Corona V6 bricked?

[fred]

Salve a tutti,
tempo fa un modder del forum mi fece RGH con Squirt 2.0 su una Corona V6 4GB. Lavoro eccellente: ha sempre avuto tempi di glitch abbastanza buoni, kernel 16747.

Veniamo al dunque:
1. Seguendo questo tutorial QUI ho tentato di aggiornare freeboot al 17526 + dashlaunch seguendo i vari passaggi...ma penso di aver brickato l'Xbox.

2. Dopo aver preparato il tutto, xeBuild ha riscritto il freeboot ed ha tentato il reboot...ma ho avuto due problemi:
- Messaggio FILE IS MISSING
- Xbox ferma col tasto power ACCESO

3. Ora la console non glitcha più (i tentativi li fa...me ne accorgo dai "soliti" rumori dell'oscillatore) e naturalmente non mi fa entrare in Xell dal tasto eject.

4. Allego il file di log di Jrunner 5.0

base path changed to D:\################\JRunner_V0.5\xeBuild
---- { Update Mode } ----
<enter> key on completion suppressed
data directory set from command line to '17526\'
dump directory set to 'D:\##########\JRunner_V0.5\output\'
***** WARNING: reusing folder D:\##########\JRunner_V0.5\output\!
started, watching network for xbox...success, found xbox beacon at 192.168.XXX.XXX
attempting to connect...success!
Getting console info...success!
connected to Corona with updsvr version 3 (peek version 2)
NAND image size: 0x3000000 Block size: 0x20000 Spare Data: No

------ parsing console info response ------
Console Current Info:
running kernel : 2.0.16747.0
bootstrap type : Corona
hardware type : Corona
hardware flags : 0x50020247
internal HDD : not present
Image Type : Corona4g (Glitch2M)
CPU key : ################ (weight:0x35 valid; ecd: valid)
DVD key : ################
1BL key : ################ (good)
Fuses : present
fuseset 00: C0FFFFFFFFFFFFFF
fuseset 01: 0F0F0F0F0F0FF0F0
fuseset 02: 000F000000000000
fuseset 03: ################
fuseset 04: ################
fuseset 05: ################
fuseset 06: ################
fuseset 07: FFF0000000000000
fuseset 08: 0000000000000000
fuseset 09: 0000000000000000
fuseset 10: 0000000000000000
fuseset 11: 0000000000000000
Virtual Fuses : present
fuseset 00: C0FFFFFFFFFFFFFF
fuseset 01: 0F0F0F0F0F0FF0F0
fuseset 02: 0F00000000000000
fuseset 03: ################
fuseset 04: ################
fuseset 05: ################
fuseset 06: ################
fuseset 07: FFF0000000000000
fuseset 08: 0000000000000000
fuseset 09: 0000000000000000
fuseset 10: 0000000000000000
fuseset 11: 0000000000000000
1BL RSA pub : good
PIRS RSA pub : good
MASTER RSA pub : good

CPU Key set to : ################ (weight:0x35 valid; ecd: valid)
1BL Key set to : ################ sum: 0x983 (expects: 0x983)
xex Key set to : ################ sum: 0x800 (expects: 0x800)
Xell Reason : console eject button
CF LDV : 3
Pairing Value : 0x000000
------ parsing ini at '17526\_glitch2m.ini' ------
ini version 17526mfg

ini: label [coronabl] found
found (1) 'cba_9188_mfg.bin' crc: 0xe7ff60d0
found (2) 'cbb_13121.bin' crc: 0x6f3f9c18
found (3) 'cd_12905.bin' crc: 0x58221592
found (4) 'ce_1888.bin' crc: 0xff9b60df
found (5) 'cf_17526.bin' crc: 0x8d661b5b
found (6) 'cg_17526.bin' crc: 0x6b62ec79
ini dictates dual CB for this model

