> As it turns out, data after the signature block isnt checked at all... and it can even override data that came before it. Whenever two blocks of the same type are stored together, the last one overrides all the others before it. So, if we want to change any license data, we can just make a block for it and put it after the signature block!
I wonder if this is the worst cryptography blunder since Nintendo Wii using 'strncmp' to validate a hash (which stops after the first matching 00 byte)
This "check the block signature and then read another one" bug is incredibly common. I'd say it's one of the top 5 bugs I see in Validating Things. Other examples of places I've seen this recently include some variants of VW AG infotainment systems (mostly MIB2 High, I think), but it's kind of everywhere (as was the `strncmp-a-hash` method of validating an RSA-PKCS#1.5 signature).
This is probably the most egregious/impactful manifestation of it, though, especially if it applies to Xbox.
Amazing.