Topic created on: January 7, 2006 22:50 CST by Faithless .

Hi,

The release of MS's latest console XBOX 360 (www.xbox360.com) has provided a new platform for win32-esque binary analysis.

I say win32-esque, as the original Xbox was based on commodity hardware and a stripped down Windows 2000 kernel (xboxkrnl.exe). The new Xbox 360 appears to run a G5 PPC system. Details can be found at (http://en.wikipedia.org/wiki/Xbox#Detailed_specifications)

While slightly different to efforts to understand the .xbe/.xex formats, OpenXDK (www.openxdk.org) does provide some good tools for low level PE to XBOX file manipulations.

The original Xbox file format (.xbe) was well documented by Aaron "caustik" Robinson, while developing his emulator Cxbx (caustik.com/cxbx/download/xbe.htm)

The latest Xbox 360 file format (.xex) is still lacking in complete documentation however. Currently, the most complete article on .xex is at from the Free360 group, (www.free60.org/wiki/XEX). I've collected a few sample .xex (XBOX 360) files to use, along with three tools to dump information on the structure of this format. The links to these can be found at www.free60.org/wiki/XEX#Availability_of_XEX_files, and I'm about to begin documenting the complete .xex format.

In particular the xexdump.exe tool has proved useful so far to compare which sections are static across the 3 currently available .xex files and which are variable.

Initially, it looks like there is still a magic first entry (similar to PE's 'MZ') of 'XEX2', that every valid .xex must begin with. Trailing this is a set of OptionalHeaderDescriptions, one of which contain a Type, Size and then Offset to the actual data of each Header.

For example, one common (and I'd assume required :) optional header is type 101 - EntryPoint, whose value appears to be crypted (unlike most other OptionalHeader details).

If there's anyone else doing similar work, or who might be interested post your findings so far here, or contact off list.