xboxdevwiki - User contributions [en]

Xbox Input Devices

2024-02-06T07:42:46Z

QuantX: Updated description of Steel Battalion Controller input/output format

== XID Overview ==

XIDs are USB devices.

The hardware side is USB with a different plug while the software side is USB without HID-descriptors.
Technicly a XID is a USB-hub for the Memory-Units and the XBL Communicator.
The logical XID gamepad USB device is internally connected to that hub.

=== USB Adapters ===
The Xbox's Input devices are USB devices. As such, you can connect a keyboard to the Xbox, or a gamepad to your PC. In fact, Linux already has drivers for the gamepad. In order to preserve Xbox hardware, please do not cut OEM Xbox cables to make an adapter; decent adapters can be acquired cheaply (~$10 USD ea. on 2017.04.30).

[[File:Xboxmaletousbfemale.png|thumb|right|Wiring diagram to show how male Xbox controller plug maps to standard female USB connector. White cable color is depicted as gray for better visibility. The yellow cable is not connected to the USB side, as it's exclusive to Xbox.]]

{| class="wikitable"
|-
! Port (From)
! Plug (To)
! Link
|-
| Xbox
| USB-A
| [https://www.amazon.com/gp/product/B000RT2868 Amazon] [https://www.aliexpress.com/item/32948906701.html Aliexpress]
|-
| USB-A
| Xbox
| [https://www.amazon.com/gp/product/B00F52LQHO Amazon] [https://www.aliexpress.com/item/4000452932782.html Aliexpress]
|}

=== Wiring ===

Untested / unverified! Take this with a grain of salt.

{| class="wikitable"
!Pin
!Typical cable color
!Description
|-
|1
|Red
|VCC
|-
|2
|White
|USB D+
|-
|3
|Green
|USB D-
|-
|4
|Yellow
|VBlank signal from video output (for Lightguns)
|-
|5
|Black
|GND
|-
|}

=== Protocol ===

XID are similar to HID but have custom Vendor requests

==== Control Transfers ====

===== GET_DESCRIPTOR =====

* bmRequestType: 0xC1
* bRequest: 6
* wValue: 0x4200
* wIndex: Interface number
* wLength: <length of respective report; typically 16>

Actual length is truncated to size of descriptor or wLength. Whichever is smaller.

<pre>
typedef struct XIDDescriptor {
uint8_t bLength;
uint8_t bDescriptorType;
uint16_t bcdXid;
uint8_t bType;
uint8_t bSubType;
uint8_t bMaxInputReportSize;
uint8_t bMaxOutputReportSize;
uint16_t wAlternateProductIds[4];
};
</pre>

bDescriptorType is probably always 0x42.

====== bType = 1: Xbox Gamecontroller ======

* bSubType:
** 0x01 = Gamepad (Duke)
** 0x02 = Gamepad (Controller-S)
** 0x10 = Steering wheel
** 0x20 = Arcade Stick
** 0x50 = Light gun

====== bType = 3: Xbox DVD Movie Playback IR Dongle======

* bSubType:
** 0x00

====== bType = 128: Steel Battalion ======

* bSubType:
** 0x01

====== Example XID reports ======

This is an example XID descriptor taken from a Controller-S (VID 0x045E / PID 0x0289).
<pre>
bLength 0x10 (16 bytes)
bDescriptorType 0x42
bcdXid 0x0100 (USB 1.0)
bType 0x01
bSubType 0x02
bMaxInputReportSize 0x14 (20 bytes)
bMaxOutputReportSize 0x06 (6 bytes)
wAlternateProductIds 4 x 0xFFFF
</pre>

This is an example XID descriptor taken from a Steel Battalion controller.
<pre>
bLength 0x10 (16 bytes)
bDescriptorType 0x42
bcdXid 0x0100 (USB 1.0)
bType 0x80
bSubType 0x01
bMaxInputReportSize 0x1A (26 bytes)
bMaxOutputReportSize 0x16 (22 bytes)
wAlternateProductIds 4 x 0xFFFF
</pre>

This is an example XID descriptor taken from an official Microsoft DVD Movie Playback IR dongle.
<pre>
bLength 0x08 (8 bytes)
bDescriptorType 0x42
bcdXid 0x0100 (USB 1.0)
bType 0x03
bSubType 0x00
bMaxInputReportSize 0x06 (6 bytes)
bMaxOutputReportSize 0x00 (0 bytes)
</pre>

===== GET_CAPABILITIES =====

* bmRequestType: 0xC1
* bRequest: 1
* wValue:
** 0x0100 for input
** 0x0200 for output
* wIndex: Interface number
* wLength: <length of respective report>

* STALL if wValue not supported.

Actual length is truncated to size of report or wLength. Whichever is smaller.

<pre>typedef struct XIDGamepadCapabilities {
uint8_t bReportId;
uint8_t bLength;
<Data>
}</pre>

The data will be similar to the GET_REPORT, but instead of storing actual values, it will have bits set (1) where the bit is valid in the respective report.
If the bit is auto-generated, it will be cleared (0).

===== SET_REPORT =====

* bmRequestType: 0x21
* bRequest: 9
* wValue: 0x0200
* wIndex: Interface number
* wLength: <length of report; typically 6>

* STALL if wValue not supported.

====== Typical report ======

<pre>typedef struct XIDGamepadReport {
uint8_t bReportId;
uint8_t bLength;
<Data>
}</pre>

===== GET_REPORT =====

* bmRequestType: 0xA1
* bRequest: 1
* wValue: 0x0100
* wIndex: Interface number
* wLength: <length of report; typically 20>

* STALL if wValue not supported or if wLength is greater than report size.
* ACK if supported.

====== Typical report ======

<pre>typedef struct XIDGamepadOutputReport {
uint8_t report_id; //FIXME: is this correct?
uint8_t length;
<Data>
}</pre>

==== Interrupt transfers ====

Alternatively interrupt-in and interrupt-out transfers can be used for GET_REPORT and SET_REPORT respectively.

In case of the interrupt-in, there is another status which can occur now:

* NAK if supported but no changes since last ACK.

== Standard Gamepads ==

=== Microsoft Hardware Variants ===

There are a few hardware re-designs of the Microsoft Gamepad.

{| class="wikitable"
!Controller Name
!Part Number
!Board Model
!Notes
!Datasheets
|-
|Xbox Game Controller (AKA "Duke")
|X08-17160
|23-0819B
|Earliest known model{{FIXME|Reason=Small sample size (5), can't confirm}}. 3 IC's: Dedicated ST 92163/JFL Micro Controller, dedicated AT43USB401 USB Controller, 4 Channel Analog Mux LW052A.
|[https://archive.org/details/ST92163 ST 92163/JFL], AT43USB401{{FIXME|Reason=Can't find datasheet}}, [https://web.archive.org/web/20191230174412/https://www.rockbox.org/wiki/pub/Main/DataSheets/TexasInstrumentsLW052ADataSheet.pdf LW052A]
|-
|Xbox Game Controller (AKA "Duke")
|X08-17160
|K023B121
|Same as 23-0819B, but manufactured in China. Only Board Model that does not follow naming conventions. Hardware identical. Easily identified by a serial number that starts with "KD".
|[https://archive.org/details/ST92163 ST 92163/JFL], AT43USB401{{FIXME|Reason=Can't find datasheet}}, [https://web.archive.org/web/20191230174412/https://www.rockbox.org/wiki/pub/Main/DataSheets/TexasInstrumentsLW052ADataSheet.pdf LW052A]
|-
|Xbox Game Controller (AKA "Duke")
|X08-17160
|23-0819C
|Last known Duke model.{{FIXME|Reason=Small sample size (5), can't confirm}}. Identical to 23-0819B in hardware, new silkscreen markings show this model is [https://en.wikipedia.org/wiki/UL_94 UL-94 V-0 compliant]. All boards after this are V-0 compliant.
|[https://archive.org/details/ST92163 ST 92163/JFL], AT43USB401{{FIXME|Reason=Can't find datasheet}}, [https://web.archive.org/web/20191230174412/https://www.rockbox.org/wiki/pub/Main/DataSheets/TexasInstrumentsLW052ADataSheet.pdf LW052A]
|-
|Xbox Game Controller (Looks like an S, with green Xbox jewel)
|X08-19383
|23-0923A
|Japan and Australia exclusive model{{FIXME|Reason=Speculation, no hard source for this}}.Minification of "Duke" PCB Design. Has exact same IC's as the Duke, only in an S controller design.
|[https://archive.org/details/ST92163 ST 92163/JFL], AT43USB401{{FIXME|Reason=Can't find datasheet}}, [https://web.archive.org/web/20191230174412/https://www.rockbox.org/wiki/pub/Main/DataSheets/TexasInstrumentsLW052ADataSheet.pdf LW052A]
|-
|Xbox Controller S
|X08-69873
|23-0923B
|Minification of "Duke" PCB Design. Has exact same IC's as the Duke, only in an S controller design
|[https://archive.org/details/ST92163 ST 92163/JFL], AT43USB401{{FIXME|Reason=Can't find datasheet}}, [https://web.archive.org/web/20191230174412/https://www.rockbox.org/wiki/pub/Main/DataSheets/TexasInstrumentsLW052ADataSheet.pdf LW052A]
|-
|Xbox Controller S
|X08-69873
|23-0923H
|Entirely new PCB design. Single IC on the board, AT43USB355M-AC
|[https://archive.org/details/AT43USB355 AT43USB355M-AC]
|-
|Xbox Controller S
|X08-69873
|23-0923I
|PCB Design almost exactly the same as H revision. Only difference is the IC is smaller: AT43USB353M-AC
|[https://archive.org/details/AT43USB353M-AC AT43USB353M-AC]
|}

There are also dedicated Part Numbers for color variants:
{| class="wikitable"
!Controller Part Number
!Controller Description
!Board Model
|-
|X02332-001
|Crystal S Controller
|23-0923I
|-
|X09-64240-01
|Transparent Green Controller
|23-0923I
|-
|X800679-100
|Black S With Halo Jewel
|23-0923I
|}

=== USB Descriptors ===

See https://github.com/xboxdrv/xboxdrv/blob/stable/src/xpad_device.cpp for a list of devices.

