6 ms·

Xbox Architecture

226 points by timeoperator 6y ago

transpute 6y ago
Xbox One architecture talk (2019): https://www.platformsecuritysummit.com/2019/speaker/chen/ https://www.platformsecuritysummit.com/2019/speaker/chen/ > Every game console since the first Atari was more or less designed to prevent the piracy of games and yet every single game console has been successfully modified to enable piracy. However, this trend has come to an end. Both the Xbox One and the PS4 have now been on the market for close to 6 years, without hackers being able to crack the system to enable piracy or cheating. This is the first time in history that game consoles have lasted this long without being cracked to enable piracy. In this talk, we will discuss how we achieved this for the Xbox One. We will first describe the Xbox security design goals and why it needs to guard against hardware attacks, followed by descriptions of the hardware and software architecture to keep the Xbox secure. This includes details about the custom SoC we built with AMD and how we addressed the fact that all data read from flash, the hard drive, and even DRAM cannot be trusted. We will also discuss the corresponding software changes we made to keep the system and the games secure.
- favokus 6y ago
  Uh, I'm confused. The PS4 has been cracked. Jailbreaks exist. And yes, they enable piracy. But like any console that is still being actively supported/updated by the manufacturer, it requires a certain firmware version (or below).
  - Thaxll 6y ago
    None of the recent firmware have been cracked.
    - favokus 6y ago
      But the PS4 has been cracked. Newest firmware or not is a bit irrelevant. Once Sony stops supporting the PS4, we're going to see the latest firmware get cracked too. That's usually how it goes. There are a number of private exploits going up to 7.00 (and possibly higher). For fuck's sake, stop downvoting. Stupid assholes. > Both the Xbox One and the PS4 have now been on the market for close to 6 years, without hackers being able to crack the system to enable piracy or cheating. This is the first time in history that game consoles have lasted this long without being cracked to enable piracy. The PS4 has been cracked to enable piracy. That's a fucking fact. I can literally go on Ebay right now and buy myself a hackable PS4 and download a bunch of games and go nuts. So you guys can go eat shit.
    - dvdbloc 6y ago
      Yet
      - elcomet 6y ago
        For 3 years. If it takes 3 years to crack and Sony can update in a few months (and force update or games won't run), cracks are uselss
        jsheard 6y ago
        Sony even managed to pre-emptively fix that last exploit a few months before it became known to the public, so users who were actively using their PS4 and allowing it to update unknowingly locked themselves out of jailbreaking before they had the chance. The prospects of jailbreaking the next gen consoles really aren't looking good given the PS4 was this much of a PITA and the Xbox One has been completely bulletproof for its entire life.
  - muricula 6y ago
    Yes. The talk was given by an xbox architect, and iirc he mentions he's not sure about the state of the PS4. It's a great talk and if you're interested in security you should give it a watch.
    - deleted 6y ago
      [deleted]
  - jsheard 6y ago
    That's true, but Sony has been successful in making jailbreaking unfeasible for most people. The only path to a jailbroken PS4 today is to find one that's been sitting in a drawer without being updated for over 3 years, and even if you get that far there's no workaround for the version check on newer games so you can't play anything (legitimately or otherwise) that require firmware newer than the last exploitable version from 3 years ago, which rules out quite a few killer app exclusives. Unlike past generations you can't just brute force it with hardware modifications either, the security is so deeply embedded in the SoC now that there's no way to touch it. Without a software exploit you're shit out of luck.
  - cortesoft 6y ago
    Do the jailbreaks let you play online with pirated games?
    - landr0id 6y ago
      Yes. The problem though is as soon as the vulnerability used in the exploit becomes public Sony pushes out a patch.
      - HenryKissinger 6y ago
        That's not a problem at all.
- vmception 6y ago
