Hacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit

by kevincox • 1 year ago

274 107 1 year ago

142• 1 year ago

Very cool to see people still working on hacking the 360. I used the RGH on my 360 years ago. Was really fun back in the day going through all the cat and mouse that went on.

A soft mod would be cool as the RGH does require soldering some very tiny wires to some very tiny pads and I remember seeing posts of many people lifting pads trying to do this mod. But in the end I had a perfect install on my 360 and would boot almost every time on the first try.

nolok2• 1 year ago

Ah, I remember I had one of the first series where they forgot to remove the JTAG pins

jsheard• 1 year ago

Xbox security has certainly come a long way since the OG Xbox, which featured a pin header that may as well have had "insert modchip here" printed next to it.

hot_gril14• 1 year ago

Do the people who hack 360s also know how to prevent them from inevitably red-ringing? Cause that's the biggest thing discouraging me from buying another (my other 2 went red).

Salgat• 1 year ago

I can't help but think that XBox 360 emulation is the only long term path that exists for the 360, which is concerning because only Xenia to my knowledge exists and it's still experimental.

pogue• 1 year ago

Not every model of the 360 will inevitably red ring. Those were typically only the "fat" models and there are some fixes to prevent it from happening. It usually just involves changing to some better quality thermal paste & reflowing the board.

https://www.ifixit.com/Guide/Xbox+360+Red+Ring+of+Death+Fix+...

throwaway484766• 1 year ago

The red ring is caused by underfill that is too soft that let's the solder bumps break. It's a BGA packaging problem and there's no fix.

rpcope1• 1 year ago

I've not modded my 360E, and it was probably one of the very last 360s built, but I've never had any problems with it, still play on it, and my understanding is there are fewer and less dire problems with it than the prior 360 and S.

142• 1 year ago

The rrod was pretty well know for a long time. Video games are sold to kids so it had the requirement to not use lead solder in them even though lead solder is perfectly safe and no way a child would be exposed to it, unless they eat the xbox.

Lead solder is much softer so with the countless hot cold cycles, when hot the solder expands and when cold it contracts, it will handle these cycles much much better. Without the lead the solder joints are not as soft and the hot and cold cycles eventually results in the solder joints cracking and no longer making a solid connection = rrod.

Some models were more prone to rrod but the biggest trick is to make sure you do regular cleaning and dusting to keep air flow working. Don't put the xbox in a cabinet with no air flow where it will heat up. Put a fan on the xbox if you can. It has been a long time since I followed the xbox scene but there are tons of posts online about the entire problem and best practices to avoid it.

minihoot• 1 year ago

The slim doesn't red ring.

mouse_2• 1 year ago

I wish there was somewhere I could toss cash into a softmod bounty.

whalesalad• 1 year ago

at this point is there any reason to use xb360 hardware? emulation on modern hardware has gotta be substantially better

mouse_2• 1 year ago

Xbox 360 emulation is still really bad for most games, despite what some YouTubers would have you believe. But let's say in a few years it does become substantially better. There's still:

• Nostalgia

• Authenticity

• Compatibility

• Preservation

• Cost of entry

Even if 360 emulation does become practical, a 360 will still be cheaper than any gaming PC capable of playing those games.

hot_gril14• 1 year ago

Xbox 360 and PS3 emulators are still borderline unusable on my new-ish PC. They're slow, glitchy, and/or hard to set up. Related to what the other commenter said, anyone who says these are good must have a lot of time to deal with it, whereas I just want the equivalent of sticking the disc into the console.

GameCube is the newest thing I've had a decent experience emulating, and even that isn't 100% unless it's Melee with the Slippi optimizations (n.b. did not try DS or Switch).

jcranmer• 1 year ago

The Xbox 360/PS3 era of video game consoles is probably the hardest era to emulate. Subsequent generations of consoles are essentially the same hardware as regular computers, just with a custom OS (and known hardware profile, certainly a benefit over regular consumer PCs). But that era of video game consoles is the last gasp of the custom hardware design of earlier consoles, which is substantially harder to emulate because the hardware just doesn't look like what modern hardware looks like.

Furthermore, said era is also right after Denard scaling came to an end, which means that current hardware doesn't have that much better specs, at least in easy-to-use form, than the hardware of the time. If any game tried to take the hardware to its limits, it would be a real struggle to emulate it with regular computers.

eddiewithzato• 1 year ago

It’s also the worst era to play natively. Bad textures and horrible frames per second.

