Slashdot Mirror
Technical Analysis of XBox Save Game Hack
DJPenguin writes "There is an excellent article at the XBox Linux Project that describes exactly how the XBox savegame hack works. It details how the author went to great lengths to hide exactly what was going on. It turns out the exploit code is hidden within an image of Tux himself!" An enlightening read, to say the least.
See IOCCC for true masters of making the code unreadable!
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
Karma whore what does that have to do with anything. All i know is that when xbox becomes 5 years old, Im putting linux on mine.
-- "Why would you quote your self?" -Me.
"we just have to add 0xAD9 to 0x5EF (The starting offset of the code above) to find the offset of the real entry point in the hack, which is therefore 0x10C8"
So... 0xAD9 + 0x5EF = 0x10C8? What a country!
From the looks of this article, they could probably make an entire course at a univeristy devoted to modding the xbox.
Paint.NET, a Free Image Editor, with Source Code Available!
The code was "hidden" in the jfif header, therefore does not qualify as steganography in my opinion. But I bet MS jumps all over this and gets stego banned.
continue praying... thank you holy tux, you defeated evil xbox with nothing more than a blink of your image. if possible reveal thy self in thy full glory and microsoft will treamble in your pressence.
C coders need a doggone contest for this?
The article made little sense to me. Can someone please explain 1. How hacking is usually done 2. And what this article was trying to tell us.
This is not what the forum was meant to be. It was supposed to foster discussion about the topic at hand. The obfuscation in the hack came not intentionally, but because it was disassembled, and decrypted.
What, they accidentally embedded the code in the header of a JPEG image and included a bogus decryptor that implies that this is not the case? Damn I'd love to see some of your code if you do stuff like that by accident.
Sorry for my ignorance, but why hide the code? If a true linux fanatic wants to spread the good word, so to speak, why bother with the whole encryption routine and fake JMP's? Why not just make the hack completely transparent so anyone can do it?
Why are you guys constantly trying to work against the hard-working software publishers at Microsoft?
Come on, guys - you know it's not right. Don't copy that floppy!
What's the point in posting anonymously and then foeing someone that has no freaks (except you)? Just curious.
If anyone knows it would be intresting to hear the reason why.
The code is just brilliant. A lot of care was taken in the construction of this hack. No script kiddie is he.
It looks like it retrives the private key. That's interesting.
Napster-to-go says "Fill and refill your compatible MP3 player", which is a lie. It's not MP3. It's WMA with DRM.
This is an amazing account of reverse engineering!
The original programmer really knows his shit to want to hide everything, but the guy who reversed it is even better!
It's almost like watching two dueling programmers!
Let's all toast them with a glass of Martini-Wodka (use only Moskovskaja: non-russian Wodkas are appalling)
+ORC (the old red cracker)
The fact that you actually used the correct versions of "your" and "you're" in the right places leads me to believe that this is a true statement.
Many calculations in computing are done in base 16 because it's convenient (each circuit is either on or off, two possibilities; 16 is 2 to the 4th power, while 10 is not an even power of two).
In base 16 notation, the digits usually are:
0, 1, 2, 3, 4, 5, 6, 7, 8, 9, a, b, c, d, e, f
So, 15 in decimal (base 10, what you're used to) is f in hexadecimal (base 16, more convenient for computing due to on/off nature of electricity, since 16 is an even power of 2).
And just as 9 + 1 = 10 (reach the highest digit? carry the one and begin with a zero again in the next column) f + 1 = 10 (reach the highest digit, carry the one and begin with a zero again in the next column).
Other basic hex math for example:
9 + 1 = a
9 + 2 = b
f0 + 1 = f1
ff + 1 = 100
a + 1 = b
b + 2 = d
And so on.
The 0x is a holdover from C programming, prefixing a value in c by 0x indicates that it is a hexidecimal (base 16) number and not a decimal (base 10) number.
STOP . AMERICA . NOW
Don't Copy That Floppy
...when you can skim that article and not need to look anything up.
