Skip to content

Commit 5384eea

Browse files
InvoxiPlayGamesInvoxiPlayGames
committed
xbox support! rop chain generator for all 7 kernels
1 parent bacc2ca commit 5384eea

File tree

4 files changed

+310
-47
lines changed

4 files changed

+310
-47
lines changed

‎.gitignore

+1-2
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,8 @@
33
*.elf
44
*.o
55
ernie
6-
# wip shellcode
7-
*.asm
86
# output artifacts
7+
savegame
98
*.gci
109
*.xsv
1110
*.xbx

‎README.md

+74-12
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,60 @@
11
# robohaxx: stackcry
22

3-
A savegame exploit / homebrew entrypoint for the game Robotech: Battlecry on the GameCube.
3+
A savegame exploit / homebrew entrypoint for the game Robotech: Battlecry on the GameCube and Xbox.
44

5-
Compatible with both USA and EUR revisions of the game. (Only USA has been tested on real GC hardware.)
5+
Compatible with both USA and EUR revisions of the game, and all 7 retail Xbox kernels. (Untested)
66

77
["it's a stack overflow in the profile name on a 6th gen console game"](https://tenor.com/view/buzz-lightyear-factory-you-will-never-find-another-store-shelf-a-bunch-of-buzz-lightyears-gif-21719996) (Tenor GIF link)
88

9-
## How to Use
10-
11-
1. Copy the .gci file for your region from [the robohaxx releases page](https://github.com/InvoxiPlayGames/robohaxx/releases)
9+
## How to Use (Xbox)
10+
11+
1. Get the kernel version from your Xbox using the dashboard.
12+
* Go to Settings -> System Info, then read the value that says **K** (e.g. K:1.00.**5530**.01, bold is the important part).
13+
* *The part that says "D" is the dashboard version, and does not matter!*
14+
2. Download the .zip file for your region and kernel version from [the robohaxx releases page](https://github.com/InvoxiPlayGames/robohaxx/releases/tag/release-xbox-1.0)
15+
and extract the contents, then copy it to an Xbox formatted USB drive using a tool like Xplorer360.
16+
* If using Rocky5's softmod tool, you also want to have the "Softmod Save" from [Rocky5's Xbox Softmodding Tool](https://github.com/Rocky5/Xbox-Softmodding-Tool/blob/master/README.md)
17+
copied to the USB drive as well. This file is in the "Softmod Package" folder in the downloaded Xbox Softmodding Tool ZIP file.
18+
* If not using the Rocky5 softmod tool, replace the "default.xbe" in the files you extracted with whatever you're using.
19+
3. On the Xbox dashboard, connect your USB drive and copy the robohaxx savegame as well as the Xbox Softmodding Tool.
20+
* Ensure there are **NO** other savegames for Robotech: Battlecry on the hard drive.
21+
* While you're here, double check that the kernel version and region on the save file match your console.
22+
4. Launch Robotech: Battlecry.
23+
5. At the main menu, select the "Load Game" option.
24+
6. After a few seconds, the Xbox Softmodding Tool (or anything else you decide to load) *should* load!
25+
* The light on your Xbox will blink and change colour. This is expected and normal.
26+
27+
## How to Use (GameCube)
28+
29+
1. Copy the .gci file for your region from [the robohaxx releases page](https://github.com/InvoxiPlayGames/robohaxx/releases/tag/release-1.0)
1230
to your Memory Card using [GCMM](https://github.com/suloku/gcmm/releases).
1331
* While you're here, make sure you have the latest Swiss boot GCI, too. (Or any other boot.dol.)
1432
* Ensure there are **NO** other savegames for Robotech: Battlecry on the memory card.
1533
2. Launch Robotech: Battlecry.
1634
3. At the main menu, select the "Load Game" option.
17-
4. Afetr a few seconds, Swiss (or any other homebrew) *should* load!
35+
4. Aetfer a few seconds, Swiss (or any other homebrew) *should* load!
1836

1937
## Credits
2038

39+
### Xbox
40+
41+
Thank you to [agarmash](https://github.com/agarmash) for the clean writeup on his [Frogger Beyond exploit](https://github.com/agarmash/FroggerBeyondExploit),
42+
as well as assistance and motivation in building this, and the modified "ernie" shellcode.
43+
44+
Thank you to the NKPatcher developer(s) for the base of the shellcode used in the exploit, and thanks to [Rocky5](https://github.com/Rocky5)
45+
for the Xbox Softmodding Tool.
46+
47+
Shoutouts to the helpful folks in the XboxDev Discord server for pointers and guidance in putting this together.
48+
49+
### GameCube
50+
2151
Thank you to [FIX94](https://github.com/FIX94) for the gc-exploit-common-loader DOL loader, and for
22-
example code for memory card loaders in other GC savegame exploits.
52+
example code for memory card loaders in other GameCube savegame exploits.
2353

