Hacking the Xbox AN INTRODUCTION TO REVERSE ENGINEERING Unlimited Edition AND REW II BUN N IE" HUANG €:j---- \~:: No Starch Press, Inca San Francisco HACKING THE XBOX. Copyright © 2003 by Xenatera LLC. Some rights reserved. This work is licensed under the Creative Commons Attribution-NonCommerical-ShareAlike License. To view a copy of this license, visit http://creativecommons.org/licenses/by-nc-sa/1.0/ or send a letter to Creative Commons, 559 Nathan Abbott Way, Stanford, CA 94305, USA. Printed on recycled paper in the United States ofAmerica 4 5 6 7 8 9 10-06 05 04 Publisher: William Pollock Managing Editor: KarolJurado Design and Layout: Xenatera LLC No Starch Press and the No Starch Press logo are registered trademarks ofNo Starch Press, Inc. Other product and company names mentioned herein may be the trademarks of their respective owners. Rather than use a trademark symbol with every occurrence of a trademarked name, we are using the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. For information on book distributors or translations, please contact No Starch Press, Inc. directly: No Starch Press, Inc. 555 De Haro Street, Suite 250, San Francisco, CA 94107 USA Phone: 415-863-9900; Fax: 415-863-9950; [email protected]; http://www.nostarch.com The information in this book is distributed on an ''As Is" basis, without warranty. While every precaution has been taken in the preparation of this work, neither the author nor No Starch Press, Inc. shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in it. ISBN 1-59327-029-1 DEDICATION Formy parents, Andrew and Margaret Huang, and for my fiancee, Nikki Justis and For all the hackers who have been silenced by fear of persecution: May there be a day when we are once again free to explore and to pursue our passion for technology. Table of Contents Prologue - README.1ST 1 The Video Game Console Market 2 About Hackers and Hacking 4 The Politics of Hacking 7 The People Behind the Hacks 11 Chapter 1 - Voiding the Warranty 15 Tools of the Trade 15 Tools to Open Things Up 15 Tools to Attach and Remove Components 17 Tools to Test and Diagnose 18 Tools for Design 20 Deconstructing the Xbox 22 Step 1: Safety First 22 Step 2: Remove Case Screws 22 Step 3: Remove the Top Cover 24 Step 4: Move the Disk Drives 25 Step 5: Remove the Disk Drives (Optional) 28 Reassembling the Xbox 28 Chapter 2 - Thinking Inside the Box 31 Reading a Circuit Board 32 Circuit Board Basics 32 Components 34 TestPoints 39 Xbox Architecture 40 High-Level Organization 40 Functional Details 42 CPU 42 Northbridges and Southbn'dges 45 MM 46 ROM 47 Odds andEnds 48 Pattern Matching : 48 Comparison: Xbox Versus the PC 49 Contrast: Xbox Versus the Gamecube 50 Chapter 3 - Installing a Blue LED 53 What You'll Need 54 Removing the Xbox Front Panel 54 Removing the Front Panel Circuit Board 58 Installing the Blue LED 59 Reassembling the Front Panel 63 Debugging 65 X Hacking the Xbox: An Introduction to ReversE! Engineering Chapter 4 ca Building a USB Adapter eo ••••••• 67 Starting Materials 67 Strategy 69 Implementation 69 Chapter 5 - Replacing a Broken Power Supply 73 Diagnosing a Broken Power Supply 74 Replacing the Power Supply 76 Strategy 77 Procedure 78 BWlding the Xbox Power Cable 78 Installing the Replacement Power Supply 84 Operatingwith the Replacement Power Supply 85 Debugging Tips 86 Chapter 6 - The Best Xbox Game: Security Hacking 89 First Encounters with a Paranoid Design 90 To Snarf a ROM 90 An Encounterwith Microsoft 92 Analyzing the ROM Contents 93 Chapter 7 - A Brief Primer on Security 101 Who Needs Security, Anyways? 101 A Brief Primer on Cryptography 104 Classes ofCryptographic Algorithms 105 SHA-1 Ha.sh 109 TEA 111 RC4 113 RSA 114 The Rest ofthe Picture 116 Chapter 8 - Reverse Engineering Xbox Security 119 Extracting Secrets from Hardware 119 Eavesdropping a High Speed Bus 122 Tapping the Bus on aBudget 122 Building the Data ugger ~ 129 Determining the Bus Order and Polan!J . 131 Making Sense of the Captured Data 131 Chapter 9 - Sneaking in the Back Door 00 •••••••••0. 137 Back Doors and Security Holes 138 VisorJam Table Attacks 139 MIST Premature Unmap Attack 140 Microsoft Retaliates 141 Reverse Engineering vl.1 Security 142 The Threat of Back Doors 147 Table of I:ontents xi Chapter 10 - More Hardware Projects .u••••••••••••••••••••• 151 The LPC Interface 151 LPC Interface on the Xbox 152 Using the LPC Interface 153 The Other 64 MB of SDRAM 155 Xbox VGA 157 Mass Storage Replacement 158 Chapter 11 - Developing Software for the Xbox 161 Xbox-Linux 161 InstallingXbox-Iinux 162 "Project B" 166 OpenXDK 171 Chapter 12 - Caveat Hacker 173 Caveat Hacker: A Primer on Intellectual Property, by Lee Tien 175 Classical Intellectual PropertyLaw: An Overview 175 Copynght 176 Patent 178 Trade Seerets 179 The Constitutional Copyright Bargain. 