Transcript of Grimdoomer's softmod video

0:00
All right, it's time to talk about the
0:02
Xbox 360 soft mod. Fair warning, this
0:05
video is going to be pretty low quality
0:06
because I'm completely exhausted from
0:08
getting this soft mod ready for release.
0:10
So, just bear with my crappy editing on
0:11
this one. As many people already know,
0:14
I've been working on a persistent soft
0:15
mod for the Xbox 360 for about a year
0:18
now. And in this video, I'm going to try
0:19
and answer some of the questions people
0:21
have and give you an idea of what to
0:22
expect from it on release. This video
0:24
isn't meant to be a step-by-step
0:26
tutorial. It's only an overview of the
0:28
soft mod and the features it includes.
0:30
With that out of the way, let's get into
0:31
it. The name of the soft mod is peer
0:33
pressure, and it's a persistent
0:35
softwareonly exploit for the Xbox 360
0:37
that triggers during startup. It's based
0:39
on the previously released bad update
0:41
exploit, but uses a new vulnerability I
0:43
found to run during startup before the
0:45
boot animation loads. This means once
0:48
it's installed, your console will
0:49
automatically boot right into a hack
0:51
state every single time you turn it on,
0:53
allowing you to have custom boot
0:54
animations and boot straight to a
0:56
homebrew dashboard of your choosing.
0:59
In order to use this exploit, you'll
1:00
need an Xbox 360 console on the 17559
1:04
system software and a hard drive.
1:07
Unfortunately, due to some changes in
1:09
the Southbridge chip used in the Corona
1:10
and Winchester models, the exploit does
1:12
not work on those revisions. So, if you
1:15
have one of those console revisions,
1:16
you're out of luck. Other than the
1:18
Corona and Winchester consoles, all
1:19
other console revisions do work with
1:21
this exploit. Now, before I go any
1:23
further, I'm going to give a very brief
1:25
and very highle overview of how the peer
1:27
pressure exploit works. For all the
1:29
nitty-gritty technical details, you'll
1:31
have to wait until part three of my
1:32
hacking the Xbox 360 hypervisor blog
1:35
series comes out. There are two main
1:37
components to this exploit, which are
1:39
the SMC and the Southbridge. The NAND
1:41
chip and hard drive are also involved,
1:43
but they're more so just along for the
1:45
ride and not doing anything inherently
1:46
malicious. When the console boots up,
1:49
it'll try and read a security sector off
1:51
of the hard drive to validate it's a
1:52
genuine Xbox hard drive. When this
1:55
happens, the SMC, which is running
1:57
modified code I installed to the NAND,
1:59
will perform witchcraft and get the
2:01
Southbridge to copy a bunch of data from
2:03
the NAND and hard drive into system
2:05
memory, which ultimately allows me to
2:07
corrupt a bunch of data and execute a
2:09
ROP chain. This chain bootstraps the
2:12
rest of the bad update exploit. And once
2:14
that finishes, your console is now in a
2:16
hacked state and ready to run homebrew.
2:20
The name peer pressure comes from using
2:22
the SMC Southbridge NAND and hard drive
2:25
to pressure the CPU into executing
2:28
malicious code. For those of you that
2:30
know your Xbox exploits, you might be
2:32
thinking this sounds similar to the old
2:34
SMC JTAG hack, and that's because it is.
2:37
This is basically the same concept, only
2:40
instead of having to solder wires to the
2:41
J-tag port on the motherboard, you need
2:43
a hard drive with some I put on
2:45
it. Earlier, I mentioned that the Corona
2:48
and Winchester models don't work with
2:50
this exploit. And that's because the
2:52
revision of the Southbridge chip they
2:53
used actually has a hardware fix for
2:55
these rogue DMA attacks using both the
2:58
old SMC JTAG hack and the peer pressure
3:00
exploit. Unfortunately, I didn't realize
3:03
this until later in the development
3:04
process. Otherwise, I probably would
3:06
have canned this whole thing and just
3:07
released it as a pock. I know a lot of
3:10
people are thinking the community will
3:11
find a way around this, and
3:12
unfortunately, unless you can find
3:14
another boot time exploit, you're out of
3:16
luck. All right, let's talk about boot
3:19
times. As you already know, bad update
3:21
1.3 is nearly instantaneous and nearly
3:23
100% reliable. This, however, is only
3:26
half the exploit. The peer pressure part
3:28
of the exploit, which involves the SMC,
3:30
Southbridge, and flash chip doing
3:32
hackery while the security sectors read
3:34
up the hard drive, is also a race
3:35
condition attack. So, if the race timing
3:37
is missed, the exploit won't trigger and
3:39
the CPU will need to be reset. However,
3:42
thanks to some clever SMC modifications,
3:44
it can detect if the exploit fails at
3:46
any stage and automatically reset the
3:48
CPU for you. This means at best your
3:51
console will boot in a single attempt
3:53
without needing to reset the CPU and at
3:55
worst the SMC will reset it for you,
3:57
adding a few seconds to the boot time.
