Print

[dutch nelson]

cache is signed to is'nt is?

[littlestevie360]

QUOTE

Best Practices
Sign all content on the hard disk and MUs, with the exception of cached audio, video, and texture data on the Z: drive.

quoted from documentation, i cant find the string to do it at the moment

but ffrom memory it was something like $xsigcalc [variables]

[stowelly]

so in theory as this crash isnt handled very gracefully (if) they have chosen not to sign this data it may be very possible to insert your own code somewhere? obviously the hypervisor may be abit more difficult to fool, possibly faking a checksum?

[littlestevie360]

ok taking another look at it the crash may actually be a result of the sig being broken, but how many times have we seen an exploit possibilty based on something breaking (007etc) if someone has oblivion and 2 consoles load oblivion on 1 console, dump the cache on the computer thru sata and 360explorer, then run it on the other console and repeat, if it is signed they will differ, signed caches arent portable even on the xbox1 cause of the way the sig is calculated

i would try this myself but i blew my xbox360 up and i dont have oblivion

[stowelly]

its times like this i wish i had the hardware to do it

would getting a recreatable cache crash on my hdd and then putting the hdd on another 360 achieve this same affect, or would it be signed to profile rather than machine?

[littlestevie360]

you wouldnt actually need to reproduce the crash, the sig would probably be to the system as multi profiles can be used

i will search the xbox1 docs again cause it does say how the signing mechanism works on the xbox1, it hasnt failed for them there so i dont see any need to change it for the x360 thus shouldnt be 2 dis-similar, idealy 2 dumps from 2 different hdd's and 2 dif consoles would be the best test as it may be signed to the HDD

anyway i will go to search XDK docs now.....

XeDK would be handy at a time like this lol, but im not big enough to licence one of those (yes i do have access to an official xbox1 debug kit so XDK is not warez'd, well for me anyway)

[stowelly]

would there be anything i can check on my xbox1? i have 2 of these so could test any possible methods?

[littlestevie360]

xbox1 caches are signed with a procedure call Xcalculatesignature_non_roaming which means that the key for the game title (hex key aka what they show up as in TDATA + UDATA) combined with a hash that is made by the console locks it to the specific xbox1, this is also how you get the game saves that are portable and ones that arent on the xbox1, now this is where thing get tricky as they have altered the design and put the HDD external the cache sigs may have changed, as it stands the xbox1 table of what sig should be used where states that cache has 2 vars, 1) non-signed cache data, and 2)signed cache data using xcalcsig_non_roaming (hash+titleID)

now due to external HDD xsigcalc may infact be used for cache signing, thus the signature is worked off the titleID.

PM me as i would like to share some resources Thnx