Topic: BugTraq: Xbox360 Hypervisor Vulnerability - Unsigned Code on Kernel 45 (Read 1754 times)

Zeze21 · « **Reply #90 on:** February 28, 2007, 03:05:00 AM »

Please can we minimize the chatting and go on thinking
seriously you all look to me like a buch of chicken who all just have laid eggs
Most of you don't know anything about the hardware or the software of the x360 but are still talking about it like they were hacking gods
Most of you don't even bother to read anything just post comments like "this is great" etc. Please open a new topic saying "comments on the x360 hack" and talk there and if someone has a great idea in there i am sure it will spread but please could you all just leave the guys who really have a clue about all this alone to think and get ideas of their own. I am sure they all apreacheate it

The Zep Man · « **Reply #91 on:** February 28, 2007, 03:31:00 AM »

QUOTE(Zeze21 @ Feb 28 2007, 11:05 AM)

Please can we minimize the chatting and go on thinking
seriously you all look to me like a buch of chicken who all just have laid eggs
Most of you don't know anything about the hardware or the software of the x360 but are still talking about it like they were hacking gods
Most of you don't even bother to read anything just post comments like "this is great" etc. Please open a new topic saying "comments on the x360 hack" and talk there and if someone has a great idea in there i am sure it will spread but please could you all just leave the guys who really have a clue about all this alone to think and get ideas of their own. I am sure they all apreacheate it

Why don't you open a separate topic with the title "Technical detailed discussion about the BugTraq news" if it bothers you so much?

This topic is bound to the news article and therefore the place to discuss give your opinion about it. The people who really do know what the news article is talking about will discuss it at some other place where it is more quiet.

Zeze21 · « **Reply #92 on:** February 28, 2007, 03:53:00 AM »

http://forums.xbox-scene.com/index.php?showtopic=589099 i did! since you are not cooperating

big nasty 187 · « **Reply #93 on:** February 28, 2007, 03:59:00 AM »

QUOTE(Zeze21 @ Feb 28 2007, 02:05 AM)

Please can we minimize the chatting and go on thinking
seriously you all look to me like a buch of chicken who all just have laid eggs
Most of you don't know anything about the hardware or the software of the x360 but are still talking about it like they were hacking gods
Most of you don't even bother to read anything just post comments like "this is great" etc. Please open a new topic saying "comments on the x360 hack" and talk there and if someone has a great idea in there i am sure it will spread but please could you all just leave the guys who really have a clue about all this alone to think and get ideas of their own. I am sure they all apreacheate it

i thought nazism died in the 1940's (IMG:style_emoticons/default/rolleyes.gif)

Zeze21 · « **Reply #94 on:** February 28, 2007, 04:02:00 AM »

are you insulting me just because i am german?

kalle_19 · « **Reply #95 on:** February 28, 2007, 04:19:00 AM »

Wenn es einige Leute gibt, die beleidigt werden muß, ist es die Amerikaner.

Mike Bowler · « **Reply #96 on:** February 28, 2007, 04:22:00 AM »

Yo Zeze21 what right do you have to tell people what to do in a community forum?

Just because someones ideas might not be of any use or of limited use doesn't mean that that particular persons idea isn't heading in the right direction or couldn't otherwise come up with a totally different idea not even based on there 1st idea that in turn turns out to be better than there 1st idea. Likewise the persons particular idea could inspire someone else to come up with another idea which could turn out to be good.

Or quite plain and simply an idea could be totally useless, but at least there trying to help and aren't going on and on (like me, but i'm defending people against people like you). (IMG:style_emoticons/default/smile.gif)

edit: sorry kalle_19 could you say that in english as well as german? (at least i think its german lol)

This post has been edited by Mike Bowler: Feb 28 2007, 12:26 PM

Adamq · « **Reply #97 on:** February 28, 2007, 04:28:00 AM »

QUOTE(kalle_19 @ Feb 28 2007, 12:19 PM)

Wenn es einige Leute gibt, die beleidigt werden muß, ist es die Amerikaner.

Translation

If there are some people, which must be insulted, it is the Americans

TheSpecialist · « **Reply #98 on:** February 28, 2007, 04:30:00 AM »

QUOTE(grogger13 @ Feb 28 2007, 10:18 AM)

If one more person offers there infinite wisdom about things they know nothing about I'm not really gonna do anything, but it is really pissing me off. I came to the forum to find some explanation of what this hack can actually do and all I see are dumbasses saying, "now all we need to do is unblow the efuse" like there the first person to think of something like that.

Please would someone who actually knows something about this offer some insight. I know i dont know anything about it so I'm not gonna try.

