Use Of Hashing In A Secure Boot Loader Ms Patent Options

[signal-to-noise-ratio]

http://appft1.uspto.gov/netacgi/nph-Parser...=DN/20050138270

Not sure if this has been mentioned yet pretty interesting stuff.

32. The method of claim 31, wherein the initial code is maintained in the non-volatile storage portion of an auxiliary processor.

33. The method of claim 31, wherein the initial code is maintained in the non-volatile storage portion of one of: (a) a graphic processor; ( an audio processor; © an input processor; (d) an output processor; (e) a communication processor; and (f) a digital signal processor.

34. The method of claim 31, wherein the initial code is maintained in the non-volatile storage portion of a processor that executes the initial code.

38. The memory medium of claim 37, wherein a public key included in the preloader portion is usable for decrypting the signature portion.

39. The memory medium of claim 37, wherein the preloader portion includes machine instructions that enable verification of the digital signature, using a public key stored within the preloader portion.

Also included within bootstrap code 212 is a stored hash value that is the expected hash value for preloader 230, and a symmetric key. A step 254 loads the stored hash value from the bootstrap code. The machine instructions in bootstrap code 212 compare the stored hash value from the bootstrap code to the hash value that was just determined for preloader 230 in step 252. The comparison is made in a decision step 256 to determine if the stored hash value is equal to the actual hash value that was determined. If not, the machine instructions in bootstrap code 212 implement a step 258, which stops the boot-up process of game console 102. Accordingly, it will be apparent that if a different ROM is substituted for the original ROM, and the new substituted or unauthorized ROM does not include an identical preloader portion that will produce the expected hash value when processed with the one-way hash algorithm, decision step 256 will detect the modification to preloader 230 and terminate the boot-up process.

[signal-to-noise-ratio]

So it seems the chipset initalization code (what happens when the 360 is pluged into wall) and the bootstrap code could reside in the ana chip? Each bootstrap code is different and married to each flash chip in every 360. If someone could they should try swapping coresponding ana chips and flash chips on two 360s.

Edit: A thought, the preloader creates a hash of the entire rom minus the signature then compares this with the one in the digital signature decrypted by the public key. If we were to modify the rom minus the preloader then create a hash of it then insert our own public key and digital signature with our own hash matcing. Execution should continue then it would load our kernel?

This post has been edited by signal-to-noise-ratio: Jan 14 2007, 03:30 AM

[vax11780]

Interesting, but don't read too much into the smiley face before the ana chip. That is just the emoticon interpreting the text in the patent. Besides, this patent was written for the original xbox, not the 360.

The patent is written to cover all possible options including some which aren't included on the 360 platform. What I find most interesting is the hash of the pre-loader is included in the bootstrap. This implies the bootstrap is re-writable (to change the hash), or the pre-loader can't be changed, even if a bug is found.

VAX

PS I like the AlternaTIFF plugin instead of the Quicktime one to view TIFF images. Google it.

This post has been edited by vax11780: Jan 15 2007, 05:47 AM

[signal-to-noise-ratio]

Interesting, but don't read too much into the smiley face before the ana chip. That is just the emoticon interpreting the text in the patent. Besides, this patent was written for the original xbox, not the 360.

The patent is written to cover all possible options including some which aren't included on the 360 platform. What I find most interesting is the hash of the pre-loader is included in the bootstrap. This implies the bootstrap is re-writable (to change the hash), or the pre-loader can't be changed, even if a bug is found.

VAX

PS I like the AlternaTIFF plugin instead of the Quicktime one to view TIFF images. Google it.

I know thats a typo with the" a" and not a smiley it doesnt look that way in the patent text. Thats not why I say its the ana chip. I say its the ana chip because of swaps done with other chips Ie the southbridge between two consoles and the removal of the cpu and gpus from consoles. The bootstrap is probably hidden in a chip under a second layer so it wil be nearly impossible to overwrite which I think is the ana chip. This could be verified with a ana and flash swap between 2 consoles. I agree the patent is broad but I would have to say they probably used some of the methods included in it. As for being written for the original xbox this patent is from 2005 and though it uses xbox 1 diagrams I think there is some pertinance to the 360.

This post has been edited by signal-to-noise-ratio: Jan 15 2007, 05:58 PM

[signal-to-noise-ratio]

Edit: If you interested in finding out about swaps of chips done see posts by teammodfreakz on xboxhacker.net They have done some swapping of chips.