Slashdot Mirror
The Hidden Boot Code of the Xbox
Device666 writes "In order to lock out both copied games as well as homebrew software, including the GNU/Linux operating system, Microsoft built a chain of trust on the Xbox reaching from the hardware to the execution of game code, in order to avoid the infiltration of code that has not been authorized by Microsoft. The link between hardware and software in this chain of trust is the hidden "MCPX" boot ROM. The principles, the implementations and the security vulnerabilities of this 512 bytes ROM will be discussed in this wikipedia article entitled
How to fit three bugs in 512 bytes of security code."
dupe
This has already been posted in the Games section. Dupe-a-thon, and posting a Wiki too? Jesus christ.
Thanks for not reading your own site, CmdrTaco
"Little does he know, but there is no 'I' in 'Idiot'!"
http://games.slashdot.org/article.pl?sid=05/08/08/ 2013251&tid=211&tid=156
and, i tried to email the on duty editor, but it was only 'from the future' for 5 mins
Hmm... this sounds strangely familier... http://games.slashdot.org/article.pl?sid=05/08/08/ 2013251
...is a duped slashdot article.
Why can't all fpga/microcontroller manufacturers just release free optimizing compilers???
The title of a seminar held on the Redmond, WA campus.
I didn't get enough out of this article the first time around. Thanks for posting it again!
http://games.slashdot.org/article.pl?sid=05/08/08/ 2013251&tid=211&tid=156
Probably pointed out already, but at least I'm helpful and give the reference link.
I never spellcheck and I freely admit it. Save your karma for more worthwhile "lol erorrs" replies
sorry, not newsworthy
In all fairness, the previous posting of this had NOTHING about Wikipedia in it. Perhaps that was the intended news to spread?
Just because some text is available on a Wiki, it's not automatically so on Wikipedia, y'know?
:%s/Open Source/Free Software/g
YTARY!
the slashdotrix adjusting itself... Pay no attention to that cat.
The principles, the implementations and the security vulnerabilities of this 512 bytes ROM will be discussed in this wikipedia article entitled How to fit three bugs in 512 bytes of security code.
So it seems someone doesn't know the difference between a page with wiki technology and Wikipedia.
You'd expect "editing" to catch something like that...
Advice: on VPS providers
Not only is this a dupe, but the summary claims that the link is a Wikipedia article. Guess what--not every site running MediaWiki is WIkipedia. In fact, I'm pretty sure that only Wikipedia is Wikipedia.
English is easier said than done.
Now you've gone ahead and made my dupe post a dupe. The irony is excruciating.
I never spellcheck and I freely admit it. Save your karma for more worthwhile "lol erorrs" replies
512b of space. NExT ON SLASHDOT!
Wheel of Time: Book by Book and Sumview (summary review) Bigdady92 style: http://bigdady92.blogspot.com/
The thing everyone needs to remember is that slashdot is akin to Norman Bates, a lot of them are confused, a lot of them crossdress and are very often psychotic.
So, the next time you see a dupe.. remember, be quiet.. or you could be murdered by a crossdressing psychopath.
Is that over or under Microsoft's par?
That's not a wikipedia article, that's an article from a wiki running mediawiki.
"...discussed in this wikipedia article entitled How to fit three..."
Articles aren't entitled to anything.
Isn't it more like a chain of mistrust?!
If someone says he and his monkey have nothing to hide, they almost certainly do.
Wow, someone forgot to turn off the auto-MSbash function. Have you heard any complaints about bugs on the xbox? no. How many millions play games on xbox live again?
And considering the lengths you have to go just to install linux on an xbox, mod chips and the like, I'd say those 512 bytes seem to be working just fine.
Oh, sorry, if MS makes it it must be buggy. And I guess they trounced nintendo in the marketplace because they were a monopoly and used anticompetitive practices too.
Why can't people just play the XBox instead of hacking it? I mean seriously, you don't see me hacking my XBox. I buy a game, I play a game. It is quite simple.
