TX组最新消息啊就是看不懂

黑金

How M$ Killed The XOR Hack
Categories: Featured Articles | 0 comments
With the new 15*** update, M$ has added a new key to their hash calculation for the rc4 key. It's basically just the first 16 bytes of the header, which include the version number, entrypoint, and size. These are all per-CB, per-version, so we cannot take a keystream from a 15*** CBB and use it to make a 14*** CB because the CBA on 14*** is unable to calculate the rc4 key no matter what we change.

What this means:
In order to RGH2 an xbox with 15***, you need either:

1) The cpu_key

2) A previous exploitable dump from the SAME XBOX. Must fit one of the following:
- Phats: 14717, 14719
- Slims: 13146, 13599, 14699, 14717, 14719

Older dumps will NOT WORK with RGH2/RGH3 !

DO NOT UPDATE TO 15*** WITHOUT BACKING UP FIRST!

What do we do now:
We are looking into ways of exploiting the rc4.

To make it clear, the new way of generating the CBB decryption rc4 key is as follows:

Secret = CBA[0x10:0x20]
Digest = CBB[0x10:0x20] + CPU_Key + CBA[0:6] + 0×0000 + CBA[8:0x10]

def decrypt_CB_Cpu(CB):
        assert cpukey
        secret = CB_A[0x10:0x20]
        h = hmac.new(secret,None, sha);
        h.update(CB[0x10:0x20]);
        h.update(cpukey);

        v = struct.unpack(">h", CB_A[0x6:0x8])[0]
        print " * checking flag: %X" % v
        if( v & 0x1000):
                print "  ** Using new encryption scheme"
                h.update(CB_A[0:0x6] + "\x00\x00" + CB_A[8:0x10]);

        key = h.digest()[0:0x10]
        CB = CB[0:0x10] +key+ RC4.new(key).decrypt(CB[0x20:])
        return CB

黑金

哪位大神给翻译翻译啊

spscott

总之就是说升级了15***系统，而且之前没有保存14***固件和cpukey的话，就自制不了啊，微软已经在新系统封死漏洞，吼吼，没自制得赶紧了

该用户已被禁言

谢谢楼上，幸好没升，要不就悲剧了

usa-911

如果要给15XXX的机子刷脉冲自制，不仅要有CPUKey，而且还要有同一台主机之前特定系统的备份，具体要求：
- Phats: 14717, 14719
- Slims: 13146, 13599, 14699, 14717, 14719
其它备份亦无效果。
所以在没有备份的情况下不要升级到15XXX！
小组正在研究破解新的加密。

jxgt

微软开始动手了 不要升级到15XXX