Earlier this year, known scene member and exploit creator "Grimdoomer" released the BadUpdate hypervisor exploit for the Xbox 360, while also revealing his retirement from console hacking. It looks like he couldn't stay away from digging into how the 360 ticks, however, because Grimdoomer is back, and has a massive announcement: there's an Xbox 360 softmod method on the horizon. In the past, Grimdoomer himself has claimed that there would never be anything more elaborate than the proof-of-concept hypervisor exploit, but he's one-upped himself, with a video that teases a 360 softmod method.

There is no ETA on any release, and Grimdoomer explains that the process will take time.

I know I said I retired from console hacking but I got one more in me. An Xbox 360 softmod is coming, no eta yet, THIS WILL TAKE TIME to finish. I still can't believe this exploit chain works, and I also can't believe I spent 20 hours a day for the last 3 weeks straight working on this. I'm so tired but seeing that coffee cup on screen was worth it

Source

 

[Idaho]

I really wonder how this works and I hope we won't be locked to using certain types of HDD, using a HDD at all is not really desirable in this day and age but maybe if that's the case its behavior could be emulated with a raspberry and then let us plug an SD card or something in its place...

 

[CoolMe]

if part of the FW is loaded from hdd/sdd at boot time, it would be possible to replace that code with something else

the dash/fw is flashed to the nand, that's why you can launch the 360 and even use the dash without the hdd on the system

now if our modder pal is getting into low level commands of hdd/sdds, it makes me wonder is he somehow feeding the xbox some code that it thinks is coming from a specific sector of the hdd - but is actually coming from some sort of injected code placed by our pal

iirc the hdd isn't one of the first things that the system gives priority to and even if it does having kernel level code execution on boot without means of overloading the memory using game saves (how BadUpdate works) is probably not possible. obv im not saying it's impossible, i hear what you're saying and he could indeed be working on something akin to what you're describing, im just saying how the HV exploit works at this point in time

Post automatically merged: Sep 1, 2025

Already been done. It's down to around 1 min with BadUpdate 1.2 (and rarely hangs anymore)


This isn't that. It very much sounds like this is a brand new exploit, from the way it's worded, and the clip. (Which might still use BadUpdate for the initial install, since it's the most accessible entry point)
Any further work on BadUpdate would be redundant after that point.

this'll be new to me.. thanks for sharing!

 

[x65943]

the dash/fw is flashed to the nand, that's why you can launch the 360 and even use the dash without the hdd on the system

iirc the hdd isn't one of the first things that the system gives priority to and even if it does having kernel level code execution on boot without means of overloading the memory using game saves (how BadUpdate works) is probably not possible. obv im not saying it's impossible, i hear what you're saying and he could indeed be working on something akin to what you're describing, im just saying how the HV exploit works at this point in time

Post automatically merged: Sep 1, 2025

this'll be new to me.. thanks for sharing!

Core FW files are on the nand, but what about other runnable/bootable files?

Like for instance, are games on the HDD able to start running code or transfer data somehow at time of boot or shortly thereafter?

Perhaps if the game files are used to either play music or show some image on the screen at time of boot (or some other function), then you have an entry there for some data - which with the help of some sort of exploit you could potentially run code

Idk I just feel it has something to do with the HDD but maybe not - we'll see

 

[tech3475]

This is why it can't be done in modding should never be worded.

The saying should be 'never say never, but don't expect it soon'.

I really wonder how this works and I hope we won't be locked to using certain types of HDD, using a HDD at all is not really desirable in this day and age but maybe if that's the case its behavior could be emulated with a raspberry and then let us plug an SD card or something in its place...

If it is dependent on an internal drive, I'm hoping it at least work with any stock HDD or at least any HDD that's compatible with the 360 drive firmware.

Right now the OG drives can be bought for peanuts.....now that I think about it, I wonder if scalpers will start buying them up given the speculation going on?

 

[x65943]

The saying should be 'never say never, but don't expect it soon'.



If it is dependent on an internal drive, I'm hoping it at least work with any stock HDD or at least any HDD that's compatible with the 360 drive firmware.

