J-Runner (basic guide) v3 build 1

Size: px

Start display at page:

Download "J-Runner (basic guide) v3 build 1"

Dina Griffith
6 years ago
Views:

J-Runner (basic guide) v3 build 1 J-Runner is a GUI that uses Xebuild, Xell-reloaded (full credit to their authors). Python has been replaced with code within the GUI.

1 J-Runner (basic guide) v3 build 1 J-Runner is a GUI that uses Xebuild, Xell-reloaded (full credit to their authors). Python has been replaced with code within the GUI. It Enables JTAG, Glitch & Retail images to be created. Nandpro is NOT required nor used. J-Runner has been designed to be used with Nand-X / JR-Programmer and T-X CoolRunner (if doing glitch hack). J-Runner relies on the fact you have already soldered in your CoolRunner or JTAG wiring there are plenty of diagrams available online and within J-Runner to achieve this correctly. In addition you should already have installed your drivers for Nand-X / JR-Programmer and have it connected to both your motherboard and CoolRunner(if doing Glitch Hack). Upon the first run of J-Runner it will automatically check that it is the latest version and ensure all the required files are correct (and download if required if File Downloads are enabled in settings). J-Runner is designed to be simple and intuitive: The process runs from left to right (Glitch Selected) And the same for JTAG (Obviously Flashing CoolRunner is not used)

2 1. Read Nand: The default is set to 2 dumps this will automatically dump the nand 2 times then compare the dumps to ensure they are the same! (number of dumps is selectable in number box) 2. Create ECC: / Create Xell-Reloaded: This uses the nanddump1.bin that is loaded in source box! It creates the file you need to flash to your nand this contains Xell-Reloaded and the glitch info(or Xell-Reloaded file with your keyvault) to allow you to boot your console to Xell-Reloaded and obtain your key. It then loads that file into Source box ready for writing. 3. Write ECC: / Write Xell-Reloaded: Does what it says on the tin writes the ECC/Xell-Reloaded file you created to your nand. Once written, remove power cable then re-plug and boot your console (fingers crossed) it will boot into xell-reloaded. This allows you to obtain your CPU Key (I suggest you open notepad and type it into that then save it as cpukey.txt if you are not using network cable to grab your key.) 4. Program CoolRunner: (not required for JTAG, R-JTAG, CR3 Pro) This is a simple as it sounds, it flashes your coolrunner with the required file. (CR3 Pro and R-JTAG are preprogrammed and should not be written to) although no longer directly in the line of operations Its not a nand function so was moved below the line of buttons. In addition more and more hacks are not requiring an XSVF to be programmed by the user. So it has been moved on the GUI. However for Coolrunners that do require programming it s required before attempting to boot your console to Xell to obtain console details. 5. Create Image: This requires your nanddump1.bin to be reloaded into the source box. As well as the cpukey pasted/loaded into the CPU Key Box. If you have the correct key then the information should be displayed on the right hand boxes. 6. Write Image: This writes the bin file you have loaded into the source box to your nand. Image selections

During creation of your final images You

create JTAG (with option for R-JTAG), Glitch

3 During creation of your final images You select what type of image you are trying to create JTAG (with option for R-JTAG), Glitch or Retail. Also which dashboard you wish to flash. Changing these buttons alters the option available to you! Aud_Clamp selection is also available for JTAG images Glitch2M is a new option in XeBuild for Trinity / Corona on dashes only

4 Xebuild Options All the available options in Xebuild can be set here, this is for advanced users! Don t change things you don t know what it does! NOTE: Shouldn t be used when Using Update Mode or Client Mode in Xebuild

Menu s explained (updated for v3 build 1) Tools: Restart: Restarts the app (it s nice to start things from fresh) Extract Files: Extract a load of files required for different things including CB s,

source. XValue: yep the old XVal program opens a window to input console serial and the X-value from console system settings.

