7 ms·

Endgame: A dashboard exploit for the original Xbox

212 points by Lammy 3y ago

pemosirichards 3y ago
[dead]
pemosirichards 3y ago
[dead]
NotPractical 3y ago
Awesome! I'd love to see a detailed writeup on how the exploit works, if someone has the time and interest to put one together. We were incredibly lucky to get one for the Switch BootROM exploit: https://github.com/Qyriad/fusee-launcher/blob/master/report/fusee_gelee.md https://github.com/Qyriad/fusee-launcher/blob/master/report/...
msk714 3y ago
ive been trying to hack the XB1 for a year now and only have two potential exploits of only one i will release because it cant be patched, maybe spoof your device family. im researching and just stumble apon 100 posts like this
bradhe 3y ago
How many things named "endgame" are there?
- HtmlProgrammer 3y ago
  6
- boomboomsubban 3y ago
  https://en.wikipedia.org/wiki/Endgame https://en.wikipedia.org/wiki/Endgame
karlgkk 3y ago
This is pretty cool. For anyone interested, it's an int overflow in savegame image handling code.
- TheJoeMan 3y ago
  I saw a little pessimism from other comments about a bleak future with fully secured consoles, but I expect image parsing bugs are forever!
  - jsheard 3y ago
    The difficulty is in turning a userland exploit into a useful jailbreak, there will always be parser bugs and WebKit bugs but those are only the first step in the chain. From there you need to escape the sandbox and that's the part which keeps getting more difficult. The "unhackable" Xbox One has had at least one userland exploit via attacking the web browser, but nothing came of it because they weren't able to break out of Hyper-V.
nebula8804 3y ago
This soothes my soul seeing exploits for the consoles I grew up with. For a second it takes me back to a simpler time. The homebrew scene for the XBOX was more fun than the console itself! A while back I saw this clickbait video of "Gen Z trying out the original XBOX" and man that was a reality check as to how much time has passed.
- Levitating 3y ago
  > Gen Z trying out the original XBOX Gen Z is a pretty wide group. I am Gen Z and played on an original xbox. However at the time the PS3 was already out, as it came out not much later. And in my region, the PS2 was much more popular than the xbox. My sister however, who is only a few years younger, is definitely part of the iPad generation. Everybody played the Wii though, hell I still play the Wii.
  - nebula8804 3y ago
    You do raise a good point as Gen Z is around 1997-2012 (exact dates are always a little fuzzy) So 97 would put you around 4-5 years old when the XBOX came out. The video made it look like the XBOX was some ancient artifact to the Gen Z people. I guess if you were born in 2012 it is an ancient artifact? [1]:https://www.youtube.com/watch?v=WJEzvijyNmw https://www.youtube.com/watch?v=WJEzvijyNmw
    - Levitating 3y ago
      If you were born in 2012 you'd be born around the time GTA V was released for PS4. So the original xbox would definitely be considered ancient.
- cheeze 3y ago
  Hacking the original Xbox + x360 is what I credit as getting me "really into computers" For OG xbox, I was a definition script kiddie but I learned how to use FTP, how to connect via crossover cable, how to solder, the basics of what exploits are and how they work, and a ton of other skills that I use daily. X360 required me to take the damn thing apart (which was terrifying as a 14 year old who wouldn't get a replacement if I broke things). I learned about firmware, SATA connections, the bits (I forget the name) that specify whether something was retail or not, why the exploit wouldn't let you run unsigned code, etc. I was just a broke kid who wanted to watch movies and play games I couldn't afford, but it literally got me into tinkering and hacking, even though what I was doing wasn't much more than "follow a guide, script kiddy"
bl4kers 3y ago
Why would I want to do this? It doesn't seem to mention that in the README
- mhh__ 3y ago
  Beyond the usual (i.e. loading ones own code on something one owns), is "because it's there" not sufficient?
- rusk 3y ago
  It’s a great platform for emulating anything up to the original playstation
- geor9e 3y ago
  I guess the younger generation grew up with unmoddable consoles, so the concept is less known nowadays. The older audience immediately knows that it's for. You can run free homebrew apps, games, and if you really wanted, with a little more code, run pirated copies of retail games, and cheats. If you had a PS1 or Xbox, you got it modchipped by some classmate, everyone did in the 2000s, it was rampant, at least at my school. I still remember bunnie, who was famous online for first hacking the xbox. Hardmods required some soldering, Softmods just required a particular game and flashdrive. This new one just requires a memory card. They didn't fully softmod it for legal reasons but they did the hard part. Since it's such an old console, it's really just a novelty that they found another method.
  - graphe 3y ago
    PS3, PS4, Xbox, PSP, DS, vita, switch and maybe PS5 all have hacks. Phones came out and killed homebrew. Now the developers developed cool super compatible stuff without needing you to hack the hardware plus games became stagnant on consoles. The PSP when I bought it was known as a boring rehash console with nothing but re-releases but the hardware made it worth it.
