lobsters score: 1 · tags: hardware, reversing
Does this work on all hardware revisions? What happens after you gain arbitrary code execution? Do you need to run the glitch every time you boot the console?
score 1 · canonical
My RGH’d (Reset Glitch Hack) console can vary in how long it takes to boot. On average, it’s not very long, but I’ve waited upwards of around 30-40 seconds to get to the splash screen. The RGH chip on my console does the glitch every boot, so it’s considered persistent (there are non-persistent software exploits such as BadUpdate, with further projects like XeUnshackle to get your system closer in state with exploited consoles that have been JTAG’d or RGH’d).
As for what what you do with exploit: my (simplified) understanding is roughly that glitching the chip causes some registers to get zero’d, which is very convenient when code performing
memcmpis being evaluated (for comparing, say, hashes). So, you want to patch the hypervisor (which has been dumped and reverse engineered from various sources) and then do whatever you want. In practice, the downstream effect of this technical trickery was that kids would be infecting each other with mod menus on Call of Duty.
score 1 · canonical
Fun fact! (Since Raspberry Pi Pico was used by the author to do fault injection)
Raspberry Pi Pico actually has defense against this kind of fault injection built into its hardware! And they even provided a $10,000 bounty to anyone who can circumvent their countermeasures.
And yes, people did succeed.
score 1 · canonical