So I decided to pick up an Xbox cheap from GameStop this week. (I couldn’t resist, they priced them at $129 and even included the Mechwarrior game with the saved game buffer overflow vulnerability). Having read through quite a few guides that appear to have been written by script kiddies, I decided to document a bit of what I did here to save someone else the trouble, should they run across this guide.
The hard part is really getting the Xbox prepared having nothing else but a Linux desktop and an Xbox. I’d originally intended on soldering a USB extension cable into an Xbox controller, (surprise, surprise, the Xbox controllers use a standard USB 1.1 hub inside them and the memory cards are your standard USB memory sticks with a funny connector). “After I’ve got a regular USB connector, I’d be able to use the handy dandy images designed to be dd’d onto a USB memory stick", I thought. However, after letting magic smoke out of various bits of the controller several hours later, I decided that this was probably a bad idea.
At that stage, it was back to the drawing board, since I’d just bought an Xbox and I really didn’t want to break it nor become unable to get Linux installed onto it. A few details about the Xbox before I talk about what I decided to do: 1) The Xbox uses a regular 8 or 10 GB hard drive with a standard ATA lock enabled. It’s using maximum security, so the vendor’s master password cannot override the password. The Xbox unlocks it by generating a SHA1 hash based upon a value stored in an eeprom, its MAC address, the drive’s model and lastly, the drive’s serial number. Since I have no way of knowing what value is stored in the eeprom (though I could piece together the rest from physical inspection of the unit), I had to figure out some way to get unsigned code to execute on the machine to hand over the value of the eeprom. This, of course, is a catch-22.
The solution to it, while simple, is kind of boneheaded to try. (So I did) This method is what the Xbox kiddies call the “Hard drive hotswap trick". The idea is fairly simple: Plug in the Xbox, let it send the ATA unlock command to the drive and then plug the IDE cable into an already running desktop. There are a couple of caveats to this: the drive cannot be reset and cannot be powered down or it returns to the locked state. It’s easier said than done.
However, I did get it to work by powering on the Xbox, navigating to the saved games screen, unplugging the IDE cable and then plugging it into my desktop by itself on the secondary IDE bus with a Xlinux (a special Xbox distro) disk running off the cdrom. Surprisingly enough, it actually worked! Any linux distro with the xfat patches can be used, but the patch that I pulled off the xbox-linux’s project site refused to compile with gcc 3.3 and gcc 2.95, on my debian machine, so I settled on the livecd.
I was pretty happy at this point, having gotten it to work, but overlooked one detail: The save files needed to start MechInstaller. So I restarted with a hard drive containing the files on the second channel of the primary ide bus. (following all the steps from before, since I didn’t want to reset the drive). After unmounting all the filesystems and starting up the Xbox with the saved files in the proper directory (it’s the UDATA one, IIRC).
With the MechAssault game started up, I hopped over to “Campaigns” and there was the emergency linux boot game, which actually worked as advertised. The rest of the install is an exercise in installing Xebian or gentoo, that of which I probably wont actually do for a little bit since my new project is getting StepMania to run on here 
.
Speaking of which, to run stepmania requires installing a dashboard replacement binary which is fairly trivial to do once you have emergency linux on your hard drive. It’s only necessary to pick up a copy of Bert is cheating on Ernie.rar and do a couple of things. (Yes, it is in fact named that, and it’s with snufflelopagus). I’m not certain about the legality of it, but since it’s my hardware, I don’t see why not.
Open up Rescue Linux and cd into /mnt/C, ftp the xbe file and the ini into the root directory, rename the .xtf files to something as a placeholder name, and move the two files into the fonts directory and bert to “Xbox book.xtf” and snuffle-boy to “Xbox.xtf". Stick the skin.ini file into /mnt/C/Skins and the two jpegs into a subdirectory of that named PheoniX. That should be about it to it, though it needs the version of the dashboard that comes with any live game for it to work. Note that while the link for the network has to be up to upgrade the dashboard, it should not give the machine a route to the internet because the replacement dashboard depends on behavior that is patched in later versions.
