Bunny
♥ Tattoos and XDKs ♥
Xbox 360 Development Kits are Xbox 360s produced by Microsoft for their personal development team and other game studios.
How XDKs all Started
Xbox 360 Development Kits all started with the Production of the Xenon Alpha Mac Kit (Xenon Alpha G5 Kit)
How XDKs all Started
Xbox 360 Development Kits all started with the Production of the Xenon Alpha Mac Kit (Xenon Alpha G5 Kit)
SOURCE:
This console was the very beginning to the production of the xbox 360.
After this console, the production of the XeDK (Xenon Development Kit) began in 2004.
XeDK
The XeDK (Xenon Development Kit) was the first xbox 360 development kit produced in the same design of the xbox 360 consoles today. These consoles were only meant to be stress tested with before they were shipped over seas to be destroyed. Thanks to those who salvaged some of them, we are here to gather the information we have on them today.
The XeDK came in 2 productions:
XeDK Beta-1
XeDK Beta-2
XeDK Beta-1
*XENON MOTHERBOARDS ONLY*
The XeDK beta-1 was the prototype xenon development kit produced by Microsoft in 2004. During the production of these consoles, Microsoft didnt have a name for it besides XeDK. The original plan was to name the console "Xenon". Microsoft not having a definate name for the console not having "Xbox 360" Printed anywhere on the console (besides the back sticker above the A/V Port that says "XBOX 360 XeDK").
These consoles were the only ones built with black molded plastic for the RF board cover and fan shroud. They were also the only xbox development kits that had the Argon RF board and Titan Kernel debugging board. The argon board on these consoles are only compatible with wired controllers to connect to the XeDK. The prototype wired controllers that came with these consoles are called Krypton controllers.
XeDKs only have beta Recoveries and therefor do not have the capability to read XeX2 files. These consoles can only run XeX1 files and compiled exe's. Beta-1 XeDKs can not and will never be able to update to a recovery capable of doing so.
XeDK Beta-2
*XENON MOTHERBOARDS ONLY*
The XeDK Beta-2 was produced shortly after the Beta-1 console and had a white case and white molded plastic (just like the current consoles).
These consoles are basically the same as the beta-1 consoles besides them having no Titan board, Argon board, or smc LEDs. These consoles do have the stress wires and xbox 360 printing on the case similar to the current white consoles.
XeDKs possess the capability of running a hacked recovery to run XeX2 files!
PICTURES:
XDK
Xbox 360 Development Kits were produced after Microsoft ordered all of the XeDK consoles to be destroyed overseas.
XDKs come in all motherboard revisions and run signed and unsigned XeX2 files. XDKs come in several different motherboard types that have different capabilities.
Types of Xbox 360 Development Kits
Stress Kit
Demo Kit
Reviewer Kit
Test Kit
Development Kit
XNA Kit
no matter what kit you have it falls under one of the 2 categories test or dev, (says in xna launcher)
Development Kits can kernel debug (ability to set, poke, or get memory, ie: editing games in realtime), unlike a Test Kit. They have full support for both DVD Emulation and PIX Debugging through the sidecar.
Test kits can ultimately be converted to Dev Kits by flashing them with a dev nand or running a temporary xex to patch it.
Determining Your Motherboard Type
Use this diagram to determine your motherboard if you don't already know how to.
Determining Dev or Test MOBO
XNA kit 1GB on board Ram = dev mobo
dev kit (sidecar) = dev mobo
test kit (sidecar) = test mobo
demo kit = either mobo
reviewer kit = dev mobo
stress test kit ( 05 ones have hole on side of case ) = dev mobo
Beta 1 kit
Beta 2 Kit
Determining your type of XDK
Reviewer Kit
Xenon - Jasper Motherboards
*No Headers for sidecar*
Stress Kit
Xenon - Jasper Motherboards
*Has headers for sidecar*
Demo Kit
Xenon - Jasper Motherboards
*No Headers for sidecar*
Test Kit
Xenon - Jasper Motherboards
*Has headers for sidecar*
Development Kit
Xenon - Jasper Motherboards
*Has headers for sidecar*
XNA Kit (Prototype/Gigabit Ethernet Sidecar)
Jasper Motherboards ONLY
*Has headers for sidecar*
Jasper Motherboards ONLY
*Has headers for sidecar*
XNA Kit (Expo Model)
Jasper Motherboards ONLY
*Has headers for sidecar*
XNA Final Kit
Jasper Motherboards ONLY
*Has headers for sidecar*
XNA Test Kit (Final)
Jasper Motherboards ONLY
*Has headers for sidecar*
Slim Prototype Kit
Trinity - Corona Motherboards
*Has no sidecar port*
Slim Engineering Kit
Trinity - Corona Motherboards
*Has port for sidecar*
Slim Final Kit
Trinity - Corona Motherboards
*Has port for sidecar*
Sidecars
A sidecar is a big box like shape on top of the Kit that is used for DVD Emulation, Investigating performance, and as a Hard Drive. These sidecars were produced in the colors Black, Grey, White, and Metallic Blue for XNA kits.