    - badsectoracula 3y ago
      Considering how often ModernVintageGamer uploads videos about new (and old) homebrew hacks, i do not think homebrew is that dead :-P.
azalemeth 3y ago
In many ways I think it is really quite sad that we're at a point where blown e-fuses, encrypted everything and properly done public/private key crypto means that it's entirely possible that next generation of consoles really might actually be unhackable and unbackupable, barring some tiny bootloader exploit, cheap TEM and an understanding of "physically uncloneable functions", or cheap and plentiful qubits. Things like this are just cool, prevent e-waste, and preserve cultural heritage.
- jdefr89 3y ago
  As Vulnerability Research is my area of expertise we are finding new attack vectors all the time. Remember with new technology and abstraction you introduce new potential security issues that can be used to subvert other means of protection. It’s a tit for tat non ending cycle. That being said exploitation of consoles and phones has become quite difficult. Enough at least to make me move to embedded security as there is more work to be done there..
- deleted 3y ago
  [deleted]
- sublinear 3y ago
  Console ownership isn't as popular with younger people anymore and their exclusive games are not what they used to be, so I wouldn't worry. We're not losing much. Consoles have been dying for a while.
- rusk 3y ago
  it saddens me as a vintage games conservator that my present day PS4 will be a brick in a few years. When I have consoles and games going back 40 years. It just doesn’t seem right.
  - deergomoo 3y ago
    The thing that has me concerned is that even if you keep the consoles working, and even if you have an extensive library of physical media, these days what’s on the disc is probably an unpatched, incomplete, possibly unplayable mess. That’s not intended as a criticism of game development, just an expression of fear for the preservation implications. It’s no longer enough to preserve what’s in your hands—which is difficult enough where electronics are concerned—but now someone must find some way to extract, archive, and reapply all the day one patches, bug fixes, DLC packs etc.
dadrian 3y ago
This is awesome. I remember back in 2006 I bought every copy of MechAssault that my local Game Stop had and hoped that one was the correct revision such that it was compatible with the Krayzie Ndure softmod exploit, and used it to install Xbox Media Center (XBMC). It's from that setup that I learned how computer networking works. I credit basically my entire career with reading about softmods at the back of a Popular Science magazine. Anyway, it's awesome that you'll eventually be able to softmod an Xbox without a specific game once the mods are integrated with this exploit. Good work!
- urbandw311er 3y ago
  Snap! And I went on to develop an XBMC add-on to control windows media center as a result of getting into the scene!
harry8 3y ago
Aside: og xbox is not so expensive 2nd hand and a great way to set up a kids lan party. 1 old router, 3 xboxes, 3 tvs, 12 controllers, Halo gets you 10 year-olds' mayhem. Noisy fun. Arguably easier if xboxes are modded. MotoGP, crash team racing, powerdrome, crimson skies all work great https://www.teamxlink.co.uk/wiki/Supported_Games https://www.teamxlink.co.uk/wiki/Supported_Games then sort by both total players and players per console descending Is this single location lan something that has been lost since those days? Any better ways to set up a temporary lan party for kids? [1] https://www.aliexpress.com/item/1005005142269614.htm https://www.aliexpress.com/item/1005005142269614.htm
- Farbklex 3y ago
  I have the same use case but with Xbox 360s since they are cheaper and easier to get here in Germany. Haven't found a better "easy LAN party" setup than this. A PC gaming LAN setup for 20 year old games is also dirt cheap but mostly requires 1 PC per player. The splitt screen support on PC is unfortunately very bad.
- mdaniel 3y ago
  Your link is 404, what was the title of the thing you were linking to? < HTTP/2 404 < content-type: application/json;charset=UTF-8 {"timestamp":1708462250423,"status":404,"error":"Not Found","message":"No message available","path":"/item/1005005142269614.htm"}
  - harry8 3y ago
    Terrible! Clipping the tracking gunk after the ? in th url took out the l in .html xbox to hdmi converter. Useful if using an lcd monitor without analog input. https://www.aliexpress.com/item/1005005142269614.html https://www.aliexpress.com/item/1005005142269614.html
- Jerrrry 3y ago
  modded oG xbox's or even X360s are a great living room centerpiece. oG Xbox, Xlink Kai is still a thing. It was my first experience playing online as a poor 12 year old script kiddie myself. For X360 LAN parties, It took a long time to find, but the hard-coded 4ms ping limit for "LAN" mode was removed, so LAN parties can be split into neighborhood LAN parties without problems
mschuster91 3y ago
> The exploit targets an integer overflow in the dashboard's handling of savegame images. It's truly fascinating how often image format parse bugs end up being the entry point for attackers...

