Mini FAQ:
Who wrote this?
Talented members of XBH contributed in many ways. You know who they are.
TeamXBR assembled the parts, coded the utilities, and glued
it all together to make it work.
How does it work?
Both XBR and Freeboot use a "patch engine" to apply patches to the
bootloaders as the console reboots. For Freeboot, this is "freeboot.bin"
or "freeboot-manual.bin"; For XBR, its "xbrfw.bin" Both of these binaries
are based on xell type start up code, and are launched by the exploit.
The code then applies patches contained at block 0x65+, and restarts
the system.
What went wrong?
Earlier versions of XBR used the same CB/CD pair to start
the 8955 kernel as the exploit. Freeboot, using a dual nand setup,
used the older bootloaders to start the exploit, than used
the newer bootloaders on the alternate flash to start the kernel.
The problems were not related to the patches used by XBR, but rather
the use of the older bootloaders. Please try to control yourselves
if problems arise, they can always be fixed. Dont do anything crazy
like start conspiracy theories, buy a cygnos, wire up a dual nand or
xd card, rip out a big nand to swap in a smaller one etc, etc. Have
a little patience, have a little faith
So whats the fix?
1) Add a copy of the new bootloaders to flash.
2) Create patches to use the newer relocated bootloaders on reboot.
It was easier to re-use the freeboot.bin patch engine to accomplish this task.
The freeboot patches themselves are not used. XBR continues to use its own
patches, however, the freeboot.bin patch engine will be used to apply them.
This also allows custom patches to be applied, in the format used by freeboot.
XENON_8955_3:
Uses 6750 as the alternate CB to allow easy support for all hardware versions.
No changes made to patches, exact same functionality as 8955_2.
XENON_8955_2:
Add a copy of the new bootloaders to flash.
Create patches to use the new relocated bootloaders on reboot.
Translated existing XBR patches to use the freeboot.bin patch engine.
Fixed build file to use CB/CD 1921 for all xenon.
Eliminate media binding path checks, run xex from all media without patching.
8955_1:
Add support for PIRS
Fixed Backup Xell
8955_0: Initial
Automatically detect correct key for dev or retail xex.
No specific secdata.bin or crl.bin requirements.
XBReboot Block Layout:
Ox00 - 0x2F Xell Boot firmware
0x30 - 0x3F Backup Xell
0x40 - 0x4F freeboot.bin or freeboot-manual.bin (patch engine core)
0x50 - 0x61 Alternate CG
0x62 - 0x64 Spare blocks
0x65 - 0x65 Patch.bin, patches for bootloaders and kernel
0x66 - 0x8F Alternate CB/CD/CE
0x90 - 0x?? Flash file system
HowTo:
1) Extract KV and Config blocks from orig.bin
nandpro orig.bin: -r16 rawkv.bin 1 1
nandpro orig.bin: -r16 rawconfig.bin 3de 2
2) Inject those blocks into XBR.bin
nandpro XBR.bin: -w16 rawkv.bin 1 1
nandpro XBR.bin: -w16 rawconfig.bin 3de 2
3) Flash result
nandpro lpt: -w16 XBR.bin
Notes:
There is no need to unpack and repack pirs files!
This is a limitation of freeboot. Not XBR.
Aside from that major difference, all functionality is the same.
Individual sections can be updated or extracted seperately using nandpro.