.Map Modding Discussion

[Eazy B]

The purpose of this thread is to discuss .map modding and its implications. This was written to replace the thread with outdated information.

Section 1 - How is it done?
Modifications of .map files is accomplished by using one of two tools so far. These tools are:
1. A modified XEX
2. Real Time Memory Editing

Modified XEX

The Xbox 360's games are written in a format that is very similar to a PC. The game files are stored in a directory, and have .dll files as libraries as well as an executable, much like a computer. Although, instead of .exe files these are called .Xex files, aka Xenon Execuables. These files are specially compiled by Microsoft Xbox 360 SDK, and are illegal to distribute as they contain copyrighted code. You may be asking, what does this have to do with Halo 3 modding? Well, When you select a map in the mainmenu, the executable for Halo 3 uses the RSA public key for the .map files, to verify that they are unmodified. If the files are unmodified, the XeX allows the map to be loaded. Otherwise, the Xex will not allow the map to be loaded and will result in a 'You have failed to load the map' error. Anthony, Xenon/Detox, and Kornman have gotten around this by mapping out the Halo 3 XEX file, and removed the check, in PowerPC based Assembly Language. This allows them to load any map files.


Real Time Memory Editing
This method has been described very briefly before, so I will try to clarify it as much as possible. A development kit is capable of running two processes at once, one being the current Title and the other being the network debug monitor. Xenon/Detox realized this and decided to use it to his advantage until he created a modified XeX. In this method, the XeDK ( Xenon Development Kit) loads an unmodified version of Halo 3. The player then goes into an unmodified .map file, and begins gameplay. Now remember, a XeDK can run two processes at once. Xenon used this to his advantage by writing a program to send commands through the network to his XeDK. He would mod his map on PC, and tell his XeDK to 'synchronize' with the PC version of his map. The PC would send these changes over the network and would be reflected immediately ingame. This is where the term, Real Time Halo is coined from.




Section 2 - Xbox 360 Development Kits ( XeDK )
Both of the above methods require one to have an XeDK, this is because an XeDK can boot in-progress games aka XeX files. For method 1, the user will simply transfer their modified XEX to the Halo 3 section of their XeDK or Dvd, and run the game on the XeDK. Method 2 requires an XeDK because retail units do not have network debug capabilities.


Some common misconceptions are:
the 'Hybrid' Xbox 360 : This was a term coined in the early stages of modding when it was believed Microsoft would bring trouble to any one thought to possess an XeDK.
the Demo Kit: The Demo Kit is one of many types of Xbox 360 Development setups. Some of the most common set ups for these are:
1. the Demo Kit
2. The Reviewer's Kit
3. The Testing/Debug Kit
4. The Development Kit

All debug hardware offers the functionality required for Halo 3 modding. None of these kits can access Xbox LIVE service, They access a service called XePartnerNet.

It is recomended that you DO NOT purchase these items, as there are many additional software tools required to mod Halo 3, and it is a waste of hardware for actual developers and people who have legitimate other uses for them.





Section 3 - Why This isnt Possible on Retail
At this point the question may be coming into your mind, ' Why cant we just Resign the maps like Halo 2?'. Halo 2's .Map files were protected via a CRC Checksum. This is basically a string of hex written to the file telling the game what the files signature should come out to be. Halo 3 has a much stronger form of protection on the maps called RSA. This is a method of encryption/signing a file based on two keys. One of these is the public key, and the other the private key. Each key has a different function. The key we can access, the public key, is used for verifying a file is unmodified. The private key, which only bungie has, is used for signing/encrypting the files to be verified by the public key. This key is an RSA 2048 bit key, mathmatically designed to be impossible to crack in our lifetimes, thus raising the need for a method of bypassing it.


This thread will be used for discussion, all others closed/deleted.

[TJF]

Thanks, this really cleared a few things up for me.

[Eaton]

VERY nice thread.:biggrin:

[DJ Shepherd]

if you pin this, you might wanna do something with my moddibg outlook topic =^,.,^=

[xI V3n93ance Ix]

@Eazy B
You said its not possible on "Retail" Consoles ...
I thought we could run unsigned Code (modified XEX) with an another Kernel ?
Maybe you should clear that up, too

[DJ Shepherd]

uh... by all means show me the custom kernal... its a possibility not a reality

[lx leo xl]

I warning out there if you try to buy a devkit to mod halo 3 we will track you down and eat you alive.

This is why noobs shouldn't get developing kits

Quote:

Quote:

Quote:

Quote:

Quote:

Quote:

Quote:

i never offerd u 1900 i never offerd any1 anything for a reviewer kit so stfu

then I thought you were some one else, PS I hope you get a devkit, and then dont mod halo 3....

Tools aren't public and the people who made them like me more than what they would like you

what tools the xdk program i know people who have a dev kit and halo modding i have most of the unrelesed tools
i have the xxs container resighner with private keyvaults if that means anything to u so if theres a dev kit program or a halo modding tool, i can get it ,or i already have it.

but anyway i know how to get retail games to load on a dev but what program do i use to transfer the files to the hdd would i use xsata with xplorer360 or somthing else, thanx in advance

look i made a mistake get over it...
The tools that arent public are the .map moddibg tools

jhonson and engineer are very much so public and .map modding tools and if all else fails my friend ambi0 know shade in real life so anything i need i can get and i know how to edit the sbsp i have been modding halo sice halo1 i know very much so what i am doing

How will you run the map files? They have a 2048bit encryption key nobody knows

All i do is mod the xex file so it dosent check for a signature and run it on a debug unit

Its funny but sad to a low level..

