-TCB!-

[Phantasm]

#3413 thespecialist:
Really
love those stories here 🙂 I was just a few years too young and finally
mastered the art of cracking when the Amiga scene was already dying.
But then again, I guess I count myself lucky that I didnt go down that
road.

My only 5 minutes of fame were when I was the
first in the world to hack the xbox 360. I never released the hack, I
was just in for the fame, not the money, but I was contacted by some
companies to sell my hack and I think one of those was Max, although I’m
not 100% sure it was him (it was a spanish company). I see Max is still
active in that scene and when googling Max another name came up,
“GaryOPA” that I also still remember from my xbox hacking days 🙂

Hi. I remember you from those early xbox 360 days on xboxhacker.net (i think it was). Not sure if you remember me but I assisted with the initial “decrypting” of the bios.

[thespecialist]

#3414 Phantasm:

Hi. I remember you from those early xbox 360 days on xboxhacker.net (i think it was). Not sure if you remember me but I assisted with the initial “decrypting” of the bios.

 Hey Phantasm ! Nice to see you here 🙂 I kinda do miss those days, hacking the ‘unhackable’ xbox 360, as Microsoft proudly announced it themselves. It was just such a fun project, all those enthousiastic people working together on xboxhacker.net, totally unorganized but self managed, everybody helping out in some way. And then after months of hacking, when I finally had successfully booted the very first DVD-R copy of an original disc, I rushed out the news on xboxhacker and went to bed, it must have been about 7 AM in the morning. I woke up a few hours later and was shocked to see it was all over the news ! Not just xbox related sites but every IT related site out there had copied the news and it was even on some official news wires all over the world ! When I had posted the news on xboxhacker.net, I was way too excited, adrenaline still rushing through my body that I had just booted a copy on the ‘unhackable xbox 360’, so that I hadn’t really thought it through and I remember that it scared the shit out of me, seeing how the news had spread over the world, haha. I watched out of my window for days, expecting the police to arrive 🙂 Luckily microsoft never tried to hit back (like Nintendo tried to get hackers arrested). I wasn’t even sure if I did something wrong, having never released the hack but just done reverse engineering but I wasn’t too eager to find out and luckily it never came to that. But it was a wakeup call for me and I decided that this was just not my thing, operating on the borders of the law, possibly crossing them and risking serious consequences, like people in the hacker scene did and do all the time. For me, I had  enough already, I had my fun, no more hacking since then. Now I still do some occasional reverse engineering, like for cyanogenmod, to get it running on samsungs (Exynos/closed source).

Anyway I didnt want to hijack this thread. It were all those Amiga cracking groups back then who got me interested in hacking, the people who replied in this and other threads here on this board ! I loved watching those Paranoimia/Paradox/Angels/Quartex/Scoopex/SkidRow/TRSI etc etc etc intros way more than actually playing the games 😉 I bought an action replay and followed a cracking tutorial that was published in a diskmag by LSD called Grapevine, I just found it here haha: http://eab.abime.net/showthread.php?t=21534 and I just read that that was Galahad/Fairlight who wrote it. So he was utterly responsible for the xbox 360 hack haha 😉

Hoping to read some more stories about  the good old Amiga days here, really enjoyed everything so far !

[Phantasm]

After reading this it made me want to go see if those posts still existed on the internet:

Brings back memories…

My original post about decrypting the bios

http://www.xboxhacker.org/index.php?PHPSESSID=f4e39943f83a0b8c6396efacc8ab8002&topic=76.msg808#msg808

Your post about having done it…

http://www.xboxhacker.org/index.php?PHPSESSID=f4e39943f83a0b8c6396efacc8ab8002&topic=481.msg4412#msg4412

[mus@shi9]

Great stuff. What did the protection do? Did it check for something on the original disc?

[thespecialist]

#3417 musashi9:
Great stuff. What did the protection do? Did it check for something on the original disc?

 It basically would read an encrypted sector from the disc, that was written on a part non-writable by dvd burners. This sector, after decryption would represent a table with a series of challenges/responses that would be issued to the dvd player, which in turn would compute the responses and compare them to the responses in the table (I think (some of the) responses were again calculated based on data on non burnable sectors). If everything was fine it would ‘unlock’ the main game partition and boot it.

All data communication between xbox and dvd player was encrypted and xbox memory was of course also encrypted and things like the security sector etc were signed,but it wasn’t too hard actually to decrypt everything. 

We never released the crack itself but did document everything on xboxhacker so people could do it themselves if they wanted to. I’m really not sure where that left us from a legal standpoint, but luckily we never were tested in that regard 😉

[mus@shi9]

That sounds like a hell of a lot of work by you and Phantasm. I never had an XBOX 360, did someone release the crack in the end ?
I guess they would have to modify the insides to make the crack  permanent ?

