Slashdot Mirror
The Hidden Boot Code of the Xbox
Device666 writes "In order to lock out both copied games as well as homebrew software, including the GNU/Linux operating system, Microsoft built a chain of trust on the Xbox reaching from the hardware to the execution of game code, in order to avoid the infiltration of code that has not been authorized by Microsoft. The link between hardware and software in this chain of trust is the hidden "MCPX" boot ROM. The principles, the implementations and the security vulnerabilities of this 512 bytes ROM will be discussed in this wikipedia article entitled
How to fit three bugs in 512 bytes of security code."
Thanks for not reading your own site, CmdrTaco
"Little does he know, but there is no 'I' in 'Idiot'!"
The title of a seminar held on the Redmond, WA campus.
I didn't get enough out of this article the first time around. Thanks for posting it again!
http://games.slashdot.org/article.pl?sid=05/08/08/ 2013251&tid=211&tid=156
Probably pointed out already, but at least I'm helpful and give the reference link.
I never spellcheck and I freely admit it. Save your karma for more worthwhile "lol erorrs" replies
In all fairness, the previous posting of this had NOTHING about Wikipedia in it. Perhaps that was the intended news to spread?
Just because some text is available on a Wiki, it's not automatically so on Wikipedia, y'know?
:%s/Open Source/Free Software/g
YTARY!
the slashdotrix adjusting itself... Pay no attention to that cat.
The principles, the implementations and the security vulnerabilities of this 512 bytes ROM will be discussed in this wikipedia article entitled How to fit three bugs in 512 bytes of security code.
So it seems someone doesn't know the difference between a page with wiki technology and Wikipedia.
You'd expect "editing" to catch something like that...
Advice: on VPS providers
Not only is this a dupe, but the summary claims that the link is a Wikipedia article. Guess what--not every site running MediaWiki is WIkipedia. In fact, I'm pretty sure that only Wikipedia is Wikipedia.
English is easier said than done.
Now you've gone ahead and made my dupe post a dupe. The irony is excruciating.
I never spellcheck and I freely admit it. Save your karma for more worthwhile "lol erorrs" replies
512b of space. NExT ON SLASHDOT!
Wheel of Time: Book by Book and Sumview (summary review) Bigdady92 style: http://bigdady92.blogspot.com/
The thing everyone needs to remember is that slashdot is akin to Norman Bates, a lot of them are confused, a lot of them crossdress and are very often psychotic.
So, the next time you see a dupe.. remember, be quiet.. or you could be murdered by a crossdressing psychopath.
Is that over or under Microsoft's par?
That's not a wikipedia article, that's an article from a wiki running mediawiki.
Isn't it more like a chain of mistrust?!
If someone says he and his monkey have nothing to hide, they almost certainly do.
Not only that, it's also certainly not a Wikipedia article. Not every Wiki is Wikipedia, for crying out loud.
Switch back to Slashdot's D1 system.
Why can't people just play the XBox instead of hacking it? I mean seriously, you don't see me hacking my XBox. I buy a game, I play a game. It is quite simple.
Sure the arguement can be brought up that some people want to know how it works. Well? Go work for a bloody gaming company who designs how it works.
I read these articles and think to myself... You know they sure do like to brand Microsoft as bug filled. But damn can't we at least brand the people who are breaking the EULA's and such for these "hacks." Microsoft made a game system for people to enjoy games on.
If they had three freaking bugs, whoopy do. At least I am not the unscrupulous individual who is taking the time and effort into doing something that is morally wrong.
Anyone able to RTFA? Fatal error: Call to a member function on a non-object in /home/groups/x/xb/xbox-linux/htdocs/w/includes/Obj ectCache.php on line 409
Easy. Just put one bug in every 170.666666666666667 bytes and you will be done.
I haven't finished RTFA yet, but I wonder if this will work with that "MS Appproved Hardware" initiative that I've read about.
The simple truth is that interstellar distances will not fit into the human imagination
- Douglas Adams
entitle
verb 1 give (someone) a right to do or have. 2 give a title to (a book, play, etc.).
You could probably make an argument, given the second definition, that it is the correct word to use. I personally prefer the simplicity of 'titled', just because it avoids problems like this.
