Remarks on forensically interesting Microsoft XBox 360 console features
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
Remarks on forensically interesting Microsoft XBox 360
console features
Silas Luttenberger, Knut Kröger and Reiner Creutzburg
Brandenburg University of Applied Sciences, Department of Informatics and Media,
Magdeburger Straße 50, D-14770 Brandenburg, Germany
ABSTRACT
This paper deals with forensically interesting features of the Microsoft Xbox 360 game console. The construction
and the internal structure are analysed more precisely. One of the main aspects of the study is to analyse the
used file system which was examined for forensic features. Possible difficulties that might be of importance to
the forensic investigator are discussed.
Keywords: Xbox 360 forensics, Xbox 360, FATX, game console forensics, small scale digital device forensics
1. INTRODUCTION - DIGITAL FORENSICS
Today digital forensics is very important when it comes to criminal activities in the internet like data theft or
online fraud. But also crime where digital devices are found, there is a need of a forensic investigation to get
evidences which can may impede or relieve a suspicious person. The area of digital forensics is relatively new
and in regularly steps new devices are released which have to be investigated by an examiner. One of the newly
devices is the category of game consoles. These devices are similar built like normal computers and made for the
specific group of gamers (mostly teenagers or young adults). The consoles are restricted in functionality so that
only a few configurations can be made and the console is just useful for gaming. Some people have discovered
the potential of a game console and unlocked more functionalities with the help of programs or modifications on
the device. This offers new possibilities for using the console and its functions for criminal activities and hide
information on the game console. Throughout the connection of the device with the internet and throughout the
community platforms of the respective manufacturer, criminals can deal as a gamer and so they can exchange
information with each other, looking for victims or can get into other criminal activities. Therefore applies to
investigate this area to get important evidences to prove if a suspect had contact with a victim, if information
was exchanged or if the suspect used the internet and the game console at a specific time.
This work is focused on the Xbox 360 S and programs which could be used for a forensic analysis of a Xbox
360. Therefore, a forensic image of the Xbox 360 S hard drive is used to get on the file system of the Xbox
360. Besides, specific files types of the Xbox are presented and which difficulties can occur during a forensic
analysis. At the end of the paper the practical process is shown as well as a summary and a prospect for future
investigations.
1.1 Motivation
The Xbox 360 was chosen because of its widespread dissemination and because it is developed by Microsoft. It
was assumed that the device is similarly built like the personal computers from Microsoft and connections can
be made between them. Another feature of the Xbox 360 is the Xbox LIVE online community where users get
connected to each other. Moreover, during recent years the Xbox LIVE occurred in connection with criminal
activities in the USA. Among these prolapses were suspects that connected with their victims. Later they met
each other in real outside of the Xbox LIVE community and sexually abused their victims1 .
Further author information: (Send correspondence to S. Luttenberger)
S. Luttenberger: E-mail: luttenbe@fh-brandenburg.de
K. Kröger: E-mail: kroeger@fh-brandenburg.de
R. Creutzburg: E-mail: creutzbu@fh-brandenburg.de, Phone: +49 (0) 3381 355 442
Other possible scenarios or criminal activities which are conceivable in context with the internet connection are1 :
• Any internet activities like for example the communication with criminal members
• Using the Xbox 360 for streaming of illegal content (like videos, music, ...)
• Searching for information about producing or selling drugs, money laundering or other criminal offences
• Prove if the user has a stolen Xbox 360 and if he was connected to the internet and when
• Radical groups can use online games for training possible attack/terror scenarios
• Saving of any data which could be useful for an investigation.
1.1.1 Background
On November 15, 2001 the Xbox was released2 in the USA and on March 14, 2002 in Europe6 . The first version
of the Xbox 360 was published on November 22, 2005 in the USA and in Europe on December 2, 20057. The
Xbox 360 exists in different variations which are different in structure, size, memory capacity and supplies. The
current version of the Xbox is the Xbox 360 S, whereas the S stands for Slim. This means that the Xbox 360
S is 30 percent smaller than the predecessor, has bigger hard drive with around 250 GB (actually 320 GB), a
WLAN adapter and is sold (depending on the package) with a Kinect. For Xbox 360 games exists a backward
compatibility that means games of the first Xbox can be used with the newer version Xbox 360. The Xbox 360
Slim includes a main processor with 3.2 GHz PPC Tri-Core, 512 MB DDR3 with 700 MHz, a Xenon 500 MHz
graphics processor ATI Xenos and various storage media such as HDD, CD-ROM or DVD-ROM. Furthermore
the Xbox 360 S has multiple interfaces such as five USB ports (two at the front and three in the back), an
Ethernet port, an HDMI AV port, S / PDIF connector, AV connector, AUX port and an infrared receiver. Until
November 2011 the console was sold around 60 million times worldwide11 .
