Endgame: A dashboard exploit for the original Xbox

https://github.com/XboxDev/endgame-exploit

by Lammy • 2 years ago

212 117 2 years ago

github.com

bradhe• 2 years ago

How many things named "endgame" are there?

HtmlProgrammer• 2 years ago

boomboomsubban• 2 years ago

https://en.wikipedia.org/wiki/Endgame

karlgkk• 2 years ago

This is pretty cool. For anyone interested, it's an int overflow in savegame image handling code.

TheJoeMan• 2 years ago

I saw a little pessimism from other comments about a bleak future with fully secured consoles, but I expect image parsing bugs are forever!

jsheard4• 2 years ago

The difficulty is in turning a userland exploit into a useful jailbreak, there will always be parser bugs and WebKit bugs but those are only the first step in the chain. From there you need to escape the sandbox and that's the part which keeps getting more difficult.

The "unhackable" Xbox One has had at least one userland exploit via attacking the web browser, but nothing came of it because they weren't able to break out of Hyper-V.

nebula88043• 2 years ago

This soothes my soul seeing exploits for the consoles I grew up with. For a second it takes me back to a simpler time. The homebrew scene for the XBOX was more fun than the console itself!

A while back I saw this clickbait video of "Gen Z trying out the original XBOX" and man that was a reality check as to how much time has passed.

cheeze• 2 years ago

Hacking the original Xbox + x360 is what I credit as getting me "really into computers"

For OG xbox, I was a definition script kiddie but I learned how to use FTP, how to connect via crossover cable, how to solder, the basics of what exploits are and how they work, and a ton of other skills that I use daily.

X360 required me to take the damn thing apart (which was terrifying as a 14 year old who wouldn't get a replacement if I broke things). I learned about firmware, SATA connections, the bits (I forget the name) that specify whether something was retail or not, why the exploit wouldn't let you run unsigned code, etc.

I was just a broke kid who wanted to watch movies and play games I couldn't afford, but it literally got me into tinkering and hacking, even though what I was doing wasn't much more than "follow a guide, script kiddy"

nebula88043• 2 years ago

Ditto for me with the OG XBOX. I was in high school and had no clue what I was doing with static ip addresses and crossover cables. We didn't even have a router hence the static ip address. Each cool homebrew XBE I FTP'ed over to my XBOX was another exciting adventure!

My computing journey started earlier on DOS but XBOX kept me going through a period of post 9/11 depression where the excitement of childhood and an amazing future was slowly disappearing. I stopped even playing video games after the end of the XBOX lifecycle (despite continuing to buy new gen hardware just so I could take it apart and admire the internals).

Now living in the post ChatGPT days and wondering about my future, i'm looking back wishing I could live through those late nights one more time.

chadkeck• 2 years ago

Same here for the OG Xbox. Lots of TSOP flashes for friends over SSH after booting a saved game exploit for 007: Agent Under Fire. Reading lots of the forums on xbox-scene.com. Learned to solder with a soldering iron I picked up from the local Radioshack.

Jerrrry3• 2 years ago

Microsoft actually just tricked an entire generation of us into learning C# and .NET.

They were playing the long-con game.

echelon_musk• 2 years ago

A +1 for me too. The Xbox modding scene taught me the foundation of my systems knowledge despite already having a Windows PC.

Levitating2• 2 years ago

Gen Z trying out the original XBOX

Gen Z is a pretty wide group. I am Gen Z and played on an original xbox. However at the time the PS3 was already out, as it came out not much later.

And in my region, the PS2 was much more popular than the xbox.

My sister however, who is only a few years younger, is definitely part of the iPad generation.

Everybody played the Wii though, hell I still play the Wii.

nebula88043• 2 years ago

You do raise a good point as Gen Z is around 1997-2012 (exact dates are always a little fuzzy)

So 97 would put you around 4-5 years old when the XBOX came out. The video made it look like the XBOX was some ancient artifact to the Gen Z people. I guess if you were born in 2012 it is an ancient artifact?

