Hacking the Xbox

138
Hacking the Xbox: An Introduction to Reverse Engineering
A Commentary on Naming
Conventions
Hacking communities often invent their own terminology
for important concepts, which can vary from community to
community and from industry standard terminology. The
following is the list of terminologies accepted by the Xbox-
Linux community. Any deviations from the terminology I use
in this book are noted.
• X-code: Jam table opcodes; the opcodes
used by the secret Southbridge (MCPX) boot
ROM to initialize the Xbox hardware
• 2BL: Second boot loader. This is the code that is
decrypted by the secret boot ROM. It is called
the second boot loader because this code’s
primary responsibility is to decrypt and
decompress a kernel image.
• Flash Boot Loader: In version 1.1 security, this is
an intermediate boot loader in between the
secret boot ROM and the 2BL. The FBL is verified
by a lightweight hash against a hard-coded
value within the secret boot ROM. As a result,
the FBL cannot be changed without changing
the MCPX silicon. The FBL is responsible for
verifying the digital signature on all critical
portions of the FLASH ROM.
• Kernel: The Xbox kernel code. It is stored
compressed and encrypted in the FLASH ROM.
• Version 1.0 security: The original Xbox security
system using RC-4 encryption on the 2BL.
• Version 1.1 security: The second Xbox security
system using the TEA hash to verify regions of the
FLASH ROM. The earliest manufacturing date
seen on boxes with version 1.1 security is around
August 2002.
The previous chapter described my eavesdropping attack on the Xbox
security mechanism that eventually yielded the RC-4 key hidden in a block of
secret code. This chapter describes a few of the other attacks available on the
Xbox that were devised by my colleagues, as well as the attack that was
mounted on the revised Xbox security scheme, herein referred to as security
version 1.1.
Back Doors and Security Holes
A class of back door attacks on the Xbox leverage a fundamental
weakness in the way the hardware is initialized by the secret boot code.