RE//verse 2026: Hacking the Xbox One by Markus 'doom' Gaasedelen

Markus Gaasedelen details the security architecture of the Xbox One and how its Platform Security Processor bootrom was analyzed and exploited.

From RE//verse 2026, catch Markus Gaasedelen’s talk Hacking the Xbox One: Launched in 2013, the Xbox One’s security story is often reduced to a single word: unhackable. Beneath that banner is a security architecture where every obvious target is both hardened by platform specific mitigations and disposable. Usermode, kernel, hypervisor, and system firmware are independently protected, signed, and bound to a morphing key tree, so exploiting one version does not buy you the ability to decrypt or run future updates and content. Only one piece of critical code lies outside that safety net: the tiny, carefully constructed bootrom of the Platform Security Processor, burned directly into the system’s custom AMD SoC. Microsoft engineered the bootrom as a fortress. A minimal complexity, hardened core with purpose built hardware countermeasures, fault tolerant software patterns, randomized stalls, and layered runtime redundancy to maintain tight control over the earliest boot stage. As the anchor for the entire chain of trust, this code is expected to perform a measured cryptographic boot while withstanding multiple targeted glitches from a persistent physical attacker, detecting power, memory, and control flow irregularities to avoid compromise. This bootrom represents an unprecedented escalation in platform security, offering only the faintest side channels to study its execution. Every experiment becomes a patient probe: a guided reverse engineering effort stacking scraps of signal, reading the tea leaves of carefully shaped faults, and weaponizing subtle side effects to wrest control of a legendary security core and shatter the Xbox One chain of trust once and for all. When you whisper your secrets into the dark heart of the system and, for the first time in history, it whispers back, “unhackable” starts to sound less like a property and more like a challenge. For more RE//verse updates, subscribe to our newsletter: mailchi.mp/re-verse/reverse-mailing-list-signup