Hacking the Xbox

Chapter 9 - Sneaking in the Back Door 141
Steil, the lead of the Xbox-Linux project, discovered a way to leverage
this feature.
The unmapping process is accomplished by writing to 0x8000.8008, a
hardware register in the PCI configuration space. The basic strategy is to
include a jam table opcode that writes to 0x8000.8008 and unmaps the
secret boot code before the initialization sequence is finished. Since the
caches are off at this time, the processor will start fetching and executing
instructions from the decoy block. Fortunately, since the decoy block can be
freely modified since it is part of the FLASH ROM. The catch, however, is
that the jam table interpreter blocks writes to location 0x8000.8008, so
this shouldn’t work. However, a bug in the decoding of the PCI configuration
space in the Southbridge chipset makes the unmap instruction respond
to multiple aliased addresses. In particular, the “function” bitfield is
ignored. Thus, a write to 0x8000.8X08 where X is not equal to 0 also does
the trick, and these writes are not blocked by the jam table interpreter.
Therefore, to gain control of the CPU IP using the MIST hack, you must
modify the decoy block in FLASH to contain your code, then add the
appropriate jam table opcode to unmap the secret boot ROM during
hardware initialization.
Microsoft Retaliates
The discovery of security holes prompted many to speculate that Microsoft
would be swift to rotate its security scheme. In August 2002, Xboxes with a
new motherboard quietly started to appear in Australia. The first official
word of the new security system came from an unlikely source: nVidia,
the producer of the chipsets used in the Xbox. Following an unspectacular
second quarter in 2002, an nVidia spokesperson cited this as the last
of a few reasons why the quarter went poorly:
“What we said about Xbox was that we reached a
volume discount milestone, further reducing the
margins. And that we will be taking an inventory
write off in Q2 related to the amount of Xbox
MCPs that were made obsolete when MSFT
transitioned to a new security code (by way of the
MIT hacker) and excess in nForce chipsets that we
built in anticipation of higher demand of Athlonbased
PCs.” — Derek Perez, PR Director, nVidia 2
2 From an article by the Inquirer, http://www.theinquirer.net/
?article=4735