Hacking the Xbox

98
Hacking the Xbox: An Introduction to Reverse Engineering
of a crypto processor. Storing the boot block in the processor was also
deemed a less likely option than storing the boot block in the chipset.
The rationale for this analysis is based on the economics of building
chips. A Pentium III processor is very complex with many handcrafted
blocks, and modifying the silicon to include a secure boot block would
require significant engineering resources as well as an upfront investment
of about a quarter of a million dollars just for the masks needed to
produce the custom silicon. In addition, it was rumored that Microsoft
had originally chosen an AMD processor for the Xbox, and switched to
Intel at the last minute. If custom blocks were integrated into the
processor core, Microsoft could not have switched between CPU
vendors so easily. On the other hand, nVidia’s chipsets are designed
modularly using silicon compilers, so it is technically easier to add warts
like a secure boot block. Furthermore, the chipset in the Xbox is a
custom build of the nForce made just for Microsoft, tailored specifically
for an Intel front-side bus (FSB). As a result, the cost of adding a secure
boot block could be rolled into the engineering resources and the mask
sets already allocated to such a project.
Operating under the theory that the real boot code is located in a secret
ROM overlay in the chipset, the challenges remaining were to determine in
which chip (Northbridge or Southbridge) the code was stored, and how to
extract this secret ROM. A few strategies for extracting the secret ROM
presented themselves:
• Use the JTAG “boundary scan” feature on the Pentium to try
to capture the initial boot code. JTAG is a diagnostic bus that
allows you to read and set the state of every pin on a chip
through a special serial port. It is a very powerful and versatile
debugging tool.
• Probe the processor FSB (Front Side Bus) to try and capture
the boot code as it enters the processor.
Figure 6-3: Missing JTAG via. Note how the filled in copper region (lighter area)
has a hole where a via used to be. This is the result of a last-minute change to
the board layout without recalculation of the fill regions.