Back in October of last year, scene enthusiast "Grimdoomer" discovered a potential hypervisor exploit for the Xbox 360. Existing mostly as a proof-of-concept softmod, Grimdoomer planned to detail the process and release the exploit, called BadUpdate. Now, that exploit has been made available, and works on any Xbox 360 model, on the latest software update, running dashboard version 17559. This allows you to softmod a 360 console without any hardware modifications, and can run unsigned code. However, BadUpdate is not persistent, and must be reapplied upon every console reboot.
In order to use the exploit, you'll need a copy of either Rockband Blitz's demo or Tony Hawk's American Wasteland and a Fat32 formatted USB. It can also take up to 20 minutes to trigger the hypervisor exploit. Due to the nature of the exploit, BadUpdate requires particular timing in order to execute, and it might take a few reboots to get it successfully working.
With this release, Grimdoomer has announced that he will be retiring from the 360 scene, having learned all that he wanted to.
If you're interested in the full write up of the exploit, you can find it linked below, as well as the GitHub repository for BadUpdate.
The Xbox 360 hypervisor is a very secure piece of code that’s backed by hardware security features and has a single purpose: preventing the console from being hacked. This presents the following challenges to attackers:
- The hypervisor has very little attack surface for finding bugs in.
- The attack surface that’s available performs heavy validation of all data and parameters being provided from kernel mode.
- All communications with other devices on the motherboard are performed by the kernel.
- The hypervisor doesn’t do any parsing of data that comes from these devices (DVD drive, HDD, network port, USB, etc.).
- Hypervisor memory is protected with encryption and integrity checks.
- This makes it very difficult to perform memory corruption attacks.
- The hypervisor almost never accesses memory that’s not protected.
:arrow:
Source
:arrow:
BadUpdate blog post
:arrow:
Download
:arrow:
Discussion Thread
