xboxscene.org forums

Pages: 1 ... 4 5 [6] 7 8 ... 17

Author Topic: BugTraq: Xbox360 Hypervisor Vulnerability - Unsigned Code on Kernel 45  (Read 1754 times)

[Evil]Dude

  • Archived User
  • Newbie
  • *
  • Posts: 8
BugTraq: Xbox360 Hypervisor Vulnerability - Unsigned Code on Kernel 45
« Reply #75 on: February 28, 2007, 12:34:00 AM »

Hm, now that we have something signed by MS with bugs, I'm hoping that some progress can be made.
Logged

Lamer123

  • Archived User
  • Sr. Member
  • *
  • Posts: 268
BugTraq: Xbox360 Hypervisor Vulnerability - Unsigned Code on Kernel 45
« Reply #76 on: February 28, 2007, 12:38:00 AM »

I see alot of talk about a downgraded Firmware chip and it seems that people forget that you cant sell a chip with copyrighted info on it.


The downgraded chip will not happen and if it does it would get shut down.


That is unless it goes the whole xbox route and sells blank chips that need to be flashed on your computer with illegal bioses.
Logged

drunken_marlboroman

  • Archived User
  • Newbie
  • *
  • Posts: 32
BugTraq: Xbox360 Hypervisor Vulnerability - Unsigned Code on Kernel 45
« Reply #77 on: February 28, 2007, 12:59:00 AM »

Holy shit!! Wasn't expecting this! biggrin.gif
Logged

kalle_19

  • Archived User
  • Newbie
  • *
  • Posts: 36
BugTraq: Xbox360 Hypervisor Vulnerability - Unsigned Code on Kernel 45
« Reply #78 on: February 28, 2007, 01:12:00 AM »

GREAT!

Has anyone tried this? Pictures would be awesome!
Logged

ITMASTER

  • Archived User
  • Newbie
  • *
  • Posts: 17
BugTraq: Xbox360 Hypervisor Vulnerability - Unsigned Code on Kernel 45
« Reply #79 on: February 28, 2007, 01:11:00 AM »

The day will come soon )) go go go wink.gif
Logged

englishnamja

  • Archived User
  • Jr. Member
  • *
  • Posts: 59
BugTraq: Xbox360 Hypervisor Vulnerability - Unsigned Code on Kernel 45
« Reply #80 on: February 28, 2007, 01:15:00 AM »

releasing the bug to the vendor the guy was given a free copy of windows vista, and a I love the WOW experince t-shirt...

i bet he wished he didnt bother..

bring on downgrading...... tongue.gif
Logged

Pandoriaantje

  • Archived User
  • Full Member
  • *
  • Posts: 248
BugTraq: Xbox360 Hypervisor Vulnerability - Unsigned Code on Kernel 45
« Reply #81 on: February 28, 2007, 01:29:00 AM »

QUOTE(ILLusions0fGrander @ Feb 28 2007, 02:50 AM) *

odd.. i dont use my FW hacked 360 much.. newest game ive played on it was... carbon?

D:2.0.4532.0

hope something comes of this! doubt it will be very soon, but its a little more hopeful

I've just played carbon (PAL/EURO), like 2 days ago and it asked me to upgrade.
My kernel is now: K:2.0.2868.0

So don't think carbon is the culprit.

Guess i'll have to find the right update.
Logged

running_wild

  • Archived User
  • Jr. Member
  • *
  • Posts: 68
BugTraq: Xbox360 Hypervisor Vulnerability - Unsigned Code on Kernel 45
« Reply #82 on: February 28, 2007, 01:32:00 AM »

QUOTE(Lamer123 @ Feb 28 2007, 08:38 AM) *

I see alot of talk about a downgraded Firmware chip and it seems that people forget that you cant sell a chip with copyrighted info on it.
The downgraded chip will not happen and if it does it would get shut down.
That is unless it goes the whole xbox route and sells blank chips that need to be flashed on your computer with illegal bioses.


I think people are missing the point here. People have already gained access to the kernel and downgraded it physically on the motherboard itself, but the CPU has fuses within it (Impossible to get at, don't even suggest it) - One of which apparently blows with the update. It does not matter how you provide a previous kernel at this stage, the security on the Xbox will NOT run it.

