Free60

Free60 is the successor to the Xbox Linux Project that aims to put Linux, BSD, or Darwin on the Microsoft Xbox 360 using a software or hardware based "hack". The Xbox 360 uses hardware encryption and will not run unsigned code out of the box.

The project's goals were met in March 2007, when shortly after the announcement of a critical software vulnerability [Bugtraq: Xbox 360 Hypervisor Privilege Escalation Vulnerability http://seclists.org/bugtraq/2007/Feb/0514.html] in the Xbox 360 Hypervisor a loader for Linux appeared, which allowed to run a Linux ported to the Xbox 360.

To date, there are two Linux kernel patchsets available, one for 2.6.21 and one for 2.6.24.3. Three main Linux distributions may be run on the Xbox 360; Gentoo, Debian and Ubuntu Linux, the last two of which are easily installable to the Xbox 360 hard drive by scripts provided by members of the Free60 project. [Debian-Etch Installation Guide http://www.free60.org/wiki/Debian-etch] [Ubuntu 7.04 Installation Script http://www.free60.org/wiki/Ubuntu7.04] [Ubuntu 7.10 Installation Script http://www.free60.org/wiki/Ubuntu7.10]

Execution Method

Due to the fact that executable code on the Xbox 360 is digitally signed, and runs underneath a hypervisor, an exploit or hack is necessary in order to execute homebrew code. On the Xbox 360, one such exploit exists, relying on and utilizing a modified DVD-ROM drive firmware, a modified burnt disc of the game (for Xbox 360), and the target console having either one of two vulnerable Kernel revisions. Optionally, a home-made serial cable may be used where attached to the appropriate pin header on the motherboard of the console. [Speedy22's Headers and Connectors Tech Info http://www.dave-bell.co.uk/~speedy22/XBOX360cpu15data.pdf]

The console must launch the modified game, which will utilize the software vulnerability to load a small chunk of code that is included on the disc. This code may either initialize the serial port to allow upload of further code to the console, or eject the drive tray and prepare the console to load further code from a specified point on optical media that is then placed in the drive. The latter method involves the readcd binary, made specifically for this cause. The code that readcd executes in this instance is known as XeLL, short for Xenon Linux Loader. XeLL captures CPU threads and launches the Linux kernel from either network (tftp) or optical media as its only purpose, providing a flat device tree for the kernel. In the cases of released 'Live CDs', the readcd binary would typically be included on the modified game disc, which would eject the drive, and a CD containing the XeLL binary as well as the complete Linux kernel and filesystem would be inserted.

Limitations

* The readcd method was initially restricted to only Hitachi branded DVD-ROM drives, but now also supports Samsung branded drives. [Gentoo Live CD Xenon Beta 2 Release Notes http://sourceforge.net/project/shownotes.php?group_id=139616&release_id=506402] All other commercially used drives are assumed unsupported, at this point in time the only other make of drive in use is manufactured by BenQ.
* An older version of the game King Kong is needed, as following the publicity of the exploit, which used an unsigned shader file in the game, Microsoft has released all newer versions of the disc as patched, so that the exploit will not work when based on these new discs.
* An older Kernel revision is required on the Xbox 360 itself, which may prove to be hard to find, since connecting to the Xbox Live service applies updates to the console, and many games include updates that must be applied before the game will run. This limitation is not as important as it once was, as it is now known to be possible to downgrade a Kernel greater than the last of the two exploitable Kernels by means of a timing attack.
* There are presently no audio drivers written to support the console's internal audio hardware, however a USB audio device can be used.
* Some codecs are incompatible with the current display driver, causing some videos to not play. In addition to this, framebuffer and cache issues mean that videos that do play are jumpy after the first few seconds when the cache is full.

Development

One of the main contributors to the Free60 project has developed a method of 3D graphics acceleration on the Xbox 360's GPU (codenamed Xenos) under Linux. [ [http://debugmo.de/?p=32 debugmo.de » fancy ] ] [ [http://debugmo.de/?p=38 debugmo.de » Fear, triangles! ] ] [ [http://debugmo.de/?p=65 debugmo.de » Xbox 360 GPU update ] ] This work has been encapsulated into an API for easier use. In order to achieve this acceleration, some data from the Xbox 360's flash needs to be uploaded to the Xenos GPU. This process may be automated to help ensure legality of any 3D graphics acceleration.

Since only a small proportion of Xbox 360's are currently able to execute unsigned code, there has been little development within the Free60 project in recent times. This may to some extent be contrasted to the Free60 predecessor, the Xbox Linux project, which saw far more development as a result of the relative ease of running unsigned code on the Xbox and the ease of porting x86 code to the Xbox's custom Intel Pentium III-based CPU.

To continue development, members of the Free60 project are looking for help. [Free60 Help http://www.free60.org/wiki/Help] Perhaps the most important of the help requests is to provide audio drivers; the Free60 members have asked for someone with knowledge of the ALSA kernel component and a SiS966 based motherboard to achieve this.

One project created as a result of the success of Free60 is a Kernel Rebooter. [Kernel Rebooter http://www.xboxhacker.net/index.php?topic=8738.0] The goal of this is, after initially loading a vulnerable kernel and exploiting it to gain control of the system, to be able to make the console reload into a modified, unsigned hypervisor and kernel. Being able to reboot into a more recent kernel revision would allow for games to be executed on the console that are dependent on these kernel revisions. This project has seen a certain level of success; there is binary files available (to be launched by the serial loader or readcd) to partially reload the hypervisor.

External links

* [http://www.free60.org/ free60.org]

References