Hacking the Xbox

164
Hacking the Xbox: An Introduction to Reverse Engineering
(Profile: Michael Steil, continued)
[We’re] not “Anti-MS” or “MS-haters.” We dislike their market in
strategy, so we have a rational reason to work against them.
Is there anything more you’d like to say about the $200k prize
for Xbox-Linux?
I think that the award didn’t attract people that wanted to
see some money: Now one month after the deadline, the
money still hasn’t been distributed yet and still not a single
person has sent me a single question about when he will get
the money. The award attracted the press; we got more publicity,
and this way we got more hackers. But nobody did it
because of the money. So we don’t want to be regarded as
being paid for the job by Michael Robertson. A good proof is
that we’re still all active after the deadline.
Can you tell us more about your “MIST X-Code hack”?
Some time after bunnie’s original hack, Andy extracted the
MCPX ROM completely and Steve, Paul , and I started to analyze
the code, and I reverse-engineered the X-Code interpreter
contained within it. When looking for bugs that could be used
to escape the X-Code interpretation loop, I found that a part
of the code had already been written with our attacks in mind.
This is my original disassembly:
cmp ebx, 80000880 ; ISA Bridge, MCPX disable?
jnz short not_mcpx_disable
; BUG: too specific: bits 24 to 30
; undefined and ignored by PCI hardware!
and ecx, not 2 ; clear bit 1 (MCPX ROM will be
; turned off by setting bit 1)
not_mcpx_disable:
mov eax, ebx
mov dx, 0CF8h
out dx, eax ; PCI configuration address
add dl, 4
mov eax, ecx
out dx, eax ; PCI configuration data
jmp short next_instruction
I had been working with “PCI configuration” before, therefore
I knew that the test for the attack was too specific: Similar
codes would do the same, but they pass the test. So the MS
developers had a good idea, but the implementation was
wrong, thus telling us about their idea this way!
I sent my idea to Andy, Steve, and Paul, and they verified after
a short time that 0x88000880 worked just as well as 0x80000880
to turn off the MCPX ROM and exiting the interpreter by mapping
the interpreter code out of memory!