IsoBuster beta with added new consoles support

[Berion]

@bucanero No, it is read only and extracted data is extracted file (so it is literally *.vms alone). Yet still thanks for the information! ^^

@sandungas :P

 

[Peppe90]

1. Dumps via i.e DMDE first 512KiB. There is partition table BRFR and this is why this is important.
2. If You could also show me the addresses where "F:\" and "G:\" starting. This will help determine if LBA in partition table is correct. However, this step is very time consuming (~3 hours for 1TiB).

Would this image be useful??

Obviously this is not mine I took it from the web (this isn't even correctly formatted). Unfortunately I cannot turn on my Xbox for now

 

[Berion]

Address must correspond with partition table. Since start of G can be anywhere, it must be find in partition table and must fit to found via hex address (to determine where it is and if this exactly this).

You don't need working Xbox. In preview posts I wrote how to do that (post with DMDE + post with HxD). ^^

 

[Desmo]

Just tested on linux and it works. I was able to install without any problems, open and view a couple of PS2 isos. My system is KDE Neon 20.04 using Q4Wine.

 

[Peppe90]

Address must correspond with partition table. Since start of G can be anywhere, it must be find in partition table and must fit to found via hex address (to determine where it is and if this exactly this).

That's a foto of XBP 1.3 main screen. G is partition number 7 (starting from the first one they're E, C, X, Y, Z, then the extended ones F and G). I though the start code could be the one you was looking for (also the size code should be the partition end). You can also see the cluster size on that screen (not in this case since there's an error), since partition must be formatted either in 16, 32 or 64kb clusters depending on the size.

You don't need working Xbox. In preview posts I wrote how to do that (post with DMDE + post with HxD). ^^

Yes yes, I simply thought it could be a short-cut. I'll check it with your linked program asap. Maybe I'll do it with the 500GB HDD firstly since it should be quicker.

 

[Berion]

@Peppe90 X/Y/Z/C/E partitions have always the same size and start from the same point. "F:\" will also always start from the same point (right after "E:\"). But if "F:\" size can be determine, also start point of "G:\" will not be always the same.

That's the reason why I need partition table + confirmed offset where at least "G:\" starting.

About clusters: it is not so easy. For some reason this value can be a multiplier.

Meanwhile, I'll check also Xbox Partitioner app as I have working Xbox so maybe I could setting up tiny F and tiny G enough to fit on my 120GiB HDD (my UnleashX doesn't allow that). But of course the more samples the better. ^^

@Desmo Thanks. ^^

 

[Peppe90]

@Peppe90 X/Y/Z/C/E partitions have always the same size and start from the same point. "F:\" will also always start from the same point (right after "E:\"). But if "F:\" size can be determine, also start point of "G:\" will not be always the same.

That's the reason why I need partition table + confirmed offset where at least "G:\" starting.

Yes, with XBPartitioner you can make G partition to start wherever you want using the triggers. You don't set the size but actually where the partition starts (you see it in the menu while doing) and where end. Indeed is easy to do errors.
I seems to remember you can do everything you want with XBP, also enlarging the default partitions (obviously you also have to modify the BIOS for the Xbox to see the changes).

 

[Peppe90]

@Peppe90 If You could do two things from all those disks I will be glad and this helps a lot to implement proper G support.

1. Dumps via i.e DMDE first 512KiB. There is partition table BRFR and this is why this is important.
2. If You could also show me the addresses where "F:\" and "G:\" starting. This will help determine if LBA in partition table is correct. However, this step is very time consuming (~3 hours for 1TiB).

a. Open disk in hex editor (any, i.e HxD on which I base). To do that, run HxD as administrator (because direct HDD reading needs elevated privileges; and don't worry it will be read-only so You will not break anything by accident). Go to menu >> Additions (?) >> Open hard disk >> physical disk.

View attachment 28973

b. Put pointer at the end of HDD. Press CTRL+F and type "464154580000000000" (this is FATX header), data type choose "hex values" and also very important: direction: up. Click ok and string searching will start.

First two matches will shows FATX offset starts for F & G (after first shot, write down the offset, then press F3 to search again from this point, after another match also write down the offset - I need them both ^^).

View attachment 28975


Thank You for Your time! ^^

I'm checking the 500GB HDD (I'll also check the 1tb one next time, if needed). Unfortunately I cannot check the partition size from file explorer until I fix the Xbox power unit. I'll check if Xbox HDM can at least see the extended partitions size.

Meanwhile this is the first 524KB of the 500GB HDD:

 

[Peppe90]

b. Put pointer at the end of HDD. Press CTRL+F and type "464154580000000000" (this is FATX header), data type choose "hex values" and also very important: direction: up. Click ok and string searching will start.

Probabably the program got updated, I have this screen:

I scrolled all down the page, so I should set Search direction "indietro" (backwards) right?
There's something else I have to change?