Sure the arguement can be brought up that some people want to know how it works. Well? Go work for a bloody gaming company who designs how it works.
I read these articles and think to myself... You know they sure do like to brand Microsoft as bug filled. But damn can't we at least brand the people who are breaking the EULA's and such for these "hacks." Microsoft made a game system for people to enjoy games on.
If they had three freaking bugs, whoopy do. At least I am not the unscrupulous individual who is taking the time and effort into doing something that is morally wrong.
Anyone able to RTFA? Fatal error: Call to a member function on a non-object in /home/groups/x/xb/xbox-linux/htdocs/w/includes/Obj ectCache.php on line 409
Easy. Just put one bug in every 170.666666666666667 bytes and you will be done.
I haven't finished RTFA yet, but I wonder if this will work with that "MS Appproved Hardware" initiative that I've read about.
The simple truth is that interstellar distances will not fit into the human imagination
- Douglas Adams
At least Microsoft provides the same level of security to it own hardware as its does yours. You can't accuse Microsoft of playing favorites.
I don't practice what I preach because I'm not the kind of person that I'm preaching to.
I didn't read it the first time. I don't think I am going to read it the second time.
Tim
Wow. Was it something in the coffee this morning?
First of all, it a dupe with another article in the games section.
Then it's wrong. The article isn't from wikipedia.
Finally, nice sensationalist terms:
- Oh noes, this code locked out GNU/Linux! Bad Microsoft!
- Hah, Microsoft can't even write 512 bytes of code without bugs!
Oh, and that last part was only the subtitle of the article, not the real title. But no thanks for pointing it out.
Read the interesting linked article, or the comments on the original post on games.slashdot, but this article here is exactly what I don't like seeing on Slashdot.
Misleading titles? Inflammatory blurbs? Keep in mind that Slashdot is a tabloid.
If I had the points, I would. Precisely what I thought when I read the GP's comments.
Until you see xbox media center play media off a remote samba share, or you sit down and enjoy playing all your old console games in similiar environment (tv/couch).. you would say things like the GP. Afterwards you would shut your mouth and learn to mod your xbox.
twitter.com/gravitronic
That was really interesting, and while it's a dupe it's the first time I've come across it.
I hadn't really tinkered in my x-box's internals just due to lack of time (I had previous tinkered with my ps1 and n64 a bit.)
I'm an amateur when it comes to assembly but the way that was presented made it pretty much easily readable for anyone. Kudos to the peeps who made it available.
Shadus
All the security that they put on games is a waste of time and money... if people want to copy a game they are going to find a way to do so, nothing has stoped them so far.
Mirror here
http://hardware.slashdot.org/comments.pl?sid=15882 1&cid=13303218 2 1&cid=13303209 2 1&cid=13303204 2 1&cid=13303198 2 1&cid=13303177 2 1&cid=13303176
http://hardware.slashdot.org/comments.pl?sid=1588
http://hardware.slashdot.org/comments.pl?sid=1588
http://hardware.slashdot.org/comments.pl?sid=1588
http://hardware.slashdot.org/comments.pl?sid=1588
http://hardware.slashdot.org/comments.pl?sid=1588
Achille Talon
Hop!
Good news everybody! Apparently according to the new editorial standards set forth by CmdrTaco himself, every site that runs on slashcode can now be referred to as Slashdot! This should help line his pockets further so he'll be able to pay even less attention to his own site (as if that's possible)...
I'll turn into a supernova and burn up everything. Well I'll turn into a black little hole and you'll turn into string.
Only 3 bugs. Out does my GPL/GNU/Linux pos open office do dad with 50 thousand bugs , poor library management, crap fonts. I may go Microsoft after all. Microsoft rules, linux sucks, cause every os sucks--and blows, at the same time
A user is desperate to get his 15 mins by getting his story on the front page. He has tried and failed. A lot. So, he waits for a story to pass that won't be too high profile, and researches it, sticks with it for a while, looking for something different to say about it.
Then he either waits a month or two, or submits it when he thinks a different editor will see it.
