@@RadikAlice theoretically you could run a bunch of checks to see if the machine is uefi or not to determine what boot loader to use, and then overwrite the entire first partition (ie C:\ drive under windows) with a live cd esque thing that unpacks an image over itself on boot, like a ramdisk or smth
this is honestly better then King Kong because it required a patched shader and a flashed dvd drive, this on the other hand is basically no clicks required, only copy a save file via usb
@@luxploit yeah i know lol, awesome stuff for being the first of a kind for the 360. Hope this can in some way aid in making a more accessible softmod in the future
the PS2 was a nightmare for devs especially at the start, because Sony thought "devs can just use our vector units to do tons of fast data transfers via DMA so they don't need much memory and we can flex the power of our hardware lol" too bad they never said this to devs and they had to eventually figure that out on their own
I guess RenderWare came into the picture to try and save they day with all the BS that is messing with Vector Units and CPU management. --- RenderWare was one of the most widely used game engines during the PS2 era. Originally developed by Criterion Software, RenderWare was a cross-platform graphics engine that provided a higher-level abstraction over the hardware, making it easier for developers to create games without needing to dive into the low-level complexities of the PS2. RenderWare handled many of the tasks that would otherwise require developers to manually program the VUs, such as 3D rendering, physics, and animation. It became popular for its ease of use and was employed in many high-profile games, including the Grand Theft Auto series, Burnout, and Tony Hawk's Pro Skater.
I shipped a couple of PS2 games. The VU0 and VU1 weren't TOO bad. Yes, people were using Excel spreadsheets for scheduling (to minimize latency / maximize throughput) but you would transfer data from the EE -> VU0 -> VU1 -> GS for rendering. What _really_ made the PS2 challenging was managing all of its SEVEN processors: EE, VU0, VU1, IOP, GS, SPU, and IPU. It was a PITA to get (especially managing DMA transfers) but once you had everything working it was magic. RenderWare was a god send for PC developers who didn't want to waste time learning idiosyncrasies of the system.
And audio enthusiasts loved the PS2 as it was the only console that supported surround at the time and xbox never supported it until the 360. I had family members that obsessed about audio and bought a PS2 because it had optical audio ports and played DVDs and CDs with no issue in full 5.1 surround.
If PS2 has million haters, then Grimdoomer is one of them. If PS2 has one hater, then Grimdoomer is THAT ONE. If PS2 has no haters, that means Grimdoomer is dead.
@tcscomment Overly complex? Maybe. As with all SONY hw, the designers went a bit nuts with SIMD, and in this case, Toshiba did certain things to save space die space and thus $$$. Piece of Garbage? I definitely can't see that. The VUs allow you to do a lot of cool things, especially in 1999/2000. I suppose that making the hardware impossible for anyone outside of the SONY engineers to grasp would constitute "garbage", however hahaha
@@Quaker763 If the PS2 is overly complex then the PS3 is purely alien with its cell processor. But I do agree that Sony was on a bit of demon time when designing their earlier consoles
Amazing work! Fantastic to see the Xbox 360 been exploited truly in software, without having to flash the DVD drive or Jtag / RGH it after all this time.
This only works for the old Blade dashboard versions, which means you can't play a lot of older games, and it severely limits what systems you can use. Sadly
@@KingKrouchIf a hypervisor exploit can be found for newer dashboard versions, which is much more of a desirable target with this exploit existing, then that would change. I imagine no one’s been looking all that much since everyone’s just been doing RGH for so long.
2024 and new exploits dropping for these OG gems. What a time to be alive. Thank you to everyone out there still tearing these things apart and sharing.
@@IDontModWTFz un tutorial de actualizar los avatares con rgh. Es que mi xbox tenia una nand dañada, pero funcionaba, y al parecer, como actualize esa nand, se corrompio aun peor y ahora, cuando la enciendo, se apaga inmediatamente
Another fine example of closed versus open platforms: Console version: This exploit that lets you get arbitrary code execution is cool. Here's how to use it to run whatever you'd like on your console. PC version: This exploit that lets you get arbitrary code execution is scary. Don't play it online, and if you must, take these precautions.
Congrats on the release and the nice write-up! Just wanted to clarify that when we were made aware of this exploit years ago, it was patched promptly. Saying that we weren't interested in fixing it is a bit misleading and unfair.
Wonderful broadcast thank you for sharing. As a Tony Hawk Veteran and console modder this video killed two of my weird niches with one stone. This is incredible stuff.
The PS2 is always going to be in a league of it's own, and some of it's features are overlooked by people trying to code for the device. PS2 had a full Linux OS you could buy and use on an unhacked console. PS2 was marketed towards audio enthusiasts as it was the only console that supported 5.1 surround with it's optical audio port (xbox didn't have surround audio like PS2 supported, no optical audio on Xbox). PS2 was marketed as a device for adults with it's more mature style of looks and features. It'll fit nicely next to an audio receiver with how it looks. There's a lot more about the PS2 that made it king of the consoles, but marketing towards the music and movie industry really solidified it's position, and at the time DVD players were over $200 a piece. You could even buy a remote that looked very professional/sleek to control a PS2 playing DVDs and CDs.
