This will allow you to get the clean 100F0 hash on any kernel, without the need for a UART.

All you need is the retail non-live HV for that kernel (first 256KB of the xboxkrnl) and the code below.



Code:
// The code below will allow you to generate the 100F0 hash for
// any dashboard without the need for a UART

// Released by: Devient

BYTE BaseHV[0x40000] = { 0 };
BYTE LiveHV[2][0x40000] = { 0 };

void UpdateBlocks(QWORD r3, QWORD r4)
{
   for (QWORD i = r4; i > 0; i--)
   {
       __asm
       {
           dcbst r0, r3
       }
       r3 += 0x80;
   }
   __sync();
   __isync();
}

void Generate100F0()
{
   // Copy our consoles HV
   HvPeekBytes(0, LiveHV[0], 0xFFFF);
   HvPeekBytes(0x8000010200010000, LiveHV[0] + 0x10000, 0xFFFF);
   HvPeekBytes(0x8000010400020000, LiveHV[0] + 0x20000, 0xFFFF);
   HvPeekBytes(0x8000010600030000, LiveHV[0] + 0x30000, 0xFFFF);
   memcpy(LiveHV[1], LiveHV[0], 0x40000);

   // Read BaseHV from file
   CReadFile("HDD:\\BaseHV.bin", BaseHV, 0x40000);

   // Overwrite xeBuild patches
   *(PDWORD)(LiveHV[1] + 0x11BC) = *(PDWORD)(BaseHV + 0x11BC);
   memcpy(LiveHV[1] + 0x154C, BaseHV + 0x154C, 0x10);
   *(PDWORD)(LiveHV[1] + 0x1880) = *(PDWORD)(BaseHV + 0x1880);
   *(PDWORD)(LiveHV[1] + 0x3120) = *(PDWORD)(BaseHV + 0x3120);
   *(PDWORD)(LiveHV[1] + 0x6BB0) = *(PDWORD)(BaseHV + 0x6BB0);
   *(PDWORD)(LiveHV[1] + 0x6BB4) = *(PDWORD)(BaseHV + 0x6BB4);
   *(PDWORD)(LiveHV[1] + 0x6C48) = *(PDWORD)(BaseHV + 0x6C48);
   *(PDWORD)(LiveHV[1] + 0x6C4C) = *(PDWORD)(BaseHV + 0x6C4C);
   *(PDWORD)(LiveHV[1] + 0x6C98) = *(PDWORD)(BaseHV + 0x6C98);
   *(PDWORD)(LiveHV[1] + 0x6C9C) = *(PDWORD)(BaseHV + 0x6C9C);
   *(PDWORD)(LiveHV[1] + 0x6D08) = *(PDWORD)(BaseHV + 0x6D08);
   *(PDWORD)(LiveHV[1] + 0x6D0C) = *(PDWORD)(BaseHV + 0x6D0C);
   *(PDWORD)(LiveHV[1] + 0x6D58) = *(PDWORD)(BaseHV + 0x6D58);
   *(PDWORD)(LiveHV[1] + 0x6D5C) = *(PDWORD)(BaseHV + 0x6D5C);
   *(PDWORD)(LiveHV[1] + 0x70BC) = *(PDWORD)(BaseHV + 0x70BC);
   *(PDWORD)(LiveHV[1] + 0x7268) = *(PDWORD)(BaseHV + 0x7268);
   *(PDWORD)(LiveHV[1] + 0x72B4) = *(PDWORD)(BaseHV + 0x72B4);
   *(PDWORD)(LiveHV[1] + 0x72C4) = *(PDWORD)(BaseHV + 0x72C4);
   *(PDWORD)(LiveHV[1] + 0x72EC) = *(PDWORD)(BaseHV + 0x72EC);
   *(PDWORD)(LiveHV[1] + 0x72F0) = *(PDWORD)(BaseHV + 0x72F0);
   *(PDWORD)(LiveHV[1] + 0x813C) = *(PDWORD)(BaseHV + 0x813C);
   *(PDWORD)(LiveHV[1] + 0xA560) = *(PDWORD)(BaseHV + 0xA560);
   *(PDWORD)(LiveHV[1] + 0xA564) = *(PDWORD)(BaseHV + 0xA564);
   memcpy(LiveHV[1] + 0xB4F8, BaseHV + 0xB4F8, 0x120);
   *(PDWORD)(LiveHV[1] + 0x15E60) = *(PDWORD)(BaseHV + 0x15E60);
   *(PDWORD)(LiveHV[1] + 0x24D58) = *(PDWORD)(BaseHV + 0x24D58);
   *(PDWORD)(LiveHV[1] + 0x24D5C) = *(PDWORD)(BaseHV + 0x24D5C);
   *(PDWORD)(LiveHV[1] + 0x264F0) = *(PDWORD)(BaseHV + 0x264F0);
   memcpy(LiveHV[1] + 0x29B08, BaseHV + 0x29B08, 0x38);
   *(PDWORD)(LiveHV[1] + 0x2A30C) = *(PDWORD)(BaseHV + 0x2A30C);
   *(PDWORD)(LiveHV[1] + 0x2A310) = *(PDWORD)(BaseHV + 0x2A310);
   *(PDWORD)(LiveHV[1] + 0x2AA80) = *(PDWORD)(BaseHV + 0x2AA80);
   *(PDWORD)(LiveHV[1] + 0x2AA8C) = *(PDWORD)(BaseHV + 0x2AA8C);
   *(PDWORD)(LiveHV[1] + 0x2B770) = *(PDWORD)(BaseHV + 0x2B770);
   *(PDWORD)(LiveHV[1] + 0x2C0B0) = *(PDWORD)(BaseHV + 0x2C0B0);
   *(PDWORD)(LiveHV[1] + 0x2C3A0) = *(PDWORD)(BaseHV + 0x2C3A0);
   *(PDWORD)(LiveHV[1] + 0x304E8) = *(PDWORD)(BaseHV + 0x304E8);
   *(PDWORD)(LiveHV[1] + 0x304FC) = *(PDWORD)(BaseHV + 0x304FC);
   *(PDWORD)(LiveHV[1] + 0x3089C) = *(PDWORD)(BaseHV + 0x3089C);
   *(PDWORD)(LiveHV[1] + 0x308A0) = *(PDWORD)(BaseHV + 0x308A0);
   *(PDWORD)(LiveHV[1] + 0x308A4) = *(PDWORD)(BaseHV + 0x308A4);
   *(PDWORD)(LiveHV[1] + 0x308A8) = *(PDWORD)(BaseHV + 0x308A8);

