xboxdevwiki - User contributions [en]

Main Page/Header

2022-01-12T19:22:58Z

Haxar: Former freenode is now Libera.Chat; gitter link is decommissioned

<div style="background-color:#e7eef6; border: 1px solid #ccc; color:#000; margin-top: 15px; margin-bottom: 10px; padding: 8px; text-align:center;">
<div style="font-size: 162%; border: none; margin: 0; padding:.1em;">Welcome to XboxDevWiki.net,</div>
<div style="font-size: 95%">a wiki dedicated to research of the original Microsoft Xbox.</div>
<div style="text-align:left;">

<hr>

XboxDevWiki is an effort to document the inner workings of the original Microsoft Xbox and Xbox-based SEGA Chihiro.
We not only care about technical details about those platforms, but also how to develop homebrew and emulate them.

We are not interested in documenting the Xbox 360, Xbox One or any other console at this point.

Also check out the [https://github.com/xboxdev XboxDev GitHub organization] where we provide tools and code related to Xbox research and development.

<hr>

'''Want to help? Contact us!'''

This wiki is the place for all remaining Xbox projects to come together.
Please come chat with us in [https://discord.gg/WxJPPyz XboxDev on Discord] or in [irc://irc.libera.chat/xqemu #xqemu on Libera.Chat IRC] ([https://web.libera.chat/#xqemu Webchat]).

You'll also get the details for wiki account creation there.
</div>
</div>

LPC Debug Port

2019-10-26T18:47:32Z

Haxar: Embed LFRAME# reconnection images from external links

{|class="wikitable" style="float:right;margin-left:10px;"
|+ Pin Layout
|-
! style="text-align:right" | Name !! style="text-align:right" | Pin !! Pin !! Name
|-
| style="text-align:right" | SERIRQ (v1.0) || style="text-align:right" | 16 || 15 || 3.3V
|-
| style="text-align:right" | SDA || style="text-align:right" | 14 || 13 || SCL
|-
| style="text-align:right" | GND || style="text-align:right" | 12 || 11 || LAD0
|-
| style="text-align:right" | LAD1 || style="text-align:right" | 10 || 9 || 3.3V
|-
| style="text-align:right" | LAD2 || style="text-align:right" | 8 || 7 || LAD3
|-
| style="text-align:right" | 5V || style="text-align:right" | 6 || 5 || LRESET#
|-
| style="text-align:right" | PWR (v1.6) || style="text-align:right" | 4 || 3 || LFRAME#
|-
| style="text-align:right" | GND || style="text-align:right" | 2 || 1 || LCLK
|}

The '''LPC Debug Port''' is an unpopulated 2x8 2.54mm (0.1") footprint on the Xbox motherboard that provides access to the system's [https://en.wikipedia.org/wiki/Low_Pin_Count Low Pin Count] Bus, as well as the [[SMBus]]. Throughout the Xbox's lifetime, Microsoft modified the LPC port in an attempt to prevent modding and, in some cases, it must be "rebuilt" to restore the port's full functionality. Rebuilding the LPC debug port involves soldering wires between it and very small vias on the motherboard.

The LPC bus is controlled by the [[MCPX|MCPX southbridge]], which conforms to the Intel Low Pin Count Specification 1.0.

== Pins ==

* '''3.3V''' (15 & 9) - Provides 3.3V while the Xbox is powered on. On 1.6 hardware, pin 9 is disconnected. Reconnect to pin 15 to restore the supply voltage.
* '''SDA''' (14) - [[SMBus]] data and address signal.
* '''SCL''' (13) - [[SMBus]] clock signal.
* '''GND''' (12 & 2) - Ground.
* '''LAD[3:0]''' (11, 10, 8, 7) - LPC address and data signals.
* '''5V''' (6) - Provides 5V while the Xbox is powered on or v1.6 always on when AC plugged in.
* '''LRESET#''' (5) - LPC reset signal; same as PCIRST#.
* '''PWR''' (4) - On pre-1.6 hardware, this pin does not physically exist. On 1.6 hardware, this pin is connected to the power button. Shorting it to ground will turn the Xbox on and off.
* '''LFRAME#''' (3) - LPC start-of-cycle signal. On 1.3-1.5 hardware, this pin is disconnected. See [[LPC_Debug_Port#LFRAME.23_reconnect|LFRAME# reconnect]] for a possible reconnection.
* '''LCLK''' (1) - 33MHz LPC clock signal; same as PCICLK.

The debug port lacks the optional LDRQ#, SERIRQ, CLKRUN#, PME#, LPCPD#, and LSMI# signals. This means peripherals connected to the debug port cannot utilize interrupt, DMA, bus mastering, or power management features.

== LFRAME# reconnect ==

[[File:LFRAME-for-v1_3-and-up.png|thumb|200px|Disconnected LFRAME# can be reconstructed with via found on all [[MCPX]] revisions]]

It is possible to reconnect the LFRAME# signal to the LPC port on 1.3-1.5 hardware by tapping the MCPX soldermask and soldering a jumper wire from the via to the disconnected pin on the LPC port.

Result should look similar to this:

[[File:Dreimer-lframe-v1-3-reconnect.jpg|500px|Image provided by dreimer]]

In the end, we can gain kernel debug output from Super I/O serial again:

[[File:Dreimer-lframe-v1-3-windbg.png|500px|Image provided by dreimer]]

This reconnection was tested on 1.3 hardware, and should also work with the later 1.4 and 1.5 revisions.

== References ==

* [https://web.archive.org/web/20140805105234/http://dwl.xbox-scene.com/~xbox/xbox-scene/tutorials/LFRAME-for-v1_3-and-up.pdf LFRAME-for-v1_3-and-up.pdf] An old manual from Xbox-Scene that explains how to reconnect '''LFRAME#''' (3) for a Cheapmod. This we don't care about, but is what we want for [[Kernel_Debug|kernel debugging]] via [[Super_I/O|Super I/O]]. Thanks to dreimer for finding and testing this documentation.

File:Dreimer-lframe-v1-3-windbg.png

2019-10-26T18:34:18Z

Haxar: Image provided by dreimer

Image provided by dreimer

File:Dreimer-lframe-v1-3-reconnect.jpg

2019-10-26T18:33:31Z

Haxar: Image provided by dreimer

Image provided by dreimer

File:LFRAME-for-v1 3-and-up.png

2019-10-26T18:29:16Z

Haxar: Image extracted from LFRAME-for-v1_3-and-up.pdf

Image extracted from LFRAME-for-v1_3-and-up.pdf

LFRAME

2019-08-04T22:16:39Z

Haxar: Redirected page to LPC_Debug_Port

#REDIRECT [[LPC_Debug_Port#LFRAME.23_reconnect]]

LPC Debug Port

2019-08-04T22:13:46Z

Haxar: Move LFRAME# reconnection page to its own section

{|class="wikitable" style="float:right;margin-left:10px;"
|+ Pin Layout
|-
! style="text-align:right" | Name !! style="text-align:right" | Pin !! Pin !! Name
|-
| style="text-align:right" | SERIRQ (v1.0) || style="text-align:right" | 16 || 15 || 3.3V
|-
| style="text-align:right" | SDA || style="text-align:right" | 14 || 13 || SCL
|-
| style="text-align:right" | GND || style="text-align:right" | 12 || 11 || LAD0
|-
| style="text-align:right" | LAD1 || style="text-align:right" | 10 || 9 || 3.3V
|-
| style="text-align:right" | LAD2 || style="text-align:right" | 8 || 7 || LAD3
|-
| style="text-align:right" | 5V || style="text-align:right" | 6 || 5 || LRESET#
|-
| style="text-align:right" | PWR (v1.6) || style="text-align:right" | 4 || 3 || LFRAME#
|-
| style="text-align:right" | GND || style="text-align:right" | 2 || 1 || LCLK
|}

The '''LPC Debug Port''' is an unpopulated 2x8 2.54mm (0.1") footprint on the Xbox motherboard that provides access to the system's [https://en.wikipedia.org/wiki/Low_Pin_Count Low Pin Count] Bus, as well as the [[SMBus]]. Throughout the Xbox's lifetime, Microsoft modified the LPC port in an attempt to prevent modding and, in some cases, it must be "rebuilt" to restore the port's full functionality. Rebuilding the LPC debug port involves soldering wires between it and very small vias on the motherboard.

The LPC bus is controlled by the [[MCPX|MCPX southbridge]], which conforms to the Intel Low Pin Count Specification 1.0.

== Pins ==

* '''3.3V''' (15 & 9) - Provides 3.3V while the Xbox is powered on. On 1.6 hardware, pin 9 is disconnected. Reconnect to pin 15 to restore the supply voltage.
* '''SDA''' (14) - [[SMBus]] data and address signal.
* '''SCL''' (13) - [[SMBus]] clock signal.
* '''GND''' (12 & 2) - Ground.
* '''LAD[3:0]''' (11, 10, 8, 7) - LPC address and data signals.
* '''5V''' (6) - Provides 5V while the Xbox is powered on or v1.6 always on when AC plugged in.
* '''LRESET#''' (5) - LPC reset signal; same as PCIRST#.
* '''PWR''' (4) - On pre-1.6 hardware, this pin does not physically exist. On 1.6 hardware, this pin is connected to the power button. Shorting it to ground will turn the Xbox on and off.
* '''LFRAME#''' (3) - LPC start-of-cycle signal. On 1.3-1.5 hardware, this pin is disconnected. See [[LPC_Debug_Port#LFRAME.23_reconnect|LFRAME# reconnect]] for a possible reconnection.
* '''LCLK''' (1) - 33MHz LPC clock signal; same as PCICLK.

The debug port lacks the optional LDRQ#, SERIRQ, CLKRUN#, PME#, LPCPD#, and LSMI# signals. This means peripherals connected to the debug port cannot utilize interrupt, DMA, bus mastering, or power management features.

== LFRAME# reconnect ==

It is possible to reconnect this pin on 1.3-1.5 hardware by tapping the MCPX soldermask and soldering a jumper wire to the disconnected pin on the LPC port.

Result should look similar to this in the end: [https://photos.app.goo.gl/wUvAwm3KS3ePSnYj8] (Image provided by dreimer)

In the end, we can gain kernel debug output from Super I/O serial again: [https://cdn.discordapp.com/attachments/603568167255801861/607540322871803904/unknown.png] (Image provided by dreimer)

This reconnection was tested on 1.3 hardware, and should work on 1.4 and 1.5 revisions, as the MCPX is the same.

== References ==

* [https://web.archive.org/web/20140805105234/http://dwl.xbox-scene.com/~xbox/xbox-scene/tutorials/LFRAME-for-v1_3-and-up.pdf LFRAME-for-v1_3-and-up.pdf] An old manual from Xbox-Scene that explains how to reconnect '''LFRAME#''' (3) for a Cheapmod. This we don't care about, but is what we want for [[Kernel_Debug|kernel debugging]] via [[Super_I/O|Super I/O]]. Thanks to dreimer for finding and testing this documentation.

Main Page

2019-08-04T21:05:00Z

Haxar: Added LPC bus under MCPX southbridge

{{:Main Page/Header}}
__NOTOC__

== Hardware ==

* [[Chihiro]]
* [[Xbox]]

* [[Hardware Revisions]]
* [[Motherboard]]
* [[CPU]]
* [[NV2A]]
** [[NV2A/Vertex attributes]]
** [[NV2A/Fixed Function Pipeline]]
** [[NV2A/Vertex Shader]]
** [[NV2A/Pixel Combiner]]
** [[NV2A/Surface Formats]]
* [[Memory]]
* [[Flash ROM]]
* [[MCPX]]
** [[LPC_Debug_Port|LPC]]
** [[APU]]
*** [[DSP]]
** [[ACI]]
** [[Network]]
* [[PCI]]
* [[SMBus]]
** [[EEPROM]]
** [[SMC]]
** [[Video Encoder]]
*** [[AV Cables]]
* [[DVD Drive]]
** [[Xbox Game Disc]]
* [[Hard Drive]]
** [[Config Sector]]
* [[USB]]
** [[Xbox Input Devices]]
** [[Xbox Memory Unit]]
** [[Xbox Live Communicator]] 
** [[Xbox DVD Movie Playback Kit]]
* [[Power Supply]]
* [[Development Kits]]
** [[Super I/O]]
** [[DVD Emulator]]
* [[Manufacturing Process]]

== System Software ==
* [[MCPX ROM]]
* [[BIOS]] / [[Kernel]]
** [[Boot Process]]
** [[XBE]] (Executable file format)
* [[FATX]] (Filesystem)
* [[Xbox ADPCM]]
* [[Dashboard]]
** [[Soundtracks]]
* [[Exploits]]

== Development Kits and Tools ==
* [https://github.com/xqemu/nxdk nxdk (New Xbox Development Kit)]
* [[OpenXDK]]
* [[Microsoft XDK]]
** [[Xbox Title Libraries]]
** [[Direct3D]]
** [[DirectSound]]
** [[System Link]]
** [[Xbox Live]]
** [[Xbox Debug Monitor]]
** [[Xbox Neighborhood]]
** [[Kernel_Debug|Xbox Kernel Debugging]]

== Games ==
* [[:Category:Games|Games]]
* [[Engine List]]

== Emulation ==
* [[Emulators]]
** [[XQEMU]]
** [[Xbox 360 Backward Compatibility]]

== Historical Pages ==
(archived from the xbox-linux wiki)
* [[Xbox Hard Drive Locking Mechanism]]
* [[Xbox Savegame System]]
* [[Xbox Hardware Overview]]
* [[Xbox Hard Disk Technical_Details]]
* [[Xbox Hard Disk Partitioning]]
* [[Xbox Manufacturing Process]]
* [[The Hidden Boot Code of the Xbox]]
* [[PIC]]
* [[SMBus]]
* [[NForce]]
* [[17 Mistakes Microsoft Made in the Xbox Security System]]
* [[Porting an Operating System to the Xbox HOWTO]]

== Other ==
* [[Patents]]
* [[Resources]]

Main Page

2019-08-04T20:55:06Z

Haxar: nit

{{:Main Page/Header}}
__NOTOC__

== Hardware ==

* [[Chihiro]]
* [[Xbox]]

* [[Hardware Revisions]]
* [[Motherboard]]
* [[CPU]]
* [[NV2A]]
** [[NV2A/Vertex attributes]]
** [[NV2A/Fixed Function Pipeline]]
** [[NV2A/Vertex Shader]]
** [[NV2A/Pixel Combiner]]
** [[NV2A/Surface Formats]]
* [[Memory]]
* [[Flash ROM]]
* [[MCPX]]
** [[APU]]
*** [[DSP]]
** [[ACI]]
** [[Network]]
* [[PCI]]
* [[SMBus]]
** [[EEPROM]]
** [[SMC]]
** [[Video Encoder]]
*** [[AV Cables]]
* [[DVD Drive]]
** [[Xbox Game Disc]]
* [[Hard Drive]]
** [[Config Sector]]
* [[USB]]
** [[Xbox Input Devices]]
** [[Xbox Memory Unit]]
** [[Xbox Live Communicator]] 
** [[Xbox DVD Movie Playback Kit]]
* [[Power Supply]]
* [[Development Kits]]
** [[Super I/O]]
** [[DVD Emulator]]
* [[Manufacturing Process]]

== System Software ==
* [[MCPX ROM]]
* [[BIOS]] / [[Kernel]]
** [[Boot Process]]
** [[XBE]] (Executable file format)
* [[FATX]] (Filesystem)
* [[Xbox ADPCM]]
* [[Dashboard]]
** [[Soundtracks]]
* [[Exploits]]

== Development Kits and Tools ==
* [https://github.com/xqemu/nxdk nxdk (New Xbox Development Kit)]
* [[OpenXDK]]
* [[Microsoft XDK]]
** [[Xbox Title Libraries]]
** [[Direct3D]]
** [[DirectSound]]
** [[System Link]]
** [[Xbox Live]]
** [[Xbox Debug Monitor]]
** [[Xbox Neighborhood]]
** [[Kernel_Debug|Xbox Kernel Debugging]]

== Games ==
* [[:Category:Games|Games]]
* [[Engine List]]

== Emulation ==
* [[Emulators]]
** [[XQEMU]]
** [[Xbox 360 Backward Compatibility]]

== Historical Pages ==
(archived from the xbox-linux wiki)
* [[Xbox Hard Drive Locking Mechanism]]
* [[Xbox Savegame System]]
* [[Xbox Hardware Overview]]
* [[Xbox Hard Disk Technical_Details]]
* [[Xbox Hard Disk Partitioning]]
* [[Xbox Manufacturing Process]]
* [[The Hidden Boot Code of the Xbox]]
* [[PIC]]
* [[SMBus]]
* [[NForce]]
* [[17 Mistakes Microsoft Made in the Xbox Security System]]
* [[Porting an Operating System to the Xbox HOWTO]]

== Other ==
* [[Patents]]
* [[Resources]]

APU

2019-07-14T01:21:03Z

Haxar: Include APU audio frame duration (0.6ms / 666.6us)

The [[MCPX]] contains an APU (Audio Processing Unit).

The APU consists of 3 main components for audio-processing:

* VP: A fixed-function block, that generates 32 channel mono audio from voices; the audio is output to the GP MIXBUF.
* GP: A programmable DSP, it is intended for general-purpose audio processing (programmable audio effects for example).
* EP: A programmable DSP, it is intended for audio encoding (5.1 AC3 encoding for example).

VP and GP are connected by the MIXBUF, but GP and EP are entirely independent, and no special-purpose memory area connects them.
Therefore, the communication between the GP and EP typically happens through programmable DMA transfers (via FIFO or scratch memory).

The GP and EP are based on the same DSP architecture, run at the same clockrate, and have the same functionality (the EP has less memory, and no direct access to the MIXBUF). So, theoretically, nothing prevents the GP from doing EP tasks or vice versa{{FIXME|reason=I have not seen counter-arguments}}.

The APU does only audio-processing but no audio output. Hence, one of the DSPs typically uses programmable DMA to transfer the finished audio to system memory, where it can be read by other components (such as AC97).

All audio processing by the APU is typically done in 24bit PCM.
An APU audio frame is 32 samples long with a duration of 0.{{overline|6}}ms at 48000Hz, giving a total of 1500 frames per second.
The MIXBUF therefore holds 1024 samples (32 channels * 32 samples/channel).

=== Glossary ===

* PRD = Physical Resource Descriptor (Same thing as SGE?!)
* SGE = Scatter Gather Entry
* SSL = Stream Segment List

== Frontend Engine (FE) ==

== Voice Processor (VP) ==

A powerful voice processor. There can be up to 256 voices [http://www.gamasutra.com/blogs/BrianSchmidt/20111117/90625/Designing_the_Boot_Sound_for_the_Original_Xbox.php][https://web.archive.org/web/20010410003338/http://www.nvnews.net/previews/mcpx/mcpx.shtml] and 64[http://www.nvidia.com/object/IO_20010530_6177.html] of those can be 3D.

Per-voice settings:
* Input type (8bit, 16bit, 24bit, ADPCM)
* 8 target bins, each with controllable volume for this voice
* [[wikipedia:Head-related transfer function|Head-related transfer function]] (HRTF)
* [[wikipedia:Low-frequency oscillation|Low-frequency oscillation]] (LFO)
* Pitch (~187.5 Hz to ~12285920.7 Hz)
* Optionally one of the following filters modes:
** For 2D Mono:
*** DLS2 Low-Pass
*** Parametric Equalizer
*** DLS2 Low-Pass + Parametric Equalizer
** For 2D Stereo:
*** DLS2 Low-Pass
*** Parametric Equalizer
** For 3D:
*** DLS2 Low-Pass + I3DL2 Reverb
*** Parametric Equalizer + I3DL2 Reverb
*** I3DL2 Reverb
* 2 Envelopes (DAHDSR: Delay, Attack, Hold, Decay, Sustain, Release)
** Amplitude Envelope
** Pitch / DLS2 Low-Pass Cutoff Envelope
* Tracking of certain parameters
** Volume
** LFO parameters
** DLS2 Low-Pass parameters?{{FIXME|reason=Not 100% sure, also not sure if this also works for the other filters}}

There are 32 bins which these voices will be mixed into.

=== Related APU memory ===

* VPV = VP Voices
* VPHT = VP HRTF Target
* VPHC = VP HRTF Current
* VPSGE = VP SGEs
* VPSSL = VP SSLs

=== Voice lists ===

The voices are kept in a single-linked list. There are 3 voice lists:

* 2D
* 3D
* MP (Multipass?)

=== Voice structure ===

This is 0x80 bytes

==== Pitch calculation ====

The 16 bit signed pitch value (''p'') can be converted to and from a unsigned frequency in Hz (''f'') using the following formulas:

<pre>
p = 4096 * log2(f / 48000)
f = pow2(p / 4096) * 48000
</pre>

=== LFO ===

=== Tracking ===

Some of the parameters of the VP can be controlled by setting timing parameters.
New values will then be slowly be adapted over time.
{{FIXME}}

=== Envelopes ===

There are seperate segments of the envelopes, 2 registers (CUR and COUNT) per envelope keeps track of this and control the envelopes level (LVL):

* 0: Off = Envelope is not used
* 1: Delay = Time where envelope stays at 0% until attack
** COUNT register counts down from DELAYTIME.
* 2: Attack = Rate at which the envelope goes from 0 to 100%
** COUNT register counts up to ATTACKRATE.
** LVL seems to be linear.
* 3: Hold = Time the envelope stays at 100%
** COUNT register counts down from HOLDTIME.
* 4: Decay = Rate at which the envelope goes from 100% to 0%
** COUNT register counts down from DECAYRATE.
** The LVL is not linear, it's a curve which drops steep at first and then slowly becomes level[https://docs.google.com/spreadsheets/d/1fNsfkvBfnlRQ9XplNnTgmh8jBaWJ56bvh2AVWn8B_k0/edit?usp=sharing]
** The best approximation I could come up with so far is: <code>255*pow(0.99988799,(DECAYRATE*16-COUNT)*4096/DECAYRATE)</code>.
** When the output level (not LVL!) reaches the sustain level the decay section is over (In my example above, this happens when the output level is less than 0.2 away from the sustain level; so if sustain is 0, the voice would switch to the sustain segment when a value below 0.2 is reached)
** Writes to the LVL register are ignored
** Writes to count (any value?) impact the LVL
** If the COUNT is larger than the decayrate the envelope will switch to the sustain state
** If the COUNT results in a smaller output level than the sustainlevel the envelope will switch to the sustain state
* 5: Sustain = Level at which the envelope stays while the voice is being played
** COUNT register writes are ignored, it will stay at 0
** LVL register writes are ignored, it will stay at the current sustain level
* 6: Release = Rate at which the envelope goes from current level to 0%
** Can start at any time{{FIXME|reason=the voice state PERSIST has to do with this. Voice is released using NV1BA0_PIO_VOICE_RELEASE ?}}
** COUNT register starts at RELEASERATE, regardless of the current sustain level
** COUNT register counts down{{FIXME|reason=What happens when it reaches 0? DirectSound seems to turn off voice - or is the hw doing that?}}
** LVL is not updated during this phase (it will keep it's previous value)
** Writes to LVL have an impact on the output volume
** If the COUNT register is higher than the releaserate, the output will be silent and LVL will drop to zero
** The actual output level is probably determined like: <code>int(COUNT * LVL / (RELEASERATE * 16))</code>{{FIXME|reason=Test..}}{{FIXME|reason=Unknown output shape}}
** COUNT will keep counting until 0 even after the output level has hit 0
* 7: Force Release = Unknown still{{FIXME}}
** Seems to happen during invalid conditions? Happened to me when modifying ebo during playback{{citation needed|reason=Need to find out why this happens}}
** LVL and COUNT seem to be ignored during this, but writes go through? Output level seems to stay at 100% ? (I only got repeating 32 samples during this and the whole Xbox crashed shortly after)

All durations are described using unsigned 12-bit times/rates. The level of sustain is stored unsigned in 8-bit.
The COUNT register is stored in unsigned 16-bit.

The 12-bit times/rates are multiplied by 16 when loading them into the 16-bit COUNT register.
The COUNT register counts at 1500 Hz[https://docs.google.com/spreadsheets/d/11jxeJ9aey_TVkyiMmmd6SKuow4j4GR9E9fRZ6HXc2WU/edit#gid=396423867].
A unit in the COUNT register is therefore 0.{{overline|6}} ms.

The 12-bit values of the envelope sections are given in units of 0.{{overline|6}} ms * 16 = 10.{{overline|6}} ms.
This can also be written as 512 / (48000 Hz) = 10.{{overline|6}} ms.
The maximum length of an envelope section is therefore 4095 * 10.{{overline|6}} ms = 43.68 seconds.

As the envelope counter runs at a fixed clock speed, it is independent of the voice pitch and duration.

If the Amplitude Envelope COUNT hits 0 during release, DirectSound{{FIXME|reason=Is this a hardware thing? I guess it makes sense..}} already deletes the voice, regardless of the Filter Envelope.

The sustain level can be changed during playback.
Also the attack register can be changed to a lower value while the counter is counting up, however, if the COUNTER does not compare equal to the set value, it will keep counting, even after an overflow. It will not leave the attack phase and keep counting until it sees value COUNTER / 16 in the attack register. If the attack register is set to a higher value while counting, the volume is going down again.
Also, if the attack register value is zero while counting, there won't be any audio output during the attack phase.
This indicates that the COUNT register is used to calculate the actual value from the current rates.

The initial state of each envelope can be controlled by the NV1BA0_PIO_VOICE_ON command. It can either be: DISABLE, DELAY, ATTACK or HOLD.

==== Amplitude Envelope ====

The amplitude envelope is mixed with the volume during mixing. The volume registers are not modified.
{{FIXME|reason=Is it multiplied on? Is it added? subtracted?}}
It is not yet known how many bits of the envelope state are used.

==== Filter Envelope ====

{{FIXME|reason=Research}}

The pitch scale is multiplied with the current envelope state and added to the current pitch during mixing. The pitch registers are not modified.

<pre>
f = 2^((signed_pitch+signed_pitch_mod*32*envelope_state_float)/4096)*48000 # envelope_state_float: [0, 1]
</pre>

It is not yet known how many bits of the envelope state are used.

=== Filters ===

==== DLS2 ====

Formulas from DirectSound

<pre>
FreqToHardwareCoeff(frequency): # Input in Hz
if (frequency < 30) { return 0x8000 }
if (frequency > 8000) { return 0x0000 }
FC = 2 * sin(PI * frequency / 48000)
octaves = 4096 * log2(FC)
return octaves & 0xFFFF
hardware_coefficient[0] = FreqToHardwareCoeff(frequency)
</pre>

<pre>
dBToHardwareCoeff(resonance): # Input in dB
resonance = min(resonance, 22.5)
Q = pow(10, -0.05 * resonance)
return min(0xFFFF)
hardware_coefficient[1] = dBToHardwareCoeff(resonance_in_db)
</pre>

Stuff from the DLS2 spec:{{FIXME|reason=Untested / unconfirmed. Most info comes from Merry of Citra}}

There are 2 coeffiecents per channel:

* F_c (Cutoff frequency)
* resonance

From Page 8 of "DLS 2.2 Version 1.0"[https://www.midi.org/specifications/item/dls-level-2-specification]

* b_1 = -2 * r * cos(θ)
* b_2 = r * r
* K = g * (1 + b_1 + b_2)

<pre>
y[i] = K * x[i] - b_1 * y[i-1] - b_2 * y[i-2]
</pre>

Where y[i-2] and y[i-1] are the last two frames of the output and x[i] the current input.

=== Operation ===

Voices are stored in VPV.
Input data (from the CPU) is loaded using VPSGE.
Voices are then processed and written to the GP MIXBUF.

== Global Processor (GP) ==

The GP is a DSP to do programmable audio processing on the voice bins.

The GP DSP seems to run at 160 MHz.

=== MIXBUF ===

The MIXBUF is a 0x400 word (24-Bit, stored as 32-Bit) section. It is split into 32 * 0x20 words.
Each 0x20 word block represents one of the 32 voice bins of the VP.
The 0x20 words are 24-Bit PCM mono samples to be played back at 48kHz. The duration of each frame is hence 0.{{overline|6}}ms.

=== Memory map ===

=== Related APU memory ===

* GPS = GP Scratch (?)
* GPF = GP FIFO

== Encode Processor (EP) ==

The EP is a DSP to encode the audio signal.

=== Memory map ===

=== Related APU memory ===

* EPS = EP Scratch (?)
* EPF = EP FIFO

== Usage in DirectSound ==

''This topic deserves it's own article{{FIXME}}''

The bins are used {{FIXME|reason=How?}}
DirectSound allows to load custom GP DSP code for a filter / effects chain.
{{FIXME|reaon=Will GP DSP automatically download code or is code pushed to it?}}
The GP waits for the frame interrupt which signals that MIXBUF data is available. It then goes through the filter chain.
At the end of the chain, the GP DSP will verify that the execution didn't take longer than the frame duration.

The GP will then issue 6 DMA requests to output the processed frames to a ringbuffer in scratch space.
The frameformat will be the same format as the GP MIXBUF format (also 0x20 words per channel).
Each ringbuffer is 0x200 words and therefore holds the last 16 frames.
Therefore, the ringbuffer region is 6 * 0x800 Bytes = 0x3000 Bytes in physical memory.

The order of the channels in the ringbuffer is (also DMA order):

* 0: Front Left
* 1: Center{{citation needed}}
* 2: Front Right
* 3: Rear Left{{citation needed}}
* 4: Rear Right{{citation needed}}
* 5: [[Wikipedia:Low-frequency effects|Low-frequency effects]] (LFE){{citation needed}}

The EP maps the same data to its own scratch space. It is assumed that it will DMA this region to its own internal memory.
The EP then AC3 encodes the audio data{{citation needed}} and writes it to the EP FIFO memory{{FIXME|How does this happen? DMA?}}.
{{FIXME|reason=When does this happen and what happens to stereo? headphones? mono?}}
The data is then send to the ACI AC97 using EP FIFO channels 0 (PCM) and 1 (SPDIF){{citation needed}}.
The EP code is loaded by DirectSound. The EP is not programmable using DirectSound APIs.

=== Modifications for Boot Animation ===

During the [[Boot Animation]] a different version of DirectSound is used.
The EP is disabled in this case.
The data is send to the ACI AC97 using GP FIFO channel 0 (PCM).
There is no AC3 / SPDIF during the boot animation[http://www.gamasutra.com/blogs/BrianSchmidt/20111117/90625/Designing_the_Boot_Sound_for_the_Original_Xbox.php]{{citation needed|reason=Link to brians gamasutra stuff}}.

== Related notes ==

* [[ACI]]
* [[DSP]]
* [[Xbox ADPCM]]
* [http://www.nvidia.com/object/apu.html Information at NVIDIAs website]
* [http://www.nvidia.com/attach/9004 "Technical Brief: NVIDIA nForce MCP Audio Processing Unit" by NVIDIA]
* [https://github.com/JayFoxRox/xbox-tools/blob/master/python-scripts/ Scripts to inspect APU registers and voice buffers]
* Filter information
** [https://de.mathworks.com/help/audio/examples/parametric-equalizer-design.html Something about Parametric Equalizers]
** [https://github.com/kcat/openal-soft/blob/master/Alc/effects/reverb.c Mentions I3DL2 Reverb]
** [https://www.midi.org/specifications/item/dls-level-2-specification DLS2 low-pass filter with resonance and dynamic filter cutoff frequency]

[[Category:APU]]

File:Haxar-a20m.jpg

2018-07-07T01:25:47Z

Haxar: Haxar uploaded a new version of File:Haxar-a20m.jpg

Exploits

2018-07-06T20:47:31Z

Haxar: /* A20M# hack */

== MCPX ==

=== LDT (Hypertransport) bus tap ===

See [http://www.xenatera.com/bunnie/proj/anatak/xboxmod.html#ldt bunnie's adventures hacking the Xbox].

=== Visor hack ===

Exploits incorrect rollover of memory address.

=== MIST hack ===

Exploits error in xcode interpreter security check.
There are at least 2 variations of this hack.

=== A20M# hack ===

[[File:Haxar-a20m.jpg|thumb|200px|A jumper wire hack to enable A20]]

Uses a legacy x86 feature.

=== RC4 attack (MCPX 1.0 only) ===

Microsoft uses the last bytes of the decrypted 2BL to check the integrity of the 2BL.
However, RC4 does not have any feedback which means changes in the 2BL will not reflect in the last couple of bytes which are checked.
As such, the 2BL can be freely modified, as long as the last couple of bytes still match what the MCPX ROM expects.

This can be used to take over the 2BL entry point.

When the attack happens, the MCPX ROM is still visible, making this a very powerful attack.

''This attack is described by Michael Steil in his Google talk.''

=== TEA attack (MCPX 1.1 only) ===

TEA, which is only used in MCPX 1.1, can not be used as a hash in Davies-Meyer mode [http://www.tayloredge.com/reference/Mathematics/VRAndem.pdf][https://www.schneier.com/academic/paperfiles/paper-key-schedule.pdf]. And yet, Microsoft used it that way.

The original attack uses the 5 bytes at 0xffffd400 (FBL entry point) which are <code>E9 83 01 00 00</code>.
This is <code>jmp 0xffffd588</code> (which is a jump within the flash region).

When flipping the highest bit of the operand DWORD (at 0xffffd400, mind your endianess) this will become: <code>E9 83 01 80 00</code>.
This is <code>jmp 0x7fd588</code> (which is a jump into the RAM region).
For the attack to be succssful, the highest bit in the DWORD at 0xffffd404 also has to be flipped.

The RAM can be controlled using the x-code command to write to RAM.
So the idea is to copy a program from Flash to RAM using x-codes.
Then the FBL / 2BL is modified to jump into said RAM region by flipping a bit of a jump operand (as described above).
The 2 bit flips will not change the hash of FBL / 2BL as TEA is broken.

As such, the FBL verification will succeed, the MCPX ROM will hand control to the FBL which will then jump into the attacker controlled RAM.

When the attack happens, the MCPX ROM is still visible, making this a very powerful attack.

''The TEA algorithm and exploit are also described in more detail in Bunnnies book (Page 109 and Page 142).''

== Dashboard ==

=== Audio hacks ===
=== Font hacks ===

[http://archiv.sega-dc.de/phoenix.maxconsole.net/docs/berternie.inc.htm Analysis of "Bert & Ernie" font-exploit].

==== Easter-egg exploit ====

== Savegames ==
Savedgames can be used as an exploit method, but care must be taken for most games are verifying digital signatures of savedgames {{citation needed}} [http://bunniefoo.com/nostarch/HackingTheXbox_Free.pdf]
=== [[007: Agent Under Fire]] ===
=== [[Frogger Beyond]] ===
=== [[MechAssault]] ===
=== [[Tom Clancy's Splinter Cell]] ===
=== [[Tony Hawk's Pro Skater 4]] ===
Grimdoomer found a savedgame exloit and shared it on Discord and later with Rocky5 for his softmod installer.
[https://drive.google.com/file/d/0B9WVULxHOmNkQVBCMHMtVGhqVVU/view a video demonstrating the game trigger (custom skatepark)]

''10-4-2017 it's just shell code I injected into the game save/ granted this save is slightly more complicated than the others and requires a small "loader" that is just a memcpy basically it's literally as simple as a buffer overflow...I just looked for null terminated strings and fuzzed them then when I got a crash I looked in teh xbe to figure out what was going on. yeah it's literally just a stack overflow'' - grimdoomer

another website talking about his exploit.
[https://www.xbmc4xbox.org.uk/forum/viewtopic.php?t=7310 xbmc4xbox.org.uk]

== Attack ideas ==

{| class="wikitable"
! Purpose || Author || Description || Status
|-
| Dumping the MCPX ROM || JayFoxRox
| Partial system reset using 0xCF9 I/O register
| Only crashes so far, mostly untested
|-
| Dumping the MCPX ROM || JayFoxRox
| Trying to find problems with the SMC reset chain. The SMC takes a couple of milliseconds to reset the system. Parts of the peripherals might stay alive for long enough. So chances (extremly unlikely) are, the peripherals could be programmed to do DMA where the DMA is only executed after the reboot.
| Untested
|-
| Unknown || JayFoxRox
| Resetting from wrong address. The errata for the CPU states that a warm-reset might occur from the wrong address.
| Concept phase, needs more research
|-
| Dumping the MCPX ROM || JayFoxRox
| Trying to access MCPX ROM through peripherals in the southbridge. If the address logic is broken, parts like the OHCI, APU or AC97 might be able to access it still.
|
* AC97: Lots of crashes / hangs. Sometimes crackling noise. Sometimes does not crash. Also can access some non-existing memory regions without any crashes. Data read from invalid addresses seemed to be 300 Hz square wave. While crashing the hardware output will have exponential falloff (measured on PCM line-out).
* APU: Untested
* OHCI: Untested
* Others: Untested
|-
| Dumping Kernel INIT || JayFoxRox
| INIT is free'd right before passing execution to the first XBE. Depending on what the XBE allocates, the INIT section might still be in memory when a dumper is run.
| Probably doesn't work. Would need the dumper to directly run after cold-boot. Softmods unfortunately reboot the Xbox and during this warm-boot the INIT section is (in at least most cases) lost.
|-
| Dumping Kernel INIT || DaveX || An extension to JayFoxRox dumping idea. Instead of running a dumper-XBE through a softmod, the softmod itself could do the dumping. This means creation of a custom softmod, just for dumping. This depends on the used softmod entry-point (font-explot, audio-exploit, ..) to gain execution as early as possible. This strategy might be slightly risky as harddisk contents have to be modified for the temporary softmod.
| WIP as of 2018-03-04
|-
| rowspan="13" | Homebrew entry point || rowspan="13" | Community
| rowspan="13" | Some movie DVDs contain default XBEs signed to run on original Xbox from DVD-R{{FIXME|reason=Add region / product codes and other DVDs you know of}}. If we can find an exploit in one of them (loaded files), we could possibly take over the entire system and run homebrew from DVD-R.
|-
|'''Star Wars: Clone Wars - Volume Two'''
[[Battlefront II]]

Untested
|-
|'''Star Wars: Episode III - Revenge of the Sith (Widescreen Edition)'''
[[Battlefront II]]

Untested
|-
|'''Star Wars Trilogy (Widescreen Edition with Bonus Disc)'''
[[Battlefront]]

Untested
|-
|'''Star Wars Trilogy DVD with Demo'''
[[Lego Star Wars 2]]

Untested
|-
|'''Star Wars: Clone Wars - Volume One'''
[[Battlefront]]

Untested
|-
|'''The Chronicles of Riddick (Widescreen Unrated Director's Cut)'''
[[Chronicles of Riddick]]

Untested
|-
|'''Doom (Unrated Widescreen Edition)'''
[[Doom 3]]

Untested
|-
|'''Hulk (Special Edition)'''
[[Hulk]]

Untested
|-
|'''King Arthur - The Director's Cut (Widescreen Edition)'''
[[King Arthur]]

Untested
|-
|'''Robots (Widescreen Edition)'''
[[Robots]]

Untested
|-
|'''Van Helsing (Widescreen Edition)'''
[[Van Helsing]]

Untested
|-
|'''Clone Wars Volume 1'''
[[Republic Commando]]

Untested
|}

== Notes ==

* [https://events.ccc.de/congress/2005/fahrplan/attachments/591-paper_xbox.pdf 17 Mistakes Microsoft Made in the Xbox Security System]
* [http://toogam.bespin.org/xboxmod/site/xbehacks.htm A list of some exploit implementations]

File:Haxar-a20m.jpg

2018-07-06T20:41:08Z

Haxar:

Xbox Input Devices

2017-08-09T06:30:35Z

Haxar: /* USB Adapters */ Replaced Amazon link to the right Xbox to USB-A cable. These are the right ones, while the old link gave me USB-A to Xbox cables.

== XID Overview ==

XIDs are USB devices.

The hardware side is USB with a different plug while the software side is USB without HID-descriptors.
Technicly a XID is a USB-hub for the Memory-Units and the XBL Communicator.
The logical XID gamepad USB device is internally connected to that hub.

=== USB Adapters ===
The Xbox input devices are USB devices. As such, you can connect a keyboard to the Xbox, or a gamepad to your PC. In fact, Linux already has drivers for the gamepad. In order to preserve Xbox hardware, please do not cut OEM Xbox cables to make an adapter. Decent adapters can be acquired cheaply (~$10 USD ea. on 2017.04.30).

{| class="wikitable"
|-
! Port (From)
! Plug (To)
! Link
|-
| Xbox
| USB-A
| [https://www.amazon.com/gp/product/B000RT2868 Amazon]
|-
| USB-A
| Xbox
| [https://www.amazon.com/gp/product/B00F52LQHO Amazon]
|}

=== Wiring ===

Untested / unverified! Take this with a grain of salt.

{| class="wikitable"
!Pin
!Typical cable color
!Description
|-
|1
|Green
|USB D-
|-
|2
|White
|USB D+
|-
|3
|Black
|GND
|-
|4
|Red
|VCC
|-
|5
|Yellow
|VBlank signal from video output (for Lightguns)
|-
|}

=== Protocol ===

==== Controller to Xbox ====

<pre>typedef struct XIDGamepadReport {
uint8_t bReportId;
uint8_t bLength;
<Data>
}</pre>

==== Xbox to Controller ====

<pre>typedef struct XIDGamepadOutputReport {
uint8_t report_id; //FIXME: is this correct?
uint8_t length;
<Data>
}</pre>

== Standard Gamepads ==

=== USB Descriptors ===

Most standard gamepads share the same USB descriptor.
Usually the only difference will be the VID / PID.
See https://github.com/xboxdrv/xboxdrv/blob/stable/src/xpad_device.cpp for a list of devices.

=== Controller to Xbox ===

20 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|DPAD_UP
|2
|0x01
|
|-
|DPAD_DOWN
|2
|0x02
|
|-
|DPAD_LEFT
|2
|0x04
|
|-
|DPAD_RIGHT
|2
|0x08
|
|-
|START
|2
|0x10
|
|-
|BACK
|2
|0x20
|
|-
|LEFT_THUMB
|2
|0x40
|
|-
|RIGHT_THUMB
|2
|0x80
|
|-
|A
|4
|0xFF
|Button is analog
|-
|B
|5
|0xFF
|Button is analog
|-
|X
|6
|0xFF
|Button is analog
|-
|Y
|7
|0xFF
|Button is analog
|-
|BLACK
|8
|0xFF
|Button is analog
|-
|WHITE
|9
|0xFF
|Button is analog
|-
|LEFT_TRIGGER
|10
|0xFF
|Trigger is analog
|-
|RIGHT_TRIGGER
|11
|0xFF
|Trigger is analog
|-
|sThumbLX
|12
|0xFFFF
|
|-
|sThumbLY
|14
|0xFFFF
|
|-
|sThumbRX
|16
|0xFFFF
|
|-
|sThumbRY
|18
|0xFFFF
|
|}

=== Xbox to Controller ===

6 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|Left actuator strength
|2
|0xFFFF
|
|-
|Right actuator strength
|4
|0xFFFF
|
|}

The Microsoft Controller S will not react to packets which don't have a value of 6 in the <code>length</code> field of the header.
The Fanatec Speedster 3 ForceShock will still react to those. Further testing is necessary with other gamepads.

== Steering wheels ==

=== MadCatz Wheel ===

{{FIXME}}

=== Fanatec Speedster 3 ForceShock ===

==== Pedals ====

The Pedals are ''not'' a USB device.

Note that the cable going to the pedals is also ''not'' a USB port despite using the Xbox controller breakaway plug.
Likewise, plugging the pedals to a PC / Xbox won't provide a USB / XID (it is detected as garbage):

<pre>
new full-speed USB device number 14 using xhci_hcd
device descriptor read/64, error -71
device descriptor read/64, error -71
new full-speed USB device number 15 using xhci_hcd
device descriptor read/64, error -71
device descriptor read/64, error -71
new full-speed USB device number 16 using xhci_hcd
Device not responding to setup address.
Device not responding to setup address.
device not accepting address 16, error -71
new full-speed USB device number 17 using xhci_hcd
Device not responding to setup address.
Device not responding to setup address.
device not accepting address 17, error -71
unable to enumerate USB device
</pre>

==== Internal HUB ====

===== USB Descriptors =====

Power not connected, pedals not connected, not in Tuning mode:

<pre>
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 9 Hub
bDeviceSubClass 0
bDeviceProtocol 0 Full speed (or root) hub
bMaxPacketSize0 8
idVendor 0x3767
idProduct 0x0102
bcdDevice 0.01
iManufacturer 0
iProduct 1 End
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 25
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xa0
(Bus Powered)
Remote Wakeup
MaxPower 64mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 9 Hub
bInterfaceSubClass 0
bInterfaceProtocol 0 Full speed (or root) hub
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0001 1x 1 bytes
bInterval 255
Hub Descriptor:
bLength 9
bDescriptorType 41
nNbrPorts 3
wHubCharacteristic 0x000d
Per-port power switching
Compound device
Per-port overcurrent protection
bPwrOn2PwrGood 50 * 2 milli seconds
bHubContrCurrent 64 milli Ampere
DeviceRemovable 0x02
PortPwrCtrlMask 0xff
Hub Port Status:
Port 1: 0000.0103 power enable connect
Port 2: 0000.0100 power
Port 3: 0000.0100 power
can't get debug descriptor: Resource temporarily unavailable
Device Status: 0x0003
Self Powered
Remote Wakeup Enabled
</pre>

==== Steering wheel (and Pedals) ====

Always connected to port 1 of the internal HUB

===== USB Descriptors =====

<pre>
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 8
idVendor 0x3767
idProduct 0x0101
bcdDevice 2.80
iManufacturer 0
iProduct 0
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 88 Xbox
bInterfaceSubClass 66 Controller
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
can't get debug descriptor: Resource temporarily unavailable
Device Status: 0x0000
(Bus Powered)
</pre>

== Light guns ==

=== EMS TopGun II ===

''This is an unlicensed / unofficial Xbox accessory.''

The website for this product can be found at http://www.hkems.com/product/xbox/EMSTopGun2.htm

The gun presents itself as a standard Xbox gamepad. It uses a different USB descriptor for Xbox (X) and the other mode (P).
There is no internal hub in this device.

{| class="wikitable"
! EMS TopGun II !! Xbox Gamepad !! Notes
|-
| Stick || Directional Pad ||
|-
| Trigger || A || rowspan="4" | Digital only, either 0 or 255
|-
| Grip || B
|-
| A || X
|-
| B || Y
|-
| START || Start ||
|-
| SE/BA || Back ||
|-
| Aim Left / Right || Negative / Positive on left thumbstick X axis || rowspan="2" | Absolute position using the full stick range
|-
| Aim Up / Down || Positive / Negative on left thumbstick Y axis
|}

There is no right thumbstick, thumbstick presses, black/white button or trigger buttons (All of those read constant zeros).

===== Turbo Mode =====

* Turbo mode 0 keeps A pressed while trigger is held
* Turbo mode 1 toggles A rapidly while trigger is held
* Turbo mode 2 toggles A rapidly and once in a while B while trigger is held

===== Force Feedback =====

The upper part of the gun is moveable and should push back to simulate recoil (possibly hurting your thumb while you are using the stick).
I could not get the force feedback working, but I'm sure I've had it working in the past on PC.{{citation needed}}

==== USB Descriptors ====

This is the descriptor in the Xbox mode (X).

