Updated Xbox360 tools

Hi Internets. Long time, no speak.

Over the weekend I dusted off my trusty Xbox360 and figured I should give it a little bit of use before its next gen replacement arrives. While I was setting it up and preparing it for use I thought it was about time I shared the current versions of my Xbox360 tools as well as a new one that is not feature complete, but at this stage may never be. :)

Continue reading

XexTool v6.1 Update + more

Here is a small update for XexTool and the Xex Loader for IDA to fix some reported bugs.

This adds some enhancements to the IDC file creation in XexTool to bring it as close to the level of the Xex Loader plugin as is possible with a script. It also adds checks to ensure the file was loaded as a Binary PPC file. It is a common mistake to use IDAs default option of “Load as a PE file”  so this will now catch this error and warn the user.

This update also fixes a bug in the Xex Loader for IDA that stopped it being usable in some versions of IDA such as v5.5. It is recommended to use this update even if the last version gave you no noticable issues.

Lastly I’ve also included the latest revision of the “PPC Altivec” plugin for IDA. This was a plugin originally created by Dean Ashton to add Altivec and VMX support to IDAs PPC processor module. It is now up to v1.8 and has been added to and tweaked by many people including myself. This plugin now also adds support to IDA for the processor specific instructions available on PS3 (CellBE), Xbox360 (Xenon) and Gamecube/Wii (Gekko). Continue reading

XexTool v6.0 Update

I have been meaning to update this site for a while, and also to release updates for XexTool and the Xex Loader for IDA. So over the weekend I finally got around to doing so.

For those who don’t know, XexTool is a windows command line tool that gives info on every aspect of an Xbox360 xex file. It also extracts the file that the xex is based on (usually an exe file) and has the ability to alter most of the various flags and parameters set inside an xex file.

XexTool v6.0

The IDA loader for XEX files enables you to directly load an xex file into the IDA disassembler in order to look at what the internal code is doing. This is extremely useful for developers and reversers. If you don’t know what IDA is or what this loader does, then this tool isn’t for you. :)

Xex Loader for IDA v6.0

XorHack v2.0: The Updated PS3 Exploit Toolkit

After using the XorHack for a while I realised it was missing some things so I decided it was time for an update. New syscalls have been added to give finer control over data access, now providing 8, 16, 32 and 64 bit reads and writes. Also some new ioctls were added to provide additional useful functions for your userland code. Lastly new userland applications were added which now give the ability to read, write and execute memory from the command line :)

Download XorHack v2.0 here

Continue reading

XorHack: The PS3 Exploit Toolkit

I finally found the time to complete the PS3 exploit toolkit software I mentioned to in my previous posts. I call it XorHack. It allows you to call lv1 syscalls (level 1 system calls) from a normal (userspace) program. It also lets you run the software required when triggering the PS3 exploit from a normal userspace program. To give an example of how it can be used I have included the following example programs:

  • ps3exploit – Runs the software required to exploit the ps3, it loops a number of times which can be specified as a parameter. (This still must be used along with the “button pressing”, it will not exploit the PS3 via software alone).
  • dumphv – Dumps the hypervisor to a file in the current directory.
  • dumpbl – Dumps the bootloader to a file in the current directory.
  • dumprom – Dumps the system  rom to a file in the current directory.

Continue reading

PS3 Exploit Tidbits

I haven’t gotten around to doing an update in a while due to work (and a little relaxation) taking all my time. Rather than wait till I have finished all of the stuff I wanted to before posting again I decided to post some tidbits to tide you over until the rest is ready. Before I do so I’d like to make the following clear as no matter how many times I say it, people believe what they want to believe instead:

THIS PS3 EXPLOIT WILL NOT ENABLE PLAYING OF COPIED OR BACKED UP GAMES. THE EXPLOIT IS FOR RESEARCH PURPOSES ONLY. Continue reading

PS3 Exploit Setup

Just a quick pic of it all working together cos everyone loves pictures!

This is the PS3 with the newer motherboard where the socket I installed in the front actually looks nice, the other one was a bit of a hack job 😉

PS3 Exploit: Hardware

This post will deal with the hardware required to trigger the PS3 hypervisor memory access exploit. The purpose of the hardware is to stop the PS3 from saving a change to a value that we don’t want changed. The PS3 saves this changed value by writing the value to RAM. Therefore in order to stop it from saving the changed value we need to stop this write from occurring.

The PS3 sends the write command to the RAM over some control lines, so we interfere with these control lines when the write command is sent. The result we want is having the PS3 think it has successfully written the value to RAM, but the RAM didn’t receive the write command due to our interference and so it did not perform the write operation. Continue reading

PS3 Exploit: Software

As I’m sure everybody heard, the memory access exploit for the PS3 hypervisor was released recently by geohotz. I was finally able to replicate his hack so I thought I’d take the time to help out others who may also have trouble due to being linux n00bs like me :) If I were to post everything at once it would be too much work and I’d never get around to it, so I’ll post bits at a time to ensure I actually do post it heh. Today’s post will talk about the software side of the exploit.

Please note that the geohotz exploit software was hardcoded for the v2.42 firmware, I have made a small fix that attempts to dynamically support all firmware versions. I have only tested and used it on v3.15 however.

Fixed PS3 Exploit Files

Continue reading

PS3 and Xbox360 IDA Plugin Update (again)

As more special PPC instructions are stumbled across, support for them gets added to the plugin. I know I could go through an exhaustive list of all instructions and add them all, but for now I am content with adding them a few at a time 😛

PPC Altivec plugin v1.6 for IDA v5.6

Support added for the instructions: attn, lwsync, ptesync, tlbiel, tlbie, tlbi, slbie.

Also added support for the SystemSim “callthru” instruction (should this even be used outside of a simulator?) and lastly an instruction that I cannot find any information about. The hex value is 0x02002000 so for now I have added this instruction as opcode_02002000 so that it will at least disassemble to code and can therefore be treated as code. If anyone knows what this instruction is please let me know :)

PS3 and Xbox360 IDA Plugin Update

Here is version 1.5 of the PPC Altivec Plugin for IDA v5.6 which adds support for special instructions that are used by some PPC based devices. This was originally written by Dean Ashton and then updated by Takires.

This is useful when disassembling Xbox360 and PS3 binaries in IDA as they utilise these special instructions that are not supported by IDAs built in PPC disassembler module.

I have done some fixes to instructions that were previously handled incorrectly, as well as adding support for some new instructions. I also fixed an issue where instruction sizes were being reported incorrectly resulting in an incorrect disassembly.

More broken technology

In lieu of adding real content to my blog, here is some more broken techonology I came across. It is an electronic billboard that is basically a computer running ads on a widescreen LCD screen. It seems to be lonely without its keyboard however.

Close up of electronic billboard

Close up of electronic billboard

Electronic billboard in its environment

Electronic billboard in its environment

Wii: Load Nintendo SDK ELFs via the HBC

The Homebrew Channel (HBC) was designed to be used with the Homebrew  SDK aka devkitPro. So any files you compile with devkitPro should load OK via the HBC.

If you try to load a file that was compiled with the Nintendo SDK however you will get an error that “This is not a valid Wii application”.  This is because the Homebrew Channel retrieves the load addresses for each ELF program segment from the Physical Address field, and in Nintendo SDK files this field is set to zero.

Hopefully the HBC guys will fix this in the next release, making the HBC more compatible. In the meantime you can use this little tool I made to patch your ELF file. It copies the values from the Virtual Address field into the Physical Address field for each program segment in your ELF file.

WiiElfFix v1.0