Slashdot has a vulnerability. People are abusing it. Get over it.
and that's how xbox-linux.org got slashdotted twice
... It equals their handicap
To Terminate, or not to Terminate, that's the question - SCSIROB
thanks for the repost, man....I almost missed an important piece of geek wisdom so I could have sex.
no..seriously...this is important.
and I almost missed it.
because I was having sex.
with a girl.
man..I wish I could have caught that it was a dupe so I could be recognized for the important accomplishments in life!
the hidden dupe code of the Slashcode...
Dupe Dupe Dupe
how many times slashdotters can say both "dupe" and "just because it's wiki doesn't mean it's wikipedia" for the same article.
Well, there goes my plan of using a fleet of Xbox2s as a render farm to compete with Wetta.
I guess I'll have to go back to scrounging parts from the MIT Flea.
"Live Free or Die." Don't like it? Then keep out of the USA
Neeeeeeoooooobody expects the Slashdot editors! Our chief weapons are laziness, laziness and corporate shilling, our *two* weapons are laziness and corporate shilling...
oh, I give up.
I don't know. From what I've been told, one editor named after a mexican dish looks smashing in a cocktail dress and red garters.
"Live Free or Die." Don't like it? Then keep out of the USA
I'll give you a personal example of why it works in their favor, and perhaps why they continue to put time and money into securing their product.
I used to support Windows 95/98/ME/2K and XP (after it came out) for Microsoft before they decided to move everything to India. (Right about that time I decided that if I didn't want to move to India to keep my job I had better make a few changes and have since left the IT industry) Right as XP was released they gave us all our own copy of XP Pro. I took mine home and installed it so I could actually use it at home while supporting it. (I think that was the whole reason that they gave it to us in the first place) Not too long after that, there was an "internal" release of the "devils own" version of XP. No Activation, No Calling Home, and no problems. I promplty thought, "I need this more than the legit version they gave me..." and installed it the same night that I got a copy of the CD from a coworker. I've been running the internal version of XP ever since and have to date installed many many programs and games and went on with life as usual. I was able to update to SP1 with no problem, and with a little tweaking (Information available online) able to upgrade to SP2. This last little upgrade that won't allow me to use Windows Update unless I'm "legit" happened to stop me from receiving the most recent security updates. I don't want to become part of some Zombie Network etc and know that constant updates help narrow the chance of those problems. Being unable to update my computers security vulnerability I finally threw my hands in the air and gave up. I ran a repair install and put my original product key in and now everything is just fine.
My point is just this. I had a fully usable copy of Windows XP that happened to be "hacked" for lack of better terms and was happy with that. In fact, I was almost proud that I was using the internal (illicit) version vs. the legit version that they had freely given me. Being unable to update from here on out just bothered me and I didn't want to waste a whole lot of time and effort to sidestep the new security that MS had added. I had to go throught he hassle of a recovery reinstall over my current install just to add the legit product key to allow me to update. Now I'm legit again and happy that I won't have to worry about circumventing the system anymore.
Point Being: Sometimes people get tired of bucking the system. (FYI, I have a dual boot setup with Linux on that PC and the same OS dual boot on all of my other computers in the house.) I still like to play games on Windows however and so XP is staying for the time being. I just got tired of having to work around Micrsoft's attempts to stop me from using their OS "illegally". Even though there are always going to be ways around the MS blockades, I don't want to fight it anymore and so have given in.
Microsoft must be thinking: "If you slow people down enough and enough times, some of them may end up just giving up."
Generation Trance: What generation are you?
Im sure that M$ has managed to put more bugs than that in 512 bytes before (ie: WinXP pre-SP1).
Victory shall be mine!
It's actually called 'circle of trust' and once you're out it's extremely hard to get back in, I hear.