24-
Thanks to [Essem](https://github.com/TheEssem) for testing on real hardware, and being the inspiration behind this
25-
[by just wanting a way to launch Swiss that isn't Animal Crossing.](https://wetdry.world/@esm/110792836912696997)
54+
Thanks to [Essem](https://github.com/TheEssem) for testing on real GameCube hardware, and being the inspiration behind
55+
this discovery [by just wanting a way to launch Swiss that isn't Animal Crossing.](https://wetdry.world/@esm/110792836912696997)
2656

27-
## Building from Source
57+
## Building from Source (GameCube)
2858

2959
The source has two components, the memory card loader and the GCI builder. The memory card loader will
3060
build if you have devkitPPC installed (although any powerpc-eabi GCC will work, change the Makefile).
@@ -36,10 +66,42 @@ compile the GCI builder, and then build the robohaxx GCI savefiles. Type `make`
3666

3767
If you only want to build for a specific region, type `make usa` or `make eur`.
3868

69+
## Building from Source (Xbox)
70+
71+
The Xbox source consists of the modified "ernie" shellcode and the XSV builder. The ernie shellcode requires
72+
the NASM assembler, while the XSV builder requires a C build system installed.
73+
74+
First, open a Terminal **in the xbox_src directory.** To build the ernie shellcode, run `nasm ernie.asm`, and to
75+
build the XSV builder, run `make`. It should build on macOS, Linux/WSL, and MingW64 on Windows.
76+
77+
The resulting game.xsv file can be created by typing `./xsv_builder ernie E 5530`, replacing E with U if
78+
targeting the USA version of the game, and 5530 with a supported target kernel version. If using another payload,
79+
replace "ernie" with the filename, and if using a custom set of offsets, provide the filename in place of the
80+
kernel version.
81+
82+
Supported kernels are 3944, 4034, 4817, 5101, 5530, 5713 and 5838, which should cover all retail kernels.
83+
Note that kernels 5530, 5713 and 5838 use the same ROP offsets - the output savegame will be identical.
84+
85+
Additional support is left over for the unofficial 4627 debug kernel. Unsupported/unofficial/debug kernels can
86+
be supported - if you use a tool such as ROPper to find offsets to identical gadgets in xboxkrnl.exe, you can
87+
create a file containing the raw addresses in binary little-endian format according to this structure:
88+
89+
```c
90+
typedef struct _ROPStringGadgets {
91+
uint32_t pop_eax__ret_4; // ("pop eax; ret 4;")
92+
uint32_t pop_ecx__pop_ebx__ret_4; // ("pop ecx; pop ebx; ret 4;")
93+
uint32_t xor_eax_ecx__ret; // ("xor eax, ecx; ret;")
94+
uint32_t jmp_eax; // ("jmp eax;")
95+
} ROPStringGadgets;
96+
```
97+
3998
## License
4099

41-
The GameCube memory card loader and GCI builder are licensed under the GNU General Public License version 2. See attached
100+
The memory card loader, GCI builder and XSV builder are licensed under the GNU General Public License version 2. See attached
42101
LICENSE file for more details.
43102

44-
The GameCube chain uses FIX94's [gc-exploit-common-loader](https://github.com/FIX94/gc-exploit-common-loader), also licensed
103+
The GameCube chain uses FIX94's [gc-exploit-common-loader](https://github.com/FIX94/gc-exploit-common-loader), licensed
45104
under GPLv2.
105+
106+
The Xbox chain uses a variation of [NKPatcher](https://github.com/Rocky5/Xbox-Softmodding-Tool/tree/master/App%20Sources/NKPatcher/Main%20NKP11)'s
107+
shellcode in `ernie.asm`, licensed under GPLv2. If this attribution is incorrect, please get in touch.

