Hacking the Xbox

Recommendations

Info

38 Hacking the Xbox: An Introduction to Reverse Engineering graphics chip, MCPX, and CPU on the Xbox motherboard use BGA packages. Figure 2-3 shows a cross section of a BGA device, revealing the hidden connections underneath. Identifying the function of a particular integrated circuit is more challenging than identifying the function of a passive device. Functionally identical silicon can be purchased in a variety of packages that can look very different. In some cases, you can guess the function of a device by observing what the device is connected to or what it looks like, but the most reliable method is to read the part number off the chip and look it up on the web. (Typically, parts have some kind of logo or part number prefix that identifies the manufacturer, which you can use to find more data on the device by visiting the manufacturer’s website.) If you do not recognize the logo or the part number prefix, the services listed below can help you look up part functions. 1. www.findchips.com can take a part number or pieces of a part number and search the inventories of many distributors for inventory matches. Most common parts will show up in FindChips, and the links provided will often lead you not only to a short description of the part, but also pricing and ordering information. 2. www.google.com indexes everything on the web, and part numbers are no exception. Google can also be used to help find manufacturer’s websites if you query on the letters in the logo plus a descriptive term such as “semiconductors.” At the manufacturer’s website, you will probably need to find the specialized part search engine buried in the website or go to the semiconductor products sub-page in order to do a part number lookup. The search function on the front page of a company’s website will sometimes find part numbers, but more often it indexes only useless corporate and marketing pages. 3. If neither of these services gets you there, try stripping off some of the prefixes and suffixes on the part number. In our M29F080A example, querying just the part number 29F080 will bring you to the webpages of multiple manufacturers who make parts that are functionally compatible with the STMicroelectronics part. Manufacturer's logo (STMicroelectronics) Pin 1 marker ST M29F080A 70N1 5881K 0141 SINGAPORE Part Number Speed Grade Lot Code Date Code Origin Country Figure 2-4: Anatomy of a typical IC part number. The diagram is a cartoon of the chip at location U7D1 on the Xbox motherboard.
Try It Test Points Chapter 2 - Thinking Inside the Box 39 Let’s try looking up an Xbox part number. Locate U7D1 on the Xbox motherboard. Figure 2-4 illustrates what you might find. The part number is typically the longest number on the chip, and it often starts with one or two alphabetic characters. Memory chips and processors also frequently have a speed grade or quality suffix after the part number. Additionally, almost all chips have a date code. Date codes are usually a four digit number of the format YY-WW, where YY is the year the chip was manufactured, and WW is the workweek. In our example, our M29F080A part was manufactured in the 41 st week of 2001 in Singapore, and it has a speed grade of 70N1. The remaining number, 5881K, is a lot code whose meaning varies between manufacturers, but in general links a chip to a particular silicon wafer or silicon wafer lot’s tracking number in the fabrication facility. The “ST” logo indicates the manufacturer of this chip is STMicroelectronics, and fortunately the website for this manufacturer can be quickly found through Google or by guessing, as the URL for the company is simply www.st.com. Entering the part number M29F080A into the search field on the home page brings you directly to search results that include detailed datasheets and descriptions of this part — an 8 Mbit Uniform Block Single Supply FLASH ROM. Almost all circuit boards in consumer electronics feature structures designed to expedite the testing of the finished board in the factory. These “test points” exist to cope with the unfortunate reality of manufacturing defects. The Xbox is no exception when it comes to test points and manufacturing defects. The bottom of the Xbox motherboard is populated with hundreds of test points — tiny silvery circles — that allow a contact probe to access almost every interesting signal