  Well this is false. But I can say that I became disinterested in piracy when they made getting games more convenient than piracy. When they made using the hardware closer to its full potential part of the default experience. When they got the pricing right for these “premium” but pretty basic features. And of course, personally having the disposable income to afford the content because I would have never been a customer when I was pirating, only an unpaid evangelist of the franchise.
  - bluedino 6y ago
    It’s still hard to beat “free”
    - 4ec0755f5522 6y ago
      I bought an Xbox just for gamepass. 200+ games, may not have everything I want to play but it always has something I fun I do want to play. (Also xbox sales are often very good. I'm ok paying $10-20 (sometimes less!) for games). I suppose it helps that my backlog is 6 years now; up until last week I was still playing games on 360/ps3.
      - acomjean 6y ago
        My partner has a ps4 and some subscription thing (PS now?). It ends up being about 6$/month and new games are available each month (including some AAA). If each month you add them to your library you quickly end up with a backlog of more games than you can play. games seems to loose value rapidly after they are released so some are very affordable.
      - recursive 6y ago
        I just can't get over the idea that a game I'm playing today might be removed from gamepass tomorrow. As a result, I don't want to play anything on gamepass, or subscribe. Although I think I might have somehow accidentally subscribed anyway. I'll stick to gold.
        6y ago
- zerr 6y ago
  Why bother? Those who "pirate" will never convert to paid customers so why not let kids from some landlocked African country or rural India enjoy games?
  - deleted 6y ago
    [deleted]
  - fwip 6y ago
    A) a lot of people who do pirate in console are current customers. They spend quite a bit of money to get access to "every game ever" and stop buying new games. B) a lot of other ones hack the console in order to play hacked copies of the game in multiplayer, which ruins the experience for paying customers.
  - jfkebwjsbx 6y ago
    > Those who "pirate" will never convert to paid customers That's not true. Many people won’t pay for something if they can get it for free reasonably easy.
saagarjha 6y ago
I'm just looking at the motherboard layout at the very top of the article, and it's really strange to my non-expert eyes. The CPU is off to one side, and the GPU is the thing in the middle. And the SDRAM is all split up and far away from the CPU! Is this some sort of game-console specific thing?
- henryfjordan 6y ago
  It looks like the CPU and GPU are really close, which makes sense because it looks like there's a ton of pins shared between the two. Ultimately designing a circuit board layout is an optimization problem. You usually have some constraints, like how close chips can be before they start interfering with each other magnetically, where the I/O will be, and where you need holes to mount the board. Then you either try to be a pathing optimizer yourself or you run a program that will layout your board for you. I'm not sure about the XBox, but game consoles sometimes have faster Memory->GPU pipelines than normal PCs to speed up render times, which might be why the GPU is the most central component.
- wtallis 6y ago
  CPUs didn't have DRAM controllers on-die back then. The GPU is performing that function for the system, and the link between the CPU and GPU is the CPU's front side bus rather than PCI(e). The CPU and GPU are also close together so they can both be cooled effectively by the same fan.
- easde 6y ago
  The architecture here is similar to old PCs (roughly before 2010) that had integrated graphics in the northbridge. The memory controller also resides in the northbridge. The CPU communicates with the northbridge through the front-side bus. Incidentally the northbridge also used to be responsible for high-speed I/O such as PCIe, so even if you had a discrete GPU it would not be connected directly to the CPU. Over time CPUs have integrated all those features on-die, resulting in today's SoC-like processors where the "chipset" is merely an I/O expander connected over a PCIe-like link.
  - noisem4ker 6y ago
walrus01 6y ago
I still remember the "Xbox is HUGE" jokes from 2001.
- crazysim 6y ago
  Fun fact: The PS5 is huger than the Xbox!
joezydeco 6y ago
