by Michael Steil

In November 2004, the Hotel Royal (http://www.hotel-royal.de/) in Munich decided to use Xboxes running Linux as set-top-boxes in its hotel rooms. Changiz, the owner, asked me to help him modify some Xboxes (Hardware Method), so that they can install a small Linux distribution with Freevo (http://freevo.sourceforge.net/) on it.

First I modified one Xbox with the Software Method. He liked it, but decided that the Hardware Method might be a better choice. So he bought five more Xboxes, and we (Changiz, Basti, me) modified all six Xboxes by putting Cromwell onto them.

On December 1st, Changiz told me that he had bought another 10 Xboxes and asked me to help them modify them. So one day later, the biggest (private) Xbox modding party took place.

Table of contents

1 Buying 10 Xboxes 2 The Xbox Modification Assembly Line 3 Copying the Savegames on 10 Xboxes 4 Opening 10 Xboxes 5 Soldering 6 Flashing 7 Conclusion

Buying 10 Xboxes

It had not been trivial to buy 10 Xboxes. Changiz went to a Media Markt store in Munich and found Xboxes with a manufacturing date of 2004-03-17 - perfect for the Hardware Modification. He asked three different employees in the shop for help in transporting the ten boxes, but all of them were reluctant to help in any way. One Media Markt employee even told him that he was "not allowed" to buy ten Xboxes, as they would only be sold for home use, which is two to three of them, but not ten, and he accused Changiz of planning to resell them. Changiz told the man that he was not planning to resell them, but that he was going to use them himself, and that he could just as well buy three boxes, come back, buy three more and so on. After a long struggle, the Media Markt employee finally gave up...

The Xbox Modification Assembly Line

We were three people: Changiz, Basti, and me. We decided to use the assembly line system to maximize the speed of the modification. The assembly line was supposed to have five stages:

• Turn on/test Xbox, copy MechInstaller savegames on the hard disk (Michael)
• Unscrew/open Xbox (Basti)
• Solder the two points (Changiz)
• Flash Cromwell onto the TSOP (Michael)
• Close Xbox (Basti)

Copying the Savegames on 10 Xboxes

Copying savegames on Xboxes is trivial - therefore I tried to optimize it, and played a bit around with this step of the assembly line. If you turn an Xbox on for the first time, you it asks you five questions - so I had to press the green button 5 times. Afterwards I had to select "MEMORY", then the memory card, then the three savegames, and copy each of them onto the hard disk.

After the first Xbox, I tried to do these steps without looking onto the screen, just by listening to the Xbox sounds. These are the buttons I had to press - in case you plan to mod 10 Xboxes at a time, you should learn these by heart:

green, green, green, green, green, up, green, left, green, down, right, green, green, green, (wait 5 seconds), red, right, green, green, green, red, right, green, green, green.

I wonder whether a chimp could do this? Anyway, I managed to copy the savegames without looking and even with the sound muted. Perhaps we should present our skills this in some TV show (http://www.wetten-dass.de/)?

Opening 10 Xboxes

Basti decided not to use an electric screwdriver - this would be lame. Although he managed to open one Xbox in only about three minutes, I was faster copying the savegames, so the Xboxes accumulated before stage #2.

All Xboxes were manufactured 2004-03-17. They all had WD hard disks, Philips DVD drives and Winbond W49F020 flash chips.

At first, Basti put all lid/HD/DVD combinations on one table and all bottom/board combinations on another table until I explained him that all hard disks are locked to their mainboards and that it was not possible to mix them. At that point, only two Xboxes had been opened, so it was no big deal to find the correct hard disks for the correct mainboards. If Basti had opened all Xboxes, we would have had to try about 28 combinations until we would have had all correct combinations...

Soldering

Changiz soldered the first three boxes - then Basti had the idea of using two-component conductive laquer, which would be applied with a small paint-brush in order to connect the points on the mainboard instead of soldering. So Changiz went out to buy some conductive laquer in a modelling store, while I took over soldering (I did two more Xboxes), and Basti continued to unscrew more devices.

After Basti finished unscrewing all Xboxes, he took over on soldering, while I started flashing them. The assembly line had become somewhat chaotic, but we were still fast.

When Changiz returned, all Xboxes already had been soldered - except for one, which we missed somehow: When I tried to flash it, it didn't work - so we found that we had missed this one. Chaos?

Basti applied the conductive laquer (which had cost 11 EUR and would have been enough for 20 or more Xboxes) on the last Xbox, and it worked perfectly. Next time, we will only use this technique!

Flashing

I flashed the Xboxes by running the game MechAssault, loading the savegame "Emergency Linux" from hard disk, uploading the Cromwell 2.32 image to /mnt/E, telnet'ting into the Xbox and using "raincoat" to overwrite the TSOP.

Except for three Xboxes, all devices could be easily flashed. Unfortunately these three devices had been the three first ones - we feared that there was a problem with all Xboxes manufactured that day (a Wednesday)... and understood that it might have been a good idea to modify a single Xbox before opening and voiding the warranty of ten of them. But after these three, all others worked without any problems.

I returned these three devices to step 3 in the assembly line, which was, at that time, represented by Basti. He re-did the soldering pads until it worked. Interestingly, the conquctive laquer only worked on new Xboxes, not on those that had been applied solder to before.

It has probably only been a coincidence that the three Xboxes that had not worked in the first run were the ones soldered by Changiz... Anyway, Basti fixed it. On two of them, he even had to add a small wire, because the soldering pads had been desroyed.

Not surprisingly, all Xboxes had the same ROM contents - no Xbox had been turned on long enough to see the kernel or dashboard versions, so all we know about Microsoft's original system software is the MD5 hash of the ROM, which I extracted (we bought this software, so we'll keep it!):

e27bbf815c67bcbf359907a68ea46978 old.bin

Conclusion

This is what we learned:

• Two-component conductive laquer is the premier choice for connecting the pads.
• If you solder, you have to be careful not to destroy the soldering pads.
• If the soldering pads have been destroyed, you should be able to fix this with a thin wire.
• Before modifying a batch of Xboxes, modify the first one separately.
• 10/90 principle: 90% of the work can be done in 10% of the time. The other 10% of the work need 90% of the time.

We needed four hours to apply the Hardware Method to 10 Xboxes - but seven of them could be done in less then two hours. I would estimate that the next 10 Xboxes can be done in 90 minutes, if we use conductive laquer from the - start.