212 points by Lammy 3y ago

pemosirichards 3y ago

[dead]

pemosirichards 3y ago

[dead]

NotPractical 3y ago

Awesome! I'd love to see a detailed writeup on how the exploit works, if someone has the time and interest to put one together. We were incredibly lucky to get one for the Switch BootROM exploit: https://github.com/Qyriad/fusee-launcher/blob/master/report/fusee_gelee.md https://github.com/Qyriad/fusee-launcher/blob/master/report/...

msk714 3y ago

ive been trying to hack the XB1 for a year now and only have two potential exploits of only one i will release because it cant be patched, maybe spoof your device family. im researching and just stumble apon 100 posts like this

bradhe 3y ago

How many things named "endgame" are there?

HtmlProgrammer 3y ago
6
boomboomsubban 3y ago
https://en.wikipedia.org/wiki/Endgame https://en.wikipedia.org/wiki/Endgame

karlgkk 3y ago

This is pretty cool. For anyone interested, it's an int overflow in savegame image handling code.

TheJoeMan 3y ago
I saw a little pessimism from other comments about a bleak future with fully secured consoles, but I expect image parsing bugs are forever!
- jsheard 3y ago
  The difficulty is in turning a userland exploit into a useful jailbreak, there will always be parser bugs and WebKit bugs but those are only the first step in the chain. From there you need to escape the sandbox and that's the part which keeps getting more difficult. The "unhackable" Xbox One has had at least one userland exploit via attacking the web browser, but nothing came of it because they weren't able to break out of Hyper-V.

nebula8804 3y ago

This soothes my soul seeing exploits for the consoles I grew up with. For a second it takes me back to a simpler time. The homebrew scene for the XBOX was more fun than the console itself! A while back I saw this clickbait video of "Gen Z trying out the original XBOX" and man that was a reality check as to how much time has passed.

Levitating 3y ago
> Gen Z trying out the original XBOX Gen Z is a pretty wide group. I am Gen Z and played on an original xbox. However at the time the PS3 was already out, as it came out not much later. And in my region, the PS2 was much more popular than the xbox. My sister however, who is only a few years younger, is definitely part of the iPad generation. Everybody played the Wii though, hell I still play the Wii.
- nebula8804 3y ago
  You do raise a good point as Gen Z is around 1997-2012 (exact dates are always a little fuzzy) So 97 would put you around 4-5 years old when the XBOX came out. The video made it look like the XBOX was some ancient artifact to the Gen Z people. I guess if you were born in 2012 it is an ancient artifact? [1]:https://www.youtube.com/watch?v=WJEzvijyNmw https://www.youtube.com/watch?v=WJEzvijyNmw
  - Levitating 3y ago
    If you were born in 2012 you'd be born around the time GTA V was released for PS4. So the original xbox would definitely be considered ancient.
cheeze 3y ago
Hacking the original Xbox + x360 is what I credit as getting me "really into computers" For OG xbox, I was a definition script kiddie but I learned how to use FTP, how to connect via crossover cable, how to solder, the basics of what exploits are and how they work, and a ton of other skills that I use daily. X360 required me to take the damn thing apart (which was terrifying as a 14 year old who wouldn't get a replacement if I broke things). I learned about firmware, SATA connections, the bits (I forget the name) that specify whether something was retail or not, why the exploit wouldn't let you run unsigned code, etc. I was just a broke kid who wanted to watch movies and play games I couldn't afford, but it literally got me into tinkering and hacking, even though what I was doing wasn't much more than "follow a guide, script kiddy"

bl4kers 3y ago

Why would I want to do this? It doesn't seem to mention that in the README

mhh__ 3y ago
Beyond the usual (i.e. loading ones own code on something one owns), is "because it's there" not sufficient?
rusk 3y ago
It’s a great platform for emulating anything up to the original playstation
geor9e 3y ago
I guess the younger generation grew up with unmoddable consoles, so the concept is less known nowadays. The older audience immediately knows that it's for. You can run free homebrew apps, games, and if you really wanted, with a little more code, run pirated copies of retail games, and cheats. If you had a PS1 or Xbox, you got it modchipped by some classmate, everyone did in the 2000s, it was rampant, at least at my school. I still remember bunnie, who was famous online for first hacking the xbox. Hardmods required some soldering, Softmods just required a particular game and flashdrive. This new one just requires a memory card. They didn't fully softmod it for legal reasons but they did the hard part. Since it's such an old console, it's really just a novelty that they found another method.
- graphe 3y ago
  PS3, PS4, Xbox, PSP, DS, vita, switch and maybe PS5 all have hacks. Phones came out and killed homebrew. Now the developers developed cool super compatible stuff without needing you to hack the hardware plus games became stagnant on consoles. The PSP when I bought it was known as a boring rehash console with nothing but re-releases but the hardware made it worth it.
  - badsectoracula 3y ago
    Considering how often ModernVintageGamer uploads videos about new (and old) homebrew hacks, i do not think homebrew is that dead :-P.

