xboxscene.org forums

Pages: [1] 2

Author Topic: 360 Prone To Dma Exploits  (Read 1155 times)

atlanta800

  • Archived User
  • Jr. Member
  • *
  • Posts: 76
360 Prone To Dma Exploits
« on: November 17, 2005, 03:34:00 PM »

Because M$ decided to open compatibility with many third party devices (iPods, etc), it opens the possibility for DMA hacks. (Read here to see where I'm coming from http://www.hackaday....34000523067226/)

So I must ask the question, is it possible to, say, write a program for an iPod runing iPodLinux, then get a complete memory dump from the 360? Taking it further, we could also write to the Xbox's memory correct? So could we insert a homebrew program that would do what we want (flash a chip, run an FTP server, etc) then change the EIP to run that code? Even if this is possible, when does the key check happen, before or after (both?) a program is loaded into RAM?

Thats just what I was thinking. If its not completly impossible, I almost feel like trying it out... Anyways, let me know your opinion.
Logged

Ces2k3

  • Archived User
  • Sr. Member
  • *
  • Posts: 462
360 Prone To Dma Exploits
« Reply #1 on: November 17, 2005, 03:37:00 PM »

i thought it only lets u read music files and picture files ?
Logged

atlanta800

  • Archived User
  • Jr. Member
  • *
  • Posts: 76
360 Prone To Dma Exploits
« Reply #2 on: November 17, 2005, 03:45:00 PM »

The xbox can only read music and pictures off the iPod yes, but, because of the USB protocol, DMA should be opened up, allowing complete access to the xbox memeory. The reason for DMA is for very fast transfer speeds, and because the Xbox 360 will be streaming music from the iPod it will need that DMA for fast transfer speeds.
Logged

tNCecil

  • Archived User
  • Sr. Member
  • *
  • Posts: 317
360 Prone To Dma Exploits
« Reply #3 on: November 17, 2005, 04:28:00 PM »

tongue.gif
Logged

atlanta800

  • Archived User
  • Jr. Member
  • *
  • Posts: 76
360 Prone To Dma Exploits
« Reply #4 on: November 17, 2005, 04:45:00 PM »

I'm not very familiar with PSP modding tNCecil, you mind elaborating or providing a link to information?
Logged

Diehardsouljah

  • Archived User
  • Newbie
  • *
  • Posts: 13
360 Prone To Dma Exploits
« Reply #5 on: November 17, 2005, 05:23:00 PM »

cool.gif
Logged

Dark_Neo

  • Archived User
  • Jr. Member
  • *
  • Posts: 95
360 Prone To Dma Exploits
« Reply #6 on: November 19, 2005, 09:52:00 AM »

biggrin.gif

Of course this all depends on whether the X360 is vulnerable in this way, and figuring out exactly how to exploit it. I know I wouldn't be able to figure that out, way above my head! Good luck to all those trying though!

Edit:Typing faster than my brain can cope with tongue.gif
Logged

jimmsta

  • Recovered User
  • Full Member
  • *
  • Posts: 121
360 Prone To Dma Exploits
« Reply #7 on: November 19, 2005, 06:57:00 PM »

are we even 100% sure that the xbox360 isn't 'open'? What I mean is, do we in fact, know, that the xbox360 cannot run unsigned code? I'll have to pick one up and test away....
Logged

SilentWatcher

  • Archived User
  • Newbie
  • *
  • Posts: 15
360 Prone To Dma Exploits
« Reply #8 on: November 20, 2005, 03:26:00 PM »

Also, to set up the wireless network adapter, you can plug in any USB key with your network settings, which will then be loaded by the 360, so an ipod is not even necessary.

Logged

gamerguy999

  • Archived User
  • Hero Member
  • *
  • Posts: 604
360 Prone To Dma Exploits
« Reply #9 on: November 20, 2005, 09:59:00 PM »

Remember guys, the USB ports are read only for anything that has to do with mass memory. This includes ipods, psps, thumbdrives, etc.
Logged

Swmorgan77

  • Archived User
  • Newbie
  • *
  • Posts: 2
360 Prone To Dma Exploits
« Reply #10 on: November 23, 2005, 12:27:00 AM »

QUOTE(Arakon @ Nov 19 2005, 08:26 PM)
if the 360 was running unsigned code, piracy would be rampant. there's simply no way that will happen.. MS didn't go on and on about how they will have tons of security features in the 360 for nothing.
Logged

The Dude

  • Archived User
  • Newbie
  • *
  • Posts: 26
360 Prone To Dma Exploits
« Reply #11 on: November 23, 2005, 03:53:00 PM »

QUOTE(jimmsta @ Nov 20 2005, 03:04 AM)
are we even 100% sure that the xbox360 isn't 'open'? What I mean is, do we in fact, know, that the xbox360 cannot run unsigned code? I'll have to pick one up and test away....
Logged

Shadowlaw

  • Archived User
  • Newbie
  • *
  • Posts: 16
360 Prone To Dma Exploits
« Reply #12 on: November 24, 2005, 06:28:00 AM »

Highly unlikely that you can just dma anywhere from the USB controller. Presumably you can get a part of the memory to read and write your data to, but the rest is closed for you. Not sure if current DMA controllers actually do this, but I don't see why MS wouldn't make their DMA controller restrict memory accesses coming from the USB hardware.
Logged

Dameon

  • Archived User
  • Newbie
  • *
  • Posts: 17
360 Prone To Dma Exploits
« Reply #13 on: November 24, 2005, 05:26:00 PM »

Note that DMA transfers would only commence in the event that both the Xbox and storage device allowed it. DMA could be only enabled for "trusted" devices (*cough* spoof), not enabled at all, or perhaps restricted to a certain block of memory. Sure, DMA bypasses the CPU, but the USB controller on the Xbox has just as much control over the DMA operation as the external device.

Cross your fingers for an oversight.
Logged

demonlord666000

  • Archived User
  • Newbie
  • *
  • Posts: 6
360 Prone To Dma Exploits
« Reply #14 on: November 24, 2005, 07:29:00 PM »

I have another big if but

what if since it won't let you read / write if it the thumb drive, ipod, ect. is too big how about 2 usb devices one to open DMA access to open read/write to the larger usb device.

If that were possible it would be much easier then trying to trick the usb controller into believeing the device is smaller then it is.
Logged
Pages: [1] 2