FATX filesystem corruption and recompiled kernels

Discussion in 'Xbox (Original console)' started by Myria, Jan 21, 2014.

  1. Myria

    Myria Peppy Member

    Joined:
    Aug 21, 2012
    Messages:
    341
    Likes Received:
    14
    I doubt a lot of people know this, but the original kernel for the Xbox had a bug in its FATX filesystem driver that supposedly caused data corruption to the filesystem metadata. It was fixed likely in the 5100s of kernel revisions.


    After the fix was added for future kernels, the XDK was updated so that all XBEs made by the XDK would detect old kernels and apply an in-memory patch to the machine code to fix the bug. The XAPI startup code checked for known kernel releases and applied patches to versions that matched.


    It doesn't look like Xecutor or the other kernel hacking groups were aware of this. Their kernels didn't fix the bug--the leaked source was around 4400 if I remember correctly. Because they always used bogus version numbers, the XBEs never try to patch. Good since the addresses would be wrong.


    Maybe this is why filling up most of the space on a drive can corrupt it?
     
  2. JayFoxRox

    JayFoxRox Spirited Member

    Joined:
    Dec 23, 2010
    Messages:
    176
    Likes Received:
    9
    The codebase for the hacked bios was patched pretty early on to solve this problem as far as I know.
    The bug was also part of the COMPLEX and at least iND 5003 changelog.

    So unless you are running an old inoffical bios you are good. The scene was aware of the bug and I believe it was even fixed before Microsoft did it.
     
  3. Echelon9

    Echelon9 Member

    Joined:
    Jan 6, 2013
    Messages:
    8
    Likes Received:
    1
    Interesting piece of history Myria!
     
  4. CodeAsm

    CodeAsm ohci_write: Bad offset 30

    Joined:
    Dec 22, 2010
    Messages:
    1,500
    Likes Received:
    176
    Wow, Thats indeed an intresting piece.. I should take a look in the changelogs and try to compare code of the official kernels (and dashboards maybe)
    Good to see a dashboard list comming aswell. Myria, do you happen to know something about MS patching other things than known Bugs or glitches?
     
  5. Myria

    Myria Peppy Member

    Joined:
    Aug 21, 2012
    Messages:
    341
    Likes Received:
    14
    The only other kernel patch I've seen a retail XBE do is change the code segment limit to be the end of the kernel's INIT section, which is an anti-exploit attempt. It causes an exception to occur if you try to execute stack memory, which makes buffer overruns and the like harder. Too bad for them, because Agent Under Fire, MechAssault, and Splinter Cell don't execute their shellcode from the stack. =)
     
sonicdude10
Draft saved Draft deleted
Insert every image as a...
  1.  0%

Share This Page