Hacking the Xbox

Chapter 8 - Reverse Engineering Xbox Security 131
The correct polarity of the eight data signals was determined by observing
the idle bus data bit pattern. The HyperTransport bus spends most of
its time in an idle state, so this is not difficult. If the idle pattern is
supposed to be all 0s, then any bit position that shows up as a 1 has its
polarity inverted. This was corrected in hardware by inserting an inversion
term in the FPGA on the appropriate wire.
Determining the correct bit ordering is much more difficult, however.
Operating under the assumption that data coming across the
HyperTransport bus must in large part come from the FLASH ROM, a 1’s
count was performed on a byte by byte basis. The theory is that the bus
ordering is a pure permutation, meaning that the number of binary 1’s in a
byte is preserved between the FLASH ROM data and the data captured by
the logger. Patterns of 1’s counts were lined up against each other to identify
candidate regions of correspondence between FLASH ROM and logged
data. Fortunately, the first few words to come across the HyperTransport
bus are some chipset-specific initializations that are located near the bottom
of FLASH memory, so finding a set of patterns that lined up correctly did
not take too long. A set of bytes from each ROM and the logger were
tabulated, and, with the aid of a short C program, columns of bits were
transposed until an ordering was found that made all of the row values
match up.
Making Sense of the Captured Data
Now that valid data traces have been extracted, the problem remains of
deciphering the meaning of it all. Before doing so, let us recap what we
know about the data we have collected thus far.
• Temporal correlation. The logged data, on a macroscopic scale,
should have a strong time correlation to the expected sequence of
initialization events: jam table initialization, followed by a decryption
step, followed by execution from RAM. The regions of the log traces
that correspond to each of these events can be determined by just
observing when large bursts of activity happen, followed by regions
of silence.
• Transaction lengths. Since the Pentium processor has both a
data and an instruction cache, all fetches on the HyperTransport bus
to FLASH ROM or the hidden boot ROM should come in evenlength
bursts of traffic.
• Guaranteed ordering. The collected data is time stamped and
chronologically correct, so if the first instruction fetched in the reset
vector can be identified in the data logs, the position and structure
of the remainder of the instructions can be deduced.
Initially, I neglected to check the macroscopic organization of data coming
across the HyperTransport bus, and this caused me some problems. The
simplified block diagram of the logging machine in Figure 8-7 would have
the log FIFO resetting each time the HyperTransport bus is reset. This