Use small bugs, like gnats.
paintball
Yes that does seem to work in some cases... I have always used Legal verions of windows cause I have never wanted to deal with any of the problems like that but there are and always will be those who don't really care, don't have the money, are board and want something to do, and will use illegal verions of anything they can get their hands on. But I was mainly talking about Games... security on games is a waste of time and money because most of the people play games seem to want to hack them anyways in some way or another. Things like Operating systems though I do agree that it is not a waste of time and money, they should try to add more security to operating systems and whatever else but games is a totally different catagory.
"While the CPU initialization can be done in less than 150 bytes, the initialization of the chipset and RAM, if done completely, will require more than 1000 bytes of assembly code."
And at this point me, the old C64 coder, just went "ewwwfffh." Back in the day, you could do all of the CPU and RAMbank initialization you wanted with five bytes! (lda #%whateverbitmask; sta $0001) And memory initialization was simple, ummm... 9 bytes + 3 bytes per 256 bytes of memory cleared. (lda $00; ldx #$00; .clrloop: sta $c0000,x; sta $c100,x; ... ; inx; cpx $ff; bne .clrloop)
PC hardware is monstrously complex. No wonder people no longer code in assembly. =)
Everytime you masturbate, a Slashdot dupe is posted.
So, basically, A LOT.
Video Game News, FAQs, etc
Soon you will be "licensing" the hardware from MS.
The article explains how having lots of internal ROM in an IC is expensive.
The is absolutely false. I worked on a cellphone product in which the main IC (DSP, MCU, etc) had 4k of internal ROM. The cost of the entire part was less than $15 and remember, this included _all_ of the digital circuitry.
You can easily have more than 512 bytes of internal ROM.
The masthead says "news for nerds." If you don't understand why somebody might want to reverse engineer his car stereo so he could install Linux on it, you're at the WRONG website.
So, I have a question actually relevant to this article. The article says that the CPU was supposed to jump to address FFFF_FFFF, turn off the ROM, then roll over to 0000_0000, where the CPU would throw an exception thus halting the CPU. However, says the article, the CPU does not in fact throw an exception in this case.
So my question is, how did the hackers who reverse engineered this code conclude that it was supposed to trigger an exception? It seems hard for me to believe that the MS engineers would base their entire security mechanism on a feature of the CPU that didn't actually exist.
Slashdot posts dupes. So the fuck what? Get over it already.
Personally, I didn't even see the original posting on this story and I'm thankful for the dupe. I doubt I would have found this interesting article otherwise.
Remember, security is layers and each layer protects against certain hackers. Sniffing and understanding communication between chipsets is way beyond the average hacker. And, to date, I cannot place a disc in my XBox and turn it into something else without opening the case ... so in my opinion, it is still secure.
you have to get Nickelodeon or be pretty "long in the tooth" to get the joke. It's a good one, 'though.
p.s.: or Identical cousins or identical Cheese-Hostesses (Google is your friend)
512 bytes is a very small amount of code (it fits on a single sheet of paper!), compared to the megabytes of code contained in software like Windows, Internet Explorer or Internet Information Server. Three bugs within these 512 bytes compromised the security completely - a bunch of hackers found them within days after first looking at the code. Why hasn't Microsoft Corp. been able to do the same? Why? Uh, maybe because they simply don't give a shit?
I've abandoned my search for truth; now I'm just looking for some useful delusions.
"The Xbox is an IBM PC, i.e. it has an x86 CPU. "
I didn't know PPC was x86....
Stupid article.
Well, this is the first time I saw this article. I can't believe they made a virtual machine to handle cpu init only! I found this very insightful into Microsoft.
I used to have conspiracy theories that when MS was going to release a build, they ran an obfuscation script to inject random code. Like copying values around in memory, values that were never used for anything, etcetera, as reverse engineering-quelling techniques.
After using Unixes for a while I began to think that it would be just too much work to reverse engineer Windows, so such techniques were just unnecessary. If you can't buy Windows or run CE for your platform, just use another toolkit and OS.
Reading the amount of work they did to break running normal x86 binaries on their custom PC, the conspiracy theories are coming back.
I also think it's insightful that, instead of say more OpenGL optimizations or more security work, they paid engineers to develop these obfuscation techniques. What does that tell you about them?
