Hereโs a blog post covering all the technical details behind a strcpy bug I found in the Tony Hawk video game series that can be used to hack several gaming consoles and even get RCE on the over the network
As of today I have a fully working software only hypervisor exploit for the latest xbox 360 retail dashboard 17559 (should work on almost any software version though). Here's what you need to know...
I still can't believe this exploit chain works, and I also can't believe I spent 20 hours a day for the last 3 weeks straight working on this. I'm so tired but seeing that coffee cup on screen was worth it
Introducing Tony Hawkโs Pro Strcpy: A game save and network RCE exploit for the Tony Hawk video game series. Use it to hack your Xbox, Playstation 2, Gamecube, and Xbox 360 consoles
Here's part 1 of my blog series on hacking the Xbox 360 hypervisor. This covers the design of the hypervisor and hardware security features that back it. Consider it prerequisite material for part 2 which will be released next week (along with the exploit)
Here's a time lapse video showing my 360 hypervisor exploit triggering in ~18.5 minutes. This is a pretty average time for the exploit with about 40% success rate. People asked if it works on winchester and I don't think there's any reason it won't but I don't have one to test on
Hereโs some drip marketing for the exploit Iโm dropping. Full RCE over network play with arbitrary file transfer while you play. Stay tuned, it gets betterโฆ
And with that I'm retiring from console hacking, at least for the foreseeable future. I've learned all I wanted to learn and hacked all I wanted to hack, on to new avenues...
The code for this exploit has gotten so large I decided to break it into multiple cpp files which means updating my custom linker to support linking multiple object files. I had to write logic to handle multiply defined symbols which gave me a funny "I've come so far" feeling
This is NOT the softmod the community desires, it's mostly a PoC to show the exploit is possible, it will most likely never be robust enough to be considered a
"softmod", and I don't think the "softmod" people desire will ever exist.