At least Microsoft provides the same level of security to it own hardware as its does yours. You can't accuse Microsoft of playing favorites.
I don't practice what I preach because I'm not the kind of person that I'm preaching to.
Those bugs are not ones that prevent games from running. Those bugs are bugs that prevent the anti-BootROM-tweak system to work.
Sig (appended to the end of comments you post, 120 chars)
I didn't read it the first time. I don't think I am going to read it the second time.
Tim
And not everyone wants to read the same whining over and over and over
Wow. Was it something in the coffee this morning?
First of all, it a dupe with another article in the games section.
Then it's wrong. The article isn't from wikipedia.
Finally, nice sensationalist terms:
- Oh noes, this code locked out GNU/Linux! Bad Microsoft!
- Hah, Microsoft can't even write 512 bytes of code without bugs!
Oh, and that last part was only the subtitle of the article, not the real title. But no thanks for pointing it out.
Read the interesting linked article, or the comments on the original post on games.slashdot, but this article here is exactly what I don't like seeing on Slashdot.
Misleading titles? Inflammatory blurbs? Keep in mind that Slashdot is a tabloid.
Not every Wiki is Wikipedia, for crying out loud.
Correction: Not every wiki that looks like Wikipedia is Wikipedia. It does look the same, but when the URL starts with http://www.xbox-linux.org/, that's kind of a giveaway.
Send email from the afterlife! Write your e-will at Dead Man's Switch.
Posted by CmdrTaco on Friday August 12, @10:32AM
from the stuff-to-read dept.
Oh the irony...
http://stoploudness.org/
Haven't I read this post before?
KFG
If I had the points, I would. Precisely what I thought when I read the GP's comments.
Until you see xbox media center play media off a remote samba share, or you sit down and enjoy playing all your old console games in similiar environment (tv/couch).. you would say things like the GP. Afterwards you would shut your mouth and learn to mod your xbox.
twitter.com/gravitronic
Please show me where they trounced Nintendo in the market place. And when I say market place, I consider the entire world where Nintendo and Microsoft have basically been neck and neck in hardware sales since their respective releases. Sure, Microsoft is doing surprisingly well in NA, but Japan is a different story.
It's like sex, except I'm having it!
That was really interesting, and while it's a dupe it's the first time I've come across it.
I hadn't really tinkered in my x-box's internals just due to lack of time (I had previous tinkered with my ps1 and n64 a bit.)
I'm an amateur when it comes to assembly but the way that was presented made it pretty much easily readable for anyone. Kudos to the peeps who made it available.
Shadus
All the security that they put on games is a waste of time and money... if people want to copy a game they are going to find a way to do so, nothing has stoped them so far.
Please do not use the name of "Jesus Christ" in vain. He died for your sins.
Mirror here
You don't even have to read Slashdot to check these dupes anymore. Just run the titles through Google.
site:slashdot.org xbox boot
With Slashdot not having had major features added in a while I have to wonder what everybody over there is doing that's keeping them from reading their own site. I heard about a CSS implementation of the site in the works, but there have been sample rewrites in CSS for almost 2 years now, so I don't know what the deal is.
Maybe the site should be renamed Slashslashdotdot to reflect its duplicative nature.
rooooar
No, he got nailed to a cross because he said what he wanted to say. Ironic you're telling someone not to say something, isn't it?
http://hardware.slashdot.org/comments.pl?sid=15882 1&cid=13303218 2 1&cid=13303209 2 1&cid=13303204 2 1&cid=13303198 2 1&cid=13303177 2 1&cid=13303176
http://hardware.slashdot.org/comments.pl?sid=1588
http://hardware.slashdot.org/comments.pl?sid=1588
http://hardware.slashdot.org/comments.pl?sid=1588
http://hardware.slashdot.org/comments.pl?sid=1588
http://hardware.slashdot.org/comments.pl?sid=1588
I suspect that they spend most of their time finding all the non-duplicate, insightful articles that have been submitted so that they can reject them.
Obviously you and they are using definitions of marketplace. You even pointed this out in your post. Yet, you are still a jackass about it. Odd.
Achille Talon
Hop!
Good news everybody! Apparently according to the new editorial standards set forth by CmdrTaco himself, every site that runs on slashcode can now be referred to as Slashdot! This should help line his pockets further so he'll be able to pay even less attention to his own site (as if that's possible)...
