Eric L. Frederich COT 4810 Sept 14 2004 Xbox Hacking Eric L. Frederich COT 4810 Sept 14 2004

Xbox Hacking Xbox Overview Xbox Hardware Hacking Legal Issues Software

Overview 733 MHz Celeron CPU Ethernet Sound Video USB 8 – 10 GB hard disk drive DVD Rom

Xbox Hardware Hacking Boot ROM Cipher Garbage // key initialization routine unsigned char K[256]; // 0xFFFFC80 in flash unsigned char S[256]; // 0x10000 in SDRAM for( i = 0; i < 256; i++ ) { S[i] = i; } j = 0; // RC-4 would do j = (j + K[i] + S[i]) % 256 j = (j + K[i] + S[j]) % 256; // swap S[i], S[j] temp = S[i]; S[i] = S[j]; S[j] = temp; // decryption routine unsigned char cipherText[16384]; // 0xFFFFA000 in FLASH unsigned char plainText[16384]; // 0x400000 in SDRAM for( index = 0x400, i = 0, k = 0; index > 0; index-- ) { // xbox version t = (X[i] ^ cipherText[k]) % 256; plainText[k] = t; // swap( S[i], S[t] ); S[i] = S[t]; S[t] = temp; i = (i + 1) % 256; k++; Boot ROM Cipher Garbage You can change the contents of the entire ROM and the xbox still boots fine.

Xbox Hardware Hacking Address and or data line scrambling What’s with this boot ROM ??? Address and or data line scrambling Secondary crypto processor Boot code contained in the processor Expensive Changed from AMD to Intel at last moment Boot code contained in the chipset You can change the contents of the entire ROM and the xbox still boots fine.

Xbox Hardware Hacking Extracting the ROM image What’s with this boot ROM ??? Extracting the ROM image Decrypting it ( RC-4 / 128 ) Sliding window Histogram Symmetric Cipher Generate your own code You can change the contents of the entire ROM and the xbox still boots fine.

Xbox Hardware Hacking LPC Bus Modchips Manufacturing costs Development Running your own code LPC Bus Manufacturing costs Development Modchips You can change the contents of the entire ROM and the xbox still boots fine.

Legal Issues Illegal Legal Modified Microsoft BIOS’s Binaries (built with illegal copies of XDK) Emulators Media Players Homemade games Legal Microsoft-free BIOS’s Cromwell Linux XDK-free Binaries Gentoox Linux

Xbox Software Hacks Game save overflows Permanent overflows http://www.xbox-linux.org/docs/007analysis.html

Xbox Links / References http://www.xbox-scene.com http://www.xbox-linux.org/ http://www.xboxhacker.net http://www.modchipman.com Hacking the Xbox: an introduction to reverse engineering Andrew “bunnie” Huang No Starch Press, Inc. San Francisco 2003