• Stars
    star
    446
  • Rank 97,888 (Top 2 %)
  • Language
    Python
  • License
    MIT License
  • Created 9 months ago
  • Updated 9 months ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

A modern dashboard exploit for the original Microsoft Xbox.

ENDGAME - A Dashboard Exploit for the Original Xbox

Overview

ENDGAME is a universal dashboard exploit for the original Microsoft Xbox. This exploit has been carefully engineered to be compatible across all retail kernel and dashboard versions released for the original Xbox. It does not require a game, or even a working DVD drive -- only a memory card.

Special credit belongs to @shutterbug2000 for the initial discovery of this vector within the dash and the first to demonstrate code execution against it. With further research, ENDGAME was developed by @gaasedelen leveraging an adjacent vulnerability that offered greater control and facilitated a more ubiquitous exploitation strategy.

Disclaimer

This project does NOT use any copyrighted code, or help circumvent security mechanisms of an Xbox console. Upon success, ENDGAME will launch a habibi-signed XBE from the root of the memory card. It does not patch kernel code or allow you to launch retail-signed executables.

By using this software, you accept the risk of experiencing total loss or destruction of data on the console in question.

Building

The exploit files can be generated from scratch using Python 3 + NASM on Windows.

Example usage is provided below:

python main.py

Successful output should look something like the following:

[*] Generating ENDGAME v1.0 exploit files -- by Markus Gaasedelen & shutterbug2000
[*] Assembling shellcode... done
[*] Un-swizzling payload... done
[*] Compressing payload... done
[*] Saving helper files... done
[*] Saving trigger files... done
[+] Success, exploit files available in ENDGAME/ directory

A pre-built zip of the exploit and sample payload XBE is available on the releases page of this repository.

Usage

Copy the contents of the generated ENDGAME/ directory to a Xbox memory card such that the root directory of the memory card has the following structure, where payload.xbe can be any habibi-signed XBE of your choosing:

/helper/
/trigger/
/payload.xbe

To trigger the exploit, plug the memory card into a controller and navigate to it while in the dashboard.

After a few seconds, the system should begin cycling the front LED to green/orange/red to indicate success. This is followed by it launching the payload.xbe placed on the memory card.

FAQ

Q: Is this a softmod?

  • A: No, by itself, ENDGAME is not a softmod. But it will make softmodding significantly more accessible as the community integrates it into existing softmod solutions.

Q: What is new about this exploit?

  • A: This exploit will enable people to softmod any revision of the original Xbox without needing a specific game. It will also allow people to easily launch a homebrew XBE (such as the Insignia setup assistant, or content scanning tools) by simply inserting a memory card into an unmodded Xbox.

Q: I don't have a memory card, can I use something else?

  • A: Yes, any FATX-formatted compatible USB device and controller port dongle should work.

Q: Why am I getting Error 21 after placing my own XBE on the memory card?

  • A: Your XBE must be signed using the habibi key. Several tools can do this, xbedump being the most popular.

Q: Why does my habibi-signed XBE result in a black screen with ENDGAME but not on a modded xbox?

  • A: The most common explanation is that your XBE may be using the Debug/XDK kernel thunk & entry point XOR keys rather than the retail ones, resulting in a crash.

Q: I triggered ENDGAME but my system quickly rebooted to the dash rather than my XBE...

  • A: While this should be uncommon, it means the exploit probably crashed. It's recommended to navigate straight to the memory card on a cold boot for successful exploitation.

Q: My XBE requires multiple files and external assets to run, will it work with ENDGAME?

  • A: No. Currently, ENDGAME is only structured to copy & execute a standalone XBE.

Q: How does this exploit work?

  • A: The exploit targets an integer overflow in the dashboard's handling of savegame images. When the dash attempts to parse the specially crafted images on the memory card, ENDGAME obtains arbitrary code execution.

Authors

  • shutterbug (@shutterbug2000), discovery and initial exploitation efforts
  • Markus Gaasedelen (@gaasedelen), root-cause-analysis & ENDGAME development
  • xbox7887 (@xbox7887), minor contributions and assistance with testing

More Repositories

1

extract-xiso

Xbox ISO Creation/Extraction utility. Imported from SourceForge.
C
582
star
2

nxdk

The cross-platform, open-source SDK to develop for original Xbox: *new* xdk
C
379
star
3

XboxDev

Information about XboxDev and issue tracker for the entire XboxDev ecosystem
91
star
4

ghidra-xbe

Xbox Executable Format (XBE) Loader Extension for Ghidra SRE framework
Java
75
star
5

cromwell

A free, legal BIOS replacement for the original Xbox
C
73
star
6

xbox-linux

Linux for the original Xbox
C
57
star
7

serial-usb-adapter

Original Xbox Serial to USB Adapter
50
star
8

xboxpy

Python module to interface with original Xbox hard- and software
Python
31
star
9

nv2a-trace

A tracing software like apitrace for the original Xbox GPU
Python
24
star
10

nxdk-rdt

Remote Dev Tool is a tool to remote control an Xbox using memory access and RPC
C
24
star
11

xbedump

Tool to dump header information or sign original Xbox executables
C
19
star
12

OpenXDK

C
16
star
13

mcpx-tools

Tools to work with the original Xbox MCPX ROM.
C
14
star
14

dump-dvd-kit

A tool to dump the ROM of the Xbox DVD Movie Playback Kit dongle
Python
14
star
15

ViridiX

Original Xbox debug communication suite
C#
12
star
16

a56

Modernized fork of a56, a DSP56001 assembler
Yacc
10
star
17

Cxbx

C++
8
star
18

xbox-linux-busybox

busybox for xbox-linux-initramfs
C
7
star
19

xbox-linux-initramfs

initramfs for xbox-linux
Shell
6
star
20

xtf-converter

A tool to convert XTF fonts to SVG fonts.
Python
5
star
21

xboxarchive.org

3
star
22

nxdk-buildbase

Dockerfile for an image containing everything required to build nxdk.
Dockerfile
2
star
23

nxdk-ci-environment-msys2

2
star
24

artwork

Artwork sources for the XboxDev ecosystem
2
star
25

xtlid

Provides a mapping of IDs to function names for .XTLID-sections found in Xbox executables
Rust
2
star
26

xboxdevwiki

Sources and issue tracker for XboxDevWiki.net
PHP
1
star