Breaking Eggs And Making Omelettes

Topics On Multimedia Technology and Reverse Engineering


Archives:

Interfacing to an Xbox Optical Drive

September 30th, 2013 by Multimedia Mike

The next generation Xbox is going to hit the streets soon. But for some reason, I’m still interested in the previous generation’s unit (i.e., the original Xbox). Specifically, I’ve always wondered if it’s possible to use the original Xbox’s optical drive in order to read Xbox discs from Linux. I was never curious enough to actually buy an Xbox just to find out but I eventually came across a cast-off console on a recycle pile.

I have long known that the Xbox has what appears to be a more or less standard optical drive with a 40-pin IDE connector. The only difference is the power adapter which I surmise is probably the easiest way to turn a bit of standardized hardware into a bit of proprietary hardware. The IDE and power connectors look like this:


Xbox optical drive connections

Thus, I wanted to try opening an Xbox and plugging the optical drive into a regular PC, albeit one that supports IDE cables, and allow the Xbox to supply power to the drive. Do you still have hardware laying around that has 40-pin IDE connectors? I guess my Mac Mini PPC fits the bill, but I’ll be darned if I’m going to pry that thing open again. I have another IDE-capable machine buried in my closet, last called into service when I needed a computer with a native RS-232 port 3 years ago. The ordeal surrounding making this old computer useful right now can be another post entirely.

Here’s what the monstrosity looks like thanks to characteristically short IDE cable lengths:


Xbox optical drive connected directly to PC

Click for larger image


Process:

  1. Turn on Xbox first
  2. Turn on PC

Doing these things in the opposite order won’t work since the kernel really wants to see the drive when booting up. Inspecting the 'dmesg' log afterward reveals interesting items:

hdd: PHILIPS XBOX DVD DRIVE, ATAPI CD/DVD-ROM drive
hdd: host max PIO5 wanted PIO255(auto-tune) selected PIO4
hdd: UDMA/33 mode selected
[...]
hdd: ATAPI DVD-ROM drive, 128kB Cache

Why is that interesting? When is the last time to saw disk devices prefixed by ‘hd’ rather than ‘sd’? Blast from the past. Oh, and the optical drive’s vendor string clearly indicates that this is an Xbox drive saying ‘hi!’.

Time To Read
When I first studied an Xbox disc in a normal optical drive, I noticed that I was able to read 6992 2048-byte sectors — about 14 MB of data — as reported by the disc table of contents (TOC). This is just enough data to play a standard DVD video animation that kindly instructs the viewer to please use a proper Xbox. At this point, I estimated that there must be something special about Xbox optical drive firmware that knows how to read alternate information on these discs and access further sectors.

I ran my TOC query tool with an Xbox Magazine demo disc in the optical drive and it reported substantially more than 6992 sectors, enough to account for more than 2 GB of data. That’s promising. I then tried running 'dd' against the device and it was able to read… about 14 MB, an exact quantity of bytes that, when divided by 2048 bytes/sector, yields 6992 sectors.

Future (Past?) Work
Assuming Google is your primary window into the broader internet, the world is beginning to lose its memory of things pertaining to the original Xbox (Microsoft’s naming scheme certainly doesn’t help searches). What I’m saying is that it can be difficult to find information about this stuff now. However, I was able to learn that a host needs to perform a sort of cryptographic handshake with the drive at the SCSI level before it is allowed to access the forbidden areas of the disc. I think. I’m still investigating this and will hopefully post more soon.

Posted in xbox | 8 Comments »

8 Responses

  1. James Says:

    Unfortunately, I suspect you’ll find opening the tray a challenge in itself! Several of the Xbox DVD drives don’t support the normal ATAPI open/close tray commands.

    Did you put the disc in with the drive connected normally to the Xbox?

    The Xbox Linux patch is probably worth a look (if you haven’t already):

    http://sourceforge.net/projects/xbox-linux/files/Linux/2.6

  2. James Says:

    Unfortunately, I suspect you’ll find opening the tray a challenge in itself! Several of the Xbox DVD drives don’t support the normal ATAPI open/close tray commands.

    Did you put the disc in with the drive connected normally to the Xbox?

    The Xbox Linux patch is probably worth a look (if you haven’t already):

    http://sourceforge.net/projects/xbox-linux/files/Linux/2.6

    I think the drive unlocking code is in drivers/ide/BootIde.c from the free BIOS replacement called Cromwell, source available from here:

    http://sourceforge.net/projects/xbox-linux/files/Xbox%20Linux%20ROM%20Source/Cromwell-2.31/

    It looks like you’ll need the EEPROM data from the Xbox to calculate the key; from memory there were several different tools that would extract that for you (if you can run unsigned code on the console, of course).

  3. James Says:

    Double post and wrong too! :)
    That’s clearly the key for the HDD, not the optical drive.

  4. Multimedia Mike Says:

    @James: Thanks for the research. I’m not entirely sure if I’m on the right track with this optical drive unlocking thing, but I hope it won’t involve much more time in order to find out. I was able to find an old Xbox hacking site that indicated this was possible. It’s where I found info on the handshake.

    At first, I had to load the disc into the Xbox drive while the IDE cable was still connected to the Xbox. However, I determined that my drive is one that supports the ATAPI eject command so I have been able to control ejection from the command line (according to some old Xbox Linux source I found, not all of the optical drives in use in Xboxes supported this feature).

  5. compn Says:

    i seem to remember some bunny guy writing a book on xbox hacking…

  6. Multimedia Mike Says:

    @compn: I googled “bunny guy writing a book on xbox hacking” and came up with:

    http://en.wikipedia.org/wiki/Andrew_Huang

    So, thanks for giving just enough keywords to find the right information. :-) I found the book on Amazon (“Hacking the Xbox: An Introduction to Reverse Engineering”), but it might be a little lower level than I need, according to the TOC.

    I searched on my Safari Books Online subscription and found a book called Makers at Work which devotes a chapter to his interview. I’ll have to read that after I finish Coders at Work.

  7. Nicke Says:

    FWIW, the book by Bunnie was actually released as a free pdf some months ago:

    http://nostarch.com/xboxfree

    Nice book, but not much about optical drives.