Bunnie Huang’s Hacking The Xbox is a great read, and it’s available as a free ebook: https://bunniefoo.com/nostarch/HackingTheXbox_Free.pdf https://bunniefoo.com/nostarch/HackingTheXbox_Free.pdf
TeaDude 6y ago
I know nothing about the actual underlying architecture but from the (credible) sources I've heard from apparently it's a really nice API hiding an absolutely unholy mess and that's why emulation has been so poor for so long.
- Aperocky 6y ago
  > it's a really nice API hiding an absolutely unholy mess Aint that universal.
- elcomet 6y ago
  If the API is nice, shouldn't the emulation be easy ? Since the emulator doesn't have to care about security / hacks. Or do you mean that the API only nice in theory, but is actually not nice in practice (lot of undocumented corner cases, or bugs, that games might rely on) ?
  - TeaDude 6y ago
    I have no idea about the specifics but from what I've heard developers really liked the XBOX (despite it's unholy internals) so I'd say the API was actually nice. As for HLE based on the API it's definitely possible but there's probably tons of nasty corner cases and that's my theory on why it's never been done. That and the chance of games with their own proprietary APIs existing and thus they won't work with that solution.
person_of_color 6y ago
For the Xbox 360, they ditched Intel and went for PowerPC. Microsoft then bought a bunch of PPC Mac Pros from Apple for development since they shared the same ISA :D
- messe 6y ago
  That entire generation of consoles, the Xbox 360, PS3 and Wii (and then arguably the Wii U) were all some form of PowerPC. The following generation though everything switched to more commodity hardware, with the PS4 and Xbox One using x86_64 processors and the Switch using an almost off-the-shelf SoC from nvidia. EDIT: Gamecube was also PPC.
loa_in_ 6y ago
> It is speculated that Microsoft may have left that code from prototype/debug units, so for the purposes of his research (possibly accidental, since this block exposes the types algorithms that Microsoft applied). In conclusion, this was considered garbage code [...] I can't parse this excerpt
- flipacholas 6y ago
  Fixed, thanks
MayeulC 6y ago
A few tidbits not included in the article: * Some emulator do exists. The earlier attempts were just API translation layers that work a bit like wine: translate the function calls to native system APIs on windows. As time went, tricks and workarounds were piling up, especially as some games used lower level HW functionality (writing in registers, etc), which provided difficult to emulate, and game executables had to be patched, thus making the emulators a collection of special cases. Such emulators include Xenia, Cxbx (and derivatives such as shogun's version, dxbx, etc). * More recently, efforts turned to low-level emulation, with complete emulation of the Xbox GPU, using a codebase derived from QEMU: XQEMU, and more recently XEMU (mborgeson's fork, focused on trying less-proven tricks and workarounds to maximize compatibility). Both are being developed in the open (XQEMU's development process might be slightly more open), and reverse-engineering is ongoing. * There is also an ongoing effort to port ReactOS to both the Xbox and XQEMU (probably using the official nvidia NV2A driver): https://reactos.org/wiki/Install_ReactOS_on_Xbox https://reactos.org/wiki/Install_ReactOS_on_Xbox * Big names (among others) on the emulation scene: mborgeson, JayfoxRox, Espes, Shogun * Bunnie Huang’s Hacking The Xbox was mentioned by another commenter, but 17 Mistakes Microsoft Made in the Xbox Security System is also an interesting read about working around the Xbox security mechanisms: https://xboxdevwiki.net/17_Mistakes_Microsoft_Made_in_the_Xbox_Security_System https://xboxdevwiki.net/17_Mistakes_Microsoft_Made_in_the_Xb... * I cannot stress enough how https://xboxdevwiki.net/ https://xboxdevwiki.net/ is a great resource for information. Other links: https://xqemu.com/ https://xqemu.com/ https://github.com/xqemu/xqemu/ https://github.com/xqemu/xqemu/ https://xemu.app/ https://xemu.app/ https://github.com/mborgerson/xemu/wiki#content-top https://github.com/mborgerson/xemu/wiki#content-top https://shogun3d-cxbx.blogspot.com/ https://shogun3d-cxbx.blogspot.com/ * There is a big discord community, some rooms are bridged with IRC on freenode, I also bridged #xqemu on Matrix: https://xboxdevwiki.net/Main_Page/Header https://xboxdevwiki.net/Main_Page/Header

