It took me nine years to hack my Xbox 360
kennedn.com
kennedn.com
And it is true, but the capability was already quite cheap in 2017 and before: fx2 chips can do quite a lot, for instance.
I hope Bunnie's Baochip BIO approach will take off in microcontrollers, making that sort of feature more ubiquitous. You can do a lot of things with an ESP32 for instance, but the RP2040 still has an edge for I/O.
Also missed the opportunity to mention that the RP2350 itself had its protection defeated by fault injection.
Lastly, side channels and fault injection attacks are highly viable for mid-2010 and earlier hardware, but chip designs are hardening against them, for instance forcing a reboot when a glitch is detected. This makes current and next-generation chips harder to attack (see the laser fault injection on RP2350, though this is also being hardened against). It's probably a good thing to some extent (make it harder to duplicate my credit card), but I mourn the loss of control over my own HW.
Incidentally, tinkering with the first gen Xbox (which is the security equivalent of a swiss cheese) taught me a lot about software, networking and electronics when I was younger. I hope that future generations will still get to tinker like that.
You would need a juicy target, easy to procure for cheap for the effort to make sense.
It's probably doable, though I suspect that more recent models are probably better protected against that sort of attack. These are performance-oriented chips though, not security-oriented, so they probably make a few compromises. They may also use chiplets with a more secure "secure element", I have no idea (though you still need to communicate with it).
I don't think I've seen anyone attempt it, so it may be that they haven't specifically hardened their designs against these attacks.
Then comes the question of practicality: would you solder a "modchip" to your GPU? It may even be hard to reach the correct spot without interfering with cooling.
I would bet that this is doable with the same setup as the RP2350 hack, but that requires drilling into the specific chip that you are targeting, so great, but not very useful: there probably aren't many secrets to extract, you could decrypt the BIOS (I thought these were just signed with asymmetric keys?) and try to find an exploit in the code there, I guess. But this specific technique is not useful for putting your own firmware then using the chip.
Anyway, it's probably doable to glitch the power supply of some mid-to-late 2010s nvidia GPUs to have it accept custom BIOSes, though graphics card are specifically designed to keep the power supply stable, so you would have to desolder a lot of capacitors (and reconnect them after startup is finished?).
Homebrew software had been a driving force behind consoles being hacked in the past. The console is obviously more secure, but they also removed some incentives.
They did implement a lot of new security tech but it would have been hacked much much sooner if there was any incentive to do it.
Which by the way is now a common security requirement on modern PC designs,
https://learn.microsoft.com/en-us/windows/security/hardware-...
Way back around 2008, AMD was bleeding money after its acquisition of ATI. They wanted to divest of their Handheld division, which was the business unit that was producing chips for smartphones. From what I heard through the grapevine, Qualcomm was interested only in some part of it, particularly the GPU IP, but AMD wanted to sell the whole thing, and eventually lowered the price enough that Qualcomm sealed the deal. I was just a nobody, so take that with a grain of salt.
At the time the purchase was finalized in 2009, the GPU was a miniaturized version of the Xenos GPU from the XBox 360; all the basic parts were there, but the tile memory (GMem) was colocated with the rest of the GPU instead of being in a separate chip. That's what was marketed as the Adreno 200 GPU. It was a pretty quirky shader architecture where each clock issued two instructions: a SIMD vec4, and a scalar op, in VLIW manner, not superscalar. A lot of the time utilization was poor because the compiler couldn't find a way to pack two useful instructions in that manner. But I digress.
Back to the Qualcomm acquisition. It was a very tense period for the workers. Our salaries at AMD had been frozen for a while, and Qualcomm refused to bump our pay. I wish we, the workers, had built a common front to negotiate, but we didn't. As part of the contract, AMD was not allowed to hire us back, so most of us went along and got swallowed into Qualcomm reluctantly.
Qualcomm had been working on their own GPU design for a number of years, largely through people they had poached from S3 Graphics, IIRC. Anyhow, they had not been able to actually ship their own IP and were still entirely reliant on AMD's GPU designs, so the acquisition made a lot of sense to them. Qualcomm's latest GPU IP was called QShader, and it featured a remarkably sane scalar-based unified architecture; it was a very significant improvement in programmability.
