AP25 FAQ by Defosho

[CoFree]

AP25 FAQ by Defosho - Last updated 12 April 2011

WARNING - Fake AP25 patches - Yes, they're still fake
Recently there has been a release of fake AP25 patches. These are made from data in the dae.bin file and are not extracted from an original retail disc.

The patches will work in the sense that they can allow an AP25-active game to boot. They were missing response data in the replay sector. Even with this data included this does not make them any safer. They are still using hardcoded angle data much like a Kreon SSv1 security sector. Therefore they are extremely unsafe for use on Xbox Live and you should not use them.

There are several non-English titles that don't have genuine patches available, reasons for which are explained the end of this post. If you've been waiting for a patch for a non-English title, I appreciate that you've been waiting a few months. These patches might allow you to boot the game but you should only consider doing so if you don't ever intend to use Xbox Live.

LT+ will not protect you from getting flagged in the event of a patch being corrupt or incorrect in even just one byte. You should obtain your patches from a trusted source (abgx360/Xecuter) as explained in this FAQ many weeks ago. abgx360 specifically uses hash checks to maintain file integrity.

A public method for AP25 extraction is coming, at which point you can rip your own and trusted uploaders can submit genuine safe patches to the abgx360 database.

Note - Beta dashboard versions
For the most part, this FAQ covers AP25 details based on retail dashboard versions. Features and behavior in beta dashboards may or may not appear in future retail dashboards, at least in their current implementation. Occasionally, verified information from beta dashboards will appear here where relevant and will be clearly marked as beta.

For more detailed beta dashboard information, please read my System Update Preview FAQ.

AP25 active game status - Based on DAE table v9 from 12625 dash

CODE
# Game title Dash active Unique media IDs Media IDs with genuine patch available

1 Assassin's Creed: Brotherhood 12416 ~10 1
2 Fable III 12606 ~10 2
3 Need for Speed: Hot Pursuit 12416 ~10 2
4 Halo Reach 12625 ~10 1
5 Call of Duty: Modern Warfare 2 12625 ~10 2
6 Call of Duty: Black Ops 12625 ~10 2


The basics

What does AP25 mean?
AP25 is short for Anti Piracy 2.5, and is the term given to a type of disc copy protection used on the Xbox 360. It is an attempt by Microsoft to prevent backups from booting. The protection came into action at the end of 2010.

Which DVD drives support and use AP25?
All drives except for:
Samsung - all
Hitachi - v59 and lower

My drive doesn't support AP25, will I be affected?
No, assuming your drive is not spoofed.
If your drive is spoofed then it may be affected, read on for spoofing information.

Which drive custom firmware (CFW) versions are affected?
LT 1.1 and older, for the supported drives. LT+ requires some games to be patched, read on for details.

Which games are AP25-active?
It depends on your current dashboard version. There is a list at the top of this post or you can find a more detailed list here. These will show you which dashboard version the games became active in. AP25 remains active for these games on subsequent dash versions.

Which retail dashboard versions are actively implementing AP25 checks for known games?
12416 - but not when installed with this AP25 bypass method
12611
12625

My dashboard version is older than these but my drive supports AP25 - will I be affected?
Not directly, but many games require a minimum dashboard version to work. The required System Update is on the disc. Some of these required dashboard versions are actively implementing AP25 for specific games. Note: Even if a game requires a particular dash version to work and that dash happens to be implementing AP25, it doesn't necessarily mean that the game itself is AP25-activated in that dash.

Example 1 - NFS:HP and AC:B are wave 9 so they require a minimum dash version of 12416 which is on the discs. Both of these games are made AP25-active in 12416. The exception is if you avoid installing the update from disc and instead install with this AP25 bypass method, then you can play existing backups of these games with your old drive CFW.

Example 2 - Bulletstorm (wave 10) requires a minimum dash version of 12611 which is on the disc. Dragon Age 2 (wave 11) requires a minimum of 12625 which is on the disc. Both of these dashboards activate AP25 checks for some games, however Bulletstorm and Dragon Age 2 are not AP25-active in these dashboards.

The AP25 games list shows the minimum dash version required as well as the dash version that AP25 was activated in.

My drive and dashboard both support AP25. Will my existing games work?
Backups that are not AP25-active will continue to work.

