Allegati: 1
Squirt 2.1 su corona v2 no glitch
Come da titolo non riesco a far glitchare sta benedetta consol ma prima di continuare nelle varie prove vorrei togliermi il dubbio che il freeboot sia stato generato bene.
il dubbio mi e venuto alla creazione velocissima del nandflash.bin da parte di xebuild ( meno di un secondo.....troppo immediato secondo me) comunque ha glitchato solo una volta con ECC poi buio totale.
Allego foto chip e log xebuild.
Allegato 20062
xeBuild v1.16.728
---------------------------------------------------------------
---- { Image Build Mode } ----
Using CFLDV option, value 4
<enter> key on completion suppressed
building glitch2 image
per build directory overridden from command line to '..\nand\'
Using PATCHSMC option
data directory overridden from command line to '17489\'
1BL key overridden from command line, not looking for 1blkey.txt
1BL Key set to : 0xDD88AD0C9ED669E7B56794FB68563EFA sum: 0x983 (expects: 0x983)
xex Key set to : 0x20B185A59D28FDC340583FBB0896BF91 sum: 0x800 (expects: 0x800)
CPU key overridden from command line, not looking for cpukey.txt
CPU Key set to: 0x0533D***********************F9F1 (weight:0x35 valid; ecd: valid)
file name overridden from command line to '..\output\nandflash.bin'
------ parsing user ini at '..\nand\options.ini' ------
******* WARNING: could not open user ini at '..\nand\options.ini', skipping
default console DVD eject button is being used to start xell
------ parsing ini at '17489\_glitch2.ini' ------
ini version 17489
ini: label [coronabl_WB4G] found
found (1) 'cba_13121.bin' crc: 0x9255dfb1
found (2) 'cbb_13182.bin' crc: 0x6899f9ab
found (3) 'cd_12905.bin' crc: 0x58221592
found (4) 'ce_1888.bin' crc: 0xff9b60df
found (5) 'cf_17489.bin' crc: 0x26c9baed
found (6) 'cg_17489.bin' crc: 0xa9c9815e
ini dictates dual CB for this model
[rawpatch] label not found in ini
ini: label [flashfs] found
found (1) 'aac.xexp' crc: 0x40d5adce
found (2) 'bootanim.xex' crc: 0x85238a78
found (3) 'createprofile.xex' crc: 0x034acd79
found (4) 'dash.xex' crc: 0xdb4717cf
found (5) 'deviceselector.xex' crc: 0x1eb402b9
found (6) 'gamerprofile.xex' crc: 0xf4e4902e
found (7) 'hud.xex' crc: 0xb1485b31
found (8) 'huduiskin.xex' crc: 0x5fb2d289
found (9) 'mfgbootlauncher.xex' crc: 0xe9d4483a
found (10) 'minimediaplayer.xex' crc: 0x61f6c912
found (11) 'nomni.xexp' crc: 0x3ec9f846
found (12) 'nomnifwk.xexp' crc: 0x96bf4907
found (13) 'nomnifwm.xexp' crc: 0x772eb1df
found (14) 'SegoeXbox-Light.xtt' crc: 0xe0ee6049
found (15) 'signin.xex' crc: 0x68541d87
found (16) 'updater.xex' crc: 0xd63a84d9
found (17) 'vk.xex' crc: 0x81700712
found (18) 'xam.xex' crc: 0xa5741001
found (19) 'xenonclatin.xtt' crc: 0xd5d17ff5
found (20) 'xenonclatin.xttp' crc: 0x7a507ad1
found (21) 'xenonjklatin.xtt' crc: 0xdde4a14c
found (22) 'xenonjklatin.xttp' crc: 0xe2adddfb
found (23) 'ximecore.xex' crc: 0x86cbabf6
found (24) 'ximedic.xex' crc: 0x1d992bfb
found (25) 'ximedic.xexp' crc: 0xbee64013
found (26) '..\launch.xex' crc: 0x00000000
found (27) '..\lhelper.xex' crc: 0x00000000
found (28) '..\launch.ini' crc: 0x00000000
ini: label [security] found
found (1) 'crl.bin' crc: 0x00000000
found (2) 'dae.bin' crc: 0x00000000
found (3) 'extended.bin' crc: 0x00000000
found (4) 'fcrt.bin' crc: 0x00000000
found (5) 'secdata.bin' crc: 0x00000000
------ ini parsing completed ------
output name overridden to: ..\output\nandflash.bin
1BL RSA pub key (1BL_pub.bin) not available, signature checks will not be performed
PIRS RSA pub key (PIRS_pub.bin) not available, signature checks will not be performed
MASTER RSA pub key (MAST_pub.bin) not available, signature checks will not be performed
------ Checking ..\nand\nanddump.bin ------
..\nand\nanddump.bin file size: 0x3180000
FATX magic found, truncating load size to 0x3000000 bytes for mmc consoles
nanddump header checks passed OK!
