Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit

icode4.coffee

Post reply on HN
Print view View original

41–50 of 109 posts

Re: Hacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit

#41

Post by gjsman-1000 »

mulmen wrote: post #28
mschuster91 wrote: post #26

Earlier quoted context omitted.

It's the same issue that was behind NVDAs "soldergate" fuck-up that ended up permanently souring the relationship between them and Apple. The core is EU's regulation on lead free solder, which led to a number of people finding out that thermal cycling on the solder led to thermal stresses. Workarounds were identified and any solder formulations since then don't suffer from that issue, so the fix is a complete re-ball…

Sounds like a R&D problem. Why the dig at the EU?

Why not blame the EU? It is just a well known fact that non-leaded soldier has inferior properties to leaded soldier, which require careful engineering to work around, and still remain somewhat unresolved.

At this point, the directive may have caused more e-waste and environmental damage from part failures than the damage the original leaded soldier would have caused.

Re: Hacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit

#42

Post by 6SixTy »

hot_gril wrote: post #37
throwaway48476 wrote: post #34

Earlier quoted context omitted.

It was an industry wide problem.

Somehow out of everyone I know with one or both consoles, 100% of 360s got red ring, 0% of PS3s got yellow light.

Fat or slim PS3? Mine experienced a YLOD circa 2010 while the slim that replaced it still works to this day.

Re: Hacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit

#43

Post by kmeisthax »

I'm gonna be honest, I thought the story was over when they started talking about "oh hey here's this hypervisor code that loads extensions", because obviously extensions are going to be a massive increase in attack surface. But even then, the system wasn't actually broken by the extension being badly designed; the extension was just the most useful target to use the actual attack on.

How the hell has this the Xbox 360 hypervisor remained basically impenetrable? You'd think at some point, someone would write and sign a hypervisor extension with a cripplingly bad memory safety bug. Hell, Apple's PPL[0] has better hardware isolation than Xenon's hypervisor mode[1] and it still gets 0wned more often.

[0] Page Protection Layer. On Apple processors, every ARM exception level has a corresponding guarded exception level that has privileges over the regular one; chiefly corresponding to memory management.

[1] On Xenon, the hypervisor runs in "real mode" plus HRMOR; Apple PPL's GL1/2 still have virtual memory and page table permissions.

Re: Hacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit

#45

Post by yieldcrv »

Retr0id wrote: post #19
mouse_ wrote: post #9

I wish there was somewhere I could toss cash into a softmod bounty.

Assigning dollar values to this kind of work gets messy, fast. Imagine if someone iterated on the exploit presented in the article so that it became a persistent "softmod" - who gets the funds? Bounties also discourage open collaboration. For example, if person A has the first half an exploit chain and person B has the second, they're each incentivised to keep the information to themselves and try to get a full chain…

Bounties are free work contests for any potential beneficiary

And the benefactor is designed by a committee who cant even agree on the value, winding up tossing pennies at the problem hoping someone in Malaysia salivates

Re: Hacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit

#46

Post by yieldcrv »

jcranmer wrote: post #38
whalesalad wrote: post #10

Earlier quoted context omitted.

at this point is there any reason to use xb360 hardware? emulation on modern hardware has gotta be substantially better

The Xbox 360/PS3 era of video game consoles is probably the hardest era to emulate. Subsequent generations of consoles are essentially the same hardware as regular computers, just with a custom OS (and known hardware profile, certainly a benefit over regular consumer PCs). But that era of video game consoles is the last gasp of the custom hardware design of earlier consoles, which is substantially harder to emulate b…

so, the challenge is what’s interesting, or any specific title or application?

Re: Hacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit

#48

Post by somat »

mschuster91 wrote: post #26
throwaway48476 wrote: post #11

Earlier quoted context omitted.

The red ring is caused by underfill that is too soft that let's the solder bumps break. It's a BGA packaging problem and there's no fix.

It's the same issue that was behind NVDAs "soldergate" fuck-up that ended up permanently souring the relationship between them and Apple. The core is EU's regulation on lead free solder, which led to a number of people finding out that thermal cycling on the solder led to thermal stresses. Workarounds were identified and any solder formulations since then don't suffer from that issue, so the fix is a complete re-ball…

Complicating the issue is that this was also an early generation of chiplet so there are two levels of bga. motherboard to processing unit and processing unit to chip_actual. the latter commonly are referred to as "bumps" to distinguish from "bga" which attaches the chip_structure to the mother board. A lot of the problem was in the bumps for this chiplet like sub assembly. and while reballing bga is a tricky but well understood process. my understanding is that reballing bumps is nearly impossible.

Re: Hacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit

#49

Post by hot_gril »

6SixTy wrote: post #42
hot_gril wrote: post #37

Earlier quoted context omitted.

Somehow out of everyone I know with one or both consoles, 100% of 360s got red ring, 0% of PS3s got yellow light.

Fat or slim PS3? Mine experienced a YLOD circa 2010 while the slim that replaced it still works to this day.

Mostly the fat PS3. And the fat 360 too.

Re: Hacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit

#50

Post by hot_gril »

mschuster91 wrote: post #40
mulmen wrote: post #28

Earlier quoted context omitted.

Sounds like a R&D problem. Why the dig at the EU?

I'm European, I actually support RoHS - it was just the original cause because everyone up to it getting in force was accustomed to classic, decades-proven leaded solder.

Did they need to have a longer transition period? Looks like it went into enforcement only 2 or 3 years after it was approved.
Post reply on HN