invoxiplaygames.uk
my research and reverse engineering notes/utilities relating to the Xbox 360 (Mirrored from https://github.com/InvoxiPlayGames/x360-research)
system link encryption
+9
-5
official-software/README.md
+9
-5
official-software/README.md
···
10
* BDES Header - The "BDES" header found at the start of system update XZP
11
files.
12
13
-
* System Software
14
-
* Security Overview - A rough high-level overview of the security features
15
-
and system of the Xbox 360.
16
-
* Software Updates - A rough overview of the software update process.
17
-
18
* Hypervisor
19
* Key Derivation - Notes on how the hypervisor derives decryption keys for
20
various parts of the system.
···
22
* Kernel
23
* Memory Map - information about the way memory is mapped out in the official
24
Xbox 360 kernel.
···
10
* BDES Header - The "BDES" header found at the start of system update XZP
11
files.
12
13
* Hypervisor
14
* Key Derivation - Notes on how the hypervisor derives decryption keys for
15
various parts of the system.
···
17
* Kernel
18
* Memory Map - information about the way memory is mapped out in the official
19
Xbox 360 kernel.
20
+
21
+
* Networking - **no information here is about Xbox Live.**
22
+
* System Link - The system link / LAN multiplayer connection and encryption
23
+
process.
24
+
25
+
* System Software
26
+
* Security Overview - A rough high-level overview of the security features
27
+
and system of the Xbox 360.
28
+
* Software Updates - A rough overview of the software update process.
+6
-6
official-software/bootloaders/cd.md
+6
-6
official-software/bootloaders/cd.md
···
1
**Emma's Xbox 360 Research Notes - Bootloaders**
2
3
-
Updated 2nd February 2024.
4
5
Stub page, for the most part. Needs some work.
6
···
17
## Launching the Hypervisor
18
19
Since CD bootloader runs in a 32-bit translated address space, it can't just
20
-
jump to the hypervisor's entrypoint/reset vector. When loading into
21
-
22
-
It does the following:
23
24
-
* Clears out any bootloader stages from instruction and data cache
25
* Clears some special purpose registers
26
* Invalidates the translation lookaside buffer
27
* Disables instruction and data address translation in the MSR
···
34
```
35
launch_hypervisor:
36
37
-
; flush CE/CF/CG from data and instruction cache (i think? check)
38
cache_flush:
39
lis r3, 0x28 ; r3 = 0x280000
40
li r4, 0x2a00
···
1
**Emma's Xbox 360 Research Notes - Bootloaders**
2
3
+
Updated 23rd October 2024.
4
5
Stub page, for the most part. Needs some work.
6
···
17
## Launching the Hypervisor
18
19
Since CD bootloader runs in a 32-bit translated address space, it can't just
20
+
jump to the hypervisor's entrypoint/reset vector. When loading into the
21
+
hypervisor, it does the following:
22
23
+
* Flushes any bootloader stages from cache and into RAM(?)
24
* Clears some special purpose registers
25
* Invalidates the translation lookaside buffer
26
* Disables instruction and data address translation in the MSR
···
33
```
34
launch_hypervisor:
35
36
+
; store CE/CF/CG into data cache and invalidate instruction cache
37
+
; (i think? check)
38
cache_flush:
39
lis r3, 0x28 ; r3 = 0x280000
40
li r4, 0x2a00
+83
official-software/networking/system_link.md
+83
official-software/networking/system_link.md
···
···
1
+
**Emma's Xbox 360 Research Notes - Networking**
2
+
3
+
Updated 23rd October 2024.
4
+
5
+
Stub page.
6
+
7
+
# System Link
8
+
9
+
To protect network traffic on LAN multiplayer games from being tampered with,
10
+
the Xbox 360 employs network encryption as well as non-standard networking on
11
+
local LAN multiplayer.
12
+
13
+
This article also applies to Games for Windows - LIVE, in sections discussing
14
+
cross-platform system link.
