Print

[celicagt1993]

QUOTE(MENTALDOMINANCE @ Apr 20 2006, 05:53 AM)

OKAY...

The DVD drive's firmware is being executed. It doesn't need to be signed.
We can read and write to it. The code is then executing.

Instead of worrying about changing the bytes that need to be changed to fake a media type,
what if someone just went ahead and blanked the whole chip and used it to write a program -
A program that runs executables that aren't signed for instance & a rudimentary driver to
make it boot off something other than the DVD drive that would be useless now since it's
firmware is holding this software.

Would this work?
And of course you would still need to keep the bytes that contain the KEY in the same place
so that the 360 would boot the drive but that is only a few bytes - quite easy to code around...

still wouldn't work...  the signature isn't check with the dvd's FW.

[MacDennis]

QUOTE(MENTALDOMINANCE @ Apr 20 2006, 06:53 AM)

Instead of worrying about changing the bytes that need to be changed to fake a media type,

Incorrect. The media type of the disc isn't even checked by the console to begin with ..

QUOTE(MENTALDOMINANCE @ Apr 20 2006, 06:53 AM)

what if someone just went ahead and blanked the whole chip and used it to write a program -
A program that runs executables that aren't signed for instance & a rudimentary driver to
make it boot off something other than the DVD drive that would be useless now since it's
firmware is holding this software.

Would this work?

You want to create a replacement device for the dvd-rom drive? Sure, that can work, but only after a lot of serious reverse engineering. But what's the point?

QUOTE(MENTALDOMINANCE @ Apr 20 2006, 06:53 AM)

And of course you would still need to keep the bytes that contain the KEY in the same place
so that the 360 would boot the drive but that is only a few bytes - quite easy to code around...

You only need the key to perform AES encryption/communication with the host (console). If you make a replacement then you can store this key at any location. But creating a replacement is a lot of work. You will need to reverse engineer and implement the AES protocol and you will need to implement the complete challenge/response protocol amongst many, many other things. It's possible but it's a bit pointless ..