https://github.com/xboxoneresearch/durfuniti2c
Durango (Xbox One) RF Unit I2C tooling
https://github.com/xboxoneresearch/durfuniti2c
durango i2c isd9100 isd9160 nuvoton rf-unit sound xbox-one
Last synced: 5 months ago
JSON representation
Durango (Xbox One) RF Unit I2C tooling
- Host: GitHub
- URL: https://github.com/xboxoneresearch/durfuniti2c
- Owner: xboxoneresearch
- License: mit
- Created: 2024-03-30T01:57:27.000Z (about 2 years ago)
- Default Branch: main
- Last Pushed: 2025-05-02T14:23:14.000Z (about 1 year ago)
- Last Synced: 2025-05-02T15:36:46.186Z (about 1 year ago)
- Topics: durango, i2c, isd9100, isd9160, nuvoton, rf-unit, sound, xbox-one
- Language: Python
- Homepage:
- Size: 1.74 MB
- Stars: 10
- Watchers: 3
- Forks: 1
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Durango RF Unit I2C tooling
> [!WARNING]
> Use at your own risk!
Technical infos:
## Requirements
- (Xbox One PHAT/One S) RF Unit board
I2C Device clients:
- GreatFET One board
or
- Raspberry Pi (untested)
or
- Micropython device (ESP8266, ESP32, Pi Pico ..)
Depending on the device, pull-up resistors might be necessary.
## Connections
| Xbox / Pin | 3V3 | GND | SDA (DATA) | SCL (CLOCK) | Note |
| ---------------- | --- | --- | ---------- | ----------- | ------------------------------------------------------ |
| RF Unit (PHAT) | 12 | 9 | 6 | 5 | Solder a bridge on R24, remove after dump/flash ! |
| RF UNIT (One S) | 7 | 11 | 16 | 15 | |
| FACET (Universal)| NC | 2 | 26 | 25 | Connector is on motherboard ! See FACET section below !|
| Board / Pin | 3V3 | GND | SDA (DATA) | SCL (CLOCK) |
| ---------------- |---- | --- | -------------------- | ------------------- |
| GreatFET One | 3V3 | Any | 39 | 40 |
| RasPi (non-Pico) | 3V3 | Any | 3 (GPIO2 / I2C1 SDA) | 5 (GPIO3 / I2C1 SCL)|
| RasPi Pico | 3V3 | Any | 1 (GP0) | 2 (GP1) |
| ESP 8266 | 3V3 | Any | GPIO 4 | GPIO 5|
### Notes on FACET
General info: [Wiki](https://xboxoneresearch.github.io/wiki/hardware/facet/)
- DO NOT CONNECT 3V3, DO NOT PRESS THE POWER BUTTON
- Solder a 300 Ohm resistor between SMC_RST (Pin 1 on FACET) and GND
- Solder the other connections to the MCU (GND, SDA, SCL)
- The Xbox Standby power is used, the PSU / power cable has to be connected to the console.
- After dumping/flashing, desolder the connections incl. the resistor bridge
### Pi Pico diagram
Xbox One PHAT
Xbox One S
## Features
- Play sounds
- Dump flash
- Write flash
## Usage
- Solder I2C connections and 5V/3.3V/GND
- Install python requirements, preferrably in a python venv
- GreatFET: `pip install greatfet`
- Raspberry Pi (not Pico): `pip install smbus2`
- Micropython: `pip install pyserial tqdm`
- For flashing: Copy `flash.bin` next to script/executable
- Execute `rfunit.py` (see below for micropython)
### Micropython
Check [Pyboard tool](https://docs.micropython.org/en/latest/reference/pyboard.py.html) for an overview.
Easy:
- For flashing: Copy `flash.bin` next to script/executable
- Execute `micropython_rfunit.py`
Manual:
- Identify the serial port where you micropython device got enumerated (via `dmesg`), f.e. `/dev/ttyACM0`
- Dumping
- Execute the script: `./vendor/pyboard.py --device /dev/ttyACM0 rfunit.py`
- Copy the dump to the PC: `./vendor/pyboard.py --device /dev/ttyACM0 -f cp :dump.bin .`
- Flashing
- Copy flash.bin to the Micropython device: `./vendor/pyboard.py --device /dev/ttyACM0 -f cp flash.bin :flash.bin`
- Execute the script: `./vendor/pyboard.py --device /dev/ttyACM0 rfunit.py`
## Flashdump
Size: 0x24400
Checksum (SHA256)
```
8150af1889203260bbbd25884447c0540f1cbc843a13e86bb0b6d501a6d032e1 dump_phat_cod_aw.bin
3789e76fd6c37bdf39751afd6164c1d8d67a53c31eca5b630901210b55753dba dump_phat_forza6.bin
388d252d7783fd2946b9b3fca57ecd1ed13a4f17ea6665f577da34224f9930da dump_phat_halo5.bin
abc699513959372faee038c78a1d7509c2020f65cb78ad07ab9c90b21b406a87 dump_phat_retail.bin
4812af697716464dff1a49e0ab2f45497492fec71aa0a73308f522db45d2b42e dump_one_s_minecraft.bin
222fcaec65d1ffd7f275616df1af5f1128d34e3b32035e3377ab48f91b232ffc dump_one_s_gow4.bin
c39871fcfef69c632955658f8e876d35a35dafb9c88c7fc082dca23d2102289f dump_one_x_tacobell.bin
```
Some strings
```
ISD9160FIMS03 FW Jun 14 2013 at 10:41:12 (C) Nuvoton 2013
Nuvoton ISD9160MS Boot FW Jun 14 2013 10:40:21
ISD-VPE Ver 920.000c 08/05/2013 PV_Prod_Units_Rev5 VERSION:0x10000007
```