emoose/excrypt

Open source replacement for the Xbox360 XeCrypt suite.

ExCrypt

ExCrypt is an open-source drop-in replacement for the XeCrypt suite of functions used by the Xbox 360.

It's been designed to be as closely compatible to those functions as possible - perhaps at the expense of various security & performance concerns.

As such, it should only be used where compatibility with existing Xbox 360 code/data is required.

Contents

The goal of ExCrypt is to implement XeCrypt functions known to be used on the Xbox 360.

We only target XeCrypt functions that are exported from the kernel, used during X360 boot, or included inside a game/app.

For a list of XeCrypt targets, their status, and any implementation-specific notes, take a look at the implementation status page.

Implementation

Code has to make sure to set the exact same state variables & return values as the 360 functions do.

This doesn't mean variables local to the function have to match up though - only data that is somehow written externally (hence could maybe be acted on by other non-XeCrypt code) should be kept exact, the rest can work however we want.

Code is expected to be receiving big-endian data, converting that data to little-endian to be worked on may be required.

Some effort to make the code a bit more readable, rather than just a straight assembly-to-C conversion, would be appreciated (though isn't exactly mandatory, so long as the code actually works)

We only target x86 & x64 - maybe other platforms in the future, but for now there's not much use in supporting anything else.

Where possible, making use of existing, well-known crypto code is always preferrable to needing to write your own (unless some XeCrypt oddity somehow prevents it, that is)

excrypt's Issues

Implementation Status

TODO:

• update list below with implemented functions
• add XeKeys functions to list
• check bootloaders/HV for any other functions that are used outside of XeCrypt-internal stuff
• add test vectors for each function
• ensure all _STATE structs are byteswapped before/after accesses to them

Kernel: 67/88

Export Name	Location	Implemented	Has Tests?	Notes
XeCryptAesKey	Kernel	✔️	❌
XeCryptAesEcb	Kernel	✔️	❌
XeCryptAesCbc	Kernel	✔️	❌
XeCryptBnDwLeDhEqualBase	Kernel	❌	❌
XeCryptBnDwLeDhInvalBase	Kernel	❌	❌
XeCryptBnDwLeDhModExp	Kernel	❌	❌
XeCryptBnDw_Copy	Kernel	✔️	❌
XeCryptBnDw_SwapLeBe	Kernel	✔️	❌
XeCryptBnDw_Zero	Kernel	✔️	❌
XeCryptBnDwLePkcs1Format	Kernel	❌	❌
XeCryptBnDwLePkcs1Verify	Kernel	❌	❌
XeCryptBnQwBeSigCreate	Kernel	❌	❌
XeCryptBnQwBeSigFormat	Kernel	✔️	❌
XeCryptBnQwBeSigVerify	Kernel	✔️	❌
XeCryptBnQwNeModExp	Kernel	❌	❌
XeCryptBnQwNeModExpRoot	Kernel	❌	❌
XeCryptBnQwNeModInv	Kernel	✔️	❌
XeCryptBnQwNeModMul	Kernel	✔️	❌
XeCryptBnQwNeRsaKeyGen	Kernel	❌	❌
XeCryptBnQwNeRsaPrvCrypt	Kernel	❌	❌
XeCryptBnQwNeRsaPubCrypt	Kernel	✔️	❌
XeCryptBnQw_Copy	Kernel	✔️	❌
XeCryptBnQw_SwapDwQw	Kernel	✔️	❌
XeCryptBnQw_SwapDwQwLeBe	Kernel	✔️	❌
XeCryptBnQw_SwapLeBe	Kernel	✔️	❌
XeCryptBnQw_Zero	Kernel	✔️	❌
XeCryptChainAndSumMac	Kernel	✔️	❌
XeCryptDesParity	Kernel	✔️	❌
XeCryptDesKey	Kernel	✔️	❌
XeCryptDesEcb	Kernel	✔️	❌
XeCryptDesCbc	Kernel	✔️	❌
XeCryptDes3Key	Kernel	✔️	❌
XeCryptDes3Ecb	Kernel	✔️	❌
XeCryptDes3Cbc	Kernel	✔️	❌
XeCryptHmacMd5Init	Kernel	✔️	❌
XeCryptHmacMd5Update	Kernel	✔️	❌
XeCryptHmacMd5Final	Kernel	✔️	❌
XeCryptHmacMd5	Kernel	✔️	❌
XeCryptHmacShaInit	Kernel	✔️	❌
XeCryptHmacShaUpdate	Kernel	✔️	❌
XeCryptHmacShaFinal	Kernel	✔️	❌
XeCryptHmacSha	Kernel	✔️	❌
XeCryptHmacShaVerify	Kernel	✔️	❌
XeCryptMd5Init	Kernel	✔️	❌
XeCryptMd5Update	Kernel	✔️	❌
XeCryptMd5Final	Kernel	✔️	❌
XeCryptMd5	Kernel	✔️	❌
XeCryptParveEcb	Kernel	✔️	❌
XeCryptParveCbcMac	Kernel	✔️	❌
XeCryptRandom	Kernel	❌	❌	Uses RC4 with a static RC4_STATE, inited by Hypervisor during boot - is it possible to find what that initial value is?
XeCryptRc4Key	Kernel	✔️	❌
XeCryptRc4Ecb	Kernel	✔️	❌
XeCryptRc4	Kernel	✔️	❌
XeCryptRotSumSha	Kernel	✔️	❌
XeCryptShaInit	Kernel	✔️	❌
XeCryptShaUpdate	Kernel	✔️	❌
XeCryptShaFinal	Kernel	✔️	❌
XeCryptSha	Kernel	✔️	❌
XeCryptSha256Init	Kernel	✔️	❌
XeCryptSha256Update	Kernel	✔️	❌
XeCryptSha256Final	Kernel	✔️	❌
XeCryptSha256	Kernel	✔️	❌
XeCryptSha384Init	Kernel	✔️	❌
XeCryptSha384Update	Kernel	✔️	❌
XeCryptSha384Final	Kernel	✔️	❌
XeCryptSha384	Kernel	✔️	❌
XeCryptSha512Init	Kernel	✔️	❌
XeCryptSha512Update	Kernel	✔️	❌
XeCryptSha512Final	Kernel	✔️	❌
XeCryptSha512	Kernel	✔️	❌
XeCryptBnQwNeCompare	Kernel	✔️	❌
XeCryptAesCtr	Kernel	❌	❌
XeCryptAesCbcMac	Kernel	❌	❌
XeCryptAesDmMac	Kernel	❌	❌
XeCryptSha224Init	Kernel	✔️	❌
XeCryptAesCreateKeySchedule	Kernel	✔️	❌
XeCryptAesEncryptOne	Kernel	✔️	❌
XeCryptAesDecryptOne	Kernel	✔️	❌
XeCryptAesCbcEncrypt	Kernel	✔️	❌
XeCryptAesCbcDecrypt	Kernel	✔️	❌
XeCryptAesGcmInitialize	Kernel	❌	❌
XeCryptAesGcmUpdate	Kernel	❌	❌
XeCryptAesGcmFinalize	Kernel	❌	❌
XeCryptEccGetCurveParameters	Kernel	✔️	❌	Weird function, returns an address to a uint32? Is there anything that uses this we can look at?
XeCryptEccEcdhGenerateKeypair	Kernel	❌	❌
XeCryptEccEcdhExponentiate	Kernel	❌	❌
XeCryptEccEcdsaGenerateSignature	Kernel	❌	❌
XeCryptEccEcdsaVerifySignature	Kernel	❌	❌

