GENERAL Finding Hardware Vulnerabilities?

[hetelek]

I have been researching Xbox file formats for a few years now, and hope to do so for the Xbox One soon. The only problem is - before software, people must find the keys to decrypt and dump the NAND (or get an XDK). With this said, I am completely clueless on where to start to look for hardware vulnerabilities.

When attempting to dump the NAND or find the keys to decrypt the NAND, where does someone start? I have read the the NAND has been dumped for the Xbox One (obviously, encrypted), and I am quite curious how they managed to figure this out. Also, what type of knowledge is needed to learn about this (ex. electrical engineering)?

I am completely clueless when it comes to this stuff, but I do want to contribute. I just don't know what to study, or where to start. I saw the thread on here that showed the Xbox One's parts and the model numbers, which seems like a start. Now lets say I wanted to dump the memory that is in chip that is surrounded by the green square (SK Hynix H26M42003GMR 8 GB eMMC NAND Flash according to the teardown) in this image - where would I start, and what do I need to learn?

 

[hetelek]

As awesome as it would be for one of the members of Team Xecuter to just drop in here and give a quick "how we did it" story....

it's not going to happen.

That's really not what I'm looking for. I'm looking for a much more general overview of what has to be learned before attempting to find vulnerabilities. Like is it electrical engineering, microprocessing, etc? Do they find stuff by literally looking at the circuits, and following them and stuff? I have 0 idea of how they do it, and I am just very curious.

 

[Oggy]

A lot of microcontrollers have their datasheets uploaded online so you can see where the data lines are, proprietary ones are not as common, but a logic analyzer will go a long way helping find data lines on it.

You have to remember, xbox's are very much like PC's - we've shown you can replaced parts in the dvdrom from their pc counterparts on numerous occasions. Nand flashes are common things these days, as are eMMC devices -

Don't let that get in the way of the skill involved of course, just it helps if you are dealing with more common components, which fairly often, you are.