Zeus
03-19-2006, 01:03 PM
Barely a day has gone by since the <a href="http://www.maxconsole.net/?mode=news&newsid=6367" target="_blank">video release of the world's first Xbox 360 hack</a>. This has brought alot of controversy across a lot of forums at the web, some question what exactly this is, some question if it's real and some fear this will be the start of mass piracy on the Xbox 360, we have scoured the web to what we hopefully brings to you everything of any great worth which has been said with regards to this hack. The following information comes by way of <a href="http://www.xboxhacker.net/index.php?option=com_smf&Itemid=33&topic=481.160" target="_blank">XboxHacker.net</a> <a href="http://www.xbox-scene.com/xbox1data/sep/EEukZpklFAhkcWwSgZ.php" target="_blank">Xbox-Scene</a>.
Why isn't this so-called Hack getting released to the public ?
It's simple Thespecialist and his crew we believe done this hack for the pure challenge, it was intrinsic motivation that led them to this. If you see in the beginning of the video, they are taking a jibe at the MS security expert who said with the Xbox 360 we will see security levels higher than ever before. If it was released to the public (it appears not to strictly illegal), the creators could get into some serious trouble (In my honest opnion, despite the quote to follow), I don't think Microsoft would be too happy about their next generation console promising next generation security running copies of games within 4 months. Seeing as there hasn't really been time for a 360-scene development team to develop and build on applications such as Xbox Media Center and emulators for the Xbox 360, the only purpose of this hack would be to promote piracy (If released publicly) on the Xbox 360, which is certainly not what The Specialist and his crew want to do. Others of you have come up with theories that it was released to take the heat off the creators, and make way for a series of Xbox 360 mods in similar to fashion when TMBINC released the first GC Mod schematics. I seriously do not think TS and his crew have any intention of this, like I say they are clearly very talented guys, in most likely well paid jobs who have a passion for challenges such as hacking the Xbox 360. RobinsonD, one of the contributors can be quoted as saying -
Lets kill this once and for all. We could just upload the file through Tor or some open WLAN or use some other anonymous mechanism. But we wont. The fact is that it would simply enable spotty kids to steal games. Thats all its good for, no unsigned code & no region free. I have a certain ammount of sympathy for people with small kids (like me - the little buggers never put the disks away) but then MS should provide replacement disks for a nominal fee since you bought a license to use the software even if the media containing it is damaged.
It's not fear of lawyers that stops us releasing we simply dont advocate or encourage piracy.
My only hope for this hack is that it gives us a new attack vector against the Kernel & as Spec said, the guys at free60 are hackers, they can figure this out for themselves. Beyond that its a cheap and cheesey hack that spoofs the below par 'original disk detection' to boot a DVD+R. If MS would do the decent thing and give us some form of homebrew SDK (Like Sony did with the Net Yarozee - I had some fun with that!) then there'd be no excuse for any of this
The video isn't Fake
Alot of contributers to the project have had many an experience with this kind off stuff, none more so than The Specialist who also help hack the original Xbox Firmware. It is very true that there may just well have been another Xbox 360 round the back of the TV, but well it isn't a fake, not just by going the reputation of thos involved. TheSpecialist even released a new video, this time 100MB in size which has better audio quality and details.
As SeventhSon said, if this is a fake it should be easy to prove. Look at the stock DVD firmware and compare it with the CR protocol post and the Sector Decryptor. Hot Swap a game disk and go look at the place holders and see if you can find the CR data in the sectors specified. Heres the CR data for both of the Type 1 response in PGR3 PAL:
CID CD RD Sector Range
79 8D8AC269 EA9536DB FCB930 FCC92F
16 CBD9E4E1 62B5B3F7 20F8F0 2108EF
Obviously this doen't help the non technical people but there ought to be enough capable bodies out there who can debunk this IF it is a fake.
