The beginning of the end for the Xbox?

[Olympichero]

Today a group called Free-X released details on how to exploit your Xbox (Dashbpard) to be able to run Linux and homebrew apps, without a mod chip.

This hack will be developed over the coming few weeks and soon it will probably have nearly as much power as a modchip (It can never be as effective as one but it can nearly match its functions) allowing people to boot pirate games etc etc.

Microsoft I think will try to stop this (using live, updated xboxs etc) but I dont think they will be able to and soon this hack will become pretty mainstream.

Now, (ease of) piracy was one of the contributing factors to the death of the dreamcast, could this hack be taking the Xbox the same way? We all know (most) people would rather buy a copied game over a retail one any day and this hack will allow them to play it without a chip so whats stopping them?

Heres what the release said:
XBOX Security -= Security Advisory =-

Advisory: XBOX Dashboard local vulnerability
Release Date: 2003/07/04
Last Modified: 2003/07/04
Author: Stefan Esser [se nopiracy.de]

Application: Microsoft XBOX Dashboard (up to today)
Severity: A vulnerability within the XBOX Dashboard allows to totally compromise the security features of the XBOX.
Risk: Critical
Vendor Status: Vendor is not willing to talk about XBOX vulnerabilities.


Overview:
The XBOX Dashboard is what appears when you turn the XBOX on without a disc in the DVD drive. It will let you adjust system settings, manage your save games, play and rip audio CDs and configure your XBOX Live account. It is the heart of the XBOX and its most vulnerable point, because it lacks several security restrictions which are enforced on games. This includes the lack of the reboot-on-eject-button "feature", which is obligatory for all games.

The existance of an exploitable vulnerability within the dashboard could totally compromises the XBOX security system. It will make the box independent from Microsoft signed code and therefore this information is released to the public now on the 4th of July 2003, the day of the XBOX Independence.


Details:
Microsoft knows that a vulnerability within the XBOX dashboard could have serious impact. This is underlined by the fact that the dashboard checks most of its files against an internal stored SHA1 hash value before it uses them.

For an unknown reason this check is not performed on the audio (.wav) and font (.xtf) files. Unfourtunately for Microsoft there exists an exploitable integer underflow vulnerabilitiy within the font file loader which can be exploited with a malformed font file. When the XTF header is processed the dashboards reads a 4 byte blocksize field from the font file. This is expected to represent the size of some datablock including the 4 bytes of the size field itself. The blocksize is then allocated and the sizefield is copied into the beginning of the buffer. This is already a possible overflow bug when the field contains the values 0..3.
Due to memory alignment this is not exploitable. But then the blocksize is decreased by 4 because the dashboard wants to read the rest of the block into memory. Obviously values of 0..3 will underflow when decreased by 4 and this results in the dashboard wanting to read up to ~4 gigabytes of data from the font file in a f.e. 3 bytes buffer.

Because the XBOX malloc()/free() implementation is also storing control information inbound and is similiar to the Windows 2000/XP heap allocators this bug is exploitable and allows execution of arbitrary code. The attached proof of concept code shows that exploiting is possible with offsets that are equal on all dashboards and XBOX versions known.

BTW: the dashboard loads its font files directly after the XBOX start animation. This means the exploit does not need any user interaction and when the code is executed only part of the dashboard background is on screen.


Proof of Concept:
Attached you will find a proof of concept exploit which will start linux. To install it you have to rename the 2 XBOX font files within the font directory of the dashboard partition and then copy ernie.xtf and bert.xtf into this directory. (If you have an XBOX with an older dashboard the font directory does not exist and you must do the renaming and file adding work in the main directory). Once the new fonts are in place you copy the default.xbe (which is a copy of xbeboot) into the main directory and add your favourite linux to it.


Anticipated Questions:
Q1: How do I get the files onto the harddisk?
A1: There are several ways. You could f.e. install the files with the\ Mechassault or 007 hacks. This requires one of the games and the files on a memorycard. The other way is to open the box and do the harddisk swap trick which is described all over the net.