3:59
The last factor in how fast the console
4:01
boots is the hard drive. The two things
4:03
that will increase the boot time are how
4:05
long the hard drive takes to spin up and
4:07
how large it is. The hard drive has to
4:09
be fully spun up before you can read
4:11
data off it. The longer it takes to spin
4:13
up, the longer the boot times will be.
4:15
By making a small modification to the
4:17
hard drive SATA adapter, you can force
4:19
the hard drive to spin up as soon as
4:21
power is applied instead of waiting
4:23
until the Xbox communicates with it. But
4:25
the modification is difficult to make by
4:27
hand. So unless you really want to
4:28
speedrun the boot times, it's probably
4:30
not worth making, especially if you're
4:32
not comfortable with performing
4:33
precision soldering. As for the size of
4:35
the hard drive, the time it takes to
4:37
mount a FATX partition increases the
4:39
larger the partition is. This is
4:42
normally hidden by the console mounting
4:43
the hard drive while the boot animation
4:45
is playing. However, since the files
4:47
needed to complete the exploit process
4:49
are stored on the hard drive, I have to
4:51
mount it before I can start playing the
4:52
boot animation.
4:54
Here's a side-by-side comparison of how
4:56
fast the peer pressure exploit boots
4:58
next to a retail console. On the left,
5:00
we have a completely stock retail
5:02
console with no modifications. In the
5:04
middle, a console running the soft mod
5:06
with a 1 TBTE hard drive. And on the
5:08
right, the same softmoded console using
5:11
the modified SATA adapter.
5:22
Now, let's talk about what types of hard
5:23
drives work with the exploit. In all
5:25
tests run thus far, every single 2 and
5:28
1/2 in mechanical hard drive has worked
5:30
with the exploit. The only drives that
5:32
do not work are solid state drives or
5:34
SSDs. To make this explicitly clear, as
5:38
long as you have a mechanical hard
5:39
drive, it doesn't matter what brand,
5:42
what size, if it's a genuine Microsoft
5:44
Xbox 360 hard drive or not, if it's
5:47
formatted to FAX or not, so long as it
5:49
is a mechanical SATA hard drive, it will
5:52
work with the exploit. There's a lot of
5:54
propaganda floating around about the
5:56
hard drive needing to be a specific
5:58
brand or model, and it's all
6:00
Find any 2 and 1/2 in mechanical SATA
6:03
hard drive and it'll work just fine. As
6:05
for SSDs, the fastest rate at which I
6:08
can attempt to exploit this race
6:10
condition is on the order of
6:11
milliseconds. The rate at which an SSD
6:14
responds to a read request is around 100
6:16
microsconds or around 10 times faster
6:19
than how fast I can exploit the race
6:21
condition. While I have some ideas on
6:23
how I can make them work with the
6:25
exploit, it's a lot of effort for little
6:27
benefit. Once I finish support for
6:29
replacing the disc drive with a second
6:31
hard drive, you'll be able to use your
6:32
SSD in place of the disc drive, and
6:34
you'll only need a mechanical drive to
6:36
keep the exploit files on. So, what do
6:38
you actually need to install the soft
6:40
mod? You'll need any Xbox 360 console
6:43
that's not a Corona or Winchester model,
6:45
any mechanical 2 and 1/2 in SATA hard
6:48
drive, and a USB stick. Once you copy
6:51
the soft installer files to the USB
6:53
stick, plug it into your console and run
6:55
RockBand Blitz. Press A at the start
6:57
menu and it'll boot into the softmod
6:59
installer.
7:01
From here, you can back up your console
7:03
CPU key, NAND image, and hard drive
7:05
security sectors.
7:07
Once that's done, you can install the
7:09
soft mod, which will make necessary
7:11
modifications to your console's NAND
7:12
image, and copy the exploit files to the
7:15
hard drive. Finally, the installer will
7:17
perform a special reboot operation on
7:20
your console to reset the SMC so the
7:22
modifications take effect the next time
7:24
you turn it on. And that's it. Your
7:26
console is now softmoded. When running
7:28
the soft installer, you can provide
7:30
additional homebrew apps to be installed
7:32
at the same time. Things like Aurora,
7:34
Freestyle Dash, Zel, or updated versions
7:37
of the original Xbox backwards
7:38
compatibility emulator. This will set up
7:41
your soft configuration file so you can
7:43
boot straight into your homebrew
7:44
dashboard the next time you turn your
7:46
console on without any additional
7:48
configuration required.
