Hacking the Xbox

100
Hacking the Xbox: An Introduction to Reverse Engineering
initializing the JTAG interface. Interestingly, TRST# was tied to the
internal ground plane, in a difficult to access area, permanently deactivating
the JTAG mechanism. Further inspection of the Xbox motherboard
revealed hints that the TRST# signal was stripped out at the last minute.
(The biggest hint of a missing via is a hole in a power trace perfectly
sized for a via near a cluster of vias dedicated to JTAG signals, as shown
in Figure 6-3.)
Another blow to the JTAG approach for extracting the secret ROM is
the fact that Intel’s JTAG scan codes are proprietary. Reverse engineering
the codes to a level where I could use them for extracting the secret boot
data was a major project on its own.
Giving up on the JTAG approach, the next method for extracting the secret
ROM was to strip the packaging off of the CPU, GPU, and MCPX and to
inspect the bare die with a microscope and search for any candidate ROM
structures. Package removal or “decapsulation” was accomplished by bathing
the chips in fuming hot sulfuric acid. (I don’t recommend trying this
approach at home; one time I spilled the toxic, corrosive solution all over
myself and thankfully, my protective gear was consumed instead of my
skin. Fuming sulfuric consumes organic material faster than a burning
flame.) Fuming nitric, also very toxic and dangerous, can also be used. While
I have not tried it myself, reports indicate that fuming nitric is more effective
at removing the epoxy encapsulation, especially in situations where selective
package removal is desired.
The manual inspection approach using a traditional visible light microscope
offered some hope; however, the technique is limited by the physics of
light. Not even the best visible microscopy technology can resolve a 150 nm
transistor, since the shortest wavelength of light is 450 nm (corresponding
to the color blue). I was hoping the secret code would be stored on the
chips using a traditional array ROM structure, with the metal lines defining a
1 or a 0 etched into the top metal layers which can be identified with an
optical microscope. The use of a hard-wired ROM structure is motivated by
cost: FLASH ROMs and fuse-based PROMs require extra processing and
manufacturing steps that can add significantly to the cost of the system,
whereas the use of top metal layers would be motivated by risk management
on the designer’s part. Top metal layers are the coarsest layers (so
coarse that an optical microscope may resolve them), and are thus the
cheapest layers to change if there is a bug in the ROM code. Also, during
initial bring-up, the top layer is the easiest to cut and jumper using a chip
repair machine knows as a FIB (focused ion beam) machine. Unfortunately,
a quick glance at the chip under the microscope revealed no such structures.
At this point, the only remaining option for extracting the secret ROM
was to probe the live Xbox hardware, in an effort to capture the code
during loading into the Xbox processor. Eavesdropping for code
upstream of the Southbridge chip and the FLASH ROM meant probing
either the Front Side bus, the Northbridge-Southbridge bus, or the main
memory bus. We’ll discuss the trade-offs of executing these probing
approaches in Chapter 8, after a short introduction to basic security
concepts in the next chapter.