Log in

View Full Version : We just unbanned a friends 360



chroma
15th November, 2009, 03:34 AM
Requirements:
1x Banned xbox
1x Bricked xbox board (rrod/e74/dropped from orbit whatever)
1x adjustable heat gun
1x soldering iron with the finest tip you can lay your grubby mits on.
1x solder's (i used 95/5 tin-silver fluxless, 60/40 tin-lead flux core)
1x tube of flux
1x desolder pump (not essential really)
1x helping hands magnifiery mah doo thingy (crocodile clips and a lens thing) fairly essential.
1x hot melt glue gun with glue sticks.

Assorted torx drivers, tweezers, needlenose pliers etc, funky tool to unclib the box (or like me a paperclip repurposed) typical tools in otherwords.

The ability to reflash your drive
A steady hand, nerves of steel (and balls to match) and a keen eye.
Previous knowledge of stripping a board down (or google it if your unsure)

I finished work tonight and headed round to my mates to cheer him up from the recent ban and discuss some code we've been working on.
Hes got a few boards that are busted (friends, family, ebay and the like that they've dumped on him rather than toss out)

We wound up surfing around looking for a procedure to unban a box and came across one that seemed fairly involved and elaborate, requiring a lot of tools, time and messing around.
It stated that it was possible via a shitload of reflashing decoding and general tweaking. After a few beers it seemed way to complicated, especialy cosidering it needed a working clean box of which we had only mine (and im not that good a friend to give over my cpu id to let him get us both banned)

Anyway the guide basicly talked you through getting the cpu code and dumping the nand flash via jtag then decoding, messing around with the clean stuff and hacking the old nand to be clean, certain conditions needed to be met, like not having upgraded for eons (already screwed) and both boards to work (another small roadblock)

Screw that, in true Tim Allen "MOAR POWAR" style we concluded that it was the method of PANSIE ASSED LOSERS WHO CANT HANDLE MANTOOLS LIKE PNUMATIC HAMMERS AND SHIT!
We decided it would be far more awesome than a robot caveman punching god in the dick to take a hammer to a job requiring a surgical scalpel.
And we did.

Stripped down the banned box to see this NAND flash thingymagubbins and get to work.
(Face it we had nothing to lose and a stack of bricked boards to perfect the method)

Im better at soldering so i took the helm and desoldered the shit out of the nand on a bricked board, just apply flux liberaly to let things get loose, wet and the heat to really soften the solder. It came off pretty fast with a few burst from a desolder pump, its still a fiddly job though with the solder joints being so damned slow, but taking shit off is easy.

Next the CPU needed to come off, we stripped off the heatsinks in a less than timid manner (hey the boards busted, whats the problem?) and then got out the heatgun and cranked the volume up to ELEVEN.
CPUS are "ball grid array" meaning theyre not supposed to be swappable, they never thought of idiots on rum and beers though fortunately.

We just cooked the thing till it was able to be gently prized off with a small flathead screwdriver. (go easy here otherwise you'll do it wrong and fail hard)
if you dont cook it enough then "BALLS R TOUCHING" and youve gayed it.

Cook it too much and you get smoke, fire, fumes and fried processors.

So yeah its a dellicate job and not the one to rush, also being a freakshow grade contortionist will help (about the only time i can think of where being able to bend into positions to lick your own anus are of benifit)

I let my mate strip down his banned box to the bare board (ie remove the heatsink and so forth using lessons learned from the previous "just rip the thing off manauvre")

Whilst he was doing that i was sitting at a desk with the processor clipped into the helping hands thing upside down and was carefully resoldering all the balls.
This as it turns out is a nightmare of a job so be prepared to go squint eyed and begin to loose the plot.

I used 95/5 tin-silver solder, it has no flux or lead so it wont remelt untill it gets to stupidly high temperatures, its also stupidly expensive (ive always bought in drums though so strands might be cheaper) bitwise i used a a 0.2mm conical tip.
The iron needs to be stupidly hot to melt this stuff and you really need to work each ball quickly to avoid damage (no small feat when pished as a fart) you need to make sure you add enough to make a tiny ball but not too much as to short when you attatch it to the board and they all melt together.
like i said, fidly, frustrating and you seriously need the patience of a saint.

Needless to say whlst i spent an eternity on this woeful task he had stripped the board right down, and proceeded to reflash the drive to stock firmware, then went and made some "old skool" cocktails.