1.2 Xbox LIVE
Xbox LIVE is the community platform of Microsoft and started on November 15, 2002. With the release of the
Xbox 360 on November 22, 2005 the Xbox LIVE got major expansions like the market store for downloadable
content and improvements for the community functions like the gamercard. Via this community user can get
connected with each other and friends, can play video games, can download new content for their avatar or game,
etc. Many games supporting the Xbox LIVE network because of the target of Microsoft. Since April 15, 2010
the first Xbox generation is no longer supported as these hinders the development of the community8 . There
are two different types of access to the Xbox LIVE network, the one with Xbox LIVE Gold and the other with
Xbox LIVE for free. For the use of Xbox LIVE Gold, a contribution will be paid to enable certain services
such as the video chat, playing online, Facebook, more marketplace options, or other services. The price for
the gold membership varies and depend on the payment method and duration. At the purchase of an Xbox
360, the player receives one free month, highlighting the advantages to enjoy full membership too8 . Free Xbox
LIVE (Xbox LIVE Silver, formerly known) is the basic access to the Xbox LIVE network. However, there are
limitations in the marketplace and several functions, among which the most important feature for players, the
multiplayer mode, can not be used8 . What offers the Xbox LIVE for the users?
• VoIP communication in games
• Video chat
• Friends list, list of the 50 people last played with
• Sending of speech and text messages within the Xbox LIVE networks
• Possibilities of managing their user profiles
• Users are assigned in gamerzone which are representing the skills of the person, so that users playing
together have the same skills
• Success and reviews of the player, searching for a multiplayer match, additional game content
• A marketplace.
If a console was blocked by the LIVE network, because the Xbox is stolen or illegal programs are installed, it is
not anymore possible to get updates for the console or for games from Xbox LIVE.
2. XBOX FORENSICS
In this section some forensic programs are explained and which difficulties that can occur during an investigation
are discussed. Furthermore, some data types of the FATX data system are introduced.
Xbox forensics is based on the process and methods of computer forensics. This means known methods for
an investigation like the LIVE analysis and the post-mortem analysis are used. Whereby it is suggested to use
the post-mortem analysis to work on a forensic image of the hard drive, because the most information which can
be important for an investigation are assumed on it. The hard drive is divided in four partitions1 (see table 1).
Each partition starts with XTAF and ends with FATX, which can be viewed in the hex view of the hard drive.
Table 1: Xbox 360 partitions1
Partition 1 Partition 2 Partition 3 Partition 4
Start sector 1024 9205120 9467264 9991552
End sector 9205119 9467123 9991551 -
Total size 4.4 GB 125 MB 255 MB - ∼ 245 GB
Data types of the Xbox
Worth knowing are the typical data types of the Xbox 360 which distinguish from the known Windows data
types. Figure 1 illustrates the file structure∗ of a FATX system by reference to a forensic duplicate in Xplorer360.
Besides the FATX file structure of the Xbox 360 there exists the STFS (Secure Transacted File System) which is
used by the system for all created and downloaded packages. It is secured through the usage of a series of SHA1
hashes and RSA signature4 . In the following the term “image” is used as a synonym for a forensic duplicate of
a hard drive.
Figure 1: Example of the file structure in a FATX system
∗
Structure of the file structure: http://home.comcast.net/ admiral powerslave/xb360hdddirstruc.htm
Extensions
Besides the special data types there are still 3 other container files called PIRS, LIVE and CON. These 3 container
files are identical and differ only in the 4 first letters in the headerfile (PIRS/LIVE/CON), where the names of
the respective data comes from and for what they are used for (see figure 2).
* PIRS: is used for saving the gametags and themes.
* LIVE: is used for saving content which comes from Xbox LIVE.
* CON: is created by the Xbox 360 themselves and is used for saving gaming scores9.
The PIRS/LIVE and CON files can be found in the partition 3.
