Hacking the Xbox

132
Hacking the Xbox: An Introduction to Reverse Engineering
seems like a fine idea, however I originally incorrectly assumed that the
HyperTransport bus is reset only once upon the application of power. In
reality, the HyperTransport bus is reset a second time following the jam table
initialization step. Thus, when I first started looking at traces, all I saw was
the encrypted data plus a smattering of code, none of which could really be
lined up in any logical fashion with a boot vector.
Imagine how disappointing that was! I took a step back and observed the
HyperTransport bus events on an oscilloscope with the time scale set at
the milliseconds per division. I observed that there was an earlier reset
pulse, and after adjusting the trigger mechanism to catch only the first
pulse, the boot instruction was easy to identify. The sixteen bytes at
0xFFFF.FFF0 in the secret ROM happened to be identical to the same
sixteen bytes in the FLASH ROM. From that point, I tracked the current
value of the program counter by performing a lot of grungy tracing and
disassembling with bookkeeping, so that I could place each instruction
block at the correct location in memory. Every cache line fetch consisted
of 16 or 32 consecutive bytes of memory, resulting in a distinctive data
logger time stamp pattern which aided the reverse engineering process.
After a few hours of sifting through traces looking for cache lines, I had
More Tools of the Trade: Software
Analysis Tools
Inevitably at some point in your hacking experiences, you
will come across a need to disassemble some assembly
language code. I was introduced to an excellent tool for
this job by some fellow software hackers in January 2002
while I was reverse engineering the Xbox security. The tool is
called “IDA Pro” by Ilfak Guilfanov, sold by DataRescue Corporation
(http://www.datarescue.com/idabase/). IDA Pro is capable
of disassembling not only x86 code, but a huge variety
of embedded processors’ code as well. The quality of
IDA Pro’s output is also very high: Code segments are automatically
annotated and organized for readability. IDA Pro
also features a vast array of useful and fun tools. Some of my
favorites include the ability to automatically pattern match
code library signatures to function calls, and the ability to
follow jumps at the press of a key.
Another tool that was quite handy during the code analysis
was HackMan. HackMan is freeware from
TechnoLogismiki Corporation (http://www.technologismiki.com/
hackman/). It is nominally a “hex editor,” i.e., a file editor that
allows you to manipulate binary data directly, but it has a
lot of unique capabilities that go far beyond simple editing.
For example, HackMan has a built in disassembler. The
disassembler is not as powerful as IDA Pro, but it is interactive
with the hex editor. This allowed me to rapidly test candidate
cache lines for valid code while tracing through the
data logs, while assembling the final binary image of the
secret ROM.