Yea @AmpBenzScientist there was one more, i'm not sure we talked about it yet.
Have You ever heard of DARPA Cyber Grand Challange?
@PawelK I wasn't inactive while I was silent. I have a problem with the Xbox One and it not being cracked. 8 cores and fast memory are very useful. It seems that the only feasible way to run unauthorized code is through browser exploits.
It seems to me that only going after the AMD Secure Platform ARM core and hitting the TPM would result in a usable break. I had various ideas about how to exploit it but that system is the most secure Microsoft product of all time.
@AmpBenzScientist
Where do the AMD and ARM sit there and how do they interact?
Something like CA/CI smartcard system from settopboxes/digitvs or harder/easier to craig.
@PawelK AMD implemented the ARM core on the CPU die in 2013. I have an A10 without it and an A4 with it. It's physically on the die and controls the CPU functions. AMD still has this on their CPUs.
If you want information about it there was a certain Lenovo laptop that had it in the UEFI. It was reverse engineered. A problem quickly arises with exploiting the PSP and that would be a series of checksums. Microsoft signed code would need to be run to get in that way. That's why I thought of an FPGA to inject code directly to the processor. The ARM core is running a RTOS and could potentially be hit through Ethernet.
The ARM core has complete control of the CPU. I believe it has trustzone too. Own the ARM core and, there's an exploit for many AMD processors, beat the other security checks to free the system.
All that work on securing the hardware and they still used garbage thermal paste.
Hmm. Nice way, I would prolly try to go after the little guy over there too, or the way the check is made on checksums, or against the predetermined prior against which the incoming one is checked.
Cant the same scenario of attack used against lenovo be applied here or cant the proceedings thereof?
@PawelK Lenovo has terrible firmware and it was so bad that it revealed some PSP secrets. Security on the Xbox One is much better. I believe they used a more advanced TPM or equivalent and that is not on the CPU. It's a real challenge unless one has advanced machinery, which is less costly now due to dye size, as the goal of the security team was to make the console require more money to crack than the retail price.
The Security Team said that and kinda hinted that the processor was the way to crack it. So it would require more precision than the ~1mm gaps I can solder. It might require something in the 14nm range.
@AmpBenzScientist
Id think here, unless the root certificate varying between the cpus from many boxes is burned into die, the CPU is just algo, and the varying root certificate must be stored elsewhere.
Basically, it seems right assumption, one has to think of such craigs in a way: it will cost you say 1M to crack it, but one has indeed to aim for shared weak point between all boxes.
As of crakin tpms/trustzones, i had a source on those. Brb.
@PawelK The PSP core is a MCU. I suspect that, like cache on CPUs or RAM, a row hammer attack could be performed successfully. That's part of the reason why I selected the (cheapest and most powerful FPGA I could find) Tang 20k.
Obviously the problem, aside from the FPGA and its associated hardware, is getting a RTOS that likely has little to no documentation running the code to safely gain that Ring -3? access.
@PawelK This feels like being trolled. Decade old hardware and firmware from Microsoft have yet to be publicly cracked. I only have an Xbox One because a friend was about to sell it or throw it away.
@AmpBenzScientist
That little geeky gnome in glasses and the other the brutha chair tosser, they seem to be pulling your leg.
@PawelK https://www.youtube.com/watch?v=OyDyOweu-PA
Curwa seems to be more versatile than I thought.
Where did you get this proprietary vid of my ex dancing in front of me in a loo?
@PawelK I just found it one day, Molchat Doma seems to lead to that.
I don't question the dancing cow but 5 grams?
@AmpBenzScientist
Idk. It night be with those Polaks similarly with c, as it is with alkie,
3%% in a blood would be deadly for 90% of human population of planet.
At 3%% Polaks just go outside asking around for any open supplier with more good thing, because its a clear signal to them, that they are sobering out.
@PawelK Perhaps so. It's probably all the mayonnaise and dumplings that help them survive.
@AmpBenzScientist
Replace dumplings with bigos.
Most common polish dumpling type name is punnable now, as they are called ruskie (pl. slightly derogatory of "the russians").
@smigol can You flex Your lower limbs in a style of this exotic dancer on the linked video?
@AmpBenzScientist
Hmm hmm.