[Music]
thank you
[Music]
welcome back everyone and finally we
have our talk on hacking the Xbox 360
with the Raspberry Pi Pico please
welcome the dealer
hello thank you thank you very much
welcome to my lecture
so we will be talking about the Xbox
360. it's a security
the security flaws and ultimately how we
can defeat it and run basically anything
we want
so first off I'm a web developer I'm a
tinkerer a gamer and I've been modding
consoles since I was 16. when I got my
first Nintendo Wii and it was pretty
boring I only got like two games
and I wanted to do something more with
it so I found out the the world of
modding your console to run uh some
Homebrew softwares some applications
that are open source and basically
anything you you yourself right or
anyone else on the web
so what's what's the deal what's the
actual deal with uh hacking consoles so
uh any console that uh that's been
manufactured by let's say Nintendo or
Microsoft uh it's got the the
it uh it can only run the code that uh
the the manufacturer have
uh signed and so it can only run a legit
code
but it's my machine I should be able to
run whatever I want
so when you hack the console you have
the freedom to run anything
the only downsides to that you you will
avoid your warranty
if you if you are able to modify the
games that you play you could have
cheaters and of course it opens the door
to piracy which is something that we
don't actually want
so a bit about the Xbox
it was released in 2005 and it had
pretty uh very powerful architecture
and very powerful hardware for that uh
period
and about its security so it had an
unencrypted ROM image
that
you can only run stuff that were checked
by the hypervisor
and it had effuses to prevent
downgrading and running some potentially
dangerous software
so what actually is a hypervisor
the whole operating system actually runs
inside a virtual machine
and the hypervisor is like the uh
Observer that makes sure that everything
that runs on it has been signed and
checked
and there's actually a piece of code in
the CPU that makes it impossible to
modify the hypervisor itself
and so the developers and some hackers
found out some pretty neat stuff
how we can do how we can actually defeat
the the hypervisor
and the first one
was called The King Kong Sader exploit
it was discovered just one year after
the console's launch
it only worked on these two kernel
versions
and it required a modified game of King
Kong
and uh
so uh you Pat essentially you patch the
game
to run some modified code instead of the
Shader that is used for the first the
first scene in the game
it was reported to Microsoft before uh
before actually showcasing it just to
make sure that nobody else would that
that Microsoft would have enough time to
patch it before somebody breaks the
system
and also it required a modified
DVD drive so you can burn the game in
and run it from there
and it's very outdated it only works for
these two kernel versions and it's not
very interesting to us but this is what
it looks like so when the the game loads
it says press start to continue and
right after that you can run Linux or
anything you want
then few years after that the JTAG
exploit was discovered
so it essentially used the same flaw in
the King Kong Shader exploit but the
only difference was that it
resided on the JTAG
port and it loaded an image right out of
the SMC chip
so it injects the King Kong Shader
exploit the payload
and it basically runs any software it
only works on a dashboard 7371 which is
way way old it's outdated and it's not
even possible to you to do that on on a
slim console like this
it was only present on the older
consoles
and then
the next development
is called the reset glitch hack so
basically
um
when the the console is booting the
the image that's on the the nand the ROM
it gets checked against the hash unknown
hash that's hard-coded inside the
processor
and so if we somebody found out if we
listen to the postcodes
when the machine is booting
and we hear a specific postcode
if we post the reset signal
it will reset the
registers that are responsible for
telling us if the image is modified or
not
but it won't actually reset the the
whole console
so we can basically uh clear the error
codes and continue to to boot the
console
so when the check
passes it returns zero because it's been
restarted
and we can run anything we want
it's actually unpatchable on
Source because it's it bypasses
everything that's that has been
designed by Microsoft to to withstand
and actually we needed an external
glitch chip that would have all the
logic for
for listening to the postcodes and to
slow down the processor and inject the
the reset code so this is what the early
[Music]
um
glitch tips looked like so you can see
there's a bunch of wires one of them is
going to the post output that is
listening to the postcodes
the other one is linked to the reset
signal itself it's the one that that
actually passes the reset signal
and we have some other ones for example
I'm not really sure just
go on
so
um
something that was discovered just a
year ago
we don't really need the glitch chip
anymore so we can program the SMC itself
to
to listen to the postcodes and to do the
actual the actual recent glitch
so we don't need any external hardware
we don't need to glue anything on the
board we just need two small wires
uh because the SMC doesn't see the the
post output and it doesn't see the the
reset uh
the reset signal
we just need to to solder two small
wires from the
from the SMC to the
to the CPU itself it was discovered by
the user
15432
and it looks something like this
so you just take two wires and connect
it as the picture shows
this is the setup on the old the fat
consoles
and this is the setup for the sling
pencils as we can see here
so how do we do it we first need to
apply the the mod wiring
um
we need to to read the ROM we need to
make sure that we can boot Linux on it
um so we can extract the CPU key decrypt
the firstly red nand and then write our
modified image on it
so this is the software that is used for
everything it is I like to call it the
Swiss army knife for Xbox 360.
