Exploits - Revision history

Lowtolerance at 23:40, 9 January 2024

2024-01-09T23:40:39Z

Lowtolerance: Added a blurb about the MechAssault exploit.

2024-01-09T02:43:44Z

Added a blurb about the MechAssault exploit.

Lowtolerance: Fleshed out Visor Hack, MIST hack and A20M# hacks with information gleaned from 17 Mistakes.

2024-01-09T02:33:13Z

Fleshed out Visor Hack, MIST hack and A20M# hacks with information gleaned from 17 Mistakes.

Derf: Undo revision 6918 by Derf (talk)

2021-03-23T17:11:17Z

Undo revision 6918 by Derf (talk)

Derf: /* Attack ideas */

2021-03-23T17:09:50Z

‎Attack ideas

Derf at 14:39, 11 May 2020

2020-05-11T14:39:05Z

Derf: /* Attack ideas */

2020-05-11T14:06:09Z

‎Attack ideas

Derf: /* Attack ideas */

2020-05-11T14:05:48Z

‎Attack ideas

Derf: /* Attack ideas */

2020-05-11T14:04:50Z

‎Attack ideas

Derf: /* Attack ideas */ Credit to /r/OriginalXbox wiki for DVD demo info.

2020-05-11T14:01:14Z

‎Attack ideas: Credit to /r/OriginalXbox wiki for DVD demo info.

@@ Line 33: / Line 33: @@
 When the attack happens, the MCPX ROM is still visible, making this a very powerful attack.
-''This attack is described by Michael Steil in his Google talk, [Hacking the Xbox Security System][https://www.youtube.com/watch?v=9NqLljaHc80].''
+''This attack is described by Michael Steil in his Google talk, “[https://www.youtube.com/watch?v=9NqLljaHc80 Hacking the Xbox Security System].''
-−
 === TEA attack (MCPX 1.1 only) ===
@@ Line 77: / Line 77: @@
 The game isnt shown in the final presentation at 22C3 (neither are Mechassault nor SplinterCell).
-In 2022, Artem Garmash published a blog post describing an approach to [exploiting Frogger Beyond][https://agarmash.com/posts/xbox-frogger-beyond-exploit/].
+In 2022, Artem Garmash published a blog post describing an approach to [https://agarmash.com/posts/xbox-frogger-beyond-exploit/ exploiting Frogger Beyond].
 === [[MechAssault]] ===

@@ Line 76: / Line 76: @@
 Not much is known why this game was in the list, [https://events.ccc.de/congress/2005/fahrplan/attachments/674-slides_xbox.pdf 22C3, page 85]
 The game isnt shown in the final presentation at 22C3 (neither are Mechassault nor SplinterCell).
 === [[MechAssault]] ===
 === [[Tom Clancy's Splinter Cell]] ===
 === [[Tony Hawk's Pro Skater 4]] ===

@@ Line 7: / Line 7: @@
 === Visor hack ===
-Exploits incorrect rollover of memory address.
+Exploits incorrect rollover of memory address. Microsoft's strategy for halting the system in the event of a "panic" event during the boot process (i.e., the hash for decrypting 2bl is incorrect) was to put the code to hide the MCPX ROM at the very end of the ROM itself, which is mapped to the top of addressable memory, and rely on the CPU to halt when the instruction pointer rolls over from 0xFFFFFFFF to 0x00000000. Incredibly, Microsoft missed that this behavior was specific to AMD's x86-compatible CPUs, which were used during the development process. In fact, the Intel CPU that ended up in retail units will happily continue execution at 0x00000000.
 === MIST hack ===
-Exploits error in xcode interpreter security check.
+Exploits error in xcode interpreter security check. MCPX 1.0 contains code intended to prevent an attacker from using Xcodes to turn off the Xcode interpreter, which is normally accomplished by setting a bit in memory used by the PCI bus to set device configuration, directing the mapping of memory to the top of memory from the MCPX's ROM to flash. The interpreter will reject Xcode that attempts to modify data at this address, but neglects to consider the behavior of the PCI controller, which only utilizes the lower 24 bits of a memory address. Consequently, it is still possible to toggle the necessary bit and turn off the MCPX's secret ROM by using a "fake" address -- the desired address with the upper bits modified so that the interpreter's check will not catch that we are hiding the secret ROM.
-There are at least 2 variations of this hack.
 === A20M# hack ===
@@ Line 18: / Line 21: @@
 [[File:Haxar-a20m.jpg|thumb|200px|A jumper wire hack to enable A20]]
-Uses a legacy x86 feature.
+Uses a legacy x86 feature (beginning with 286 CPUs) that relied on a gate on address line 20 (A20) to determine whether the code execution should roll over to the lower 64kb or continue on into higher memory addresses. This feature still existed in the CPU used in the Xbox. By pulling down the A20 gate, an attacker can effectively modulate an address so that the system will point to a location in memory below the addressed location. For instance, with the A20 gate pulled down, the address 0xFFFFFFFF would be translated to 0xFFEFFFFF, which on the Xbox would continue code instruction at a location in flash.
 === RC4 attack (MCPX 1.0 only) ===
@@ Line 30: / Line 33: @@
 When the attack happens, the MCPX ROM is still visible, making this a very powerful attack.
-''This attack is described by Michael Steil in his Google talk.''
+''This attack is described by Michael Steil in his Google talk, [Hacking the Xbox Security System][https://www.youtube.com/watch?v=9NqLljaHc80].''
 === TEA attack (MCPX 1.1 only) ===