[thespecialist]

#3419 musashi9:
That sounds like a hell of a lot of work by you and Phantasm. I never had an XBOX 360, did someone release the crack in the end ?
I guess they would have to modify the insides to make the crack  permanent ?

 Basically you could just flash a new firmware to the DVD drive that would tell the console that everything was fine, that the disc was an original. So you basically would write the ‘security sector’ to another sector of the disc, one that *was* writable with a dvd burner and then you would modify the DVD firmware to read it from that sector and make sure it would answer with the correct responses to the challenges.

Like I mentioned earlier, shortly after the hack I was contacted by some guy from Spain who ran a forum/shop, who wanted to buy the hack. I think this might have been Max from paradox cause if you google him you will see that he ended up with “GaryOPA” who at the time was also helping with the crack, so it would make sense that after I told him I wasnt interested in making money with this/selling the hack, he contacted GaryOPA. But that’s just speculation, I didnt ask him back then, so really dont know for sure.

Anyway solutions appeared shortly after, from people who made software solutions but also people who were trying to sell hardware based solutions. Basically, before it was just fun, everybody helping out together on the forum, adding something to the forum, really from a hackers perspective. We had people who were very good with the hardware, so they would dump things directly via soldered debugging ports and even were able to dump the communication between console and dvd drive. People who helped out decrypting things etc and a few who people who worked on the  reverse engineering of which I was one. But once it was all done, it all turned into ‘business’, and people jumped in who just wanted to make money. I think that’s basically also what happened in the Amiga scene, you had people who were just in for the fun & fame and you had people who wanted to make money. I guess it’s always like that. But it kind of did turn me off. Obviously I’m not the one to be lecturing about ethics but I do feel that money should flow to the people who created the games, not the ones selling a hack. So that was also one of the reasons that I turned my back to all this. And I also really realized: hacking is one thing but creating a good protection, like nowadays there are some quite good software protections out there, that is intellectually way more challenging than hacking a protection. And you are ethically ‘on the right side’, which kinda feels good too 🙂 So I wrote a protection for some software company, wont mention which one, but it was a piece of software that quite a few hackers wanted to hack. It did get hacked though after a while, I think also because the company I wrote it for, didnt want to implement all of my ideas, because it would translate to not 100% compatability with some windows versions and would most certainly not run on future windows versions without modification. But it was great fun. I saw some of the others here from the old Amiga scene who said they’re now working for ‘the other side’ too, I think that’s really nice. The thrill surely is a bit less but in the end of the day, I think it makes people happier. But again, I shouldnt be the one lecturing about ethics here 😉

[mus@shi9]

😀 Did you look at the hack for  your software? and figure out how they did it?

[thespecialist]

Hey Musashi9, sorry didnt check this board for a while. No, I never looked back after we published info on the xbox 360 hack, I left the xbox scene shortly after. I still love reverse engineering though, just last week I read this nice article: http://www.kerneronsec.com/2016/02/remote-code-execution-in-cctv-dvrs-of.html and thought, let’s ‘do this at home’, lol and started reverse engineering the FW for this box: http://www.ambery.com/prreposwphco.html, it’s a powerswitch which you can hook up and control via the internet. I own one and just for the fun of it I wanted to see if it had weaknesses similar to the one in the above article and yes it had quite a few which gained me a command shell+root via HTTP in notime but more interestingly, I found a backdoor in and reversed engineered it to find out how it works, basically you can send JSON formatted instructions which are 3DES encrypted which should contain a key which you can download via the /manager_key_ask.csp. Wow, that’s kinda horrible right, a company selling hardware with backdoors in it to control every piece of hardware they sell. I wonder how often this happens ! Anyway, I didnt publish the hack, just doing stuff like that for fun every now and then 😉 What about yourself, I saw you did some very nice cracking tutorials on this site, were you active in the Amiga scene yourself ? And sorry for going offtopic to the extreme here but hey, you’re the Admin so I guess it’s ok 😉 Cheers !

[thespecialist]

#3414 Phantasm:
Hi. I remember you from those early xbox 360 days on xboxhacker.net (i think it was). Not sure if you remember me but I assisted with the initial “decrypting” of the bios.

@Phantasm: I just read your double dragon tutorial, nice work mate ! I never realized amiga games had protections like this, I always figured it wasn’t much more than some simple novella/MFM. Nice to see some nifty programmers took the time to try to take it to the next level. I’m sure that blitter trick would have had me busy for a while for sure 🙂

[Author]

Posts