Hacking the Xbox

Recommendations

Info

122 Hacking the Xbox: An Introduction to Reverse Engineering tions available at the HyperTransport consortium’s website, were used to verify the assumption that the HyperTransport signalling convention is indeed being used. The HyperTransport bus is implemented on the Xbox motherboard with all the signals parallel and evenly spaced, a decision likely driven by the high operating speed of the bus. This makes the bus an ideal target for eavesdropping, except for the fact that it runs at such a high data rate. Eavesdropping a bus that runs at this speed requires special attention to the stub length of the eavesdropping traces (in order to preserve the integrity of the signals) and it also requires a rather expensive logic analyzer or a custom analyzer circuit. Ultimately, the Northbridge-Southbridge connection was chosen as the first bus to eavesdrop because it has by far the fewest wires, and therefore requires the least amount of soldering. The Northbrige-Southbridge connection has only ten unique signals, whereas both the FSB and the main memory have about one hundred signals each. Soldering a large number of connections not only consumes a large amount of time, but also greatly increases the risk of hardware failures due to solder bridges or damaged traces. Thus, minimizing the number of solder connections minimizes the risk of collateral damage to the motherboard. Eavesdropping a High Speed Bus I had committed to the HyperTransport eavesdropping approach in late January 2002. The significant technical issues with this approach were: • Tapping the high-speed differential bus without disrupting signal integrity • Finding or building a logging tool that could keep up with the 400 MB/s data rates on the HyperTransport bus • Determining the polarity and bit ordering of the differential HyperTransport bus traces on the motherboard Tapping the Bus on a Budget The first two issues are intimately linked. High-speed bus analysis and logging tools typically have proprietary interfaces that would require a custom adapter to the Xbox motherboard. The last issue, determining bit polarity and ordering, just requires a lot of post-processing and data massaging after the data logger is attached and functioning. HyperTransport is an open standard that has gained industry acceptance, meaning that off-the-shelf protocol analyzers and logging tools are available for the bus. One such example is the HyperTransport protocol analyzer by FuturePlus. Unfortunately, this protocol analyzer was priced in excess
Chapter 8 - Reverse Engineering Xbox Security 123 of $25,000 at the time the work was being done. In addition, the protocol analyzer requires the target board to be specially designed to accommodate the protocol analyzer’s bus interface pod. Instead of buying a protocol analyzer and investing the time and effort to adapt it for use with the Xbox, I built my own simplified one. This task is feasible because the HyperTransport protocol is quite simple. The Xbox implementation of HyperTransport uses two 8-bit unidirectional buses, one for transmit and one for receive. Each bus has a clock and a strobe line associated with it. The signaling standard requires valid data to be presented on each edge of the clock. The beginning of a new packet is indicated by the data lines leaving their idle state. The strobe line differentiates between command and data packets. All of the sideband signals typical of other busses, such as the address, read/write control, chip select, and interrupt lines, are handled in HyperTransport using in-band command packets. Hence, just ten differential signals (twenty wires) are all you need for eavesdropping the bus — great news for hackers. The HyperTransport protocol is simple enough, but what about finding something that can both physically interface to the Xbox bus and keep up with the 400 MB/s speeds? The ideal tool for building this HyperTransport bus tap would be an FPGA. However, at the time, no FPGA was available that could keep up with the high data rates and more importantly, no FPGA was available that was certified by the vendor for use with HyperTransport. Theoretically, a Xilinx Virtex-II FPGA would work for this application, but the product had just been launched and the devices were extremely pricey and hard to get (today, you can purchase a low-end Virtex-II FPGA for well under a hundred dollars). The best FPGA that I had on hand at the time was a Xilinx Virtex-E FPGA that I had previously designed into a prototype supercomputer network router as part of my thesis. The network router board used CTT (Center Tap Terminated) signaling for its network interfaces, and also had an Intel StrongArm processor on board