Tony Hawk's Pro Strcpy

> The more interesting thing about the habibi key is that the public key modulus only has a 4 byte difference compared to the Microsoft RSA public key. For reference the MS key is a 2048 bit RSA key. I’ve asked a few people how this might be possible and the answer I got is “if you change the exponent to something small like 3 you easily factor out a similar key”. This should require that the exponent of the public key is also patched to “3”. However, none of the shell code payloads that use the habibi key ever change the exponent used by the RSA signature verification routine. Presumably it’s still performing the validation using the exponent 65537 so I’m not entirely sure how this works. Perhaps someone more knowledgeable could shed some light on it.

A random 2048-bit integer has a moderate chance of being trivially factorizeable (I don't know the precise odds but we can infer that it's roughly on the order of 2^-32 (for some definition of trivial) without doing any real math). Presumably, they wrote code that did something like this:

    while true:
        randomly tweak/increment 4 bytes of the public modulus 
        spend 1 millisecond trying to factor it
        did it work? if yes, we're done here.
        else, try again.

The resulting public modulus likely has lots of smaller factors (it should be possible to verify this, if anyone knows where I can find the "habibi public key"?). Although an RSA modulus normally has exactly 2 prime factors, the math still works out if you have more (as long as e is coprime).

It may not be possible for me to articulate how fucking insane of an accomplishment this is.

Xbox 360...._softmod_.... via the park name on a Tony Hawk game.

24 segment ROP chain :')

His rightful lamentation for the hypervisor, concise functional write up, and immediate thoughts of an x360 botnet make this the greatest xbox 360 nostalgia gut-punch of all time.

kudos++

- "If I was lucky it would be strcpy (opposed to something like strncpy)"

it really ought to have been strncpy, I'm sure Tony Hawk who's lauded for his advocacy of safety gear would prefer to be associated with safer string copying

A bit of a shame about the exploit applying to THUG PRO. The mod is played to this day, since the more competitive side of the Tony Hawk franchise has been dead for almost twenty years (with the exception of the THPS1+2 remake, which was but a blip in the scene).

The mod itself is over 10 years old now, and I think the original developers are gone, explaining why no one was interested in fixing it when Ryan reported it. But this means that now the mod is unusable, no one is going to want to risk a full privilege exploit taking over their PC.

Hopefully this article reaches someone who's a bit more interested in patching the mod.

FYI, what looks like a section header icon followed by the text "So what's the habibi key?" is actually a clickable expanding segment (html details). You should click it if you're interested!

A question I have is where/when/how the corresponding private habibi key was released/leaked, if the story about it being used exclusively by the linux console group to prevent pirated content from being used is true. OP clearly was able to patch the four byte difference between the MS key and the habibi key to then run "unsigned" (but, actually, signed with the habibi private key) executables, so they clearly got their hands on it.

This is awesome!

I've been doing some PSX decompiling and there are lots of similar things there as well. Interestingly, something like `memmove` is linked in using an SDK library[0], but `strcpy` is a function provided by the BIOS. Later version of the SDK could patch that out for a library version, but as late as 1997 it hadn't been.

0 - https://github.com/Xeeynamo/sotn-decomp/blob/master/src/main...

I've read so many flavors of this sort of exploit analysis over the years, and if I get to read 100 more I'll be all the happier for it.

Great article!

This seems like a great example of having the wrong security mindset in console development. "We're the only thing that can write this saved data, so we only have to parse what we wrote" is a very common console mindset, and fundamentally wrong when people can prepare artificially constructed saved data.

(Completely separate from that, consoles shouldn't be treating users as the adversary, but given that they do, games are failing to have a security mindset consistent with that stance.)

In Tony Hawk’s defence, he’s a pro skater, not a security analyst. Limited time behind the keyboard in the late 90s/early 2000s grinding on his soon-to-be iconic game series would have been spent making sure 900 McTwists felt really natural, not auditing code for buffer overruns!

This gives me an opportunity to clarify a myth from my childhood. Was Tony Hawk the first ever to hit a 720?

Thanks for sharing, the other articles on this blog are equally fascinating

Imagine a VSCode plugin that made up trick names and gave you a combo points score at the bottom for your continuous keystrokes. Tony Hawk's Pro-grammer

I was hoping that the exploit would only execute if he stuck the landing across the gap

I have a dumb question. Once you soft mod a game console, what type of stuff can you do?

at that point I would rather re-make the game in Godot

Very good article.