Things you will need
An Xbox (any version PAL or NTSC)
One of the following games:-
James Bond 007 Agent under fire (007)
Splinter Cell (SC)
One of the following saves (depending which game you have), all based on Ltools' excellent installer v1.8:-
Mechassault : ed2k: Ltools1.8_MA.zip
[4.74 Mb] [Stats
James Bond 007 Agent under fire : ed2k: Ltools1.8_007.zip
[4.68 Mb] [Stats
Splinter Cell (PAL): ed2k: Splintercell_Parts1&2.zip
[4.68 Mb] [Stats
If you are using 007 or SC grab the MA save as well
An Action Replay,
or Xbox Memory card used with Homemade Action replay
or USB memory stick (1.0 compatible) (although compatibility of memory sticks is very hit and miss)
There ARE ways round the Action Replay requirement, but they involve opening the xbox and for the sake of this guide I'm assuming you want to avoid doing that and maintain your warranty.
OK, I've got all that, what do I do with it all?
Firstly a quick primer as to what we are actually going to do and why :
Basically, softmodding involves using a bug that exists in the way the games above handle their save game loading in order to force the Xbox to load "unsigned" (i.e non M$ approved) code, then exploiting a buffer overflow in M$'s font files to do the same to the xbox itself.
The hardest part of this whole process is getting the necessary save onto the xbox and there are essentially 2 ways to do this
1) Put it on a removable media that the standard M$ dash will read (memory card or USB memory stick)
2) Put it on the Harddisk directly (this would involve opening the Xbox and is not what we are looking for)
Which leads neatly on to :
Getting the save onto the Memorycard
OK, you could use a Datel AR, but they have 2 drawbacks,
1) They're expensive
and (more importantly)
2) Their memory cards are of EXTREMELY variable quality and some have been known to corrupt saves (although recently they have improved dramatically)
BUT it's easy on the xbox to make your own Action Replay AND it had the added advantage of being able to use the xbox controller on the PC.
How to make a homemade Action Replay
Follow my guide here
If you have already got an AR or have completed the guide above, all you have to do is drag the relevant .zip file into the middle window and use the AR software to transfer it across to the memory card.
<img src="http://members.lycos.co.uk/hhahscreens2/uploads/ARtransfer.jpg" width=640>
OK, having done that and transferred the save (or saves in the case of Splinter Cell) across to the memory card you then need to transfer the save(s) from the memory card to the Xbox.
Transferring the save
Plug the controller with the memory card into the xbox.
In order to transfer the save to the memory card, from the M$ dashboard select the Memory option from this screen
then select the memory card, listed as Controller 1 (assuming you have the controller in port 1) and you should be taken to a screen similar to this :
Move the cursor down until the larger icon of the relevant save (MA,007 or SC) on the left is highlighted, then press right and A and select "Copy" with the destination as Hard Disk.
Press B 3 times to return to the main menu.
If you are running either 007 or SC you will also need to repeat this with the MA save AS WELL, so for 007 you will need both the 007 save AND the MA save on your xbox.
This will need to be done using the action replay on two separate occasions as the memory card is not big enough to have both games on at once.
What xbox do I have?
It is impoortant to know whether you have a v1.6(b) Xbox or not, in order to find out select the settings option from the dashboard root
move the cursor down to "about" and press A
Let the copyright messages scroll to the bottom and make a note of the 4 digit number to the right of the "K:", if this number is 5838 you have a 1.6(b) xbox and will need to use slightly different settings, which will be outlined later.
Exploiting the Dashboard
Load MA, 007 or SC then load the save by one of the following methods :
Select Load Mission
Select Hard Disk
Selct Play, then take the "Linux" profile
OK, if all has gone to plan, the screen should go black, fill with a matrix style effect and then load an alternative dashboard called MXM
press the "B" button to step back a screen
Select UXE Menu
Then select UXE Install
A number of pop-up selection boxes will appear on after the other, the selections you should make are as follows:-
The first is just an information screen and all you need to do is Press "A" to continue
You will then have a choice of programs to load after the Exploit
these are as follows
PBL stands for Phoenix Bios Loader and essentially loads a hacked BIOS into the Xbox's protected memory which is booted as a replacement for the BIOS on the Xbox's Chip. There are numerous differences between the versions you have to choose from, but there is little need to run any other version than PBL Metoo.
NKPatcher - patches the Xbox's retail BIOS on the fly to ignore protection routines and allow ANY program to run.
The selection of choice here is either PBL Metoo or NKpatcher, if you're running the software exploit from a hard disk over 137Gb then you should select PBL Metoo, otherwise you can choose between the two, there is little to choose between them, the PBL method is slightly faster to react to things such as IGR (In game reset) and because of this tends to be my preference. However if you own the game crimson skies, choose NKpatcher as it does not work with PBL.
If you chose one of the PBL variants, you will be given a choice of bios, 1.6 owners (K:5838+) should choose Evox M8, everyone else should select X2 4981
Next you will be given a choice of Dashes to install, or rather you wont, as only MXM is available to install from the save listed above. Select it.
Next you can choose between Kernal specific fonts or Generic fonts, either is fine, although I would err towards Generic
Next you can choose between traystate booting, what this means is that if the dvd tray is open then the gamesave exploit is loaded (what you're currently in), otherwise the permanent exploit will be loaded. I personally choose no for this option, but it's very much a matter of personal taste, it CAN be handy in case anything goes wrong, but it's unlikely to do so and therefore is IMHO fairly pointless.
Having made your selections the xbox will now load linux and make a backup of your C: drive and your eeprom (VERY important) then install the exploits automatically, this will take ~2:30 minutes, when the "All done your xbox can now be switched off" message appears, turn the xbox off
(1.6 owners will have a corrupted diplay during this process, keep your eye on the LED round the eject button, when it turns from orange (during the install process) to blinking green the xbox is safe to turn off and it should be)
Press eject and remove the MA, 007 or SC disk.
Your Xbox is now Modded
You can now run "backup" games and FTP things to (and from) your xbox.
However it is running a (IMHO) horrible dash and has NO useful programs on, a problem which I'll address in the next post[ Add all 3 links to your ed2k client ]