14 ms·
Hacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit
- 14 2y agoVery cool to see people still working on hacking the 360. I used the RGH on my 360 years ago. Was really fun back in the day going through all the cat and mouse that went on. A soft mod would be cool as the RGH does require soldering some very tiny wires to some very tiny pads and I remember seeing posts of many people lifting pads trying to do this mod. But in the end I had a perfect install on my 360 and would boot almost every time on the first try.
- nolok 2y agoAh, I remember I had one of the first series where they forgot to remove the JTAG pins
- jsheard 2y agoXbox security has certainly come a long way since the OG Xbox, which featured a pin header that may as well have had "insert modchip here" printed next to it.
- hot_gril 2y agoDo the people who hack 360s also know how to prevent them from inevitably red-ringing? Cause that's the biggest thing discouraging me from buying another (my other 2 went red).
- Salgat 2y agoI can't help but think that XBox 360 emulation is the only long term path that exists for the 360, which is concerning because only Xenia to my knowledge exists and it's still experimental.
- hot_gril 2y agoMaybe it's easier at this point to reverse-engineer Halo 3 into a Windows build Edit: wait https://store.steampowered.com/app/1064271/Halo_3/ https://store.steampowered.com/app/1064271/Halo_3/ Well it'd still be nice to get the original experience and not to deal with Steam.
- pogue 2y agoNot every model of the 360 will inevitably red ring. Those were typically only the "fat" models and there are some fixes to prevent it from happening. It usually just involves changing to some better quality thermal paste & reflowing the board. https://www.ifixit.com/Guide/Xbox+360+Red+Ring+of+Death+Fix+Kit/3550 https://www.ifixit.com/Guide/Xbox+360+Red+Ring+of+Death+Fix+...
- hart_russell 2y agoThis video does a deep dive on the subject: https://www.youtube.com/watch?v=24KbVf1AD1c https://www.youtube.com/watch?v=24KbVf1AD1c He suggests that all of the fat models will eventually red ring due to being stress tested at the factory. Not sure how true that is.
- throwaway48476 2y agoRIP Felix has a much better video that explains the cause of the failure. Factory stress isn't the cause. It was a bad design.
- hart_russell 2y agoYou misread, that's not what I wrote.
- ghusbands 2y agoYou wrote "He suggests that all of the fat models will eventually red ring due to being stress tested at the factory" - it directly states that stress testing at the factory is the claimed reason that the fat models will red ring. Or was the video host somehow stress tested at a factory?
- hart_russell 2y agoThe video states that the stress testing is what aggravates the underlying design flaw.
- throwaway48476 2y agoThe red ring is caused by underfill that is too soft that let's the solder bumps break. It's a BGA packaging problem and there's no fix.
- Novosell 2y agoSure you're not thinking of the PS3 or did both of them actually suffer the same issue?
- 6SixTy 2y agoBoth of them experience the same issue. Though it's a yellow light instead of the ring on the Xbox.
- perching_aix 2y agoIIRC the PS3 issues were a mix of the RSX die cracking and the NEC Tokin caps giving out, not a solder issue.
- throwaway48476 2y agoIt was an industry wide problem.
- rpcope1 2y agoI've not modded my 360E, and it was probably one of the very last 360s built, but I've never had any problems with it, still play on it, and my understanding is there are fewer and less dire problems with it than the prior 360 and S.
- 14 2y agoThe rrod was pretty well know for a long time. Video games are sold to kids so it had the requirement to not use lead solder in them even though lead solder is perfectly safe and no way a child would be exposed to it, unless they eat the xbox. Lead solder is much softer so with the countless hot cold cycles, when hot the solder expands and when cold it contracts, it will handle these cycles much much better. Without the lead the solder joints are not as soft and the hot and cold cycles eventually results in the solder joints cracking and no longer making a solid connection = rrod. Some models were more prone to rrod but the biggest trick is to make sure you do regular cleaning and dusting to keep air flow working. Don't put the xbox in a cabinet with no air flow where it will heat up. Put a fan on the xbox if you can. It has been a long time since I followed the xbox scene but there are tons of posts online about the entire problem and best practices to avoid it.
- minihoot 2y agoThe slim doesn't red ring.
- mouse_ 2y agoI wish there was somewhere I could toss cash into a softmod bounty.
- whalesalad 2y agoat this point is there any reason to use xb360 hardware? emulation on modern hardware has gotta be substantially better
- mouse_ 2y agoXbox 360 emulation is still really bad for most games, despite what some YouTubers would have you believe. But let's say in a few years it does become substantially better. There's still: • Nostalgia • Authenticity • Compatibility • Preservation • Cost of entry Even if 360 emulation does become practical, a 360 will still be cheaper than any gaming PC capable of playing those games.
- deleted 2y ago[deleted]
- reassembled 2y agoJust this week a PC port of the 360 version of Sonic Unleashed was released that was accomplished via static recompilation techniques. It plays flawlessly and is really quite an impressive release. If this is possible now then emulation of these consoles might not be the only avenue to preserving their history.
- gjsman-1000 2y agoYes, but the graphics system for the game was completely reworked by people familiar with Sega's proprietary Hedgehog Engine. A straight recompile would have been unplayable.
- reassembled 2y agoInteresting, I didn’t know that. I suspect many casual observers don’t either. So you’re suggesting they did this work with proprietary info they’d gained through work with Sega and thus broke their NDA?
- knowitnone 2y agoand here I am having trouble even removing the case! haha.
- throwaway48476 2y agoIts not that hard when you get the hang of it and have the right tools.
- zymhan 2y agoThat was not their point.
- noisem4ker 2y agoGotta stab it hard in those holes.
- kmeisthax 2y agoI'm gonna be honest, I thought the story was over when they started talking about "oh hey here's this hypervisor code that loads extensions", because obviously extensions are going to be a massive increase in attack surface. But even then, the system wasn't actually broken by the extension being badly designed; the extension was just the most useful target to use the actual attack on. How the hell has this the Xbox 360 hypervisor remained basically impenetrable? You'd think at some point, someone would write and sign a hypervisor extension with a cripplingly bad memory safety bug. Hell, Apple's PPL[0] has better hardware isolation than Xenon's hypervisor mode[1] and it still gets 0wned more often. [0] Page Protection Layer. On Apple processors, every ARM exception level has a corresponding guarded exception level that has privileges over the regular one; chiefly corresponding to memory management. [1] On Xenon, the hypervisor runs in "real mode" plus HRMOR; Apple PPL's GL1/2 still have virtual memory and page table permissions.
- MisterTea 2y ago> You'd think at some point, someone would write and sign a hypervisor extension with a cripplingly bad memory safety bug. I'd hazard a guess that the Apple hardware is easier to work on than a video game console. Your already sitting in front of a general purpose computer running programming tools. A video game console is the antitheses of that.
- chc4 2y agoIt sounds like the hypervisor extensions are more like one-shot payloads, which probably have much less attack surface than normal kernel modules that are exposing new functionality to userspace.
- karlgkk 2y agoPart of the reason is motivation - if you hack a console, you can make a fair money, by selling your exploit as a package piece of software. Much like modchip vendors do. In fact, there have been a few software exploits that were sold with ties to a specific console. Funny if you think about it - If you hack an iPhone, you can sell your exploit to many governments and government agencies for millions of dollars If i were a profit motivated attacker, i know which I’d focus on
- djmips 2y agotour de force - I'm very impressed.