Hacking the Xbox

Recommendations

Info

166 Hacking the Xbox: An Introduction to Reverse Engineering a set of custom CD-ROM images, since this would solve many of the CD/RW headaches that users have been experiencing. (Also note that it is possible to install in your Xbox an after-market DVD-ROM drive that has better compatibility with writeable CD formats, as discussed in the previous chapter.) Note “Project B” Keep in mind that Xbox-Linux is an active project that is constantly evolving. The most up-to-date instructions for installing GNU/Linux on the Xbox can be found at the Sourceforge Xbox-Linux website, and these instructions have been translated into at least a half-dozen languages at the time of this writing. If you are interested in contributing your talents to the Xbox-Linux project, there is a list of projects to-do on the Sourceforge Xbox-Linux website as well as some instructions on how to join the developer’s mailing list. There is a work in progress, referred to as “Project B” by the Xbox-Linux developers, to find a way to install and boot Xbox-Linux without any hardware modifications. The Project B moniker comes from the criteria defined for the awarding of a $200,000 prize offered by Michael Robertson, the CEO of Lindows. The “Project A” prize was $100,000 and it has been awarded to the first group to get Linux running on an Xbox with hardware modifications. The remaining $100,000 will be awarded to the individual or group that completes Project B. The asymmetric division of the prize money hints at the challenge of completing Project B. (More details on Project B can be found at the Sourceforge Xbox-Linux website at http:// xbox-linux.sourceforge.net/articles.php?aid=2002354043211.) There are a number of Project B strategies being pursued by various groups. The most conceptually simple approach is to factor the 2048-bit RSA key used to sign Xbox game disks. This approach is being pursued by OperationProjectX (http://sourceforge.net/projects/opx) using a distributed computing approach. Simply put, if the 2048-bit RSA key is factored to reveal Microsoft’s private key, anyone can forge Microsoft’s digital signature and create bootable game disks for the Xbox, given that Microsoft never removes from the Xbox kernel the ability to load programs from regular CD or CD/RW media. Significantly, Microsoft ships its games on 2layer DVD-9 format disks with special security structures. The Xbox firmware could be configured by Microsoft to only boot from disks that have this particular structure, regardless of the digital signature check. Since it is currently impossible to burn 2-layer DVDs using a common DVD burner drive, requiring secured DVD-9 media as the only source for executables would present an impairment to distributing Xbox-Linux through free downloads off the Internet. The other problem with this approach is that the chance of successfully factoring the Xbox’s private key through a brute force search is very, very small. (Chapter 7, “A Brief Primer on Security,”
Chapter 11 - Developing Software for the Xbox 167 contains a sidebar on “Very Difficult Problems” that attempts to communicate the computational difficulty of this task.) If the private key is successfully recovered within a reasonable amount of time by this approach, it will significantly reduce people’s confidence in the RSA algorithm. (On the other hand, you can never win the lottery if you don’t buy a ticket, and running a free distributed factoring client using the spare cycles on your CPU is much cheaper than a Powerball ticket.) Another approach, related to cracking the RSA-2048 bit key, is to modify an existing, signed Xbox executable in a useful manner without changing its cryptographic hash value. Such a constructive hash collision would make the modified executable look identical to the original as far as the digital signature check is concerned. The hash used in the Xbox’s digital signature algorithm is SHA-1. SHA-1 is a 160-bit hash with no publicly known algorithmic weaknesses; since the source of the hash is fixed, about 2 160 random variations would have to be tried to discover a collision. As a side note, you can’t use a birthday attack to reduce the