Right now the OG drives can be bought for peanuts.....now that I think about it, I wonder if scalpers will start buying them up given the speculation going on?

Idk, can anyone with more knowledge comment

That certainly doesn't look stock sticking out the top there

 

[CoolMe]

Core FW files are on the nand, but what about other runnable/bootable files?

there are none, apart from maybe fw (or avatar) update files when updating fw via usb, but they're not exactly executable or modifiable from what i know

Like for instance, are games on the HDD able to start running code or transfer data somehow at time of boot or shortly thereafter?

can't run games (or saves) until you're on dash, by that point the system is already fortified

 

[K3Nv4]

Idk, can anyone with more knowledge comment

That certainly doesn't look stock sticking out the top there

View attachment 525362

It is stock it just got slightly moved in shipping.

 

[x65943]

there are none, apart from maybe fw (or avatar) update files when updating fw via usb, but they're not exactly executable or modifiable from what i know

can't run games (or saves) until you're on dash, by that point the system is already fortified

He has been posting about modifying hdds for days

This was his last post before today

"Well I got my custom code running on this Western Digital HDD. Also did some debugging and found the lookup table for the vendor specific commands, there's more than I thought"

So whatever magic he cooked up seems to use a western digital hdd

 

[CoolMe]

Idk, can anyone with more knowledge comment

That certainly doesn't look stock sticking out the top there

View attachment 525362

the hdd inside the enclosure bit is like any other 2.5" hdd, so he probably has it removed because it's broken or he's testing things around with the same compatible hdd or others that aren't?

 

[The Real Jdbye]

My guess, it doesn't have anything to do with low level HDD/SSD stuff. That's normally read only, and there isn't enough data we can control in the SMART info or what not. Modded drive controller firmware? Possible, but that would make this specific to certain models of drives, and even the same model of drive can have completely different internals and firmware with no obvious way to tell. So that would make this pretty difficult for end users to utilize and probably not worth a big announcement.

So whatever it is, it's probably just data on the drive and so should work with any drive that works with the 360 but as a consequence, it's unlikely to make drives that aren't normally supported work, as the drive ID check should be happening before the drive is mounted or any files are read from it.

At best an educated guess so take it with a grain of salt. We won't know anything for sure until it's released or the dev provides more info.

Disregard that. I didn't look at his previous tweets. That's incredibly impressive. I don't think anything like that has ever been done, outside of big budget data recovery operations.
While impressive, it does also complicate things. It's clear from his tweets that this won't be something that is easy to make work with any HDD. And I'm afraid that the number of people able to contribute on making this work with a wider range of HDDs/SSDs is extremely small. Because as said, nothing like this has ever been done before. So it will (at least for a while) probably come down to one guy, how many drives people are willing to send him to test on, and how much time he has to invest in it. The patches might hopefully work on multiple drive models if the firmware is similar enough. But it will be difficult to make them work with other brands or with drives that are significantly newer or older than what he's using (because the firmware is likely to be more different, and especially with newer drives, they might have better security that prevents this sort of tampering)

 

[x65943]

the hdd inside the enclosure bit is like any other 2.5" hdd, so he probably has it removed because it's broken or he's testing things around with the same compatible hdd or others that aren't?

So what FW is he referring to here?

And idk if you looked at his twitter posts which is just days of debugging Xbox 360 hdds

Am I misreading this, or is he saying he can write to FW

 

[CoolMe]

And idk if you looked at his twitter posts which is just days of debugging Xbox 360 hdds

I didn't

Am I misreading this, or is he saying he can write to FW

View attachment 525363

View attachment 525364

You know hdds have fw too, most likely what he's talking about here (modifying the hdds's fw and making them compatible/work), otherwise how can he modify the 360's fw using these incompatible hdds without flashing to the nand? because there's no way he could modify anything without doing that, and that's assuming he knows what to look for

 

[x65943]