 

[Berion]

@Peppe90 Oh right, I'm using ancient version. In "Opzioni", should be something like hex values (because on screen above is set up text; if You want text You can search for "FATX" string and check checkbox "Distingui tra (...)" but if You have some XBE's on G or F it is possible that this search shows us false positives (part of compiled code instead of start of partition); so better is to search only hex values).

And yes, scrolling down to end of file, putting there cursor, and choosing Indietro.

Now I will remember those Spainish words for end of my life because of writing them by hand in translator.

PS: Thanks for the table. ^^

 

[Peppe90]

I leaved the PC scanning last night, estimated time was almost 9 hours (for the entire HDD I guess. Btw I cannot find hours of free time...).
But this morning I found the empty desktop, so I guess the PC rebooted itself for some reason.
Better so, since I wasn't doing it the right way.

@Peppe90 Oh right, I'm using ancient version. In "Opzioni", should be something like hex values (because on screen above is set up text; if You want text You can search for "FATX" string and check checkbox "Distingui tra (...)" but if You have some XBE's on G or F it is possible that this search shows us false positives (part of compiled code instead of start of partition); so better is to search only hex values).

I've a lot of XBEs since I have Xbox games on F. and Emulators on G:

I'll check if I can find the hex value option you're talking about. I can't find it in option, see:

And yes, scrolling down to end of file, putting there cursor, and choosing Indietro.

I should put the mouse cursor on the values or on the right column? There's difference?

I mean like this?:

[ATTACH=full]29031[/ATTACH]

Or like this?:

[ATTACH=full]29032[/ATTACH]

[QUOTE="Berion, post: 268450, member: 1431"][USER=42412]Now I will remember those Spainish words for end of my life because of writing them by hand in translator. :)[/QUOTE]

How can you confuse Italiano with Español !! XD

[QUOTE="Berion, post: 268450, member: 1431"]PS: Thanks for the table. ^^[/QUOTE]

No problem, thank you for this commitment.[/USER]

 

[Berion]

@Peppe90 Of course, the Italiano! I'm using DeepL translator which shows me Spain so I blindly just retype it. ^^ I'm sorry of course.

I updated today HxD app and see that indeed this dialogue box has changed a little. Also I forgot that after FATX with contents on it, there are other values instead of zeros. So it doesn't matter if we search for hex (46415458 (yes, exactly this)) or text (FATX). First card is for text strings (as on screen below), the second is hex values (in earlier versions this was on one). In "Opcje" ("Opzioni") there is codepage ("Kodowane tekstu" / "Codifica del testo"), can be ANSI or UTF as this text string will stay the same in both. If You decide to search by hex, then this listbox of course will not be visible.

Found partition starting will looks like on screen below. Which means, always started on "00 top bar" up to 03 (no later or earlier). I need only offset, so in example below is "1DD156000" which is in this example start of F (the same should be in Your case; so You can press CTRL+G and go directly to that address). If You put cursor on there (yes, in left window on Your screen ;]), direction should be then "Tutto". I think this will be shorter wait if G is larger than F.

 

[Peppe90]

@Peppe90 Of course, the Italiano! I'm using DeepL translator which shows me Spain so I blindly just retype it. ^^ I'm sorry of course.

Just joking, spanish and italian have many similarities after all

I updated today HxD app and see that indeed this dialogue box has changed a little. Also I forgot that after FATX with contents on it, there are other values instead of zeros. So it doesn't matter if we search for hex (46415458 (yes, exactly this)) or text (FATX). First card is for text strings (as on screen below), the second is hex values (in earlier versions this was on one). In "Opcje" ("Opzioni") there is codepage ("Kodowane tekstu" / "Codifica del testo"), can be ANSI or UTF as this text string will stay the same in both. If You decide to search by hex, then this listbox of course will not be visible.

Found partition starting will looks like on screen below. Which means, always started on "00 top bar" up to 03 (no later or earlier). I need only offset, so in example below is "1DD156000" which is in this example start of F (the same should be in Your case; so You can press CTRL+G and go directly to that address). If You put cursor on there (yes, in left window on Your screen ;]), direction should be then "Tutto". I think this will be shorter wait if G is larger than F.

View attachment 29038

I figured out after I writed that hex means esadecimal, sorry I'm not very good at english, also I used a hex editor only one time in my entire life before '^^

F: is bigger than G: btw. This is a 500GB HDD as I said. I can't remenber if I made G: 80 or 120GB in that HDD (and F: is all the remained space obviously). I'll try to find some time for fixing the Xbox these days so I can check it (xbox HDM can't see partitions size).

 

[Peppe90]

@Peppe90 Of course, the Italiano! I'm using DeepL translator which shows me Spain so I blindly just retype it. ^^ I'm sorry of course.

I updated today HxD app and see that indeed this dialogue box has changed a little. Also I forgot that after FATX with contents on it, there are other values instead of zeros. So it doesn't matter if we search for hex (46415458 (yes, exactly this)) or text (FATX). First card is for text strings (as on screen below), the second is hex values (in earlier versions this was on one). In "Opcje" ("Opzioni") there is codepage ("Kodowane tekstu" / "Codifica del testo"), can be ANSI or UTF as this text string will stay the same in both. If You decide to search by hex, then this listbox of course will not be visible.