==== 23-0819B ====

<pre>
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x045e Microsoft Corp.
idProduct 0x0202 Xbox Controller
bcdDevice 1.00
iManufacturer 0
iProduct 0
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 88 Xbox
bInterfaceSubClass 66 Controller
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
</pre>

==== K023B121 ====

Identical to 23-0819B {{FIXME|Reason=Confirm with xid-dumper tool}}

==== 23-0819C ====

Identical to 23-0819B {{FIXME|Reason=Confirm with xid-dumper tool}}

==== 23-0923A ====

Changes from 23-0819B

<pre>
Device Descriptor:
idProduct: 0x0285
</pre>

==== 23-0923B ====

{{FIXME|Reason=No Descriptor Dump}}

==== 23-0923H ====

Changes from 23-0819B

<pre>
Device Descriptor
bMaxPacketSize0: 8
idProduct: 0x0289
bcdDevice: 1.20
Configuration Descriptor
Interface Descriptor
Endpoint Descriptor
bEndpointAddress: 0x81
</pre>

==== 23-0923I ====

Changes from 23-0923H

<pre>
Device Descriptor
bcdDevice: 1.21
</pre>

=== Controller to Xbox ===

20 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|{{input-dy+}}
|2
|0x01
|
|-
|{{input-dy-}}
|2
|0x02
|
|-
|{{input-dx-}}
|2
|0x04
|
|-
|{{input-dx+}}
|2
|0x08
|
|-
|{{input-start}}
|2
|0x10
|
|-
|{{input-back}}
|2
|0x20
|
|-
|{{input-ls}}
|2
|0x40
|
|-
|{{input-rs}}
|2
|0x80
|
|-
|{{input-a}}
|4
|0xFF
|Button is analog
|-
|{{input-b}}
|5
|0xFF
|Button is analog
|-
|{{input-x}}
|6
|0xFF
|Button is analog
|-
|{{input-y}}
|7
|0xFF
|Button is analog
|-
|{{input-black}}
|8
|0xFF
|Button is analog
|-
|{{input-white}}
|9
|0xFF
|Button is analog
|-
|{{input-lt}}
|10
|0xFF
|Trigger is analog
|-
|{{input-rt}}
|11
|0xFF
|Trigger is analog
|-
|{{input-lx}}
|12
|0xFFFF
|Negative = Left; Positive = Right
|-
|{{input-ly}}
|14
|0xFFFF
|Negative = Down; Positive = Up
|-
|{{input-rx}}
|16
|0xFFFF
|Negative = Left; Positive = Right
|-
|{{input-ry}}
|18
|0xFFFF
|Negative = Down; Positive = Up
|}

=== Xbox to Controller ===

6 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|Left actuator strength
|2
|0xFFFF
|
|-
|Right actuator strength
|4
|0xFFFF
|
|}

The Microsoft Controller S will not react to packets which don't have a value of 6 in the <code>length</code> field of the header.
The Fanatec Speedster 3 ForceShock will still react to those. Further testing is necessary with other gamepads.

== Steering wheels ==

=== MadCatz Wheel ===

{{FIXME}}

=== Fanatec Speedster 3 ForceShock ===

==== Pedals ====

The Pedals are ''not'' a USB device.

Note that the cable going to the pedals is also ''not'' a USB port despite using the Xbox controller breakaway plug.
Likewise, plugging the pedals to a PC / Xbox won't provide a USB / XID (it is detected as garbage):

<pre>
new full-speed USB device number 14 using xhci_hcd
device descriptor read/64, error -71
device descriptor read/64, error -71
new full-speed USB device number 15 using xhci_hcd
device descriptor read/64, error -71
device descriptor read/64, error -71
new full-speed USB device number 16 using xhci_hcd
Device not responding to setup address.
Device not responding to setup address.
device not accepting address 16, error -71
new full-speed USB device number 17 using xhci_hcd
Device not responding to setup address.
Device not responding to setup address.
device not accepting address 17, error -71
unable to enumerate USB device
</pre>

==== Internal HUB ====

===== USB Descriptors =====

Power not connected, pedals not connected, not in Tuning mode:

<pre>
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 9 Hub
bDeviceSubClass 0
bDeviceProtocol 0 Full speed (or root) hub
bMaxPacketSize0 8
idVendor 0x3767
idProduct 0x0102
bcdDevice 0.01
iManufacturer 0
iProduct 1 End
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 25
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xa0
(Bus Powered)
Remote Wakeup
MaxPower 64mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 9 Hub
bInterfaceSubClass 0
bInterfaceProtocol 0 Full speed (or root) hub
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0001 1x 1 bytes
bInterval 255
Hub Descriptor:
bLength 9
bDescriptorType 41
nNbrPorts 3
wHubCharacteristic 0x000d
Per-port power switching
Compound device
Per-port overcurrent protection
bPwrOn2PwrGood 50 * 2 milli seconds
bHubContrCurrent 64 milli Ampere
DeviceRemovable 0x02
PortPwrCtrlMask 0xff
Hub Port Status:
Port 1: 0000.0103 power enable connect
Port 2: 0000.0100 power
Port 3: 0000.0100 power
can't get debug descriptor: Resource temporarily unavailable
Device Status: 0x0003
Self Powered
Remote Wakeup Enabled
</pre>

==== Steering wheel (and Pedals) ====

Always connected to port 1 of the internal HUB

===== USB Descriptors =====

<pre>
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 8
idVendor 0x3767
idProduct 0x0101
bcdDevice 2.80
iManufacturer 0
iProduct 0
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 88 Xbox
bInterfaceSubClass 66 Controller
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
can't get debug descriptor: Resource temporarily unavailable
Device Status: 0x0000
(Bus Powered)
</pre>

== Arcade Sticks ==

=== Xbox TECMO Dead or Alive 3 ARCADE Stick Joystick Controller Japan ===

{{FIXME}}

=== Street Fighter 15th Anniversary Edition Arcade Stick ===

{{FIXME}}

=== Gamester Xbox Arcade Stick ===

{{FIXME}}

=== Nuby Xbox Fighter Arcade Stick ===

{{FIXME}}

=== Nuby Xbox Arcade Super Stick ===

{{FIXME}}

The source image of the box and on device has item<nowiki>#:</nowiki>36020.

=== Naki Ultimate Fighting Stick ===

{{FIXME}}

[https://www.youtube.com/watch?v=4GphUsTzgds YouTube reviewer] report this joystick to have rumble support.

== Light guns ==

Light guns use similar input and output reports to standard gamepads. Their bSubType is set to 0x50. They report where they are aimed in place of the left stick coordinates, and an extra bit at offset 3 in their input reports flags whether the light gun is currently pointed at the screen or not. Light guns may not function properly if they are not supplied with a video sync signal (they may not populate their input reports correctly, or even fail to enumerate as USB devices entirely).

=== Controller to Xbox ===

20 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|{{input-dy+}}
|2
|0x01
|
|-
|{{input-dy-}}
|2
|0x02
|
|-
|{{input-dx-}}
|2
|0x04
|
|-
|{{input-dx+}}
|2
|0x08
|
|-
|{{input-start}}
|2
|0x10
|
|-
|{{input-back}}
|2
|0x20
|
|-
|Light visible
|3
|0x20
|Set to 1 if the gun is pointed to a bright screen, 0 if no light visible.
|-
|Unknown 1
|3
|0x40
|rowspan="2" | Light guns from different manufacturers include these two bits in their GET_CAPABILITIES reports, but they always seem to read back as 0 in GET_REPORT.
|-
|Unknown 2
|3
|0x80
|-
|{{input-a}} Trigger
|4
|0xFF
|rowspan="6" | Digital only, either 0 or 255
|-
|{{input-b}}
|5
|0xFF
|-
|{{input-x}}
|6
|0xFF
|-
|{{input-y}}
|7
|0xFF
|-
|{{input-black}}
|8
|0xFF
|-
|{{input-white}}
|9
|0xFF
|-
|{{input-lx}}
|12
|0xFFFF
|rowspan="2" | Absolute position using the full stick range.
(0, 0) is the center of the screen and is also reported if the light gun is pointed off-screen.
|-
|{{input-ly}}
|14
|0xFFFF
|}

=== Xbox to Controller ===

==== Force feedback: wValue: 0x0200, wLength: 6 ====

6 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|Actuator strength
|2
|0xFFFF
|
|-
|(Unused)
|4
|0x0000
|
|}

The 4Gamers-branded gun (which appears to be sold by a number of different manufacturers) only reports it has the left actuator, however it only responds to force feedback output reports for the ''right'' actuator. Games appear to always enable both actuators, whether the controller reports it has both or not.

