Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exploring the Halo 1 System Link Protocol

hllmn.net

Post reply on HN
Print view View original

21–30 of 65 posts

Re: Exploring the Halo 1 System Link Protocol

#21

Post by monocasa »

ClassyJacket wrote: post #4
PawBer wrote: post #3

Earlier quoted context omitted.

The LAN code is probably the same code as the online multiplayer.

Halo 1 on original Xbox does not have online multiplayer. It launched before Xbox Live did.

As someone who's written replacement backend Xbox Live server infra, I can confirm that system link is very nearly the same base protocol set as is used by Live. They must have had that nailed down pretty close to launch, and were mainly working on support services that live needs but system link doesn't up until Live actually launched.

Re: Exploring the Halo 1 System Link Protocol

#22

Post by monocasa »

loeg wrote: post #11

"age in a bot" might be a truncated form of "message in a bottle." The PRNG exponentiation scheme is essentially Diffie-Hellman. > Modifying the fire duration does not seem to have any effect Including, e.g., plasma pistol? Very cool investigation and writeup.

Yeah, it's straight up diffe-hellman, even using the First Oakley Default Group as it's prime.

https://github.com/XombieOnline/xombie/blob/7a1ef08045271437...

Re: Exploring the Halo 1 System Link Protocol

#23

Post by coldpie »

nhellman wrote: post #14
loeg wrote: post #11

"age in a bot" might be a truncated form of "message in a bottle." The PRNG exponentiation scheme is essentially Diffie-Hellman. > Modifying the fire duration does not seem to have any effect Including, e.g., plasma pistol? Very cool investigation and writeup.

> "age in a bot" might be a truncated form of "message in a bottle." Yeah, that makes sense, it is a very odd sentence otherwise. Truncating on "bot" might be a play on words for game AI/NPC. > The PRNG exponentiation scheme is essentially Diffie-Hellman. Ah, of course, yes, I was thinking it reminded of public-key cryptography. > Including, e.g., plasma pistol? Yeah, it seems so, that was the first weapon I was thin…

> Yeah, that makes sense, it is a very odd sentence otherwise. Truncating on "bot" might be a play on words for game AI/NPC.

I wonder if you could dig into the game code and see where the string is coming from.

Re: Exploring the Halo 1 System Link Protocol

#24

Post by Sxubas »

Loved it, thanks for being so thorough and document the train of thought.

I want to ask about one thing I could not understand completely on the final section: If there was a client that sent arbitrary values for selected weapon, forward, left, etc; would the host count them as valid? (I understood this is essentially what the MITM allowed to do)

Also, a little feedback, my immersion broke when the video did not show Howard and Ghost anymore. Something like Howard1 and Ghost1 would've helped understand a little bit more.

Re: Exploring the Halo 1 System Link Protocol

#25

Post by monocasa »

nhellman wrote: post #7
reidjs wrote: post #2

This is a well written, in depth analysis of the system. Why do you think the packets are encrypted?

Thanks, I was initially surprised that they were encrypted but I can speculate on a few potential reasons: - The Xbox was designed to be able to play online via Xbox Live (e.g. with Halo 2 that came out later in 2004), and they might have simply reused the network stack for System Link over LAN. I looked a little bit at Halo 2 system link, it uses the same system calls from the kernel but the protocol seems to be mor…

From what I've heard from microsofties over beers, it was really the second one. They didn't expect developers to write network code in ~2001 that didn't have memory safety vulnerabilities and wanted a barrier there between simple overflows and system security.

Re: Exploring the Halo 1 System Link Protocol

#26

Post by nhellman »

Sxubas wrote: post #24

Loved it, thanks for being so thorough and document the train of thought. I want to ask about one thing I could not understand completely on the final section: If there was a client that sent arbitrary values for selected weapon, forward, left, etc; would the host count them as valid? (I understood this is essentially what the MITM allowed to do) Also, a little feedback, my immersion broke when the video did not show…

> Loved it, thanks for being so thorough and document the train of thought.

Glad to hear! I was hoping to make the whole process easy to follow without any large skips or prior knowledge. It is more or less my process but with a lot of dead ends removed.

> I want to ask about one thing I could not understand completely on the final section: If there was a client that sent arbitrary values for selected weapon, forward, left, etc; would the host count them as valid? (I understood this is essentially what the MITM allowed to do)

Yes, it appears so. The host seems to accept more or less arbitrary values (at least for forward, left, actions) and also just re-broadcasts them to everyone. The guest client then also ignores what it sent and just uses what it receives from the host. This allows us to modify the inputs/speed of any guest client players without desyncing the clients.