azalemeth 3y ago

In many ways I think it is really quite sad that we're at a point where blown e-fuses, encrypted everything and properly done public/private key crypto means that it's entirely possible that next generation of consoles really might actually be unhackable and unbackupable, barring some tiny bootloader exploit, cheap TEM and an understanding of "physically uncloneable functions", or cheap and plentiful qubits. Things like this are just cool, prevent e-waste, and preserve cultural heritage.

jdefr89 3y ago
As Vulnerability Research is my area of expertise we are finding new attack vectors all the time. Remember with new technology and abstraction you introduce new potential security issues that can be used to subvert other means of protection. It’s a tit for tat non ending cycle. That being said exploitation of consoles and phones has become quite difficult. Enough at least to make me move to embedded security as there is more work to be done there..
deleted 3y ago
[deleted]
sublinear 3y ago
Console ownership isn't as popular with younger people anymore and their exclusive games are not what they used to be, so I wouldn't worry. We're not losing much. Consoles have been dying for a while.
rusk 3y ago
it saddens me as a vintage games conservator that my present day PS4 will be a brick in a few years. When I have consoles and games going back 40 years. It just doesn’t seem right.
- deergomoo 3y ago
  The thing that has me concerned is that even if you keep the consoles working, and even if you have an extensive library of physical media, these days what’s on the disc is probably an unpatched, incomplete, possibly unplayable mess. That’s not intended as a criticism of game development, just an expression of fear for the preservation implications. It’s no longer enough to preserve what’s in your hands—which is difficult enough where electronics are concerned—but now someone must find some way to extract, archive, and reapply all the day one patches, bug fixes, DLC packs etc.

dadrian 3y ago

This is awesome. I remember back in 2006 I bought every copy of MechAssault that my local Game Stop had and hoped that one was the correct revision such that it was compatible with the Krayzie Ndure softmod exploit, and used it to install Xbox Media Center (XBMC). It's from that setup that I learned how computer networking works. I credit basically my entire career with reading about softmods at the back of a Popular Science magazine. Anyway, it's awesome that you'll eventually be able to softmod an Xbox without a specific game once the mods are integrated with this exploit. Good work!

urbandw311er 3y ago
Snap! And I went on to develop an XBMC add-on to control windows media center as a result of getting into the scene!

harry8 3y ago

Aside: og xbox is not so expensive 2nd hand and a great way to set up a kids lan party. 1 old router, 3 xboxes, 3 tvs, 12 controllers, Halo gets you 10 year-olds' mayhem. Noisy fun. Arguably easier if xboxes are modded. MotoGP, crash team racing, powerdrome, crimson skies all work great https://www.teamxlink.co.uk/wiki/Supported_Games https://www.teamxlink.co.uk/wiki/Supported_Games then sort by both total players and players per console descending Is this single location lan something that has been lost since those days? Any better ways to set up a temporary lan party for kids? [1] https://www.aliexpress.com/item/1005005142269614.htm https://www.aliexpress.com/item/1005005142269614.htm

Farbklex 3y ago
I have the same use case but with Xbox 360s since they are cheaper and easier to get here in Germany. Haven't found a better "easy LAN party" setup than this. A PC gaming LAN setup for 20 year old games is also dirt cheap but mostly requires 1 PC per player. The splitt screen support on PC is unfortunately very bad.
mdaniel 3y ago
Your link is 404, what was the title of the thing you were linking to? < HTTP/2 404 < content-type: application/json;charset=UTF-8 {"timestamp":1708462250423,"status":404,"error":"Not Found","message":"No message available","path":"/item/1005005142269614.htm"}
- harry8 3y ago
  Terrible! Clipping the tracking gunk after the ? in th url took out the l in .html xbox to hdmi converter. Useful if using an lcd monitor without analog input. https://www.aliexpress.com/item/1005005142269614.html https://www.aliexpress.com/item/1005005142269614.html
Jerrrry 3y ago
modded oG xbox's or even X360s are a great living room centerpiece. oG Xbox, Xlink Kai is still a thing. It was my first experience playing online as a poor 12 year old script kiddie myself. For X360 LAN parties, It took a long time to find, but the hard-coded 4ms ping limit for "LAN" mode was removed, so LAN parties can be split into neighborhood LAN parties without problems

mschuster91 3y ago

> The exploit targets an integer overflow in the dashboard's handling of savegame images. It's truly fascinating how often image format parse bugs end up being the entry point for attackers...