[rawpatch] label not found in ini

ini: label [flashfs] found
found (1) 'aac.xexp' crc: 0x13303a9c
found (2) 'bootanim.xex' crc: 0xd2f4a6d9
found (3) 'createprofile.xex' crc: 0xc562ba54
found (4) 'dash.xex' crc: 0x641a1c3e
found (5) 'deviceselector.xex' crc: 0x9cb7027f
found (6) 'gamerprofile.xex' crc: 0x6aace979
found (7) 'hud.xex' crc: 0x08c59cfe
found (8) 'huduiskin.xex' crc: 0xcd8eecab
found (9) 'mfgbootlauncher.xex' crc: 0x95c59c45
found (10) 'minimediaplayer.xex' crc: 0xa18ffc32
found (11) 'nomni.xexp' crc: 0x4471a7ee
found (12) 'nomnifwk.xexp' crc: 0x0b39c359
found (13) 'nomnifwm.xexp' crc: 0x44b88191
found (14) 'SegoeXbox-Light.xtt' crc: 0xe0ee6049
found (15) 'signin.xex' crc: 0x3f9b5388
found (16) 'updater.xex' crc: 0xd64b93de
found (17) 'vk.xex' crc: 0x3d5f4376
found (18) 'xam.xex' crc: 0xd2aeec08
found (19) 'xenonclatin.xtt' crc: 0xd5d17ff5
found (20) 'xenonclatin.xttp' crc: 0x7a507ad1
found (21) 'xenonjklatin.xtt' crc: 0xdde4a14c
found (22) 'xenonjklatin.xttp' crc: 0xe2adddfb
found (23) 'ximecore.xex' crc: 0xc40c1b5d
found (24) 'ximedic.xex' crc: 0x1d992bfb
found (25) 'ximedic.xexp' crc: 0x758d0b67
found (26) '..\launch.xex' crc: 0x00000000
found (27) '..\lhelper.xex' crc: 0x00000000
found (28) '..\launch.ini' crc: 0x00000000

ini: label [security] found
found (1) 'crl.bin' crc: 0x00000000
found (2) 'dae.bin' crc: 0x00000000
found (3) 'extended.bin' crc: 0x00000000
found (4) 'fcrt.bin' crc: 0x00000000
found (5) 'secdata.bin' crc: 0x00000000
------ ini parsing completed ------

mounting \SystemRoot to usv:...success!

------ getting bootloaders ------
reading bootloader data...success! Bootloader size with xell is 0x000b0000

------ getting security files ------
retrieving USVR\crl.bin...OK, received 0xa00 bytes
sig good! verified! Will use if external file not found.
retrieving USVR\dae.bin...OK, received 0xad30 bytes
sig 1 good! sig 2 good! verified! Will use if external file not found.
retrieving USVR\extended.bin...OK, received 0x4000 bytes
verified! Will use if external file not found.
retrieving USVR\fcrt.bin...OK, received 0x4000 bytes
sig good! verified! Will use if external file not found.
retrieving USVR\secdata.bin...OK, received 0x400 bytes
verified! Will use if external file not found.
extracting BLDR\kv_enc...OK, received 0x4000 bytes
decrypt and verify...keyvault is good!
extracting BLDR\smc_enc...OK, received 0x3800 bytes
decrypt and verify...smc is good!

------ getting mobile settings ------
retrieving USVR\MobileB.dat...OK, received 0x800 bytes
retrieving USVR\MobileC.dat...OK, received 0x200 bytes
retrieving USVR\MobileD.dat...not available
retrieving USVR\MobileE.dat...OK, received 0x800 bytes
retrieving USVR\MobileF.dat...not available
retrieving USVR\MobileG.dat...not available
retrieving USVR\MobileH.dat...not available
retrieving USVR\MobileI.dat...not available
retrieving USVR\MobileJ.dat...not available
retrieving USVR\Statistics.settings...OK, received 0x400 bytes
retrieving USVR\Manufacturing.data...OK, received 0x80 bytes
console has no available blmod
console has no available addons
retrieving USVR\Static.settings (smc_config.bin)...OK, received 0x4000 bytes
verifying...smc_config is good!

