XBE files (XBox Executable) are the main files that are executed in the Xbox System. In official games, these files are created by game developers, and then signed by Microsoft.
The file structure is adapted from Windows PE files. It is very similar, however it has important changes for the Xbox. The file is composed of an image header, a certificate, a collection of section headers, a collection of library versions, thread local storage data, a Microsoft bitmap, and the sections that contain the code and resources.
The image header contains the information that describes where the other parts of the executable are located within the file, and how the executable should be treated and loaded. It always starts with the "Magic number" 0x48454258, which translates to "XBEH". Right after the header comes the digital signature for the executable. This signature is 256 bytes.
Each Xbox executable has a certificate that contains information about the title.
- Time and date when the certificate was created
- Title ID
- Title name
- Alternative title IDs
- Allowed types of media that the executable can be run from (HD, DVD, CD, etc.)
- Game region
- Game ratings
- Disk number
- LAN key raw data used for System Link
- Signature key raw data (used to sign savegames)
- Alternate signature keys
- Original size of the certificate
- Online service name (not present in early executables)
- Run time security flags (not present in early executables)
A title ID is usually 2 ASCII letters for the publisher, followed by a u16 integer game number (Above 2000 for non-original Xbox games)
|BV||Buena Vista Games|
|CK||Kemco Corporation |
|EA||Electronic Arts (EA)|
|HE||Tru Blu (Entertainment division of Home Entertainment Suppliers)|
|IA||Mad Catz Interactive|
|IX||InXile Entertainment |
|KB||Kemco |
|KI||Kids Station Inc. |
|KU||Kobi and/or GAE (formerly Global A Entertainment)|
|LS||Black Bean Games (publishing arm of Leader S.p.A.)|
|MP||MediaQuest |
|MS||Microsoft Game Studios|
|MX||Empire Interactive |
|PL||Phantagram Co., Ltd.|
|SS||Simon & Schuster|
|TD||The 3DO Company (or just 3DO)|
|TT||Take-Two Interactive Software|
|VC||Victor Interactive Software|
|VN||Vivendi Universal (just took Interplays publishing rights) |
|VU||Vivendi Universal Games|
|VV||Vivendi Universal Games |
|WR||Warner Bros. Interactive Entertainment |
|XI||XPEC Entertainment and Idea Factory|
|XK||Xbox kiosk disk? |
|XL||Xbox special bundled or live demo disk? |
|XM||Evolved Games |
|YB||YBM Sisa (South-Korea)|
|ZD||Zushi Games (formerly Zoo Digital Publishing)|
The title ID seems to double the information from the Xbox Game Disc mastering code etched into the ring or readable from the DMI. The game number is expressed in 3 decimal digits here which suggests that it will always be below 1000.
- DMI and mastering code: EA02302E (Meaning: publisher EA, game number 023, version 02, region Europe)
- Title ID: [FIXME]
- DMI and mastering code: MS00402A (Meaning: publisher Microsoft, game number 004, version 02, region America)
- Title ID: 4D530004 [MS-004]
- DMI and mastering code: MS00404E (Meaning: publisher Microsoft, game number 004, version 04, region Europe)
- Title ID: 4D530004 [MS-004]
Allowed media types
Allowed media types off which the executable is allowed to be run from. The following values are known:
The sections are described by the section headers. The section headers start right after the certificate and contain describe where in the file the actual sections reside. Each header contains a hash of the section that is checked by the Xbox to ensure the integrity of the sections.
At least two sections are always present in an Xbox executable: .text and .rdata. There might be more sections that contain either executable code or resources such as images, text, etc.
The .text section contains all x86 subroutines to be executed by the processor.
The .rdata section contains the kernel thunk table. The ordinals in the table are to be resolved to the kernel's actual calling routine, when loaded.
Xbox Alpha executable format
Binaries from early Xbox development (Alpha units), are using a different binary format. There are no known public tools that can read them. Known differences include that the first bytes of the file are 'XE' instead the 'XBEH' from the final XBE format. The format is rumored to be more like the Windows PE format.