Hacking the Xbox

152
Hacking the Xbox: An Introduction to Reverse Engineering
at a high speed. All of the legacy I/O and expansion functions are
mapped into this high-bandwidth bus, enabling system designers to create
so-called “Super I/O” chips that in turn enable Southbridge chips with a
much lower pin count. In addition, segregating functions between Super
I/O chips and Southbridge chips allows designers to choose Super I/O
and Southbridge chip combinations that provide the optimal set of
features for a given application.
The LPC physical interface is quite simple. The interface is a 4-bit bidirectional
bus that runs at a 33 MHz clock rate. The interface also has two
“sideband” signals: one framing signal that indicates the start and end of
LPC bus cycles, and one reset signal that forces all LPC peripheral devices
into a known state for initialization purposes. In addition, there are a couple
of optional signals for the LPC interface that provide DMA and interrupt
capabilities as well as power management for more sophisticated I/O
devices. (More information on the LPC bus and its protocol can be found in
the Intel Low Pin Count (LPC) Interface Specification, version 1.1. The
specification can be found on the Intel corporate website at http://
www.intel.com/design/chipsets/industry/lpc.htm.)
LPC Interface on the Xbox
The Xbox incorporates an LPC interface on the motherboard. The LPC
interface in this case is used to implement a debug and test bus. One can
connect a keyboard and mouse through this LPC interface, as well as an
alternate boot ROM for diagnostic purposes. The LPC interface is activated
to load alternate boot code when the FLASH ROM on the Xbox is not
available. The lack of a FLASH ROM device can be simulated by forcing the
lowest data bit (D0) of the FLASH ROM data bus to a level of zero volts.
Many speculate that the LPC interface is an essential part of the Xbox
production line because of the alternate boot ROM ability provided by the
LPC interface. Fully assembled Xboxes can be configured with a comprehensive
self-test program via the LPC interface. Applying the CPU as a fast test
controller allows defective units to be quickly and efficiently isolated on the
factory floor without the cost of expensive testing machines.
For hackers, the alternate boot ROM facility provided by the LPC interface is
an ideal mechanism for getting code into the Xbox. Valid LPC-loadable
boot ROM images for the Xbox can be created by anyone since the cryptographically
secured boot procedure of the Xbox is now fully understood. In
fact, some vendors of alternate boot ROM devices for the Xbox have
leveraged the regularity of the LPC interface’s pinout geometry on the Xbox
1 The circuits on a chip are typically surrounded by squares of
metal (“bond pads”) that are wired to the pins on the chip’s
packaging. A chip is said to be bond-pad limited when the
area required for the ring of bond pads exceeds the area
required by the circuitry inside the chip. The cost of excess pins
becomes even higher in the case that a chip is bond-pad
limited.