DISCLAIMER:
-----------

Use at your own risk. It is very easy to make a mistake here. This guide is
very rudimentary and makes assumptions that a newbie may find puzzling.

Before installing any files using this guide, please consider ldots' memory
card UDE installer package. It is a LOT easier and includes additional
software (such as Phoenix BIOS Loader and a replacement dashboard.)


Required:
---------

	- An update.xbe file from MS dashboard version 4920. There are two
	  supported versions:
		* MS dashboard 4920 with directory xboxdashdata.10027100
		  - update.xbe has file size 1914880 and md5sum
		    73402a42463766842e56e82b839d5669.
		  - only works with kernels 5530 and less.

		* MS dashboard 4920 with directory xboxdashdata.1012A700
		  - update.xbe has file size 1974272 and md5sum
		    8ab653c39f555758fb65d9014928c4cd.
		  - only works with kernels 5530 and less.

		* The game NFL Fever 2003 !Live content has/had an update.xbe:
		  - update.xbe has file size 1916928 and md5sum
		    b2875da022264e19107db4fb1f7af1db.
		  - works with all kernels (3944-5838).
		  - only for US/CANADA region.

	- Your own default.xbe you wish to run after boot up. This may
          be e.g. an executable for a replacement dashboard or a boot loader
          (Linux boot loader, Phoenix BIOS Loader etc.) The file default.xbe
          must be signed with the HABIBI-key (you can sign with the xbedump
          program.)


The exploit itself depends on two additional files, bert and ernie.

The directory fonts/s1914880 contains berts for the 1914880-byte update.xbe.
The directory fonts/s1974272 contains berts for the 1974272-byte update.xbe.
The directory fonts/nfl-fever-2003-us-s1916928 contains berts for the
NFL Fever 2003 US/CANADA update.xbe.

Ernie is the file fonts/ernie.xtf.


Quick installation guide:
-------------------------

It is recommended that you first set language to English in the original
dashboard's settings menu.

1. Rename your current C:\xboxdash.xbe to C:\orig-xboxdash.xbe

2. Copy update.xbe to C:\xboxdash.xbe

3. Rename C:\fonts directory to C:\f0nts  (note the ZERO!)

4. Create directory C:\fonts

5. Select a bert file corresponding to your update.xbe version and your kernel
   version. E.g. if you have the 1974272-byte update.xbe and kernel version
   5101, select the file fonts/s1974272/bert-5101-01.xtf. Copy it to C:\fonts\.
   If you can't find a bert file for your kernel version, use bert-generic.xtf.
   (however, see "Required" section above for version restrictions.)

6. Copy ernie.xtf to C:\fonts\

7. If you are using the 1914880-byte version update.xbe, copy s.xtf to
   C:\fonts\  (recommended, but may not be necessary)

8. Copy your own HABIBI-signed default.xbe to E:\default.xbe. This file
   can be e.g. dashboard executable or Phoenix BIOS Loader executable.

9. Reboot. Your box should now run E:\default.xbe automatically.


If it doesn't, double check everything. DO NOT LEAVE YOUR XBOX FOR EXTENDED
PERIODS OF TIME IN A STATE WHERE IT CANNOT BOOT INTO A DASHBOARD. Especially
do not unplug the Xbox in such a state. If you do, your Xbox may not boot
even a DVD game disc (007/MechAssault/Splinter Cell) upon the next power up
and will then probably need to be opened to recover. So if things don't work
out, reverse steps 1 and 3.

NOTE: do not change the order of steps 5 and 6. For kernel version specific
berts this is important (bert must appear first in the actual directory data
on the disk), but doesn't matter for bert-generic.



If you have done everything ABSOLUTELY CERTAINLY CORRECT (triple checked,
and triple installed) so far, and it still doesn't work (freezes in the big X
logo and white MS text under it), you may have one of the rare Xboxes that
need additional steps:

10. Copy s.xtf to C:\fonts\s.xtf  (if you already didn't)

Still not working:

11. Copy s.xtf also to C:\fonts\s2.xtf

Still not working:

12. Copy s.xtf also to C:\fonts\s3.xtf


If you wish to change your language setting to something else than
English (in case you want an MS dashboard derivative such as thc lite),
beware that you may need to do steps 10-12 to make it work after the change.



Editing the default.xbe path and file name:
-------------------------------------------

If you wish to boot some other file than E:\default.xbe you may hex-edit
ernie.xtf. The path and file name string there has 12 zero bytes after it and
these may be freely replaced to make the string longer. You may also recompile
the file ernie.asm (source code in src directory).


-rmenhal
