First You Need The Hypervisor and Challenge Response

Open spoiler for fun
[spoil]
]#include <xtl.h>
#include "stdafx.h"
#include "AtgConsole.h"//simple text output to screen
#include "AtgFont.h"
#include "AtgInput.h"//get input from controller
#include <string>
#define XBOX_KRNL
#define resolveFunct
#define XECRYPT_RC4_STATE
#define rc4
#define XeCryptRc4Ecb
#define XeCryptRc4Key
#define MmGetPhysicalAddress
#define XeCryptHmacSha
#define patchInJump
bool DecryptChallenge(BYTE* data, DWORD fileSize);
#include <string>

ATG::Console daConsole;
using namespace std;
void doConsole(string daText);
void __cdecl main()
{
doConsole("XeDumpChallenge");
doConsole("By ColdK1ller86");
doConsole("Thanks to Fuse, Kaine7s, teh1337 and Dwack");
doConsole("Press A to begin");
for(;;)
{
ATG::GAMEPAD* pGamepad = ATG::Input::GetMergedInput();//Get the Inputs ATM
if( pGamepad->wPressedButtons & XINPUT_GAMEPAD_A )//If buttons are pressed and the button pressed is the a button
{
typedef DWORD (*XEKEYSEXECUTE)(BYTE* chalData, DWORD size, BYTE* HVSalt, UINT64 krnlBuild, UINT64 r7, UINT64 r8);
// Catching call to XeKeysExecute in XAM
// Directing it to this function instead of actual Kernel function
DWORD XeKeysExecuteHook(BYTE* chalData, DWORD size, BYTE* HVSalt, UINT64 krnlBuild, UINT64 r7, UINT64 r8)
{
XEKEYSEXECUTE XeKeysExecute=(XEKEYSEXECUTE)resolveFunct(XBOX_KRNL 607);
SYSTEMTIME LocalSysTime; GetLocalTime( &LocalSysTime);


doConsole("Entering Xbox Live Challenge hook\n");
doConsole.("SystemTime: %d-%d-%d\t%d:%d:%d\n", LocalSysTime.wMonth, LocalSysTime.wDay,LocalSysTime.wYear, LocalSysTime.wHour, LocalSysTime.wMinute, LocalSysTime.wSecond);
doConsole("r3 = 0x%08X, r4 = 0x%08X, r5 = 0x%08X\n",
chalData, size, HVSalt);
doConsole("r6 = 0x%016I64X, r7 = 0x%016I64X, r8 = 0x%016I64X\n",
krnlBuild, r7, r8);

// Decrypt the challenge data
// Seems to share the same header as a bootloader
// char[2] Magic
// short Version
// int Flags
// int EntryPoint
// int Size
// byte[0x10] HMAC Hash -> RC4 Key


DWORD dataSize = *(DWORD*)(chalData + 0xC);
if(!DecryptChallenge(chalData, dataSize))
{
doConsole("Error decrypting challenge \n");
int HalReturnToFirmware(6);
}

// Create HV Salt file
HANDLE hvSalt = CreateFile("hdd:\\XeKeysExecute_HVSalt.bin", GENERIC_WRITE,
FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
if( hvSalt == INVALID_HANDLE_VALUE)
{
doConsole("Error Creating HV Salt File\n");
int HalReturnToFirmware(6);
}
doConsole("File Created\n");



// Get the HV salt
DWORD saltOut = 0;
if (WriteFile( hvSalt, HVSalt, 0x10, &saltOut, NULL))
doConsole("Saved HV Salt\n");
else doConsole("Could not save HV Salt \n");


// Close our HV Salt handle
CloseHandle( hvSalt );

doConsole("Dumping resp\n");


// Execute the challenge
BYTE* physSalt = (BYTE*)MmGetPhysicalAddress(HVSalt); // Do what we patched
XeKeysExecute(chalData, size, physSalt, krnlBuild, r7, r8); // go to actual kernel function

HANDLE chalResp = CreateFile("hdd:\\XeKeysExecute_resp.bin", GENERIC_WRITE,
FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
if( chalResp == INVALID_HANDLE_VALUE)
{
doConsole("Error Creating Response File\n");
int HalReturnToFirmware(6);
}
doConsole("Response File Created\n");

// Save the challenge response
DWORD respOut = 0;
if (WriteFile( chalResp, chalData, size, &respOut, NULL))
doConsole("Saved response data\n");
else doConsole("Could not save response data \n");

// Close our challange response dump
CloseHandle( chalResp );

// We dumped the challange data -> reboot
doConsole("Dumped Challenge - Rebooting System\n");
int HalReturnToFirmware(6);
return (0);
}

void patchPhysicalAddr()
{
DbgPrint("Patching MmGetPhysicalAddress in challenge function so we can grab the HV Salt\n");
UINT32* addr = (UINT32*)(0x81677EE4); // 14719
addr[0] = 0x60000000;
}

bool DecryptChallenge(BYTE* data, DWORD fileSize)

{
doConsole("Decrypting XeKeysExecute Challenge Data\n");
XECRYPT_RC4_STATE rc4;
BYTE* decChalData = (BYTE*)XPhysicalAlloc(fileSize, MAXULONG_PTR, 0, PAGE_READWRITE);
memcpy(decChalData, data, fileSize);
BYTE* rc4Key = (BYTE*)XPhysicalAlloc(0x10, MAXULONG_PTR, 0, PAGE_READWRITE);
BYTE key[0x10] = {0xDD, 0x88, 0xAD, 0x0C, 0x9E, 0xD6, 0x69, 0xE7, 0xB5, 0x67, 0x94, 0xFB, 0x68, 0x56, 0x3E, 0xFA}; // found in HV
XeCryptHmacSha((BYTE*)key, 0x10, decChalData + 0x10, 0x10, 0, 0, 0, 0, rc4Key, 0x10);
XeCryptRc4Key(&rc4 rc4Key, 0x10);
XeCryptRc4Ecb(&rc4 decChalData + 0x20, fileSize - 0x20);
HANDLE hFile;
DWORD size;
hFile = CreateFile("hdd:\\XeKeysExecute_chalData_dec.bin", GENERIC_WRITE,
FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
if( hFile != INVALID_HANDLE_VALUE)
{
doConsole("Created Challenge File\n");
if(WriteFile(hFile, decChalData, fileSize, &size, NULL))
{
CloseHandle(hFile);
XPhysicalFree(decChalData);
XPhysicalFree(rc4Key);
doConsole("Decrypted challenge data saved\n");
return true;
}
else
return false;
}
patchPhysicalAddr();
patchInJump((PDWORD)(0x81A30364), (DWORD)XeKeysExecuteHook, false);
}
}
}
}
void doConsole(string daText)
{
daConsole.Create( "game:\\Media\\Fonts\\Arial_16.xpr", D3DCOLOR_XRGB(0, 0, 0), D3DCOLOR_XRGB(0,200,0) );//First D3D is the Background and the second is the text color
daConsole.Format((" - "+daText+" - ").c_str());//The format function adds text to the console
//daConsole.Format("\ntest");
}