Hacking the Xbox

154
Hacking the Xbox: An Introduction to Reverse Engineering
Figure 10-1: The solderless Xodus/Matrix alternate firmware device, showing
the spring-loaded “pogo-pin” contacts that enable a solderless connection to
the LPC connector on the Xbox motherboard.
Let’s make the concept of bottom- and top-relative addressing more
concrete with an example. The addresses for the 16 MB boot ROM area in
the Xbox spans from 0xFF00.0000 to 0xFFFF.FFFF. Programs on the
Xbox that use bottom-relative addressing will compute addresses using
0xFF00.0000 + offset (bottom address plus offset), while programs
that use top-relative addressing will use 0xFFFF.FFFF – offset (top
address minus offset). Suppose a 1 MB boot ROM is installed in the Xbox.
This means that the processor will see 16 identical copies of this 1 MB ROM
spread evenly over the 16 MB ROM address space. In other words, the
contents of the boot memory appear identical for every address A +
0xFF00.0000 + n * 0x0010.0000, n = 0 through 15, A = 0
through 0x000F.FFFF. As a result, programmers can pack data into the
smaller 1 MB boot ROM using both top- and bottom-relative addressing
without having to change any of their code: A valid copy of the ROM image