No other game console supported high quality audio or 5.1 surround until xbox 360 came out. Want the best audio/game music of that generation, get a PS2.
Truly amazing stuff! I can't even imagine what you had to go through to get a 360 without burned bootloader efuses. Hope you didn't forget to remove the R6T3! Speaking of the PC version, IMO no one should play the version where strcpy isn't replaced with strncpy, the consequences can be quite severe. Also, the shellcode at 0:49 looks heartwarmingly familiar (I'm the guy behind the publicly available Frogger Beyond exploit :D)
I used to have my 360 soft modded and it was insanely easy. I can't remember the exact process I used but it enabled me to download 360 games to a flash drive and play them for free from the flash drive. They eventually caught me and my account was banned until 9999 lol
@@Mr_Twiglesworth it's an open door for remote code execution on your computer, which allows the attacker to do virtually anything: plant a malware / steal your data / etc
The 360 exploit in this is particularly impressive. Love your work man - as someone who has utilized every single one of these softmods mentioned, this would've made life easier back in the day. Keep it up!
whoa, hold on, I was promised an exploit for the N64. (j/k. Very enjoyable video. Thank you for posting this. I can't imagine the time it took to put this together.)
haven't actually confirmed, but it probably does work on N64. it's just the N64 has no way of doing anything useful since there's no hard drive or USB port or way to load anything. if you're going as far as to make a custom cartridge.... then well you've already just made a flashcart
@@kneesnap1041 Or going the route of TASbot and making a serial I/O that sends data over the controller port(s) to load up a simple pong game, and then you've just built a very lowgrade network adapter (Cool as heck, but a lot of engineering.). Just saying, you toss out a cartridge like that, someone in the audience is going to ask for it ;)
I was super into all of this stuff in 2012-2013 and then just stopped playing video games altogether. Almost like the unrestricted availability of all of these old games annihilated scarcity and made me lose interest. Coming back a decade later I don’t even know if I really like video games at all but the software side of this fascinates me. Very cool vid
Whatever effort Nintendo put on the GameCube architecture, they did get a return with the Wii. They didn't try the switch after the Wii because of the familiarity with PowerPC and cost to manufacture of something similar to the switch would be very prohibitive in 2013
I really think the Switch wasn't attempted earlier because there really wasn't an industry standard port that Nintendo could use to create a proper dock until like 2015-2016 with USB C. Every other solution before USB C sucked.
@@No-mq5lw Nintendo didn't give a damn about industry standard ports. Even when they do use them, they rarely use them correctly. (See: Switches being bricked by third-party chargers; GameCube controller adapter/Wiimote not being standard HID protocols...)
@@No-mq5lwswitch was released after USB-C PD standard, and Nintendo is one of the biggest companies on the planet. They can afford to implement the standard correctly.
The biggest advantage of the PS2 was the controller, since Hawk games were native to Playstation and the other versions were ports. Playing THPS with a stick is like eating pizza with a fork.
I never thought about this, but having played the original THPS on PS1 and THUG on GC, I can now see why it seemed to me that the learning curve was steeper!
@@wheedler Oh no just it's way easier to do tricks that require diagonals on a D-pad IMHO - and again I never realized this before reading the comment but it's true!
Some game creators hacked the ps2 to make the games function better. Pretty sure that racing game was one of them, it was like Mario Kart but was that fox looking character. I think it was Crash Team Racing or whatever, watched a interview with the creator and it was super interesting.
@@banguseater All the newer model fats came with one, slim ditched it, thou you could still use a USB hard drive as plug and play. Thou I would like to correct myself, most functions of the hard drive were locked out of most games Socom 2 used it for DLC I think that's like the only game to every utilize it. With a mod chip, or FreeMcBoot and some other loaders, you can store whole games on it and read them from the hdd.
@@omicron0mega no what im saying is that the harddrive and the network adapter didnt come with it, you had to buy them. xbox OG came with it stock . thats why not too many PS2 games used the HDD way before the slim model came out. including the networking.
Taking your PS2 slander on the chin and thanking you for giving me another reason to love THPS4. (also this exploit suits the specific situation i got with my ps2 right now very well so again thank you)
Getting a ROP chain on the 360 is still damn impressive! I do wonder, with the OG Xbox emulator on the 360 employing a JIT machine code translator, I wonder if the hypervisor enforces code signing on that end.
Really cool video and excellent work, I can’t begin to pretend i understand how this stuff works, but it’s incredibly entertaining to see it being pulled off, especially on 360, as particular as this exploit is
Dude, I have that same green skulls Xbox decal on my modded Xbox that also has the Xecutor 3CE & dipswitch bank on the front corner there. Maybe it's the video and lighting but my skulls look darker. Just wild seeing someone else with the same decals and Xecutor in their box these days. This is the first I'm hearing of the Strcpy RCE.
