Hacking Hardware "PeerPressure" (Xbox 360) softmod discussion

Nadaman · Sunday at 6:15 AM

bonkmaykr said:
I wasn't aware, in my experience accidentally logging on without a subscription active I was unable to complete matchmaking in any games.

Yeah, that's expected. The only thing that the so-called "Gold spoofing" that most stealths adverise only allow you to play multiplayer through game invites, and matchmaking with a handfull of games, such as Call of Duty: Black Ops II & Halo 3/Reach with Sunrise.

bonkmaykr said:
Grim's stance against stealthing in general would imply that he consciously chose not to allow local implementations either.

The only thing we're pretty sure of is that DashLaunch's launch.xex and Aurora's nova.xex are blocked, because of the softmod's native .DLL system & other kernel patch features. There is no concrete evidence that there is anything else in the softmod that actively blocks methods of also blocking challenge response spoofing, so I personally would be careful of purposing such statements. Many people these days will just take that statement and treat it like it's absolute fact instead of seeing the words "would imply" and acknowledge the nuance that the statement may or may not be real.

Who knows if his softmod is even detected by the 17559 challenge responses anyway? Maybe the existing ones were only built for the existing 17559 Freeboot patches that have existed for the last seven years.

bonkmaykr said:
Realizing now there is a third page to this thread, but I don't want to drag this out.

I don't plan on dragging out this weird discourse topic out either (at least after this reply) but I want to say this.

I don't know what it is about the internet, but it seems to program its user's brains to only intepret language said by others to be in the worst faith possible, reguardless of if the statement is obviously meant to be a joke or just not that deep, or they genuinely just don't understand the topic, but they cherry pick something that makes the other look bad. Due to that, they feel morally obligated to crusade against the entire thing in the discussion. Nuance gets killed reguardless of the platform.

Either way, I still feel that the drama about Grimdoomer being a big meanie for not being able to boot the stealth server plugins that currently exist would've still been created reguardless of if he did or didn't make the snarky comments about stealths in the video. Dammed if you do, dammed if you don't.

akq · Sunday at 8:48 AM

-snip- would there be a way to run plugins outside of dash launch? It would be great to run old dashboards, even me I don't really give a fuck about stealth servers but it would be great this support, yes it would be sad there would be no xbPirate support but if there is old dashboards it is good

Nadaman · Sunday at 8:57 AM

akq said:
-snip- would there be a way to run plugins outside of dash launch? It would be great to run old dashboards, even me I don't really give a fuck about stealth servers but it would be great this support, yes it would be sad there would be no xbPirate support but if there is old dashboards it is good

I don't see any reason why the actual plugins themselves can't theoretically be loaded through Peer Pressure. My impression from the video was that it just doesn't come with an end user mechanism for doing so, like in an .ini file.

This has been demonstrated recently with FreeMyXe's 1.2 update. It got its own homegrown plugin loader, with no DashLaunch required. Before XeUnshackle was released, someone made a standalone plugin loader app too.

lightwo · Sunday at 9:05 AM

landaire said:
By patching the functions which return your Xbox LIVE membership level and changes "silver" or (whatever it's called these days) to "gold". See this code I wrote about 14 years ago (this was devkits on PartnerNet though, not ProdNet): https://github.com/landaire/LaunchC...2b32f88a15/LaunchCode/Utilities.cpp#L102-L109

It's quite simple actually:

Xbox LIVE multiplayer is a tier of service you generally have to pay for.

On Xbox 360, the client is trusted for determining someone's membership level and if they meet this criteria.

Stealth services patch this, and bypass checks which are used to determine if a console has been modified.

I don't personally agree with the Xbox LIVE model since all the game servers are peer-to-peer. But you are bypassing intentional checks at various stages which are intended to prevent non-paying members from playing "online" multiplayer, and checks which are intended to prevent modified consoles from playing with unmodified consoles.

I understand very well what a stealth service provides. A stealth service provides functionality that bypasses the Xbox LIVE challenges (xosc) -- the challenges being hashing of various regions of the system memory to ensure their integrity -- and when those challenges fail, your keyvault is banned.

You can "protect" your stock KV by just swapping the keyvault used to authenticate to XBL and used as part of the challenge/response at runtime before connecting.

I understand that some stealth services provide features that can auto-swap keyvaults too. But the challenges haven't changed in so long. How are people even getting banned to begin with? Just... don't fail the challenges?

I don't have to, people already have. (Note: not an endorsement!)

https://github.com/Crackpot-Live/Crackpot-Client

https://kagi.com/search?q=siteastebin.com+xosc+xbox

But doesn't there need to be a matchmaking layer (SNet/XCommunity) to work? Simply spoofing Gold won't make matchmaking work, only invites initiated by friends, at least from what I could gather...

Really good information though, as someone who isn't knowledgeable on the subject, no amount of digging would have revealed much of what you said in that post. Thank you for sharing arcane knowledge.

landaire · Sunday at 9:09 AM

Nadaman said:
I don't see any reason why the actual plugins themselves can't theoretically be loaded through Peer Pressure. My impression from the video was that it just doesn't come with an end user mechanism for doing so, like in an .ini file.

