XBOX 360 Hacking Topic

[jimaros]

Αντε...κολαν,σπασουαρ,μπαστουνι και τρεχουμεεεε

 

Lol...Ti sou kanoun oi amerikanoi....:mrgreen:

[xvagos]

Έκαψα το The Darkness (wrx release) και όταν πάω να μπω στα Turkish Baths κολλάει; Δεν μου έχει ξανατύχει σε κάποιο άλλο game. Τι να φταίει; Μήπως δεν ήταν καλό το ISO ή να προσπαθήσω να το ξαναγράψω;

[jimbrav]

Έκαψα το The Darkness (wrx release) και όταν πάω να μπω στα Turkish Baths κολλάει; Δεν μου έχει ξανατύχει σε κάποιο άλλο game. Τι να φταίει; Μήπως δεν ήταν καλό το ISO ή να προσπαθήσω να το ξαναγράψω;

 

dokimase pali ...2.4X taxitita - vebratim- to pc otan kaneis burn na min einai fortomeno.

ean ta exeis kanei ayta kati allo den ksero...kai ean exeis toshiba drive valtou slow fw... ayta...

[xvagos]

Με 2,4x τα γράφω αλλά σε... Intenso.

Έχω Hitachi με FW C4EVA_XTRM-HITACHI_v2_4_Stealth.

Μήπως έχει κανείς το ίδιο πρόβλημα;

[Stormwatch]

Change DVD key and Game Region Code on Xbox360 (CPU key required)

 

Hackers on the XBH forums managed to change some stuff in the Xbox 360 'Key Vault' (note that to decrypt this you need your unique CPU key, thus this is only possible on Hypervisor exploitable 360s (kernel 4532 and 4548) for now).

From SeventhSon on xboxhacker.net (free reg. req.):

I successfully changed the DVD key and region code of a 360. So it's all confirmed.

 

As for landmarks and interweb fame. All I did towards this was to reverse the plaintext KV signature to figure out how to modify and resign the KV contents. And even this work was built on the efforts of other hackers. For example, I didn't locate the region code in the KV and a lot of the SHA1 and RC4 encryption code was reversed and documented by others way before I started looking at it. *If* the region code tests are successful, then the following people contributed *much more* to this achievement than me.

Takires, TheSpecialist, Robinsod, tmbinc.

 

The following assumes you have the correct 1BL key and CPU key set in the flashtool.

1. Dump the NAND from the US 360 (528-bytes-per-page)

2. Open in the latest flashtool (v0.8) and click [extract]

3. Edit extracted KV.bin and change 16-bits at offset 0xB8 from 0x00FF to 0x02FE

4. Open in flashtool and click [patch], check the "patch keyvault" box and select the KV.bin modified in step 3

5. Click [OK] and choose output file

6. Flash output image back to the NAND of the US 360

7. Try an EU game or two.

 

Arakon tested this successfully:

My USA 360 just booted a PAL (non-regionfree) game. the region patching WORKS.

 

News-Source: xboxhacker.net

[Blackjim]

Wraia, kana kolpo na paizei ola ta region omws? :D

 

 

Xtes vgike to All.Pro.Football.2K8.NTSC.XBOX360-CCCLX alla distixws "Region: NTSC/U Only"

[jimaros]

Wraia...An pragmatika isxuei ayto einai polu kaloo...Ntsc se pal mhxanh...Pwpw trela einai!!!!H epomenh douleia tous 8a einai na alla3oun to serial tou 360 ki oles oi banarismenes na mpainoun live...lol...

[klainmaingr]

Yparxei kapoio site me plhreis guides gia firmware modification olon ton ekdoseon ton Drive?

 

Exo diabasei sxedon oles tis selides tou thread alla katalabaino pos apo to 2005 pou exei dhmiourgithei to topic mexri shmera ta pragmata exoun allaksei arketa! (Stealth - ixtreme - banned consoles etc)

Auto pou me endiaferei kyrios einai an yparxei kapoia ekdosh pou prepei na APOFYGO kai an yparxei kapoia ekdosh pio eykola anabathmisimi kai pio

mod-ath

 

Typou : pare ena 1.50ri psp k oxi ena 3.50ri...

 

Apo to afterdawn den exo brei oloklhromenes apanthseis (exei men guides gia sygkekrimena drive alla... prospatho na kano mia PREBUY ereyna... mhn bretho me ena kouba pou den tha mporei na paizei ta antigrafa asfaleias mou

 

Kai telos na po kai edo pos an yparxei h paramikrh periptosh kapoios na barethike - sixathike -exei 2 - kerdise - brhke Xbox360 kai thelei ena wii gia antallagma na mou sfyriksei

Yg: Diplofournista k bannarismena mhxanhmata na ta kanete kadro :}

[jimaros]

Yparxei kapoio site me plhreis guides gia firmware modification olon ton ekdoseon ton Drive?