<pre>
Bus 003 Device 016: ID 0b9a:016b
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x0b9a
idProduct 0x016b
bcdDevice 4.57
iManufacturer 1 EMS̖E
iProduct 2 EMS TopGun
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 88 Xbox
bInterfaceSubClass 66 Controller
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 8
can't get debug descriptor: Resource temporarily unavailable
Device Status: 0x0000
(Bus Powered)
</pre>

== Steel Battalion Controller ==

=== USB Descriptors ===

From http://www.yaronet.com/topics/154490-steel-battalion-controller-homemade#post-15

<pre>bcdUSB: 0x0110
bDeviceClass: 0x00
bDeviceSubClass: 0x00
bDeviceProtocol: 0x00
bMaxPacketSize0: 0x08 (8)
idVendor: 0x0A7B
idProduct: 0xD000
bcdDevice: 0x0100
iManufacturer: 0x00
iProduct: 0x00
iSerialNumber: 0x00
bNumConfigurations: 0x01

ConnectionStatus: DeviceConnected
Current Config Value: 0x00
Device Bus Speed: Full
Device Address: 0x03
Open Pipes: 0

Configuration Descriptor:
wTotalLength: 0x0020
bNumInterfaces: 0x01
bConfigurationValue: 0x01
iConfiguration: 0x00
bmAttributes: 0x80 (Bus Powered )
MaxPower: 0xFA (500 Ma)

Interface Descriptor:
bInterfaceNumber: 0x00
bAlternateSetting: 0x00
bNumEndpoints: 0x02
bInterfaceClass: 0x58
bInterfaceSubClass: 0x42
bInterfaceProtocol: 0x00
iInterface: 0x00

Endpoint Descriptor:
bEndpointAddress: 0x82
Transfer Type: Interrupt</pre>

=== Controller to Xbox ===

From http://steelbattalionnet.codeplex.com/SourceControl/latest#SBC/SteelBattalionController.cs

26 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|RightJoyMainWeapon
|2
|0x01
|
|-
|RightJoyFire
|2
|0x03
|FIXME: WTF?! Mask might be bad?
|-
|RightJoyLockOn
|2
|0x04
|
|-
|Eject
|2
|0x08
|
|-
|CockpitHatch
|2
|0x10
|
|-
|Ignition
|2
|0x20
|
|-
|Start
|2
|0x40
|
|-
|MultiMonOpenClose
|2
|0x80
|
|-
|MultiMonMapZoomInOut
|3
|0x01
|
|-
|MultiMonModeSelect
|3
|0x02
|
|-
|MultiMonSubMonitor
|3
|0x04
|
|-
|MainMonZoomIn
|3
|0x08
|
|-
|MainMonZoomOut
|3
|0x10
|
|-
|FunctionFSS
|3
|0x20
|
|-
|FunctionManipulator
|3
|0x40
|
|-
|FunctionLineColorChange
|3
|0x80
|
|-
|Washing
|4
|0x01
|
|-
|Extinguisher
|4
|0x02
|
|-
|Chaff
|4
|0x04
|
|-
|FunctionTankDetach
|4
|0x08
|
|-
|FunctionOverride
|4
|0x10
|
|-
|FunctionNightScope
|4
|0x20
|
|-
|FunctionF1
|4
|0x40
|
|-
|FunctionF2
|4
|0x80
|
|-
|FunctionF3
|5
|0x01
|
|-
|WeaponConMain
|5
|0x02
|
|-
|WeaponConSub
|5
|0x04
|
|-
|WeaponConMagazine
|5
|0x08
|
|-
|Comm1
|5
|0x10
|
|-
|Comm2
|5
|0x20
|
|-
|Comm3
|5
|0x40
|
|-
|Comm4
|5
|0x80
|
|-
|Comm5
|6
|0x01
|
|-
|LeftJoySightChange
|6
|0x02
|
|-
|ToggleFilterControl
|6
|0x04
|
|-
|ToggleOxygenSupply
|6
|0x08
|
|-
|ToggleFuelFlowRate
|6
|0x10
|
|-
|ToggleBuffreMaterial
|6
|0x20
|
|-
|ToggleVTLocation
|6
|0x40
|
|-
|
|6
|0x80
|
|-
|
|7
|0xFF
|
|-
|
|8
|0xFF
|
|-
|AimingX
|9
|0xFF, maybe 0xFFFF at offset 8?
|"Aiming Lever" joystick on the right. X Axis value.
|-
|AimingY
|11
|0xFF, maybe 0xFFFF at offset 10?
|"Aiming Lever" joystick on the right. Y Axis value.
|-
|RotationLever
|13
|0xFF, maybe 0xFFFF at offset 12?
|"Rotation Lever" joystick on the left.
|-
|SightChangeX
|15
|0xFF, maybe 0xFFFF at offset 14?
|"Sight Change" analog stick on the "Rotation Lever" joystick. X Axis value.
|-
|SightChangeY
|17
|0xFF, maybe 0xFFFF at offset 16?
|"Sight Change" analog stick on the "Rotation Lever" joystick. Y Axis value.
|-
|LeftPedal
|19
|0xFF, maybe 0xFFFF at offset 18?
|
|-
|MiddlePedal
|21
|0xFF, maybe 0xFFFF at offset 20?
|
|-
|RightPedal
|23
|0xFF, maybe 0xFFFF at offset 22?
|
|-
|TunerDial
|24
|0x0F
|The 9 o'clock postion is 0, and the 6 o'clock position is 12. The blank area between the 6 and 9 o'clock positions is 13, 14, and 15 clockwise.
|-
|
|24
|0xF0
|
|-
|GearLever
|25
|0xFF
|The gear lever on the left block.
|}

=== Xbox to Controller ===

From http://steelbattalionnet.codeplex.com/SourceControl/latest#SBC/SteelBattalionController.cs

34 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|EmergencyEject
|2
|0x0F
|
|-
|CockpitHatch
|2
|0xF0
|
|-
|Ignition
|3
|0x0F
|
|-
|Start
|3
|0xF0
|
|-
|OpenClose
|4
|0x0F
|
|-
|MapZoomInOut
|4
|0xF0
|
|-
|ModeSelect
|5
|0x0F
|
|-
|SubMonitorModeSelect
|5
|0xF0
|
|-
|MainMonitorZoomIn
|6
|0x0F
|
|-
|MainMonitorZoomOut
|6
|0xF0
|
|-
|ForecastShootingSystem
|7
|0x0F
|
|-
|Manipulator
|7
|0xF0
|
|-
|LineColorChange
|8
|0x0F
|
|-
|Washing
|8
|0xF0
|
|-
|Extinguisher
|9
|0x0F
|
|-
|Chaff
|9
|0xF0
|
|-
|TankDetach
|10
|0x0F
|
|-
|Override
|10
|0xF0
|
|-
|NightScope
|11
|0x0F
|
|-
|F1
|11
|0xF0
|
|-
|F2
|12
|0x0F
|
|-
|F3
|12
|0xF0
|
|-
|MainWeaponControl
|13
|0x0F
|
|-
|SubWeaponControl
|13
|0xF0
|
|-
|MagazineChange
|14
|0x0F
|
|-
|Comm1
|14
|0xF0
|
|-
|Comm2
|15
|0x0F
|
|-
|Comm3
|15
|0xF0
|
|-
|Comm4
|16
|0x0F
|
|-
|Comm5
|16
|0xF0
|
|-
|
|17
|0x0F
|
|-
|GearR
|17
|0xF0
|
|-
|GearN
|18
|0x0F
|
|-
|Gear1
|18
|0xF0
|
|-
|Gear2
|19
|0x0F
|
|-
|Gear3
|19
|0xF0
|
|-
|Gear4
|20
|0x0F
|
|-
|Gear5
|20
|0xF0
|
|}

Main Page

2017-07-31T07:35:44Z

Haxar:

{{:Main Page/Header}}

== Hardware ==

* [[Chihiro]]
* [[Xbox]]

* [[Hardware Revisions]]
* [[Motherboard]]
* [[CPU]]
* [[NV2A]]
** [[NV2A/Vertex attributes]]
** [[NV2A/Fixed Function Pipeline]]
** [[NV2A/Vertex Shader]]
** [[NV2A/Pixel Combiner]]
** [[NV2A/Surface Formats]]
* [[Memory]]
* [[Flash]]
* [[MCPX]]
** [[APU]]
** [[ACI]]
* [[EEPROM]]
* [[SMC]]
* [[Video Encoder]]
** [[AV Cables]]
* [[NVNet|Network Controller (NVNet)]]
* [[DVD Drive]]
** [[Xbox Game Disc]]
* [[Hard Drive]]
* [[USB]]
** [[Xbox Input Devices]]
** [[Xbox Memory Unit]]
** [[Xbox Live Communicator]] 
** [[DVD-IR Internals]]
* [[Power Supply]]

* [[Development Kits]]
** [[Super I/O]]
** [[DVD Emulator]]

== System Software ==
* [[MCPX ROM]]
* [[BIOS]] / [[Kernel]]
** [[Boot Process]]
** [[XBE]] (Executable file format)
* [[FATX]] (Filesystem)
* [[Dashboard]]
* [[Exploits]]

== Development Kits and Tools ==
* [https://github.com/xqemu/nxdk nxdk (New Xbox Development Kit)]
* [[OpenXDK]]
* [[Microsoft XDK]]
** [[Xbox Debug Monitor]]
** [[Xbox Neighborhood]]
** [[Kernel_Debug| Xbox Kernel Debugging]]

== Games ==
* [[:Category:Games|Games]]
* [[Engine List]]

== Emulation ==
* [[Emulators]]
** [[XQEMU]]
** [[Xbox 360 Backward Compatibility]]

== Other ==
* [[Network]]
* [[Patents]]
* Find random stuff in [[Resources]]

Kernel

2017-07-17T04:08:11Z

Haxar: Calling conventions are x86 specific.

The Xbox kernel is called xboxkrnl.exe. It is closely related to the Windows NT [[Wikipedia:Ntoskrnl.exe|ntoskrnl.exe]].
Its image base address is always 0x80010000.

== Header modifications ==

xboxkrnl.exe is a mostly standard exe file.
However, the MS-DOS header was patched to contain Xbox specific data in the reserved 20 byte block starting at offset 40:

{| class=wikitable
! Offset !! Meaning
|-
|40 || Size of uninitialized portion of the .data section
|-
|44 || Size of initialized portion of the .data section
|-
|48 || Memory address of initialized portion of the .data section (usually in [[Flash]]). <br> Used to re-initialize the data section pointed to by the next field. <br> Note that the pointer might be invalid during normal execution as the Flash might not be mapped at all times.
|-
|52 || Memory address where the .data section is stored (usually the same as in the section header + image base).
|}

== Sections ==

All sections are identity mapped (meaning file offsets and offsets in RAM match). This is because the kernel is not loaded through a traditional PE / exe loader, but just unpacked into memory.

=== .text ===

The .text section contains the kernel exports.

=== .data ===

The .data section stores initialized and uninitialized data.
A copy of the initialized portion of this section is usually stored in the [[BIOS]].

=== STICKY ===

Stores variables which must be preserved across a quick-reboot.

=== IDEXPRDT ===

A Physical Region Descriptor Table (PRDT) for the IDE bus. This section serves as a memory allocation only, it does not have to be initialized when loading the kernel{{citation needed}}.

=== INIT ===

This section is always the last one. It contains the entrypoint of the kernel.
This does all the cold-boot kernel initialization as described [[Boot_Process#Initialization|here]].
Later kernels{{FIXME|reason=Which revision? right now it appears that *ALL* kernels will discard this}} will discard this section after initialization.
INIT also contains the [[Boot Animation]], so once the kernel has finished booting it can't do a full hardware re-initialization or play the boot animation anymore.

== Kernel exports ==
{| class="wikitable"
|+Kernel exports
|-
!Name
!Ordinal
!x86 Calling Convention
!Notes
|-
|[[Kernel/AvGetSavedDataAddress]]
|1
|stdcall
|
|-
|[[Kernel/AvSendTVEncoderOption]]
|2
|stdcall
|
|-
|[[Kernel/AvSetDisplayMode]]
|3
|stdcall
|
|-
|[[Kernel/AvSetSavedDataAddress]]
|4
|stdcall
|
|-
|[[Kernel/DbgBreakPoint]]
|5
|stdcall
|
|-
|[[Kernel/DbgBreakPointWithStatus]]
|6
|stdcall
|
|-
|[[Kernel/DbgLoadImageSymbols]]
|7
|stdcall
|Devkits only!
|-
|[[Kernel/DbgPrint]]
|8
|stdcall
|
|-
|[[Kernel/HalReadSMCTrayState]]
|9
|stdcall
|
|-
|[[Kernel/DbgPrompt]]
|10
|stdcall
|
|-
|[[Kernel/DbgUnLoadImageSymbols]]
|11
|stdcall
|Devkits only!
|-
|[[Kernel/ExAcquireReadWriteLockExclusive]]
|12
|stdcall
|
|-
|[[Kernel/ExAcquireReadWriteLockShared]]
|13
|stdcall
|
|-
|[[Kernel/ExAllocatePool]]
|14
|stdcall
|
|-
|[[Kernel/ExAllocatePoolWithTag]]
|15
|stdcall
|
|-
|[[Kernel/ExEventObjectType]]
|16
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/ExFreePool]]
|17
|stdcall
|
|-
|[[Kernel/ExInitializeReadWriteLock]]
|18
|stdcall
|
|-
|[[Kernel/ExInterlockedAddLargeInteger]]
|19
|stdcall
|
|-
|[[Kernel/ExInterlockedAddLargeStatistic]]
|20
|fastcall
|
|-
|[[Kernel/ExInterlockedCompareExchange64]]
|21
|fastcall
|
|-
|[[Kernel/ExMutantObjectType]]
|22
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/ExQueryPoolBlockSize]]
|23
|stdcall
|
|-
|[[Kernel/ExQueryNonVolatileSetting]]
|24
|stdcall
|
|-
|[[Kernel/ExReadWriteRefurbInfo]]
|25
|stdcall
|
|-
|[[Kernel/ExRaiseException]]
|26
|stdcall
|
|-
|[[Kernel/ExRaiseStatus]]
|27
|stdcall
|
|-
|[[Kernel/ExReleaseReadWriteLock]]
|28
|stdcall
|
|-
|[[Kernel/ExSaveNonVolatileSetting]]
|29
|stdcall
|
|-
|[[Kernel/ExSemaphoreObjectType]]
|30
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/ExTimerObjectType]]
|31
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/ExfInterlockedInsertHeadList]]
|32
|stdcall
|
|-
|[[Kernel/ExfInterlockedInsertTailList]]
|33
|fastcall
|
|-
|[[Kernel/ExfInterlockedRemoveHeadList]]
|34
|fastcall
|
|-
|[[Kernel/FscGetCacheSize]]
|35
|stdcall
|
|-
|[[Kernel/FscInvalidateIdleBlocks]]
|36
|stdcall
|
|-
|[[Kernel/FscSetCacheSize]]
|37
|stdcall
|
|-
|[[Kernel/HalClearSoftwareInterrupt]]
|38
|fastcall
|
|-
|[[Kernel/HalDisableSystemInterrupt]]
|39
|stdcall
|
|-
|[[Kernel/HalDiskCachePartitionCount]]
|40
|
|Variable: ULONG
|-
|[[Kernel/HalDiskModelNumber]]
|41
|
|Variable: STRING
|-
|[[Kernel/HalDiskSerialNumber]]
|42
|
|Variable: STRING
|-
|[[Kernel/HalEnableSystemInterrupt]]
|43
|stdcall
|
|-
|[[Kernel/HalGetInterruptVector]]
|44
|stdcall
|
|-
|[[Kernel/HalReadSMBusValue]]
|45
|stdcall
|
|-
|[[Kernel/HalReadWritePCISpace]]
|46
|stdcall
|
|-
|[[Kernel/HalRegisterShutdownNotification]]
|47
|stdcall
|
|-
|[[Kernel/HalRequestSoftwareInterrupt]]
|48
|fastcall
|
|-
|[[Kernel/HalReturnToFirmware]]
|49
|stdcall
|
|-
|[[Kernel/HalWriteSMBusValue]]
|50
|stdcall
|
|-
|[[Kernel/InterlockedCompareExchange]]
|51
|fastcall
|
|-
|[[Kernel/InterlockedDecrement]]
|52
|fastcall
|
|-
|[[Kernel/InterlockedIncrement]]
|53
|fastcall
|
|-
|[[Kernel/InterlockedExchange]]
|54
|fastcall
|
|-
|[[Kernel/InterlockedExchangeAdd]]
|55
|fastcall
|
|-
|[[Kernel/InterlockedFlushSList]]
|56
|fastcall
|
|-
|[[Kernel/InterlockedPopEntrySList]]
|57
|fastcall
|
|-
|[[Kernel/InterlockedPushEntrySList]]
|58
|fastcall
|
|-
|[[Kernel/IoAllocateIrp]]
|59
|stdcall
|
|-
|[[Kernel/IoBuildAsynchronousFsdRequest]]
|60
|stdcall
|
|-
|[[Kernel/IoBuildDeviceIoControlRequest]]
|61
|stdcall
|
|-
|[[Kernel/IoBuildSynchronousFsdRequest]]
|62
|stdcall
|
|-
|[[Kernel/IoCheckShareAccess]]
|63
|stdcall
|
|-
|[[Kernel/IoCompletionObjectType]]
|64
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/IoCreateDevice]]
|65
|stdcall
|
|-
|[[Kernel/IoCreateFile]]
|66
|stdcall
|
|-
|[[Kernel/IoCreateSymbolicLink]]
|67
|stdcall
|
|-
|[[Kernel/IoDeleteDevice]]
|68
|stdcall
|
|-
|[[Kernel/IoDeleteSymbolicLink]]
|69
|stdcall
|
|-
|[[Kernel/IoDeviceObjectType]]
|70
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/IoFileObjectType]]
|71
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/IoFreeIrp]]
|72
|stdcall
|
|-
|[[Kernel/IoInitializeIrp]]
|73
|stdcall
|
|-
|[[Kernel/IoInvalidDeviceRequest]]
|74
|stdcall
|
|-
|[[Kernel/IoQueryFileInformation]]
|75
|stdcall
|
|-
|[[Kernel/IoQueryVolumeInformation]]
|76
|stdcall
|
|-
|[[Kernel/IoQueueThreadIrp]]
|77
|stdcall
|
|-
|[[Kernel/IoRemoveShareAccess]]
|78
|stdcall
|
|-
|[[Kernel/IoSetIoCompletion]]
|79
|stdcall
|
|-
|[[Kernel/IoSetShareAccess]]
|80
|stdcall
|
|-
|[[Kernel/IoStartNextPacket]]
|81
|stdcall
|
|-
|[[Kernel/IoStartNextPacketByKey]]
|82
|stdcall
|
|-
|[[Kernel/IoStartPacket]]
|83
|stdcall
|
|-
|[[Kernel/IoSynchronousDeviceIoControlRequest]]
|84
|stdcall
|
|-
|[[Kernel/IoSynchronousFsdRequest]]
|85
|stdcall
|
|-
|[[Kernel/IofCallDriver]]
|86
|fastcall
|
|-
|[[Kernel/IofCompleteRequest]]
|87
|fastcall
|
|-
|[[Kernel/KdDebuggerEnabled]]
|88
|
|Variable: BOOLEAN
|-
|[[Kernel/KdDebuggerNotPresent]]
|89
|
|Variable: BOOLEAN
|-
|[[Kernel/IoDismountVolume]]
|90
|stdcall
|
|-
|[[Kernel/IoDismountVolumeByName]]
|91
|stdcall
|
|-
|[[Kernel/KeAlertResumeThread]]
|92
|stdcall
|
|-
|[[Kernel/KeAlertThread]]
|93
|stdcall
|
|-
|[[Kernel/KeBoostPriorityThread]]
|94
|stdcall
|
|-
|[[Kernel/KeBugCheck]]
|95
|stdcall
|
|-
|[[Kernel/KeBugCheckEx]]
|96
|stdcall
|
|-
|[[Kernel/KeCancelTimer]]
|97
|stdcall
|
|-
|[[Kernel/KeConnectInterrupt]]
|98
|stdcall
|
|-
|[[Kernel/KeDelayExecutionThread]]
|99
|stdcall
|
|-
|[[Kernel/KeDisconnectInterrupt]]
|100
|stdcall
|
|-
|[[Kernel/KeEnterCriticalRegion]]
|101
|stdcall
|
|-
|[[Kernel/MmGlobalData]]
|102
|
|Variable: MMGLOBALDATA
|-
|[[Kernel/KeGetCurrentIrql]]
|103
|stdcall
|
|-
|[[Kernel/KeGetCurrentThread]]
|104
|stdcall
|
|-
|[[Kernel/KeInitializeApc]]
|105
|stdcall
|
|-
|[[Kernel/KeInitializeDeviceQueue]]
|106
|stdcall
|
|-
|[[Kernel/KeInitializeDpc]]
|107
|stdcall
|
|-
|[[Kernel/KeInitializeEvent]]
|108
|stdcall
|
|-
|[[Kernel/KeInitializeInterrupt]]
|109
|stdcall
|
|-
|[[Kernel/KeInitializeMutant]]
|110
|stdcall
|
|-
|[[Kernel/KeInitializeQueue]]
|111
|stdcall
|
|-
|[[Kernel/KeInitializeSemaphore]]
|112
|stdcall
|
|-
|[[Kernel/KeInitializeTimerEx]]
|113
|stdcall
|
|-
|[[Kernel/KeInsertByKeyDeviceQueue]]
|114
|stdcall
|
|-
|[[Kernel/KeInsertDeviceQueue]]
|115
|stdcall
|
|-
|[[Kernel/KeInsertHeadQueue]]
|116
|stdcall
|
|-
|[[Kernel/KeInsertQueue]]
|117
|stdcall
|
|-
|[[Kernel/KeInsertQueueApc]]
|118
|stdcall
|
|-
|[[Kernel/KeInsertQueueDpc]]
|119
|stdcall
|
|-
|[[Kernel/KeInterruptTime]]
|120
|
|Variable: KSYSTEM_TIME
|-
|[[Kernel/KeIsExecutingDpc]]
|121
|stdcall
|
|-
|[[Kernel/KeLeaveCriticalRegion]]
|122
|stdcall
|
|-
|[[Kernel/KePulseEvent]]
|123
|stdcall
|
|-
|[[Kernel/KeQueryBasePriorityThread]]
|124
|stdcall
|
|-
|[[Kernel/KeQueryInterruptTime]]
|125
|stdcall
|
|-
|[[Kernel/KeQueryPerformanceCounter]]
|126
|stdcall
|
|-
|[[Kernel/KeQueryPerformanceFrequency]]
|127
|stdcall
|
|-
|[[Kernel/KeQuerySystemTime]]
|128
|stdcall
|
|-
|[[Kernel/KeRaiseIrqlToDpcLevel]]
|129
|stdcall
|
|-
|[[Kernel/KeRaiseIrqlToSynchLevel]]
|130
|stdcall
|
|-
|[[Kernel/KeReleaseMutant]]
|131
|stdcall
|
|-
|[[Kernel/KeReleaseSemaphore]]
|132
|stdcall
|
|-
|[[Kernel/KeRemoveByKeyDeviceQueue]]
|133
|stdcall
|
|-
|[[Kernel/KeRemoveDeviceQueue]]
|134
|stdcall
|
|-
|[[Kernel/KeRemoveEntryDeviceQueue]]
|135
|stdcall
|
|-
|[[Kernel/KeRemoveQueue]]
|136
|stdcall
|
|-
|[[Kernel/KeRemoveQueueDpc]]
|137
|stdcall
|
|-
|[[Kernel/KeResetEvent]]
|138
|stdcall
|
|-
|[[Kernel/KeRestoreFloatingPointState]]
|139
|stdcall
|
|-
|[[Kernel/KeResumeThread]]
|140
|stdcall
|
|-
|[[Kernel/KeRundownQueue]]
|141
|stdcall
|
|-
|[[Kernel/KeSaveFloatingPointState]]
|142
|stdcall
|
|-
|[[Kernel/KeSetBasePriorityThread]]
|143
|stdcall
|
|-
|[[Kernel/KeSetDisableBoostThread]]
|144
|stdcall
|
|-
|[[Kernel/KeSetEvent]]
|145
|stdcall
|
|-
|[[Kernel/KeSetEventBoostPriority]]
|146
|stdcall
|
|-
|[[Kernel/KeSetPriorityProcess]]
|147
|stdcall
|
|-
|[[Kernel/KeSetPriorityThread]]
|148
|stdcall
|
|-
|[[Kernel/KeSetTimer]]
|149
|stdcall
|
|-
|[[Kernel/KeSetTimerEx]]
|150
|stdcall
|
|-
|[[Kernel/KeStallExecutionProcessor]]
|151
|stdcall
|
|-
|[[Kernel/KeSuspendThread]]
|152
|stdcall
|
|-
|[[Kernel/KeSynchronizeExecution]]
|153
|stdcall
|
|-
|[[Kernel/KeSystemTime]]
|154
|
|Variable: KSYSTEM_TIME
|-
|[[Kernel/KeTestAlertThread]]
|155
|stdcall
|
|-
|[[Kernel/KeTickCount]]
|156
|
|Variable: ULONG
|-
|[[Kernel/KeTimeIncrement]]
|157
|
|Variable: ULONG
|-
|[[Kernel/KeWaitForMultipleObjects]]
|158
|stdcall
|
|-
|[[Kernel/KeWaitForSingleObject]]
|159
|stdcall
|
|-
|[[Kernel/KfRaiseIrql]]
|160
|fastcall
|
|-
|[[Kernel/KfLowerIrql]]
|161
|fastcall
|
|-
|[[Kernel/KiBugCheckData]]
|162
|
|Variable: ULONG_PTR[5]
|-
|[[Kernel/KiUnlockDispatcherDatabase]]
|163
|fastcall
|
|-
|[[Kernel/LaunchDataPage]]
|164
|
|Variable: PLAUNCH_DATA_PAGE
|-
|[[Kernel/MmAllocateContiguousMemory]]
|165
|stdcall
|
|-
|[[Kernel/MmAllocateContiguousMemoryEx]]
|166
|stdcall
|
|-
|[[Kernel/MmAllocateSystemMemory]]
|167
|stdcall
|
|-
|[[Kernel/MmClaimGpuInstanceMemory]]
|168
|stdcall
|
|-
|[[Kernel/MmCreateKernelStack]]
|169
|stdcall
|
|-
|[[Kernel/MmDeleteKernelStack]]
|170
|stdcall
|
|-
|[[Kernel/MmFreeContiguousMemory]]
|171
|stdcall
|
|-
|[[Kernel/MmFreeSystemMemory]]
|172
|stdcall
|
|-
|[[Kernel/MmGetPhysicalAddress]]
|173
|stdcall
|
|-
|[[Kernel/MmIsAddressValid]]
|174
|stdcall
|
|-
|[[Kernel/MmLockUnlockBufferPages]]
|175
|stdcall
|
|-
|[[Kernel/MmLockUnlockPhysicalPage]]
|176
|stdcall
|
|-
|[[Kernel/MmMapIoSpace]]
|177
|stdcall
|
|-
|[[Kernel/MmPersistContiguousMemory]]
|178
|stdcall
|
|-
|[[Kernel/MmQueryAddressProtect]]
|179
|stdcall
|
|-
|[[Kernel/MmQueryAllocationSize]]
|180
|stdcall
|
|-
|[[Kernel/MmQueryStatistics]]
|181
|stdcall
|
|-
|[[Kernel/MmSetAddressProtect]]
|182
|stdcall
|
|-
|[[Kernel/MmUnmapIoSpace]]
|183
|stdcall
|
|-
|[[Kernel/NtAllocateVirtualMemory]]
|184
|stdcall
|
|-
|[[Kernel/NtCancelTimer]]
|185
|stdcall
|
|-
|[[Kernel/NtClearEvent]]
|186
|stdcall
|
|-
|[[Kernel/NtClose]]
|187
|stdcall
|
|-
|[[Kernel/NtCreateDirectoryObject]]
|188
|stdcall
|
|-
|[[Kernel/NtCreateEvent]]
|189
|stdcall
|
|-
|[[Kernel/NtCreateFile]]
|190
|stdcall
|
|-
|[[Kernel/NtCreateIoCompletion]]
|191
|stdcall
|
|-
|[[Kernel/NtCreateMutant]]
|192
|stdcall
|
|-
|[[Kernel/NtCreateSemaphore]]
|193
|stdcall
|
|-
|[[Kernel/NtCreateTimer]]
|194
|stdcall
|
|-
|[[Kernel/NtDeleteFile]]
|195
|stdcall
|
|-
|[[Kernel/NtDeviceIoControlFile]]
|196
|stdcall
|
|-
|[[Kernel/NtDuplicateObject]]
|197
|stdcall
|
|-
|[[Kernel/NtFlushBuffersFile]]
|198
|stdcall
|
|-
|[[Kernel/NtFreeVirtualMemory]]
|199
|stdcall
|
|-
|[[Kernel/NtFsControlFile]]
|200
|stdcall
|
|-
|[[Kernel/NtOpenDirectoryObject]]
|201
|stdcall
|
|-
|[[Kernel/NtOpenFile]]
|202
|stdcall
|
|-
|[[Kernel/NtOpenSymbolicLinkObject]]
|203
|stdcall
|
|-
|[[Kernel/NtProtectVirtualMemory]]
|204
|stdcall
|
|-
|[[Kernel/NtPulseEvent]]
|205
|stdcall
|
|-
|[[Kernel/NtQueueApcThread]]
|206
|stdcall
|
|-
|[[Kernel/NtQueryDirectoryFile]]
|207
|stdcall
|
|-
|[[Kernel/NtQueryDirectoryObject]]
|208
|stdcall
|
|-
|[[Kernel/NtQueryEvent]]
|209
|stdcall
|
|-
|[[Kernel/NtQueryFullAttributesFile]]
|210
|stdcall
|
|-
|[[Kernel/NtQueryInformationFile]]
|211
|stdcall
|
|-
|[[Kernel/NtQueryIoCompletion]]
|212
|stdcall
|
|-
|[[Kernel/NtQueryMutant]]
|213
|stdcall
|
|-
|[[Kernel/NtQuerySemaphore]]
|214
|stdcall
|
|-
|[[Kernel/NtQuerySymbolicLinkObject]]
|215
|stdcall
|
|-
|[[Kernel/NtQueryTimer]]
|216
|stdcall
|
|-
|[[Kernel/NtQueryVirtualMemory]]
|217
|stdcall
|
|-
|[[Kernel/NtQueryVolumeInformationFile]]
|218
|stdcall
|
|-
|[[Kernel/NtReadFile]]
|219
|stdcall
|
|-
|[[Kernel/NtReadFileScatter]]
|220
|stdcall
|
|-
|[[Kernel/NtReleaseMutant]]
|221
|stdcall
|
|-
|[[Kernel/NtReleaseSemaphore]]
|222
|stdcall
|
|-
|[[Kernel/NtRemoveIoCompletion]]
|223
|stdcall
|
|-
|[[Kernel/NtResumeThread]]
|224
|stdcall
|
|-
|[[Kernel/NtSetEvent]]
|225
|stdcall
|
|-
|[[Kernel/NtSetInformationFile]]
|226
|stdcall
|
|-
|[[Kernel/NtSetIoCompletion]]
|227
|stdcall
|
|-
|[[Kernel/NtSetSystemTime]]
|228
|stdcall
|
|-
|[[Kernel/NtSetTimerEx]]
|229
|stdcall
|
|-
|[[Kernel/NtSignalAndWaitForSingleObjectEx]]
|230
|stdcall
|
|-
|[[Kernel/NtSuspendThread]]
|231
|stdcall
|
|-
|[[Kernel/NtUserIoApcDispatcher]]
|232
|stdcall
|
|-
|[[Kernel/NtWaitForSingleObject]]
|233
|stdcall
|
|-
|[[Kernel/NtWaitForSingleObjectEx]]
|234
|stdcall
|
|-
|[[Kernel/NtWaitForMultipleObjectsEx]]
|235
|stdcall
|
|-
|[[Kernel/NtWriteFile]]
|236
|stdcall
|
|-
|[[Kernel/NtWriteFileGather]]
|237
|stdcall
|
|-
|[[Kernel/NtYieldExecution]]
|238
|stdcall
|
|-
|[[Kernel/ObCreateObject]]
|239
|stdcall
|
|-
|[[Kernel/ObDirectoryObjectType]]
|240
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/ObInsertObject]]
|241
|stdcall
|
|-
|[[Kernel/ObMakeTemporaryObject]]
|242
|stdcall
|
|-
|[[Kernel/ObOpenObjectByName]]
|243
|stdcall
|
|-
|[[Kernel/ObOpenObjectByPointer]]
|244
|stdcall
|
|-
|[[Kernel/ObpObjectHandleTable]]
|245
|
|Variable: OBJECT_HANDLE_TABLE
|-
|[[Kernel/ObReferenceObjectByHandle]]
|246
|stdcall
|
|-
|[[Kernel/ObReferenceObjectByName]]
|247
|stdcall
|
|-
|[[Kernel/ObReferenceObjectByPointer]]
|248
|stdcall
|
|-
|[[Kernel/ObSymbolicLinkObjectType]]
|249
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/ObfDereferenceObject]]
|250
|fastcall
|
|-
|[[Kernel/ObfReferenceObject]]
|251
|fastcall
|
|-
|[[Kernel/PhyGetLinkState]]
|252
|stdcall
|
|-
|[[Kernel/PhyInitialize]]
|253
|stdcall
|
|-
|[[Kernel/PsCreateSystemThread]]
|254
|stdcall
|
|-
|[[Kernel/PsCreateSystemThreadEx]]
|255
|stdcall
|
|-
|[[Kernel/PsQueryStatistics]]
|256
|stdcall
|
|-
|[[Kernel/PsSetCreateThreadNotifyRoutine]]
|257
|stdcall
|
|-
|[[Kernel/PsTerminateSystemThread]]
|258
|stdcall
|
|-
|[[Kernel/PsThreadObjectType]]
|259
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/RtlAnsiStringToUnicodeString]]
|260
|stdcall
|
|-
|[[Kernel/RtlAppendStringToString]]
|261
|stdcall
|
|-
|[[Kernel/RtlAppendUnicodeStringToString]]
|262
|stdcall
|
|-
|[[Kernel/RtlAppendUnicodeToString]]
|263
|stdcall
|
|-
|[[Kernel/RtlAssert]]
|264
|stdcall
|
|-
|[[Kernel/RtlCaptureContext]]
|265
|stdcall
|
|-
|[[Kernel/RtlCaptureStackBackTrace]]
|266
|stdcall
|
|-
|[[Kernel/RtlCharToInteger]]
|267
|stdcall
|
|-
|[[Kernel/RtlCompareMemory]]
|268
|stdcall
|
|-
|[[Kernel/RtlCompareMemoryUlong]]
|269
|stdcall
|
|-
|[[Kernel/RtlCompareString]]
|270
|stdcall
|
|-
|[[Kernel/RtlCompareUnicodeString]]
|271
|stdcall
|
|-
|[[Kernel/RtlCopyString]]
|272
|stdcall
|
|-
|[[Kernel/RtlCopyUnicodeString]]
|273
|stdcall
|
|-
|[[Kernel/RtlCreateUnicodeString]]
|274
|stdcall
|
|-
|[[Kernel/RtlDowncaseUnicodeChar]]
|275
|stdcall
|
|-
|[[Kernel/RtlDowncaseUnicodeString]]
|276
|stdcall
|
|-
|[[Kernel/RtlEnterCriticalSection]]
|277
|stdcall
|
|-
|[[Kernel/RtlEnterCriticalSectionAndRegion]]
|278
|stdcall
|
|-
|[[Kernel/RtlEqualString]]
|279
|stdcall
|
|-
|[[Kernel/RtlEqualUnicodeString]]
|280
|stdcall
|
|-
|[[Kernel/RtlExtendedIntegerMultiply]]
|281
|stdcall
|
|-
|[[Kernel/RtlExtendedLargeIntegerDivide]]
|282
|stdcall
|
|-
|[[Kernel/RtlExtendedMagicDivide]]
|283
|stdcall
|
|-
|[[Kernel/RtlFillMemory]]
|284
|stdcall
|
|-
|[[Kernel/RtlFillMemoryUlong]]
|285
|stdcall
|
|-
|[[Kernel/RtlFreeAnsiString]]
|286
|stdcall
|
|-
|[[Kernel/RtlFreeUnicodeString]]
|287
|stdcall
|
|-
|[[Kernel/RtlGetCallersAddress]]
|288
|stdcall
|
|-
|[[Kernel/RtlInitAnsiString]]
|289
|stdcall
|
|-
|[[Kernel/RtlInitUnicodeString]]
|290
|stdcall
|
|-
|[[Kernel/RtlInitializeCriticalSection]]
|291
|stdcall
|
|-
|[[Kernel/RtlIntegerToChar]]
|292
|stdcall
|
|-
|[[Kernel/RtlIntegerToUnicodeString]]
|293
|stdcall
|
|-
|[[Kernel/RtlLeaveCriticalSection]]
|294
|stdcall
|
|-
|[[Kernel/RtlLeaveCriticalSectionAndRegion]]
|295
|stdcall
|
|-
|[[Kernel/RtlLowerChar]]
|296
|stdcall
|
|-
|[[Kernel/RtlMapGenericMask]]
|297
|stdcall
|
|-
|[[Kernel/RtlMoveMemory]]
|298
|stdcall
|
|-
|[[Kernel/RtlMultiByteToUnicodeN]]
|299
|stdcall
|
|-
|[[Kernel/RtlMultiByteToUnicodeSize]]
|300
|stdcall
|
|-
|[[Kernel/RtlNtStatusToDosError]]
|301
|stdcall
|
|-
|[[Kernel/RtlRaiseException]]
|302
|stdcall
|
|-
|[[Kernel/RtlRaiseStatus]]
|303
|stdcall
|
|-
|[[Kernel/RtlTimeFieldsToTime]]
|304
|stdcall
|
|-
|[[Kernel/RtlTimeToTimeFields]]
|305
|stdcall
|
|-
|[[Kernel/RtlTryEnterCriticalSection]]
|306
|stdcall
|
|-
|[[Kernel/RtlUlongByteSwap]]
|307
|fastcall
|
|-
|[[Kernel/RtlUnicodeStringToAnsiString]]
|308
|stdcall
|
|-
|[[Kernel/RtlUnicodeStringToInteger]]
|309
|stdcall
|
|-
|[[Kernel/RtlUnicodeToMultiByteN]]
|310
|stdcall
|
|-
|[[Kernel/RtlUnicodeToMultiByteSize]]
|311
|stdcall
|
|-
|[[Kernel/RtlUnwind]]
|312
|stdcall
|
|-
|[[Kernel/RtlUpcaseUnicodeChar]]
|313
|stdcall
|
|-
|[[Kernel/RtlUpcaseUnicodeString]]
|314
|stdcall
|
|-
|[[Kernel/RtlUpcaseUnicodeToMultiByteN]]
|315
|stdcall
|
|-
|[[Kernel/RtlUpperChar]]
|316
|stdcall
|
|-
|[[Kernel/RtlUpperString]]
|317
|stdcall
|
|-
|[[Kernel/RtlUshortByteSwap]]
|318
|fastcall
|
|-
|[[Kernel/RtlWalkFrameChain]]
|319
|stdcall
|
|-
|[[Kernel/RtlZeroMemory]]
|320
|stdcall
|
|-
|[[Kernel/XboxEEPROMKey]]
|321
|
|Variable: XBOX_KEY_DATA
|-
|[[Kernel/XboxHardwareInfo]]
|322
|
|Variable: XBOX_HARDWARE_INFO
|-
|[[Kernel/XboxHDKey]]
|323
|
|Variable: XBOX_KEY_DATA
|-
|[[Kernel/XboxKrnlVersion]]
|324
|
|Variable: XBOX_KRNL_VERSION
|-
|[[Kernel/XboxSignatureKey]]
|325
|
|Variable: XBOX_KEY_DATA
|-
|[[Kernel/XeImageFileName]]
|326
|
|Variable: OBJECT_STRING
|-
|[[Kernel/XeLoadSection]]
|327
|stdcall
|
|-
|[[Kernel/XeUnloadSection]]
|328
|stdcall
|
|-
|[[Kernel/READ_PORT_BUFFER_UCHAR]]
|329
|stdcall
|
|-
|[[Kernel/READ_PORT_BUFFER_USHORT]]
|330
|stdcall
|
|-
|[[Kernel/READ_PORT_BUFFER_ULONG]]
|331
|stdcall
|
|-
|[[Kernel/WRITE_PORT_BUFFER_UCHAR]]
|332
|stdcall
|
|-
|[[Kernel/WRITE_PORT_BUFFER_USHORT]]
|333
|stdcall
|
|-
|[[Kernel/WRITE_PORT_BUFFER_ULONG]]
|334
|stdcall
|
|-
|[[Kernel/XcSHAInit]]
|335
|stdcall
|
|-
|[[Kernel/XcSHAUpdate]]
|336
|stdcall
|
|-
|[[Kernel/XcSHAFinal]]
|337
|stdcall
|
|-
|[[Kernel/XcRC4Key]]
|338
|stdcall
|
|-
|[[Kernel/XcRC4Crypt]]
|339
|stdcall
|
|-
|[[Kernel/XcHMAC]]
|340
|stdcall
|
|-
|[[Kernel/XcPKEncPublic]]
|341
|stdcall
|
|-
|[[Kernel/XcPKDecPrivate]]
|342
|stdcall
|
|-
|[[Kernel/XcPKGetKeyLen]]
|343
|stdcall
|
|-
|[[Kernel/XcVerifyPKCS1Signature]]
|344
|stdcall
|
|-
|[[Kernel/XcModExp]]
|345
|stdcall
|
|-
|[[Kernel/XcDESKeyParity]]
|346
|stdcall
|
|-
|[[Kernel/XcKeyTable]]
|347
|stdcall
|
|-
|[[Kernel/XcBlockCrypt]]
|348
|stdcall
|
|-
|[[Kernel/XcBlockCryptCBC]]
|349
|stdcall
|
|-
|[[Kernel/XcCryptService]]
|350
|stdcall
|
|-
|[[Kernel/XcUpdateCrypto]]
|351
|stdcall
|
|-
|[[Kernel/RtlRip]]
|352
|stdcall
|
|-
|[[Kernel/XboxLANKey]]
|353
|
|Variable: XBOX_KEY_DATA
|-
|[[Kernel/XboxAlternateSignatureKeys]]
|354
|
|Variable: XBOX_KEY_DATA[XBEIMAGE_ALTERNATE_TITLE_ID_COUNT]
|-
|[[Kernel/XePublicKeyData]]
|355
|
|Variable: UCHAR[XC_PUBLIC_KEYDATA_SIZE]
|-
|[[Kernel/HalBootSMCVideoMode]]
|356
|
|Variable: ULONG
|-
|[[Kernel/IdexChannelObject]]
|357
|
|Variable: IDE_CHANNEL_OBJECT
|-
|[[Kernel/HalIsResetOrShutdownPending]]
|358
|stdcall
|
|-
|[[Kernel/IoMarkIrpMustComplete]]
|359
|stdcall
|
|-
|[[Kernel/HalInitiateShutdown]]
|360
|stdcall
|
|-
|[[Kernel/RtlSnprintf]]
|361
|stdcall
|Unused?
|-
|[[Kernel/RtlSprintf]]
|362
|stdcall
|Unused?
|-
|[[Kernel/RtlVsnprintf]]
|363
|stdcall
|Unused?
|-
|[[Kernel/RtlVsprintf]]
|364
|stdcall
|Unused?
|-
|[[Kernel/HalEnableSecureTrayEject]]
|365
|stdcall
|
|-
|[[Kernel/HalWriteSMCScratchRegister]]
|366
|stdcall
|
|-
|
|367
|
|Unused?
|-
|
|368
|
|Unused?
|-
|
|369
|
|Unused?
|-
|
|370
|
|Unused?
|-
|
|371
|
|Unused?
|-
|
|372
|
|Unused?
|-
|
|373
|
|Unused?
|-
|[[Kernel/MmDbgAllocateMemory]]
|374
|stdcall
|Devkits only!
|-
|[[Kernel/MmDbgFreeMemory]]
|375
|stdcall
|Devkits only!
|-
|[[Kernel/MmDbgQueryAvailablePages]]
|376
|stdcall
|Devkits only!
|-
|[[Kernel/MmDbgReleaseAddress]]
|377
|stdcall
|Devkits only!
|-
|[[Kernel/MmDbgWriteCheck]]
|378
|stdcall
|Devkits only!
|}

CPU

2017-07-17T02:47:32Z

Haxar:

The CPU in the Xbox was a custom Pentium 3 running at 733MHz. The 'custom' part of this was that that the Pentium 3 in the Xbox was that it had only 128KB L2 cache instead of the usual 256KB. This allowed Microsoft to buy them at a bit of a discount and Intel to shift a few more CPUs{{citation needed}}.

== References ==

* [http://www.intel.com/content/dam/support/us/en/documents/processors/mobile/celeron/sb/28365403.pdf Mobile Intel® Celeron® Processor (0.18μ) in BGA2 and Micro-PGA2 Packages] (This datasheet is for the mobile version Coppermine with 256kB L2 cache. It does not contain the Xbox Coppermine-128 with 128kB L2 cache at 733MHz (S-Spec SL5SN). No such datasheet exists. Both differences are pin compatible.
* [https://www.google.com/patents/US20050282621 CPU upgrading adapter for a Microsoft XboxTM game machine] US Patent Application 20050282621 by Friendtech, filed 2003-08-21.

Patents

2017-07-17T02:34:41Z

Haxar:

Here a list of patents that might be related to the original Xbox:

* Filed 1997-11-25 by Nvidia: https://www.google.com/patents/US6697063 "Rendering pipeline"
* Filed 1998-12-23 by Microsoft: https://www.google.com/patents/US6417858 "Processor for geometry transformations and lighting calculations"
* Filed 1999-12-06 by Nvidia: https://www.google.com/patents/US6198488 "Transform, lighting and rasterization system embodied on a single semiconductor platform"
* Filed 1999-12-06 by Nvidia: https://www.google.com/patents/US6573900 "Method, apparatus and article of manufacture for a sequencer in a transform/lighting module capable of processing multiple independent execution threads"
* Filed 1999-12-06 by Nvidia: https://www.google.com/patents/US6765575 "Clip-less rasterization using line equation-based traversal"
* Filed 1999-12-06 by Nvidia: https://www.google.com/patents/US6650325 "Method, apparatus and article of manufacture for boustrophedonic rasterization"
* Filed 2000-12-05 by Nvidia: https://www.google.com/patents/US6690372 "System, method and article of manufacture for shadow mapping"
* Filed 2001-01-11 by Microsoft: https://www.google.com/patents/USD452282 "Portion of an electronic housing"
* Filed 2001-01-11 by Microsoft: https://www.google.com/patents/USD451513 "Computer input device" (describes the original Xbox controller, a.k.a. : "the Duke")
* Filed 2001-06-19 by Nvidia: https://www.google.com/patents/US6870540 "System, method and computer program product for a programmable pixel processing model with instruction set"
* Filed 2002-06-07 by Microsoft: https://www.google.com/patents/US6907522 "Use of hashing in a secure boot loader" (mentions "NV2A")
* Filed 2003-08-21 by Friendtech: https://www.google.com/patents/US20050282621 "CPU upgrading adapter for a Microsoft XboxTM game machine"
* Filed 2005-01-04 by Nvidia: https://www.google.com/patents/US7916149 "Block linear memory ordering of texture data"
* Filed 2005-01-07 by Microsoft: https://www.google.com/patents/US7676840 "Use of hashing in a secure boot loader" (a continuation of patent US6907522)
* Filed 2005-05-17 by Nvidia: https://www.google.com/patents/US7793029 "Translation device apparatus for configuring printed circuit board connectors " (describes coupling two PCI Express connectors, possibly for the secondary Chihiro board, mentions "Xbox")

Possibly unrelated :
* Filed 1989-12-29 by Dolby Laboratories: https://www.google.com/patents/US5109417 "Low bit rate transform coder, decoder, and encoder/decoder for high-quality audio"
* Filed 2008-01-15 by Microsoft: https://www.google.com/patents/US8607324 "Untrusted gaming system access to online gaming service" (describes part of Xbox online)
* Filed 2011-06-17 by Microsoft: https://www.google.com/patents/US8641525 "Controller for video game console" (one of the 51 patents comprising the Xbox One controller)
* Filed 2011-09-07 by Microsoft: https://www.google.com/patents/US8597125 "System and method for configuring game data about players"
* Filed 2012-01-13 by Microsoft: https://www.google.com/patents/US8602897 "Extended and editable gamer profile"

Kernel

2017-06-19T02:23:20Z

Haxar: Kernel/XboxLANKey

The Xbox kernel is called xboxkrnl.exe. It is closely related to the Windows NT [[Wikipedia:Ntoskrnl.exe|ntoskrnl.exe]].
Its image base address is always 0x80010000.

== Header modifications ==

xboxkrnl.exe is a mostly standard exe file.
However, the MS-DOS header was patched to contain Xbox specific data in the reserved 20 byte block starting at offset 40:

{| class=wikitable
! Offset !! Meaning
|-
|40 || Size of uninitialized portion of the .data section
|-
|44 || Size of initialized portion of the .data section
|-
|48 || Memory address of initialized portion of the .data section (usually in [[Flash]]). <br> Used to re-initialize the data section pointed to by the next field. <br> Note that the pointer might be invalid during normal execution as the Flash might not be mapped at all times.
|-
|52 || Memory address where the .data section is stored (usually the same as in the section header + image base).
|}

== Sections ==

All sections are identity mapped (meaning file offsets and offsets in RAM match). This is because the kernel is not loaded through a traditional PE / exe loader, but just unpacked into memory.

=== .text ===

The .text section contains the kernel exports.

=== .data ===

The .data section stores initialized and uninitialized data.
A copy of the initialized portion of this section is usually stored in the [[BIOS]].

=== STICKY ===

Stores variables which must be preserved across a quick-reboot.

