Skip to content

Commit dc4deac

Browse files
gaasedelengaasedelen
committed
adds ENDGAME v1.0
1 parent 676f407 commit dc4deac

File tree

6 files changed

+989
-0
lines changed

6 files changed

+989
-0
lines changed

‎.gitignore

+4
Original file line numberDiff line numberDiff line change
@@ -158,3 +158,7 @@ cython_debug/
158158
# and can be added to the global gitignore or merged into this file. For a more nuclear
159159
# option (not recommended) you can uncomment the following to ignore the entire idea folder.
160160
#.idea/
161+
162+
# ignore ENDGAME build files
163+
shellcode
164+
/ENDGAME

‎LICENSE

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2024 Markus Gaasedelen
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md

+99
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
# ENDGAME - A Dashboard Exploit for the Original Xbox
2+
3+
<p align="center">
4+
<img src="https://github.com/XboxDev/endgame-exploit/assets/9522648/84c9890a-0d57-4d32-bcd6-d43ff8738ebf">
5+
</p>
6+
7+
## Overview
8+
9+
ENDGAME is a universal dashboard exploit for the original [Microsoft Xbox](https://en.wikipedia.org/wiki/Xbox_(console)). This exploit has been carefully engineered to be compatible across all retail kernel and dashboard versions released for the original Xbox. It does not require a game, or even a working DVD drive -- *only a memory card.*
10+
11+
Special credit belongs to [@shutterbug2000](https://twitter.com/shutterbug20002) for the initial discovery of this vector within the dash and the first to demonstrate code execution against it. With further research, ENDGAME was developed by [@gaasedelen](https://twitter.com/gaasedelen) leveraging an adjacent vulnerability that offered greater control and facilitated a more ubiquitous exploitation strategy.
12+
13+
## Disclaimer
14+
15+
**This project does NOT use any copyrighted code, or help circumvent security mechanisms of an Xbox console.** Upon success, ENDGAME will launch a [habibi](http://toogam.bespin.org/xboxmod/site/signxbe.htm)-signed XBE from the root of the memory card. It does not patch kernel code or allow you to launch retail-signed executables.
16+
17+
By using this software, you accept the risk of experiencing total loss or destruction of data on the console in question.
18+
19+
## Building
20+
21+
The exploit files can be generated from scratch using Python 3 + NASM on Windows.
22+
23+
Example usage is provided below:
24+
25+
```bash
26+
python main.py
27+
```
28+
29+
Successful output should look something like the following:
30+
31+
```
32+
[*] Generating ENDGAME v1.0 exploit files -- by Markus Gaasedelen & shutterbug2000
33+
[*] Assembling shellcode... done
34+
[*] Un-swizzling payload... done
35+
[*] Compressing payload... done
36+
[*] Saving helper files... done
37+
[*] Saving trigger files... done
38+
[+] Success, exploit files available in ENDGAME/ directory
39+
```
40+
41+
A pre-built zip of the exploit and sample payload XBE is available on the [releases](https://github.com/XboxDev/endgame-exploit/releases) page of this repository.
42+
43+
## Usage
44+
45+
Copy the contents of the generated `ENDGAME/` directory to a Xbox memory card such that the root directory of the memory card has the following structure, where `payload.xbe` can be any [habibi](http://toogam.bespin.org/xboxmod/site/signxbe.htm)-signed XBE of your choosing:
46+
47+
```bash
48+
/helper/
49+
/trigger/
50+
/payload.xbe
51+
```
52+
53+
To trigger the exploit, plug the memory card into a controller and navigate to it while in the dashboard.
54+
55+
<p align="center">
56+
<img src="https://github.com/XboxDev/endgame-exploit/assets/9522648/d4701947-8174-4186-ae27-affd8a7778b8">
57+
</p>
58+
59+
After a few seconds, the system should begin cycling the front LED to green/orange/red to indicate success. This is followed by it launching the `payload.xbe` placed on the memory card.
60+
61+
# FAQ
62+
63+
#### Q: Is this a softmod?
64+
65+
* *A: No, by itself, ENDGAME is not a softmod. But it will make softmodding significantly more accessible as the community integrates it into existing softmod solutions.*
66+
67+
#### Q: What is new about this exploit?
68+
69+
* *A: This exploit will enable people to softmod any revision of the original Xbox without needing a specific game. It will also allow people to easily launch a homebrew XBE (such as the [Insignia setup assistant](https://insignia.live/connect), or content scanning tools) by simply inserting a memory card into an unmodded Xbox.*
70+
71+
#### Q: I don't have a memory card, can I use something else?
72+
73+
* *A: Yes, any FATX-formatted compatible USB device and controller port dongle should work.*
74+
75+
#### Q: Why am I getting Error 21 after placing my own XBE on the memory card?
76+
77+
* *A: Your XBE must be signed using the [habibi](http://toogam.bespin.org/xboxmod/site/signxbe.htm) key. Several tools can do this, `xbedump` being the most popular.*
78+
79+
#### Q: Why does my habibi-signed XBE result in a black screen with ENDGAME but not on a modded xbox?
80+
81+
* *A: The most common explanation is that your XBE may be using the Debug/XDK __kernel thunk__ & __entry point__ [XOR keys](https://xboxdevwiki.net/Xbe) rather than the retail ones, resulting in a crash.*
82+
83+
#### Q: I triggered ENDGAME but my system quickly rebooted to the dash rather than my XBE...
84+
85+
* *A: While this should be uncommon, it means the exploit probably crashed. It's recommended to navigate straight to the memory card on a cold boot for successful exploitation.*
86+
87+
#### Q: My XBE requires multiple files and external assets to run, will it work with ENDGAME?
88+
89+
* *A: No. Currently, ENDGAME is only structured to copy & execute a standalone XBE.*
90+
91+
#### Q: How does this exploit work?
92+
93+
* *A: The exploit targets an integer overflow in the dashboard's handling of savegame images. When the dash attempts to parse the specially crafted images on the memory card, ENDGAME obtains arbitrary code execution.*
94+
95+
# Authors
96+
97+
* shutterbug ([@shutterbug2000](https://twitter.com/shutterbug20002)), discovery and initial exploitation efforts
98+
* Markus Gaasedelen ([@gaasedelen](https://twitter.com/gaasedelen)), root-cause-analysis & ENDGAME development
99+
* xbox7887 ([@xbox7887](https://twitter.com/xbox7887)), minor contributions and assistance with testing

0 commit comments

Comments
 (0)