Figure 2: Example of a LIVE file in a hex-view
There are still some other file formats which the assignment and the purpose couldn’t determined unambigu-
ously, e.g. files with the ending .lex or .xtf. The table 2 shows some of the found file types of a Xbox 360 with a
short description.
Table 2: Files types of the Xbox 360 partition1
File Description
type
.xex Executable file (Xbox Executable File) is normally used in the Xbox (but can also be found on the
Xbox 360).
.xuiz Container file for visual files.
.xdbf Used in the Xbox 360 as a generic database. It is used as the format for gpd (gamer profile data)
and spa (Statistics, Presence and Achievements) files. With spa-linked files to the Xbox 360 and
are executable during compilation. SPA files from your dashboard (graphical user interface of the
Xbox) used to gpd.
.xstr Contain language files with information about games or console information in different languages
that are converted into readable text files by XeXtractor.
.xscr Are relevant files for programs (games), detailed description and purpose unclear.
.gpd Is a container format which based on the XDBF format. GPD stands for gamer profile data and
stores information within a profile. Profiles are compiled from several of these file types. Each
gpd file is named after the respective executable Title ID (for example 4D5307E6.gpd for Halo 3).
The dashboard gpd (FFFE07D1.gpd) contains information and synchronization information of the
titles.
.spa Files are included within the xex files. SPA files based on the xdbf format and used by the
Dashboard for the creation of gpd files information and Xbox LIVE.
.db Known extension files database, but not the db files can be opened using standard programs for
these file type.
3. SOFTWARE
Forensic software for an analysis of the Xbox 360 is quite difficult to find. Creating a forensic duplicate of the
hard drive can be made with different programs and methods as long as the program/computer recognizes the
hard drive. A better way is to use separate technical equipment like the Tableau Forensic Duplicator Model TD1
or similar. However the FATX data format is not supported by the most programs. FTK and XWays, which
are professional forensic programs, for example can’t extract much information out of an image. They found
only a few pictures in the image. These pictures could be connected to some Xbox games which where played
or installed on the Xbox 360. In the internet can be found a few freeware programs which could be helpful in
investigations. They are immature and have only restricted access on the file structure (partitions) or files. In
the following some programs are introduced and described. Except of the program XTF all programs can be
found in the internet and downloaded for free.
3.1 XTF
XTF (2.0) is a quite new forensic software which is a special development for Xbox forensics. The software
should be in the position to integrate backup files of the Xbox5 and can interpret the FATX format with the
individual partitions and their content (files). Currently the program couldn’t be tested and information about
the program are rare. Some information can be found on the website† of the publisher with some details.
3.2 wx* programs
There are some programs which are coded by Gael360‡ . Some of theses programs give detailed insights in certain
data types of the Xbox. Among them are:
wxPirs: This program can open PIRS, LIVE or CON files, which are generic container files of the Xbox9 .
In these containers are different data files like e.g. xexp, xex, pak, png and other file types. All data are shown
in the container structure (see figure 3) and the found entries can be extracted by the user.
Figure 3: Example file among wxPirs
†
XTF: http://www.protowise.com/1601.html
‡
http://gael360.free.fr
wxTheme:
This program is used to view files of Xbox 360 themes, which are stored during use of Xbox LIVE. The files
are stored under“\Content\0000000000000000\FFFFE07D1\00030000” . The program can also open PIRS files,
but it is pointed out that errors can occur9 . The program opened in practice more than wxPirs files and found
some additional pictures. In addition to showing the program files with cryptic symbols there were fewer errors
in the opening of PIRS, LIVE or CON files, as in wxPirs. Unlike wxPirs all files are listed, but only among
themselves, without the folder structure of the corresponding container(see figure 4).
Figure 4: Example file among wxTheme
There are other wx programs which are intended more for modders to access the hard drive or copy games,
but were not necessary for a forensic investigation.
3.3 Xplorer360
The Xplorer360§ is the best known tool for exploring FATX data systems. There are different Xplorer360
versions. Each version is adapted another size of the hard drive. In case of the investigation of the new Xbox
360 S the Xplorer360 250gb edition was used. The individual program versions can’t be used with other (smaller
or bigger) hard drive sizes, because problems can occur. Xplorer360 can read FATX hard drives and images of
this format. After opening, the individual partitions (zero, two and three) are shown in a folder structure like in
§
http://www.xbox-scene.com/xbox360-tools/Xplorer360.php
the Windows Explorer. The single folder, files or the whole partitions can be exported by the program for more
investigation with other programs.