226 points by timeoperator 6y ago

Xbox One architecture talk (2019): https://www.platformsecuritysummit.com/2019/speaker/chen/ https://www.platformsecuritysummit.com/2019/speaker/chen/ > Every game console since the first Atari was more or less designed to prevent the piracy of games and yet every single game console has been successfully modified to enable piracy. However, this trend has come to an end. Both the Xbox One and the PS4 have now been on the market for close to 6 years, without hackers being able to crack the system to enable piracy or cheating. This is the first time in history that game consoles have lasted this long without being cracked to enable piracy. In this talk, we will discuss how we achieved this for the Xbox One. We will first describe the Xbox security design goals and why it needs to guard against hardware attacks, followed by descriptions of the hardware and software architecture to keep the Xbox secure. This includes details about the custom SoC we built with AMD and how we addressed the fact that all data read from flash, the hard drive, and even DRAM cannot be trusted. We will also discuss the corresponding software changes we made to keep the system and the games secure.

favokus 6y ago
Uh, I'm confused. The PS4 has been cracked. Jailbreaks exist. And yes, they enable piracy. But like any console that is still being actively supported/updated by the manufacturer, it requires a certain firmware version (or below).
- Thaxll 6y ago
  None of the recent firmware have been cracked.
  - favokus 6y ago
    But the PS4 has been cracked. Newest firmware or not is a bit irrelevant. Once Sony stops supporting the PS4, we're going to see the latest firmware get cracked too. That's usually how it goes. There are a number of private exploits going up to 7.00 (and possibly higher). For fuck's sake, stop downvoting. Stupid assholes. > Both the Xbox One and the PS4 have now been on the market for close to 6 years, without hackers being able to crack the system to enable piracy or cheating. This is the first time in history that game consoles have lasted this long without being cracked to enable piracy. The PS4 has been cracked to enable piracy. That's a fucking fact. I can literally go on Ebay right now and buy myself a hackable PS4 and download a bunch of games and go nuts. So you guys can go eat shit.
  - dvdbloc 6y ago
    Yet
    - elcomet 6y ago
      For 3 years. If it takes 3 years to crack and Sony can update in a few months (and force update or games won't run), cracks are uselss
      - jsheard 6y ago
        Sony even managed to pre-emptively fix that last exploit a few months before it became known to the public, so users who were actively using their PS4 and allowing it to update unknowingly locked themselves out of jailbreaking before they had the chance. The prospects of jailbreaking the next gen consoles really aren't looking good given the PS4 was this much of a PITA and the Xbox One has been completely bulletproof for its entire life.
- muricula 6y ago
  Yes. The talk was given by an xbox architect, and iirc he mentions he's not sure about the state of the PS4. It's a great talk and if you're interested in security you should give it a watch.
  - deleted 6y ago
    [deleted]
- jsheard 6y ago
  That's true, but Sony has been successful in making jailbreaking unfeasible for most people. The only path to a jailbroken PS4 today is to find one that's been sitting in a drawer without being updated for over 3 years, and even if you get that far there's no workaround for the version check on newer games so you can't play anything (legitimately or otherwise) that require firmware newer than the last exploitable version from 3 years ago, which rules out quite a few killer app exclusives. Unlike past generations you can't just brute force it with hardware modifications either, the security is so deeply embedded in the SoC now that there's no way to touch it. Without a software exploit you're shit out of luck.
- cortesoft 6y ago
  Do the jailbreaks let you play online with pirated games?
  - landr0id 6y ago
    Yes. The problem though is as soon as the vulnerability used in the exploit becomes public Sony pushes out a patch.
    - HenryKissinger 6y ago
      That's not a problem at all.
vmception 6y ago
Well this is false. But I can say that I became disinterested in piracy when they made getting games more convenient than piracy. When they made using the hardware closer to its full potential part of the default experience. When they got the pricing right for these “premium” but pretty basic features. And of course, personally having the disposable income to afford the content because I would have never been a customer when I was pirating, only an unpaid evangelist of the franchise.
- bluedino 6y ago
  It’s still hard to beat “free”
  - 4ec0755f5522 6y ago
    I bought an Xbox just for gamepass. 200+ games, may not have everything I want to play but it always has something I fun I do want to play. (Also xbox sales are often very good. I'm ok paying $10-20 (sometimes less!) for games). I suppose it helps that my backlog is 6 years now; up until last week I was still playing games on 360/ps3.
    - acomjean 6y ago
      My partner has a ps4 and some subscription thing (PS now?). It ends up being about 6$/month and new games are available each month (including some AAA). If each month you add them to your library you quickly end up with a backlog of more games than you can play. games seems to loose value rapidly after they are released so some are very affordable.
    - recursive 6y ago
      I just can't get over the idea that a game I'm playing today might be removed from gamepass tomorrow. As a result, I don't want to play anything on gamepass, or subscribe. Although I think I might have somehow accidentally subscribed anyway. I'll stick to gold.
      - 6y ago
zerr 6y ago
Why bother? Those who "pirate" will never convert to paid customers so why not let kids from some landlocked African country or rural India enjoy games?
- deleted 6y ago
  [deleted]
- fwip 6y ago
  A) a lot of people who do pirate in console are current customers. They spend quite a bit of money to get access to "every game ever" and stop buying new games. B) a lot of other ones hack the console in order to play hacked copies of the game in multiplayer, which ruins the experience for paying customers.
- jfkebwjsbx 6y ago
  > Those who "pirate" will never convert to paid customers That's not true. Many people won’t pay for something if they can get it for free reasonably easy.

