Psikic.com Xbox Repair - Reading the EEPROM using SDRAM

Consider the following scenario. Your Xbox suddenly decides to die – for some unknown reason. Maybe you attempt to install a modchip and fail? Maybe a large electrical surge spares the power supply but the motherboard dies. Maybe it just doesn’t like you. Either way, your motherboard is toast. You order a new motherboard and hard drive from a popular Xbox repair website such as Llamma’s. You don’t want to mod this new board, and you hate the thought of even soldering onto this board and destroying what seems to be the only chance of getting back to your favorite games. You have all of your saved games on the old drive and want to get them onto your computer so you can transfer them back to your new Xbox.

Some would say that the old drive can only be unlocked if you move the EEPROM from the old motherboard and put it on the new motherboard. This is not the case. You can actually read the contents of the old EEPROM with your PC! Sure, you could get a serial port EEPROM reader, but that would cost even more money! …and you just spent all of your recreation budget on your new motherboard.

Have an old PC lying around that has an old stick of SDRAM to spare? Go grab the SDRAM chip and examine it closely. Notice that chip in the corner that looks similar to an Xbox EEPROM? Also, get that broken Xbox motherboard. Find the EEPROM chip on it as well.

Wow! These look exactly the same! Why, you ask? Because they are the same chip! Don’t risk destroying your new motherboard when you can destroy an old stick of SDRAM instead! You can actually remove the EEPROM from the SDRAM, remove the EEPROM from the old Xbox motherboard, and put the Xbox EEPROM onto the SDRAM! Then, you can read the EEPROM with Linux.

Here’s a little background. The EEPROM on the Xbox motherboard and the SDRAM chip are both 24CXXX devices compatible with the i2c interface. Every PC since around 1995 has a SMBus (System management bus). SMBus is actually a superset of i2c, so i2c devices are also SMBus devices. Therefore, Xbox EEPROMs are SMBus devices, which are readable by the hardware on a normal PC! You just need to know how to connect it and use it.

Do the soldering. I shouldn’t have to tell you how, but the biggest thing you should make sure of is that pin 1 on the Xbox EEPROM matches where pin 1 was on the SDRAM EEPROM.

Put the SDRAM chip in the computer. Your computer will be a little mad at you when you boot it up. On the particular vintage DELL that I performed these steps on, it said “One of the memory chips are out of rev.” On other PCs, I would expect to see error messages that say something similar to some parts of your RAM being bad, or just ignoring that stick of memory entirely. Note that the modified SDRAM chip will not function as RAM until the original EEPROM is replaced. You could either move the original EEPROM back, or write a backup of the SDRAM EEPROM onto the Xbox EEPROM. I’ve never done the latter, but I see no reason why it wouldn’t be possible. Of course, the modified stick of RAM can’t be the only stick of RAM in the PC.

Once the machine is booted, load the i2c kernel modules for your particular machine. I’m not sure how to help here, because all machines are different. The procedure I used was:

We see that this machine lists the SMBus as bus 0. Run i2cdetect again with the bus as a parameter to see what SMBus devices are available in your PC.

root@ubuntu:~# i2cdetect -y 0
0 1 2 3 4 5 6 7 8 9 a b c d e f
00: XX XX XX XX XX XX XX XX XX XX XX XX XX
10: XX XX XX XX XX XX XX XX XX XX UU XX XX XX XX XX
20: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX
30: XX XX 32 XX XX XX XX XX XX XX XX XX XX XX XX XX
40: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX
50: XX UU UU XX XX XX XX XX XX XX XX XX XX XX XX XX
60: XX XX XX XX XX XX XX XX XX 69 XX XX XX XX XX XX
70: XX XX XX XX XX XX XX XX

The output of i2cdetect may not always be completely intuitive, but one thing that is for sure is that devices detected between 0x50 and 0x57 are most likely EEPROMs attached to SDRAM chips. This particular machine has two SDRAM chips – the primary one that it is using (0x52) and the one with the Xbox EEPROM (0x51).

