Free60

Last updated

[1] Free60 is the successor to the Xbox Linux Project that aims to put Linux, BSD, or Darwin on the Microsoft Xbox 360 using a software or hardware based "hack". The Xbox 360 uses hardware encryption and will not run unsigned code out of the box.

Contents

The project's goals were met in March 2007, when shortly after the announcement of a critical software vulnerability [2] in the Xbox 360 Hypervisor a loader for Linux appeared, which allowed to run a Linux ported to the Xbox 360.

To date, there are two Linux kernel patchsets available, one for 2.6.21 and one for 2.6.24.3. Three main Linux distributions may be run on the Xbox 360; Gentoo, Debian and Ubuntu Linux, the last two of which are easily installable to the Xbox 360 hard drive by scripts provided by members of the Free60 project. [3] [4] [5]

Execution Method

Since executable code on the Xbox 360 is digitally signed, and runs underneath a hypervisor, an exploit or hack is necessary in order to execute homebrew code. On the Xbox 360, the first exploit which enabled booting of unsigned code relied on a modified DVD-ROM drive firmware, a modified burned disc of the game King Kong (for Xbox 360), and the target console having either one of two vulnerable kernel revisions. Alternatively, a home-made cable may be used to dump and patch the bios with jumpers attached to the appropriate pin header on the motherboard of the console to patch the hypervisor and allows unsigned execution directly at boot, known as the "JTAG/SMC exploit", which was patched after June 2009 but replaced by "Reset Glitch Hack", in 2011, which is applicable on any kernel version on all but the latest revision of the Xbox 360 motherboard (most 360's produced from 2014 until end of production in 2015), one caveat is being a glitch and relies on timing, boot times may be unstable. [6]

With the original King Kong exploit, the console must launch the modified game which will utilize the software vulnerability to load a small chunk of code that is included on the disc. This code may either initialize the serial port to allow upload of further code to the console, or eject the drive tray and prepare the console to load further code from a specified point on optical media that is then placed in the drive. The latter method involves the readcd binary, made specifically for this cause. The code that readcd executes in this instance is known as XeLL, short for Xenon Linux Loader. XeLL captures CPU threads and launches the Linux kernel from either network (tftp) or optical media as its only purpose, providing a flat device tree for the kernel. In the cases of released 'Live CDs', the readcd binary would typically be included on the modified game disc, which would eject the drive, and a CD containing the XeLL binary as well as the complete Linux kernel and filesystem would be inserted.

Limitations

Development

One of the main contributors to the Free60 project has developed a method of 3D graphics acceleration on the Xbox 360's GPU (codenamed Xenos) under Linux. [8] [9] [10] This work has been encapsulated into an API for easier use. In order to achieve this acceleration, some data from the Xbox 360's flash needs to be uploaded to the Xenos GPU. This process may be automated to help ensure legality of any 3D graphics acceleration.

Since only a small proportion of Xbox 360's are currently able to execute unsigned code, there has been little development within the Free60 project in recent times. This may to some extent be contrasted to the Free60 predecessor, the Xbox Linux project, which saw far more development as a result of the relative ease of running unsigned code on the Xbox and the ease of porting x86 code to the Xbox's custom Intel Pentium III-based CPU.

To continue development, members of the Free60 project are looking for help. [11] Perhaps the most important of the help requests is to provide audio drivers; the Free60 members have asked for someone with knowledge of the ALSA kernel component and a SiS966 based motherboard to achieve this.

One project created as a result of the success of Free60 is a Kernel Rebooter. [12] The goal of this is, after initially loading a vulnerable kernel and exploiting it to gain control of the system, to be able to make the console reload into a modified, unsigned hypervisor and kernel. Being able to reboot into a more recent kernel revision would allow for games to be executed on the console that are dependent on these kernel revisions. This project has seen a certain level of success; there are binary files available (to be launched by the serial loader or readcd) to partially reload the hypervisor.

Summer 2009 Xbox Live Update

On August 11, 2009 Microsoft released an Xbox 360 software update that overwrites the Second stage bootloader of the system. Any failure while updating this will break the Xbox 360 beyond repair. Statistics from other systems have shown that about one in a thousand bootloader updates went wrong and unless Microsoft has a novel solution to this problem, this puts tens of thousands of Xboxes at risk.