Q2: This vulnerability is in the dashboard, isn't it? So Microsoft can simply update the dashboard with XBOX Live or with the help of new games.
A2: Yes Microsoft could try to upgrade the dashboard and fix the vulnerability with such an update, but keep in mind that this vulnerability is like a "local root" hole. You can do nearly everything with it and this includes redirecting reads and writes to the xboxdash.xbe file. Additionally people who do not play games on their box will not be reachable with such updates. And groups who pirate games can always disable the update feature.

Q3: Well but MS can make the kernel block the vulnerable dashboard.
A3: Indeed they can. But until boxes with new kernels reach the market we will have the end of this year (You can still get 1.0 boxes in shops over here) and they can only fix the bugs they know about.

Q4: Is it possible to play "backed-up" games with this?
A4: Yes it is possible to play pirated games by using this vulnerability but my proof of concept code will not allow this. You have to change the exploit to patch the kernel in memory. This is not very hard and I am not going to help you with this.

Q5: Can I go "Live" with this hack?
A5: You have full control over the box with this vulnerability. You can modify the exploit to allow XBOX Live playing but this will only start a cat & mouse game with Microsoft.

Q6: I have read that I can solder my mainboard with this hack...
A6: This exploit has nothing to do with soldering, It will just run everything you want on unmodded (and even unopened) XBOXes. Infact when this hack is installed you do not need to solder anything to get your homebrew or whatever applications to run.

[evilmatt]

Everyone knows how much the PS1 was pirated, didn't do that any harm.

If this exploit leads to a FreeloaderX then I'll be a very happy bunny

In time for Halo 2 please Datel

[Saurian]

Piracy sells hardware - I strongly believe this.

Modding the Xbox is easy enough as it is, making it even easier will open modding up to a greater number of people. People who dont already own the machine will now buy one simply because of the ease of running pirate software. I seriously believe piracy kept the PS1 sales high - it was very awkward to fully mod a Saturn in camparison.

Not saying piracy is right - but you cant ignore that a huge number of people will only consider a console when it's cracked.

[Tom Salter]

Very interesting...

Could take a while to see something useful coming from it though.

[Olympichero]

Piracy sells hardware - I strongly believe this.

Modding the Xbox is easy enough as it is, making it even easier will open modding up to a greater number of people. People who dont already own the machine will now buy one simply because of the ease of running pirate software. I seriously believe piracy kept the PS1 sales high - it was very awkward to fully mod a Saturn in camparison.

Not saying piracy is right - but you cant ignore that a huge number of people will only consider a console when it's cracked.

That said Microsoft gets most of its profits from software as it makes a loss on each xbox sold, so surely this means Microsoft will just keep on losing more and more money untill they:
a) Sort this out
b) Pull the plug on the xbox
c) Release the Xbox 2

[Saurian]

a) Sort this out
b) Pull the plug on the xbox
c) Release the Xbox 2

Yup - and it'll be just as easy to hack the hell out of the new one.
I really dont rate the Xbox at all as a console but once modded with apps it's as vital as your TV.

What you wrote about above is not the whole story - there are even easier methods in the works (I've seen the prototype mod unit and it's hysterical how easy it is! )

[JRMacumber]

[Uli]

i doubt as well that piracy led to the death of the dreamcast! it was for many reasons but mainly because of segas (sometimes silly) software policy which simply did not appeal to the mass market.

xbox will make it - anyway. ms has enough (will)power and money to make it successful. and if piracy helps to spread/sell the hardware than this is not too bad.

piracy only get dangerous if it widespreads so much that publishing games not mass market targeted can't make profit anymore! in this case the gamers are punished for exploiting an industry!

[Max M]

i doubt as well that piracy led to the death of the dreamcast! it was for many reasons but mainly because of segas (sometimes silly) software policy which simply did not appeal to the mass market.

