Whipping Up A Quick Adapter To Hack The Xbox 360

[Androxilogin] had a problem. An Xbox 360 Slim had shown up in the post, but failed to give much more than a beep when turned on. Disassembly revealed some missing components, but replacing them failed to breathe life into the beleaguered console. Deeper repair was needed, and that would require a special adapter which [Androxilogin] was able to whip up from scratch.

When it comes to the Corona models of the Xbox 360, it’s often necessary to use something called a “post-fix adapter” to do certain diagnostic and repair tasks. These adapters consist of a bracket which wraps around the CPU, and probes the solder ball for the POST_OUT signal which is otherwise difficult to access on the motherboard itself. Adapters are readily available online, and are usually manufactured as a PCB with a protruding contact to make a connection.

For [Androxilogin], though, time was short. Rather than wait for adapters to ship, it was quicker to whip up a custom piece to do the same job. This was achieved with a 3D print which was able to clamp around the CPU, while snugly holding a piece of tinned 30 AWG wire to poke the critical point beneath the chip. After a couple of attempts to get the sizing just right, [Androxilogin] was able to make the necessary connection which enabled installing Xell Loader on to the machine to bring it back to life.

If you’re eager to make your own post-fix adapter, files are available on Printables, with more details over on Reddit to boot. While the Xbox 360 is starting to suffer some awkward symptoms of age. we nevertheless still see a steady stream of hacks come in for this vintage machine. If you’re tackling your own retro console mods, be sure to notify the tipsline.

Internet-Connected Consoles Are Retro Now, And That Means Problems

A long time ago, there was a big difference between PC and console gaming. The former often came with headaches. You’d fight with drivers, struggle with crashes, and grow ever more frustrated dealing with CD piracy checks and endless patches and updates. Meanwhile, consoles offered the exact opposite experience—just slam in a cartridge, and go!

That beautiful feature fell away when consoles joined the Internet. Suddenly there were servers to sign in to and updates to download and a whole bunch of hoops to jump through before you even got to play a game. Now, those early generations of Internet-connected consoles are becoming retro, and that’s introduced a whole new set of problems now the infrastructure is dying or dead. Boot up and play? You must be joking!

Continue reading “Internet-Connected Consoles Are Retro Now, And That Means Problems”

Iconic Xbox Prototype Brought To Life

When Microsoft decided they wanted to get into the game console market, they were faced with a problem. Everyone knew them as a company that developed computer software, and there was a concern that consumers wouldn’t understand that their new Xbox console was a separate product from their software division. To make sure they got the message though, Microsoft decided to show off a prototype that nobody could mistake for a desktop computer.

The giant gleaming X that shared the stage with Bill Gates and Seamus Blackley at the 2000 Game Developers Conference became the stuff of legend. We now know the machine wasn’t actually a working Xbox, but at the time, it generated enormous buzz. But could it have been a functional console? That’s what [Tito] of Macho Nacho Productions wanted to find out — and the results are nothing short of spectacular.

Continue reading “Iconic Xbox Prototype Brought To Life”

Building A (Not Very) Portable Xbox

Modern handheld game consoles are impressive feats of engineering, featuring full fledged computers in near pocket-sized packages. So what happens if you take an original Xbox and sprinkle on some modern electronics and create a handheld? Well, if you’re [James] of James Channel, you end up with this sandwich of PCBs held together with hot glue and duck tape. 

The first order of miniaturization in this Xbox was replacing the hard drive. Because a CompactFlash card uses parallel ATA, that could be a simple drop in replacement. However, the Xbox locks the hard drive to the system requiring a mod chip for the CF card to work. Fortunately, the sacrificial Xbox came with a mod chip installed. After using an arcade machine to flash the card and copy over the contents of the drive, the CF card install was a breeze. 

For the screen and batteries, a portable DVD player that had remained unused since 2006 was repurposed. The battery cells were rather unhappy, but managed to get resurrected with some careful charging. As it turns out, the iPod 30 pin connector inside the portable screen contains an S-Video line. By tapping into that and adding in some power management for the batteries, the Xbox became a pile of PCBs that could maybe be taken places.

Continue reading “Building A (Not Very) Portable Xbox”

If You Give A Dev A Tricked Out Xbox, They’ll Patch Halo 2

[Ryan Miceli] had spent a few years poring over and reverse-engineering Halo 2 when a friend asked for a favor. His friend created an improved Xbox with significant overclocks, RAM upgrades, BIOS hacks, and a processor swap. The goal was simple: patch the hardcoded maximum resolution from 480p to 720p and maybe even 1080p. With double the CPU clock speed but only a 15% overclock on the GPU, [Ryan] got to work.

Step one was to increase the size of the DirectX framebuffers. Increasing the output resolution introduced severe graphical glitches and rendering bugs. The game reuses the framebuffers multiple times as memory views, and each view encodes a header at the top with helpful information like width, height, and tiling. After patching that, [Ryan] had something more legible, but some models weren’t loading (particularly the water in the title screen). The answer was the texture accumulation layer. The Xbox has a hardware limitation of only sampling four textures per shader pass, which means you need a buffer the size of the render resolution to accumulate the textures if you want to sample more than four textures. Trying to boot the game resulted in an out-of-memory crash. The Xbox [Ryan] was working on had been upgraded with an additional 64MB of RAM, but the memory allocator in Halo 2 wasn’t taking advantage of it. Yet.

