Bunnie explains the technical intricacies and legalities of Xbox hacking


Andrew "bunnie" Huang, who literally wrote the book on hacking Xboxes, was to be a witness in last week's first-of-its-kind trial for Xbox modding. However, the government prosecutor bungled his case so badly that he was forced to withdraw the charge and walk away, leaving the defendant unscathed.

However, Bunnie had already prepared an exhaustive briefing explaining the use-control system in the Xbox 360 that Crippen, the defendant, was on trial for modifying. It was intended to explain to a lay jury the fundamentals of crytographic signatures and scrambling, and to point on the subtle and important ways in which Xbox modding is different from other reverse-engineering that courts have already ruled against, such as breaking the DRM on a DVD.


I've been following this kind of thing closely for years, but I'm not a technical expert — not in the sense that Bunnie, a legendarily accomplished reverse engineer is, anyway. Bunnie's explanations always leave me with a more thorough understanding of the subject than I had when I started, and this is no exception. Highly recommended reading.

The common use of "encryption" or "scambling" is tantamount to an "access control" insofar as a work is scrambled, using the authority imbued via a key, so that any attempt to read the work after the scrambling reveals gibberish. Only through the authority granted by that key, either legitimately or illegitimately obtained, can one again access the original work.

However, in the case of the Xbox360, two technically different systems are required to secure the authenticity of the content, without hampering access to the content: digital signatures, and watermarks (to be complete, the game developer may still apply traditional encryption but this is not a requirement by Microsoft: remember, Microsoft is in the business of typically selling you someone else's copyrighted material printed on authentic pieces of plastic; in other words, they incur no loss if you can read the material on the disk; instead, they incur a loss if you can fake the disk or modify the disk contents to cheat or further exploit the system).

USA v. Crippen — A Retrospective