After the acquisition there was a slow process of merging QShader with AMD's Xenos derivative, with the goal of producing a hybrid that would eventually be marketed as Adreno 300. In essence, they took the fixed-function blocks from Xenos, from its command processor to its texture units, while the shading processor was brought in from QShader. That first Adreno 300 (codenamed "Oxili") was a momumental effort from all involved, and while it had some teething problems, it was the foundation for all future Adreno GPUs in Snapdragon chips. And, hey, it even made it to Mars! [0].
Twenty years later and Adreno GPUs still ship with that Xenos-style tile-based rendering architecture. I can't believe that Andy Gruber, the chief architect behind it, doesn't have a Wikipedia page.
[0] https://en.wikipedia.org/wiki/Ingenuity_(helicopter) [1]
Is the market for GPU developers so specialized that engineers get trapped in a company or set of companies? If those employees were uneasy was part of that driven by lack of opportunities for their skill set? I'd imagine this is a niche where everyone knows each other no?
I wonder if this legacy would allow easier decomps of Xbox 360 software to run on Adreno GPUs? I ask because, my attempts to port software like PS2 demoscene to a very different platform like Mac has led me down very painful path and I now understand that graphics is so custom tailored and built for a specific use case that anything that can lower the bar of difficulty (such as the target having the same GPU design) can only increase the chances of successful ports/decomps.
To put it bluntly: yes. The upside is that people stick around for a long time, so you get to know your coworkers, and people treat each other nicely.
> If those employees were uneasy was part of that driven by lack of opportunities for their skill set?
Definitely. Sometimes people are unhappy with their job but they don't want to move. So they either stick with a job they don't like, or get out of the GPU niche. Nowadays more people work remotely, so there is more mobility than there used to be, but you still have a very short list of places where you realistically want to work at, so people rarely burn any bridges.
> I'd imagine this is a niche where everyone knows each other no?
Yeah, it is a pretty small world. People are usually hired straight out of college, or they are poached from a competitor.
There is a lot of specialized knowledge, so it takes years for people to really be productive. I left AMD/Qualcomm after nine years and I was finally beginning to understand how that GPU worked. I then spent five years at NVidia and left frustrated with how little I had managed to learn about that behemoth. They are immensely complex systems.
> I wonder if this legacy would allow easier decomps of Xbox 360 software to run on Adreno GPUs?
Oh, such a good question! Let me think.
I don't know how much of the hardware was exposed in the XBox 360. If it was all standard DirecX, then the underlying hardware won't matter (modulo performance). But if they exposed some of the internal quirks, such as the aforementioned GMem, that could be easier to emulate on hardware of the same family. But only if that new hardware also exposes those hardware features, which is not a given.
It is an excellent talk into why the security of the Xbox is so good by the platform security architect himself(at least the software stack). I highly recommend a watch.
The softmod had me seeing what the status quo is and things are... not great.
17 years since the JTAG hack and just as of a couple days ago someone finally vibecoded a non-proprietary SDK. The scene by and large to the masses (or at least, the loudest group) mostly associates homebrew with "stealth" servers aka servers your console connects to which assist in bypassing Xbox LIVE challenges that detect modified consoles. The servers provide mod menus (trainers, basically) for various games and the ability to use older dashboards.
The kicker is the custom servers are not required, code for bypassing challenges leaked ages ago, and people still pay for stealth server access! I can't even imagine who is still playing Xbox 360 titles on Xbox LIVE except people with modded consoles at this point.
Hacking the console is complete. But the state of the scene is a bit sad.
At least now we can vibecode the missing bits of the ecosystem (I say this as I'm literally reverse engineering and reimplementing the devkit debug monitor).
No it's not. For starters the recently released softmod does not work on all Xbox 360 revisions.
With BadAvatar you get interactionless console exploitation that's good enough for most people.
You can just throw it on the filesystem and the console will accept it. I believe it would require a system update to add the executable to a revocation list, which Microsoft is unlikely to do. It's not the only method of achieving initial code execution either.