Whatever he is doing, it appears as though

1. It involves hacking an HDD
2. Somehow modifying the HDD leads to persistence
3. It either has an extremely reliable and fast success rate given the near immediate coffee cup image showing up OR it doesn't require an exploit to be run each time/boot and custom code itself can be run at boot

I guess it's possible he is somehow running the bad update exploit every boot, but seems pretty unlikely given the speed shown in the video (unless this is like a best take video)

 

[K3Nv4]

Whatever he is doing, it appears as though

1. It involves hacking an HDD
2. Somehow modifying the HDD leads to persistence
3. It either has an extremely reliable and fast success rate given the near immediate coffee cup image showing up OR it doesn't require an exploit to be run each time/boot and custom code itself can be run at boot

I guess it's possible he is somehow running the bad update exploit every boot, but seems pretty unlikely given the speed shown in the video (unless this is like a best take video)

It's possible he's trying to write a up to date windows tool that loads Auroras permanently to any hdd via USB and all you need to do is copy dash to some place to make it main boot dashboard. Possibly needing BAD files to start process then becomes permanent.

 

[tech3475]

Idk, can anyone with more knowledge comment

That certainly doesn't look stock sticking out the top there

View attachment 525362

The Phat 360 HDD was just a 2.5" SATA HDD in a caddy with a fancy connector (IIRC it was referred to as 'XSATA').

For 'internal'/caddy HDDs, the 360 also required the drives to have a specific firmware on them in order to be recognised, although it was discovered that this firmware could be dumped and used on other compatible drives.

360s with a hacked dashboard can disable the HDD firmware requirement.

So it sounds like they may have found a vulnerability in this drive firmware, or at least how the 360 reads it, which would allow for persistance.

 

[The Real Jdbye]

I didn't

You know hdds have fw too, most likely what he's talking about here (modifying the hdds's fw and making them compatible/work), otherwise how can he modify the 360's fw using these incompatible hdds without flashing to the nand? because there's no way he could modify anything without doing that, and that's assuming he knows what to look for

There's no reason to think it has anything to do with making incompatible drives work. If we can modify the drive FW that is indeed possible to achieve. And it might well be that the exploitable drive he is using needs the drive identifiers modified to work on a stock 360. But that wouldn't explain why he is doing all of this to begin with.
If the softmod itself has nothing to do with drive firmware what does it matter which specific drive he is using? He could modify the file system on a compatible drive. He wouldn't need to specifically seek out an incompatible drive to do that.
Somehow, the exploit is dependant on modded drive FW. That's pretty obvious from his tweets. Unless the tweets actually have nothing to do with the recent softmod announcement (or for that matter even the Xbox 360) at all and we're all just reading too much into it.

 

[Latiodile]

His tweets leading up to this announcement were all about tinkering with hard drives

I wonder if you will need a specific hard drive when this is released - hopefully not one with limited availability

I wonder if the next step is trying to get it working on more hardware?

Exciting times

if it isn't limited availability now, it will be once the exploit is released

 

[Deleted member 753700]

Let's fucking goooo!

 

[K3Nv4]

The Phat 360 HDD was just a 2.5" SATA HDD in a caddy with a fancy connector (IIRC it was referred to as 'XSATA').

For 'internal'/caddy HDDs, the 360 also required the drives to have a specific firmware on them in order to be recognised, although it was discovered that this firmware could be dumped and used on other compatible drives.

360s with a hacked dashboard can disable the HDD firmware requirement.

So it sounds like they may have found a vulnerability in this drive firmware, or at least how the 360 reads it, which would allow for persistance.

Same type of idea recently with the series console is cloning drives which has a 50/50 success rate all over the internet but that requires cloning probably two different operations. It's not too far stretched to believe they found a batch file that can unlock any drive for 360 and easily write new data to it with current bad files?

 

[CoolMe]

Why would he need to mess with incompatible HDDs at all?

you know, to make them work too?

If this is related to the exploit, which it sounds like it is, that would mean that incompatible HDDs are somehow required for the exploit.

not necessarily. what if he's working on making it work on both? again, just a guess

There's no reason to think it has anything to do with making incompatible drives work.

outside of the exploit/softmod? why not?