@@ Line 166: / Line 166: @@
 [[The Hulk]]
-This DVD is unique and contains a partial dashboard (5860 with 4831 libraries) with an xboxdash.xbe signed to run from DVD-ROM. The default.xbe calls this dashboard XBE with parameters to play a video on the disc. By swapping this XBE with the default.xbe, you can boot the dashboard to a blank sphere. By placing dashboard 4920's mainmenu5.xip in the xboxdash folder, you can restore the orb and menu options, but selecting an option will show a blank sphere after the zoom animation. All xips are loaded from DVD and are hash checked. Font/audio files are loaded from HDD and hash checked. Aside from xboxdash.xbe, default.xbe will load video_ts.ifo and an audio file from disc, so a vulnerability could be found in those.
+This DVD is unique and contains a partial dashboard (5860 with 4831 libraries) with an xboxdash.xbe signed to run from DVD-ROM. The default.xbe calls this dashboard XBE with parameters to play a video on the disc. By swapping this XBE with the default.xbe, you can boot the dashboard to a blank sphere. By placing dashboard 4920's mainmenu5.xip in the xboxdash folder, you can restore the orb and menu options, but selecting an option will show a blank sphere after the zoom animation. All xips are loaded from DVD and are hash checked. Font/audio files are loaded from HDD and hash checked. Aside from xboxdash.xbe, default.xbe will load video_ts.ifo and an audio file from cdrom, so a vulnerability could be found in those.
 Untested

@@ Line 166: / Line 166: @@
 [[The Hulk]]
-This DVD is unique and contains a partial dashboard (5860 with 4831 libraries) with an xboxdash.xbe signed to run from DVD-ROM. The default.xbe calls this dashboard XBE with parameters to play a video on the disc. By swapping this XBE with the default.xbe, you can boot the dashboard to a blank sphere. By placing dashboard 4920's mainmenu5.xip in the xboxdash folder, you can restore the orb and menu options, but selecting an option will show a blank sphere after the zoom animation. All xips are loaded from DVD and are hash checked. Font/audio files are loaded from HDD and hash checked. Aside from xboxdash.xbe, default.xbe will load video_ts.ifo and an audio file from cdrom, so a vulnerability could be found in those.
+This DVD is unique and contains a partial dashboard (5860 with 4831 libraries) with an xboxdash.xbe signed to run from DVD-ROM. The default.xbe calls this dashboard XBE with parameters to play a video on the disc. By swapping this XBE with the default.xbe, you can boot the dashboard to a blank sphere. By placing dashboard 4920's mainmenu5.xip in the xboxdash folder, you can restore the orb and menu options, but selecting an option will show a blank sphere after the zoom animation. All xips are loaded from DVD and are hash checked. Font/audio files are loaded from HDD and hash checked. Aside from xboxdash.xbe, default.xbe will load video_ts.ifo and an audio file from disc, so a vulnerability could be found in those.
 Untested

@@ Line 161: / Line 161: @@
 |-
 |'''Hulk (Special Edition)'''
 UPC 2519224892
 [[The Hulk]]