==== Calibration: wValue: 0x0201, wLength: 10 ====

10 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|Center calibration X
|2
|0xFFFF
|rowspan="2"|Gun's reported value subtracted from (0,0)
|-
|Center calibration Y
|4
|0xFFFF
|-
|Top left calibration X
|6
|0xFFFF
|rowspan="2"|Gun's reported value subtracted from (-25000,25000)
|-
|Top left calibration Y
|8
|0xFFFF
|}

Light guns are expected to handle their own calibration, i.e. the game will tell the gun the offsets between its reported position and the expected position and then expect the gun to offset and scale its output to compensate. The calibration process runs as follows:

# The game will first send a calibration report with all four offsets reset to (0, 0), (0, 0) to reset any offsets and scaling.
# The game will now display a target in the centre of the screen and ask you to shoot it. This will tell it how "wrong" the gun is when aimed at where it thinks (0, 0) should be on the screen. If the gun normally shoots slightly too high and further to the right, it might report (1000, 3000) for example.
# The game sends a calibration report to the gun to negate the offset, e.g. (-1000, -3000), (0, 0) using our example of (1000, 3000) from before.
# The game will now display a target in at (-25000, 25000) on the screen and ask you to shoot it. This will tell it how "wrong" the gun is when aimed at the top left of the screen.
# The coordinates received from the gun will be subtracted from the expected (-25000, 25000) and sent back to the gun in the second part of the calibration report along with the values previously determined for the centre position. If the first calibration was enough to adjust the screen offset we might have seen the "perfect" coordinates of (-25000, 25000) in which case the report would be (-1000, -3000), (0, 0) again. However, if our gun read the coordinates slightly closer the the middle of the screen at (-20000, 22000) then the report would be (-1000, -3000), (5000, -3000).

If the light gun does not handle the calibration output report then you will not be able to get past the calibration screen in ''The House of the Dead III''.

=== EMS TopGun II ===

''This is an unlicensed / unofficial Xbox accessory.''

The website for this product can be found at http://www.hkems.com/product/xbox/EMSTopGun2.htm

The gun presents itself as a standard Xbox gamepad. It uses a different USB descriptor for Xbox (X) and the other mode (P).
There is no internal hub in this device.

{| class="wikitable"
! EMS TopGun II !! Xbox Gamepad !! Notes
|-
| Stick || {{input-d}} ||
|-
| Trigger || {{input-a}} || rowspan="4" | Digital only, either 0 or 255
|-
| Grip || {{input-b}}
|-
| A || {{input-x}}
|-
| B || {{input-y}}
|-
| START || {{input-start}} ||
|-
| SE/BA || {{input-back}} ||
|-
| Aim Left / Right || {{input-lx}} || rowspan="2" | Absolute position using the full stick range
|-
| Aim Up / Down || {{input-ly}}
|}

There is no right thumbstick, thumbstick presses, black/white button or trigger buttons (All of those read constant zeros).

===== Turbo Mode =====

* Turbo mode 0 keeps {{input-a}} pressed while trigger is held
* Turbo mode 1 toggles {{input-a}} rapidly while trigger is held
* Turbo mode 2 toggles {{input-a}} rapidly and once in a while {{input-b}} while trigger is held

===== Force Feedback =====

The upper part of the gun is moveable and should push back to simulate recoil (possibly hurting your thumb while you are using the stick).
I could not get the force feedback working, but I'm sure I've had it working in the past on PC.{{citation needed}}

==== USB Descriptors ====

This is the descriptor in the Xbox mode (X).

<pre>
Bus 003 Device 016: ID 0b9a:016b
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x0b9a
idProduct 0x016b
bcdDevice 4.57
iManufacturer 1 EMS̖E
iProduct 2 EMS TopGun
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 88 Xbox
bInterfaceSubClass 66 Controller
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 8
can't get debug descriptor: Resource temporarily unavailable
Device Status: 0x0000
(Bus Powered)
</pre>

=== Joytech Sharp Shooter ===

''This is an unlicensed / unofficial Xbox accessory.''

The third party light gun from Joytech reports itself as 2 devices and mentions pattent [http://www.google.com/patents/US6287198 US6287198]
it came with a detachable viewfinder scope without any magnification. a red dot apears in the viewfinder, its a reflection of a red led, powered by the gun over usb.

model numer: JS-901D

{| class="wikitable"
! Joytech Sharp Shooter !! Xbox Gamepad !! Notes
|-
| Stick || {{input-d}} ||
|-
| Trigger || {{input-a}} || rowspan="6" | Digital only, either 0 or 255 {{citation needed}}
|-
| B (Left side) || rowspan="3" | {{input-b}}
|-
| B (Right side)
|-
| B (Magazine button)
|-
| x || {{input-x}}
|-
| y || {{input-y}}
|-
| START || {{input-start}} ||
|-
| BACK || {{input-back}} ||
|-
| Aim Left / Right || {{input-lx}} || {{citation needed}}
|-
| Aim Up / Down || {{input-ly}} || {{citation needed}}
|}

There is no right thumbstick, thumbstick presses, black/white button or trigger buttons {{citation needed}}

===== Fire/Reload Mode =====

* Normal mode does nothing, normal operation
* Auto reload mode toggles {{input-b}} rapidly to rappidly reload {{citation needed}}
* Auto fire+reload mode toggles {{input-a}} + {{input-b}} rapidly {{citation needed}}

==== USB Descriptors ====

<pre>

Bus 003 Device 025: ID 1292:3006 Innomedia
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 8
idVendor 0x1292 Innomedia
idProduct 0x3006
bcdDevice 1.50
iManufacturer 0
iProduct 0
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 1 (error)
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 88 Xbox
bInterfaceSubClass 66 Controller
bInterfaceProtocol 0
iInterface 2 (error)
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4

Bus 003 Device 024: ID 1292:3006 Innomedia
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 9 Hub
bDeviceSubClass 0
bDeviceProtocol 0 Full speed (or root) hub
bMaxPacketSize0 8
idVendor 0x1292 Innomedia
idProduct 0x3006
bcdDevice 1.50
iManufacturer 1 (c) 2004 R0R3 Inc.
iProduct 2 US Patent 6,287,198
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 25
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 4 (c) R0R3 Devices Inc. US Patent 6,287,19Ē
bmAttributes 0xa0
(Bus Powered)
Remote Wakeup
MaxPower 64mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 9 Hub
bInterfaceSubClass 0
bInterfaceProtocol 0 Full speed (or root) hub
iInterface 5 (error)
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0001 1x 1 bytes
bInterval 255
Hub Descriptor:
bLength 9
bDescriptorType 41
nNbrPorts 3
wHubCharacteristic 0x000d
Per-port power switching
Compound device
Per-port overcurrent protection
bPwrOn2PwrGood 32 * 2 milli seconds
bHubContrCurrent 64 milli Ampere
DeviceRemovable 0x02
PortPwrCtrlMask 0x0e
Hub Port Status:
Port 1: 0000.0103 power enable connect
Port 2: 0000.0100 power
Port 3: 0100.0100 power
Device Status: 0x0000
(Bus Powered)
</pre>

== Microphones ==

=== Xbox Communicator ===

==== USB Descriptor ====

<pre>
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 8
idVendor 0x045e Microsoft Corp.
idProduct 0x0283 Xbox Communicator
bcdDevice 1.58
iManufacturer 0
iProduct 0
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x002d
bNumInterfaces 2
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 120
bInterfaceSubClass 0
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 9
bDescriptorType 5
bEndpointAddress 0x04 EP 4 OUT
bmAttributes 5
Transfer Type Isochronous
Synch Type Asynchronous
Usage Type Data
wMaxPacketSize 0x0030 1x 48 bytes
bInterval 1
bRefresh 0
bSynchAddress 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 120
bInterfaceSubClass 0
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 9
bDescriptorType 5
bEndpointAddress 0x85 EP 5 IN
bmAttributes 5
Transfer Type Isochronous
Synch Type Asynchronous
Usage Type Data
wMaxPacketSize 0x0030 1x 48 bytes
bInterval 1
bRefresh 0
bSynchAddress 0
</pre>

=== Xbox Karaoke ===

==== USB Descriptor ====

<pre>
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 8
idVendor 0x045e Microsoft Corp.
idProduct 0x0501
bcdDevice 1.00
iManufacturer 1 Licensed 3PP Vendor
iProduct 2 Karaoke Microphone Module
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x001b
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 121
bInterfaceSubClass 1
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 9
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 5
Transfer Type Isochronous
Synch Type Asynchronous
Usage Type Data
wMaxPacketSize 0x0060 1x 96 bytes
bInterval 1
bRefresh 0
bSynchAddress 0
</pre>

== Steel Battalion Controller ==

[[File:SBC.jpg|thumb|200px|Steel Battalion Controller Layout]]

=== USB Descriptors ===

<pre>
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 8
idVendor 0x0a7b
idProduct 0xd000
bcdDevice 1.00
iManufacturer 0
iProduct 0
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 500mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 88 Xbox
bInterfaceSubClass 66 Controller
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
</pre>

=== Controller to Xbox ===

From http://steelbattalionnet.codeplex.com/SourceControl/latest#SBC/SteelBattalionController.cs