---

Extra: 2/8

These are mentioned in a header file available on pastebin, doesn't seem like kernel has them included though, need to see if any bootloaders or other OS files might include them (otherwise there's not really any way to tell how they're implemented...)

If nothing uses them I guess they aren't that important, but still worth mentioning for completeness sake.

Export Name	Location	Implemented	Has Tests?	Notes
XeCryptBnQwNeRsaPrvExpFromRoot	Header	❌	❌	Generates private exponent for input private key?
XeCryptBnQwBeSigDifference	Header (+ Bootloaders/HV?)	✔️	❌	Mostly same as SigVerify but "returns difference"?
XeCryptMemDiff	1BL	✔️	❌	Used by SigDifference
XeCryptBnQwNeEcSigVerify	Header	❌	❌	Elliptic curve
XeCryptEmeOaepPack	Header	❌	❌
XeCryptEmeOaepUnpack	Header	❌	❌
XeCryptPkcs1ReverseBytes	Header	❌	❌	Related to the EmeOaep funcs above
XeCryptOmac1Compute	Header	❌	❌

AesCbc differences

When encrypting, XeCrypt pads block with zeroes if a block is < 16, but atm we just treat every block as if it's 16 bytes, so trying to encrypt 65 bytes will result in those 65 bytes, and the following 15 bytes of whatever is in memory next to it (buffer overreads are fun!)

When decrypting, it seems only full blocks will be decrypted, eg. trying to decrypt 65 bytes will result in only 64 decrypted bytes being written.

Need to try and emulate the XeCrypt behaviors.

Testing against actual XeCrypt code

Need to test the functions against the actual XeCrypt ones, and make sure that all outputs & state variables are the same between them both.