@@ Line 169: / Line 169: @@
 |-
 |'''Star Wars: Clone Wars - Volume One'''
 UPC 2454317005
 [[Republic Commando]]
@@ Line 175: / Line 177: @@
 |-
 |'''Star Wars: Clone Wars - Volume Two'''
 UPC 24543214137
 [[Battlefront II]]
@@ Line 181: / Line 185: @@
 |-
 |'''Star Wars: Episode III - Revenge of the Sith (Widescreen Edition)'''
 UPC 5039036023238
 [[Battlefront II]]
@@ Line 187: / Line 193: @@
 |-
 |'''Star Wars Trilogy (Widescreen Edition with Bonus Disc)'''
 UPC 24543123415 or 5039036017374
 [[Star Wars Battlefront]]
@@ Line 193: / Line 201: @@
 |-
 |'''Star Wars Trilogy DVD (Widescreen theatrical edition)'''
 UPC 24543559856
 [[Lego Star Wars 2]]
@@ Line 199: / Line 209: @@
 |-
 |'''The Chronicles of Riddick (Widescreen Unrated Director's Cut)'''
 UPC 5050582274639
 [[Chronicles of Riddick]]
@@ Line 205: / Line 217: @@
 |-
 |'''Doom (Unrated Widescreen Edition)'''
 UPC 25192031229
 [[Doom 3]]
@@ Line 211: / Line 225: @@
 |-
 |'''King Arthur - The Director's Cut (Widescreen Edition)'''
 UPC 786936265262
 [[King Arthur]]
@@ Line 217: / Line 233: @@
 |-
 |'''Robots (Widescreen Edition)'''
 UPC 24543193845
 [[Robots]]
@@ Line 223: / Line 241: @@
 |-
 |'''Van Helsing (Widescreen Edition)'''
 UPC 25192326622 or 25192586125
 [[Van Helsing]]
@@ Line 229: / Line 249: @@
 |-
 |'''The Godfather'''
 UPC not 5014437812834 nor 14633165401 nor 014633165401

@@ Line 158: / Line 158: @@
 |-
 | rowspan="13" | Homebrew entry point || rowspan="13" | Community
-| rowspan="13" | Some movie DVDs contain default XBEs signed to run on original Xbox from DVD-ROM. The XBE extracts the actual game XBE (which is signed to run from HDD) onto the cache drives. If we can find an exploit in one of them (loaded files), we could possibly take over the entire system and run a softmod from DVD+R. In order to make a bootable DVD+R, you must have a DVD burner that - either natively, or by custom firmware - can set booktype to DVD-ROM. From a small sample size, it appears that the drive must also be capable of setting the layertype on the disc to "read-only", which is a very rarely used security feature apparently only present for Xbox, Xbox 360, and an Audi navigation system. Layertype is a rather unknown thing, and it appears DVD burners were accidentally set with this from factory, but regular burner drives could potentially have the layertype modified using custom firmware (as the Burnermax payload does for dual layer DVDs).
+| rowspan="13" | Some movie DVDs contain default XBEs signed to run on original Xbox from DVD-ROM. The XBE extracts the actual game XBE (which is signed to run from HDD) onto the cache drives. If we can find a vulnerability in one of them (loaded files), we could possibly take over the entire system and run a softmod from DVD+R. In order to make a bootable DVD+R, you must have a DVD burner that - either natively, or by custom firmware - can set booktype to DVD-ROM. From a small sample size, it appears that the drive must also be capable of setting the layertype on the disc to "read-only", which is a very rarely used security feature apparently only present for Xbox, Xbox 360, and an Audi navigation system. Layertype is a rather unknown thing, and it appears DVD burners were accidentally set with this from factory, but regular burner drives could potentially have the layertype modified using custom firmware (as the Burnermax payload does for dual layer DVDs).
 |-
 |'''Hulk (Special Edition)'''
@@ Line 164: / Line 164: @@
 [[The Hulk]]
-This DVD is unique and contains a partial dashboard (5860 with 4931? libraries) with an xboxdash.xbe signed to run from DVD-ROM. The default.xbe calls this dashboard XBE with parameters to play a video on the disc. By swapping this XBE with the default.xbe, you can boot the dashboard to a blank sphere. By placing dashboard 4920's mainmenu5.xip in the xboxdash folder, you can restore the orb and menu options, but selecting an option will show a blank sphere after the zoom animation.
+This DVD is unique and contains a partial dashboard (5860 with 4931? libraries) with an xboxdash.xbe signed to run from DVD-ROM. The default.xbe calls this dashboard XBE with parameters to play a video on the disc. By swapping this XBE with the default.xbe, you can boot the dashboard to a blank sphere. By placing dashboard 4920's mainmenu5.xip in the xboxdash folder, you can restore the orb and menu options, but selecting an option will show a blank sphere after the zoom animation. All xips are loaded from DVD and are hash checked. Font/audio files are loaded from HDD and hash checked. Aside from xboxdash.xbe, default.xbe will load video_ts.ifo and an audio file from cdrom, so a vulnerability could be found in those.
 Untested
@@ Line 230: / Line 230: @@
 |'''The Godfather'''
 UPC not 5014437812834 nor 14633165401 nor 014633165401
 SPPV and Atreyu187 claim this exists and contains an XBE capable of chainloading any signed game XBE. No evidence exists of this actually existing on the DVD or game bonus disc, but it is listed here for posterity.
 [[The Godfather: The Game]]
 |}