引用:

Xbox360 LIVE Bans Info and iXtreme Online FW WIP
Posted by XanTium | May 21 23:43 EST | News Category: Xbox360

  
Here are some details about the Xbox360 LIVE bans I got directly and indirectly from GaryOPA, Commodore4eva (C4E), Iriez and others. Of course don't take any of this info as 100% confirmed, noone knows exactly based on what data MS is banning ... it's just an analysis of what they think is happening and what MS might/can be checking.

C4E thinks MS is probably detecting and banning consoles from LIVE by tracking usage of backups via timing of the challenge response (c/r) on the drive over the last few weeks or months. A modified FW will reply much faster to the the Challenges requests (stored in a table) than an original firmware (seek on drive). They probably do this test more than once and can ban you if you're above a certain average.
FuzzyLogic also found that microsoft is sometimes doing additional checks on discs: PFI/DMI (so images without these sectors (or if using an old FWs without support for PFI/DMI) can probably be detected easily), drive inquiry (reads ascii string from drive), and capacity (reports capacity of disc) are requested. Strange thing here is MS requests 0x8000 bytes for PFI and DMI, while it should normally be 0x0800 bytes. TheSpecialist pointed out that the remaining 0x7800 bytes contains the relocated SS and PFI on burned discs ... which would make it very easy to detect backups for MS. C4E however told us this would not work on TS drives as its cut off to 0800 even if more data is asked, it's unconfirmed how modified HLG FWs drives respond to this atm.
The "read capacity check" will also work as detection on HLG because, unlike the newest TS FWs, it doesn't have true 'stealth media' yet, these drives are reporting back the burned disc based size of PFI instead of the correct PFI.
Apparently there's also an issue with SS (Security Sector) extracted from Hitachi-LG, some necessary data is screwed ... which means that probably only the Toshiba-Samsung / kreon setup has been extracting correct SS.

Another thing they are probably detecting (but probably not using yet to decide to ban or not) and log/flag is if you ever booted your Xbox360 with DVD SATA cable not connected to your Xbox360 (E64). Many people did this to power their drive when they wanted to flash it (power connected to 360, SATA to PC). So it's highly suggested to use an external power to flash next time.
It's also possible MS also bans based on stuff like bad credit card info for your country, running a NTSC machine with euro-address/credit card (or inverse), having out-of-region (arcade) games and demos on your HDD, unofficial 360 HDD, internet downloaded gamesaves etc. There's no clear view on all this yet.
For now, C4E believes Microsoft is not detecting modified FWs or detecting FW changes/updates. Using a special FW they did not detect any debug commands sent to the drive by MS (they went through the dash/kernel updates with the special FW as well and did not detect any debug commands there either). So they think either:
A/ MS is not doing any FW detection right now, and only previously (maybe on request of MS servers while playing on LIVE?), or
B/ MS is banning based only on the timings of the drive, ss/pfi/dmi checks, capacity, drive inquiry and c/r verification.

We also got information C4E is working on an "iXtreme Online" FW for Toshiba-Samsung drives, a Hitachi-LG version and maybe even BenQ version might follow later.
The new FW will have less features than the current Xtreme FWs: no single-layer (DVD5) support, no ripping of games (0800 mode), but more features to safely play from burned discs (emulate the exact speed and timings of the original games) and prevent booting from un-safe discs (without PFI and DMI or bad SS - so discs not passing the 'Stealth Check' (using Xbox Backup Creator(info)(info) for example) are not going to boot on the new firmware), or images that aren't exact dumps of the original.
There's no official ETA (maybe this weekend though for TS drives), and of course no guarantee MS will never ban you based on new checks (that's the risk it takes if you want to be part of the modding community ) The HLG FW will take a bit longer as it'll require true 'Stealth media' etc added.

This new FW will of course be made mostly for new consoles being modded, because even if you're not banned from LIVE yet there's no way to know if MS already has info/logs on your console ID regarding timings or other stuff so even changing to this new firmware in the near future may not stop that console ID from being banned in the next wave of MS bans.
If your console is not banned yet, it's highly suggested you don't boot any burned discs, originals should be ok, even when offline (MS might be storing results of some checks in flash), until the release of the new FW.
If your console is already banned this will of course not help you ... just enjoy the offline playing on that console for now (with some games you could try using 3rd party networks like XLink Kai(info)) and maybe some day a new exploit will allow you to do more with that console.