saagarjha 6y ago

I'm just looking at the motherboard layout at the very top of the article, and it's really strange to my non-expert eyes. The CPU is off to one side, and the GPU is the thing in the middle. And the SDRAM is all split up and far away from the CPU! Is this some sort of game-console specific thing?

henryfjordan 6y ago
It looks like the CPU and GPU are really close, which makes sense because it looks like there's a ton of pins shared between the two. Ultimately designing a circuit board layout is an optimization problem. You usually have some constraints, like how close chips can be before they start interfering with each other magnetically, where the I/O will be, and where you need holes to mount the board. Then you either try to be a pathing optimizer yourself or you run a program that will layout your board for you. I'm not sure about the XBox, but game consoles sometimes have faster Memory->GPU pipelines than normal PCs to speed up render times, which might be why the GPU is the most central component.
wtallis 6y ago
CPUs didn't have DRAM controllers on-die back then. The GPU is performing that function for the system, and the link between the CPU and GPU is the CPU's front side bus rather than PCI(e). The CPU and GPU are also close together so they can both be cooled effectively by the same fan.
easde 6y ago
The architecture here is similar to old PCs (roughly before 2010) that had integrated graphics in the northbridge. The memory controller also resides in the northbridge. The CPU communicates with the northbridge through the front-side bus. Incidentally the northbridge also used to be responsible for high-speed I/O such as PCIe, so even if you had a discrete GPU it would not be connected directly to the CPU. Over time CPUs have integrated all those features on-die, resulting in today's SoC-like processors where the "chipset" is merely an I/O expander connected over a PCIe-like link.
- noisem4ker 6y ago

walrus01 6y ago

I still remember the "Xbox is HUGE" jokes from 2001.

crazysim 6y ago
Fun fact: The PS5 is huger than the Xbox!

joezydeco 6y ago

Bunnie Huang’s Hacking The Xbox is a great read, and it’s available as a free ebook: https://bunniefoo.com/nostarch/HackingTheXbox_Free.pdf https://bunniefoo.com/nostarch/HackingTheXbox_Free.pdf

TeaDude 6y ago

I know nothing about the actual underlying architecture but from the (credible) sources I've heard from apparently it's a really nice API hiding an absolutely unholy mess and that's why emulation has been so poor for so long.

