Dustin Holden - MakeMHz

Software and hardware developer. Owner of @MakeMHz LLC. ESL. Convicted hacker turned security researcher.

[Dustin Holden - MakeMHz @LoveMHz]

After 25 years, the original Xbox's last hidden ROM has finally been dumped: the CPU's microcode!

This has been a goal of mine for over 6 years, and I've worked on it off and on ever since.

Over the last couple of weeks, while building inventory and shipping orders, I've also been running hardware tests 24/7. This poor Xbox has rebooted over 50,000 times in those two weeks alone.

And it finally paid off.

The dump covers the entire 4,096-line microcode address space. The ROM itself occupies 3,200 of those lines, roughly 12 KB of microcode.

I can't overstate how huge this feels. After all these years, I finally have it.

A full write-up is coming next year!

[Dustin Holden - MakeMHz @LoveMHz]

You’re confusing microcode updates (patches) with the CPU’s internal microcode ROM, which is what I dumped. Comparing updates doesn’t establish whether the underlying ROMs match.

Stellar has also shipped microcode updates for all compatible Xbox CPU upgrades for years.

We can decode, modify, and repack these updates. I demonstrated a custom CPU patch in my follow-up tweet.

We also don’t know what all these updates fix. There’s no published changelog detailing their changes. That requires reverse engineering.

[Dustin Holden - MakeMHz @LoveMHz]

After 25 years, the original Xbox's last hidden ROM has finally been dumped: the CPU's microcode!

This has been a goal of mine for over 6 years, and I've worked on it off and on ever since.

Over the last couple of weeks, while building inventory and shipping orders, I've also been running hardware tests 24/7. This poor Xbox has rebooted over 50,000 times in those two weeks alone.

And it finally paid off.

The dump covers the entire 4,096-line microcode address space. The ROM itself occupies 3,200 of those lines, roughly 12 KB of microcode.

I can't overstate how huge this feels. After all these years, I finally have it.

A full write-up is coming next year!

[Dustin Holden - MakeMHz @LoveMHz]

@MakeAugusta 👀

[Dustin Holden - MakeMHz @LoveMHz]

Let the real fun begin!

[Dustin Holden - MakeMHz @LoveMHz]

After 25 years, the original Xbox's last hidden ROM has finally been dumped: the CPU's microcode!

This has been a goal of mine for over 6 years, and I've worked on it off and on ever since.

Over the last couple of weeks, while building inventory and shipping orders, I've also been running hardware tests 24/7. This poor Xbox has rebooted over 50,000 times in those two weeks alone.

And it finally paid off.

The dump covers the entire 4,096-line microcode address space. The ROM itself occupies 3,200 of those lines, roughly 12 KB of microcode.

I can't overstate how huge this feels. After all these years, I finally have it.

A full write-up is coming next year!

[Pink Skeleton Gaming @Pink_Skelly]

Stellar + HDMI install on the workbench today! Always a pleasure working on these.

[Dustin Holden - MakeMHz @LoveMHz]

@Professor_Jonny Yep, Peter did amazing work on the PII/P6. The PIII is quite different in many ways, which made this more of a challenge than I expected.

It's also a blind attack on the Xbox CPU, which made it even more challenging.

My work rides purely on his coattails. 🙏

[Dustin Holden - MakeMHz @LoveMHz]

@Professor_Jonny @jfwfreo What about it?

[Dustin Holden - MakeMHz @LoveMHz]

@rain0x06 Release what? The ROM belongs to Intel.

I’m working with others on tools so people can dump it themselves. Getting those ready for public release takes time.

[Dustin Holden - MakeMHz @LoveMHz]

And yes, we can patch the CPU itself!

Some of the obscure, difficult problems we’ve solved in Project Stellar’s software could potentially be handled through CPU microcode updates, allowing the original game code to run unchanged.

It’s far too early to say which fixes could benefit, but having the dumps is a huge step toward understanding what’s possible.

[Dustin Holden - MakeMHz @LoveMHz]

After 25 years, the original Xbox's last hidden ROM has finally been dumped: the CPU's microcode!

This has been a goal of mine for over 6 years, and I've worked on it off and on ever since.

Over the last couple of weeks, while building inventory and shipping orders, I've also been running hardware tests 24/7. This poor Xbox has rebooted over 50,000 times in those two weeks alone.

And it finally paid off.

The dump covers the entire 4,096-line microcode address space. The ROM itself occupies 3,200 of those lines, roughly 12 KB of microcode.

I can't overstate how huge this feels. After all these years, I finally have it.

A full write-up is coming next year!

[Dustin Holden - MakeMHz @LoveMHz]

Microcode updates are tied to specific CPU signatures: family, model, stepping, etc. There’s going to be overlap in CPUIDs, but that alone doesn’t establish whether the underlying ROMs are identical.

Pentium III microcode research is still very new, and there aren’t public ROM dumps available to compare against. This is something we’ll have to keep working on.

[Dustin Holden - MakeMHz @LoveMHz]

@_markel___ Hole in the current p6tools: it only unpacks the 231-bit uop line. I measured the RAM line at 246. This dump is 8 dwords, and 243 of those 256 lanes go high at least once. The extra live lanes aren't decoded yet.

I'll dig into that after I get Socket 370 / Slot 1 boards.

[Dustin Holden - MakeMHz @LoveMHz]

@cyothevile Yep! It's crazy what's possible now. Plus, being able to understand what is going on under the hood is huge.

[Dustin Holden - MakeMHz @LoveMHz]

For the very obscure and hard problems we solved in software, we can move some of that to "hardware patches" (the original code runs and the CPU is updated directly). It's way too early to say what exactly, but having the dumps is a huge step in being able to understand how everything works.

[Dustin Holden - MakeMHz @LoveMHz]

@DiabboVerdde @MakeMHz Soon! Join our Discord for firmware release announcements so you’ll know when updates are available.

[iFixRetro @iFixRetro]

XboxHD+ and Stellar Kit installed on a clear green Microsoft Xbox console! Play your games in crispy ass 720p HD display, while unlocking the full potential of the system!

[Dustin Holden - MakeMHz @LoveMHz]

😢

[troy @RobloxVoiceChat]

https://t.co/rtEdsgVD0U, a site to track decomp progress, is being sunsetted after 2 years. this is due to a lot of reasons but i'll cover the main reasons in this thread.

[Dustin Holden - MakeMHz @LoveMHz]

😍

[Dustin Holden - MakeMHz @LoveMHz]

👀

[Dustin Holden - MakeMHz @LoveMHz]

👀

[Tom's Hardware @tomshardware]

Original Sony PlayStation 2 security chip ‘broken wide open’ after 26 years — chemical decapping and four years of reverse engineering unlocks MechaCon secrets https://t.co/nKdKjbqDhh

[DiscoStarslayer @DiscoStarslayer]

After 4 years of effort, I'm happy to announce that one of the final secrets of the PS2 has been broken wide open!

It's been a long process of decapping, optical dumping, and now at last a software solution.

Thank you Libby for finding the exploit from our dirty optical dumps!