and you can find the GitHub right here
so in order to read an end you would
actually need a
a device that's able to connect to the
uh
to do SPI port on the on demand ROM
itself
but those are outdated because last year
somebody got the genius idea of making
one for of making a firmware for the
Raspberry Pi Pico that essentially
essentially it makes it a SPI flasher
and you can download it so you can Flash
it on your on your Raspberry Pi Pico and
you can read your nand you can write it
you can do anything you want
so what do we do next after we
read an end
we can write a modified ECC image on it
so ECC is essentially just first 50
blocks of the nand it doesn't need to be
encrypted
uh but it can read a CPU key you can
read all the encryption information that
we need
it runs this cell reloaded so it's a
modified Linux image
it starts the network so you can connect
your previously mentioned uh
jrunner software to it and as you can
see right here you can see you guys yeah
so this is the CPU key that is needed to
decrypt the net
and so while this Linux is running it's
also uh listening to
um update information
so essentially you can even update your
nand from the from the software you
don't need to to hook it you don't need
to to hook the Raspberry Pi again
in order to to write the image
after you get your CPU Keys you need to
to input them into this program
in order to decrypt the image in order
to make the completely new modified
image image that essentially can run
unsigned code
and yeah you just enjoy your modded
headbox
like this
so this is a modified Xbox
here I have an application that's called
the XCX menu normally an unmodified
console wouldn't be able to see this
application it would just
report some corrupted data or stuff that
we can read
when you open this
you have a
essentially a menu to run anything you
want
if I go to
technical difficulties sorry
okay so what you see here is an
application called the dash launch
uh essentially it's like a god mode
application for your Xbox
it can notify the
the launch uh pads so anything that you
you don't need to to boot inside the the
Xbox dashboard you can boot to anything
you want
you can set your own
application to run from it for example
this is a modified dashboard that's
called the Aurora
it contains a modified dashboard with uh
file manager with system settings
essentially you can you have the control
of of your whole system
and just to demonstrate one also another
neat thing that you can do
you can't really hear it but I can
override the fan speed and for example
if my console is overheating I can just
keep it cooler
and from this menu I can also launch any
other executable that I want
so basically that's it for the
modified system
so
what's what was the the point of all
this so uh when you own a console you
should be able to run anything you want
that was the the whole point of of
modifying the concepts so uh Microsoft
they actually realized that if we give
enough freedom to to developers to to
run their own software we wouldn't have
that many people trying to break it and
and open the door to piracy and stuff
like that so uh when they released the
Xbox One
and also the the newer Xbox series says
they have uh developer mode
uh it's like a one-time payment
that enables you to uh to have a
essentially a software development kit
on your legit console
so they
and it it showed that it was actually a
very smart idea because nobody then
tried to to modify the the Xbox one
because you essentially can you have the
freedom to to run whatever you want
and even for the Xbox 360 uh the newest
revision of the motherboard so called
Winchester uh it has
it has a hardware patch for the reset
glitch hack because you can't really
pulse the reset
uh it gets latched so it disables the
whole hack so the latest version of of
the Xbox 360 and the Xbox One are not
vulnerable to this hack
and so that would be it
questions
[Applause]
thank you I have a question if I can
have you tried overclocking your 360.
I'm not sure it's possible I mean it can
be but it's not really something that
you
it's not really something that that's
useful because
the the hardware itself is powerful
enough to run everything that that has
been written for it
so maybe someone tried but I'm not sure
thank you
uh I've owned I actually own a mod at
360 as well and I see a lot of same goes
for the PS3 being used for emulation and
stuff how do you look at it using for
things like that in regards to power
draw and efficiency towards a knock or
something more modern which you can use
for the same Purpose with a lower
wattage do you still see a a business
case for using a 360 for example
well yes of course so you can when you
have a modified system you can run you
can emulate software like you said it
doesn't really matter if if it's a
PlayStation 3 if it's an Xbox 360. so
your main concern is the power draw of
the office yeah for example you could
replace it with a more modern knock
whatever and achieve the same result
with more efficient Hardware in my
opinion but I'm curious to how you look
at it
well but I can agree with with the with
your point but for example if I only
have an old Xbox that's lying around and
it's not doing anything but collecting
dust uh why not why not just modify it
and be able to run whatever you want
fair enough yeah
any more questions
thank you very much
[Music]
thank you