[1] https://www.youtube.com/watch?v=WJEzvijyNmw

bl4kers• 2 years ago

Why would I want to do this? It doesn't seem to mention that in the README

mhh__• 2 years ago

Beyond the usual (i.e. loading ones own code on something one owns), is "because it's there" not sufficient?

rusk3• 2 years ago

It’s a great platform for emulating anything up to the original playstation

geor9e• 2 years ago

I guess the younger generation grew up with unmoddable consoles, so the concept is less known nowadays. The older audience immediately knows that it's for. You can run free homebrew apps, games, and if you really wanted, with a little more code, run pirated copies of retail games, and cheats. If you had a PS1 or Xbox, you got it modchipped by some classmate, everyone did in the 2000s, it was rampant, at least at my school. I still remember bunnie, who was famous online for first hacking the xbox. Hardmods required some soldering, Softmods just required a particular game and flashdrive. This new one just requires a memory card. They didn't fully softmod it for legal reasons but they did the hard part. Since it's such an old console, it's really just a novelty that they found another method.

graphe3• 2 years ago

PS3, PS4, Xbox, PSP, DS, vita, switch and maybe PS5 all have hacks.

Phones came out and killed homebrew. Now the developers developed cool super compatible stuff without needing you to hack the hardware plus games became stagnant on consoles. The PSP when I bought it was known as a boring rehash console with nothing but re-releases but the hardware made it worth it.

breakingcups• 2 years ago

The original Xbox was locked down so only code signed by Microsoft was allowed to run on it. The executables also had a flag specifying which media it was allowed to run from. This meant that you couldn't run a game from a copied disc (different media-type) or the internal hard drive (again, different media-type).

There were plenty of hacks that allowed you to circumvent this. Once you get some form of code execution on the Xbox, it's over, everything runs in Ring 0, meaning you get full access. You can use exploitable executables to maintain persistence without having to do any hardware modifications. However, all these methods relied on an initial entry through either:

A. Installing new hardware (a modchip) to run an altered version of the Microsoft Xbox kernel that doesn't perform the usual checks.

B. Transferring an altered save game to the Xbox through the memory card (internally it's just a USB drive), running the game and loading the save, which triggers an exploit

C. Booting the console (which unlocks the hard drive), waiting until the hard drive activity ceases, "hotswapping" the IDE cable to your computer, modifying the files, swapping it back and turning the console off so the drive locks again. (If the hard drive loses power, it locks itself again too, hence why the hotswap-which is not supported by the PATA standard obviously-is needed)

Now, with this, there is no more reliance on bespoke modchip hardware, aging vulnerable game discs or machines that you can still hotswap an IDE drive to. Which means that Xbox modding has gotten more reliable for the coming years. Which is good news in my book.

ace2358• 2 years ago

Oh man! That hot swap method! I remember my computer, running Linux (which freaked 14 year old me out) from a live cd, case open, and plugging in the hdd while the Xbox and pc was on.

I felt like a warlock when I could rip my games after that.

Great memories.

And my mate at school saying there is no such thing as a soft mod! Haha

azalemeth• 2 years ago

In many ways I think it is really quite sad that we're at a point where blown e-fuses, encrypted everything and properly done public/private key crypto means that it's entirely possible that next generation of consoles really might actually be unhackable and unbackupable, barring some tiny bootloader exploit, cheap TEM and an understanding of "physically uncloneable functions", or cheap and plentiful qubits.

Things like this are just cool, prevent e-waste, and preserve cultural heritage.

rusk3• 2 years ago

it saddens me as a vintage games conservator that my present day PS4 will be a brick in a few years. When I have consoles and games going back 40 years. It just doesn’t seem right.

codetrotter• 2 years ago

OTOH, has there really been any actually culturally significant video games released in recent years?

I enjoyed for example the Uncharted games a lot. But I don’t think anything significant will have been lost if future generations of people don’t get to play the Uncharted games, no matter how much I enjoyed them myself.

