Pictures from a prototype

[Sally]

Since i haven't been able to update my site lately and i've promised an update, here is a zip file with a bunch of pictures from one of my prototype xboxes. This is from the one with the stress test. Most of these pictures have never seen the light of day.

These are the pictures, it's a 40 meg zip file that extracts to about 200 meg.:
http://gamerhistory.com/images/xlab1020-image1.zip

In case someone finds it interesting, this is the kernel output from the stress test. This is running off of the original hardware. The output is slightly different off of final hardware.
http://gamerhistory.com/proto.txt


Questions, comments, lawsuits? lmk.

[DeadperfecT]

Great screen caps. Thx for sharing a piece of xbox history.

[atomiX]

Awesome stuff. You finally got it working again? :)

BTW, I'm positive I've seen some of those textures in one of my bootloader discs (june 2003). Kind of odd but i'll see what others I can find.

Edit 2: INDEED, I checked my disc and it contains all the different textures used on those cogs as well as a final screenshot of the cogs like the one in your archive. I'm positive now that this disc contains the same stress tests found on your kit. It's a shame I don't know how to make it run (it requires a connection to the MS server to launch).
lol...

This is the disc I'm talking about if you're wondering:

[Sally]

I've been trying to get one of those discs for a while now... If that does have the stress test, it would be very interesting. The textures are actually compiled into the binary on the prototype.

That could help answer a few questions i have. When i decompiled the stress test app, i found a section of code that could only be activated over a network. I could run a lot more tests using the PC side of the stress test. Unfortunately no one seems to have it anymore.

One of the weird things about the stress test is that is uses a custom set of networking protocalls, it doesn't touch the xbox live network api at all. This leads me to believe that they used the same protocalls for the server appliance. In which case, i could probably remote trigger the testing disc without the server appliance as i already have the syn/ack response patern... he he he...

lmk if you ever want to get rid of it.

Oh... and what's written in sharpie above the word microsoft on that disc is as much of an identifier as anything else. It corosponds with the line number of the production facility, and considering the date it was made, that disc could only have come from one factory.

[atomiX]

A bout a year or so ago, I made a thread on X-S about this very disc. Using a disassembler, a person I know was able to bypass the IP verification by forcing a correct reply from the server. It skipped the part where it asks for the IP but it sadly locked up on the next step when it was looking for actual data from the server. The xbe itself seems to be an archive where all the test executables are compressed and are extracted to the HD to be run. I'll try to find that thread if I can but I doubt it since search is still down over there...

edit: There we go, I found it using google search. There's various bit and pieces of info in that thread so maybe there's something you might find useful. It does seem to look for a specific IP for the server end.

http://forums.xbox-scene.com/index.php?showtopic=354276


Also, this stress test functionality seems to only be available on the newer versions of the bootloader discs (ie June 2003). I also have the less rare Sept 2001 version but that one simply contains a promo DVD video of early xbox games including alpha Halo and a single XBE that displays a yellow screen. Maybe has different colors for diagnostics.

[Sally]

That's exactly how the stress test is supposed to work too. It connects to a server to download all of the media (in this case, about a gig worth of data). If the server isn't there, it looks for a local cashe for the info. Luckly the proto happened to have a local cashe.

The other issue with the stress test is that it was locked to a certain kernel (in this case, 3910). Since everything else is nearly identical, i would assume the test utility disc has similar protection. Since the media seems the same as the stress test, i could probably force the disc to boot.

[atomiX]

The other issue with the stress test is that it was locked to a certain kernel (in this case, 3910). Since everything else is nearly identical, i would assume the test utility disc has similar protection. Since the media seems the same as the stress test, i could probably force the disc to boot.

I doubt it's locked to a kernel since I could run it on my DVT4 dev and a modded retail but the XBE is debug-signed so it won't run on an unmodded retail console (unless the fallback when no valid eeprom exists is real).

[Sally]

The kernel locking is a bit odd... the program will run fine until it checks the kernel, then i freezes and casuses a kernel panic. It would be helpful if you could attach xbox watson to the debugger while the disc starts up.