1:58* the Endgame usb exploit exists, which streamlines the process to just plugging a usb in and reading from it, so while its cool that a new softmod exploit is available for the og xbox, its reccomended to use endgame for ease of use.
You might dislike the PS2 and I never cared for it until I messed around with PCSX2 shortly before v2 released in the past days but this might be a super simple method to me to get a freeMC memory card.
While the 360 hack may seem useless now, the technical data provided may be the other half to someone else's softmod research. The key to softmodding the 360 likely already exists but we haven't pieced it together yet.
The PotC world in KH2 was quite impressive. Overall though, Silent Hill 3, The Getaway and Champions of Norrath were all PS2 exclusives and the best looking games of that entire console generation. PS2 wasn't weak, it was extremely well designed and blew the competition away when utilized right.
It's honestly amazing they didn't use strncpy; that's been available since forever ago, and prevents buffer smashing by fixing the length of the string. Now that has it's own issues, and shouldn't be used in modern code, but as long as you properly null-terminate your strings you're probably fine. I'm also not sure if strcpy_s, strncpy_s were available at the time but I think they were. If so they definitely should have used that.
The fact that strncpy doesn't always null-terminate is a dumb oversight, imo, and should have been fixed as a "non-breaking change", since any code relying on its broken behavior is broken, anyway.
strncpy according to stack overflow is a poor choice as it has a bunch of weird side-effects outside its original use-case. strncat with some logic to insert a terminator at the end is the method they suggest using for a thread-safe version of strcpy. If you lack a secure strcpy you can make your own by making a memcpy wrapper which uses the string's length as an input. EDIT: A cute little detail is that the C documentation refers to strcopy as having "undefined behavior" if the source string is longer than the destination string, which is a very quaint way to putting the fact that you're suffering a buffer overflow and will be wide open to malicious remote code execution when this happens. No big deal, just a little undefined behavior.
Kinda sad that the THUGPro devs said they don't care about fixing it, seeing it's still quite popular these days... wondering what kind of mailicious stuff is going on, haven't played for 5 years.
The OG Xbox only has analog outputs, so the TV needs to sync to the signal before it can know what is supposed to be the top left of the image. This is not unique to CRTs, but is a requirement of the analog video signal.
You mentioned Xbox 360, but I have no idea how that would work. Not only do you need to defeat the security cookie, you will also have to find a way to find and execute the kernel function from the stack, because of the page protection and encryption the Xbox has. If there was a way, the LEGO games also have a cross-platform strcpy vulnerability (although not networked), that was at least present in the Wii and PS2 version (where I could create a POC exploit) and likely is in the Xbox 360 version as well.
the exploit is still there in the Xbox 360 version, but the hypervisor prevents memory pages to be both readable, writable and executable at the same time. that's why a dashboard from like 2006 is needed: that specific version contains a bug in the hypervisor that's used to get full code execution
@@tcscomment I need to admit I wrote that comment, only skimming through the timeline and not finding the "Xbox360" screen and watched the video afterwards. It appears as if there is no security cookie in the first place on that game, which surprises me a lot, but also explains a lot. I thought the Xbox360 toolchain forces that to be on by default. Thinking of that, what prevents someone from writing entirely stack-based code other than being confined to the stack size? You could surely look for utility functions within the game, that when combined do the side effects you were looking for. If one was dedicated enough, surely you could create a universal Xbox360 "userspace" homebrew toolchain (including exploit)
@@tcscomment Why do you think so? Assuming, the compiler doesn't save valid return addresses and the hypervisor doesn't track them otherwise (for example through a hardware register with a list of last used jump targets), there's no way for the hypervisor to track "abused" code. You'd "only" need to find code inside the game that's small enough and allows for manipulation of the most important registers. I imagine the hardest part would be to find utility functions, that push elements to the stack without popping them. (You'd need to find a function that executes at least two push, before popping the return address). None of my code would need to be mapped as executable, because it will only point the return address into pages already mapped as executable. This would be entirely CPU-sided and to the supervisor it would look like only the game code is being used. The hypervisor could only tell through probing the PC and heuristics if the game is behaving abnormally. And for stability sake that's unlikely to be the case. Tbh, given the knowledge, that Tony Hawk's at least doesn't feature a stack cookie, I'm very intrigued about giving it a shot. Well at least depending on if I can test that in Xenia or not.
@@tcscomment Never mind, grimdoomer himself said, that a stack software only exploit is possible on his git repo for Xbox360. I might still try to make a nice demo out of it. By creating stack only based code using utility functions.
I like technical videos like this already, but man. That title and thumbnail was too funny to pass up. Had no idea you had prior experience, but it makes sense you would. No way a novice could pull this off
Finally, a way to softmod my PC.
This comment will be fun to look back at in 10 years.
I'm looking for a good hard mod so it can't be patched out by Microsoft.