About the video: it was released for fun, not as 'proof'. A video can't proof anything actually. The proof is in the technical details in the HW section of this site, but of course, you'll need some knowledge to understand these. But like said before, if the info is not correct, we'll sure as hell be proven wrong soon
Anyway, If we had shown the back, ppl would have said that we had hid the xbox UNDER the table. if we had shown under the table, ppl would have said that we had hid the xbox IN the TV. If we had opened the TV, ppl would have said we had put a wireless receiver IN the TV. If we had shown all HW IN the TV, ppl would have said we had edited the video. Hehe.
Best frame you can see what your supposedly 360 is, is the frame just before the screen goes red.
I think the best 'proof' of this video is in the laser movement. It's reading the responses from disc, from the outer area. Try to get your 360's laser to do the same movement when YOU insert a DVD-R. Also, listen to the sound of the disc spinning up and try to get your drive to do that when you insert a backup.
The following comes from an article at <a href="http://www.xbox-scene.com/xbox1data/sep/EEukZpklFAhkcWwSgZ.php" target="_blank">Xbox-Scene</a>.
What Exactly is this Hack ?
The hack is a modified firmware of the Xbox 360 Hitachi-LG GDR-3120L DVD-ROM drive (the security in the Toshiba/Samsung TS-H943 is said to be similar, so it's probably also possible with this drive ... but it does require it's own hacked firmware of course).
If the firmware was released, what would it mean?
Right now the Xbox 360 DVD firmware can't be flashed via PC (and for us, end-users, even less directly by the Xbox 360 itself (Microsoft could probably flash the drive from Xbox360 tho)), because there's no software to do this. Of course, drivers and flashing software for Xbox360 DVD drives could probably be written (and some people have been working on this), but so far this has not been done (atleast not publicly).
So, that means you'd have to open your Xbox 360, open your DVD drive and desolder the chip where the firmware is stored on.
Each Xbox 360 DVD drive has a unique key, if that key doesn't match what your console is expecting your DVD drive will not work.
So next you will need to read your current firmware chip with special hardware (flash programmer), to find your unique DVD 16 byte key (stored at 0x4F00). Then you'll have to insert this key in the modified firmware (or patch your original firmware) and program this modified firmware back on the firmware chip. Then put the firmware chip back in the drive, close DVD drive and Xbox 360 and I guess you're done.
As said above the hack would allow you to run MS-signed and unmodified XEX files only, so that also means the game must be of right region (as changing the regionflag in the XEX header would break the signature). Unsigned, homebrew executables would of course not work, again because signature check would fail.
LIVE and Updates ...
Can you go on LIVE with this hack? Well the firmware isn't released, so noone can try, but I'd guess it would work yes. The Xbox 360 itself is fully in 'normal state', nothing is modified to the Xbox 360 itself, it just gets 'wrong' info from the DVD drive. Of course if you start modifying non-signed files (like textures, ini files, ...) in order to cheat on LIVE or so MS could easily check for that.
Can Microsoft stop this firmware hack with forced LIVE updates? They could probably try detect a basic modified DVD firmware, but anything the Xbox 360 asks to the DVD drive goes via the DVD firmware, and if the firmware is 'open' in the hands of the hackers the firmware can probably each time be modified again to give the reply to the console expects. Microsoft could maybe do more with a HW security update ... but I'll let them analyse that.
As you (should) know, all Xbox 360 executables (XEX files) are signed by Microsoft (with a private key only MS has). This means that if you try to change anything to the XEX file, the signature will be wrong and the file will not boot.
Now ... to protect from booting an exact copy of a game from a DVD-R or other recordable media, microsoft gave each XEX file a 'mediaflag'. This mediaflag tells the Xbox 360 from which media (cd-r, dvd-r, dvd+r, dvd-rw, hdd, dvdxbox, dvdxbox360, ...) the XEX is allowed to boot. Changing this mediaflag in the XEX header is not an option as it'll break the signature of the file (see above), so ... what's done in this firmware hack is 'break' the detection of the disc.
Retail games usually get a mediaflag where they only allow 'dvdxbox360' (Xbox 360 discs - different than a normal DVD because it has some specific bad sectors and special info in lead-in/out that can't be written with a standard dvd burner). The modified firmware will trick the DVD drive into reporting a DVD-R (or other) as a DVDXBOX360 to the Xbox 360.
