And then there was fbBuild...

TouchingVirus

Introduction:
Sad to hear the rumor of ikari stepping down, and even sadder to hear of the profiteers taking advantage of this... we bring you a tribute to ikari. If you paid for this, get a refund!

fbBuild is a NAND image builder made to suit freeBoot style images, the included patches and freeboot.bin core are based on the original works done by ikari.

It is suitable to build rebooter images for all current JTAG exploit compatible xbox 360's. As with ibuild produced images, this version only requires a single flash 16MiB in size or larger.

What's New:
- based on targeting kernel 2.0.12611.0
- patches from freeBoot kernel/hv are ported to 12611
- supports both flash tool and ibuild extracted kv/smc_config
- supports injecting Mobile*.dat
- previously revoked usb devices should now work
- kinect works (apply system update for avatars and kinect) it is strongly recommended that r6t3 be removed
- entirely new image builder (no extraction)
- rebuilt/cleaned core can now boot xell on slot to eject dvd drives (see bin directory for alternate)
- exploit payload simplified

Current Limitations:
- security files besides KV must be provided in encrypted form
- STAY THE HELL OFF LIVE! Nuff said, we're not your mum.

I'll have an updated guide post later on when I get home and get building

Hold on Kinect Dash, I'll be right over :P

Reamer Fanny

Is this a new rebooter for the new kinect dash?

TouchingVirus

justryan wrote: »

Is this a new rebooter for the new kinect dash?

Yup, but there's no one-click toolbox out just yet, so you've to build your image manually via the command line. It also doesn't support dashlaunch yet

Myrddin

Glad to see the scene is still alive

TouchingVirus

Yeah, the good news is two fold. Delighted there are people out there who care about the scene and not the exclusive Kinect Dash "Give me money for access" fools who are ruining it.

And delighted that homebrew kinect may be an option in the future

TouchingVirus

New dashlaunch is out :P

Reamer Fanny

So did anyone compile the new dash and flash it yet? It's great to see a new rebooter that supports the kinect accessory

Reamer Fanny

There is a toolbox floating about on Se7enSins, try the links below it has all the files necessary no messing around with the command prompt

http://www.megaupload.com/?d=3IBWH06E
http://www.multiupload.com/P7319LBDVW
http://www.hotfile.com/dl/81949849/e9c4407/EFB.rar.html

Just upgraded my 512mb Jasper to the new dash using the above utility, when it asks you about CB say No and choose your motherboard manually it will compile and prompt you to save the updflash.bin file. I updated with flash360 and ignored the ZeroPairing warning and now I've got the new dash

Update: Downloaded the avatar update and my stomach turned when I seen the e71 error, but thankfully after rebooting it I was greeted with the kinect setup screen and avatars

docentore

After going through E72, Christmas lights and blank screen decided to put the idea of having new dash tonight to sleep.

davidsatelle100

Right lads someone point me to an absolute n00b guide to updating this.

TouchingVirus

The GUI has to be the worst-explained GUI ever.

1) What's the AUD_CLAMP fix? I know I'm using AUD_CLAMP on all of my JTAGs and it's the suggested wiring in my guide too. I know that it needs a different SMC (one with the TMS set to AUD_CLAMP), is that what this is - if that's the case it should say "Use AUD_CLAMP SMC"

2) It doesn't auto-detect my Jasper256 and the detection message isn't helpful "We have detected model: with a CB of : 6723. Is this correct? Just tell me you didn't detect a model you piece of crap GUI

Bah, come on Bestpig, give us a real gui!

TouchingVirus

TouchingVirus wrote: »

The GUI has to be the worst-explained GUI ever.

1) What's the AUD_CLAMP fix? I know I'm using AUD_CLAMP on all of my JTAGs and it's the suggested wiring in my guide too. I know that it needs a different SMC (one with the TMS set to AUD_CLAMP), is that what this is - if that's the case it should say "Use AUD_CLAMP SMC"

2) It doesn't auto-detect my Jasper256 and the detection message isn't helpful "We have detected model: with a CB of : 6723. Is this correct? Just tell me you didn't detect a model you piece of crap GUI

Bah, come on Bestpig, give us a real gui!

The AUD_CLAMP fix is for the Zephyrs who would random E79 with the original wiring. Patching the SMC with the fix and moving to AUD_CLAMP would fix the issue.

TouchingVirus

Jaspers are usually done with TMS set to the Ring of Light I/O, whereas I've been using AUD_CLAMP on them all. So the regular Jasper SMC.bin won't work for me, I need a jasper SMC that's got TMS patched to AUD_CLAMP

TouchingVirus

Oh.. Hello Kinect Dash

Reamer Fanny

I like it better than the 9199 dash

TouchingVirus

Build Instructions:

For simplicity you need the following:

1) Your CPU Key
2) Your Freeboot v0.032 (Dash 9199) nand file and SMC
3) 12611.zip (xbins)
4) fbBuild v0.1 (xbins)

Getting ready
Download fbBuild and extract it to a folder - say C:\fbBuild

Download 12611.zip and extract the contents to C:\fbBuild\data

Edit C:\fbBuild\1blkey.txt. On the first line is a dummy key - replace it with DD88AD0C9ED669E7B56794FB68563EFA

Edit C:\fbBuild\mydata\cpukey.txt. On the first line is a dummy key - replace it with the CPU key of the console.