Some people in this thread already made the right conclusion. This hack is interesting because it opens a whole new world of new hacking possibilities.

One of the key features in the xbox 360 security is the 'hypervisor'. Microsoft moved all 'security sensitive' processes to the hypervisor this time. The hypervisor is in encrypted in RAM. Also, in the flash, where it is (most probably) stored, it is encrypted. In short, it's VERY VERY difficult to get to the decrypted hypervisor code.

With this hack, it finally becomes feasible to get that decrypted hypervisor code, containing all the security stuff, so that is the true merit of this hack, IMHO

So, now people will start to try to replicate this hack, which isn't as easy as it seems by the way. The main problem is: how to get the exploit code into the memory ? As you could also see in the video, they use the king kong demo. About a year ago, some people were using this this for shader experiments. Some people found a way to crash the x360. My idea is that they use a shader exploit to crash the x360 and then move the exploit code to the stack. Or maybe they use a shader exploit to just directly write to system RAM. But details on this are not public, so still, quite some research has to be done, even to just be able to replicate this hack ...

This post has been edited by TheSpecialist: Feb 28 2007, 12:49 PM

GBW88 · « **Reply #99 on:** February 28, 2007, 04:36:00 AM »

QUOTE(kalle_19 @ Feb 28 2007, 06:19 AM)

Wenn es einige Leute gibt, die beleidigt werden muß, ist es die Amerikaner.

Good job smart guy. Here, heres a funny one- we made the console your playing on. Show some respect.

RolfLobker · « **Reply #100 on:** February 28, 2007, 04:42:00 AM »

QUOTE(TheSpecialist @ Feb 28 2007, 12:30 PM)

........

In addition I think that there are still lot's of obstacles which are still in the way of an 'easy hack' (i.e. modchip / softmod)

It's not possible to just downgrade any kernel and there is, as stated by TheSpecialist, also the problem of: how to get code into memory.
As a proof of concept this is fine. But most 360's have the Kiosk Disc blacklisted and have newer kernels.

Personally I don't think we can expect modchips like for the original xbox.
Maybe something more like the old PS2 chips will work (lots of soldering points and wires for on-the-fly code-patching)
Or maybe microsoft will goof up somewhere, like they did with the kiosk disc, and release an exploitable live game or something.

This hack provides a lot of insight and indeed opens doors.
It gives the right people access to other means of hacking the 360 just like modchips for the original xbox paved the way to softmods. (softmods on the original xbox would not have been possible without modchips first which also provided lots of insight and opportunities)

But maybe I'm just talking from my ass here...

pelago · « **Reply #101 on:** February 28, 2007, 04:54:00 AM »

xboxhacker.net is the place to go if you want informed discussion about hacks. Don't post there unless you're an expert though!

This post has been edited by pelago: Feb 28 2007, 12:54 PM

razorrifh · « **Reply #102 on:** February 28, 2007, 04:58:00 AM »

im assuming bugtraq is a company that finds security holes and helps companies fix them. thats why they worked with ms to fix it.

fghjj · « **Reply #103 on:** February 28, 2007, 04:59:00 AM »

This means the anonymous hacker probably had code running in "ring2" mode since forever.

He knows that there are still plenty of v.4532 and v.4548 boxes around, so anyone smart can acquire one and start searching for exploitable bugs in other game titles.

flashfreak · « **Reply #104 on:** February 28, 2007, 04:57:00 AM »

QUOTE(brandogg @ Feb 28 2007, 03:36 PM)

I wonder if Team Xecuter's interview the other day was hinting at any of this.

Thinking of it now, im suprised no1 else picked this up. It was very conincidental that they started talking about this now.

QUOTE(GBW88 @ Feb 28 2007, 03:49 PM)

Bring back bunnie, I say.

They fry a fuse, and everything gets locked down. Period.

Just to let you and many people know, bunny did well, he managed to find some very useful things, but he is not God. Not saying hes useless, hes done amazing things for the scene, but so have many other people.

Though I liked ur way of pointing out the security system. They can simply stop it all. We're gonna see heaps of bricked consoles during testing of this hole.

Though I dont think i have a need for much homebrew at the moment. I dont need XBMC on my 360, cos its in my room on my 40" LCD, right with my computer on the same screen, its easier to use the PC.

Though i am interested in some homebrew games

Jumpnbump on 360. I cant wait

Pwning rabbits using wireless controllers! Hopefully someone upgrades that game to HD, heh heh. Anyone who has played it will know exactly what im talking about. Go Jiffy!

Author Topic: BugTraq: Xbox360 Hypervisor Vulnerability - Unsigned Code on Kernel 45 (Read 1754 times)