@@renakunisaki SecureBoot: So I took that personally
Imagine someone uses this to do a fully automated Linux install on someone else's PC🤣
@@RadikAlice theoretically you could run a bunch of checks to see if the machine is uefi or not to determine what boot loader to use, and then overwrite the entire first partition (ie C:\ drive under windows) with a live cd esque thing that unpacks an image over itself on boot, like a ramdisk or smth
died 2006 born 2024 welcome back king kong exploit
this is honestly better then King Kong because it required a patched shader and a flashed dvd drive, this on the other hand is basically no clicks required, only copy a save file via usb
close enough, welcome back king kong exploit
@@luxploit yeah i know lol, awesome stuff for being the first of a kind for the 360. Hope this can in some way aid in making a more accessible softmod in the future
@@luxploit potentially even just join a networked game... can you still do that?
@@renakunisakiBelieve it's been shut down.
You're the guy that brought us exFAT support on PS2? God bless you hackerman!
Yeah seriously. With that and the memcard pro 2 this thing is a lot more usable
🫡
The greatest trick Tony pulled off since the 900.
The greatest trick Tony pulled was to convince the world an exploit didn't exist
christ, you're like my shadow
@@spv420 lmao
the PS2 was a nightmare for devs especially at the start, because Sony thought "devs can just use our vector units to do tons of fast data transfers via DMA so they don't need much memory and we can flex the power of our hardware lol"
too bad they never said this to devs and they had to eventually figure that out on their own
I guess RenderWare came into the picture to try and save they day with all the BS that is messing with Vector Units and CPU management.
---
RenderWare was one of the most widely used game engines during the PS2 era. Originally developed by Criterion Software, RenderWare was a cross-platform graphics engine that provided a higher-level abstraction over the hardware, making it easier for developers to create games without needing to dive into the low-level complexities of the PS2.
RenderWare handled many of the tasks that would otherwise require developers to manually program the VUs, such as 3D rendering, physics, and animation. It became popular for its ease of use and was employed in many high-profile games, including the Grand Theft Auto series, Burnout, and Tony Hawk's Pro Skater.
I shipped a couple of PS2 games. The VU0 and VU1 weren't TOO bad. Yes, people were using Excel spreadsheets for scheduling (to minimize latency / maximize throughput) but you would transfer data from the EE -> VU0 -> VU1 -> GS for rendering.
What _really_ made the PS2 challenging was managing all of its SEVEN processors: EE, VU0, VU1, IOP, GS, SPU, and IPU. It was a PITA to get (especially managing DMA transfers) but once you had everything working it was magic.
RenderWare was a god send for PC developers who didn't want to waste time learning idiosyncrasies of the system.
Thing is, that's how most mips hardware works though...
@@MichaelPohoreski In other words... the PS2 was literally a piece of shit.
@@DGTelevsionNetwork Many routers and Chinese Special media players/consoles use MIPS but are NOTHING like the PS2.
People who loved the PS2: Players.
People who hated the PS2: Programmers.
very true 🤣
And audio enthusiasts loved the PS2 as it was the only console that supported surround at the time and xbox never supported it until the 360. I had family members that obsessed about audio and bought a PS2 because it had optical audio ports and played DVDs and CDs with no issue in full 5.1 surround.
@@Vandius24Still is a half decent cd reader
@@remingtonjensen2231 lasers don’t live so long though. My ps1 is a more solid CD player
@@slarbiter oh whoops yea I meant ps1 lol
If PS2 has million haters, then Grimdoomer is one of them.
If PS2 has one hater, then Grimdoomer is THAT ONE.
If PS2 has no haters, that means Grimdoomer is dead.
Hating the ps2 is wild
@@izBrnDDfrom a programmer's perspective it is indeed a real piece of garbage
@@tcscomment i'll look into it
@tcscomment Overly complex? Maybe. As with all SONY hw, the designers went a bit nuts with SIMD, and in this case, Toshiba did certain things to save space die space and thus $$$.
Piece of Garbage? I definitely can't see that. The VUs allow you to do a lot of cool things, especially in 1999/2000.
I suppose that making the hardware impossible for anyone outside of the SONY engineers to grasp would constitute "garbage", however hahaha
@@Quaker763 If the PS2 is overly complex then the PS3 is purely alien with its cell processor. But I do agree that Sony was on a bit of demon time when designing their earlier consoles
i thought this was about a obscure polish tony hawk game nobodys ever heard of but i wasnt disappointed
Pronounced "strotspee" for some reason.
7:52 just a friendly reminder warranty seals are illegal in usa, have been for like 30 years. There's also a ftc lawsuit out right now.
1974 was 50 years ago partner. Sorry if that makes you feel old lol.
Amazing work! Fantastic to see the Xbox 360 been exploited truly in software, without having to flash the DVD drive or Jtag / RGH it after all this time.
EHHH ERES EL DE DIGIEX!!!! SALUDOOOS!!!!
I think you'd still need to JTAG / RGH to get the needed keys and flash the nand, no?
