2 ms·
That's how the original "unhackable" Xbox was broken. The encrypted firmware was decrypted by hardware in the south-bridge but sent unencrypted to the RAM via t
by MisterTea 5y ago
That's how the original "unhackable" Xbox was broken. The encrypted firmware was decrypted by hardware in the south-bridge but sent unencrypted to the RAM via the open hyper transport bus. So someone hooked a fast logic analyzer to the bus and read the firmware during boot.
- monocasa 5y agoWell, the encrypted second stage firmware was decoded in software by a plaintext ROM stored in the southbridge that contained the keys. That 512 byte southbridge ROM also didn't do quality asymmetric crypto, so by dumping the RC4 key (and in later revisions the TEA hash digest) they were able to decrypt the main firmware in flash and replace it with arbitrary code. With today's consoles, it's sort of assumed that the attackers will get read access to the first stage boot loader, so they use public keys to validate any stages not originating from the CPU die itself. Then attackers can't replace follow on stages even with read access to the first stage.