They either have one, or two USB ports on the back of them, each has their own use.
If you don't use a sidecar with a kit, you can use a standard power supply with it.
However,if you do use a sidecar you need a different type of power supply.
You need a 213W Power supply for it to work correctly.
Sidecar USB Ports
As stated above,a sidecar will either have one,or two USB ports.
These both serve different functions,and yes,two is better than one but is more expensive as a result.
Usually you will find 2 USB's on a sidecar intended for a Development Kit.
If the sidecar has one USB port, that USB is used for DVD Emulation.
If the sidecar has two USB ports, the first one will be used for DVD Emulation and the second one will be used for PIX.
DVD EMU
DVD Emulation allows you to play or debug games that are a work in project directly from your computers hard drive without the need to transfer the game onto the Kit.
PIX
PIX (Performance Investigator for Xbox) basically allows you to see your CPU output. Now that the ethernet port can investigate performance, the pix port is no longer needed on sidecars. This is why you dont see PIX ports on the XNA and slim sidecars.
PICTURES
Blue XNA Sidecar
Black Sidecar
Grey Sidecar
White Sidecar
Slim Sidecar + INTERNALS
PNET (Partner Network)
PNET is Xbox live for Xbox 360 Developers.
XDKs can only connect to PNET and other development networks, Ex: Production Network. XDKs will never be able to connect to XBOX LIVE.
PNET is a Xbox live server where developers share, test, and debug content released by other developers or by Microsoft prior to the release to the public.
Everything on PNET is free, including downloads, Microsoft points, and Xbox live.
Nothing on a PNET account can be transferred to a retail console so no, you can not get free Xbox live membership or Microsoft points through this.
Most of this information is now irrelevant considering that Partner Network is now whitelisted and only those manually added by Microsoft can connect to the server.
PNET is Xbox live for Xbox 360 Developers.
XDKs can only connect to PNET and other development networks, Ex: Production Network. XDKs will never be able to connect to XBOX LIVE.
PNET is a Xbox live server where developers share, test, and debug content released by other developers or by Microsoft prior to the release to the public.
Everything on PNET is free, including downloads, Microsoft points, and Xbox live.
Nothing on a PNET account can be transferred to a retail console so no, you can not get free Xbox live membership or Microsoft points through this.
Most of this information is now irrelevant considering that Partner Network is now whitelisted and only those manually added by Microsoft can connect to the server.
Extras
Here are some Accessories, parts, boards, tools, ect...
Prototype/XDK PSUs
213w PSU *Used to power XDKs with Sidecars*
Prototype Slim PSU *Used to power Prototype slim XDKs*
Krypton Controller
The Xbox 360 Wired Prototype Krypton Game pad(controller) was made for the XeDK Beta-1 consoles. These controllers were used on XeDK Beta-1 consoles because they had Argon RF boards. Argon RF boards only allow the connection of wired controllers though one of the USB ports on the console.
Versions of the Controller
Motherboard
Physical characteristics:
Lamprey Board
Ok, these boards made by Microsoft have been rumored to do countless remarkable things in the development of XDKs.
Lamprey Board:
These Lamprey Boards were used to:
1. Program a Retail Xbox 360 into Development Kit during MFC boot mode
2. Convert serials
3. Program Argon RF Boards
4. Kernal debug XDKs
5. Flash nands (with addon boards)
6. Reverse engineer the 360 SPI
Full Setup with Lamprey board, Argon board, Stress wires connected to a XDK, ect... :
A developer with Xboxs ready to program:
Clue:
Here are some Accessories, parts, boards, tools, ect...