=== IDEXPRDT ===

A Physical Region Descriptor Table (PRDT) for the IDE bus. This section serves as a memory allocation only, it does not have to be initialized when loading the kernel{{citation needed}}.

=== INIT ===

This section is always the last one. It contains the entrypoint of the kernel.
This does all the cold-boot kernel initialization as described [[Boot_Process#Initialization|here]].
Later kernels{{FIXME|reason=Which revision? right now it appears that *ALL* kernels will discard this}} will discard this section after initialization.
INIT also contains the [[Boot Animation]], so once the kernel has finished booting it can't do a full hardware re-initialization or play the boot animation anymore.

== Kernel exports ==
{| class="wikitable"
|+Kernel exports
|-
!Name
!Ordinal
!Calling Convention
!Notes
|-
|[[Kernel/AvGetSavedDataAddress]]
|1
|stdcall
|
|-
|[[Kernel/AvSendTVEncoderOption]]
|2
|stdcall
|
|-
|[[Kernel/AvSetDisplayMode]]
|3
|stdcall
|
|-
|[[Kernel/AvSetSavedDataAddress]]
|4
|stdcall
|
|-
|[[Kernel/DbgBreakPoint]]
|5
|stdcall
|
|-
|[[Kernel/DbgBreakPointWithStatus]]
|6
|stdcall
|
|-
|[[Kernel/DbgLoadImageSymbols]]
|7
|stdcall
|Devkits only!
|-
|[[Kernel/DbgPrint]]
|8
|stdcall
|
|-
|[[Kernel/HalReadSMCTrayState]]
|9
|stdcall
|
|-
|[[Kernel/DbgPrompt]]
|10
|stdcall
|
|-
|[[Kernel/DbgUnLoadImageSymbols]]
|11
|stdcall
|Devkits only!
|-
|[[Kernel/ExAcquireReadWriteLockExclusive]]
|12
|stdcall
|
|-
|[[Kernel/ExAcquireReadWriteLockShared]]
|13
|stdcall
|
|-
|[[Kernel/ExAllocatePool]]
|14
|stdcall
|
|-
|[[Kernel/ExAllocatePoolWithTag]]
|15
|stdcall
|
|-
|[[Kernel/ExEventObjectType]]
|16
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/ExFreePool]]
|17
|stdcall
|
|-
|[[Kernel/ExInitializeReadWriteLock]]
|18
|stdcall
|
|-
|[[Kernel/ExInterlockedAddLargeInteger]]
|19
|stdcall
|
|-
|[[Kernel/ExInterlockedAddLargeStatistic]]
|20
|fastcall
|
|-
|[[Kernel/ExInterlockedCompareExchange64]]
|21
|fastcall
|
|-
|[[Kernel/ExMutantObjectType]]
|22
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/ExQueryPoolBlockSize]]
|23
|stdcall
|
|-
|[[Kernel/ExQueryNonVolatileSetting]]
|24
|stdcall
|
|-
|[[Kernel/ExReadWriteRefurbInfo]]
|25
|stdcall
|
|-
|[[Kernel/ExRaiseException]]
|26
|stdcall
|
|-
|[[Kernel/ExRaiseStatus]]
|27
|stdcall
|
|-
|[[Kernel/ExReleaseReadWriteLock]]
|28
|stdcall
|
|-
|[[Kernel/ExSaveNonVolatileSetting]]
|29
|stdcall
|
|-
|[[Kernel/ExSemaphoreObjectType]]
|30
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/ExTimerObjectType]]
|31
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/ExfInterlockedInsertHeadList]]
|32
|stdcall
|
|-
|[[Kernel/ExfInterlockedInsertTailList]]
|33
|fastcall
|
|-
|[[Kernel/ExfInterlockedRemoveHeadList]]
|34
|fastcall
|
|-
|[[Kernel/FscGetCacheSize]]
|35
|stdcall
|
|-
|[[Kernel/FscInvalidateIdleBlocks]]
|36
|stdcall
|
|-
|[[Kernel/FscSetCacheSize]]
|37
|stdcall
|
|-
|[[Kernel/HalClearSoftwareInterrupt]]
|38
|fastcall
|
|-
|[[Kernel/HalDisableSystemInterrupt]]
|39
|stdcall
|
|-
|[[Kernel/HalDiskCachePartitionCount]]
|40
|
|Variable: ULONG
|-
|[[Kernel/HalDiskModelNumber]]
|41
|
|Variable: STRING
|-
|[[Kernel/HalDiskSerialNumber]]
|42
|
|Variable: STRING
|-
|[[Kernel/HalEnableSystemInterrupt]]
|43
|stdcall
|
|-
|[[Kernel/HalGetInterruptVector]]
|44
|stdcall
|
|-
|[[Kernel/HalReadSMBusValue]]
|45
|stdcall
|
|-
|[[Kernel/HalReadWritePCISpace]]
|46
|stdcall
|
|-
|[[Kernel/HalRegisterShutdownNotification]]
|47
|stdcall
|
|-
|[[Kernel/HalRequestSoftwareInterrupt]]
|48
|fastcall
|
|-
|[[Kernel/HalReturnToFirmware]]
|49
|stdcall
|
|-
|[[Kernel/HalWriteSMBusValue]]
|50
|stdcall
|
|-
|[[Kernel/InterlockedCompareExchange]]
|51
|fastcall
|
|-
|[[Kernel/InterlockedDecrement]]
|52
|fastcall
|
|-
|[[Kernel/InterlockedIncrement]]
|53
|fastcall
|
|-
|[[Kernel/InterlockedExchange]]
|54
|fastcall
|
|-
|[[Kernel/InterlockedExchangeAdd]]
|55
|fastcall
|
|-
|[[Kernel/InterlockedFlushSList]]
|56
|fastcall
|
|-
|[[Kernel/InterlockedPopEntrySList]]
|57
|fastcall
|
|-
|[[Kernel/InterlockedPushEntrySList]]
|58
|fastcall
|
|-
|[[Kernel/IoAllocateIrp]]
|59
|stdcall
|
|-
|[[Kernel/IoBuildAsynchronousFsdRequest]]
|60
|stdcall
|
|-
|[[Kernel/IoBuildDeviceIoControlRequest]]
|61
|stdcall
|
|-
|[[Kernel/IoBuildSynchronousFsdRequest]]
|62
|stdcall
|
|-
|[[Kernel/IoCheckShareAccess]]
|63
|stdcall
|
|-
|[[Kernel/IoCompletionObjectType]]
|64
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/IoCreateDevice]]
|65
|stdcall
|
|-
|[[Kernel/IoCreateFile]]
|66
|stdcall
|
|-
|[[Kernel/IoCreateSymbolicLink]]
|67
|stdcall
|
|-
|[[Kernel/IoDeleteDevice]]
|68
|stdcall
|
|-
|[[Kernel/IoDeleteSymbolicLink]]
|69
|stdcall
|
|-
|[[Kernel/IoDeviceObjectType]]
|70
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/IoFileObjectType]]
|71
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/IoFreeIrp]]
|72
|stdcall
|
|-
|[[Kernel/IoInitializeIrp]]
|73
|stdcall
|
|-
|[[Kernel/IoInvalidDeviceRequest]]
|74
|stdcall
|
|-
|[[Kernel/IoQueryFileInformation]]
|75
|stdcall
|
|-
|[[Kernel/IoQueryVolumeInformation]]
|76
|stdcall
|
|-
|[[Kernel/IoQueueThreadIrp]]
|77
|stdcall
|
|-
|[[Kernel/IoRemoveShareAccess]]
|78
|stdcall
|
|-
|[[Kernel/IoSetIoCompletion]]
|79
|stdcall
|
|-
|[[Kernel/IoSetShareAccess]]
|80
|stdcall
|
|-
|[[Kernel/IoStartNextPacket]]
|81
|stdcall
|
|-
|[[Kernel/IoStartNextPacketByKey]]
|82
|stdcall
|
|-
|[[Kernel/IoStartPacket]]
|83
|stdcall
|
|-
|[[Kernel/IoSynchronousDeviceIoControlRequest]]
|84
|stdcall
|
|-
|[[Kernel/IoSynchronousFsdRequest]]
|85
|stdcall
|
|-
|[[Kernel/IofCallDriver]]
|86
|fastcall
|
|-
|[[Kernel/IofCompleteRequest]]
|87
|fastcall
|
|-
|[[Kernel/KdDebuggerEnabled]]
|88
|
|Variable: BOOLEAN
|-
|[[Kernel/KdDebuggerNotPresent]]
|89
|
|Variable: BOOLEAN
|-
|[[Kernel/IoDismountVolume]]
|90
|stdcall
|
|-
|[[Kernel/IoDismountVolumeByName]]
|91
|stdcall
|
|-
|[[Kernel/KeAlertResumeThread]]
|92
|stdcall
|
|-
|[[Kernel/KeAlertThread]]
|93
|stdcall
|
|-
|[[Kernel/KeBoostPriorityThread]]
|94
|stdcall
|
|-
|[[Kernel/KeBugCheck]]
|95
|stdcall
|
|-
|[[Kernel/KeBugCheckEx]]
|96
|stdcall
|
|-
|[[Kernel/KeCancelTimer]]
|97
|stdcall
|
|-
|[[Kernel/KeConnectInterrupt]]
|98
|stdcall
|
|-
|[[Kernel/KeDelayExecutionThread]]
|99
|stdcall
|
|-
|[[Kernel/KeDisconnectInterrupt]]
|100
|stdcall
|
|-
|[[Kernel/KeEnterCriticalRegion]]
|101
|stdcall
|
|-
|[[Kernel/MmGlobalData]]
|102
|
|Variable: MMGLOBALDATA
|-
|[[Kernel/KeGetCurrentIrql]]
|103
|stdcall
|
|-
|[[Kernel/KeGetCurrentThread]]
|104
|stdcall
|
|-
|[[Kernel/KeInitializeApc]]
|105
|stdcall
|
|-
|[[Kernel/KeInitializeDeviceQueue]]
|106
|stdcall
|
|-
|[[Kernel/KeInitializeDpc]]
|107
|stdcall
|
|-
|[[Kernel/KeInitializeEvent]]
|108
|stdcall
|
|-
|[[Kernel/KeInitializeInterrupt]]
|109
|stdcall
|
|-
|[[Kernel/KeInitializeMutant]]
|110
|stdcall
|
|-
|[[Kernel/KeInitializeQueue]]
|111
|stdcall
|
|-
|[[Kernel/KeInitializeSemaphore]]
|112
|stdcall
|
|-
|[[Kernel/KeInitializeTimerEx]]
|113
|stdcall
|
|-
|[[Kernel/KeInsertByKeyDeviceQueue]]
|114
|stdcall
|
|-
|[[Kernel/KeInsertDeviceQueue]]
|115
|stdcall
|
|-
|[[Kernel/KeInsertHeadQueue]]
|116
|stdcall
|
|-
|[[Kernel/KeInsertQueue]]
|117
|stdcall
|
|-
|[[Kernel/KeInsertQueueApc]]
|118
|stdcall
|
|-
|[[Kernel/KeInsertQueueDpc]]
|119
|stdcall
|
|-
|[[Kernel/KeInterruptTime]]
|120
|
|Variable: KSYSTEM_TIME
|-
|[[Kernel/KeIsExecutingDpc]]
|121
|stdcall
|
|-
|[[Kernel/KeLeaveCriticalRegion]]
|122
|stdcall
|
|-
|[[Kernel/KePulseEvent]]
|123
|stdcall
|
|-
|[[Kernel/KeQueryBasePriorityThread]]
|124
|stdcall
|
|-
|[[Kernel/KeQueryInterruptTime]]
|125
|stdcall
|
|-
|[[Kernel/KeQueryPerformanceCounter]]
|126
|stdcall
|
|-
|[[Kernel/KeQueryPerformanceFrequency]]
|127
|stdcall
|
|-
|[[Kernel/KeQuerySystemTime]]
|128
|stdcall
|
|-
|[[Kernel/KeRaiseIrqlToDpcLevel]]
|129
|stdcall
|
|-
|[[Kernel/KeRaiseIrqlToSynchLevel]]
|130
|stdcall
|
|-
|[[Kernel/KeReleaseMutant]]
|131
|stdcall
|
|-
|[[Kernel/KeReleaseSemaphore]]
|132
|stdcall
|
|-
|[[Kernel/KeRemoveByKeyDeviceQueue]]
|133
|stdcall
|
|-
|[[Kernel/KeRemoveDeviceQueue]]
|134
|stdcall
|
|-
|[[Kernel/KeRemoveEntryDeviceQueue]]
|135
|stdcall
|
|-
|[[Kernel/KeRemoveQueue]]
|136
|stdcall
|
|-
|[[Kernel/KeRemoveQueueDpc]]
|137
|stdcall
|
|-
|[[Kernel/KeResetEvent]]
|138
|stdcall
|
|-
|[[Kernel/KeRestoreFloatingPointState]]
|139
|stdcall
|
|-
|[[Kernel/KeResumeThread]]
|140
|stdcall
|
|-
|[[Kernel/KeRundownQueue]]
|141
|stdcall
|
|-
|[[Kernel/KeSaveFloatingPointState]]
|142
|stdcall
|
|-
|[[Kernel/KeSetBasePriorityThread]]
|143
|stdcall
|
|-
|[[Kernel/KeSetDisableBoostThread]]
|144
|stdcall
|
|-
|[[Kernel/KeSetEvent]]
|145
|stdcall
|
|-
|[[Kernel/KeSetEventBoostPriority]]
|146
|stdcall
|
|-
|[[Kernel/KeSetPriorityProcess]]
|147
|stdcall
|
|-
|[[Kernel/KeSetPriorityThread]]
|148
|stdcall
|
|-
|[[Kernel/KeSetTimer]]
|149
|stdcall
|
|-
|[[Kernel/KeSetTimerEx]]
|150
|stdcall
|
|-
|[[Kernel/KeStallExecutionProcessor]]
|151
|stdcall
|
|-
|[[Kernel/KeSuspendThread]]
|152
|stdcall
|
|-
|[[Kernel/KeSynchronizeExecution]]
|153
|stdcall
|
|-
|[[Kernel/KeSystemTime]]
|154
|
|Variable: KSYSTEM_TIME
|-
|[[Kernel/KeTestAlertThread]]
|155
|stdcall
|
|-
|[[Kernel/KeTickCount]]
|156
|
|Variable: ULONG
|-
|[[Kernel/KeTimeIncrement]]
|157
|
|Variable: ULONG
|-
|[[Kernel/KeWaitForMultipleObjects]]
|158
|stdcall
|
|-
|[[Kernel/KeWaitForSingleObject]]
|159
|stdcall
|
|-
|[[Kernel/KfRaiseIrql]]
|160
|fastcall
|
|-
|[[Kernel/KfLowerIrql]]
|161
|fastcall
|
|-
|[[Kernel/KiBugCheckData]]
|162
|
|Variable: ULONG_PTR[5]
|-
|[[Kernel/KiUnlockDispatcherDatabase]]
|163
|fastcall
|
|-
|[[Kernel/LaunchDataPage]]
|164
|
|Variable: PLAUNCH_DATA_PAGE
|-
|[[Kernel/MmAllocateContiguousMemory]]
|165
|stdcall
|
|-
|[[Kernel/MmAllocateContiguousMemoryEx]]
|166
|stdcall
|
|-
|[[Kernel/MmAllocateSystemMemory]]
|167
|stdcall
|
|-
|[[Kernel/MmClaimGpuInstanceMemory]]
|168
|stdcall
|
|-
|[[Kernel/MmCreateKernelStack]]
|169
|stdcall
|
|-
|[[Kernel/MmDeleteKernelStack]]
|170
|stdcall
|
|-
|[[Kernel/MmFreeContiguousMemory]]
|171
|stdcall
|
|-
|[[Kernel/MmFreeSystemMemory]]
|172
|stdcall
|
|-
|[[Kernel/MmGetPhysicalAddress]]
|173
|stdcall
|
|-
|[[Kernel/MmIsAddressValid]]
|174
|stdcall
|
|-
|[[Kernel/MmLockUnlockBufferPages]]
|175
|stdcall
|
|-
|[[Kernel/MmLockUnlockPhysicalPage]]
|176
|stdcall
|
|-
|[[Kernel/MmMapIoSpace]]
|177
|stdcall
|
|-
|[[Kernel/MmPersistContiguousMemory]]
|178
|stdcall
|
|-
|[[Kernel/MmQueryAddressProtect]]
|179
|stdcall
|
|-
|[[Kernel/MmQueryAllocationSize]]
|180
|stdcall
|
|-
|[[Kernel/MmQueryStatistics]]
|181
|stdcall
|
|-
|[[Kernel/MmSetAddressProtect]]
|182
|stdcall
|
|-
|[[Kernel/MmUnmapIoSpace]]
|183
|stdcall
|
|-
|[[Kernel/NtAllocateVirtualMemory]]
|184
|stdcall
|
|-
|[[Kernel/NtCancelTimer]]
|185
|stdcall
|
|-
|[[Kernel/NtClearEvent]]
|186
|stdcall
|
|-
|[[Kernel/NtClose]]
|187
|stdcall
|
|-
|[[Kernel/NtCreateDirectoryObject]]
|188
|stdcall
|
|-
|[[Kernel/NtCreateEvent]]
|189
|stdcall
|
|-
|[[Kernel/NtCreateFile]]
|190
|stdcall
|
|-
|[[Kernel/NtCreateIoCompletion]]
|191
|stdcall
|
|-
|[[Kernel/NtCreateMutant]]
|192
|stdcall
|
|-
|[[Kernel/NtCreateSemaphore]]
|193
|stdcall
|
|-
|[[Kernel/NtCreateTimer]]
|194
|stdcall
|
|-
|[[Kernel/NtDeleteFile]]
|195
|stdcall
|
|-
|[[Kernel/NtDeviceIoControlFile]]
|196
|stdcall
|
|-
|[[Kernel/NtDuplicateObject]]
|197
|stdcall
|
|-
|[[Kernel/NtFlushBuffersFile]]
|198
|stdcall
|
|-
|[[Kernel/NtFreeVirtualMemory]]
|199
|stdcall
|
|-
|[[Kernel/NtFsControlFile]]
|200
|stdcall
|
|-
|[[Kernel/NtOpenDirectoryObject]]
|201
|stdcall
|
|-
|[[Kernel/NtOpenFile]]
|202
|stdcall
|
|-
|[[Kernel/NtOpenSymbolicLinkObject]]
|203
|stdcall
|
|-
|[[Kernel/NtProtectVirtualMemory]]
|204
|stdcall
|
|-
|[[Kernel/NtPulseEvent]]
|205
|stdcall
|
|-
|[[Kernel/NtQueueApcThread]]
|206
|stdcall
|
|-
|[[Kernel/NtQueryDirectoryFile]]
|207
|stdcall
|
|-
|[[Kernel/NtQueryDirectoryObject]]
|208
|stdcall
|
|-
|[[Kernel/NtQueryEvent]]
|209
|stdcall
|
|-
|[[Kernel/NtQueryFullAttributesFile]]
|210
|stdcall
|
|-
|[[Kernel/NtQueryInformationFile]]
|211
|stdcall
|
|-
|[[Kernel/NtQueryIoCompletion]]
|212
|stdcall
|
|-
|[[Kernel/NtQueryMutant]]
|213
|stdcall
|
|-
|[[Kernel/NtQuerySemaphore]]
|214
|stdcall
|
|-
|[[Kernel/NtQuerySymbolicLinkObject]]
|215
|stdcall
|
|-
|[[Kernel/NtQueryTimer]]
|216
|stdcall
|
|-
|[[Kernel/NtQueryVirtualMemory]]
|217
|stdcall
|
|-
|[[Kernel/NtQueryVolumeInformationFile]]
|218
|stdcall
|
|-
|[[Kernel/NtReadFile]]
|219
|stdcall
|
|-
|[[Kernel/NtReadFileScatter]]
|220
|stdcall
|
|-
|[[Kernel/NtReleaseMutant]]
|221
|stdcall
|
|-
|[[Kernel/NtReleaseSemaphore]]
|222
|stdcall
|
|-
|[[Kernel/NtRemoveIoCompletion]]
|223
|stdcall
|
|-
|[[Kernel/NtResumeThread]]
|224
|stdcall
|
|-
|[[Kernel/NtSetEvent]]
|225
|stdcall
|
|-
|[[Kernel/NtSetInformationFile]]
|226
|stdcall
|
|-
|[[Kernel/NtSetIoCompletion]]
|227
|stdcall
|
|-
|[[Kernel/NtSetSystemTime]]
|228
|stdcall
|
|-
|[[Kernel/NtSetTimerEx]]
|229
|stdcall
|
|-
|[[Kernel/NtSignalAndWaitForSingleObjectEx]]
|230
|stdcall
|
|-
|[[Kernel/NtSuspendThread]]
|231
|stdcall
|
|-
|[[Kernel/NtUserIoApcDispatcher]]
|232
|stdcall
|
|-
|[[Kernel/NtWaitForSingleObject]]
|233
|stdcall
|
|-
|[[Kernel/NtWaitForSingleObjectEx]]
|234
|stdcall
|
|-
|[[Kernel/NtWaitForMultipleObjectsEx]]
|235
|stdcall
|
|-
|[[Kernel/NtWriteFile]]
|236
|stdcall
|
|-
|[[Kernel/NtWriteFileGather]]
|237
|stdcall
|
|-
|[[Kernel/NtYieldExecution]]
|238
|stdcall
|
|-
|[[Kernel/ObCreateObject]]
|239
|stdcall
|
|-
|[[Kernel/ObDirectoryObjectType]]
|240
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/ObInsertObject]]
|241
|stdcall
|
|-
|[[Kernel/ObMakeTemporaryObject]]
|242
|stdcall
|
|-
|[[Kernel/ObOpenObjectByName]]
|243
|stdcall
|
|-
|[[Kernel/ObOpenObjectByPointer]]
|244
|stdcall
|
|-
|[[Kernel/ObpObjectHandleTable]]
|245
|
|Variable: OBJECT_HANDLE_TABLE
|-
|[[Kernel/ObReferenceObjectByHandle]]
|246
|stdcall
|
|-
|[[Kernel/ObReferenceObjectByName]]
|247
|stdcall
|
|-
|[[Kernel/ObReferenceObjectByPointer]]
|248
|stdcall
|
|-
|[[Kernel/ObSymbolicLinkObjectType]]
|249
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/ObfDereferenceObject]]
|250
|fastcall
|
|-
|[[Kernel/ObfReferenceObject]]
|251
|fastcall
|
|-
|[[Kernel/PhyGetLinkState]]
|252
|stdcall
|
|-
|[[Kernel/PhyInitialize]]
|253
|stdcall
|
|-
|[[Kernel/PsCreateSystemThread]]
|254
|stdcall
|
|-
|[[Kernel/PsCreateSystemThreadEx]]
|255
|stdcall
|
|-
|[[Kernel/PsQueryStatistics]]
|256
|stdcall
|
|-
|[[Kernel/PsSetCreateThreadNotifyRoutine]]
|257
|stdcall
|
|-
|[[Kernel/PsTerminateSystemThread]]
|258
|stdcall
|
|-
|[[Kernel/PsThreadObjectType]]
|259
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/RtlAnsiStringToUnicodeString]]
|260
|stdcall
|
|-
|[[Kernel/RtlAppendStringToString]]
|261
|stdcall
|
|-
|[[Kernel/RtlAppendUnicodeStringToString]]
|262
|stdcall
|
|-
|[[Kernel/RtlAppendUnicodeToString]]
|263
|stdcall
|
|-
|[[Kernel/RtlAssert]]
|264
|stdcall
|
|-
|[[Kernel/RtlCaptureContext]]
|265
|stdcall
|
|-
|[[Kernel/RtlCaptureStackBackTrace]]
|266
|stdcall
|
|-
|[[Kernel/RtlCharToInteger]]
|267
|stdcall
|
|-
|[[Kernel/RtlCompareMemory]]
|268
|stdcall
|
|-
|[[Kernel/RtlCompareMemoryUlong]]
|269
|stdcall
|
|-
|[[Kernel/RtlCompareString]]
|270
|stdcall
|
|-
|[[Kernel/RtlCompareUnicodeString]]
|271
|stdcall
|
|-
|[[Kernel/RtlCopyString]]
|272
|stdcall
|
|-
|[[Kernel/RtlCopyUnicodeString]]
|273
|stdcall
|
|-
|[[Kernel/RtlCreateUnicodeString]]
|274
|stdcall
|
|-
|[[Kernel/RtlDowncaseUnicodeChar]]
|275
|stdcall
|
|-
|[[Kernel/RtlDowncaseUnicodeString]]
|276
|stdcall
|
|-
|[[Kernel/RtlEnterCriticalSection]]
|277
|stdcall
|
|-
|[[Kernel/RtlEnterCriticalSectionAndRegion]]
|278
|stdcall
|
|-
|[[Kernel/RtlEqualString]]
|279
|stdcall
|
|-
|[[Kernel/RtlEqualUnicodeString]]
|280
|stdcall
|
|-
|[[Kernel/RtlExtendedIntegerMultiply]]
|281
|stdcall
|
|-
|[[Kernel/RtlExtendedLargeIntegerDivide]]
|282
|stdcall
|
|-
|[[Kernel/RtlExtendedMagicDivide]]
|283
|stdcall
|
|-
|[[Kernel/RtlFillMemory]]
|284
|stdcall
|
|-
|[[Kernel/RtlFillMemoryUlong]]
|285
|stdcall
|
|-
|[[Kernel/RtlFreeAnsiString]]
|286
|stdcall
|
|-
|[[Kernel/RtlFreeUnicodeString]]
|287
|stdcall
|
|-
|[[Kernel/RtlGetCallersAddress]]
|288
|stdcall
|
|-
|[[Kernel/RtlInitAnsiString]]
|289
|stdcall
|
|-
|[[Kernel/RtlInitUnicodeString]]
|290
|stdcall
|
|-
|[[Kernel/RtlInitializeCriticalSection]]
|291
|stdcall
|
|-
|[[Kernel/RtlIntegerToChar]]
|292
|stdcall
|
|-
|[[Kernel/RtlIntegerToUnicodeString]]
|293
|stdcall
|
|-
|[[Kernel/RtlLeaveCriticalSection]]
|294
|stdcall
|
|-
|[[Kernel/RtlLeaveCriticalSectionAndRegion]]
|295
|stdcall
|
|-
|[[Kernel/RtlLowerChar]]
|296
|stdcall
|
|-
|[[Kernel/RtlMapGenericMask]]
|297
|stdcall
|
|-
|[[Kernel/RtlMoveMemory]]
|298
|stdcall
|
|-
|[[Kernel/RtlMultiByteToUnicodeN]]
|299
|stdcall
|
|-
|[[Kernel/RtlMultiByteToUnicodeSize]]
|300
|stdcall
|
|-
|[[Kernel/RtlNtStatusToDosError]]
|301
|stdcall
|
|-
|[[Kernel/RtlRaiseException]]
|302
|stdcall
|
|-
|[[Kernel/RtlRaiseStatus]]
|303
|stdcall
|
|-
|[[Kernel/RtlTimeFieldsToTime]]
|304
|stdcall
|
|-
|[[Kernel/RtlTimeToTimeFields]]
|305
|stdcall
|
|-
|[[Kernel/RtlTryEnterCriticalSection]]
|306
|stdcall
|
|-
|[[Kernel/RtlUlongByteSwap]]
|307
|fastcall
|
|-
|[[Kernel/RtlUnicodeStringToAnsiString]]
|308
|stdcall
|
|-
|[[Kernel/RtlUnicodeStringToInteger]]
|309
|stdcall
|
|-
|[[Kernel/RtlUnicodeToMultiByteN]]
|310
|stdcall
|
|-
|[[Kernel/RtlUnicodeToMultiByteSize]]
|311
|stdcall
|
|-
|[[Kernel/RtlUnwind]]
|312
|stdcall
|
|-
|[[Kernel/RtlUpcaseUnicodeChar]]
|313
|stdcall
|
|-
|[[Kernel/RtlUpcaseUnicodeString]]
|314
|stdcall
|
|-
|[[Kernel/RtlUpcaseUnicodeToMultiByteN]]
|315
|stdcall
|
|-
|[[Kernel/RtlUpperChar]]
|316
|stdcall
|
|-
|[[Kernel/RtlUpperString]]
|317
|stdcall
|
|-
|[[Kernel/RtlUshortByteSwap]]
|318
|fastcall
|
|-
|[[Kernel/RtlWalkFrameChain]]
|319
|stdcall
|
|-
|[[Kernel/RtlZeroMemory]]
|320
|stdcall
|
|-
|[[Kernel/XboxEEPROMKey]]
|321
|
|Variable: XBOX_KEY_DATA
|-
|[[Kernel/XboxHardwareInfo]]
|322
|
|Variable: XBOX_HARDWARE_INFO
|-
|[[Kernel/XboxHDKey]]
|323
|
|Variable: XBOX_KEY_DATA
|-
|[[Kernel/XboxKrnlVersion]]
|324
|
|Variable: XBOX_KRNL_VERSION
|-
|[[Kernel/XboxSignatureKey]]
|325
|
|Variable: XBOX_KEY_DATA
|-
|[[Kernel/XeImageFileName]]
|326
|
|Variable: OBJECT_STRING
|-
|[[Kernel/XeLoadSection]]
|327
|stdcall
|
|-
|[[Kernel/XeUnloadSection]]
|328
|stdcall
|
|-
|[[Kernel/READ_PORT_BUFFER_UCHAR]]
|329
|stdcall
|
|-
|[[Kernel/READ_PORT_BUFFER_USHORT]]
|330
|stdcall
|
|-
|[[Kernel/READ_PORT_BUFFER_ULONG]]
|331
|stdcall
|
|-
|[[Kernel/WRITE_PORT_BUFFER_UCHAR]]
|332
|stdcall
|
|-
|[[Kernel/WRITE_PORT_BUFFER_USHORT]]
|333
|stdcall
|
|-
|[[Kernel/WRITE_PORT_BUFFER_ULONG]]
|334
|stdcall
|
|-
|[[Kernel/XcSHAInit]]
|335
|stdcall
|
|-
|[[Kernel/XcSHAUpdate]]
|336
|stdcall
|
|-
|[[Kernel/XcSHAFinal]]
|337
|stdcall
|
|-
|[[Kernel/XcRC4Key]]
|338
|stdcall
|
|-
|[[Kernel/XcRC4Crypt]]
|339
|stdcall
|
|-
|[[Kernel/XcHMAC]]
|340
|stdcall
|
|-
|[[Kernel/XcPKEncPublic]]
|341
|stdcall
|
|-
|[[Kernel/XcPKDecPrivate]]
|342
|stdcall
|
|-
|[[Kernel/XcPKGetKeyLen]]
|343
|stdcall
|
|-
|[[Kernel/XcVerifyPKCS1Signature]]
|344
|stdcall
|
|-
|[[Kernel/XcModExp]]
|345
|stdcall
|
|-
|[[Kernel/XcDESKeyParity]]
|346
|stdcall
|
|-
|[[Kernel/XcKeyTable]]
|347
|stdcall
|
|-
|[[Kernel/XcBlockCrypt]]
|348
|stdcall
|
|-
|[[Kernel/XcBlockCryptCBC]]
|349
|stdcall
|
|-
|[[Kernel/XcCryptService]]
|350
|stdcall
|
|-
|[[Kernel/XcUpdateCrypto]]
|351
|stdcall
|
|-
|[[Kernel/RtlRip]]
|352
|stdcall
|
|-
|[[Kernel/XboxLANKey]]
|353
|
|Variable: XBOX_KEY_DATA
|-
|[[Kernel/XboxAlternateSignatureKeys]]
|354
|
|Variable: XBOX_KEY_DATA[XBEIMAGE_ALTERNATE_TITLE_ID_COUNT]
|-
|[[Kernel/XePublicKeyData]]
|355
|
|Variable: UCHAR[XC_PUBLIC_KEYDATA_SIZE]
|-
|[[Kernel/HalBootSMCVideoMode]]
|356
|
|Variable: ULONG
|-
|[[Kernel/IdexChannelObject]]
|357
|
|Variable: IDE_CHANNEL_OBJECT
|-
|[[Kernel/HalIsResetOrShutdownPending]]
|358
|stdcall
|
|-
|[[Kernel/IoMarkIrpMustComplete]]
|359
|stdcall
|
|-
|[[Kernel/HalInitiateShutdown]]
|360
|stdcall
|
|-
|[[Kernel/RtlSnprintf]]
|361
|stdcall
|Unused?
|-
|[[Kernel/RtlSprintf]]
|362
|stdcall
|Unused?
|-
|[[Kernel/RtlVsnprintf]]
|363
|stdcall
|Unused?
|-
|[[Kernel/RtlVsprintf]]
|364
|stdcall
|Unused?
|-
|[[Kernel/HalEnableSecureTrayEject]]
|365
|stdcall
|
|-
|[[Kernel/HalWriteSMCScratchRegister]]
|366
|stdcall
|
|-
|
|367
|
|Unused?
|-
|
|368
|
|Unused?
|-
|
|369
|
|Unused?
|-
|
|370
|
|Unused?
|-
|
|371
|
|Unused?
|-
|
|372
|
|Unused?
|-
|
|373
|
|Unused?
|-
|[[Kernel/MmDbgAllocateMemory]]
|374
|stdcall
|Devkits only!
|-
|[[Kernel/MmDbgFreeMemory]]
|375
|stdcall
|Devkits only!
|-
|[[Kernel/MmDbgQueryAvailablePages]]
|376
|stdcall
|Devkits only!
|-
|[[Kernel/MmDbgReleaseAddress]]
|377
|stdcall
|Devkits only!
|-
|[[Kernel/MmDbgWriteCheck]]
|378
|stdcall
|Devkits only!
|}

Kernel

2017-06-18T21:48:20Z

Haxar: Kernel Variables

The Xbox kernel is called xboxkrnl.exe. It is closely related to the Windows NT [[Wikipedia:Ntoskrnl.exe|ntoskrnl.exe]].
Its image base address is always 0x80010000.

== Header modifications ==

xboxkrnl.exe is a mostly standard exe file.
However, the MS-DOS header was patched to contain Xbox specific data in the reserved 20 byte block starting at offset 40:

{| class=wikitable
! Offset !! Meaning
|-
|40 || Size of uninitialized portion of the .data section
|-
|44 || Size of initialized portion of the .data section
|-
|48 || Memory address of initialized portion of the .data section (usually in [[Flash]]). <br> Used to re-initialize the data section pointed to by the next field. <br> Note that the pointer might be invalid during normal execution as the Flash might not be mapped at all times.
|-
|52 || Memory address where the .data section is stored (usually the same as in the section header + image base).
|}

== Sections ==

All sections are identity mapped (meaning file offsets and offsets in RAM match). This is because the kernel is not loaded through a traditional PE / exe loader, but just unpacked into memory.

=== .text ===

The .text section contains the kernel exports.

=== .data ===

The .data section stores initialized and uninitialized data.
A copy of the initialized portion of this section is usually stored in the [[BIOS]].

=== STICKY ===

Stores variables which must be preserved across a quick-reboot.

=== IDEXPRDT ===

A Physical Region Descriptor Table (PRDT) for the IDE bus. This section serves as a memory allocation only, it does not have to be initialized when loading the kernel{{citation needed}}.

=== INIT ===

This section is always the last one. It contains the entrypoint of the kernel.
This does all the cold-boot kernel initialization as described [[Boot_Process#Initialization|here]].
Later kernels{{FIXME|reason=Which revision? right now it appears that *ALL* kernels will discard this}} will discard this section after initialization.
INIT also contains the [[Boot Animation]], so once the kernel has finished booting it can't do a full hardware re-initialization or play the boot animation anymore.