Extracting KV and SMC_CONFIG.bin
Open up 360 Flash Tool v0.97 and click Settings->Options. Tick the box that says "Extract ibuild compatible files". Then open your freeboot nand and click extract on the bottom. Tick the box for 'config blocks' and 'Keyvault' and click OK. Choose a folder for these files. When extraction is done, go to that folder and there'll be a folder called freeBOOT, click into it, then into data and you will find two files - kv.bin and smc_config.bin. Copy these two files to C:\fbBuild\mydata

Picking the right SMC (not for Xenon consoles)
This step is very important if your console is not a xenon - flashing the wrong SMC can end your JTAG When you built freeboot v0.032 you probably downloaded some pre-built Xellous files and SMC files from the guide:

Zephyr, Jasper, Falcon
Jasper Big Block Alternative

Well each of these files had an SMC in the archive and when building your custom freeBOOT using Bestpig's tool you renamed the file to smc.bin and copied it into data directory. This is the right SMC for your console, so once again rename it to smc.bin and copy it to C:\fbBuild\mydata

Build freeBOOT
Open a command prompt, go to C:\fbBuild and type the following

fbbuild -c <model> -d mydata updflash.bin

<model> is either xenon, falcon, zephyr, jasper, jasper256, jasper512

Freeboot v0.04 will build as updflash.bin - copy it to USB, boot to Xellous and flash it.


Post-Install

Download the full system update - http://download.microsoft.com/download/4/1/D/41D9A2BA-3B48-4BD5-B613-122E7C3A1390/SystemUpdate12611.zip
Extract to a USB stick (blank)
Insert USB stick into console
Power console on, accept the update, the console will apply and then reboot.

If you had modified the console fanspeed on the previous dash (I run at 60% on the Jaspers) then run FanSpeed_60.xex or whatever via XeXMenu

TouchingVirus

Some apps need updates for the new dash - the only one I've encountered thus far in very brief testing is NXE2GOD which failed to run after spending time installing Sonic/Sega Tennis. It doesn't run at all, so my guess is the application needs a fix to run on the new dash

davidsatelle100

trying to extract the kv.bin. but i keep on getting a kv-enc.bin file.

when i open up the updflash.bin in flash .97 i get bad keys in the key vault on the right hand side



thanks for any assistance.

TouchingVirus

davidsatelle100 wrote: »

trying to extract the kv.bin. but i keep on getting a kv-enc.bin file.

when i open up the updflash.bin in flash .97 i get bad keys in the key vault on the right hand side

thanks for any assistance.

You never set 360 Flash Tool to extract ibuild compatible files? Even if you did, you don't go to the KV folder which will have kv_enc.bin and kv_dec.bin - you go to the freeBOOT folder in the folder you told Flashtool to extract to, and then the data folder - that will have your kv.bin file.

If you have not entered your CPU key into 360 Flash Tool you'll get Bad K/V in the right hand side of 360 Flash tool. Without the right CPU Key you cannot produce kv_dec.bin or the kv.bin file in the freeBOOT folder (both of which are decrypted keyvaults, which is why you require the CPU key). Go to Settings->Keys and put in the CPU key, click Add and then open your updflash.bin

davidsatelle100

thanks TV got the updflash built.

Now the next question what happens when i have done it wrong and it now wont boot used flash360 to update and all seemed to be okay, but now it wont boot, the power light comes on but nothing else

TouchingVirus

Have you tried getting it into Xellous by pressing the eject key? You are aware you've got a Falcon and used the right SMC file? If you can get into Xellous you could try reloading the 9199 dashboard's updflash.bin

davidsatelle100

TV yeah tried that and is not happening same thing just sits there.

yeah know its a falcon and have the smc from the disc you gave me

TouchingVirus

I honestly have no idea what went wrong then, maybe Flash360 flashed it wrong, fbBuild messed up or the KV is corrupted. Either way, with no Xellous there's not a lot you can do because you don't have a nand reader. If you want to drop it out to me I'll take a look at it free of charge, it's the best help I can offer and at the very least I should be able to get 9199 up and running again.

davidsatelle100

thanks TV will drop you a PM

TouchingVirus

Just to update the thread I've successfully used the method I outlined in a previous post to make davidsatelle100's Falcon work. I'm not sure what the issue was, perhaps a bad flash, or flash tool mucked up extracting the keyvault - either way there's another JTAGer on the Kinect dash so the tutorial works fine, don't be scared

I IZ A TALIBAN

Well TV, made the flash image with my freeboot image and my original nand for my main console, was easy enough. Used my flashdmp to upgrade to the new rebooter with best pig. I don't think it gave me the CB on one of them so I had to manually add in the rest with my other consoles. All of them are working splended. Cheers for modifying my consoles

TouchingVirus

I IZ A TALIBAN wrote: »

Well TV, made the flash image with my freeboot image and my original nand for my main console, was easy enough. Used my flashdmp to upgrade to the new rebooter with best pig. I don't think it gave me the CB on one of them so I had to manually add in the rest with my other consoles. All of them are working splended. Cheers for modifying my consoles

Glad you're up and running, no hassle at all

TouchingVirus

Hold the phone.... fbBuild v0.11 was released, fixing a critical bug for Jasper 16MB models

Changes:
0.11
- add "jasper16a" LBA method as default for jasper
- add SMC check for encrypted and known hack SMC
- search for valid smc_config hash instead of hard coded offsets, support filename "config.bin"
- refine KV encryption check
- disable extended DVD auth for OSIG keyvaults (aka: AP25)
- random non-critical changes

Bolded bit = o_O?

