5 ms·

Xbox Hacks: The A20 (2021)

106 points by mattweinberg 1y ago

pwdisswordfishz 1y ago
I was confused as to why Xbox would ever enable a feature intended for backwards compatibility with systems it does not need to be compatible with. Especially at boot time. Turns out it did not; this apparently required a hardware modification to pull off. https://xboxdevwiki.net/Exploits#A20M.23_hack https://xboxdevwiki.net/Exploits#A20M.23_hack
deleted 1y ago
[deleted]
userbinator 1y ago
For those wondering what software depended on A20 wraparound, there is this interesting series of articles: https://www.os2museum.com/wp/who-needs-the-address-wraparound-anyway/ https://www.os2museum.com/wp/who-needs-the-address-wraparoun... https://www.os2museum.com/wp/the-a20-gate-it-wasnt-wordstar/ https://www.os2museum.com/wp/the-a20-gate-it-wasnt-wordstar/ https://www.os2museum.com/wp/exepack-and-the-a20-gate/ https://www.os2museum.com/wp/exepack-and-the-a20-gate/ https://www.os2museum.com/wp/the-a20-gate-fallout/ https://www.os2museum.com/wp/the-a20-gate-fallout/
- bigstrat2003 1y ago
  It's always blown my mind that software would depend on that behavior. What possessed people to do that? It's very obviously a bad idea.
  - toast0 1y ago
    If the system behavior is defined to wrap around, using defined system behavior to reduce code complexity makes perfect sense. This was in an era where new computer systems usually meant throwing away all the existing software and rewriting it (or doing a fresh port anyway). Why would you assume someone would extend the system and cause trouble.
  - rasz 1y ago
    Im blown away at how small a number of software depended on the wraparound and IBM still forced A20 hack on us all.
mjg59 1y ago
A20 bugs were still with us until at least 2009, when I tripped over one: https://mjg59.livejournal.com/118098.html https://mjg59.livejournal.com/118098.html . I love the visualisations in this post, it makes it much clearer what's actually going on.
- diffuse_l 1y ago
  Indeed, more than you ever wanted to know about the A20 line: https://aeb.win.tue.nl/linux/kbd/A20.html https://aeb.win.tue.nl/linux/kbd/A20.html (from your article) This is one hell of a rabbit hole...
LongjumpingCat 1y ago
[flagged]
- endlessvoid94 1y ago
  Same. I modded my original Xbox back in the day. It was a lot of fun and I learned a lot.
- ljf 1y ago
  As an FYI to others, it appears this account (and others in this thread) might be a bot.
  - glimshe 1y ago
    I didn't notice it at first but once you said it, it became obvious. There is a cheesiness to LLM comments that is hard for humans to emulate... Although it's still plausible that a person would say something like that.
    - ljf 1y ago
      I'll be honest, I upvoted it at first, and it was only when I saw the 2nd very similar post here and then went into their cookie cutter post histories.
OkPin 1y ago
What really caught my attention is how this marketing snippet highlights the tension between authenticity and polish in gaming culture. Xbox was trying to hit that sweet spot, it wanted to feel edgy and gamer-friendly but the copy ended up sounding like corporate speak.
- eddythompson80 1y ago
  This is a bot, right? Same with all the new accounts commenting completely unrelated things?
  - cebert 1y ago
    Based on this post and others, it looks like a spammy account to me.
messe 1y ago
Something this article doesn't mention is how the A20 gate was toggled: by writing to registers on the keyboard controller. I was always thought this was a completely inexplicable design choice, until I started working in embedded, working with hardware engineers, and having to go through schematics myself. I now entirely understand the choice of wanting to minimize the redesign work and going with the one free pin available (our product has made similar choices too at this stage).
- st_goliath 1y ago
  The original IBM PC used an Intel 8048 microcontroller inside the keyboard and an 8255 I/O controller on the main board to communicate with the keyboard. The PC AT (which had an 80286), later replaced the 8255 with an 8042 microcontroller too. It was running firmware, so re-purposing it for a Hodge-poge of other tasks became trivial. A single GPIO pin was used for masking the A20 line and another for handling CPU reset. Having a total of 24 programmable I/O lines, I guess this could have been done with the 8255 too, but the microcontroller probably allowed simpler interfacing with the CPU and bought them more flexibility for future expansion. For the article, this is mostly irrelevant. As somebody else noted, the Xbox wasn't supposed to be able to toggle/mask the A20 line, but later x86 CPUs had already integrated the A20 masking feature into the CPU itself and exposed an A20 control line. The Xbox simply tied the A20 enable line to a fixed potential, the hack described in the article requires a simple hardware modification to change that (https://xboxdevwiki.net/File:Haxar-a20m.jpg https://xboxdevwiki.net/File:Haxar-a20m.jpg).
  - privatelypublic 1y ago
    Linux kernel still has the option to try and use the keyboard to reset the system while rebooting. (Just an aside)
- wrs 1y ago
  Similarly, on the original Macintosh one of the mouse axis encoders was connected to the carrier detect pin of the serial port chip. Thus, in early versions of the OS, if you closed the serial driver, the mouse would only move horizontally (or was it vertically?).
msk-lywenn 1y ago
I highly recommend watching the deconstructing xbox talk. It gets very funny. https://m.youtube.com/watch?v=9NqLljaHc80 https://m.youtube.com/watch?v=9NqLljaHc80
heraldgeezer 1y ago
What a machine. Would have liked to see PS2 games maxed out on XBOX if possible. Imagine RE4/FFXII versions of those games on xbox? Still, Halo 2 legendary is unmatched.
486sx33 1y ago
[dead]
junon 1y ago
Building an operating system currently. This isn't just Xbox, we still have to do this in bootloaders.