Loading NAND dump (0x3000000 bytes)...done!
Detecting NAND controller type from dump data...
NAND dump is from a mmc machine
NAND dump uses big block controller
decrypting KeyVault at address 0x4000 of size 0x4000
keyvault decrypted OK, will use if no kv.bin is provided
decrypting SMC at address 0x800 of size 0x3800
SMC decrypted OK, will use if no external smc.bin is provided
seeking smc config in dump...found at offset 0x2ffc000! Using if no smc config is provided.
CF slot 0 decrypted ok LDV 0x03 Pairing: 0xbc6fa6
CF slot 1 decrypted ok LDV 0x04 Pairing: 0xbc6fa6
setting pairing data from image to 0xbc6fa6
pairing set to: bc 6f a6
LDV was already set to 4
Scanning for mobile data and fsroot...attempting to find valid anchor block
anchor block v 3347 at 0x2fe8000 is valid
anchor block v 3346 at 0x2fec000 is valid
anchor block v 3347 at 0x2fe8000 is selected
Mobiles found:
fsroot version 01 found at offset 0x02ee4000 len 0x4000 page 0x00000000
mobileB.dat version 01 found at offset 0x01024000 len 0x0800 page 0x00000001
mobileC.dat version 01 found at offset 0x0009c000 len 0x0200 page 0x00000002
mobileD.dat version 01 found at offset 0x00a28000 len 0x0800 page 0x00000003
mobileE.dat version 01 found at offset 0x012b0000 len 0x0800 page 0x00000004
extracting MobileB.dat from page 0x1 (offset 0x1024000), size 2048 (0x800) bytes
extracting MobileC.dat from page 0x2 (offset 0x9c000), size 512 (0x200) bytes
extracting MobileD.dat from page 0x3 (offset 0xa28000), size 2048 (0x800) bytes
extracting MobileE.dat from page 0x4 (offset 0x12b0000), size 2048 (0x800) bytes
Statistics.settings found at offset 0x2ff8000, size 4096 (0x1000) bytes
Manufacturing.data found at offset 0x2ff4000, size 4096 (0x1000) bytes
seeking security files...
crl.bin found in sector 0x945 size 0xa00...verified! Will use if external file not found.
dae.bin found in sector 0x942 size 0x7090...verified! Will use if external file not found.
extended.bin found in sector 0x90f size 0x4000...verified! Will use if external file not found.
fcrt.bin found in sector 0x381 size 0x4000...pub key to verify signature is not available, skipping!
verified! Will use if external file not found.
secdata.bin found in sector 0x940 size 0x400...verified! Will use if external file not found.
done!
Writing initial header to flash image
------ loading system update container ------
17489\su20076000_00000000 found, loading...done!
Read 0xb50000 bytes to memory
checking integrity...
header seems valid, version 2.0.17489.0
header hash is OK, checking content hashes...
content hashes seem OK, everything looks good!
extracted SUPD\xboxupd.bin (0x7ce00 bytes)
decrypting SUPD\xboxupd.bin\CF_17489.bin (0x4560 bytes)...done!
decrypting SUPD\xboxupd.bin\CG_17489.bin (0x7889c bytes)...done!
------ Loading bootloaders and required security files ------
reading ..\nand\smc.bin failed, using smc.bin from nand dump
reset smc load address to 0x800 size 0x3800
reading ..\nand\kv.bin failed, using kv.bin from nand dump
reading .\common\cba_13121.bin (0x1af0 bytes)
loaded cba_13121.bin, could not check signature rsa key not present!
