|
Bunnie about Xbox 360 Kiosk Demo DiscPublished by patto on Monday, January 02, 2006
' Bunnie posted some comments on his blog about the recent findings with the Xbox360 Kiosk Demo Disc '
Andrew "bunnie" Huang is one of the main guys behind the original Xbox hacking, he's also known for his book "Hacking the Xbox". Here's what he said on his blog:
I've also been observing the progress on the Xbox360 hacking, and I'm impressed. The hacking scene is more or less an organized anarchy that is frightfully productive. Now that I've had a little brush with being a manager in my day job, I can see that clarity of purpose obviates the need for management; people just self-organize and things happen. I could ponder on this for many parargaphs, but I'll spare you my treatise on human social behavior.
At any rate, some very interesting things are afoot. Much of it stems from the discovery of an all-media bootable kiosk demo disk. Many hackers will instantly recognize the value of this, but it's still interesting to reflect on the significance of this find.
Like the original Xbox, the Xbox360 uses a media flag on its executables. The media flag tells the OS what type of media it should be on; typically, games are released with the flag set to Microsoft's proprietary secure Xbox DVD format (which is in itself not that secure...). Significantly, only the executable is signed for a game; the data sections typically are not signed (presumably for performance reasons). Thus, one has the ability to fuzz the executable by corrupting the data sections, potentially invoking a buffer overrun or some other unintentional behavior-if one could effectively modify the data sections. Remember that this is normally not possible, since modifying the data segment requires making a copy to a writeable media, and this contradicts the signed media flag.
Thus, the run-anywhere demo disk now enables software hackers to create and test the interaction of signed executables with modified game data using no tool other than a DVD-RW drive (and an Xbox360 console, still considerably rare and difficult to obtain in the US). Some of the more interesting modifiable data regions include Shockwave Flash movies, and the pixel shaders executed by the GPU (more info can be found on the xboxhacker.net website). Of particular interest is the MEMEXPORT shader command in the 360, which could enable people to dump physical memory to the screen (where it can be digitized or extracted with a sniffer upstream of the ANA chip), or to some other peripheral function. Presuming plaintext kernel code can be extracted this way, it bootstraps further efforts in vulnerability analysis of the code running in the Xbox...and so forth. Of course, its quite possible that this hole is plugged, since Microsoft's NGSCB spec calls for the Northbridge to limit DMA access from the graphics card to main memory. Furthermore, buffer overrun exploits have questionable applicability since each process runs as its own virtual machine and rumors has it that the no-execute bit is used on heap space. Still, I'm very surprised that such a media was even released into the wild by Microsoft...their own worst enemy is their own haste to get to the market and carelessness; security is for naught without consideration of human factors. Very exciting! Perhaps the Xbox360 will be opened without the need for significant hardware hacking.
New-Source: http://www.bunniestudios.com
( Subscribe via
)
|
|
| |
|
|
|
| Monday, April 15 | | Perennial Order is set to bloom on Xbox Serie |
Friday, April 12 | | Umbraclaw hits Xbox, PlayStation, Switch & PC |
Thursday, April 11 | | TMNT: Wrath of the Mutants Hits XBOX, PlaySta |
| GIC’24 Early Bird Tickets Now Available |
Wednesday, April 10 | | Mars 2120 launches out of Early Access onto a |
Tuesday, April 09 | | Die by the Blade Slashes Its Way onto PC in M |
Monday, April 08 | | Strike Gold with the Call of Duty Gold & Silv |
| Neptunia: Sisters VS Sisters Arrives May 21st |
Thursday, March 28 | | FALLEN LEAF Teams Up with STUDIOS EXTRAORDINA |
Tuesday, March 26 | | Explore the World of Ink Painting in Realm of |
Monday, March 25 | | JSAUX’S Black MODCASE for the ROG Ally Is Ava |
Friday, March 22 | | Barton Lynch Pro Surfing Update v1.07 is LIVE |
| RuneScape developer Jagex joins CVC Capital P |
Thursday, March 21 | | Paper Ghost Stories: Third Eye Open coming to |
Wednesday, March 20 | | Dark JRPG Graphic Adventure 'Neon Blood' debu |
Tuesday, March 19 | | Hauntii hits Xbox Game Pass for console and P |
Monday, March 18 | | Discover the Sound of Life in The Lullaby of |
Thursday, March 14 | | WWII-based strategy epic Classified: France ' |
| Night Slashers: Remake confirmed for XBOX, Pl |
Wednesday, March 13 | | Highwater is coming soon for Xbox X|S, XB1, P |
Tuesday, March 12 | | Terra Memoria is set to launch on Xbox Series |
| Rugrats: Adventures in Gameland releases in M |
Monday, March 11 | | Sonic X Shadow Generations hits Xbox One, Xbo |
Friday, March 08 | | Taxi Life: A City Driving Simulator out now f |
| Sci-fi adventure 'Sky of Tides' announced for |
Thursday, March 07 | | Planet Zoo: Console Edition arrives on March |
Wednesday, March 06 | | MLB The Show 24 launches later this month on |
| FLIPGO: A portable dual monitor that you can |
Tuesday, March 05 | | EARTHLOCK 2 Reveals New Details On Desert Shi |
Monday, March 04 | | Reverse-city builder, Flooded Out Now on Xbox |
See All Xbox 360 News | Xbox 360 News Archive
|
| |