Once the nightmare had passed we just repeated the same procedure on the banned board, removed the nand and cpu.

Then i set him on prepping the board for the cpu (re-tinning the joints for the BGA CPU and nand flash chip, removing excess solder and cleaning the lot up) then i set about tinning the nand, and soldering it to the board (another pain of a job) its fiddly so dont rush it, a relatively easy job after the cpu prep.

Almost done!

The next job is the worst nightmare.
BGA's are set by robots with nice tolerances and the ability to work in microns, two pished friends are not configured or tooled for this purpose.
Which is where the keen eye comes in.
carefully by eye line up all the balls with the contacts by squinting sideways.
then realise that its a two dimentional grid and you need to repeat it with the adjacent side, once youve got it lined up on both planes your good to go.

The next problem was that one of us would need to keep it in place whilst the other torched the board with the heat gun, neither wanted the job of "hold the red hot processor" and several games of rock-paper-scissors nor coin tosses resolved the issue.

SUPERGLUE!
no you dumbshit! superglue will keep the processor away from the board and the contacts will all mely but the processor wont sink on to em! besides it will fume and we'll see finger prints everywhere like those csi doods and im neither sober enough nor drunk enough to face that.

So it was decided in stylistic Horatio Cain monotone with added effect pauses that "HOT MELT!" should be used to affix the processor. (then we donned the shades just to drive home the point whilst he screamed "YEEEEEEEEeeeeeeeeeahhhhhh"

So whilst listening to "The who" we placed a tiny dab on two corners across the diagonal, with the rationale that it would melt as the solder does and things would go well.
(dont forsake us Pete Townsend)

This seemed to work, although it was a slow dubious process that was doubtful and again it was back to "how hot do we really wanna make this?"

Needless to say, Mojitos where consumed whilst the bloody hing cooled back down and we then reassembled the unit for the moment of truth.

It powered up flawlessly which was nice and unexpected.
Plugged it into tinternets and voila back on live without a hitch!

Drunken idiots 1
Microsoft NILL.

Synopsis.
1:Strip down the donor board and timmidly remove both the nand chip and cpu (see picture)
2:clean processor and nand chips and prep for donation.
3:strip down the banned board, and discard the banned nand and cpu.
4:clean the nand and cpu terminals
5:reflash the dvd drive to stock firmware
6:reattatch the donor nand
7:align the cpu by trial and error and fix in position with a tiny ammount of glue.
8:fix it by blasting the sucker whilst keeping it level and flat at all times
9: reassemble the unbanned box
10: power up and test.
11: pull off a heart surgery where brain surgery was recommended to achieve the same result.

Its only really usefull if youve already got another board to strip, but face it a bricked box can be gotten hold of from ebay as "spares or repair" for next to nothing.
The margin for error however is pretty bad, you really need to be OCD level carefull and patient, at several points during the prep of the cpu i had to just walk away and take a break and im fairly advanced with an iron.
It took ages (mainly due to initial trial and error of removing the cpu's) and general tedious prep.

so yeah i sure it can all go wrong at a number of stages (as a couple of early processors will attest to) but we had nothing to lose and "STICKING IT TO THE MAN" to gain.

chroma
15th November, 2009, 03:39 AM
the image was missing.
I guess it was too big.

http://ultraxs.com/thumb-F1F1_4AFF6B00.jpg (http://ultraxs.com/share-F1F1_4AFF6B00.html)

djjwdubz
15th November, 2009, 12:28 PM
hey there i have parts if you want them

u can have them free but u need to come 2 me
i got
2 motherboards
+
rom drive
+
no fan i kicked it and broke it

if u want it i am in the West Midlands Dudley

djjwdubz
15th November, 2009, 12:30 PM
nice post mate

chroma
16th November, 2009, 01:17 AM
Man the PM's are comming in thick and fast.

Just to address a few questions. (thusly saving me responding to everyone individualy)


TIME
The entire process took us roughly 6 hours work, bearing in mind we where both drunk and experimenting, efficiency wasnt a priority.
If you knew what you where doing however you could probably do the exact same thing in just under 3hrs sober lol

The real timesink is the preperation of the processor, if i had a professional BGA reball station and templates this would be an effortless task, but vew people own that kind of specialised hardware (coupled with the fact that ive only ever seen a GPU reball template)

HOW MUCH TO HAVE THIS DONE?
I dont know anyone professional that can or will do this kind of job, nor really have any idea how much it would cost. I dont imagine it would be cheap though considering just how much time and effort is required without specialised hardware, so labour would be the primary factor. I expect prices would vary widely depending on wether or not you where supplying all the parts too.