------ Copying bootloader image to flash image ------
CB v9188 at 0x8000 size 0x1ac0 (CB)
CB v13121 at 0x9ac0 size 0x7b40 (dual CB)
CD v12905 at 0x11600 size 0x5400 (CD)
CE v1888 at 0x16a00 size 0x5606a (CE)
final truncated bootloader size 0x6ca70

------ loading system update container ------
system update container not found at 17526\su20076000_00000000, trying alt
17526\$SystemUpdate/su20076000_00000000 found, loading...done!
Read 0xb50000 bytes to memory
checking integrity...
header seems valid, version 2.0.17526.0
header hash is OK, checking content hashes...
content hashes seem OK, everything looks good!
extracted SUPD/xboxupd.bin (0x7b420 bytes)
decrypting SUPD/xboxupd.bin/CF_17526.bin (0x4560 bytes)...done!
decrypting SUPD/xboxupd.bin/CG_17526.bin (0x76eb4 bytes)...done!

------ Loading bootloaders and required security files ------
using smc binary from console
reset smc load address to 0x800 size 0x3800
using keyvault data from console
skipping cba_9188_mfg.bin as it is in glitch bootloader dump
skipping cbb_13121.bin as it is in glitch bootloader dump
skipping cd_12905.bin as it is in glitch bootloader dump
skipping ce_1888.bin as it is in glitch bootloader dump
xell not found in perbuild directory, checking firmware /bin folder
xell not found in firmware /bin folder, checking base path
reading xell-gggggg.bin (0x40000 bytes)
extracted SUPD/xboxupd.bin/CF_17526.bin (0x4560 bytes)
extracted SUPD/xboxupd.bin/CG_17526.bin (0x76eb4 bytes)
reading 17526\bin\patches_g2mcorona.bin (0xae8 bytes)
using smc configuration from console
-------------------
checking smc_config
-------------------
extracting config
------------------
SMC config info:
------------------
Target temps: Cpu: 82øC Gpu: 78øC Edram: 76øC
Max temps : Cpu: 89øC Gpu: 82øC Edram: 82øC
Cpu Fan : (auto)
Gpu Fan : (auto)
MAC Address : XX:XX:XX:XX:XX:XX
AVRegion : 0x00000300 (PAL50)
GameRegion : 0x02fe (PAL/EU)
DVDRegion : 2
resetKey : DUUX
---------------------
Checking for smc config data patches
smc config was not patched
---------------------
done!
patch slot offset reset to: 0xb0000

------ Patching BLs and modifying patches ------
Fixing up patch set...Done!

------ Encrypting and finalizing bootloaders ------
initializing static pairing value
Fuse CF LDV set to : 0xFFF00000000000000000000000000000
Fuse CPU Key set to: 0x################################
encoding cf_17526.bin size 0x4560
encoding cg_17526.bin size 0x76ec0

Virtual Fuses set to:
fuseset 00: C0FFFFFFFFFFFFFF
fuseset 01: 0F0F0F0F0F0F0FF0
fuseset 02: 0000000000000000
fuseset 03: ################
fuseset 04: ################
fuseset 05: ################
fuseset 06: ################
fuseset 07: FFF0000000000000
fuseset 08: 0000000000000000
fuseset 09: 0000000000000000
fuseset 10: 0000000000000000
fuseset 11: 0000000000000000
done!

------ Adding bootloaders to flash image ------
adding xell-gggggg.bin at raw offset 0x00070000 len 0x40000 (end 0xb0000)
adding cf_17526.bin at raw offset 0x000b0000 len 0x4560 (end 0xb4560)
adding cg_17526.bin at raw offset 0x000b4560 len 0x76ec0 (end 0xc0000, rest in fs)
adding fuses.bin at raw offset 0x000c0000 len 0x60 (end 0xc0060)
adding patches_g2mcorona.bin at raw offset 0x000c0060 len 0x674 (end 0xc06d4)
Fixing up FS table...done!
Writing zeropair CG patch slot overflow data to sysupdate.xexp1
at raw offset 0xd0000 len 0x0006b420 (end: 0x0013b420)...done!