‎xbox_src/ernie.asm

+101
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
2+
; Modified ernie.asm shellcode for robohaxx
3+
; Originally modified from: https://github.com/agarmash/FroggerBeyondExploit/blob/master/source/savefile.asm
4+
; which was modified from https://github.com/Rocky5/Xbox-Softmodding-Tool/blob/master/App%20Sources/NKPatcher/Main%20NKP11/ernie.asm
5+
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
6+
7+
BITS 32
8+
base:
9+
mov ebp, eax ; Set the EBP to point to the beginning of the exploit (ROP chain makes eax the start address!)
10+
cld ; Clear the Direction Flag so the string instructions increment the address
11+
mov esi,80010000h ; Kernel base address
12+
mov eax,[esi+3Ch] ; Value of e_lfanew (File address of new exe header)
13+
mov ebx,[esi+eax+78h] ; Value of IMAGE_NT_HEADERS32 -> IMAGE_OPTIONAL_HEADER32 -> IMAGE_DATA_DIRECTORY -> ibo32 (Virtual Address) (0x02e0)
14+
add ebx,esi
15+
mov edx,[ebx+1Ch] ; Value of IMAGE_DIRECTORY_ENTRY_EXPORT -> AddressOfFunctions (0x0308)
16+
add edx,esi ; Address of kernel export table
17+
lea edi,[ebp+kexports-base] ; Address of the local kernel export table
18+
getexports:
19+
mov ecx,[edi] ; Load the entry from the local table
20+
jecxz .done
21+
sub ecx,[ebx+10h] ; Subtract the IMAGE_DIRECTORY_ENTRY_EXPORT -> Base
22+
mov eax,[edx+4*ecx] ; Load the export by number from the kernel table
23+
test eax,eax
24+
jz .empty ; Skip if the export is empty
25+
add eax,esi ; Add kernel base address to the export to construct a valid pointer
26+
.empty:
27+
stosd ; Save the value back to the local table and increment EDI by 4
28+
jmp getexports
29+
.done:
30+
blinkled: ; https://xboxdevwiki.net/PIC#The_LED
31+
mov edi,[ebp+HalWriteSMBusValue-base]
32+
push 0D7h ; Red-orange-green-orange LED sequence
33+
push byte 0
34+
push byte 8
35+
push byte 20h
36+
call edi
37+
push byte 1
38+
push byte 0
39+
push byte 7
40+
push byte 20h
41+
call edi
42+
patchpublickey:
43+
mov ebx,[ebp+XePublicKeyData-base] ; The structure and location of the RSA key hasn't been changed between the kernel versions, no need to search for anything
44+
pushf ; Enter the critical section, more details here:
45+
cli ; https://lkml.iu.edu/hypermail/linux/kernel/9703.0/0060.html
46+
mov eax,cr0
47+
mov ecx, eax
48+
and ecx,0FFFEFFFFh ; Clear the Write Protect bit
49+
mov cr0,ecx
50+
mov ecx, cr3 ; Invalidate TLB to defeat possible implicit caching. Done to make sure that no unpatched code is executed speculatively.
51+
mov cr3, ecx ; See Intel Software Dev Manual Vol. 3A, 11.7 Implicit Caching
52+
xor dword [ebx+110h],2DD78BD6h ; Alter the last 4 bytes of the public key
53+
mov cr0, eax ; Restore the original value
54+
wbinvd ; Flush the CPU caches
55+
mov ecx, cr3 ; Invalidate TLB once again, just in case
56+
mov cr3, ecx
57+
popf ; Leave the critical section
58+
launchxbe: ; Quite similar to https://github.com/XboxDev/OpenXDK/blob/master/src/hal/xbox.c#L36
59+
mov esi,[ebp+LaunchDataPage-base] ; https://xboxdevwiki.net/Kernel/LaunchDataPage
60+
mov ebx,[esi]
61+
mov edi,1000h
62+
test ebx,ebx ; Check the LaunchDataPage pointer
63+
jnz .memok ; Jump if it's not NULL
64+
push edi
65+
call dword [ebp+MmAllocateContiguousMemory-base] ; Otherwise, allocate a memory page
66+
mov ebx,eax ; And store the pointer to the allocated page in EBX
67+
mov [esi],eax ; Store the pointer back to the kernel as well
68+
.memok:
69+
push byte 1
70+
push edi
71+
push ebx
72+
call dword [ebp+MmPersistContiguousMemory-base]
73+
74+
mov edi,ebx
75+
xor eax,eax
76+
mov ecx,400h
77+
rep stosd ; Fill the whole LaunchDataPage memory page (4096 Bytes) with zeros
78+
79+
or dword [ebx],byte -1 ; Set LaunchDataPage.launch_data_type to 0xFFFFFFFF
80+
mov [ebx+4],eax ; Set LaunchDataPage.title_id to 0
81+
lea edi,[ebx+8] ; Copy the address of LaunchDataPage.launch_path string
82+
lea esi,[ebp+xbestr-base]
83+
push byte xbestrlen
84+
pop ecx
85+
rep movsb ; Copy the executable path to the LaunchDataPage.launch_path
86+
push byte 2 ; 2 stands for ReturnFirmwareQuickReboot
87+
call dword [ebp+HalReturnToFirmware-base]
88+
.inf:
89+
jmp short .inf
90+
91+
kexports:
92+
HalReturnToFirmware dd 49
93+
HalWriteSMBusValue dd 50
94+
LaunchDataPage dd 164
95+
MmAllocateContiguousMemory dd 165
96+
MmPersistContiguousMemory dd 178
97+
XePublicKeyData dd 355
98+
dd 0
99+
xbestr:
100+
db '\Device\Harddisk0\Partition1\UDATA\544d0002\8DEDAC5BF7EA;default.xbe',0
101+
xbestrlen equ $-xbestr

0 commit comments

Comments
 (0)