3.4 Le Fluffie
Le Fluffie¶ is a 3rd party project of some hobby programmer. The program can open FATX formats (hard
drives and images) and shows the content in a list view or in a so called GUI view (see figure 5). After the hard
drive is successful detected, the program divided them not in the different partitions but under Compatibility
(was found in Xplorer360 in partition 2) and in System. Even the System area is interesting, because there were
found and shown more files compared to the Xplorer360. These were mainly .xex or .lex files which could be
then extracted.
Figure 5: List view in the program Le Fluffie
3.5 FATX Explorer
The FATX Explorerk was developed by Andy & Luke and is coded in MFC, so that the MFC library is needed.
The program can read an image of the Xbox. For that the user has to choose the path to the image and also
the sector of the partition which should be read. After this it can be chosen which files should be read.
3.6 XexTool
XexTool∗∗ is a command line program. With the help of this program .xex files can be extracted, read and
modified. The newest version of this tool is version 6.1 as a standalone application or as a plug-in for the IDA.
The IDA is a disassembler and debugger offers a variety of features and is often used by modders, hackers or
programmers.
3.7 XeXtractor
Unlike XexTool the program XeXtractor†† has a user interface which shows the user file types like xex, xstr,
xscr, xdbf and xuiz, can open and extract their contents (see figure 6). In the xex files other file types are usually
included and will be partially opened in the program immediately, so that their content is displayed. Often it
¶
http://skunkiebutt.com/?page id=362
k
http://www.xbox-scene.com/tools/tools.php?page=harddrive
∗∗
http://www.xblog-360.com/2010/12/07/xextool-v6-1-xex-loader-v6-1-and-ppcaltivec-plugin-v1-8/
††
http://www.xbox-scene.com/xbox1data/sep/EkZEAEpFpFzuxKxniV.php
is necessary to verify the extracted data files to be among the supported formats of XeXtractor and then open
them with the program again. Indeed, there are file formats such as e.g. gpd files which can be opened after
extracted by the XeXtractor. The same applies to .xstr files.
Figure 6: XeXtractor with opened xdbf file
3.8 Difficulties
There are a variety of other programs that are suitable for opening or viewing the system structure or file types,
but these programs are not always executable. Many websites are no longer active, so that instructions and
programs are no longer available in the original form.
During the forensic examination of the Xbox 360 different problems occurred. Already the file system FATX
is a problem, because an image or a Xbox hard drive can not be simply connected to a computer and analysed.
The reason is that it is a native file format for the Xbox is that Windows will not be recognized and interpreted.
The same applies for the known computer forensic software like FTK, Encase or XWays. They can display the
image only in hex format.
Another problem is the variety of data types which are largely unknown and what they are used for. The
purpose of many sections of the FATX system is still unknown and it requires the investigation in some areas
in more detail. An additional difficulty is the fact that many files are encrypted and therefore the information
is difficult to get. There is a console security certificate (Security Certificate Console) that is used by the Xbox
360 for the generation of RSA signatures which verifies the authenticity of the drive.
4. PRACTICE
This chapter addresses the information gain from the dashboard of the Xbox 360, the approach to the investi-
gation of the Xbox 360, as well as entries that have been identified as important. The entire investigations with
the Xbox 360 were carried out with the help of Windows programs.
4.1 Investigation of the dashboard
In the investigation of a console, it is obvious to connect them and to examine entries or interesting information.