Prototype/XDK PSUs
213w PSU *Used to power XDKs with Sidecars*
Prototype Slim PSU *Used to power Prototype slim XDKs*
Krypton Controller
The Xbox 360 Wired Prototype Krypton Game pad(controller) was made for the XeDK Beta-1 consoles. These controllers were used on XeDK Beta-1 consoles because they had Argon RF boards. Argon RF boards only allow the connection of wired controllers though one of the USB ports on the console.
Versions of the Controller
Motherboard
Physical characteristics:
Lamprey Board
Ok, these boards made by Microsoft have been rumored to do countless remarkable things in the development of XDKs.
Lamprey Board:
These Lamprey Boards were used to:
1. Program a Retail Xbox 360 into Development Kit during MFC boot mode
2. Convert serials
3. Program Argon RF Boards
4. Kernal debug XDKs
5. Flash nands (with addon boards)
6. Reverse engineer the 360 SPI
Full Setup with Lamprey board, Argon board, Stress wires connected to a XDK, ect... :
A developer with Xboxs ready to program:
Clue:
Rare Faceplates
XeDK Beta 1 Faceplate(Black)
This faceplate is so unique because of its USB rubber flap doors that can be opened one at a time and because it doesnt fit on any consoles other than the beta 1 kits!
This faceplate is incredably hard to find in good condition.
XeDK Beta 2 Faceplate(White)
This faceplate is much rarer than the XeDK beta 1 faceplate. This is the only photo of one I have ever been able to find of it.
XeDK Beta 1 Faceplate(Black)
This faceplate is so unique because of its USB rubber flap doors that can be opened one at a time and because it doesnt fit on any consoles other than the beta 1 kits!
This faceplate is incredably hard to find in good condition.
XeDK Beta 2 Faceplate(White)
This faceplate is much rarer than the XeDK beta 1 faceplate. This is the only photo of one I have ever been able to find of it.
XNA Faceplate
The XNA faceplate only comes off of XNA Development kits. Im pretty sure you can guess why it is so rare and valuable.
Xbox One XDK
Considering they have not yet been obtained by anyone willing to drop much information on them yet, I will be showing you pictures of the motherboard and different Prototypes produced.
Xbox One XDK Bare Motherboard
Xbox One XDK Internals
White Xbox One XDK
Zebra Xbox One XDK
Clear Xbox One XDK
Xbox One XDK's connected to Lamprey boards
Downloads
Return to Launcher
*Returns you to Xshell from the dashboard*
http://www.mediafire.com/download/yvrvp6ib6fnisnp/C0DE0004.rar
DevLink 1.0
*Allows you to system link with a retail Xbox 360*
http://www.mediafire.com/download/xln9e3ozmm73sux/DevLink1.0.rar
HvxDump 1.3
*Dumps your KV and CPU Key while on recovery 20353 or below*
http://www.mediafire.com/download/n6c414xgm47ivea/HvxDump-1.3.rar
HvxBootOS 1.0
*Runs Xell on recovery 20353 or below*
http://www.mediafire.com/download/5b5f3kmy8n8nqiy/HvxBootOS_1_0.rar
Test to Dev
*Patches your Test Kit to a full Dev Kit*
http://www.mediafire.com/download/reosau1zeqxxxbn/Test_to_Dev.rar
Internal Drive Linker
*Lets you access all memory partitons*
http://www.mediafire.com/download/7j2m82dtdfkm7v5/InternalDriveLinker(Access_Flash_Volume).rar
X360GameHack
*Patches your extracted game's xexs to run on your XDK*
http://www.mediafire.com/download/jzdsir62a2k3xdl/X360GameHack.exe
XbMovie GUI
*Lets you record your screen over your ethernet connection*
http://www.mediafire.com/download/axfgoxe3e84c6g8/xbmovie_gui.exe
Live Environment Files
*Live environments are additional networks you can connect to on your XDK*
https://mega.co.nz/#!YF5RBIgL!37g1ffT7N8tIn2IyI8noNOSPmYzxKXVQC-1G1hu04Zs
Party Buffalo
*Lets you access the Dev partitions of your HDD via transfer cable*
https://mega.co.nz/#!ZdhD1QxR!rFKkoIU7QbY436UXy56FRw68XbE9gszJMxaQaPpo5UM
x360 Version Info Tool
*Gives you the MD5 and information on recoveries and SDKs*
http://www.mediafire.com/download/a9qgwah7qqex6qo/x360_devkit_version_info_tool.exe
XShell Themes + Dowloads
Xshell themes are backgrounds for the main screen on your XDK once it boots.