 

Exo diabasei sxedon oles tis selides tou thread alla katalabaino pos apo to 2005 pou exei dhmiourgithei to topic mexri shmera ta pragmata exoun allaksei arketa! (Stealth - ixtreme - banned consoles etc)

Auto pou me endiaferei kyrios einai an yparxei kapoia ekdosh pou prepei na APOFYGO kai an yparxei kapoia ekdosh pio eykola anabathmisimi kai pio

mod-ath

 

Typou : pare ena 1.50ri psp k oxi ena 3.50ri...

 

Apo to afterdawn den exo brei oloklhromenes apanthseis (exei men guides gia sygkekrimena drive alla... prospatho na kano mia PREBUY ereyna... mhn bretho me ena kouba pou den tha mporei na paizei ta antigrafa asfaleias mou

 

Kai telos na po kai edo pos an yparxei h paramikrh periptosh kapoios na barethike - sixathike -exei 2 - kerdise - brhke Xbox360 kai thelei ena wii gia antallagma na mou sfyriksei

Yg: Diplofournista k bannarismena mhxanhmata na ta kanete kadro :}

 

To prwto pou prepei na kaneis einai na pareis to 360 sou:)...De mporeis na kaneis tpt gia to drive pou 8a exei mesa opote den exei nohma..Mexri stigmhs ola ta drive mporoun na flasharistoun...Mono gia to nec den 3erw alla den 3erw an vgainei sthn eyrwph:???:...Oso gia to xbox live mexri twra to ixtreme den exei dokimastei kai toso polu....Opote mporei na etoimazesai kai sy gia to kadraki sou..:mrgreen:

[jimaros]

ELEOS GAMW THN TRELA MOU GAMW...ELEOS...EXW KAPSEI 6 DISKAKIA GIA NA GRAPSW ENA GAME KAI H VLAKEIA TO IMGBURN MOU PETAEI GIA PRWTH FORA ENA SFALMA 3ARFWTO TELEIOS....

 

E 15:25:54 Failed to read from file: XGD2DVD_NTSC.ISO

E 15:25:54 Reason: Το χρονικό όριο του σηματοφορέα (semaphore) εξαντλήθηκε.

 

Ti sto diaolo einai touto mporei na mou pei kapoios????Ta xw parei agria....Ti sto diaolo ftaei....

[trojan21]

kane add remove,mpas kai strosi

[urezin]

me clonecd dokimases?

[trojan21]

me to nero ginete ?

[Stormwatch]

Συνεντευξη του Specialist στο Xlife.nl

 

 

* Xlife.nl:To start with you'll find a quote from TheSpecialist explaining some details of the Xbox 360 security

* TheSpecialist: All executables on the Xbox360 have a signature. This signature is checked by the hypervisor. If we can modify the hypervisor, we can run homebrew.

However the hypervisor is also signed.

The bootsequence is as follow. The first thing that will happen when you power on the Xbox360 is loading the bootloader (=1bl). This is a very small file because it's extremely expensive put store huge files on the CPU. So the bootloader doesn't do much more than load a 2nd (bigger) bootloader (2bl). This one is found on the Xbox360 flash (which you can decrypt/dump with our tool). Also this 2bl has a signature checked by the 1st bootloader (1bl) located in the CPU ROM. The 2bl will then start a sequence to put together the kernel (with the 'base' kernel (1888) and the patches) and the hypervisor. Once done it will start both kernel and hypervisor.

So if you want to run unsigned code you should be able to get around the 1bl. Then you could install your own bootloader that will not check the signature of the 2bl and then you patch the 2bl so it doesn't check the signature of the kernel/hypervisor which would allow you to patch this to remove all checks on signature of executables. Basically it's a chain of signature checks: 1bl checks signature of 2bl, 2bl checks signature of kernel and hypervisor and hypervisor checks the signature of executables. So if you can break the start of the chain, you can change all the rest like you want.

But to get around the 1bl is not easy as it's located on the CPU ... but nothing is impossible.

 

* Xlife.nl: The DVD Firmware hack has been out for more than 1 year now, tell us what happened and what you have been up to since then.

* TheSpecialist: After the disclosure of the DVD FW hack I didn't do any hacking for a few months. Once you start with which a project you really put lots of time in it and it's often hard to stop certainly if you are constantly making progress. It's a bit like watching series like '24' or 'Lost': if you have all episodes it can be very hard to stop because you just want to know what happens next. It's just the same with hacking, you keep progressing and it's hard to take a minute of rest. Thus when the DVD FW hacking was done, I think it was time to do 'nothing' for a while.

But after some time it started to itch again and then I started working on the HDD resulting in 'HDDHackr'. Just after I released that the 'Hypervisor Exploit' got released which opened tons of new possibilities. Then we started researching the flash encryption which resulted in the release of the 'Flash Dump' tool that allows you to decrypt the whole Flash NAND, dump the kernel and keyvault and the latest version even allows you to downgrade your kernel IF you know your CPU key.