Beep beep.
I don't get it. I read the article, but I don't quite get what is being hacked or what is activating it. Is it a hack to hack your saved games? Or is it a way to modify your save game through an editor, which when loaded will overwrite your operating system in some what that lets you hack it? And what does it have to do with Linux - doesn't the xbox run something else? How could someone design a saved game for the xbox which hacks a Linux kernel?
Windows XP is stored in tux
--
microsoft takes the open PC standard, cripples it, makes it so that you can't upgrade it, you cant WRITE code for it without paying them royalties, you cant RUN code on it without paying them, and puts their logo on the front. If you even try to open this crippled PC, your warranty is void, if you open up and play around with this crippled PC that you payed for and you own ("hack") you are breaking the law. Dont even think about selling modifications to this crippled PC. You will be put in prison with all the rapists and murderers and other menaces to society.
The scariest part? Is that in 10 years, we wont be talking about a console. This is the future of the PC.
You might be right about this being a spy vs. spy thing because the stakes are so huge. This could mean that rival Console makers are actually hacking the X-box to diminish it's threat. That could be a reason why this hack was so well done!
You brought up an excellent point!
I'm still curious as to what "deceipt" is.
... Should go down in the hall of fame right next to the guy who figured out Whippits (sp?). To misquote Dennis Leary, these kids should be working for the Space Program!
...Also, I didn't know Buggalo could fly.
for buffer overflows or what??
Seems that's the number one way to whack an M$ system...
I just loved that. I think the kids were using and Apple GS. I mean can I say that here?
This is interesting in that is predates the major wave of open source that we can freely copy.
You say putting program code in contents of jpeg (despite the fact it could work quite elsewhere just as well) is just a common practice?
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
... that I didn't understand.
I didn't have to look anything up, though...
I know Assembly, and 80x8n assembly, especially. So that was no problem. I could follow the basic plot; I didn't bother to try to read most of the code, but when I did, it wasn't hard to read. The article was pretty good that way.
But it looks to me like the article really didn't tell how the 007 Save Game was hacked. Rather, the article says "yeah it was hacked, and here's the neat part." But that's where it stops.
There isn't enough info here to reproduce it, unless you already are into hacking the XBox.
But that said, I wonder why [and maybe someone who does understand this hack can explain] the XBox-Linux people at sourceforge don't rewrite their install CDs, and give instructions, to allow a person to use this weakness to install Linux from a single CD.
Could it be that this hack really isn't "out there" yet? That the "Free the XBox" hackers are actually still in negotiations with Microsoft [or with their concrete boots at the bottom of the river]?
Correct Horse Battery Staple: 72 bits of entropy. Enter "Correct H" into google. When it generates the phrase, that's
You're going on my ever growing list of foes--people too immature to be of any interest. ...As one of over 150? Wooow! Exquisite!
The modification of the public key to make it divisible by three was absolutely beautiful. Huge props to the unknown hacker.
Conoles will stay consoles. They will be made to play purely games and nothing else. This is what people want to buy, and they're showing it with their pocketbooks right now. Look at how many dedicated gaming devices Sony and Nintendo have sold compared to Microsofts try-and-do-everything Box. The numbers speak for themselves.
The article says:
But you may not know the actual section he's referring to. Here it is:
And (a)(1)(A) is the bit that everyone calls to mind when they think of the DMCA:
(full text of DMCA)
IANAL, but I think this means that if you crack the protection on something simply so you can understand (and document) the program so it will work with other programs and files, then that's not considered a violation of the DMCA.
-jh
Excellent analysis...
Such obfuscated code could only be the prodcut of
A: a paranoid mind
B: someone on a mission to prevent their code from being exploited
C: both.
In the future, I would want to not be isolated from my friends in the Space Station.
That, and the fact that I filmed it
sheesh, the dude were replying to a question about hex math
Eventually, I think all game consoles will have security keys like the Xbox.
