Hacking the Xbox

Chapter 6 - The Best Xbox Game: Security Hacking 99
• Install a memory sniffer to try and capture the decrypted data
stream as it is written into memory.
• Use microscopy to read out the contents of the secure boot
area from the chip surface.
• Probe the bus between the Southbridge and the
Northbridge chips to try and capture the boot code being sent
to the processor by the chipset. This would only work if the boot
data is stored somewhere in the Southbridge chip.
None of these theories were trivial to test, so the Xbox hacking effort slowly
ground down to a halt as frustrated hackers gave up trying to cryptanalyze
the FLASH ROM image. I would have been one of the quitters (after all, I
had a doctoral thesis to finish and write in just a few months) had it not
been for the community of determined hackers feeding me encouragement.
Over Christmas break in December 2001, I kept in touch with my hacker
friends via IRC channels and web fora. Hackers from all over the world and
all walks of life pervaded the Xbox hacking IRC channel, and I enjoyed
learning from them and chatting with them about their various experiences,
both technical and personal.
Even though I was determined to spend all of January writing my PhD
thesis 6 and avoiding Xbox hacking, I was still pulled in by the intriguingly
complex security employed by the Xbox. As time went on, the need for a
hardware guy to join the small group of hardcore hackers hanging out on
the IRC channel became increasingly clear. By the end of January, the reports
I was hearing about the Xbox security scheme were too interesting to
ignore.
I purchased a second Xbox and I started removing all of its key parts using
a hot air gun. Stripping down the Xbox served many purposes. First,
removing the chips exposed all of the traces and connections on the Xbox
so that I could easily follow the connections between chips using the
continuity test mode on my multimeter. Second, I was able to drop all of
the interesting chips into a hot acid bath and remove their plastic encapsulation
for analysis under a microscope. Finally, buying an Xbox and totally
ripping it apart gave me a sort of peace of mind when it comes to probing
and modifying a working Xbox. (Reverse engineering is like gardening.
Planting a garden is much more challenging if you’re trying to keep your
hands and knees clean, so you might as well get over it and start rolling in
the dirt.)
The results of the Xbox tear-down revealed some of the measures that
Microsoft took to secure the box against hardware hackers. For example, I
first checked the JTAG connections on the Pentium CPU. All of the JTAG
signals were conveniently routed to a set of easy-to-tap resistors near the
processor, except for one, the TRST# signal. TRST# plays a critical role in
6 For those interested in supercomputer architecture, data and
thread migration, fault tolerance, high speed low-latency
networks, or massively multithreaded machines, check out my
thesis at http://www.xenatera.com/bunnie/phdthesis.pdf.