Forum

Loading





The ENDGAME exploit
 
Notifications
Clear all

The ENDGAME exploit


enCyde avatar
(@encyde)
Estimable Member Admin
Joined: 6 years ago
Posts: 58
Topic starter  
wpf-cross-image

ENDGAME is a dashboard exploit for the Original Xbox that allows you to copy habibi-signed XBE payloads from a memory card and execute them automatically. This exploit is compatible with all retail kernel and dashboard versions and, unlike other softmod methods, does not require a game or even a working DVD drive — only a memory card.

ENDGAME was developed by Markus Gaasedelen (gaasedelen) with credit to shutterbug2000 for the initial discovery of the exploit vector and first proof of concept and to xbox7887 for minor contributions. The Xbox Softmodding Tool by Rocky5 utilizes this exploit to run the softmod installer. A video of this process can be found on MrMario2011's channel.

Softmodding your Xbox

Materials Needed

  • A Female USB to Xbox controller port adapter such as this one from Amazon OR an Xbox memory card with another modded Xbox or GameShark/Action Replay to load the softmod installer onto the card.
  • A USB flash drive that is 4GB or smaller (USB Compatibility List) or an Android device using DriveDroid. You do not need either if you are using a memory card.

Running the Exploit

  1. Download the Xbox Softmodding Tool.zip, open it, open the Softmod Package folder, and extract the contents of Endgame.zip. It should be a folder named helper, a folder named trigger, and a file called payload.xbe.
  2. Copy the helper folder, trigger folder, and payload.xbe to the root of your flash drive or memory unit.
  3. Plug the memory device into your controller and turn on the Xbox. Select "Memory", then click your memory device. It will freeze for a minute and then the LED ring on the front of your Xbox should cycle colors before booting into the softmod installer.
    • If it does not boot into the softmod installer within a minute after cycling the LED ring colors, turn off your Xbox and try again.
  4. Press A to install the softmod. Read the prompts that come up and press A to acknowledge them. Your Xbox will reboot.
  5. The tool will finish setting up. You will be left on the Xbox Softmodding Tool dashboard, which is just a skinned UnleashX dashboard. You can change the skin under System → Skins.

Optional) Standardising your HDD Key

One of Microsoft's techniques for tamper-proofing each Xbox console involved the placement of an ATA security lock on the internal HDD. The password used for each lock is partially based upon a special HDD key, uniquely encoded into the EEPROM chip on each system's motherboard. The use of unique keys prevents Xbox HDDs from being swapped between game consoles, and also makes it difficult to access the contents through other devices (eg PCs).

After softmodding your Xbox you may easily "uno" its HDD key, setting it to a non-unique string of thirty-two 1's. Secured Xbox HDDs can be readily switched between consoles which are set to use the same key, and if your actual EEPROM backup is ever lost, then accessing or replacing your HDD will be much easier with a key so readily remembered. The convention may also benefit a potential new owner if the console later passes from your hands, as it's well known throughout the Xbox modding scene.

Be aware that if an Xbox has already been registered for use with Insignia, then changing its HDD key afterwards will break that registration (there's no problem registering after your key has been changed). Any pre-installed DLCs / EEPROM-locked saves will also need to be resigned with FeudalNate's Content Recovery Tool before they can be loaded again (there's no problem creating new saves or installing DLCs after your key has been changed). If the console is later hardmodded (for example, by TSOP Flashing it), then the HDD can subsequently have its ATA security lock disabled entirely, making a HDD key change quite pointless: secured HDDs are only required when using stock Xbox firmware.

If you wish to change your Xbox's HDD key, launch NKPatcher Settings from the Applications menu and then go to EEPROM > Advanced Features > Hard Drive > Change EEPROM HDD Key.

If you softmodded with an installer other than Rocky5's Xbox Softmodding Tool, make sure you upgrade to the Xbox Softmodding Tool before you attempt to change your HDD key. Some alternate installers configure a "virtual" EEPROM which may prevent changes to the actual chip's contents, potentially leading to a softbrick with error code 06.
Previous versions of the Softmodding Tool "nulled" the HDD key instead of "uno'ing" it, by setting it to thirty-two zeros instead of ones. This behaviour changed in September 2020 with v1.1.8, as it was found that nulled keys would not be compatible with Insignia. Anything other than a totally nulled key will work - eg your original key is also fine for online play - but "all ones" is the current recommendation.
If a console has already had its key nulled to zeroes in the past, it's still possible to change it to all ones later.
Your Xbox EEPROM chip also contains other important configuration data specific to your system, including its serial number. Although the key is the only component required for building a new HDD, it's still strongly recommended to copy the complete EEPROM dump saved by the Xbox Softmodding Tool from your Xbox HDD over to your PC - using FTP, for example. The dump, along with other relevant files, can be found in E:\Backups

This topic was modified 2 months ago by enCyde

   
Quote
Share: