5 ms·

I would pay money to enroll in a class dedicated to game console hacking of this depth.

by smtddr 12y ago

trevyn 12y ago
Not this depth, but pretty great anyway: http://www.sexviahex.com/ http://www.sexviahex.com/
- rasz_pl 12y ago
  $4K for learning how to dump a nand chip? Im clearly in the wrong business.
ssclafani 12y ago
Check out Hacking the Xbox: http://www.nostarch.com/xboxfree http://www.nostarch.com/xboxfree It covers general reverse engineering techniques as well as going in depth into the original Xbox's security mechanisms.
- MrBuddyCasino 12y ago
  I agree this is a good one, thanks for bringing this up. I like how he's trying to avoid too much jargon, and really getting people to understand the subject, instead of showing off with his knowledge, which is all too common.
- smw 12y ago
  This is now 404? Strange, maybe attention resulted in a DMCA takedown request?
femto 12y ago
If you have money to spend, spend it on an instance of the console that you are interested in, then open it up and start figuring out how it works. (Google is your friend here.) One of the biggest barriers to learning about reverse engineering is fear of the expense of breaking the system you are working on. Being afraid of breakage makes one's exploration timid. In buying a system specifically for the purpose, you've removed the major barrier. Pulling something apart and figuring out how it works has to be the best way to learn about engineering. Every child (and curious adult) should do it, with children having the advantage of all the time in the world to do things. As you pull lots of things apart, you begin to learn about the full spectrum of current engineering techniques, eventually ending up with the knowledge to design your own stuff. It would be cool if there was a "Wikipedia" of reverse engineering, whereby every consumer item out there has a web of articles, and an army of the curious has fun by stripping devices down and collaboratively documenting innards to the lowest level possible. It would be extra cool if the community extended to a means of obtaining broken reverse engineering targets, that would otherwise be thrown away, or a way of spreading the cost of purchasing sacrificial devices. Such an effort would directly feed into Free Software efforts, by providing the knowledge required to rewrite replacement software, from scratch, for the devices in our lives. (For example, Free Software for your phone's modem processor, your washing machine, your fridge, your TV, ...?) Free Software for consumer appliances will come into prominence as every appliance in our lives, and their associated sensors, joins the "Internet Of Things".
- Nursie 12y ago
  Such an effort would likely lead to a lot of lawsuits from multinationals like Sony. For an example, look at what happened to various members of the ps3 hacking scene.
  - nitrogen 12y ago
    Sounds like a good use for a .onion.
    - luke-stanley 12y ago
      Maybe even the ole Freenet? All this talk of onion's could have one crying ;)
  - crististm 12y ago
    For this and other related reasons, I specifically filter out any Sony products when I'm buying stuff. I also remind my friends to avoid Sony for their involvement in SOPA/PIPA/rootkits
- RubyPinch 12y ago
  tangential rant/vent > Google is your friend here and then you find people who do writeups consisting of "And I'm gonna skip over this part, since if you don't know how to do it, you shouldn't be doing it", or "I reverse engineered X, but I'm not going to tell anyone because it would be bad if this was widespread" (though, my personal focuses were more towards specific games (though not for uncompetitive advantage sake, the tools resulting from the RE mentioned are public n' stuff, and known by the devs for a long time now)) one of the tools was in python so it was easy enough to decompile that, but it still doesn't teach thought process or methods for finding relevant items in the code (like hooking into a function that processes in game market data so it can be saved to a text file)
  - Cthulhu_ 12y ago
    TBH they may be skipping certain parts because they're afraid of the legal departments of the companies whose stuff they're reverse-engineering - iirc Sony wanted to sue everyone after the PS3 encryption key was found and published.
joshvm 12y ago
There's a lot of information about reverse engineering some of the older CPUs around e.g. the MOS6502 (NES, Apple II, C64, etc). This is a great presentation showing how this CPU is reverse engineered: https://www.youtube.com/watch?v=fWqBmmPQP40 https://www.youtube.com/watch?v=fWqBmmPQP40 Basically it comes down to the fact that you can't really hide transistors and ultimately that's something you can reconstruct. It sounds like a lot of work, and it is, but if you do it you can perfectly emulate a chip. If you can dig out non volatile memory then potentially you have the firmware. Once someone has their hands on that it'll be broken, almost guaranteed, as it becomes a software problem. Lots of people are very good at assembly hacking.
byuu 12y ago
I worked with a professional who helped decap and extract firmware from various DSPs. It was enthralling. He succeeded, too. I've also read at lengths the attempts at the hobbyist level. While also very fun, these attempts were not successful even at '90s process scales. At the hobbyist level, you'll be dealing with fumes from nitric acid to decap chips, and getting blurry, dirty scans that only give you a basic idea on function. Go back to '80s tech and before, and you'll possibly be able to painstakingly read NAND ROM sections by hand. At the professional level, you'll be spending up to millions of dollars on the equipment necessary to do live probing of chips at this process scale. Here you'll be able to advance the clock on your own, probe and hijack address and data bus lines and log their data constantly. On the extreme end of security, these chips are countless layers deep and have complicated wire mesh overlays that are used to detect intrusions and self-destruct. They can be beaten, but not by anything you can do with affordable hobbyist equipment. Contact these guys for a quote; expect it to be at least five figures to work on a single chip.