Halo Themes.
Halo 4 Hologram
(Created By Vonkova)
Waypoint
(Created by Vonkova)
Halo 4
(Created by Vonkova)
Halo 3
(Created By Drachir)
Final Fantasy Themes.
Final Fantasy Xii-2
Final Fantasy Xii-2 (Light)
Color Themes.
Color Flare
(Created by Vonkova)
Space Themes.
Chill In Space
(Created by Vonkova)
Original Xshell
(BG by Microsoft, Updated by ???)
ZntvljBI4vWMXq0K2LBNIVSX9ip7D1UMtix2cuYGxiA
White XNA
(Created By ???)
Steam Themes
Steam Replication
(Made by Vonkova)
Paint Themes
Paint Splatter
(Made by Vonkova)
4chan Themes
4Chan
(Made by DevUltra)
Ironman Themes
S.H.I.E.L.D. OS. Xshell
(Created By Vonkova)
Sound Cloud Themes
Soundcloud
(Created By CAPiiX)
Pink Floyd Themes
Pink Floyd
(Created By DevUltra)
Xbox Live Enforcement Theme
Xbox Live Enforcement Xshell
(Created By Vonkova)
Metro Themes
Metro baby Blue
(Created by Vonkova)
Metro Dark Blue
(Created by Vonkova)
Metro Orange
(Created by Vonkova)
Documentation
XDK vs Retail Efuse
MADE BY xXXBOXxHACKERXx Kinect Dashboard Leaker
DO NOT COPY AS YOUR OWN WORK!
some infor from http://free60.org/Fusesets
SCROLL DOWN FOR INFO!
DEVKIT FUSES:
FUSESET 00:C0FFFFFFFFFFFFFF
FUSESET 01:0F0F0F0F0F0FF00F
FUSESET 02:0000000000000000
FUSESET 03XXXXXXXXXXXXXXX
FUSESET 04XXXXXXXXXXXXXXX
FUSESET 05:YYYYYYYYYYYYYYYY
FUSESET 06:YYYYYYYYYYYYYYYY
FUSESET 07:0000000000000000
FUSESET 08:0000000000000000
FUSESET 09:0000000000000000
FUSESET 10:0000000000000000
FUSESET 11:0000000000000000
RETAIL FUSES:
FUSESET 00:C0FFFFFFFFFFFFFF
FUSESET 01:0F0F0F0F0F0F0FF0
FUSESET 02:0F00000000000000
FUSESET 03XXXXXXXXXXXXXXX
FUSESET 04XXXXXXXXXXXXXXX
FUSESET 05:YYYYYYYYYYYYYYYY
FUSESET 06:YYYYYYYYYYYYYYYY
FUSESET 07:0000000000000000
FUSESET 08:0000000000000000
FUSESET 09:0000000000000000
FUSESET 10:0000000000000000
FUSESET 11:0000000000000000
RETAIL BINARY FUSES:
Fuseset 00: 1100011111111111111
Fuseset 01: 0101010101010110
Fuseset 02: 0100000000000000
Fuseset 03: 1001111110110000000101110100000000010101011101000101000000000000
Fuseset 04: 1001111110110000000101110100000000010101011101000101000000000000
Fuseset 05: 1101010101101001101110101101011010010101100011011011000000000000
Fuseset 06: 1101010101101001101110101101011010010101100011011011000000000000
Fuseset 07: 1111000000000000
Fuseset 08: 0000000000000000
Fuseset 09: 0000000000000000
Fuseset 10: 0000000000000000
Fuseset 11: 0000000000000000
ACTUAL RETAIL DUMP FOR BINARY:
fuseset 00: C0FFFFFFFFFFFFFF
fuseset 01: 0F0F0F0F0F0F0FF0
fuseset 02: 0F00000000000000
fuseset 03: 9FB0174015744DAF
fuseset 04: 9FB0174015744DAF
fuseset 05: D569BAD6958DAE9D
fuseset 06: D569BAD6958DAE9D
fuseset 07: FFFF000000000000
fuseset 08: 0000000000000000
fuseset 09: 0000000000000000
fuseset 10: 0000000000000000
fuseset 11: 0000000000000000
INFO:
FUSES 10-11 = 0A-0B
x+Y= CPU KEY
The dev kit fuseSet 2 is different. In another document by microsoft to make retail a dev it says:
6) Reset the console type from Retail to Dev (Agile doc H03710)
RETAIL 00000002
DEVELOPMENT 00000001
DEV:
Fuseset 01:0F0F0F0F0F0FF00F
RETAIL:
Fuseset 01:0F0F0F0F0F0F0FF0
DEV BINARY:
Fuseset 01: 0101010101011001
RETIAL BINARY:
Fuseset 01: 0101010101010110
so this means that it reverses 4 fuses in the procceses and retail is 2 so if retail is 0110