It seems that this update was issued to fix a vulnerability already known to the Free60 Project. This vulnerability has been successfully exploited to run arbitrary code, and a complete end user compatible hack has been in development for some time and is planned to be released on free60.org shortly. It will allow users to take back control of their Xboxes and run arbitrary code like homebrew applications or Linux right after turning on the console and without the need of a modchip, finally opening up the Xbox 360 to a level of hacking as the original Xbox.

Because of the danger of the update and the homebrew lockout, the Free60 Project advises all Xbox 360 users to not update their systems to the latest software version. The Free60 website will provide the latest information on this ongoing topic, including the final hack software.

Related Research Articles

<span class="mw-page-title-main">Linux distribution</span> Operating system based on the Linux kernel

A Linux distribution is an operating system made from a software collection that includes the Linux kernel, and often a package management system. Linux users usually obtain their operating system by downloading one of the Linux distributions, which are available for a wide variety of systems ranging from embedded devices and personal computers to powerful supercomputers.

<span class="mw-page-title-main">GNU GRUB</span> Boot loader package

GNU GRUB is a boot loader package from the GNU Project. GRUB is the reference implementation of the Free Software Foundation's Multiboot Specification, which provides a user the choice to boot one of multiple operating systems installed on a computer or select a specific kernel configuration available on a particular operating system's partitions.

<span class="mw-page-title-main">Privilege escalation</span> Gaining control of computer privileges beyond what is normally granted

Privilege escalation is the act of exploiting a bug, a design flaw, or a configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user. The result is that an application with more privileges than intended by the application developer or system administrator can perform unauthorized actions.

<span class="mw-page-title-main">UEFI</span> Operating system and firmware specification

UEFI is a set of specifications written by the UEFI Forum. They define the architecture of the platform firmware used for booting and its interface for interaction with the operating system. Examples of firmware that implement these specifications are AMI Aptio, Phoenix SecureCore Tiano, TianoCore EDK II and InsydeH2O.

A softmod is a method of using software to modify the intended behavior of hardware, such as video cards, sound cards, or game consoles in a way that can overcome restrictions of the firmware, or install custom firmware.

Homebrew, when applied to video games, refers to games produced by hobbyists for proprietary video game consoles which are not intended to be user-programmable. The official documentation is often only available to licensed developers, and these systems may use storage formats that make distribution difficult, such as ROM cartridges or encrypted CD-ROMs. Many consoles have hardware restrictions to prevent unauthorized development. A non-professional developer for a system intended to be user-programmable, like the Commodore 64, is simply called a hobbyist.

<span class="mw-page-title-main">Xbox Linux</span>

Xbox Linux was a project that ported the Linux operating system to the Xbox video game console. Because the Xbox uses a digital signature system to prevent the public from running unsigned code, one must either use a modchip, or a softmod. Originally, modchips were the only option; however, it was later demonstrated that the TSOP chip on which the Xbox's BIOS is held may be reflashed. This way, one may flash on the "Cromwell" BIOS, which was developed legally by the Xbox Linux project. Catalyzed by a large cash prize for the first team to provide the possibility of booting Linux on an Xbox without the need of a hardware hack, numerous software-only hacks were also found. For example, a buffer overflow was found in the game 007: Agent Under Fire that allowed the booting of a Linux loader ("xbeboot") straight from a save game.

<span class="mw-page-title-main">PlayStation Portable homebrew</span> Executing unsigned code on PlayStation Portable

PlayStation Portable homebrew refers to the process of using exploits and hacks to execute unsigned code on the PlayStation Portable (PSP).

In the context of free and open-source software, proprietary software only available as a binary executable is referred to as a blob or binary blob. The term usually refers to a device driver module loaded into the kernel of an open-source operating system, and is sometimes also applied to code running outside the kernel, such as system firmware images, microcode updates, or userland programs. The term blob was first used in database management systems to describe a collection of binary data stored as a single entity.

HAL is a software subsystem for UNIX-like operating systems providing hardware abstraction.

OtherOS is a feature of early versions of the PlayStation 3 video game console, allowing user installed software, such as Linux or FreeBSD. The feature was removed since system firmware update 3.21, released on April 1, 2010.

authbind is an open-source system utility written by Ian Jackson and is distributed under the GNU General Public License. The authbind software allows a program that would normally require superuser privileges to access privileged network services to run as a non-privileged user. authbind allows the system administrator to permit specific users and groups access to bind to TCP and UDP ports below 1024. Ports 0 - 1023 are normally privileged and reserved for programs that are run as the root user. Allowing regular users limited access to privileged ports helps prevent possible privilege escalation and system compromise if the software happens to contain software bugs or is found to be vulnerable to unknown exploits.