EDIT:

the more i think about this, the more it all ties together. I'm begining to think that the stress test is a prototype application for the server appliance. Actually stressing out the xbox's hardware is only the visible side of the stress test, if you look at the kernel, it's running through hunderds of internal hardware checks. Everything from bus speeds to the system clock crystal. The custom remote networking commands just hammer in this idea. Maybe the reason i can't find a pc side controller is that it didn't actually run on a pc, but on the server appliance. It all fits together. The fact the stress test calls itself "HARNESS" suddenly makes sense as well, considering the internal utility disc atomiX pictured above was also called "HARNESS". I'm thinking the applications are actually one and the same, or at least related to one another.

Take a look at the kernel ouput from the prototype:

HARNESS: Start testing
HARNESS: system version 1.00.3910.01, XTL version 1.00.3910.01
HARNESS: found logical drive A: (\Device\Cdrom0)
HARNESS: found logical drive D: (\Device\Harddisk0\Partition1\devkit)
HARNESS: found logical drive T: (\Device\Harddisk0\partition1\TDATA\a7049955)
HARNESS: found logical drive U: (\Device\Harddisk0\partition1\UDATA\a7049955)
HARNESS: found logical drive Z: (\Device\Harddisk0\Partition5)

Each one of those lines actually corosponds with an internal security check, the system runs off of a custom dxt file that screws with the standard drive mappings. C becomes Y, D becomes A, that sort of thing. That's part of the security check. It also checks the kernel revision number, if it doesn't match the application shuts down, much like atomiX saw with the test utility disc. I was able to break each of the security tests on the prototype so that it would work on a standard debugger.

I've already started working on a pc side app to control the stress test, in essense mimicing the server appliance, so i know i can fake the connection. Luckly most of the control interfaces are actually set by an ini file stored in the TDATA folder, with that ini i could fake a connection to the server appliance and run the utility disc. In theory of course... i can't publicly condone cracking the security of microsoft internal confidental applications... :lol:

[atomiX]

The kernel locking is a bit odd... the program will run fine until it checks the kernel, then i freezes and casuses a kernel panic. It would be helpful if you could attach xbox watson to the debugger while the disc starts up.

Launched from HD
[CODE]xbwatson: Connection to Xbox successful.
xbwatson: Xbox is restarting.
VX: INFO TCR verification disabled (use "vxa /reset" to enable)
VX: INFO VerifierX loaded
VX: INFO Watchdog thread started
VX: INFO \Device\Harddisk0\Partition6\Bootloader\default.xb e
VX: INFO Application loaded, TitleID=0xfffd0001
Xbox image loaded: \Device\Harddisk0\Partition6\Bootloader\default.xb e
This XBE was linked with XAPILIB.LIB version 1.00.4831.09
This XBE was linked with LIBCMT.LIB version 1.00.4831.01
This XBE was linked with XBOXKRNL.LIB version 1.00.4831.01
This XBE was linked with XNET.LIB version 1.00.4831.08
This XBE was linked with D3D8.LIB version 1.00.4831.01
XNetGetTitleXnAddr returned 0x68.
iInitHostCommunication: Incorrect Base LAN address found 0x9701a8c0
MTLDR: Found an error in setting up. No more attempts will be tried.[/CODE]

Launched from DVD:
[CODE]xbwatson: Connection to Xbox successful.
WRN[XShell]: ::LaunchXBE():Filename - 'default.xbe'
WRN[XShell]: ::LaunchXBE():Directory - '\Device\CdRom0'
xbwatson: Xbox is restarting.
VX: INFO TCR verification disabled (use "vxa /reset" to enable)
VX: INFO VerifierX loaded
VX: INFO Watchdog thread started
VX: INFO \Device\CdRom0\default.xbe
VX: INFO Application loaded, TitleID=0xfffd0001
Xbox image loaded: \Device\CdRom0\default.xbe
This XBE was linked with XAPILIB.LIB version 1.00.4831.09
This XBE was linked with LIBCMT.LIB version 1.00.4831.01
This XBE was linked with XBOXKRNL.LIB version 1.00.4831.01
This XBE was linked with XNET.LIB version 1.00.4831.08
This XBE was linked with D3D8.LIB version 1.00.4831.01
XNetGetTitleXnAddr returned 0x68.
iInitHostCommunication: Incorrect Base LAN address found 0x9701a8c0
MTLDR: Found an error in setting up. No more attempts will be tried.[/CODE]

0x9701a8c0 = 192.168.1.151 in this case which is the title IP address

Check page 4 in the thread I posted above. You'll find good info regarding the IP configuration ;)