This only works for the old Blade dashboard versions, which means you can't play a lot of older games, and it severely limits what systems you can use. Sadly
yo i recognize you from some 360 forums
@@KingKrouchIf a hypervisor exploit can be found for newer dashboard versions, which is much more of a desirable target with this exploit existing, then that would change. I imagine no one’s been looking all that much since everyone’s just been doing RGH for so long.
For those wondering, yes, you do need the XBOX 360 version of American Wasteland for exploiting the 360, not OG version.
2024 and new exploits dropping for these OG gems. What a time to be alive. Thank you to everyone out there still tearing these things apart and sharing.
if i had a nickel for every exploit that worked on multiple tony hawk games i’d have two nickels
Wait what’s the other nickel
@@gerardgeer642 TonyHax
@@gerardgeer642 tonyhax for the ps1
Are you Chad Kroeger because I want my nickelback
is this a meme i am seeing this phrase on a ton of videos
clicked this expecting a ytp, now i'm intrigued
FOR REAL
so that's why Visual Studio tells me that strcpy is cringe
Stellar work, dude!
ey tu tutorial me brickeo la xbox 360
@@luzroja29AKApeyo unlucky bro
@@FSSHetPDGE si cierto. Me quiero comprar una ps3
@@luzroja29AKApeyo what tutorial did you follow? It's extremely hard to brick a 360 bud
@@IDontModWTFz un tutorial de actualizar los avatares con rgh. Es que mi xbox tenia una nand dañada, pero funcionaba, y al parecer, como actualize esa nand, se corrompio aun peor y ahora, cuando la enciendo, se apaga inmediatamente
My dude only appears when he's got solid stuff to show.
Congrats.
Another fine example of closed versus open platforms:
Console version: This exploit that lets you get arbitrary code execution is cool. Here's how to use it to run whatever you'd like on your console.
PC version: This exploit that lets you get arbitrary code execution is scary. Don't play it online, and if you must, take these precautions.
Great work and find.
Hating the PS2 and still you gave us Exfat support for the PS2 HDD.
Nah, cursing the console with exfat is entirely appropriate.
Sleep deprived coder, 2006: I don't need to sanitize the input for a gap, it'll be fine
Modders, 2024: you FOOL
Hahahahahah this made me laugh so hard 😂
"it has 2 cpus that have to reboot multiple times and there's almost no RAM" we just played the games man
what games? ive always heard playstation has no games.
@@SaenGaems you're thinking of the ps5
@@kellymountain surely you mean the ps3
@@redhel the PS3 has game. singular
the ps5 has no games
@@redhelThe PS3 has an absolutely god awful hardware architecture, but it has quite few games on it.
Great console tbh.
"Because strcpy is not safe, we can craft a malicious gap name" 💀
god i hope the xbox 360 gets an easy softmod one day
we're getting close 🙏
Congrats on the release and the nice write-up! Just wanted to clarify that when we were made aware of this exploit years ago, it was patched promptly. Saying that we weren't interested in fixing it is a bit misleading and unfair.
Was that swiftness ever communicated?
Thanks for confirming this!
I was wondering if now we'd have to be worried about joining created park servers on tpro
Gay
@@bongjovi4928brain rot detected. get off internet
WHY IS IT ALWAYS THE TONY HAWK GAMES
Best games
Even when played normally, you can see and feel the jank Neversoft had to contend with in their own work
Bc Tony hawk was great at skateboarding but a terrible coder.
Wonderful broadcast thank you for sharing. As a Tony Hawk Veteran and console modder this video killed two of my weird niches with one stone. This is incredible stuff.
The PS2 is always going to be in a league of it's own, and some of it's features are overlooked by people trying to code for the device. PS2 had a full Linux OS you could buy and use on an unhacked console. PS2 was marketed towards audio enthusiasts as it was the only console that supported 5.1 surround with it's optical audio port (xbox didn't have surround audio like PS2 supported, no optical audio on Xbox). PS2 was marketed as a device for adults with it's more mature style of looks and features. It'll fit nicely next to an audio receiver with how it looks. There's a lot more about the PS2 that made it king of the consoles, but marketing towards the music and movie industry really solidified it's position, and at the time DVD players were over $200 a piece. You could even buy a remote that looked very professional/sleek to control a PS2 playing DVDs and CDs.
No other game console supported high quality audio or 5.1 surround until xbox 360 came out. Want the best audio/game music of that generation, get a PS2.
Truly amazing stuff!
I can't even imagine what you had to go through to get a 360 without burned bootloader efuses. Hope you didn't forget to remove the R6T3!
Speaking of the PC version, IMO no one should play the version where strcpy isn't replaced with strncpy, the consequences can be quite severe.
Also, the shellcode at 0:49 looks heartwarmingly familiar (I'm the guy behind the publicly available Frogger Beyond exploit :D)
I used to have my 360 soft modded and it was insanely easy. I can't remember the exact process I used but it enabled me to download 360 games to a flash drive and play them for free from the flash drive. They eventually caught me and my account was banned until 9999 lol
What are the consequences?