106 points by mattweinberg 1y ago

I was confused as to why Xbox would ever enable a feature intended for backwards compatibility with systems it does not need to be compatible with. Especially at boot time. Turns out it did not; this apparently required a hardware modification to pull off. https://xboxdevwiki.net/Exploits#A20M.23_hack https://xboxdevwiki.net/Exploits#A20M.23_hack

deleted 1y ago

[deleted]

userbinator 1y ago

For those wondering what software depended on A20 wraparound, there is this interesting series of articles: https://www.os2museum.com/wp/who-needs-the-address-wraparound-anyway/ https://www.os2museum.com/wp/who-needs-the-address-wraparoun... https://www.os2museum.com/wp/the-a20-gate-it-wasnt-wordstar/ https://www.os2museum.com/wp/the-a20-gate-it-wasnt-wordstar/ https://www.os2museum.com/wp/exepack-and-the-a20-gate/ https://www.os2museum.com/wp/exepack-and-the-a20-gate/ https://www.os2museum.com/wp/the-a20-gate-fallout/ https://www.os2museum.com/wp/the-a20-gate-fallout/

bigstrat2003 1y ago
It's always blown my mind that software would depend on that behavior. What possessed people to do that? It's very obviously a bad idea.
- toast0 1y ago
  If the system behavior is defined to wrap around, using defined system behavior to reduce code complexity makes perfect sense. This was in an era where new computer systems usually meant throwing away all the existing software and rewriting it (or doing a fresh port anyway). Why would you assume someone would extend the system and cause trouble.
- rasz 1y ago
  Im blown away at how small a number of software depended on the wraparound and IBM still forced A20 hack on us all.

mjg59 1y ago

A20 bugs were still with us until at least 2009, when I tripped over one: https://mjg59.livejournal.com/118098.html https://mjg59.livejournal.com/118098.html . I love the visualisations in this post, it makes it much clearer what's actually going on.

diffuse_l 1y ago
Indeed, more than you ever wanted to know about the A20 line: https://aeb.win.tue.nl/linux/kbd/A20.html https://aeb.win.tue.nl/linux/kbd/A20.html (from your article) This is one hell of a rabbit hole...

LongjumpingCat 1y ago

[flagged]

endlessvoid94 1y ago
Same. I modded my original Xbox back in the day. It was a lot of fun and I learned a lot.
ljf 1y ago
As an FYI to others, it appears this account (and others in this thread) might be a bot.
- glimshe 1y ago
  I didn't notice it at first but once you said it, it became obvious. There is a cheesiness to LLM comments that is hard for humans to emulate... Although it's still plausible that a person would say something like that.
  - ljf 1y ago
    I'll be honest, I upvoted it at first, and it was only when I saw the 2nd very similar post here and then went into their cookie cutter post histories.

OkPin 1y ago

What really caught my attention is how this marketing snippet highlights the tension between authenticity and polish in gaming culture. Xbox was trying to hit that sweet spot, it wanted to feel edgy and gamer-friendly but the copy ended up sounding like corporate speak.

eddythompson80 1y ago
This is a bot, right? Same with all the new accounts commenting completely unrelated things?
- cebert 1y ago
  Based on this post and others, it looks like a spammy account to me.

messe 1y ago

Something this article doesn't mention is how the A20 gate was toggled: by writing to registers on the keyboard controller. I was always thought this was a completely inexplicable design choice, until I started working in embedded, working with hardware engineers, and having to go through schematics myself. I now entirely understand the choice of wanting to minimize the redesign work and going with the one free pin available (our product has made similar choices too at this stage).

st_goliath 1y ago
The original IBM PC used an Intel 8048 microcontroller inside the keyboard and an 8255 I/O controller on the main board to communicate with the keyboard. The PC AT (which had an 80286), later replaced the 8255 with an 8042 microcontroller too. It was running firmware, so re-purposing it for a Hodge-poge of other tasks became trivial. A single GPIO pin was used for masking the A20 line and another for handling CPU reset. Having a total of 24 programmable I/O lines, I guess this could have been done with the 8255 too, but the microcontroller probably allowed simpler interfacing with the CPU and bought them more flexibility for future expansion. For the article, this is mostly irrelevant. As somebody else noted, the Xbox wasn't supposed to be able to toggle/mask the A20 line, but later x86 CPUs had already integrated the A20 masking feature into the CPU itself and exposed an A20 control line. The Xbox simply tied the A20 enable line to a fixed potential, the hack described in the article requires a simple hardware modification to change that (https://xboxdevwiki.net/File:Haxar-a20m.jpg https://xboxdevwiki.net/File:Haxar-a20m.jpg).
- privatelypublic 1y ago
  Linux kernel still has the option to try and use the keyboard to reset the system while rebooting. (Just an aside)
wrs 1y ago
Similarly, on the original Macintosh one of the mouse axis encoders was connected to the carrier detect pin of the serial port chip. Thus, in early versions of the OS, if you closed the serial driver, the mouse would only move horizontally (or was it vertically?).

msk-lywenn 1y ago

I highly recommend watching the deconstructing xbox talk. It gets very funny. https://m.youtube.com/watch?v=9NqLljaHc80 https://m.youtube.com/watch?v=9NqLljaHc80

heraldgeezer 1y ago

What a machine. Would have liked to see PS2 games maxed out on XBOX if possible. Imagine RE4/FFXII versions of those games on xbox? Still, Halo 2 legendary is unmatched.

486sx33 1y ago

[dead]

junon 1y ago

Building an operating system currently. This isn't just Xbox, we still have to do this in bootloaders.