To read the contents of the device, use i2cdump with the bus number and the address of the device to read. For example, here is address 0x52 (the SDRAM EEPROM):

root@ubuntu:~# i2cdump -y 0 0x52
No size specified (using byte-data access)
     0 1 2 3 4 5 6 7 8 9 a b c d e f    0123456789abcdef
00: 80 08 04 0c 0a 01 40 00 01 80 60 00 80 08 00 01    ??????@.??`.??.?
10: 8f 04 06 01 01 00 0e a0 60 00 00 14 14 14 32 20    ?????.??`..???2
20: 20 10 20 10 00 00 00 00 00 00 00 00 00 00 00 00     ? ?............
30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 12 f6    ..............??
40: 2c ff ff ff ff ff ff ff 01 38 4c 53 44 54 31 36    ,.......?8LSDT16
50: 36 34 41 47 2d 31 30 45 45 31 20 01 00 02 2d 0b    64AG-10EE1 ?.?-?
60: 15 d7 51 00 00 00 00 00 00 00 00 00 00 00 00 00    ??Q.............
70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64 af    ..............d?
80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff    ................
90: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff    ................
a0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff    ................
b0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff    ................
c0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff    ................
d0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff    ................
e0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff    ................
f0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff    ................

root@ubuntu:~# i2cdump -y 0 0x51
No size specified (using byte-data access)
     0 1 2 3 4 5 6 7 8 9 a b c d e f    0123456789abcdef
00: 72 b4 98 64 a4 d7 67 bb 04 99 6f 22 7e 79 92 ac    r??d??g???o"~y??
10: 84 df dd 8e a5 cf fb af 0b 74 cd 56 9a 99 3f 08    ?????????t?V????
20: 30 7e 4e b7 e9 6f 7a 32 c1 7d 7e be 70 40 33 94    0~N??oz2?}~?p@3?
30: 72 7f b5 18 XX XX XX XX XX XX XX XX XX XX XX XX    r???XXXXXXXXXXXX
40: 00 0d 3a 1a bc 36 00 00 07 5c 9c 36 3d b2 ab ba    .?:??6..?\?6=???
50: b4 b0 c9 03 3b e3 25 38 00 01 40 00 00 00 00 00    ????;?%8.?@.....
60: ec 2e 57 fb 68 01 00 00 43 53 54 00 43 44 54 00    ?.W?h?..CST.CDT.
70: 00 00 00 00 00 00 00 00 0a 05 00 02 04 01 00 02    ........??.???.?
80: 00 00 00 00 00 00 00 00 00 00 00 00 c4 ff ff ff    ............?...
90: 01 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00    ?.......?.......
a0: 41 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00    A2..............
b0: 00 00 00 00 00 00 00 00 0d 00 00 00 01 00 00 00    ........?...?...
c0: 68 aa dd 02 46 45 8f 8f 78 56 bb 69 01 04 46 45    h???FE??xV?i??FE
d0: 8f 8f 78 56 bb 69 01 04 46 45 8f 8f 78 56 bb 69    ??xV?i??FE??xV?i
e0: 12 03 46 45 8f 8f 78 56 bb 69 02 02 46 45 8f 8f    ??FE??xV?i??FE??
f0: 78 56 bb 69 12 02 a0 9f 80 00 00 00 84 00 00 00    xV?i?????...?...

(The serial number of the Xbox will be where the underline capital X's are in the above dump.)

How do you use this dump of the EEPROM to unlock your drive? Well, you must use a hex editor to convert the dump to a binary file for use with LiveInfo in Windows. Install the drive in a PC with windows and download LiveInfo (binary) (source). Run LiveInfo, load the EEPROM.BIN file you just created with the hex editor, and choose the Xbox hard drive from the drop down. Write down the password that is generated. This is the secret key!

Now download the hard drive unlock tools (binary). Put all of the files on a bootable DOS floppy. Boot from the floppy and then run hdunlock and enter the password. Now run hddisabl and enter the password. Now you can read the hard drive on your PC! Of course, the drive is formatted in such as way that you can’t read it normally on a PC.

There are two methods for reading the files off of the hard drive now that is unlocked. Either download Xebian (a version of Linux made specifically for the Xbox, which can actually run on the PC and read the Xbox filesystem), or use a program like FatXExplorer to save individual files off of the drive in Windows. (binary)

That’s it for now! If you have any feedback or questions, post a reply to the topic created for this article on the forums. Click here.