179 The Traditional View of Reverse Engineering 180 Trade Seeref)' and (1mproper Means IJ 180 Copyright Law and the Problem ofIntermediate Copying 181 Patent Law 182 New Challenges for Reverse Engineers 183 The DigitalMillennium CopyrightActand the Problem ofUnauthorizedAccess 184 UnauthorizedAccess 184 Circumvention Technologies 185 Navigating the DMCAjExemptions 185 1201 (f): reverse-engineering for interoperability 186 1201 (g): encryption research 187 1201G): securityresearch 187 End-User LicenseAgreements and ContractualProhibitions on Reverse-Engineering 187 Trade Seerets and the Economic Espionage Act..... 189 The Responsible Hacker: Ignorance Is No Defense 189 Civiland Criminal Offenses and Penalties 190 Reverse Engineering as "The Freedom to Tinker" and Other Legal Issues 191 Chapter 13 - Onward! 193 The Hacking Community 193 Hacking Fora 194 Making a Contribution 195 Trusted Computing 197 Taking a Step Back 199 Palladium Versus TCPA 202 Hacking the Trusted PC 204 Looking Forward 205 Concluding Thoughts 206 xii Hacking the Xbox: An Introduction 'to ReversE! Engineering Appendix A ... Where to Get Your Hacking Gear'.0000 207 Vendors for Hobbyists 207 Prepared Equipment Order Forms 209 Appendix B ... Soldering Techniques .0000000 0.. 00 00 .. 00 211 Introduction to Soldering 211 Use Flux 212 Starter Tips 213 Surface Mount Soldering 214 Technique for Simple Components 215 Technique for Complex Components 216 Technique for Removing Components 219 Appendix C ... Getting into PCB Layout o oooooooo ..oo.223 Philosophy and Design Flow 223 RefIning Your Idea 223 Schematic Capture 224 Board Layout 226 General Placement and Routing Guidelines 227 Leave Spacefor Via Fanouts on Surface Mount Devices 228 Decoupling Capacitors Fit NicelY Under SMD Pads 228 Know Your Special Traces 229 Circuit Boards Make Fine Reatsinks 231 Establish Preferred Routing Directionsfor Each Layer 231 Stack a Board with Orthogonal Layers 231 On Two-Layer Boards, Use Fingers to Bus Power 232 Hints on Usitlg an Auto-'Router 232 CAD Tools 232 Board Fabrication Companies 233 Sierra Proto Express 233 Data Circuit Systems 234 Advanced Circuits 234 Alberta Printed Circuits 234 Starter Projects 235 Appendix D ... Getting Started with FPGAs 0 000000.0.000237 What Is an FPGA? 237 Designing for an FPGA 239 Project Ideas 243 Where to Buy 244 Appendix E- Debugging: Hints and Tips 00000000000 •• 0000247 Don't Panic! 247 Understand the System 247 Observe Symptoms 248 Common Bugs 249 Recovering from a Lifted Trace or Pad 252 Table of Contents xiii Appendix F- Xbox Hardware Reference .8 ••••••••••••••••• 257 Power Supply Pinout 257 Video Connector Pinout 258 USB Connector Pinout 260 Eth.emet Connector Pinout 261 ATA Connector Pinout 262 DVD-ROM Power Connector 263 LPC Connector 264 Fan Connector 265 Front Panel Connector 265 Index 8 •••••••••••••••••••••••••••••••••••••••••• 267 ACKNOWLEDGMENTS I would like to thank my dedicated and caring parents for raising me to be the person that I am today. I would also like to thank my loving fiancee, NikkiJustis, for the wonderful Christmas gift that got this whole thing started. Nikki also deserves a special thanks for helping me produce this book. She was my production staff after Wiley's lawyers decided itwas too legally risky to publish this book because ofthe DMCA. Nikki designed the cover art, assisted with placement, and spent many long hours editing and correcting this book. I would also like to thank the online hacking community for their advice and guidance, especially those who must operate anonymously for fear of persecution by government orretribution by their employer. Lee Tien ofthe Electronic Frontier Foundation,Joseph Liu ofthe Boston College Law School, and Dr. Tom Knight and Prof. Hal Abelson of the :MIT Artificial Intelligence Laboratory all deserve a special thanks for helping me through the process ofpublishing my original paper on the Xbox security system. Had it not been for their support and counsel I never would have published it. I am also indebted to the Xbox-Linux team: Michael Steil, Milosch Meriac, Franz Lehner (thanks for all the detailed technical review!), and the amazing Andy Green (aka numbnut), for providing so much insight into the latest Xbox hacks and for providing such interesting material for the book. Mad props to you guys; keep up the great work. I would also like to thank DanJohnson (aka SiliconIce), founder of the XboxHacker.net BBS, for starting the XboxHacker.net BBS and for his interesting material for the book, and for his very helpful technical review; advice, and encouragement. Also, thanks to Gerhard Farfeleder for contributing a photograph of the Xbox-Linux team. Thanks to Timothy Chen of Via Technologies, Inc., for contributing the P4M266 motherboard for the Xbox versus PC comparison and for his fascinating insight into the PC industry.