== Kernel exports ==
{| class="wikitable"
|+Kernel exports
|-
!Name
!Ordinal
!Calling Convention
!Notes
|-
|[[Kernel/AvGetSavedDataAddress]]
|1
|stdcall
|
|-
|[[Kernel/AvSendTVEncoderOption]]
|2
|stdcall
|
|-
|[[Kernel/AvSetDisplayMode]]
|3
|stdcall
|
|-
|[[Kernel/AvSetSavedDataAddress]]
|4
|stdcall
|
|-
|[[Kernel/DbgBreakPoint]]
|5
|stdcall
|
|-
|[[Kernel/DbgBreakPointWithStatus]]
|6
|stdcall
|
|-
|[[Kernel/DbgLoadImageSymbols]]
|7
|stdcall
|Devkits only!
|-
|[[Kernel/DbgPrint]]
|8
|stdcall
|
|-
|[[Kernel/HalReadSMCTrayState]]
|9
|stdcall
|
|-
|[[Kernel/DbgPrompt]]
|10
|stdcall
|
|-
|[[Kernel/DbgUnLoadImageSymbols]]
|11
|stdcall
|Devkits only!
|-
|[[Kernel/ExAcquireReadWriteLockExclusive]]
|12
|stdcall
|
|-
|[[Kernel/ExAcquireReadWriteLockShared]]
|13
|stdcall
|
|-
|[[Kernel/ExAllocatePool]]
|14
|stdcall
|
|-
|[[Kernel/ExAllocatePoolWithTag]]
|15
|stdcall
|
|-
|[[Kernel/ExEventObjectType]]
|16
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/ExFreePool]]
|17
|stdcall
|
|-
|[[Kernel/ExInitializeReadWriteLock]]
|18
|stdcall
|
|-
|[[Kernel/ExInterlockedAddLargeInteger]]
|19
|stdcall
|
|-
|[[Kernel/ExInterlockedAddLargeStatistic]]
|20
|fastcall
|
|-
|[[Kernel/ExInterlockedCompareExchange64]]
|21
|fastcall
|
|-
|[[Kernel/ExMutantObjectType]]
|22
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/ExQueryPoolBlockSize]]
|23
|stdcall
|
|-
|[[Kernel/ExQueryNonVolatileSetting]]
|24
|stdcall
|
|-
|[[Kernel/ExReadWriteRefurbInfo]]
|25
|stdcall
|
|-
|[[Kernel/ExRaiseException]]
|26
|stdcall
|
|-
|[[Kernel/ExRaiseStatus]]
|27
|stdcall
|
|-
|[[Kernel/ExReleaseReadWriteLock]]
|28
|stdcall
|
|-
|[[Kernel/ExSaveNonVolatileSetting]]
|29
|stdcall
|
|-
|[[Kernel/ExSemaphoreObjectType]]
|30
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/ExTimerObjectType]]
|31
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/ExfInterlockedInsertHeadList]]
|32
|stdcall
|
|-
|[[Kernel/ExfInterlockedInsertTailList]]
|33
|fastcall
|
|-
|[[Kernel/ExfInterlockedRemoveHeadList]]
|34
|fastcall
|
|-
|[[Kernel/FscGetCacheSize]]
|35
|stdcall
|
|-
|[[Kernel/FscInvalidateIdleBlocks]]
|36
|stdcall
|
|-
|[[Kernel/FscSetCacheSize]]
|37
|stdcall
|
|-
|[[Kernel/HalClearSoftwareInterrupt]]
|38
|fastcall
|
|-
|[[Kernel/HalDisableSystemInterrupt]]
|39
|stdcall
|
|-
|[[Kernel/HalDiskCachePartitionCount]]
|40
|
|Variable: ULONG
|-
|[[Kernel/HalDiskModelNumber]]
|41
|
|Variable: STRING
|-
|[[Kernel/HalDiskSerialNumber]]
|42
|
|Variable: STRING
|-
|[[Kernel/HalEnableSystemInterrupt]]
|43
|stdcall
|
|-
|[[Kernel/HalGetInterruptVector]]
|44
|stdcall
|
|-
|[[Kernel/HalReadSMBusValue]]
|45
|stdcall
|
|-
|[[Kernel/HalReadWritePCISpace]]
|46
|stdcall
|
|-
|[[Kernel/HalRegisterShutdownNotification]]
|47
|stdcall
|
|-
|[[Kernel/HalRequestSoftwareInterrupt]]
|48
|fastcall
|
|-
|[[Kernel/HalReturnToFirmware]]
|49
|stdcall
|
|-
|[[Kernel/HalWriteSMBusValue]]
|50
|stdcall
|
|-
|[[Kernel/InterlockedCompareExchange]]
|51
|fastcall
|
|-
|[[Kernel/InterlockedDecrement]]
|52
|fastcall
|
|-
|[[Kernel/InterlockedIncrement]]
|53
|fastcall
|
|-
|[[Kernel/InterlockedExchange]]
|54
|fastcall
|
|-
|[[Kernel/InterlockedExchangeAdd]]
|55
|fastcall
|
|-
|[[Kernel/InterlockedFlushSList]]
|56
|fastcall
|
|-
|[[Kernel/InterlockedPopEntrySList]]
|57
|fastcall
|
|-
|[[Kernel/InterlockedPushEntrySList]]
|58
|fastcall
|
|-
|[[Kernel/IoAllocateIrp]]
|59
|stdcall
|
|-
|[[Kernel/IoBuildAsynchronousFsdRequest]]
|60
|stdcall
|
|-
|[[Kernel/IoBuildDeviceIoControlRequest]]
|61
|stdcall
|
|-
|[[Kernel/IoBuildSynchronousFsdRequest]]
|62
|stdcall
|
|-
|[[Kernel/IoCheckShareAccess]]
|63
|stdcall
|
|-
|[[Kernel/IoCompletionObjectType]]
|64
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/IoCreateDevice]]
|65
|stdcall
|
|-
|[[Kernel/IoCreateFile]]
|66
|stdcall
|
|-
|[[Kernel/IoCreateSymbolicLink]]
|67
|stdcall
|
|-
|[[Kernel/IoDeleteDevice]]
|68
|stdcall
|
|-
|[[Kernel/IoDeleteSymbolicLink]]
|69
|stdcall
|
|-
|[[Kernel/IoDeviceObjectType]]
|70
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/IoFileObjectType]]
|71
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/IoFreeIrp]]
|72
|stdcall
|
|-
|[[Kernel/IoInitializeIrp]]
|73
|stdcall
|
|-
|[[Kernel/IoInvalidDeviceRequest]]
|74
|stdcall
|
|-
|[[Kernel/IoQueryFileInformation]]
|75
|stdcall
|
|-
|[[Kernel/IoQueryVolumeInformation]]
|76
|stdcall
|
|-
|[[Kernel/IoQueueThreadIrp]]
|77
|stdcall
|
|-
|[[Kernel/IoRemoveShareAccess]]
|78
|stdcall
|
|-
|[[Kernel/IoSetIoCompletion]]
|79
|stdcall
|
|-
|[[Kernel/IoSetShareAccess]]
|80
|stdcall
|
|-
|[[Kernel/IoStartNextPacket]]
|81
|stdcall
|
|-
|[[Kernel/IoStartNextPacketByKey]]
|82
|stdcall
|
|-
|[[Kernel/IoStartPacket]]
|83
|stdcall
|
|-
|[[Kernel/IoSynchronousDeviceIoControlRequest]]
|84
|stdcall
|
|-
|[[Kernel/IoSynchronousFsdRequest]]
|85
|stdcall
|
|-
|[[Kernel/IofCallDriver]]
|86
|fastcall
|
|-
|[[Kernel/IofCompleteRequest]]
|87
|fastcall
|
|-
|[[Kernel/KdDebuggerEnabled]]
|88
|
|Variable: BOOLEAN
|-
|[[Kernel/KdDebuggerNotPresent]]
|89
|
|Variable: BOOLEAN
|-
|[[Kernel/IoDismountVolume]]
|90
|stdcall
|
|-
|[[Kernel/IoDismountVolumeByName]]
|91
|stdcall
|
|-
|[[Kernel/KeAlertResumeThread]]
|92
|stdcall
|
|-
|[[Kernel/KeAlertThread]]
|93
|stdcall
|
|-
|[[Kernel/KeBoostPriorityThread]]
|94
|stdcall
|
|-
|[[Kernel/KeBugCheck]]
|95
|stdcall
|
|-
|[[Kernel/KeBugCheckEx]]
|96
|stdcall
|
|-
|[[Kernel/KeCancelTimer]]
|97
|stdcall
|
|-
|[[Kernel/KeConnectInterrupt]]
|98
|stdcall
|
|-
|[[Kernel/KeDelayExecutionThread]]
|99
|stdcall
|
|-
|[[Kernel/KeDisconnectInterrupt]]
|100
|stdcall
|
|-
|[[Kernel/KeEnterCriticalRegion]]
|101
|stdcall
|
|-
|[[Kernel/MmGlobalData]]
|102
|
|Variable: MMGLOBALDATA
|-
|[[Kernel/KeGetCurrentIrql]]
|103
|stdcall
|
|-
|[[Kernel/KeGetCurrentThread]]
|104
|stdcall
|
|-
|[[Kernel/KeInitializeApc]]
|105
|stdcall
|
|-
|[[Kernel/KeInitializeDeviceQueue]]
|106
|stdcall
|
|-
|[[Kernel/KeInitializeDpc]]
|107
|stdcall
|
|-
|[[Kernel/KeInitializeEvent]]
|108
|stdcall
|
|-
|[[Kernel/KeInitializeInterrupt]]
|109
|stdcall
|
|-
|[[Kernel/KeInitializeMutant]]
|110
|stdcall
|
|-
|[[Kernel/KeInitializeQueue]]
|111
|stdcall
|
|-
|[[Kernel/KeInitializeSemaphore]]
|112
|stdcall
|
|-
|[[Kernel/KeInitializeTimerEx]]
|113
|stdcall
|
|-
|[[Kernel/KeInsertByKeyDeviceQueue]]
|114
|stdcall
|
|-
|[[Kernel/KeInsertDeviceQueue]]
|115
|stdcall
|
|-
|[[Kernel/KeInsertHeadQueue]]
|116
|stdcall
|
|-
|[[Kernel/KeInsertQueue]]
|117
|stdcall
|
|-
|[[Kernel/KeInsertQueueApc]]
|118
|stdcall
|
|-
|[[Kernel/KeInsertQueueDpc]]
|119
|stdcall
|
|-
|[[Kernel/KeInterruptTime]]
|120
|
|Variable: KSYSTEM_TIME
|-
|[[Kernel/KeIsExecutingDpc]]
|121
|stdcall
|
|-
|[[Kernel/KeLeaveCriticalRegion]]
|122
|stdcall
|
|-
|[[Kernel/KePulseEvent]]
|123
|stdcall
|
|-
|[[Kernel/KeQueryBasePriorityThread]]
|124
|stdcall
|
|-
|[[Kernel/KeQueryInterruptTime]]
|125
|stdcall
|
|-
|[[Kernel/KeQueryPerformanceCounter]]
|126
|stdcall
|
|-
|[[Kernel/KeQueryPerformanceFrequency]]
|127
|stdcall
|
|-
|[[Kernel/KeQuerySystemTime]]
|128
|stdcall
|
|-
|[[Kernel/KeRaiseIrqlToDpcLevel]]
|129
|stdcall
|
|-
|[[Kernel/KeRaiseIrqlToSynchLevel]]
|130
|stdcall
|
|-
|[[Kernel/KeReleaseMutant]]
|131
|stdcall
|
|-
|[[Kernel/KeReleaseSemaphore]]
|132
|stdcall
|
|-
|[[Kernel/KeRemoveByKeyDeviceQueue]]
|133
|stdcall
|
|-
|[[Kernel/KeRemoveDeviceQueue]]
|134
|stdcall
|
|-
|[[Kernel/KeRemoveEntryDeviceQueue]]
|135
|stdcall
|
|-
|[[Kernel/KeRemoveQueue]]
|136
|stdcall
|
|-
|[[Kernel/KeRemoveQueueDpc]]
|137
|stdcall
|
|-
|[[Kernel/KeResetEvent]]
|138
|stdcall
|
|-
|[[Kernel/KeRestoreFloatingPointState]]
|139
|stdcall
|
|-
|[[Kernel/KeResumeThread]]
|140
|stdcall
|
|-
|[[Kernel/KeRundownQueue]]
|141
|stdcall
|
|-
|[[Kernel/KeSaveFloatingPointState]]
|142
|stdcall
|
|-
|[[Kernel/KeSetBasePriorityThread]]
|143
|stdcall
|
|-
|[[Kernel/KeSetDisableBoostThread]]
|144
|stdcall
|
|-
|[[Kernel/KeSetEvent]]
|145
|stdcall
|
|-
|[[Kernel/KeSetEventBoostPriority]]
|146
|stdcall
|
|-
|[[Kernel/KeSetPriorityProcess]]
|147
|stdcall
|
|-
|[[Kernel/KeSetPriorityThread]]
|148
|stdcall
|
|-
|[[Kernel/KeSetTimer]]
|149
|stdcall
|
|-
|[[Kernel/KeSetTimerEx]]
|150
|stdcall
|
|-
|[[Kernel/KeStallExecutionProcessor]]
|151
|stdcall
|
|-
|[[Kernel/KeSuspendThread]]
|152
|stdcall
|
|-
|[[Kernel/KeSynchronizeExecution]]
|153
|stdcall
|
|-
|[[Kernel/KeSystemTime]]
|154
|
|Variable: KSYSTEM_TIME
|-
|[[Kernel/KeTestAlertThread]]
|155
|stdcall
|
|-
|[[Kernel/KeTickCount]]
|156
|
|Variable: ULONG
|-
|[[Kernel/KeTimeIncrement]]
|157
|
|Variable: ULONG
|-
|[[Kernel/KeWaitForMultipleObjects]]
|158
|stdcall
|
|-
|[[Kernel/KeWaitForSingleObject]]
|159
|stdcall
|
|-
|[[Kernel/KfRaiseIrql]]
|160
|fastcall
|
|-
|[[Kernel/KfLowerIrql]]
|161
|fastcall
|
|-
|[[Kernel/KiBugCheckData]]
|162
|
|Variable: ULONG_PTR[5]
|-
|[[Kernel/KiUnlockDispatcherDatabase]]
|163
|fastcall
|
|-
|[[Kernel/LaunchDataPage]]
|164
|
|Variable: PLAUNCH_DATA_PAGE
|-
|[[Kernel/MmAllocateContiguousMemory]]
|165
|stdcall
|
|-
|[[Kernel/MmAllocateContiguousMemoryEx]]
|166
|stdcall
|
|-
|[[Kernel/MmAllocateSystemMemory]]
|167
|stdcall
|
|-
|[[Kernel/MmClaimGpuInstanceMemory]]
|168
|stdcall
|
|-
|[[Kernel/MmCreateKernelStack]]
|169
|stdcall
|
|-
|[[Kernel/MmDeleteKernelStack]]
|170
|stdcall
|
|-
|[[Kernel/MmFreeContiguousMemory]]
|171
|stdcall
|
|-
|[[Kernel/MmFreeSystemMemory]]
|172
|stdcall
|
|-
|[[Kernel/MmGetPhysicalAddress]]
|173
|stdcall
|
|-
|[[Kernel/MmIsAddressValid]]
|174
|stdcall
|
|-
|[[Kernel/MmLockUnlockBufferPages]]
|175
|stdcall
|
|-
|[[Kernel/MmLockUnlockPhysicalPage]]
|176
|stdcall
|
|-
|[[Kernel/MmMapIoSpace]]
|177
|stdcall
|
|-
|[[Kernel/MmPersistContiguousMemory]]
|178
|stdcall
|
|-
|[[Kernel/MmQueryAddressProtect]]
|179
|stdcall
|
|-
|[[Kernel/MmQueryAllocationSize]]
|180
|stdcall
|
|-
|[[Kernel/MmQueryStatistics]]
|181
|stdcall
|
|-
|[[Kernel/MmSetAddressProtect]]
|182
|stdcall
|
|-
|[[Kernel/MmUnmapIoSpace]]
|183
|stdcall
|
|-
|[[Kernel/NtAllocateVirtualMemory]]
|184
|stdcall
|
|-
|[[Kernel/NtCancelTimer]]
|185
|stdcall
|
|-
|[[Kernel/NtClearEvent]]
|186
|stdcall
|
|-
|[[Kernel/NtClose]]
|187
|stdcall
|
|-
|[[Kernel/NtCreateDirectoryObject]]
|188
|stdcall
|
|-
|[[Kernel/NtCreateEvent]]
|189
|stdcall
|
|-
|[[Kernel/NtCreateFile]]
|190
|stdcall
|
|-
|[[Kernel/NtCreateIoCompletion]]
|191
|stdcall
|
|-
|[[Kernel/NtCreateMutant]]
|192
|stdcall
|
|-
|[[Kernel/NtCreateSemaphore]]
|193
|stdcall
|
|-
|[[Kernel/NtCreateTimer]]
|194
|stdcall
|
|-
|[[Kernel/NtDeleteFile]]
|195
|stdcall
|
|-
|[[Kernel/NtDeviceIoControlFile]]
|196
|stdcall
|
|-
|[[Kernel/NtDuplicateObject]]
|197
|stdcall
|
|-
|[[Kernel/NtFlushBuffersFile]]
|198
|stdcall
|
|-
|[[Kernel/NtFreeVirtualMemory]]
|199
|stdcall
|
|-
|[[Kernel/NtFsControlFile]]
|200
|stdcall
|
|-
|[[Kernel/NtOpenDirectoryObject]]
|201
|stdcall
|
|-
|[[Kernel/NtOpenFile]]
|202
|stdcall
|
|-
|[[Kernel/NtOpenSymbolicLinkObject]]
|203
|stdcall
|
|-
|[[Kernel/NtProtectVirtualMemory]]
|204
|stdcall
|
|-
|[[Kernel/NtPulseEvent]]
|205
|stdcall
|
|-
|[[Kernel/NtQueueApcThread]]
|206
|stdcall
|
|-
|[[Kernel/NtQueryDirectoryFile]]
|207
|stdcall
|
|-
|[[Kernel/NtQueryDirectoryObject]]
|208
|stdcall
|
|-
|[[Kernel/NtQueryEvent]]
|209
|stdcall
|
|-
|[[Kernel/NtQueryFullAttributesFile]]
|210
|stdcall
|
|-
|[[Kernel/NtQueryInformationFile]]
|211
|stdcall
|
|-
|[[Kernel/NtQueryIoCompletion]]
|212
|stdcall
|
|-
|[[Kernel/NtQueryMutant]]
|213
|stdcall
|
|-
|[[Kernel/NtQuerySemaphore]]
|214
|stdcall
|
|-
|[[Kernel/NtQuerySymbolicLinkObject]]
|215
|stdcall
|
|-
|[[Kernel/NtQueryTimer]]
|216
|stdcall
|
|-
|[[Kernel/NtQueryVirtualMemory]]
|217
|stdcall
|
|-
|[[Kernel/NtQueryVolumeInformationFile]]
|218
|stdcall
|
|-
|[[Kernel/NtReadFile]]
|219
|stdcall
|
|-
|[[Kernel/NtReadFileScatter]]
|220
|stdcall
|
|-
|[[Kernel/NtReleaseMutant]]
|221
|stdcall
|
|-
|[[Kernel/NtReleaseSemaphore]]
|222
|stdcall
|
|-
|[[Kernel/NtRemoveIoCompletion]]
|223
|stdcall
|
|-
|[[Kernel/NtResumeThread]]
|224
|stdcall
|
|-
|[[Kernel/NtSetEvent]]
|225
|stdcall
|
|-
|[[Kernel/NtSetInformationFile]]
|226
|stdcall
|
|-
|[[Kernel/NtSetIoCompletion]]
|227
|stdcall
|
|-
|[[Kernel/NtSetSystemTime]]
|228
|stdcall
|
|-
|[[Kernel/NtSetTimerEx]]
|229
|stdcall
|
|-
|[[Kernel/NtSignalAndWaitForSingleObjectEx]]
|230
|stdcall
|
|-
|[[Kernel/NtSuspendThread]]
|231
|stdcall
|
|-
|[[Kernel/NtUserIoApcDispatcher]]
|232
|stdcall
|
|-
|[[Kernel/NtWaitForSingleObject]]
|233
|stdcall
|
|-
|[[Kernel/NtWaitForSingleObjectEx]]
|234
|stdcall
|
|-
|[[Kernel/NtWaitForMultipleObjectsEx]]
|235
|stdcall
|
|-
|[[Kernel/NtWriteFile]]
|236
|stdcall
|
|-
|[[Kernel/NtWriteFileGather]]
|237
|stdcall
|
|-
|[[Kernel/NtYieldExecution]]
|238
|stdcall
|
|-
|[[Kernel/ObCreateObject]]
|239
|stdcall
|
|-
|[[Kernel/ObDirectoryObjectType]]
|240
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/ObInsertObject]]
|241
|stdcall
|
|-
|[[Kernel/ObMakeTemporaryObject]]
|242
|stdcall
|
|-
|[[Kernel/ObOpenObjectByName]]
|243
|stdcall
|
|-
|[[Kernel/ObOpenObjectByPointer]]
|244
|stdcall
|
|-
|[[Kernel/ObpObjectHandleTable]]
|245
|
|Variable: OBJECT_HANDLE_TABLE
|-
|[[Kernel/ObReferenceObjectByHandle]]
|246
|stdcall
|
|-
|[[Kernel/ObReferenceObjectByName]]
|247
|stdcall
|
|-
|[[Kernel/ObReferenceObjectByPointer]]
|248
|stdcall
|
|-
|[[Kernel/ObSymbolicLinkObjectType]]
|249
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/ObfDereferenceObject]]
|250
|fastcall
|
|-
|[[Kernel/ObfReferenceObject]]
|251
|fastcall
|
|-
|[[Kernel/PhyGetLinkState]]
|252
|stdcall
|
|-
|[[Kernel/PhyInitialize]]
|253
|stdcall
|
|-
|[[Kernel/PsCreateSystemThread]]
|254
|stdcall
|
|-
|[[Kernel/PsCreateSystemThreadEx]]
|255
|stdcall
|
|-
|[[Kernel/PsQueryStatistics]]
|256
|stdcall
|
|-
|[[Kernel/PsSetCreateThreadNotifyRoutine]]
|257
|stdcall
|
|-
|[[Kernel/PsTerminateSystemThread]]
|258
|stdcall
|
|-
|[[Kernel/PsThreadObjectType]]
|259
|
|Variable: OBJECT_TYPE
|-
|[[Kernel/RtlAnsiStringToUnicodeString]]
|260
|stdcall
|
|-
|[[Kernel/RtlAppendStringToString]]
|261
|stdcall
|
|-
|[[Kernel/RtlAppendUnicodeStringToString]]
|262
|stdcall
|
|-
|[[Kernel/RtlAppendUnicodeToString]]
|263
|stdcall
|
|-
|[[Kernel/RtlAssert]]
|264
|stdcall
|
|-
|[[Kernel/RtlCaptureContext]]
|265
|stdcall
|
|-
|[[Kernel/RtlCaptureStackBackTrace]]
|266
|stdcall
|
|-
|[[Kernel/RtlCharToInteger]]
|267
|stdcall
|
|-
|[[Kernel/RtlCompareMemory]]
|268
|stdcall
|
|-
|[[Kernel/RtlCompareMemoryUlong]]
|269
|stdcall
|
|-
|[[Kernel/RtlCompareString]]
|270
|stdcall
|
|-
|[[Kernel/RtlCompareUnicodeString]]
|271
|stdcall
|
|-
|[[Kernel/RtlCopyString]]
|272
|stdcall
|
|-
|[[Kernel/RtlCopyUnicodeString]]
|273
|stdcall
|
|-
|[[Kernel/RtlCreateUnicodeString]]
|274
|stdcall
|
|-
|[[Kernel/RtlDowncaseUnicodeChar]]
|275
|stdcall
|
|-
|[[Kernel/RtlDowncaseUnicodeString]]
|276
|stdcall
|
|-
|[[Kernel/RtlEnterCriticalSection]]
|277
|stdcall
|
|-
|[[Kernel/RtlEnterCriticalSectionAndRegion]]
|278
|stdcall
|
|-
|[[Kernel/RtlEqualString]]
|279
|stdcall
|
|-
|[[Kernel/RtlEqualUnicodeString]]
|280
|stdcall
|
|-
|[[Kernel/RtlExtendedIntegerMultiply]]
|281
|stdcall
|
|-
|[[Kernel/RtlExtendedLargeIntegerDivide]]
|282
|stdcall
|
|-
|[[Kernel/RtlExtendedMagicDivide]]
|283
|stdcall
|
|-
|[[Kernel/RtlFillMemory]]
|284
|stdcall
|
|-
|[[Kernel/RtlFillMemoryUlong]]
|285
|stdcall
|
|-
|[[Kernel/RtlFreeAnsiString]]
|286
|stdcall
|
|-
|[[Kernel/RtlFreeUnicodeString]]
|287
|stdcall
|
|-
|[[Kernel/RtlGetCallersAddress]]
|288
|stdcall
|
|-
|[[Kernel/RtlInitAnsiString]]
|289
|stdcall
|
|-
|[[Kernel/RtlInitUnicodeString]]
|290
|stdcall
|
|-
|[[Kernel/RtlInitializeCriticalSection]]
|291
|stdcall
|
|-
|[[Kernel/RtlIntegerToChar]]
|292
|stdcall
|
|-
|[[Kernel/RtlIntegerToUnicodeString]]
|293
|stdcall
|
|-
|[[Kernel/RtlLeaveCriticalSection]]
|294
|stdcall
|
|-
|[[Kernel/RtlLeaveCriticalSectionAndRegion]]
|295
|stdcall
|
|-
|[[Kernel/RtlLowerChar]]
|296
|stdcall
|
|-
|[[Kernel/RtlMapGenericMask]]
|297
|stdcall
|
|-
|[[Kernel/RtlMoveMemory]]
|298
|stdcall
|
|-
|[[Kernel/RtlMultiByteToUnicodeN]]
|299
|stdcall
|
|-
|[[Kernel/RtlMultiByteToUnicodeSize]]
|300
|stdcall
|
|-
|[[Kernel/RtlNtStatusToDosError]]
|301
|stdcall
|
|-
|[[Kernel/RtlRaiseException]]
|302
|stdcall
|
|-
|[[Kernel/RtlRaiseStatus]]
|303
|stdcall
|
|-
|[[Kernel/RtlTimeFieldsToTime]]
|304
|stdcall
|
|-
|[[Kernel/RtlTimeToTimeFields]]
|305
|stdcall
|
|-
|[[Kernel/RtlTryEnterCriticalSection]]
|306
|stdcall
|
|-
|[[Kernel/RtlUlongByteSwap]]
|307
|fastcall
|
|-
|[[Kernel/RtlUnicodeStringToAnsiString]]
|308
|stdcall
|
|-
|[[Kernel/RtlUnicodeStringToInteger]]
|309
|stdcall
|
|-
|[[Kernel/RtlUnicodeToMultiByteN]]
|310
|stdcall
|
|-
|[[Kernel/RtlUnicodeToMultiByteSize]]
|311
|stdcall
|
|-
|[[Kernel/RtlUnwind]]
|312
|stdcall
|
|-
|[[Kernel/RtlUpcaseUnicodeChar]]
|313
|stdcall
|
|-
|[[Kernel/RtlUpcaseUnicodeString]]
|314
|stdcall
|
|-
|[[Kernel/RtlUpcaseUnicodeToMultiByteN]]
|315
|stdcall
|
|-
|[[Kernel/RtlUpperChar]]
|316
|stdcall
|
|-
|[[Kernel/RtlUpperString]]
|317
|stdcall
|
|-
|[[Kernel/RtlUshortByteSwap]]
|318
|fastcall
|
|-
|[[Kernel/RtlWalkFrameChain]]
|319
|stdcall
|
|-
|[[Kernel/RtlZeroMemory]]
|320
|stdcall
|
|-
|[[Kernel/XboxEEPROMKey]]
|321
|
|Variable: XBOX_KEY_DATA
|-
|[[Kernel/XboxHardwareInfo]]
|322
|
|Variable: XBOX_HARDWARE_INFO
|-
|[[Kernel/XboxHDKey]]
|323
|
|Variable: XBOX_KEY_DATA
|-
|[[Kernel/XboxKrnlVersion]]
|324
|
|Variable: XBOX_KRNL_VERSION
|-
|[[Kernel/XboxSignatureKey]]
|325
|
|Variable: XBOX_KEY_DATA
|-
|[[Kernel/XeImageFileName]]
|326
|
|Variable: OBJECT_STRING
|-
|[[Kernel/XeLoadSection]]
|327
|stdcall
|
|-
|[[Kernel/XeUnloadSection]]
|328
|stdcall
|
|-
|[[Kernel/READ_PORT_BUFFER_UCHAR]]
|329
|stdcall
|
|-
|[[Kernel/READ_PORT_BUFFER_USHORT]]
|330
|stdcall
|
|-
|[[Kernel/READ_PORT_BUFFER_ULONG]]
|331
|stdcall
|
|-
|[[Kernel/WRITE_PORT_BUFFER_UCHAR]]
|332
|stdcall
|
|-
|[[Kernel/WRITE_PORT_BUFFER_USHORT]]
|333
|stdcall
|
|-
|[[Kernel/WRITE_PORT_BUFFER_ULONG]]
|334
|stdcall
|
|-
|[[Kernel/XcSHAInit]]
|335
|stdcall
|
|-
|[[Kernel/XcSHAUpdate]]
|336
|stdcall
|
|-
|[[Kernel/XcSHAFinal]]
|337
|stdcall
|
|-
|[[Kernel/XcRC4Key]]
|338
|stdcall
|
|-
|[[Kernel/XcRC4Crypt]]
|339
|stdcall
|
|-
|[[Kernel/XcHMAC]]
|340
|stdcall
|
|-
|[[Kernel/XcPKEncPublic]]
|341
|stdcall
|
|-
|[[Kernel/XcPKDecPrivate]]
|342
|stdcall
|
|-
|[[Kernel/XcPKGetKeyLen]]
|343
|stdcall
|
|-
|[[Kernel/XcVerifyPKCS1Signature]]
|344
|stdcall
|
|-
|[[Kernel/XcModExp]]
|345
|stdcall
|
|-
|[[Kernel/XcDESKeyParity]]
|346
|stdcall
|
|-
|[[Kernel/XcKeyTable]]
|347
|stdcall
|
|-
|[[Kernel/XcBlockCrypt]]
|348
|stdcall
|
|-
|[[Kernel/XcBlockCryptCBC]]
|349
|stdcall
|
|-
|[[Kernel/XcCryptService]]
|350
|stdcall
|
|-
|[[Kernel/XcUpdateCrypto]]
|351
|stdcall
|
|-
|[[Kernel/RtlRip]]
|352
|stdcall
|
|-
|[[Kernel/XboxLANKey]]
|353
|stdcall
|
|-
|[[Kernel/XboxAlternateSignatureKeys]]
|354
|
|Variable: XBOX_KEY_DATA[XBEIMAGE_ALTERNATE_TITLE_ID_COUNT]
|-
|[[Kernel/XePublicKeyData]]
|355
|
|Variable: UCHAR[XC_PUBLIC_KEYDATA_SIZE]
|-
|[[Kernel/HalBootSMCVideoMode]]
|356
|
|Variable: ULONG
|-
|[[Kernel/IdexChannelObject]]
|357
|
|Variable: IDE_CHANNEL_OBJECT
|-
|[[Kernel/HalIsResetOrShutdownPending]]
|358
|stdcall
|
|-
|[[Kernel/IoMarkIrpMustComplete]]
|359
|stdcall
|
|-
|[[Kernel/HalInitiateShutdown]]
|360
|stdcall
|
|-
|[[Kernel/RtlSnprintf]]
|361
|stdcall
|Unused?
|-
|[[Kernel/RtlSprintf]]
|362
|stdcall
|Unused?
|-
|[[Kernel/RtlVsnprintf]]
|363
|stdcall
|Unused?
|-
|[[Kernel/RtlVsprintf]]
|364
|stdcall
|Unused?
|-
|[[Kernel/HalEnableSecureTrayEject]]
|365
|stdcall
|
|-
|[[Kernel/HalWriteSMCScratchRegister]]
|366
|stdcall
|
|-
|
|367
|
|Unused?
|-
|
|368
|
|Unused?
|-
|
|369
|
|Unused?
|-
|
|370
|
|Unused?
|-
|
|371
|
|Unused?
|-
|
|372
|
|Unused?
|-
|
|373
|
|Unused?
|-
|[[Kernel/MmDbgAllocateMemory]]
|374
|stdcall
|Devkits only!
|-
|[[Kernel/MmDbgFreeMemory]]
|375
|stdcall
|Devkits only!
|-
|[[Kernel/MmDbgQueryAvailablePages]]
|376
|stdcall
|Devkits only!
|-
|[[Kernel/MmDbgReleaseAddress]]
|377
|stdcall
|Devkits only!
|-
|[[Kernel/MmDbgWriteCheck]]
|378
|stdcall
|Devkits only!
|}

Memory

2017-06-10T22:09:36Z

Haxar: Table centered.

The Xbox has 64MB Memory. This could be expanded to 128MB of memory (and the motherboard has empty spots where these could have been) but no games took advantage of it. The debug Xbox and the Chihiro both contained 128MB Memory.

The memory was shared between the CPU and GPU. On the retail Xbox, the [[Flash]] and [[MCPX ROM]] are also mapped to memory at the top 16 MiB and the top 512 Bytes respectively. On Debug Xboxs and Chihiro, only the Flash is mapped as they don't contain an MCPX ROM.

{| class="wikitable" style="text-align: center;"
! Memory Type
! Retail Xbox Range
! Debug/Chihiro Range
|-
|Main Memory
|0x00000000 - 0x04000000
|0x00000000 - 0x08000000
|-
|[[GPU|GPU (NV2A) Registers]]
|colspan="2"|0xFD000000 - 0xFE000000
|-
|APU Registers
|colspan="2"|0xFE800000 - 0xFE880000
|-
|ACI (AC97) Registers
|colspan="2"|0xFEC00000 - 0xFEC01000
|-
|USB 0 Registers
|colspan="2"|0xFED00000 - 0xFED01000
|-
|USB 1 Registers
|colspan="2"|0xFED08000 - 0xFED09000
|-
|NIC (NVNet) Registers
|colspan="2"|0xFEF00000 - 0xFEF00400
|-
|[[Flash]]
|colspan="2"|0xFF000000 - 0xFFFFFFFF
|-
|[[MCPX ROM]]
|0xFFFFFE00 - 0xFFFFFFFF
|N/A
|}

Code for emulating the memory might consist of:

<pre>
#ifdef DEBUG || CHIHIRO
#define MEMORY_SIZE 128 * 1024 * 1024
int mcpx_active = 0;
#else
#define MEMORY_SIZE 64 * 1024 * 1024
int mcpx_active = 1;
#endif

#define FLASH_SIZE 256 * 1024
#define FLASH_MAP_SIZE 16 * 1024 * 1024
#define FLASH_MAP_ADDRESS (0xFFFFFFFF - FLASH_MAP_SIZE + 1)

#define MCPX_SIZE 0x200
#define MCPX_MAP_ADDRESS (0xFFFFFFFF - MCPX_MAP_SIZE + 1)

uint8_t memory[MEMORY_SIZE] = {0};
uint8_t flash[FLASH_SIZE] = {0};
uint8_t mcpx[MCPX_SIZE] = {0};

uint8_t get_memory_byte(uint32_t location) {
if (location < MEMORY_SIZE) {
return memory[location];
}

if (mcpx_active && location >= MCPX_MAP_ADDRESS) {
return mcpx[location - MCPX_MAP_ADDRESS];
}

if (location >= FLASH_MAP_ADDRESS) {
return flash[(location - FLASH_MAP_ADDRESS) % FLASH_SIZE];
}

printf("Memory in unspecified range: %08X\n", location);
return 0;
}

uint16_t get_memory_word(uint32_t location) {
return get_memory(location + 1) << 8 | get_memory(location);
}

uint32_t get_memory_dword(uint32_t location) {
return get_memory_word(location + 2) << 16 | get_memory_word(location);
}

void deactivate_mcpx() {
mcpx_active = 0;
}
</pre>

Memory

2017-06-10T22:00:36Z

Haxar: Hardware Registers

The Xbox has 64MB Memory. This could be expanded to 128MB of memory (and the motherboard has empty spots where these could have been) but no games took advantage of it. The debug Xbox and the Chihiro both contained 128MB Memory.

The memory was shared between the CPU and GPU. On the retail Xbox, the [[Flash]] and [[MCPX ROM]] are also mapped to memory at the top 16 MiB and the top 512 Bytes respectively. On Debug Xboxs and Chihiro, only the Flash is mapped as they don't contain an MCPX ROM.

{| class="wikitable"
! Memory Type
! Retail Xbox Range
! Debug/Chihiro Range
|-
|Main Memory
|0x00000000 - 0x04000000
|0x00000000 - 0x08000000
|-
|[[GPU|GPU (NV2A) Registers]]
|colspan="2"|0xFD000000 - 0xFE000000
|-
|APU Registers
|colspan="2"|0xFE800000 - 0xFE880000
|-
|ACI (AC97) Registers
|colspan="2"|0xFEC00000 - 0xFEC01000
|-
|USB 0 Registers
|colspan="2"|0xFED00000 - 0xFED01000
|-
|USB 1 Registers
|colspan="2"|0xFED08000 - 0xFED09000
|-
|NIC (NVNet) Registers
|colspan="2"|0xFEF00000 - 0xFEF00400
|-
|[[Flash]]
|colspan="2"|0xFF000000 - 0xFFFFFFFF
|-
|[[MCPX ROM]]
|0xFFFFFE00 - 0xFFFFFFFF
|N/A
|}

Code for emulating the memory might consist of:

<pre>
#ifdef DEBUG || CHIHIRO
#define MEMORY_SIZE 128 * 1024 * 1024
int mcpx_active = 0;
#else
#define MEMORY_SIZE 64 * 1024 * 1024
int mcpx_active = 1;
#endif

#define FLASH_SIZE 256 * 1024
#define FLASH_MAP_SIZE 16 * 1024 * 1024
#define FLASH_MAP_ADDRESS (0xFFFFFFFF - FLASH_MAP_SIZE + 1)

#define MCPX_SIZE 0x200
#define MCPX_MAP_ADDRESS (0xFFFFFFFF - MCPX_MAP_SIZE + 1)

uint8_t memory[MEMORY_SIZE] = {0};
uint8_t flash[FLASH_SIZE] = {0};
uint8_t mcpx[MCPX_SIZE] = {0};

uint8_t get_memory_byte(uint32_t location) {
if (location < MEMORY_SIZE) {
return memory[location];
}

if (mcpx_active && location >= MCPX_MAP_ADDRESS) {
return mcpx[location - MCPX_MAP_ADDRESS];
}

if (location >= FLASH_MAP_ADDRESS) {
return flash[(location - FLASH_MAP_ADDRESS) % FLASH_SIZE];
}

printf("Memory in unspecified range: %08X\n", location);
return 0;
}

uint16_t get_memory_word(uint32_t location) {
return get_memory(location + 1) << 8 | get_memory(location);
}

uint32_t get_memory_dword(uint32_t location) {
return get_memory_word(location + 2) << 16 | get_memory_word(location);
}

void deactivate_mcpx() {
mcpx_active = 0;
}
</pre>

GPU

2017-06-10T21:39:34Z

Haxar: Redirected page to NV2A

#REDIRECT [[NV2A]]

Halo 2

2017-06-07T00:17:51Z

Haxar:

{{Game}}

== Map File Format (Iron_Forge whitepaper) ==

Retrieved from [http://old.halomods.com old.halomods.com].

Halo 2 .map file format whitepaper originally by Iron_Forge.

Filename: H2WhitePaper.doc

Created: 11/21/2004, 12:13:00, Iron_Forge.

Revision: 0.9b

=== 1 - General Information ===

==== 1.1 - Introduction ====

Greetings. My name is Iron_Forge, and I have been working on and off with Halo map files of one type or another for a little over a year now. I have remained active in all areas of map formatting of Halo 1 for the xbox as well as the pc. Odds are if you have used an application for Halo 1, I have had a hand in it, or the information that led to its conception.

I have been working on the Halo 2 map format since its release, and this document serves as a collection of the information I have compiled with the help of good friends MonoxideC and ViperNeo. Applying my experience from Halo 1 and other projects, I am one of a handful of people who could be considered experts on the map file formats. Using this document, I hope to pass this on to you.

Many things are not contained within this document, for the simple reason of I did not figure out how they work (the BSP is a good example.) That’s not to say these things are still unknown. ViperNeo had the BSP information completed the same time we were working on models together, due to the strong similarity between them.

==== 1.2 - Glossary ====

'''dword''' – 4 bytes of data (double word)

'''word''' – 2 bytes of data

'''primary magic''' – A value used to increase offsets, allowing large areas of data to be moved without modifying the offsets contained within it.

'''secondary magic''' – A value used to increase offsets, allowing large areas of data to be moved without modifying the offsets contained within it, primarily used for meta.

'''pure offset''' – A value which represents an offset in the file that has not been modified in any way

'''raw offset''' – A pure offset whose 2 most significant bits represent the file the offset references

'''primary magic offset''' – A pure offset whose value has been increased by the primary magic value

'''secondary magic offset''' – A pure offset whose value has been increased by the secondary magic value

=== 2 - Map Information ===

==== 2.1 - Map Layout ====

The Halo 2 map files can be broken up into the following sections: header, sound raw data, model raw data, bsp model raw data, model animation raw data, bsp structure, script references, file names, unicode strings raw data, other, texture raw data, object index, index padding, object meta information, and finally the cache where applicable.

==== 2.2 - Processing ====

When Halo 2 is loaded, it will create cache files (copying the original files to the hard drive of the xbox). The shared and single player shared map files are exceptions to this rule, most likely to lower the load times of the game starting, and each map being processed. If your installation has valid bink video files, these will be played during load times, otherwise a progress text will appear on the screen showing the percentage copied.

All loaded files are signed (see section on encryptomatic signature), and should a loading map fail, the engine will retry the copy twice more before giving a “dirty disk” error, or a “map failed to load” error, depending on the map.

Upon loading a map, only the required resources are placed in memory. As objects appear on screen, the data for them is streamed from the shared files, replacing the very low copy kept in memory with a much richer and more detailed counterparts. This process allows even multiplayer maps to have access to several hundred megabytes of information, while remaining within the limitations of the xbox hardware.

==== 2.3 - Map Header ====

The map header1 is 2048 bytes just as previous versions of Halo. The version tag is now 8. The index offset is a pure offset pointing to the index header, followed by the meta start, which when added to the index offset will point to the beginning of the meta area. Map origin will define the path (and file) the cache was created from, and as such is only defined in the cache files.

===== 2.3.1 - File Table =====

The file table contains full paths for each object in relative order (first filename is for the first object.) The strings are standard ASCII, with a null termination and no padding is used regardless of where the string terminates.

The file table index contains unsigned integers defining the offset which each string begins, also relative. This allows the file table to be read as a single block of characters, and each object to be issued a pointer to the beginning of its string.

===== 2.3.2 - Encryptomatic Signature =====

The encryptomatic signature is created by xoring every dword after the header together. It is my belief that this value has the single purpose of validating maps copied correctly, and was not used to “thwart” would be modders.

===== 2.3.3 - Script References =====

Script references link some object to a specific event. The string table defining these references is in the same format as the file table, including an index. They can often be found following dependencies such as effect dependencies. This would link that effect to be triggered by a given event, such as a button being pressed, or an item being picked up. The reference themselves consist of a pair of words, the first being the index to the string in the table, the second being the length of the script reference string.

==== 2.4 - Index Header ====

The first value in the index header remains the constant used to calculate magic. The object index offset here is a primary magic offset, and points to the object index.

===== 2.4.1 - Tag List =====

Directly following the index header is the tag list. This list contains all used tags in the map file, and defines their object hierarchy. This allows the engine to know for example, that all vehicles are a sub class of the unit class, which is a sub class of the object class. I believe the wildcard tags are used as a way of using the primary tag without its parents, though this is just speculation.

===== 2.4.2 - Object Index =====

The object index is a recursively-constructed collection defining all objects in the map. The objects identifier is defined here, which is used to reference the object from all other areas of the map file. The identifier is composed of two short values, each are incremented equally throughout the index. The meta offset is a secondary magic offset which points to the beginning of the objects meta.

===== 2.4.3 - Primary and Secondary Magic =====

The magic values are used to allow moving large blocks of data without having to modify the data itself. Using a magic value applied to all offsets, after moving the data x bytes, the magic only needs to be increased or decreased 8 to correct all offsets, rather than each offset needing re-calculation. Primary magic is still calculated by magic constant - (index header offset) + sizeof(index header)). Secondary magic, which is now used instead of primary magic for meta related offsets, is primary magic + sizeof(BSP). Since we cannot obtain the size of the BSP object without using secondary magic (it is located in the scenery tag), we use the known offset of the meta start and the secondary magic offset of the first object to calculate this value.

=== 3 - Objects ===

==== 3.1 - Raw Offsets ====

Raw offsets in Halo 2 have no magic applied to them. However, they can reference the current map file, or the three shared files. To do this, it reserves the two most significant (highest) bits to define the referencing file. These are defined as: 002 being local file, 012 being mainmenu.map, 102 being shared.map, and 112 being single_player_shared.map.

When referencing a raw offset, one should first determine the file being referenced, remove those two bits from the offset value (and with 0x3FFFFFFF), and then seek to that offset in the correct file to find the referenced data. Given the size of the shared files, it is possible that the third most significant bit is also reserved for sharing new downloadable content in the future, but this would just be speculation.

==== 3.2 - Unicode Strings ====

Unicode strings are built to allow for up to nine languages. The globals object defines where each language block is located, and its related information (size, string count, etc.) as needed. Each unicode string object then contains two shorts per language, the first defining the offset (as a string count) in the language block that the unicode object begins, and the second defining how many strings are in the object.

This method allows the multiplayer maps to be identical for every version and region of Halo 2. The engine can simply detect you xbox language settings, and supply the correct string(s) form the language block.

==== 3.3 - Bitmaps & Textures ====

Bitmap objects are collections of the textures in Halo 2, and their layout is rather straightforward. Each texture is allowed up to six levels of detail. Each level of detail is identical to its predecessors first mipmap. So if the first quality level were 256x256, the following would be 128x128. Each level of detail however still contains its own entire set of mipmaps. I suspect this goes further towards Halo 2’s efficient use of memory management.

Each bitmap object may also contain several images, usually used where options between similar sets of images are needed (such as multiple level images in the main menu.) These will be represented by the bitm struct reflexive. Each bitmap may be extracted as if it were its own object.

Referencing the source to HME/HMT, we can find the different image formats for the different image objects. In addition to these types, 0x11 and 0x12 are both single channel images (you may extract them as A8 if using the common DDS), and are used for bump maps, and light maps (respectively.)

Many images are still swizzled (a technique for faster memory copies), and this information may also be referenced from the HME/HMT sources.

==== 3.4 - Sounds ====

Sounds were probably the most enjoyable piece of Halo 2 to work on. They entwine with an “ugh!” object named “I’ve got a lovely bunch of coconuts”, a song done by the amazing comedic group Monty Python. I cannot help but believe this system was done as an easter egg designed just for me as “the curious modder”. To Bungie, I thank you (unless of course this was designed to keep us from removing sounds, in which case I sincerely apologize.)

In each sound meta, there is an index and chunk count that references a block in the fifth reflexive in the coconuts object. This block has another index and chunk count, referencing the sixth reflexive in the coconuts object. These chunks reference “option” sounds, such as several different sound choices for entering a vehicle.

Each item in the sixth block contains another index and chunk count, this time referencing the ninth reflexive in the coconuts object. The ninth reflexive contains the size and raw offset for each piece of the sound.

Sounds in Halo 2 are xbox adpcm or WMA, depending on the type byte. The WMA sounds can be assembled completely from the raw data pieces. The xbox adpcm pieces require the header be written.

If the type byte is 1, then the sound is an adpcm, mono, and 22050kbps sound file. Type 2 is also adpcm, stereo, and 44100kbps sound file. Type 3 is a WMA sound file. There is more to the sound formatting than this, however this was mare than enough for me to extract all the sounds.

==== 3.5 - Models ====

Models in Halo 2 use a compressed format based on a bounding box. This bounding box can be found in the first reflexive of the model meta. Using its constraints for each value relevant to the models, the uncompressed value can be found using the formula (((shortValue + 32768) / 65535) * (maxValue – minValue)) + minValue.

The model raw data block now contains a header, footer, and several resource chunks. The header contains information regarding how many chunks are in each resource block, allowing you to determine which block contains the information needed (for example, if a given block has 0 chunks, then it will not have a corresponding resource block). The important resource blocks are the mesh information block (containing mesh information), the indices block (containing the indices for the triangle strip), the vertices block (containing at minimum 3 shorts defining the x, y, and z of the vertices), the UV map (containing the compressed UV points.), and the bone map.

The third dword (as an unsigned integer) in each mesh information block defines how many indices are in that mesh. The indices are placed in order, so each meshes indices can be found after its predecessor in the indices resource block.

The vertices are stored with several sized blocks within their resource block, however the x, y, and z points are still represented by the first 3 shorts respectively. The size of each vertex block can be determined by the type bytes in the model meta. Each short must then be decompressed using the above-mentioned formula and their own constraint value, min x and max x for x, and so on.

If the given vertex type has more than 6 bytes, it is followed by the bone references and weights of this vertex. Both are one byte in length, and the bone references are sorted. Therefore if a bone with a value of 0 is read in any position other than the first, this bone reference should be discarded, as should all that follow. Following the bone references are their weights, which are also one byte in length, and can be considered compressed. The weights are a value between 0 an 1 once uncompressed, thus a byte with a weight of 128 will have a weight of 0.5 (or 50% deformation based on this bone.) The exception to this is the 8 byte vertices, where the two bytes following are both bones. If both are set, they each have a weight of 0.5, and if only one is set it is given full weight.

The UV’s are slightly more complicated. They are compressed in the same fashion as the vertices. However, while UV’s must always remain between 0 and 1, their constraints are not governed by the same limits. The resulting uncompressed values can be fixed through “looping” them. If the value is 1.3, the resulting value would be 0.3, and given the value -0.3, the resulting value would be 0.7. The easiest way to accomplish this is to mod the resulting value by 1, and then if the value is negative, subtract it from 1.

Since the bones have to act over several different pieces, each raw model block has a bone map, relating the bone byte to the correct bone id. This is a byte array, so if a vertex references bone 0, then boneMap[0] will provide the correct bone id.

Back to the meta, the sixth reflexive in the model meta defines the bone hierarchy of the model. When parent, child, or sibling is none, the value will be set to 0xFFFF. These chunks are the bones which are mapped to from the raw data. The name is a script reference, and defines what the bone is called.

The second reflexive defines all the level of details (LOD) for the model pieces. The name is again a script reference defining what this particular LOD is called. This is followed by a reflexive. This reflexive is for all the different options for the particular LOD (for example: base, default, damaged, etc.) Each of these reflexives consist of another script reference name, defining what this option is referred to as, followed by a series of 5 shorts. These shorts refer to the piece of the model which makes up one of the 5 LODs for this option. The last short (following the 5 LODs), defines the piece of the model which has the highest LOD (this should be equal to the 5th LOD value.) If a model only has 3 LODs, the first three LOD values will be the same, defining one piece to be used for all three levels.

The seventh reflexive in the model meta defines a series of locations defining everything from where lights and other effects are located on a model, to where the characters place their hands while using the model. These are set by a script reference to link the point to, and the points location data.

==== 3.6 - Other Tags ====

For the most part, objects are quite similar to their Halo 1 counterparts. Usually there has been some general compacting of the data (the tags have been cleaned up, unused values removed), or a reflexive added here and there. Notable exceptions that I haven’t written about here (as lack of time and motivation kept me away) are the model animations, which now have large blocks of raw data.

=== 4 - In Closing ===

==== 4.1 - Conclusion ====

In closing, I would like to say that not all the information enclosed here is guaranteed to be accurate. It is composed of my findings, and how I interpreted them at the time. Much of the structs are incomplete, as I tend to not write down things I figure out while seeking other answers, and I tried to only include solid information, instead of all my random notes.

The information contained within these pages should be enough to get any one started, and take them to the point of being able to obtain any of the above items, and replace them with their own creations.

I would like to thank all of you who read this far (and bothered reading this), and to you all, happy modding.

==== 4.2 - Acknowledgements ====

I would also once again like to thank MonoxideC and ViperNeo for their help in this. While they may remain modest, both were invaluable in explaining things I didn’t fully understand, bouncing ideas off, and just helping out anyway they could. The community is better for having them, and I better for knowing them.

=== 5 - Appendix I - Structures ===

<pre>
struct mapHeader {
char[4] head;
int version;
int filesize;
int zero;
int indexOffset;
int metaStart;
dword[2] unknown;
char[32] mapOrigin;
byte[224]unknown;
char[32] build;
byte[20] unknown;
int unknown;
int offsetToStrangeFileStrings;
int unknown;
int offsetToSomething;
int scriptReferenceCount;
int sizeOfScriptReference;
int offsetToScriptReferenceIndex;
int offsetToScriptReferenceStrings;
byte[36] unknown;
char[32] mapName;
int zero;
char[32] scenarioPath;
byte[224] zero;
int unknown;
int fileCount;
int fileTableOffset;
int fileTableSize;
int filesIndex;
int signature;
byte[1320] zero;
char[4] foot;
}

struct indexHeader {
int primaryMagicConstantMagic;
int tagListCount;
int objectIndexOffset;
int scenarioID;
int tagIDStart;
int unknown;
int objectCount;
char[4] tags;
}

struct tagListEntry {
char[4] objectClass;
char[4] parentClass;
char[4] grandparentClass;
}
struct objectEntry {
char[4] tag;
int ID;
int offset;
int metaSize;
}

struct unicMeta {
uint[4] zero;
short lang1Offset;
short lang1Count;
short lang2Offset;
short lang2Count;
short lang3Offset;
short lang3Count;
short lang4Offset;
short lang4Count;
short lang5Offset;
short lang5Count;
short lang6Offset;
short lang6Count;
short lang7Offset;
short lang7Count;
short lang8Offset;
short lang8Count;
short lang9Offset;
short lang9Count;
}

struct bitmMeta {
byte[68] data;
struct image {
char[4] bitm;
ushort width;
ushort height;
ushort depth;
ushort type;
ushort format;
ushort flags;
ushort regPointX;
ushort regPointY;
ushort mipMapCount;
ushort pixelOffset;
uint zero;
uint[6] offset;
uint[6] size;
uint identifier;
byte[36] unknown;
}
}

struct sndMeta {
dword unknown;
byte format;
byte[3] unknown;
short index;
byte chunkCount;
byte unknown;
dword[2] unknown;
}

struct ughMeta {
struct {}
struct {}
struct {
scriptRef sound;
}
struct {}
struct soundOptions {
dword[2] unknown;
short index;
short chunkCount;
}
struct soundPieces {
dword[3] unknown;
short index;
short chunkCount;
}
struct {}
struct {}
struct rawSound {
uint rawOffset;
uint size;
uint eff;
}
struct {}
struct {}
}

struct modeMeta {
scriptRef modelName;
dword val2;
dword val3;
dword zero;
dword zero;
struct boundingBox
{
float minX;
float maxX;
float minY;
float maxY;
float minZ;
float maxZ;
float minU;
float maxU;
float minV;
float maxV;
dword:4 zero;
}
struct LODs
{
scriptRef modelPiece;
word sval1; // FFFF
word sval2; // 0000
struct ref2.1
{
scriptRef modelType;
word LODPiece1;
word LODPiece2;
word LODPiece3;
word LODPiece4;
word LODPiece5;
word LODPieceHigh;
}
}
struct pieces
{
dword unknown;
ushort vertCount;
ushort unknown;
byte[12] val1;
ushort type;
ushort unkown;
dword val;
dword[2] zero;
dword[3] val;
dword[2] zero;
uint rawOffset;
uint size;
uint headerSize;
dword val4;
struct rsrc
{
word val;
word val;
word val;
word val;
uint size;
uint offset;
}
dword identifier;
dword val5;
dword eff;
}
struct ref4
{
dword zero;
}
struct ref5
{
dword val1;
dword:2 zero;
}
dword[3] zero;
struct bones
{
scriptRef boneName
ushort parent;
ushort firstChild;
ushort nextSibling;
word val1;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float distanceFromParent;
}
dword[2] zero;
struct points
{
scriptRef pointName;
struct points
{
short; // 0xFFFF
short;
float[7] val;
dword zero;
}
}
struct shaders
{
dependancy shad;
dependancy shad;
dword:4 zero;
}
dword[7] zero;
}

struct modelHeader {
char[4] blkh;
uint size;
uint informationChunks;
uint zero;
uint unkChunks;
uint zero;
uint unk2Chunks;
uint[3] zero;
uint indicesChunks;
uint[5] zero;
uint unk3Chunks;
uint[10] zero;
uint boneChunks;
uint[2] zero;
}
</pre>

Halo 2

2017-06-07T00:11:37Z

Haxar: Created page with "{{Game}} == Map File Format (Iron_Forge whitepaper) == Halo 2 .map file format whitepaper originally by Iron_Forge. Created: 11/21/2004, 12:13:00, Iron_Forge. Filename: H2..."

{{Game}}

== Map File Format (Iron_Forge whitepaper) ==

Halo 2 .map file format whitepaper originally by Iron_Forge.

Created: 11/21/2004, 12:13:00, Iron_Forge.

Filename: H2WhitePaper.doc

Retrieved from [http://old.halomods.com old.halomods.com].

=== 1 - General Information ===

==== 1.1 - Introduction ====

Greetings. My name is Iron_Forge, and I have been working on and off with Halo map files of one type or another for a little over a year now. I have remained active in all areas of map formatting of Halo 1 for the xbox as well as the pc. Odds are if you have used an application for Halo 1, I have had a hand in it, or the information that led to its conception.

I have been working on the Halo 2 map format since its release, and this document serves as a collection of the information I have compiled with the help of good friends MonoxideC and ViperNeo. Applying my experience from Halo 1 and other projects, I am one of a handful of people who could be considered experts on the map file formats. Using this document, I hope to pass this on to you.

Many things are not contained within this document, for the simple reason of I did not figure out how they work (the BSP is a good example.) That’s not to say these things are still unknown. ViperNeo had the BSP information completed the same time we were working on models together, due to the strong similarity between them.

==== 1.2 - Glossary ====

'''dword''' – 4 bytes of data (double word)

'''word''' – 2 bytes of data

'''primary magic''' – A value used to increase offsets, allowing large areas of data to be moved without modifying the offsets contained within it.

'''secondary magic''' – A value used to increase offsets, allowing large areas of data to be moved without modifying the offsets contained within it, primarily used for meta.

'''pure offset''' – A value which represents an offset in the file that has not been modified in any way

'''raw offset''' – A pure offset whose 2 most significant bits represent the file the offset references

'''primary magic offset''' – A pure offset whose value has been increased by the primary magic value

'''secondary magic offset''' – A pure offset whose value has been increased by the secondary magic value

=== 2 - Map Information ===

==== 2.1 - Map Layout ====

The Halo 2 map files can be broken up into the following sections: header, sound raw data, model raw data, bsp model raw data, model animation raw data, bsp structure, script references, file names, unicode strings raw data, other, texture raw data, object index, index padding, object meta information, and finally the cache where applicable.

==== 2.2 - Processing ====

When Halo 2 is loaded, it will create cache files (copying the original files to the hard drive of the xbox). The shared and single player shared map files are exceptions to this rule, most likely to lower the load times of the game starting, and each map being processed. If your installation has valid bink video files, these will be played during load times, otherwise a progress text will appear on the screen showing the percentage copied.

All loaded files are signed (see section on encryptomatic signature), and should a loading map fail, the engine will retry the copy twice more before giving a “dirty disk” error, or a “map failed to load” error, depending on the map.

Upon loading a map, only the required resources are placed in memory. As objects appear on screen, the data for them is streamed from the shared files, replacing the very low copy kept in memory with a much richer and more detailed counterparts. This process allows even multiplayer maps to have access to several hundred megabytes of information, while remaining within the limitations of the xbox hardware.

==== 2.3 - Map Header ====

The map header1 is 2048 bytes just as previous versions of Halo. The version tag is now 8. The index offset is a pure offset pointing to the index header, followed by the meta start, which when added to the index offset will point to the beginning of the meta area. Map origin will define the path (and file) the cache was created from, and as such is only defined in the cache files.

===== 2.3.1 - File Table =====

The file table contains full paths for each object in relative order (first filename is for the first object.) The strings are standard ASCII, with a null termination and no padding is used regardless of where the string terminates.

The file table index contains unsigned integers defining the offset which each string begins, also relative. This allows the file table to be read as a single block of characters, and each object to be issued a pointer to the beginning of its string.

===== 2.3.2 - Encryptomatic Signature =====

The encryptomatic signature is created by xoring every dword after the header together. It is my belief that this value has the single purpose of validating maps copied correctly, and was not used to “thwart” would be modders.

===== 2.3.3 - Script References =====

Script references link some object to a specific event. The string table defining these references is in the same format as the file table, including an index. They can often be found following dependencies such as effect dependencies. This would link that effect to be triggered by a given event, such as a button being pressed, or an item being picked up. The reference themselves consist of a pair of words, the first being the index to the string in the table, the second being the length of the script reference string.

