Through the years those following the hacking scene have seen plenty of games exploited in order to run code and help softmod game consoles. Cubic Ninja's QR code reader was exploited to allow for the Homebrew Launcher to be installed on the Nintendo 3DS, and an edited save file of Tom Clancy's Splinter Cell for the original Xbox could execute a payload that would softmod the system. A member of the Xbox scene by the name of Grimdoomer wanted to test their skill, and see if they could discover a new exploit for older consoles. Choosing to see what potential exploits could be done in Tony Hawk's Pro Skater 4 for Xbox, Grimdoomer has managed to create and release an RCE exploit that can hack not just one console, but also the PlayStation 2, GameCube, and shockingly, the Xbox 360.

​

Named Tony Hawk's Pro Strcpy, the exploit exists across Tony Hawk's Pro Skater 3, Tony Hawk's Pro Skater 4, Tony Hawk's Underground 1, Tony Hawk's Underground 2, and Tony Hawk's American Wasteland. The hack is a pre-made save file that you can load for your console of choice, which utilizes the game's Create-A-Park level builder to allow remote code execution.

Fast forward to present day (2024) and I finally got around to cleaning up and releasing all these Tony Hawk exploits. However, since I’m most likely retiring from game console hacking after this I wanted to drop an absolute banger of a release so I ported the exploit to some other game consoles that are vulnerable to it. This bug exists in 5 different iterations of the Tony Hawk video game series across numerous game consoles and handhelds. No one is safe from Tony Hawk’s Pro Strcpy. Since you’re probably tired of me talking about the same strcpy bug over and over I’m only going to provide some brief details of which games for which platforms I ported the exploit to and how it may or may not make hacking those consoles easier.

Grimdoomer posted a highly-detailed blog that goes in-depth on how the strcpy bug works, and how to execute it. They also released the exploit, available on GitHub, with versions that support Tony Hawk's American Wasteland for the Xbox 360, Tony Hawk Pro Skater 4 for the GameCube, Xbox, and PlayStation 2. He also noted that the PC version of Tony Hawk's Underground, which has a community built around a fan-patch of the game and has network play, is also exploitable, and that players should be wary.

And there you have it, the first software only exploit for the Xbox 360. It’s kind of ironic that this worked out almost exactly the same as the save game exploits for the original Xbox: performing a stack buffer overflow from a strcpy call on data contained in a save game file you can copy to your console using a memory card. You can use the strcpy bug to get ROP execution on any Xbox 360 OS version, but you’ll only be able to get full hypervisor code execution on the 4548 kernel version. If a new hypervisor bug is discovered this can easily be paired with it to work on newer kernel versions. I still have some hope that there might be an exploitable bug that would get you hypervisor code execution on a new kernel version. But I highly suspect it would be some kind of CPU or MMU bug rather than a bug in the hypervisor code.

Source
GitHub Release

 

[chrisrlink]

has this been patched yet (360)? MS made a dumb move by closing online completely (no incentive to update to a patch only fw iirc THPS4 is only $9 (gc) on amazon better that $150 for either pokemon game (which was an oops by genius) wonder how fast amazon will inflate the price cause of the exploit

 

[Armadillo]

has this been patched yet (360)? MS made a dumb move by closing online completely (no incentive to update to a patch only fw iirc THPS4 is only $9 (gc) on amazon better that $150 for either pokemon game (which was an oops by genius) wonder how fast amazon will inflate the price cause of the exploit

Savegame entrypoint/exploit isn't patched. Hypervisor exploit for code execution was patched way back in 2007.

 

[gisel213]

Interesting to try this on those un rghable Winchester models.... Edit says it only works on 4548 kernels like that king Kong exploit did... But gamecube part even cooler...

 

[_47iscool]

has this been patched yet (360)? MS made a dumb move by closing online completely (no incentive to update to a patch only fw iirc THPS4 is only $9 (gc) on amazon better that $150 for either pokemon game (which was an oops by genius) wonder how fast amazon will inflate the price cause of the exploit

Game updates are still available. So they could if they wanted to.

But I most likely will refuse it if a softmod does come out that works on the latest (2019) dashboard.

Edit: Is MVG aware of this?

 

[Blythe93]

Edit: Is MVG aware of this?

No clue, but I saw his video covering the old Blades dashboard and it sucks that his dashboard version is 6723 (this hacks works only on 4548). I wonder if he'll find a unit that where he can showcase the exploit. I really love his videos, they are very informative.

 

[_47iscool]

No clue, but I saw his video covering the old Blades dashboard and it sucks that his dashboard version is 6723 (this hacks works only on 4548). I wonder if he'll find a unit that where he can showcase the exploit. I really love his videos, they are very informative.

Same here.

 

[MultiKoopa]

I don't know anything about 360 modding. Is it possible to use an SSD with one, without hacking it in a way that'll automatically get you banned from online?

 

[Blythe93]

I don't know anything about 360 modding. Is it possible to use an SSD with one, without hacking it in a way that'll automatically get you banned from online?

Apparently it is (source), but it's still not available to the public. A Kingston A400 240GB SSD was used in this specific case.
On FATXplorer's FAQ page it says:

This is a new development and Xbox 360 HDD Maker does not have SSD support right now. Specific SSDs may be supported in the future. An announcement will be made if/when this happens.

Note that 465.76 GB is the largest storage you can have on unmodified system, according to this:

With the currently available security sectors, the maximum space the retail Xbox 360 kernel will allow you to use is 465.76 GB. While you can flash and use larger drives up to 2 TB, only 465.76 GB will be utilized. It is not possible to raise this utilization limit on retail. This is an entirely different challenge and 465.76 GB will probably be the limit forever. Also note RGH and JTAG consoles do not have this limit.

Source: https://fatxplorer.eaton-works.com/2024/08/13/fatxplorer-3-0-beta-32-an-alternative-to-hddhackr/

 

[MultiKoopa]

oh fantastic thanks

 

[_47iscool]

Can Xenia run the dashboard? Maybe they could use it to find an exploit. But if the HV is not emulated, then maybe not.

 

[thevideogameraptor]

This is really cool, but I have the 360 E, so it'll probably be a while before I can exploit this.

 

[Evanjellydonutz]

hoping that some kind of HV exploit gets found before the end of the year

 

[FFTW]

Pretty impressive