In part 3 of the Xbox 360 Hypervisor hacking series, the author details significant improvements to the Bad Update exploit, transforming it from a slow, unreliable process into a near-instantaneous, near-100% successful method. The first major improvement came from "ihatecompvir" and "Invoxi Play Games", who discovered a new game save entry point in the demo version of Rock Band Blitz (RBB). By exploiting memory corruption vulnerabilities in the game's DLC parsing code, they crafted a game save file that could bootstrap the Bad Update stage 2 ROP chain. This eliminated the need for the Tony Hawk American Wasteland game disc, making the exploit as simple as copying files to a USB stick and launching Rock Band Blitz from the dashboard.
Shortly after, "Máté" submitted a pull request with optimizations to the hypervisor race condition part of the exploit. These improvements included a hash table for precomputing and storing malicious ciphertext values, a better cache flushing primitive, and improved thread scheduling between the XKE payload thread and ciphertext overwrite thread. These changes reduced execution time to a few seconds and significantly increased the success rate. The author also discusses the ciphertext hash table, explaining how they previously failed to use a lookup table due to issues with an old hypervisor build and TLB flushes, which are now resolved.
Source: Hacker News · Summarized by HeadlinesBriefing