5 Menu s explained (updated for v3 build 1) Tools: Restart: Restarts the app (it s nice to start things from fresh) Extract Files: Extract a load of files required for different things including CB s, KV.bin, SMC_config, SMC etc (these extract into working folder in a folder of their own based on serial or given name) SMC Config Editor: allows you to edit the config of SMC of any nand loaded into source. XValue: yep the old XVal program opens a window to input console serial and the X-value from console system settings. (proven to be unreliable as a means of checking if your console is banned but interesting none the less) Check Secdata: checks your nands secdata and reports a full breakdown of the values listed. Monitor POST: Does what it says on the tin (used for monitoring Power-On Self-Test - requires additional HW, google it)

Update JR-P fw: If you need to reprogram

6 Update JR-P fw: If you need to reprogram the JR-P, select bootloader update switch, press this! While its updating switch the update switch back to off Hex Editor: allows you to view the loaded file as hex (editing ability using CTRL F2) Images: Here you have handy reference pictures for wiring your JTAG/RGH Advanced Menu:

Custom Nand/CR Functions: From here you can write/read/erase nand tailoring specific blocks to start and block length etc and flash custom xsvf files Custom XeBuild Command: If

Demon/Fusion Write (remaps bad blocks): This function is only useful when you have a created an image with noremap and want to write it to console, it will remap the bad blocks

7 Custom Nand/CR Functions: From here you can write/read/erase nand tailoring specific blocks to start and block length etc and flash custom xsvf files Custom XeBuild Command: If you don t know how to use XeBuild on its own don t touch this! Corona 4GB Read/Write: This gives you free reign to read, write and erase to your 4GB nand, Use with caution. Demon/Fusion Write (remaps bad blocks): This function is only useful when you have a created an image with noremap and want to write it to console, it will remap the bad blocks automatically. Disclaimer! It s not recommended whatsoever to use this function with an image that has already remapped blocks, if you don t know that, we suggest you don t use it.

8 Change Lock Down Value: If you have to alter your LDV simply select this option the LDV boxes on nand info tab become editable, alter one of them and return to this menu to confirm it. Patch Nand: If I need to explain this you shouldn t be using it! A somewhat deprecated function. Its use is mostly to change the contents of kv.bin like region, dvdkey, serial, osig and Console ID Create an image without nanddump.bin: A rather nice feature. If you have carelessly ended up with ecc on your console and no stock nand! EEK! You need a KV.bin(rename kv_en.bin after an extract from ecc file), SMC.bin(rename SMC_en.bin from an extract), SMC_config.bin placed into Xebuild/data/ folder then enter your CPUKey into CPUKey box. Choose your dash and image type then select this option from menu. Get Latest SystemUpdate: It will download the latest system update from Microsoft, and extract it on the xebuild/[version] folder, if that folder exists, for xebuild use. Before you use this ensure that you add the latest dash to dash files first (this will create your xebuild/[version] folder ).

Settings: J-Runner now has some audible indication of things happening. It has some default embedded sounds for nand write/read complete, nand compare success and a failure sound!

Sonus360 Delay: if you experience lag whilst writing to the sonus try adding incrementing this Delay setting by 1 at a time. IP: The saved address to grab key from Xell.

9 Settings: J-Runner now has some audible indication of things happening. It has some default embedded sounds for nand write/read complete, nand compare success and a failure sound! If you are not a fan of these sounds you can set your own.wav files to play upon these 3 events from the settings menu on the toolbar. Sonus360 Delay: if you experience lag whilst writing to the sonus try adding incrementing this Delay setting by 1 at a time. IP: The saved address to grab key from Xell. IP Ranges: The to and from IP range to use Scan IP Range Button on main form XeBuild Image Name: choose the output name of the image (in case you want to use xenon.elf etc) Enable/Disable Filechecks: Checked is default to allow J-Runner to check all the files against its records and downloads any required. Auto Extract Files from nands: This setting will extract the files such as KV.bin, fcrt.bin, C-R.bin to a folder within your output folder named according to console serial or if you have Unique Name setting as well according to that. This should prevent any additional files becoming mixed up with other consoles if you have been working on other consoles and left files in the output folder. Only Move Nand/Files upon first CPU Key entry: If selected this will prevent J-Runner moving files you are working on to their respective serial folders, everytime you load a nand whose key is already in the db. (probably better with this selected selected by default) Use Unique name instead of Console Type in Db : This is for those who wish to use their own identifier instead of console type in CPU Key Db. If this is selected everytime you press read nand, you will be asked for a unique name. This in turn will be used in place of console type in the database and your Extracted files folder will use the name also. E.g. Extracted-uniquename.