==== 2.4 - Index Header ====

The first value in the index header remains the constant used to calculate magic. The object index offset here is a primary magic offset, and points to the object index.

===== 2.4.1 - Tag List =====

Directly following the index header is the tag list. This list contains all used tags in the map file, and defines their object hierarchy. This allows the engine to know for example, that all vehicles are a sub class of the unit class, which is a sub class of the object class. I believe the wildcard tags are used as a way of using the primary tag without its parents, though this is just speculation.

===== 2.4.2 - Object Index =====

The object index is a recursively-constructed collection defining all objects in the map. The objects identifier is defined here, which is used to reference the object from all other areas of the map file. The identifier is composed of two short values, each are incremented equally throughout the index. The meta offset is a secondary magic offset which points to the beginning of the objects meta.

===== 2.4.3 - Primary and Secondary Magic =====

The magic values are used to allow moving large blocks of data without having to modify the data itself. Using a magic value applied to all offsets, after moving the data x bytes, the magic only needs to be increased or decreased 8 to correct all offsets, rather than each offset needing re-calculation. Primary magic is still calculated by magic constant - (index header offset) + sizeof(index header)). Secondary magic, which is now used instead of primary magic for meta related offsets, is primary magic + sizeof(BSP). Since we cannot obtain the size of the BSP object without using secondary magic (it is located in the scenery tag), we use the known offset of the meta start and the secondary magic offset of the first object to calculate this value.

=== 3 - Objects ===

==== 3.1 - Raw Offsets ====

Raw offsets in Halo 2 have no magic applied to them. However, they can reference the current map file, or the three shared files. To do this, it reserves the two most significant (highest) bits to define the referencing file. These are defined as: 002 being local file, 012 being mainmenu.map, 102 being shared.map, and 112 being single_player_shared.map.

When referencing a raw offset, one should first determine the file being referenced, remove those two bits from the offset value (and with 0x3FFFFFFF), and then seek to that offset in the correct file to find the referenced data. Given the size of the shared files, it is possible that the third most significant bit is also reserved for sharing new downloadable content in the future, but this would just be speculation.

==== 3.2 - Unicode Strings ====

Unicode strings are built to allow for up to nine languages. The globals object defines where each language block is located, and its related information (size, string count, etc.) as needed. Each unicode string object then contains two shorts per language, the first defining the offset (as a string count) in the language block that the unicode object begins, and the second defining how many strings are in the object.

This method allows the multiplayer maps to be identical for every version and region of Halo 2. The engine can simply detect you xbox language settings, and supply the correct string(s) form the language block.

==== 3.3 - Bitmaps & Textures ====

Bitmap objects are collections of the textures in Halo 2, and their layout is rather straightforward. Each texture is allowed up to six levels of detail. Each level of detail is identical to its predecessors first mipmap. So if the first quality level were 256x256, the following would be 128x128. Each level of detail however still contains its own entire set of mipmaps. I suspect this goes further towards Halo 2’s efficient use of memory management.

Each bitmap object may also contain several images, usually used where options between similar sets of images are needed (such as multiple level images in the main menu.) These will be represented by the bitm struct reflexive. Each bitmap may be extracted as if it were its own object.

Referencing the source to HME/HMT, we can find the different image formats for the different image objects. In addition to these types, 0x11 and 0x12 are both single channel images (you may extract them as A8 if using the common DDS), and are used for bump maps, and light maps (respectively.)

Many images are still swizzled (a technique for faster memory copies), and this information may also be referenced from the HME/HMT sources.

==== 3.4 - Sounds ====

Sounds were probably the most enjoyable piece of Halo 2 to work on. They entwine with an “ugh!” object named “I’ve got a lovely bunch of coconuts”, a song done by the amazing comedic group Monty Python. I cannot help but believe this system was done as an easter egg designed just for me as “the curious modder”. To Bungie, I thank you (unless of course this was designed to keep us from removing sounds, in which case I sincerely apologize.)

In each sound meta, there is an index and chunk count that references a block in the fifth reflexive in the coconuts object. This block has another index and chunk count, referencing the sixth reflexive in the coconuts object. These chunks reference “option” sounds, such as several different sound choices for entering a vehicle.

Each item in the sixth block contains another index and chunk count, this time referencing the ninth reflexive in the coconuts object. The ninth reflexive contains the size and raw offset for each piece of the sound.

Sounds in Halo 2 are xbox adpcm or WMA, depending on the type byte. The WMA sounds can be assembled completely from the raw data pieces. The xbox adpcm pieces require the header be written.

If the type byte is 1, then the sound is an adpcm, mono, and 22050kbps sound file. Type 2 is also adpcm, stereo, and 44100kbps sound file. Type 3 is a WMA sound file. There is more to the sound formatting than this, however this was mare than enough for me to extract all the sounds.

==== 3.5 - Models ====

Models in Halo 2 use a compressed format based on a bounding box. This bounding box can be found in the first reflexive of the model meta. Using its constraints for each value relevant to the models, the uncompressed value can be found using the formula (((shortValue + 32768) / 65535) * (maxValue – minValue)) + minValue.

The model raw data block now contains a header, footer, and several resource chunks. The header contains information regarding how many chunks are in each resource block, allowing you to determine which block contains the information needed (for example, if a given block has 0 chunks, then it will not have a corresponding resource block). The important resource blocks are the mesh information block (containing mesh information), the indices block (containing the indices for the triangle strip), the vertices block (containing at minimum 3 shorts defining the x, y, and z of the vertices), the UV map (containing the compressed UV points.), and the bone map.

The third dword (as an unsigned integer) in each mesh information block defines how many indices are in that mesh. The indices are placed in order, so each meshes indices can be found after its predecessor in the indices resource block.

The vertices are stored with several sized blocks within their resource block, however the x, y, and z points are still represented by the first 3 shorts respectively. The size of each vertex block can be determined by the type bytes in the model meta. Each short must then be decompressed using the above-mentioned formula and their own constraint value, min x and max x for x, and so on.

If the given vertex type has more than 6 bytes, it is followed by the bone references and weights of this vertex. Both are one byte in length, and the bone references are sorted. Therefore if a bone with a value of 0 is read in any position other than the first, this bone reference should be discarded, as should all that follow. Following the bone references are their weights, which are also one byte in length, and can be considered compressed. The weights are a value between 0 an 1 once uncompressed, thus a byte with a weight of 128 will have a weight of 0.5 (or 50% deformation based on this bone.) The exception to this is the 8 byte vertices, where the two bytes following are both bones. If both are set, they each have a weight of 0.5, and if only one is set it is given full weight.

The UV’s are slightly more complicated. They are compressed in the same fashion as the vertices. However, while UV’s must always remain between 0 and 1, their constraints are not governed by the same limits. The resulting uncompressed values can be fixed through “looping” them. If the value is 1.3, the resulting value would be 0.3, and given the value -0.3, the resulting value would be 0.7. The easiest way to accomplish this is to mod the resulting value by 1, and then if the value is negative, subtract it from 1.

Since the bones have to act over several different pieces, each raw model block has a bone map, relating the bone byte to the correct bone id. This is a byte array, so if a vertex references bone 0, then boneMap[0] will provide the correct bone id.

Back to the meta, the sixth reflexive in the model meta defines the bone hierarchy of the model. When parent, child, or sibling is none, the value will be set to 0xFFFF. These chunks are the bones which are mapped to from the raw data. The name is a script reference, and defines what the bone is called.

The second reflexive defines all the level of details (LOD) for the model pieces. The name is again a script reference defining what this particular LOD is called. This is followed by a reflexive. This reflexive is for all the different options for the particular LOD (for example: base, default, damaged, etc.) Each of these reflexives consist of another script reference name, defining what this option is referred to as, followed by a series of 5 shorts. These shorts refer to the piece of the model which makes up one of the 5 LODs for this option. The last short (following the 5 LODs), defines the piece of the model which has the highest LOD (this should be equal to the 5th LOD value.) If a model only has 3 LODs, the first three LOD values will be the same, defining one piece to be used for all three levels.

The seventh reflexive in the model meta defines a series of locations defining everything from where lights and other effects are located on a model, to where the characters place their hands while using the model. These are set by a script reference to link the point to, and the points location data.

==== 3.6 - Other Tags ====

For the most part, objects are quite similar to their Halo 1 counterparts. Usually there has been some general compacting of the data (the tags have been cleaned up, unused values removed), or a reflexive added here and there. Notable exceptions that I haven’t written about here (as lack of time and motivation kept me away) are the model animations, which now have large blocks of raw data.

=== 4 - In Closing ===

==== 4.1 - Conclusion ====

In closing, I would like to say that not all the information enclosed here is guaranteed to be accurate. It is composed of my findings, and how I interpreted them at the time. Much of the structs are incomplete, as I tend to not write down things I figure out while seeking other answers, and I tried to only include solid information, instead of all my random notes.

The information contained within these pages should be enough to get any one started, and take them to the point of being able to obtain any of the above items, and replace them with their own creations.

I would like to thank all of you who read this far (and bothered reading this), and to you all, happy modding.

==== 4.2 - Acknowledgements ====

I would also once again like to thank MonoxideC and ViperNeo for their help in this. While they may remain modest, both were invaluable in explaining things I didn’t fully understand, bouncing ideas off, and just helping out anyway they could. The community is better for having them, and I better for knowing them.

=== 5 - Appendix I - Structures ===

<pre>
struct mapHeader {
char[4] head;
int version;
int filesize;
int zero;
int indexOffset;
int metaStart;
dword[2] unknown;
char[32] mapOrigin;
byte[224]unknown;
char[32] build;
byte[20] unknown;
int unknown;
int offsetToStrangeFileStrings;
int unknown;
int offsetToSomething;
int scriptReferenceCount;
int sizeOfScriptReference;
int offsetToScriptReferenceIndex;
int offsetToScriptReferenceStrings;
byte[36] unknown;
char[32] mapName;
int zero;
char[32] scenarioPath;
byte[224] zero;
int unknown;
int fileCount;
int fileTableOffset;
int fileTableSize;
int filesIndex;
int signature;
byte[1320] zero;
char[4] foot;
}

struct indexHeader {
int primaryMagicConstantMagic;
int tagListCount;
int objectIndexOffset;
int scenarioID;
int tagIDStart;
int unknown;
int objectCount;
char[4] tags;
}

struct tagListEntry {
char[4] objectClass;
char[4] parentClass;
char[4] grandparentClass;
}
struct objectEntry {
char[4] tag;
int ID;
int offset;
int metaSize;
}

struct unicMeta {
uint[4] zero;
short lang1Offset;
short lang1Count;
short lang2Offset;
short lang2Count;
short lang3Offset;
short lang3Count;
short lang4Offset;
short lang4Count;
short lang5Offset;
short lang5Count;
short lang6Offset;
short lang6Count;
short lang7Offset;
short lang7Count;
short lang8Offset;
short lang8Count;
short lang9Offset;
short lang9Count;
}

struct bitmMeta {
byte[68] data;
struct image {
char[4] bitm;
ushort width;
ushort height;
ushort depth;
ushort type;
ushort format;
ushort flags;
ushort regPointX;
ushort regPointY;
ushort mipMapCount;
ushort pixelOffset;
uint zero;
uint[6] offset;
uint[6] size;
uint identifier;
byte[36] unknown;
}
}

struct sndMeta {
dword unknown;
byte format;
byte[3] unknown;
short index;
byte chunkCount;
byte unknown;
dword[2] unknown;
}

struct ughMeta {
struct {}
struct {}
struct {
scriptRef sound;
}
struct {}
struct soundOptions {
dword[2] unknown;
short index;
short chunkCount;
}
struct soundPieces {
dword[3] unknown;
short index;
short chunkCount;
}
struct {}
struct {}
struct rawSound {
uint rawOffset;
uint size;
uint eff;
}
struct {}
struct {}
}

struct modeMeta {
scriptRef modelName;
dword val2;
dword val3;
dword zero;
dword zero;
struct boundingBox
{
float minX;
float maxX;
float minY;
float maxY;
float minZ;
float maxZ;
float minU;
float maxU;
float minV;
float maxV;
dword:4 zero;
}
struct LODs
{
scriptRef modelPiece;
word sval1; // FFFF
word sval2; // 0000
struct ref2.1
{
scriptRef modelType;
word LODPiece1;
word LODPiece2;
word LODPiece3;
word LODPiece4;
word LODPiece5;
word LODPieceHigh;
}
}
struct pieces
{
dword unknown;
ushort vertCount;
ushort unknown;
byte[12] val1;
ushort type;
ushort unkown;
dword val;
dword[2] zero;
dword[3] val;
dword[2] zero;
uint rawOffset;
uint size;
uint headerSize;
dword val4;
struct rsrc
{
word val;
word val;
word val;
word val;
uint size;
uint offset;
}
dword identifier;
dword val5;
dword eff;
}
struct ref4
{
dword zero;
}
struct ref5
{
dword val1;
dword:2 zero;
}
dword[3] zero;
struct bones
{
scriptRef boneName
ushort parent;
ushort firstChild;
ushort nextSibling;
word val1;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float;
float distanceFromParent;
}
dword[2] zero;
struct points
{
scriptRef pointName;
struct points
{
short; // 0xFFFF
short;
float[7] val;
dword zero;
}
}
struct shaders
{
dependancy shad;
dependancy shad;
dword:4 zero;
}
dword[7] zero;
}

struct modelHeader {
char[4] blkh;
uint size;
uint informationChunks;
uint zero;
uint unkChunks;
uint zero;
uint unk2Chunks;
uint[3] zero;
uint indicesChunks;
uint[5] zero;
uint unk3Chunks;
uint[10] zero;
uint boneChunks;
uint[2] zero;
}
</pre>

User:Haxar/NV2A

2017-06-04T09:51:02Z

Haxar:

=== NV2A register access from D3D8 ===

I wanted to know how NV2A registers were being accessed from Xbox executables. So, I loaded IDA with Turok with the applied Xbox Flirt Signatures v.2 and took references from '''pbkit''' to help me out with this.

'''D3D::CMiniport::MapRegisters''' is where it all begins. This is just a handful of subroutines from the '''D3D::CMiniport''' namespace.

Every single access is annotated from '''pbkit'''. It has been very useful.

<pre>
// turok
// using pbkit/outer.h
// gpu == 0xfd000000
</pre>
<pre>
signed int __thiscall D3D::CMiniport::MapRegisters(void *this)
{
*(_DWORD *)this = 0xFD000000u; // VIDEO_BASE
vFD001804 |= 4u; // NV_PBUS_PCI_NV_1_BUS_MASTER_ENABLED
vFD600140 = 0; // PCRTC_INTR_EN_VBLANK_DISABLED
vFD009140 = 0; // NV_PTIMER_INTR_EN_0_ALARM_DISABLED
return 1;
}
</pre>
<pre>
signed int __thiscall D3D::CMiniport::LoadEngines(void *this)
{
void *v1; // edi@1
int gpu; // esi@1
int v3; // eax@1
int v4; // ecx@1

v1 = this;
gpu = *(_DWORD *)this;
v3 = *(_DWORD *)this + 6220;
v4 = *(_DWORD *)v3;
*(_DWORD *)v3 &= 0xFFFFFCFFu;
*(_DWORD *)v3 = v4;
*(_DWORD *)(gpu + 0x200) = 0xFFFFFFFFu; // NV_PMC_ENABLE_ALL_ENABLE
*(_DWORD *)(gpu + 0x140) = *((_DWORD *)v1 + 45);// NV_PMC_INTR_EN_0
D3D::CMiniport::HalDacLoad(v1); // PCRTC_INTR_EN_VBLANK_ENABLED
*(_DWORD *)(gpu + 0x9400) = 0; // NV_PTIMER_TIME_0
*(_DWORD *)(gpu + 0x9410) = 0; // NV_PTIMER_TIME_1
*(_DWORD *)(gpu + 0x400720) = 0; // NV_PGRAPH_FIFO_ACCESS_DISABLE
D3D::CMiniport::HalGrControlLoad(v1);
*(_DWORD *)(gpu + 0x400100) = 0xFFFFFFFFu; // NV_PGRAPH_INTR_ALL_ENABLE
*(_DWORD *)(gpu + 0x400140) = 0xFFFFFFFFu; // NV_PGRAPH_INTR_EN_ALL_ENABLE
D3D::CMiniport::HalFifoControlLoad(v1);
*(_DWORD *)(gpu + 0x2100) = 0xFFFFFFFFu; // NV_PFIFO_INTR_0_ALL_RESET
*(_DWORD *)(gpu + 0x2140) = *((_DWORD *)v1 + 71);// NV_PFIFO_INTR_EN_0
*((_DWORD *)v1 + 528) = 0xFFFFFFFFu;
*((_DWORD *)v1 + 529) = 0xFFFFFFFFu;
*((_DWORD *)v1 + 520) = 0;
*((_DWORD *)v1 + 521) = 0;
return 1;
}
</pre>
<pre>
int __thiscall D3D::CMiniport::HalDacLoad(void *this)
{
int gpu; // eax@1

gpu = *(_DWORD *)this;
*(_DWORD *)(*(_DWORD *)this + 6291712) = 1;
*(_DWORD *)(gpu + 0x600140) = 1; // PCRTC_INTR_EN_VBLANK_ENABLED
return gpu;
}
</pre>
<pre>
int __thiscall D3D::CMiniport::HalGrControlLoad(int this)
{
int v1; // edi@1
int gpu; // esi@1
int v3; // eax@1
signed int v4; // edx@1
int v5; // eax@1
int v6; // ebp@2
int v7; // ebp@2
int v8; // ebp@2
int v9; // eax@3
int v10; // edx@4
int v11; // ebp@4
char v12; // zf@4
int v13; // eax@5
int v14; // eax@5
int v15; // eax@5
signed int v17; // [sp+14h] [bp-4h]@3

v1 = this;
gpu = *(_DWORD *)this;
v3 = *(_DWORD *)this + 512;
*(_DWORD *)v3 &= 0xFFFFEFFFu;
*(_DWORD *)v3 |= 0x1000u;
*(_DWORD *)(this + 2028) = 0;
*(_DWORD *)(this + 2044) = 0; // NV_PGRAPH_DEBUG_4
*(_DWORD *)(this + 2056) = 0; // NV_PGRAPH_UNKNOWN_400B84
*(_DWORD *)(this + 2068) = 0; // NV_PGRAPH_UNKNOWN_400B88
*(_DWORD *)(this + 2032) = 0x118700u; // NV_PGRAPH_DEBUG_1
*(_DWORD *)(this + 2036) = 0x28C3FFu; // NV_PGRAPH_DEBUG_7
*(_DWORD *)(this + 2040) = 0xF3DE0479u; // NV_PGRAPH_DEBUG_3
*(_DWORD *)(this + 2048) = 4; // NV_PGRAPH_DEBUG_5
*(_DWORD *)(this + 2052) = 0x45EAD10Eu; // NV_PGRAPH_UNKNOWN_400B80
*(_DWORD *)(this + 2060) = 0x78u; // NV_PGRAPH_UNKNOWN_400098
*(_DWORD *)(this + 2064) = 0x40u; // NV_PGRAPH_UNKNOWN_40009C
*(_DWORD *)(gpu + 0x400080) = 0; // NV_PGRAPH_DEBUG_0_NO_RESET
*(_DWORD *)(gpu + 0x400084) = *(_DWORD *)(this + 2032);// NV_PGRAPH_DEBUG_1
*(_DWORD *)(gpu + 0x400880) = *(_DWORD *)(this + 2036);// NV_PGRAPH_DEBUG_7
*(_DWORD *)(gpu + 0x40008C) = *(_DWORD *)(this + 2040);// NV_PGRAPH_DEBUG_3
*(_DWORD *)(gpu + 0x400090) = *(_DWORD *)(this + 2044);// NV_PGRAPH_DEBUG_4
*(_DWORD *)(gpu + 0x400094) = *(_DWORD *)(this + 2048);// NV_PGRAPH_DEBUG_5
*(_DWORD *)(gpu + 0x400B80) = *(_DWORD *)(this + 2052);// NV_PGRAPH_UNKNOWN_400B80
*(_DWORD *)(gpu + 0x400B84) = *(_DWORD *)(this + 2056);// NV_PGRAPH_UNKNOWN_400B84
*(_DWORD *)(gpu + 0x400098) = *(_DWORD *)(this + 2060);// NV_PGRAPH_UNKNOWN_400098
*(_DWORD *)(gpu + 0x40009C) = *(_DWORD *)(this + 2064);// NV_PGRAPH_UNKNOWN_40009C
*(_DWORD *)(gpu + 0x400B88) = *(_DWORD *)(this + 2068);// NV_PGRAPH_UNKNOWN_400B88
*(_DWORD *)(gpu + 0x400780) = *(_DWORD *)(this + 320) & 0xFFFF;// NV_PGRAPH_CHANNEL_CTX_TABLE
D3D::CMiniport::HalGrIdle((void *)this);
v4 = 80;
v5 = gpu + 0x400904; // NV_PGRAPH_TLIMIT_XBOX
do
{
v6 = *(_DWORD *)(v5 - 0x3006C0); // NV_PFB_TLIMIT
*(_DWORD *)v5 = v6; // NV_PGRAPH_TLIMIT_XBOX
*(_DWORD *)(gpu + 0x400750) = (v4 - 32) & 0x1FFC | 0xEA0000;// NV_PGRAPH_RDI_INDEX
*(_DWORD *)(gpu + 0x400754) = v6; // NV_PGRAPH_RDI_DATA
v7 = *(_DWORD *)(v5 - 0x3006BC); // NV_PFB_TSIZE
*(_DWORD *)(v5 + 4) = v7; // NV_PGRAPH_TSIZE_XBOX
*(_DWORD *)(gpu + 0x400750) = v4 & 0x1FFC | 0xEA0000;// NV_PGRAPH_RDI_INDEX
*(_DWORD *)(gpu + 0x400754) = v7; // NV_PGRAPH_RDI_DATA
v8 = *(_DWORD *)(v5 - 0x3006C4); // NV_PFB_TILE
*(_DWORD *)(v5 - 4) = v8; // NV_PGRAPH_TILE_XBOX
*(_DWORD *)(gpu + 0x400750) = (v4 - 64) & 0x1FFC | 0xEA0000;// NV_PGRAPH_RDI_INDEX
v4 += 4;
v5 += 0x10u;
*(_DWORD *)(gpu + 0x400754) = v8; // NV_PGRAPH_RDI_DATA
}
while ( v4 < 112 );
v9 = gpu + 0x400980; // NV_PGRAPH_ZCOMP_XBOX
v17 = 8;
do
{
v10 = *(_DWORD *)(v9 - 0x300680); // NV_PFB_ZCOMP
*(_DWORD *)v9 = v10; // NV_PGRAPH_ZCOMP_XBOX
v11 = (v9 + 0xFFBFF710 - gpu) & 0x1FFC | 0xEA0000;// (0x90) & 0x1FFC | 0xEA0000
v9 += 4;
v12 = v17-- == 1;
*(_DWORD *)(gpu + 0x400750) = v11; // NV_PGRAPH_RDI_INDEX
*(_DWORD *)(gpu + 0x400754) = v10; // NV_PGRAPH_RDI_DATA
}
while ( !v12 );
v13 = *(_DWORD *)(gpu + 0x100324); // NV_PFB_ZCOMP_OFFSET
*(_DWORD *)(gpu + 0x4009A0) = v13; // NV_PGRAPH_ZCOMP_OFFSET_XBOX
*(_DWORD *)(gpu + 0x400750) = 0xEA000Cu; // NV_PGRAPH_RDI_INDEX
*(_DWORD *)(gpu + 0x400754) = v13; // NV_PGRAPH_RDI_DATA
v14 = *(_DWORD *)(gpu + 0x100200); // NV_PFB_CFG0
*(_DWORD *)(gpu + 0x4009A4) = v14; // NV_PGRAPH_CFG0_XBOX
*(_DWORD *)(gpu + 0x400750) = 0xEA0000u; // NV_PGRAPH_RDI_INDEX
*(_DWORD *)(gpu + 0x400754) = v14; // NV_PGRAPH_RDI_DATA
v15 = *(_DWORD *)(gpu + 0x100204); // NV_PFB_CFG1
*(_DWORD *)(gpu + 0x4009A8) = v15; // NV_PGRAPH_CFG1_XBOX
*(_DWORD *)(gpu + 0x400750) = 0xEA0004u; // NV_PGRAPH_RDI_INDEX
*(_DWORD *)(gpu + 0x400754) = v15; // NV_PGRAPH_RDI_DATA
*(_DWORD *)(gpu + 0x40014C) = 0; // NV_PGRAPH_CTX_SWITCH1_ALL_DISABLE
*(_DWORD *)(gpu + 0x400150) = 0; // NV_PGRAPH_CTX_SWITCH2_ALL_DISABLE
*(_DWORD *)(gpu + 0x400154) = 0; // NV_PGRAPH_CTX_SWITCH3_ALL_DISABLE
*(_DWORD *)(gpu + 0x400158) = 0; // NV_PGRAPH_CTX_SWITCH4_ALL_DISABLE
*(_DWORD *)(gpu + 0x400144) = 0x10000000u; // NV_PGRAPH_CTX_CONTROL_DEVICE_ENABLED
*(_DWORD *)(gpu + 0x400764) = 0x8000000u; // NV_PGRAPH_FFINTFC_ST2_CHID_STATUS_VALID
return D3D::CMiniport::HalGrLoadChannelContext((void *)v1, *(_DWORD *)(v1 + 308));
}

int __thiscall D3D::CMiniport::HalGrIdle(void *this)
{
void *v1; // edi@1
int gpu; // esi@1
int result; // eax@1
int v4; // ebx@2

v1 = this;
gpu = *(_DWORD *)this;
result = *(_DWORD *)(*(_DWORD *)this + 4196096);
if ( result )
{
do
{
v4 = *(_DWORD *)(gpu + 0x100); // NV_PBUS_ROM_VERSION_MASK
if ( BYTE1(v4) & 0x10 )
result = unknown_libname_835(v1);
if ( v4 & 0x1000000 )
result = D3D::CMiniport::VBlank(v1);
}
while ( *(_DWORD *)(gpu + 0x400700) ); // NV_PGRAPH_STATUS_NOT_BUSY (while BUSY)
}
return result;
}

int __thiscall unknown_libname_835(void *this)
{
int gpu; // esi@1
int v2; // eax@1
int v3; // ebx@1
int v4; // edi@1
void *v6; // [sp+0h] [bp-4h]@1

v6 = this;
gpu = *(_DWORD *)this;
*(_DWORD *)(*(_DWORD *)this + 0x400720) = 0; // NV_PGRAPH_FIFO_ACCESS_DISABLE
v2 = *(_DWORD *)(gpu + 0x400100); // NV_PGRAPH_INTR
v3 = *(_DWORD *)(gpu + 0x400108); // NV_PGRAPH_NSOURCE
v4 = *(_DWORD *)(gpu + 0x400704) & 0x1FFC; // NV_PGRAPH_TRAPPED_ADDR_MTHD
if ( !(BYTE1(v2) & 0x10) ) // NV_PGRAPH_INTR_MISSING_HW_PENDING
goto LABEL_14;
*(_DWORD *)(gpu + 0x400100) = 0x1000u; // NV_PGRAPH_INTR_CONTEXT_SWITCH_PENDING
while ( *(_DWORD *)(*(_DWORD *)this + 0x400700) )// NV_PGRAPH_STATUS_NOT_BUSY (while BUSY)
;
D3D::CMiniport::HalGrLoadChannelContext(this, ((unsigned int)v4 >> 20) & 0x1F);
v2 = *(_DWORD *)(gpu + 0x400100); // NV_PGRAPH_INTR
if ( v2 )
{
LABEL_14:
*(_DWORD *)(gpu + 0x400100) = v2; // NV_PGRAPH_INTR
if ( v3 && v2 & 0x100001 && !(v3 & 0x40) ) // NV_PGRAPH_NSOURCE && NV_PGRAPH_INTR & NV_PGRAPH_INTR_NOTIFY_PENDING|NV_PGRAPH_INTR_ERROR_PENDING && !(NV_PGRAPH_NSOURCE & NV_PGRAPH_NSOURCE_ILLEGAL_MTHD_PENDING)
{
if ( v4 == 0x100 ) // NV_PGRAPH_TRAPPED_ADDR_MTHD
{
D3D::CMiniport::SoftwareMethod(v6, *(_DWORD *)(gpu + 0x400708));// NV_PGRAPH_TRAPPED_DATA_LOW
}
else
{
unknown_libname_837(
"Graphics hardware error information:\n Source: %08x\n ChID: %d\n Class: %x\n Method: %08x\n Data: %08x\n Get: %08x\n",
v3, // NV_PGRAPH_NSOURCE
((unsigned int)v4 >> 20) & 0x1F, // NV_PGRAPH_TRAPPED_ADDR_CHID
*(_DWORD *)(gpu + 0x40014C) & 0xFF, // NV_PGRAPH_CTX_SWITCH1_GRCLASS
v4, // NV_PGRAPH_TRAPPED_ADDR_MTHD
*(_DWORD *)(gpu + 0x400708), // NV_PGRAPH_TRAPPED_DATA_LOW
vFD003244 | 0x80000000); // NV_PFIFO_CACHE1_DMA_GET
__debugbreak();
}
}
}
*(_DWORD *)(gpu + 0x400720) = 1; // NV_PGRAPH_FIFO_ACCESS_ENABLE
return *(_DWORD *)(gpu + 0x400100); // NV_PGRAPH_INTR
}

//TODO D3D::CMiniport::VBlank

int __thiscall D3D::CMiniport::HalGrLoadChannelContext(void *this, int a2)
{
void *v2; // ebx@1
int gpu; // esi@1
int v4; // edx@3
int result; // eax@6
signed int v6; // eax@8
int v7; // edi@10
int v8; // esi@10
int v9; // [sp+Ch] [bp-4h]@3

v2 = this;
gpu = *(_DWORD *)this;
if ( *(_DWORD *)(*(_DWORD *)this + 4194560) )
unknown_libname_835(this);
v9 = *(_DWORD *)(gpu + 0x400720); // NV_PGRAPH_FIFO
*(_DWORD *)(gpu + 0x400720) = 0; // NV_PGRAPH_FIFO_ACCESS_DISABLE
D3D::CMiniport::HalGrIdle(v2);
v4 = a2;
if ( *((_DWORD *)v2 + 77) != a2 )
{
D3D::CMiniport::HalGrUnloadChannelContext(v2, *((_DWORD *)v2 + 77));
v4 = a2;
}
*((_DWORD *)v2 + 77) = v4;
if ( v4 == 2 )
{
*(_DWORD *)(gpu + 0x400144) = 0x10000100u; // NV_PGRAPH_CTX_CONTROL_TIME_NOT_EXPIRED|NV_PGRAPH_CTX_CONTROL_DEVICE_ENABLED
result = v9 | 1;
*(_DWORD *)(gpu + 0x400764) = 0x8000000u; // NV_PGRAPH_FFINTFC_ST2_CHID_STATUS_VALID
*(_DWORD *)(gpu + 0x400720) = v9 | 1; // NV_PGRAPH_FIFO_ACCESS_ENABLE
}
else
{
if ( *((_DWORD *)v2 + v4 + 81) )
{
*(_DWORD *)(gpu + 0x400080) = 0x70000u; // NV_PGRAPH_DEBUG_0_IDX_STATE_RESET|NV_PGRAPH_DEBUG_0_VTX_STATE_RESET|NV_PGRAPH_DEBUG_0_CAS_STATE_RESET
*(_DWORD *)(gpu + 0x400080) = 0; // NV_PGRAPH_DEBUG_0_NO_RESET
*(_DWORD *)(gpu + 0x400750) = 0x3D0000u; // NV_PGRAPH_RDI_INDEX_SELECT
v6 = 15;
do
{
--v6;
*(_DWORD *)(gpu + 0x400754) = 0; // NV_PGRAPH_RDI_DATA
}
while ( v6 );
}
*(_DWORD *)(gpu + 0x400084) |= 0x1000000u; // NV_PGRAPH_DEBUG_1_CACHE_INVALIDATE
v7 = (v4 & 0x1F) << 24;
*(_DWORD *)(gpu + 0x400148) = v7; // NV_PGRAPH_CTX_USER
*(_DWORD *)(gpu + 0x400784) = *((_DWORD *)v2 + a2 + 78) & 0xFFFF;// NV_PGRAPH_CHANNEL_CTX_POINTER_INST
*(_DWORD *)(gpu + 0x400788) = 1; // NV_PGRAPH_CHANNEL_CTX_STATUS_LOADED
D3D::CMiniport::HalGrIdle(v2);
*(_DWORD *)(gpu + 0x400148) = v7 | *(_DWORD *)(gpu + 0x400148) & 0xE0FFFFFF;// NV_PGRAPH_CTX_USER_CHID (inverted mask)
*(_DWORD *)(gpu + 0x400144) = 0x10010100u; // NV_PGRAPH_CTX_CONTROL_TIME_NOT_EXPIRED|NV_PGRAPH_CTX_CONTROL_CHID_VALID|NV_PGRAPH_CTX_CONTROL_DEVICE_ENABLED
v8 = gpu + 0x400764; // NV_PGRAPH_FFINTFC_ST2
result = *(_DWORD *)v8 & 0xCFFFFFFF; // NV_PGRAPH_FFINTFC_ST2_CHSWITCH_CLEAR&NV_PGRAPH_FFINTFC_ST2_FIFOHOLD_CLEAR
*(_DWORD *)v8 = result; // NV_PGRAPH_FFINTFC_ST2
}
return result;
}

int __thiscall D3D::CMiniport::HalGrUnloadChannelContext(void *this, int a2)
{
int result; // eax@1
int gpu; // esi@1

result = a2;
gpu = *(_DWORD *)this;
if ( a2 != 2 )
{
*(_DWORD *)(gpu + 0x400784) = *((_DWORD *)this + a2 + 78) & 0xFFFF;// NV_PGRAPH_CHANNEL_CTX_POINTER_INST
*(_DWORD *)(gpu + 0x400788) = 2; // NV_PGRAPH_CHANNEL_CTX_STATUS_UNLOADED
result = D3D::CMiniport::HalGrIdle(this);
*(_DWORD *)(gpu + 0x400144) = 0x10000000u; // NV_PGRAPH_CTX_CONTROL_DEVICE_ENABLED
}
return result;
}
</pre>
<pre>
int __thiscall D3D::CMiniport::HalFifoControlLoad(void *this)
{
int gpu; // esi@1
int result; // eax@1

gpu = *(_DWORD *)this;
*(_DWORD *)(*(_DWORD *)this + 12836) = 0xF0078u;
*(_DWORD *)(gpu + 0x2044) = 0x101FFFFu; // NV_PFIFO_DMA_TIMESLICE_SELECT_128K|NV_PFIFO_DMA_TIMESLICE_TIMEOUT_ENABLED
*(_DWORD *)(gpu + 0x2040) = *((_DWORD *)this + 72) & 0x3FF;// NV_PFIFO_DELAY_0_WAIT_RETRY
*(_DWORD *)(gpu + 0x2500) = 0; // NV_PFIFO_CACHES_ALL_DISABLE
*(_DWORD *)(gpu + 0x3000) = 0; // NV_PFIFO_CACHE0_PUSH0_ACCESS_DISABLE
*(_DWORD *)(gpu + 0x3050) = 0; // NV_PFIFO_CACHE0_PULL0_ACCESS_DISABLE
*(_DWORD *)(gpu + 0x3200) = 0; // NV_PFIFO_CACHE1_PUSH0_ACCESS_DISABLE
*(_DWORD *)(gpu + 0x3250) = 0; // NV_PFIFO_CACHE1_PULL0_ACCESS_DISABLE
*(_DWORD *)(gpu + 0x3220) = 0; // NV_PFIFO_CACHE1_DMA_PUSH_ACCESS_DISABLE
result = D3D::CMiniport::HalFifoContextSwitch(this, 1);
*(_DWORD *)(gpu + 0x3210) = 0; // NV_PFIFO_CACHE1_PUT_ADDRESS
*(_DWORD *)(gpu + 0x3270) = 0; // NV_PFIFO_CACHE1_GET_ADDRESS
*(_DWORD *)(gpu + 0x3250) = 1; // NV_PFIFO_CACHE1_PULL0_ACCESS_ENABLE
*(_DWORD *)(gpu + 0x3200) = 1; // NV_PFIFO_CACHE1_PUSH0_ACCESS_ENABLE
*(_DWORD *)(gpu + 0x2500) = 1; // NV_PFIFO_CACHES_REASSIGN_ENABLED
*(_DWORD *)(gpu + 0x2500) = 0; // NV_PFIFO_CACHES_ALL_DISABLE
return result;
}

int __thiscall D3D::CMiniport::HalFifoContextSwitch(void *this, int a2_switch)
{
void *v2; // esi@1
int gpu; // eax@1
int v4; // ebx@1
int v5; // ecx@1
int v6; // edx@1
int v7; // ecx@2
int v8; // edx@8
int v9; // [sp+Ch] [bp-14h]@1
int v10; // [sp+10h] [bp-10h]@1
int v11; // [sp+14h] [bp-Ch]@1
signed int v12; // [sp+1Ch] [bp-4h]@2

v2 = this;
gpu = *(_DWORD *)this;
v4 = *((_DWORD *)this + 74); // unknown1
v9 = *(_DWORD *)(*(_DWORD *)this + 9472);
v10 = *(_DWORD *)(*(_DWORD *)this + 12800);
v11 = *(_DWORD *)(*(_DWORD *)this + 12880);
*(_DWORD *)(*(_DWORD *)this + 9472) = 0;
*(_DWORD *)(gpu + 0x3200) = 0; // NV_PFIFO_CACHE1_PUSH0_ACCESS_DISABLE
*(_DWORD *)(gpu + 0x3250) = 0; // NV_PFIFO_CACHE1_PULL0_ACCESS_DISABLE
v5 = *(_DWORD *)(gpu + 0x3204) & 0x1F; // NV_PFIFO_CACHE1_PUSH1_CHID
v6 = gpu + v4 + ((*(_DWORD *)(gpu + 0x3204) & 0x1F) << 6);// unknown2
*(_DWORD *)v6 = *(_DWORD *)(gpu + 0x3240); // NV_PFIFO_CACHE1_DMA_PUT
*(_DWORD *)(v6 + 4) = *(_DWORD *)(gpu + 0x3244);// NV_PFIFO_CACHE1_DMA_GET
*(_DWORD *)(v6 + 8) = *(_DWORD *)(gpu + 0x3248);// NV_PFIFO_CACHE1_REF
*(_DWORD *)(v6 + 12) = *(_DWORD *)(gpu + 0x322C);// NV_PFIFO_CACHE1_DMA_INSTANCE
*(_DWORD *)(v6 + 16) = *(_DWORD *)(gpu + 0x3228);// NV_PFIFO_CACHE1_DMA_STATE
*(_DWORD *)(v6 + 20) = *(_DWORD *)(gpu + 0x3224);// NV_PFIFO_CACHE1_DMA_FETCH
*(_DWORD *)(v6 + 24) = *(_DWORD *)(gpu + 0x3280);// NV_PFIFO_CACHE1_ENGINE
*(_DWORD *)(v6 + 28) = *(_DWORD *)(gpu + 0x3254);// NV_PFIFO_CACHE1_PULL1
*(_DWORD *)(v6 + 32) = *(_DWORD *)(gpu + 0x3268);// NV_PFIFO_CACHE1_ACQUIRE_2
*(_DWORD *)(v6 + 36) = *(_DWORD *)(gpu + 0x3264);// NV_PFIFO_CACHE1_ACQUIRE_1
*(_DWORD *)(v6 + 40) = *(_DWORD *)(gpu + 0x3260);// NV_PFIFO_CACHE1_ACQUIRE_0
*(_DWORD *)(v6 + 44) = *(_DWORD *)(gpu + 0x326C);// NV_PFIFO_CACHE1_SEMAPHORE
*(_DWORD *)(v6 + 48) = *(_DWORD *)(gpu + 0x324C);// NV_PFIFO_CACHE1_DMA_SUBROUTINE
if ( *(_DWORD *)(gpu + 0x3204) & 0x100 ) // NV_PFIFO_CACHE1_PUSH1_MODE_DMA
{
v12 = 1 << v5;
v7 = *(_DWORD *)(gpu + 0x2508) & ~(1 << v5);// NV_PFIFO_DMA
if ( *(_DWORD *)(gpu + 0x3240) != *(_DWORD *)(gpu + 0x3244) )// NV_PFIFO_CACHE1_DMA_PUT != NV_PFIFO_CACHE1_DMA_GET
v7 |= v12;
*(_DWORD *)(gpu + 0x2508) = v7; // NV_PFIFO_DMA
}
*(_DWORD *)(gpu + 0x3204) = a2_switch & 0x1F; // NV_PFIFO_CACHE1_PUSH1_CHID
if ( (1 << a2_switch) & *((_DWORD *)v2 + 65) && a2_switch != 1 )
*(_DWORD *)(gpu + 0x3204) |= 0x100u; // NV_PFIFO_CACHE1_PUSH1_MODE_DMA
v8 = v4 + (a2_switch << 6) + gpu; // unknown3
*(_DWORD *)(gpu + 0x3240) = *(_DWORD *)v8; // NV_PFIFO_CACHE1_DMA_PUT
*(_DWORD *)(gpu + 0x3244) = *(_DWORD *)(v8 + 4);// NV_PFIFO_CACHE1_DMA_GET
*(_DWORD *)(gpu + 0x3248) = *(_DWORD *)(v8 + 8);// NV_PFIFO_CACHE1_REF
*(_DWORD *)(gpu + 0x322C) = *(_DWORD *)(v8 + 12);// NV_PFIFO_CACHE1_DMA_INSTANCE
*(_DWORD *)(gpu + 0x3228) = *(_DWORD *)(v8 + 16);// NV_PFIFO_CACHE1_DMA_STATE
*(_DWORD *)(gpu + 0x3224) = *(_DWORD *)(v8 + 20);// NV_PFIFO_CACHE1_DMA_FETCH
*(_DWORD *)(gpu + 0x3280) = *(_DWORD *)(v8 + 24);// NV_PFIFO_CACHE1_ENGINE
*(_DWORD *)(gpu + 0x3254) = *(_DWORD *)(v8 + 28);// NV_PFIFO_CACHE1_PULL1
*(_DWORD *)(gpu + 0x3268) = *(_DWORD *)(v8 + 32);// NV_PFIFO_CACHE1_ACQUIRE_2
*(_DWORD *)(gpu + 0x3264) = *(_DWORD *)(v8 + 36);// NV_PFIFO_CACHE1_ACQUIRE_1
*(_DWORD *)(gpu + 0x3260) = *(_DWORD *)(v8 + 40);// NV_PFIFO_CACHE1_ACQUIRE_0
*(_DWORD *)(gpu + 0x326C) = *(_DWORD *)(v8 + 44);// NV_PFIFO_CACHE1_SEMAPHORE
*(_DWORD *)(gpu + 0x324C) = *(_DWORD *)(v8 + 48);// NV_PFIFO_CACHE1_DMA_SUBROUTINE
if ( (1 << a2_switch) & *((_DWORD *)v2 + 65) && a2_switch != 1 )
*(_DWORD *)(gpu + 0x3220) = 1; // NV_PFIFO_CACHE1_DMA_PUSH_ACCESS_ENABLE
*(_DWORD *)(gpu + 0x204C) = 0x1FFFFFu; // NV_PFIFO_TIMESLICE_TIMER_EXPIRED
*(_DWORD *)(gpu + 0x3250) = v11; // NV_PFIFO_CACHE1_PULL0
*(_DWORD *)(gpu + 0x3200) = v10; // NV_PFIFO_CACHE1_PUSH0
*(_DWORD *)(gpu + 0x2500) = v9; // NV_PFIFO_CACHES
return gpu;
}
</pre>

User:Haxar

2017-06-04T09:49:59Z

Haxar:

=== GitHub ===

* [https://github.com/haxar/cxbx-shogun Cxbx w/ Wine support.]

=== R&D ===

* [[User:Haxar/fastcall|fastcall routines from rgrep]]
* [[User:Haxar/NV2A|NV2A register access from D3D8]]

User:Haxar/NV2A

2017-06-04T09:48:31Z

Haxar: Created page with "I wanted to know how NV2A registers were being accessed from Xbox executables. So, I loaded IDA with Turok with the applied Xbox Flirt Signatures v.2 and took references from..."

I wanted to know how NV2A registers were being accessed from Xbox executables. So, I loaded IDA with Turok with the applied Xbox Flirt Signatures v.2 and took references from '''pbkit''' to help me out with this.

'''D3D::CMiniport::MapRegisters''' is where it all begins. This is just a handful of subroutines from the '''D3D::CMiniport''' namespace.

Every single access is annotated from '''pbkit'''. It has been very useful.