Whereas, things like Pong, and Pac-Man and the first Super Mario games and the Pokémon Red and Blue and Yellow games feel much more important for me, and of course the original Doom, all of these are important on a whole other level. And thankfully they are all sure to be able to be preserved at least in some form.

theodric2• 2 years ago

I mean this as earnestly as possible: remember that pain and don't buy a PS5, or a PS6, or [...] Don't build any more emotional relationships with products built by rentiers that refuse to respect your ability to enjoy the perpetuity of your license (and god forbid even considering actually owning anything). Take on an allotment and breed a new hybrid chili pepper, or brew some beer and share it with your neighbors. Beat Galaga for the 11,000th time. Whatever it takes. To hell with Huxley's Brave New World-- a better one is possible if we force it to exist by refusing to continue enabling the system enslaving us.

deergomoo• 2 years ago

The thing that has me concerned is that even if you keep the consoles working, and even if you have an extensive library of physical media, these days what’s on the disc is probably an unpatched, incomplete, possibly unplayable mess.

That’s not intended as a criticism of game development, just an expression of fear for the preservation implications. It’s no longer enough to preserve what’s in your hands—which is difficult enough where electronics are concerned—but now someone must find some way to extract, archive, and reapply all the day one patches, bug fixes, DLC packs etc.

graphe3• 2 years ago

They're all x86 so don't despair.

Plus they haven't made a good exclusive since Bloodborne. No Xbox exclusives afaik.

Don't worry, gaming peaked a long time ago. There's a huge backlog of great games that are better than their remakes like XCOM. Aside from graphics, I'd say AAA gameplay has even regressed in many ways. Indie games do their own thing and run on PC.

auguzanellato• 2 years ago

In many ways I think it is really quite sad that we're at a point where blown e-fuses, encrypted everything and properly done public/private key crypto means that it's entirely possible that next generation of consoles really might actually be unhackable

Pirates will always find a way, the Nintendo Switch had all the countermeasures you mentioned, the latest revisions also have a patched bootloader but someone figured out that they could still boot a custom firmware via power fault injection on the SoC.

jsheard4• 2 years ago

Nintendo (or rather Nvidia) was behind the curve on fault injection counter-measures, Sony and Microsoft did their homework and it's never been achieved on their last two generations of systems as far as I know. Microsoft openly talked about it here: https://www.youtube.com/watch?v=U7VwtOrwceo

Seriously, console security is getting really good. The Switch had some major hardware blunders between the bootloader bug and fault injection, but the developer of the main Switch CFW project is on record that their custom microkernel is absolutely bulletproof and he expects there will never be another software exploit. If Switch 2 gets the hardware right, there's no way in.

https://twitter.com/SciresM/status/1486787208333774848

https://twitter.com/SciresM/status/1327721899862888448

The Playstation is the weakest of the bunch, since they run FreeBSD on bare metal there's a large attack surface and a lot of eyes on the code. The Xbox uses some variant of NT but each application gets its own Hyper-V virtualized NT instance, so to jailbreak you need to escape Hyper-V, which is easier said than done and has a $250,000 bug bounty so MS would probably be the first to be informed.

jedrek• 2 years ago

The Playstation 4 was launched in 2013 and there is no modern hack for it.

NotPractical3• 2 years ago

Pirates will always find a way

Except it's usually not pirates who find these exploits, rather curious tinkerers that want to unlock the full capabilities of the hardware that they own. The pirates / script kiddies usually come in after the groundwork has already been laid by these true hackers. E.g. the people who hacked the Switch in fact condemn piracy and any discussion of it on within their communities will lead to an immediate ban.

