Hacking the Xbox

Recommendations

Info

92 Hacking the Xbox: An Introduction to Reverse Engineering Removing the FLASH ROM in a manner that preserves the integrity of its fine-pitched pins simple if you have the right tools, and nearly impossible with the wrong tools. The key is to heat all of the pins of the FLASH ROM simultaneously; once uniform heating is achieved, the FLASH ROM will fall right off the motherboard. Clearly, the standard pencil-style soldering iron is not going to be able to heat all of the pins simultaneously. The proper tool for the job is a “tong” or “tweezer” style soldering iron as shown in Figure 6-1 below. These soldering irons have two heating elements, so they can heat both sides of the chip simultaneously. Furthermore, the soldering iron must have a paddle-tip that is wide enough to heat the length of the chip all at once. A soldering iron with these features can cost quite a bit (hundreds of dollars), but it is a worthwhile investment as it comes in handy in all kinds of situations. I use an Ersa SMT Unit 60A soldering iron that I bought for a good discount on the floor of a tradeshow, and it quickly paid for itself through the few board assembly jobs that I picked up on the side while finishing my degree. A more affordable iron by Xytronic can be purchased through Jameco (#168410) for about $70, but I have not used it so I cannot vouch for its quality. Another budget approach that is very simple and straightforward is to use a desoldering alloy, as described in Appendix B, “Soldering Techniques.” (Note that a suitable socket for the ROM 3 is relatively cheap — under $20 — although installing it does require a steady hand and an optical magnifying device of some kind.) Once the ROM is removed and its pins cleaned and inspected, its contents can be read out in a ROM reader. Of course ROM readers can be purchased, but it is always a good learning experience to build your own. You can read up a little bit on ROM programmers that I’ve built at my website, http:// www.xenatera.com/bunnie. My original Flashburner 4 programmer is a simple device that is easier to understand and build than its second revision 5 , but it is less powerful. However, if your goal is to read out ROMs as quickly as possible, just purchase a ROM reader outright. A good ROM reader is an essential tool in any serious hardware hacker’s toolbox. Needham’s Electronics (http:// www.needhams.com) makes a great line of ROM programmers/readers that fit a wide range of budgets. An Encounter with Microsoft After extracting the ROM contents, the next step is to share its contents with fellow hackers for analysis. Or is it? Within twelve hours of posting the contents of the ROM to my website, I received a call from an engineer at 3 Emulation Technologies (http://www.emulation.com) makes a wide line of affordable sockets for purposes just like these. The specific model for the Xbox is the S-TS-SM-040-A. 4 http://www.xenatera.com/bunnie/proj/flashburn/fb.html 5 http://www.xenatera.com/bunnie/proj/fb2/
Chapter 6 - The Best Xbox Game: Security Hacking 93 Microsoft politely requesting that I remove their copyrighted content from my website. Of course, I immediately removed their content from my website; I should have known better before posting it in the first place. This first brush with Microsoft was a sobering warning that reverse engineering the Xbox was not going to be like any other home appliance reverse engineering project. There are laws that protect aspects of reverse engineering, and a vast body of copyright law that protects the intellectual property (IP) owner. Collaborative reverse engineering of the Xbox while respecting Microsoft’s rights is a legal minefield. On the one hand, Microsoft should be able to invest in a product and take a risk in hopes of a profit. However, profitability is not guaranteed by law. For example, selling the consoles at a huge loss, as Microsoft has done, in hopes of selling software to make up the difference (as a “loss leader”) is a risky proposition, and there is no guarantee by law that Microsoft has to come out ahead in the end. On the other hand, we as hackers have the right to tinker (“fair use”) with hardware purchased with our own hard-earned cash, and if Microsoft wants to basically sell PCs at a huge discount to us, that’s fine. Whether or not we purchase enough games (around ten or more) to compensate for Microsoft’s losses on the Xbox is entirely up to Microsoft’s business and marketing strategy. In my view, Microsoft’s large loss-to-revenue ratio is a bit of an anomaly in this industry. Sony and Nintendo roughly break-even on the cost of their console hardware. Also, cell phone providers often sell their phones at a loss comparable to that of the Xbox, but require the subscriber to enter