<pre>
// turok
// using pbkit/outer.h
// gpu == 0xfd000000
</pre>
<pre>
signed int __thiscall D3D::CMiniport::MapRegisters(void *this)
{
*(_DWORD *)this = 0xFD000000u; // VIDEO_BASE
vFD001804 |= 4u; // NV_PBUS_PCI_NV_1_BUS_MASTER_ENABLED
vFD600140 = 0; // PCRTC_INTR_EN_VBLANK_DISABLED
vFD009140 = 0; // NV_PTIMER_INTR_EN_0_ALARM_DISABLED
return 1;
}
</pre>
<pre>
signed int __thiscall D3D::CMiniport::LoadEngines(void *this)
{
void *v1; // edi@1
int gpu; // esi@1
int v3; // eax@1
int v4; // ecx@1

v1 = this;
gpu = *(_DWORD *)this;
v3 = *(_DWORD *)this + 6220;
v4 = *(_DWORD *)v3;
*(_DWORD *)v3 &= 0xFFFFFCFFu;
*(_DWORD *)v3 = v4;
*(_DWORD *)(gpu + 0x200) = 0xFFFFFFFFu; // NV_PMC_ENABLE_ALL_ENABLE
*(_DWORD *)(gpu + 0x140) = *((_DWORD *)v1 + 45);// NV_PMC_INTR_EN_0
D3D::CMiniport::HalDacLoad(v1); // PCRTC_INTR_EN_VBLANK_ENABLED
*(_DWORD *)(gpu + 0x9400) = 0; // NV_PTIMER_TIME_0
*(_DWORD *)(gpu + 0x9410) = 0; // NV_PTIMER_TIME_1
*(_DWORD *)(gpu + 0x400720) = 0; // NV_PGRAPH_FIFO_ACCESS_DISABLE
D3D::CMiniport::HalGrControlLoad(v1);
*(_DWORD *)(gpu + 0x400100) = 0xFFFFFFFFu; // NV_PGRAPH_INTR_ALL_ENABLE
*(_DWORD *)(gpu + 0x400140) = 0xFFFFFFFFu; // NV_PGRAPH_INTR_EN_ALL_ENABLE
D3D::CMiniport::HalFifoControlLoad(v1);
*(_DWORD *)(gpu + 0x2100) = 0xFFFFFFFFu; // NV_PFIFO_INTR_0_ALL_RESET
*(_DWORD *)(gpu + 0x2140) = *((_DWORD *)v1 + 71);// NV_PFIFO_INTR_EN_0
*((_DWORD *)v1 + 528) = 0xFFFFFFFFu;
*((_DWORD *)v1 + 529) = 0xFFFFFFFFu;
*((_DWORD *)v1 + 520) = 0;
*((_DWORD *)v1 + 521) = 0;
return 1;
}
</pre>
<pre>
int __thiscall D3D::CMiniport::HalDacLoad(void *this)
{
int gpu; // eax@1

gpu = *(_DWORD *)this;
*(_DWORD *)(*(_DWORD *)this + 6291712) = 1;
*(_DWORD *)(gpu + 0x600140) = 1; // PCRTC_INTR_EN_VBLANK_ENABLED
return gpu;
}
</pre>
<pre>
int __thiscall D3D::CMiniport::HalGrControlLoad(int this)
{
int v1; // edi@1
int gpu; // esi@1
int v3; // eax@1
signed int v4; // edx@1
int v5; // eax@1
int v6; // ebp@2
int v7; // ebp@2
int v8; // ebp@2
int v9; // eax@3
int v10; // edx@4
int v11; // ebp@4
char v12; // zf@4
int v13; // eax@5
int v14; // eax@5
int v15; // eax@5
signed int v17; // [sp+14h] [bp-4h]@3

v1 = this;
gpu = *(_DWORD *)this;
v3 = *(_DWORD *)this + 512;
*(_DWORD *)v3 &= 0xFFFFEFFFu;
*(_DWORD *)v3 |= 0x1000u;
*(_DWORD *)(this + 2028) = 0;
*(_DWORD *)(this + 2044) = 0; // NV_PGRAPH_DEBUG_4
*(_DWORD *)(this + 2056) = 0; // NV_PGRAPH_UNKNOWN_400B84
*(_DWORD *)(this + 2068) = 0; // NV_PGRAPH_UNKNOWN_400B88
*(_DWORD *)(this + 2032) = 0x118700u; // NV_PGRAPH_DEBUG_1
*(_DWORD *)(this + 2036) = 0x28C3FFu; // NV_PGRAPH_DEBUG_7
*(_DWORD *)(this + 2040) = 0xF3DE0479u; // NV_PGRAPH_DEBUG_3
*(_DWORD *)(this + 2048) = 4; // NV_PGRAPH_DEBUG_5
*(_DWORD *)(this + 2052) = 0x45EAD10Eu; // NV_PGRAPH_UNKNOWN_400B80
*(_DWORD *)(this + 2060) = 0x78u; // NV_PGRAPH_UNKNOWN_400098
*(_DWORD *)(this + 2064) = 0x40u; // NV_PGRAPH_UNKNOWN_40009C
*(_DWORD *)(gpu + 0x400080) = 0; // NV_PGRAPH_DEBUG_0_NO_RESET
*(_DWORD *)(gpu + 0x400084) = *(_DWORD *)(this + 2032);// NV_PGRAPH_DEBUG_1
*(_DWORD *)(gpu + 0x400880) = *(_DWORD *)(this + 2036);// NV_PGRAPH_DEBUG_7
*(_DWORD *)(gpu + 0x40008C) = *(_DWORD *)(this + 2040);// NV_PGRAPH_DEBUG_3
*(_DWORD *)(gpu + 0x400090) = *(_DWORD *)(this + 2044);// NV_PGRAPH_DEBUG_4
*(_DWORD *)(gpu + 0x400094) = *(_DWORD *)(this + 2048);// NV_PGRAPH_DEBUG_5
*(_DWORD *)(gpu + 0x400B80) = *(_DWORD *)(this + 2052);// NV_PGRAPH_UNKNOWN_400B80
*(_DWORD *)(gpu + 0x400B84) = *(_DWORD *)(this + 2056);// NV_PGRAPH_UNKNOWN_400B84
*(_DWORD *)(gpu + 0x400098) = *(_DWORD *)(this + 2060);// NV_PGRAPH_UNKNOWN_400098
*(_DWORD *)(gpu + 0x40009C) = *(_DWORD *)(this + 2064);// NV_PGRAPH_UNKNOWN_40009C
*(_DWORD *)(gpu + 0x400B88) = *(_DWORD *)(this + 2068);// NV_PGRAPH_UNKNOWN_400B88
*(_DWORD *)(gpu + 0x400780) = *(_DWORD *)(this + 320) & 0xFFFF;// NV_PGRAPH_CHANNEL_CTX_TABLE
D3D::CMiniport::HalGrIdle((void *)this);
v4 = 80;
v5 = gpu + 0x400904; // NV_PGRAPH_TLIMIT_XBOX
do
{
v6 = *(_DWORD *)(v5 - 0x3006C0); // NV_PFB_TLIMIT
*(_DWORD *)v5 = v6; // NV_PGRAPH_TLIMIT_XBOX
*(_DWORD *)(gpu + 0x400750) = (v4 - 32) & 0x1FFC | 0xEA0000;// NV_PGRAPH_RDI_INDEX
*(_DWORD *)(gpu + 0x400754) = v6; // NV_PGRAPH_RDI_DATA
v7 = *(_DWORD *)(v5 - 0x3006BC); // NV_PFB_TSIZE
*(_DWORD *)(v5 + 4) = v7; // NV_PGRAPH_TSIZE_XBOX
*(_DWORD *)(gpu + 0x400750) = v4 & 0x1FFC | 0xEA0000;// NV_PGRAPH_RDI_INDEX
*(_DWORD *)(gpu + 0x400754) = v7; // NV_PGRAPH_RDI_DATA
v8 = *(_DWORD *)(v5 - 0x3006C4); // NV_PFB_TILE
*(_DWORD *)(v5 - 4) = v8; // NV_PGRAPH_TILE_XBOX
*(_DWORD *)(gpu + 0x400750) = (v4 - 64) & 0x1FFC | 0xEA0000;// NV_PGRAPH_RDI_INDEX
v4 += 4;
v5 += 0x10u;
*(_DWORD *)(gpu + 0x400754) = v8; // NV_PGRAPH_RDI_DATA
}
while ( v4 < 112 );
v9 = gpu + 0x400980; // NV_PGRAPH_ZCOMP_XBOX
v17 = 8;
do
{
v10 = *(_DWORD *)(v9 - 0x300680); // NV_PFB_ZCOMP
*(_DWORD *)v9 = v10; // NV_PGRAPH_ZCOMP_XBOX
v11 = (v9 + 0xFFBFF710 - gpu) & 0x1FFC | 0xEA0000;// (0x90) & 0x1FFC | 0xEA0000
v9 += 4;
v12 = v17-- == 1;
*(_DWORD *)(gpu + 0x400750) = v11; // NV_PGRAPH_RDI_INDEX
*(_DWORD *)(gpu + 0x400754) = v10; // NV_PGRAPH_RDI_DATA
}
while ( !v12 );
v13 = *(_DWORD *)(gpu + 0x100324); // NV_PFB_ZCOMP_OFFSET
*(_DWORD *)(gpu + 0x4009A0) = v13; // NV_PGRAPH_ZCOMP_OFFSET_XBOX
*(_DWORD *)(gpu + 0x400750) = 0xEA000Cu; // NV_PGRAPH_RDI_INDEX
*(_DWORD *)(gpu + 0x400754) = v13; // NV_PGRAPH_RDI_DATA
v14 = *(_DWORD *)(gpu + 0x100200); // NV_PFB_CFG0
*(_DWORD *)(gpu + 0x4009A4) = v14; // NV_PGRAPH_CFG0_XBOX
*(_DWORD *)(gpu + 0x400750) = 0xEA0000u; // NV_PGRAPH_RDI_INDEX
*(_DWORD *)(gpu + 0x400754) = v14; // NV_PGRAPH_RDI_DATA
v15 = *(_DWORD *)(gpu + 0x100204); // NV_PFB_CFG1
*(_DWORD *)(gpu + 0x4009A8) = v15; // NV_PGRAPH_CFG1_XBOX
*(_DWORD *)(gpu + 0x400750) = 0xEA0004u; // NV_PGRAPH_RDI_INDEX
*(_DWORD *)(gpu + 0x400754) = v15; // NV_PGRAPH_RDI_DATA
*(_DWORD *)(gpu + 0x40014C) = 0; // NV_PGRAPH_CTX_SWITCH1_ALL_DISABLE
*(_DWORD *)(gpu + 0x400150) = 0; // NV_PGRAPH_CTX_SWITCH2_ALL_DISABLE
*(_DWORD *)(gpu + 0x400154) = 0; // NV_PGRAPH_CTX_SWITCH3_ALL_DISABLE
*(_DWORD *)(gpu + 0x400158) = 0; // NV_PGRAPH_CTX_SWITCH4_ALL_DISABLE
*(_DWORD *)(gpu + 0x400144) = 0x10000000u; // NV_PGRAPH_CTX_CONTROL_DEVICE_ENABLED
*(_DWORD *)(gpu + 0x400764) = 0x8000000u; // NV_PGRAPH_FFINTFC_ST2_CHID_STATUS_VALID
return D3D::CMiniport::HalGrLoadChannelContext((void *)v1, *(_DWORD *)(v1 + 308));
}

int __thiscall D3D::CMiniport::HalGrIdle(void *this)
{
void *v1; // edi@1
int gpu; // esi@1
int result; // eax@1
int v4; // ebx@2

v1 = this;
gpu = *(_DWORD *)this;
result = *(_DWORD *)(*(_DWORD *)this + 4196096);
if ( result )
{
do
{
v4 = *(_DWORD *)(gpu + 0x100); // NV_PBUS_ROM_VERSION_MASK
if ( BYTE1(v4) & 0x10 )
result = unknown_libname_835(v1);
if ( v4 & 0x1000000 )
result = D3D::CMiniport::VBlank(v1);
}
while ( *(_DWORD *)(gpu + 0x400700) ); // NV_PGRAPH_STATUS_NOT_BUSY (while BUSY)
}
return result;
}

int __thiscall unknown_libname_835(void *this)
{
int gpu; // esi@1
int v2; // eax@1
int v3; // ebx@1
int v4; // edi@1
void *v6; // [sp+0h] [bp-4h]@1

v6 = this;
gpu = *(_DWORD *)this;
*(_DWORD *)(*(_DWORD *)this + 0x400720) = 0; // NV_PGRAPH_FIFO_ACCESS_DISABLE
v2 = *(_DWORD *)(gpu + 0x400100); // NV_PGRAPH_INTR
v3 = *(_DWORD *)(gpu + 0x400108); // NV_PGRAPH_NSOURCE
v4 = *(_DWORD *)(gpu + 0x400704) & 0x1FFC; // NV_PGRAPH_TRAPPED_ADDR_MTHD
if ( !(BYTE1(v2) & 0x10) ) // NV_PGRAPH_INTR_MISSING_HW_PENDING
goto LABEL_14;
*(_DWORD *)(gpu + 0x400100) = 0x1000u; // NV_PGRAPH_INTR_CONTEXT_SWITCH_PENDING
while ( *(_DWORD *)(*(_DWORD *)this + 0x400700) )// NV_PGRAPH_STATUS_NOT_BUSY (while BUSY)
;
D3D::CMiniport::HalGrLoadChannelContext(this, ((unsigned int)v4 >> 20) & 0x1F);
v2 = *(_DWORD *)(gpu + 0x400100); // NV_PGRAPH_INTR
if ( v2 )
{
LABEL_14:
*(_DWORD *)(gpu + 0x400100) = v2; // NV_PGRAPH_INTR
if ( v3 && v2 & 0x100001 && !(v3 & 0x40) ) // NV_PGRAPH_NSOURCE && NV_PGRAPH_INTR & NV_PGRAPH_INTR_NOTIFY_PENDING|NV_PGRAPH_INTR_ERROR_PENDING && !(NV_PGRAPH_NSOURCE & NV_PGRAPH_NSOURCE_ILLEGAL_MTHD_PENDING)
{
if ( v4 == 0x100 ) // NV_PGRAPH_TRAPPED_ADDR_MTHD
{
D3D::CMiniport::SoftwareMethod(v6, *(_DWORD *)(gpu + 0x400708));// NV_PGRAPH_TRAPPED_DATA_LOW
}
else
{
unknown_libname_837(
"Graphics hardware error information:\n Source: %08x\n ChID: %d\n Class: %x\n Method: %08x\n Data: %08x\n Get: %08x\n",
v3, // NV_PGRAPH_NSOURCE
((unsigned int)v4 >> 20) & 0x1F, // NV_PGRAPH_TRAPPED_ADDR_CHID
*(_DWORD *)(gpu + 0x40014C) & 0xFF, // NV_PGRAPH_CTX_SWITCH1_GRCLASS
v4, // NV_PGRAPH_TRAPPED_ADDR_MTHD
*(_DWORD *)(gpu + 0x400708), // NV_PGRAPH_TRAPPED_DATA_LOW
vFD003244 | 0x80000000); // NV_PFIFO_CACHE1_DMA_GET
__debugbreak();
}
}
}
*(_DWORD *)(gpu + 0x400720) = 1; // NV_PGRAPH_FIFO_ACCESS_ENABLE
return *(_DWORD *)(gpu + 0x400100); // NV_PGRAPH_INTR
}

//TODO D3D::CMiniport::VBlank

int __thiscall D3D::CMiniport::HalGrLoadChannelContext(void *this, int a2)
{
void *v2; // ebx@1
int gpu; // esi@1
int v4; // edx@3
int result; // eax@6
signed int v6; // eax@8
int v7; // edi@10
int v8; // esi@10
int v9; // [sp+Ch] [bp-4h]@3

v2 = this;
gpu = *(_DWORD *)this;
if ( *(_DWORD *)(*(_DWORD *)this + 4194560) )
unknown_libname_835(this);
v9 = *(_DWORD *)(gpu + 0x400720); // NV_PGRAPH_FIFO
*(_DWORD *)(gpu + 0x400720) = 0; // NV_PGRAPH_FIFO_ACCESS_DISABLE
D3D::CMiniport::HalGrIdle(v2);
v4 = a2;
if ( *((_DWORD *)v2 + 77) != a2 )
{
D3D::CMiniport::HalGrUnloadChannelContext(v2, *((_DWORD *)v2 + 77));
v4 = a2;
}
*((_DWORD *)v2 + 77) = v4;
if ( v4 == 2 )
{
*(_DWORD *)(gpu + 0x400144) = 0x10000100u; // NV_PGRAPH_CTX_CONTROL_TIME_NOT_EXPIRED|NV_PGRAPH_CTX_CONTROL_DEVICE_ENABLED
result = v9 | 1;
*(_DWORD *)(gpu + 0x400764) = 0x8000000u; // NV_PGRAPH_FFINTFC_ST2_CHID_STATUS_VALID
*(_DWORD *)(gpu + 0x400720) = v9 | 1; // NV_PGRAPH_FIFO_ACCESS_ENABLE
}
else
{
if ( *((_DWORD *)v2 + v4 + 81) )
{
*(_DWORD *)(gpu + 0x400080) = 0x70000u; // NV_PGRAPH_DEBUG_0_IDX_STATE_RESET|NV_PGRAPH_DEBUG_0_VTX_STATE_RESET|NV_PGRAPH_DEBUG_0_CAS_STATE_RESET
*(_DWORD *)(gpu + 0x400080) = 0; // NV_PGRAPH_DEBUG_0_NO_RESET
*(_DWORD *)(gpu + 0x400750) = 0x3D0000u; // NV_PGRAPH_RDI_INDEX_SELECT
v6 = 15;
do
{
--v6;
*(_DWORD *)(gpu + 0x400754) = 0; // NV_PGRAPH_RDI_DATA
}
while ( v6 );
}
*(_DWORD *)(gpu + 0x400084) |= 0x1000000u; // NV_PGRAPH_DEBUG_1_CACHE_INVALIDATE
v7 = (v4 & 0x1F) << 24;
*(_DWORD *)(gpu + 0x400148) = v7; // NV_PGRAPH_CTX_USER
*(_DWORD *)(gpu + 0x400784) = *((_DWORD *)v2 + a2 + 78) & 0xFFFF;// NV_PGRAPH_CHANNEL_CTX_POINTER_INST
*(_DWORD *)(gpu + 0x400788) = 1; // NV_PGRAPH_CHANNEL_CTX_STATUS_LOADED
D3D::CMiniport::HalGrIdle(v2);
*(_DWORD *)(gpu + 0x400148) = v7 | *(_DWORD *)(gpu + 0x400148) & 0xE0FFFFFF;// NV_PGRAPH_CTX_USER_CHID (inverted mask)
*(_DWORD *)(gpu + 0x400144) = 0x10010100u; // NV_PGRAPH_CTX_CONTROL_TIME_NOT_EXPIRED|NV_PGRAPH_CTX_CONTROL_CHID_VALID|NV_PGRAPH_CTX_CONTROL_DEVICE_ENABLED
v8 = gpu + 0x400764; // NV_PGRAPH_FFINTFC_ST2
result = *(_DWORD *)v8 & 0xCFFFFFFF; // NV_PGRAPH_FFINTFC_ST2_CHSWITCH_CLEAR&NV_PGRAPH_FFINTFC_ST2_FIFOHOLD_CLEAR
*(_DWORD *)v8 = result; // NV_PGRAPH_FFINTFC_ST2
}
return result;
}

int __thiscall D3D::CMiniport::HalGrUnloadChannelContext(void *this, int a2)
{
int result; // eax@1
int gpu; // esi@1

result = a2;
gpu = *(_DWORD *)this;
if ( a2 != 2 )
{
*(_DWORD *)(gpu + 0x400784) = *((_DWORD *)this + a2 + 78) & 0xFFFF;// NV_PGRAPH_CHANNEL_CTX_POINTER_INST
*(_DWORD *)(gpu + 0x400788) = 2; // NV_PGRAPH_CHANNEL_CTX_STATUS_UNLOADED
result = D3D::CMiniport::HalGrIdle(this);
*(_DWORD *)(gpu + 0x400144) = 0x10000000u; // NV_PGRAPH_CTX_CONTROL_DEVICE_ENABLED
}
return result;
}
</pre>
<pre>
int __thiscall D3D::CMiniport::HalFifoControlLoad(void *this)
{
int gpu; // esi@1
int result; // eax@1

gpu = *(_DWORD *)this;
*(_DWORD *)(*(_DWORD *)this + 12836) = 0xF0078u;
*(_DWORD *)(gpu + 0x2044) = 0x101FFFFu; // NV_PFIFO_DMA_TIMESLICE_SELECT_128K|NV_PFIFO_DMA_TIMESLICE_TIMEOUT_ENABLED
*(_DWORD *)(gpu + 0x2040) = *((_DWORD *)this + 72) & 0x3FF;// NV_PFIFO_DELAY_0_WAIT_RETRY
*(_DWORD *)(gpu + 0x2500) = 0; // NV_PFIFO_CACHES_ALL_DISABLE
*(_DWORD *)(gpu + 0x3000) = 0; // NV_PFIFO_CACHE0_PUSH0_ACCESS_DISABLE
*(_DWORD *)(gpu + 0x3050) = 0; // NV_PFIFO_CACHE0_PULL0_ACCESS_DISABLE
*(_DWORD *)(gpu + 0x3200) = 0; // NV_PFIFO_CACHE1_PUSH0_ACCESS_DISABLE
*(_DWORD *)(gpu + 0x3250) = 0; // NV_PFIFO_CACHE1_PULL0_ACCESS_DISABLE
*(_DWORD *)(gpu + 0x3220) = 0; // NV_PFIFO_CACHE1_DMA_PUSH_ACCESS_DISABLE
result = D3D::CMiniport::HalFifoContextSwitch(this, 1);
*(_DWORD *)(gpu + 0x3210) = 0; // NV_PFIFO_CACHE1_PUT_ADDRESS
*(_DWORD *)(gpu + 0x3270) = 0; // NV_PFIFO_CACHE1_GET_ADDRESS
*(_DWORD *)(gpu + 0x3250) = 1; // NV_PFIFO_CACHE1_PULL0_ACCESS_ENABLE
*(_DWORD *)(gpu + 0x3200) = 1; // NV_PFIFO_CACHE1_PUSH0_ACCESS_ENABLE
*(_DWORD *)(gpu + 0x2500) = 1; // NV_PFIFO_CACHES_REASSIGN_ENABLED
*(_DWORD *)(gpu + 0x2500) = 0; // NV_PFIFO_CACHES_ALL_DISABLE
return result;
}

int __thiscall D3D::CMiniport::HalFifoContextSwitch(void *this, int a2_switch)
{
void *v2; // esi@1
int gpu; // eax@1
int v4; // ebx@1
int v5; // ecx@1
int v6; // edx@1
int v7; // ecx@2
int v8; // edx@8
int v9; // [sp+Ch] [bp-14h]@1
int v10; // [sp+10h] [bp-10h]@1
int v11; // [sp+14h] [bp-Ch]@1
signed int v12; // [sp+1Ch] [bp-4h]@2

v2 = this;
gpu = *(_DWORD *)this;
v4 = *((_DWORD *)this + 74); // unknown1
v9 = *(_DWORD *)(*(_DWORD *)this + 9472);
v10 = *(_DWORD *)(*(_DWORD *)this + 12800);
v11 = *(_DWORD *)(*(_DWORD *)this + 12880);
*(_DWORD *)(*(_DWORD *)this + 9472) = 0;
*(_DWORD *)(gpu + 0x3200) = 0; // NV_PFIFO_CACHE1_PUSH0_ACCESS_DISABLE
*(_DWORD *)(gpu + 0x3250) = 0; // NV_PFIFO_CACHE1_PULL0_ACCESS_DISABLE
v5 = *(_DWORD *)(gpu + 0x3204) & 0x1F; // NV_PFIFO_CACHE1_PUSH1_CHID
v6 = gpu + v4 + ((*(_DWORD *)(gpu + 0x3204) & 0x1F) << 6);// unknown2
*(_DWORD *)v6 = *(_DWORD *)(gpu + 0x3240); // NV_PFIFO_CACHE1_DMA_PUT
*(_DWORD *)(v6 + 4) = *(_DWORD *)(gpu + 0x3244);// NV_PFIFO_CACHE1_DMA_GET
*(_DWORD *)(v6 + 8) = *(_DWORD *)(gpu + 0x3248);// NV_PFIFO_CACHE1_REF
*(_DWORD *)(v6 + 12) = *(_DWORD *)(gpu + 0x322C);// NV_PFIFO_CACHE1_DMA_INSTANCE
*(_DWORD *)(v6 + 16) = *(_DWORD *)(gpu + 0x3228);// NV_PFIFO_CACHE1_DMA_STATE
*(_DWORD *)(v6 + 20) = *(_DWORD *)(gpu + 0x3224);// NV_PFIFO_CACHE1_DMA_FETCH
*(_DWORD *)(v6 + 24) = *(_DWORD *)(gpu + 0x3280);// NV_PFIFO_CACHE1_ENGINE
*(_DWORD *)(v6 + 28) = *(_DWORD *)(gpu + 0x3254);// NV_PFIFO_CACHE1_PULL1
*(_DWORD *)(v6 + 32) = *(_DWORD *)(gpu + 0x3268);// NV_PFIFO_CACHE1_ACQUIRE_2
*(_DWORD *)(v6 + 36) = *(_DWORD *)(gpu + 0x3264);// NV_PFIFO_CACHE1_ACQUIRE_1
*(_DWORD *)(v6 + 40) = *(_DWORD *)(gpu + 0x3260);// NV_PFIFO_CACHE1_ACQUIRE_0
*(_DWORD *)(v6 + 44) = *(_DWORD *)(gpu + 0x326C);// NV_PFIFO_CACHE1_SEMAPHORE
*(_DWORD *)(v6 + 48) = *(_DWORD *)(gpu + 0x324C);// NV_PFIFO_CACHE1_DMA_SUBROUTINE
if ( *(_DWORD *)(gpu + 0x3204) & 0x100 ) // NV_PFIFO_CACHE1_PUSH1_MODE_DMA
{
v12 = 1 << v5;
v7 = *(_DWORD *)(gpu + 0x2508) & ~(1 << v5);// NV_PFIFO_DMA
if ( *(_DWORD *)(gpu + 0x3240) != *(_DWORD *)(gpu + 0x3244) )// NV_PFIFO_CACHE1_DMA_PUT != NV_PFIFO_CACHE1_DMA_GET
v7 |= v12;
*(_DWORD *)(gpu + 0x2508) = v7; // NV_PFIFO_DMA
}
*(_DWORD *)(gpu + 0x3204) = a2_switch & 0x1F; // NV_PFIFO_CACHE1_PUSH1_CHID
if ( (1 << a2_switch) & *((_DWORD *)v2 + 65) && a2_switch != 1 )
*(_DWORD *)(gpu + 0x3204) |= 0x100u; // NV_PFIFO_CACHE1_PUSH1_MODE_DMA
v8 = v4 + (a2_switch << 6) + gpu; // unknown3
*(_DWORD *)(gpu + 0x3240) = *(_DWORD *)v8; // NV_PFIFO_CACHE1_DMA_PUT
*(_DWORD *)(gpu + 0x3244) = *(_DWORD *)(v8 + 4);// NV_PFIFO_CACHE1_DMA_GET
*(_DWORD *)(gpu + 0x3248) = *(_DWORD *)(v8 + 8);// NV_PFIFO_CACHE1_REF
*(_DWORD *)(gpu + 0x322C) = *(_DWORD *)(v8 + 12);// NV_PFIFO_CACHE1_DMA_INSTANCE
*(_DWORD *)(gpu + 0x3228) = *(_DWORD *)(v8 + 16);// NV_PFIFO_CACHE1_DMA_STATE
*(_DWORD *)(gpu + 0x3224) = *(_DWORD *)(v8 + 20);// NV_PFIFO_CACHE1_DMA_FETCH
*(_DWORD *)(gpu + 0x3280) = *(_DWORD *)(v8 + 24);// NV_PFIFO_CACHE1_ENGINE
*(_DWORD *)(gpu + 0x3254) = *(_DWORD *)(v8 + 28);// NV_PFIFO_CACHE1_PULL1
*(_DWORD *)(gpu + 0x3268) = *(_DWORD *)(v8 + 32);// NV_PFIFO_CACHE1_ACQUIRE_2
*(_DWORD *)(gpu + 0x3264) = *(_DWORD *)(v8 + 36);// NV_PFIFO_CACHE1_ACQUIRE_1
*(_DWORD *)(gpu + 0x3260) = *(_DWORD *)(v8 + 40);// NV_PFIFO_CACHE1_ACQUIRE_0
*(_DWORD *)(gpu + 0x326C) = *(_DWORD *)(v8 + 44);// NV_PFIFO_CACHE1_SEMAPHORE
*(_DWORD *)(gpu + 0x324C) = *(_DWORD *)(v8 + 48);// NV_PFIFO_CACHE1_DMA_SUBROUTINE
if ( (1 << a2_switch) & *((_DWORD *)v2 + 65) && a2_switch != 1 )
*(_DWORD *)(gpu + 0x3220) = 1; // NV_PFIFO_CACHE1_DMA_PUSH_ACCESS_ENABLE
*(_DWORD *)(gpu + 0x204C) = 0x1FFFFFu; // NV_PFIFO_TIMESLICE_TIMER_EXPIRED
*(_DWORD *)(gpu + 0x3250) = v11; // NV_PFIFO_CACHE1_PULL0
*(_DWORD *)(gpu + 0x3200) = v10; // NV_PFIFO_CACHE1_PUSH0
*(_DWORD *)(gpu + 0x2500) = v9; // NV_PFIFO_CACHES
return gpu;
}
</pre>

CPU

2017-05-30T03:47:43Z

Haxar: A better reference for the Xbox processor.

XBE

2017-05-30T01:14:59Z

Haxar: Redirected page to Xbe

#REDIRECT [[Xbe]]

XBE

2017-05-30T01:13:05Z

Haxar: An XBE page already exists.

Xbe

2017-05-30T01:12:09Z

Haxar:

{{DISPLAYTITLE:XBE}}
XBE files (XBox Executable) are the main files that are executed in the Xbox System. In official games, these files are created by game developers, and then signed by Microsoft.

=== Title ID ===

A title ID is usually 2 ASCII letters for the publisher, followed by a u16 integer game number (Above 2000 for non-original Xbox games)

{| class=wikitable
! Publisher ID !! Name
|-
| AC || Acclaim Entertainment
|-
| AH || ARUSH Entertainment
|-
| AQ || Aqua System
|-
| AT || Atlus
|-
| AV || Activision
|-
| AY || Aspyr Media
|-
| BA || Bandai
|-
| BM || BAM! Entertainment
|-
| BR || Broccoli Co.
|-
| BS || Bethesda Softworks
|-
| BU || Bunkasha Co.
|-
| BV || Buena Vista Games
|-
| BW || BBC Multimedia
|-
| CC || Capcom
|-
| CK || Kemco Corporation {{citation needed|reason=Did they realy swapped the ASCII letters? is KC a curced acroniem in Japan? Just want to be sure its Kemco|date=May 2017}}
|-
| CM || Codemasters
|-
| CV || Crave Entertainment
|-
| DC || DreamCatcher Interactive
|-
| DX || Davilex
|-
| EA || Electronic Arts (EA)
|-
| EC || Encore inc
|-
| EL || Enlight Software
|-
| EM || Empire Interactive
|-
| ES || Eidos Interactive
|-
| FI || Fox Interactive
|-
| FS || From Software
|-
| GE || Genki Co.
|-
| GV || Groove Games
|-
| HE || Tru Blu (Entertainment division of Home Entertainment Suppliers)
|-
| HP || Hip games
|-
| HU || Hudson Soft
|-
| IA || Mad Catz Interactive
|-
| IF || Idea Factory
|-
| IG || Infogrames
|-
| IL || [[Interlex Corporation]]
|-
| IM || Imagine Media
|-
| IO || Ignition Entertainment
|-
| IP || Interplay Entertainment
|-
| IX || InXile Entertainment {{citation needed}}
|-
| JA || Jaleco
|-
| JW || JoWooD
|-
| KB || Kemco {{citation needed|reason=CK is also Kemco, is this a diferent subsidairy or country based? Just want to be sure its Kemco|date=May 2017}}
|-
| KI || Kids Station Inc. {{citation needed|reason=Games info page was in japanese, I dont read japanese. but this seemed very logicaly the publisher, can a japanese reader confirm?|date=May 2017}}
|-
| KN || Konami
|-
| KO || KOEI
|-
| KU || Kobi and/or GAE (formerly Global A Entertainment){{citation needed|reason=What name did the publisher use at the time of release?|date=May 2017}}
|-
| LA || LucasArts
|-
| LS || Black Bean Games (publishing arm of Leader S.p.A.)
|-
| MD || Metro3D
|-
| ME || Medix
|-
| MI || Microïds
|-
| MJ || Majesco Entertainment
|-
| MM || Myelin Media
|-
| MP || MediaQuest {{citation needed|reason=Where is the P? I dont trust my source yet... but seems close|date=May 2017}}
|-
| MS || Microsoft Game Studios
|-
| MW || Midway Games
|-
| MX || Empire Interactive {{citation needed|reason=What happend to the publisher, who published this game?|date=May 2017}}
|-
| NK || NewKidCo
|-
| NL || NovaLogic
|-
| NM || Namco
|-
| OX || Oxygen Interactive
|-
| PC || Playlogic Entertainment
|-
| PL || Phantagram Co., Ltd.
|-
| RA || Rage
|-
| SA || Sammy
|-
| SC || SCi Games
|-
| SE || SEGA
|-
| SN || SNK
|-
| SS || Simon & Schuster
|-
| SU || Success Corporation
|-
| SW || Swing! Deutschland
|-
| TA || Takara
|-
| TC || Tecmo
|-
| TD || The 3DO Company (or just 3DO)
|-
| TK || Takuyo
|-
| TM || TDK Mediactive
|-
| TQ || THQ
|-
| TS || Titus Interactive
|-
| TT || Take-Two Interactive Software
|-
| US || Ubisoft
|-
| VC || Victor Interactive Software
|-
| VN || Vivendi Universal (just took Interplays publishing rights) {{citation needed}}
|-
| VU || Vivendi Universal Games
|-
| VV || Vivendi Universal Games {{citation needed}}
|-
| WE || Wanadoo Edition
|-
| WR || Warner Bros. Interactive Entertainment {{citation needed}}
|-
| XI || XPEC Entertainment and Idea Factory
|-
| XK || ''Xbox kiosk disk?'' {{citation needed}}
|-
| XL || ''Xbox special bundled or live demo disk?'' {{citation needed}}
|-
| XM || Evolved Games {{citation needed|reason=Probably not, game "Malice"|date=May 2017}}
|-
| XP || XPEC Entertainment
|-
| YB || YBM Sisa (South-Korea)
|-
| ZD || Zushi Games (formerly Zoo Digital Publishing)
|}

The title ID seems to double the information from the [[Xbox Game Disc]] mastering code etched into the ring or readable from the DMI.
The game number is expressed in 3 decimal digits here which suggests that it will always be below 1000.

'''Examples''':

[[FIFA Soccer 2003]]:
* DMI and mastering code: EA02302E (Meaning: publisher EA, game number 023, version 02, region Europe)
* Title ID: {{FIXME}}

[[Halo: Combat Evolved]]:
* DMI and mastering code: MS00402A (Meaning: publisher Microsoft, game number 004, version 02, region America)
* Title ID: 4D530004 [MS-004]

[[Halo: Combat Evolved]]:
* DMI and mastering code: MS00404E (Meaning: publisher Microsoft, game number 004, version 04, region Europe)
* Title ID: 4D530004 [MS-004]

=== Sections ===

=== .text ===

The .text section contains all x86 subroutines to be executed by the [[CPU|processor]].

=== .rdata ===

The .rdata section contains the [[Kernel|kernel thunk table]]. The ordinals in the table are to be resolved to the kernel's actual calling routine, when loaded.

== Resources and links ==
* [http://www.caustik.com/cxbx/download/xbe.htm .XBE File Format 1.1]

User:Haxar/fastcall

2017-05-30T00:47:38Z

Haxar: Created page with "=== fastcall routines from rgrep === All kernel and library routines are '''stdcall''' unless noted otherwise: <pre> FASTCALL D3DDevice_SetRenderState_Deferred FASTCALL D3DDe..."

=== fastcall routines from rgrep ===

All kernel and library routines are '''stdcall''' unless noted otherwise:
<pre>
FASTCALL D3DDevice_SetRenderState_Deferred
FASTCALL D3DDevice_SetRenderState_Simple
FASTCALL D3DDevice_SetTextureState_Deferred
FASTCALL D3DDevice_SetVertexShaderConstant1
FASTCALL D3DDevice_SetVertexShaderConstant1Fast
FASTCALL D3DDevice_SetVertexShaderConstant4
FASTCALL D3DDevice_SetVertexShaderConstantNotInline
FASTCALL D3DDevice_SetVertexShaderConstantNotInlineFast
FASTCALL D3DDevice_SwitchTexture
FASTCALL DmProfileDpcDispatchNotifyCallback
FASTCALL DmProfileThreadSwitchNotifyCallback
FASTCALL ExAcquireFastMutex
FASTCALL ExAcquireFastMutexUnsafe
FASTCALL ExfInterlockedInsertTailList
FASTCALL ExfInterlockedRemoveHeadList
FASTCALL ExInterlockedAddLargeStatistic
FASTCALL ExInterlockedAddUlong
FASTCALL ExInterlockedCompareExchange64
FASTCALL ExInterlockedFlushSList
FASTCALL ExInterlockedInsertHeadList
FASTCALL ExInterlockedInsertTailList
FASTCALL ExInterlockedPopEntryList
FASTCALL ExInterlockedPopEntrySList
FASTCALL ExInterlockedPushEntryList
FASTCALL ExInterlockedPushEntrySList
FASTCALL ExInterlockedRemoveHeadList
FASTCALL ExReleaseFastMutex
FASTCALL ExReleaseFastMutexUnsafe
FASTCALL FlashReadMSR
FASTCALL FlashWriteMSR
FASTCALL fProcessBrainBoxData
FASTCALL FscSetCacheBufferProtection
FASTCALL GetTypeInformation
FASTCALL HalBeginClockInterrupt
FASTCALL HalBeginProfileInterrupt
FASTCALL HalBeginSMBusInterrupt
FASTCALL HalBeginSystemControlInterrupt
FASTCALL HalBeginSystemInterrupt
FASTCALL HalClearSoftwareInterrupt
FASTCALL HalEndSystemInterrupt
FASTCALL HalEndSystemLevelInterrupt
FASTCALL HalRequestSoftwareInterrupt
FASTCALL IdexCdRomStartCheckVerify
FASTCALL IdexCdRomStartEndSession
FASTCALL IdexCdRomStartGetDriveGeometry
FASTCALL IdexCdRomStartRawRead
FASTCALL IdexCdRomStartReadKey
FASTCALL IdexCdRomStartReadTOC
FASTCALL IdexCdRomStartScsiPassThrough
FASTCALL IdexCdRomStartSendKey
FASTCALL IdexCdRomStartSetSpindleSpeed
FASTCALL IdexCdRomStartStartSession
FASTCALL IdexChannelInvalidParameterRequest
FASTCALL IdexChannelPrepareBufferTransfer
FASTCALL IdexChannelSpinWhileBusy
FASTCALL IdexChannelSpinWhileBusyAndNotDrq
FASTCALL IdexDiskStartFlushBuffers
FASTCALL IdexDiskStartReadWrite
FASTCALL IdexDiskStartVerify
FASTCALL IdexMediaBoardStartReadWrite
FASTCALL InterlockedCompareExchange
FASTCALL InterlockedDecrement
FASTCALL InterlockedExchange
FASTCALL InterlockedExchangeAdd
FASTCALL InterlockedFlushSList
FASTCALL InterlockedIncrement
FASTCALL InterlockedPopEntrySList
FASTCALL InterlockedPushEntrySList
FASTCALL IofCallDriver
FASTCALL IofCompleteRequest
FASTCALL IopAcquireFileObjectLock
FASTCALL IopReleaseFileObjectLock
FASTCALL KeAcquireSpinLockRaiseToSynch
FASTCALL KefAcquireSpinLockAtDpcLevel
FASTCALL KefReleaseSpinLockFromDpcLevel
FASTCALL KfAcquireSpinLock
FASTCALL KfLowerIrql
FASTCALL KfRaiseIrql
FASTCALL KfReleaseSpinLock
FASTCALL KiAcquireSpinLock
FASTCALL KiActivateWaiterQueue
FASTCALL KiComputeWaitInterval
FASTCALL KiDpcDispatchNotify
FASTCALL KiFindReadyThread
FASTCALL KiInsertQueue
FASTCALL KiInsertQueueApc
FASTCALL KiInsertTimerTable
FASTCALL KiInsertTreeTimer
FASTCALL KiReadyThread
FASTCALL KiReinsertTreeTimer
FASTCALL KiReleaseSpinLock
FASTCALL KiSelectNextThread
FASTCALL KiSetPriorityThread
FASTCALL KiSwapThread
FASTCALL KiTimerListExpire
FASTCALL KiUnlockDispatcherDatabase
FASTCALL KiUnwaitThread
FASTCALL KiWaitSatisfyAll
FASTCALL KiWaitSatisfyAny
FASTCALL KiWaitSatisfyMutant
FASTCALL KiWaitSatisfyOther
FASTCALL KiWaitTest
FASTCALL MiDecodePteProtectionMask
FASTCALL MiGetFirstNode
FASTCALL MiGetNextNode
FASTCALL MiGetPreviousNode
FASTCALL MiInsertNode
FASTCALL MiInsertPageInFreeList
FASTCALL MiLocateAddress
FASTCALL MiLocateAddressInTree
FASTCALL MiMakePteProtectionMask
FASTCALL MiMakeSystemPteProtectionMask
FASTCALL MiReleasePageOwnership
FASTCALL MiRelocateBusyPage
FASTCALL MiRemoveAnyPage
FASTCALL MiRemoveAnyPageFromFreeList
FASTCALL MiRemoveDebuggerPage
FASTCALL MiRemoveNode
FASTCALL MiRemovePageFromFreeList
FASTCALL MiRemoveZeroPage
FASTCALL MiZeroAndFlushPtes
FASTCALL MU_fCbwTransfer
FASTCALL MU_fCloseEndpoints
FASTCALL MU_fCswTransfer
FASTCALL MU_fDataTransfer
FASTCALL MU_fDiskReadDriveCapacity
FASTCALL MU_fDiskReadWrite
FASTCALL MU_fDiskVerify
FASTCALL MU_fMarkWriteBufferCorrupt
FASTCALL MU_fMrbErrorHandler
FASTCALL MU_fStartMrb
FASTCALL MU_fValidateMrb
FASTCALL MU_fVscCommand
FASTCALL ObfDereferenceObject
FASTCALL ObfReferenceObject
FASTCALL ObpComputeHashIndex
FASTCALL OHCD_fAbortEndpoint
FASTCALL OHCD_fCancelQueuedUrbs
FASTCALL OHCD_fCleanEndpointTDs
FASTCALL OHCD_fCloseEndpoint
FASTCALL OHCD_fCompleteRequest
FASTCALL OHCD_fCreditTDQuota
FASTCALL OHCD_fDequeueBulkTransfer
FASTCALL OHCD_fDequeueControlTransfer
FASTCALL OHCD_fDequeueInterruptTransfer
FASTCALL OHCD_fGetEndpointState
FASTCALL OHCD_fGetTDsRequired
FASTCALL OHCD_fIsochAttachBuffer
FASTCALL OHCD_fIsochCloseEndpoint
FASTCALL OHCD_fIsochCompleteCloseEndpoint
FASTCALL OHCD_fIsochOpenEndpoint
FASTCALL OHCD_fIsochProcessTD
FASTCALL OHCD_fIsochStartTransfer
FASTCALL OHCD_fIsochStopTransfer
FASTCALL OHCD_fMapTransfer
FASTCALL OHCD_fOpenEndpoint
FASTCALL OHCD_fPauseEndpoint
FASTCALL OHCD_fPoolFindLostDoneHead
FASTCALL OHCD_fPoolInit
FASTCALL OHCD_fProcessAbortPendingList
FASTCALL OHCD_fProcessCancelPendingList
FASTCALL OHCD_fProcessClosePendingList
FASTCALL OHCD_fProcessDoneTD
FASTCALL OHCD_fProcessFailedTD
FASTCALL OHCD_fProgramBulkTransfer
FASTCALL OHCD_fProgramControlTransfer
FASTCALL OHCD_fProgramInterruptTransfer
FASTCALL OHCD_fProgramTransfer
FASTCALL OHCD_fQueueBulkTransfer
FASTCALL OHCD_fQueueControlTransfer
FASTCALL OHCD_fQueueInterruptTransfer
FASTCALL OHCD_fQueueTransferRequest
FASTCALL OHCD_fSetEndpointState
FASTCALL OHCD_fSetResources
FASTCALL OHCD_Get32BitFrameNumber
FASTCALL OHCD_HookNewEndpointToChildren
FASTCALL OHCD_ReverseBits
FASTCALL OHCD_RootHubInitialize
FASTCALL OHCD_RootHubProcessHotPlug
FASTCALL OHCD_RootHubProcessInterrupt
FASTCALL OHCD_ScheduleAddEndpointControlOrBulk
FASTCALL OHCD_ScheduleAddEndpointPeriodic
FASTCALL OHCD_ScheduleInitialize
FASTCALL OHCD_ScheduleRemoveEndpointControlOrBulk
FASTCALL OHCD_ScheduleRemoveEndpointPeriodic
FASTCALL PFMM
FASTCALL PFN_PROCESS_NEWDATA
FASTCALL PFOFSC
FASTCALL PFOFSTM
FASTCALL PFOFSTMED
FASTCALL PPROCESSOR_IDLE_FUNCTION
FASTCALL PPROCESSOR_IDLE_HANDLER
FASTCALL PSET_PROCESSOR_THROTTLE
FASTCALL PSWAP_CONTEXT_NOTIFY_ROUTINE
FASTCALL PTHREAD_SELECT_NOTIFY_ROUTINE
FASTCALL PTIME_UPDATE_NOTIFY_ROUTINE
FASTCALL RDMSR
FASTCALL RtlFindFirstSetRightMember
FASTCALL RtlpInterlockedPopEntrySList
FASTCALL RtlpInterlockedPushEntrySList
FASTCALL RtlUlongByteSwap
FASTCALL RtlUlonglongByteSwap
FASTCALL RtlUshortByteSwap
FASTCALL USBD_AllocateUsbAddress
FASTCALL USBD_fDeviceAbortEnum2
FASTCALL USBD_fDeviceEnumStage1
FASTCALL USBD_fDeviceEnumStage4
FASTCALL USBD_FreeUsbAddress
FASTCALL USBD_LoadClassDriver
FASTCALL VideoPortInterlockedDecrement
FASTCALL VideoPortInterlockedExchange
FASTCALL VideoPortInterlockedIncrement
FASTCALL XDCS_fCompleteRemove
FASTCALL XDCS_fCreateBufferEvents
FASTCALL XDCS_fDownloadFile
FASTCALL XDCS_fRandomBlock
FASTCALL XDCS_fVerifyFile
FASTCALL XID_fCloseDevice
FASTCALL XID_fCloseEndpoints
FASTCALL XID_fFindNode
FASTCALL XID_fOpenDevice
FASTCALL XID_fOpenEndpoints
FASTCALL XID_fOutputComplete1
FASTCALL XID_fRemoveDeviceComplete
FASTCALL XID_fSendDeviceReport
FASTCALL XID_ProcessGamepadData
FASTCALL XID_ProcessIRRemoteData
FASTCALL XID_ProcessNewKeyboardData
FASTCALL XProfpDpcDispatchNotifyCallback
FASTCALL XProfpThreadSwitchNotifyCallback
</pre>

User:Haxar

2017-05-30T00:41:03Z

Haxar: Created page with "=== GitHub === * [https://github.com/haxar/cxbx-shogun Cxbx w/ Wine support.] === R&D === * fastcall routines from rgrep"

=== GitHub ===

* [https://github.com/haxar/cxbx-shogun Cxbx w/ Wine support.]

=== R&D ===

* [[User:Haxar/fastcall|fastcall routines from rgrep]]

Main Page

2017-05-30T00:04:11Z

Haxar: /* System Software */

{{:Main Page/Header}}

== Hardware ==

* [[Chihiro]]
* [[Xbox]]

* [[Hardware Revisions]]
* [[Motherboard]]
* [[CPU|CPU (Custom Pentium 3 733 MHz)]]
* [[NV2A]]
** [[NV2A/Vertex attributes]]
** [[NV2A/Fixed Function Pipeline]]
** [[NV2A/Vertex Shader]]
** [[NV2A/Pixel Combiner]]
** [[NV2A/Surface Formats]]
* [[DSP]]
* [[Memory]]
* [[Flash]]
* [[MCPX]]
* [[EEPROM]]
* [[SMC]]
* [[Video Encoder]]
* [[NVNet|Network Controller (NVNet)]]
* [[DVD Drive]]
** [[Xbox Game Disc]]
* [[Hard Drive]]
* [[USB]]
** [[Xbox Input Devices]]
* [[Power Supply]]

== System Software ==
* [[MCPX ROM]]
* [[BIOS]] / [[Kernel]]
** [[Boot Process]]
** [[XBE]] (Executable file format)
* [[FATX]] (Filesystem)
* [[Dashboard]]
* [[Exploits]]

== Development Kits and Tools ==
* [https://github.com/xqemu/nxdk NXDK (New Xbox Development Kit)]
* [[OpenXDK]]
* [[Microsoft XDK]]
** [[Xbox Debug Monitor]]
** [[Xbox Neighborhood]]

== Games ==
* [[:Category:Games|Games]]
* [[Engine List]]

== Emulation ==
* [[Emulators]]

== Other ==
* [[Network]]
* Find random stuff in [[Resources]]

XBE

2017-05-30T00:01:29Z

Haxar: Created page with "=== .text === The .text section contains all x86 subroutines to be executed by the processor. === .rdata === The .rdata section contains the Kernel|kernel thunk t..."

=== .text ===

The .text section contains all x86 subroutines to be executed by the [[CPU|processor]].

=== .rdata ===

The .rdata section contains the [[Kernel|kernel thunk table]]. The ordinals in the table are to be resolved to the kernel's actual calling routine, when loaded.

Kernel

2017-05-29T23:52:42Z

Haxar: Undo revision 5551: whoops... should go to the XBE page

The Xbox kernel is called xboxkrnl.exe. It is closely related to the Windows NT [[Wikipedia:Ntoskrnl.exe|ntoskrnl.exe]].
Its image base address is always 0x80010000.

== Header modifications ==

xboxkrnl.exe is a mostly standard exe file.
However, the MS-DOS header was patched to contain Xbox specific data in the reserved 20 byte block starting at offset 40:

{| class=wikitable
! Offset !! Meaning
|-
|40 || Size of uninitialized portion of the .data section
|-
|44 || Size of initialized portion of the .data section
|-
|48 || Memory address of initialized portion of the .data section (usually in [[Flash]]). <br> Used to re-initialize the data section pointed to by the next field. <br> Note that the pointer might be invalid during normal execution as the Flash might not be mapped at all times.
|-
|52 || Memory address where the .data section is stored (usually the same as in the section header + image base).
|}

== Sections ==

All sections are identity mapped (meaning file offsets and offsets in RAM match). This is because the kernel is not loaded through a traditional PE / exe loader, but just unpacked into memory.

=== .text ===

The .text section contains the kernel exports.

=== .data ===

The .data section stores initialized and uninitialized data.
A copy of the initialized portion of this section is usually stored in the [[BIOS]].

=== STICKY ===

Stores variables which must be preserved across a quick-reboot.

=== IDEXPRDT ===

A Physical Region Descriptor Table (PRDT) for the IDE bus. This section serves as a memory allocation only, it does not have to be initialized when loading the kernel{{citation needed}}.

=== INIT ===

This section is always the last one. It contains the entrypoint of the kernel.
Later kernels{{FIXME|reason=Which revision?}} will discard this section after initialization.