reading .\common\cbb_13182.bin (0x9080 bytes)
reading .\common\cd_12905.bin (0x5090 bytes)
reading .\common\ce_1888.bin (0x5606a b pad 0x56070 b)
reading ..\nand\xell-gggggg.bin (0x40000 bytes)
extracted SUPD\xboxupd.bin\CF_17489.bin (0x4560 bytes)
extracted SUPD\xboxupd.bin\CG_17489.bin (0x7889c bytes)
reading 17489\bin\patches_g2corona_WB4G.bin (0x1a2c bytes)
reading ..\nand\smc_config.bin failed, using smc_config.bin from nand dump
-------------------
checking smc_config
-------------------
extracting config
------------------
SMC config info:
------------------
Target temps: Cpu: 82øC Gpu: 78øC Edram: 76øC
Max temps : Cpu: 89øC Gpu: 82øC Edram: 82øC
Cpu Fan : (auto)
Gpu Fan : (auto)
MAC Address : 7c:1e:52:77:6f:09
AVRegion : 0x00000300 (PAL50)
GameRegion : 0x02fe (PAL/EU)
DVDRegion : 2
resetKey : YARY
---------------------
Checking for smc config data patches
smc config was not patched
---------------------
could not check signature of cba_13121.bin, 1BL RSA key not present!
done!
patch slot offset reset to: 0xb0000
------ Patching BLs and modifying patches ------
Patching BLs...Done!
------ Patching boot reasons and options into flash header ------
Patching header for xell power reason
------ Encrypting and finalizing bootloaders ------
encoding smc.bin size 0x3800
SMC checksum: ba42ab9f
known clean SMC found, type: Corona v6.2(2.05)
patching SMC reset limit at offset: 0x13b4
SMC reset limit patched successfully!
encoding kv.bin size 0x4000
decrypted keyvault has been set for reference
Master RSA pub not available, not checking hash
encoding cba_13121.bin size 0x1af0
encoding cbb_13182.bin size 0xa100
CB 13182 seq 0x0304000e type: 0x03 cseq: 0x04 allow: 0x000e
expected fuses:
fuseset 00: C0FFFFFFFFFFFFFF
fuseset 01: 0F0F0F0F0F0FF0F0 (retail slim)
fuseset 02: 000F000000000000 (sequence)
fuseset 02: 0F00000000000000 (allow cseq 2)
fuseset 02: 00F0000000000000 (allow cseq 3)
fuseset 02: 000F000000000000 (allow cseq 4)
**dual CB flag detected!**
encoding cd_12905.bin size 0x5400
encoding ce_1888.bin size 0x56070
encoding xell-gggggg.bin size 0x40000
encoding cf_17489.bin size 0x4560
encoding cg_17489.bin size 0x788a0
encoding patches_g2corona_WB4G.bin size 0x550
done!
------ Adding bootloaders to flash image ------
adding smc.bin at raw offset 0x00000800 len 0x3800 (end 0x4000)
adding kv.bin at raw offset 0x00004000 len 0x4000 (end 0x8000)
adding cba_13121.bin at raw offset 0x00008000 len 0x1af0 (end 0x9af0)
adding cbb_13182.bin at raw offset 0x00009af0 len 0xa100 (end 0x13bf0)
adding cd_12905.bin at raw offset 0x00013bf0 len 0x5400 (end 0x18ff0)
adding ce_1888.bin at raw offset 0x00018ff0 len 0x56070 (end 0x6f060)
adding xell-gggggg.bin at raw offset 0x00070000 len 0x40000 (end 0xb0000)
adding cf_17489.bin at raw offset 0x000b0000 len 0x4560 (end 0xb4560)
adding cg_17489.bin at raw offset 0x000b4560 len 0x788a0 (end 0xc0000, rest in fs)
adding patches_g2corona_WB4G.bin at raw offset 0x000c0010 len 0x550 (end 0xc0560)
Fixing up FS table...done!
Writing zeropair CG patch slot overflow data to sysupdate.xexp1
at raw offset 0xd0000 len 0x0006ce00 (end: 0x0013ce00)...done!
