Slashdot Mirror

One of my first forays into the realm of hardware hacking was following along as you recorded your exploration of the original Xbox console. I was fascinated by the hardware, but enjoyed your analysis and methods even more. It was you that got me interested in hardware and hacking. (Aside: Thank you very much for releasing your book as a freely-available download and for the open-letter about Aaron and MIT)

What was the most memorable experience for you of your Xbox expose? Was there a particular part of the hardware that you found especially well-designed (or laughably poor)? A method that yielded unexpected success (or failure)? What kind of fallout from Microsoft did you face? I remember you posting the voicemail of the Microsoft employee asking you to remove the images of the Xbox ROM -- something I got a good laugh out of. And as a follow-up: do you have a feeling for how "secure" hardware has changed in the decade since the original Xbox launch?

Thanks for taking the time to answer our questions, and also for all the work you've done pushing for a world with both open software and open hardware.

First off ... or course DRM can work. You know it, I know it. You just need to start with the *hardware*, and make sure that people who buy a computer cannot gain access to OS internals without first having to hack the hardware. And that's no cakewalk. Just remember that it took the resources of an MIT computing lab to hack the hardware of the XBox (see this link http://www.xenatera.com/bunnie/proj/anatak/xboxmod .html. Lesson learned: solder the BIOS chip on the motherboard for maximum security.}

That's called "trusted hardware". Really, does nobody remember Microsoft's Palladium scheme to make Windows work with "trusted hrdware"?

If the entertainment industry needed anyone to make the case that "trusted hardware" is really really necessary to protect their precious content, then this is it. What will your friendly neighbourhood lawmaker say when the RIAA / MPAA wave this rant under their noses and say:

"Told you so ... it's either mandatory Palladium and Trusted Hardware or we're dead. Now think of what that will mean in terms of your campaign contributions.

So here's the deal. We don't need you to actually outlaw non-compliant computer hardware, just to make "trusted hardware" and Microsoft's Palladium the standard for *all* Government applications. And make it mandatory for anything connected to the Internet that handles financial transactions, especially including anything that accesses Ebay or can order airline tickets on-line. That's all we ask.

The department of Home Security ought to like that, all banks and credit-card companies ought to like that, and we will bring out our content *only* for trusted hardware. We'll even throw in a 5-year price reduction on content for Trusted Computers. What's not to like eh?".

Crowing about how Joe Schmuck will be able to crack any DRM to illegally copy videos, songs or whatever is of a depth of stupidity that I never thought possible. Much as I respect Jeremy Allison for his work on Samba, there are some people in the Open Source software development that I would gladly do without. For example when they spout this sort of idiocy. Let him go back to writing code instead of trying his had at prose.

And doesn't he realise that with his rant he is indirectly positioning MS Windows as the *only* platform that the content industry can trust to protect it's content behind DRM?

Seriously ... doesn't he realise how close we have come {and the danger still isn't passed} of having "trusted hardware" shoved down our collective throats? Palladium anyone? Think that can't happen anymore??? Think again. Just look at Wikipedia and read up on trusted computing {http://en.wikipedia.org/wiki/Trusted_Computing}. It's not dead yet.

I was thinking along the lines of adding a PIC controller with a simple clock/timer routine preprogrammed on it, and making it available through the i2c bus and connecting an output to the poweron pin of the xbox. Some kind of simple daemon could manage requests for 'wakeups' by storing a list of requests and making sure the most imminent one was loaded onto the PIC controller. Upon shutdown/wakeup the daemon could update the chip to the next required 'wakeup'. Maybe you could ask your friend how difficult it would be to attach a simple pic device to the i2c/smbus and have it available at a given address - I have limited hardware hacking skills

It may be possible to alter the code on the onboard PIC16LC chip which already controls the power/reset, eject and led functions. This chip has also been alleged to contain the realtime clock (by bunnie) as it is powered when the xbox is switched off (will run for some time after power cord is removed from a capacitor). Microsoft have probably blown the fuses that would have allowed for this.

http://www.xbox-linux.org/wiki/SMBus_Controller

http://www.xbox-linux.org/wiki/Xbox_Hardware_Overv iew#PIC16LC

http://www.xenatera.com/bunnie/proj/anatak/xboxmod .html

1. Not every place even in the US has zoning laws.
2. The EULA is not a law.
3. I bought my XBox from a pawn shop. I got no EULA and even if I did Shrink wrap EULAs are not binding.
4. From this site http://www.xenatera.com/bunnie/proj/anatak/xboxmod .html"Well, it's been about three months since I've posted anything significant. Half of that is I've been finishing my PhD thesis, and the other half is that I've been dealing with legal issues versus my work on the Xbox. Well, last week, I finished both my thesis, and I got a grudging thumbs up, so to speak, from Microsoft on my Xbox reverse engineering work. so...here I am, again."
So Microsoft has have decided it is not illegal.
And finally http://www.gcwf.com/articles/ipu/ipu_sum00_9.html "You are actually allowed by law to reverse engineer copyrighted code so long as it is necessary to discover the ideas or functional elements behind the code" So it is legal.
So if it is totally legal I would say that any question as to it's morality is dumb.

http://www.xenatera.com/bunnie/proj/anatak/xboxnex t_security.pdf

Security is a system problem, and requires you to look beyond the boundaries of software.

Breaking security requires to find a side-channel, where secure information leaks through. Just when you thought you found the perfect software solution, there's some chap that starts probing your address bus or checking the power consumption profile of your processor. Darn!

Has anyone else noticed this MoMA was started by Andrew 'bunnie' Huang? This guy is one of the formost underground experts on what has come to be called hardware hacking, and in that respect he is a genius. I seriously doubt that an MIT graduate of this caliber would let something stupid come to market, give this project some time. Plus, hes a regular /.er.

I've seen press releases that he is on the Infinium Labs advisory board. I've looked on his website and searched google, etc, but I can't find any information about what if anything he may have done there.

Does anyone know what the advisory board did, or knew about? Is that where some of the $350,000 in "advisory fees" went? That's about $50,000 each. I wonder what all that advising bought them.

Someone so needs to send him a free copy of Hacking the Xbox.

Apparently it's also use in the XBox. Instead of the clock havine a battery, they decided to use an aerogel capacitor. Now while it's not enough aerogel to do much with, I found it interesting that it was there anyways.

Have a look at the paper Keeping Secrets in Hardware: the Microsoft XBox Case Study by Andrew "bunnie" Huang, XBox hacker extraordinaire.

Also have a look at his xbox hacking page for lots of other goodies.

You call this hot??? She may be 1000x better than you would ever get, but she aint no hottie.

Correct Link

it seems that this might have some useful application, if i understand the copy protection scheme right.

of course, i haven't tried adding digital output to my discman, and i pretty much prefer vinyl over cds in most cases anyway.

p.

http://www.xenatera.com/bunnie/proj/cdhack/cdhack. html

But looks fun nonetheless.

whatever happened to the MIT hacker, Andrew "bunnie" Huang who supposedly put a custom solder board between x-box components to read the data traveling between them? he supposedly deciphered the security format and figured out the key.

you can read about it here

his ultimate goal was to create "a legal way to create a boot ROM," and he said that "hopefully, in a couple of months we'll have a canned, easy-to-use solution that will allow people to write their own code." you can read his self recorded exploits here

Whatever happened to this guy?

The XBox has hardware-based security to prevent running unauthorized code. Read here for an in-depth description of how the security was cracked.