Boot Process - Revision history

Ippo: Minor tweak in struct RSAPUBKEY

2024-12-06T19:30:45Z

Minor tweak in struct RSAPUBKEY

2024-12-06T19:25:32Z

Add more information about the integrity check in the FBL.

2024-12-06T18:56:51Z

Undo revision 7374 by Ippo (talk)

2024-12-06T18:56:33Z

2024-01-10T19:11:37Z

2024-01-10T06:43:15Z

‎Running the kernel: kernel is checked for MZ/PE headers

2024-01-10T06:32:13Z

basic documenting of FBL, kernel uses LZX

2024-01-07T00:03:56Z

‎References: -- links now point to appropriate articles through wayback machine

2018-10-18T04:00:07Z

Order was slightly confusing

2018-10-17T14:04:48Z

Improve the short-version of chain of trust

@@ Line 240: / Line 240: @@
    DWORD bitlen; /* Size of modulus in bits, usually 2048 */
    BYTE unknown[4];
-   BYTE pubexp[4]; /* Public exponent e */
+   DWORD pubexp; /* Public exponent e */
    BYTE modulus[256]; /* Modulus N (stored in little endian) */
    BYTE pad[8];

@@ Line 232: / Line 232: @@
 === Verifying Integrity ===
-{{FIXME|reason=What is it doing here? Something RSA-like?}}
+A struct containing RSA public keys is decrypted using RC4 with the MCPX key. Despite the struct at first glance resembling the publicly documented RSAPUBKEY struct in the Win32 documentation, it is in fact quite different.
 === Calculating 2BL Key ===

@@ Line 232: / Line 232: @@
 === Verifying Integrity ===
-The FBL performs an RC4 decryption of the following struct using the MCPX key. Despite it at first glance resembling the publicly documented RSAPUBKEY struct in the Win32 documentation, it is in fact quite different
+{{FIXME|reason=What is it doing here? Something RSA-like?}}
 === Calculating 2BL Key ===

@@ Line 232: / Line 232: @@
 === Verifying Integrity ===
-{{FIXME|reason=What is it doing here? Something RSA-like?}}
+The FBL performs an RC4 decryption of the following struct using the MCPX key. Despite it at first glance resembling the publicly documented RSAPUBKEY struct in the Win32 documentation, it is in fact quite different
 === Calculating 2BL Key ===

@@ Line 209: / Line 209: @@
 </pre>
-=== TEA Decryption of the FBL (MCPX 1.1 only) ===
+=== TEA Verification of the FBL (MCPX 1.1 only) ===
-{{FIXME}}
+Version 1.1 of the ROM uses TEA (Tiny Encryption Algorithm) to verify the contents of the FBL, and delegates the task of decrypting 2BL to it.
 == FBL (MCPX 1.1 only) ==
-The Flash Boot Loader was added in MCPX 1.1, it connects the MCPX ROM and the 2BL.{{FIXME}}
+The Flash Boot Loader (FBL) was added in MCPX 1.1. It is stored unencrypted in flash, verified with a TEA checksum by the MCPX ROM, and is designed to be an intermediary loader between the MCPX and the 2BL.
-It is not part of the MCPX ROM, but part of the flash.
-The FBL's job is to verify flash integrity, then load and decrypt 2BL.
+The ESP is set to 0x8F000 in RAM, and later used to store variables used in the verification process.
 === Verifying Integrity ===

@@ Line 479: / Line 479: @@
 ==== Running the kernel ====
-The xboxkrnl.exe header at 0x8001000 is checked{{FIXME|reason=how?}}.
+The xboxkrnl.exe header at 0x80010000 is checked to make sure it contains both the "MZ" and "PE" magic values at the correct positions.
-If it is invalid, {{FIXME}}.
+If it is invalid, some hardware is touched {{FIXME|reason=which hardware and how?}} and the system is put into an infinite loop.
-If it is valid, the kernel entry point is looked up from the PE optional header. The hardcoded image base of 0x8001000 is added to the entry point.
+If it is valid, the kernel entry point is looked up from the PE optional header. The hardcoded image base of 0x80010000 is added to the entry point.
-The entry-point is now being called. Argumnts are passed on the stack, from right to left.
+The entry-point is now being called. Arguments are passed on the stack, from right to left.
-The first argument is a commandline string loaded from memory address 0x80400000. It is an empty string for retail BIOS{{FIXME|reason=Mention options for debug bioses here}}.
+The first argument is a commandline string loaded from memory address 0x80400004. It is an empty string for retail BIOS{{FIXME|reason=Mention options for debug bioses here}}.
 A pointer to the previously mentioned array of 3 keys is passed as the second argument.

@@ Line 217: / Line 217: @@
 The Flash Boot Loader was added in MCPX 1.1, it connects the MCPX ROM and the 2BL.{{FIXME}}
 It is not part of the MCPX ROM, but part of the flash.
 == 2BL ==
@@ Line 439: / Line 475: @@
 ===== Kernel decompression =====
-The Kernel is decompressed directly to 0x80010000 where it will reside until a full system shutdown.
+The Kernel is decompressed directly to 0x80010000 using the LZX compression scheme, where it will reside until a full system shutdown.
 ==== Running the kernel ====

@@ Line 520: / Line 520: @@
 == References ==
-* [http://hackspot.net/XboxBlog/?p=1 Understanding the Xbox boot process]
+* [https://web.archive.org/web/20141024145145/http://hackspot.net/XboxBlog/?p=1 Understanding the Xbox boot process]
-* [https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Boot ROM]
+* [https://web.archive.org/web/20150612173331/https://mborgerson.com/deconstructing-the-xbox-boot-rom Deconstructing the Boot ROM]

@@ Line 287: / Line 287: @@
 ! Offset in PDE !! Value !! Notes
 |-
-|0x000 || 0x000000E3 || rowspan="7" | Identity maps the first 256MiB of RAM: 0x00000000 and 0x80000000 will both map to physical page 0 <br><br> 0xE3: Flags: <br> * 0x80: 4 MiB page <br> * 0x40: Marked as previously written (Dirty) <br> * 0x20: Marked as previously accessed <br> * 0x02: Read/Write <br> * 0x01: Present
+|0x800 || 0x000000E3 || rowspan="7" | Identity maps the first 256MiB of RAM: 0x80000000 and 0x00000000 will each map to physical page 0 <br><br> 0xE3: Flags: <br> * 0x80: 4 MiB page <br> * 0x40: Marked as previously written (Dirty) <br> * 0x20: Marked as previously accessed <br> * 0x02: Read/Write <br> * 0x01: Present
 |-
-|0x800 || 0x000000E3
+|0x000 || 0x000000E3
 |-
 |0x004 || 0x004000E3
 |-
 | colspan="2" | ...

@@ Line 12: / Line 12: @@
 The Xbox uses a chain of trust during the boot process:
-* The MCPX ROM contains a key to decrypt the 2BL.
+'''MCPX X2'''
-There are also a handful of assumptions:
+There's no chain of trust.
-* The CPU will start execution in the MCPX ROM.
+It behaves similar to the MCPX X3 1.0 boot, just that the MCPX ROM is not available, so the code is loaded from untrusted flash.
 * The MCPX ROM can not be read or modified.
-* The decrpyted 2BL or Kernel can not be read entirely.
+* The decrypted 2BL or kernel can not be read entirely.
 * All parts of the software following the MCPX are not-attackable and signed.