Hacking the Xbox

120
Hacking the Xbox: An Introduction to Reverse Engineering
Our next eavesdropping candidate, the main memory bus, is a 128-bit
data bus plus address and control signals running at 200 MHz with
double data rate (DDR) clocking. The memory bus uses a signaling
convention known as SSTL-2. (The details of this bus can be inferred by
reading the datasheet for the Samsung K4D263238M memory part,
available at the Samsung Electronics website.) Despite its higher speeds,
eavesdropping the main memory bus is probably easier than eavesdropping
the processor FSB, because of the empty (spare) memory footprints
designed into the Xbox motherboard.
A relatively inexpensive, standard 100-pin TQFP adapter (Thin Quad Flat
Pack, a rectangular chip package with 100 gull-wing shaped pins) could be
soldered onto the empty memory footprints. These adapters would provide
convenient probe points for connecting a logic analyzer. The problem with
this approach is that you can only capture data that is written to main
memory. Decryption keys are generally read-only data, and read-only
More About High Speed
Information Transmission
Eavesdropping and modifying data on computer buses is
a powerful technique that is difficult to counter. In order to
understand how to eavesdrop, you will need a little bit of
background on how digital information is transmitted inside
a computer.
There are two major categories of signaling standards: singleended
and differential. The transmission of digital information
over a wire requires a translation into physical quantities
such as voltage and current. Classically, signals were
defined in terms of voltages measured with respect to a
common reference potential called the “ground.” This kind
of signaling is known as single-ended or unbalanced signaling.
Unfortunately, the idea of a ground reference point
only works when signals change slowly with respect to their
propagation time. In reality, every change in potential is
accompanied by a flow of current. The laws of nature demand
that current be conserved, i.e., for every flow of current
in one direction, there must be a flow of current in the
reverse direction. In single-ended signaling, the reverse current,
also known as a return current, must find its way back
through the “ground”. At very high speeds, the return paths
for current do not necessarily follow the same path as the
signal current. This imbalance results in a distorted signal.
Di ferential signaling combats this problem by using two wires
to transmit a signal, with one wire used for the signal current
and the other used for an explicit return current path. The
differential approach allows the signal and return paths to
be laid out so that they track each other, ensuring that the
flow of current is balanced. The result is a more robust signal
transmission system at the cost of twice the number of wires.
(continued)