杏吧原创

Hardware hackers back in business

The powerful computers inside games consoles are spawning creations their makers never intended

RICH LEGRAND鈥橲 HUMR robot zips around the floor, controlled by a palm-sized computer mounted atop its four-wheeled Lego chassis. The computer started life as a Gameboy Advance, and a robot is probably not the application Nintendo had in mind for its $70 toy.

Yet the games console, which has an advanced 32-bit microprocessor at its heart, is turning out to be one of the cheapest ways of getting hold of a high-powered, lightweight, portable battery-powered computer. LeGrand is one of many enthusiasts who have started hacking into the sophisticated electronics inside cheap games consoles to adapt it to their own ends. He has even turned his hobby into a moneymaking venture, and now runs a company called Charmed Labs that sells Gameboy enhancements.

His first project, called the Xport, transformed the Gameboy into a programming device for one of the most versatile electronic components around: the field programmable gate array. An FPGA is a chip sporting thousands of logic gates whose internal connections can be changed by software. One minute the FPGA might be configured to recognise images, say, and the next it could be a number-crunching processor. In the past, reprogramming an FPGA required professional engineering equipment. Xport made it fun.

It鈥檚 not the first time this trend, known as hardware hacking, has led to the creation of a profitable business. Andrew 鈥淏unnie鈥 Huang, author of Hacking the Xbox, likens the recent boom in modifying electronics to the early days of the microcomputer revolution. Back then, Silicon Valley garage hackers dismantled and expanded each other鈥檚 creations, spawning dozens of companies. One of them was Apple, founded by Steve Wozniak and Steve Jobs (see 鈥淭he slot plot鈥).

In the 1970s, enthusiasts could dissect products, and then go and improve them. But by the 1980s, the average piece of consumer electronics had become too complex for amateurs to take apart. Hacking became something you did with software, not solder.

So why the change now? Huang puts it down to the dotcom downturn. 鈥淪uddenly you could pick up expensive test equipment at dotcom fire-sale auctions,鈥 he says. This gear is often specific to a particular consumer product, and has allowed hackers to peer into gadgets as never before 鈥 much to the dismay of the manufacturers. It鈥檚 something Huang himself discovered when he unlocked the secrets of the Xbox.

The Xbox is supposed to be a 鈥渃losed鈥 version of a traditional PC 鈥 unexpandable, and designed to play only Microsoft-approved games. To prevent anyone loading their own software, Microsoft buried a 128-bit cryptographic key on a 512-byte area of ROM hidden within its support circuitry, which is required to decrypt the rest of the Xbox鈥檚 on-board software. The way it worked was impenetrable: dropping in code without using Microsoft鈥檚 key to encrypt it first was impossible.

Curious to uncover Microsoft鈥檚 secret code, Huang realised he could read the ROM if he tapped into the console鈥檚 internal data channel that links its chips. He hand-soldered links to the 20 data lines, and connected them to a purpose-built circuit, capturing the key as it flitted between chips. With the code, owners of an Xbox can load any software, just as on an ordinary PC. Since Huang鈥檚 hack, Microsoft has updated Xbox security 鈥 only to find it hacked again by other enthusiasts.

And it鈥檚 here, running unauthorised code, that hardware hacking might hit stiff opposition. Microsoft subsidises every console that it sells, expecting to more than make up the deficit in profits from approved games sales. A hacked Xbox means Microsoft is, in effect, selling general-purpose hardware at a loss.

The legal climate for reverse-engineering is more hostile now than it was in Jobs and Wozniak鈥檚 day. Huang鈥檚 research was rejected by one book publisher and almost disowned by MIT, his alma mater, because of fears that publication might put the institute in breach of the Digital Millennium Copyright Act, which makes it illegal to break copy-protection systems.

鈥淭raditionally, hardware makers and their users shared a common interest in wanting to make their product as useful as possible,鈥 says Wendy Seltzer, a lawyer with the Electronic Frontier Foundation, the civil rights group that advised Huang. 鈥淣ow manufacturers are making deliberately crippled products 鈥 and hackers are trying to fix them.鈥

So even if hardware hackers do spawn another revolution in innovation, they may be tarred with a reputation for freebooting piracy as much as their software-hacking predecessors.

The slot plot

Steve Wozniak and Steve jobs, the founders of Apple Computer, did well out of Silicon Valley鈥檚 hardware-hadding culture in the 1970s. Wozniak openly shared the blueprints and software of the original Apple I design. He also insisted on providing an extravagant eight expansion slots for their first mainstream computer, the Apple II, that owners could use to plug in their own hardware. While jobs felt this was overkill, Wozniak knew that eager hackers would find more applications for the Apple II than its two creators could imagine. The free and open specification of the Apple II design created a cottage industry of add-ons and modifications that kept the machine in production for almost 20 years.

Then Apple changed. In 1984, Jobs made it clear he wanted a closed design for the new all-in-one-box Macintosh Peeved engineers led by Burrell Smith, the developer of the first Mac, tried to sneak in what they called a 鈥渄iagnostic port鈥, but they were rumbled when a senior engineers got wing of their plot, and the slot was removed.