I just started digging into hacking 360s this week, and I'm blown away by how simple it is once you cobble together some files from a few github repos...
There exist 3 main things in the software hack space for Xbox 360:
1. BadUpdate (Grimdoomer) which is the only software hypervisor exploit for the Xbox 360. It's intended to be launched from scenarios where someone could achieve code execution. The main method for launching BadUpdate was through Rock Band Blitz (created by ihateccompvir and InvoxiPlayGames). Pure software, works across all hardware revisions of the Xbox.
2. ABadAvatar (shutterbug2000) which uses a memory corruption vulnerability in the avatar loading code in the Xbox dashboard to gain code execution after the dashboard loads, then launches BadUpdate to exploit the console. Pure software, works across all hardware revisions of the Xbox.
3. Peer Pressure (Grimdoomer). First compromises the console through one of the above methods and modifies the SMC firmware to attack the southbridge. The SMC was abused in a similar manner for the JTAG hack, which likely led to Microsoft hardening it in later revisions of the hardware and mitigating the attack used here by Grimdoomer.
More info on #3 here: https://youtu.be/ftEuor1asBM?t=96
At any rate, #1 and #2 do not provide early boot exploitation.
#3 does. The hard drive security sector is involved and the kernel is responsible for loading that, so at this stage you've gone through 2BL, hypervisor, and kernel initialization. So you can't compromise the bootloaders, but you're early enough in the boot chain to do interesting things like replacing the boot animation with something custom.
The JTAG hack does some weird stuff that, truthfully, I've never seen replicated on other hardware. tl;dr the console must be on a vulnerable software version which did not blow a downgrade fuse and using an additional hardware flash chip containing a different version of the OS which had a hypervisor bug, boots the console into that, triggers the exploit using SMC black magic, then reboots back into the upgraded version of the OS.
The RGH hack described in this article would allow you to replace 2BL, so you've compromised the console earlier in the boot chain.
> Peer Pressure is a persistent softmod exploit for Xbox 360.
>You can try to use the exploit with a SSD if you choose, however, for optimal boot times and reliability it's recommended to use a mechanical HDD instead
is also very amusing to read
> Funnily enough, a software-only exploit for the Xbox 360 dropped just last week , rendering my years of effort somewhat moot. Nevertheless, it was a fascinating deep dive into the inner workings of the console and the security mechanisms designed to protect it.
It doesn't suck, but it certainly isn't the best and I've always found the Playstation stans' insistence on it being the greatest possible design to be hilarious because we know exactly how it came to be.
The SNES controller is pretty universally agreed to be great and has more or less defined the standard layout for digital gamepads since then. Given the history between Sony and Microsoft I don't think anyone disputes that the original digital PSX pad is basically a legally-distinct evolution of the SNES pad, made mostly better other than the then-patent-encumbered D-pad. It's a top tier digital input device and allowed for a very easy transition for 2D franchises established on the SNES.
When the N64 however it became immediately clear that 3D gameplay really benefitted from analog inputs, and Sony was caught with their pants down having barely even launched a full size analog joystick at that point. The Dual Analog was quickly put together by slapping two analog sticks on to the standard PSX gamepad in the least disruptive way possible, which was a perfectly fine solution for the time but absolutely not the way to get the best analog controls.
Then they freaking stuck with it instead of designing a controller optimized primarily for 3D play. To this day the Playstation platform has a controller that is derived from one of the best 2D digital gamepads ever to exist but where 3D analog support remains more or less bolted on to the bottom.
Again, it's not terrible, but I find it hilarious how many people insist it's peak controller design overall when it's more of a historical accident.
If I'm playing SNES emulators, I reach for my PS3 gamepad. If I'm playing 3D games, I reach for my Xbox One gamepad. I only ever play 3D games with PS controllers when they're exclusive to PS platforms that aren't yet emulated
> Funnily enough, a software-only exploit for the Xbox 360 dropped just last week , rendering my years of effort somewhat moot. Nevertheless, it was a fascinating deep dive into the inner workings of the console and the security mechanisms designed to protect it.