If the Xbox 360 is connected to a TV or monitor and if there is no game in the console drive, the default interfaceis displayed. Then, the player can look at his console settings and what’s on his Xbox. The first menu item in the series includes the gamer profiles. This is recognizable by the avatar and the player’s name denotes the field, and the display of game points (gamerscore), player evaluation (Rep) and some game icons. Is this menu item selected the player profiles are displayed. Here are the games listed that were previously used or stored on the hard drive of the console. Besides can also be connected to Xbox LIVE, which shows profiles, gives possibility to adjust the avatar, adapted the theme or the profiles can be changed. Interesting for an investigation of this point profiles, in which the player can record detailed information about themselves. The information which can be found here are for example (if entered): • Listing of all games, • biography, location, slogan, name. All other items under profile are setting options which are not very interesting. Other items in the main menu are the game library, video library, music collection and the photo album. In each of this menu points is a listing of the respective media and the classification if these are from a computer, the currently inserted CD/DVD in the hard drive or if they are from an external device which is connected through the Xbox. Depending on the parental control, provided they were hired by the owner of the console, the access can be restricted to the media, so that e.g. songs or movies with a certain age limit can not be viewed, i.e. the passcode is required to view certain content. As the last menu item, there is the system settings in which the console, Kinect and network settings are included, as well as information about the Windows Media Center and the hard disk. Under the console setting information about the selected language, region and time zone is included, as well as system information. In the item system information the serial number of the console, the console ID and version numbers of the dashboard, the kernel and etc is included. In addition to the console settings the menu item about the memory is interesting, indicating how much storage capacity is available and is already occupied. The memory can also be accessed so that the folder structure is displayed with each allocated memory. Each folder can be selected again, but there is only roughly indicated what programs occupy the memory. If the particular item is selected the user gets displayed only options what to do with the particular entry (e.g. copy, delete, move, · · ·). To summarize, entries, settings and interesting numbers can be verified to navigate through the dashboard manually. However, detailed information for the forensic examination which could be of interest were not really available. 4.2 Method of a hard drive investigation At the beginning of the investigation the hard drive was removed of the Xbox 360. Then with the Tableau Forensic Duplicator Model TD1 was connected to create a forensic image. The process to copy the hard drive was time consuming (around 3-4 hours), because the size of the hard drive was 250 GB. A second image was made after using Xbox LIVE to compare entries, results and possible modification at the Xbox. For that an online game and Facebook was tested, to check if information will be found of connections, games or about social contacts (which was not confirmed). The images were first involved in the existing forensic programs (like FTK, XWays or Encase), where the complete image was found but without data structure or partitions, just in hex view. When carving, from the pure image there were partially found some pictures of games that were on the hard disk. To get more information and possibly files, that have been trying to open the various file types and to extract the folders, files or container. For that the Xplorer360 was used first. This program recognizes three partitions 0, 2 and 3 in the image and could extract the individual partitions (with their contents). Besides Le Fluffie was used to get some additional files from the partition 2 which the Xplorer360 didn’t find. As part of the partition several container files were found. To open them other software solutions were needed for extracting the contents again. One solution was the program XeXtractor (see 3.7 for supported file formates) for opening of different container files. The process of opening one container file and extracting the content had to be repeated for each container which was found before. Beside the programs wxTheme and wxPirs was used (see 3.2) for opening and extracting files from the partition 2 (the cache and content section). There were several entries in the cache, while only TU ... files can be opened by wxTheme and wxPirs. These TU files are LIVE container. Under $TitleUpdate there is also a tu file which is a PIRS container file. In the content folder all three container
types can be found (LIVE PIRS, CON). As in the LIVE, PIRS and CON formats are included other container
files like .xex files. These files has to be opened again with XeXtractor. After all these steps as far as all the
files from the containers and the image are extracted, all files will be read again in FTK (and XWays) in order
to browse for additional files (carving) and to look at the hex code, if interesting information or entries can be
found. The process can shortly be described by the follwoing steps:
• Creating an image of the hard drive,
• Use of Xplorer360 & Le Fluffie to extract content of the partitions,
• Reading the supported container files with the help of XeXtractor,
• Open the PIRS, CON and LIVE container formates with wxTheme (or wxPirs) to extract their content,
• Contents of the new found files has to be extracted again with the XeXtractor,
• Read and investigate the extracted files with forensic software.
4.3 Entries & files
In the partition 3 is always the entry saved which is linked to a user profile (structure: partition 3 → con-
tent → here E00000E18D49B094 → FFFE07D1 → 00010000 → E00000E18D49B094). The folder and file
E00000E18D49B094 differ in the label in every Xbox for each profiles after the part of the file name E00000E.
It was also found the gamertag from the internet(username = Xylofon...). Besides the name löffel was found
in a few different files which implies on another gamer profile or an earlier username.
The first-readable information to the Xbox 360 are located in sector 4 of the whole image where the revision
number1 (= DX853XXX-XXX) is available, as well as a date 01-30-11. These two entries are also stored in
almost all file types and are found in plaintext.
In Sector 16 is the hard drive model and the brand with the full name (number and etc.).
When viewing the individual files it can be found out which games are installed on the device, because the
names of the games are often stored in plaintext (see figure 7) and also e.g. that a Kinect was connected with
the Xbox.