------ adding 28 firmware files ------
extracted SUPD\aac.xexp (0x14000 bytes) (crc32: 0x40d5adce ini: 0x40d5adce)
adding as aac.xexp1 at raw offset 0x13ce00 len 0x00014000 (end 0x00150e00)
extracted SUPD\bootanim.xex (0x61000 bytes) (crc32: 0x85238a78 ini: 0x85238a78)
adding as bootanim.xex at raw offset 0x154000 len 0x00061000 (end 0x001b5000)
extracted SUPD\createprofile.xex (0xc000 bytes) (crc32: 0x034acd79 ini: 0x034acd79)
adding as createprofile.xex at raw offset 0x1b5000 len 0x0000c000 (end 0x001c1000)
extracted SUPD\dash.xex (0x5b0000 bytes) (crc32: 0xdb4717cf ini: 0xdb4717cf)
adding as dash.xex at raw offset 0x1c4000 len 0x005b0000 (end 0x00774000)
extracted SUPD\deviceselector.xex (0xa000 bytes) (crc32: 0x1eb402b9 ini: 0x1eb402b9)
adding as deviceselector.xex at raw offset 0x774000 len 0x0000a000 (end 0x0077e000)
extracted SUPD\gamerprofile.xex (0x1b000 bytes) (crc32: 0xf4e4902e ini: 0xf4e4902e)
adding as gamerprofile.xex at raw offset 0x77e000 len 0x0001b000 (end 0x00799000)
extracted SUPD\hud.xex (0x1d000 bytes) (crc32: 0xb1485b31 ini: 0xb1485b31)
adding as hud.xex at raw offset 0x79b000 len 0x0001d000 (end 0x007b8000)
extracted SUPD\huduiskin.xex (0x14000 bytes) (crc32: 0x5fb2d289 ini: 0x5fb2d289)
adding as huduiskin.xex at raw offset 0x7b9000 len 0x00014000 (end 0x007cd000)
extracted SUPD\mfgbootlauncher.xex (0x8000 bytes) (crc32: 0xe9d4483a ini: 0xe9d4483a)
adding as mfgbootlauncher.xex at raw offset 0x7d0000 len 0x00008000 (end 0x007d8000)
extracted SUPD\minimediaplayer.xex (0xc000 bytes) (crc32: 0x61f6c912 ini: 0x61f6c912)
adding as minimediaplayer.xex at raw offset 0x7d8000 len 0x0000c000 (end 0x007e4000)
extracted SUPD\nomni.xexp (0xf000 bytes) (crc32: 0x3ec9f846 ini: 0x3ec9f846)
adding as nomni.xexp1 at raw offset 0x7e4000 len 0x0000f000 (end 0x007f3000)
extracted SUPD\nomnifwk.xexp (0x2000 bytes) (crc32: 0x96bf4907 ini: 0x96bf4907)
adding as nomnifwk.xexp1 at raw offset 0x7f3000 len 0x00002000 (end 0x007f5000)
extracted SUPD\nomnifwm.xexp (0x5000 bytes) (crc32: 0x772eb1df ini: 0x772eb1df)
adding as nomnifwm.xexp1 at raw offset 0x7f6000 len 0x00005000 (end 0x007fb000)
extracted SUPD\SegoeXbox-Light.xtt (0x6000 bytes) (crc32: 0xe0ee6049 ini: 0xe0ee6049)
adding as SegoeXbox-Light.xtt at raw offset 0x7fd000 len 0x00006000 (end 0x00803000)
extracted SUPD\signin.xex (0x1a000 bytes) (crc32: 0x68541d87 ini: 0x68541d87)
adding as signin.xex at raw offset 0x806000 len 0x0001a000 (end 0x00820000)
extracted SUPD\updater.xex (0x7000 bytes) (crc32: 0xd63a84d9 ini: 0xd63a84d9)
adding as updater.xex at raw offset 0x822000 len 0x00007000 (end 0x00829000)
extracted SUPD\vk.xex (0xb000 bytes) (crc32: 0x81700712 ini: 0x81700712)
adding as vk.xex at raw offset 0x82b000 len 0x0000b000 (end 0x00836000)
extracted SUPD\xam.xex (0x251000 bytes) (crc32: 0xa5741001 ini: 0xa5741001)
adding as xam.xex at raw offset 0x837000 len 0x00251000 (end 0x00a88000)
extracted nanddump\xenonclatin.xtt (0x11b000 bytes) (crc32: 0xd5d17ff5 ini: 0xd5d17ff5)
adding as xenonclatin.xtt at raw offset 0xa89000 len 0x0011b000 (end 0x00ba4000)
extracted SUPD\xenonclatin.xttp (0x18000 bytes) (crc32: 0x7a507ad1 ini: 0x7a507ad1)
adding as xenonclatin.xttp1 at raw offset 0xba7000 len 0x00018000 (end 0x00bbf000)
extracted nanddump\xenonjklatin.xtt (0x1a8000 bytes) (crc32: 0xdde4a14c ini: 0xdde4a14c)
adding as xenonjklatin.xtt at raw offset 0xbc0000 len 0x001a8000 (end 0x00d68000)
extracted SUPD\xenonjklatin.xttp (0x7000 bytes) (crc32: 0xe2adddfb ini: 0xe2adddfb)
adding as xenonjklatin.xttp1 at raw offset 0xd68000 len 0x00007000 (end 0x00d6f000)
extracted SUPD\ximecore.xex (0x17000 bytes) (crc32: 0x86cbabf6 ini: 0x86cbabf6)
adding as ximecore.xex at raw offset 0xd6f000 len 0x00017000 (end 0x00d86000)
extracted nanddump\ximedic.xex (0x90000 bytes) (crc32: 0x1d992bfb ini: 0x1d992bfb)
adding as ximedic.xex at raw offset 0xd87000 len 0x00090000 (end 0x00e17000)
extracted SUPD\ximedic.xexp (0x2800 bytes) (crc32: 0xbee64013 ini: 0xbee64013)
adding as ximedic.xexp1 at raw offset 0xe18000 len 0x00002800 (end 0x00e1a800)
***** could not read file '..\launch.xex', skipping *****
***** could not read file '..\lhelper.xex', skipping *****
***** could not read file '..\launch.ini', skipping *****
------ adding 5 security files ------
<- Processing crl.bin ->
reading ..\nand\crl.bin (0xa00 bytes)
crl appears crypted, attempting to decrypt with CPU key...failed! Trying alternate key...success!