15
+
16
+
## Encryption Key Initialisation
17
+
18
+
When a title initialises WinSock and XNet, `CXnIp::IpInit` initialises several
19
+
encryption keys, likely for three different cryptography types, AES, 3DES and
20
+
DES. *(TODO: Check)* Pseudocode for the derivation process is as follows:
21
+
22
+
(Note that this is pseudocode of just key initialisation - it is not C that can
23
+
be compiled nor is it any specific CXnIp function)
24
+
25
+
```c
26
+
void initialise_ip_encryption(CXnIp *this) {
27
+
struct {
28
+
char id;
29
+
uint8_t key[0x10];
30
+
} config_buffer; // sizeof(config_buffer) = 0x11
31
+
32
+
struct {
33
+
uint8_t key1[0x14];
34
+
uint8_t key2[0x14];
35
+
uint8_t key3[0x14];
36
+
} key_buffer; // sizeof(key_buffer) = 0x3c
37
+
38
+
// fetch the LAN key from the executable (360) or config file (GfWL)
39
+
uint8_t *lan_key = get_lan_key();
40
+
if (lan_key == NULL) // no key set = use random key, useless lmao
41
+
XeCryptRandom(config_buffer.key, sizeof(config_buffer.key));
42
+
else
43
+
memcpy(config_buffer.key, lan_key, sizeof(config_buffer.key));
44
+
45
+
// only 360 takes this path, GfWL always goes down the cross-platform path
46
+
#ifdef XBOX360
47
+
if (use_cross_platform() == false) {
48
+
XeCryptRandom(&key_buffer, sizeof(key_buffer));
49
+
50
+
config_buffer.id = 0;
51
+
XeCryptHmacSha(ROAMABLE_KEY, &config_buffer, sizeof(config_buffer), NULL, 0, NULL, 0, key_buffer.key1, 0x14);
52
+
config_buffer.id = 1;
53
+
XeCryptHmacSha(ROAMABLE_KEY, &config_buffer, sizeof(config_buffer), NULL, 0, NULL, 0, key_buffer.key2, 0x14);
54
+
config_buffer.id = 2;
55
+
XeCryptHmacSha(ROAMABLE_KEY, &config_buffer, sizeof(config_buffer), NULL, 0, NULL, 0, key_buffer.key3, 0x14);
56
+
} else
57
+
#endif
58
+
{
59
+
// encrypt the title key with the cross-platform system link key,
60
+
// protected by the hypervisor / some mad x86 fuckery
61
+
int r = XeKeysAesCbc(XPLAT_SYSLINK_KEY, config_buffer.key, 0x10, config_buffer.key, &key_buffer /*this is IV, what?*/, ENCRYPT);
62
+
if (!r) // encryption failed, use random key, useless
63
+
XeCryptRandom(config_buffer.key, sizeof(config_buffer.key))
64
+
65
+
config_buffer.id = 0;
66
+
XeCryptSha(&config_buffer, 0x11, NULL, 0, NULL, 0, key_buffer.key1, 0x14);
67
+
config_buffer.id = 1;
68
+
XeCryptSha(&config_buffer, 0x11, NULL, 0, NULL, 0, key_buffer.key2, 0x14);
69
+
config_buffer.id = 2;
70
+
XeCryptSha(&config_buffer, 0x11, NULL, 0, NULL, 0, key_buffer.key3, 0x14);
71
+
}
72
+
73
+
// use first 0x10 bytes of key1 for some 0x10 byte key, likely AES
74
+
memcpy(this->lan_aes_key, key_buffer.key1, sizeof(this->lan_aes_key)); // 0x10
75
+
76
+
// use the next 0x4 bytes of key1 and all of key2 for some 0x18 byte key, likely 3DES
77
+
memcpy(this->lan_3des_key, key_buffer + 0x10, sizeof(this->lan_3des_key)); // 0x18
78
+
XeCryptDesParity(this->lan_3des_key, sizeof(this->lan_3des_key), this->lan_3des_key);
79
+
80
+
// use the first 0x8 bytes of key3 for some 0x8 byte key, likely DES
81
+
memcpy(this->lan_des_key, key_buffer.key3, sizeof(this->lan_des_key));
82
+
}
83
+
```