Anyone who’s owned a game console from the last couple of generations will tell you that the machines are becoming increasingly like set-top computers — equipped with USB ports, Bluetooth, removable hard drives, and their own online software repositories. But while this overlap theoretically offers considerable benefits, such as the ability to use your own USB controller rather than being stuck with the system’s default, the manufacturers haven’t always been so accommodating.
Take for example the removable hard drive of the Xbox 360. It was a bog standard 2.5″ SATA drive inside a fancy enclosure, but as explained by [Eaton], Microsoft went to considerable lengths to prevent the user from upgrading it themselves. Which wouldn’t have been such a big deal, if the Redmond giant wasn’t putting a huge markup on the things; even in 2005, $99 USD for 20 GBs was highway robbery.
So how did the drive lockout work? Genuine Xbox drives had an RSA-signed “security sector” at sector 16, which contained information like the drive’s serial number, firmware revision, and model number. The RSA signature would prevent tampering with the fields stored in the security sector, and you couldn’t simply copy this sector over to a blank drive, because when the console compared the data with what the drive self-reported, it wouldn’t match.
Of course, industrious hackers did eventually figure out some workarounds. A DOS tool called HDDHackr was created which would let you plug in whatever identifying information you wanted into drives from Western Digital. All one had to do was grab a copy of a security sector from the seedier parts of the Internet, spoof the values it contained to the drive with HDDHackr, and you were golden. There’s reason to believe Microsoft could detect this — hundreds or thousands of Xbox consoles phoning into the mothership with identical drive serial numbers was surely a red flag — but apparently no action was ever taken to stop it.
Later on, once it was possible to modify the console’s firmware with JTAG access, the RSA check on the security sector was patched out, basically allowing you to use whatever drive you wanted. But this is where Microsoft apparently drew the line, as modifying your console in this way meant you could no longer sign on to Xbox Live.
As an interesting side effect of being able to modify the security sector, [Eton] notes it’s possible to replace the Microsoft logo with whatever image you wish, which will show up on the console when you check the drive’s capacity. Why have a logo stored on the drive at all? He theorizes Microsoft may have planned to let third-party companies produce drives, in which case you’d have seen their logo instead. It’s only conjecture though, since in the end, Microsoft was the only company to produce drives for the 360.
These days, Sony lets you install your own M.2 SSD in the PS5, and even the traditionally tech-adverse Nintendo will let you store your games on generic SD cards. The situation hasn’t changed much for Microsoft though, as their latest Series X console uses custom NVMe-based storage devices that only Seagate makes. That said, they’ve adopted a considerably more enlightened approach towards letting the user run their own software on the console, which is certainly a step in the right direction.
A Look Back at the Xbox 360’s Hard Drive Security
Source: Manila Flash Report
0 Comments