------ adding 28 firmware files ------
extracted SUPD/aac.xexp (0x14000 bytes) (crc32: 0x13303a9c ini: 0x13303a9c)
adding as aac.xexp1 at raw offset 0x13b420 len 0x00014000 (end 0x0014f420)
extracted SUPD/bootanim.xex (0x61000 bytes) (crc32: 0xd2f4a6d9 ini: 0xd2f4a6d9)
adding as bootanim.xex at raw offset 0x150000 len 0x00061000 (end 0x001b1000)
extracted SUPD/createprofile.xex (0xc000 bytes) (crc32: 0xc562ba54 ini: 0xc562ba54)
adding as createprofile.xex at raw offset 0x1b1000 len 0x0000c000 (end 0x001bd000)
extracted SUPD/dash.xex (0x5b1000 bytes) (crc32: 0x641a1c3e ini: 0x641a1c3e)
adding as dash.xex at raw offset 0x1c0000 len 0x005b1000 (end 0x00771000)
extracted SUPD/deviceselector.xex (0xa000 bytes) (crc32: 0x9cb7027f ini: 0x9cb7027f)
adding as deviceselector.xex at raw offset 0x771000 len 0x0000a000 (end 0x0077b000)
extracted SUPD/gamerprofile.xex (0x1b000 bytes) (crc32: 0x6aace979 ini: 0x6aace979)
adding as gamerprofile.xex at raw offset 0x77e000 len 0x0001b000 (end 0x00799000)
extracted SUPD/hud.xex (0x1d000 bytes) (crc32: 0x08c59cfe ini: 0x08c59cfe)
adding as hud.xex at raw offset 0x79b000 len 0x0001d000 (end 0x007b8000)
extracted SUPD/huduiskin.xex (0x14000 bytes) (crc32: 0xcd8eecab ini: 0xcd8eecab)
adding as huduiskin.xex at raw offset 0x7b9000 len 0x00014000 (end 0x007cd000)
extracted SUPD/mfgbootlauncher.xex (0x8000 bytes) (crc32: 0x95c59c45 ini: 0x95c59c45)
adding as mfgbootlauncher.xex at raw offset 0x7d0000 len 0x00008000 (end 0x007d8000)
extracted SUPD/minimediaplayer.xex (0xc000 bytes) (crc32: 0xa18ffc32 ini: 0xa18ffc32)
adding as minimediaplayer.xex at raw offset 0x7d8000 len 0x0000c000 (end 0x007e4000)
extracted SUPD/nomni.xexp (0xf000 bytes) (crc32: 0x4471a7ee ini: 0x4471a7ee)
adding as nomni.xexp1 at raw offset 0x7e4000 len 0x0000f000 (end 0x007f3000)
extracted SUPD/nomnifwk.xexp (0x2000 bytes) (crc32: 0x0b39c359 ini: 0x0b39c359)
adding as nomnifwk.xexp1 at raw offset 0x7f3000 len 0x00002000 (end 0x007f5000)
extracted SUPD/nomnifwm.xexp (0x5000 bytes) (crc32: 0x44b88191 ini: 0x44b88191)
adding as nomnifwm.xexp1 at raw offset 0x7f6000 len 0x00005000 (end 0x007fb000)
extracted SUPD/SegoeXbox-Light.xtt (0x6000 bytes) (crc32: 0xe0ee6049 ini: 0xe0ee6049)
adding as SegoeXbox-Light.xtt at raw offset 0x7fd000 len 0x00006000 (end 0x00803000)