Figure 7: Hex view shows the name of a game which was played on the Xbox in plaintext
Furthermore, it is important to mention that some images were found and displayed (after carving) which,
when testing the enclosed game Kinect Adventures, were shot automatically without permission of the gamer or
user (see figure 8).Figure 8: Carved pictures which were made by Kinect automatically without user/gamer permission
5. CONCLUSION
In this paper the method, some free programs and difficulties for an investigation on the Xbox 360 S are described.
A forensic examination of the Xbox 360 S is currently seen as rather difficult, since it is difficult to get information
that can be used later in court. This is due to lack of professional software solutions for forensic examination.
Programs from the community to modify and hack the Xbox are useful to get information on files, pictures and
to view certain information and to extract them. However, this information is rather useless, because programs
such as the Xplorer360 can extract the files from the hard drive or the image, but the actual date and time of
the PC is given for the extracted files. Thus, timestamps are worthless and incomprehensive. Besides, in the
programs of the modder no hash values are used which are needed to verify the integrity of the data before and
after the extraction. Thus, it is at the discretion of the judge whether the information retrieved will be admitted
as evidence or not. Currently, the only possibility is a detailed documentation with screenshots and procedures
for the detection of an ordinary forensic investigation. A promising possibility of the forensic examination of the
Xbox 360 is the program XTF, which until now could not be used. A study using XTF should be considered in
a future paper.
Prospect
In the future it is important to focus more on the investigation of the individual sections of the FATX system
to develop more programs for Xbox forensics. A forensic software (similar to FTK) which supports the different
console types, i.e. read the images and hard drives, interpret and analyse them would be helpful. Other options
which may allow to identify hacked consoles or prove if a game is copied would certainly be interesting for the
games industry and investigators. Moreover, it would be very interesting to use Linux programs for examination.
The same applies for hacking an Xbox 360 S and the execution of homebrew applications or perhaps forensically
important programs on a hacked console. A hacked Xbox 360 should be compared with a normal Xbox 360,
to determine differences, gaps, and the advantages and disadvantages of forensic investigation. The question
is if there are any hints which shows that the device was hacked. The amount of consoles will increase and
the community will become bigger. So crime on and with the devices will continue and it is important for the
examiners to know effective ways for an investigation.References [1]Bolt, Steven: XBOX 360 Forensics - A Digital Forensics Guide to Examining Artifacts. Syngress - Elsevier, Inc., 2011. ISBN: 978-1-59749-623-0 [2]Craiger, Phillip ; Shenoi, Sujeet: Advances in digital Forensics III. Springer, 2007. ISBN: 978-0-387-73741-6 [3]“XDBF”. http://www.free60.org/XDBF. Version:August 2010. [last access: January 20, 2012] [4]“STFS”. http://www.free60.org/STFS. Version:May 2011. [last access: January 20, 2012] [5]“XBox forensics”. http://esciencenews.com/articles/2009/04/30/xbox.forensics. Version: April 2009. [last access: January 20, 2012] [6]Wikipedia: “Xbox — Wikipedia, Die freie Enzyklopdie”. http://de.wikipedia.org/w/index.php?title=Xbox&oldid=88776203. Version: 2011. [last access: January 20, 2012] [7]Wikipedia: “Xbox 360 — Wikipedia, Die freie Enzyklopdie”. http://de.wikipedia.org/w/index.php?title=Xbox 360&oldid=88486318. Version: 2011. [last access: January 20, 2012] [8]Wikipedia: “Xbox Live — Wikipedia, Die freie Enzyklopdie”. http://de.wikipedia.org/w/index.php?title=Xbox Live&oldid=89401545. Version: 2011. [last access: January 20, 2012] [9]“Xbox 360 PC Tools - wxPirs”. http://www.xbox-scene.com/xbox360-tools/wxPirs.php. Version: February 2006. [last access: January 20, 2012] [10]“Xbox 360 PC Tools - wxTheme”. http://www.xbox-scene.com/xbox360-tools/wxPirs.php. Version: February 2006. [last access: January 20, 2012] [11]Parker, Seb: “Xbox 360 Tops 60 Million Units Worldwide”. http://www.vgchartz.com/article/88543/xbox-360-tops-60-million-units-worldwide/ Version: December 2011 [last access: January 20, 2012]
You can also read
