Print

[patto]

QUOTE (STKD @ Sep 24 2004, 08:13 PM)

The method I have suggested on the prior page may actually be a whole new angle to look at though. After all, you'd have an exact copy of the contents, possibly including media flags etc, without ever having to FTP your XBox. All with nothing much other than a bog-standard PC CD ROM drive. Something to look into if nothing else.

don't you mean bog standard DVD ROM drive

[jimmsta]

I'm going to guess that the dvdrom drives in the xboxes are locked, just like the hard drives, and that the same key for the hard drive works for the dvd drive... either that, or the xbox dvd drives use a universal key -- which might be the key that MS signs their xbe's with... who knows... I'm just hopeful that there's something there that hasn't been explored...

[ouellette420]

I also had a chance to also backup Burnout 3, and Tiger Woods 2005 successfully. Both of them contained what seemed to be the same dashupdate.xbe

[BassACE]

QUOTE

I'm going to guess that the dvdrom drives in the xboxes are locked, just like the hard drives, and that the same key for the hard drive works for the dvd drive... either that, or the xbox dvd drives use a universal key -- which might be the key that MS signs their xbe's with... who knows... I'm just hopeful that there's something there that hasn't been explored...

That's an interesting theory jimmsta.  If they are, then perhaps there could be an exploit there.  Well, maybe not, but it could be something.  I wonder if anyone's tried replacing the Xbox's DVD-ROM drive with one not designed for the Xbox without having a modded box.  Perhaps that could provide some insight to that.

Finally, in regards to reading the XDiscs in raw mode, could it be done using a program designed to recover data from a corrupted hard drive (such as OnTrack or something). I recently lost a hard drive and it was able to recover some of my files.  Perhaps, with either a firmware or software hack, it may be possible to either fool the program into thinking that the PC DVD-ROM drive is actually a HDD, or to get the software to read the raw data from the DVD drive.

I'm relatively new to the scene (in fact, this is my first post).  I modded my box early this year.  In that time, I've learned a lot about the Xbox by reading about it here as well as other sites (specifically: Xbox Linux).  I don't claim to be an expert, nor do I wish to try.  I'm merely an engineering student who loves his Xbox, and the scene that helped him so much over the past several months.  I've been wanting to give something back, but all I know how to program is dumbass text based Win32 console apps for PC as well as a little 80x86 assembly.

A thought occurs: I'm not sure what you mean by the media flags, but what if you could use some program or other tool to see what the registers inside of the CPU say (specifically, the registers that have flags such as how to boot).  That or boot flags from the kernel.  It's been a while since I read the stuff on Xbox Linux, but, if I remember correctly, there's a set of flags to boot the xbox into different modes (the example they use is that they had to replace the hard drive with a new one without having to replace the EEPROM; they use a special xbe to set a certain flag somewhere so that it ignores the status of the HDD).  Perhaps a flag there (perhaps some sort of debug flag or something) could be used to ignore whether or not the xbe is properly signed.  Maybe compare a standard Xbox to a XDK Xbox.  I don't know though.  Perhaps all of this has already been tried.  There's also a good chance that I have no clue wtf I'm talking about (more than likely).  I'm gonna look a little more into the hardware inside of the Xbox (read about it on Xbox Linux's documentation), and combine that with what I learn in my computer architecture class and hope I come up with something a little bit more coherent next time.  If anyone wants to, send me an IM over AIM at omega71122.  Peace all.

You know what, most of this makes sense to me, but it is after all 2:30 AM.  Perhaps this could spark further discussion (or confusion on the part of the noobs).  Just kidding (I too am a noob)...  

PS- Sorry about this being so long.  Once I get going, then the brain just won't stop.

[anjilslaire]

QUOTE (superballs333x2 @ Sep 24 2004, 11:03 PM)

dude i dont know whats up with the hulk or the star wars dvds but i have been able to play bruned dvd movies on an unmoded xbox for like 2 years now i think my post is stell up about how to do it its not hard to do at all and you dont even need to know anything about xbox codeing or what not you just need your self 2 files off of one dvd-audio disc name Insane clown posse the wrath shangre la if you have that disc you can get the 2 small files out of the audio_ts folder and brun them in an aodio_ts folder along with your movie in the video_ts folder and damn a dvd-/+r that plays in an unmoded xbox what do you know

There isn't an issue to playing burned dvd movies on an unmodded (or modded) xbox. THe xbox can read/play them  fine. The Star Wars extras disc, and the Hulk disc have xbox content on them also, which puts them in a different category.

Regular DVD movies (copies) don't need any special DVD-audio stuff to play. I just DVDshrink & burn.

EDIT:
ouellette420, thanks for that. I've been wondering.

[ZakMcRofl]

Maybe I am missing the point but I totally don't see how those SW disks bring us anywhere.
We now have three files that are signed and run from DVD+R/RW (tagged as DVD-ROM) but not one of them can run from harddisk.
We can't edit those three files and they only run from DVD-ROM. So we cannot replace any of them since all other signed XBE's we have are runnable from HDD or XDVD (or whatever the name for XBOX discs is).