Read Original Artice: <a href="<a href="http://www.maxconsole.net/?mode=news&newsid=6367" target="_Blank">
The Xbox 360 Firmware 100% Hacked - PGR3 Back Up Running *Update* Video Available!</a>
Why isn't this so-called Hack getting released to the public ?
It's simple Thespecialist and his crew we believe done this hack for the pure challenge, it was intrinsic motivation that led them to this. If you see in the beginning of the video, they are taking a jibe at the MS security expert who said with the Xbox 360 we will see security levels higher than ever before. If it was released to the public (it appears not to strictly illegal), the creators could get into some serious trouble (In my honest opnion, despite the quote to follow), I don't think Microsoft would be too happy about their next generation console promising next generation security running copies of games within 4 months. Seeing as there hasn't really been time for a 360-scene development team to develop and build on applications such as Xbox Media Center and emulators for the Xbox 360, the only purpose of this hack would be to promote piracy (If released publicly) on the Xbox 360, which is certainly not what The Specialist and his crew want to do. Others of you have come up with theories that it was released to take the heat off the creators, and make way for a series of Xbox 360 mods in similar to fashion when TMBINC released the first GC Mod schematics. I seriously do not think TS and his crew have any intention of this, like I say they are clearly very talented guys, in most likely well paid jobs who have a passion for challenges such as hacking the Xbox 360. RobinsonD, one of the contributors can be quoted as saying -
Lets kill this once and for all. We could just upload the file through Tor or some open WLAN or use some other anonymous mechanism. But we wont. The fact is that it would simply enable spotty kids to steal games. Thats all its good for, no unsigned code & no region free. I have a certain ammount of sympathy for people with small kids (like me - the little buggers never put the disks away) but then MS should provide replacement disks for a nominal fee since you bought a license to use the software even if the media containing it is damaged.
It's not fear of lawyers that stops us releasing we simply dont advocate or encourage piracy.
My only hope for this hack is that it gives us a new attack vector against the Kernel & as Spec said, the guys at free60 are hackers, they can figure this out for themselves. Beyond that its a cheap and cheesey hack that spoofs the below par 'original disk detection' to boot a DVD+R. If MS would do the decent thing and give us some form of homebrew SDK (Like Sony did with the Net Yarozee - I had some fun with that!) then there'd be no excuse for any of this
The video isn't Fake
Alot of contributers to the project have had many an experience with this kind off stuff, none more so than The Specialist who also help hack the original Xbox Firmware. It is very true that there may just well have been another Xbox 360 round the back of the TV, but well it isn't a fake, not just by going the reputation of thos involved. TheSpecialist even released a new video, this time 100MB in size which has better audio quality and details.
As SeventhSon said, if this is a fake it should be easy to prove. Look at the stock DVD firmware and compare it with the CR protocol post and the Sector Decryptor. Hot Swap a game disk and go look at the place holders and see if you can find the CR data in the sectors specified. Heres the CR data for both of the Type 1 response in PGR3 PAL:
CID CD RD Sector Range
79 8D8AC269 EA9536DB FCB930 FCC92F
16 CBD9E4E1 62B5B3F7 20F8F0 2108EF
Obviously this doen't help the non technical people but there ought to be enough capable bodies out there who can debunk this IF it is a fake.
About the video: it was released for fun, not as 'proof'. A video can't proof anything actually. The proof is in the technical details in the HW section of this site, but of course, you'll need some knowledge to understand these. But like said before, if the info is not correct, we'll sure as hell be proven wrong soon
Anyway, If we had shown the back, ppl would have said that we had hid the xbox UNDER the table. if we had shown under the table, ppl would have said that we had hid the xbox IN the TV. If we had opened the TV, ppl would have said we had put a wireless receiver IN the TV. If we had shown all HW IN the TV, ppl would have said we had edited the video. Hehe.
