Hacking Question How does one start with console hacking?

[smf]

Also how would I connect the console to my computer to find software vulnerabilities?

How you do it depends on the hardware involved. On modern hardware you might want to look at interfacing your computer to the ram chips of the console using some FPGA hardware. On the original XBOX, bunny got the boot code by intercepting the LDT bus

http://www.xenatera.com/bunnie/proj/anatak/xboxmod.html

The ram may be encrypted, probably something simple like xor on the address and data bits.

At the moment you don't even know what you don't know.

 

[Im_Sarcastic_JackAzz]

How does one find software bugs in consoles like for example ps4. I know about crashing the console to get a good crash dump, but is there another way to find software bugs on a closed system?

 

[FAST6191]

Finding crashes is a start.

Most systems are not all that closed -- even if they are not open sourced/source released in any useful way they will likely still use libraries for images, web browsing, video decoding... and those will be open source after a fashion, or at least have public bug trackers. Many times said trackers will lag behind things (see also the endless discussions about responsible disclosure) but ultimately show what is up. Most console devs don't seem to update or use current libraries so you then find out there.

The systems themselves might not be closed either -- if Intel somehow pulled a coup and got the contract to make the next xbox then their PR wing would be shouting about it (as might their reports, logos on the chips, possibly an e3 presentation from Microsoft trying to get fanboys slathering with tech talk they don't understand) but also as Intel are not going to design anything truly new (being Microsoft the whole point is that is is basically a windows PC you make your games for) you can probably look at what is already available and move sideways. Said chip might have a particular flaw you can exploit.

Should all that not prove useful you can start "fuzzing" inputs. If a dev does not check their inputs (or expects the limited input that the console provides to be their check) then that provides an in, or if you prefer there is a reason we have a thousand different save hacks, custom level loading hacks, load this web page hacks or even microphone hacks ( https://hackaday.com/2014/12/31/running-nintendo-ds-unsigned-code-with-audio/ ) for various systems. Not as useful in the modern world as things are increasingly sandboxed or signed for a specific console but that does not mean you skip it entirely.

Even without that you can still manually go through the system. For a modern system it might take a while to get a clean dump (be it from memory, because the encryption used, because you need to find a beta/dev/unmodified/specific version/repair tools, because it is really secure if you are not a nation state or high end university*...) but once you are there you can start pulling it apart. I mentioned shoulders of giants earlier -- some people really really like messing with one aspect of low level code, or are really good at power analysis/sidechannel attacks, others might be really good at ROP... again there is a reason why if you watch a hacker conference talk on a new console that multiple people will be there taking individual aspects. That might not get you all the way in but you can then publish what you have and someone else can run with it, or you can pick up from where someone else left off. Even narrowing down things but saying what they are not can be helpful, just don't believe people too hard -- there was a fairly noted talk about the 360 security system once with a comment along the lines of "this particular bus has nothing interesting on it", said bus a couple of years later would give us the RGH family of hacks.

If you can then when developers patch systems "for stability and security" purposes then the changes made between them are likely just that. Figure out what was changed and then on older versions you might be able to exploit something, or indeed maybe the newer versions too if they did not do a proper job of fixing the issue.

*guess where there are a lot of bored people with high end skills.

 

[Im_Sarcastic_JackAzz]

Finding crashes is a start.

Most systems are not all that closed -- even if they are not open sourced/source released in any useful way they will likely still use libraries for images, web browsing, video decoding... and those will be open source after a fashion, or at least have public bug trackers. Many times said trackers will lag behind things (see also the endless discussions about responsible disclosure) but ultimately show what is up. Most console devs don't seem to update or use current libraries so you then find out there.

The systems themselves might not be closed either -- if Intel somehow pulled a coup and got the contract to make the next xbox then their PR wing would be shouting about it (as might their reports, logos on the chips, possibly an e3 presentation from Microsoft trying to get fanboys slathering with tech talk they don't understand) but also as Intel are not going to design anything truly new (being Microsoft the whole point is that is is basically a windows PC you make your games for) you can probably look at what is already available and move sideways. Said chip might have a particular flaw you can exploit.

Should all that not prove useful you can start "fuzzing" inputs. If a dev does not check their inputs (or expects the limited input that the console provides to be their check) then that provides an in, or if you prefer there is a reason we have a thousand different save hacks, custom level loading hacks, load this web page hacks or even microphone hacks ( https://hackaday.com/2014/12/31/running-nintendo-ds-unsigned-code-with-audio/ ) for various systems. Not as useful in the modern world as things are increasingly sandboxed or signed for a specific console but that does not mean you skip it entirely.

Even without that you can still manually go through the system. For a modern system it might take a while to get a clean dump (be it from memory, because the encryption used, because you need to find a beta/dev/unmodified/specific version/repair tools, because it is really secure if you are not a nation state or high end university*...) but once you are there you can start pulling it apart. I mentioned shoulders of giants earlier -- some people really really like messing with one aspect of low level code, or are really good at power analysis/sidechannel attacks, others might be really good at ROP... again there is a reason why if you watch a hacker conference talk on a new console that multiple people will be there taking individual aspects. That might not get you all the way in but you can then publish what you have and someone else can run with it, or you can pick up from where someone else left off. Even narrowing down things but saying what they are not can be helpful, just don't believe people too hard -- there was a fairly noted talk about the 360 security system once with a comment along the lines of "this particular bus has nothing interesting on it", said bus a couple of years later would give us the RGH family of hacks.

If you can then when developers patch systems "for stability and security" purposes then the changes made between them are likely just that. Figure out what was changed and then on older versions you might be able to exploit something, or indeed maybe the newer versions too if they did not do a proper job of fixing the issue.