So the only ways to attack the security sheme would be to
1) Produce an buffer overflow/underrun in one of the three XBEs (how? we would need to manipulate a resource it uses, we don't have one)
2) Find another DVD-ROM-signed XBE which is exploitable
3)

Also I don't get how the disk layout of a xbox disk is of any relevance here, the Xbox only boots signed code so as long as we don't have a signed exploitable xbe we're getting nowhere IMHO.
Of course I could be wrong (I wish) but I am pretty sure that M$ made sure that those XBE's are cleaner then clean before releasing them DVD-ROM signed.

Regards, Zak

[STKD]

[Disabled]

I just wanted to start reading about how the SHA1 system works etc, but now I got another Idea.
Once I saw a Windows XP installation disc with about 7 different Versions of WinXP on one CD. The Explorer said the CD (!) was several GBs big. The trick was to reuse the Data the different Versions had in common on every installation folder.
Or perhaps you know these Audio CDs, that have a track before the first track?
Both use a non standart TOC.

Would it be possible to create a modified TOC that makes the DVD behave different with checking the SHA1 hash and executing the Program? Perhaps say, XBE starts at 0x12345678 but is fragmented and byte 1000 begins at 0xsomewhere?
Is fragmentation even possible on burned media?
Might be something to think about...

(Of course all this using the DVDROM signed XBE and stuff)

[tg78]

When I made a working copy of the hulk dvd earlier, I made it without using the xbox. Because of that I believe that if I knew exactly what kind of media was used I could create a copy that works on an unmodded box. I will be ordering some dual layer media tonight and I am open to suggestions.

[ZakMcRofl]

We can already boot those files from any DVD+R/RW which has the media setting set to DVD-ROM.
Obviously this has nothing to do with DVDX2-Layout since the xbox isn't detecting it as a DVDX2 (Xbox DVD) it is detecting it as a DVD-ROM.

As for the idea of using a fake TOC: afaik the xbox makes a check of the entire xbe file against the signature it carries. Sure if you could make it behave different when it is executing the file, it would be great. But how would you want to achieve that? Both functions (check and execute) probably use the same "OS" methods to access a file, why shouldn't they?
It's a good idea but I doubt that it is possible to create a disk that behaves differently to two operations which are basically the same (i.e. read file). Their only difference is what they do after the reading: check or execute.

Anyways I contacted the guys at xbox-linux and they'll look into this as well.

It's a very promising first step to have 5 XBE's that run from DVD-ROM (2 on hulk, 3 on star wars). Maybe one of them is exploitable.

[Disabled]

Yeah I know that this will most probably not give a result, but I might have overseen something. And with Audio CDs you can do excact that: Simply play the CD (read the whole file) it sees the data from byte 1 till end, skip a title (read from program entry point) jump not to the next, but to the overnext title (as the TOC sais the next Song is 30MB further on the CD)... but this is no Audio CD...

[BassACE]

QUOTE

ive swapped xbox dvd drives between xbox's with no need for any kind of key changing.

I was referring to not using one designed for the Xbox (not one from Samsung, Thomson, or Phillips).  There are a few tutorials on Xbox Scene.

[jimmsta]

I believe that we need some sort of firmware-loading app/driver that emulates an xbox dvdrom drive, but allows data to be read from a normal pc dvdrom drive, and converted using, say, the samnsung hacked firmware... something like that....

Firmware->Loaded by Driver->Driver emulates device id, atapi/scsi command interface->interprets commands, reformats them for normal pc-dvdrom drive->redirects atapi/scsi commands to pc-dvdrom drive->returns results in a raw data dump->file on hard drive...

Then, we go and decipher everything... or as much as we can... oh joy.

I BELIEVE that this idea for an emulation driver might work... it would require someone to know the atapi/scsi command interface rather well, I might add, as well as enough knowledge to interpret firmware... I might just work on that part for the time being...

This is one of the many ways that I think we can overcome this...

Although, I wonder, if we can plug in an xbox dvd-rom drive into a pc, and fire up linux, perhaps there's some way to gain full access to the complete atapi interface, and read data without the use of standard drivers... heck, maybe even write a driver to recognize the xbox dvdrom drive's device id, but then force it into the lowest-level command interface... that might be more... feasible...

Actually, I like that idea a LOT better, seeing as linux allows low-level communication with hardware, whereas windows doesn't really do that without extreme knowledge of the windows API... which I'm not about to learn...

So, the best idea would be a low-level linux kernel driver for xbox dvdrom drives...
*By low-level, I mean actually reading data sent back and forth along the atapi command bus... a LOT of debugging, a little programming, for now...

[jimmsta]

the problem with that is that the drive data is already figured out on the xbox's chipset/bios... what I want is to be able to figure it out on a PC's chipset/bios... it would be interesting to see different results, if any...

[Kthulu]

my thoughts exactly!

for the occasional dvd of this nature, one can use dvdx2.  it is a small price to pay for all the wonderful things you can do with a modded xbox.