MKING MONEY
I also dont need any more boards, i dont plan on ever doing this again (once was more than enough)
I can see people making some money from stripping their old boards, prepping the CPU and NAND and reselling the paired chips to banned customers.
Its not a hard job, but it is a godawful timesink, half way through reballing the processor i would gladly have payed anything to not have to go through it any more lol

Couple this with the fact that if i had a paired set then the job could have been completed in under an hour.

If someone was seriously interested in this and had a dremmel with a fine bit then they could assemble a jig template to make reballing almost effortless, clip the jig over the processor and mass solder the lot in minuites as opposed to hours.

IMPORTANT STUFF NOT INCLUDED IN THE ORIGINAL POST
Board types!
We used up a few jaspers figuring it all out.
I have no real idea whether combinging parts from a Falcon to a Jasper would actualy work, i immagine they would but id expect issues like differing voltages and so forth.
If this was the case you would also need to faricate a daughter board to compensate for changes (not a seriously hard job, but definately a minor headache)
Ive not conducted any research here though because like i said, we had simmilar boards and it seemed easier than messing with different hardware.

PAIRING, chips MUST be paired.
The nand is encoded and can only be read if it has a matching code from the CPU (this was how the original hack with JTAG's worked, by swapping keys around decoding and patching the contents of the nand before reflashing) so all the processors and nands donated must come from unbanned consoles.

It should also be noted that neither i nor my buddy are electronic engineering experts in any way shape or form, we know enough to get by and can tell the difference between resistors, diodes and capacitors. but like i said theres no real degree of professional expertise, just drunken tomfoolery with the ability to understand a schematic and really nothing to lose from messing around.

All in all it seemed like a fun project to mess around with as a proof of concept, i just figured some of you guys might find it interesting or useful and something anyone really could attempt.
If you can operate a soldering iron and our able to flash a drive then your pretty much able to do this yourselves, just be warned that its a pain in the ass to reball a bga by hand.

MISCELANEOUS
Pre-empting the questions regarding a jig, i figure the easiest way to make one would be to first manualy reball a processor.
Get hold of some thin steel like you would find on a filing cabinet or old computer case for example.

Rough cut it to size (make sure its bigger)

Lay the processor against it flat and trace an outline with tabs jutting out with a stanley blade of craft knife.

Rip the head off a biro and blow the ink out onto a sheet of paper or a square of sponge.

dip the processors ball in the ink to get a coating, then line it back up with the sheet of metal to transfer over the ball pattern.

Get a drill and use an adequately small sized bit to drill out all the holes from the pattern.

fit to the processor and test to see the holes line up properly then fold the tabs over the processor to form slight clips that you can get off easily when red hot.

Get a processor needing reballed and just go to town with a blowtorch or heat gun and fill in all the holes with tin-silver solder without flux.

leave it to cool and bond nicely, then just heat the jig up using either short bursts of the blow torch or heat gun (the trick is not to melt the solder completely, just soften it enough and melt it where its in contact with the jig.

Remove the jig and voila, hours of work achived in minuites.

Pair it with the nand and sell it over ebay for a tidy profit ;)

chroma
16th November, 2009, 09:21 PM
Um... bit of a roadblock with this whole thing...

We tried live and got online, YaY!

However we never actualy tested any games, turns out that when he slapped in a disk it wouldnt load, it wold play movies and such though...

Yup you guessed it the drives key was wrong for that nand :p
Luckily we still had the rest of the donor unit so it was just a matter of swapping drives (or reflashing with the donor drivekey)

Just figured id let you guys know before anyone tries it and starts screaming WTF? NO GAMES???? HOW USEFUL IS THAT?

So yeah bit of a headache if your selling on processor and nands, you should also include the drivekey (otherwise games wont work) and this is only going to be possible if youve got the drive already (we had a few bare boards, so things could have went badly wrong and needed a whole nother procedure to resolve) it should also be possible to retrieve the drivekey from the nand via jtag but i dont have a soloution to this yet.