   // Poke newly modified HV back to memory
   HvPokeBytes(0, LiveHV[1], 0xFFFF);
   HvPokeBytes(0x8000010200010000, LiveHV[1] + 0x10000, 0xFFFF);
   HvPokeBytes(0x8000010400020000, LiveHV[1] + 0x20000, 0xFFFF);
   HvPokeBytes(0x8000010600030000, LiveHV[1] + 0x30000, 0xFFFF);

   // Update cache blocks to reflect changes
   UpdateBlocks(0, 0x200);
   UpdateBlocks(0x8000010200010000, 0x200);
   UpdateBlocks(0x8000010400020000, 0x200);
   UpdateBlocks(0x8000010600030000, 0x200);

   // Read and hash updated cache blocks
   PBYTE pCache = (PBYTE)XPhysicalAlloc(0x1000, MAXULONG_PTR, 0, PAGE_READWRITE);
   memset(pCache, 0, 0x1000);
   HvPeekBytes(0x8000020000010000, pCache, 0x1000);

   BYTE pHash[0x14] = { 0 };
   XECRYPT_SHA_STATE SHA;
   XeCryptShaInit(&SHA);
   XeCryptShaUpdate(&SHA, pCache + 0x2, 0x3FE);
   XeCryptShaUpdate(&SHA, pCache + 0x410, 0x170);
   XeCryptShaUpdate(&SHA, pCache + 0x5B6, 0x24A);
   XeCryptShaUpdate(&SHA, pCache + 0x800, 0x400);
   XeCryptShaUpdate(&SHA, pCache + 0xC00, 0x400);
   XeCryptShaFinal(&SHA, pHash, 0x14);

   CWriteFile("HDD:\\100F0.bin", pHash, 0x10);
   XPhysicalFree(pCache);

   // Write unmodified HV back to main memory
   HvPokeBytes(0, LiveHV[0], 0xFFFF);
   HvPokeBytes(0x8000010200010000, LiveHV[0] + 0x10000, 0xFFFF);
   HvPokeBytes(0x8000010400020000, LiveHV[0] + 0x20000, 0xFFFF);
   HvPokeBytes(0x8000010600030000, LiveHV[0] + 0x30000, 0xFFFF);
}