Hacking Bypassing first-boot DRM efforts

Torus

Member
OP
Newcomer
Joined
Dec 12, 2021
Messages
23
Trophies
0
XP
243
Country
Hong Kong
Hello everyone,

I have a pair of day-one and overall old Xbox one PHAT consoles that were never used. They were never booted and therefore, when turning them on now, request you to establish an internet connection, link an account, and update the console's firmware. This is a DRM problem that affects not only unused consoles, but also factory-formatted consoles, which afaik also require you to update them and link an account. This is a huge preservation and repairability problem.

So I wanted to document the efforts and things I have attempted at bypassing the initial DRM, in case someone wants to help me research it. I have tested all the following things in consoles from 2018 and before

  • Booting into Kiosk Mode: by placing a file called MSXB_Kiosk in a NTFS USB drive it is possible to boot a console into kiosk mode. This does not seem to have any apparent effect in uninitialized consoles

  • OSU (Offline System Updates): I haven't tried this yet, but it is possible to perform an offline update of the system to a more actual firmware version through a USB. I reckon this would still require you to connect to the internet after the update is completed.

  • Arbitrary HostOS VBI loading EXPLOIT: This is probably the most promising idea. Assuming Xbox One consoles ship with some basic capabilities certificate, and it is not generated the first time they connect to Xbox Live, which is what we are just trying to bypass. This exploit allows to replace the SystemOS or GameOS with your own custom Virtual Machine. Someone on the forums mentioned that there was a person working on booting a custom firmware through this method. However, assuming that the initial DRM screen the Xbox One shows is handled by SystemOS, that would mean the rest of the system (i.e.: HostOS) are capable of working without connecting to xbox live and the exploit may work. We don't need a custom firmware, I believe it would be possible to dump the SystemOS VBI from an already updated/valid console, and put it into the locked console hard disk drive (following the exploit steps basically) to make it boot into an already valid SystemOS VM. I'm sure at some point the donor SystemOS will complain and crash because of the hardware IDs being different, but it would be a good starting point. Additionally, in the previous custom firmware discussion mentioned above and in the exploit page, it seems like there are no signature checks being performed on the system.vbi file, which may allow for patches made to ignore the different hardware IDs.

I have yet to discover how to dump SystemOS's system.vbi from a retail console (or even from an SRA $19 devkit), but unless I'm missing something important, the last method could be a potential way to unlock and get code running on non-initialized Xbox Ones before 2017.

What do you think about this?
 
Last edited by Torus,

Torus

Member
OP
Newcomer
Joined
Dec 12, 2021
Messages
23
Trophies
0
XP
243
Country
Hong Kong
Just a brief update, I reckon I now know where to focus my efforts to make the last path idea work. It is not the system.xvd (that is Read Only) but other parts of the OS. I now have a way of dumping the .VBIs as well, I just have very little time to work on it and that situation will continue until next month
 
  • Like
Reactions: CompSciOrBust

Jamesgamingthe

Member
Newcomer
Joined
Nov 19, 2021
Messages
13
Trophies
0
Age
22
XP
60
Country
United States
Just a brief update, I reckon I now know where to focus my efforts to make the last path idea work. It is not the system.xvd (that is Read Only) but other parts of the OS. I now have a way of dumping the .VBIs as well, I just have very little time to work on it and that situation will continue until next month
alright
 

Torus

Member
OP
Newcomer
Joined
Dec 12, 2021
Messages
23
Trophies
0
XP
243
Country
Hong Kong
Kiosks and OSUs are signed I think.
Yeah everything is signed. Which doesn't prevent unpacking and analyzing the contents.
I'd like to put my hands on a real Kiosk file .xvd though (these files came in USBs with the kiosk units if I remember correctly) because the ones archived online have disappeared completely. If anyone have a dump let me know
 
  • Like
Reactions: cheloruiz79
Joined
Sep 9, 2019
Messages
904
Trophies
1
Location
Switch scene
Website
github.com
XP
2,663
Country
Korea, North
Yeah everything is signed. Which doesn't prevent unpacking and analyzing the contents.
I'd like to put my hands on a real Kiosk file .xvd though (these files came in USBs with the kiosk units if I remember correctly) because the ones archived online have disappeared completely. If anyone have a dump let me know
@ZachyCatGames Doesn't Neko have an old XOne devkit? I don't think I have his new account on Discord.
 
  • Like
Reactions: Torus

ZachyCatGames

Well-Known Member
Member
Joined
Jun 19, 2018
Messages
3,398
Trophies
1
Location
Hell
XP
4,210
Country
United States
@ZachyCatGames Doesn't Neko have an old XOne devkit? I don't think I have his new account on Discord.
Uh, I vaguely recall him saying he had some xbox kiosk thing that was labeled as a prototype. But that might’ve been an empty shell with all the components being elsewhere, I don’t remember.

I was more concerned with the other thing we were doing there so I don’t remember much :P
I can poke him about it if you want though.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
  • BakerMan @ BakerMan:
    oh joy, heat wave all week where i live
  • BakerMan @ BakerMan:
    plus there's thunder and lightning outside, and it'll rain soon, there's somehow no tornado watch tho
  • BakerMan @ BakerMan:
    and to make it worse, the heat didn't sway my brother away from wanting to spend some time swimming on his birthday tomorrow
  • Sicklyboy @ Sicklyboy:
    idr where in the US the heat wave is
  • Sicklyboy @ Sicklyboy:
    idk if I'm in it or not
  • BakerMan @ BakerMan:
    midwest, near me and bigonya
  • Sicklyboy @ Sicklyboy:
    ah fuck NJ is in the heat wave
  • BakerMan @ BakerMan:
    we're cooked, possibly literally
  • BakerMan @ BakerMan:
    if you have a habitable basement, the heat shouldn't be down there and that's where you should hang out
  • Sicklyboy @ Sicklyboy:
    No, but, the air conditioner in my living room gets fuckin icy
  • Sicklyboy @ Sicklyboy:
    In a good way, not as in a "my coils are freezing" kind of way
  • K3Nv2 @ K3Nv2:
    Not everyone lives in theirs mom's basement gosh
  • BakerMan @ BakerMan:
    nah, my mom's basement is just for the weekends to check in on the family
  • BakerMan @ BakerMan:
    i usually live in your mom's basement
    +1
  • BakerMan @ BakerMan:
    saves a lot of time fr
  • Sicklyboy @ Sicklyboy:
    It's 11:30 PM here, I just took the trash out and my god is it awful outside
  • Sicklyboy @ Sicklyboy:
    This heatwave can eat my ass
    +3
  • MysticStarlight @ MysticStarlight:
    omg same, it's VERY hot here, too
  • BakerMan @ BakerMan:
    fuck this heatwave, i don't usually sleep with a fan, but i believe the fan is getting put on the bed rather than beside it
  • BakerMan @ BakerMan:
    IT'S 12:30 IN THE FUCKING MORNING AND IT'S STILL 78°, WHAT THE FUCK?
    +1
  • NinStar @ NinStar:
    78º seems abnormal for any part of the day
  • BigOnYa @ BigOnYa:
    Yea it was 96 F for the high, 78 F for the low today, in Ohio, bout same for bakerman in Michigan
  • BigOnYa @ BigOnYa:
    F- fahrenheit C-Celsius. We in USA use F as our temp ratings
    BigOnYa @ BigOnYa: F- fahrenheit C-Celsius. We in USA use F as our temp ratings