@@Mr_Twiglesworth it's an open door for remote code execution on your computer, which allows the attacker to do virtually anything: plant a malware / steal your data / etc
The 360 exploit in this is particularly impressive. Love your work man - as someone who has utilized every single one of these softmods mentioned, this would've made life easier back in the day. Keep it up!
Your hatred for PS2 is palpable. xD
Great job as always!
whoa, hold on, I was promised an exploit for the N64. (j/k. Very enjoyable video. Thank you for posting this. I can't imagine the time it took to put this together.)
haven't actually confirmed, but it probably does work on N64. it's just the N64 has no way of doing anything useful since there's no hard drive or USB port or way to load anything. if you're going as far as to make a custom cartridge.... then well you've already just made a flashcart
@@kneesnap1041 Or going the route of TASbot and making a serial I/O that sends data over the controller port(s) to load up a simple pong game, and then you've just built a very lowgrade network adapter (Cool as heck, but a lot of engineering.). Just saying, you toss out a cartridge like that, someone in the audience is going to ask for it ;)
I was super into all of this stuff in 2012-2013 and then just stopped playing video games altogether. Almost like the unrestricted availability of all of these old games annihilated scarcity and made me lose interest. Coming back a decade later I don’t even know if I really like video games at all but the software side of this fascinates me. Very cool vid
I have to agree with you, I used to game a lot, now I only care to get on GTA V-SP and FSX
Whatever effort Nintendo put on the GameCube architecture, they did get a return with the Wii. They didn't try the switch after the Wii because of the familiarity with PowerPC and cost to manufacture of something similar to the switch would be very prohibitive in 2013
I really think the Switch wasn't attempted earlier because there really wasn't an industry standard port that Nintendo could use to create a proper dock until like 2015-2016 with USB C. Every other solution before USB C sucked.
@@No-mq5lw Nintendo didn't give a damn about industry standard ports. Even when they do use them, they rarely use them correctly. (See: Switches being bricked by third-party chargers; GameCube controller adapter/Wiimote not being standard HID protocols...)
@@renakunisaki Proprietary USB C power delivery protocols weren't uncommon in the early days, and neither does Sony for their controllers.
@@No-mq5lwswitch was released after USB-C PD standard, and Nintendo is one of the biggest companies on the planet. They can afford to implement the standard correctly.
Wow. What a blast from the past.
Softmodded many Xboxes with Agent Under Fire for friends, this would have been huge back in the day!
I just downloaded a backup copy of my pro skater 4 few minutes ago and now I get your video in my recommendations.
dude, you rock
The biggest advantage of the PS2 was the controller, since Hawk games were native to Playstation and the other versions were ports. Playing THPS with a stick is like eating pizza with a fork.
Pc Keyboard gang
I never thought about this, but having played the original THPS on PS1 and THUG on GC, I can now see why it seemed to me that the learning curve was steeper!
Are you implying Playstation controllers don't have sticks?
@@wheedler His comment makes sense to me when we look at an N64 controller's layout in comparison
@@wheedler Oh no just it's way easier to do tricks that require diagonals on a D-pad IMHO - and again I never realized this before reading the comment but it's true!
finally a good explanation for not having gaps in the 1+2 CAP
I already jailbroke my PS2 and installed free mcboot using my gran turismo 3 game disc but this is still insanely cool, keep up the great work!
god i love these goofy titles on technical videos
Congrats on the find! This is just what we needed to get some people interested in hypervisor exploit research.
Some game creators hacked the ps2 to make the games function better.
Pretty sure that racing game was one of them, it was like Mario Kart but was that fox looking character.
I think it was Crash Team Racing or whatever, watched a interview with the creator and it was super interesting.
MAYBE was Crash Bandicoot..
Yeah youre thinking of Crash Bandicoot on PS1
@@koraku8519 ahh yeah it was PS1 wasn't it
dude i spent so much time in the create a park as a kid
Tony Hawk exploits led to so many great things in the past :D
0:00 Intro
1:36 Xbox
4:05 PS2
5:42 GameCube
6:35 Xbox 360
8:53 PC
Awesome AND scary AF at the same time!
I remember seeing you do your live demo of this on the xbox original in College! I hope you're doin well, man!
You’re a LEGEND! Thank you for what you’ve done for the PS2 community
Oh nice. I saw the blog post on HN and put it on my reading list. But it's nice to see there's a video too!
Nyan cat just took me back.
Also realized my pronunciation of both are different. "Nanya - to Nya"
The fat PS2 had persistent storage, the network adapter add-on had an IDE interface.
yea but It doesnt come with it stock so it’s not really the case
@@banguseater All the newer model fats came with one, slim ditched it, thou you could still use a USB hard drive as plug and play. Thou I would like to correct myself, most functions of the hard drive were locked out of most games Socom 2 used it for DLC I think that's like the only game to every utilize it. With a mod chip, or FreeMcBoot and some other loaders, you can store whole games on it and read them from the hdd.
