Kernel Debug

2025-04-18T14:50:20Z

Applesauce:

Only enabled in debug kernels, a Xbox with serial port can be kernel debugged with windbg.
only executables that have debugging switched on can be debugged over serial aswell(?) {{citation needed}}
{FIXME| Explain with more details ;) }

Xqemu emulates this serial port, wich uses a [[Super_I/O | LPC chip ].

== KD Commands ==

{| class="wikitable"
! Command
! Description
|-
| <code>CTRL+B</code>
| Exit the kernel debugger.
|-
| <code><ENTER></code>
| Repeat the last command you entered.
|-
| <code>?</code>
| Display a quick reference of basic debugger commands.
|-
| <code>.help</code>
| List meta‑commands available in the debugger.
|-
| <code>!help</code>
| List the extension commands provided by debugger plugins.
|-
| <code>x MODULE!SYMBOL</code>
| Show symbols within a module (supports wildcards). e.g. <code>Vidya!*</code> lists all symbols starting with “Vidya”.
|-
| <code>db ADDRESS</code>
| Dump raw bytes at the specified address, with any printable ASCII alongside.
|-
| <code>dd ADDRESS</code>
| Dump memory as 32‑bit words starting at the given address.
|-
| <code>df ADDRESS</code>
| Dump memory as floating‑point values from the given address.
|-
| <code>dds ADDRESS</code>
| Dump 32‑bit words and resolve any that match symbol names—handy for spotting return addresses on the stack.
|-
| <code>dt TYPE ADDRESS</code>
| Display the fields of a structure type at a memory address. Add <code>-b</code> to recurse into nested structures.
|-
| <code>rM 54</code>
| Show FP/MMX/XMM register contents (note the uppercase “M”).
|-
| <code>rM 1fd</code>
| Show all CPU registers.
|-
| <code>p</code>
| Step over the next instruction (runs calls/interrupts without entering them).
|-
| <code>t</code>
| Step into the next instruction (enters calls and interrupts).
|-
| <code>bp ADDRESS</code>
| Set a breakpoint at the specified instruction address.
|-
| <code>bp ADDRESS "commands"</code>
| Create a breakpoint that executes a sequence of commands when hit (semicolon‑separated).
|-
| <code>ba w1 ADDRESS</code>
| Set a data breakpoint on writes to one byte at ADDRESS. Use “r” for reads, or “2”/“4” for word/dword sizes.
|-
| <code>bl</code>
| List all active breakpoints.
|-
| <code>bc INDEX</code>
| Clear the breakpoint with the given index (as shown by <code>bl</code>).
|-
| <code>!memusage</code>
| Display a summary of free memory pages and usage by category.
|-
| <code>!heap 0 -a</code>
| Dump detailed heap entries for all heaps (can generate a lot of output).
|-
| <code>!handle 0 7</code>
| List all open handles in the system (files, threads, etc.).
|-
| <code>!poolused 3</code>
| Report how pool memory is allocated across different tags.
|-
| <code>!poolfind TAG</code>
| List every pool allocation marked with the four‑character TAG.
|-
| <code>.reboot</code>
| Restart the console.
|-
| <code>.sympath</code>
| Show the current symbol search paths.
|-
| <code>.sympath PATH</code>
| Change the symbol path to PATH; use <code>.reload</code> to apply.
|-
| <code>.echotimestamps</code>
| Toggle timestamps on debug messages and break notifications.
|}
{| class="wikitable"
! Command
! Description
|-
| <code>r</code>
| Shows the current register values.
|-
| <code>kp</code>
| Displays the call stack with function parameters and line numbers. If <code>kp</code> isn’t supported in your debugger version, use <code>kb</code> instead.
|-
| <code>dd esp L80</code>
| Dumps raw stack memory as DWORDs starting at <code>esp</code> (the stack pointer). <code>L80</code> specifies length 0x80 (128 DWORDs), letting you inspect local variables on the stack.
|-
| <code>ln eip</code><br><code>u xxxxxxxx xxxxxxxx</code>
| Lists symbols around the current instruction pointer (<code>eip</code>) so you can see where the crash happened, for example:
:<code>(00011050) YourGame!main+0x9</code><br>
:<code>(0001109d) YourGame!DebugBreak.Next</code>
Then use those addresses with <code>u</code> to disassemble that code range (e.g. <code>u 00011050 0001109d</code>).
|-
| <code>!process 0 7</code>
| Shows details about the current process and prints a call stack for each thread.
|-
| <code>dd nt!KeTickCount L1</code>
| Displays the kernel tick count (milliseconds since boot, excluding debugger pauses). Divide the result by 1,000 for seconds or by 3,600,000 for hours.
|}

Xbox Live

2024-05-26T04:15:27Z

Applesauce: /* XDK Functions */

Xbox Live is an online multiplayer gaming and digital media delivery service created and operated by Microsoft. It was first made available to the Xbox system in November 2002. ([https://en.wikipedia.org/wiki/Xbox_Live Wikipedia]) Xbox Live support for the original Xbox ended in April 15, 2010.

