CEN/CE Capstone Project @ EKU

Digital Media Centralization:xbox 360 capability enhancementDylan MeridaEastern Kentucky UniversityDept. of Technology, CEN12OUTLINEMotivation for centralization of digital mediaIntroduction to FreeNAS and X360 modificationProblem statement: Centralize media & unlock X360 platform to run unsigned codeProposed solution: Virtualize FreeNAS, build USB SPI Flasher, & perform JTAG/SMC hack on X360Results: Custom built FreeBOOT image running in single-NAND mode23OUTLINE (cont.)Conclusions: The importance of open platforms and homebrew software in the futureFuture Work: Expanding on the idea by building or porting open source software to the platformQ & A

3

4MOTIVATIONDigital media should have high availability throughout the home network and internetThe absence of Network Attached Storage (NAS) causes disorganization of data between PCs and laptops4MOTIVATION (cont.)Physical media is cumbersome and antiquated.HDDs and SSDs have the capacity to replace physical multimedia collectionsConsolidated digital media should be accessible through networked home theater devicesExisting multimedia platforms (Xbox 360) should be open and free to run open source software556

7INTRODUCTIONFreeNAS can suit file sharing needs through CIFS (samba), FTP, NFS, TFTP, AFP, RSYNC, Unison, iSCSI (initiator and target) and UPnPFreeBSD, UNIX, and Linux have a long standing performance issues with CIFS/SMBRooted in the lack of kernel tuning, asynchronous I/O, and large r/w SMB variantFreeBSD 7.2 introduced tuning and newer Samba daemons added the large r/w SMB variant

78INTRODUCTION (cont.)FreeNAS 0.7.1 (4/11/2010) is based on FreeBSD 7.1, includes AIO, and Samba is compiled with itNFS is the file sharing protocol of choice in UNIX world and its performance was much higherOnly Windows Vista & 7 Enterprise and Ultimate Editions include:Subsystem for UNIX-based applications (SUA)Client for NFS v3

89

10INTRODUCTION (cont.)Xbox 360 platform was chosen as network media player because:Its existing multimedia support (No MKV support)An abundance of processing powerRecent scene developments and breakthroughs12/23/2006: Xbox 360 King Kong Shader ExploitUtilizes a bug in the Hypervisor to allow unsigned code execution (e.g. run Linux)Only works on Xbox Kernel version 4532 and 4548Xbox Kernel version is currently at 9199 (April, 2010)

1011INTRODUCTION (cont.)The System Management Controller (SMC) is an 8051/8052 core inside the SouthbridgeIt manages the power sequencing, and is always active when the Xbox 360 has (standby or full) power appliedJTAG/SMC Hack to run unsigned codeNew way to exploit the well-known 4532 kernel ~ 5 secVerified to work until the 849x-update (Summer 09)Requires bridging 3 points on the GPU JTAG: Two with switching diodes and one with a resistorRequires read and write to NAND using SPI bus

1112

13PROBLEM STATEMENTHome and enterprise networks need an effective solution for data storage and multimedia centralizationSANs allow direct hardware access, but rely on the host PC for file system dutiesTo fully utilize this data store, network media players need to support open source software

1314PROPOSED SOLUTIONVirtualize FreeNAS to create a NAS and test its performance speed with CIFS/SMB sharing to the host OS Build USB SPI Programmer to facilitate quick NAND read and write in under 6minLPT port is similar cost with ~50min write durationInstall JTAG/SMC hack & flash X360 NANDRun homebrew code (Linux, Dashboards, Emulators, Media Players, XBMC one day)14SOLUTION STEPsStep 1: Virtualize FreeNAS 0.7.1 (revision 5127)Install VirtualBox v3.1.4Create new FreeBSD VMAllocate 512MB of RAMCreate 2GB dynamically expanding VDILoad FreeNAS LiveCDInstall to HDD Opt 9Reboot & configureSet up partitions, shares, and CIFS/SMB15

1516

SOLUTION STEPsStep 2: Build USB SPI Programmer with PIC MCPurchase partsBuild programmer or use ISP on WillemFlash PIC with full imageBuild SPI flashing circuitInsert PIC into socketInstall NandPro 2.0e software on PCInstall USB NandPro driver171718

