Here's a Quick explanation of the RGH and how it works.
For reference, 1BL = First Boot Loader, 2BL = CB [CB_B] {Slims & Refurbished Units have a CB_A as well}, 4BL = CD
The Xbox 360's boot system works like this:
1BL (First Boot Loader) is loaded by the CPU (also burned into the ROM of the CPU so it can't be changed)
1BL then Loads 2BL from the NAND, does a Hash compare, and then boots it.
2BL then Loads 4BL from the NAND and checks for the MS signature and correct encryption based on the private and local keys.
4BL then moves on to the rest of the boot sequence, somewhat modified between each revision,but the end result is your Dashboard.
What's Glitched here is the check when 2BL loads 4BL. [On Slims & Refurbs, it's the check when CB_A loads CB_B]
The glitch makes the CPU return correct values to the checks on 4BL, even though it's modified. [Again, Slims & Refurbs, Check is on CB_B by CB_A]
As such, regardless of the hash or signature of 4BL [or CB_B], it'll load as usual and do what ever we want it to do.
As the Xbox 360 will normally only attempt to boot 5 times [around 5 seconds from power on to fifth check], there isn't enough time to correctly glitch the Xbox 360 on some motherboard revisions. To make up for this, the CD [and CB_B] is patched to reload the Xbox 360 infinitely until a successful boot has occurred.
As to why it's un-patchable, if you haven't already noticed:
1BL is burned to the CPU's ROM. As ROM, or Read Only Memory, can't be re-programmed after it's initial programming at the factory, Microsoft can't change it in any currently released Hardware.
2BL is on the NAND, and Microsoft can modify it, but because there's no fuse check on the current version and 1BL will always recognize the old version as valid we can downgrade it as necessary.
4BL can also be modified. As we broke all the checks in 2BL though, we can run any 4BL we want, with or without correct signatures. Even if Microsoft decides to makes a new one, they can't stop us from downgrading it as well, as 2BL is the only law in the system after 1BL and when 2BL tells an application to boot, there's nothing to stop it from doing so.
As such, only with a new 1BL that renders the CPU hardware hack impossible can Microsoft prevent current versions of the Xbox 360 hardware from being exploitable. As 1BL can't be modified on any released hardware, It is not possible for it to be patched on said released hardware.
All currently released hardware revisions, excluding the Xenon (due to a difference in the CPU's clock controller), will ALWAYS be hackable.
31Likes
LinkBack URL
About LinkBacks
Rispondi Citando
Originariamente Scritto da Chuck Bartowski
Segnalibri