Neradau dabar kur ten ta paskaiciavima rase, bet yra va kas:

Originally {downgrading kernel was possible} but Microsoft blew eFuses 
during the upgrade from kernel 4548 to 4552 as that's where they fixed 
the {Hypervisor Vulnerability} (which only works on kernel 4532/4548 and 
allows to run unsigned code / linux). It was already known that by 
removing the {r6t3 resistor} from the motherboard before the upgrade you 
could prevent MS from blowing eFuses and thus still be able to downgrade 
from a 4552+ to pre-4552, but I don't know how safe this is for future 
kernel updates.
MS doesn't blow new eFuses (located on the CPU dye) on each upgrade 
because they only have a limited amount available: 768 (12 'fuselines' 
of 64 fuses each) in total and only a part of these (5 'fuselines'(= 320 
fuses)?) can be used to prevent kernel downgrading (= 80 possible 
downgrade bans? - once blown it can't be undone}. The eFuses also 
contain {other data} like a unique 'CPU Key'.
According to tmbinc, this key is used for:
* Encryption of the *keyvault* (that stores: console certificate(s), 
per-box private keys, DVD key, however NOT any code-related encryption keys)
* Encryption of an imported console revocation table (CRLL, that stuff 
which recently hit 360gamesaves.com, and no, this isn't live-related),
* "Encryption" of the pairing information of the 'CB' and 'CF' (for 
exact details, please reverse that code, it's a bit hard to describe.)

-------------------
In the decrypted CF there is a "version lockdown counter" at 0x21F. 
Every time an update is applied (since version 4532) an eFuse is blown 
and the counter is incremented by 1 before it is written into the new 
CF. When booting, a check is made to ensure that the lockdown counter in 
the selected CF >= number of blown eFuses.
The good news is that we can modify the lockdown counter byte and 
re-encrypt the CF section. The bad news is that a hash of the first 
0x220 bytes requires the CPU Key. So as long as we know our CPU Key we 
can downgrade to a vulnerable kernel.

1) Brand new XBox with 1888 & 2241
The Version Lockdown Counter in my 2241 CF is 0
2) Applied 4532
The Version Lockdown Counter in my 4532 CF is 1
Also fuseset 07: f000000000000000
3) Applied 4552
The Version Lockdown Counter in my 4552 CF is 2. Confirmed that I cant 
downgrade to unpatched 4532 dump
4) Fixed up a dump of 4532 with CF Lockdown Counter = 2. Boots!
Now when I dump my fuse data
fuseset 07: ff00000000000000
A second fuse was blown by 4552




On 2011.01.24 14:10, bullka wrote:
>
>> paskui http://www.xboxhacker.org/index.php?topic=7241.0  ir kituose 
>> threaduose.
>
> Imesk ka ten raso. Nes praso registruotis. Nelabai norisi.