This thread/post is about the ability to run an(y) unsigned kernel + hypervisor by rebooting.

***Introduction:
Before going to the juicy stuff I will first address these matters:
* How rebooting into an(y) unsigned kernel and hypervisor is done (using a 4532 or 4548 xbox).
* Why it is required to make substantial progress in the development of homebrew applications and software mods.
* How it can be a solution to the dilemma of having to choose between homebrew/linux vs playing new (or live) games.
* What milestones this project has to reach to arrive at the desired results.

I'm also releasing the first version of the rebooter which does most of the rebooting already. :-) That way other hackers can contribute as well and speed up the progress. I've also made a tool to assemble the rebooter file (using your own xbox-specific information) to allow everyone to create his or her own kernel/hv patches and run (and share) them. And that way there are no copyright issues.

I hope my contribution here will kickstart this project and will give all xbox 360 users a good reason not to update to any future version of the dash/kernel (which will most likely kill any hope of homebrew/linux or whatever else can be done besides what MS wants you to do) but instead to consider downgrading your xbox using the timing attack.

***Rebooting:
First off. We are talking about rebooting. Not about booting. And there is a fundamental difference.
I will explain.

When the xbox 360 is turned on the first thing it does is start look in its ROM (also called the first bootloader or 1BL). In the 1BL there is code which the cpu will execute. There is also a public key in it. This is used to check the validity of second bootloader (the CB section in the flash). Because the key is in ROM (and only MS has the private key) and the ROM is inside the cpu casing there is no way to run unsigned code during normal boot.

We can however run unsigned code on the xbox 360. This is done using the KK exploit. And you need kernel version 4532 or 4548 for this. The problem is when doing the KK exploit there is still a signed kernel in memory. And its "non-trivial" to change/patch it on-the-fly and return to it as if nothing was happened.

In order to run an unsigned kernel/hv (which is required to run unsigned software on the xbox 360) you somehow need to replace the current operating system (kernel/hv/dash etc) completely. The best way to do this is to reboot the xbox but while rebooting change some things on-the-fly (eg. turning off xex-signature checks, the functions that blow fuses etc).

In other words: do a soft-reboot.

Doing a soft-reboot (as opposed to a hard-reset/boot which lets the cpu start in the ROM again) allows us to stay in control. That way we can choose how the to-be-booted kernel/hv/dash should look like (and in principle we can also choose which version we want to run, more on that later).

The rebooter I've written so far does this. It loads the CD section into memory and essentially runs it. The tricky part is to make sure the xbox is put into the same state as it was during the normal boot. But much of this has been done now. The current version of the rebooter can now reliably reboot from POST 0x40 to 0x79 (which is the last POST output during normal boot). The xbox also resets the screen output and seems to detect the wireless again.

***Homebrew:
If we are succesfull in (fully) rebooting into an unsigned kernel/hv we can patch the the kernel/hv to allow execution of unsigned xex-es (among many other things). Right now it is already possible to patch the kernel/hv so the moment we can get it to fully boot it should be easy to turn off the bad stuff... Wink

Creating unsigned xex-es probably requires the ability to compress and encrypt self made xex-es. Although the availabilty of libraries (not on retails boxes) might be a harder problem. But I guess these problems were also solved with the xbox1.

Apart from homebrew applications you can also think of mods: how big do you want your hdd to be? Want to change the dashboard appearance? Want to disable dvd-video or game region check? No problem.

But all of that is only possible if you can run an unsigned kernel/hv. And since we cannot boot into one we have to reboot into one.

Keep in mind that in order to run homebrew or linux you have to downgrade to an exploitable kernel. And this requirement is unlikely to change. Upgrading to the upcoming "fall update" is most likely going to disable the ability to run any old kernel version (well thats what we expect MS to do). So its decision time Wink.

***Solution to the Dilemma:
While it may seem like you have to choose between two worlds the ability to run any unsigned

Hi.

I have a new version, with DLDI support. Please, can anybody try it and report me the results? I have tested it on my Supercard and it works perfectly... but that's nothing new :P

DLDI version can be downloaded here:
http://www.4shared.com/file/26317847.../GEA_DLDI.html

I am specially interested on R4

PD: resource directory called ZRes must be stored in the root

Here are the first images for download + junk, I think the mini mini mini is there, that is to say, the personal blows, blocks or dies ... A single player, for the time being ...
Other sprites are there to decorate ;-)

Apart from that, so nothing is final, the frames are out of order, the menu is there to form, the code is disgusting ... I have a todo-list ouf ...

You got it was done, YOU WERE WRONG! >=D Yes, MazeGen3D 2.0 is OUT! Now with tons of wicked cool stuff.

Added:
Menus (Lol Text GUI)
Save Mazes
Load Mazes
Pause Menu
(semi)MP3 Support!

Changes:
3D Rendering has been GREATLY improved, now guaranteed to be LAG FREE regardless of maze size!
Changing Maze Size is now MUCH easier, Maximum Sizes changed to 100.

ToDo:
Maze Editor
Save Games
OGG Support (almost done, minor problems)
Full, skipless MP3 Support
Perfect 3D Rendering (You MAY see empty spaces, this is a known bug.)
Map Packs

How to...:

Add Music: Place all MP3s you would like to listen to while you play into "ms0:/MUSIC/".

Add Mazes: With the ability to save and load Mazes, people can now post Mazes online, in order to play these mazes, simply place all .mze files in the "Mazes" directory.

Special Thanks to:
jsharrad (For turning it into EBoot form!)
Tactical Penguin (Could never have done this without your 3D tutorials, you're a credit to the LUA world! )
Bleh (For his 3D Camera tutorial)
Cools (For his awesome LUA Mod!)

Final Notes:
With the creation of .mze files I really hope to see some mazes on the internet. Although there is no maze editor now, you can still create your own mazes by hand in ANY text editor. All you have to do is create an array (or even just copy another one) and place the following:

0 = Wall
1 = Path
2 = Start Point
3 = Ending Point (MUST BE FACING NORTH!)

You don't need to name the maze files anything special, you just need to have a ".mze" extension. Enjoy!