Hacking the Xbox

Recommendations

Info

152 Hacking the Xbox: An Introduction to Reverse Engineering at a high speed. All of the legacy I/O and expansion functions are mapped into this high-bandwidth bus, enabling system designers to create so-called “Super I/O” chips that in turn enable Southbridge chips with a much lower pin count. In addition, segregating functions between Super I/O chips and Southbridge chips allows designers to choose Super I/O and Southbridge chip combinations that provide the optimal set of features for a given application. The LPC physical interface is quite simple. The interface is a 4-bit bidirectional bus that runs at a 33 MHz clock rate. The interface also has two “sideband” signals: one framing signal that indicates the start and end of LPC bus cycles, and one reset signal that forces all LPC peripheral devices into a known state for initialization purposes. In addition, there are a couple of optional signals for the LPC interface that provide DMA and interrupt capabilities as well as power management for more sophisticated I/O devices. (More information on the LPC bus and its protocol can be found in the Intel Low Pin Count (LPC) Interface Specification, version 1.1. The specification can be found on the Intel corporate website at http:// www.intel.com/design/chipsets/industry/lpc.htm.) LPC Interface on the Xbox The Xbox incorporates an LPC interface on the motherboard. The LPC interface in this case is used to implement a debug and test bus. One can connect a keyboard and mouse through this LPC interface, as well as an alternate boot ROM for diagnostic purposes. The LPC interface is activated to load alternate boot code when the FLASH ROM on the Xbox is not available. The lack of a FLASH ROM device can be simulated by forcing the lowest data bit (D0) of the FLASH ROM data bus to a level of zero volts. Many speculate that the LPC interface is an essential part of the Xbox production line because of the alternate boot ROM ability provided by the LPC interface. Fully assembled Xboxes can be configured with a comprehensive self-test program via the LPC interface. Applying the CPU as a fast test controller allows defective units to be quickly and efficiently isolated on the factory floor without the cost of expensive testing machines. For hackers, the alternate boot ROM facility provided by the LPC interface is an ideal mechanism for getting code into the Xbox. Valid LPC-loadable boot ROM images for the Xbox can be created by anyone since the cryptographically secured boot procedure of the Xbox is now fully understood. In fact, some vendors of alternate boot ROM devices for the Xbox have leveraged the regularity of the LPC interface’s pinout geometry on the Xbox 1 The circuits on a chip are typically surrounded by squares of metal (“bond pads”) that are wired to the pins on the chip’s packaging. A chip is said to be bond-pad limited when the area required for the ring of bond pads exceeds the area required by the circuitry inside the chip. The cost of excess pins becomes even higher in the case that a chip is bond-pad limited.
Chapter 10 - More Hardware Projects 153 motherboard to create ROM devices that install without any soldering. These devices use a set of spring-loaded “pogo-pins,” similar to those used during production for Xbox testing, to contact the LPC interface with just a pressure-fit. (The pinout of the LPC bus as implemented on the Xbox can be found in Appendix F, “Xbox Hardware Reference.”) Using the LPC Interface The fact that the LPC interface is an industry standard is quite convenient for Xbox hardware hackers. First, there is a plethora of LPC-compatible interface devices, ranging from Super-I/O chips to firmware ROMs with built-in LPC interfaces. Second, the wide acceptance of the LPC interface as a diagnostic and convenience bus for generic PCs helps mitigate the legal risk of using the LPC interface and selling LPC interface devices. A firmware ROM for the LPC interface can be sold without any Xbox-specific contents since end-users can easily reprogram their LPC bus devices using a simple, cheap adapter for their PC. A further help to the legality of LPC firmware devices is that the Xbox’s LPC connector pinout is nearly identical to the one recommended by Intel for generic PCs. As a result, an LPC firmware device sold for the Xbox is very similar to an LPC firmware device sold for the standard PC. One of the first LPC boot ROM devices was developed by Andy Green. The project is called “Cheapmod” and it is an SST 49LF020 device (256 kByte FLASH ROM with an integrated LPC interface) in a socket wired to an LPC-compatible header. According to Andy’s Cheapmod webpage, “http://warmcat.com/milksop/cheapmod.html,” “If you can get ahold of the $2.50 SST 49LF020, you can build an alternative BIOS for $4.” This device can be programmed using