Yes, the three holes are very common in Sweden, the first time I even encountered covers without them was when moving abroad.
However, a few years ago Ikea removed them in Sweden also, unfortunately. From what I've heard it's because they got too many complaints internationally due to people believing that the covers were broken.
NHE looks interesting, they seem to have modified all clients to make the host player teleport above the map. With the current protocol, it seems like it is impossible to achieve this without modifying the guest clients as well. And by modifying all clients they are also able to add extra maps and make gameplay changes.
Are you thinking of Theater mode that first appeared in Halo 3? Unfortunately it was slimmed down in later Halo games and it is rarely seen in other games at all, especially not console games.
> So that's basically most of the lowest layers of the Xbox Live protocol as well. Simply game discovery happens over local broadcast instead of through the Live servers. There's some other specifics that change, such as logging into a host xbox doesn't diffie-hellman anymore but instead key sets are distributed by the server backends with the session information. Additionally the auth side is basically non existent on system link.
Ah, cool, there has been some similar work done before! Is there any documented resources or write-ups of the Xbox Live protocol somewhere?
> Great RE work!
Thanks!
> Disclaimer: I created a proof of concept implementation of the Xbox Live server infrastructure here: https://github.com/xombieonline
That is a really cool project! How does one make sure the console connects to the server instead of the (now shutdown) Xbox Live servers? Does it e.g. have a hardcoded domain so one can simply add a DNS entry?
> Ah, cool, there has been some similar work done before! Is there any documented resources or write-ups of the Xbox Live protocol somewhere?
I talked at defcon a bit last year. https://www.youtube.com/watch?v=HLyZfZMu-5E Otherwise I've been a "source is documentation" kind of guy so far. Could definitely use a high level walkthrough as good as you've done here; I should probably get on that.
> That is a really cool project! How does one make sure the console connects to the server instead of the (now shutdown) Xbox Live servers? Does it e.g. have a hardcoded domain so one can simply add a DNS entry?
Yeah, they bootstrap off of a set of hardcoded domains. The config screens on the boxes let you specify a DNS server, so the project runs it's own DNS server that's basically when obi-wan says "of course I know him, he's me". Then the relative lack of any public/private crypto lets us take over as long as we know the preshared key in the individual xbox's eeprom.
> Loved it, thanks for being so thorough and document the train of thought.
Glad to hear! I was hoping to make the whole process easy to follow without any large skips or prior knowledge. It is more or less my process but with a lot of dead ends removed.
> I want to ask about one thing I could not understand completely on the final section: If there was a client that sent arbitrary values for selected weapon, forward, left, etc; would the host count them as valid? (I understood this is essentially what the MITM allowed to do)
Yes, it appears so. The host seems to accept more or less arbitrary values (at least for forward, left, actions) and also just re-broadcasts them to everyone. The guest client then also ignores what it sent and just uses what it receives from the host. This allows us to modify the inputs/speed of any guest client players without desyncing the clients.
> Also, a little feedback, my immersion broke when the video did not show Howard and Ghost anymore. Something like Howard1 and Ghost1 would've helped understand a little bit more.
Good idea, I could have made it clearer which perspective the video was taken from (the guest client). Might be able to re-record or simply mention it in the text.
I haven't tried this out, I wonder how well the Halo 1 net protocol works over a less reliable connection. I encounter issues as soon as I momentarily minimize the emulator and it does not recover without starting a new game.
I wonder if it is enough for XLink to simply send the packets through a networked tunnel or if it actually needs to modify the packet payload somehow. The consoles might be able to handle everything as long as they are able to communicate with each other?
I played competitive HaloCE through 3 at a professional level. XBConnect is what people playing competitive CE used prior to halo 2 and xbox live. Game was playable up to about 60ms, with <40 greatly preferred. Hosts had a large advantage, but off host was very predictable, and required leading the targets.
The same advantage existed on LAN, with competitive tournaments setup to trade host advantage for team color advantage. The last in person CE lan I attended, we were playing on modded Xboxes with a patched version of the game that allowed a third box as a neutral host, and added an on screen timer. Happy to expand on the details if anyone is interested.
> "age in a bot" might be a truncated form of "message in a bottle."
Yeah, that makes sense, it is a very odd sentence otherwise. Truncating on "bot" might be a play on words for game AI/NPC.
> The PRNG exponentiation scheme is essentially Diffie-Hellman.
Ah, of course, yes, I was thinking it reminded of public-key cryptography.
> Including, e.g., plasma pistol?
Yeah, it seems so, that was the first weapon I was thinking it to be used for. I tried e.g. setting the duration to zero and charging the plasma pistol. It still shoots like normal and does not seem to affect visual effects, audio or damage for neither host nor guest. It is still possible that it is used for something else that I have not noticed. Modifying the host's fire duration does not cause a desync so it might not affect the game state.
Thanks, I was initially surprised that they were encrypted but I can speculate on a few potential reasons:
- The Xbox was designed to be able to play online via Xbox Live (e.g. with Halo 2 that came out later in 2004), and they might have simply reused the network stack for System Link over LAN. I looked a little bit at Halo 2 system link, it uses the same system calls from the kernel but the protocol seems to be more complicated (e.g. the IV is never sent in plaintext, the two consoles derive it somehow). I haven't looked at Xbox Live, but Halo 2 could potentially use the same for System Link and Xbox Live.
- The Xbox also really tried to lock down its security in order to prevent game piracy and homebrew games. This might have been another attempt to reduce the attack surface.
- They also might have just wanted to keep their game protocols secret for trade secrets or simply avoiding scrutiny. In this case, we were able to create a kind of cheat, which they might have also wanted to avoid. Even though it is rarely an issue at LAN parties, it might have simply looked bad for the brand.
From what I've heard from microsofties over beers, it was really the second one. They didn't expect developers to write network code in ~2001 that didn't have memory safety vulnerabilities and wanted a barrier there between simple overflows and system security.
The child in me from 20 years ago dreams of a software tool downloaded from a questionable website that jailbroke an xbox just by putting in the IP address.
I mean, minus the USB->controller wire "hardware mod", it has been perfected to "download a memory card gamesave", "have a non-GOTY edition of a game" and you were a few minutes away from being soft-modded, ready to hack your cached Halo maps to swap the needler texture in for the wall textures, and change character textures to brighter versions (gummibear hack, maybe?).
Makes me want to wipe the XBMC xbox in my parents basement and break out my Splinter Cell and memory card just to do it all again.
Thanks for the answer. Like 5 years ago I tried snooping around halo system link packets because I just assumed there was no encryption and was disappointed. Wasn't this multiplayer rushed out in a month? Why on earth is a LAN protocol secure in 2001?! lol
Makes total sense, especially recalling the zeitgeist of the era. IIRC, this was during the height of worms which propagated via vulnerabilities in code that handles network traffic.
However, a few years ago Ikea removed them in Sweden also, unfortunately. From what I've heard it's because they got too many complaints internationally due to people believing that the covers were broken.