I'll turn into a supernova and burn up everything. Well I'll turn into a black little hole and you'll turn into string.
He was a little eairly, I didnt start sinning until about 14 years ago. It's good he got a jump on it though.
These stories aren't the same you see: one is a crazy modern teenager while the one is the sophisticated identical cousin from England.
What a crazy pair, two of a kind!
We'll call it the Patty Dupe Show!
Where does the school board find them and why do they keep sending them to ME?
Only 3 bugs. Out does my GPL/GNU/Linux pos open office do dad with 50 thousand bugs , poor library management, crap fonts. I may go Microsoft after all. Microsoft rules, linux sucks, cause every os sucks--and blows, at the same time
A user is desperate to get his 15 mins by getting his story on the front page. He has tried and failed. A lot. So, he waits for a story to pass that won't be too high profile, and researches it, sticks with it for a while, looking for something different to say about it.
Then he either waits a month or two, or submits it when he thinks a different editor will see it.
Slashdot has a vulnerability. People are abusing it. Get over it.
and that's how xbox-linux.org got slashdotted twice
... It equals their handicap
To Terminate, or not to Terminate, that's the question - SCSIROB
thanks for the repost, man....I almost missed an important piece of geek wisdom so I could have sex.
no..seriously...this is important.
and I almost missed it.
because I was having sex.
with a girl.
man..I wish I could have caught that it was a dupe so I could be recognized for the important accomplishments in life!
Perhaps this is all part of a elegant scheme to bring down xbox-linux's website. Way to go Cmdr Taco!
Everything was moving along swimmingly at /. until some monkey decided to allow CmdrTaco to start posting stories.
Or reading the submission...
... but ok. Try "pirated" or "counterfeit" games.
In order to lock out both copied games as well as homebrew software,
Linux is much more than "homebrew software"
including the GNU/Linux operating system,
slows down the lede. do you know for sure that they targeted Linux? how? don't state speculation as fact.
Microsoft built a chain of trust on the Xbox reaching from the hardware to the execution of game code,
try: Microsoft built a chain of trust on the Xbox between the hardware and game code execution.
in order to avoid the infiltration of code that has not been authorized by Microsoft.
this was said already in the first clause. If you are absolutely attached to the word "authorized", eliminate the first clause and move its ideas here. That way you're explaining what happened, and then why it happened, which is a much more natural and readable progression of ideas.
I've noticed a decent amount of code changes that appear to be implemented, and then rolled back. (Testing in production i suppose?) One I noticed a month or two ago that was gone a day or two later was an "Alter Relationship" link instead of seeing the friend/foe bubbles. Another change they rollout and rollback seems to be allowing Anonymous cowards posting from proxies...sometimes i can post as anonymous at work, sometimes not (mostly not...with the "Slowdown cowboy, Its been 15 minutes since you last posted" error.
the hidden dupe code of the Slashcode...
Dupe Dupe Dupe
how many times slashdotters can say both "dupe" and "just because it's wiki doesn't mean it's wikipedia" for the same article.
Well, there goes my plan of using a fleet of Xbox2s as a render farm to compete with Wetta.
I guess I'll have to go back to scrounging parts from the MIT Flea.
"Live Free or Die." Don't like it? Then keep out of the USA
Neeeeeeoooooobody expects the Slashdot editors! Our chief weapons are laziness, laziness and corporate shilling, our *two* weapons are laziness and corporate shilling...
oh, I give up.
http://www.google.com/search?hl=en&lr=&q=site%3Asl ashdot.org+dupe&filter=0
I don't know. From what I've been told, one editor named after a mexican dish looks smashing in a cocktail dress and red garters.
"Live Free or Die." Don't like it? Then keep out of the USA
Yeah, and Hansel and Grethel found a house made of gingerbread. What's your point?
Je fume. Tu fumes. Nous fûmes!
I'll give you a personal example of why it works in their favor, and perhaps why they continue to put time and money into securing their product.