his “CheapLPC” programmer (http://warmcat.com/milksop/cheapLPC.html), a delightfully simple PC parallel-port based device that can (slowly) talk to and reprogram an LPC device. Many commercially available alternate firmware devices have been based off of or inspired by his design, including the Xodus/Matrix design. The Xodus/Matrix is a particularly interesting variant of Andy’s original design, as it was the first Xbox alternate firmware device to implement an entirely solderless installation procedure. This opened up the world of Xbox hacking to software-oriented hackers who were not inclined to solder wires into their Xboxes. (A photograph of the Xodus/Matrix can be seen in Figure 10-1.) The Xodus/Matrix device comes without any code programmed in it; the user must provide the alternate firmware image. There are some important functional considerations when selecting a FLASH ROM chip with an LPC interface for use with the Xbox. The most significant is that the native Xbox architecture allocates a 16 MB area for the boot ROM. If the physical boot ROM is smaller than 16 MB in size, the boot ROM contents are aliased to fill up the entire 16 MB space. This gives Xbox designers more flexibility in choosing the size of the ROM chip without causing problems with routines that uses both bottom- and toprelative addressing.
Page 1:
Hacking the Xbox An Introduction to
Page 4 and 5:
The US government is far and away t
Page 7 and 8:
Hacking the Xbox An Introduction to
Page 9:
In memory of Aaron Swartz
Page 12 and 13:
x Hacking the Xbox: An Introduction
Page 14 and 15:
xii Hacking the Xbox: An Introducti
Page 17:
Acknowledgments I would like to tha
Page 20 and 21:
2 Hacking the Xbox: An Introduction
Page 22 and 23:
Page 24 and 25:
Page 26 and 27:
Page 28 and 29:
10 Hacking the Xbox: An Introductio
Page 30 and 31:
Page 32 and 33:
Page 34 and 35:
Page 36 and 37:
Page 38 and 39:
Page 40 and 41:
Page 42 and 43:
Page 44 and 45:
Page 46 and 47:
Page 48 and 49:
Page 50 and 51:
Page 52 and 53:
Page 54 and 55:
Page 56 and 57:
Page 58 and 59:
Page 60 and 61:
Page 62 and 63:
Page 64 and 65:
Page 66 and 67:
Page 68 and 69:
Page 70 and 71:
Page 72 and 73:
Page 74 and 75:
Page 76 and 77:
Page 78 and 79:
Page 80 and 81:
Page 82 and 83:
Page 85 and 86:
CHAPTER 4 Building a USB Adapter Ca
Page 87 and 88:
Strategy Chapter 4 - Building a USB
Page 89 and 90:
Chapter 4 - Building a USB Adapter
Page 91 and 92:
CHAPTER 5 Replacing a Broken Power
Page 93 and 94:
Chapter 5 - Replacing a Broken Powe
Page 95 and 96:
Strategy Chapter 5 - Replacing a Br
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
Figure 5-6: The final cable assembl
Page 103 and 104:
Page 105:
Page 108 and 109:
Page 110 and 111:
Page 112 and 113:
Page 114 and 115:
Page 116 and 117:
Page 118 and 119:
100 Hacking the Xbox: An Introducti
Page 120 and 121: 102 Hacking the Xbox: An Introducti
Page 137 and 138: CHAPTER 8 Reverse Engineering Xbox
Page 139 and 140: Chapter 8 - Reverse Engineering Xbo
Page 145 and 146: clearance for motherboard component
Page 155 and 156: CHAPTER 9 Sneaking in the Back Door
Page 157 and 158: Chapter 9 - Sneaking in the Back Do
Page 167: Note Chapter 9 - Sneaking in the Ba
Page 179 and 180: CHAPTER 11 Developing Software for
Page 181 and 182: Chapter 11 - Developing Software fo
Page 191 and 192: CHAPTER 12 Caveat Hacker Reverse en
Page 193 and 194: Chapter 12 - Caveat Hacker 175 tech
Page 195 and 196: Chapter 12 - Caveat Hacker 177 type
Page 197 and 198: Chapter 12 - Caveat Hacker 179 art
Page 199 and 200: Chapter 12 - Caveat Hacker 181 tres
Page 201 and 202: Chapter 12 - Caveat Hacker 183 Also
Page 203 and 204: Chapter 12 - Caveat Hacker 185 oppo
Page 205 and 206: Chapter 12 - Caveat Hacker 187 inte
Page 207 and 208: Chapter 12 - Caveat Hacker 189 Such
Page 209: Chapter 12 - Caveat Hacker 191 his
Page 220 and 221:
Page 222 and 223:
Page 224 and 225:
Page 226 and 227:
Page 228 and 229:
Page 230 and 231:
Page 232 and 233:
Page 234 and 235:
Page 236 and 237:
Page 238 and 239:
Page 240 and 241:
Page 242 and 243:
Page 244 and 245:
Page 246 and 247:
Page 248 and 249:
Page 250 and 251:
Page 252 and 253:
Page 255 and 256:
APPENDIX D Getting Started with FPG
Page 257 and 258:
Appendix D - Getting Started with F
Page 259 and 260:
Page 261 and 262:
Page 263:
Page 266 and 267:
Page 268 and 269:
Page 270 and 271:
Page 272 and 273:
Page 275 and 276:
APPENDIX F Xbox Hardware Reference
Page 277 and 278:
Appendix F - Xbox Hardware Referenc
Page 279 and 280:
Appendix F - Xbox Hardware Referenc
Page 281 and 282:
DVD-ROM Power Connector Appendix F
Page 283:
Fan Connector Appendix F - Xbox Har
Page 286 and 287:
268 continuity mode, in DMMs 19 Cop
Page 288 and 289:
270 Molex 76 Moore’s Law 5 Mosis
Page 290 and 291:
272 Virtex-II FPGA 123 Visor 139, 1
show all

Hacking the Xbox

Create successful ePaper yourself

Delete template?

Save as template?