Existing backups that are now AP25-active will not boot. If you have a CFW older than LT+ you will see a "disc unreadable" error message and be flagged for a possible future XBL ban. If you have LT+ you will see a black screen and it will protect you from being flagged. To be safe, turn off the console within 3 minutes of seeing the black screen then throw the disc in the trash.

All originals will still work.

My backup is an identical copy to the original, so it should work, right?
You don't have an identical copy. It is not possible for consumer DVD writers to make an exact copy of a retail disc. Your copy is missing data location characteristics that AP25 is checking for.

So how can I play backups of these AP25-active games?
First there needs to be a patch available for your version of the game. Each patch is unique to a particular version of a game and is not interchangeable with other versions of the same game nor with other games. The patch contains data based on original disc locations that your existing backup does not have. You can find out whether a patch is available for your game version on the AP25 games list.

Second you need to patch and re-burn the game with the correct AP25 replay data. I recommend using abgx360. Make sure that the option "Check for updates" is ticked to ensure that it recognises the recent AP25-active games. Alternatively you can patch the game manually with a PPF patch from a trusted source, you must ensure that you have the correct version (media ID) of the game that the patch applies to.

Finally you must update your drive CFW to LT+ (1.1 is the current version). Your drive will then be able to interpret the newly patched data and provide the correct responses to mimic an original disc. LT+ will also protect you from being flagged if you boot a game that is missing the replay data.

Will LT+ always protect me from being flagged if I accidentally boot an unpatched game?
In most circumstances, yes. However, a corrupt AP25 patch can flag your console. Therefore you should only apply patches from trusted sources, for example Team Xecuter or abgx360.

Is there any way I can avoid this? Updating firmware and patching is too much hassle for me.
Three options for you:

1) Remain on a dashboard version older than 12416. You won't be able to play games that require a minimum of 12416 (wave 9 titles like NFS:HP, Kinectimals, AC:B) and higher.

2) Install 12416 dash with this AP25 bypass method, but you can only do this if you are currently on an older version. You can now play the games mentioned in (1) but you won't be able to play games that require a minimum of 12611 (wave 10 titles like Bulletstorm) and higher (wave 11 titles like Dragon Age 2 which requires a minimum of 12625).

3) Play your original retail games instead.

Can I downgrade my dashboard version?
No.

Can I apply the AP25 bypass to 12416 if I have already installed 12416?
No.

Can I spoof my AP25 drive to a Samsung or early Hitachi? Could this trick the console into disabling AP25 checks because these drives don't have AP25?
No. AP25 checks the OSIG (original drive signature: make+version+fw) stored in your motherboard which cannot be changed (unless you have a JTAGged console). If the drive specifed here is one that supports AP25, the console will initiate the AP25 challenges, regardless of whether the actual physical installed drive supports AP25 or not.

So if the OSIG stored is a Liteon, BenQ or late Hitachi, and your actual drive is a Samsung or early Hitachi (spoofed or not), the AP25 challenges are initiated. The drive cannot respond to these challenges because it is not AP25-aware. So the check fails, the disc doesn't boot, and you may get flagged for a future XBL ban.

What about the opposite, a Samsung/early Hitachi OSIG with a spoofed Liteon/BenQ/late Hitachi actual drive?
This should work but it may not be XBL-safe.

Why am I getting more disc read errors since AP25 came into action?
It has been reported that an AP25-active game causes more work for the laser than usual. The AP25 checks occur during the first few seconds of booting only so if you're getting past that stage then it's not an AP25 issue.
Check that you're using quality media, a decent writer with up to date firmware, and decent writing software like Imgburn. If you're still having issues then you may want to get your drive laser cleaned/repaired/replaced. Intermittent and inconsistent booting is a key symptom of a bad drive or media.

AP25 activation

What is the AP25 xex flag?
This is a marker in a game executable file which designates the game as "AntiPiracy25 Media". Only AC:B and NFS:HP have this flag. Kinect dashboard versions prior to 12606 use this flag to determine whether to activate AP25 checking. However, since 12606 this is no longer used and now any game could potentially be activated whether it has the flag or not. Therefore, the flag is not a reliable way to determine if a game is AP25-active.

So how can I reliably determine if a game is AP25-active?
If the game's media ID is in the DAE table of your particular dashboard, it is AP25-active. Media IDs from the most recent table are listed here. Microsoft decides when to add a game to the table. Only these games are being checked for AP25 responses. Since November 2010, they have activated six known games.