and dev is 1001 this mean you convert 2 together to 1-2 apart to get f00f
The size of the Retail version is: 16.5 MB (17,301,504 bytes)
The size of veron Devkit fact: 66.0 MB (69,206,016 bytes)
The Xbox 360's Xenon CPU has 768 bits of eFUSE, a technology invented by IBM, and implemented
in some of it's processors. eFUSEs are hardware fuses on the CPU, and can be "blown" to a binary
value (1 being blown, and 0 being un-blown) in the Xbox 360, there are 768 fuses, that make up
the fusesets. Though each fuseset can be blown individually, they are blown in groups of 8 to
make a hexadecimal value for the CPU key, and fuseline 00, instead of a binary value, which is
what XeLL will actually display. Technically, there are only 192 viewable fuses.
Fusesets 00 and 01
These are burned at the factory, after the console is manufactured, they show whether
the console is a devkit or not. They also disable CPU JTAG after the console's flash is programed.
Fuseset 02
This is the lockdown counter for the 2BL/CB (The 2nd Bootloader, stored in NAND Flash)
One of these are burned everytime the console updates it's bootloader (Which isn't very often)
this is the reason that there is no way to recover a JTAG that has been updated to 2.0.8***.0,
even is you have the CPU key, (2BL is encrypted with the CPU/1BL key, but is signed with
Microsoft's private key so you can't change the lockdown counter in the NAND. The bootloader
will fail signature checks, and panic)
Fusesets 03-06
These make up the CPU key. These start out as all zero's, and are burned presumably at random when
the console boots for the first time, they are used to encrypt the keyvault, and the bootloader
sections. The CPU key is unique to each console, and is sometimes refered to as the "per-box key"
To find the CPU key, add fusesets 03, and 05, OR 04 and 06. For example, this console's CPU key
would be "XXXXXXXXXXXXXXXXYYYYYYYYYYYYYYYY."
Fusesets 07-11
These make up the console's "Lockdown Counter." They are blown after each dashboard update starting
with the update from 4532/4548 to 4598. They prevent a previous version of the dashboard from being
run on an updated console. There are enough eFUSEs in this section for Microsoft to update the
console roughly 80 times. The lockdown counter of this console is at FFFF00000..., this means that
it has recieved 4 dashboard updates since 2.0.4548.0 ran on it. Microsoft originally intended to
only blow an eFUSE when a system update patched a critical vulnerability (Like the HV vulnerability
in 4532 and 4548) but has now decided to blow an eFUSE with every update since the update to 4598.
In the NAND's 6BL(CF) section, there is another lockdown counter that should match the one of the
eFUSEs. If it doesn't match, the console will panic on boot, and will show a RRoD. Now, here's the
good part! If we know the CPU key of the console, we can decrypt the 6BL, and change the lockdown
counter in the NAND to match the one on the console, and therefore run an older dashboard. Since
the 6BL isn't signed with Microsoft's private key, we can edit it as we please, so long as we have
our CPU key.
some infor from http://free60.org/Fusesets
SCROLL DOWN FOR INFO!
