Archive for category games

Python script to generate Xbox save signing keys

A while ago I discussed how save signing for the original Xbox works and the methodology to generate the correct key to resign a save.  Save Hacking is becoming something of a legacy these days and I’m keen to do what I can to enable others to continue to work on what I guess is called ‘retro’ these days.

With that in mind I’ve uploaded a quick and dirty Python script to generate Xbox save signing keys to GitHub.

Using xbox-save-sig is as simple as passing in the path to a default.xbe file:

python xboxsig.py -i /path/to/default.xbe

The output will be a text representation of the digital signature for save signing:

737E064C0236BA3E7140EC2B91D76766

The script can output the key in a selection of formats and being Python can run on many different systems.

The script is licensed under the MIT License, which is pretty permissive, so feel free to fork, improve and put it to good use!

Tags: , ,

How to get out of Tashgar on Battlefield 4

Tashgar is surprisingly easy to get out of and there’s a huge section of the map that you never get to see.  Check out the video below to see how to get out and a couple of highlights I found.

The video is also available The Xbox One Upload Studio so check out my gamertag, goffi

Tags: , ,

Elgato Game Capture HD tutorial: Record Skype calls & chat during capturing

The Elgato Game Capture HD is a great bit of kit for easily and quickly capturing HD video from your console or any HDMI equipped device.  One of it’s great features is the ability to Live Stream to your provider of choice, Twitch in my case, and overlay a live commentary in real time.

Now a live stream without any talk gets a bit dull, especially when there’s a few of you in a group discussing and laughing about what you’re doing.  Unfortunately there’s no easy way to capture the Xbox party chat. There’s a few tutorials out there which either have you push the party chat through the game audio on the Xbox whilst recording yourself separately or require you to have a specific headset and an array of different cables and adapters. Neither of these methods work great, the audio quality is often poor and in some cases you’ll find yourself manually mixing in audio tracks trying to line up your own chat recording to the game audio you recorded earlier .

I’ve found a much easier way to pass a Skype chat through to the Game Capture HD software which results in much faster and convenient recording as well as vastly increased voice audio quality.  Best of all, there’s no mixing audio tracks manually and it’s just about as lag free as you can get.

The tutorial is based on using a Mac running OSX 10.9, although any recent Mac OS will work and uses only free software.  You’ll need a gaming headset for the best results but this method can also be used with s standard headset with mic although you run the risk of game noise from your TV being heard whilst you speak which can ruin a good video.

Check the video below for full instructions on getting started.

I’m looking at doing an advanced follow up video for recording game audio as a separate track allowing you to stream to Twitch with a live commentary but also have local clips with just the pure game audio, keep an eye out on the Youtube Channel for it landing.

Tags: , ,

Authentic Neo Geo experience on the Raspberry Pi

I’ve been looking for some use to put my 1st gen Raspberry Pi to for some time and Shea Silverman’s work on getting a Neo Geo emulator up and running on the Pi seemed to be almost the perfect answer.

Almost.

Playing classics such as Soccer Brawl (possibly the first game I played on the AES) with a keyboard is OK but lets knock this up a notch; enter the Neo Geo X Arcade Stick (disclaimer: this link takes you to the purchase page for the Arcade Stick but I get no referral fees or payment).
The new Neo Geo X Arcade Stick claims to be a 1:1 replica of the original with genuine arcade parts all tied together neatly with a USB connector.  What better way to recreate the arcade experience at home?

The Arcade Stick is automatically recognised as a joystick by the Raspberry Pi and if you’ve followed Shea’s instructions you already have a config file with joystick support enabled (top tip for the installation; if the ~/.gngeo folder doesn’t get created automatically you probably don’t have the right bios or rom set, the folder is only created after a successful launch).
If you have rolled your own config you need to ensure joystick support is enabled:

# enable joystick support ?
joystick true

There’s only one thing left to do which is update the config file with a joystick mapping, unfortunately the 2 sample configs aren’t a 1:1 match with the Arcade Stick layout so we’ll have to write our own.  One thing to note is the Arcade Stick buttons C & D are presented out of order and need to be swapped accordingly in the config file.

# NeoGeoX
p1control A=J0B0,B=J0B1,C=J0B3,D=J0B2,START=J0B9,COIN=J0B8,UP=J0a1,DOWN=J0a1,LEFT=J0A0,RIGHT=J0A0

Add the config under the existing Xbox 360 and Dualshock2 samples, save the file and you’re good to go.
Add Coin is mapped to Select so once you’ve loaded the emu you can select menu items with B (A is cancel), hit Select to insert a coin and relive the days when you would look on with wonder at what is possibly the most expensive gaming system to date.

