Hacking the Xbox

Chapter 10 - More Hardware Projects 155
Alternate Firmware Devices vs.
Modchips
An alternate firmware device is a hardware module that
provides a method for running user-specified firmware on
the Xbox hardware. Alternate firmware devices are distinguished
from the so-called “modchip” in that an alternate
firmware device is furnished as a blank device and has no
inherent ability to circumvent copyright control mechanisms.
A blank LPC-interface ROM device, for example, is
an alternate firmware device: you could burn a copy of
the U.S. Bill of Rights on it if you wanted. Any user-installed
FLASH ROM that comes blank is also an alternate firmware
device. A modchip, on the other hand, colloquially implies
a device that is crafted for playing game backups and
otherwise modifying or removing DRM (digital rights management)
policy restrictions. Hence, the term modchip encompasses
certain boot ROM devices that have been programmed
with code that enables DRM policy modifications,
as well as devices such as “patchers” that contain no
ROM and operate by dynamically patching a few key
Xbox firmware locations as the firmware is loaded for execution.
appears near both the top- and the bottom-relative base addresses. Now,
suppose that Microsoft decided to save on cost and shrink their 1 MB boot
ROM down to a 256 kB boot ROM. The processor now sees 64 identical
copies of this 256 kB boot ROM distributed over the 16 MB ROM address
space, and all of the old code that uses bottom- and top-relative addressing
still works. Significantly, the CPU in the Xbox is hard-wired to start
executing code on power-up from an address located 16 bytes from the top
of memory (its “reset vector”), while the hardware initialization routines
wired into the Xbox chipsets use ROM locations located near the bottom
of the 16 MB FLASH ROM space. As a result, the Xbox hardware requires
an LPC ROM implementation that is either 16 MB in size, or else aliases a
smaller ROM’s contents throughout the FLASH ROM address space. (The
SST 49LF020 is one of the few LPC FLASH ROMs that aliases the ROM’s
contents over the whole address space. Arguably, this feature is actually a
bug: By ignoring the upper address bits and aliasing the ROM’s contents
over the whole address space, this chip occupies space that could be allocated
to other functions. As a result, SST has released an updated “A-step” of the
part, called the 49LF020A, that does not alias the ROM’s contents over
memory. Likewise, the A-step silicon will not work as an alternate firmware
device for the Xbox.)
The Other 64 MB of SDRAM
An astute observer will note that there are two missing chips on the top
side of the Xbox motherboard, and that these missing chip spots look