Myrddin

TouchingVirus wrote: »

Hold the phone.... fbBuild v0.11 was released, fixing a critical bug for Jasper 16MB models



Bolded bit = o_O?

Is that AP25 patched out altogether now?

TouchingVirus

That's what I'm wondering, I think they've just patched the bit of the kernel that's doing extended checking for spoofed drives on the new dash with AP2.5 games - the one that the LT firmware can't get around but hopefully the LT+ firmware will. That is only one check though, there's still some others like the random realtime checks that will require updated firmware on the drive itself.

That said, I don't know. The only way to check would be to play an AP2.5 game on the fbBuild v0.11 dash with the LT firmware on a non-samsung drive

Myrddin

TouchingVirus wrote: »

That's what I'm wondering, I think they've just patched the bit of the kernel that's doing extended checking for spoofed drives on the new dash with AP2.5 games - the one that the LT firmware can't get around but hopefully the LT+ firmware will. That is only one check though, there's still some others like the random realtime checks that will require updated firmware on the drive itself.

That said, I don't know. The only way to check would be to play an AP2.5 game on the fbBuild v0.11 dash with the LT firmware on a non-samsung drive

Feck that, internal hdd ftw I think I'll take the plunge today and avail of bestpig's awesomeness once again.

TouchingVirus

I wouldn't just yet, Bestpig hasn't updated to using fbBuild v0.11 yet. If you're gonna go for it, use the manual fbBuild instructions I posted earlier with the new fbBuild v0.11 archive

Yeah, use BestPig's toolbox, he's quick with the updates

Myrddin

TouchingVirus wrote: »

I wouldn't just yet, Bestpig hasn't updated to using fbBuild v0.11 yet. If you're gonna go for it, use the manual fbBuild instructions I posted earlier with the new fbBuild v0.11 archive

Yeah, use BestPig's toolbox, he's quick with the updates

:pac::pac:

Myrddin

Quick one TV, I've BP's toolbox here 0.4 v2.6, there's an option for "my console does not have a dvd drive" - what are the implications of this? As you know I have a 3.5" Sata HDD where my dvd drive used to be and rely on ftp/usb instead, but I've never built an image with that option before.

TouchingVirus

From what I understand, the new freeBOOT (because of the 12611 kernel) will always boot Xellous if you have no DVD drive because it thinks that TRAY_OPEN is logic high :P So there's a freeboot_alt.bin which will stop the centre light in the ROL from flashing and will let you boot in the dashboard without having to install a jumper on the DVD drive power header. So check that box if you want to boot into the dashboard. I have experienced this "won't boot dashboard unless a DVD drive is connected" issue myself when I upgraded my console and thought it curious

I do not know how you get to Xellous after flashing freeBOOT_alt.bin though, but that's a problem for down the road

Myrddin

TouchingVirus wrote: »

From what I understand, the new freeBOOT (because of the 12611 kernel) will always boot Xellous if you have no DVD drive because it thinks that TRAY_OPEN is logic high :P So there's a freeboot_alt.bin which will stop the centre light in the ROL from flashing and will let you boot in the dashboard without having to install a jumper on the DVD drive power header. So check that box if you want to boot into the dashboard. I have experienced this "won't boot dashboard unless a DVD drive is connected" issue myself when I upgraded my console and thought it curious

I do not know how you get to Xellous after flashing freeBOOT_alt.bin though, but that's a problem for down the road

Ah so it's just to avoid having to jump pins 4 & 6 on the power header? Even though I have those pins jumped, Xellous still boots on pressing eject, so I don't really see the point (for my case), so I just built a standard updflash to keep things the way they were (EnterNow doesn't like change ).

TouchingVirus

Yup, I think it's for the lads who don't want to jumper or got annoyed by the ROL centre light. That said, it might have some other effect on the Dashboard - I mean they got hard on the OSIG checking so god only knows what Microsoft will do if they find out you're running without a DVD drive :P

Stick with the standard build until you experience issues, that'd be my suggestion

Myrddin

TouchingVirus wrote: »

Yup, I think it's for the lads who don't want to jumper or got annoyed by the ROL centre light. That said, it might have some other effect on the Dashboard - I mean they got hard on the OSIG checking so god only knows what Microsoft will do if they find out you're running without a DVD drive :P

Stick with the standard build until you experience issues, that'd be my suggestion

As soon as the avatar updates are downloaded, I'll try a few things out & let you know