CPU Key Database There is a Key database included in J-Runner this is automatically populated during the process and will store your key against console serial number.

10 CPU Key Database There is a Key database included in J-Runner this is automatically populated during the process and will store your key against console serial number. Next time you load that nand into sourcebox the key will auto populate from the database! Scan Folders : press this and point to the folders you d like to scan, it searches for keys and nands and add them to your database (once checking they match of course) Another new addition is the ability to use console type as a unique ID, you can manually right click on a row and select edit or you can use Unique name setting in settings page and JR will ask for a name at the start of a Read Nand and use that when adding to the database. If you double click a row your cpu key will be loaded into cpukey box on mainform pressing load source button after that should open the console serial folder that nand is kept in (providing you haven t moved it in relation to the application.exe) Making finding previous nands simple. Quick Key Functions F1 - Restarts the application F2 - F9 - F12 - Grabs the Config from the Nand (identify the nand) check source file against cpukeydb Forces a re-download of the application.

Read Nand: The default is 2 reads (this is to allow comparison to ensure you have a good dump) Ensure you have Nand-X or JR-Programmer all connected with drivers installed.

The choice you make here will be displayed in the text box on app and remain until you manually alter it by clicking on textbox itself or restart the app or manually load a file into source.

11 Read Nand: The default is 2 reads (this is to allow comparison to ensure you have a good dump) Ensure you have Nand-X or JR-Programmer all connected with drivers installed. Board plugged in but not powered on, then press the Read Nand button, J-Runner will check the nand type upon starting read it will select the correct nand for you. The choice you make here will be displayed in the text box on app and remain until you manually alter it by clicking on textbox itself or restart the app or manually load a file into source. Nand read is initialized and begins the first dump. NOTE: For Big Block Jaspers you have 3 options (selected board only = 64mb Dumps, 2mb Dumps(only if advanced selected) or Full Dumps) NOTE: For 4GB Corona Consoles an additional panel will temporarily replace nand info until you select close (on its panel) Once complete the second dump begins automatically. Upon both dumps being auto loaded into GUI for automatic comparison. Look in the log for the comparison result

12 With Glitch - Selected Flash CoolRunner At this point you should Flash the CoolRunner with relevant file Press the Program Coolrunner button You can also use LPT cable Programmer to program your CoolRunner

Create ECC At this point press the create ECC button you should see a

Look at the log and ensure there are no error messages NOTE: If you have

create a fixed file from which to create the ECC file.

13 Create ECC At this point press the create ECC button you should see a whole load of text appear in the log file. Look at the log and ensure there are no error messages NOTE: If you have bad blocks in the first 50 blocks, J-Runner will remap these for you and create a fixed file from which to create the ECC file. The created image is now loaded into the source box ready for writing At this point there have still been no changes made to your nand

14 Write ECC You now have to write the Xell-reloaded image with ECC data for your nand. Press write ECC You will then see this (or similar) Once finished Unplug power cord, wait 10 seconds or so, replug it and boot the console With any luck you should see Xell-reloaded on your screen

15 Once fully loaded Open notepad on your PC and type in the cpu key (at bottom of screen) then save the file as cpukey.txt (or you can use Http Then copy your key and paste into the CPU Key box in J-Runner. If you network the Xbox to your router and connect to the address shown at the bottom of the screen you can then use the grab CPU Key function just enter the digits shown on the screen for the IP address. For Corona motherboards Xell prior to 0.92 will not display video so you can use either Scan IP Range (This will scan the range you set in the Settings page and grab the CPUKey if it finds your Xbox running Xell) or Monitor COM (monitor com explained HERE) J-Runner will then reload your nanddump1.bin into source box again in preparation of key validation and image creation Now you should have all the info in KV tab on the right hand box and you will get a CPU Key verified message in the log! The log will also show your current LDV value of console!