If you’re a PC gamer wondering if the Neo Geo X Arcade Stick works on your platform of choice I can confirm that I have had it successfully running with FBA with only the joystick mapping needing to be changed.  But lets face it, running Neo Geo games on a £500+ PC isn’t as cool as running it on one that costs £35.

Tags: ,

Xbox save resigning – a technical overview

This article covers the saves signing process used by the original Xbox.  Only the standard signing process is discussed, the “noroam” signatures are not covered.  All code is based on my own work or derivative work of others.  The language used in examples is Delphi and assumes a familiarity with programming concepts such as the use of records or structures for reading in data.

The reason I’ve never previously discussed the Xbox save signing procedure in public is concern that by doing so would negatively impact Xbox Live.  Now that the original Xbox and it’s games are unable to access the Xbox Live service the following information is relatively harmless.

A brief history

The original Xbox used digital signatures to validate not only executables it was loading but save data, with this it was impossible to change or tamper with a save without updating the file’s digital signature using the correct key.  This key was generated using data contained within the default.xbe and a key used by the Xbox Operating System.  The save data was then run through a SHA1 HMAC routine and the 20 byte result appended to the save data to confirm integrity. This result, or digest, was usually found at the beginning or the end of a file although it can potentially be located anywhere in the file if the developer was feeling adventurous.

Obtaining the XBE key

Each Xbox game has a default.xbe file, this is the executable that is loaded whenever you start a game. It contains various information including the title ID, age rating, game region and the all important signature key.  Don’t get confused, this is not the key used to sign the saves but is an essential piece in the process.
The first step is to obtain the key directly from the XBE. This is stored in a certificate area of the file, the address of which is located in the XBE header. Before we can retrieve the key we need to define the structure of the XBE Header and the Certificate data we will be retrieving:

?View Code DELPHI
// XBE sections
unit xbestruct;
 
interface
 
type
ByteArray = array[0..15] of byte;
 
type
TxbeHeader = record
	m_magic : cardinal;                    // magic number [should be "XBEH"]
	m_digsig : array[0..255] of char;      // digital signature
	m_base: cardinal;                      // base address
	m_sizeof_headers : cardinal;           // size of headers
	m_sizeof_image : cardinal;             // size of image
	m_sizeof_image_header : cardinal;      // size of image header
	m_timedate : cardinal;                 // timedate stamp
	m_certificate_addr : cardinal;         // certificate address
	m_sections : cardinal;                 // number of sections
	m_section_headers_addr : cardinal;     // section headers address
	m_init_flags : cardinal;
	m_entry : cardinal;                         // entry point address
	m_tls_addr : cardinal;                       // thread local storage directory address
	m_pe_stack_commit  : cardinal;                // size of stack commit
	m_pe_heap_reserve : cardinal;               // size of heap reserve
	m_pe_heap_commit  : cardinal;                 // size of heap commit
	m_pe_base_addr : cardinal;                   // original base address
	m_pe_sizeof_image : cardinal;               // size of original image
	m_pe_checksum : cardinal;                // original checksum
	m_pe_timedate : cardinal;                   // original timedate stamp
	m_debug_pathname_addr  : cardinal;            // debug pathname address
	m_debug_filename_addr : cardinal;           // debug filename address
	m_debug_unicode_filename_addr : cardinal;   // debug unicode filename address
	m_kernel_image_thunk_addr : cardinal;        // kernel image thunk address
	m_nonkernel_import_dir_addr : cardinal;      // non kernel import directory address
	m_library_versions : cardinal;               // number of library versions
	m_library_versions_addr : cardinal;          // library versions address
	m_kernel_library_version_addr : cardinal;    // kernel library version address
	m_xapi_library_version_addr : cardinal;      // xapi library version address
	m_logo_bitmap_addr : cardinal;               // logo bitmap address
	m_logo_bitmap_size : cardinal;               // logo bitmap size
end;
 
pTXbeHeader = ^TXbeHeader;
 
type
TxbeCertificate  = record
	m_size : cardinal;                          // size of certificate
	m_timedate : cardinal;                     // timedate stamp
	m_titleid : cardinal;                       // title id
	m_title_name : array[0..63] of widechar;                // title name (unicode)
	m_alt_title_id : byteArray;            // alternate title ids
	m_allowed_media  : cardinal;                 // allowed media types
	m_game_region  : cardinal;               // game region
	m_game_ratings  : cardinal;                  // game ratings
	m_disk_number : cardinal;                   // disk number
	m_version : cardinal;                       // version
	m_lan_key : byteArray;                 // lan key
	m_sig_key : byteArray;                  // signature key
	m_title_alt_sig_key : array[0..15, 0..15] of byte;     // alternate signature keys
end;
 
pTxbeCertificate = ^ TxbeCertificate;
 
implementation
 
end.