7:50
Once the soft is installed, you'll have
7:52
a few different modes you can boot your
7:54
console in. The default mode is softmod
7:56
mode, which will boot your console with
7:58
the soft mod enabled in full homebrew
8:00
features. The next is safe mode. By
8:02
holding the sync button and pressing the
8:04
eject button, your console will boot
8:06
with the soft enabled but ignore your
8:08
softmod configuration file. This mode
8:11
can be used if you mess something up
8:12
with your config file, homebrew
8:14
dashboard, etc., and your console
8:16
encounters issues getting to the
8:18
dashboard. The last mode is retail mode.
8:21
By holding down the sync button and
8:22
pressing the power button, your console
8:24
will boot with the soft mod disabled in
8:26
a completely stock state. No homebrew,
8:29
no unsigned code, just completely stock
8:31
Xbox 360. No matter what happens with
8:34
the soft files, whether they get
8:36
corrupted or deleted, you'll always be
8:37
able to boot into retail mode and repair
8:39
the soft installation. From the softmod
8:42
configuration app, you can also change
8:44
the behavior powering on the console via
8:46
the eject button. You can choose between
8:48
the default eject button behavior and
8:50
booting zel. One thing you'll need to
8:52
keep in mind is that the soft install
8:54
has two parts, the console part and the
8:56
hard drive part. Both are required for
8:58
the soft mod to work. If you remove your
9:00
hard drive or connect one that doesn't
9:02
have peer pressure installed, the
9:03
console will only be able to boot in
9:05
retail mode. Similarly, putting a hard
9:08
drive with peer pressure installed on an
9:10
unmoded console will not allow you to
9:12
use the soft mod. Once peer pressure is
9:14
installed on a hard drive, it can be
9:16
used on any console that also has peer
9:18
pressure installed, allowing you to
9:20
share one hard drive between multiple
9:22
soft modded consoles. Additionally, if
9:24
your hard drive is a genuine Xbox hard
9:27
drive or has been modded to act like a
9:29
genuine Xbox hard drive, you'll still be
9:31
able to use it on an unmoded retail
9:33
console even after installing the soft
9:35
mod. So, you got the soft mod installed,
9:38
your console's booted. Let's talk about
9:40
running homebrew. When I decided to turn
9:42
this exploit into a feature complete
9:44
thing, I wanted a completely blank slate
9:46
to start from. With the peer pressure
9:48
soft, you no longer need Dash Launch,
9:50
and it's actually completely
9:51
incompatible with the soft mod. Most of
9:53
the features Dash Launch provides have
9:55
already been implemented as mainline
9:57
features in peer pressure, and some of
9:59
which I have improved for better
10:00
functionality. The one exception to this
10:03
is the so-called plug-in system. The
10:05
Dash Launch plug-in model was never
10:07
intended to be used as extensively as it
10:09
is today, which is why most of these
10:11
plugins are incompatible with each other
10:13
and require specific load orders. Many
10:15
of these things are competing for the
10:17
same address space in memory, and even
10:19
worse are competing to hook the same OS
10:21
functions and make god knows what
10:23
modifications to the OS. The bottom line
10:25
is that any plugin that hooks into the
10:27
OS can cause compatibility issues with
10:29
the soft mod and prevent me from adding
10:31
new features later on. After looking at
10:33
all the different plugins people are
10:34
using, they basically fall into one of
10:36
three categories. So-called stealth
10:38
services, game specific plugins, or
10:41
other. As far as stealth services go,
10:43
there's no chance I'm going to help you
10:45
steal access to a paid service so you
10:47
can cheat in online video games. If
10:49
that's all you want to use a soft mod
10:50
for, don't even bother installing it and
10:52
just stick to using other methods to
10:54
hack your console. For game specific
10:56
plugins, I have plans to implement a new
10:58
trainer system with better support for
11:00
these things. But in the meantime,
11:02
there's a side loading feature that can
11:03
be used to load a DLL anytime a specific
11:06
game is launched. The sideloading
11:08
feature is not meant to be used as a
11:10
trainer system, but it can be used for
11:12
plugins that do things like restore dead
11:14
online services for various games. For
11:16
things in the other category, such as UI
11:19
skinning, device drivers, etc. I've
11:21
looked at some of these and scoped them
11:23
out for potential mainline features in
11:24
the soft mod, but have no definitive
11:26
plans for if or when that'll actually
11:28
happen. Outside of Dash Launch plugins,
11:31
all other homebrew apps, games, etc.