Aperocky 6y ago
> it's a really nice API hiding an absolutely unholy mess Aint that universal.
elcomet 6y ago
If the API is nice, shouldn't the emulation be easy ? Since the emulator doesn't have to care about security / hacks. Or do you mean that the API only nice in theory, but is actually not nice in practice (lot of undocumented corner cases, or bugs, that games might rely on) ?
- TeaDude 6y ago
  I have no idea about the specifics but from what I've heard developers really liked the XBOX (despite it's unholy internals) so I'd say the API was actually nice. As for HLE based on the API it's definitely possible but there's probably tons of nasty corner cases and that's my theory on why it's never been done. That and the chance of games with their own proprietary APIs existing and thus they won't work with that solution.

person_of_color 6y ago

For the Xbox 360, they ditched Intel and went for PowerPC. Microsoft then bought a bunch of PPC Mac Pros from Apple for development since they shared the same ISA :D

messe 6y ago
That entire generation of consoles, the Xbox 360, PS3 and Wii (and then arguably the Wii U) were all some form of PowerPC. The following generation though everything switched to more commodity hardware, with the PS4 and Xbox One using x86_64 processors and the Switch using an almost off-the-shelf SoC from nvidia. EDIT: Gamecube was also PPC.

loa_in_ 6y ago

> It is speculated that Microsoft may have left that code from prototype/debug units, so for the purposes of his research (possibly accidental, since this block exposes the types algorithms that Microsoft applied). In conclusion, this was considered garbage code [...] I can't parse this excerpt

flipacholas 6y ago
Fixed, thanks

MayeulC 6y ago

A few tidbits not included in the article: * Some emulator do exists. The earlier attempts were just API translation layers that work a bit like wine: translate the function calls to native system APIs on windows. As time went, tricks and workarounds were piling up, especially as some games used lower level HW functionality (writing in registers, etc), which provided difficult to emulate, and game executables had to be patched, thus making the emulators a collection of special cases. Such emulators include Xenia, Cxbx (and derivatives such as shogun's version, dxbx, etc). * More recently, efforts turned to low-level emulation, with complete emulation of the Xbox GPU, using a codebase derived from QEMU: XQEMU, and more recently XEMU (mborgeson's fork, focused on trying less-proven tricks and workarounds to maximize compatibility). Both are being developed in the open (XQEMU's development process might be slightly more open), and reverse-engineering is ongoing. * There is also an ongoing effort to port ReactOS to both the Xbox and XQEMU (probably using the official nvidia NV2A driver): https://reactos.org/wiki/Install_ReactOS_on_Xbox https://reactos.org/wiki/Install_ReactOS_on_Xbox * Big names (among others) on the emulation scene: mborgeson, JayfoxRox, Espes, Shogun * Bunnie Huang’s Hacking The Xbox was mentioned by another commenter, but 17 Mistakes Microsoft Made in the Xbox Security System is also an interesting read about working around the Xbox security mechanisms: https://xboxdevwiki.net/17_Mistakes_Microsoft_Made_in_the_Xbox_Security_System https://xboxdevwiki.net/17_Mistakes_Microsoft_Made_in_the_Xb... * I cannot stress enough how https://xboxdevwiki.net/ https://xboxdevwiki.net/ is a great resource for information. Other links: https://xqemu.com/ https://xqemu.com/ https://github.com/xqemu/xqemu/ https://github.com/xqemu/xqemu/ https://xemu.app/ https://xemu.app/ https://github.com/mborgerson/xemu/wiki#content-top https://github.com/mborgerson/xemu/wiki#content-top https://shogun3d-cxbx.blogspot.com/ https://shogun3d-cxbx.blogspot.com/ * There is a big discord community, some rooms are bridged with IRC on freenode, I also bridged #xqemu on Matrix: https://xboxdevwiki.net/Main_Page/Header https://xboxdevwiki.net/Main_Page/Header