Hardware Security Exploit Research – Xbox 360

https://github.com/kooscode/srgh-matrix-trinity/blob/main/README.md

by nazgulsenpai • 2 years ago

216 98 2 years ago

Lammy2• 2 years ago

So - here is a hopefully informative write up of my Journey to figuring out how these guys were running unsigned code in 2011 on a XBOX 360
XBOX 360 Security defeated - 2011

I realize this post is more about hardware security than software security, but if the benchmark is unsigned code execution then the author should at least mention the 2007 (King Kong shader exploit) and 2009 (SMC hack — same root flaw but executed automatically at boot) methods of achieving the same:

- https://github.com/Free60Project/wiki/blob/master/docs/Hacks...

PaulHoule• 2 years ago

Back in the day I really liked my 360 whereas my ONE seems like a mistake.

mrandish2• 2 years ago

Yeah, I still have an Xbox One hooked up (along with a SOTA gaming PC) but I now have more fun playing retro games via emulation than modern games.

Lately I've been having a blast exploring the X360 library via Xenia (since I had a PS3 during that era and never got to see some of these titles).

dinartem6• 2 years ago

Good times. I was the developer at Microsoft who designed the Xbox 360 hardware security, wrote all the boot loaders, and the hypervisor code.

Note to self: you should have added random delays before and after making the POST code visible on the external pins.

spencerflem3• 2 years ago

Congratulations, haven't had a reason to mess with it myself, but I've heard it described online as the most secure piece of consumer hardware before or since

SteveNuts• 2 years ago

I'm curious how it fares against a modern iPhone or similar, has that ever been compared?

liamwire2• 2 years ago

I have a hard time believing the ‘since’ part of that description. Intuition suggests the latest iPhone would take that crown each year.

jsheard• 2 years ago

I think you might be mixing up the Xbox 360 with the Xbox One, the former was ultimately compromised in several ways, but the latter's security has held up extremely well for 11 years and counting. The Xbox One and its successor are easily the most secure consoles ever made.

Obligatory: https://www.youtube.com/watch?v=U7VwtOrwceo

notavalleyman• 2 years ago

What are the reasons for why Microsoft wanted to lock down consoles to only run signed code? As a games console manufacturer, what are the business reasons for doing so? Thanks

treyd• 2 years ago

They sell the consoles at a loss, so if you could port your own games to the consoles instead of buying the games that they could take a royalty from then they lose money. It doesn't have to be an effective circumvention to trigger the DMCA making it illegal.

Lammy2• 2 years ago

A games console provided a platform where they could more effectively argue that “their” works “““needed””” to be protected so they could farm us (people who want to run their own code on hardware they purchased) for digital-jail technologies which would never otherwise have reason to exist. Then those technologies can metastasize fully-formed over to general-purpose computing in a way that's harder to argue against. They learned with Clipper and Palladium that trying to develop jail tech on PC would be vehemently opposed.

nemothekid• 2 years ago

Limiting piracy is the ongoing reason, but there is also the historical reason of the Video game crash of 1983 which led to Nintendo's Seal of Quality.

Essentially as the platform owner, you want to ensure games sold for the platform "just work", and if you have a bunch of third parties running bad software, consumers would lose faith in the platform altogether.

brokenmachine3• 2 years ago

They are rent seekers.

throwaway484764• 2 years ago

They sell the console at a loss but make 30% on every game sold. The business model is variant of "dumping" but antitrust isn't enforced anymore.

ashleyn• 2 years ago

business reasons, the console is sold as a loss leader and the real money is made in licensing the games. also serves as brand protection i.e. preventing poor quality third party games from tarnishing the reputation of the console.

vlovich123• 2 years ago

I feel like random delays would make the glitch attack harder but it would still be possible given enough attempts. Seems like the bigger issue is that you can glitch the CPU reset line which corrupts the processing rather than having no effect or resetting the CPU.

kaoD2• 2 years ago

I assume those are probably very hard to fix since (again, I assume, I'm just a hobbyist in the hardware space) that sort of glitch relies on propagation delays (e.g. a short burst triggering some latches but not others, or triggering the latches in some specific synchrony).

Can anyone confirm if I'm on the right track with my guess?

liamwire2• 2 years ago

Can you speak to some of the harder or more interesting challenges you faced during that time?

dinartem6• 2 years ago

One challenge was that while I started working on the Xbox 360 about three years before it would ship, we knew that the custom CPU would not be available until early 2005 (first chips arrived in early February). And there was only supposed to be one hardware spin before final release.

So I had no real hardware to test any of the software I was writing, and no other chips (like the Apple G5 we used as alpha kits) had the custom security hardware or boot sequence like the custom chip would have. But I still needed to provide the first stage boot loader which is stored in ROM inside the CPU weeks before first manufacture.

I ended up writing a simulator of the CPU (instruction level), to make progress on writing the boot code. Obviously my boot code and hypervisor would run perfectly on my simulator since I wrote both!

But IBM had also had a hardware accelerated cycle-accurate simulator that I got to use. I was required to boot the entire Xbox 360 kernel in their simulator before I could release the boot ROM. What takes a few seconds on hardware to boot took over 3 hours in simulation. The POST codes would be displayed every so often to let me know that progress was still being made.

The first CPU arrived on a Friday, by Saturday the electrical engineers flew to Austin to help get the chip on the motherboard and make sure FSB and other busses were all working. I arrived on Monday evening with a laptop containing the source code to the kernel, on Tuesday I compiled and flashed various versions, working through the typical bring-up issues. By Wednesday afternoon the kernel was running Quake, including sound output and controller input.