The only way I can see to do this ATM is to create an XEX and run it on an actual 360, though I do wonder if maybe GFWL includes XeCrypt funcs, and if we could run them externally... (testing against actual 360 results is probably better than anything on x86/x64 though, since the outputs/states from 360 tests would definitely be in the correct endian order, etc)

Improve SHA1 & MD5 update functions

(SHA1 & MD5 both seem to be able to use the same update code, since the block size for both is 64 bytes, only the transform algorithm is different between them)

Right now the ExCryptShaUpdate function code is a little bit dumb, handling inputs one byte at a time, which slows things down immensely.

XeCryptShaUpdate on the other hand uses much more optimised code, checking against the input size to see if the input could be memcpy'd directly, etc. Probably worth trying to reverse this and replacing our update function with it.

Once the Update function is more optimised it might be worth looking into using "Intel SHA Extensions" to get even more out of it.

E: It seems ShaUpdate currently isn't updating the SHA_STATE properly after being ran neither, ditto for ShaFinal IIRC. It might be worth disassembling the actual XeCrypt functions and using those instead of a third-party lib.

Change build system

Should change the build system from VS solutions/projects to something more cross-platform, maybe go with premake like Xenia uses? Don't know how difficult that'd be to set up for this though.

Implementation Checklist

Checklist of function names, see #5 for more info about them.

• XeCryptAesKey
• XeCryptAesEcb
• XeCryptAesCbc
• XeCryptBnDwLeDhEqualBase
• XeCryptBnDwLeDhInvalBase
• XeCryptBnDwLeDhModExp
• XeCryptBnDw_Copy
• XeCryptBnDw_SwapLeBe
• XeCryptBnDw_Zero
• XeCryptBnDwLePkcs1Format
• XeCryptBnDwLePkcs1Verify
• XeCryptBnQwBeSigCreate
• XeCryptBnQwBeSigFormat
• XeCryptBnQwBeSigVerify
• XeCryptBnQwNeModExp
• XeCryptBnQwNeModExpRoot
• XeCryptBnQwNeModInv
• XeCryptBnQwNeModMul
• XeCryptBnQwNeRsaKeyGen
• XeCryptBnQwNeRsaPrvCrypt
• XeCryptBnQwNeRsaPubCrypt
• XeCryptBnQw_Copy
• XeCryptBnQw_SwapDwQw
• XeCryptBnQw_SwapDwQwLeBe
• XeCryptBnQw_SwapLeBe
• XeCryptBnQw_Zero
• XeCryptChainAndSumMac
• XeCryptDesParity
• XeCryptDesKey
• XeCryptDesEcb
• XeCryptDesCbc
• XeCryptDes3Key
• XeCryptDes3Ecb
• XeCryptDes3Cbc
• XeCryptHmacMd5Init
• XeCryptHmacMd5Update
• XeCryptHmacMd5Final
• XeCryptHmacMd5
• XeCryptHmacShaInit
• XeCryptHmacShaUpdate
• XeCryptHmacShaFinal
• XeCryptHmacSha
• XeCryptHmacShaVerify
• XeCryptMd5Init
• XeCryptMd5Update
• XeCryptMd5Final
• XeCryptMd5
• XeCryptParveEcb
• XeCryptParveCbcMac
• XeCryptRandom
• XeCryptRc4Key
• XeCryptRc4Ecb
• XeCryptRc4
• XeCryptRotSumSha
• XeCryptShaInit
• XeCryptShaUpdate
• XeCryptShaFinal
• XeCryptSha
• XeCryptSha256Init
• XeCryptSha256Update
• XeCryptSha256Final
• XeCryptSha256
• XeCryptSha384Init
• XeCryptSha384Update
• XeCryptSha384Final
• XeCryptSha384
• XeCryptSha512Init
• XeCryptSha512Update
• XeCryptSha512Final
• XeCryptSha512
• XeCryptBnQwNeCompare
• XeCryptAesCtr
• XeCryptAesCbcMac
• XeCryptAesDmMac
• XeCryptSha224Init
• XeCryptAesCreateKeySchedule
• XeCryptAesEncryptOne
• XeCryptAesDecryptOne
• XeCryptAesCbcEncrypt
• XeCryptAesCbcDecrypt
• XeCryptAesGcmInitialize
• XeCryptAesGcmUpdate
• XeCryptAesGcmFinalize
• XeCryptEccGetCurveParameters
• XeCryptEccEcdhGenerateKeypair
• XeCryptEccEcdhExponentiate
• XeCryptEccEcdsaGenerateSignature
• XeCryptEccEcdsaVerifySignature

Extras:

• XeCryptBnQwNeRsaPrvExpFromRoot
• XeCryptBnQwBeSigDifference
• XeCryptMemDiff
• XeCryptBnQwNeEcSigVerify
• XeCryptEmeOaepPack
• XeCryptEmeOaepUnpack
• XeCryptPkcs1ReverseBytes
• XeCryptOmac1Compute