Found partition starting will looks like on screen below. Which means, always started on "00 top bar" up to 03 (no later or earlier). I need only offset, so in example below is "1DD156000" which is in this example start of F (the same should be in Your case; so You can press CTRL+G and go directly to that address). If You put cursor on there (yes, in left window on Your screen ;]), direction should be then "Tutto". I think this will be shorter wait if G is larger than F.

View attachment 29038

Ok, so I pressed control + G and entered 1DD156000, so I should be on F: start.

Then I pressed control + F go on second card, entered 46415458 (also checked the box Tutto), pressed ok and in less than a second it brought me here:

 

[Peppe90]

I think it was another partition since it's on sector 1024.

I repeated the test checking "avanti" (onwards) instead of "tutto" (all) and after some seconds it found this:

This is a executable right? It is close to F start so it cannot be already G partition. If I correctly understood, the code 46415458 must start at 00 top bar.

I also checked ISOBuster beta you linked. I can see all files in default partitions:

However it can't find G partition and sees F partition as empty:

 

[Berion]

This is a executable right? It is close to F start so it cannot be already G partition. If I correctly understood, the code 46415458 must start at 00 top bar.

Yes, only at the top of 00. That's why I mentioned that FATX alone as text string or as hex values can produce false positives (like part of XBE executable code) but we don't have other choice.

Thanks for Your big effort and time! ^^

 

[Peppe90]

Yes, only at the top of 00. That's why I mentioned that FATX alone as text string or as hex values can produce false positives (like part of XBE executable code) but we don't have other choice.

Thanks for Your big effort and time! ^^

Here's the debug dump. All seems to be perfect. I just noticed a little difference compared to the previous beta:

As you can see from the dump, when opening the F: Drive you find a subfolder into it, where F: content is, but it is named G: (this is F actually).
And viceversa, when opening G: Drive you find into it a subfolder named F:

For avoid misunderstanding I have Xbox games only in the actual F: partition (also a couple emulators are in F).
On G: I've only emulators (almost all of them).

 

[Berion]

Based on the image, it looks like that You have gigantic E partition, beyond standard. This was unexpected and big thanks to hunt this issue! In addition, partition with label "XBOX G" starting before partition with label "XBOX F" and drive letters X/Y/Z/C/E/F/G are putting for partitions in order. So actually this is ok (You messed partitions a little in Xbox Partitioner ). Drive letters are nowhere written on Xbox HDD so it cannot be determine for all cases perfectly, that's why application guess it (normally You will have symbol "-" near the "FAT" rectangle but I ask author if he could set letters for better look). On standard partitions configurations (on all HDD from unhacked Xbox'es and majority of hacked Xbox'es this will works perfect (because it is not something common that user modifying original normally hardcoded LBAs for partitions up and including to E)). So in other words, current IsoBuster version expecting that E have standard ~4,7GiB size and that's why now You see unassigned partition as next partition starting far higher. I let the author know and this probably can be fixed in next version. ^^ Again, big thanks!

 

[Peppe90]

Based on the image, it looks like that You have gigantic E partition, beyond standard. This was unexpected and big thanks to hunt this issue!

In addition, partition with label "XBOX G" starting before partition with label "XBOX F" and drive letters X/Y/Z/C/E/F/G are putting for partitions in order. So actually this is ok (You messed partitions a little in Xbox Partitioner ). Drive letters are nowhere written on Xbox HDD so it cannot be determine for all cases perfectly, that's why application guess it (normally You will have symbol "-" near the "FAT" rectangle but I ask author if he could set letters for better look). On standard partitions configurations (on all HDD from unhacked Xbox'es and majority of hacked Xbox'es this will works perfect (because it is not something common that user modifying original normally hardcoded LBAs for partitions up and including to E)). So in other words, current IsoBuster version expecting that E have standard ~4,7GiB size and that's why now You see unassigned partition as next partition starting far higher. And this one unassigned partition, affecting drive letters order near the rectangles.

View attachment 29106

I see. I absolutely never modified E: or any of the original partitions. I think is normal for E: to be 5GB (a little less due to formatting).

Also I didn't messed up anything with XBP. I mean, I done thing correctly if something's wrong in partition names I think it's a XBP innacuracy.

Why the unassigned partition 06 is 229,15GB. On what's based that number?

 

[Berion]

I thinking Yours "E:\" have around 233GiB. This isn't true? IsoBuster assuming that standard partition (X - E) have standard size. So if ISB assume that E ends like in normal environments, a next partition starting at LBA 496203120, then space between them assign as unassigned partition (empty space).

And name "Unassigned Partition 06" comes from partition in order. It is seventh area found/interpreted (00 >> 01 >> 02 >> 03 >> 04 >> 05 >> 06).

IsoBuster showing whole data logic on i.e HDD, not only those partitions which can be parsed. So if E wasn't recognize as should, the rest of it threat like unknown data.