Perhaps there is potential for an exploit here, but as it stands, replacing the kernel is only a portion of the problem (One already mostly solved), Getting a CPU to run a downgraded kernel with a blown Efuse is now the difficulty.

I think that a far more likely outcome is another similer exploit is discovered, and the removal of the afforementioned resistor is used to block any more e-fuse abuse on MS's behalf.
Logged

jron

  • Archived User
  • Newbie
  • *
  • Posts: 2
BugTraq: Xbox360 Hypervisor Vulnerability - Unsigned Code on Kernel 45
« Reply #83 on: February 28, 2007, 01:38:00 AM »

What is this resistor R6T3 a few people are talking about? If true, simply go buy a 360 that wasn't shipped in the last 30 days and remove that resistor. Then, downgrading is always an option. Is this resistor info true or simply bologna?
Logged

englishnamja

  • Archived User
  • Jr. Member
  • *
  • Posts: 59
BugTraq: Xbox360 Hypervisor Vulnerability - Unsigned Code on Kernel 45
« Reply #84 on: February 28, 2007, 01:51:00 AM »


QUOTE FROM SITE....

eFuse, so called because it employs millions of electrical fuses that are built into the chip's circuitry. Together, the microfuses act as a kind of autonomous traffic control network, responding to the changing demands placed on the microprocessor to switch individual circuits on and off as required.

Under-utilised circuits can be throttled back to conserve power - a technique already used in modern processors, albeit on a larger functional unit-level scale - which in-demand circuits can be adjusted upward to enhance performance, IBM said.

The traffic management analogy is also IBM's. It likens the technology to opening and closing a highway's lanes according to the level of traffic. Of course, you can't open up lanes that aren't there in the first place, so the analogy implies the addition of resources on board each die the remain unused except in times of peak demand.

Certainly Power 5 is known to support simultaneous multi-threading (SMT), the same technique that Intel uses but calls HyperThreading. Essentially, functional units unneeded by one thread are given a second thread to process, with the upshot that the OS 'sees' the CPU as two, rather than one. You don't get a doubling of performance, but there is a gain.

By the sounds of things, IBM has rolled its SMT implementation into the broader eFuse technology, which also appears to provide a number of features originally came out of Big Blue's eLiza project, which sought to develop fault detection and management systems for software and hardware.

Indeed, "eFuse is part of a built-in self-repair system that constantly monitors a chip's functionality. If an imperfection is detected, this technology 'instinctively' initiates corrective actions by tripping inexpensive electrical fuses that are designed into the chip. The fuses help the chip control individual circuit speed to manage power consumption and repair unexpected, and potentially costly flaws", says IBM.

Overclockers, beware
"If the technology detects that the chip is malfunctioning because individual circuits are running too fast or too slow, it can 'throttle down' these circuits or speed them up by controlling the appropriate local voltage," the company continues. So, overclockers, beware.

eFuse appears to operate at several levels. There's an element of pre-ship tuning, in which IBM allows eFuse to adapt processors for the customer's anticipated application load. On site, the technology continues to adapt according to ongoing workloads.

So how does is work? Essentially, the system uses the phenomenon of 'electromigration', in which moving electrons - current - transfer momentum to the surrounding crystal lattice. That causes the lattice to vibrate and can ultimately induce changes in the microstructure that in turn cause a circuit to fail - the chip equivalent of a light-bulb filament fusing. The greater the vibrations, the hotter the circuit and the hotter the circuit gets, the more it vibrates and the more likely electrons are to hit the lattice, imparting more momentum.

This is a real problem with integrated circuits, and chip designers have spent many hours and dollars figuring out how to limit the problem and thus be able to ship chips that don't fail after a few weeks' operation.

IBM claims that it is the first to actually use this unwanted phenomenon to control all those fuses it's added to the chip, presumably by using the thermal changes to trip fuses and thus kick in so-far unused circuits. Again, that implies a high level of redundancy.

IBM admits the technique isn't entirely new, but it has figured out how to trip the fuses without damaging other parts of the processor, which was the key failing of previous attempts to use microfuses.