within the Xbox. These test points are a welcome gift to reverse engineers and to people who wish to modify their hardware, because they provide easy access to signals that might otherwise require a microscope and a steady hand. A set of test points are probed all at once on the manufacturing line with a piece of equipment called a “bed of nails tester.” Aptly named, the bed of nails tester consists of hundreds of spring-loaded “pogo pin” structures. A motherboard is aligned to the testbed and clamped down with either mechanical plungers or a vacuum chuck. Similarly, you can use pogo-pins to make your own solderless modifications to an Xbox motherboard by leveraging the test points. You will need to build your own circuit boards (see Appendix), but the result will be a board that you can install simply by screwing it down — no soldering required!
Page 1:
Hacking the Xbox An Introduction to
Page 4 and 5:
The US government is far and away t
Page 7 and 8: Hacking the Xbox An Introduction to
Page 9: In memory of Aaron Swartz
Page 12 and 13: x Hacking the Xbox: An Introduction
Page 14 and 15: xii Hacking the Xbox: An Introducti
Page 17: Acknowledgments I would like to tha
Page 20 and 21: 2 Hacking the Xbox: An Introduction
Page 28 and 29: 10 Hacking the Xbox: An Introductio
Page 85 and 86: CHAPTER 4 Building a USB Adapter Ca
Page 87 and 88: Strategy Chapter 4 - Building a USB
Page 89 and 90: Chapter 4 - Building a USB Adapter
Page 91 and 92: CHAPTER 5 Replacing a Broken Power
Page 93 and 94: Chapter 5 - Replacing a Broken Powe
Page 95 and 96: Strategy Chapter 5 - Replacing a Br
Page 101 and 102: Figure 5-6: The final cable assembl
Page 105: Chapter 5 - Replacing a Broken Powe
Page 108 and 109:
90 Hacking the Xbox: An Introductio
Page 110 and 111:
Page 112 and 113:
Page 114 and 115:
Page 116 and 117:
Page 118 and 119:
100 Hacking the Xbox: An Introducti
Page 120 and 121:
Page 122 and 123:
Page 124 and 125:
Page 126 and 127:
Page 128 and 129:
Page 130 and 131:
Page 132 and 133:
Page 134 and 135:
Page 137 and 138:
CHAPTER 8 Reverse Engineering Xbox
Page 139 and 140:
Chapter 8 - Reverse Engineering Xbo
Page 141 and 142:
Page 143 and 144:
Page 145 and 146:
clearance for motherboard component
Page 147 and 148:
Page 149 and 150:
Page 151 and 152:
Page 153 and 154:
Page 155 and 156:
CHAPTER 9 Sneaking in the Back Door
Page 157 and 158:
Chapter 9 - Sneaking in the Back Do
Page 159 and 160:
Page 161 and 162:
Page 163 and 164:
Page 165 and 166:
Page 167:
Note Chapter 9 - Sneaking in the Ba
Page 170 and 171:
Page 172 and 173:
Page 174 and 175:
Page 176 and 177:
Page 179 and 180:
CHAPTER 11 Developing Software for
Page 181 and 182:
Chapter 11 - Developing Software fo
Page 183 and 184:
Page 185 and 186:
Page 187 and 188:
Page 189 and 190:
Page 191 and 192:
CHAPTER 12 Caveat Hacker Reverse en
Page 193 and 194:
Chapter 12 - Caveat Hacker 175 tech
Page 195 and 196:
Chapter 12 - Caveat Hacker 177 type
Page 197 and 198:
Chapter 12 - Caveat Hacker 179 art
Page 199 and 200:
Chapter 12 - Caveat Hacker 181 tres
Page 201 and 202:
Chapter 12 - Caveat Hacker 183 Also
Page 203 and 204:
Chapter 12 - Caveat Hacker 185 oppo
Page 205 and 206:
Chapter 12 - Caveat Hacker 187 inte
Page 207 and 208:
Chapter 12 - Caveat Hacker 189 Such
Page 209:
Chapter 12 - Caveat Hacker 191 his
Page 212 and 213:
Page 214 and 215:
Page 216 and 217:
Page 218 and 219:
Page 220 and 221:
Page 222 and 223:
Page 224 and 225:
Page 226 and 227:
Page 228 and 229:
Page 230 and 231:
Page 232 and 233:
Page 234 and 235:
Page 236 and 237:
Page 238 and 239:
Page 240 and 241:
Page 242 and 243:
Page 244 and 245:
Page 246 and 247:
Page 248 and 249:
Page 250 and 251:
Page 252 and 253:
Page 255 and 256:
APPENDIX D Getting Started with FPG
Page 257 and 258:
Appendix D - Getting Started with F
Page 259 and 260:
Page 261 and 262:
Page 263:
Page 266 and 267:
Page 268 and 269:
Page 270 and 271:
Page 272 and 273:
Page 275 and 276:
APPENDIX F Xbox Hardware Reference
Page 277 and 278:
Appendix F - Xbox Hardware Referenc
Page 279 and 280:
Appendix F - Xbox Hardware Referenc
Page 281 and 282:
DVD-ROM Power Connector Appendix F
Page 283:
Fan Connector Appendix F - Xbox Har
Page 286 and 287:
268 continuity mode, in DMMs 19 Cop
Page 288 and 289:
270 Molex 76 Moore’s Law 5 Mosis
Page 290 and 291:
272 Virtex-II FPGA 123 Visor 139, 1
show all

Hacking the Xbox

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?