Hacker breaks into most secure product Microsoft has ever made
Once considered an unhackable fortress, Microsoft’s Xbox One console has been successfully jailbroken, opening the door for enthusiasts to run arbitrary code on the device for the first time.
While newer Nintendo and PlayStation consoles have been cracked, Microsoft’s console remained unhacked since the launch of the Xbox One in 2013.
In 2020, David Weston, who is now Microsoft’s head of OS security and enterprise, went so far as to say it was the most secure product the company had ever made.
“Hacking game consoles is kind of a rite of passage for each generation, but in 2013, some kind of iron curtain came down in security,” said hacker Markus Gaasedelen in his RE//verse 2026 talk about the crack.
“The Xbox One never got hacked, nor did any of its successors,” he said, adding that it remained this way for 12 years.
In the talk, Gaasedelen explained his process for hacking the unhackable console, which began with research.
He watched a video where senior Microsoft software engineer Tony Shen detailed why the console was so secure, adding in an important detail.
“Tony also stressed that the entire chain of trust really hinges on them being able to maintain control of the BootROM,” Gaasedelen said.
The BootROM is the console’s initial code executed when it is powered on. It initialises the device’s hardware and loads the system software.
This was the vector Gaasedelen decided to explore for a vulnerability, but finding the chink in the Xbox’s armour would be no easy feat.
He decided that the best method would be to force the hardware to fault by playing with the electrical supply to various components.
Initially, Gaasedelen had to create his own device to “see” into the console to make sure his efforts to manipulate the voltage in components around the ARM Cortex R4 chip were working.
To achieve full control, he would have to cause a “double glitch”. This required chaining two precise voltage glitches to overcome the console’s security layers.
These layers were formidable. The Xbox One’s BootROM can trap code execution within “user jails,” essentially areas where unprivileged code cannot run.
The console’s Memory Protection Unit (MPU) enforced these user jails and prevented the BootROM from running any code that didn’t come from the system root user.
Microsoft had a counter for the double-glitch attack too, as it had inserted 37 randomised stalls in the BootROM, making it extremely challenging to time a voltage glitch.
Gaasedelen built a device that monitored power drops during the pre-boot phase, and when he observed the correct timing between the random stalls, he was able to inject the glitch.
This glitch completely prevented the MPU from turning on, allowing him to avoid the jails and grant himself read, write, and execute permissions.
Gaasedelen still needed access to supervisor mode if he was going to officially proclaim that the unhackable Xbox One was finally cracked. That meant he had to perform another voltage glitch attack.
Completing the hack
The second glitch would be a program counter hijack. He caused another finely timed voltage glitch on the hardware during a heavily optimised memory operation, timed down to the millisecond.
This caused the console to glitch and treat the code Gaasedelen placed in memory as official Microsoft code. This step gave him control of the supervisor and completed the hack.
Gaasedelen explained that the real power of this type of hardware hack is that it manages to insert code and assume control at the very moment the console begins to boot up.
Since the attack happened so early in the console’s wake-up process, control was achieved even before it had a chance to launch security protocols to block hostile code or encrypt files and passwords.
Since the exploit was baked into hardware, it is “basically a god mode hardware hack that cannot be patched,” he said.
Gaasedelen could now unlock any file on the console and run whatever custom software he wanted on the machine.
Given the age of the Xbox One and Microsoft’s approach to its consoles, it seems unlikely that the jailbreak will benefit gamers or harm the company.
It isn’t expected that a new wave of Xbox One game emulators will emerge following the hack. Not because it can’t be done now, but because there just isn’t demand.
Tom’s Hardware reported that there could be breakthroughs in emulator tech stemming from the crack, and that archivists will have access to newly revealed Xbox One firmware, OS, and games.
However, there are very few Xbox One games that are not already available on PC or newer Microsoft consoles. As it stands, Gaasedelen carried out his hack solely to take on a world-first challenge.
Loading ...