How the Xbox 360 Console Detects Fake Hard Drives
In 2005, the Xbox 360 console was released as two models: Core and Pro. The Core was a cheap model that allowed you to run games from an optical disc, while the Pro contained a 20 GB hard drive, which at the time was more than enough to store downloadable content and other additional information. The hard drive has always been an optional accessory, but has quickly become a necessity for gamers who want to save their profiles and download content from Xbox Live. The downside was that Xbox 360-branded hard drives were expensive. At the time of the console’s release, a 20 GB drive cost $99! According to the old
November 2005 AnandTech Pricing Guide
, for $57 you could buy an 80 GB hard drive for a PC. The Xbox 360 drive sold at a steep premium.
Modders began to explore the possibility of using third-party hard drives to get a lot of storage cheaply. Unfortunately, they soon found out that this problem cannot be solved so simply.
Kernel Mode Authentication
Each genuine Xbox 360 hard drive stored in sector 16, called the “protection sector”, a unique piece of data containing the following information:
Protection sector data is handled by a kernel function called
SataDiskAuthenticateDevice
. In IDA it looks like this:
Decompiled version:
The function is relatively simple. It starts with a call
IoSynchronousFsdRequest
. This feature has been carried over from the original Xbox console and is not found on Windows. Basically, it executes an asynchronous I/O request and then waits for it to complete. In this case, this is a request to read sector 16:
After executing this function
Buffer
will contain the protection sector data, and if the read fails, the console will display an E69 error screen. This happens only when the drive is very badly connected or it starts to fail.
When the protection sector is in memory, authentication is performed. All hard drives report serial number, firmware version and model number within the IDE_COMMAND_IDENTIFY_DEVICE command. The data reported by the disk firmware is compared with that stored in the protection sector. This is done with a special helper function called SataDiskEqualAuthenticationStringswhich essentially works like memcmp (a function that checks for byte equality).
If any of these three lines does not match, then the check is considered failed. Perhaps you thought that it should be very easy to just change the protection sector so that it matches the data in the disk firmware reports? Unfortunately, the entire security sector is signed with RSA using a private key that only Microsoft has. This means that if you change the protection sector so that it matches the information in the disk firmware, it will not pass the cryptographic check. Here is the RSA signature verification:
Ways to solve the problem
If you don’t want to buy a genuine Microsoft Xbox 360 hard drive, there are two ways to solve it.
1.HDDHackr
Since the protection sector cannot be changed to match the drive’s firmware information, the only possible solution is to change the drive’s firmware to match the protection sector. That’s how it was created
is an MS-DOS application that updates the firmware of Western Digital drives in such a way as to pass them off as others. For example, if the protection sector says that the drive was created by Hitachi, HDDHackr changes the drive’s firmware to pass the information to Hitachi.
However, the HDDHackr hack has its limitations:
- It is no longer supported and only works on older PC hardware.
- There are reports that it does not work well with newer versions of Western Digital drives.
- It does not allow you to connect drives larger than 500 GB. The protection sector limits the number of addressable sectors, and Microsoft officially released hard drives with a maximum capacity of 500 GB.
2. Console Modding
When it became possible to mod Xbox 360 consoles with JTAG and RGH hacks, authentication and hard drive size limits were among the first to be patched. After eliminating the checks, it became possible to connect, format in a dashboard and use any hard drive up to 2 TB. However, these hacks require hardware modifications and during the modding process you have to give up access to Xbox Live.
Microsoft knows about your hacked hard drive
If you have used HDDHackr, then you need to download a genuine protection sector from the Internet to use your hard drive. For example, when the 500 GB HDD was released in 2014, the modding community
quickly published the protection sector
to allow users to create their own 500 GB hard drives. What most people didn’t realize, however, was that Microsoft had been collecting information about users’ hard drives all along. Specifically, when connecting to Xbox Live, the following information was intermittently transmitted in response to a Microsoft security challenge:
- Serial number
- Firmware version
- Model number
- User Addressable Sectors
Microsoft knows about every Xbox Live-connected console that has an HDDHackr processed drive connected to it, as it sees tens of thousands of consoles using the same hard drive. Protection sectors are unique and can be used to identify a hard drive. Xbox 360 hard drives can be used on different consoles, so if Microsoft sees multiple consoles using the same hard drive, it won’t be a red flag, but if hundreds or thousands of consoles report using the same hard drive at the same time, it’s fairly obvious that they have cracked hard drive installed.
Microsoft could ban consoles for using a fake hard drive, but there was no evidence that this ever happened.
Logo check
If you carefully study the structure
HDD_SECURITY_BLOB
at the beginning of the article, you might have noticed
LogoBitmapDigest
. Immediately after the protection sector, in sector 17, there is a PNG image of the old Microsoft logo:
Fun fact: Based on the metadata embedded in the image, it was created in Macromedia Fireworks MX 2004 on July 19, 2005. The Xbox 360 was released on November 22 of the same year. After examining samples of both old and new protection sectors, I came to the conclusion that this particular image was used in each protection sector of every hard drive that was sold.
The logo is used when displaying the drive in the Xbox 360 dashboard:
Microsoft cared so much about their logo that they hashed it with SHA1. This hash is signed by RSA in the security sector, so it is not possible to change the hash or the logo.
Perhaps Microsoft was thinking about allowing third-party manufacturers to sell hard drives for the Xbox 360 under their own brands, as Seagate is now selling Xbox Series X|S Expansion Cards. Presumably, the Microsoft logo was supposed to be replaced with a third-party logo. But all this is just a hypothesis: perhaps Microsoft just wanted the user to feel confident knowing that he bought a genuine accessory.
Logo Entertainment
On a modded console, you can replace the logo with any image, since cryptographic checks are no longer applied. Below are examples of funny images. Please note, although the HDD is named Retail, you can only change the logo on a modified console. All these are screenshots from a real console, not photoshop!
sad mistakes
The protection sector is located at the beginning of the disk. If you connect the drive to Windows and open Disk Management, it will show up as “Not Initialized” because Windows does not recognize the Xbox 360’s partitioning scheme. A pop-up will also appear asking you to initialize the drive in MBR or GPT format in order to prepare it for partitioning Windows.
Unfortunately, the consequences of clicking OK are disastrous. The protection sector is overwritten by Windows disk partitioning tables. If you don’t make a backup, the hard drive will never work again on an Xbox 360 without modding. I get emails about this all the time and it pains me to tell people that it’s impossible to save the hard drive. This problem has become so common that in 2015 I added to
automatic backup of the protection sector. When launched, the program immediately creates backup copies of protection sectors on all found hard drives. Unfortunately, at the time of this post, this hasn’t saved a single hard drive. Everyone first randomly initializes the disks
before
the first launch of FATXplorer, because of which all disk rescue measures are useless. If you’re still playing on Xbox 360, consider backing up your protection sector!
![[Паттерны API] Asynchrony and time management](https://prog.world/wp-content/uploads/2023/05/ffda31052ac72f457031cc6fbadb3c40-768x403.png)
