Hacking the Xbox

130
Hacking the Xbox: An Introduction to Reverse Engineering
HyperTransport bus
reset line
HyperTransport
Data (200 MHz DDR)
HyperTransport
Clock
Adjust clocking phase on a bit
by bit basis to compensate for
FPGA delays
Dual-edge
triggered
data demux
9 9
D QP
div by 2
div by 2
QN
2x200 MHz
SDR
9
4x100 MHz
SDR
Quad-phase
data demux
9
DP QPP
9
QPN
DN
9
QNP
9
QNN
32-bit up
counter
RESET
Align
vs
Clock Phase
32
4
compare
and trigger
2 kB x 36
deep FIFO
memory
Figure 8-7: Block diagram of the data logger built in the Xilinx Virtex-E FPGA.
data
sequence
count
logged
data
alignment
automated place-and-route tool handle the non-critical parts of the
circuit. Figure 8-7 shows the overall design that was used to capture the
data on the HyperTransport bus.
read
strobe
The design is fairly simple in concept: take the high speed data off of the
HyperTransport bus and clock it into four phases of a quarter speed clock,
creating a data stream that is four times slower but four times wider. This
confines all hand-placing and tweaking to just the first few input flip flops.
Next, realign the data using a set of delays and rotators, and store the data
one piece at a time inside a first in, first out (FIFO) memory. The signal that
triggers the start of FIFO capture is generated by a timer-comparator that
starts counting up from first reset. Long windows of data can be captured
by concatenating the results of multiple runs, each with the capture trigger
point delayed from the previous. A later optimization applied to the trigger
circuit is a “do not store zeros” (DNSZ) function. In the DNSZ mode, data
consisting of all 0’s is not stored in the FIFO. This is helpful in culling out
all of the idle data on the HyperTransport bus. The resulting data traces are a
time-stamped series of 32-bit words.
The most difficult part of the FPGA data logger design was calibrating the
delays on the input paths. Delay calibration was accomplished by using an
oscilloscope to probe a small window of data on the HyperTransport bus.
Wire delays and byte-wide rotations were tweaked until the probed data
matched the log data. This process was aided by the fact that during idle
times, a common sequence of commands was repeated on the bus every
few hundred microseconds, which served as the calibration reference.
Determining the Bus Order and Polarity
The final challenge after logging the data is figuring out the order of the
signals on the HyperTransport bus and their polarities. Note that while the
two most important signals of the HyperTransport bus on the Xbox
motherboard are labeled for us, the remaining eight data lines have ambiguous
polarity and bit ordering.