26 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|RightJoyMainWeapon
|2
|0x01
|
|-
|RightJoyFire
|2
|0x02
|
|-
|RightJoyLockOn
|2
|0x04
|
|-
|Eject
|2
|0x08
|
|-
|CockpitHatch
|2
|0x10
|
|-
|Ignition
|2
|0x20
|
|-
|Start
|2
|0x40
|
|-
|MultiMonOpenClose
|2
|0x80
|
|-
|MultiMonMapZoomInOut
|3
|0x01
|
|-
|MultiMonModeSelect
|3
|0x02
|
|-
|MultiMonSubMonitor
|3
|0x04
|
|-
|MainMonZoomIn
|3
|0x08
|
|-
|MainMonZoomOut
|3
|0x10
|
|-
|FunctionFSS
|3
|0x20
|
|-
|FunctionManipulator
|3
|0x40
|
|-
|FunctionLineColorChange
|3
|0x80
|
|-
|Washing
|4
|0x01
|
|-
|Extinguisher
|4
|0x02
|
|-
|Chaff
|4
|0x04
|
|-
|FunctionTankDetach
|4
|0x08
|
|-
|FunctionOverride
|4
|0x10
|
|-
|FunctionNightScope
|4
|0x20
|
|-
|FunctionF1
|4
|0x40
|
|-
|FunctionF2
|4
|0x80
|
|-
|FunctionF3
|5
|0x01
|
|-
|WeaponConMain
|5
|0x02
|
|-
|WeaponConSub
|5
|0x04
|
|-
|WeaponConMagazine
|5
|0x08
|
|-
|Comm1
|5
|0x10
|
|-
|Comm2
|5
|0x20
|
|-
|Comm3
|5
|0x40
|
|-
|Comm4
|5
|0x80
|
|-
|Comm5
|6
|0x01
|
|-
|LeftJoySightChange
|6
|0x02
|
|-
|ToggleFilterControl
|6
|0x04
|
|-
|ToggleOxygenSupply
|6
|0x08
|
|-
|ToggleFuelFlowRate
|6
|0x10
|
|-
|ToggleBuffreMaterial
|6
|0x20
|
|-
|ToggleVTLocation
|6
|0x40
|
|-
|
|6
|0x80
|
|-
|
|7
|0xFF
|
|-
|
|8
|0xFF
|
|-
|AimingX
|9
|0xFFFF
|"Aiming Lever" joystick on the right. Unsigned X Axis value: 0 (Left) to 0xFFFF (Right).
|-
|AimingY
|11
|0xFFFF
|"Aiming Lever" joystick on the right. Unsigned Y Axis value: 0 (Top) to 0xFFFF (Bottom).
|-
|RotationLever
|13
|0xFFFF
|"Rotation Lever" joystick on the left. Signed X Axis value: -0x7FFF (Left) to 0x7FFF (Right)
|-
|SightChangeX
|15
|0xFFFF
|"Sight Change" analog stick on the "Rotation Lever" joystick. Signed X Axis value: -0x7FFF (Left) to 0x7FFF (Right)
|-
|SightChangeY
|17
|0xFFFF
|"Sight Change" analog stick on the "Rotation Lever" joystick. Signed Y Axis value: -0x7FFF (Top) to 0x7FFF (Bottom)
|-
|LeftPedal
|19
|0xFFFF
|
|-
|MiddlePedal
|21
|0xFFFF
|
|-
|RightPedal
|23
|0xFFFF
|
|-
|TunerDial
|24
|0x0F
|The 9 o'clock postion is 0, and the 6 o'clock position is 12. The blank area between the 6 and 9 o'clock positions is 13, 14, and 15 clockwise.
|-
|
|24
|0xF0
|
|-
|GearLever
|25
|0xFF
|The gear lever on the left block. R = -2, N = -1, 1st = 1, 2nd = 2, 3rd = 3, 4th = 4, 5th = 5. If the shifter is between two gears this value will be 0.
|}

=== Xbox to Controller ===

From http://steelbattalionnet.codeplex.com/SourceControl/latest#SBC/SteelBattalionController.cs

22 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|Start
|0
|0x00
|This will always be 0x00
|-
|bLen
|1
|0x16
|This will always be 0x16 (22 bytes)
|-
|EmergencyEject
|2
|0x0F
|
|-
|CockpitHatch
|2
|0xF0
|
|-
|Ignition
|3
|0x0F
|
|-
|Start
|3
|0xF0
|
|-
|OpenClose
|4
|0x0F
|
|-
|MapZoomInOut
|4
|0xF0
|
|-
|ModeSelect
|5
|0x0F
|
|-
|SubMonitorModeSelect
|5
|0xF0
|
|-
|MainMonitorZoomIn
|6
|0x0F
|
|-
|MainMonitorZoomOut
|6
|0xF0
|
|-
|ForecastShootingSystem
|7
|0x0F
|
|-
|Manipulator
|7
|0xF0
|
|-
|LineColorChange
|8
|0x0F
|
|-
|Washing
|8
|0xF0
|
|-
|Extinguisher
|9
|0x0F
|
|-
|Chaff
|9
|0xF0
|
|-
|TankDetach
|10
|0x0F
|
|-
|Override
|10
|0xF0
|
|-
|NightScope
|11
|0x0F
|
|-
|F1
|11
|0xF0
|
|-
|F2
|12
|0x0F
|
|-
|F3
|12
|0xF0
|
|-
|MainWeaponControl
|13
|0x0F
|
|-
|SubWeaponControl
|13
|0xF0
|
|-
|MagazineChange
|14
|0x0F
|
|-
|Comm1
|14
|0xF0
|
|-
|Comm2
|15
|0x0F
|
|-
|Comm3
|15
|0xF0
|
|-
|Comm4
|16
|0x0F
|
|-
|Comm5
|16
|0xF0
|
|-
|
|17
|0x0F
|
|-
|GearR
|17
|0xF0
|
|-
|GearN
|18
|0x0F
|
|-
|Gear1
|18
|0xF0
|
|-
|Gear2
|19
|0x0F
|
|-
|Gear3
|19
|0xF0
|
|-
|Gear4
|20
|0x0F
|
|-
|Gear5
|20
|0xF0
|
|-
|Unused?
|21
|
|-
|}

== Related links ==
[https://github.com/xqemu/xqemu/blob/xbox/hw/xbox/xid.c XID emulation in XQEMU]

[https://docs.google.com/spreadsheets/d/1-c1tXfOMvaWuno3ixQyI_rPCQVAZA24N4v9OPZUSrCk/edit?usp=sharing Compilation of Xbox Controller Hardware Research]

Xbe

2023-09-26T07:32:42Z

QuantX:

{{DISPLAYTITLE:XBE}}
XBE files (XBox Executable) are the main files that are executed in the Xbox System. In official games, these files are created by game developers, and then signed by Microsoft.

The file structure is adapted from Windows PE files. It is very similar, however it has important changes for the Xbox. The file is composed of an image header, a certificate, a collection of section headers, a collection of library versions, thread local storage data, a Microsoft bitmap, and the sections that contain the code and resources.

= Image Header =

The image header contains the information that describes where the other parts of the executable are located within the file, and how the executable should be treated and loaded. It has the following layout (all fields are little-endian):

{| class="wikitable
|-
! Offset
! Size
! Name
! Description
|-
! 0x0000
! 0x0004
| Magic Number
| This field must always equal 0x48454258 ("XBEH")
|-
! 0x0004
! 0x0100
| Digital Signature
| 256 Bytes. This is where a game is signed. Only on officially signed games is this field worthwhile.
|-
! 0x0104
! 0x0004
| Base Address
| Address at which to load this .XBE. Typically this will be 0x00010000.
|-
! 0x0108
! 0x0004
| Size of Headers
| Number of bytes that should be reserved for headers.
|-
! 0x010C
! 0x0004
| Size of Image
| Number of bytes that should be reserved for this image.
|-
! 0x0110
! 0x0004
| Size of Image Header
| Number of bytes that should be reserved for the image header. The header size varies by XDK version, but is at least 0x178.
|-
! 0x0114
! 0x0004
| TimeDate
| Time and Date when this image was created. UNIX timestamp format.
|-
! 0x0118
! 0x0004
| Certificate Address
| Address to a [[#Certificate|Certificate]] structure, after the .XBE is loaded into memory.
|-
! 0x011C
! 0x0004
| Number of Sections
| Number of sections contained in this .XBE.
|-
! 0x0120
! 0x0004
| Section Headers Address
| Address to an array of SectionHeader structures, after the .XBE is loaded into memory.
|-
! 0x0124
! 0x0004
| Initialization Flags
| Various flags for this .XBE file. Known flags are:

MountUtilityDrive = 0x00000001
FormatUtilityDrive = 0x00000002
Limit64Megabytes = 0x00000004
DontSetupHarddisk = 0x00000008
|-
! 0x0128
! 0x0004
| Entry Point
| Address to the Image entry point, after the .XBE is loaded into memory. This is where execution starts.

This value is encoded with an XOR key. Considering this is far too weak to be considered security, I assume this XOR is a clever method for discerning between Debug/Retail .XBE files without adding another field to the .XBE header. The XOR key is dependant on the build:

Beta = 0xE682F45B, Debug = 0x94859D4B, Retail = 0xA8FC57AB

To encode an entry point, you simply XOR the real entry point with either Debug or Retail key, depending on if you want the XBox to see this as a Debug or Retail executable.

To decode an entry point, you XOR with the debug key, then check if it is a valid entry point. If it is not, then you try again with the retail key.