@@omicron0mega no what im saying is that the harddrive and the network adapter didnt come with it, you had to buy them. xbox OG came with it stock . thats why not too many PS2 games used the HDD way before the slim model came out. including the networking.
Taking your PS2 slander on the chin and thanking you for giving me another reason to love THPS4. (also this exploit suits the specific situation i got with my ps2 right now very well so again thank you)
Now that’s how you knows he’s a real gamer, he hates games 😂
Getting a ROP chain on the 360 is still damn impressive!
I do wonder, with the OG Xbox emulator on the 360 employing a JIT machine code translator, I wonder if the hypervisor enforces code signing on that end.
That's a good question. Honestly I wonder if there's any possibly exploits in the Hypervisor itself.
I understood about half of this but it was still interesting. I think it's well presented. Nice video
Pro Skater 2 on PC with offbrand controller was the best,
Highlights of childhood!
Really cool video and excellent work, I can’t begin to pretend i understand how this stuff works, but it’s incredibly entertaining to see it being pulled off, especially on 360, as particular as this exploit is
I loved making parks in THPS
Dude, I have that same green skulls Xbox decal on my modded Xbox that also has the Xecutor 3CE & dipswitch bank on the front corner there. Maybe it's the video and lighting but my skulls look darker. Just wild seeing someone else with the same decals and Xecutor in their box these days. This is the first I'm hearing of the Strcpy RCE.
The skulls decal goes crazy hard
Played so much tony hawk proskater 4 as a kid always new this game held something special lol. Great work & research!
I don't care for ACDC at all but hearing TNT will always give me a wild nostalgia rush
It's insane how much damage a single strcpy can cause. Really makes you think.
1:58* the Endgame usb exploit exists, which streamlines the process to just plugging a usb in and reading from it, so while its cool that a new softmod exploit is available for the og xbox, its reccomended to use endgame for ease of use.
Wait what about the PSP games? didnt it have 2 tony hawk games that could be affected by this?
oh cool can potentially hack the vita with it too then right?
@@LiEnbyPSP games on the Vita run in a sandbox, plus there are already ways to mod a PSVita
I used to love this game back in the day, and now it can be used to mod consoles? Awesome!
"A game console that doesn"t suck" "Gamecube"
The PS2 was, is, and will forever be the best console ever made
Gamecube was so trash lol no games more people had xbox than gamecube everyone and their mom had a ps2
Damn hearing T.N.T at the start of this video put me in a great mood
Dang, Tony keeps delivering!
Appreciate your work
You might dislike the PS2 and I never cared for it until I messed around with PCSX2 shortly before v2 released in the past days but this might be a super simple method to me to get a freeMC memory card.
Your presentation ability is great. I love it, and hope you keep making videos!
What an awesome channel! Also like your blog! Please continue making such content
Nice work! Can't wait to see what other fun work you'll do on the PS2 especially ;)
I subscribed. You only have two videos on your channel but their both awsome. Hope to see more. Thanks.
tony hawk pulls of a devious lick on the 6th generation of consoles
Everything I wondered about you explained. Excellent video.
i can't believe Tony Hawk was so careless in his implementation of the standard library
"Moving on to a game console that doesn't suck." 😂 Gotta love the GC
say what you will about the ps2 but its never red ringed of death on me, thing still works like 20 years later lol
Didn't know this game existed for so long on different consoles after i played it in my youth on pc and n64
While the 360 hack may seem useless now, the technical data provided may be the other half to someone else's softmod research. The key to softmodding the 360 likely already exists but we haven't pieced it together yet.
No, it doesn't. The roadblock to any soft mod on the 360 is the Hypervisor, and no one has figured out how to get around it yet on a modern dashboard.
Aleph One is laughing in Stack Smashing right now
Badass breakdown and never knew this was in the games
You may hate the PS2, but you gotta admit, the _Kingdom Hearts_ games made for it are some of the nicest-looking games on the console
Metal Gear Solid 2 looks only a million times better.
The PotC world in KH2 was quite impressive. Overall though, Silent Hill 3, The Getaway and Champions of Norrath were all PS2 exclusives and the best looking games of that entire console generation. PS2 wasn't weak, it was extremely well designed and blew the competition away when utilized right.
Kingdom Slop!
Valkyrie Profile 2 is also quite a looker. And ZoE 2nd Runner
Sorry, but it's the most boring game series ever
It's honestly amazing they didn't use strncpy; that's been available since forever ago, and prevents buffer smashing by fixing the length of the string.
Now that has it's own issues, and shouldn't be used in modern code, but as long as you properly null-terminate your strings you're probably fine.
I'm also not sure if strcpy_s, strncpy_s were available at the time but I think they were. If so they definitely should have used that.
The _s versions are nonstandard and only available in MSVC /MSVCRT.