To see where the memory was going, [Ryan] wrote a new tool called XboxImageGrabber to show where memory was allocated and by whom. Most games make a few substantial initial allocations from the native allocator, then toss it over to a custom allocator tuned for their game. However, the extra 64MB of RAM was in dev consoles and meant as debug RAM, which meant the GPU couldn’t properly access it. Additionally, between the lower 64MB and upper is the Xbox kernel. Now, it became an exercise of patching the allocator to work with two blobs of memory instead of one contiguous one. It also moved runtime data into the upper 64MB while keeping video allocations in the lower. Ultimately, [Ryan] found it easier to patch the kernel to allow memory allocations the GPU could use in the upper 64MB of memory. Running the game at 720p resulted in only a semi-playable framerate, dropping to 10fps in a few scenes.

After some initial tests, [Ryan] concluded that it wasn’t the GPU or the CPU that was the bottleneck but the swap chain. Halo 2 turns VSync on by default, meaning it has to wait until a blank period before swapping between its two framebuffers. A simple tweak is to add a third frame buffer. The average FPS jumped 10%, and the GPU became the next bottleneck to tweak. With a light GPU overclock, the game was getting very close to 30fps. Luckily for [Ryan], no BIOS tweak was needed as the GPU clock hardware can be mapped and tweaked as an MMIO. After reverse engineering, a debugging feature to visual cache evictions, [Ryan] tuned the texture and geometry cache to minimize pop-ins that the original game was infamous for.

Overall, it’s an incredible hack with months of hard work behind it. The code for the patch is on Github, and there’s a video after the break comparing the patched and unpatched games. If you still need more Halo in your life, why not make yourself a realistic battle rifle from the game?

Continue reading “If You Give A Dev A Tricked Out Xbox, They’ll Patch Halo 2

Kickflips And Buffer Slips: An Exploit In Tony Hawk’s Pro Skater

[Ryan Miceli] wanted to build some reverse engineering skills by finding a new exploit for an original Xbox. Where he ended up was an exploit that worked across the network, across several games, and several different consoles. But it all started with an unbounded strcpy in Tony Hawk Pro Skater (THPS).

Xbox, PlayStation 2, and Gamecube (often referred to as the sixth generation) are wonderful hacking targets as they don’t possess many of the security enhancements of the seventh generation, like hypervisors, privilege levels, and hardware executability protections. The console launches the game, and control is fully within the game, so once you get your code executing, you’re done. The exploit started with a feature in many Tony Hawk games, the custom map editor. In the editor, you can create gaps between jumps with a name so that when a player completes the gap, it can flash “you jumped x” in big letters. However, on Xbox, the gap name is copied with an unbounded strcpy to the stack, meaning you can overwrite the return pointer. Additionally, there are no stack cookies for THPS, which meant nothing stopped [Ryan] from smashing his way through. He includes a small memcpy stub in the header of the level, which the gap name jumps to, which then copies and executes his full payload.

The other games in the series, like Tony Hawk’s Pro Skater 3 (THPS3), had the bug, but the gap name was copied to the heap, not the stack. However, he could overflow into a vtable of the next object that would call his code when the object was freed. However, the level save data wasn’t an executable region of memory, which meant he needed ROP (return-oriented programming). Just a few gadgets later, and [Ryan] had another exploit working.

Tony Hawk’s Underground 1 and 2 had stack cookies turned on. This meant a random value was placed on the stack before a function, then popped off and checked. This meant the program could check if its stack had been smashed. Unfortunately for [Ryan], this proved to be a major roadblock. However, the PC and PS2 versions of these games do not have stack cookies, which means they can be exploited in the same manner.

The beauty of the exploit is that the game allows you to invite a friend to play a custom level. This means once the level is transferred over the network, their console is hacked as well. However, the full payload wasn’t sent to the client console, which meant the exploit had to send the payload to the other console using the game’s existing net code. The exploit sets up an asynchronous file transfer then hands control back to the game. Of course, there was a memory leak in the netcode, because the game had never sent large amounts of data over the network before. So, part of the exploit was a hot patch for a memory leak.

As a last hurrah, [Ryan] ported the hack to Gamecube, PS2, and PC. The code is on GitHub, and the video is after the break. We love the attention the Xbox has been getting, and if you’re curious about a hardware hack, this 256MB ROM mod goes deep into the internals.

Continue reading “Kickflips And Buffer Slips: An Exploit In Tony Hawk’s Pro Skater”

Giving The Original Xbox 256 MB Of Memory

The original Xbox forever changed the console world, because it was basically just PC components laced together in a slightly different architecture. It featured a Pentium 733 MHz CPU with just 64MB of RAM. [Prehistoricman] has been hard at work, figuring out how to up that to 256MB instead.

This isn’t [Prehistoricman’s] first rodeo. Previously, he managed to up the Xbox’s RAM to 128 MB. To figure out how to go further, he had to figure out the addressing scheme. A datasheet for the Xbox’s original memory chip was a help in this regard, as was the envytools project and an Xbox source code leak.

A BIOS hack was needed to move the auto-precharge pin to free up more address pins for the higher memory space. Furthermore, the only available memory chips that were suitable used BGA packages, so a small PCB with castellated edges was needed to adapt the chip to the Xbox’s motherboard, which expects a TQFP package.

Ultimately, getting this hack to work involved a lot of bare-metal hacking. It also won’t help the performance of commercial games at all, as they were all designed within the limitations of the original console. Still, it’s impressive to see this now-ancient platform hacked to do more. It’s also hilarious to compare it with a contemporary PC, which could simply accept 256 MB of RAM by using additional memory slots. Video after the break.

Continue reading “Giving The Original Xbox 256 MB Of Memory”