Note: The Kernel Image Thunk Address member of this header must also be encoded as described later in this document.
|-
! 0x012C
! 0x0004
| TLS Address
| Address to a [[#TLS Table|TLS]] (Thread Local Storage) structure.
|-
! 0x0130
! 0x0004
| Stack Size
| Default stack size. As the Xbox does not allow for stacks to grow, this needs to be copied from the SizeOfStackReserve PE field, not SizeOfStackCommit!
|-
! 0x0134
! 0x0004
| PE Heap Reserve
| Copied from the PE file this .XBE was created from.
|-
! 0x0138
! 0x0004
| PE Heap Commit
| Copied from the PE file this .XBE was created from.
|-
! 0x013C
! 0x0004
| PE Base Address
| Copied from the PE file this .XBE was created from.
|-
! 0x0140
! 0x0004
| PE Size of Image
| Copied from the PE file this .XBE was created from.
|-
! 0x0144
! 0x0004
| PE Checksum
| Copied from the PE file this .XBE was created from.
|-
! 0x0148
! 0x0004
| PE TimeDate
| Copied from the PE file this .XBE was created from (UNIX timestamp format).
|-
! 0x014C
! 0x0004
| Debug PathName Address
| Address to the debug pathname (i.e. "D:\Nightlybuilds\011026.0\code\build\xbox\Release\simpsons.exe").
|-
! 0x0150
! 0x0004
| Debug FileName Address
| Address to the debug filename (i.e. "simpsons.exe")
|-
! 0x0154
! 0x0004
| Address to the UTF-16 debug filename (i.e. L"simpsons.exe")
| UTF-16 Debug FileName Address
|-
! 0x0158
! 0x0004
| Kernel Image Thunk Address
| Address to the Kernel Image Thunk Table, after the .XBE is loaded into memory. This is how .XBE files import kernel functions and data.

This value is encoded with an XOR key. Considering this is far too weak to be considered security, I assume this XOR is a clever method for discerning between Debug/Retail .XBE files without adding another field to the .XBE header. The XOR key is dependant on the build:

Beta = 0x46437DCD, Debug = 0xEFB1F152, Retail = 0x5B6D40B6

To encode a kernel thunk address, you simply XOR the real address with either Debug or Retail key, depending on if you want the XBox to see this as a Debug or Retail executable.

To decode a kernel thunk address, you XOR with the debug key, then check if it is a valid address. If it is not, then you try again with the retail key.

The Kernel Thunk Table itself is simply an array of pointers to Kernel imports. There are 366 possible imports, and the table is terminated with a zero dword (0x00000000). Typically the values in this table can be generated with the following formula:

KernelThunkTable[v] = ImportThunk + 0x80000000;

so, for example, the import PsCreateSystemThreadEx, which has a thunk value of 255 (0xFF) would be...

KernelThunkTable[v] = 0xFF + 0x80000000; // (0x800000FF)

When the .XBE is loaded by the OS (or the CXBX Emulator), all kernel imports are replaced by a valid function or data type address. In the case of CXBX, the import table entry at which (KernelThunkTable[v] & 0x1FF == 0xFF) will be replaced by &cxbx_PsCreateSystemThreadEx (which is a wrapper function).

Note: The Entry Point member of this header must also be encoded as described earlier in this document.
|-
! 0x015C
! 0x0004
| Non-Kernel Import Directory Address
| Address to the Non-Kernel Import Directory. It is typically safe to set this to zero.
|-
! 0x0160
! 0x0004
| Number of Library Versions
| Number of Library Versions pointed to by Library Versions Address.
|-
! 0x0164
! 0x0004
| Library Versions Address
| Address to an array of LibraryVersion structures, after the .XBE is loaded into memory.
|-
! 0x0168
! 0x0004
| Kernel Library Version Address
| Address to a LibraryVersion structure, after the .XBE is loaded into memory.
|-
! 0x016C
! 0x0004
| XAPI Library Version Address
| Address to a LibraryVersion structure, after the .XBE is loaded into memory.
|-
! 0x0170
! 0x0004
| Logo Bitmap Address
| Address to the Logo Bitmap (Typically a "Microsoft" logo). The format of this image is described here. This field can be set to zero, meaning there is no bitmap present.
|-
! 0x0174
! 0x0004
| Logo Bitmap Size
| Size (in bytes) of the Logo Bitmap data. The format of this image is described here.
|-
! 0x0178
! 0x0008
| Unknown1
| The meaning of this field hasn't been figured out yet. It only exists on XBEs built with an XDK version >= 5028.
|-
! 0x0180
! 0x0004
| Unknown2
| The meaning of this field hasn't been figured out yet. It only exists on XBEs built with an XDK version >= 5455.
|}

== LibraryVersion Table ==
{| class="wikitable
|-
! Offset
! Size
! Name
! Description
|-
! 0x0000
! 0x0008
| Library Name
| 8-byte ASCII-name of this library. (i.e. "XAPILIB")
|-
! 0x0008
! 0x0002
| Major Version
| Major version for this library (2-byte WORD).
|-
! 0x000A
! 0x0002
| Minor Version
| Minor version for this library (2-byte WORD).
|-
! 0x000C
! 0x0002
| Build Version
| Build version for this library (2-byte WORD).
|-
! 0x000E
! 0x0002
| Library Flags
| Various flags for this library. The fields are:

QFEVersion = 0x1FFF (13-Bit Mask)
Approved = 0x6000 (02-Bit Mask)
Debug Build = 0x8000 (01-Bit Mask)
|}

== TLS Table ==

The TLS Table contains all the information needed by the XBE to properly set up thread-local storage. It is structurally identical to the TLS Directory found in PE32 files<ref>https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#the-tls-section</ref>, and can be directly copied from there. If the XBE does not use any thread-local storage, this table may be omitted, and the respective field in the image header set to zero.

{| class="wikitable
|-
! Offset
! Size
! Name
! Description
|-
! 0x0000
! 0x0004
| Raw Data Start
| Absolute (i.e. not an RVA) address of start of the TLS variable data in the program image.
|-
! 0x0004
! 0x0004
| Raw Data End
| Absolute (i.e. not an RVA) address of end of the TLS variable data in the program image.
|-
! 0x0008
! 0x0004
| Address of Index
| Absolute (i.e. not an RVA) address of the TLS Index variable.
|-
! 0x000C
! 0x0004
| Address of Callbacks
| Absolute (i.e. not an RVA) address of the null-terminated TLS callback functions table.
|-
! 0x0010
! 0x0004
| Size of Zero Fill
| The number of bytes following the raw data that should be set to zero in memory.
|-
! 0x0014
! 0x0004
| Characteristics
| Describes alignment.
|}

= Certificate =

Each Xbox executable has a certificate that contains information about the title.

* Time and date when the certificate was created
* Title ID
* Title name
* Alternative title IDs
* Allowed types of media that the executable can be run from (HD, DVD, CD, etc.)
* Game region
* Game ratings
* Disk number
* Version
* LAN key raw data used for [[System Link]]
* Signature key raw data (used to sign [[Xbox Savegame System|savegames]])
* Alternate signature keys
* Original size of the certificate
* Online service name (not present in early executables)
* Run time security flags (not present in early executables)

=== Title ID ===

A title ID is usually 2 ASCII letters for the publisher, followed by a u16 integer game number (Above 2000 for non-original Xbox games)

{| class=wikitable
! Publisher ID !! Name
|-
| AC || Acclaim Entertainment
|-
| AH || ARUSH Entertainment
|-
| AP || Aquaplus
|-
| AQ || Aqua System
|-
| AS || ASK
|-
| AT || Atlus
|-
| AV || Activision
|-
| AY || Aspyr Media
|-
| BA || Bandai
|-
| BL || Black Box
|-
| BM || BAM! Entertainment
|-
| BR || Broccoli Co.
|-
| BS || Bethesda Softworks
|-
| BU || Bunkasha Co.
|-
| BV || Buena Vista Games
|-
| BW || BBC Multimedia
|-
| BZ || Blizzard
|-
| CC || Capcom
|-
| CK || Kemco Corporation {{citation needed|reason=Did they realy swapped the ASCII letters? is KC a curced acroniem in Japan? Just want to be sure its Kemco|date=May 2017}}
|-
| CM || Codemasters
|-
| CT || CTO S.p.A.
|-
| CV || Crave Entertainment
|-
| DC || DreamCatcher Interactive
|-
| DX || Davilex
|-
| EA || Electronic Arts (EA)
|-
| EC || Encore inc
|-
| EL || Enlight Software
|-
| EM || Empire Interactive
|-
| ES || Eidos Interactive
|-
| FI || Fox Interactive
|-
| FS || From Software
|-
| GE || Genki Co.
|-
| GV || Groove Games
|-
| HE || Tru Blu (Entertainment division of Home Entertainment Suppliers)
|-
| HP || Hip games
|-
| HU || Hudson Soft
|-
| HW || Highwaystar
|-
| IA || Mad Catz Interactive
|-
| IF || Idea Factory
|-
| IG || Infogrames
|-
| IL || [[Interlex Corporation]]
|-
| IM || Imagine Media
|-
| IO || Ignition Entertainment
|-
| IP || Interplay Entertainment
|-
| IX || InXile Entertainment {{citation needed}}
|-
| JA || Jaleco
|-
| JW || JoWooD
|-
| KB || Kemco {{citation needed|reason=CK is also Kemco, is this a diferent subsidairy or country based? Just want to be sure its Kemco|date=May 2017}}
|-
| KI || Kids Station Inc. {{citation needed|reason=Games info page was in japanese, I dont read japanese. but this seemed very logicaly the publisher, can a japanese reader confirm?|date=May 2017}}
|-
| KK || KiKi
|-
| KN || Konami
|-
| KO || KOEI
|-
| KT || Konami Tokyo
|-
| KU || Kobi and/or GAE (formerly Global A Entertainment){{citation needed|reason=What name did the publisher use at the time of release?|date=May 2017}}
|-
| LA || LucasArts
|-
| LS || Black Bean Games (publishing arm of Leader S.p.A.)
|-
| MD || Metro3D
|-
| ME || Medix
|-
| MI || Microïds
|-
| MJ || Majesco Entertainment
|-
| MM || Myelin Media
|-
| MP || MediaQuest {{citation needed|reason=Where is the P? I dont trust my source yet... but seems close|date=May 2017}}
|-
| MS || Microsoft Game Studios
|-
| MW || Midway Games
|-
| MX || Empire Interactive {{citation needed|reason=What happend to the publisher, who published this game?|date=May 2017}}
|-
| NK || NewKidCo
|-
| NL || NovaLogic
|-
| NM || Namco
|-
| OX || Oxygen Interactive
|-
| PC || Playlogic Entertainment
|-
| PL || Phantagram Co., Ltd.
|-
| RA || Rage
|-
| SA || Sammy
|-
| SC || SCi Games
|-
| SE || SEGA
|-
| SN || SNK
|-
| SS || Simon & Schuster
|-
| SU || Success Corporation
|-
| SW || Swing! Deutschland
|-
| TA || Takara
|-
| TC || Tecmo
|-
| TD || The 3DO Company (or just 3DO)
|-
| TK || Takuyo
|-
| TM || TDK Mediactive
|-
| TQ || THQ
|-
| TS || Titus Interactive
|-
| TT || Take-Two Interactive Software
|-
| US || Ubisoft
|-
| VC || Victor Interactive Software
|-
| VN || Vivendi Universal (just took Interplays publishing rights) {{citation needed}}
|-
| VU || Vivendi Universal Games
|-
| VV || Vivendi Universal Games {{citation needed}}
|-
| WE || Wanadoo Edition
|-
| WR || Warner Bros. Interactive Entertainment {{citation needed}}
|-
| XD || ''Xbox demo disk? (Japan?)''
|-
| XI || XPEC Entertainment and Idea Factory
|-
| XK || ''Xbox kiosk disk?'' {{citation needed}}
|-
| XL || ''Xbox special bundled or live demo disk?'' {{citation needed}}
|-
| XM || Evolved Games {{citation needed|reason=Probably not, game "Malice"|date=May 2017}}
|-
| XP || XPEC Entertainment
|-
| XR || Panorama
|-
| XX || Microsoft Windows Media Center Extender for Xbox
|-
| YB || YBM Sisa (South-Korea)
|-
| ZD || Zushi Games (formerly Zoo Digital Publishing)
|}