Piracy played a big factor in it. Sega was making a number of large losses (Sound like anyone else?) and they relied on software sales to make up for it.

Edit: @ that comic.

[nips]

Piracy sells hardware - I strongly believe this...

...People who dont already own the machine will now buy one simply because of the ease of running pirate software...

...Not saying piracy is right - but you cant ignore that a huge number of people will only consider a console when it's cracked.

That said Microsoft gets most of its profits from software as it makes a loss on each xbox sold, so surely this means Microsoft will just keep on losing more and more money...

Just because you can play pirate software doesn't mean that you will unquestionably. I'd be suprised that everyone with a modded console will exclusively buy copied games.

I'm sure that if the option of piracy gets consoles in peoples homes, then developers will see the large user base that they can exploit - increasing the range of titles. And when these people with linux consoles do buy a proper game, that'll be one copy Microsfot would never have sold before!

[Viktor Laszlo]

The problem with the Xbox is that the chip gives pirates unprecedented options.

You can rip a game on the hard drive to play it. With GAME's 10 day return policy, this means that there is "no reason to buy a game" for some people.

Of course I'd say the 10 Gb normal hard drive probably fills up fast, but then again there are reports on the net of Xboxen with 120 Gb hard drives.

This will very probably impact game sales, especially if somebody releases a way to hack the Xbox by only inserting one cd... It seems that that might be close now, when Xbox Scene .com says that they have already installed the pirate game dashboard on an unchipped console.

Sorry if I'm wrong with the terminology, but I only started reading up on the scene today. Scary stuff!

[nips]

The normal HDD does fill up really quickly, but it is so easy to replace it with a much bigger one.

Ripping games to the HDD is a good thing though. I do it all the time. It lowers the loading times on loads of games. But of course, there are some who will exploit it for the negative reasons.

The XBox aims to give the user a multimedia console... and by giving them more options in the first place, it gives people more options when they crack it.

Consoles could quickly become like PCs.

It's really interesting stuff. Only when the h4xx0r scence is big enough will it truely have an effect. The Xbox penetration is small next to PS2, and unless lots of 'casuals' cotton on it will have little effect.

[essankay]

Consoles could quickly become like PCs.

I hope you mean this as a bad thing.

Most average joes out there won't pirate unless it is super-simple.

An aquaintance of mine bought a modded Xbox, but found it way too complex to navigate the menu system and such, so he sold it. Casuals don't want to fiddle with anything, they just want to pop the disc in and go.

As for the beginning of the end, and parallels with the DC. It is a whole different ball-game with the Xbox. Apart from Japan, the Xbox has been far more successful than the DC.

In the US in May, three of the top five games were Xbox titles(#2, 4 & 5).

The Dreamcast never had that kind of software presence on the charts.

[nips]

Consoles could quickly become like PCs.

I hope you mean this as a bad thing.

It's certainly a double-edged sword.

I agree that many will be unwilling to persevere through the increased complexity of chipped consoles. I've had difficulties with my console at times and I'm sure that many will not put up with what I have.

But the way I mean Consoles could become like PCs are is with these increased options. Most people don't get the most out of their PCs. They just get by - which is cool. And I think that with the increase in options with consoles, the more options hackers and modders have and the more they could become like PCs e.g. More versitility with the sacrifice of stability in some cases!

I love the mod scene. I love being able to play Chrono Trigger on my TV again! I'm sure that many more wouldn't appreciate it like me though.

People will take as much or as little from consoles as they want...

[smokedog]

I?ve recently modded my Xbox it?s the best thing I?ve ever done. I put a few Dixv flims on the drive and found 10Gb was too small.

I upgraded to a 120Gb drive and now its become a multimedia home entertainment unit. I?ve used over 30gigs in 1 week.

I admit to pirating games , but these are games that I would never buy anyway, ie :Midtown Maddness 3, dragons lair etc. Its not stop me buying games, its just gave me access to play more games. Games I wouldn?t of play otherwise.