adding as crl.bin at raw offset 0xe1c000 len 0x00000a00 (end 0x00e1ca00)
<- Processing dae.bin ->
reading ..\nand\dae.bin (0xad30 bytes)
dae appears encrypted, attempting to decrypt with CPU key...failed! Attempting to decrypt with alternate key...
success!
adding as dae.bin at raw offset 0xe20000 len 0x0000ad30 (end 0x00e2ad30)
<- Processing extended.bin ->
reading ..\nand\extended.bin (0x4000 bytes)
adding as extended.bin at raw offset 0xe2c000 len 0x00004000 (end 0x00e30000)
<- Processing fcrt.bin ->
could not read fcrt.bin, using data from previous parse...
adding as fcrt.bin at raw offset 0xe30000 len 0x00004000 (end 0x00e34000)
<- Processing secdata.bin ->
reading ..\nand\secdata.bin (0x400 bytes)
adding as secdata.bin at raw offset 0xe34000 len 0x00000400 (end 0x00e34400)
------ checking for Mobile*.dat ------
MobileB.dat found, adding from previous parse
adding MobileB.dat as type 0x31 at raw offset 0xe38000 len 0x800 (end 0xe38800)
MobileC.dat found, adding from previous parse
adding MobileC.dat as type 0x32 at raw offset 0xe3c000 len 0x200 (end 0xe3c200)
MobileD.dat found, adding from previous parse
adding MobileD.dat as type 0x33 at raw offset 0xe40000 len 0x800 (end 0xe40800)
MobileE.dat found, adding from previous parse
adding MobileE.dat as type 0x34 at raw offset 0xe44000 len 0x800 (end 0xe44800)
Statistics.settings found, adding from previous parse
adding Statistics.settings at raw offset 0x2ff8000 len 0x1000 (end 0x2ff9000)
Manufacturing.data found, adding from previous parse
adding Manufacturing.data at raw offset 0x2ff4000 len 0x1000 (end 0x2ff5000)
------ adding smc_config.bin ------
adding smc config to offset 0x02ffc000, len 0x400
------ cleaning up image ------
Fixing up empty FS block entries...done!
Writing FS table to image offset 0xe48000 len 0x4000 (end 0xe4c000)...done!
copying anchor block 1 to offset 0x2fe8000
copying anchor block 2 to offset 0x2fec000
------ finalizing image ------
------ writing image to disk ------
writing file '..\output\nandflash.bin' to disk...done!
---------------------------------------------------------------
..\output\nandflash.bin image built, info:
---------------------------------------------------------------
Kernel : 2.0.17489.0
Console : Corona
NAND size : 48MiB MMC (system only)
Build : Glitch (v2)
Xell : power on console with console eject button
Serial : 686263414405
ConsoleId : 500374853218
MoboSerial: 7910079107671445
Mfg Date : 10/29/2011
CPU Key : 0533*************************F9F1
1BL Key : DD88AD0C9ED669E7B56794FB68563EFA
DVD Key : E434************************A420
CF LDV : 4
KV type : type2 (hashed - unchecked, master key not available)
---------------------------------------------------------------
xeBuild Finished. Have a nice day.
---------------------------------------------------------------