> Also, a little feedback, my immersion broke when the video did not show Howard and Ghost anymore. Something like Howard1 and Ghost1 would've helped understand a little bit more.

Good idea, I could have made it clearer which perspective the video was taken from (the guest client). Might be able to re-record or simply mention it in the text.

Re: Exploring the Halo 1 System Link Protocol

#27

Post by nhellman »

monocasa wrote: post #19

So that's basically most of the lowest layers of the Xbox Live protocol as well. Simply game discovery happens over local broadcast instead of through the Live servers. There's some other specifics that change, such as logging into a host xbox doesn't diffie-hellman anymore but instead key sets are distributed by the server backends with the session information. Additionally the auth side is basically non existent on…

> So that's basically most of the lowest layers of the Xbox Live protocol as well. Simply game discovery happens over local broadcast instead of through the Live servers. There's some other specifics that change, such as logging into a host xbox doesn't diffie-hellman anymore but instead key sets are distributed by the server backends with the session information. Additionally the auth side is basically non existent on system link.

Ah, cool, there has been some similar work done before! Is there any documented resources or write-ups of the Xbox Live protocol somewhere?

> Great RE work!

Thanks!

> Disclaimer: I created a proof of concept implementation of the Xbox Live server infrastructure here: https://github.com/xombieonline

That is a really cool project! How does one make sure the console connects to the server instead of the (now shutdown) Xbox Live servers? Does it e.g. have a hardcoded domain so one can simply add a DNS entry?

Re: Exploring the Halo 1 System Link Protocol

#28

Post by mywittyname »

monocasa wrote: post #25
nhellman wrote: post #7

Earlier quoted context omitted.

Thanks, I was initially surprised that they were encrypted but I can speculate on a few potential reasons: - The Xbox was designed to be able to play online via Xbox Live (e.g. with Halo 2 that came out later in 2004), and they might have simply reused the network stack for System Link over LAN. I looked a little bit at Halo 2 system link, it uses the same system calls from the kernel but the protocol seems to be mor…

From what I've heard from microsofties over beers, it was really the second one. They didn't expect developers to write network code in ~2001 that didn't have memory safety vulnerabilities and wanted a barrier there between simple overflows and system security.

Makes total sense, especially recalling the zeitgeist of the era. IIRC, this was during the height of worms which propagated via vulnerabilities in code that handles network traffic.

Re: Exploring the Halo 1 System Link Protocol

#29

Post by monocasa »

nhellman wrote: post #27
monocasa wrote: post #19

So that's basically most of the lowest layers of the Xbox Live protocol as well. Simply game discovery happens over local broadcast instead of through the Live servers. There's some other specifics that change, such as logging into a host xbox doesn't diffie-hellman anymore but instead key sets are distributed by the server backends with the session information. Additionally the auth side is basically non existent on…

> So that's basically most of the lowest layers of the Xbox Live protocol as well. Simply game discovery happens over local broadcast instead of through the Live servers. There's some other specifics that change, such as logging into a host xbox doesn't diffie-hellman anymore but instead key sets are distributed by the server backends with the session information. Additionally the auth side is basically non existent…

> Ah, cool, there has been some similar work done before! Is there any documented resources or write-ups of the Xbox Live protocol somewhere?

I talked at defcon a bit last year. https://www.youtube.com/watch?v=HLyZfZMu-5E Otherwise I've been a "source is documentation" kind of guy so far. Could definitely use a high level walkthrough as good as you've done here; I should probably get on that.

> That is a really cool project! How does one make sure the console connects to the server instead of the (now shutdown) Xbox Live servers? Does it e.g. have a hardcoded domain so one can simply add a DNS entry?

Yeah, they bootstrap off of a set of hardcoded domains. The config screens on the boxes let you specify a DNS server, so the project runs it's own DNS server that's basically when obi-wan says "of course I know him, he's me". Then the relative lack of any public/private crypto lets us take over as long as we know the preshared key in the individual xbox's eeprom.

Re: Exploring the Halo 1 System Link Protocol

#30

Post by dinartem »

Nice work! Always fun to see something I wrote long ago reverse engineered. The packet format was indeed inspired by ESP over UDP, and I named it XSP. After system link shipped with the original launch of the console, I also worked on Xbox Live networking, including the client/server interactions and the design and implementation of the front-end Security Gateways that all Xboxes would talk to, first to authenticate themselves to the service, and then to maintain a heartbeat connection to the service (to keep NAT ports open during idle time), and to facilitate NAT traversal.
Post reply on HN