Print

[Pr0crastin8r]

  keep up the good work... you and opjose make a nice team

[Zander]

Can at least a couple of ppl try this please?

I KNOW some ppl in here have ethereal, and know how to use it.

You can find me on efnet running around. I'd like to discuss the results.

Z

[MagamiAKO]

Actually this is quite a bit of a better job at sniffing than what opjose did, as this is far less confusing......at least to the people experienced in basic packet sniffing.

Unfortunately Zander and I are in the same position, though he knows just a tad more Kerberos than I do......neither of us can decrypt the data. Though when I tried to sniff my xbox through double NAT, it returned KB5DC_ERROR or something like that...We assumed it was more than likely the fact that it was travelling like this:

xbox > my pc > gateway pc > internet


LOL.....the things thhat I find that work are amusing. Though it did work, packets did get to and from as.xboxlive.com, just had return packets of kerberos errors.

[pvwr]

.

[Zander]

I've noticed that working xbox's after the 4 packets of kerberos, go into a direct connection with the XBL IP over port 3074, that conversationis tart by the xbox initially. It doesn't wait for a prompt from XBL.

But in a FAILED Xbox... they like bornounce said in his new thread, the "broken" boxes try to multicast out to XBL, which isn't going to work on lik 99% of networks out there.

Any ideas on how to capture the 4 kerberos packet inboudn adn changing the site0 to site1? I'm trying to come up with a way to do that now...

I REALLY want to know what would happen if a site1 response was issued to a broken xbox. Is it possible this code could determine the way the xbox would determine the method of connection to use somehow? This is theory, no real basis, don't take it for fact at all.

site1 = attempt conventional UDP connection over 3074?
site0 = come at me with mutlicasts?

no idea.

I'm reading up on kerberos to come up with SOMETHING. I just hope it's not some custom MS thing.

Z

[pvwr]

.

[Zander]

It will be hard to decipher if you don't know much about networking and have never sniffed before.

You can find me on efnet though, I can look at the packet for you.

Please note - Your serial is in the packet, if you don't want me to be able to read your serial, don't give out your ethereal capture. Note also though, I have had 3 ppl give me their serials and captures, I will not use them no give them out. It's up to you.

Z

[pvwr]

And was there something relevant on their packets? I guess that mine would be most likely the same thing after all ...

[Zander]

They could be used to establish a established thread of continuitiy, ie.

Broken xboxes have = site0
working xboxes have = site1

I'd like to verify this with ppls sniffs. They can just post their results, if they know how to read the packet sniff, if not, then someone else should analyze it for them and post results here.

I have tested about 5 xboxes and their sniffs thus far, I'd really like to know what more WORKING xboxes see.

Z

[pvwr]

QUOTE

Kerberos Version: 5 MSG Type: TGS-REP Pre-Authentication Type: Unknown preauth type Oxca Value: 30820108a003020117a103020101a281.... Realm: PASSPORT.NET Client Name: SN.(my serial)@xbox.com Type: Service and Instance Name: SN.(SERIALNUMBER)@xbox.com Name: PASSPORT.NET Ticket Version: 5 Realm: XBOX.COM Service Name: sg  Type: Service and Instance  Name: sg  Name: site1 Encrypted Data: Ticket data  Type: rc4-hmac  KVNO: 1  Ciphertext: .... Encrypted Data: Encrypted Payload Type: rc4-hmac CipherText: ...

Yeah, I kinda copied your template, but well, there goes the information anyway.

My XBox is modded with a homebrew chip, no switch so far. I have Evox on HD (evoxdash.xbe bios), linking to MS dah. I updated the dash with Whacked sometime ago and tested it just to see if my connection would work with Live and it did, as it does now (dashboard test).

Of course, as I have not updated the dash after that, I'm not on a ban list whatsover, and I don't even have an account. I guess if I just add the switch I will be fine, but I just don't know for how long   . The safest bet is to get a brand new one, but I'll sure miss DiVX viewing on the XBox, which rocks   .

[NetJunkie]

Hey Zander.  I just tested the non-working box and my results match yours exactly.  Before the non-workign would hit A and get a KB-ERROR reply, then try and hit macs.xboxlive.com.  Now it hits A and gets the same as yours, then hits TGS and gets the same.  It shows up in Site 0.

So, SOMETHING has changed in the last 48 hours.  Maybe MS is working on the issue.

[Zander]

I have taken this as far as my technical ability will allow me.

I would LOVE to see what sending the xbox a "site1" would do, but it's beyond my ability to intercept the communication from TGS.XBOXLIVE.COM change the ONE byte, and forward it to the xbox.

CAN ANYONE DO THIS??? I would love to see what would happen if a non-working xbox got a "site1" packet from TGS.XBOXLIVE.COM

I'm not a programmer though, I can't write a redirector like this.

Help? burnonce? Opjose? anyone?

Z

[NetJunkie]

You won't be able to just change that one item.  This is Kerberos..not just some clear text transmission.  As soon as you change that the system on the other side will detect it with the built-in checks and throw out that packet.  Before someone says "Just regenerate the CRC" it isn't that easy.  Those pieces of info are encrypted in the packet and can't just be changed.

[ArMaGeDdOn]

There is another way to do what you are trying to do and with a, most likely, easier procedure.  It will be lengthier, but will work better [if it works at all]

instead of getting the right signal to GET to the xbox, why don't you have the xbox itself interpret both signals as the same?  that way it will be local.  MS will NOT be able to detect it, and if your theories are correct, you will be able to get online with XBL.  To do this you would have to decompile, edit, and recompile  XBL and possibly its updates.

Uhmm....that's all I can think of.  It will be easier to do, especially if it is successful and others want to do it.  Great job guys.  Hoping you and opjose can figure something out.  You guys are MY biggest hope.

[ArMaGeDdOn]