1. Eric L. Frederich COT 4810 Sept 14 2004
Xbox Hacking
Eric L. Frederich
COT 4810
Sept

2. Xbox Hacking
Xbox Overview
Xbox Hardware Hacking
Legal Issues
Software

3. Overview 733 MHz Celeron CPU Ethernet Sound Video USB
8 – 10 GB hard disk drive
DVD Rom

5. Xbox Hardware Hacking Boot ROM Cipher Garbage
// key initialization routine
unsigned char K[256]; // 0xFFFFC80 in flash
unsigned char S[256]; // 0x10000 in SDRAM
for( i = 0; i < 256; i++ ) {
S[i] = i; }
j = 0;
// RC-4 would do j = (j + K[i] + S[i]) % 256
j = (j + K[i] + S[j]) % 256;
// swap S[i], S[j]
temp = S[i];
S[i] = S[j];
S[j] = temp;
// decryption routine
unsigned char cipherText[16384]; // 0xFFFFA000 in FLASH
unsigned char plainText[16384]; // 0x in SDRAM
for( index = 0x400, i = 0, k = 0; index > 0; index-- ) {
// xbox version
t = (X[i] ^ cipherText[k]) % 256;
plainText[k] = t;
// swap( S[i], S[t] );
S[i] = S[t];
S[t] = temp;
i = (i + 1) % 256;
k++;
Boot ROM
Cipher
Garbage
You can change the contents of the entire ROM and the xbox still boots fine.

6. Xbox Hardware Hacking Address and or data line scrambling
What’s with this boot ROM ???
Address and or data line scrambling
Secondary crypto processor
Boot code contained in the processor
Expensive
Changed from AMD to Intel at last moment
Boot code contained in the chipset
You can change the contents of the entire ROM and the xbox still boots fine.

7. Xbox Hardware Hacking Extracting the ROM image
What’s with this boot ROM ???
Extracting the ROM image
Decrypting it ( RC-4 / 128 )
Sliding window
Histogram
Symmetric Cipher
Generate your own code
You can change the contents of the entire ROM and the xbox still boots fine.

8. Xbox Hardware Hacking LPC Bus Modchips Manufacturing costs Development
Running your own code
LPC Bus
Manufacturing costs
Development
Modchips
You can change the contents of the entire ROM and the xbox still boots fine.

9. Legal Issues Illegal Legal Modified Microsoft BIOS’s
Binaries (built with illegal copies of XDK)
Emulators
Media Players
Homemade games
Legal
Microsoft-free BIOS’s
Cromwell Linux
XDK-free Binaries
Gentoox Linux

12. Xbox Software Hacks Game save overflows Permanent overflows

13. Xbox Links / References
Hacking the Xbox: an introduction to reverse engineering
Andrew “bunnie” Huang
No Starch Press, Inc. San Francisco 2003