Hacking the Xbox

Try It
Test Points
Chapter 2 - Thinking Inside the Box 39
Let’s try looking up an Xbox part number. Locate U7D1 on
the Xbox motherboard. Figure 2-4 illustrates what you might
find. The part number is typically the longest number on
the chip, and it often starts with one or two alphabetic
characters. Memory chips and processors also frequently
have a speed grade or quality suffix after the part number.
Additionally, almost all chips have a date code. Date codes
are usually a four digit number of the format YY-WW, where
YY is the year the chip was manufactured, and WW is the
workweek. In our example, our M29F080A part was manufactured
in the 41 st week of 2001 in Singapore, and it has a
speed grade of 70N1. The remaining number, 5881K, is a
lot code whose meaning varies between manufacturers, but
in general links a chip to a particular silicon wafer or silicon
wafer lot’s tracking number in the fabrication facility.
The “ST” logo indicates the manufacturer of this chip is
STMicroelectronics, and fortunately the website for this
manufacturer can be quickly found through Google or by
guessing, as the URL for the company is simply www.st.com.
Entering the part number M29F080A into the search field on
the home page brings you directly to search results that
include detailed datasheets and descriptions of this part
— an 8 Mbit Uniform Block Single Supply FLASH ROM.
Almost all circuit boards in consumer electronics feature structures designed
to expedite the testing of the finished board in the factory. These “test
points” exist to cope with the unfortunate reality of manufacturing defects.
The Xbox is no exception when it comes to test points and manufacturing
defects. The bottom of the Xbox motherboard is populated with hundreds
of test points — tiny silvery circles — that allow a contact probe to
access almost every interesting signal within the Xbox. These test points
are a welcome gift to reverse engineers and to people who wish to
modify their hardware, because they provide easy access to signals that
might otherwise require a microscope and a steady hand.
A set of test points are probed all at once on the manufacturing line with a
piece of equipment called a “bed of nails tester.” Aptly named, the bed
of nails tester consists of hundreds of spring-loaded “pogo pin”
structures. A motherboard is aligned to the testbed and clamped down
with either mechanical plungers or a vacuum chuck. Similarly, you can use
pogo-pins to make your own solderless modifications to an Xbox
motherboard by leveraging the test points. You will need to build your
own circuit boards (see Appendix), but the result will be a board that you
can install simply by screwing it down — no soldering required!