Three years of preparation to make my contribution to hardware bring-up as short as possible, since I would bottleneck everyone else in the development team until the CPU booted the kernel.

dvdbloc• 2 years ago

What was the culture like working on this project and back in those days? I’ve always been fascinated by the development of consoles, especially the story of the 360. Any sources you recommend to learn more? I thought the Microsoft documentary on Xbox was the best I’ve found so far.

jolan2• 2 years ago

The Winchester revision is still considered unhackable afaik. It's crazy how many Xbox 360 revisions there were compared to other consoles.

saturn86014• 2 years ago

Was it ever explained why? This was an unanswered question I always wondered about from time to time. They must have done something to remove RGH capability?

LPisGood• 2 years ago

I’m surprised this was a task that only took a single developer!

cbanek2• 2 years ago

Having a single developer allows fewer offices with their windows completely covered with newspaper. Plus, there's one person doing everything, which can be a lot better than two with people who have different ideas of how to make the system work together.

dhx• 2 years ago

Have you seen Tony Chen's (development lead for Xbox One security) description of the Xbox 360 reset glitch hack at [1] and the effect this (and other console exploits of that time) had on Xbox One development?

This is one of my go-to case study videos for the development effort required to architect a computer to resist attackers who have physical access.

[1] https://youtu.be/U7VwtOrwceo?t=536

landr0id4• 2 years ago

Wait until you read Grimdoomer’s (yet to be published) write-up on his recent hypervisor exploit that works on the latest OS: https://x.com/grimdoomer/status/1847497275289063676

It’s going to be a doozy

Dracophoenix• 2 years ago

How did you feel about teenagers and college students exploiting holes in your work? Were you impressed, disappointed, amused, etc.?

Oh and I'd just like to say thank you for your contribution to my childhood/adolescence.

kaoD2• 2 years ago

Note - Newer revisions of XBOX 360 has no access to CLK and you must use Matrix oscillator

If there's no CLK line on the mobo, does this mean newer X360s have everything that might be clocked (I assume at least CPU, GPU and V/RAM?) in a single chip, SoC-like?

15155• 2 years ago

I'm not aware of any reason nor modern computer system that would have these things clocked by a common clock line of any kind.

Today, GPUs connected via PCIe or the like use 8b/10b coding over differentially-signaled pairs. The signal itself has clock recovery.

(V)RAM is generally clocked at a different frequency than the CPU as well, and all DDR utilizes strobes to determine when data is valid because access time is variable.

In some SOCs/FPGA-based devices, a central clock generator will sometimes provide LVCMOS/HCSL/LVDS/etc. clock lines to each device, but these aren't often re-used. This allows for flexibility and later programmability. There's generally no assumed phase or frequency relationship between these derived clocks and the original source - especially after the signal has traveled 20cm across a board.

In the case of a CPU/GPU, though, a 20 cent crystal oscillator at each device feeding into internal PLLs is typically the go-to.

14• 2 years ago

Fun thinking back to the days of cat and mouse between MS and hackers so many cool things went down. My favorite being hackers making custom firmware for certain dvd burners so that you could burn right to the very edge of 7.5gb discs and make 8gb games that MS started using. Truncated games were being detected and then hackers came up with this idea it was so genius.

Then came along the reset glitch hack and I moved away from discs to an external hard drive and never looked back. I did a few for me and a couple friends. The soldering involved was pretty precise in the fact that it was a very very small pad you needed to solder to and if you screwed up it was very easy to lift the pad and putting yourself into a big heap of trouble fixing it. I was also using a crappy $15 soldering iron with a bad tip because I was poor. But never did I have an issue. Depending on your install you could get the glitch to happen sometimes on the first reset or for some it took multiple resets. I was happy because all mine seemed to work first if not second reset which a lot of people struggled to get. I still have my rgh 360 my kids have it with a hdd full of games I backed up from my own games you know.

jackjackk0• 2 years ago

If you are not familiar with the fascinating story behind it, I recommend this podcast episode [1], it's one of my absolute favorites (along with its sequel)! I found out about it on this very forum a few years ago, hope to propagate the favor to somebody else out there.

[1] https://darknetdiaries.com/episode/45/

Aurornis• 2 years ago

Fun article. One note:

I have a Saleae 8 channel 100Mhz, which turned out not to be fast enough I found a not too expensive 200Mhz Kingst LA2016 Logic Analyzer on Amazon

The author is confusing MHz with MS/s (mega samples per second). Salaea has a logic analyzer that works on 100MHz signals (with 500 MS/s), but I suspect the author had the unit with 100 MS/s that only works up to 25MHz signals.

The cheap Kingst unit has 200 MS/s but only works with signals up to 40MHz.

SyncOnGreen• 2 years ago

Generating VERY precise timing and pulses, you need FPGA's or CPLD's

Back in the day, I managed to create a working RGH modchip based on Atmega8 (8 bit micro) running at 20 MHz with hand-crafted assembly code. I named it RWH (Reset Witch Hack) and it was able to boot Xbox 360 Jasper in 1-2 minutes. Old motherboards had a physical pad on the motherboard allowing for slowing down the CPU, so no i2c was required. I also have to connect the whole 8 bit POST bus to read the current value in one instruction.

PCB was made at home, and since AVR is 5V system, I used NPNs for voltage conversion (all values were inverted in the software).

Why? I didn't have money to buy the "real" CPLD modchip.

Rush and happiness when it first booted - priceless.

I still should have the source code for it somewhere on backup.

photos: https://gist.githubusercontent.com/JaCzekanski/c02ed11c30fac... https://gist.githubusercontent.com/JaCzekanski/c02ed11c30fac...

Hardware Security Exploit Research – Xbox 360

Related Stories