Lainaus:

---

So, some quick news:

We kept on working on this idea, and it worked out. pretty well. We use JTAG to program the DMA target addr, and then SMC to trigger the DMA read. The exploit itself is based on the old 4532 exploit.

The magic is how we launch 4532 - there is a "backdoor" for manufacturing since CB 1920. We have been able to restore the newer CD versions for all hardware types.

This means:
- We can boot own code in HV context ~5s after boot, before any video output, right after the kernel runs.
- we need to reflash the flash, and add 3 resistors for the JTAG (no modchip required! but you might want a dual-nand modchip),
- 8498 kills this by updating the bootloader - it blacklists 4532/4548. it also does hw init stuff which might interefere with the jtag hack, we don't know yet.
- we have a proof of concept hack, we will release it SOON (a matter of hours/days, not more - promised.).
- DON'T UPDATE to summer 09. Did i already say this?
- you don't need to know your cpu key. You can update to all BUT summer '09. you don't need a dvdrom.
- It works on all xenon, zephyr, falcon, opus, jasper. Unless you have updated to 849x. Then you're screwed.

---

Lainaus:

---

This vulnerability has been successfully exploited to run arbitrary code, and a complete end user compatible hack has been in development for some time and is planned to be released on free60.org shortly. It will allow users to take back control of their Xboxes and run arbitrary code like homebrew applications or Linux right after turning on the console and without the need of a modchip, finally opening up the Xbox 360 to a level of hacking as the original Xbox.

---

Lainaus:

---

- It's possible to recover DVD keys. In fact, no DVD-ROM is required to run the hack, so it's possible to run own code, dump cpu key, decrypt HV, inject key, flash back. Note that I personally don't like games, so I won't be of much help here.
- No, even if you know your CPU key, it's not possible to downgrade back from 8498.
- Right now, the only way to support both gaming and hacking would be a dual-nand modchip, which switches between nand contents. Note that you still couldn't update to 8498, as it likely (haven't tried) doesn't run without R6T3.


From a technical perspective, I want to stress that this is not "yet another bug" - it's THE SAME bug we used 2 years ago. It's just that we changed the way how we write to memory, and that allows for the new cool features.

---

Lainaus:

---

So, some more details:

CB1920 and up allow to boot into any kernel version, including 4532, but only in "mfgbootlauncher" mode, which is used in manufacturing. This mode (also called "zero pairing", because you need to zero out the CB pairing data) has been known before, however, previous to CD1920, it was useless, because you could only boot into 1888, not into 4532. It was *also* useless because you couldn't run a game.

Now, we developed a way that uses JTAG+SMC to write into physical memory at any time. I think the idea came even from this thread. Basically a flash sector will be prepared to contain the exploit buffer and the code we want to run. JTAG will be used to program the DMA target address (the only thing you can't do from SMC), and SMC will be used to kick off the read (remember, SMC code can access the nand controller as well - just not the dma addr.).

SMC will be patched so that it kick off the DMA read right when the kernel is loaded. We are using the "read rtc" command for that, which happens pretty early in the kernel, way before GPU init, for example. It also happens before nand controller init, which is important, as that would overwrite the dma addr again.

Basically everything required to assemble this hack was present in this thread already since some months.

---

Lainaus, alkuperäisen viestin kirjoitti angelmoon:

---

Jos tuo X360 saadaan jotenkin ees samaan malliin, kuin vanha xbox XBMC:n avulla, nii odotukseni ovat korkealla. Mutta se on taas eri juttu kuin kauan tuohon vielä menee. Nii, ja taidanpa jättää päivittämättä...

---

Lainaus:

---

Microsoftin 11.6. julkaisema järjestelmäpäivitys Xbox 360:lle saattaa tehdä konsolista käyttökelvottoman. Päivitys ylikirjoittaa bootloaderin, jota X360 on käyttänyt julkaisupäivästään asti. Tämä päivitys on siis ensimmäinen joka kajoaa bootloaderiin. Nyt on käynyt ilmi, että useita konsoleita on mennyt käyttökelvottomaksi päivityksen jälkeen.

On suositeltevaa, että päivitystä ei ladata vaan odotetaan mitä Microsoft tekee asialle.

---

Lainaus, alkuperäisen viestin kirjoitti BaldAngel:

---

lol xbmc360, ei tuu kesää tolla melulla htpc käytöstä

---

Lainaus, alkuperäisen viestin kirjoitti BaldAngel:

---

itse en pidä tätä kyllä mitenkään ihmeellisenä asiana, en näe mitään syytä jollekkin homebrew ohjelmille. Jos se ei pitäisi niin jumalatonta meteliä niin silloinhan siitä saisi ihan ookoon wannabe-htpc:n

---

Lainaus:

---

eikä oo tarvetta törsätä 189? htpc:een kaikkine kilkkeineen koska sellanen on jo.

---

Lainaus, alkuperäisen viestin kirjoitti Ace_365:

---

Kattelen jos löydän kuitin, mutta ainakin kuukausi sitten Joensuun Gigantista sai Xbox 360 60GB:n + kolme peliä hintaan 189? tai 199?, en todellakaan tarkoittanut Arcadea, lol.

---

Lainaus, alkuperäisen viestin kirjoitti BaldAngel:

---

Edelleen vähintään yks nolla liian vähän tallennuskapasiteetissa kenen tahansa HTPC käyttöön, lol.

Ja saatanallista meteliä se kone pitää vaikka kuinka yrittäisit sitä kyseenalaistaa

---

Lainaus, alkuperäisen viestin kirjoitti mikkooo:

---

Mitäs uutta tossa on? Eikös sitä SexBoxia ole osattu modata jo iät ja ajat Dashboardista riippumatta?


Mä muuten asensin sen päivityksen tänään.

---

Lainaus, alkuperäisen viestin kirjoitti leffa1:

---

tuleeko xbox 360 netti selain jossakin päivityksessä ?

---