Revision as of 08:52, 13 July 2019

XBE files (XBox Executable) are the main files that are executed in the Xbox System. In official games, these files are created by game developers, and then signed by Microsoft.

The file structure is adapted from Windows PE files. It is very similar, however it has important changes for the Xbox. The file is composed of an image header, a certificate, a collection of section headers, a collection of library versions, thread local storage data, a Microsoft bitmap, and the sections that contain the code and resources.

Image Header

The image header contains the information that describes where the other parts of the executable are located within the file, and how the executable should be treated and loaded. It always starts with the "Magic number" 0x48454258, which translates to "XBEH". Right after the header comes the digital signature for the executable. This signature is 256 bytes.

Certificate

Each Xbox executable has a certificate that contains information about the title.

• Time and date when the certificate was created
• Title ID
• Title name
• Alternative title IDs
• Allowed types of media that the executable can be run from (HD, DVD, CD, etc.)
• Game region
• Game ratings
• Disk number
• Version
• LAN key raw data used for System Link
• Signature key raw data (used to sign savegames)
• Alternate signature keys
• Original size of the certificate
• Online service name (not present in early executables)
• Run time security flags (not present in early executables)

Title ID

A title ID is usually 2 ASCII letters for the publisher, followed by a u16 integer game number (Above 2000 for non-original Xbox games)

The title ID seems to double the information from the Xbox Game Disc mastering code etched into the ring or readable from the DMI. The game number is expressed in 3 decimal digits here which suggests that it will always be below 1000.

Examples:

FIFA Soccer 2003:

• DMI and mastering code: EA02302E (Meaning: publisher EA, game number 023, version 02, region Europe)
• Title ID: ^[FIXME]

Halo: Combat Evolved:

• DMI and mastering code: MS00402A (Meaning: publisher Microsoft, game number 004, version 02, region America)
• Title ID: 4D530004 [MS-004]

Halo: Combat Evolved:

• DMI and mastering code: MS00404E (Meaning: publisher Microsoft, game number 004, version 04, region Europe)
• Title ID: 4D530004 [MS-004]

Allowed media types

Allowed media types off which the executable is allowed to be run from. The following values are known:

Sections

The sections are described by the section headers. The section headers start right after the certificate and contain describe where in the file the actual sections reside. Each header contains a hash of the section that is checked by the Xbox to ensure the integrity of the sections.

At least two sections are always present in an Xbox executable: .text and .rdata. There might be more sections that contain either executable code or resources such as images, text, etc.

.text

The .text section contains all x86 subroutines to be executed by the processor.

.rdata

The .rdata section contains the kernel thunk table. The ordinals in the table are to be resolved to the kernel's actual calling routine, when loaded.

Xbox Alpha executable format

Binaries from early Xbox development (Alpha units), are using a different binary format. There are no known public tools that can read them. Known differences include that the first bytes of the file are 'XE' instead the 'XBEH' from the final XBE format. The format is rumored to be more like the Windows PE format.^{[citation needed]}

Resources and links

• .XBE File Format 1.1