Tuesday, January 4, 2011

Xbox 360 Forensics: Part 1

My research activity is coming to a head and I thought I'd let you all know how it is going. My early explorations were plagued by a plethora of hardware and software failures. The Xbox 360 thoughtfully provided to me by my University had a damaged hard drive which took me longer than it should to diagnose because I had to eliminate my procedure and imaging equipment as possible sources of errors. My setup is a little weird since I'm studying on the road, I'm using an Ubuntu virtual machine on my Dell Laptop and a cheap Xbox 360 -> USB hard drive connector and I was worried about issues arising from the level of indirection. The error that manifested was quite strange, the first 40Gb or so of the image would copy fine and if copying in a reverse order the last 40Gb would also copy fine. I tried imaging from the host OS, tried using a different USB adapter and even directly attached the drive using SATA. My tentative conclusion is that the middle platter of the 120Gb drive was damaged and any reads on it would fail. During this stage I voided some warranties (always fun) and learnt that inside the fancy casing Xbox 360 hard drives are standard laptop drives. I replaced the pictured drive with a 60Gb drive from a local games store and I was in business. A quick:

       dd if=/dev/sdc of=/mnt/data/image.bin 
   ./x360 /mnt/data/image.bin /mnt/xbox -o uid=1000,gid=1000

and I was in business... or so I thought (to be continued!)


  1. I've JTAG'd one of my Xbox 360s (well, technically I had someone else do it after realising it required some delicate soldering) so I'm very interested in your findings - even if some of the more in depth stuff is sure to go over my head :P

    Fun fact: Only a small list of WD models can be used for the original Xbox 360 (unless you JTAG it), but the new 360S model seems to accept any 2.5" SATA HDD.

  2. From the looks of it the 360S also did away with the proprietary case and connector combo requiring just a regular SATA connector. It looks like fun times.

    I haven't looked too closely into these restrictions but from what I've read the limits on drive type and/or size are enforced by placing a special signed blob of data on the drive that the OS checks during boot. If the specific blob doesn't match the drive's size and other characteristics it refuses. This is why you can't have a drive bigger than whatever the biggest Microsoft has released without a complete mod.

    Strangely at the moment I don't even own an Xbox 360 (I'm just borrowing one from my University). I've never spent much time reading about the various homebrew/mod options so I don't really know what's possible. I've been looking at some of the mod sites and they've been really helpful but it's also been frustrating because we're focusing on very different areas.