In addition to Power 5, IBM will add eFuse to all other 90nm chips it produces, including future PowerPC G5s, the company's literature suggests. It will also offer the technique to foundry customers.
-----------------------------------------------------------------------------------------------------------------------------

prehaps M$ asked IBM to build it arround the fact that.. if the Kernel or Bios is flashed withing signing it would blow a fuse....

who knows but damn smart idea.....

Logged

geoffmac

  • Archived User
  • Jr. Member
  • *
  • Posts: 73
BugTraq: Xbox360 Hypervisor Vulnerability - Unsigned Code on Kernel 45
« Reply #85 on: February 28, 2007, 01:57:00 AM »

Maybe the system can be tricked into thinking the older kernel is actually the newer kernel version??
Logged

grogger13

  • Archived User
  • Full Member
  • *
  • Posts: 101
BugTraq: Xbox360 Hypervisor Vulnerability - Unsigned Code on Kernel 45
« Reply #86 on: February 28, 2007, 02:18:00 AM »

If one more person offers there infinite wisdom about things they know nothing about I'm not really gonna do anything, but it is really pissing me off.  I came to the forum to find some explanation of what this hack can actually do and all I see are dumbasses saying, "now all we need to do is unblow the efuse"  like there the first person to think of something like that.

Please would someone who actually knows something about this offer some insight.  I know i dont know anything about it so I'm not gonna try.

This post has been edited by grogger13: Feb 28 2007, 10:18 AM
Logged

HoRnEyDvL

  • Administrator
  • Sr. Member
  • *****
  • Posts: 462
BugTraq: Xbox360 Hypervisor Vulnerability - Unsigned Code on Kernel 45
« Reply #87 on: February 28, 2007, 02:20:00 AM »

Did some one say nexgen 360 on 360 (IMG:style_emoticons/default/smile.gif) checked my kernel version & have 4548
Wont be updating it until i get homebrew running psyched (IMG:style_emoticons/default/smile.gif)

Those who updated well tough luck u cant unblow an efuse or create a bypass or anything what u can do tho is wait & be patient. Let us hack this first & get things running once that is done the we can start focusing on higher kernels like the PSP scene first it was 1.0 then 1.5 then 1.7 Ect One kernel will help us understand what changes have been added to the next & we can start finding work a rounds.

This post has been edited by HoRnEyDvL: Feb 28 2007, 11:00 AM
Logged

openxdkman

  • Archived User
  • Hero Member
  • *
  • Posts: 550
BugTraq: Xbox360 Hypervisor Vulnerability - Unsigned Code on Kernel 45
« Reply #88 on: February 28, 2007, 02:43:00 AM »

Mmm, I'm a bit disappointed. I was hoping hacker could wait for release of 65nm model...
Current model lifespan is a bit small for doing interesting things on long term... Whatever...

For those interested in homebrew and not in online stuff or evern retail games (others, ignore it) :

1st batch of homebrew compatible xbox360's : ones with kernel 4532 or 4548

People with kernel<4532 :  Don't connect, don't play new retail games. Keep your kernel version.
Wait for modchips sellers advice (mod to prevent efuse blow, specific upgrader, etc...)

People with kernel 4532 : Don't connect, don't play new retail games. Keep your kernel version.

People with kernel 4548 : Don't connect, don't play new retail games. Keep your kernel version.

People with kernel>4548 : Gather people in class action suit in order to know if you can obtain back the blown efuse. It's very interesting to know if it's legal to blow an efuse inside someone's harware remotely without warning customer. If efuse threat is always active every future breach will end the same way for online gamers : too late.

Everyone: we need to know which retail games are forcing updates that blow efuses. (start a new thread)

Good point: a few people will now be able to explore all software parts, maybe to produce xbox360 emulators for future platforms.

This post has been edited by openxdkman: Feb 28 2007, 10:46 AM
Logged

The Zep Man

  • Archived User
  • Hero Member
  • *
  • Posts: 888
BugTraq: Xbox360 Hypervisor Vulnerability - Unsigned Code on Kernel 45
« Reply #89 on: February 28, 2007, 02:39:00 AM »

Most interesting Xbox 360 news. Finally something different, compared to the hundreds of DVD mods. Time to attack the Xbox 360 itself. wink.gif

I think 2007 will be the year in which we can see the first homebrew applications running on a retail Xbox 360.
Logged
Pages: 1 ... 4 5 [6] 7 8 ... 17