Their still grudgingly trying to sell black boxes, whether software or hardware, that buyers will be helpless to work with without them. How can you still think that will work?
When people are using Nokia devices with Linux or whatever the future holds, Bill 'Monty Burns' Gates will still be refusing to get entangled in building or selling anything that he doesn't have total lock-in on. And the tar pit will swell up around him, and he'll join the other dinosaurs.
and the code running on it.
When you bought the xbox, you likely bought a LICENSE TO USE the box to play games, you did NOT get a license TO BREAK their system or use it in a way Microsoft can't capture your money. Just like you don't own MS Windows if you use it. You bought a license for your personal use.
It's precisely because you have no philosophical objection to TCPA devices that the emininent demise of user-modifiable devices is coming quickly. User modifiable devices threaten mega-corporation's ability to maintain control of their property. The political/economic environment will continue to eliminate devices and their manufacturers that mega-corporations can't control.
There is nothing new going on here! This was happening way before DMCA. It's a very simple process, you buy products for a very narrow and well defined purpose of entertainment or productivity. For example, Sony doesn't give you all rights to their movies and games when you buy one. They limit your rights by letting you be entertained by them in your own home among many other very strict conditions.
It's SO sad there are at least 5 people who can't understand a more complex notion of ownership and act indifferent to the extreme limits and controls being forced onto them.
Professing outrage about the DMCA (or any other matter) and it's limitations and doing NOTHING about it is the new american way. Enjoy the new america you have chosen to make for yourself. Sad sad sad.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Then if I smash the XBox I buy with a sledge-hammer, am I guilty of vandalism? After all, I just destroyed Microsoft's property, right?
Furthermore, if I mod it to run Linux and Apache, does Microsoft *really* have any recourse under the DMCA? After all I am not *accessing* their copyrighted code. I am *replacing* it. IANAL, but I think that the Lexmark case might have some relevance here.
Personally I disagree with you in that I don't think that user-modifyable devices are in danger of demise. I think that there will always be a strong market for such devices, and we need to do a better job of selling them. But the market will exist and unless legal mandates exist preventing user modifyable devices from existing, then I don't think there will be a problem.
I am more optimistic than you are. I think that it is just fine for the Studios to be involved in DRM, etc. I think that the tyrany which they excersize over the mind of man will come back to haunt them becuase not only will the market react against them (which it has been doing) but also this will provide incentives to build an open alternative.
Open Source happend before Open Music because software licenses were more intrusive. With the music companies trying to emulate the software industries, they are creating a market for any good entrepreneur who wants to create such a business.
Call me naive, but I think that it is one of the deepest drives of man that he be free. This doesn't necessarily mean anarchy, but it means being free from the fetters which unduely restrain that liberty. Think of how one feels when micromanaged at work or face to face with DRM restrictions. That drive for liberty is undying and, though greed can pervade the world from time to time, it is in its eternal nature stronger than any other drive.
LedgerSMB: Open source Accounting/ERP
Personally I disagree with you in that I don't think that user-modifyable devices are in danger of demise.
True, but user-modifiable devices that can be connected to the Internet are in danger of demise. Alsee explains how.
Sure, Microsoft is doing surprisingly well in NA, but Japan is a different story.
In Europe, only old people have a GameCube. Here's the battle for the #2 console as I see it:
Bring out your obsolete stories...err, x-boxen
Seriously, Microsoft, just stop trying to protect your hardware/software. The second you guys release it, you will have an MASSIVE ARMY of hackers descend upon it and tear it to pieces, while laughing at feeble copy-protection attempts. And if said protection would block, for instance, Linux, you;'ve got a whole NEW army going after it too. Just not worth it, Bill. You're only making it worse for yourself.
It's dumb that the submitter doesn't know the difference between a Wiki and Wikipedia. It's sad that the editor didn't catch this. It's utterly, hopelessly, painfully ridiculous that the editor in question is Rob Malda himself.
You seem to have "a serious case of old."