This has so far been the only issue he's come across since playing around with it, so it looks to be a nice little fix... aside from the drive hiccup.

Just a heads up guys.

cgscott
16th November, 2009, 09:44 PM
Yes i read this. And the reason you have to pair the chips is due to the fact that the CPU has an ID as well and this has to be jtagged into the NAND chip as if replacing the NAND only.

The nand chip stores all information relating to the motherboard.

Wont be long till someone devises a way to extract and flash NAND chip information.
Have seen there is a way to develop your own key.

Some think this ban was a bad thing but from what i have been reading it seems to be a blessing in diguise are people are looking into other ways to get round banning other than flashing drives with updated firmware.

Bring it on i say.

chroma
18th November, 2009, 03:20 AM
Hes banhammered again.
Using stock drive firmware and not using any "illegal" mods.

From the research ive conducted i think ive figured out why it was detected as an illegal modified console.

Its a frankensteined unit, so all the serial information wouldnt add up, things like console serial and more importantly the MAC address of the NIC would differ.

We spent a while arguing over this, he seems to think the console serial plays a part... im sceptical, i mean if it did then users who bought a new box would be banned because irt would differ. im fairly certain the consoles serial is stored in the NAND.

Where we both agree is that the MAC Address is wildly different, thats stored on the chipset of the network interface and wont match with the data stored in the NAND thustly throwing up a big red flag. Therefore a the chipset wold need to be transfered over to maintain the full units mac address. (this is getting to be more akin to just swapping over boards to keep the case lol) its shouldnt be a major job, just another chip to swap (certainly not as bad as a CPU transplant)

The only other way would be to dump the contents of the nand and hack the shit out of them to change serial numbers where needed (im going to have to make a dump anyway to figure out just what plays a part and what really doesnt)
The problem with this is that if heard theres a file which seems to be integrity checked, and if its edited you wind up banned. i dont know the validity of this but i guess im going to have to find out.

My mate is understandably pissed off right now, especialy considering i'd talked him into going on the straight and narrow and actualy paying for software only to get banned...
Im begining to get scared of mentioning the word "Microsoft" around him at this point.
I'll chill him ot once i get the jtag interface prepped and ready to fit.

I'll keep you guys posted as to developments, but take it as read that this method is UNSAFE at present, at least until i find a way to work around the initial problems :(

Back to the drawing board i guess.
On the bright side i might ork out a software fix that will ultimately wind up making the need to swap a thousand chips unnecissary.

cgscott
18th November, 2009, 03:48 AM
I always thought from the beginning ths was a mac address ban as it will be stored with the ethernet adapter.

Simple yet suffice way to ban any access to the internet whatsoever on any device that can connect to the interweb.

Bit like modems.

Cloning the Mac address will be the way to go if someone can manage a way to do this.

chroma
18th November, 2009, 04:09 AM
Yeah to clone the MAC you need to edit the keyvault which as far as i can tell is digitaly signed by microsoft.

AFAIK no one has thus far managed to crack it, leaving me in uncharted waters, but screw it, needs must.

Im thinking going to try and get hold of both a clean and a banned nand dump to see just what the deal is between the two.

meh if it was simple everyone would be doing it ;)

Raven
18th November, 2009, 07:27 PM
It's probably cheaper in more ways than one just to fork out for an unbanned 360 lol.

delboy71
18th November, 2009, 07:53 PM
Must agree really in just getting a new 360,but must admit this saga is making a good read..keep up the good work(or maybe not).

chroma
18th November, 2009, 09:46 PM
It's probably cheaper in more ways than one just to fork out for an unbanned 360 lol.

I agree however in our case we have stacks of unused boards to play around with to figure it all out, eventualy there will be a cheap simple soloution that will negate the need to either swap hardware around or buy a replacement.

So far the only thing tis has cost us is time, effort and miscelaneous stuff like solder and electricity.

tango
19th November, 2009, 12:54 AM
that pic is showing the nand chip and the gpu not cpu
the cpu is the chip that sits under the big(higher) heatsink

Raven
19th November, 2009, 03:13 AM
eventualy there will be a cheap simple soloution that will negate the need to either swap hardware around or buy a replacement.

At which point Microsoft will find another way to stifle you into buying another console, because that's the sole purpose of the mass bans in the first place - they know most go out and supplement their sales figures by purchasing a new console or at the very least they won't lose most people's custom. Notice how they always ban just before Christmas too ? It's not a coincidence!

davewilldo
28th November, 2009, 01:55 AM
Hi All,
Chroma, very impressed by the pished work you guys put in on unbanning the 360.