ISP Header19

20

SOLUTION STEPsStep 3: Install JTAG/SMC hack & flash X360 NANDMake sure its kernel 2.0.7371.0 or lowerCheck X360 revisionSolder adapter to X360 NAND SPIUse USB SPI flasher to dump NANDCheck for exploitable CB version from NANDIf exploitable, install JTAG/SMC hack shown on the left21

21Check Kernel Version22

23

24

25

26

SOLUTION STEPsExploitable CB VersionsXenon: 1921 or lower is Exploitable (exception: 8192 IS EXPLOITABLE)Zephyr: 4558 or lower is Exploitable (exception: 4580 IS EXPLOITABLE)Falcon: 5770 or lower is ExploitableJasper 16mb: 6712 or lower is ExploitableJasper Arcade (256/512): 6723 or lower is ExploitableNandPro & FreeBOOTnandpro usb: -r16 7371.binExtract your original imageibuild x -d temp\ -p [cpu key] -b [1bl key] 7371.binExtract "9199.zip" to dataCopy config files from "temp" to "data" directoryChoose or patch SMCBuild FreeBOOT 0.032 imageibuild c freeBOOT -c [console] -d data\ -p [cpu key] -b [1bl key] bin\image.bin bin\fuses.binnandpro usb: -w16 FREEBOOT.bin

27Step 3: Install JTAG/SMC hack & flash X360 NANDSOLUTION STEPsStep 4: Run homebrew and open source codeAcquire XeXMenu v1.1 LiveCD from XbinsBurn to CD, boot on X360, and connect etherFTP will be accessible from networkMod in external HDD or use FAT32 formatted USBFTP over to HDD a GOD to boot FreeStyle Dash28

2829

30

31

32RESULTSThe FreeNAS box can store and share large amounts of media to the networkThe X360 is now completely open to run any homebrew software necessaryThe X360 homebrew scene is exploding with new projects and ports of softwareMany emulators are already complete with an N64 emulator and video plugin rewrite in the works3233

34

35

36

37CONCLUSIONSOpen platforms are important because they promote competition between software vendorsFor the X360, Microsoft has a complete lock down on what goes on their platform and royalty feesOpen source software allows:bits of pre-existing code to be reusedUs to learn from our mistakesThe intelligence of a large collective human effort to improve software and patch its security flaws quickly3738CONCLUSIONS (cont.)Ive learned:The workings of hardware and software NAS solutionsA great deal about FreeBSD, FreeNAS and UNIX filesystemsThe intricate workings of the Xbox 360 hardware and its low level software kernelSerial Peripheral Interface Bus and JTAG connectionsSATA bus interfacing and connectionsTo greatly improve my soldering skills and patienceHow to virtualize FreeNAS, Mac OS X Leopard, etc

3839FUTURE WORKThe project could be expanded through:Programming of a useful application for the X360Porting another software or emulator to the platformSetting up software raid on FreeNASModifying X360 games like Halo 3Finding a way to stream X360 in real-time across the network

3940REFERENCESDIPERT, B. (2009). Accelerating consumers' NAS adoptions: ASSESSING YOUR PRODUCT OPTIONS. EDN, 54(12), 30-37. Retrieved from Academic Search Premier database.Sangani, K. (2009). An audiophile's utopia. Engineering & Technology (17509637), 4(18), 28-29. doi:10.1049/et.2009.1804.Andrews, J., & Baker, N. (2006). Xbox 360 System Architecture. IEEE Micro, 26(2), 25-37. Retrieved from Academic Search Premier database.USB SPI Flasher with PIC18F2455 - now with source and binaries. (2009, August 31). XboxHacker BBS. Retrieved February 18, 2010, from http://www.xboxhacker.org/index.php?PHPSESSID=11dbecdaecf4f96fd9beae4cfa37c234&topic=12306.0USB SPI Flasher with PIC18F2455 - TECHNICAL thread ONLY. (2009, September 17). XboxHacker BBS. Retrieved February 18, 2010, from http://www.xboxhacker.org/index.php?topic=13850.0

4041ACKNOWLEDGEMENTSVigs Chandra and Jeff Kilgore for all their help and guidance over the yearsFree60: http://free60.org/Main_PageFreeNAS: http://freenas.org/Xbox Hacker: http://www.xboxhacker.org/Xbox-Scene: http://xboxscene.com/

41

42Questions?Thank you for your time!

Contact Information:Dylan MeridaPhone: (859) 955-0066Email: dmerida@gmail.com

42