extracted SUPD/signin.xex (0x1a000 bytes) (crc32: 0x3f9b5388 ini: 0x3f9b5388)
adding as signin.xex at raw offset 0x806000 len 0x0001a000 (end 0x00820000)
extracted SUPD/updater.xex (0x7000 bytes) (crc32: 0xd64b93de ini: 0xd64b93de)
adding as updater.xex at raw offset 0x822000 len 0x00007000 (end 0x00829000)
extracted SUPD/vk.xex (0xb000 bytes) (crc32: 0x3d5f4376 ini: 0x3d5f4376)
adding as vk.xex at raw offset 0x82b000 len 0x0000b000 (end 0x00836000)
extracted SUPD/xam.xex (0x251000 bytes) (crc32: 0xd2aeec08 ini: 0xd2aeec08)
adding as xam.xex at raw offset 0x837000 len 0x00251000 (end 0x00a88000)
retrieving USVR\xenonclatin.xtt...OK, received 0x11b000 bytes
extracted USVR/xenonclatin.xtt (0x11b000 bytes) (crc32: 0xd5d17ff5 ini: 0xd5d17ff5)
adding as xenonclatin.xtt at raw offset 0xa89000 len 0x0011b000 (end 0x00ba4000)
extracted SUPD/xenonclatin.xttp (0x18000 bytes) (crc32: 0x7a507ad1 ini: 0x7a507ad1)
adding as xenonclatin.xttp1 at raw offset 0xba7000 len 0x00018000 (end 0x00bbf000)
retrieving USVR\xenonjklatin.xtt...OK, received 0x1a8000 bytes
extracted USVR/xenonjklatin.xtt (0x1a8000 bytes) (crc32: 0xdde4a14c ini: 0xdde4a14c)
adding as xenonjklatin.xtt at raw offset 0xbc0000 len 0x001a8000 (end 0x00d68000)
extracted SUPD/xenonjklatin.xttp (0x7000 bytes) (crc32: 0xe2adddfb ini: 0xe2adddfb)
adding as xenonjklatin.xttp1 at raw offset 0xd68000 len 0x00007000 (end 0x00d6f000)
extracted SUPD/ximecore.xex (0x17000 bytes) (crc32: 0xc40c1b5d ini: 0xc40c1b5d)
adding as ximecore.xex at raw offset 0xd6f000 len 0x00017000 (end 0x00d86000)
retrieving USVR\ximedic.xex...OK, received 0x90000 bytes
extracted USVR/ximedic.xex (0x90000 bytes) (crc32: 0x1d992bfb ini: 0x1d992bfb)
adding as ximedic.xex at raw offset 0xd87000 len 0x00090000 (end 0x00e17000)
extracted SUPD/ximedic.xexp (0x2800 bytes) (crc32: 0x758d0b67 ini: 0x758d0b67)
adding as ximedic.xexp1 at raw offset 0xe18000 len 0x00002800 (end 0x00e1a800)
reading 17526\..\launch.xex (0xb800 bytes)
adding as launch.xex at raw offset 0xe1a800 len 0x0000b800 (end 0x00e26000)
reading 17526\..\lhelper.xex (0x4800 bytes)
adding as lhelper.xex at raw offset 0xe27800 len 0x00004800 (end 0x00e2c000)
retrieving USVR\launch.ini...OK, received 0x2e5 bytes
extracted USVR/launch.ini (0x2e5 bytes)
adding as launch.ini at raw offset 0xe2c800 len 0x000002e5 (end 0x00e2cae5)

