xboxscene.org forums

Pages: 1 2 [3] 4 5

Author Topic: Font Exploit Analysis  (Read 486 times)

Chicken Scratch Boy

  • Archived User
  • Hero Member
  • *
  • Posts: 1054
Font Exploit Analysis
« Reply #30 on: March 22, 2004, 04:00:00 PM »

count me in, i ahve eeprom backups, a spare hdd (stock-efied) and a gs on my hdd... note that i have not have any problems with clock loops with the current fonts (reloaded)
Logged

Dolfhin

  • Archived User
  • Sr. Member
  • *
  • Posts: 351
Font Exploit Analysis
« Reply #31 on: March 23, 2004, 04:45:00 AM »

Well i haven't got any sort of backup yet so please don't send me the fonts before i kill my xbox biggrin.gif But I just wanted to say thanks for all the work you have done so far.
I'm not a really active user of xbox-scene but I like to read some text and keep up to date. The only weak points of the Font hack are the speed (they boot up slow sad.gif) and the clockloop (the red flashing LED seems to be fixed in PBL 1.41 unofficial) and I hope that you're able to fix this two litle problems that are left.

Thanks and keep up the good work i'm sure the're a lot of people waiting until the clock loop is fixed before the're going to use the fonts hack.

Btw : I hope to have some sort of backup soon so I can test this new fonts they look really really good tongue.gif
Logged

triggernum5

  • Archived User
  • Hero Member
  • *
  • Posts: 896
Font Exploit Analysis
« Reply #32 on: March 23, 2004, 08:50:00 AM »

So if the Mechinstaller (Evox) package has a hugely compressed ernie for mem card reasons, its the save game that decompresses it.  Is there any way to install it manually without a copy of the game? Or are there decompressed versions floating around?
Logged

krayzie

  • Archived User
  • Hero Member
  • *
  • Posts: 3350
Font Exploit Analysis
« Reply #33 on: March 23, 2004, 11:42:00 AM »

The bluhdebluhs fonts thread is located here
These first mechinstaller fonts are very close to the linux fonts and I still find these the coolest ones around. Never experiensed loops whatsoever on multiple xbox versions.
Other fonts from catfish's installer can be found at the maxconsole forums. There are several versions around.
Logged

theBloodShed

  • Archived User
  • Newbie
  • *
  • Posts: 30
Font Exploit Analysis
« Reply #34 on: March 23, 2004, 04:26:00 PM »

I can't really judge since I have not looked into the technical details of the font exploit.  Maybe I'll get time in the future to do that.  But it seems to me that most people trying to resolve the clock loop the wrong way.  Everyone is trying the same basic "solution"; to fix the time.

So why is it impossible to get an executable to load just because the dashboard is trying to load the clock instead of the main dashboard screen?  In both cases, it loads the font files.  It was my understanding that the fonts caused a buffer overflow to crash the dash.  Why is this not happening when it tries to load the clock?  It is my guess that it either has to do with the fact that the dashboard refuses to attempt to execute code when the time is not set or it has to do the address jumps become offset when this happens and hence, it doesn't land on the exploit code like it should.  I'm sure there's a mathematical solution to the later situation.  Any input?
Logged

ldots

  • Archived User
  • Hero Member
  • *
  • Posts: 822
Font Exploit Analysis
« Reply #35 on: March 24, 2004, 12:28:00 AM »

Hi Gros. Sent you a PM with some test results.
Logged

ldots

  • Archived User
  • Hero Member
  • *
  • Posts: 822
Font Exploit Analysis
« Reply #36 on: March 24, 2004, 06:30:00 AM »

blink.gif
Logged

krayzie

  • Archived User
  • Hero Member
  • *
  • Posts: 3350
Font Exploit Analysis
« Reply #37 on: March 24, 2004, 06:45:00 AM »

If it is posible to load msdash without the original fonts this could work. Don't think
that's possible though.
Logged

ldots

  • Archived User
  • Hero Member
  • *
  • Posts: 822
Font Exploit Analysis
« Reply #38 on: March 24, 2004, 06:49:00 AM »

msdash would be looking for the original fonts (now renamed to .bak).
When msdash is being loaded we have replaced the key in memory, so it doesn't matter that we hexed msdash.
Logged

krayzie

  • Archived User
  • Hero Member
  • *
  • Posts: 3350
Font Exploit Analysis
« Reply #39 on: March 24, 2004, 06:52:00 AM »

So how is this different than the mechfonts with exception of the hexed msdash? There would still be a possible loop as the fonts need to redirect to the .bak fonts and reload the dashboard?
Logged

Wooger

  • Archived User
  • Sr. Member
  • *
  • Posts: 259
Font Exploit Analysis
« Reply #40 on: March 24, 2004, 07:31:00 AM »

From the description above when the mechfonts are loaded into memory they patch the msdash that is loaded into memory to look for the original fonts with the new names (*.bak) so in the event that the clock check thread completes before the exploit the time screen can be desplayed. Before if the clock check thread finished first the clock screen would look for the xb *.xtf files it would error screen your a$$.

If in the event the exploit finishes first and the clock does not need to be loaded it mearly loads the ms-dash with what appears to be the link for the xbox live dash pointed to a new locations and since the ms-hash is also modified when you select the dash menu option it loads the program.  This set program doesnt need to be say a dashboard it can be an app like dvdx as long as the app is signed with the correct hash key (habibi in this case)


If I am understanding him correctly he is saying to manipulate the ms-dash loaded into memory however far you want to take it

Wooger
Logged

krayzie

  • Archived User
  • Hero Member
  • *
  • Posts: 3350
Font Exploit Analysis
« Reply #41 on: March 24, 2004, 07:50:00 AM »

From what I understand he wants to let the fonts boot a hexed msdash that uses the .bak fonts. Now since the new msdash needs to be booted from the harddisk wouldn't it take way to much time when the clock is dead and the xbox is desperately seeking for its dash?
Logged

ldots

  • Archived User
  • Hero Member
  • *
  • Posts: 822
Font Exploit Analysis
« Reply #42 on: March 24, 2004, 08:03:00 AM »

sad.gif . I guess it would only work if launching a new app (msdash.xbe) will kill the thread that will eventually check whether the clock is set or not.
Logged

Wooger

  • Archived User
  • Sr. Member
  • *
  • Posts: 259
Font Exploit Analysis
« Reply #43 on: March 24, 2004, 08:04:00 AM »

In any case the method that the mechfonts uses to patch dash information in memory is a great idea.  Now if you could only manipulate more of the dash such as more tab's other than the "xbox live" tab (which im sure is possible just someone has to take the time to do it)  If this can be done the xbox would load its msdash and then things would be manipulated after that so the xbox hasnt the slightest clue its being highjacked.

Do keep in mind though the font exploit is an old exploit and newer exploits really need to be found to work on the newer xbox dash versions otherwise its back to mod chips.

Wooger

P.S. Does anyone get the feeling that the public is testing the M$ software and helping MS fix there problems?
Logged

ldots

  • Archived User
  • Hero Member
  • *
  • Posts: 822
Font Exploit Analysis
« Reply #44 on: March 24, 2004, 08:06:00 AM »

QUOTE
Now since the new msdash needs to be booted from the harddisk wouldn't it take way to much time when the clock is dead and the xbox is desperately seeking for its dash?

Maybe Grospolina can answer this. When the orginal Mech fonts reload the dash in memory where does it get this dash from. The memory is so sevely messed up from the exploit that it would have to be reread from the harddisk wouldn't it. In that case it's the same situation.
Logged
Pages: 1 2 [3] 4 5