The title ID seems to double the information from the [[Xbox Game Disc]] mastering code etched into the ring or readable from the DMI.
The game number is expressed in 3 decimal digits here which suggests that it will always be below 1000.

'''Examples''':

[[FIFA Soccer 2003]]:
* DMI and mastering code: EA02302E (Meaning: publisher EA, game number 023, version 02, region Europe)
* Title ID: 45410017 [EA-023]

[[Halo: Combat Evolved]]:
* DMI and mastering code: MS00402A (Meaning: publisher Microsoft, game number 004, version 02, region America)
* Title ID: 4D530004 [MS-004]

[[Halo: Combat Evolved]]:
* DMI and mastering code: MS00404E (Meaning: publisher Microsoft, game number 004, version 04, region Europe)
* Title ID: 4D530004 [MS-004]

== Allowed media types ==
Allowed media types off which the executable is allowed to be run from. The following values are known:
{| class=wikitable
! Media type !! Value
|-
|HARD_DISK || 0x00000001
|-
|DVD_X2 || 0x00000002
|-
|DVD_CD || 0x00000004
|-
|CD || 0x00000008
|-
|DVD_5_RO || 0x00000010
|-
|DVD_9_RO || 0x00000020
|-
|DVD_5_RW || 0x00000040
|-
|DVD_9_RW || 0x00000080
|-
|DONGLE || 0x00000100
|-
|MEDIA_BOARD || 0x00000200
|-
|NONSECURE_HARD_DISK || 0x40000000
|-
|NONSECURE_MODE || 0x80000000
|-
|MEDIA_MASK || 0x00FFFFFF
|}

= Sections =
The sections are described by the section headers. The section headers start right after the certificate and contain describe where in the file the actual sections reside. Each header contains a 20 byte SHA-1 hash of the section that is checked by the Xbox to ensure the integrity of the sections.

The SHA-1 hash is computed by prepending the length of the section (excluding any padding) as an unsigned 32-bit integer followed by the contents of the section itself.

At least two sections are always present in an Xbox executable: .text and .rdata. There might be more sections that contain either executable code or resources such as images, text, etc.

== .text ==

The .text section contains all x86 subroutines to be executed by the [[CPU|processor]].

== .rdata ==

The .rdata section contains the [[Kernel|kernel thunk table]]. The ordinals in the table are to be resolved to the kernel's actual calling routine, when loaded.

= Xbox Alpha executable format =

Binaries from early Xbox development (Alpha units), are using a different binary format. There are no known public tools that can read them.
Known differences include that the first bytes of the file are 'XE' instead the 'XBEH' from the final XBE format. The format is rumored to be more like the Windows PE format.{{citation needed}}

= Resources and links =
* [http://www.caustik.com/cxbx/download/xbe.htm .XBE File Format 1.1]

[[Category:Fileformats]]

Xbe

2023-09-24T11:18:39Z

QuantX: Specify hashing algorithm used to check each section

{{DISPLAYTITLE:XBE}}
XBE files (XBox Executable) are the main files that are executed in the Xbox System. In official games, these files are created by game developers, and then signed by Microsoft.

The file structure is adapted from Windows PE files. It is very similar, however it has important changes for the Xbox. The file is composed of an image header, a certificate, a collection of section headers, a collection of library versions, thread local storage data, a Microsoft bitmap, and the sections that contain the code and resources.

= Image Header =

The image header contains the information that describes where the other parts of the executable are located within the file, and how the executable should be treated and loaded. It has the following layout (all fields are little-endian):

{| class="wikitable
|-
! Offset
! Size
! Name
! Description
|-
! 0x0000
! 0x0004
| Magic Number
| This field must always equal 0x48454258 ("XBEH")
|-
! 0x0004
! 0x0100
| Digital Signature
| 256 Bytes. This is where a game is signed. Only on officially signed games is this field worthwhile.
|-
! 0x0104
! 0x0004
| Base Address
| Address at which to load this .XBE. Typically this will be 0x00010000.
|-
! 0x0108
! 0x0004
| Size of Headers
| Number of bytes that should be reserved for headers.
|-
! 0x010C
! 0x0004
| Size of Image
| Number of bytes that should be reserved for this image.
|-
! 0x0110
! 0x0004
| Size of Image Header
| Number of bytes that should be reserved for the image header. The header size varies by XDK version, but is at least 0x178.
|-
! 0x0114
! 0x0004
| TimeDate
| Time and Date when this image was created. UNIX timestamp format.
|-
! 0x0118
! 0x0004
| Certificate Address
| Address to a [[#Certificate|Certificate]] structure, after the .XBE is loaded into memory.
|-
! 0x011C
! 0x0004
| Number of Sections
| Number of sections contained in this .XBE.
|-
! 0x0120
! 0x0004
| Section Headers Address
| Address to an array of SectionHeader structures, after the .XBE is loaded into memory.
|-
! 0x0124
! 0x0004
| Initialization Flags
| Various flags for this .XBE file. Known flags are:

MountUtilityDrive = 0x00000001
FormatUtilityDrive = 0x00000002
Limit64Megabytes = 0x00000004
DontSetupHarddisk = 0x00000008
|-
! 0x0128
! 0x0004
| Entry Point
| Address to the Image entry point, after the .XBE is loaded into memory. This is where execution starts.

This value is encoded with an XOR key. Considering this is far too weak to be considered security, I assume this XOR is a clever method for discerning between Debug/Retail .XBE files without adding another field to the .XBE header. The XOR key is dependant on the build:

Beta = 0xE682F45B, Debug = 0x94859D4B, Retail = 0xA8FC57AB

To encode an entry point, you simply XOR the real entry point with either Debug or Retail key, depending on if you want the XBox to see this as a Debug or Retail executable.

To decode an entry point, you XOR with the debug key, then check if it is a valid entry point. If it is not, then you try again with the retail key.

Note: The Kernel Image Thunk Address member of this header must also be encoded as described later in this document.
|-
! 0x012C
! 0x0004
| TLS Address
| Address to a [[#TLS Table|TLS]] (Thread Local Storage) structure.
|-
! 0x0130
! 0x0004
| Stack Size
| Default stack size. As the Xbox does not allow for stacks to grow, this needs to be copied from the SizeOfStackReserve PE field, not SizeOfStackCommit!
|-
! 0x0134
! 0x0004
| PE Heap Reserve
| Copied from the PE file this .XBE was created from.
|-
! 0x0138
! 0x0004
| PE Heap Commit
| Copied from the PE file this .XBE was created from.
|-
! 0x013C
! 0x0004
| PE Base Address
| Copied from the PE file this .XBE was created from.
|-
! 0x0140
! 0x0004
| PE Size of Image
| Copied from the PE file this .XBE was created from.
|-
! 0x0144
! 0x0004
| PE Checksum
| Copied from the PE file this .XBE was created from.
|-
! 0x0148
! 0x0004
| PE TimeDate
| Copied from the PE file this .XBE was created from (UNIX timestamp format).
|-
! 0x014C
! 0x0004
| Debug PathName Address
| Address to the debug pathname (i.e. "D:\Nightlybuilds\011026.0\code\build\xbox\Release\simpsons.exe").
|-
! 0x0150
! 0x0004
| Debug FileName Address
| Address to the debug filename (i.e. "simpsons.exe")
|-
! 0x0154
! 0x0004
| Address to the UTF-16 debug filename (i.e. L"simpsons.exe")
| UTF-16 Debug FileName Address
|-
! 0x0158
! 0x0004
| Kernel Image Thunk Address
| Address to the Kernel Image Thunk Table, after the .XBE is loaded into memory. This is how .XBE files import kernel functions and data.