11:33
should work just fine. Now, let's talk
11:35
about the additional features the soft
11:37
mod provides. The soft mod implements
11:40
most of the typical OS patches that
11:41
disable security and licensing checks,
11:44
meaning all the games, DLC, etc. that
11:46
work on an RGH console will also work on
11:48
the soft mod. There's a few additional
11:51
restrictions that I've removed, and
11:52
you'll be able to see a complete list of
11:54
these once the soft mod is released.
11:56
While the soft mod is active, Xbox Live
11:58
access is disabled, so you can leave
12:00
your console connected to the internet
12:02
with the soft mod installed and don't
12:03
have to worry about getting banned.
12:05
While I would like to say you can sign
12:06
into Xbox Live while running in retail
12:08
mode, I haven't confirmed if any of the
12:10
modifications made by the softmod
12:12
install can be detected by Xbox Live
12:14
antiche. At the time of making this
12:16
video, the antiche system is not
12:18
actually functioning correctly. So, I
12:20
can't even test this out using one of my
12:22
own consoles until it's been confirmed
12:24
whether or not using Xbox Live in retail
12:26
mode is safe. You'll have the option to
12:28
disable Xbox Live access using parental
12:31
controls when installing the soft mod.
12:33
The soft also has a built-in autoupdate
12:36
system, which will alert you whenever
12:37
there's a new update available and allow
12:39
you to download and install it
12:41
automatically. If your console doesn't
12:43
have internet access, you can also
12:45
download the latest update manually and
12:47
install it offline. By default, the soft
12:50
mod has a flash protection mechanism
12:52
that blocks attempts to modify the
12:54
console NAND image, which could render
12:55
your console unable to boot in any mode.
12:58
For people who understand the risks
13:00
associated with tampering with the
13:01
console NAND image, this feature can be
13:03
temporarily disabled until the next
13:05
reboot in the soft settings app. The
13:08
soft mod will also have a boot animation
13:10
editor that can be used to customize the
13:12
Blades era boot animation and create
13:14
theme files that can be shared with
13:16
other people. Alternatively, the boot
13:19
animation can be swapped out for a
13:21
custom one using the soft mod settings
13:22
app. At this time, I don't have any
13:25
immediate plans to support customizing
13:27
other versions of the boot animation,
13:29
but perhaps I'll add it in a future
13:31
update. Unfortunately, XFAT support and
13:34
dual hard drive support will not be in
13:36
the first release of Peer Pressure. In
13:38
order to get this release faster, I
13:40
decided to move both of those features
13:41
to the first major update, which will
13:44
most likely not happen until early 2027.
13:47
While XFAT and dual hard drive support
13:49
are mostly complete, it'll take a month
13:51
or two to finish them and do all the
13:53
required testing to make sure they're up
13:54
to par for daily use. Rather than delay
13:57
the release any longer, I decided to cut
13:58
them for the first release and ship them
14:00
in an update.
14:02
Some people might be wondering if
14:03
they'll be able to use this on their RGH
14:05
console and the answer is not right now.
14:07
Testing all the different configurations
14:09
for this exploit is already difficult
14:11
enough and trying to add proper RGH
14:13
support will make this even more
14:15
difficult and timeconuming. It is
14:17
possible to flash a stock NAND image to
14:19
your RGH console and then install the
14:21
soft mod that way. However, be warned
14:24
depending on what wiring method you use
14:25
for the RGH install. Leaving the wires
14:28
connected while running nonRGH SMC code
14:31
could cause stability issues or
14:33
potentially damage your console if left
14:34
that way long term. If you're using a
14:37
mod chip based install, you'll probably
14:39
be fine if you disable the mod chip
14:41
before installing the soft mod. At this
14:43
time, I don't have any definitive plans
14:45
to add proper RGH support as it just
14:47
complicates the testing process and
14:49
makes it even more timeconuming.
14:51
And finally, the thing everyone has been
14:53
waiting for. The soft mod has been in
14:55
beta testing for a few weeks now, and as
14:57
long as no major issues are found, I'll
14:59
most likely release it sometime between
15:01
October 2nd and October 9th. If you have
15:04
a supported console type and a hardware
15:06
nan flasher and would like to sign up to
15:07
join the beta test, you can find the
15:09
sign up link in the description of this
15:11
video. That's all for this video. See
15:13
you next time.