|
TheSpecialist
|
 |
« Reply #40 on: June 13, 2007, 07:16:31 AM » |
|
do we have the ability to encrypt it again with the correct signature for it to boot on the xbox? We're working on adding that ability to the tool right now. |
|
|
|
|
Logged
|
|
|
|
|
fickdiach
|
|
« Reply #41 on: June 13, 2007, 07:43:55 AM » |
|
yeah but what advantage does this bring for us ?
i mean everything is encrypted, all we could flash is the same we dumped before , or am i wrong?
|
|
|
|
|
Logged
|
|
|
|
|
TheSpecialist
|
|
« Reply #42 on: June 13, 2007, 07:48:15 AM » |
|
yeah but what advantage does this bring for us ?
i mean everything is encrypted, all we could flash is the same we dumped before , or am i wrong?
Eh ? The tool decrypts everything, not sure what you mean with 'everything is encrypted'. |
|
|
|
|
Logged
|
|
|
|
|
fickdiach
|
|
« Reply #43 on: June 13, 2007, 07:50:56 AM » |
|
yeah but what advantage does this bring for us ?
i mean everything is encrypted, all we could flash is the same we dumped before , or am i wrong?
Eh ? The tool decrypts everything, not sure what you mean with 'everything is encrypted'. Sorry, I was a little bit tired. I meant what advantage does reencrypting bringt to us, since we cant modify the Kernel/HV/Dash... since its signed. Of course this shows us how all this works, but I think many people here think its as easy as on the PSP where you can simply flash a modified Firmware. |
|
|
|
|
Logged
|
|
|
|
|
TheSpecialist
|
|
« Reply #44 on: June 13, 2007, 07:53:50 AM » |
|
Sorry, I was a little bit tired. I meant what advantage does reencrypting bringt to us, since we cant modify the Kernel/HV/Dash... since its signed.
Of course this shows us how all this works, but I think many people here think its as easy as on the PSP where you can simply flash a modified Firmware.
For starters, the Keyvault (containing for example region code) is not signed. Secondly, some very interesting data, like the pairing stuff and the stuff that keeps us from downgrading kernels, is not signed either. And then there's a bit more of data that's not signed and may be interesting to play with. |
|
|
|
|
Logged
|
|
|
|
|
anita999
|
|
« Reply #45 on: June 13, 2007, 08:17:40 AM » |
|
... the day our 360's will boot directly into XBMC ...
well, haven't been here for a while. I am really glad to see there progresses. And for sure that your signature is what most people are expecting, including me. Good job, specialist and all the team members here.
|
|
|
|
|
Logged
|
|
|
|
|
Bydox
|
|
« Reply #46 on: June 14, 2007, 03:18:12 AM » |
|
yeah but what advantage does this bring for us ?
i mean everything is encrypted, all we could flash is the same we dumped before , or am i wrong?
Eh ? The tool decrypts everything, not sure what you mean with 'everything is encrypted'. Sorry, I was a little bit tired. I meant what advantage does reencrypting bringt to us, since we cant modify the Kernel/HV/Dash... since its signed. Of course this shows us how all this works, but I think many people here think its as easy as on the PSP where you can simply flash a modified Firmware. So what performs the signature check of the new kernel image? Is it something fixed in hardware (like the CPU/MMU) or is it done by code in the previous kernel/dash? If the check is software driven, can't we just remove that routine from the modded image before we flash it back? |
|
|
|
|
Logged
|
|
|
|
robinsod
Global Moderator
Xbox Hacker
Posts: 648
Perl packed my shorts during global destruction
|
|
« Reply #47 on: June 14, 2007, 05:07:52 AM » |
|
The checks are daisy chained, the 1BL (in ROM in the CPU) checks CB which checks CD which CE. We cant modify 1BL so we can't tamper with the others
|
|
|
|
|
Logged
|
|
|
|
|
Kiss
|
|
« Reply #48 on: June 15, 2007, 03:21:17 PM » |
|
This is all "good stuff" but a little OT, so I propose to split it into a new thread - Everyone ok with that?
@robinsod Yes pls @all, someone manage to create an working 32bit code from this ? |
|
|
|
|
Logged
|
|
|
|
robinsod
Global Moderator
Xbox Hacker
Posts: 648
Perl packed my shorts during global destruction
|
|
« Reply #49 on: June 21, 2007, 12:42:11 PM » |
|
http://rapidshare.com/files/38552194/tool.06.rar.htmlThis release supports downgrading if you know your CPU key. Right click on a CF section and choose "Fix Version Lock", enter the new lock down number, click ok & then click "Patch" and choose the directory/filename for your patched flash image. The file produced is all fixed up and ready to be flashed into your 360. In my case I had a dump of 4532 (with Lockdown Counter = 1) and upgraded to 4552 (the Lockdown Counter incremented to 2). I patched the 4532 flash image to change the Lockdown Counter to 2 and flashed my 360, now I have a vulnerable kernel (again).
|
|
|
|
|
Logged
|
|
|
|
|
jacksback
|
|
« Reply #50 on: June 21, 2007, 10:21:54 PM » |
|
http://rapidshare.com/files/38552194/tool.06.rar.htmlThis release supports downgrading if you know your CPU key. Right click on a CF section and choose "Fix Version Lock", enter the new lock down number, click ok & then click "Patch" and choose the directory/filename for your patched flash image. The file produced is all fixed up and ready to be flashed into your 360. In my case I had a dump of 4532 (with Lockdown Counter = 1) and upgraded to 4552 (the Lockdown Counter incremented to 2). I patched the 4532 flash image to change the Lockdown Counter to 2 and flashed my 360, now I have a vulnerable kernel (again). Nice work Robinsod Am I right in thinking you can now downgrade without having removed the R6T3 resistor? |
|
|
|
|
Logged
|
|
|
|
|
Arakon
|
|
« Reply #51 on: June 21, 2007, 11:23:34 PM » |
|
only if you first got your cpu key with a vulnerable kernel.