The PlayStation Portable system software is the official firmware for the PlayStation Portable (PSP). It uses the XrossMediaBar (XMB) as its user interface, similar to the PlayStation 3 console. Updates add new functionality as well as security patches to prevent unsigned code from being executed on the system. Updates can be obtained in four ways:

<span class="mw-page-title-main">Ksplice</span>

Ksplice is an open-source extension of the Linux kernel that allows security patches to be applied to a running kernel without the need for reboots, avoiding downtimes and improving availability. Ksplice supports only the patches that do not make significant semantic changes to kernel's data structures.

<span class="mw-page-title-main">Linux-libre</span> Version of the Linux kernel without proprietary code

Linux-libre is a modified version of the Linux kernel that contains no binary blobs, obfuscated code, or code released under proprietary licenses. In the Linux kernel, they are mostly used for proprietary firmware images. While generally redistributable, binary blobs do not give the user the freedom to audit, modify, or, consequently, redistribute their modified versions. The GNU Project keeps Linux-libre in synchronization with the mainline Linux kernel.

<span class="mw-page-title-main">Hacking of consumer electronics</span>

The hacking of consumer electronics is an increasingly common practice which users perform in order to customize and modify their devices beyond what is typically possible. This activity has a long history, dating from the days of early computer, programming, and electronics hobbyists.

Xbox modding is the practice of circumventing the built-in hardware and software security mechanisms of the Xbox video game console.

Homebrew software was first run on the PlayStation 3 by a group of hackers under the name "Team Ice" by exploiting a vulnerability in the game Resistance: Fall of Man. Following various other hacks executed from Linux, Sony removed the ability to install another operating system in the 3.21 firmware update. This event caused backlash among the hacker communities, and eventually the group Fail0verflow found a flaw in the generation of encryption keys which they leveraged to restore the ability to install Linux. George Hotz (Geohot), often misattributed as the genesis of homebrew on the PS3, later created the first homebrew signed using the private "metldr" encryption key which he leaked onto the internet. Leaking the key led to Hotz being sued by Sony. The court case was settled out of court, with the result of George Hotz not being able to further reverse engineer the PS3.

Custom firmware, also known as aftermarket firmware, is an unofficial new or modified version of firmware created by third parties on devices such as video game consoles and various embedded device types to provide new features or to unlock hidden functionality. In the video game console community, the term is often written as custom firmware or simply CFW, referring to an altered version of the original system software inside a video game console such as the PlayStation Portable, PlayStation 3, PlayStation Vita/PlayStation TV, PlayStation 4, Nintendo 3DS and Nintendo Switch. Installing custom firmware typically requires bootloader unlocking.

References

  1. ↑ "Slashdot". m.slashdot.org. Retrieved 2023-01-22.
  2. ↑ Bugtraq: Xbox 360 Hypervisor Privilege Escalation Vulnerability http://seclists.org/bugtraq/2007/Feb/0514.html
  3. ↑ Debian-Etch Installation Guide "Debian-etch - Free60 Project". Archived from the original on July 4, 2008. Retrieved July 7, 2008.
  4. ↑ Ubuntu 7.04 Installation Script "Ubuntu7.04 - Free60 Project". Archived from the original on July 4, 2008. Retrieved July 7, 2008.
  5. ↑ Ubuntu 7.10 Installation Script "Ubuntu7.10 - Free60 Project". Archived from the original on July 4, 2008. Retrieved July 7, 2008.
  6. ↑ Speedy22's Headers and Connectors Tech Info "Archived copy" (PDF). Archived from the original (PDF) on 2006-10-22. Retrieved 2008-07-07.{{cite web}}: CS1 maint: archived copy as title (link)
  7. ↑ Gentoo Live CD Xenon Beta 2 Release Notes http://sourceforge.net/project/shownotes.php?group_id=139616&release_id=506402
  8. ↑ debugmo.de » fancy
  9. ↑ debugmo.de » Fear, triangles!
  10. ↑ debugmo.de » Xbox 360 GPU update
  11. ↑ Free60 Help "Help - Free60 Project". Archived from the original on July 4, 2008. Retrieved July 7, 2008.
  12. ↑ Kernel Rebooter http://www.xboxhacker.net/index.php?topic=8738.0
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.