Hi Hackernews, don't forget you can use the alternative edition without styles: <a href="https://classic.copetti.org/writings/consoles/xbox-360/" rel="nofollow">https://classic.copetti.org/writings/consoles/xbox-360/</a><p>(works better with accessibility tools, like text to speech; and translators)<p>There are also new PDF and EPUB editions here: <a href="https://www.patreon.com/posts/67035520" rel="nofollow">https://www.patreon.com/posts/67035520</a> (it's a public post, I just needed a place to upload those files without consuming my hosting's bandwidth).<p>If you spot a mistake, please log an issue on the repo (<a href="https://github.com/flipacholas/Architecture-of-consoles" rel="nofollow">https://github.com/flipacholas/Architecture-of-consoles</a>) so I can review it. Thanks!
Super minor nitpick but ROP wasn’t used for the King Kong/SMC exploit. I would consider it a ROP exploit if multiple <i>return-oriented</i> gadgets were chained together to form a full exploit chain, but what happened here is the syscall handler was invoked with a malformed index causing a <i>single</i> jump to user-mode code with kernel-mode privileges. It’s not too dissimilar to calling an arbitrary function pointer.<p>Otherwise this is a great comprehensive rundown!<p>I was just recently talking to a coworker too about how I think the Xbox 360 was the first consumer device to have the following types of attacks done to it:<p>1. Hypervisor attack to then reboot the console into a newer system OS version to retain the vulnerable hypervisor but be able to play new games and get online. This required soldering a separate flash chip to hold the newer system files.<p>2. Fault injection (reset glitch hack) to attack the system's bootloader<p>As a teenager who learned programming/hacking by messing with the Xbox 360, I'm thankful that Nintendo is still keeping the dream alive for our next generation of hackers.
I used to have a G5 Mac living a second life as a doorstep with a “property of Microsoft” sticker on it because they were used as early alpha devkits for the 360. Given away at the company I worked for a year or two after the 360 shipped. Rumour has it they were even delivered at the dead of night so no one would see the MS branding on Apple hardware.
This is beautiful.<p>I wish I could remember enough to contribute, especially to the DEV/XBL online chapters.<p>If I ever recover my old /modding/ folder, I will reach out [OP].<p>I was pseudo-privy to a lot of non-public stuff that I think the public could benefit now from, with a decade passing, I think it would be be appropriate to share.
This thing branched horribly. You had to use instructions to selectively write to distinct memory locations to avoid typical branching because misprediction was expensive.<p>This was Frostbite/Battlefield 3 era. Good Times.
I love this series. A minor point about the layout only: I know you are very fond of those tabbed boxes (as I've seen them in every such article of yours that I read over the years), and I bet they make a lot of sense when reading on a mobile device, but on my desktop browser with plenty of screen space I often wish they weren't there. I.e., I wish everything was always visible and maximally require (normal vertical) scrolling.<p>This is especially true for things you intend to compare. For example, I was awkwardly flipping between the "Xenon" and "Cell" tabs a lot, to compare the two block diagrams.
Modding my JTAGed Xbox 360 to go online and then getting banned and bricking it while trying to unban myself was my first true moment in tinkering, good times :')
Building the little probe used to read the x360 dvd drive key out of discrete components with zero knowledge of electronics was probably one of the most fun technical things I did in my early 20's. It was a logic level shifter if I remember correctly, wired to my PC's serial port.
That 2008 Windows Live Mail screenshot hit me right in the feels :') That's the period of time I got my first "high bandwidth" connection (really anything faster than a 56k dial-up connection), and basically the true start of my programming adventures...
Wow what a journey the homebrew section of that article was. As someone who grew up heavily involved in the evolving Xbox homebrew scene, I dipped out of consoles before the 360 was truly cracked. I remember the sadness in realising the DVD drive exploit had effectively killed off any interest in trying to run homebrew, but I'm thoroughly glad to learn that the community not only persisted, but became incredibly inventive.
It is kind of funny that the 3 major consoles of this generation used PowerPC, followed by the next generation mostly using AMD.<p>Do the major manufacturers just copy each other?
I wonder how true this rumor is, but I remember reading that around the time the F35's computer system was designed, Lockheed Martin shopped around for CPUs from different vendors. PowerPC was a very popular architecture used in military hardware, so LM contracted IBM to design a CPU for them.<p>In Aerospace applications, it's very popular to have triple-redundant system, that's why IBM designed an unusual 3-core PowerPC CPU. Later, when Microsoft came into the picture, they used the design, with essentially minimal modifications.<p>I haven't followed the F-35s development that closely, so I have no idea what they ended up using, but it's an interesting rumor nontheless.
I finally got through this, coming in and out throughout the work day. I owned 3 360's over the lifespan of the console (a launch version, a replacement after it red ringed a few years later, and then a slim), and I never even brushed up against the cracking or homebrew scene. Very interesting stuff!<p>I am curious though, other that one brief mention, why didn't you touch on the early hardware reliability issues at all?<p>Also, either the site has been swarmed and its down right now, or the links in footers 117, 118, and 119 are bad.
Wow, this is probably the best/longest essay that I've read about the 360's hardware and software (but without getting into the games themselves).
Fascinating read.<p>It's funny to me that IBM - a company not known to promote fun and games - ended up providing the processors that powered the PS3, XBox360, and I think the GameCube and Wii, too.<p>Thank you very much for the deep dive, I imagine the research must have been exhausting (but also rewarding, I hope!).
It's amazing to think that we had already hit peak gigahertz, and multi-core was just starting to become a major "thing" at the time.<p>Even with the advances in the M* chips from Apple, it seems the "chip wars" are basically over, at least on the design choice side of things.
Great read and made me nostalgic. There was also a way to turn a jtag/rgh console in to running dev console stuff. Also the trick where if you moved a dev consoles update file to your dev kit's main directory then it will allow 100% r/w/unsigned code. Modern xbone dev kits require their IP to be allowlisted/brick/turn to a retail if not constantly activated. Though there was the ps4 dev kit trick where you could set the console's clock back to when it was activated to unbrick/unlock it again. I wonder what protections/exploits the ps5 dev kits have.
Working with the ESP32 is what introduced me to the concept of eFuses. Really neat. Allows you to run encrypted firmware images which cannot be easily decrypted even with full physical access to the hardware.
I'm thankful for the people that did the work of reverse engineering/modding the Xbox and Xbox 360, without them I'm not sure if I would have gotten into programming as early as I did, around 13 years old. I got started with using simple modding tools for Halo 2 on Xbox then moved on to writing code for modding COD MW2 on the Xbox 360. Good times, it lead me away from spending all my free time gaming for fun and into coding for fun.
Great resource, nice work putting it all together. I was on the software side of 360 (mostly C++ and Lua), so I didn't get too deep in the hardware. Most of my time was spent modifying and building on the XAM, glad to see it mentioned briefly in there!<p>The old screenshots of the dash bring back lots of memories. The releases were all named after European cities at the time; Berlin, Geneva, Stockholm, Madrid, etc.
Super exciting read! I was interested in the Xbox 360 modding scene and re-reading this brought back a ton of memories from reading about all this stuff the first time!<p>Thanks for compiling this, the quality is excellent and the content is approachable.
A labor of love that would benefit from reorganization and editing.<p>It could also use a round of fact checking. Some of the info appears to be based on third-hand speculation.