Only reason i stopped this project is that the original source was released. Grab that and work out the pinout and all will be revealed.

Most things silkscreened on a PCB with an "R" designator are in fact a resistor.

By bridging that connection your probably gonna be pulling whichever dataline its tied to permanently high. Not reccomended.

Here ya go

http://www.gc-forever.com/forums/viewto ... ?f=3&t=444

Just to confirm the flash updater does appear to function although i had to repeat the process.

Got a 1.00 xenoGC now reporting a Shell when pressing start, guess that makes it a V2

Seems to be a combination of the prepatcher and stopping the motor.

Both games (Wind waker/twilight Princess) boot in r33 using unpatched images and leaving the motor running.

Same as yamaharacer, tried both Wind Waker and Twilight Princess.

Both prepatched with pp r17. Both work fine in swiss r29 but in r33 soon after booting, both games stop the dvd and generate the error message.

Just going to try unpatched

Not that its the final goal of this partiular project but if enough people contribute with any information they can, anything should be possible.

Just in case anyone is interested, here are the 2 main payloads for the Xeno1

Payload1 is the smaller high speed loader and associated commands.

Payload2 is the main piece of drive code loaded in the second instance

Lol,i could make it look like kitt from knightrider but it wouldn't make it any more funtional :P What was catching my interest is the credits payload that it can run via the start button. At first i thought it might be a way of loading swiss but as you mention, it patches the apploader which i assu...

Phew, well after a short while sampling, chopping and coverting i now have the 2109 bytes of the main Xeno payload, Woot ! With a cursory glance it does look like valid drivecode but as i have yet to fully dissasemble the "high speed loader" i have no idea where in memory it is loaded or i...

Yay, even more progress. Im currently spending a bit of time picking apart the main initial payload. As far as i can tell it basically repurposes the debug port to enable a much higher transmission speed. I also grabbed a more detailed pic of the transition between the regular debug commands and the...

http://debugmo.de/2008/11/anatomy-of-an ... ntication/

Nice work on the GC disk copy protection by Tmbinc, im looking forward to the next parts..

Ahh it makes more sense now. Its kinda like a springboard into launching our drivecode payload. We upload a main block to 0x40D000, then a small "cleanup" routine to 0x008674 and then our final command overwrites what i assume to be an IRQ pointer. The re-directed IRQ returns to our cleanu...

Quick dissasembly of the last 8 command long block. 0x008674: F474 740A08 MOV $080A74,A0 0x008679: F720 4C80 MOV A0,($804C) 0x00867D: F474 00D040 MOV $40D000,A0 0x008682: F000 JMP (A0) First two commands look to restore some sort of pointer within the drivecode. The last two obviosuly launch our mai...

Never been told but i always assumed the author was a user called Cheqmate. I remember chatting on IRC to him back in the day and he was very knowledgable about the inner workings of the GC (and Wii) drivecodes.

No, nothing at all to do with me.

Im a regular visitor to eurasia.nu cos its great for scene stuff but im not affiliated in any way. It did spook me out a bit though, within a day or so of me starting my posts that article popped up. Maybe modrobert saw my posts ?

Interesting nonetheless.

WooHoo, postie dropped mine off this morning.

From Deutschland to Grosbritannien in not much more than a couple of days

Thanks Liquitt

Strange at all the XenoGC info popping up recently

http://www.eurasia.nu/modules.php?name= ... =0&thold=0

Pictures paint a thousand words.

Heres the point where the SPI data transitions between the standard debug packets and into its new serial format.

Thanks for that emu, ill keep an eye out for those. Any chance of that DOL btw ?

Im just waiting on a replacement cube in the post, only gone and killed the laser on mine at the worst time Can still sniff the SPI but wont boot disks now .. hey ho.

Are those commands added to the debug port or commands that the GC can send to the drive ?

The fuse bits are not a concern other than when it comes to trying to dump the contents of an MCU. If its locked then other than a glitch attack, decapping and manually resetting the CP fuses is the only way of retrieving the contents. I have a company in china that i have used a number of times in ...

If you upload it i can dissasemble it if its a valid Atmega8 dump.

The easy way to validate it is that it will contain the block of code i am about to post which is sent by the Xeno.

Been having a play with the drive setup this afternoon and now have a little bit of data to play with. Luckily my Logic Analyser software has the ability to automatically decode SPI data so it took a bit of the donkey work out of it so far. The SPI debug port is accessed by the modchip using a read ...

Ive labled in pink where you can connect to. The pad directly above the "3" of the "CN302" silk OR the via that both that pad and your missing pad leads to.