for configuration, control, and debugging purposes. The challenge therefore boiled down to figuring out how to interface HyperTransport signals to CTT signals, and how to coax 400 MB/s performance out of an FPGA that wasn’t intended to run at those speeds. The HyperTransport signaling convention, it turns out, is a close relative of the more common LVDS (low voltage differential signaling) convention, specified in the TIA/EIA-644 standard. HyperTransport drivers create a signal with a differential swing of 600 mV typically, centered around a common mode voltage of 600 mV. LVDS receivers, on the other hand, can make sense out of data that has a differential swing of greater than 100 mV and a common mode voltage anywhere between 50 mV and 2.35 V. So LVDS receivers are directly compatible with HyperTransport drivers! (Although the Virtex-E supports a direct interface to LVDS signals, I could not take advantage of this because the Virtex-E parts I had were already designed into a system that is hard-wired for CTT signals.) If you are designing your own tap board, the best approach would be to use the native LVDS capabilities of the FPGA instead of the hack described
Page 1:
Hacking the Xbox An Introduction to
Page 4 and 5:
The US government is far and away t
Page 7 and 8:
Hacking the Xbox An Introduction to
Page 9:
In memory of Aaron Swartz
Page 12 and 13:
x Hacking the Xbox: An Introduction
Page 14 and 15:
xii Hacking the Xbox: An Introducti
Page 17:
Acknowledgments I would like to tha
Page 20 and 21:
2 Hacking the Xbox: An Introduction
Page 22 and 23:
Page 24 and 25:
Page 26 and 27:
Page 28 and 29:
10 Hacking the Xbox: An Introductio
Page 30 and 31:
Page 32 and 33:
Page 34 and 35:
Page 36 and 37:
Page 38 and 39:
Page 40 and 41:
Page 42 and 43:
Page 44 and 45:
Page 46 and 47:
Page 48 and 49:
Page 50 and 51:
Page 52 and 53:
Page 54 and 55:
Page 56 and 57:
Page 58 and 59:
Page 60 and 61:
Page 62 and 63:
Page 64 and 65:
Page 66 and 67:
Page 68 and 69:
Page 70 and 71:
Page 72 and 73:
Page 74 and 75:
Page 76 and 77:
Page 78 and 79:
Page 80 and 81:
Page 82 and 83:
Page 85 and 86:
CHAPTER 4 Building a USB Adapter Ca
Page 87 and 88:
Strategy Chapter 4 - Building a USB
Page 89 and 90: Chapter 4 - Building a USB Adapter
Page 91 and 92: CHAPTER 5 Replacing a Broken Power
Page 93 and 94: Chapter 5 - Replacing a Broken Powe
Page 95 and 96: Strategy Chapter 5 - Replacing a Br
Page 101 and 102: Figure 5-6: The final cable assembl
Page 105: Chapter 5 - Replacing a Broken Powe
Page 108 and 109: 90 Hacking the Xbox: An Introductio
Page 118 and 119: 100 Hacking the Xbox: An Introducti
Page 137 and 138: CHAPTER 8 Reverse Engineering Xbox
Page 139: Chapter 8 - Reverse Engineering Xbo
Page 143 and 144: Chapter 8 - Reverse Engineering Xbo
Page 145 and 146: clearance for motherboard component
Page 155 and 156: CHAPTER 9 Sneaking in the Back Door
Page 157 and 158: Chapter 9 - Sneaking in the Back Do
Page 167: Note Chapter 9 - Sneaking in the Ba
Page 179 and 180: CHAPTER 11 Developing Software for
Page 181 and 182: Chapter 11 - Developing Software fo
Page 191 and 192:
CHAPTER 12 Caveat Hacker Reverse en
Page 193 and 194:
Chapter 12 - Caveat Hacker 175 tech
Page 195 and 196:
Chapter 12 - Caveat Hacker 177 type
Page 197 and 198:
Chapter 12 - Caveat Hacker 179 art
Page 199 and 200:
Chapter 12 - Caveat Hacker 181 tres
Page 201 and 202:
Chapter 12 - Caveat Hacker 183 Also
Page 203 and 204:
Chapter 12 - Caveat Hacker 185 oppo
Page 205 and 206:
Chapter 12 - Caveat Hacker 187 inte
Page 207 and 208:
Chapter 12 - Caveat Hacker 189 Such
Page 209:
Chapter 12 - Caveat Hacker 191 his
Page 212 and 213:
194 Hacking the Xbox: An Introducti
Page 214 and 215:
Page 216 and 217:
Page 218 and 219:
Page 220 and 221:
Page 222 and 223:
Page 224 and 225:
Page 226 and 227:
Page 228 and 229:
Page 230 and 231:
Page 232 and 233:
Page 234 and 235:
Page 236 and 237:
Page 238 and 239:
Page 240 and 241:
Page 242 and 243:
Page 244 and 245:
Page 246 and 247:
Page 248 and 249:
Page 250 and 251:
Page 252 and 253:
Page 255 and 256:
APPENDIX D Getting Started with FPG
Page 257 and 258:
Appendix D - Getting Started with F
Page 259 and 260:
Page 261 and 262:
Page 263:
Page 266 and 267:
Page 268 and 269:
Page 270 and 271:
Page 272 and 273:
Page 275 and 276:
APPENDIX F Xbox Hardware Reference
Page 277 and 278:
Appendix F - Xbox Hardware Referenc
Page 279 and 280:
Appendix F - Xbox Hardware Referenc
Page 281 and 282:
DVD-ROM Power Connector Appendix F
Page 283:
Fan Connector Appendix F - Xbox Har
Page 286 and 287:
268 continuity mode, in DMMs 19 Cop
Page 288 and 289:
270 Molex 76 Moore’s Law 5 Mosis
Page 290 and 291:
272 Virtex-II FPGA 123 Visor 139, 1
show all

Hacking the Xbox

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?