I used to support Windows 95/98/ME/2K and XP (after it came out) for Microsoft before they decided to move everything to India. (Right about that time I decided that if I didn't want to move to India to keep my job I had better make a few changes and have since left the IT industry) Right as XP was released they gave us all our own copy of XP Pro. I took mine home and installed it so I could actually use it at home while supporting it. (I think that was the whole reason that they gave it to us in the first place) Not too long after that, there was an "internal" release of the "devils own" version of XP. No Activation, No Calling Home, and no problems. I promplty thought, "I need this more than the legit version they gave me..." and installed it the same night that I got a copy of the CD from a coworker. I've been running the internal version of XP ever since and have to date installed many many programs and games and went on with life as usual. I was able to update to SP1 with no problem, and with a little tweaking (Information available online) able to upgrade to SP2. This last little upgrade that won't allow me to use Windows Update unless I'm "legit" happened to stop me from receiving the most recent security updates. I don't want to become part of some Zombie Network etc and know that constant updates help narrow the chance of those problems. Being unable to update my computers security vulnerability I finally threw my hands in the air and gave up. I ran a repair install and put my original product key in and now everything is just fine.
My point is just this. I had a fully usable copy of Windows XP that happened to be "hacked" for lack of better terms and was happy with that. In fact, I was almost proud that I was using the internal (illicit) version vs. the legit version that they had freely given me. Being unable to update from here on out just bothered me and I didn't want to waste a whole lot of time and effort to sidestep the new security that MS had added. I had to go throught he hassle of a recovery reinstall over my current install just to add the legit product key to allow me to update. Now I'm legit again and happy that I won't have to worry about circumventing the system anymore.
Point Being: Sometimes people get tired of bucking the system. (FYI, I have a dual boot setup with Linux on that PC and the same OS dual boot on all of my other computers in the house.) I still like to play games on Windows however and so XP is staying for the time being. I just got tired of having to work around Micrsoft's attempts to stop me from using their OS "illegally". Even though there are always going to be ways around the MS blockades, I don't want to fight it anymore and so have given in.
Microsoft must be thinking: "If you slow people down enough and enough times, some of them may end up just giving up."
Generation Trance: What generation are you?
Im sure that M$ has managed to put more bugs than that in 512 bytes before (ie: WinXP pre-SP1).
Victory shall be mine!
It's actually called 'circle of trust' and once you're out it's extremely hard to get back in, I hear.
Use small bugs, like gnats.
paintball
Yes that does seem to work in some cases... I have always used Legal verions of windows cause I have never wanted to deal with any of the problems like that but there are and always will be those who don't really care, don't have the money, are board and want something to do, and will use illegal verions of anything they can get their hands on. But I was mainly talking about Games... security on games is a waste of time and money because most of the people play games seem to want to hack them anyways in some way or another. Things like Operating systems though I do agree that it is not a waste of time and money, they should try to add more security to operating systems and whatever else but games is a totally different catagory.
"While the CPU initialization can be done in less than 150 bytes, the initialization of the chipset and RAM, if done completely, will require more than 1000 bytes of assembly code."
And at this point me, the old C64 coder, just went "ewwwfffh." Back in the day, you could do all of the CPU and RAMbank initialization you wanted with five bytes! (lda #%whateverbitmask; sta $0001) And memory initialization was simple, ummm... 9 bytes + 3 bytes per 256 bytes of memory cleared. (lda $00; ldx #$00; .clrloop: sta $c0000,x; sta $c100,x; ... ; inx; cpx $ff; bne .clrloop)
PC hardware is monstrously complex. No wonder people no longer code in assembly. =)
Everytime you masturbate, a Slashdot dupe is posted.
So, basically, A LOT.
Video Game News, FAQs, etc
That's the fourth bug in 512 bytes of code.
--
"Open source is good." - Steve Jobs
"Open source is evil." - Microsoft
Oh come on mods!
It's not redundant... it's duplicate!
Hmmm witty sig or funny sig? Maybe elitest techy sig!
Soon you will be "licensing" the hardware from MS.
Uhuh, Wikipedia uses MediaWiki. Xbox-Linux uses MediaWiki. Hence the similarity.
-Jar.
Together, We Can Make Slashdot Better. I Do NOT Mod ACs. - Check Me Out
"Alter Relationship" is the alt text for those buttons. The image might not have loaded :)
The article explains how having lots of internal ROM in an IC is expensive.
