Article URL: https://www.tomshardware.com/video-games/console-gaming/microsofts-unhackable-xbox-one-has-been-hacked-by-bliss-the-2013-console-finally-fell-to-voltage-glitching-allowing-the-loading-of-
This console had remained a fortress since its launch over a decade ago.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
You are now subscribed
Your newsletter sign-up was successful
A groundbreaking hack for Microsoft’s ‘unhackable’ Xbox One was revealed at the recent RE//verse 2026 conference. This console has remained a fortress since its launch in 2013, but now Markus ‘Doom’ Gaasedelen has showcased the ‘Bliss’ double glitch. Just as the Xbox 360 famously fell to the Reset Glitch Hack (RGH), the Xbox One has now fallen to Voltage Glitch Hacking (VGH).
“In 2013 some kind of iron curtain came down on security, of the Xbox ecosystem, and the Xbox One never got hacked,” noted Gaasedelen in his introduction. The same is true of the Xbox One’s successors, and Microsoft was rightly proud. Seven years after its launch, Microsoft engineers would still assert that the Xbox One was “the most secure product Microsoft has ever produced.”
What made the Xbox One so secure, so special? Gaasedelen referenced prior work and presentations to convey this information. I’ve shared a summary slide about this, too, but let’s fast forward to the demo of the new Bliss hack, which takes place from about 46 minutes into the presentation.
Since reset glitching wasn’t possible, Gaasedelen thought some voltage glitching could do the trick. So, instead of tinkering with the system rest pin(s) the hacker targeted the momentary collapse of the CPU voltage rail. This was quite a feat, as Gaasedelen couldn’t ‘see’ into the Xbox One, so had to develop new hardware introspection tools.
Eventually, the Bliss exploit was formulated, where two precise voltage glitches were made to land in succession. One skipped the loop where the ARM Cortex memory protection was setup. Then the Memcpy operation was targeted during the header read, allowing him to jump to the attacker-controlled data.
As a hardware attack against the boot ROM in silicon, Gaasedelen says the attack in unpatchable. Thus it is a complete compromise of the console allowing for loading unsigned code at every level, including the Hypervisor and OS. Moreover, Bliss allows access to the security processor so games, firmware, and so on can be decrypted.
What happens next with this technique remains to be seen. Digital archivists should enjoy new levels of access to Xbox One firmware, OS, games. There could be subsequent emulation breakthroughs thanks to this effort. We also now have a route to making a Bliss-a-like mod chip to automate the precise electrical glitching required.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
Whether PC users, our core readership, will be interested in actually emulating Xbox One, looks unlikely. The 2013 system’s game library is largely overlapped in better quality on the PC platform.
Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.
Mark Tyson is a news editor at Tom's Hardware. He enjoys covering the full breadth of PC tech; from business and semiconductor design to products approaching the edge of reason.
SPPV said:"One skipped the loop where the ARM Cortex memory protection was setup."Reply
The XBOX One doesnt use an Arm Cortex CPU it uses AMD. Nice try though
And it just so happens to have an ARM CPU on it for certain tasks.
that Lee guy said:So... 13 years later, its hacked... thats not news and it was most likely hacked way sooner but nobody wanted to say something.Reply
the point of hacking it is to do something with it once it is hacked. had it been done before, we'd know cause we'd have ROMs and plenty of other fun stuff to do with it. there is no reason for anyone to go through the trouble of finding the exploit to not tell anyone. that's just not how the world works :)
Thunder64 said:And it just so happens to have an ARM CPU on it for certain tasks.The ARM microcontroller in the gamepad hardly countsReply
SPPV said:The ARM microcontroller in the gamepad hardly countsJust watch the video...Reply
The AMD APU has a mini arm core in it,
"platform security processor (PSP) based on the ARM Cortex-A5"
https://www.pcmag.com/news/amd-adds-arm-security-core-to-next-gen-mobile-chips
TerryLaze said:Just watch the video...Reply
The AMD APU has a mini arm core in it,
"platform security processor (PSP) based on the ARM Cortex-A5"
https://www.pcmag.com/news/amd-adds-arm-security-core-to-next-gen-mobile-chipsThat PCMag article would seem to contradict there being an ARM co-processor embeded in the AMD APU on the X1 though. That article, dated April 2014 quotes AMD as saying that they will be being released for the first time later that year for retail and commercial clients but the X1 was 2013. If M$/XBOX was already buying them back would have had to have been 2011 or so at least for it to be included in the X1 then somebody is mistaken. Either AMDs spokesperson is giving erroneous info or there isnt a co-processor
SPPV said:That PCMag article would seem to contradict there being an ARM co-processor embeded in the AMD APU on the X1 though. That article, dated April 2014 quotes AMD as saying that they will be being released for the first time later that year for retail and commercial clients but the X1 was 2013. If M$/XBOX was already buying them back would have had to have been 2011 or so at least for it to be included in the X1 then somebody is mistaken. Either AMDs spokesperson is giving erroneous info or there isnt a co-processorAs I said just watch the video, he goes into great detail and shows detailed pics of the actual APU and shows where the PSP is on that.Reply