16 At this point you now have all the info you need to create a Freeboot image. Shutdown the Xbox and proceed With JTAG Selected Flash CoolRunner This Button is NOT USED as part of JTAG HACK AS SUCH IS DISABLED - IGNORE IT IF DOING R-JTAG ENSURE YOU HAVE THE OPTION BOX TICKED Create Xell-Reloaded At this point press the Create Xell-Reloaded button You should see a text appear in the log file. Look at this and ensure there are no error messages The created image is now loaded into the source box ready for writing At this point there have still been no changes made to your nand Write Xell-Reloaded You now have to write the Xell-Reloaded image with your data to your nand. Press write Xell-Reloaded

You will then see this Once finished Unplug power cord, wait 10 seconds or so, replug it and boot the console With any luck you should see Xell-Reloaded on your screen Once fully loaded Open notepad

17 You will then see this Once finished Unplug power cord, wait 10 seconds or so, replug it and boot the console With any luck you should see Xell-Reloaded on your screen Once fully loaded Open notepad on your PC and type in the cpu key (at bottom of screen) then save the file as cpukey.txt Then copy your key and paste into the CPUKey box in J-Runner. (If you have your Xbox connected with network cable use Grab CPU Key function or you can use either Scan IP Range (This will scan the range you set in the Settings page and grab the CPUKey if it finds your Xbox running Xell) or Monitor COM (monitor com explained HERE)) Then J-Runner will reload your original nanddump1.bin into source box again

18 Now you should have all the info in kv tab on right hand box ( if CPU key is correct) and you will get a CPU Key verified message in the log! The log will also show your current LDV value of console! At this point you now have all the info you need to create a Freeboot image. Shutdown the Xbox and proceed

Dashlaunch remember to tick DL Patches Click the launch.ini Options Button Configure each option as you wish.

19 Create Image: You have to reloaded you original nand dump back into source box and have pasted in your cpu key. At this point you need to decide if you want dashlaunch installed There is a dashlaunch configurator included in J-Runner, if you want to include Dashlaunch remember to tick DL Patches Click the launch.ini Options Button Configure each option as you wish. I have selected the default boot of Freestyle Dash from a USB stick (naming the freestyle folder as FSD) You can save the settings for future use (becomes the default ini). But click create to save your file for this image. Exit the window.

(for experienced users) Now click Create XeBuild Image Button You should now be faced with something in log like this all your

20 Patching Xebuild: There are several patches available to use and can be found on the XeBuild Settings Tab Advanced options are also available within this tab. (for experienced users) Now click Create XeBuild Image Button You should now be faced with something in log like this all your files from this hack are saved in a folder (console serial number) You now have 2 options to flash this image to your Nand You can either press Write Nand Or you can copy the updflash.bin to a USB stick put into xbox and boot it!

$power for a few seconds At this point I plugged in my USB with Freestyle Dash folder (\FSD) Then replug and boot$

21 Write Nand Is as simple as it sounds Press the button and Nand write will start Once finished flashing Unplug power for a few seconds At this point I plugged in my USB with Freestyle Dash folder (\FSD) Then replug and boot it.

Using Xebuild to update your Console: New XeBuild has some exciting new features J-runner has been changed to reflect these.

xex on a FAT32 USB stick and boot your console) You can update your current RGH/JTAG over LAN Its incredibly quick and easy to do.

22 Using Xebuild to update your Console: New XeBuild has some exciting new features J-runner has been changed to reflect these. Dashlaunch updsver is required to be running on your xbox to make use of these. A standalone version of this has been released also (throw its default.xex on a FAT32 USB stick and boot your console) You can update your current RGH/JTAG over LAN Its incredibly quick and easy to do. Please ensure you added current dash to dash files, downloaded system update from advanced menu before using this updater The patches in settings tab are included in settings for this. The updater grabs your data from console, creates new nand and writes it and avatar and Kinect data to your console. Client Mode has a lot more selectable options For more detailed info regarding these functions read the release notes for XeBuild These functions should be used with caution.

