Exploitability and hijacking the chain of control.

[adcurtin]

So I have a few basic questions about how the 360 works with loading the different bootloaders and how they're encrypted.

1. The 1BL is on the CPU die, and cannot be changed (right?). Is it encrypted, unencrypted, or we have no (easy) way of getting at the data at all, and have no idea?

2. the 2BL is on the nand, it is encrypted with RSA (right?). The 1BL loads the 2BL, does it do any sort of hash checking other than decrypting the RSA? (so if we had MS's RSA key, we could write our own 2BL and have complete exploitability on all consoles? [I know, won't happen, just helping me figured out how it's loaded]).

3. the 2BL checks the efuses to see if it can run, if it can, what does it do? (if it can't, it throws an error). When the 2BL checks the fuses, what is it comparing to?

4. the 4BL is loaded by the 2BL and is encrypted with the consoles CPU key, right?

5. the current exploit is in the 2BL / CB, how does it work (like a brief overview)?

Thanks.

[littlestevie360]

1. 1BL can be extracted from linux using dump32
2. 2BL is signed and encrypted, the signature is a sha1 hash that is then encrypted with the private key
3. 2BL(CB) checks the second row fuses to see if its been revoked, the check is hardcoded
4. 4BL is encrypted with the CPU key, but also signed with microsofts public key
5. the SMC JTAG is documented http://free60.git.sourceforge.net/git/gitweb.cgi?p=free60/tools;a=blob_plain;f=imgbuild/hack.txt;hb=HEAD but is not the exploit itself, its just a way of executing the exploit, the exploit itself resides within the 4532/4548 kernel (which was discovered 2 years ago)

[MRA]

The 4BL is not encrypted with the CPU key.

[littlestevie360]

The 4BL is not encrypted with the CPU key.

it is in newer units, new CB's encrypt with CPU key from the CD section and on

[MRA]

Oh, OK. Thanks for the info. Didn´t take a look at kernels since quite a time. Just knew that Xenons CD were definately not encrypted with the CPU key.

[adcurtin]

ok, that pretty much answers all my questions. Thanks.

[Martin_sw]

@littlestevie360

The 4BL is not signed, the 4BL SHA-1 hash is just hardcoded into the 2BL. The 4BL in turn contains the hardcoded SHA-1 hash for the 5BL.