Hacking the Xbox 360 Hypervisor Part 3: Bad Update Improvements

Bad Update is an Xbox 360 hypervisor exploit whose original proof of concept required the Tony Hawk’s American Wasteland disc, took about 20 minutes to run, and succeeded roughly 30% of the time. Subsequent work made it far easier to launch and dramatically more reliable. Researchers found a memory-corruption entry point in the free Rock Band Blitz demo: a crafted save file triggers the exploit’s second-stage ROP chain, so users can launch it by copying files to a USB drive and starting the demo. This removes the need for the game disc and makes the exploit accessible through the console dashboard.

A separate set of changes improved the hypervisor race condition, reducing execution to a few seconds and raising success close to 100%. A lookup table now maps expected encrypted-memory ciphertext to malicious replacement ciphertext across all 1,024 possible whitening values. The original attempt at this table failed because the author used an older hypervisor build and called an encryption routine directly, bypassing a TLB flush normally performed by its kernel wrapper; stale whitening bits produced invalid ciphertext. The revised method accounts for those variations. Cache pressure also improved: instead of relying mainly on L2-cache locking, the exploit uses the kernel’s dcbz instruction across memory regions to allocate cache lines and evict existing data. Better scheduling of the payload and overwrite threads further strengthens the race.