(Screenshot from earlier version operation is the same) Mode: shows up as bootloader if the DemoN has no firmware installed.

23 DemoN Usage J-Runner has now integrated DemoN commands to enable full control of the Team Xecuter DemoN from within J-Runner. With Demon attached using USB (and driver installed) the DemoN icon will appear and the demon details will appear at bottom right of screen. (Screenshot from earlier version operation is the same) Mode: shows up as bootloader if the DemoN has no firmware installed. FW: Displays Current firmware/bootloader version (will not show up if in bootloader mode) Flash: This displays the nand that is selected at time of DemoN detection or Toggle-Nand function is used. NOTE: If you swap nands manually using switch on console whilst J-Runner is running this display will not change warn you if you select a nand function and the nand has been switched manually! J-Runner will DemoN Menu When DemoN is detected a new menu will appear that relates purely to DemoN functions.

24 Toggle NAND: To switch nand between the one on DemoN and the one on the Xbox360 use Toggle NAND menu selection. Upon toggling the currently selected nand will be displayed on bottom bar and in the log window. The Power On and Power Off function: only works if you have the optional wire connected for remote power. This enables you to power the xbox on and off! Update DemoN: this allows you to update the firmware on the DemoN. Just select this and select the firmware file. All Read, Write and flash CoolRunner functions operate as normal within J-Runner using DemoN instead of Nand-X or J-R Programmer when DemoN is connected using USB. (so expect nand functions to occur a lot faster!)

Monitor COM This feature allows you to see what s displayed on screen during booting of

Use an old DVD Drive power connector and utilize the wiring as shown below.

(same set up for upgrading Nand-x to ARM 3).

25 Monitor COM This feature allows you to see what s displayed on screen during booting of Xell. To use the COM Port you must have additional wiring and Hardware to use this feature. Use an old DVD Drive power connector and utilize the wiring as shown below. Then just connect a CK3i or X360USBPro V2 or even a CK3 Pro RevD with the additional wire (same set up for upgrading Nand-x to ARM 3). Slim points shown below For CK3i/X360USBPRO V2/CK3 Ver D (with wire) To use simply open port and boot Xell-Reloaded! Xell output will be displayed in window!

26 Nand-X USB Update Cable Picture xslvry (TX Forums) Credit for

bin read your nand (even though it contains ECC in first 50 blocks) (if you don t have the files above) You can get those files using the Extract Files

27 HOW-TO Create a Nand from CPUkey and files Create an image without nanddump.bin What you ll need: your cpukey that s crucial and unique kv.bin encrypted or not smc.bin encrypted or not smc_config.bin read your nand (even though it contains ECC in first 50 blocks) (if you don t have the files above) You can get those files using the Extract Files option load as source then select Extract from the tools menu Look in Output/Extracted-serial or Extracted-Uniquename folder First, copy those on files on the xebuild/data folder, if you haven t copied them, J-Runner will open the folder for you to copy them.

28 Copy the cpukey in the cpukey section Select the Dash Version you want Select the type of hack you want rgh, jtag or retail Press Advanced -> Create image without nanddump.bin You need to select mobo type

29 You will be asked for LDV, you can find the current one by booting to xell Your nand will be created and saved into folder

HOW-TO Change Lock down value Load Nand and cpu key Choose a dash version, nand type, and type of image you want (retail, glitch, jtag) On advanced menu click Change Lock Down Value Now enter

30 HOW-TO Change Lock down value Load Nand and cpu key Choose a dash version, nand type, and type of image you want (retail, glitch, jtag) On advanced menu click Change Lock Down Value Now enter the new lockdown value you wish Programmer s note: When you get the cpu key via Ethernet, current ldv will be mentioned in log and simply create an image as usual (New LDV will be used during build)