The is absolutely false. I worked on a cellphone product in which the main IC (DSP, MCU, etc) had 4k of internal ROM. The cost of the entire part was less than $15 and remember, this included _all_ of the digital circuitry.
You can easily have more than 512 bytes of internal ROM.
Shouldn't that be "site:slashdot.org intitle:xbox intitle:boot"?
Method of processing duck feet
The masthead says "news for nerds." If you don't understand why somebody might want to reverse engineer his car stereo so he could install Linux on it, you're at the WRONG website.
1. "copied games" is quite correct; they are generally locked out regardless of legality
2. "A, including B" means that B falls into category A. Nothing else. It doesn't have any effect on the prior part dealing with the verb.
3. Last I checked, things can reach from something to another...
Luke-Jr
So, I have a question actually relevant to this article. The article says that the CPU was supposed to jump to address FFFF_FFFF, turn off the ROM, then roll over to 0000_0000, where the CPU would throw an exception thus halting the CPU. However, says the article, the CPU does not in fact throw an exception in this case.
So my question is, how did the hackers who reverse engineered this code conclude that it was supposed to trigger an exception? It seems hard for me to believe that the MS engineers would base their entire security mechanism on a feature of the CPU that didn't actually exist.
For anyone (like me) who missed the original:
/ 2013251&tid=211&tid=156
http://games.slashdot.org/article.pl?sid=05/08/08
Slashdot posts dupes. So the fuck what? Get over it already.
Personally, I didn't even see the original posting on this story and I'm thankful for the dupe. I doubt I would have found this interesting article otherwise.
Remember, security is layers and each layer protects against certain hackers. Sniffing and understanding communication between chipsets is way beyond the average hacker. And, to date, I cannot place a disc in my XBox and turn it into something else without opening the case ... so in my opinion, it is still secure.
As offtopic as it is, parent really deserves an Insightful mod.
kurzweil_freak
5th Kyu Genbukan Ninpo/KJJR student
Be the darkness that allows the light to shine.
you have to get Nickelodeon or be pretty "long in the tooth" to get the joke. It's a good one, 'though.
p.s.: or Identical cousins or identical Cheese-Hostesses (Google is your friend)
Challenge to Perl geeks -
Write a dupe checker in 512 characters.
512 bytes is a very small amount of code (it fits on a single sheet of paper!), compared to the megabytes of code contained in software like Windows, Internet Explorer or Internet Information Server. Three bugs within these 512 bytes compromised the security completely - a bunch of hackers found them within days after first looking at the code. Why hasn't Microsoft Corp. been able to do the same? Why? Uh, maybe because they simply don't give a shit?
I've abandoned my search for truth; now I'm just looking for some useful delusions.
And the acronym works too: SSDD (same shit, different day).
We all know what to do, but we don't know how to get re-elected once we have done it
"The Xbox is an IBM PC, i.e. it has an x86 CPU. "
I didn't know PPC was x86....
Stupid article.
Well, this is the first time I saw this article. I can't believe they made a virtual machine to handle cpu init only! I found this very insightful into Microsoft.
I used to have conspiracy theories that when MS was going to release a build, they ran an obfuscation script to inject random code. Like copying values around in memory, values that were never used for anything, etcetera, as reverse engineering-quelling techniques.
After using Unixes for a while I began to think that it would be just too much work to reverse engineer Windows, so such techniques were just unnecessary. If you can't buy Windows or run CE for your platform, just use another toolkit and OS.
Reading the amount of work they did to break running normal x86 binaries on their custom PC, the conspiracy theories are coming back.
I also think it's insightful that, instead of say more OpenGL optimizations or more security work, they paid engineers to develop these obfuscation techniques. What does that tell you about them?
Their still grudgingly trying to sell black boxes, whether software or hardware, that buyers will be helpless to work with without them. How can you still think that will work?
When people are using Nokia devices with Linux or whatever the future holds, Bill 'Monty Burns' Gates will still be refusing to get entangled in building or selling anything that he doesn't have total lock-in on. And the tar pit will swell up around him, and he'll join the other dinosaurs.
and the code running on it.
When you bought the xbox, you likely bought a LICENSE TO USE the box to play games, you did NOT get a license TO BREAK their system or use it in a way Microsoft can't capture your money. Just like you don't own MS Windows if you use it. You bought a license for your personal use.
