Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dump-xbox: Incomplete xboxkrnl.exe dump #35

Open
JayFoxRox opened this issue Jul 8, 2017 · 0 comments
Open

dump-xbox: Incomplete xboxkrnl.exe dump #35

JayFoxRox opened this issue Jul 8, 2017 · 0 comments

Comments

@JayFoxRox
Copy link
Owner

Due to how the kernel is loaded on Xbox, we can currently (?) not dump the entire kernel (without the MCPX key).
The dumped xboxkrnl.exe will miss the INIT section (in most cases), which creates a kernel which is runnable from a savestate / on initialized hardware. However, the kernel will be unable to initialize the hardware and boot the system.

I came up with an attack to dump the INIT section seperately on a cold-boot (as the memory location of INIT is known and it's still in memory after free()). However, gaining access to be the first XBE to run after a cold-boot is tricky, maybe even impossible without hardware hacks.
Also, if hardware is involved this tool failed it's purpose and we could also just dump the MCPX ROM directly.

= We need new attacks to dump MCPX ROM or the full Kernel image.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant