Thread by @carrot_c4k3

some info about the xbox hacking news that is starting to be shared bc i want to make sure everyones expectations are set appropriately: my goal is to release (probably early next month) an exploit for xbox one/series consoles which will allow full kernel read/write in systemos.

this is NOT a "jailbreak". systemos is the virtual machine where apps run, its the environment you get control over when you enable dev mode on your console. this exploit will allow full control over this vm homebrew on retail consoles without dev mode. it will NOT allow piracy.

the exploit consists of two pieces: a user mode part which gains native code execution in the context of a uwp store app (). i've posted a proof-of-concept here which demos mapping and executing new code using this app's language apps.microsoft.com/detail/9pb1gw7…
gist.github.com/carrot-c4k3/10…

once user mode code exec has been achieved, the second part starts, which is to exploit the kernel. this part uses a kernel vulnerability to achieve arbitrary kernel read/write and elevate the process's privileges.

full transparency: this part isnt done yet 🙃 i have exploited this bug on standard windows from medium il, but the environment where we get user mode code exec here is a uwp app, which is more locked down. i have poc'd the kernel bug from uwp on xbox to verify it is accessible.

BUT the difficulty at the moment is... kaslr! my medium il exploit is reliant on the classic NtQuerySystemInformation leaks, which are not available to uwp apps 🥲 so i'm being forced to work around this.

loyal readers of will recognize this as a difficulty i discussed in the last post () when attempting to exploit 24h2 insider preview and solved using a timing side channel.exploits.forsale
exploits.forsale/24h2-nt-exploi…

my current plan is to do the same here, but xbox is amd and i only really got the side channel reliable on intel, so i have lots of timing and number crunching ahead of me 🫠

ANYWAY thats the status of things. hopefully soon i will have an exploit to share with everyone! if you'd like to play around with it using this then i recommend updating a console to the latest dash, downloading the game script app, running it, and taking the console OFFLINE :^]

(also if anyone has a uwp accessible kaslr bypass they wanna give me that would be greatly appreciated <3)