Hacking the Xbox

264
Hacking the Xbox: An Introduction to Reverse Engineering
LPC Connector
The Xbox features a debug and test port based on the LPC (Low Pin
Count) bus. This bus was originally defined by Intel for use with
Southbridge chipsets to reduce pin count, thus saving on cost, while
maintaining support for legacy PC I/O functions. These legacy I/O
functions used to sit on the nearly extinct ISA bus, and they include the
keyboard, mouse, serial port, parallel port, and boot ROM. Intel’s specification
for the LPC bus can be found at http://www.intel.com/design/
chipsets/industry/25128901.pdf.
The LPC debug connector is particularly significant because it can be used to
supply an alternate ROM image to the Xbox in case the built-in ROM is
absent or corrupted in a fashion that makes the ROM seem absent or blank.
This feature can be and has been used to make an easy to install alternate
boot ROM for the Xbox.
The pinout for the Xbox LPC debug connector seems to be based on the
Installable LPC Debug Module Design Guide by Intel, http://
www.intel.com/technology/easeofuse/LPC_mod_spec72.pdf,
with some minor modifications as noted in Table F-7. In particular, the
function of pin 16 is unclear, as its companion pin 15 was re-assigned to be
a power pin on the Xbox motherboard. The allocation of pin 15 as a power
pin is deduced by the fat trace and nearby decoupling capacitor allocated to
the pin. If pin 15 were intended for use as a permanently high SPDA1
signal, then a narrower trace without the power conditioning would have
been used.
Pin Name Comment Pin Name Comment
1 LCLK 33 MHz clock
Start, end of LPC
2 VSS Current return
3 LFRAME# transactions 4 KEYWAY Blank for polarizing
5 LRST# LPC Reset 6 VCC5 +5V power
7 LAD3# Muxed Address/Data 8 LAD2# Muxed Address/Data
9 VCC3 +3.3V power 10 LAD1# Muxed Address/Data
11 LAD0# Muxed Address/Data 12 VSS Current return
13 SCL I2C serial clock 14 SDA I2C serial data
+3.3V power (was
Address select for serial
15 VCC3 SPDA1 in Intel spec.) 16 SPDA0 EEPROM device (?).
Table F-7: LPC connector pinout (as viewed on motherboard).