*guess where there are a lot of bored people with high end skills.

All i want to know is how to find software bugs or where to look for them do you look into the memory and how do i extract that info from the memory, where do i look, flash memory or storage? Im just very curious i know how computers work but i still dont understand how software bugs are found on closed system such as the ps4. Also my grammar sucks sorry about that.

 

[FAST6191]

The trouble comes in that the PS4 is a big boy system with modern security that you necessarily have to cut through first.
The following video covers some of the history of such things and where we are at today


15 years ago then yeah I could say look at save files. Few people check those and if you control a game you control the whole system. Today save files are checked, or at least signed to that system so you have to figure out its signing first. Similarly once you are there you only own the game which does little for you so you have to instead look at the menu or boot sequence. Because of the things in the video above you might

If you want to watch the 3ds presentation when it covers going through all the layers then that might help


"and how do i extract that info from the memory"
I don't know about the PS4 offhand but the 360 encrypted its memory with a new key every boot, and checked that the key was "random" when it did so. To that end some of the more classic things where people would attach a very fast capture tool to memory in a lab were less useful than they might have been.

Similarly flash memory is probably encrypted by default in the chip (lots come with AES onboard the actual flash memory these days) so the simple dump like you might have seen with old equipment

is not as useful, if it is at all.

It is all still possible to hack, however it necessarily requires cutting through a lot more stuff first. Most security is a response to things rather than sitting down and figuring it out from scratch. To that end if you want to start on the original xbox stuff (the 17 mistakes is good), move to the 360 (the one linked earlier is a good start, maybe then cover how the RGH stuff worked later), the PS3 stuff from C3, maybe go back for the old wii conference, the 3ds stuff mentioned earlier and so on and so on it will help.

If you are asking the sorts of questions you are asking there you could probably make a nice dent in P4 era PCs with windows 98 or early XP, maybe up to more modern stuff on a PC where there are not things thrown in your way as much. The modern consoles though are designed for security so you have a bit more to go before you might be able to usefully do something there.

 

[Im_Sarcastic_JackAzz]

Thanks. But i'm looking for a simple answer to my question, "how do hackers find software bugs on consoles?" What tools do they use to find those bugs? Sorry that i am persistent and constantly asking for answers to the same question I have no experience in console hacking. You just dont got the tools for this stuff unlike PC.

Thanks for your patience.

 

[danny08]

Oh Boy,
Its not like your starting a special software, click a button called 'find bugs' and whoosh, there are they.
Every answer in this thread is right, you have to walk a long and hard path to actually hack a console and you need knowledge about so much stuff.
Why do you think most hackers are computer science students and have doing the hacking stuff for at least 5 years?
Its nothing you can learn in a week or two.
More like 2+ years.

 

[Im_Sarcastic_JackAzz]

Oh Boy,
Its not like your starting a special software, click a button called 'find bugs' and whoosh, there are they.
Every answer in this thread is right, you have to walk a long and hard path to actually hack a console and you need knowledge about so much stuff.
Why do you think most hackers are computer science students and have doing the hacking stuff for at least 5 years?
Its nothing you can learn in a week or two.
More like 2+ years.

True I don't expect to be a computer genius but I try to ask people who are. I guess its to Broad of a subject let me change my question. What skills do I need to learn to be a console hacker?

 

[FAST6191]

Most of anything you learn to go toe to toe with modern consoles will take years for most people to learn. Fair enough but by the time you have that we will probably have the PS5 and fully realised hacks for the current consoles. Quite a common problem in universities as well actually.

Similarly I don't know for how much longer it is going to be practical for most people, even those that can hack modern stuff, to keep it all in their head. I already mentioned talks where people hand it off to other members in their groups, and said people will probably be the first to say "I don't know how they do what they do", but it will probably apply again in reverse (one I saw had one guy showcase an incredible understanding of encryption, however the other guy on the team was really good at analogue debugging techniques and soldering, such that they could attach probes to areas of devices that most would not even consider and generate data for the crypto guy). Some of it is also luck -- while I have read https://www.schneier.com/books/cryptography_engineering/ or at least the book that came before it if someone has just spent the last 10 months properly implementing and understanding a particular type of encryption that just so happens to be used in the new console then they are probably far more primed than I am to find the flaws, or if I am referencing back to the basic implementation all the time in my head I will miss things or take far far longer to spot things.

Anyway
Electronics design, possibly through electronics physics. On the other hand while knowing electronics physics will mean you inherently understand side channel attacks they are also a technique you can just use if you are taught it so you might be able to skip something somewhere, what that will be may only be knowable after the fact though.
A knowledge of what way the wind is blowing in electronics, security, operating system design. Engineers are inherently lazy bastards, or at least constrained by cost, and will build on what came before so learn what has happened there. Earlier I mentioned about modern NAND chips coming with encryption onboard -- if I know that is coming and current I can keep myself a bit more flexible or gear up to deal with it.
Straight up computer science will of course help. If you understand how programming languages, operating systems, software based security and more works then yeah.
Most of that will also benefit from a lot of maths, however there is also a lot of maths that will be of limited value, or limited value from pursuing it to the highest levels of that area (I don't imagine a would be hacker is going to get too far not understanding boolean logic and logic gates, most would be hackers would probably not benefit much from extending that into the quantum computing equivalents even though it is an utterly fascinating area. Of course if we do get quantum computing said people that do know it will be able to grasp Shor's algorithm in short order).
I could probably continue but it seems you are angling for a "learn this and you will be able to hang" type answer and there is not really one that can be given. Understand the system you are working on, probably in a considerable amount of detail, and you will be able to do things. Understanding though might involve a lot of related but still separately considered areas.