>Keeping this in mind, the attack on the Xbox is pretty straightforward: If we connect the CPU's A20# pin to GND, the Xbox will not start from FFFFFFF0, but from FFEFFFF0 - this is not covered by the secret ROM, but is ordinary flash memory, because flash is mirrored over the upper 16 MB. So by only connecting a single pin, the secret ROM is completely bypassed
This is interesting to me because it sounds remarkably similar to my admittedly very naive understanding of how jailbreaking the Nintendo Switch (original console, not sure about the recent Switch 2) works, just inverted; there's a single pin under where the right joycon slots in that seems to be responsible for ensuring that the OS (or firmware? my understanding of what step this is in the boot process is pretty fuzzy) is properly loaded, so shorting it is enough to allow injection of pretty much whatever you want to boot instead. The entirety of what you need to do from a hardware perspective even as a complete novice is access to a desktop/laptop, the USB-C cable that comes with the console, and a plastic nub people 3D print and sell on Amazon for like $8 to slide into the joycon slot, and you're done.
All this makes me wonder how hard it should actually be for console makers to catch these sorts of things ahead of time. Shouldn't be be fairly straightforward to just look at every single pin and consider what happens if it's turned on or off? Assuming the others are in the default state would be sufficient to have noticed both the issue with the Xbox and the one I describe in the Switch, so it's not like there's some insanely high number of combinations you need to consider to at least make it twice as hard to hack. It's understandable that in 2005 maybe this wasn't something that Microsoft would have thought of in their first time making a console, but the Switch came out over a decade after that, and Nintendo has been pretty vigorously going after "piracy" since before then, so it's hard to imagine that this was due to indifference.
This is interesting to me because it sounds remarkably similar to my admittedly very naive understanding of how jailbreaking the Nintendo Switch (original console, not sure about the recent Switch 2) works, just inverted; there's a single pin under where the right joycon slots in that seems to be responsible for ensuring that the OS (or firmware? my understanding of what step this is in the boot process is pretty fuzzy) is properly loaded, so shorting it is enough to allow injection of pretty much whatever you want to boot instead. The entirety of what you need to do from a hardware perspective even as a complete novice is access to a desktop/laptop, the USB-C cable that comes with the console, and a plastic nub people 3D print and sell on Amazon for like $8 to slide into the joycon slot, and you're done.
All this makes me wonder how hard it should actually be for console makers to catch these sorts of things ahead of time. Shouldn't be be fairly straightforward to just look at every single pin and consider what happens if it's turned on or off? Assuming the others are in the default state would be sufficient to have noticed both the issue with the Xbox and the one I describe in the Switch, so it's not like there's some insanely high number of combinations you need to consider to at least make it twice as hard to hack. It's understandable that in 2005 maybe this wasn't something that Microsoft would have thought of in their first time making a console, but the Switch came out over a decade after that, and Nintendo has been pretty vigorously going after "piracy" since before then, so it's hard to imagine that this was due to indifference.