Mistakes Microsoft made in the Xbox security system

15 davikr 3 7/17/2025, 12:23:12 AM xboxdevwiki.net ↗

Comments (3)

mjg59 · 10m ago
The fundamental problem was that x86 had no mechanism for verifying first instruction at the time (Boot Guard and Platform Secure Boot provide that now), and the only way to try to deal with this was by adding immutable storage - but given where they put it, that was expensive, so small. And that led to making poor tradeoffs, influenced by having what was clearly not a great level of adversarial security analysis, but even implementing that perfectly they'd still have been fucked by the gate A20 thing which is maybe the absolute funniest legacy design failure that perpetuated well into the 21st century.

(The Intel/AMD difference on IP rollover is also funny but given the number of other ways to circumvent things...)

I actually use this as a teaching example - it's a great way to talk about how CPUs actually work and interact with other hardware, and a good understanding of this gives a lot of insight into low level platform design

Scaevolus · 17m ago
Microsoft clearly learned from their Xbox and Xbox 360 mistakes, leading to unhacked (?) Xbox One and Xbox Series X consoles: https://www.platformsecuritysummit.com/2019/speaker/chen/
munchler · 36m ago
This is from 2005.