It's precisely because you have no philosophical objection to TCPA devices that the emininent demise of user-modifiable devices is coming quickly. User modifiable devices threaten mega-corporation's ability to maintain control of their property. The political/economic environment will continue to eliminate devices and their manufacturers that mega-corporations can't control.
There is nothing new going on here! This was happening way before DMCA. It's a very simple process, you buy products for a very narrow and well defined purpose of entertainment or productivity. For example, Sony doesn't give you all rights to their movies and games when you buy one. They limit your rights by letting you be entertained by them in your own home among many other very strict conditions.
It's SO sad there are at least 5 people who can't understand a more complex notion of ownership and act indifferent to the extreme limits and controls being forced onto them.
Professing outrage about the DMCA (or any other matter) and it's limitations and doing NOTHING about it is the new american way. Enjoy the new america you have chosen to make for yourself. Sad sad sad.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Then if I smash the XBox I buy with a sledge-hammer, am I guilty of vandalism? After all, I just destroyed Microsoft's property, right?
Furthermore, if I mod it to run Linux and Apache, does Microsoft *really* have any recourse under the DMCA? After all I am not *accessing* their copyrighted code. I am *replacing* it. IANAL, but I think that the Lexmark case might have some relevance here.
Personally I disagree with you in that I don't think that user-modifyable devices are in danger of demise. I think that there will always be a strong market for such devices, and we need to do a better job of selling them. But the market will exist and unless legal mandates exist preventing user modifyable devices from existing, then I don't think there will be a problem.
I am more optimistic than you are. I think that it is just fine for the Studios to be involved in DRM, etc. I think that the tyrany which they excersize over the mind of man will come back to haunt them becuase not only will the market react against them (which it has been doing) but also this will provide incentives to build an open alternative.
Open Source happend before Open Music because software licenses were more intrusive. With the music companies trying to emulate the software industries, they are creating a market for any good entrepreneur who wants to create such a business.
Call me naive, but I think that it is one of the deepest drives of man that he be free. This doesn't necessarily mean anarchy, but it means being free from the fetters which unduely restrain that liberty. Think of how one feels when micromanaged at work or face to face with DRM restrictions. That drive for liberty is undying and, though greed can pervade the world from time to time, it is in its eternal nature stronger than any other drive.
LedgerSMB: Open source Accounting/ERP
Personally I disagree with you in that I don't think that user-modifyable devices are in danger of demise.
True, but user-modifiable devices that can be connected to the Internet are in danger of demise. Alsee explains how.
Sure, Microsoft is doing surprisingly well in NA, but Japan is a different story.
In Europe, only old people have a GameCube. Here's the battle for the #2 console as I see it:
The point has been lost if you don't understand that editors are supposed to improve functionally correct text by adding clarity and making it more concise.
Bring out your obsolete stories...err, x-boxen
Well, I must admit that dupes are worth reading over again just for the funny comments! Maybe Mr. Taco was just trying to make us laugh? :)
Seriously, Microsoft, just stop trying to protect your hardware/software. The second you guys release it, you will have an MASSIVE ARMY of hackers descend upon it and tear it to pieces, while laughing at feeble copy-protection attempts. And if said protection would block, for instance, Linux, you;'ve got a whole NEW army going after it too. Just not worth it, Bill. You're only making it worse for yourself.
It's dumb that the submitter doesn't know the difference between a Wiki and Wikipedia. It's sad that the editor didn't catch this. It's utterly, hopelessly, painfully ridiculous that the editor in question is Rob Malda himself.
$ while true; do (echo "not every site running MediaWiki is WIkipedia!" | post-to-slashdot sid=15882); done
How many more of those can Slashdot take?
Maybe we should try all permutations of words in that sentence? Write a polymorphic engine for it? DOS attack Wikipedia asking it for its own definition?
Oh well...
The Hacker's Guide To The Kernel: Don't panic()!
Your point was lost when you had delusions about being an editor, rather than an incorrect, petty pedant.
im in ur
You seem to have "a serious case of old."
Because I pipe the text into post-to-slashdot, to make it clear what is input to what. Not using parens would break the while loop.
I generally don't like "here-documents" that much, especially if they contain shell commands, messes up string highlighting to make the input stand out.