difficulty of the attack to 2 80 random variations because we are not trying to find two messages that hash to the same arbitrary value. The goal is to generate a specific target hash, or perhaps one of a very limited set of target hashes harvested from the set of all published Xbox game titles. Hence, this approach also falls into the category of “Very Difficult Problems.” Figure 11-1: The Xbox-Linux core team at the 19 th annual Chaos Computer Conference, held in Berlin, Germany. In the back, Michael Steil; in the front, from left to right: Andy Green, Milosch Meriac, and Franz Lehner. (Photograph courtesy of Gerhard Farfeleder.)
Page 1:
Hacking the Xbox An Introduction to
Page 4 and 5:
The US government is far and away t
Page 7 and 8:
Hacking the Xbox An Introduction to
Page 9:
In memory of Aaron Swartz
Page 12 and 13:
x Hacking the Xbox: An Introduction
Page 14 and 15:
xii Hacking the Xbox: An Introducti
Page 17:
Acknowledgments I would like to tha
Page 20 and 21:
2 Hacking the Xbox: An Introduction
Page 22 and 23:
Page 24 and 25:
Page 26 and 27:
Page 28 and 29:
10 Hacking the Xbox: An Introductio
Page 30 and 31:
Page 32 and 33:
Page 34 and 35:
Page 36 and 37:
Page 38 and 39:
Page 40 and 41:
Page 42 and 43:
Page 44 and 45:
Page 46 and 47:
Page 48 and 49:
Page 50 and 51:
Page 52 and 53:
Page 54 and 55:
Page 56 and 57:
Page 58 and 59:
Page 60 and 61:
Page 62 and 63:
Page 64 and 65:
Page 66 and 67:
Page 68 and 69:
Page 70 and 71:
Page 72 and 73:
Page 74 and 75:
Page 76 and 77:
Page 78 and 79:
Page 80 and 81:
Page 82 and 83:
Page 85 and 86:
CHAPTER 4 Building a USB Adapter Ca
Page 87 and 88:
Strategy Chapter 4 - Building a USB
Page 89 and 90:
Chapter 4 - Building a USB Adapter
Page 91 and 92:
CHAPTER 5 Replacing a Broken Power
Page 93 and 94:
Chapter 5 - Replacing a Broken Powe
Page 95 and 96:
Strategy Chapter 5 - Replacing a Br
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
Figure 5-6: The final cable assembl
Page 103 and 104:
Page 105:
Page 108 and 109:
Page 110 and 111:
Page 112 and 113:
Page 114 and 115:
Page 116 and 117:
Page 118 and 119:
100 Hacking the Xbox: An Introducti
Page 120 and 121:
Page 122 and 123:
Page 124 and 125:
Page 126 and 127:
Page 128 and 129:
Page 130 and 131:
Page 132 and 133:
Page 134 and 135: 116 Hacking the Xbox: An Introducti
Page 137 and 138: CHAPTER 8 Reverse Engineering Xbox
Page 139 and 140: Chapter 8 - Reverse Engineering Xbo
Page 145 and 146: clearance for motherboard component
Page 155 and 156: CHAPTER 9 Sneaking in the Back Door
Page 157 and 158: Chapter 9 - Sneaking in the Back Do
Page 167: Note Chapter 9 - Sneaking in the Ba
Page 179 and 180: CHAPTER 11 Developing Software for
Page 181 and 182: Chapter 11 - Developing Software fo
Page 183: Chapter 11 - Developing Software fo
Page 191 and 192: CHAPTER 12 Caveat Hacker Reverse en
Page 193 and 194: Chapter 12 - Caveat Hacker 175 tech
Page 195 and 196: Chapter 12 - Caveat Hacker 177 type
Page 197 and 198: Chapter 12 - Caveat Hacker 179 art
Page 199 and 200: Chapter 12 - Caveat Hacker 181 tres
Page 201 and 202: Chapter 12 - Caveat Hacker 183 Also
Page 203 and 204: Chapter 12 - Caveat Hacker 185 oppo
Page 205 and 206: Chapter 12 - Caveat Hacker 187 inte
Page 207 and 208: Chapter 12 - Caveat Hacker 189 Such
Page 209: Chapter 12 - Caveat Hacker 191 his
Page 234 and 235:
Page 236 and 237:
Page 238 and 239:
Page 240 and 241:
Page 242 and 243:
Page 244 and 245:
Page 246 and 247:
Page 248 and 249:
Page 250 and 251:
Page 252 and 253:
Page 255 and 256:
APPENDIX D Getting Started with FPG
Page 257 and 258:
Appendix D - Getting Started with F
Page 259 and 260:
Page 261 and 262:
Page 263:
Page 266 and 267:
Page 268 and 269:
Page 270 and 271:
Page 272 and 273:
Page 275 and 276:
APPENDIX F Xbox Hardware Reference
Page 277 and 278:
Appendix F - Xbox Hardware Referenc
Page 279 and 280:
Appendix F - Xbox Hardware Referenc
Page 281 and 282:
DVD-ROM Power Connector Appendix F
Page 283:
Fan Connector Appendix F - Xbox Har
Page 286 and 287:
268 continuity mode, in DMMs 19 Cop
Page 288 and 289:
270 Molex 76 Moore’s Law 5 Mosis
Page 290 and 291:
272 Virtex-II FPGA 123 Visor 139, 1
show all

Hacking the Xbox

Create successful ePaper yourself

Delete template?

Save as template?