The TxbeHeader record contains a lot of data but the two most important sections are m_certificate_addr, and m_base.  These two values give us the address of the certificate.

The following code retrieves the key from an XBE file:

?View Code DELPHI
var
    MS : TMemoryStream;
    xbeHeader : pTxbeHeader;
    xbeCert : pTxbeCertificate;
begin
 
    MS := TmemoryStream.Create;
    MS.LoadFromFile(FileName);
    new(xbeHeader);
    new(xbeCert);
    //Read in header and certificate
    MS.Read(xbeHeader^, sizeof(xbeHeader^));
    MS.Position := xbeHeader^.m_certificate_addr - xbeHeader^.m_base;
    MS.Read(xbeCert^, sizeof(xbeCert^));

We can now access the sig_key directly

?View Code DELPHI
xbeCert^.m_sig_key

Generating the signing key

The key we retrieved from the XBE is not used to directly sign save data, instead it is used in a SHA1 HMAC with the Xbox key to produce the actual key we need. Thankfully we don’t need to determine the Xbox key every time we need to sign or verify a save as it is a constant.

The following is a textual representation of this key, to use it you must first convert it to a 16 byte array:

5C0733AE0401F7E8BA7993FDCD2F1FE0

Once you have this key in a byte array simply run both the XBE key and the Xbox key through a SHA1 HMAC (referring to the documentation for your SHA1 HMAC function as to whether you need to pass data or memory addresses to the function). The output should be a 160bit digest truncated to 16 bytes (the last 4 bytes are not required and should not be used or present).

?View Code DELPHI
var
    digest : T160BitDigest;
begin
    digest := CalcHMAC_SHA1(addr(xboxKey), 16, xbeCert^.m_sig_key, 16);

Determining the data to process

As noted before the digital signature is usually found before or after the actual save data.  It is entirely possible to store this signature at any location in the file and treat this location as all 0’s during the HMAC process.  Since we cannot rely on all developers using the same location for the signature we must determine the location ourselves.

The fastest and easiest way to do this is to start a new game and make a save at the earliest opportunity.  If the game saves any options you change this is ideal, otherwise start playing and save as soon as you can.  Copy this save to you PC and label is SAVE A.

Load the game again and create another save with as small a difference as you can but ensuring something is different.  As before, if the game saves option changes you should change only a single item and re-save. Copy this save to your PC and label it SAVE B.

Open both saves in a hex editor and visually compare the two, with little differences between them you should easily spot the 20 byte digital signature either at the start or the end of the file.  You can use an automatic file comparison if your editor supports it but in my experience I can find the sig faster by eye.  The signature in both files should be wildly different with the actual save data very consistent, aside from the minor differences you saved earlier.

Once you have found the sig location you should exclude this from the HMAC routines.  If the sig is at the end of the file you should HMAC all data up to the last 20 bytes, if it is at the beginning then all data after the first 20 bytes should be processed.  If the signature is located at another location in the file then you will need to experiment as to what data to HMAC.  A common trick when generating checksum’s is to treat the area containing the result of the checksum as all 0’s during the processing stage and write the result back to this location once complete.  Please note, it is rare to see this, most saves store their signature at the beginning or end of the file.

Generating the signature

Now you have the correct key and the data to process you can generate or check signatures for that particular games save files.  Similar to how the key was generated, the actual signature generation is a SHA1 HMAC of the save data (excluding the existing signature) with the key.

In the following example the save signature is located at the end of the file and the data is copied to a different memory stream for processing. The previously generated key is stored in a 16 byte array named sigKey

?View Code DELPHI
mem := TMemoryStream.Create;
mem2 := TMemoryStream.Create;
mem.LoadFromFile(FileName);
mem.Position := 0;
mem2.CopyFrom(mem, mem.Size - 20);
digest := CalcHMAC_SHA1(addr(sigKey), 16, mem2.memory^, mem2.size);

Before making any changes to a save you should confirm that the signature you generate matches that already present on an unaltered save.

It’s worth bearing in mind that a lot of saves contain a checksum as well as a digital signature.  The most common being a CRC32 or a simple addition of bytes, you must recalculate this before the digital signature should you make any changes to the file.