Linux is cool, but not every computing device in the world needs to run it. Unlike servers and desktop PCs, game consoles are not mission critical for anything. These Linux hackers should leave the Xbox alone and devote some time to improving X performance on the desktop, or something else useful.
when you say "You know your a geek..."
Oh what about polish vodka?
Liberty freedom are no1, not dicks in suits.
Each Xbox contains the public key. The private key is hidden somewhere at Microsoft.
Besides, the entire ROM of the Xbox has already been dumped by modchip users. If the private key were there it would already be out of the bag and we wouldn't need hacks.
Korahmatah......
Korah rahtahmah....
Korah rahtamah!
Yoodhah korah!
Korah syahdho!
Rahtahmah daanyah!
Korah... keelah... daanyah!
Nyohah! Keelah! Korah! Rahtahmah!
Syadho! Keelah! Korah! Rahtahmah!
(etc)
The interesting bit should be how the dude discovered the overflow...not how it works.
Discovering an overflow in a controlled environment such as a console is no easy task. Console games don't usually crash - what indicated an overflow was present for exploiting?
After that, exploiting an overflow is really just a menial task. There really are only a few issues to differentiate each case - how long can the exploit string be before it overwrites something critical? Are certain characters not allowed in the string?
Beyond that, exploiting it is simple...
So, anybody know how that particular overflow was discovered?
woooohooooo i finally registered confucious says: "man who goes through airport door sideways , going to Bangkok."
"the universe is a figment of its own imagination" (play DAOC its good)
The particular versions of 007 and MechWarrior or whatever games have the exploit, will soon become as sought-after as H-cards were, series 1 Tivos are, and chippable playstations etc., or the modchips themselves. I'd bet the games are already "fixed" to break this exploit, and looking forward the xbox linux folks haven't really moved ahead in the arms race at all.
Now, it appears to me that there might actually be grounds for a lawsuit on the basis of the company's anticompetitive actions, but a few emails to Microsoft and a fax to the attorney general don't amount to anything, and I'm not surprised at the lack of response.
The letter to the antitrust folks would be a good start, if it were revised into a more literate, more polite, and more appropriate form, and then sent via traditional means to carefully selected individuals. But in its current state, and particularly only faxed, it's no surprise at all that the letter was ignored.
There might really be a case here. Possibly a stronger case than the original antitrust issues against Microsoft. But it won't be considered unless someone actually makes an effort to press the matter.
For all the talk about how expensive justice is, I'm having a hard time sympathizing with someone who can't even bother to pay the price of a certified letter with a return envelope, nor the political sense to have the same request sent on their behalf by an individual who has the ear of a politician.
The system -- you get no more out of it than you put in.
Ouch - glad I posted anonymously now - the parent post was beneath my threshold and I didn't notice. Sorry, great-grandparent post.
"and the community is doing this to a product they paid for and own."
/*" may be a bit more dangerous than some n00b with spiked models, but in the end, the asshole who just wiped your root directory is no different than the asshole who just forcibly changed the rules of the game you're playing. They're both modifying something you've paid for, without your permission.
You may have paid for your X-Box. You may have paid for a game. You may be paying your subscription for X-Box Online and whatnot.
Are you paying for everyone else's?
Cheating in single player games, offline, is fine and dandy. Cheating in multiplayer games, online, forces your modifications onto someone else - thereby modding something that you certainly did not pay for.
As much as I'd like to call Microsoft evil for attempting to prevent X-Box hacking any way they can, well.. Years of dealing with pathetic morons in online games has me cheering for Microsoft on this one.
In the end, it's a question of who you want taking your rights away from you. I'd rather have Microsoft attempting to do it as opposed to Joe Noskillz out in Backwater, Kansas.
A different world? The only difference is the depth of damages. "rm -rf
That isn't really you, is it +ORC?
;)
In case it is: Mad props for the great drink recipe - although I'd been cracking for five years before I ever saw your tutorials, I couldn't mix a drink to save my life.