I'm proud to say that I've hacked my Switch, but have never pirated anything on it. An impressive homebrew scene has formed around the console, which has produced gems such as Mission Control, allowing you to seamlessly pair third party controllers. I use it with my PS4 controllers.

https://github.com/ndeadly/MissionControl

Cloudef2• 2 years ago

As long as consoles have web browser there is a way. Ps5 was broken recently

tirant• 2 years ago

Why? A web browser does not need to run under any kind of privileged mode, nor its library dependencies…

cmur• 2 years ago

I think there’s some hope in the console market via the likes of things like the Steamdeck and other handheld PC devices. Hopefully they’ll get cheaper as time goes on and compete at the same price point as the switch.

jdefr89• 2 years ago

As Vulnerability Research is my area of expertise we are finding new attack vectors all the time. Remember with new technology and abstraction you introduce new potential security issues that can be used to subvert other means of protection. It’s a tit for tat non ending cycle. That being said exploitation of consoles and phones has become quite difficult. Enough at least to make me move to embedded security as there is more work to be done there..

sublinear• 2 years ago

Console ownership isn't as popular with younger people anymore and their exclusive games are not what they used to be, so I wouldn't worry.

We're not losing much. Consoles have been dying for a while.

dadrian• 2 years ago

This is awesome. I remember back in 2006 I bought every copy of MechAssault that my local Game Stop had and hoped that one was the correct revision such that it was compatible with the Krayzie Ndure softmod exploit, and used it to install Xbox Media Center (XBMC). It's from that setup that I learned how computer networking works. I credit basically my entire career with reading about softmods at the back of a Popular Science magazine.

Anyway, it's awesome that you'll eventually be able to softmod an Xbox without a specific game once the mods are integrated with this exploit. Good work!

urbandw311er• 2 years ago

Snap! And I went on to develop an XBMC add-on to control windows media center as a result of getting into the scene!

harry83• 2 years ago

Aside: og xbox is not so expensive 2nd hand and a great way to set up a kids lan party. 1 old router, 3 xboxes, 3 tvs, 12 controllers, Halo gets you 10 year-olds' mayhem. Noisy fun. Arguably easier if xboxes are modded.

MotoGP, crash team racing, powerdrome, crimson skies all work great https://www.teamxlink.co.uk/wiki/Supported_Games then sort by both total players and players per console descending

Is this single location lan something that has been lost since those days?

Any better ways to set up a temporary lan party for kids?

[1] https://www.aliexpress.com/item/1005005142269614.htm

Jerrrry3• 2 years ago

modded oG xbox's or even X360s are a great living room centerpiece.

oG Xbox, Xlink Kai is still a thing. It was my first experience playing online as a poor 12 year old script kiddie myself.

For X360 LAN parties, It took a long time to find, but the hard-coded 4ms ping limit for "LAN" mode was removed, so LAN parties can be split into neighborhood LAN parties without problems

Farbklex• 2 years ago

I have the same use case but with Xbox 360s since they are cheaper and easier to get here in Germany.

Haven't found a better "easy LAN party" setup than this.

A PC gaming LAN setup for 20 year old games is also dirt cheap but mostly requires 1 PC per player. The splitt screen support on PC is unfortunately very bad.

mdaniel• 2 years ago

Your link is 404, what was the title of the thing you were linking to?

  < HTTP/2 404
  < content-type: application/json;charset=UTF-8
  {"timestamp":1708462250423,"status":404,"error":"Not Found","message":"No message available","path":"/item/1005005142269614.htm"}

harry83• 2 years ago

Terrible! Clipping the tracking gunk after the ? in th url took out the l in .html

xbox to hdmi converter. Useful if using an lcd monitor without analog input.

https://www.aliexpress.com/item/1005005142269614.html

mschuster91• 2 years ago

The exploit targets an integer overflow in the dashboard's handling of savegame images.

It's truly fascinating how often image format parse bugs end up being the entry point for attackers...

NotPractical3• 2 years ago

Awesome! I'd love to see a detailed writeup on how the exploit works, if someone has the time and interest to put one together.

We were incredibly lucky to get one for the Switch BootROM exploit: https://github.com/Qyriad/fusee-launcher/blob/master/report/...

msk714• 2 years ago

ive been trying to hack the XB1 for a year now and only have two potential exploits of only one i will release because it cant be patched, maybe spoof your device family. im researching and just stumble apon 100 posts like this

Endgame: A dashboard exploit for the original Xbox

Related Stories