DEVKIT FUSES:
FUSESET 00:C0FFFFFFFFFFFFFF
FUSESET 01:0F0F0F0F0F0FF00F
FUSESET 02:0000000000000000
FUSESET 03XXXXXXXXXXXXXXX
FUSESET 04XXXXXXXXXXXXXXX
FUSESET 05:YYYYYYYYYYYYYYYY
FUSESET 06:YYYYYYYYYYYYYYYY
FUSESET 07:0000000000000000
FUSESET 08:0000000000000000
FUSESET 09:0000000000000000
FUSESET 10:0000000000000000
FUSESET 11:0000000000000000
RETAIL FUSES:
FUSESET 00:C0FFFFFFFFFFFFFF
FUSESET 01:0F0F0F0F0F0F0FF0
FUSESET 02:0F00000000000000
FUSESET 03XXXXXXXXXXXXXXX
FUSESET 04XXXXXXXXXXXXXXX
FUSESET 05:YYYYYYYYYYYYYYYY
FUSESET 06:YYYYYYYYYYYYYYYY
FUSESET 07:0000000000000000
FUSESET 08:0000000000000000
FUSESET 09:0000000000000000
FUSESET 10:0000000000000000
FUSESET 11:0000000000000000
RETAIL BINARY FUSES:
Fuseset 00: 1100011111111111111
Fuseset 01: 0101010101010110
Fuseset 02: 0100000000000000
Fuseset 03: 1001111110110000000101110100000000010101011101000101000000000000
Fuseset 04: 1001111110110000000101110100000000010101011101000101000000000000
Fuseset 05: 1101010101101001101110101101011010010101100011011011000000000000
Fuseset 06: 1101010101101001101110101101011010010101100011011011000000000000
Fuseset 07: 1111000000000000
Fuseset 08: 0000000000000000
Fuseset 09: 0000000000000000
Fuseset 10: 0000000000000000
Fuseset 11: 0000000000000000
ACTUAL RETAIL DUMP FOR BINARY:
fuseset 00: C0FFFFFFFFFFFFFF
fuseset 01: 0F0F0F0F0F0F0FF0
fuseset 02: 0F00000000000000
fuseset 03: 9FB0174015744DAF
fuseset 04: 9FB0174015744DAF
fuseset 05: D569BAD6958DAE9D
fuseset 06: D569BAD6958DAE9D
fuseset 07: FFFF000000000000
fuseset 08: 0000000000000000
fuseset 09: 0000000000000000
fuseset 10: 0000000000000000
fuseset 11: 0000000000000000
INFO:
FUSES 10-11 = 0A-0B
x+Y= CPU KEY
The dev kit fuseSet 2 is different. In another document by microsoft to make retail a dev it says:
6) Reset the console type from Retail to Dev (Agile doc H03710)
RETAIL 00000002
DEVELOPMENT 00000001
DEV:
Fuseset 01:0F0F0F0F0F0FF00F
RETAIL:
Fuseset 01:0F0F0F0F0F0F0FF0
DEV BINARY:
Fuseset 01: 0101010101011001
RETIAL BINARY:
Fuseset 01: 0101010101010110
so this means that it reverses 4 fuses in the procceses and retail is 2 so if retail is 0110
and dev is 1001 this mean you convert 2 together to 1-2 apart to get f00f
The size of the Retail version is: 16.5 MB (17,301,504 bytes)
The size of veron Devkit fact: 66.0 MB (69,206,016 bytes)
The Xbox 360's Xenon CPU has 768 bits of eFUSE, a technology invented by IBM, and implemented
in some of it's processors. eFUSEs are hardware fuses on the CPU, and can be "blown" to a binary
value (1 being blown, and 0 being un-blown) in the Xbox 360, there are 768 fuses, that make up
the fusesets. Though each fuseset can be blown individually, they are blown in groups of 8 to
make a hexadecimal value for the CPU key, and fuseline 00, instead of a binary value, which is
what XeLL will actually display. Technically, there are only 192 viewable fuses.
Fusesets 00 and 01
These are burned at the factory, after the console is manufactured, they show whether
the console is a devkit or not. They also disable CPU JTAG after the console's flash is programed.
Fuseset 02
This is the lockdown counter for the 2BL/CB (The 2nd Bootloader, stored in NAND Flash)
One of these are burned everytime the console updates it's bootloader (Which isn't very often)
this is the reason that there is no way to recover a JTAG that has been updated to 2.0.8***.0,
even is you have the CPU key, (2BL is encrypted with the CPU/1BL key, but is signed with
Microsoft's private key so you can't change the lockdown counter in the NAND. The bootloader
will fail signature checks, and panic)
Fusesets 03-06
These make up the CPU key. These start out as all zero's, and are burned presumably at random when
the console boots for the first time, they are used to encrypt the keyvault, and the bootloader
sections. The CPU key is unique to each console, and is sometimes refered to as the "per-box key"
To find the CPU key, add fusesets 03, and 05, OR 04 and 06. For example, this console's CPU key
would be "XXXXXXXXXXXXXXXXYYYYYYYYYYYYYYYY."