Retr0id• 1 year ago

Assigning dollar values to this kind of work gets messy, fast.

Imagine if someone iterated on the exploit presented in the article so that it became a persistent "softmod" - who gets the funds?

Bounties also discourage open collaboration. For example, if person A has the first half an exploit chain and person B has the second, they're each incentivised to keep the information to themselves and try to get a full chain on their own to claim the bounty. Of course, this assumes they're financially motivated - but if they're not there's no point in the bounty in the first place.

yieldcrv2• 1 year ago

Bounties are free work contests for any potential beneficiary

And the benefactor is designed by a committee who cant even agree on the value, winding up tossing pennies at the problem hoping someone in Malaysia salivates

knowitnone• 1 year ago

and here I am having trouble even removing the case! haha.

throwaway484766• 1 year ago

Its not that hard when you get the hang of it and have the right tools.

zymhan• 1 year ago

That was not their point.

noisem4ker• 1 year ago

Gotta stab it hard in those holes.

kmeisthax2• 1 year ago

I'm gonna be honest, I thought the story was over when they started talking about "oh hey here's this hypervisor code that loads extensions", because obviously extensions are going to be a massive increase in attack surface. But even then, the system wasn't actually broken by the extension being badly designed; the extension was just the most useful target to use the actual attack on.

How the hell has this the Xbox 360 hypervisor remained basically impenetrable? You'd think at some point, someone would write and sign a hypervisor extension with a cripplingly bad memory safety bug. Hell, Apple's PPL[0] has better hardware isolation than Xenon's hypervisor mode[1] and it still gets 0wned more often.

[0] Page Protection Layer. On Apple processors, every ARM exception level has a corresponding guarded exception level that has privileges over the regular one; chiefly corresponding to memory management.

[1] On Xenon, the hypervisor runs in "real mode" plus HRMOR; Apple PPL's GL1/2 still have virtual memory and page table permissions.

MisterTea• 1 year ago

You'd think at some point, someone would write and sign a hypervisor extension with a cripplingly bad memory safety bug.

I'd hazard a guess that the Apple hardware is easier to work on than a video game console. Your already sitting in front of a general purpose computer running programming tools. A video game console is the antitheses of that.

chc4• 1 year ago

It sounds like the hypervisor extensions are more like one-shot payloads, which probably have much less attack surface than normal kernel modules that are exposing new functionality to userspace.

karlgkk• 1 year ago

Part of the reason is motivation

- if you hack a console, you can make a fair money, by selling your exploit as a package piece of software. Much like modchip vendors do. In fact, there have been a few software exploits that were sold with ties to a specific console. Funny if you think about it

- If you hack an iPhone, you can sell your exploit to many governments and government agencies for millions of dollars

If i were a profit motivated attacker, i know which I’d focus on

kmeisthax2• 1 year ago

That is true today, but back in 2005 when the Xbox 360 launched we didn't have every government buying up security vulnerabilities by the truckload. The market for zero-days didn't really get established until the early 2010s when the 360 was on its way out. Every contemporary competitor to the Xbox 360 got hacked within its commercial lifespan, due to having comically awful security practices. Microsoft certainly was, at the time, 'better' than Sony or Nintendo; but the task they were doing was just plain impossible.

A game console is, effectively, a Point of Presence[0] for a DRM vendor. It's job is to tie the owner's hands so that they don't copy games, and that they don't buy games from competing companies. This is an incredibly difficult, if not impossible task. In contrast, while the iPhone's security also does DRM and developer lockout; their main concern is keeping you from getting hacked by nation states. Those are certainly more sophisticated and well-financed attackers; but they (usually) don't have physical access to or ownership over what you're trying to protect.

[0] In telecom, a PoP is the dividing line between your systems and someone else's. If that sounds really arbitrary, it's because that's how they untangled the Bell monopoly.

ryantheleach• 1 year ago

How the hell has this the Xbox 360 hypervisor remained basically impenetrable?

Conspiracy theorist in me thinks that since it was a games console, the NSA didn't mandate backdoors, so MS software and hardware security guys could just make the toughest hardware and software they could dream of. Sprinkled with a decent serving of luck.

So the Xbox360 was essentially a playground for MS hypervisor team, without needing to worry about national security or interference.

A perfect breeding ground for developing an actually secure product they could potentially use in the future, if they were allowed.

djmips• 1 year ago

tour de force - I'm very impressed.

Hacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit

Related Stories