To end with ... X-Scene's obvious tip of the month: don't buy 2nd hand Xbox360 consoles

本文是从GaryOPA, Commodore4eva (C4E), Iriez那里了解到的有关ban机时间的一些细节，当然不保证这些细节信息百分之百准确，目前没有人能肯定MS究竟是根据什么来ban主机的，只是他们认为MS目前可能采用的手段而已。
C4E认为MS可能是通过驱动器里的“查询/应答计时器”来检测备份光盘的使用情况，而且可能已经持续检验数周到数月了。修改过的固件在响应查询请求的速度比原始固件要快很多，MS可能多次进行这种测试，如果你的平均响应值超过标准，你就死了。
FuzzyLogic也发现有时MS会对光盘进行额外的PFI（物理格式信息）和DMI（光碟制造信息）检测，驱动器查询（从光驱查询ascii字符串），以及光盘容量查询。奇怪的是MS会针对PFI、DMI请求0x8000字节的数据，而正常应该是请求0x0800字节的数据，有砖家指出，多请求的0x7800字节数据内包括备份光盘中位置已经变动的SS和PFI信息，这样来辨别备份光盘会更加容易。
但是C4E指出，这样的做法在三星光驱上是行不通的，因为三星光驱只响应0x0800字节的数据，超过部分就抛弃掉。目前还不清楚修改后HL光驱固件如何响应这个请求。
“读取容量检测”也可以被MS用来检测HL光驱，因为目前HL光驱和三星光驱相比，还没有做到真正的保密功能。HL光驱在响应请求的时候会返回备份光盘的PFI而不是原始的PFI。
而且，从HL光驱的导出的SS也有问题，有一些必要的信息丢失了，所以目前也许从三星光驱才能导出的正确SS信息。
MS也可能还在检测别的一些信息（未必会用来作为ban机的决定性信息）并且记录你是否曾经在未将光驱的SATA线连接至主机的情况下启动主机（这是刷机的必经步骤，除非你买了额外的电源模块），所以建议你下次刷机的时候使用电源模块给光驱供电，不要启动主机来供电。
另外MS可能的ban机根据还有：信用卡的信用等级、运行MTSC主机但是用的是其他国家的信用卡、下载了跨区的arcade游戏或者demo，自己改装的硬盘、下载的游戏存档等等，目前这些没有确实的根据。
目前C4E认为MS并没有检测光驱固件的修改和变动，通过使用特殊的固件进行测试，他们发现MS并没有发送任何debug命令给光驱（使用该固件的情况下进行了春季更新，依然没有发现任何异常）。所以他们认为或者
A：MS目前没有检测固件版本，或者在玩live游戏的时候游戏服务器会检测也未可知。
B：MS根据光驱内的计时器，ss/pfi/dmi的检测，容量检测，驱动器查询等上述的方式来决定是否ban你的主机
我们还得知目前C4E正在为三星光驱制作iXtreme Online固件，HL光驱的固件甚至BENQ的固件会在之后稍晚放出。
新的固件比之前的固件会少一些特性：
不能玩D5的游戏了
不能对游戏进行rip操作
但是会有更多的安全特性，如模拟Z版游戏的导出速度和计时，阻止运行不安全的光盘（没有PFI、DMI、SS信息等或者和原始镜像相比数据有缺失）。
目前还没有官方的发布时间（三星光驱的固件可能在这个周末发布），而且不会保证刷了以后MS就永远不会ban掉你的主机，HL的固件因为需要添加数据保密功能，所以需时较长。
新的固件主要是为新的主机准备的，因为即使你现在还没有被ban，你没有办法确认MS是不是之前已经记录了你的主机信息，如果是，那么即使你刷了新的固件，那么MS下一波就可能要了你的命。
如果你还没被ban，那么强烈建议你目前不要玩任何备份光盘，即便是离线状态也尽量不要，因为主机可能会记录你的游戏信息，然后耐心等待新固件的到来
当然玩正版应该没事。
如果你已经被ban，那么你死翘了，好好享受你美妙的单机人生吧，或者部分游戏试试KAI也不错，也可能在将来会发现新的漏洞....总之一切都还有希望

最后，强烈建议你：以后就不要买二手的XO了！

[ 本帖最后由 akirasai 于 2007-5-22 17:18 编辑 ]

麻痹，没看到，居然有人先发了，真是白蛋疼了

引用:

原帖由 狂涂 于 2007-5-22 17:00 发表
建议把另一段也翻译了...

哪一段？

这段？
小学生都看得懂，翻毛啊

引用:

原帖由 RestlessDream 于 2007-5-22 18:54 发表

这个问题偶已经在老外的论坛问了
不知道是不是胡说
等待验证ing