How can I check what Media ID my game is?
Scan the ISO or backup disc through abgx360 and it will show in the log. On a retail disc, the last 8 characters are marked on the inner ring, data side.

DvdAuthEx (DAE) table

What is the DvdAuthEx (DAE) table?
Contains a list of games that are AP25-active. Each game is identified by a unique media ID and there is a set of challenges associated with each entry.

Where is the DAE table stored?
It's stored in an encrypted file in your NAND flash memory on the motherboard of your console, the filename is dae.bin.

The console reads this file to determine whether to initiate AP25 checks on a game with a specific Media ID.

Why are there many media IDs associated with a particular game?
Different region/language versions of a game each have a unique media ID. List of media IDs here.

Do the different versions of a game have different AP25 challenges?
Yes, each media ID has a unique set of challenges, so a unique set of responses is produced, therefore a unique AP25 patch is required for the particular version.

How many different versions are there of a particular game?
Approximately 10 media IDs per game.

How many unique media IDs are in the table?
Currently, 101 as of dash version 12625. There are about 40 media IDs that do not match any known released game. This could be dummy or test data, unreleased or review games.

How many challenges are there per media ID?
In the table there are 50 challenges per media ID, of which 13 are currently being used.

Could Microsoft increase the challenge "pool" as there are 37 unused challenges per game at the moment?
It's possible.

Could Microsoft update the table to change the current challenges or add more challenges?
It's possible.

Could Microsoft update the table to add more media IDs (games) in the future?
Yes.

If Microsoft update the table to change or add to existing challenges, will I have to patch my game with the new replay data and re-burn?
Yes, if an updated patch is available at the time.

Why don't we extract _every_ AP25 response from the original disc then patch our games with this data so that our backups will never need to be re-burned?
Not feasible. The console is currently sending 13 challenges to the drive to produce response data that can be captured. Microsoft could change the challenges at any time at which point we can capture the new response data. The total number of possible challenges is potentially very large as each challenge includes two disc locations and there is a lot of suitable locations on a disc.

How many times has the table changed?
There are several table versions, each associated with a particular dashboard version. Once a game is added, it appears in all subsequent table and dash versions (so far). The most notable are:

CODE
Date Table ver. Dash ver. Known games added

06 Sep 10 5 12416 AC:B, Fable III, NFS:HP
19 Jan 11 9 12625 Halo Reach, COD:MW2. COD:BO

How is the table updated?
So far, only through System Updates. The System Update writes a new dae.bin file to the NAND flash. However they could in theory send table updates over XBL "out-of-cycle" of the System Updates.

Can a Title Update activate AP25 for a game?
Unknown, it hasn't happened yet. Currently, the only way a game can become AP25-active is for its Media ID to be added to the DAE table. The updated table must then be included in a System Update.

Can I edit the table myself to change or remove challenges?
Probably not. The file is encrypted, signed and tied to the associated dashboard version, any tampering or switching may cause AP25 to fail and the console to be flagged.

Extracting AP25 data from original discs

Can I extract my own AP25 data from a original disc?
Not currently. According to k3rn3l the current method by c4eva is being kept secret due to its complexity and revealing it would expose a hole which Microsoft could block, preventing future extraction.

What about the public 0800 fw with AP25 extraction that c4eva has recently announced?
This uses a different method that can be made public. The original method remains private.

Which games have AP25 patches available?
Check the AP25 games list or run the game through abgx360 and it will show you if a patch is available and, if you choose to, it will patch the game if there is.

Why doesn't every version of a game have a patch available (e.g. non-English titles)?
There is currently only two people who can extract the AP25 response data from the original retail discs, k3rn3l and c4eva. The original disc is required to extract the data, so the retail game has to be purchased, often from abroad. This takes time and money. English language version patches are released first because the English games are easier to obtain.

A specific language version of a game is now AP25-active and there is no patch available, please can you release a patch?
You'll have to wait for a patch to be released if or when the original game is obtained by k3rn3l or c4eva. There is no ETA for patches, you can play your originals in the meantime. You will be able to extract your own AP25 data from retail discs with the public 0800 which is in development.

I've found a patch for my game that appears to work but is not highlighted in your list. Why not?
There has been a release of fake AP25 patches which are unsafe to use. Read the warning at the top of this post.

Thanks/credits
Anthares2k/Luigi Marconi/WizZy - 12416 AP25 bypass
Seacrest - abgx360
c4eva
k3rn3l - Team Xecuter
Redline99