Hacking the Xbox

44
Hacking the Xbox: An Introduction to Reverse Engineering
Binary and Hexadecimal Numbers (continued)
Bin Dec Hex Bin Dec Hex
0000 0 0 1000 8 8
0001 1 1 1001 9 9
0010 2 2 1010 10 A
0011 3 3 1011 11 B
0100 4 4 1100 12 C
0101 5 5 1101 13 D
0110 6 6 1110 14 E
0111 7 7 1111 15 F
Table 2-2: Binary, decimal, and hexadecimal conversion table.
The heart of a CPU is a tiny, but very fast, memory called the register file.
Multiple pieces of data can be written into and read out of a register file
each processor clock cycle. Data from the register file is fed into an
execution unit called the arithmetic logic unit (ALU). The function
computed by the ALU is controlled by instructions fetched from
memory. Once the data has been processed by the ALU, it can either be
written back into the register file, or stored into memory.
One important performance feature of almost every modern CPU is a
memory access accelerator called a cache. Caches are small, fast memories
that store copies of data and instruction snippets that are likely to be
used in the near future by the CPU core. Caches are slower than register
files but faster than main memory; likewise, caches store more data than a
register file, but store less data than main memory.
One important feature of the Xbox CPU cache to be aware of is that it is
a writeback cache. Writeback caches allow copies of data stored inside
the CPU to be out of sync with what exists in main memory. This timing
difference can complicate attempts to trace CPU execution by observing
external memory traffic alone. The cache memory can also be leveraged
by security routines to hide intermediate computation results from
someone observing the memory bus.
Northbridges and Southbridges
The terms Northbridge and Southbridge are vernacular specific to the
PC architecture. They refer to the two basic support chips that are found
in virtually every PC. A Northbridge chip connects the CPU to main
memory as well as any high-performance expansion busses, such as AGP
and PCI. A Southbridge chip hangs off of the Northbridge chip and
contains all of the extra peripherals that are found in a typical PC —
parallel, serial, USB, mouse, keyboard, IDE controllers, audio codecs,