That's accurate. There are no technical blockers to running plugins (technically builtin things like the system guide for example is a "plugin"). The mechanism by which they are loaded for end-users is what's missing.

The issues as outlined by Grim in the video are that the Xbox 360 does not have relocatable binaries -- I.e. an executable or DLL are loaded to a static address on each load. If you have two modules specifying the same load address they will conflict with each other.

Same with function hooking. He mentioned in the video that some plugins fight to hook the same system routines. In order to hook those you basically rewrite the assembly of the function prologue to jump to your own function -- or rewrite the module's export table. They may either want to replace the original function, modify its return value, or run some code before it runs.

Two plugins trying to do that are, again, going to conflict with each other and conflicts may only arise when loaded in a particular order.

I can't speak to technical issues with dashlaunch itself as I'm not familiar with its source code, but I wouldn't be surprised if it expects a certain runtime environment provided by JTAG/RGH images and has some kind of issues with the softmod environment as well.

Post automatically merged: Sunday at 9:12 AM

lightwo said:
But doesn't there need to be XCommunity for matchmaking to work? Simply spoofing Gold won't make matchmaking work, only invites initiated by friends, at least from what I could gather...

It's probably dependent on the title but I'm not really sure the particulars of why some games work and some don't. Back in the day it worked for all the games I played and I don't recall having to receive an invite from friends to play.

There are a bunch of goofy things you can do with the LIVE protocols though because the client is quite trusted by online services, so you can just lie to the servers about a lot.

Nadaman · Sunday at 9:40 AM

landaire said:
I can't speak to technical issues with dashlaunch itself as I'm not familiar with its source code, but I wouldn't be surprised if it expects a certain runtime environment provided by JTAG/RGH images and has some kind of issues with the softmod environment as well.

If you're curious, c0z released the source code some time ago.

I also heard that the JTAG version of XBDM requires DashLaunch (which would also include all the -RPC plugins, because they rely on xbdm), but I know you don't exactly have a high opinion of XBDM being distributed anyways

landaire · Sunday at 9:47 AM

Nadaman said:
If you're curious, c0z released the source code some time ago.

I've been reading bits here and there but haven't had a good time to fully understand the architecture behind it. Happy he did so though.

Nadaman said:
but I know you don't exactly have a high opinion of XBDM being distributed anyways

I know you joke, but to clarify my disappointment is mostly that the scene didn't grow to reimplement it in a greenfield/copyright-free manner -- less about its distribution. All this time passed and it's just a shame that the needle hasn't moved beyond proprietary Microsoft tooling into open-source and extensible foundations. I'm actively doing things in my spare time though in an attempt to change that:

https://github.com/landaire/xeedee
https://github.com/landaire/binja-xex2
https://github.com/landaire/acceleration
https://github.com/landaire/exui

bonkmaykr · Sunday at 10:18 AM

Nadaman said:
There is no concrete evidence that there is anything else in the softmod that actively blocks methods of also blocking challenge response spoofing, so I personally would be careful of purposing such statements.

My thought process was that the means to do so would be provided through an API in userspace, i.e. the PeerPressure payload would act as the authority over plugins, rather than just load them with relative addressing (absolute addressing is the problem with DashLaunch if I understand?).

I admit he doesn't outright say this is the case, but when you tell an entire demographic of users to "forget about it" and say you won't support them, it's a bit of a pointless statement if you don't have anything in place to prevent such a plugin from being made. Which is why without seeing the code, that was my best guess.

I also have a distrust in general of developers making decisions based on what the user is morally allowed to do. This isn't exactly the Signal project so the consequences are not significant, but it is a red flag.

I hope if this is the case, the response from would-be users has changed his mind, not turned him off from his work. I've been checking in on this since the dag the Tony Hawk strcpy exploit was first revealed and the overgeneralizing of stealth users was a shock to me.

vassilakisdim · 2026-10-05T15:30:08+0100

Dude cmon just wait for the release

Thing is... I don't want the official thing. I really want DashLaunch support since I like to use Xbox One controllers and ReLive

Nadaman · 2026-10-06T02:34:35+0100

vassilakisdim said:
Thing is... I don't want the official thing. I really want DashLaunch support since I like to use Xbox One controllers and ReLive

For what it's worth, someone shared an exchange from Grimdoomer's beta tester server that gives the indication you can utilize controller plugins or stealth plugins anyway.

Nadaman said:
I don't see any reason why the actual plugins themselves can't theoretically be loaded through Peer Pressure. My impression from the video was that it just doesn't come with an end user mechanism for doing so, like in an .ini file.

It seems like my hunch is gonna be correct after all.

Hacking Hardware "PeerPressure" (Xbox 360) softmod discussion

Member

Active Member

Member

サーガル

New Member

Member

New Member

Wild Animal

New Member

Member

Similar threads

Popular threads in this forum