The fact that strncpy doesn't always null-terminate is a dumb oversight, imo, and should have been fixed as a "non-breaking change", since any code relying on its broken behavior is broken, anyway.
strncpy according to stack overflow is a poor choice as it has a bunch of weird side-effects outside its original use-case.
strncat with some logic to insert a terminator at the end is the method they suggest using for a thread-safe version of strcpy.
If you lack a secure strcpy you can make your own by making a memcpy wrapper which uses the string's length as an input.
EDIT: A cute little detail is that the C documentation refers to strcopy as having "undefined behavior" if the source string is longer than the destination string, which is a very quaint way to putting the fact that you're suffering a buffer overflow and will be wide open to malicious remote code execution when this happens. No big deal, just a little undefined behavior.
2 vids and theyre both bangers. subbed
Cool to see soft mod community still around i soft modded my PS2 fat since i had badk from 02 back in 2010 with agent under fire
WINCHESTEEEEEEEEEER!!! YOUR DAYS ARE NUMBERED!
nope, as the exploit works only on very old dashboard versions… not only that, but Winchester motherboards still have yet to be exploited and modded
@@pinksheep752 progress is progress
Wow, great work, the true full exploit.
If you ported this to the SEGA Dreamcast, you would save the lives of so many Revision VA2 owners everywhere.
Finally, using a game series I already have
Kinda sad that the THUGPro devs said they don't care about fixing it, seeing it's still quite popular these days... wondering what kind of mailicious stuff is going on, haven't played for 5 years.
One of the devs commented here and said they fixed it shortly after it was reported. There was never a lack of interest in fixing it
Dude these games were coded using an assembler!? So cool
remember, if you ever think "I know it's unsafe, but I know what input it's going to get" no you don't.
What causes this CRT-like picture offset for a short time when Nyan cat is loaded at 2:22?
The OG Xbox only has analog outputs, so the TV needs to sync to the signal before it can know what is supposed to be the top left of the image. This is not unique to CRTs, but is a requirement of the analog video signal.
As much as I love the PS2, yeah, I don’t blame anyone who tries to work with it and comes out of the experience feeling s bit more misanthropic.
You mentioned Xbox 360, but I have no idea how that would work.
Not only do you need to defeat the security cookie,
you will also have to find a way to find and execute the kernel function from the stack, because of the page protection and encryption the Xbox has.
If there was a way, the LEGO games also have a cross-platform strcpy vulnerability (although not networked), that was at least present in the Wii and PS2 version (where I could create a POC exploit) and likely is in the Xbox 360 version as well.
the exploit is still there in the Xbox 360 version, but the hypervisor prevents memory pages to be both readable, writable and executable at the same time. that's why a dashboard from like 2006 is needed: that specific version contains a bug in the hypervisor that's used to get full code execution
@@tcscomment I need to admit I wrote that comment, only skimming through the timeline and not finding the "Xbox360" screen and watched the video afterwards. It appears as if there is no security cookie in the first place on that game, which surprises me a lot, but also explains a lot. I thought the Xbox360 toolchain forces that to be on by default.
Thinking of that, what prevents someone from writing entirely stack-based code other than being confined to the stack size? You could surely look for utility functions within the game, that when combined do the side effects you were looking for. If one was dedicated enough, surely you could create a universal Xbox360 "userspace" homebrew toolchain (including exploit)
@@Littlefighter1911 that could be a way, yes, but I'm still afraid the hypervisor would catch that
@@tcscomment Why do you think so? Assuming, the compiler doesn't save valid return addresses and the hypervisor doesn't track them otherwise (for example through a hardware register with a list of last used jump targets), there's no way for the hypervisor to track "abused" code.
You'd "only" need to find code inside the game that's small enough and allows for manipulation of the most important registers.
I imagine the hardest part would be to find utility functions, that push elements to the stack without popping them. (You'd need to find a function that executes at least two push, before popping the return address).
None of my code would need to be mapped as executable, because it will only point the return address into pages already mapped as executable.
This would be entirely CPU-sided and to the supervisor it would look like only the game code is being used.
The hypervisor could only tell through probing the PC and heuristics if the game is behaving abnormally.
And for stability sake that's unlikely to be the case.
Tbh, given the knowledge, that Tony Hawk's at least doesn't feature a stack cookie, I'm very intrigued about giving it a shot. Well at least depending on if I can test that in Xenia or not.
@@tcscomment Never mind, grimdoomer himself said, that a stack software only exploit is possible on his git repo for Xbox360.
I might still try to make a nice demo out of it. By creating stack only based code using utility functions.
Game: *Lets you write/save/read text*
Hackers: It's free real state!
tony hawk's colonoscopy
I don't know why but this made me miss the days of hotswapping disks into my 360 to load modded ISOs of games
I clicked this video because i like THPS and my favourite tool which is underrated af is called SCRCPY
I like technical videos like this already, but man. That title and thumbnail was too funny to pass up.
Had no idea you had prior experience, but it makes sense you would. No way a novice could pull this off
can you do a video detailing exactly why you don't like the PS2 and its shortcomings please?