|
|
|
|
|
Logged
|
I do NOT give support by email, PM, ICQ or whatever. Anyone annoying me that way will have his balls removed. With a rusty butterknife. Slowly. And I'll enjoy doing it.
|
|
|
|
zillionare
|
|
« Reply #52 on: June 21, 2007, 11:40:19 PM » |
|
This release supports downgrading if you know your CPU key. Right click on a CF section and choose "Fix Version Lock", enter the new lock down number, click ok & then click "Patch" and choose the directory/filename for your patched flash image. The file produced is all fixed up and ready to be flashed into your 360.
In my case I had a dump of 4532 (with Lockdown Counter = 1) and upgraded to 4552 (the Lockdown Counter incremented to 2). I patched the 4532 flash image to change the Lockdown Counter to 2 and flashed my 360, now I have a vulnerable kernel (again).
This is really great news!! Congrats robinsod I thought it would be a flip/flop from an odd fuse # to an even fuse #. much like dss. guess it still could be. Since whole numbers are even/odd but this is more than just a bit...it's a string. Are you going to try with the new kernal 5759? *RISKY*... I'm still waiting on some programming hardware.....but will try when parts arrive. Seems if your allready upgraded at 4554 or newer tho "can't get fuses = no key" your still dead in the water. Once again, thanks for sharing your tools. peace, zil |
|
|
|
|
Logged
|
Why buy one, when you can buy two for twice the price.
|
|
|
|
Arakon
|
|
« Reply #53 on: June 21, 2007, 11:50:16 PM » |
|
I have successfully downgraded from 5759 to 4532 using an infectus, with the efuse resistor removed.. so at least there's no additional changes beyond the efuses for downgrade protection.
|
|
|
|
|
Logged
|
I do NOT give support by email, PM, ICQ or whatever. Anyone annoying me that way will have his balls removed. With a rusty butterknife. Slowly. And I'll enjoy doing it.
|
|
|
robinsod
Global Moderator
Xbox Hacker
Posts: 648
Perl packed my shorts during global destruction
|
|
« Reply #54 on: June 22, 2007, 08:01:12 AM » |
|
I thought it would be a flip/flop from an odd fuse # to an even fuse #. much like dss. guess it still could be. Since whole numbers are even/odd but this is more than just a bit...it's a string.
I am surprised that there seems to be only 16 Version Lockdown fuses - I wonder what happens if you blow them all, I might spend a bit of time up & downgrading...... Are you going to try with the new kernal 5759? *RISKY*... I'm still waiting on some programming hardware.....but will try when parts arrive.
Nah, I doubt there's anything else to prevent downgrading. Seems if your allready upgraded at 4554 or newer tho "can't get fuses = no key" your still dead in the water.
Yeah, this anti "hero attack" technology is working really well, if you don't have the CPU keys a lot of the interesting stuff is unavailable to you. |
|
|
|
|
Logged
|
|
|
|
|
tmbinc
|
|
« Reply #55 on: June 22, 2007, 08:31:56 AM » |
|
I am surprised that there seems to be only 16 Version Lockdown fuses - I wonder what happens if you blow them all, I might spend a bit of time up & downgrading......
No, the last 4 fuselines can also be used, unless another condition is met (which is never). |
|
|
|
|
Logged
|
Please don't copy/quote full text outside this board. Instead, summarize and link to this post. Thanks! This lets me keep information updated and doesn't pull things out of context.
|
|
|
|
sectroyer
|
|
« Reply #56 on: June 23, 2007, 07:20:00 AM » |
|
Hi.
So we can downgrade without removing R6T3 if we know the CPU Key. The same CPU Key that is used to decrypt/encrypt the kernel/HV itself? So isn't it possible to brute-force the CPU Key? We have the dump from infectus. We know what to expect (some static data i.e.) and we could brute force the cpu key without ever dumping it?
Regards.
|
|
|
|
|
Logged
|
|
|
|
|
TheSpecialist
|
|
« Reply #57 on: June 23, 2007, 07:38:07 AM » |
|
Hi.
So we can downgrade without removing R6T3 if we know the CPU Key. The same CPU Key that is used to decrypt/encrypt the kernel/HV itself? So isn't it possible to brute-force the CPU Key? We have the dump from infectus. We know what to expect (some static data i.e.) and we could brute force the cpu key without ever dumping it?
Regards.
Kernel/HV is not encrypted with a per box key, only the Keyvault is encrypted with the cpu key. Brute force is not possible on a 16 bytes key. But yeah, if you'd find a way to get the CPU key (fuse data), then you've 'won', because you then can downgrade the kernel and run unsigned code. |
|
|
|
« Last Edit: June 23, 2007, 02:26:50 PM by TheSpecialist »
|
Logged
|
|
|
|
|
|
|
TheSpecialist
|
|
« Reply #59 on: June 23, 2007, 09:09:51 AM » |
|
 But does the encryption/decryption use whole 16byte key at once ? or do they divide it for example in two parts? Maybe it does something similar as windows with LM Hashes  ? Of course brute forcint 16 byte key at once may be hard. But brute forcing parts of it seems possible  They use Hmac-sha1/Rc4, no way you can bruteforce that. |
|
|
|
|
Logged
|
|
|
|
|