Now that these tools start to work great, we started working on a new tool that will allow you to unpack and decrypt XEX files. That tool got finished too in meantime and we can finally decrypt and analyze ALL code found on the Xbox360. However that's a HUGE job. So we are now working on new tools to make analyze all this code a bit easier, for example by recognition and labeling of standard functions in code and stuff like that.

 

* Xlife.nl: So you managed to dump the Xbox 360 kernel. On the DVD FW hack you worked with 6 other hackers, how many people are you working with on this new project?

* TheSpecialist: I work a lot with Robinsod of XBH. But we of course also talk a lot with with other hackers like tmbinc, who found the hypervisor exploit. And there are of course also lots of discussions on XBH.

 

* Xlife.nl: What do you think of the security Microsoft implemented to protect their kernel?

* TheSpecialist: Very good! Microsoft has often been in the news about the lack of security in Windows, but I can only have respect for the security on their Xbox360. The Xbox360 was announced as the most secure console ever. Of course they made a huge mistake on the security of the DVD FW, but the security in the core is really really good.

The idea of the hypervisor and certainly the fuses is simply genius. Putting the bootrom in the CPU was also a real good idea. All communication is encrypted as it should be. Even now we can dump and decrypt all program code and nothing is really 'secret' anymore we still can't run unsigned code on the new kernels. I think that says a lot.

On the other side there's now a huge amount of program code we can analyze. That will just take a lot of time. With the release of the newest info and tools I think it won't take so long until a new hack comes out.

 

* Xlife.nl: You told me that while decrypting the 4552 kernel you found stuff related to DVD FW detection/bans. Is this protection any good? Or does it look better than it really is?

* TheSpecialist: I didn't do any direct research on that, since the disclosure of the DVD FW hack I didn't do any research on it and I also don't plan to do this in the future. The biggest goal of the DVD FW hack was to help find a way to run unsigned code, which also happened. Without the DVD FW hack there would still be no way to run unsigned code on the exploitable kernels.

However I did notice a few things while analyzing the kernel, like the clear text names and types of the DVD drives which weren't found in older kernels. It's obviously used to recognize the type of DVD drive connected with your Xbox360. But like I said earlier I'm mostly working on finding a way to run unsigned code now.

 

* Xlife.nl: Now that we are talking about bans, what's your opinion on the subject?

* TheSpecialist: It's of course not fun for end-users that they can or have been banned. But you have to look at this from the 2 point of views. I'm pretty sure Microsoft has been thinking about a way to motivate people not to play backups. Sony did the same and recently came in the news saying they want to hit hard on users with hacked PS3s, with lawsuits and more. I can imagine what they want to achieve, but if you look at it this way I think Microsoft is doing it in a 'friendlier' way, and thus I have more respect for the way Microsoft is handling it than how Sony wants to do it. And of course ... the Xbox 360 is way better than that stupid PS3, haha

 

* Xlife.nl: Did Microsoft ever try to contact you after the DVD FW release?

* TheSpecialist: No

 

* Xlife.nl: If you manage to hack the kernel (and I have full faith you will) and get total control over the console, will it get distributed like the DVD FW hack, or with it only be announced?

* TheSpecialist: If someone is trying to force the front door of your house, you can call the cops. I think there will only be few people that won't do this, no matter if the person actually manages to get in your house. Microsoft could have chosen for such a strategy too and send their lawyers against the hackers. No matter if that actually leads to any result, these type of lawyers can destroy you.

Luckily they never did that (unlike Sony who's currently threatening with lawsuits for PS3 hacks). Instead they even invited tmbinc and Bunnie after the hypervisor exploit to come to them to talk about the hack. There was lots of criticisms from 'the scene' about this, but I think it was very 'clean' and I have a lot of respect with the way Microsoft currently handles hackers. I think people should not forget that if Microsoft would start threatening with lawsuits many hackers might give up and there might be no new hacks at all.

So in the end I'm very happy with this strategy. As 'counter-payment' I think it's only normal that the hacking scene plays it 'clean' too and talks with Microsoft before releasing a new hack. On the other side, by now everyone knows that they have to remove the R6T3 resistor [which prevents MS from blowing new fuses during kernel upgrades] and I think that everyone that has any interest in running unsigned code already did this. So concerning that I don't think it will make a lot of difference for the end-users and they will still be able to enjoy the hack.

[jimaros]

me clonecd dokimases?

 

variemai na psaxnw tora spasmeno to clonecd kai e3allou olo ton kairo me imgburn eggrafa xwris kanena prob...Ti diaolo egine den mporw na katalavw...Den 3erw an to prob einai apo to pionner h apo to program re gamwto...