破解 Xbox 360 管理程序第 1 部分：系统概述

Overview: This is part 1 of a series on hacking the Xbox 360 hypervisor. It gives an overview of the Xbox 360 system architecture, hypervisor, and security features.
Xbox 360 System Architecture:
- At the heart is the hypervisor, which prevents hacking. It's one of the most secure pieces of code with only one known exploit.
- Similar to the Original Xbox in design but with enhanced security features like custom CPU, updatable system software, and encrypted code.
Xenon CPU:
- A custom PowerPC chip with 3.2Ghz base clock, 3 physical cores with 2 hardware threads each (total 6 threads), and specific cache sizes.
- Has security features like 32KB ROM for bootloader, 64KB SRAM for boot ops, 768 eFuses for crypto keys, and on-die cryptography.
- Custom caching behavior around caching, including allowing GPU and southbridge access and having bugs in custom instructions.
- Supports 3 privilege levels: hypervisor, kernel, and user mode with different access rights.
- In hypervisor mode, uses 64-bit "real" addresses directly; in kernel and user modes, uses 32-bit virtual addresses with address translation.
Protected and Encrypted Memory:
- Xenon CPU supports 64-bit addressing but only has 512MB RAM. Custom modifications use bits for different memory access pathways with encryption and CRC checksums.
- Encrypted memory uses AES ECB with per-boot per-pathway encryption keys and whitening values. Caching behavior involves fetching and decrypting cache lines.
- Protected memory adds CRC checksums to cache lines and verifies them. Checksums are stored in CPU SRAM in groups (slots).
- Patents provide detailed information about the memory protection design.
The Hypervisor:
- The 256KB hypervisor image is in protected memory with segments and pages for various data.
- Manages security operations like code authentication and executable memory allocation.
- Uses the Hypervisor Real Mode Offset Register to ensure memory accesses have CRC integrity checks.
- Manages executable memory with page tables and whitening values.
- Exposes system calls to kernel mode with extensive validation.
- Doesn't trust external devices and handles communications through the kernel.
- The 4548 system call handler bug allows kernel mode code to bypass memory protection and execute shell code.
Conclusion: The Xbox 360 hypervisor is very secure with limited attack surface, no direct device communication by the hypervisor, and protected memory. Stay tuned for part 2 on finding and exploiting a new vulnerability.