------ adding 5 security files ------
<- Processing crl.bin ->
could not read crl.bin, using data from SUPD...
crl appears crypted, attempting to decrypt with CPU key...failed! Trying alternate key...sig good! success!
adding as crl.bin at raw offset 0xe34000 len 0x00000a00 (end 0x00e34a00)

<- Processing dae.bin ->
could not read dae.bin, using data from SUPD...
dae appears encrypted, attempting to decrypt with CPU key...failed! Attempting to decrypt with alternate key...
success!
adding as dae.bin at raw offset 0xe38000 len 0x00007090 (end 0x00e3f090)

<- Processing extended.bin ->
could not read extended.bin, using data from previous parse...
adding as extended.bin at raw offset 0xe40000 len 0x00004000 (end 0x00e44000)

<- Processing fcrt.bin ->
could not read fcrt.bin, using data from previous parse...
adding as fcrt.bin at raw offset 0xe44000 len 0x00004000 (end 0x00e48000)

<- Processing secdata.bin ->
could not read secdata.bin, using data from previous parse...
adding as secdata.bin at raw offset 0xe48000 len 0x00000400 (end 0x00e48400)

------ checking for Mobile*.dat ------
MobileB.dat found, adding from previous parse
adding MobileB.dat as type 0x31 at raw offset 0xe4c000 len 0x800 (end 0xe4c800)
MobileC.dat found, adding from previous parse
adding MobileC.dat as type 0x32 at raw offset 0xe50000 len 0x200 (end 0xe50200)
MobileE.dat found, adding from previous parse
adding MobileE.dat as type 0x34 at raw offset 0xe54000 len 0x800 (end 0xe54800)
Statistics.settings found, adding from previous parse
adding Statistics.settings at raw offset 0x2ff8000 len 0x400 (end 0x2ff8400)
Manufacturing.data found, adding from previous parse
adding Manufacturing.data at raw offset 0x2ff4000 len 0x80 (end 0x2ff4080)

------ adding smc_config.bin ------
adding smc config to offset 0x02ffc000, len 0x400

------ cleaning up image ------
Fixing up empty FS block entries...done!
Writing FS table to image offset 0xe58000 len 0x4000 (end 0xe5c000)...done!
copying anchor block 1 to offset 0x2fe8000
copying anchor block 2 to offset 0x2fec000

------ finalizing image ------
unmounting usv:...success!

------ dumping console flash ------
reading flash image from console...received 0x3000000 bytes data OK, writing to file D:\################\JRunner_V0.5\output\nanddump.b in...success!
Completed in 16s

------ flashing console ------
sending flash data to console...
file sent OK, awaiting result...success!
Completed in 12s

------ loading and sending avatar data ------
avatar data skipped, no HDD detected
sending reboot command...OK

------ writing image to disk ------
writing file 'D:\################\JRunner_V0.5\output\17526mfg_ g2m_corona4g.bin' to disk...done!
---------------------------------------------------------------
D:\################\JRunner_V0.5\output\17526mfg_g 2m_corona4g.bin image built, info:
---------------------------------------------------------------
Kernel : 2.0.17526.0
Console : Corona
NAND size : 48MiB MMC (system only)
Build : Glitch (v2 mfg)
Xell : power on console with console eject button
CPU Key : ################################
1BL Key : ################################
CF LDV : 3
---------------------------------------------------------------
xeBuild Finished. Have a nice day.
---------------------------------------------------------------

5. Non ho esperienze serie col saldatore e non ho ancora aperto la console...ho con me il backup della nand con la quale glitchava correttamente ma non ho il programmer nè so quale sia e come usarlo su una Corona V6.

6. Suggerimenti? E' brickata? Mi devo rivolgere ad un modder e ripristinare la Nand corretta?

Grazie

[thunderbirddd]

Naturalmente la nand originale la hai giusto?
E anche la cpu key suppongo
Allora ricrei un freeboot con autogg e colleghi una fake sd con tanto di lettore compatibile e flashi

[fred]

Grazie della risposta innanzitutto,
ho la cpu key e la nand originale che mi ha dato il modder...e anche la nand che mi faceva glitchare (quella che mi ha estratto jrunner un attimo prima di flashare quella "brickante").

Domande da newbie (non vorrei chiedere eresie), chiedo scusa nel caso:
- se riscrivessi il backup della nand che faceva glitchare (senza ricrearla con autogg partendo dall'originale) andrebbe bene lo stesso?
- devo rimuovere l'RGH prima di scrivere nand? Non saprei farlo nel caso
- sulla corona V6 per effettuare scrittura nand devo saldare e usare QUESTO kit?
- è possibile scrivere la nand senza saldare (suppongo di no)?

[thunderbirddd]

Grazie della risposta innanzitutto,
ho la cpu key e la nand originale che mi ha dato il modder...e anche la nand che mi faceva glitchare (quella che mi ha estratto jrunner un attimo prima di flashare quella "brickante").

Domande da newbie (non vorrei chiedere eresie), chiedo scusa nel caso:
- se riscrivessi il backup della nand che faceva glitchare (senza ricrearla con autogg partendo dall'originale) andrebbe bene lo stesso?
- devo rimuovere l'RGH prima di scrivere nand? Non saprei farlo nel caso
- sulla corona V6 per effettuare scrittura nand devo saldare e usare QUESTO kit?
- è possibile scrivere la nand senza saldare (suppongo di no)?

Kit buono
Senza saldare impossibile
Si rimetti il freeboot che glitchava
Non devi rimuovere nulla