[QWEEWQAZ]

Could I get a little info on "PowerPC based Assembly Language"? Like what is it?

Google tells me that PowerPC is a processor family or something and the xbox chip in the family is the Xenon chip. I fail to see how a Halo XeX needs to have a basic processor language to remove checks. O.o

[ddxcb]

Yea I belive the only way halo 3 map modding is to have a custom kernal to play unresign xex but prob if u can make one u just get banned from xbl but system link is ur friend. This is my opion

[shade45]

Quote: Originally Posted by Eazy B

At this point the question may be coming into your mind, ' Why cant we just Resign the maps like Halo 2?'. Halo 2's .Map files were protected via a CRC Checksum

I'd just like to point out that Halo 3 still uses a checksum to protect the contents of the map file. The RSA only covers the header.

[Eazy B]

Quote: Originally Posted by qweewqaz667

Could I get a little info on "PowerPC based Assembly Language"? Like what is it?

Google tells me that PowerPC is a processor family or something and the xbox chip in the family is the Xenon chip. I fail to see how a Halo XeX needs to have a basic processor language to remove checks. O.o

Assembly language is basically 'Machine Code'. Different processors use different machine code, so the names are usually after the processor. The 360 uses a PowerPC processor, so the assembly language is named after it. You need to know this language to edit the XEX because we do not have its source, nor can it be decompiled easily. So, you would Disassemble it in to its most basic code, which is what the 360 processor uses, therefore PPC ASM. To the question about running it on retail, there is an exploit in a king kong shader, but this has only been used to run Linux. If a person were to create a custom kernel for this exploit, then it could be plausibly done on retail if the creators of the xex/rth tools decide to release, which is again unlikely.

[Supermodder911]

The Xbox 360 has a few extra instructions in addition to the standard PPC instructions.

[xI V3n93ance Ix]

Quote: Originally Posted by Eazy B

Assembly language is basically 'Machine Code'. Different processors use different machine code, so the names are usually after the processor. The 360 uses a PowerPC processor, so the assembly language is named after it. You need to know this language to edit the XEX because we do not have its source, nor can it be decompiled easily. So, you would Disassemble it in to its most basic code, which is what the 360 processor uses, therefore PPC ASM. To the question about running it on retail, there is an exploit in a king kong shader, but this has only been used to run Linux. If a person were to create a custom kernel for this exploit, then it could be plausibly done on retail if the creators of the xex/rth tools decide to release, which is again unlikely.

As far as I know and read they currently try to make it "Noob friendly".
But I dont know how they want to make the Time Attack Noob friendly xD
The tools will be public when the time comes, and I think all the kernel stuff is allready finish, they want to make it Live-safe.
The devlopers of XBMC and Mimesis just started after the release of the 360 with their XDK´s to program.
I saw pictures of that.

We just have to wait ...

sry for dual Post, but I couldn´t find an "Edit" button.

@DJ Shepherd
I know that we dont have acess to it, but its out there

[Eazy B]

Quote: Originally Posted by xI V3n93ance Ix

As far as I know and read they currently try to make it "Noob friendly".
But I dont know how they want to make the Time Attack Noob friendly xD
The tools will be public when the time comes, and I think all the kernel stuff is allready finish, they want to make it Live-safe.
The devlopers of XBMC and Mimesis just started after the release of the 360 with their XDK´s to program.
I saw pictures of that.

We just have to wait ...

Sorry to inform you, but you are wrong.... XBMC developers havent touched the Xbox 360 yet. The MAME 360 was done on a development kit. I have direct word from the creator of the Halo 3 tools that it is unlikely for them to be released... No custom kernel has been made either.

[xI V3n93ance Ix]

?!
Im pretty sure I saw some Screens ^^
I would say that I wouldn´t make Homebrew for the 360 either if I would ...

And you´re sure that there is no Custom Kernel in the making ?
Like, never a modified 360 ?
No Homebrew ?
No Games on HDD ?
No XBC ?

[Supermodder911]

Sure its in the works. It hasn't been publicly announced.

[Eazy B]

Quote: Originally Posted by xI V3n93ance Ix

?!
Im pretty sure I saw some Screens ^^
I would say that I wouldn´t make Homebrew for the 360 either if I would ...

And you´re sure that there is no Custom Kernel in the making ?
Like, never a modified 360 ?
No Homebrew ?
No Games on HDD ?
No XBC ?

Sure it could be in the works, but never anounced for public release/usage.

[Sasquatch 45]

Thanks for the thread, this cleared a lot of things up for me.

[Supermodder911]

Eazy saying "The executable for Halo 3 uses the RSA public key in your .map files, to verify that they are unmodified." is pretty misleading.

There is no public key in the maps. If there was we could simply generate a new Keypair and sign the map with the private key we generated and simply replace the public key in the map with the public key that we generated.

[Eazy B]

Updated.