This value is encoded with an XOR key. Considering this is far too weak to be considered security, I assume this XOR is a clever method for discerning between Debug/Retail .XBE files without adding another field to the .XBE header. The XOR key is dependant on the build:

Beta = 0x46437DCD, Debug = 0xEFB1F152, Retail = 0x5B6D40B6

To encode a kernel thunk address, you simply XOR the real address with either Debug or Retail key, depending on if you want the XBox to see this as a Debug or Retail executable.

To decode a kernel thunk address, you XOR with the debug key, then check if it is a valid address. If it is not, then you try again with the retail key.

The Kernel Thunk Table itself is simply an array of pointers to Kernel imports. There are 366 possible imports, and the table is terminated with a zero dword (0x00000000). Typically the values in this table can be generated with the following formula:

KernelThunkTable[v] = ImportThunk + 0x80000000;

so, for example, the import PsCreateSystemThreadEx, which has a thunk value of 255 (0xFF) would be...

KernelThunkTable[v] = 0xFF + 0x80000000; // (0x800000FF)

When the .XBE is loaded by the OS (or the CXBX Emulator), all kernel imports are replaced by a valid function or data type address. In the case of CXBX, the import table entry at which (KernelThunkTable[v] & 0x1FF == 0xFF) will be replaced by &cxbx_PsCreateSystemThreadEx (which is a wrapper function).

Note: The Entry Point member of this header must also be encoded as described earlier in this document.
|-
! 0x015C
! 0x0004
| Non-Kernel Import Directory Address
| Address to the Non-Kernel Import Directory. It is typically safe to set this to zero.
|-
! 0x0160
! 0x0004
| Number of Library Versions
| Number of Library Versions pointed to by Library Versions Address.
|-
! 0x0164
! 0x0004
| Library Versions Address
| Address to an array of LibraryVersion structures, after the .XBE is loaded into memory.
|-
! 0x0168
! 0x0004
| Kernel Library Version Address
| Address to a LibraryVersion structure, after the .XBE is loaded into memory.
|-
! 0x016C
! 0x0004
| XAPI Library Version Address
| Address to a LibraryVersion structure, after the .XBE is loaded into memory.
|-
! 0x0170
! 0x0004
| Logo Bitmap Address
| Address to the Logo Bitmap (Typically a "Microsoft" logo). The format of this image is described here. This field can be set to zero, meaning there is no bitmap present.
|-
! 0x0174
! 0x0004
| Logo Bitmap Size
| Size (in bytes) of the Logo Bitmap data. The format of this image is described here.
|-
! 0x0178
! 0x0008
| Unknown1
| The meaning of this field hasn't been figured out yet. It only exists on XBEs built with an XDK version >= 5028.
|-
! 0x0180
! 0x0004
| Unknown2
| The meaning of this field hasn't been figured out yet. It only exists on XBEs built with an XDK version >= 5455.
|}

== LibraryVersion Table ==
{| class="wikitable
|-
! Offset
! Size
! Name
! Description
|-
! 0x0000
! 0x0008
| Library Name
| 8-byte ASCII-name of this library. (i.e. "XAPILIB")
|-
! 0x0008
! 0x0002
| Major Version
| Major version for this library (2-byte WORD).
|-
! 0x000A
! 0x0002
| Minor Version
| Minor version for this library (2-byte WORD).
|-
! 0x000C
! 0x0002
| Build Version
| Build version for this library (2-byte WORD).
|-
! 0x000E
! 0x0002
| Library Flags
| Various flags for this library. The fields are:

QFEVersion = 0x1FFF (13-Bit Mask)
Approved = 0x6000 (02-Bit Mask)
Debug Build = 0x8000 (01-Bit Mask)
|}

== TLS Table ==

The TLS Table contains all the information needed by the XBE to properly set up thread-local storage. It is structurally identical to the TLS Directory found in PE32 files<ref>https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#the-tls-section</ref>, and can be directly copied from there. If the XBE does not use any thread-local storage, this table may be omitted, and the respective field in the image header set to zero.

{| class="wikitable
|-
! Offset
! Size
! Name
! Description
|-
! 0x0000
! 0x0004
| Raw Data Start
| Absolute (i.e. not an RVA) address of start of the TLS variable data in the program image.
|-
! 0x0004
! 0x0004
| Raw Data End
| Absolute (i.e. not an RVA) address of end of the TLS variable data in the program image.
|-
! 0x0008
! 0x0004
| Address of Index
| Absolute (i.e. not an RVA) address of the TLS Index variable.
|-
! 0x000C
! 0x0004
| Address of Callbacks
| Absolute (i.e. not an RVA) address of the null-terminated TLS callback functions table.
|-
! 0x0010
! 0x0004
| Size of Zero Fill
| The number of bytes following the raw data that should be set to zero in memory.
|-
! 0x0014
! 0x0004
| Characteristics
| Describes alignment.
|}

= Certificate =

Each Xbox executable has a certificate that contains information about the title.

* Time and date when the certificate was created
* Title ID
* Title name
* Alternative title IDs
* Allowed types of media that the executable can be run from (HD, DVD, CD, etc.)
* Game region
* Game ratings
* Disk number
* Version
* LAN key raw data used for [[System Link]]
* Signature key raw data (used to sign [[Xbox Savegame System|savegames]])
* Alternate signature keys
* Original size of the certificate
* Online service name (not present in early executables)
* Run time security flags (not present in early executables)

=== Title ID ===

A title ID is usually 2 ASCII letters for the publisher, followed by a u16 integer game number (Above 2000 for non-original Xbox games)

{| class=wikitable
! Publisher ID !! Name
|-
| AC || Acclaim Entertainment
|-
| AH || ARUSH Entertainment
|-
| AP || Aquaplus
|-
| AQ || Aqua System
|-
| AS || ASK
|-
| AT || Atlus
|-
| AV || Activision
|-
| AY || Aspyr Media
|-
| BA || Bandai
|-
| BL || Black Box
|-
| BM || BAM! Entertainment
|-
| BR || Broccoli Co.
|-
| BS || Bethesda Softworks
|-
| BU || Bunkasha Co.
|-
| BV || Buena Vista Games
|-
| BW || BBC Multimedia
|-
| BZ || Blizzard
|-
| CC || Capcom
|-
| CK || Kemco Corporation {{citation needed|reason=Did they realy swapped the ASCII letters? is KC a curced acroniem in Japan? Just want to be sure its Kemco|date=May 2017}}
|-
| CM || Codemasters
|-
| CT || CTO S.p.A.
|-
| CV || Crave Entertainment
|-
| DC || DreamCatcher Interactive
|-
| DX || Davilex
|-
| EA || Electronic Arts (EA)
|-
| EC || Encore inc
|-
| EL || Enlight Software
|-
| EM || Empire Interactive
|-
| ES || Eidos Interactive
|-
| FI || Fox Interactive
|-
| FS || From Software
|-
| GE || Genki Co.
|-
| GV || Groove Games
|-
| HE || Tru Blu (Entertainment division of Home Entertainment Suppliers)
|-
| HP || Hip games
|-
| HU || Hudson Soft
|-
| HW || Highwaystar
|-
| IA || Mad Catz Interactive
|-
| IF || Idea Factory
|-
| IG || Infogrames
|-
| IL || [[Interlex Corporation]]
|-
| IM || Imagine Media
|-
| IO || Ignition Entertainment
|-
| IP || Interplay Entertainment
|-
| IX || InXile Entertainment {{citation needed}}
|-
| JA || Jaleco
|-
| JW || JoWooD
|-
| KB || Kemco {{citation needed|reason=CK is also Kemco, is this a diferent subsidairy or country based? Just want to be sure its Kemco|date=May 2017}}
|-
| KI || Kids Station Inc. {{citation needed|reason=Games info page was in japanese, I dont read japanese. but this seemed very logicaly the publisher, can a japanese reader confirm?|date=May 2017}}
|-
| KK || KiKi
|-
| KN || Konami
|-
| KO || KOEI
|-
| KT || Konami Tokyo
|-
| KU || Kobi and/or GAE (formerly Global A Entertainment){{citation needed|reason=What name did the publisher use at the time of release?|date=May 2017}}
|-
| LA || LucasArts
|-
| LS || Black Bean Games (publishing arm of Leader S.p.A.)
|-
| MD || Metro3D
|-
| ME || Medix
|-
| MI || Microïds
|-
| MJ || Majesco Entertainment
|-
| MM || Myelin Media
|-
| MP || MediaQuest {{citation needed|reason=Where is the P? I dont trust my source yet... but seems close|date=May 2017}}
|-
| MS || Microsoft Game Studios
|-
| MW || Midway Games
|-
| MX || Empire Interactive {{citation needed|reason=What happend to the publisher, who published this game?|date=May 2017}}
|-
| NK || NewKidCo
|-
| NL || NovaLogic
|-
| NM || Namco
|-
| OX || Oxygen Interactive
|-
| PC || Playlogic Entertainment
|-
| PL || Phantagram Co., Ltd.
|-
| RA || Rage
|-
| SA || Sammy
|-
| SC || SCi Games
|-
| SE || SEGA
|-
| SN || SNK
|-
| SS || Simon & Schuster
|-
| SU || Success Corporation
|-
| SW || Swing! Deutschland
|-
| TA || Takara
|-
| TC || Tecmo
|-
| TD || The 3DO Company (or just 3DO)
|-
| TK || Takuyo
|-
| TM || TDK Mediactive
|-
| TQ || THQ
|-
| TS || Titus Interactive
|-
| TT || Take-Two Interactive Software
|-
| US || Ubisoft
|-
| VC || Victor Interactive Software
|-
| VN || Vivendi Universal (just took Interplays publishing rights) {{citation needed}}
|-
| VU || Vivendi Universal Games
|-
| VV || Vivendi Universal Games {{citation needed}}
|-
| WE || Wanadoo Edition
|-
| WR || Warner Bros. Interactive Entertainment {{citation needed}}
|-
| XD || ''Xbox demo disk? (Japan?)''
|-
| XI || XPEC Entertainment and Idea Factory
|-
| XK || ''Xbox kiosk disk?'' {{citation needed}}
|-
| XL || ''Xbox special bundled or live demo disk?'' {{citation needed}}
|-
| XM || Evolved Games {{citation needed|reason=Probably not, game "Malice"|date=May 2017}}
|-
| XP || XPEC Entertainment
|-
| XR || Panorama
|-
| XX || Microsoft Windows Media Center Extender for Xbox
|-
| YB || YBM Sisa (South-Korea)
|-
| ZD || Zushi Games (formerly Zoo Digital Publishing)
|}