== Kernel exports ==
{| class="wikitable"
|+Kernel exports
|-
!Name
!Ordinal
!Calling Convention
!Notes
|-
|[[Kernel/AvGetSavedDataAddress]]
|1
|stdcall
|
|-
|[[Kernel/AvSendTVEncoderOption]]
|2
|stdcall
|
|-
|[[Kernel/AvSetDisplayMode]]
|3
|stdcall
|
|-
|[[Kernel/AvSetSavedDataAddress]]
|4
|stdcall
|
|-
|[[Kernel/DbgBreakPoint]]
|5
|stdcall
|
|-
|[[Kernel/DbgBreakPointWithStatus]]
|6
|stdcall
|
|-
|[[Kernel/DbgLoadImageSymbols]]
|7
|stdcall
|Devkits only!
|-
|[[Kernel/DbgPrint]]
|8
|stdcall
|
|-
|[[Kernel/HalReadSMCTrayState]]
|9
|stdcall
|
|-
|[[Kernel/DbgPrompt]]
|10
|stdcall
|
|-
|[[Kernel/DbgUnLoadImageSymbols]]
|11
|stdcall
|Devkits only!
|-
|[[Kernel/ExAcquireReadWriteLockExclusive]]
|12
|stdcall
|
|-
|[[Kernel/ExAcquireReadWriteLockShared]]
|13
|stdcall
|
|-
|[[Kernel/ExAllocatePool]]
|14
|stdcall
|
|-
|[[Kernel/ExAllocatePoolWithTag]]
|15
|stdcall
|
|-
|[[Kernel/ExEventObjectType]]
|16
|stdcall
|Variable?
|-
|[[Kernel/ExFreePool]]
|17
|stdcall
|
|-
|[[Kernel/ExInitializeReadWriteLock]]
|18
|stdcall
|
|-
|[[Kernel/ExInterlockedAddLargeInteger]]
|19
|stdcall
|
|-
|[[Kernel/ExInterlockedAddLargeStatistic]]
|20
|fastcall
|
|-
|[[Kernel/ExInterlockedCompareExchange64]]
|21
|fastcall
|
|-
|[[Kernel/ExMutantObjectType]]
|22
|stdcall
|Variable?
|-
|[[Kernel/ExQueryPoolBlockSize]]
|23
|stdcall
|
|-
|[[Kernel/ExQueryNonVolatileSetting]]
|24
|stdcall
|
|-
|[[Kernel/ExReadWriteRefurbInfo]]
|25
|stdcall
|
|-
|[[Kernel/ExRaiseException]]
|26
|stdcall
|
|-
|[[Kernel/ExRaiseStatus]]
|27
|stdcall
|
|-
|[[Kernel/ExReleaseReadWriteLock]]
|28
|stdcall
|
|-
|[[Kernel/ExSaveNonVolatileSetting]]
|29
|stdcall
|
|-
|[[Kernel/ExSemaphoreObjectType]]
|30
|stdcall
|Variable?
|-
|[[Kernel/ExTimerObjectType]]
|31
|stdcall
|Variable?
|-
|[[Kernel/ExfInterlockedInsertHeadList]]
|32
|stdcall
|
|-
|[[Kernel/ExfInterlockedInsertTailList]]
|33
|fastcall
|
|-
|[[Kernel/ExfInterlockedRemoveHeadList]]
|34
|fastcall
|
|-
|[[Kernel/FscGetCacheSize]]
|35
|stdcall
|
|-
|[[Kernel/FscInvalidateIdleBlocks]]
|36
|stdcall
|
|-
|[[Kernel/FscSetCacheSize]]
|37
|stdcall
|
|-
|[[Kernel/HalClearSoftwareInterrupt]]
|38
|fastcall
|
|-
|[[Kernel/HalDisableSystemInterrupt]]
|39
|stdcall
|
|-
|[[Kernel/HalDiskCachePartitionCount]]
|40
|stdcall
|Variable?
|-
|[[Kernel/HalDiskModelNumber]]
|41
|stdcall
|Variable?
|-
|[[Kernel/HalDiskSerialNumber]]
|42
|stdcall
|Variable?
|-
|[[Kernel/HalEnableSystemInterrupt]]
|43
|stdcall
|
|-
|[[Kernel/HalGetInterruptVector]]
|44
|stdcall
|
|-
|[[Kernel/HalReadSMBusValue]]
|45
|stdcall
|
|-
|[[Kernel/HalReadWritePCISpace]]
|46
|stdcall
|
|-
|[[Kernel/HalRegisterShutdownNotification]]
|47
|stdcall
|
|-
|[[Kernel/HalRequestSoftwareInterrupt]]
|48
|fastcall
|
|-
|[[Kernel/HalReturnToFirmware]]
|49
|stdcall
|
|-
|[[Kernel/HalWriteSMBusValue]]
|50
|stdcall
|
|-
|[[Kernel/InterlockedCompareExchange]]
|51
|fastcall
|
|-
|[[Kernel/InterlockedDecrement]]
|52
|fastcall
|
|-
|[[Kernel/InterlockedIncrement]]
|53
|fastcall
|
|-
|[[Kernel/InterlockedExchange]]
|54
|fastcall
|
|-
|[[Kernel/InterlockedExchangeAdd]]
|55
|fastcall
|
|-
|[[Kernel/InterlockedFlushSList]]
|56
|fastcall
|
|-
|[[Kernel/InterlockedPopEntrySList]]
|57
|fastcall
|
|-
|[[Kernel/InterlockedPushEntrySList]]
|58
|fastcall
|
|-
|[[Kernel/IoAllocateIrp]]
|59
|stdcall
|
|-
|[[Kernel/IoBuildAsynchronousFsdRequest]]
|60
|stdcall
|
|-
|[[Kernel/IoBuildDeviceIoControlRequest]]
|61
|stdcall
|
|-
|[[Kernel/IoBuildSynchronousFsdRequest]]
|62
|stdcall
|
|-
|[[Kernel/IoCheckShareAccess]]
|63
|stdcall
|
|-
|[[Kernel/IoCompletionObjectType]]
|64
|stdcall
|Variable?
|-
|[[Kernel/IoCreateDevice]]
|65
|stdcall
|
|-
|[[Kernel/IoCreateFile]]
|66
|stdcall
|
|-
|[[Kernel/IoCreateSymbolicLink]]
|67
|stdcall
|
|-
|[[Kernel/IoDeleteDevice]]
|68
|stdcall
|
|-
|[[Kernel/IoDeleteSymbolicLink]]
|69
|stdcall
|
|-
|[[Kernel/IoDeviceObjectType]]
|70
|stdcall
|Variable?
|-
|[[Kernel/IoFileObjectType]]
|71
|stdcall
|Variable?
|-
|[[Kernel/IoFreeIrp]]
|72
|stdcall
|
|-
|[[Kernel/IoInitializeIrp]]
|73
|stdcall
|
|-
|[[Kernel/IoInvalidDeviceRequest]]
|74
|stdcall
|
|-
|[[Kernel/IoQueryFileInformation]]
|75
|stdcall
|
|-
|[[Kernel/IoQueryVolumeInformation]]
|76
|stdcall
|
|-
|[[Kernel/IoQueueThreadIrp]]
|77
|stdcall
|
|-
|[[Kernel/IoRemoveShareAccess]]
|78
|stdcall
|
|-
|[[Kernel/IoSetIoCompletion]]
|79
|stdcall
|
|-
|[[Kernel/IoSetShareAccess]]
|80
|stdcall
|
|-
|[[Kernel/IoStartNextPacket]]
|81
|stdcall
|
|-
|[[Kernel/IoStartNextPacketByKey]]
|82
|stdcall
|
|-
|[[Kernel/IoStartPacket]]
|83
|stdcall
|
|-
|[[Kernel/IoSynchronousDeviceIoControlRequest]]
|84
|stdcall
|
|-
|[[Kernel/IoSynchronousFsdRequest]]
|85
|stdcall
|
|-
|[[Kernel/IofCallDriver]]
|86
|fastcall
|
|-
|[[Kernel/IofCompleteRequest]]
|87
|fastcall
|
|-
|[[Kernel/KdDebuggerEnabled]]
|88
|stdcall
|Variable?
|-
|[[Kernel/KdDebuggerNotPresent]]
|89
|stdcall
|Variable?
|-
|[[Kernel/IoDismountVolume]]
|90
|stdcall
|
|-
|[[Kernel/IoDismountVolumeByName]]
|91
|stdcall
|
|-
|[[Kernel/KeAlertResumeThread]]
|92
|stdcall
|
|-
|[[Kernel/KeAlertThread]]
|93
|stdcall
|
|-
|[[Kernel/KeBoostPriorityThread]]
|94
|stdcall
|
|-
|[[Kernel/KeBugCheck]]
|95
|stdcall
|
|-
|[[Kernel/KeBugCheckEx]]
|96
|stdcall
|
|-
|[[Kernel/KeCancelTimer]]
|97
|stdcall
|
|-
|[[Kernel/KeConnectInterrupt]]
|98
|stdcall
|
|-
|[[Kernel/KeDelayExecutionThread]]
|99
|stdcall
|
|-
|[[Kernel/KeDisconnectInterrupt]]
|100
|stdcall
|
|-
|[[Kernel/KeEnterCriticalRegion]]
|101
|stdcall
|
|-
|[[Kernel/MmGlobalData]]
|102
|stdcall
|Variable?
|-
|[[Kernel/KeGetCurrentIrql]]
|103
|stdcall
|
|-
|[[Kernel/KeGetCurrentThread]]
|104
|stdcall
|
|-
|[[Kernel/KeInitializeApc]]
|105
|stdcall
|
|-
|[[Kernel/KeInitializeDeviceQueue]]
|106
|stdcall
|
|-
|[[Kernel/KeInitializeDpc]]
|107
|stdcall
|
|-
|[[Kernel/KeInitializeEvent]]
|108
|stdcall
|
|-
|[[Kernel/KeInitializeInterrupt]]
|109
|stdcall
|
|-
|[[Kernel/KeInitializeMutant]]
|110
|stdcall
|
|-
|[[Kernel/KeInitializeQueue]]
|111
|stdcall
|
|-
|[[Kernel/KeInitializeSemaphore]]
|112
|stdcall
|
|-
|[[Kernel/KeInitializeTimerEx]]
|113
|stdcall
|
|-
|[[Kernel/KeInsertByKeyDeviceQueue]]
|114
|stdcall
|
|-
|[[Kernel/KeInsertDeviceQueue]]
|115
|stdcall
|
|-
|[[Kernel/KeInsertHeadQueue]]
|116
|stdcall
|
|-
|[[Kernel/KeInsertQueue]]
|117
|stdcall
|
|-
|[[Kernel/KeInsertQueueApc]]
|118
|stdcall
|
|-
|[[Kernel/KeInsertQueueDpc]]
|119
|stdcall
|
|-
|[[Kernel/KeInterruptTime]]
|120
|stdcall
|Variable?
|-
|[[Kernel/KeIsExecutingDpc]]
|121
|stdcall
|
|-
|[[Kernel/KeLeaveCriticalRegion]]
|122
|stdcall
|
|-
|[[Kernel/KePulseEvent]]
|123
|stdcall
|
|-
|[[Kernel/KeQueryBasePriorityThread]]
|124
|stdcall
|
|-
|[[Kernel/KeQueryInterruptTime]]
|125
|stdcall
|
|-
|[[Kernel/KeQueryPerformanceCounter]]
|126
|stdcall
|
|-
|[[Kernel/KeQueryPerformanceFrequency]]
|127
|stdcall
|
|-
|[[Kernel/KeQuerySystemTime]]
|128
|stdcall
|
|-
|[[Kernel/KeRaiseIrqlToDpcLevel]]
|129
|stdcall
|
|-
|[[Kernel/KeRaiseIrqlToSynchLevel]]
|130
|stdcall
|
|-
|[[Kernel/KeReleaseMutant]]
|131
|stdcall
|
|-
|[[Kernel/KeReleaseSemaphore]]
|132
|stdcall
|
|-
|[[Kernel/KeRemoveByKeyDeviceQueue]]
|133
|stdcall
|
|-
|[[Kernel/KeRemoveDeviceQueue]]
|134
|stdcall
|
|-
|[[Kernel/KeRemoveEntryDeviceQueue]]
|135
|stdcall
|
|-
|[[Kernel/KeRemoveQueue]]
|136
|stdcall
|
|-
|[[Kernel/KeRemoveQueueDpc]]
|137
|stdcall
|
|-
|[[Kernel/KeResetEvent]]
|138
|stdcall
|
|-
|[[Kernel/KeRestoreFloatingPointState]]
|139
|stdcall
|
|-
|[[Kernel/KeResumeThread]]
|140
|stdcall
|
|-
|[[Kernel/KeRundownQueue]]
|141
|stdcall
|
|-
|[[Kernel/KeSaveFloatingPointState]]
|142
|stdcall
|
|-
|[[Kernel/KeSetBasePriorityThread]]
|143
|stdcall
|
|-
|[[Kernel/KeSetDisableBoostThread]]
|144
|stdcall
|
|-
|[[Kernel/KeSetEvent]]
|145
|stdcall
|
|-
|[[Kernel/KeSetEventBoostPriority]]
|146
|stdcall
|
|-
|[[Kernel/KeSetPriorityProcess]]
|147
|stdcall
|
|-
|[[Kernel/KeSetPriorityThread]]
|148
|stdcall
|
|-
|[[Kernel/KeSetTimer]]
|149
|stdcall
|
|-
|[[Kernel/KeSetTimerEx]]
|150
|stdcall
|
|-
|[[Kernel/KeStallExecutionProcessor]]
|151
|stdcall
|
|-
|[[Kernel/KeSuspendThread]]
|152
|stdcall
|
|-
|[[Kernel/KeSynchronizeExecution]]
|153
|stdcall
|
|-
|[[Kernel/KeSystemTime]]
|154
|stdcall
|Variable?
|-
|[[Kernel/KeTestAlertThread]]
|155
|stdcall
|
|-
|[[Kernel/KeTickCount]]
|156
|stdcall
|Variable?
|-
|[[Kernel/KeTimeIncrement]]
|157
|stdcall
|Variable?
|-
|[[Kernel/KeWaitForMultipleObjects]]
|158
|stdcall
|
|-
|[[Kernel/KeWaitForSingleObject]]
|159
|stdcall
|
|-
|[[Kernel/KfRaiseIrql]]
|160
|fastcall
|
|-
|[[Kernel/KfLowerIrql]]
|161
|fastcall
|
|-
|[[Kernel/KiBugCheckData]]
|162
|stdcall
|Variable?
|-
|[[Kernel/KiUnlockDispatcherDatabase]]
|163
|fastcall
|
|-
|[[Kernel/LaunchDataPage]]
|164
|stdcall
|Variable?
|-
|[[Kernel/MmAllocateContiguousMemory]]
|165
|stdcall
|
|-
|[[Kernel/MmAllocateContiguousMemoryEx]]
|166
|stdcall
|
|-
|[[Kernel/MmAllocateSystemMemory]]
|167
|stdcall
|
|-
|[[Kernel/MmClaimGpuInstanceMemory]]
|168
|stdcall
|
|-
|[[Kernel/MmCreateKernelStack]]
|169
|stdcall
|
|-
|[[Kernel/MmDeleteKernelStack]]
|170
|stdcall
|
|-
|[[Kernel/MmFreeContiguousMemory]]
|171
|stdcall
|
|-
|[[Kernel/MmFreeSystemMemory]]
|172
|stdcall
|
|-
|[[Kernel/MmGetPhysicalAddress]]
|173
|stdcall
|
|-
|[[Kernel/MmIsAddressValid]]
|174
|stdcall
|
|-
|[[Kernel/MmLockUnlockBufferPages]]
|175
|stdcall
|
|-
|[[Kernel/MmLockUnlockPhysicalPage]]
|176
|stdcall
|
|-
|[[Kernel/MmMapIoSpace]]
|177
|stdcall
|
|-
|[[Kernel/MmPersistContiguousMemory]]
|178
|stdcall
|
|-
|[[Kernel/MmQueryAddressProtect]]
|179
|stdcall
|
|-
|[[Kernel/MmQueryAllocationSize]]
|180
|stdcall
|
|-
|[[Kernel/MmQueryStatistics]]
|181
|stdcall
|
|-
|[[Kernel/MmSetAddressProtect]]
|182
|stdcall
|
|-
|[[Kernel/MmUnmapIoSpace]]
|183
|stdcall
|
|-
|[[Kernel/NtAllocateVirtualMemory]]
|184
|stdcall
|
|-
|[[Kernel/NtCancelTimer]]
|185
|stdcall
|
|-
|[[Kernel/NtClearEvent]]
|186
|stdcall
|
|-
|[[Kernel/NtClose]]
|187
|stdcall
|
|-
|[[Kernel/NtCreateDirectoryObject]]
|188
|stdcall
|
|-
|[[Kernel/NtCreateEvent]]
|189
|stdcall
|
|-
|[[Kernel/NtCreateFile]]
|190
|stdcall
|
|-
|[[Kernel/NtCreateIoCompletion]]
|191
|stdcall
|
|-
|[[Kernel/NtCreateMutant]]
|192
|stdcall
|
|-
|[[Kernel/NtCreateSemaphore]]
|193
|stdcall
|
|-
|[[Kernel/NtCreateTimer]]
|194
|stdcall
|
|-
|[[Kernel/NtDeleteFile]]
|195
|stdcall
|
|-
|[[Kernel/NtDeviceIoControlFile]]
|196
|stdcall
|
|-
|[[Kernel/NtDuplicateObject]]
|197
|stdcall
|
|-
|[[Kernel/NtFlushBuffersFile]]
|198
|stdcall
|
|-
|[[Kernel/NtFreeVirtualMemory]]
|199
|stdcall
|
|-
|[[Kernel/NtFsControlFile]]
|200
|stdcall
|
|-
|[[Kernel/NtOpenDirectoryObject]]
|201
|stdcall
|
|-
|[[Kernel/NtOpenFile]]
|202
|stdcall
|
|-
|[[Kernel/NtOpenSymbolicLinkObject]]
|203
|stdcall
|
|-
|[[Kernel/NtProtectVirtualMemory]]
|204
|stdcall
|
|-
|[[Kernel/NtPulseEvent]]
|205
|stdcall
|
|-
|[[Kernel/NtQueueApcThread]]
|206
|stdcall
|
|-
|[[Kernel/NtQueryDirectoryFile]]
|207
|stdcall
|
|-
|[[Kernel/NtQueryDirectoryObject]]
|208
|stdcall
|
|-
|[[Kernel/NtQueryEvent]]
|209
|stdcall
|
|-
|[[Kernel/NtQueryFullAttributesFile]]
|210
|stdcall
|
|-
|[[Kernel/NtQueryInformationFile]]
|211
|stdcall
|
|-
|[[Kernel/NtQueryIoCompletion]]
|212
|stdcall
|
|-
|[[Kernel/NtQueryMutant]]
|213
|stdcall
|
|-
|[[Kernel/NtQuerySemaphore]]
|214
|stdcall
|
|-
|[[Kernel/NtQuerySymbolicLinkObject]]
|215
|stdcall
|
|-
|[[Kernel/NtQueryTimer]]
|216
|stdcall
|
|-
|[[Kernel/NtQueryVirtualMemory]]
|217
|stdcall
|
|-
|[[Kernel/NtQueryVolumeInformationFile]]
|218
|stdcall
|
|-
|[[Kernel/NtReadFile]]
|219
|stdcall
|
|-
|[[Kernel/NtReadFileScatter]]
|220
|stdcall
|
|-
|[[Kernel/NtReleaseMutant]]
|221
|stdcall
|
|-
|[[Kernel/NtReleaseSemaphore]]
|222
|stdcall
|
|-
|[[Kernel/NtRemoveIoCompletion]]
|223
|stdcall
|
|-
|[[Kernel/NtResumeThread]]
|224
|stdcall
|
|-
|[[Kernel/NtSetEvent]]
|225
|stdcall
|
|-
|[[Kernel/NtSetInformationFile]]
|226
|stdcall
|
|-
|[[Kernel/NtSetIoCompletion]]
|227
|stdcall
|
|-
|[[Kernel/NtSetSystemTime]]
|228
|stdcall
|
|-
|[[Kernel/NtSetTimerEx]]
|229
|stdcall
|
|-
|[[Kernel/NtSignalAndWaitForSingleObjectEx]]
|230
|stdcall
|
|-
|[[Kernel/NtSuspendThread]]
|231
|stdcall
|
|-
|[[Kernel/NtUserIoApcDispatcher]]
|232
|stdcall
|
|-
|[[Kernel/NtWaitForSingleObject]]
|233
|stdcall
|
|-
|[[Kernel/NtWaitForSingleObjectEx]]
|234
|stdcall
|
|-
|[[Kernel/NtWaitForMultipleObjectsEx]]
|235
|stdcall
|
|-
|[[Kernel/NtWriteFile]]
|236
|stdcall
|
|-
|[[Kernel/NtWriteFileGather]]
|237
|stdcall
|
|-
|[[Kernel/NtYieldExecution]]
|238
|stdcall
|
|-
|[[Kernel/ObCreateObject]]
|239
|stdcall
|
|-
|[[Kernel/ObDirectoryObjectType]]
|240
|stdcall
|Variable?
|-
|[[Kernel/ObInsertObject]]
|241
|stdcall
|
|-
|[[Kernel/ObMakeTemporaryObject]]
|242
|stdcall
|
|-
|[[Kernel/ObOpenObjectByName]]
|243
|stdcall
|
|-
|[[Kernel/ObOpenObjectByPointer]]
|244
|stdcall
|
|-
|[[Kernel/ObpObjectHandleTable]]
|245
|stdcall
|Variable?
|-
|[[Kernel/ObReferenceObjectByHandle]]
|246
|stdcall
|
|-
|[[Kernel/ObReferenceObjectByName]]
|247
|stdcall
|
|-
|[[Kernel/ObReferenceObjectByPointer]]
|248
|stdcall
|
|-
|[[Kernel/ObSymbolicLinkObjectType]]
|249
|stdcall
|Variable?
|-
|[[Kernel/ObfDereferenceObject]]
|250
|fastcall
|
|-
|[[Kernel/ObfReferenceObject]]
|251
|fastcall
|
|-
|[[Kernel/PhyGetLinkState]]
|252
|stdcall
|
|-
|[[Kernel/PhyInitialize]]
|253
|stdcall
|
|-
|[[Kernel/PsCreateSystemThread]]
|254
|stdcall
|
|-
|[[Kernel/PsCreateSystemThreadEx]]
|255
|stdcall
|
|-
|[[Kernel/PsQueryStatistics]]
|256
|stdcall
|
|-
|[[Kernel/PsSetCreateThreadNotifyRoutine]]
|257
|stdcall
|
|-
|[[Kernel/PsTerminateSystemThread]]
|258
|stdcall
|
|-
|[[Kernel/PsThreadObjectType]]
|259
|stdcall
|Variable?
|-
|[[Kernel/RtlAnsiStringToUnicodeString]]
|260
|stdcall
|
|-
|[[Kernel/RtlAppendStringToString]]
|261
|stdcall
|
|-
|[[Kernel/RtlAppendUnicodeStringToString]]
|262
|stdcall
|
|-
|[[Kernel/RtlAppendUnicodeToString]]
|263
|stdcall
|
|-
|[[Kernel/RtlAssert]]
|264
|stdcall
|
|-
|[[Kernel/RtlCaptureContext]]
|265
|stdcall
|
|-
|[[Kernel/RtlCaptureStackBackTrace]]
|266
|stdcall
|
|-
|[[Kernel/RtlCharToInteger]]
|267
|stdcall
|
|-
|[[Kernel/RtlCompareMemory]]
|268
|stdcall
|
|-
|[[Kernel/RtlCompareMemoryUlong]]
|269
|stdcall
|
|-
|[[Kernel/RtlCompareString]]
|270
|stdcall
|
|-
|[[Kernel/RtlCompareUnicodeString]]
|271
|stdcall
|
|-
|[[Kernel/RtlCopyString]]
|272
|stdcall
|
|-
|[[Kernel/RtlCopyUnicodeString]]
|273
|stdcall
|
|-
|[[Kernel/RtlCreateUnicodeString]]
|274
|stdcall
|
|-
|[[Kernel/RtlDowncaseUnicodeChar]]
|275
|stdcall
|
|-
|[[Kernel/RtlDowncaseUnicodeString]]
|276
|stdcall
|
|-
|[[Kernel/RtlEnterCriticalSection]]
|277
|stdcall
|
|-
|[[Kernel/RtlEnterCriticalSectionAndRegion]]
|278
|stdcall
|
|-
|[[Kernel/RtlEqualString]]
|279
|stdcall
|
|-
|[[Kernel/RtlEqualUnicodeString]]
|280
|stdcall
|
|-
|[[Kernel/RtlExtendedIntegerMultiply]]
|281
|stdcall
|
|-
|[[Kernel/RtlExtendedLargeIntegerDivide]]
|282
|stdcall
|
|-
|[[Kernel/RtlExtendedMagicDivide]]
|283
|stdcall
|
|-
|[[Kernel/RtlFillMemory]]
|284
|stdcall
|
|-
|[[Kernel/RtlFillMemoryUlong]]
|285
|stdcall
|
|-
|[[Kernel/RtlFreeAnsiString]]
|286
|stdcall
|
|-
|[[Kernel/RtlFreeUnicodeString]]
|287
|stdcall
|
|-
|[[Kernel/RtlGetCallersAddress]]
|288
|stdcall
|
|-
|[[Kernel/RtlInitAnsiString]]
|289
|stdcall
|
|-
|[[Kernel/RtlInitUnicodeString]]
|290
|stdcall
|
|-
|[[Kernel/RtlInitializeCriticalSection]]
|291
|stdcall
|
|-
|[[Kernel/RtlIntegerToChar]]
|292
|stdcall
|
|-
|[[Kernel/RtlIntegerToUnicodeString]]
|293
|stdcall
|
|-
|[[Kernel/RtlLeaveCriticalSection]]
|294
|stdcall
|
|-
|[[Kernel/RtlLeaveCriticalSectionAndRegion]]
|295
|stdcall
|
|-
|[[Kernel/RtlLowerChar]]
|296
|stdcall
|
|-
|[[Kernel/RtlMapGenericMask]]
|297
|stdcall
|
|-
|[[Kernel/RtlMoveMemory]]
|298
|stdcall
|
|-
|[[Kernel/RtlMultiByteToUnicodeN]]
|299
|stdcall
|
|-
|[[Kernel/RtlMultiByteToUnicodeSize]]
|300
|stdcall
|
|-
|[[Kernel/RtlNtStatusToDosError]]
|301
|stdcall
|
|-
|[[Kernel/RtlRaiseException]]
|302
|stdcall
|
|-
|[[Kernel/RtlRaiseStatus]]
|303
|stdcall
|
|-
|[[Kernel/RtlTimeFieldsToTime]]
|304
|stdcall
|
|-
|[[Kernel/RtlTimeToTimeFields]]
|305
|stdcall
|
|-
|[[Kernel/RtlTryEnterCriticalSection]]
|306
|stdcall
|
|-
|[[Kernel/RtlUlongByteSwap]]
|307
|fastcall
|
|-
|[[Kernel/RtlUnicodeStringToAnsiString]]
|308
|stdcall
|
|-
|[[Kernel/RtlUnicodeStringToInteger]]
|309
|stdcall
|
|-
|[[Kernel/RtlUnicodeToMultiByteN]]
|310
|stdcall
|
|-
|[[Kernel/RtlUnicodeToMultiByteSize]]
|311
|stdcall
|
|-
|[[Kernel/RtlUnwind]]
|312
|stdcall
|
|-
|[[Kernel/RtlUpcaseUnicodeChar]]
|313
|stdcall
|
|-
|[[Kernel/RtlUpcaseUnicodeString]]
|314
|stdcall
|
|-
|[[Kernel/RtlUpcaseUnicodeToMultiByteN]]
|315
|stdcall
|
|-
|[[Kernel/RtlUpperChar]]
|316
|stdcall
|
|-
|[[Kernel/RtlUpperString]]
|317
|stdcall
|
|-
|[[Kernel/RtlUshortByteSwap]]
|318
|fastcall
|
|-
|[[Kernel/RtlWalkFrameChain]]
|319
|stdcall
|
|-
|[[Kernel/RtlZeroMemory]]
|320
|stdcall
|
|-
|[[Kernel/XboxEEPROMKey]]
|321
|stdcall
|Variable?
|-
|[[Kernel/XboxHardwareInfo]]
|322
|stdcall
|Variable?
|-
|[[Kernel/XboxHDKey]]
|323
|stdcall
|Variable?
|-
|[[Kernel/XboxKrnlVersion]]
|324
|stdcall
|Variable?
|-
|[[Kernel/XboxSignatureKey]]
|325
|stdcall
|Variable?
|-
|[[Kernel/XeImageFileName]]
|326
|stdcall
|Variable?
|-
|[[Kernel/XeLoadSection]]
|327
|stdcall
|
|-
|[[Kernel/XeUnloadSection]]
|328
|stdcall
|
|-
|[[Kernel/READ_PORT_BUFFER_UCHAR]]
|329
|stdcall
|
|-
|[[Kernel/READ_PORT_BUFFER_USHORT]]
|330
|stdcall
|
|-
|[[Kernel/READ_PORT_BUFFER_ULONG]]
|331
|stdcall
|
|-
|[[Kernel/WRITE_PORT_BUFFER_UCHAR]]
|332
|stdcall
|
|-
|[[Kernel/WRITE_PORT_BUFFER_USHORT]]
|333
|stdcall
|
|-
|[[Kernel/WRITE_PORT_BUFFER_ULONG]]
|334
|stdcall
|
|-
|[[Kernel/XcSHAInit]]
|335
|stdcall
|
|-
|[[Kernel/XcSHAUpdate]]
|336
|stdcall
|
|-
|[[Kernel/XcSHAFinal]]
|337
|stdcall
|
|-
|[[Kernel/XcRC4Key]]
|338
|stdcall
|
|-
|[[Kernel/XcRC4Crypt]]
|339
|stdcall
|
|-
|[[Kernel/XcHMAC]]
|340
|stdcall
|
|-
|[[Kernel/XcPKEncPublic]]
|341
|stdcall
|
|-
|[[Kernel/XcPKDecPrivate]]
|342
|stdcall
|
|-
|[[Kernel/XcPKGetKeyLen]]
|343
|stdcall
|
|-
|[[Kernel/XcVerifyPKCS1Signature]]
|344
|stdcall
|
|-
|[[Kernel/XcModExp]]
|345
|stdcall
|
|-
|[[Kernel/XcDESKeyParity]]
|346
|stdcall
|
|-
|[[Kernel/XcKeyTable]]
|347
|stdcall
|
|-
|[[Kernel/XcBlockCrypt]]
|348
|stdcall
|
|-
|[[Kernel/XcBlockCryptCBC]]
|349
|stdcall
|
|-
|[[Kernel/XcCryptService]]
|350
|stdcall
|
|-
|[[Kernel/XcUpdateCrypto]]
|351
|stdcall
|
|-
|[[Kernel/RtlRip]]
|352
|stdcall
|
|-
|[[Kernel/XboxLANKey]]
|353
|stdcall
|
|-
|[[Kernel/XboxAlternateSignatureKeys]]
|354
|stdcall
|Variable?
|-
|[[Kernel/XePublicKeyData]]
|355
|stdcall
|Variable?
|-
|[[Kernel/HalBootSMCVideoMode]]
|356
|stdcall
|Variable?
|-
|[[Kernel/IdexChannelObject]]
|357
|stdcall
|Variable?
|-
|[[Kernel/HalIsResetOrShutdownPending]]
|358
|stdcall
|
|-
|[[Kernel/IoMarkIrpMustComplete]]
|359
|stdcall
|
|-
|[[Kernel/HalInitiateShutdown]]
|360
|stdcall
|
|-
|[[Kernel/RtlSnprintf]]
|361
|stdcall
|Unused?
|-
|[[Kernel/RtlSprintf]]
|362
|stdcall
|Unused?
|-
|[[Kernel/RtlVsnprintf]]
|363
|stdcall
|Unused?
|-
|[[Kernel/RtlVsprintf]]
|364
|stdcall
|Unused?
|-
|[[Kernel/HalEnableSecureTrayEject]]
|365
|stdcall
|
|-
|[[Kernel/HalWriteSMCScratchRegister]]
|366
|stdcall
|
|-
|
|367
|
|Unused?
|-
|
|368
|
|Unused?
|-
|
|369
|
|Unused?
|-
|
|370
|
|Unused?
|-
|
|371
|
|Unused?
|-
|
|372
|
|Unused?
|-
|
|373
|
|Unused?
|-
|[[Kernel/MmDbgAllocateMemory]]
|374
|stdcall
|Devkits only!
|-
|[[Kernel/MmDbgFreeMemory]]
|375
|stdcall
|Devkits only!
|-
|[[Kernel/MmDbgQueryAvailablePages]]
|376
|stdcall
|Devkits only!
|-
|[[Kernel/MmDbgReleaseAddress]]
|377
|stdcall
|Devkits only!
|-
|[[Kernel/MmDbgWriteCheck]]
|378
|stdcall
|Devkits only!
|}

== See Also ==

[[Hard Drive Files]]

Kernel

2017-05-29T23:49:21Z

Haxar: Added Calling Convention definitions

The Xbox kernel is called xboxkrnl.exe. It is closely related to the Windows NT [[Wikipedia:Ntoskrnl.exe|ntoskrnl.exe]].
Its image base address is always 0x80010000.

== Header modifications ==

xboxkrnl.exe is a mostly standard exe file.
However, the MS-DOS header was patched to contain Xbox specific data in the reserved 20 byte block starting at offset 40:

{| class=wikitable
! Offset !! Meaning
|-
|40 || Size of uninitialized portion of the .data section
|-
|44 || Size of initialized portion of the .data section
|-
|48 || Memory address of initialized portion of the .data section (usually in [[Flash]]). <br> Used to re-initialize the data section pointed to by the next field. <br> Note that the pointer might be invalid during normal execution as the Flash might not be mapped at all times.
|-
|52 || Memory address where the .data section is stored (usually the same as in the section header + image base).
|}

== Sections ==

All sections are identity mapped (meaning file offsets and offsets in RAM match). This is because the kernel is not loaded through a traditional PE / exe loader, but just unpacked into memory.

=== .text ===

The .text section contains all x86 subroutines to be executed by the processor.

=== .rdata ===

The .rdata section contains the kernel thunk table. The ordinals in the table are to be resolved to the kernel's actual calling routine, when loaded.

=== .data ===

The .data section stores initialized and uninitialized data.
A copy of the initialized portion of this section is usually stored in the [[BIOS]].

=== STICKY ===

Stores variables which must be preserved across a quick-reboot.

=== IDEXPRDT ===

A Physical Region Descriptor Table (PRDT) for the IDE bus. This section serves as a memory allocation only, it does not have to be initialized when loading the kernel{{citation needed}}.

=== INIT ===

This section is always the last one. It contains the entrypoint of the kernel.
Later kernels{{FIXME|reason=Which revision?}} will discard this section after initialization.