I would pay money to enroll in a class dedicated to game console hacking of this depth.

by smtddr 12y ago

I would pay money to enroll in a class dedicated to game console hacking of this depth.

trevyn 12y ago

Not this depth, but pretty great anyway: http://www.sexviahex.com/ http://www.sexviahex.com/

rasz_pl 12y ago
$4K for learning how to dump a nand chip? Im clearly in the wrong business.

ssclafani 12y ago

Check out Hacking the Xbox: http://www.nostarch.com/xboxfree http://www.nostarch.com/xboxfree It covers general reverse engineering techniques as well as going in depth into the original Xbox's security mechanisms.

MrBuddyCasino 12y ago
I agree this is a good one, thanks for bringing this up. I like how he's trying to avoid too much jargon, and really getting people to understand the subject, instead of showing off with his knowledge, which is all too common.
smw 12y ago
This is now 404? Strange, maybe attention resulted in a DMCA takedown request?

femto 12y ago

If you have money to spend, spend it on an instance of the console that you are interested in, then open it up and start figuring out how it works. (Google is your friend here.) One of the biggest barriers to learning about reverse engineering is fear of the expense of breaking the system you are working on. Being afraid of breakage makes one's exploration timid. In buying a system specifically for the purpose, you've removed the major barrier. Pulling something apart and figuring out how it works has to be the best way to learn about engineering. Every child (and curious adult) should do it, with children having the advantage of all the time in the world to do things. As you pull lots of things apart, you begin to learn about the full spectrum of current engineering techniques, eventually ending up with the knowledge to design your own stuff. It would be cool if there was a "Wikipedia" of reverse engineering, whereby every consumer item out there has a web of articles, and an army of the curious has fun by stripping devices down and collaboratively documenting innards to the lowest level possible. It would be extra cool if the community extended to a means of obtaining broken reverse engineering targets, that would otherwise be thrown away, or a way of spreading the cost of purchasing sacrificial devices. Such an effort would directly feed into Free Software efforts, by providing the knowledge required to rewrite replacement software, from scratch, for the devices in our lives. (For example, Free Software for your phone's modem processor, your washing machine, your fridge, your TV, ...?) Free Software for consumer appliances will come into prominence as every appliance in our lives, and their associated sensors, joins the "Internet Of Things".

Nursie 12y ago
Such an effort would likely lead to a lot of lawsuits from multinationals like Sony. For an example, look at what happened to various members of the ps3 hacking scene.
- nitrogen 12y ago
  Sounds like a good use for a .onion.
  - luke-stanley 12y ago
    Maybe even the ole Freenet? All this talk of onion's could have one crying ;)
- crististm 12y ago
  For this and other related reasons, I specifically filter out any Sony products when I'm buying stuff. I also remind my friends to avoid Sony for their involvement in SOPA/PIPA/rootkits
RubyPinch 12y ago
tangential rant/vent > Google is your friend here and then you find people who do writeups consisting of "And I'm gonna skip over this part, since if you don't know how to do it, you shouldn't be doing it", or "I reverse engineered X, but I'm not going to tell anyone because it would be bad if this was widespread" (though, my personal focuses were more towards specific games (though not for uncompetitive advantage sake, the tools resulting from the RE mentioned are public n' stuff, and known by the devs for a long time now)) one of the tools was in python so it was easy enough to decompile that, but it still doesn't teach thought process or methods for finding relevant items in the code (like hooking into a function that processes in game market data so it can be saved to a text file)
- Cthulhu_ 12y ago
  TBH they may be skipping certain parts because they're afraid of the legal departments of the companies whose stuff they're reverse-engineering - iirc Sony wanted to sue everyone after the PS3 encryption key was found and published.

joshvm 12y ago

There's a lot of information about reverse engineering some of the older CPUs around e.g. the MOS6502 (NES, Apple II, C64, etc). This is a great presentation showing how this CPU is reverse engineered: https://www.youtube.com/watch?v=fWqBmmPQP40 https://www.youtube.com/watch?v=fWqBmmPQP40 Basically it comes down to the fact that you can't really hide transistors and ultimately that's something you can reconstruct. It sounds like a lot of work, and it is, but if you do it you can perfectly emulate a chip. If you can dig out non volatile memory then potentially you have the firmware. Once someone has their hands on that it'll be broken, almost guaranteed, as it becomes a software problem. Lots of people are very good at assembly hacking.

byuu 12y ago

I worked with a professional who helped decap and extract firmware from various DSPs. It was enthralling. He succeeded, too. I've also read at lengths the attempts at the hobbyist level. While also very fun, these attempts were not successful even at '90s process scales. At the hobbyist level, you'll be dealing with fumes from nitric acid to decap chips, and getting blurry, dirty scans that only give you a basic idea on function. Go back to '80s tech and before, and you'll possibly be able to painstakingly read NAND ROM sections by hand. At the professional level, you'll be spending up to millions of dollars on the equipment necessary to do live probing of chips at this process scale. Here you'll be able to advance the clock on your own, probe and hijack address and data bus lines and log their data constantly. On the extreme end of security, these chips are countless layers deep and have complicated wire mesh overlays that are used to detect intrusions and self-destruct. They can be beaten, but not by anything you can do with affordable hobbyist equipment. Contact these guys for a quote; expect it to be at least five figures to work on a single chip.