Conclusion

The process of creating a digital signature for Xbox saves is fairly simple and can be summarized as

  • SHA1 HMAC “XBE key” using “Xbox key”
  • Truncate resulting 160 bit digest to 16 bytes to create the “signature key”
  • SHA1 HMAC Save data using “signature key”
  • Compare resulting 160 bit digest to existing signature or write back to save file.

If you use the information above to create anything or produce a unique save, drop me a line in the comments, sometimes the most interesting time in a games life is long after it was released..

Tags: , , ,

Halo Waypoint Top 5 Series returns

I’m a big fan of the community features introduced in Halo 3 and always check out the latest screen shots and videos whilst waiting for a game to start. When Halo Waypoint was released I was pleased to see a regular feature on community videos and it became a regular feature for my Wednesdays.

If, like me, you were disappointed when season 1 ended you’ll be glad to hear that it’s made it’s return today with a top 5 entitled “Welcome Aboard” focusing on the art of boarding.

The video at number 2 might look a little familiar to those that were reading (and watching) my exploits back in June 2009….

Tags: , , ,

“Bump” your way to hidden areas on ODST

The Secret Glyph Project have been hard at work and have figured out what was causing the doors in Sector 8 to disappear (see The ODST glyphs *DO NOT* unlock a door!” and Confirmed: ODST door disappearance is a glitch) and got in working in other sectors!

They’ve wrapped it up nicely in this Youtube video which servers as both a demonstration and tutorial.

For detailed information on how to repeat it and how it works check out their discussion forum and get “bumping”!

Tags: , , ,

Confirmed: ODST door disappearance is a glitch

I’ve just gone back to the in-game video of me showing a friend the disappearing door in Sector 8 (see my previous post for details) and I checked out Sector 8 before and after the door disappears. This is nothing more than a repeatable glitch.

In comparison to the fully loaded sector when the door is missing the following applies:

3 areas used as the SI supply drops are now open (not just the 1 originally discovered).
The grunts and turrets are not loaded in one of the circular areas.
Adverts for cars are missing from the walls.
Various items are not loaded such as the Opticon health dispensers and stand alone terminals (such as the one near the shotgun).

So it’s a case of good work on finding a glitch, now can we do this on other sectors to access even more areas that should be blocked off?

JSM26 has uploaded an ODST video to his Bungie.net file share showing missing Opticon dispensers and de-loaded doors in the starting sector. Further evidence that the ODST modified Halo 3 engine has glitches, possibly exploitable to access other blocked off areas the designers never wanted us to get to…

Tags: , , ,

The ODST glyphs *DO NOT* unlock a door!

There’s been quite a bit of excitement over at Bungie.net recently, someone noticed that if you look at some of the glowing Covenant glyphs in Sector 6 resulted in two doors in Sector 8 disappearing allowing access to a previously blocked off area and an empty supply drop.  The Secret Glyph Project got on the wagon and produced a video demonstrating the effect and a whole slew of sub-forums were created to track this phenomenon.

I’m sad to say that  the doors disappear from what appears to be a loading glitch, not from looking at any glyphs. Here’s how I determined this, I encourage you to try this to replicate the results:

Having completed the game I loaded up New Mombasa Streets,  immediately got myself a mongoose and headed to Sector 8 to check on the door.  At this point I should point out that at no time after getting the mongoose did I have the visor on. The door was closed as expected.
I then drove over to Sector 6 and without turning on my visor walked up to the covenant sniper rifle next to the Elites, picked it up and got back on my mongoose (parked near to the Sector exit). I then drove immediately back to the door which was now open with no glyphs sighted.

If you look at a map you’ll see that Sector 8 is actually a twisted mirror of Sector 3 and if you look closely you’ll see that Sector 3 also has a room with funny tiles on it matching the location and design of the one in Sector 8. If you go to this area you’ll immediately feel at home and easily spot the Security door as placed in a mirror fashion to the one in Sector 8. This door opens…

So, it’s my belief that this is just fall out to the way the game engine loads the levels and nothing at all to do with the glyphs, it’s just coincidence that they are located in the area you need to go to de-load the doors.

Certain glyphs lead you to keys areas so for me it’s pretty clear that the glyphs are there for player guidance and to add an air of mystery. Give it it a go, try the experiment above and let me know your results.

Tags: , ,

Halo 3 Asset-O-Matic R.I.P?

As expected, the redesign of Bungie.net; has stopped the Halo 3 Asset-O-Matic from working.

I’m not sure if I will be updating the app to support the new layout, I’ll have to see how inspired I am with the release of ODST…;)

Tags: ,