added an extra boot loader, by splitting the CB in to two parts. They gave us a place in the boot chain to glitch that has a boot loader that is writable because it’s stored in the nand it can be decrypted with the 1BL key which they didn’t change, when they know that we still have it from the last exploit. Also now doesn’t have a Lock Down Value because it has been moved to CB_B so it doesn’t matter what the efuse values are this boot loader will always load. This is why the RGH is not patchable on trinity boards at least.

Now for the slim RGH we glitch the CB_A check of the CB_B SHA hash to return true when the hash is wrong because we have a patched CB_B. This CB_B has been patched so we can run own CD which loads the CE which is the base kernel and hypervisor, so we can do anything from there. So to some up you can just go and update the slim’s to the newest dash it doesn’t matter. All you will have to do is change the CF Lock Down Value because even in the hacked kernel it still has to match fuse line 7.

So why do Phats get patched

Because the Phats only have the CB boot loader which does have a Lock Down Value they can’t still run the old 6750 CB. Now we still can edit the CB because it is stored in the nand we do it for the RGH any way by making the CB zero-paired, this is so we can use a modified SMC image. But doing this doesn’t break the signature if we edited the LDV to match the new CB LDV it would break the signature. So the old CB 6750 CB won’t run anymore because the Lock Down Value isn’t going to match the fuse line 2 anymore because it was updated when the efuse was blown. And if were run the new CB that matches the efuses POST is disabled.

Now for Phat dual CB’s, there is the 6751 and the 6752 CB now there isn’t much information on these CB’s and I have never had a console with one. So I haven’t seen or looked at them but there are some reports of some XBOX’s with the 6751 CB’s being downgraded, to the 6750 CB and glitching. So that means the LDV wasn’t updated for the 6751 CB and it is the same as the 6750 CB, but there aren’t any reports of the 6752 being downgraded to the 6750 CB. But anyway the dual CB for Phats would have mean updated as well. Hell the new CB on all the Phats could be dual now I haven’t seen one only read that the POST has been disabled. (Will update when I get more information on this)

But it isn’t over for Phats

Gligli said himself that apparently CB 9188 can run on fats, so we could still glitch the Phats using the slim’s dual CB. Plus the glitch would work better on the Phats because we wouldn’t have to use the HANA to slow down the CPU we can use CPU_PLL_BYPASS. Which slows the CPU more than HANA PLL’s can do. And the slower the CPU the better the CPLD can time the glitch and reset the CPU. So we will just have to wait and see what happens for Phats.
Thx to nitramb for the Info.

This is exactly the kind of additional information I was looking to find.  Thanks for the great explanation!

[Rodent]

I signed on to xbl this morning they added another update  is now 2.0.14719 Dashboard....6:44 est is when i got on xbl