Fusesets 07-11
These make up the console's "Lockdown Counter." They are blown after each dashboard update starting
with the update from 4532/4548 to 4598. They prevent a previous version of the dashboard from being
run on an updated console. There are enough eFUSEs in this section for Microsoft to update the
console roughly 80 times. The lockdown counter of this console is at FFFF00000..., this means that
it has recieved 4 dashboard updates since 2.0.4548.0 ran on it. Microsoft originally intended to
only blow an eFUSE when a system update patched a critical vulnerability (Like the HV vulnerability
in 4532 and 4548) but has now decided to blow an eFUSE with every update since the update to 4598.
In the NAND's 6BL(CF) section, there is another lockdown counter that should match the one of the
eFUSEs. If it doesn't match, the console will panic on boot, and will show a RRoD. Now, here's the
good part! If we know the CPU key of the console, we can decrypt the 6BL, and change the lockdown
counter in the NAND to match the one on the console, and therefore run an older dashboard. Since
the 6BL isn't signed with Microsoft's private key, we can edit it as we please, so long as we have
our CPU key.
F.A.Q's
Q: Can I access PNET with my XDK?
A: No, you no longer can due to the whitelist.
Q: Can I get free microsoft points/Live on my XDK?
A: Yes, if you are using a live environment other than PNET you can do so. And no, these accounts preloaded with live/microsoft points can not be used on a retail console.
Q: Are XDKs Harder to use than JTAGs?
A: Yes
Q: Can I system link my retail and my XDK?
A: Yes, you just need a certain xex to do so. You can easily find it on Google.
A: No, you no longer can due to the whitelist.
Q: Can I get free microsoft points/Live on my XDK?
A: Yes, if you are using a live environment other than PNET you can do so. And no, these accounts preloaded with live/microsoft points can not be used on a retail console.
Q: Are XDKs Harder to use than JTAGs?
A: Yes
Q: Can I system link my retail and my XDK?
A: Yes, you just need a certain xex to do so. You can easily find it on Google.
Q: Can I play games on a XDK?
A: Yes, but not with disks. You need to extract the iso's and patch the xex's in order to run them.
Q: Are test kits the same as dev kits? If not, what is the difference?
A: Yes, but they can not kernel debug.
Q: Where can I buy a XDK?
A: Without a development license and/or access to GDN, you will need to find one for sale online. The marketplace here sometimes has them for sale.
Q: What is the SDK?
A: It is the software development kit used with XDKs.
Q: Do XDKs still function without sidecars?
A: Yes, of coarse. Sidecars arent needed for anything other than the additional abilities to investigate performance and DVD emulation. That is, unless you are talking about a XNA sidecar with a gigabit ethernet port. Without that on a XNA kit, You would only be able push and receive memory from the kit as fast as a regular XDK.
Q: Do 213w PSUs work with consoles that dont have an attached sidecar?
A: Yes
Q: Can I connect my XDK to retail xbox live?
A: Yes, it is possible through a third party environment that connects to production net ( retail live ) through its own server. All you would need is a xonline.ini configured for that server.
Q: How can I update my XDK to a newer dashboard?
A: You need to Flash your XDK with a newer recovery than the one you are currently running. This can be done with a remote recovery on your pc or an iso burned to a disk.
Q: Can you unbrick a XDK?
A: It depends on whether it was bricked due to a bad nand flash, a malicious xex, or a PNET brick.
1. If you simply flashed it with a corrupted nand than you can try running a recovery disk. If that doesnt work then you will need to flash the original nand to the motherboard with a Nand-X
2. If you ran a xex that turned your screen back and caused your console to RROD upon bootup then you might be screwed. If flashing your kit with the original nand using a Nand-X doesnt fix this then the xex you ran blew your CPU efuses and the kit is beyond repair.
3. If you were PNET bricked then all of the CPU efuses are blown and your kit is a paperweight.
Last edited by a moderator: