Exploring the Halo 1 System Link Protocol • Hacker News Board

Re: Exploring the Halo 1 System Link Protocol

#31

Post by monocasa » Wed, Sep 20, 2023, 8:41 PM UTC

dinartem wrote: post #30

Nice work! Always fun to see something I wrote long ago reverse engineered. The packet format was indeed inspired by ESP over UDP, and I named it XSP. After system link shipped with the original launch of the console, I also worked on Xbox Live networking, including the client/server interactions and the design and implementation of the front-end Security Gateways that all Xboxes would talk to, first to authenticate…

Nice! You did a great job on the protocol. Probably my only complaint on the XSP side of things is the fact that you have to do relatively complex parsing of the XSP packets before you can get to the point of verifying the signature of the packet. Seems like all of the corner cases were handled well in the implementation on the boxes, but as someone who does auth/cryptography in my day job, it kind of gives me the heebie-jeebies.

Do you know if the auth side was carried into deeper parts of the backend? So like, did the SG decorate incoming connections with the auth information as they made their way to the different services? There seemed to be more auth information than I expected in headers on some of those HTTP calls into services like matchmaking.

Re: Exploring the Halo 1 System Link Protocol

#32

Post by dinartem » Wed, Sep 20, 2023, 8:59 PM UTC

monocasa wrote: post #31

dinartem wrote: post #30

Nice work! Always fun to see something I wrote long ago reverse engineered. The packet format was indeed inspired by ESP over UDP, and I named it XSP. After system link shipped with the original launch of the console, I also worked on Xbox Live networking, including the client/server interactions and the design and implementation of the front-end Security Gateways that all Xboxes would talk to, first to authenticate…

Nice! You did a great job on the protocol. Probably my only complaint on the XSP side of things is the fact that you have to do relatively complex parsing of the XSP packets before you can get to the point of verifying the signature of the packet. Seems like all of the corner cases were handled well in the implementation on the boxes, but as someone who does auth/cryptography in my day job, it kind of gives me the he…

That's a valid point about complex parsing. I remember being very concerned about adding unnecessary overhead to each packet during encapsulation.

As for the SG, it primarily authenticated the Xbox machine account using Kerberos and then maintained a security association, accepted heartbeats, authenticated and decrypted incoming ESP-UDP packets into IP packets that it forwarded to the backend servers. Responses from the backend would be encrypted, authenticated, and encapsulated before sending back to the Xbox. I don't think the SG had any knowledge of higher level connections running through it, such as TCP or HTTP, so it would not have manipulated HTTP headers as they passed through.

Re: Exploring the Halo 1 System Link Protocol

#33

Post by nmstoker » Wed, Sep 20, 2023, 9:07 PM UTC

I recall the game recording feature feeling pretty cutting edge at the time, as you could pause it and rotate/fly round the scene, it felt really fluid and responsive. I guess now it would be common place but back then it definitely seemed a little magical.

Re: Exploring the Halo 1 System Link Protocol

#34

Post by willis936 » Wed, Sep 20, 2023, 9:22 PM UTC

monocasa wrote: post #25

nhellman wrote: post #7

Earlier quoted context omitted.

Thanks, I was initially surprised that they were encrypted but I can speculate on a few potential reasons: - The Xbox was designed to be able to play online via Xbox Live (e.g. with Halo 2 that came out later in 2004), and they might have simply reused the network stack for System Link over LAN. I looked a little bit at Halo 2 system link, it uses the same system calls from the kernel but the protocol seems to be mor…

From what I've heard from microsofties over beers, it was really the second one. They didn't expect developers to write network code in ~2001 that didn't have memory safety vulnerabilities and wanted a barrier there between simple overflows and system security.

The child in me from 20 years ago dreams of a software tool downloaded from a questionable website that jailbroke an xbox just by putting in the IP address.

Re: Exploring the Halo 1 System Link Protocol

#35

Post by kmeisthax » Wed, Sep 20, 2023, 9:28 PM UTC

Tangential point: the weirdest part about the Xbox was the system name. As far as I'm aware that was never configurable by users, but certain games would set your system name as an easter egg. Any reason why it was built that way?

Re: Exploring the Halo 1 System Link Protocol

#36

Post by nhellman » Wed, Sep 20, 2023, 9:30 PM UTC

nmstoker wrote: post #33

I recall the game recording feature feeling pretty cutting edge at the time, as you could pause it and rotate/fly round the scene, it felt really fluid and responsive. I guess now it would be common place but back then it definitely seemed a little magical.

Are you thinking of Theater mode that first appeared in Halo 3? Unfortunately it was slimmed down in later Halo games and it is rarely seen in other games at all, especially not console games.

Re: Exploring the Halo 1 System Link Protocol

#37

Post by nhellman » Wed, Sep 20, 2023, 9:34 PM UTC

dinartem wrote: post #30

Nice work! Always fun to see something I wrote long ago reverse engineered. The packet format was indeed inspired by ESP over UDP, and I named it XSP. After system link shipped with the original launch of the console, I also worked on Xbox Live networking, including the client/server interactions and the design and implementation of the front-end Security Gateways that all Xboxes would talk to, first to authenticate…

Heh, what a coincidence!

Does XSP stand for anything?

Re: Exploring the Halo 1 System Link Protocol

#38

Post by sosodev » Wed, Sep 20, 2023, 9:36 PM UTC

dinartem wrote: post #30

Nice work! Always fun to see something I wrote long ago reverse engineered. The packet format was indeed inspired by ESP over UDP, and I named it XSP. After system link shipped with the original launch of the console, I also worked on Xbox Live networking, including the client/server interactions and the design and implementation of the front-end Security Gateways that all Xboxes would talk to, first to authenticate…

Very cool. Have you written a blog or anything about these experiences? I would love to read it.

Re: Exploring the Halo 1 System Link Protocol

#39

Post by dinartem » Wed, Sep 20, 2023, 9:39 PM UTC

nhellman wrote: post #37

dinartem wrote: post #30

Nice work! Always fun to see something I wrote long ago reverse engineered. The packet format was indeed inspired by ESP over UDP, and I named it XSP. After system link shipped with the original launch of the console, I also worked on Xbox Live networking, including the client/server interactions and the design and implementation of the front-end Security Gateways that all Xboxes would talk to, first to authenticate…

Heh, what a coincidence! Does XSP stand for anything?

Xbox Security Protocol. We liked to add X to things back then.

Re: Exploring the Halo 1 System Link Protocol

#40

Post by monocasa » Wed, Sep 20, 2023, 10:40 PM UTC

willis936 wrote: post #34

monocasa wrote: post #25

Earlier quoted context omitted.

From what I've heard from microsofties over beers, it was really the second one. They didn't expect developers to write network code in ~2001 that didn't have memory safety vulnerabilities and wanted a barrier there between simple overflows and system security.

The child in me from 20 years ago dreams of a software tool downloaded from a questionable website that jailbroke an xbox just by putting in the IP address.

I hear that; I wish I was cool enough back in the day to release a tool on xbins. I'll have to settle for retro computing.