== Kernel exports ==
{| class="wikitable"
|+Kernel exports
|-
!Name
!Ordinal
!Calling Convention
!Notes
|-
|[[Kernel/AvGetSavedDataAddress]]
|1
|stdcall
|
|-
|[[Kernel/AvSendTVEncoderOption]]
|2
|stdcall
|
|-
|[[Kernel/AvSetDisplayMode]]
|3
|stdcall
|
|-
|[[Kernel/AvSetSavedDataAddress]]
|4
|stdcall
|
|-
|[[Kernel/DbgBreakPoint]]
|5
|stdcall
|
|-
|[[Kernel/DbgBreakPointWithStatus]]
|6
|stdcall
|
|-
|[[Kernel/DbgLoadImageSymbols]]
|7
|stdcall
|Devkits only!
|-
|[[Kernel/DbgPrint]]
|8
|stdcall
|
|-
|[[Kernel/HalReadSMCTrayState]]
|9
|stdcall
|
|-
|[[Kernel/DbgPrompt]]
|10
|stdcall
|
|-
|[[Kernel/DbgUnLoadImageSymbols]]
|11
|stdcall
|Devkits only!
|-
|[[Kernel/ExAcquireReadWriteLockExclusive]]
|12
|stdcall
|
|-
|[[Kernel/ExAcquireReadWriteLockShared]]
|13
|stdcall
|
|-
|[[Kernel/ExAllocatePool]]
|14
|stdcall
|
|-
|[[Kernel/ExAllocatePoolWithTag]]
|15
|stdcall
|
|-
|[[Kernel/ExEventObjectType]]
|16
|stdcall
|Variable?
|-
|[[Kernel/ExFreePool]]
|17
|stdcall
|
|-
|[[Kernel/ExInitializeReadWriteLock]]
|18
|stdcall
|
|-
|[[Kernel/ExInterlockedAddLargeInteger]]
|19
|stdcall
|
|-
|[[Kernel/ExInterlockedAddLargeStatistic]]
|20
|fastcall
|
|-
|[[Kernel/ExInterlockedCompareExchange64]]
|21
|fastcall
|
|-
|[[Kernel/ExMutantObjectType]]
|22
|stdcall
|Variable?
|-
|[[Kernel/ExQueryPoolBlockSize]]
|23
|stdcall
|
|-
|[[Kernel/ExQueryNonVolatileSetting]]
|24
|stdcall
|
|-
|[[Kernel/ExReadWriteRefurbInfo]]
|25
|stdcall
|
|-
|[[Kernel/ExRaiseException]]
|26
|stdcall
|
|-
|[[Kernel/ExRaiseStatus]]
|27
|stdcall
|
|-
|[[Kernel/ExReleaseReadWriteLock]]
|28
|stdcall
|
|-
|[[Kernel/ExSaveNonVolatileSetting]]
|29
|stdcall
|
|-
|[[Kernel/ExSemaphoreObjectType]]
|30
|stdcall
|Variable?
|-
|[[Kernel/ExTimerObjectType]]
|31
|stdcall
|Variable?
|-
|[[Kernel/ExfInterlockedInsertHeadList]]
|32
|stdcall
|
|-
|[[Kernel/ExfInterlockedInsertTailList]]
|33
|fastcall
|
|-
|[[Kernel/ExfInterlockedRemoveHeadList]]
|34
|fastcall
|
|-
|[[Kernel/FscGetCacheSize]]
|35
|stdcall
|
|-
|[[Kernel/FscInvalidateIdleBlocks]]
|36
|stdcall
|
|-
|[[Kernel/FscSetCacheSize]]
|37
|stdcall
|
|-
|[[Kernel/HalClearSoftwareInterrupt]]
|38
|fastcall
|
|-
|[[Kernel/HalDisableSystemInterrupt]]
|39
|stdcall
|
|-
|[[Kernel/HalDiskCachePartitionCount]]
|40
|stdcall
|Variable?
|-
|[[Kernel/HalDiskModelNumber]]
|41
|stdcall
|Variable?
|-
|[[Kernel/HalDiskSerialNumber]]
|42
|stdcall
|Variable?
|-
|[[Kernel/HalEnableSystemInterrupt]]
|43
|stdcall
|
|-
|[[Kernel/HalGetInterruptVector]]
|44
|stdcall
|
|-
|[[Kernel/HalReadSMBusValue]]
|45
|stdcall
|
|-
|[[Kernel/HalReadWritePCISpace]]
|46
|stdcall
|
|-
|[[Kernel/HalRegisterShutdownNotification]]
|47
|stdcall
|
|-
|[[Kernel/HalRequestSoftwareInterrupt]]
|48
|fastcall
|
|-
|[[Kernel/HalReturnToFirmware]]
|49
|stdcall
|
|-
|[[Kernel/HalWriteSMBusValue]]
|50
|stdcall
|
|-
|[[Kernel/InterlockedCompareExchange]]
|51
|fastcall
|
|-
|[[Kernel/InterlockedDecrement]]
|52
|fastcall
|
|-
|[[Kernel/InterlockedIncrement]]
|53
|fastcall
|
|-
|[[Kernel/InterlockedExchange]]
|54
|fastcall
|
|-
|[[Kernel/InterlockedExchangeAdd]]
|55
|fastcall
|
|-
|[[Kernel/InterlockedFlushSList]]
|56
|fastcall
|
|-
|[[Kernel/InterlockedPopEntrySList]]
|57
|fastcall
|
|-
|[[Kernel/InterlockedPushEntrySList]]
|58
|fastcall
|
|-
|[[Kernel/IoAllocateIrp]]
|59
|stdcall
|
|-
|[[Kernel/IoBuildAsynchronousFsdRequest]]
|60
|stdcall
|
|-
|[[Kernel/IoBuildDeviceIoControlRequest]]
|61
|stdcall
|
|-
|[[Kernel/IoBuildSynchronousFsdRequest]]
|62
|stdcall
|
|-
|[[Kernel/IoCheckShareAccess]]
|63
|stdcall
|
|-
|[[Kernel/IoCompletionObjectType]]
|64
|stdcall
|Variable?
|-
|[[Kernel/IoCreateDevice]]
|65
|stdcall
|
|-
|[[Kernel/IoCreateFile]]
|66
|stdcall
|
|-
|[[Kernel/IoCreateSymbolicLink]]
|67
|stdcall
|
|-
|[[Kernel/IoDeleteDevice]]
|68
|stdcall
|
|-
|[[Kernel/IoDeleteSymbolicLink]]
|69
|stdcall
|
|-
|[[Kernel/IoDeviceObjectType]]
|70
|stdcall
|Variable?
|-
|[[Kernel/IoFileObjectType]]
|71
|stdcall
|Variable?
|-
|[[Kernel/IoFreeIrp]]
|72
|stdcall
|
|-
|[[Kernel/IoInitializeIrp]]
|73
|stdcall
|
|-
|[[Kernel/IoInvalidDeviceRequest]]
|74
|stdcall
|
|-
|[[Kernel/IoQueryFileInformation]]
|75
|stdcall
|
|-
|[[Kernel/IoQueryVolumeInformation]]
|76
|stdcall
|
|-
|[[Kernel/IoQueueThreadIrp]]
|77
|stdcall
|
|-
|[[Kernel/IoRemoveShareAccess]]
|78
|stdcall
|
|-
|[[Kernel/IoSetIoCompletion]]
|79
|stdcall
|
|-
|[[Kernel/IoSetShareAccess]]
|80
|stdcall
|
|-
|[[Kernel/IoStartNextPacket]]
|81
|stdcall
|
|-
|[[Kernel/IoStartNextPacketByKey]]
|82
|stdcall
|
|-
|[[Kernel/IoStartPacket]]
|83
|stdcall
|
|-
|[[Kernel/IoSynchronousDeviceIoControlRequest]]
|84
|stdcall
|
|-
|[[Kernel/IoSynchronousFsdRequest]]
|85
|stdcall
|
|-
|[[Kernel/IofCallDriver]]
|86
|fastcall
|
|-
|[[Kernel/IofCompleteRequest]]
|87
|fastcall
|
|-
|[[Kernel/KdDebuggerEnabled]]
|88
|stdcall
|Variable?
|-
|[[Kernel/KdDebuggerNotPresent]]
|89
|stdcall
|Variable?
|-
|[[Kernel/IoDismountVolume]]
|90
|stdcall
|
|-
|[[Kernel/IoDismountVolumeByName]]
|91
|stdcall
|
|-
|[[Kernel/KeAlertResumeThread]]
|92
|stdcall
|
|-
|[[Kernel/KeAlertThread]]
|93
|stdcall
|
|-
|[[Kernel/KeBoostPriorityThread]]
|94
|stdcall
|
|-
|[[Kernel/KeBugCheck]]
|95
|stdcall
|
|-
|[[Kernel/KeBugCheckEx]]
|96
|stdcall
|
|-
|[[Kernel/KeCancelTimer]]
|97
|stdcall
|
|-
|[[Kernel/KeConnectInterrupt]]
|98
|stdcall
|
|-
|[[Kernel/KeDelayExecutionThread]]
|99
|stdcall
|
|-
|[[Kernel/KeDisconnectInterrupt]]
|100
|stdcall
|
|-
|[[Kernel/KeEnterCriticalRegion]]
|101
|stdcall
|
|-
|[[Kernel/MmGlobalData]]
|102
|stdcall
|Variable?
|-
|[[Kernel/KeGetCurrentIrql]]
|103
|stdcall
|
|-
|[[Kernel/KeGetCurrentThread]]
|104
|stdcall
|
|-
|[[Kernel/KeInitializeApc]]
|105
|stdcall
|
|-
|[[Kernel/KeInitializeDeviceQueue]]
|106
|stdcall
|
|-
|[[Kernel/KeInitializeDpc]]
|107
|stdcall
|
|-
|[[Kernel/KeInitializeEvent]]
|108
|stdcall
|
|-
|[[Kernel/KeInitializeInterrupt]]
|109
|stdcall
|
|-
|[[Kernel/KeInitializeMutant]]
|110
|stdcall
|
|-
|[[Kernel/KeInitializeQueue]]
|111
|stdcall
|
|-
|[[Kernel/KeInitializeSemaphore]]
|112
|stdcall
|
|-
|[[Kernel/KeInitializeTimerEx]]
|113
|stdcall
|
|-
|[[Kernel/KeInsertByKeyDeviceQueue]]
|114
|stdcall
|
|-
|[[Kernel/KeInsertDeviceQueue]]
|115
|stdcall
|
|-
|[[Kernel/KeInsertHeadQueue]]
|116
|stdcall
|
|-
|[[Kernel/KeInsertQueue]]
|117
|stdcall
|
|-
|[[Kernel/KeInsertQueueApc]]
|118
|stdcall
|
|-
|[[Kernel/KeInsertQueueDpc]]
|119
|stdcall
|
|-
|[[Kernel/KeInterruptTime]]
|120
|stdcall
|Variable?
|-
|[[Kernel/KeIsExecutingDpc]]
|121
|stdcall
|
|-
|[[Kernel/KeLeaveCriticalRegion]]
|122
|stdcall
|
|-
|[[Kernel/KePulseEvent]]
|123
|stdcall
|
|-
|[[Kernel/KeQueryBasePriorityThread]]
|124
|stdcall
|
|-
|[[Kernel/KeQueryInterruptTime]]
|125
|stdcall
|
|-
|[[Kernel/KeQueryPerformanceCounter]]
|126
|stdcall
|
|-
|[[Kernel/KeQueryPerformanceFrequency]]
|127
|stdcall
|
|-
|[[Kernel/KeQuerySystemTime]]
|128
|stdcall
|
|-
|[[Kernel/KeRaiseIrqlToDpcLevel]]
|129
|stdcall
|
|-
|[[Kernel/KeRaiseIrqlToSynchLevel]]
|130
|stdcall
|
|-
|[[Kernel/KeReleaseMutant]]
|131
|stdcall
|
|-
|[[Kernel/KeReleaseSemaphore]]
|132
|stdcall
|
|-
|[[Kernel/KeRemoveByKeyDeviceQueue]]
|133
|stdcall
|
|-
|[[Kernel/KeRemoveDeviceQueue]]
|134
|stdcall
|
|-
|[[Kernel/KeRemoveEntryDeviceQueue]]
|135
|stdcall
|
|-
|[[Kernel/KeRemoveQueue]]
|136
|stdcall
|
|-
|[[Kernel/KeRemoveQueueDpc]]
|137
|stdcall
|
|-
|[[Kernel/KeResetEvent]]
|138
|stdcall
|
|-
|[[Kernel/KeRestoreFloatingPointState]]
|139
|stdcall
|
|-
|[[Kernel/KeResumeThread]]
|140
|stdcall
|
|-
|[[Kernel/KeRundownQueue]]
|141
|stdcall
|
|-
|[[Kernel/KeSaveFloatingPointState]]
|142
|stdcall
|
|-
|[[Kernel/KeSetBasePriorityThread]]
|143
|stdcall
|
|-
|[[Kernel/KeSetDisableBoostThread]]
|144
|stdcall
|
|-
|[[Kernel/KeSetEvent]]
|145
|stdcall
|
|-
|[[Kernel/KeSetEventBoostPriority]]
|146
|stdcall
|
|-
|[[Kernel/KeSetPriorityProcess]]
|147
|stdcall
|
|-
|[[Kernel/KeSetPriorityThread]]
|148
|stdcall
|
|-
|[[Kernel/KeSetTimer]]
|149
|stdcall
|
|-
|[[Kernel/KeSetTimerEx]]
|150
|stdcall
|
|-
|[[Kernel/KeStallExecutionProcessor]]
|151
|stdcall
|
|-
|[[Kernel/KeSuspendThread]]
|152
|stdcall
|
|-
|[[Kernel/KeSynchronizeExecution]]
|153
|stdcall
|
|-
|[[Kernel/KeSystemTime]]
|154
|stdcall
|Variable?
|-
|[[Kernel/KeTestAlertThread]]
|155
|stdcall
|
|-
|[[Kernel/KeTickCount]]
|156
|stdcall
|Variable?
|-
|[[Kernel/KeTimeIncrement]]
|157
|stdcall
|Variable?
|-
|[[Kernel/KeWaitForMultipleObjects]]
|158
|stdcall
|
|-
|[[Kernel/KeWaitForSingleObject]]
|159
|stdcall
|
|-
|[[Kernel/KfRaiseIrql]]
|160
|fastcall
|
|-
|[[Kernel/KfLowerIrql]]
|161
|fastcall
|
|-
|[[Kernel/KiBugCheckData]]
|162
|stdcall
|Variable?
|-
|[[Kernel/KiUnlockDispatcherDatabase]]
|163
|fastcall
|
|-
|[[Kernel/LaunchDataPage]]
|164
|stdcall
|Variable?
|-
|[[Kernel/MmAllocateContiguousMemory]]
|165
|stdcall
|
|-
|[[Kernel/MmAllocateContiguousMemoryEx]]
|166
|stdcall
|
|-
|[[Kernel/MmAllocateSystemMemory]]
|167
|stdcall
|
|-
|[[Kernel/MmClaimGpuInstanceMemory]]
|168
|stdcall
|
|-
|[[Kernel/MmCreateKernelStack]]
|169
|stdcall
|
|-
|[[Kernel/MmDeleteKernelStack]]
|170
|stdcall
|
|-
|[[Kernel/MmFreeContiguousMemory]]
|171
|stdcall
|
|-
|[[Kernel/MmFreeSystemMemory]]
|172
|stdcall
|
|-
|[[Kernel/MmGetPhysicalAddress]]
|173
|stdcall
|
|-
|[[Kernel/MmIsAddressValid]]
|174
|stdcall
|
|-
|[[Kernel/MmLockUnlockBufferPages]]
|175
|stdcall
|
|-
|[[Kernel/MmLockUnlockPhysicalPage]]
|176
|stdcall
|
|-
|[[Kernel/MmMapIoSpace]]
|177
|stdcall
|
|-
|[[Kernel/MmPersistContiguousMemory]]
|178
|stdcall
|
|-
|[[Kernel/MmQueryAddressProtect]]
|179
|stdcall
|
|-
|[[Kernel/MmQueryAllocationSize]]
|180
|stdcall
|
|-
|[[Kernel/MmQueryStatistics]]
|181
|stdcall
|
|-
|[[Kernel/MmSetAddressProtect]]
|182
|stdcall
|
|-
|[[Kernel/MmUnmapIoSpace]]
|183
|stdcall
|
|-
|[[Kernel/NtAllocateVirtualMemory]]
|184
|stdcall
|
|-
|[[Kernel/NtCancelTimer]]
|185
|stdcall
|
|-
|[[Kernel/NtClearEvent]]
|186
|stdcall
|
|-
|[[Kernel/NtClose]]
|187
|stdcall
|
|-
|[[Kernel/NtCreateDirectoryObject]]
|188
|stdcall
|
|-
|[[Kernel/NtCreateEvent]]
|189
|stdcall
|
|-
|[[Kernel/NtCreateFile]]
|190
|stdcall
|
|-
|[[Kernel/NtCreateIoCompletion]]
|191
|stdcall
|
|-
|[[Kernel/NtCreateMutant]]
|192
|stdcall
|
|-
|[[Kernel/NtCreateSemaphore]]
|193
|stdcall
|
|-
|[[Kernel/NtCreateTimer]]
|194
|stdcall
|
|-
|[[Kernel/NtDeleteFile]]
|195
|stdcall
|
|-
|[[Kernel/NtDeviceIoControlFile]]
|196
|stdcall
|
|-
|[[Kernel/NtDuplicateObject]]
|197
|stdcall
|
|-
|[[Kernel/NtFlushBuffersFile]]
|198
|stdcall
|
|-
|[[Kernel/NtFreeVirtualMemory]]
|199
|stdcall
|
|-
|[[Kernel/NtFsControlFile]]
|200
|stdcall
|
|-
|[[Kernel/NtOpenDirectoryObject]]
|201
|stdcall
|
|-
|[[Kernel/NtOpenFile]]
|202
|stdcall
|
|-
|[[Kernel/NtOpenSymbolicLinkObject]]
|203
|stdcall
|
|-
|[[Kernel/NtProtectVirtualMemory]]
|204
|stdcall
|
|-
|[[Kernel/NtPulseEvent]]
|205
|stdcall
|
|-
|[[Kernel/NtQueueApcThread]]
|206
|stdcall
|
|-
|[[Kernel/NtQueryDirectoryFile]]
|207
|stdcall
|
|-
|[[Kernel/NtQueryDirectoryObject]]
|208
|stdcall
|
|-
|[[Kernel/NtQueryEvent]]
|209
|stdcall
|
|-
|[[Kernel/NtQueryFullAttributesFile]]
|210
|stdcall
|
|-
|[[Kernel/NtQueryInformationFile]]
|211
|stdcall
|
|-
|[[Kernel/NtQueryIoCompletion]]
|212
|stdcall
|
|-
|[[Kernel/NtQueryMutant]]
|213
|stdcall
|
|-
|[[Kernel/NtQuerySemaphore]]
|214
|stdcall
|
|-
|[[Kernel/NtQuerySymbolicLinkObject]]
|215
|stdcall
|
|-
|[[Kernel/NtQueryTimer]]
|216
|stdcall
|
|-
|[[Kernel/NtQueryVirtualMemory]]
|217
|stdcall
|
|-
|[[Kernel/NtQueryVolumeInformationFile]]
|218
|stdcall
|
|-
|[[Kernel/NtReadFile]]
|219
|stdcall
|
|-
|[[Kernel/NtReadFileScatter]]
|220
|stdcall
|
|-
|[[Kernel/NtReleaseMutant]]
|221
|stdcall
|
|-
|[[Kernel/NtReleaseSemaphore]]
|222
|stdcall
|
|-
|[[Kernel/NtRemoveIoCompletion]]
|223
|stdcall
|
|-
|[[Kernel/NtResumeThread]]
|224
|stdcall
|
|-
|[[Kernel/NtSetEvent]]
|225
|stdcall
|
|-
|[[Kernel/NtSetInformationFile]]
|226
|stdcall
|
|-
|[[Kernel/NtSetIoCompletion]]
|227
|stdcall
|
|-
|[[Kernel/NtSetSystemTime]]
|228
|stdcall
|
|-
|[[Kernel/NtSetTimerEx]]
|229
|stdcall
|
|-
|[[Kernel/NtSignalAndWaitForSingleObjectEx]]
|230
|stdcall
|
|-
|[[Kernel/NtSuspendThread]]
|231
|stdcall
|
|-
|[[Kernel/NtUserIoApcDispatcher]]
|232
|stdcall
|
|-
|[[Kernel/NtWaitForSingleObject]]
|233
|stdcall
|
|-
|[[Kernel/NtWaitForSingleObjectEx]]
|234
|stdcall
|
|-
|[[Kernel/NtWaitForMultipleObjectsEx]]
|235
|stdcall
|
|-
|[[Kernel/NtWriteFile]]
|236
|stdcall
|
|-
|[[Kernel/NtWriteFileGather]]
|237
|stdcall
|
|-
|[[Kernel/NtYieldExecution]]
|238
|stdcall
|
|-
|[[Kernel/ObCreateObject]]
|239
|stdcall
|
|-
|[[Kernel/ObDirectoryObjectType]]
|240
|stdcall
|Variable?
|-
|[[Kernel/ObInsertObject]]
|241
|stdcall
|
|-
|[[Kernel/ObMakeTemporaryObject]]
|242
|stdcall
|
|-
|[[Kernel/ObOpenObjectByName]]
|243
|stdcall
|
|-
|[[Kernel/ObOpenObjectByPointer]]
|244
|stdcall
|
|-
|[[Kernel/ObpObjectHandleTable]]
|245
|stdcall
|Variable?
|-
|[[Kernel/ObReferenceObjectByHandle]]
|246
|stdcall
|
|-
|[[Kernel/ObReferenceObjectByName]]
|247
|stdcall
|
|-
|[[Kernel/ObReferenceObjectByPointer]]
|248
|stdcall
|
|-
|[[Kernel/ObSymbolicLinkObjectType]]
|249
|stdcall
|Variable?
|-
|[[Kernel/ObfDereferenceObject]]
|250
|fastcall
|
|-
|[[Kernel/ObfReferenceObject]]
|251
|fastcall
|
|-
|[[Kernel/PhyGetLinkState]]
|252
|stdcall
|
|-
|[[Kernel/PhyInitialize]]
|253
|stdcall
|
|-
|[[Kernel/PsCreateSystemThread]]
|254
|stdcall
|
|-
|[[Kernel/PsCreateSystemThreadEx]]
|255
|stdcall
|
|-
|[[Kernel/PsQueryStatistics]]
|256
|stdcall
|
|-
|[[Kernel/PsSetCreateThreadNotifyRoutine]]
|257
|stdcall
|
|-
|[[Kernel/PsTerminateSystemThread]]
|258
|stdcall
|
|-
|[[Kernel/PsThreadObjectType]]
|259
|stdcall
|Variable?
|-
|[[Kernel/RtlAnsiStringToUnicodeString]]
|260
|stdcall
|
|-
|[[Kernel/RtlAppendStringToString]]
|261
|stdcall
|
|-
|[[Kernel/RtlAppendUnicodeStringToString]]
|262
|stdcall
|
|-
|[[Kernel/RtlAppendUnicodeToString]]
|263
|stdcall
|
|-
|[[Kernel/RtlAssert]]
|264
|stdcall
|
|-
|[[Kernel/RtlCaptureContext]]
|265
|stdcall
|
|-
|[[Kernel/RtlCaptureStackBackTrace]]
|266
|stdcall
|
|-
|[[Kernel/RtlCharToInteger]]
|267
|stdcall
|
|-
|[[Kernel/RtlCompareMemory]]
|268
|stdcall
|
|-
|[[Kernel/RtlCompareMemoryUlong]]
|269
|stdcall
|
|-
|[[Kernel/RtlCompareString]]
|270
|stdcall
|
|-
|[[Kernel/RtlCompareUnicodeString]]
|271
|stdcall
|
|-
|[[Kernel/RtlCopyString]]
|272
|stdcall
|
|-
|[[Kernel/RtlCopyUnicodeString]]
|273
|stdcall
|
|-
|[[Kernel/RtlCreateUnicodeString]]
|274
|stdcall
|
|-
|[[Kernel/RtlDowncaseUnicodeChar]]
|275
|stdcall
|
|-
|[[Kernel/RtlDowncaseUnicodeString]]
|276
|stdcall
|
|-
|[[Kernel/RtlEnterCriticalSection]]
|277
|stdcall
|
|-
|[[Kernel/RtlEnterCriticalSectionAndRegion]]
|278
|stdcall
|
|-
|[[Kernel/RtlEqualString]]
|279
|stdcall
|
|-
|[[Kernel/RtlEqualUnicodeString]]
|280
|stdcall
|
|-
|[[Kernel/RtlExtendedIntegerMultiply]]
|281
|stdcall
|
|-
|[[Kernel/RtlExtendedLargeIntegerDivide]]
|282
|stdcall
|
|-
|[[Kernel/RtlExtendedMagicDivide]]
|283
|stdcall
|
|-
|[[Kernel/RtlFillMemory]]
|284
|stdcall
|
|-
|[[Kernel/RtlFillMemoryUlong]]
|285
|stdcall
|
|-
|[[Kernel/RtlFreeAnsiString]]
|286
|stdcall
|
|-
|[[Kernel/RtlFreeUnicodeString]]
|287
|stdcall
|
|-
|[[Kernel/RtlGetCallersAddress]]
|288
|stdcall
|
|-
|[[Kernel/RtlInitAnsiString]]
|289
|stdcall
|
|-
|[[Kernel/RtlInitUnicodeString]]
|290
|stdcall
|
|-
|[[Kernel/RtlInitializeCriticalSection]]
|291
|stdcall
|
|-
|[[Kernel/RtlIntegerToChar]]
|292
|stdcall
|
|-
|[[Kernel/RtlIntegerToUnicodeString]]
|293
|stdcall
|
|-
|[[Kernel/RtlLeaveCriticalSection]]
|294
|stdcall
|
|-
|[[Kernel/RtlLeaveCriticalSectionAndRegion]]
|295
|stdcall
|
|-
|[[Kernel/RtlLowerChar]]
|296
|stdcall
|
|-
|[[Kernel/RtlMapGenericMask]]
|297
|stdcall
|
|-
|[[Kernel/RtlMoveMemory]]
|298
|stdcall
|
|-
|[[Kernel/RtlMultiByteToUnicodeN]]
|299
|stdcall
|
|-
|[[Kernel/RtlMultiByteToUnicodeSize]]
|300
|stdcall
|
|-
|[[Kernel/RtlNtStatusToDosError]]
|301
|stdcall
|
|-
|[[Kernel/RtlRaiseException]]
|302
|stdcall
|
|-
|[[Kernel/RtlRaiseStatus]]
|303
|stdcall
|
|-
|[[Kernel/RtlTimeFieldsToTime]]
|304
|stdcall
|
|-
|[[Kernel/RtlTimeToTimeFields]]
|305
|stdcall
|
|-
|[[Kernel/RtlTryEnterCriticalSection]]
|306
|stdcall
|
|-
|[[Kernel/RtlUlongByteSwap]]
|307
|fastcall
|
|-
|[[Kernel/RtlUnicodeStringToAnsiString]]
|308
|stdcall
|
|-
|[[Kernel/RtlUnicodeStringToInteger]]
|309
|stdcall
|
|-
|[[Kernel/RtlUnicodeToMultiByteN]]
|310
|stdcall
|
|-
|[[Kernel/RtlUnicodeToMultiByteSize]]
|311
|stdcall
|
|-
|[[Kernel/RtlUnwind]]
|312
|stdcall
|
|-
|[[Kernel/RtlUpcaseUnicodeChar]]
|313
|stdcall
|
|-
|[[Kernel/RtlUpcaseUnicodeString]]
|314
|stdcall
|
|-
|[[Kernel/RtlUpcaseUnicodeToMultiByteN]]
|315
|stdcall
|
|-
|[[Kernel/RtlUpperChar]]
|316
|stdcall
|
|-
|[[Kernel/RtlUpperString]]
|317
|stdcall
|
|-
|[[Kernel/RtlUshortByteSwap]]
|318
|fastcall
|
|-
|[[Kernel/RtlWalkFrameChain]]
|319
|stdcall
|
|-
|[[Kernel/RtlZeroMemory]]
|320
|stdcall
|
|-
|[[Kernel/XboxEEPROMKey]]
|321
|stdcall
|Variable?
|-
|[[Kernel/XboxHardwareInfo]]
|322
|stdcall
|Variable?
|-
|[[Kernel/XboxHDKey]]
|323
|stdcall
|Variable?
|-
|[[Kernel/XboxKrnlVersion]]
|324
|stdcall
|Variable?
|-
|[[Kernel/XboxSignatureKey]]
|325
|stdcall
|Variable?
|-
|[[Kernel/XeImageFileName]]
|326
|stdcall
|Variable?
|-
|[[Kernel/XeLoadSection]]
|327
|stdcall
|
|-
|[[Kernel/XeUnloadSection]]
|328
|stdcall
|
|-
|[[Kernel/READ_PORT_BUFFER_UCHAR]]
|329
|stdcall
|
|-
|[[Kernel/READ_PORT_BUFFER_USHORT]]
|330
|stdcall
|
|-
|[[Kernel/READ_PORT_BUFFER_ULONG]]
|331
|stdcall
|
|-
|[[Kernel/WRITE_PORT_BUFFER_UCHAR]]
|332
|stdcall
|
|-
|[[Kernel/WRITE_PORT_BUFFER_USHORT]]
|333
|stdcall
|
|-
|[[Kernel/WRITE_PORT_BUFFER_ULONG]]
|334
|stdcall
|
|-
|[[Kernel/XcSHAInit]]
|335
|stdcall
|
|-
|[[Kernel/XcSHAUpdate]]
|336
|stdcall
|
|-
|[[Kernel/XcSHAFinal]]
|337
|stdcall
|
|-
|[[Kernel/XcRC4Key]]
|338
|stdcall
|
|-
|[[Kernel/XcRC4Crypt]]
|339
|stdcall
|
|-
|[[Kernel/XcHMAC]]
|340
|stdcall
|
|-
|[[Kernel/XcPKEncPublic]]
|341
|stdcall
|
|-
|[[Kernel/XcPKDecPrivate]]
|342
|stdcall
|
|-
|[[Kernel/XcPKGetKeyLen]]
|343
|stdcall
|
|-
|[[Kernel/XcVerifyPKCS1Signature]]
|344
|stdcall
|
|-
|[[Kernel/XcModExp]]
|345
|stdcall
|
|-
|[[Kernel/XcDESKeyParity]]
|346
|stdcall
|
|-
|[[Kernel/XcKeyTable]]
|347
|stdcall
|
|-
|[[Kernel/XcBlockCrypt]]
|348
|stdcall
|
|-
|[[Kernel/XcBlockCryptCBC]]
|349
|stdcall
|
|-
|[[Kernel/XcCryptService]]
|350
|stdcall
|
|-
|[[Kernel/XcUpdateCrypto]]
|351
|stdcall
|
|-
|[[Kernel/RtlRip]]
|352
|stdcall
|
|-
|[[Kernel/XboxLANKey]]
|353
|stdcall
|
|-
|[[Kernel/XboxAlternateSignatureKeys]]
|354
|stdcall
|Variable?
|-
|[[Kernel/XePublicKeyData]]
|355
|stdcall
|Variable?
|-
|[[Kernel/HalBootSMCVideoMode]]
|356
|stdcall
|Variable?
|-
|[[Kernel/IdexChannelObject]]
|357
|stdcall
|Variable?
|-
|[[Kernel/HalIsResetOrShutdownPending]]
|358
|stdcall
|
|-
|[[Kernel/IoMarkIrpMustComplete]]
|359
|stdcall
|
|-
|[[Kernel/HalInitiateShutdown]]
|360
|stdcall
|
|-
|[[Kernel/RtlSnprintf]]
|361
|stdcall
|Unused?
|-
|[[Kernel/RtlSprintf]]
|362
|stdcall
|Unused?
|-
|[[Kernel/RtlVsnprintf]]
|363
|stdcall
|Unused?
|-
|[[Kernel/RtlVsprintf]]
|364
|stdcall
|Unused?
|-
|[[Kernel/HalEnableSecureTrayEject]]
|365
|stdcall
|
|-
|[[Kernel/HalWriteSMCScratchRegister]]
|366
|stdcall
|
|-
|
|367
|
|Unused?
|-
|
|368
|
|Unused?
|-
|
|369
|
|Unused?
|-
|
|370
|
|Unused?
|-
|
|371
|
|Unused?
|-
|
|372
|
|Unused?
|-
|
|373
|
|Unused?
|-
|[[Kernel/MmDbgAllocateMemory]]
|374
|stdcall
|Devkits only!
|-
|[[Kernel/MmDbgFreeMemory]]
|375
|stdcall
|Devkits only!
|-
|[[Kernel/MmDbgQueryAvailablePages]]
|376
|stdcall
|Devkits only!
|-
|[[Kernel/MmDbgReleaseAddress]]
|377
|stdcall
|Devkits only!
|-
|[[Kernel/MmDbgWriteCheck]]
|378
|stdcall
|Devkits only!
|}

== See Also ==

[[Hard Drive Files]]

Kernel

2017-05-29T23:18:07Z

Haxar: .text and .rdata distinction

The Xbox kernel is called xboxkrnl.exe. It is closely related to the Windows NT [[Wikipedia:Ntoskrnl.exe|ntoskrnl.exe]].
Its image base address is always 0x80010000.

== Header modifications ==

xboxkrnl.exe is a mostly standard exe file.
However, the MS-DOS header was patched to contain Xbox specific data in the reserved 20 byte block starting at offset 40:

{| class=wikitable
! Offset !! Meaning
|-
|40 || Size of uninitialized portion of the .data section
|-
|44 || Size of initialized portion of the .data section
|-
|48 || Memory address of initialized portion of the .data section (usually in [[Flash]]). <br> Used to re-initialize the data section pointed to by the next field. <br> Note that the pointer might be invalid during normal execution as the Flash might not be mapped at all times.
|-
|52 || Memory address where the .data section is stored (usually the same as in the section header + image base).
|}

== Sections ==

All sections are identity mapped (meaning file offsets and offsets in RAM match). This is because the kernel is not loaded through a traditional PE / exe loader, but just unpacked into memory.

=== .text ===

The .text section contains all x86 subroutines to be executed by the processor.

=== .rdata ===

The .rdata section contains the kernel thunk table. The ordinals in the table are to be resolved to the kernel's actual calling routine, when loaded.

=== .data ===

The .data section stores initialized and uninitialized data.
A copy of the initialized portion of this section is usually stored in the [[BIOS]].

=== STICKY ===

Stores variables which must be preserved across a quick-reboot.

=== IDEXPRDT ===

A Physical Region Descriptor Table (PRDT) for the IDE bus. This section serves as a memory allocation only, it does not have to be initialized when loading the kernel{{citation needed}}.

=== INIT ===

This section is always the last one. It contains the entrypoint of the kernel.
Later kernels{{FIXME|reason=Which revision?}} will discard this section after initialization.

== Kernel exports ==
{| class="wikitable"
|+Kernel exports
|-
!Name
!Ordinal
!Notes
|-
|[[Kernel/AvGetSavedDataAddress]]
|1
|
|-
|[[Kernel/AvSendTVEncoderOption]]
|2
|
|-
|[[Kernel/AvSetDisplayMode]]
|3
|
|-
|[[Kernel/AvSetSavedDataAddress]]
|4
|
|-
|[[Kernel/DbgBreakPoint]]
|5
|
|-
|[[Kernel/DbgBreakPointWithStatus]]
|6
|
|-
|[[Kernel/DbgLoadImageSymbols]]
|7
|Devkits only!
|-
|[[Kernel/DbgPrint]]
|8
|
|-
|[[Kernel/HalReadSMCTrayState]]
|9
|
|-
|[[Kernel/DbgPrompt]]
|10
|
|-
|[[Kernel/DbgUnLoadImageSymbols]]
|11
|Devkits only!
|-
|[[Kernel/ExAcquireReadWriteLockExclusive]]
|12
|
|-
|[[Kernel/ExAcquireReadWriteLockShared]]
|13
|
|-
|[[Kernel/ExAllocatePool]]
|14
|
|-
|[[Kernel/ExAllocatePoolWithTag]]
|15
|
|-
|[[Kernel/ExEventObjectType]]
|16
|Variable?
|-
|[[Kernel/ExFreePool]]
|17
|
|-
|[[Kernel/ExInitializeReadWriteLock]]
|18
|
|-
|[[Kernel/ExInterlockedAddLargeInteger]]
|19
|
|-
|[[Kernel/ExInterlockedAddLargeStatistic]]
|20
|
|-
|[[Kernel/ExInterlockedCompareExchange64]]
|21
|
|-
|[[Kernel/ExMutantObjectType]]
|22
|Variable?
|-
|[[Kernel/ExQueryPoolBlockSize]]
|23
|
|-
|[[Kernel/ExQueryNonVolatileSetting]]
|24
|
|-
|[[Kernel/ExReadWriteRefurbInfo]]
|25
|
|-
|[[Kernel/ExRaiseException]]
|26
|
|-
|[[Kernel/ExRaiseStatus]]
|27
|
|-
|[[Kernel/ExReleaseReadWriteLock]]
|28
|
|-
|[[Kernel/ExSaveNonVolatileSetting]]
|29
|
|-
|[[Kernel/ExSemaphoreObjectType]]
|30
|Variable?
|-
|[[Kernel/ExTimerObjectType]]
|31
|Variable?
|-
|[[Kernel/ExfInterlockedInsertHeadList]]
|32
|
|-
|[[Kernel/ExfInterlockedInsertTailList]]
|33
|
|-
|[[Kernel/ExfInterlockedRemoveHeadList]]
|34
|
|-
|[[Kernel/FscGetCacheSize]]
|35
|
|-
|[[Kernel/FscInvalidateIdleBlocks]]
|36
|
|-
|[[Kernel/FscSetCacheSize]]
|37
|
|-
|[[Kernel/HalClearSoftwareInterrupt]]
|38
|
|-
|[[Kernel/HalDisableSystemInterrupt]]
|39
|
|-
|[[Kernel/HalDiskCachePartitionCount]]
|40
|Variable?
|-
|[[Kernel/HalDiskModelNumber]]
|41
|Variable?
|-
|[[Kernel/HalDiskSerialNumber]]
|42
|Variable?
|-
|[[Kernel/HalEnableSystemInterrupt]]
|43
|
|-
|[[Kernel/HalGetInterruptVector]]
|44
|
|-
|[[Kernel/HalReadSMBusValue]]
|45
|
|-
|[[Kernel/HalReadWritePCISpace]]
|46
|
|-
|[[Kernel/HalRegisterShutdownNotification]]
|47
|
|-
|[[Kernel/HalRequestSoftwareInterrupt]]
|48
|
|-
|[[Kernel/HalReturnToFirmware]]
|49
|
|-
|[[Kernel/HalWriteSMBusValue]]
|50
|
|-
|[[Kernel/InterlockedCompareExchange]]
|51
|
|-
|[[Kernel/InterlockedDecrement]]
|52
|
|-
|[[Kernel/InterlockedIncrement]]
|53
|
|-
|[[Kernel/InterlockedExchange]]
|54
|
|-
|[[Kernel/InterlockedExchangeAdd]]
|55
|
|-
|[[Kernel/InterlockedFlushSList]]
|56
|
|-
|[[Kernel/InterlockedPopEntrySList]]
|57
|
|-
|[[Kernel/InterlockedPushEntrySList]]
|58
|
|-
|[[Kernel/IoAllocateIrp]]
|59
|
|-
|[[Kernel/IoBuildAsynchronousFsdRequest]]
|60
|
|-
|[[Kernel/IoBuildDeviceIoControlRequest]]
|61
|
|-
|[[Kernel/IoBuildSynchronousFsdRequest]]
|62
|
|-
|[[Kernel/IoCheckShareAccess]]
|63
|
|-
|[[Kernel/IoCompletionObjectType]]
|64
|Variable?
|-
|[[Kernel/IoCreateDevice]]
|65
|
|-
|[[Kernel/IoCreateFile]]
|66
|
|-
|[[Kernel/IoCreateSymbolicLink]]
|67
|
|-
|[[Kernel/IoDeleteDevice]]
|68
|
|-
|[[Kernel/IoDeleteSymbolicLink]]
|69
|
|-
|[[Kernel/IoDeviceObjectType]]
|70
|Variable?
|-
|[[Kernel/IoFileObjectType]]
|71
|Variable?
|-
|[[Kernel/IoFreeIrp]]
|72
|
|-
|[[Kernel/IoInitializeIrp]]
|73
|
|-
|[[Kernel/IoInvalidDeviceRequest]]
|74
|
|-
|[[Kernel/IoQueryFileInformation]]
|75
|
|-
|[[Kernel/IoQueryVolumeInformation]]
|76
|
|-
|[[Kernel/IoQueueThreadIrp]]
|77
|
|-
|[[Kernel/IoRemoveShareAccess]]
|78
|
|-
|[[Kernel/IoSetIoCompletion]]
|79
|
|-
|[[Kernel/IoSetShareAccess]]
|80
|
|-
|[[Kernel/IoStartNextPacket]]
|81
|
|-
|[[Kernel/IoStartNextPacketByKey]]
|82
|
|-
|[[Kernel/IoStartPacket]]
|83
|
|-
|[[Kernel/IoSynchronousDeviceIoControlRequest]]
|84
|
|-
|[[Kernel/IoSynchronousFsdRequest]]
|85
|
|-
|[[Kernel/IofCallDriver]]
|86
|
|-
|[[Kernel/IofCompleteRequest]]
|87
|
|-
|[[Kernel/KdDebuggerEnabled]]
|88
|Variable?
|-
|[[Kernel/KdDebuggerNotPresent]]
|89
|Variable?
|-
|[[Kernel/IoDismountVolume]]
|90
|
|-
|[[Kernel/IoDismountVolumeByName]]
|91
|
|-
|[[Kernel/KeAlertResumeThread]]
|92
|
|-
|[[Kernel/KeAlertThread]]
|93
|
|-
|[[Kernel/KeBoostPriorityThread]]
|94
|
|-
|[[Kernel/KeBugCheck]]
|95
|
|-
|[[Kernel/KeBugCheckEx]]
|96
|
|-
|[[Kernel/KeCancelTimer]]
|97
|
|-
|[[Kernel/KeConnectInterrupt]]
|98
|
|-
|[[Kernel/KeDelayExecutionThread]]
|99
|
|-
|[[Kernel/KeDisconnectInterrupt]]
|100
|
|-
|[[Kernel/KeEnterCriticalRegion]]
|101
|
|-
|[[Kernel/MmGlobalData]]
|102
|Variable?
|-
|[[Kernel/KeGetCurrentIrql]]
|103
|
|-
|[[Kernel/KeGetCurrentThread]]
|104
|
|-
|[[Kernel/KeInitializeApc]]
|105
|
|-
|[[Kernel/KeInitializeDeviceQueue]]
|106
|
|-
|[[Kernel/KeInitializeDpc]]
|107
|
|-
|[[Kernel/KeInitializeEvent]]
|108
|
|-
|[[Kernel/KeInitializeInterrupt]]
|109
|
|-
|[[Kernel/KeInitializeMutant]]
|110
|
|-
|[[Kernel/KeInitializeQueue]]
|111
|
|-
|[[Kernel/KeInitializeSemaphore]]
|112
|
|-
|[[Kernel/KeInitializeTimerEx]]
|113
|
|-
|[[Kernel/KeInsertByKeyDeviceQueue]]
|114
|
|-
|[[Kernel/KeInsertDeviceQueue]]
|115
|
|-
|[[Kernel/KeInsertHeadQueue]]
|116
|
|-
|[[Kernel/KeInsertQueue]]
|117
|
|-
|[[Kernel/KeInsertQueueApc]]
|118
|
|-
|[[Kernel/KeInsertQueueDpc]]
|119
|
|-
|[[Kernel/KeInterruptTime]]
|120
|Variable?
|-
|[[Kernel/KeIsExecutingDpc]]
|121
|
|-
|[[Kernel/KeLeaveCriticalRegion]]
|122
|
|-
|[[Kernel/KePulseEvent]]
|123
|
|-
|[[Kernel/KeQueryBasePriorityThread]]
|124
|
|-
|[[Kernel/KeQueryInterruptTime]]
|125
|
|-
|[[Kernel/KeQueryPerformanceCounter]]
|126
|
|-
|[[Kernel/KeQueryPerformanceFrequency]]
|127
|
|-
|[[Kernel/KeQuerySystemTime]]
|128
|
|-
|[[Kernel/KeRaiseIrqlToDpcLevel]]
|129
|
|-
|[[Kernel/KeRaiseIrqlToSynchLevel]]
|130
|
|-
|[[Kernel/KeReleaseMutant]]
|131
|
|-
|[[Kernel/KeReleaseSemaphore]]
|132
|
|-
|[[Kernel/KeRemoveByKeyDeviceQueue]]
|133
|
|-
|[[Kernel/KeRemoveDeviceQueue]]
|134
|
|-
|[[Kernel/KeRemoveEntryDeviceQueue]]
|135
|
|-
|[[Kernel/KeRemoveQueue]]
|136
|
|-
|[[Kernel/KeRemoveQueueDpc]]
|137
|
|-
|[[Kernel/KeResetEvent]]
|138
|
|-
|[[Kernel/KeRestoreFloatingPointState]]
|139
|
|-
|[[Kernel/KeResumeThread]]
|140
|
|-
|[[Kernel/KeRundownQueue]]
|141
|
|-
|[[Kernel/KeSaveFloatingPointState]]
|142
|
|-
|[[Kernel/KeSetBasePriorityThread]]
|143
|
|-
|[[Kernel/KeSetDisableBoostThread]]
|144
|
|-
|[[Kernel/KeSetEvent]]
|145
|
|-
|[[Kernel/KeSetEventBoostPriority]]
|146
|
|-
|[[Kernel/KeSetPriorityProcess]]
|147
|
|-
|[[Kernel/KeSetPriorityThread]]
|148
|
|-
|[[Kernel/KeSetTimer]]
|149
|
|-
|[[Kernel/KeSetTimerEx]]
|150
|
|-
|[[Kernel/KeStallExecutionProcessor]]
|151
|
|-
|[[Kernel/KeSuspendThread]]
|152
|
|-
|[[Kernel/KeSynchronizeExecution]]
|153
|
|-
|[[Kernel/KeSystemTime]]
|154
|Variable?
|-
|[[Kernel/KeTestAlertThread]]
|155
|
|-
|[[Kernel/KeTickCount]]
|156
|Variable?
|-
|[[Kernel/KeTimeIncrement]]
|157
|Variable?
|-
|[[Kernel/KeWaitForMultipleObjects]]
|158
|
|-
|[[Kernel/KeWaitForSingleObject]]
|159
|
|-
|[[Kernel/KfRaiseIrql]]
|160
|
|-
|[[Kernel/KfLowerIrql]]
|161
|
|-
|[[Kernel/KiBugCheckData]]
|162
|Variable?
|-
|[[Kernel/KiUnlockDispatcherDatabase]]
|163
|
|-
|[[Kernel/LaunchDataPage]]
|164
|Variable?
|-
|[[Kernel/MmAllocateContiguousMemory]]
|165
|
|-
|[[Kernel/MmAllocateContiguousMemoryEx]]
|166
|
|-
|[[Kernel/MmAllocateSystemMemory]]
|167
|
|-
|[[Kernel/MmClaimGpuInstanceMemory]]
|168
|
|-
|[[Kernel/MmCreateKernelStack]]
|169
|
|-
|[[Kernel/MmDeleteKernelStack]]
|170
|
|-
|[[Kernel/MmFreeContiguousMemory]]
|171
|
|-
|[[Kernel/MmFreeSystemMemory]]
|172
|
|-
|[[Kernel/MmGetPhysicalAddress]]
|173
|
|-
|[[Kernel/MmIsAddressValid]]
|174
|
|-
|[[Kernel/MmLockUnlockBufferPages]]
|175
|
|-
|[[Kernel/MmLockUnlockPhysicalPage]]
|176
|
|-
|[[Kernel/MmMapIoSpace]]
|177
|
|-
|[[Kernel/MmPersistContiguousMemory]]
|178
|
|-
|[[Kernel/MmQueryAddressProtect]]
|179
|
|-
|[[Kernel/MmQueryAllocationSize]]
|180
|
|-
|[[Kernel/MmQueryStatistics]]
|181
|
|-
|[[Kernel/MmSetAddressProtect]]
|182
|
|-
|[[Kernel/MmUnmapIoSpace]]
|183
|
|-
|[[Kernel/NtAllocateVirtualMemory]]
|184
|
|-
|[[Kernel/NtCancelTimer]]
|185
|
|-
|[[Kernel/NtClearEvent]]
|186
|
|-
|[[Kernel/NtClose]]
|187
|
|-
|[[Kernel/NtCreateDirectoryObject]]
|188
|
|-
|[[Kernel/NtCreateEvent]]
|189
|
|-
|[[Kernel/NtCreateFile]]
|190
|
|-
|[[Kernel/NtCreateIoCompletion]]
|191
|
|-
|[[Kernel/NtCreateMutant]]
|192
|
|-
|[[Kernel/NtCreateSemaphore]]
|193
|
|-
|[[Kernel/NtCreateTimer]]
|194
|
|-
|[[Kernel/NtDeleteFile]]
|195
|
|-
|[[Kernel/NtDeviceIoControlFile]]
|196
|
|-
|[[Kernel/NtDuplicateObject]]
|197
|
|-
|[[Kernel/NtFlushBuffersFile]]
|198
|
|-
|[[Kernel/NtFreeVirtualMemory]]
|199
|
|-
|[[Kernel/NtFsControlFile]]
|200
|
|-
|[[Kernel/NtOpenDirectoryObject]]
|201
|
|-
|[[Kernel/NtOpenFile]]
|202
|
|-
|[[Kernel/NtOpenSymbolicLinkObject]]
|203
|
|-
|[[Kernel/NtProtectVirtualMemory]]
|204
|
|-
|[[Kernel/NtPulseEvent]]
|205
|
|-
|[[Kernel/NtQueueApcThread]]
|206
|
|-
|[[Kernel/NtQueryDirectoryFile]]
|207
|
|-
|[[Kernel/NtQueryDirectoryObject]]
|208
|
|-
|[[Kernel/NtQueryEvent]]
|209
|
|-
|[[Kernel/NtQueryFullAttributesFile]]
|210
|
|-
|[[Kernel/NtQueryInformationFile]]
|211
|
|-
|[[Kernel/NtQueryIoCompletion]]
|212
|
|-
|[[Kernel/NtQueryMutant]]
|213
|
|-
|[[Kernel/NtQuerySemaphore]]
|214
|
|-
|[[Kernel/NtQuerySymbolicLinkObject]]
|215
|
|-
|[[Kernel/NtQueryTimer]]
|216
|
|-
|[[Kernel/NtQueryVirtualMemory]]
|217
|
|-
|[[Kernel/NtQueryVolumeInformationFile]]
|218
|
|-
|[[Kernel/NtReadFile]]
|219
|
|-
|[[Kernel/NtReadFileScatter]]
|220
|
|-
|[[Kernel/NtReleaseMutant]]
|221
|
|-
|[[Kernel/NtReleaseSemaphore]]
|222
|
|-
|[[Kernel/NtRemoveIoCompletion]]
|223
|
|-
|[[Kernel/NtResumeThread]]
|224
|
|-
|[[Kernel/NtSetEvent]]
|225
|
|-
|[[Kernel/NtSetInformationFile]]
|226
|
|-
|[[Kernel/NtSetIoCompletion]]
|227
|
|-
|[[Kernel/NtSetSystemTime]]
|228
|
|-
|[[Kernel/NtSetTimerEx]]
|229
|
|-
|[[Kernel/NtSignalAndWaitForSingleObjectEx]]
|230
|
|-
|[[Kernel/NtSuspendThread]]
|231
|
|-
|[[Kernel/NtUserIoApcDispatcher]]
|232
|
|-
|[[Kernel/NtWaitForSingleObject]]
|233
|
|-
|[[Kernel/NtWaitForSingleObjectEx]]
|234
|
|-
|[[Kernel/NtWaitForMultipleObjectsEx]]
|235
|
|-
|[[Kernel/NtWriteFile]]
|236
|
|-
|[[Kernel/NtWriteFileGather]]
|237
|
|-
|[[Kernel/NtYieldExecution]]
|238
|
|-
|[[Kernel/ObCreateObject]]
|239
|
|-
|[[Kernel/ObDirectoryObjectType]]
|240
|Variable?
|-
|[[Kernel/ObInsertObject]]
|241
|
|-
|[[Kernel/ObMakeTemporaryObject]]
|242
|
|-
|[[Kernel/ObOpenObjectByName]]
|243
|
|-
|[[Kernel/ObOpenObjectByPointer]]
|244
|
|-
|[[Kernel/ObpObjectHandleTable]]
|245
|Variable?
|-
|[[Kernel/ObReferenceObjectByHandle]]
|246
|
|-
|[[Kernel/ObReferenceObjectByName]]
|247
|
|-
|[[Kernel/ObReferenceObjectByPointer]]
|248
|
|-
|[[Kernel/ObSymbolicLinkObjectType]]
|249
|Variable?
|-
|[[Kernel/ObfDereferenceObject]]
|250
|
|-
|[[Kernel/ObfReferenceObject]]
|251
|
|-
|[[Kernel/PhyGetLinkState]]
|252
|
|-
|[[Kernel/PhyInitialize]]
|253
|
|-
|[[Kernel/PsCreateSystemThread]]
|254
|
|-
|[[Kernel/PsCreateSystemThreadEx]]
|255
|
|-
|[[Kernel/PsQueryStatistics]]
|256
|
|-
|[[Kernel/PsSetCreateThreadNotifyRoutine]]
|257
|
|-
|[[Kernel/PsTerminateSystemThread]]
|258
|
|-
|[[Kernel/PsThreadObjectType]]
|259
|Variable?
|-
|[[Kernel/RtlAnsiStringToUnicodeString]]
|260
|
|-
|[[Kernel/RtlAppendStringToString]]
|261
|
|-
|[[Kernel/RtlAppendUnicodeStringToString]]
|262
|
|-
|[[Kernel/RtlAppendUnicodeToString]]
|263
|
|-
|[[Kernel/RtlAssert]]
|264
|
|-
|[[Kernel/RtlCaptureContext]]
|265
|
|-
|[[Kernel/RtlCaptureStackBackTrace]]
|266
|
|-
|[[Kernel/RtlCharToInteger]]
|267
|
|-
|[[Kernel/RtlCompareMemory]]
|268
|
|-
|[[Kernel/RtlCompareMemoryUlong]]
|269
|
|-
|[[Kernel/RtlCompareString]]
|270
|
|-
|[[Kernel/RtlCompareUnicodeString]]
|271
|
|-
|[[Kernel/RtlCopyString]]
|272
|
|-
|[[Kernel/RtlCopyUnicodeString]]
|273
|
|-
|[[Kernel/RtlCreateUnicodeString]]
|274
|
|-
|[[Kernel/RtlDowncaseUnicodeChar]]
|275
|
|-
|[[Kernel/RtlDowncaseUnicodeString]]
|276
|
|-
|[[Kernel/RtlEnterCriticalSection]]
|277
|
|-
|[[Kernel/RtlEnterCriticalSectionAndRegion]]
|278
|
|-
|[[Kernel/RtlEqualString]]
|279
|
|-
|[[Kernel/RtlEqualUnicodeString]]
|280
|
|-
|[[Kernel/RtlExtendedIntegerMultiply]]
|281
|
|-
|[[Kernel/RtlExtendedLargeIntegerDivide]]
|282
|
|-
|[[Kernel/RtlExtendedMagicDivide]]
|283
|
|-
|[[Kernel/RtlFillMemory]]
|284
|
|-
|[[Kernel/RtlFillMemoryUlong]]
|285
|
|-
|[[Kernel/RtlFreeAnsiString]]
|286
|
|-
|[[Kernel/RtlFreeUnicodeString]]
|287
|
|-
|[[Kernel/RtlGetCallersAddress]]
|288
|
|-
|[[Kernel/RtlInitAnsiString]]
|289
|
|-
|[[Kernel/RtlInitUnicodeString]]
|290
|
|-
|[[Kernel/RtlInitializeCriticalSection]]
|291
|
|-
|[[Kernel/RtlIntegerToChar]]
|292
|
|-
|[[Kernel/RtlIntegerToUnicodeString]]
|293
|
|-
|[[Kernel/RtlLeaveCriticalSection]]
|294
|
|-
|[[Kernel/RtlLeaveCriticalSectionAndRegion]]
|295
|
|-
|[[Kernel/RtlLowerChar]]
|296
|
|-
|[[Kernel/RtlMapGenericMask]]
|297
|
|-
|[[Kernel/RtlMoveMemory]]
|298
|
|-
|[[Kernel/RtlMultiByteToUnicodeN]]
|299
|
|-
|[[Kernel/RtlMultiByteToUnicodeSize]]
|300
|
|-
|[[Kernel/RtlNtStatusToDosError]]
|301
|
|-
|[[Kernel/RtlRaiseException]]
|302
|
|-
|[[Kernel/RtlRaiseStatus]]
|303
|
|-
|[[Kernel/RtlTimeFieldsToTime]]
|304
|
|-
|[[Kernel/RtlTimeToTimeFields]]
|305
|
|-
|[[Kernel/RtlTryEnterCriticalSection]]
|306
|
|-
|[[Kernel/RtlUlongByteSwap]]
|307
|
|-
|[[Kernel/RtlUnicodeStringToAnsiString]]
|308
|
|-
|[[Kernel/RtlUnicodeStringToInteger]]
|309
|
|-
|[[Kernel/RtlUnicodeToMultiByteN]]
|310
|
|-
|[[Kernel/RtlUnicodeToMultiByteSize]]
|311
|
|-
|[[Kernel/RtlUnwind]]
|312
|
|-
|[[Kernel/RtlUpcaseUnicodeChar]]
|313
|
|-
|[[Kernel/RtlUpcaseUnicodeString]]
|314
|
|-
|[[Kernel/RtlUpcaseUnicodeToMultiByteN]]
|315
|
|-
|[[Kernel/RtlUpperChar]]
|316
|
|-
|[[Kernel/RtlUpperString]]
|317
|
|-
|[[Kernel/RtlUshortByteSwap]]
|318
|
|-
|[[Kernel/RtlWalkFrameChain]]
|319
|
|-
|[[Kernel/RtlZeroMemory]]
|320
|
|-
|[[Kernel/XboxEEPROMKey]]
|321
|Variable?
|-
|[[Kernel/XboxHardwareInfo]]
|322
|Variable?
|-
|[[Kernel/XboxHDKey]]
|323
|Variable?
|-
|[[Kernel/XboxKrnlVersion]]
|324
|Variable?
|-
|[[Kernel/XboxSignatureKey]]
|325
|Variable?
|-
|[[Kernel/XeImageFileName]]
|326
|Variable?
|-
|[[Kernel/XeLoadSection]]
|327
|
|-
|[[Kernel/XeUnloadSection]]
|328
|
|-
|[[Kernel/READ_PORT_BUFFER_UCHAR]]
|329
|
|-
|[[Kernel/READ_PORT_BUFFER_USHORT]]
|330
|
|-
|[[Kernel/READ_PORT_BUFFER_ULONG]]
|331
|
|-
|[[Kernel/WRITE_PORT_BUFFER_UCHAR]]
|332
|
|-
|[[Kernel/WRITE_PORT_BUFFER_USHORT]]
|333
|
|-
|[[Kernel/WRITE_PORT_BUFFER_ULONG]]
|334
|
|-
|[[Kernel/XcSHAInit]]
|335
|
|-
|[[Kernel/XcSHAUpdate]]
|336
|
|-
|[[Kernel/XcSHAFinal]]
|337
|
|-
|[[Kernel/XcRC4Key]]
|338
|
|-
|[[Kernel/XcRC4Crypt]]
|339
|
|-
|[[Kernel/XcHMAC]]
|340
|
|-
|[[Kernel/XcPKEncPublic]]
|341
|
|-
|[[Kernel/XcPKDecPrivate]]
|342
|
|-
|[[Kernel/XcPKGetKeyLen]]
|343
|
|-
|[[Kernel/XcVerifyPKCS1Signature]]
|344
|
|-
|[[Kernel/XcModExp]]
|345
|
|-
|[[Kernel/XcDESKeyParity]]
|346
|
|-
|[[Kernel/XcKeyTable]]
|347
|
|-
|[[Kernel/XcBlockCrypt]]
|348
|
|-
|[[Kernel/XcBlockCryptCBC]]
|349
|
|-
|[[Kernel/XcCryptService]]
|350
|
|-
|[[Kernel/XcUpdateCrypto]]
|351
|
|-
|[[Kernel/RtlRip]]
|352
|
|-
|[[Kernel/XboxLANKey]]
|353
|
|-
|[[Kernel/XboxAlternateSignatureKeys]]
|354
|Variable?
|-
|[[Kernel/XePublicKeyData]]
|355
|Variable?
|-
|[[Kernel/HalBootSMCVideoMode]]
|356
|Variable?
|-
|[[Kernel/IdexChannelObject]]
|357
|Variable?
|-
|[[Kernel/HalIsResetOrShutdownPending]]
|358
|
|-
|[[Kernel/IoMarkIrpMustComplete]]
|359
|
|-
|[[Kernel/HalInitiateShutdown]]
|360
|
|-
|[[Kernel/RtlSnprintf]]
|361
|Unused?
|-
|[[Kernel/RtlSprintf]]
|362
|Unused?
|-
|[[Kernel/RtlVsnprintf]]
|363
|Unused?
|-
|[[Kernel/RtlVsprintf]]
|364
|Unused?
|-
|[[Kernel/HalEnableSecureTrayEject]]
|365
|
|-
|[[Kernel/HalWriteSMCScratchRegister]]
|366
|
|-
|
|367
|Unused?
|-
|
|368
|Unused?
|-
|
|369
|Unused?
|-
|
|370
|Unused?
|-
|
|371
|Unused?
|-
|
|372
|Unused?
|-
|
|373
|Unused?
|-
|[[Kernel/MmDbgAllocateMemory]]
|374
|Devkits only!
|-
|[[Kernel/MmDbgFreeMemory]]
|375
|Devkits only!
|-
|[[Kernel/MmDbgQueryAvailablePages]]
|376
|Devkits only!
|-
|[[Kernel/MmDbgReleaseAddress]]
|377
|Devkits only!
|-
|[[Kernel/MmDbgWriteCheck]]
|378
|Devkits only!
|}

== See Also ==

[[Hard Drive Files]]