31 HOW-TO deal with BadBlocks In simple terms J-Runner is fully automated in dealing with badblocks! So use J-Runner as normal don t mess with the files or the process it s all taken care of! To help you understand; J-Runner remaps bad blocks only when: 1. Comparing the nands 2. It initializes the nand 3. Creates ECC those 3 DO NOT have any effect at all on the nand files or the console! The actual bad block handling is happening when JR is writing ECC, where the blocks are remapped on console! Remember bad blocks are not always bad, they're normal and common when hardware is involved. They are just areas of memory where the console has had issues writing to in the past. Also remapped blocks don t always exist. So don t panic In short if there is bad blocks J-Runner will deal with them whilst writing the ECC to the console. If you then use the same dump (the dump is never altered by J-Runner) then xebuild handles the bad blocks when creating an image. J-Runner then mearly writes that image as normal. So Bad-Blocks (proper ones, not bad soldering and getting badblocks reported on every block) how do you deal with them? You don t! J-Runner and XeBuild do! Be aware of them but continue as normal!

What is Building a New Bootloader Chain? Essentially this is building an ECC file for RGH2 whilst using a RGH1 Nand with the CPUKey! It s that simple!

32 What is Building a New Bootloader Chain? Essentially this is building an ECC file for RGH2 whilst using a RGH1 Nand with the CPUKey! It s that simple! So if you have a RGH1 Nand and the CPUKey and you want to experiment and try RGH2 without updating your console to Stock Nand beyond RGH1 ability. This is the way to do it.! I hope this clears things up.

HOW-TO Create Custom Sounds with SonuS SonuS requires sound files to be.wav in a certain format to be able to create.bins from them then combines those.bin to make a final.

33 HOW-TO Create Custom Sounds with SonuS SonuS requires sound files to be.wav in a certain format to be able to create.bins from them then combines those.bin to make a final.bin ready for writing to the console. So to get your wav file in the correct format, you need to do a little editing. Your final bin file size is also limited to 44k so you can t use a full music score as wav file and expect it to work. Dependant on your selection you end up with 2 or 3 sounds within your allowable 44k, so keep your files as small as possible to start with. To edit your sound file it s suggested you use Audacity it s a free sound editor that produces the sound to the correct format So open your sound file with Audacity Then set your project rate to 8000 Then you can maximise your volume level using Effect>Amplify

34 Don t amplify too much as will start to clip the peak points

35 4 seconds is quite long so you can play around and clip the length of the sound Once you finished editing length and volume (smaller size is better) You then Export the file

36 You now have a wav file in the correct format ready to be used! Do the same for the next sound/s you wish to use. Then in SonuS Editor load your files into the appropriate boxes (Start/Eject/Glitch)

Then press Convert.wav button. This converts your wavs to.

bin files have been loaded ready to create final files Upon pressing

bin if the combined filesize is too big you will see something like this

37 Then press Convert.wav button. This converts your wavs to.bin ready for creating final bin file You can see the new.bin files have been loaded ready to create final files Upon pressing Create.bin if the combined filesize is too big you will see something like this You then need to edit your wavs even further to make the file sizes smaller or choose alternate sounds/combinations Reload them and press Convert.wav again then Create.bin

must also be disconnected from SonuS to allow the glitch sound to play)

38 Wav s converted now press Create.bin Now you can write it and test it out! NOTE: If wishing to use the Glitch Sound option you are required to wire a single wire from sonus(shown below) to ROL point on CR (JR-Programmer must also be disconnected from SonuS to allow the glitch sound to play) Also a very short sound file is suggested to be used for Glitch noise. For Glitch Sound - a single wire goes from point shown to ROL point on CR3

THE LITE-ON DG16D5S AND HITACHI DLN10N 0500/0502* SOLUTION FROM THE MATRIX TEAM

QUICK INSTALL GUIDE FOR MATRIX CRYPTOCOP ADDON + FREEDOM LITE PCB: THE LITE-ON DG16D5S AND HITACHI DLN10N 0500/0502* SOLUTION FROM THE MATRIX TEAM BEFORE YOU BEGIN This solution provides the option to