a contract to ensure that the cost of the phone is recouped; breaking the contract implies termination fees. Perhaps this is a reflection of Microsoft’s confidence in the Xbox Live business model. Somewhere in the middle of all of this is the interplay of cryptographic copyright protection mechanisms and the right to fair use. It turns out that the Xbox makes extensive use of cryptography to enforce copy protections as well as console usage policies, which brings us to the Digital Millennium Copyright Act of 1998 (DMCA), a relatively new, untested body of law. With little established court precedent and plenty of gray area in between the letters of the law, you as a hacker must assess the potential liabilities that you could face. Chapter 12, “Caveat Hacker,” explores in greater detail the legal issues of hacking in the new millennium. Analyzing the ROM Contents Rebuffed by Microsoft, but ROM contents still in hand, I proceeded to analyze the ROM contents. One would expect that the boot ROM contains a hardware initialization procedure, followed by instructions that load up the operating system, and possibly the operating system code itself. But where to start?
Page 1:
Hacking the Xbox An Introduction to
Page 4 and 5:
The US government is far and away t
Page 7 and 8:
Hacking the Xbox An Introduction to
Page 9:
In memory of Aaron Swartz
Page 12 and 13:
x Hacking the Xbox: An Introduction
Page 14 and 15:
xii Hacking the Xbox: An Introducti
Page 17:
Acknowledgments I would like to tha
Page 20 and 21:
2 Hacking the Xbox: An Introduction
Page 22 and 23:
Page 24 and 25:
Page 26 and 27:
Page 28 and 29:
10 Hacking the Xbox: An Introductio
Page 30 and 31:
Page 32 and 33:
Page 34 and 35:
Page 36 and 37:
Page 38 and 39:
Page 40 and 41:
Page 42 and 43:
Page 44 and 45:
Page 46 and 47:
Page 48 and 49:
Page 50 and 51:
Page 52 and 53:
Page 54 and 55:
Page 56 and 57:
Page 58 and 59:
Page 60 and 61: 42 Hacking the Xbox: An Introductio
Page 85 and 86: CHAPTER 4 Building a USB Adapter Ca
Page 87 and 88: Strategy Chapter 4 - Building a USB
Page 89 and 90: Chapter 4 - Building a USB Adapter
Page 91 and 92: CHAPTER 5 Replacing a Broken Power
Page 93 and 94: Chapter 5 - Replacing a Broken Powe
Page 95 and 96: Strategy Chapter 5 - Replacing a Br
Page 101 and 102: Figure 5-6: The final cable assembl
Page 105: Chapter 5 - Replacing a Broken Powe
Page 118 and 119: 100 Hacking the Xbox: An Introducti
Page 137 and 138: CHAPTER 8 Reverse Engineering Xbox
Page 139 and 140: Chapter 8 - Reverse Engineering Xbo
Page 145 and 146: clearance for motherboard component
Page 155 and 156: CHAPTER 9 Sneaking in the Back Door
Page 157 and 158: Chapter 9 - Sneaking in the Back Do
Page 159 and 160: Chapter 9 - Sneaking in the Back Do
Page 161 and 162:
Chapter 9 - Sneaking in the Back Do
Page 163 and 164:
Page 165 and 166:
Page 167:
Note Chapter 9 - Sneaking in the Ba
Page 170 and 171:
152 Hacking the Xbox: An Introducti
Page 172 and 173:
Page 174 and 175:
Page 176 and 177:
Page 179 and 180:
CHAPTER 11 Developing Software for
Page 181 and 182:
Chapter 11 - Developing Software fo
Page 183 and 184:
Page 185 and 186:
Page 187 and 188:
Page 189 and 190:
Page 191 and 192:
CHAPTER 12 Caveat Hacker Reverse en
Page 193 and 194:
Chapter 12 - Caveat Hacker 175 tech
Page 195 and 196:
Chapter 12 - Caveat Hacker 177 type
Page 197 and 198:
Chapter 12 - Caveat Hacker 179 art
Page 199 and 200:
Chapter 12 - Caveat Hacker 181 tres
Page 201 and 202:
Chapter 12 - Caveat Hacker 183 Also
Page 203 and 204:
Chapter 12 - Caveat Hacker 185 oppo
Page 205 and 206:
Chapter 12 - Caveat Hacker 187 inte
Page 207 and 208:
Chapter 12 - Caveat Hacker 189 Such
Page 209:
Chapter 12 - Caveat Hacker 191 his
Page 212 and 213:
Page 214 and 215:
Page 216 and 217:
Page 218 and 219:
Page 220 and 221:
Page 222 and 223:
Page 224 and 225:
Page 226 and 227:
Page 228 and 229:
Page 230 and 231:
Page 232 and 233:
Page 234 and 235:
Page 236 and 237:
Page 238 and 239:
Page 240 and 241:
Page 242 and 243:
Page 244 and 245:
Page 246 and 247:
Page 248 and 249:
Page 250 and 251:
Page 252 and 253:
Page 255 and 256:
APPENDIX D Getting Started with FPG
Page 257 and 258:
Appendix D - Getting Started with F
Page 259 and 260:
Page 261 and 262:
Page 263:
Page 266 and 267:
Page 268 and 269:
Page 270 and 271:
Page 272 and 273:
Page 275 and 276:
APPENDIX F Xbox Hardware Reference
Page 277 and 278:
Appendix F - Xbox Hardware Referenc
Page 279 and 280:
Appendix F - Xbox Hardware Referenc
Page 281 and 282:
DVD-ROM Power Connector Appendix F
Page 283:
Fan Connector Appendix F - Xbox Har
Page 286 and 287:
268 continuity mode, in DMMs 19 Cop
Page 288 and 289:
270 Molex 76 Moore’s Law 5 Mosis
Page 290 and 291:
272 Virtex-II FPGA 123 Visor 139, 1
show all

Hacking the Xbox

Create successful ePaper yourself

Delete template?

Save as template?