== Architecture ==
The Xbox Live architecture consists of Kerberos-based authentication tickets, with a Secure Gateway used to then access services (such as Matchmaking, Statistics/Leaderboards, and custom game servers)

Authentication and access to Xbox Live services is controlled using the Kerberos protocol with a few proprietary customisations for the Xbox. When an Xbox first connects, the server gives it a [[Xbox Live/Machine Account|Machine Account]] which it uses to access the service; this machine account is always sent, but it can only be used alone to access UACS (User Account Creation Service) to create a user account - with both a machine account and user account, all other services are accessible.

== XDK Functions ==

{| class="wikitable"
|+XOnline* Functions
|-
! function
! description
|-
|XOnlineGetUsers(XONLINE_USER* XBLAccountusers, DWORD* numOfXBLiveAccounts)
|The XOnlineGetUsers function will enumerate both the hard disk and any attached memory units looking for user accounts
|-
|XOnlineTaskClose(XONLINETASK_HANDLE logonHandle)
|Called to abort the authentication process.
|-
|XOnlineStartup( XONLINE_STARTUP_PARAMS* )
|
|-
|XOnlineLogon(XONLINE_USER* XBLLoggedOnUsers, DWORD* XBLservices, DWORD SERVICE_COUNT, NULL, XONLINETASK_HANDLE &logonHandle)
|When a title calls XOnlineLogon to sign in, instead of blocking until the authentication completes, an asynchronous task handle is returned. As part of the authentication process a title must specify which services it will be using (XBLservices, SERVICE_COUNT).
|-
|XOnlineTaskContinue(XONLINETASK_HANDLE logonHandle)
|Called to check the status of XOnlineLogon. It will return XONLINETASK_S_RUNNING while the login process has not been completed.
|-
|XOnlineLogonTaskGetResults(XONLINETASK_HANDLE logonHandle)
|Will return XONLINE_S_LOGON_CONNECTION_ESTABLISHED when the task is successfully completed. Otherwise it will return an error code.
|-
|XOnlineGetLogonUsers()
|This returns a pointer to an array of XONLINE USER structures. This array is similar the XONLINE USER array we populated and passed into XOnlineLogon, but is updated with error status and permission flags for each user.
|-
|XOnlineSetUserGuestNumber(dwUserFlags , 1)
|macro sets a specific guest number for a player in an online game. It updates the dwUserFlags code with the new guest number, which is required for logging in.
|-
|XOnlineTitleUpdate(DWORD)
|The XOnlineTitleUpdate function will boot into an updater application, which performs the actual update
|-
|XOnlineGetServiceInfo(Service, ?)
|XOnlineGetServiceInfo returns the connection status for a service
|-
|XOnlineNotificationSetState
|-
|XOnlineArbitrationCreateRoundID
|Generates an arbitration round ID. Takes a pointer to a ULONGLONG variable, which will hold the round ID upon return. This function must be called to generate a round ID before using other arbitration functions.
|-
|XOnlineArbitrationRegister
|This function registers an arbitration session by setting up necessary parameters like session ID, round duration, and control flags. It also handles the completion event and task handle for asynchronous operation.
|-
|XOnlineArbitrationReport
|This function reports the results of a specified round. If stats are specified, every participant must pass the stats for all participants. The arbitration server matches up and analyzes the stats, connectivity problems, and suspicious information reported by every participant to determine the outcome of the round.
|-
|XOnlineStorageCreateServerPath
|generates a server path using provided information such as storage facility, user ID, team ID, and file name.
|-
|XOnlineStringVerify
|The XOnlineStringVerify function checks user-provided text strings for objectionable content before they are uploaded or stored. It takes the number of strings, an array of Unicode strings, the language of the text, an optional event handle for signaling, and an output task handle. It returns S_OK if the task starts successfully,and XOnlineTaskContinue will indicate success or failure of the strings. The function can verify up to four strings at once, each up to 256 characters long. It supports multiple languages.
|}

== Discontinuation of service ==

The service was officially discontinued on April 15th, 2010.

12 players decided to stay in a lobby of ''Halo 2'' 24/7 to keep a server running.
The final player, Apache N4SIR was streaming the entire event, as the player count of 12 twindeled down to just him. At 11:40 PM PDT, on May 11th 2010, Apache N4SIR was booted from the game[http://i.imgur.com/oQw6k5H.jpg].

== See Also ==

* [https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20video%20and%20slides/DEF%20CON%2030%20-%20Tristan%20Miller%20-%20Reversing%20the%20Original%20Xbox%20Live%20Protocols.mp4 Reversing the Original Xbox Live Protocols] presented by [[User:monocasa]] at DEF CON 30 (2022).

xboxdevwiki - User contributions [en]

Kernel Debug

Xbox Live