Best frame you can see what your supposedly 360 is, is the frame just before the screen goes red.
I think the best 'proof' of this video is in the laser movement. It's reading the responses from disc, from the outer area. Try to get your 360's laser to do the same movement when YOU insert a DVD-R. Also, listen to the sound of the disc spinning up and try to get your drive to do that when you insert a backup.
The following comes from an article at <a href="http://www.xbox-scene.com/xbox1data/sep/EEukZpklFAhkcWwSgZ.php" target="_blank">Xbox-Scene</a>.
What Exactly is this Hack ?
The hack is a modified firmware of the Xbox 360 Hitachi-LG GDR-3120L DVD-ROM drive (the security in the Toshiba/Samsung TS-H943 is said to be similar, so it's probably also possible with this drive ... but it does require it's own hacked firmware of course).
If the firmware was released, what would it mean?
Right now the Xbox 360 DVD firmware can't be flashed via PC (and for us, end-users, even less directly by the Xbox 360 itself (Microsoft could probably flash the drive from Xbox360 tho)), because there's no software to do this. Of course, drivers and flashing software for Xbox360 DVD drives could probably be written (and some people have been working on this), but so far this has not been done (atleast not publicly).
So, that means you'd have to open your Xbox 360, open your DVD drive and desolder the chip where the firmware is stored on.
Each Xbox 360 DVD drive has a unique key, if that key doesn't match what your console is expecting your DVD drive will not work.
So next you will need to read your current firmware chip with special hardware (flash programmer), to find your unique DVD 16 byte key (stored at 0x4F00). Then you'll have to insert this key in the modified firmware (or patch your original firmware) and program this modified firmware back on the firmware chip. Then put the firmware chip back in the drive, close DVD drive and Xbox 360 and I guess you're done.
As said above the hack would allow you to run MS-signed and unmodified XEX files only, so that also means the game must be of right region (as changing the regionflag in the XEX header would break the signature). Unsigned, homebrew executables would of course not work, again because signature check would fail.
LIVE and Updates ...
Can you go on LIVE with this hack? Well the firmware isn't released, so noone can try, but I'd guess it would work yes. The Xbox 360 itself is fully in 'normal state', nothing is modified to the Xbox 360 itself, it just gets 'wrong' info from the DVD drive. Of course if you start modifying non-signed files (like textures, ini files, ...) in order to cheat on LIVE or so MS could easily check for that.
Can Microsoft stop this firmware hack with forced LIVE updates? They could probably try detect a basic modified DVD firmware, but anything the Xbox 360 asks to the DVD drive goes via the DVD firmware, and if the firmware is 'open' in the hands of the hackers the firmware can probably each time be modified again to give the reply to the console expects. Microsoft could maybe do more with a HW security update ... but I'll let them analyse that.
As you (should) know, all Xbox 360 executables (XEX files) are signed by Microsoft (with a private key only MS has). This means that if you try to change anything to the XEX file, the signature will be wrong and the file will not boot.
Now ... to protect from booting an exact copy of a game from a DVD-R or other recordable media, microsoft gave each XEX file a 'mediaflag'. This mediaflag tells the Xbox 360 from which media (cd-r, dvd-r, dvd+r, dvd-rw, hdd, dvdxbox, dvdxbox360, ...) the XEX is allowed to boot. Changing this mediaflag in the XEX header is not an option as it'll break the signature of the file (see above), so ... what's done in this firmware hack is 'break' the detection of the disc.
Retail games usually get a mediaflag where they only allow 'dvdxbox360' (Xbox 360 discs - different than a normal DVD because it has some specific bad sectors and special info in lead-in/out that can't be written with a standard dvd burner). The modified firmware will trick the DVD drive into reporting a DVD-R (or other) as a DVDXBOX360 to the Xbox 360.
Read Original Artice: <a href="<a href="http://www.maxconsole.net/?mode=news&newsid=6367" target="_Blank">
The Xbox 360 Firmware 100% Hacked - PGR3 Back Up Running *Update* Video Available!</a>