The title ID seems to double the information from the [[Xbox Game Disc]] mastering code etched into the ring or readable from the DMI.
The game number is expressed in 3 decimal digits here which suggests that it will always be below 1000.

'''Examples''':

[[FIFA Soccer 2003]]:
* DMI and mastering code: EA02302E (Meaning: publisher EA, game number 023, version 02, region Europe)
* Title ID: 45410017 [EA-023]

[[Halo: Combat Evolved]]:
* DMI and mastering code: MS00402A (Meaning: publisher Microsoft, game number 004, version 02, region America)
* Title ID: 4D530004 [MS-004]

[[Halo: Combat Evolved]]:
* DMI and mastering code: MS00404E (Meaning: publisher Microsoft, game number 004, version 04, region Europe)
* Title ID: 4D530004 [MS-004]

== Allowed media types ==
Allowed media types off which the executable is allowed to be run from. The following values are known:
{| class=wikitable
! Media type !! Value
|-
|HARD_DISK || 0x00000001
|-
|DVD_X2 || 0x00000002
|-
|DVD_CD || 0x00000004
|-
|CD || 0x00000008
|-
|DVD_5_RO || 0x00000010
|-
|DVD_9_RO || 0x00000020
|-
|DVD_5_RW || 0x00000040
|-
|DVD_9_RW || 0x00000080
|-
|DONGLE || 0x00000100
|-
|MEDIA_BOARD || 0x00000200
|-
|NONSECURE_HARD_DISK || 0x40000000
|-
|NONSECURE_MODE || 0x80000000
|-
|MEDIA_MASK || 0x00FFFFFF
|}

= Sections =
The sections are described by the section headers. The section headers start right after the certificate and contain describe where in the file the actual sections reside. Each header contains a 20 byte SHA-1 hash of the section that is checked by the Xbox to ensure the integrity of the sections.

At least two sections are always present in an Xbox executable: .text and .rdata. There might be more sections that contain either executable code or resources such as images, text, etc.

== .text ==

The .text section contains all x86 subroutines to be executed by the [[CPU|processor]].

== .rdata ==

The .rdata section contains the [[Kernel|kernel thunk table]]. The ordinals in the table are to be resolved to the kernel's actual calling routine, when loaded.

= Xbox Alpha executable format =

Binaries from early Xbox development (Alpha units), are using a different binary format. There are no known public tools that can read them.
Known differences include that the first bytes of the file are 'XE' instead the 'XBEH' from the final XBE format. The format is rumored to be more like the Windows PE format.{{citation needed}}

= Resources and links =
* [http://www.caustik.com/cxbx/download/xbe.htm .XBE File Format 1.1]

[[Category:Fileformats]]

XPR

2023-09-22T03:17:02Z

QuantX: Complete rewrite based on my reverse engineering of the XPR0 format as used by Steel Battalion and Steel Battalion: Line of Contact

'''XPR''' probably stands for '''Xbox Packed Resource'''. It's a structure and file-format used by the [[Microsoft XDK]].
It is being used in parts of [[XAPI]].

XPRs can store a variety of different data types that are useful for Xbox D3D.
XPRs are storing data similar to internal structures in the D3D driver. So D3D has mechanisms to simply load such resources into D3D objects (by moving them into GPU accessible memory).

An XPR header consists of a number of resource entries which each look something like this{{FIXME|Incomplete}}:

<pre>
struct {
union {
uint32_t resource_type; // Type information and who "owns" this resource
struct {
uint32_t ref_count:16; // (lowest bits)
uint32_t type:3;
uint32_t unk3:13; // (highest bits)
};
};
uint32_t data; // Offset of this resource's data in the file
uint32_t unknown; // Always zero

union {
struct XPR_Vertexbuffer; // Vertexbuffer (type 0x0)
...
} XPR_Vertexbuffer;
struct { // Indexbuffer (type 0x1)
...
} XPR_Indexbuffer;
struct { // Unknown (type 0x2)
...
} ...;
struct { // Unknown (type 0x3)
...
} ...;
struct { // Texture (type 0x4)
...;
} XPR_Texture;
struct { // Unknown (type 0x5)
...
} ...;
struct { // Unknown (type 0x6)
...
} ...;
struct { // Unknown (type 0x7)
...
} ...;
};
} XPR_Resource;
</pre>

The XPR header as a whole looks like this:

<pre>
union {
struct {
char magic[4]; // Always "XPR0" / 0x30525058
uint32_t size; // Size of XPR (including magic and this field)
uint32_t header_size; // Size of this header rounded up to the nearest 2048 byte boundary
XPR_Resource resources[]; // An array of XPR_Resource entries
uint32_t last_resource; // Always 0xFFFFFFFF
};
uint8_t pad[XPR.header_size]; // Padded with 0xAD bytes
} XPR;
</pre>

The headers are then followed by the resource data.

----

Texture data can be stored in a variety of hardware defined formats as specified by the architecture of the NV2A GPU.
The format used, along with other information such as width, height, depth, and mipmap levels is stored in the resource header for the texture.

The format for an XPR texture resource is as follows:
<pre>
struct {
union {
uint32_t gpu; // This 32-bit value is placed in the NV097_SET_TEXTURE_FORMAT GPU register
struct {
uint32_t dma : 4; (lowest bits)
uint32_t dimensions : 4; // Is this a 1D, 2D, or 3D texture
uint32_t format : 8; // The format of the texture data (see the table below)
uint32_t levels : 4; // Number of mipmap levels
uint32_t width : 4; // Width of the texture in the following format: actual_width = (1 << width)
uint32_t height : 4; // Height of the texture in the following format: actual_height = (1 << height)
uint32_t depth: 4; (highest bits) // Depth of the texture (for 3D textures) in the following format: actual_depth = (1 << depth)
};
};
union {
uint32_t size; // Describes the size of a texture who's dimensions are not a power-of-2
struct {
uint32_t width : 12; (lowest bits) // The width of the texture in the following format: actual_width = width + 1
uint32_t height : 12; // The height of the texture in the following format: actual_height = height + 1
uint32_t depth : 8; (highest bits) // The depth of the texture (for 3D textures) in the following format: actual_depth = depth + 1
}
};
} XPR_Texture;
</pre>

For textures that use arbitrary dimensions the width, height, and depth attributes of the gpu field should be zero. For textures such as DXT that use power-of-2 dimensions the size field should be zero.

The following as a list of texture formats which can be used for the format attribute of the gpu field:

<pre>
NV097_SET_TEXTURE_FORMAT_COLOR_SZ_A1R5G5B5 0x02
NV097_SET_TEXTURE_FORMAT_COLOR_SZ_X1R5G5B5 0x03
NV097_SET_TEXTURE_FORMAT_COLOR_SZ_A4R4G4B4 0x04
NV097_SET_TEXTURE_FORMAT_COLOR_SZ_R5G6B5 0x05
NV097_SET_TEXTURE_FORMAT_COLOR_SZ_A8R8G8B8 0x06
NV097_SET_TEXTURE_FORMAT_COLOR_SZ_X8R8G8B8 0x07
NV097_SET_TEXTURE_FORMAT_COLOR_SZ_I8_A8R8G8B8 0x0B
NV097_SET_TEXTURE_FORMAT_COLOR_L_DXT1_A1R5G5B5 0x0C
NV097_SET_TEXTURE_FORMAT_COLOR_L_DXT23_A8R8G8B8 0x0E
NV097_SET_TEXTURE_FORMAT_COLOR_L_DXT45_A8R8G8B8 0x0F
NV097_SET_TEXTURE_FORMAT_COLOR_LU_IMAGE_R5G6B5 0x11
NV097_SET_TEXTURE_FORMAT_COLOR_LU_IMAGE_A8R8G8B8 0x12
NV097_SET_TEXTURE_FORMAT_COLOR_SZ_A8 0x19
NV097_SET_TEXTURE_FORMAT_COLOR_LU_IMAGE_X8R8G8B8 0x1E
NV097_SET_TEXTURE_FORMAT_COLOR_LU_IMAGE_DEPTH_Y16_FIXED 0x30
NV097_SET_TEXTURE_FORMAT_COLOR_SZ_A8B8G8R8 0x3A
NV097_SET_TEXTURE_FORMAT_COLOR_LU_IMAGE_A8B8G8R8 0x3F
</pre>