I have a few weeks to kill, whilst stuck at home recovering (saying nothing). To top that MY XBOX is with MS being repaired!

Anyone in the merseyside area with faulty units they are giving away I would love to play around with my old banned Xbox to try and un-ban it cos I am so BOARD.

Can arrange for someone to collect for me.

Cheers Everyone!

Dave :puke:

cgscott
28th November, 2009, 02:07 AM
Hi All,
Chroma, very impressed by the pished work you guys put in on unbanning the 360.

I have a few weeks to kill, whilst stuck at home recovering (saying nothing). To top that MY XBOX is with MS being repaired!

Anyone in the merseyside area with faulty units they are giving away I would love to play around with my old banned Xbox to try and un-ban it cos I am so BOARD.

Can arrange for someone to collect for me.

Cheers Everyone!

Dave :puke:

Reading your post nearly made me fall asleep.

But feel free to come collect my BOARDS i have got here.

Just PM me your collectors details and at what time they would like to collect.

P.S You a Bailiff

Had many of them at my door just ended up batting them in the mouth! :rolleyes:

Stuart 0366
28th November, 2009, 02:20 AM
Chroma, you are a hero

Just read what you did and thought...only a pissed crew could manage that.

Would you have attempted it sober? I know you have the ken to do it sober but honestly, would you have bothered? Well impressed with you and your mate :rock::rock:

You just gotta work on the Wii now lol

cgscott
28th November, 2009, 02:22 AM
Chroma, you are a hero

Just read what you did and thought...only a pissed crew could manage that.

Would you have attempted it sober? I know you have the ken to do it sober but honestly, would you have bothered? Well impressed with you and your mate :rock::rock:

You just gotta work on the Wii now lol

Wii a piece of piss..they both mean the same thing!

Stuart 0366
28th November, 2009, 02:33 AM
So the Wii is pretty much the same as the X-box in as much as the fixing or the coding? Is Nintendo really that close to Microsoft?

I am not being funny...I really don't know, I have not owned either or had the chance to rip old ones apart so I bow to those that do know (Gimme a PS 1 anyday lol lol). As for the more recent games consoles I dont have a clue, I am sitting with a mundane PS 2. We have nothing more recent in our house unfortunately (crimbo will se a Wii though :rolleyes:)

I do know that mates have done the dirty with both boxes (X-box and Wii) and come a cropper.

chroma
28th November, 2009, 03:06 AM
Chroma, you are a hero

Just read what you did and thought...only a pissed crew could manage that.

Would you have attempted it sober? I know you have the ken to do it sober but honestly, would you have bothered? Well impressed with you and your mate :rock::rock:

You just gotta work on the Wii now lol

Not now (sober or drunk) its a stupid ammount of work (admittely rum helps) we set out initialy sober, things jut went downhill in a hurry :p

Weve not done much testing since (like i said its a massive ammount of work, if only down to the cpu) and things did go badly wrong as an end result.

I figure if you swap over the nand, cpu and NIC then flash the drive with the new code you should be fine, but like i said weve yet to test this.

Its the prospect of another cpu thats putting us off (trust me once youve done one you'll instantly know what we mean) resoldering 899 tiny little balls at a pitch of 1mm by hand gets tedious fast.
Especialy when you screw it up (which you will) and need to keep retrying and fix the balls around the screwup.
Coupled with the fact that you need to move FAST with lead free solder because its stupidly hot and will kill the die.

Then rechecking every single one (because if one is slightly out the entire thing will be up the river with a turd for a paddle)

Its the worst thing ive ever had the misfortune to do and ive did some really shitty jobs in the past.

So yeah if it wasnt for the stupid mindnumbing bga workup then it would be insanely easy.

Adapters_plus,BGA sockets,BGA adapters,headers,interposers (http://www.adapt-plus.com/products/ic_sockets/bga.html) looks like a godsend in this respect, they apparently do a 900 30x30 (31mm x 31mm) 1.0pitch bga adaptor however the footprint is showing as an 896 ball part...

Regardless expect to spend hours with your head screaming "oh **** oh **** oh **** FUUUUUUUUUUUUU" and pondering why the hell you started in the first place lol