logo: an integrated circuit

  1. The Xbox dashboard has a PAL60 option to make games run at 60 Hz but Halo: Combat Evolved runs at 50 Hz with 25 FPS regardless.↩︎︎

  2. Port 3074 is a registered port assigned by the IANA.↩︎︎

  3. Is it possible to simply list the currently memory mapped regions of a remote GDB target instead of determining them with trial and error like this? E.g. like info proc mem for a native process.↩︎︎

  4. The 288 $2^88$ constant is represented with 96 bytes: 95 zeros followed by a two. I initially thought it was a big-endian 2 but since the XcModExp uses little-endian, the value will evaluated as 288 $2^88$. I am not sure if 288 $2^88$ is a better value than 2 here and if it was even intentional to use that over simply 2.↩︎︎

  5. The d $d$ constant is the prime number 2768-2704-1+264(2638π+149686) $2^768-2^704-1+2^64(2^638\pi+149686)$, referred to as the “First Oakley Default Group” by RFC 2409. Although, it it is written in big-endian while XcModExp seems to use little-endian.↩︎︎

  6. This is known as the Diffie-Hellman problem.↩︎︎

  7. The packets are kind of odd, they always use the same destination IP addresses for all recipients (255.255.255.255 for broadcasts and 0.0.0.1 for unicasts). I tried to capture the packets by using UDP sockets that listen to the Xbox port. The broadcasts that were addressed to 255.255.255.255 were picked up after binding to INADDR_ANY (0.0.0.0) or INADDR_BROADCAST (255.255.255.255). However, the packets addressed to 0.0.0.1 were not, and I was also not able to bind the socket to 0.0.0.1 because that address is not considered local. I am not sure if it is possible to listen to addresses not assigned to my machine? Would I be able to listen to it if I managed to statically assign 0.0.0.1 to my machine?↩︎︎

  8. Due to some fields not being aligned like a struct in C is typically aligned, we have to use uint8_t arrays in order to avoid padding.↩︎︎

  9. Interestingly, the guest seems to take the latest packet it receives and just overwrite the earlier information it received rather than trusting the first packet and ignoring later packets. If we also choose to overwrite the host ID, we instead get two options two choose from in the game selection list. But by keeping the same host ID, we can silently act act as the original host.↩︎︎

  10. The yaw and pitch is in radians from 0 to 2π $2\pi$ and -π2 $\frac{-\pi}{2}$ to π2 $\frac{\pi}{2}$, respectively. The yaw is 0 when facing east (assuming the assault rifle compass is pointing north).↩︎︎

  11. We cannot represent the elements after the player array in the struct because the number of players varies, instead we use a C99 flexible array member which just points to the start of the player array and ignore the byte after because it is constant anyway.↩︎︎

  12. I am not sure how or if it is attempting to reset. In order to resynchronize, would the host not need to send its full game state? There are no additional packets being exchanged except for the normal ones.↩︎︎

  13. How does it detect the desync, though? Perhaps they are using the hash value that is sent by the host. The host might calculate a hash of its entire game state, if the guest client then obtains a different hash for its game state compared to the one it receives by the host, it will present the desync message and try to reset. Modifying this hash value once using our MITM client causes the desync message to flash by for a second on the guest console and make the guest players immediately leave the game.

    Unfortunately, this makes it difficult to create a dedicated server. If it were not for this desync detection, it might have been possible to create a simple server that simply broadcasts all player information to the guests.↩︎︎

  14. As far as I know, all current softmod methods still require special Xbox adapters in order to transfer the exploit program to the Xbox.↩︎︎