Struct Xbe 

pub struct Xbe<'a> { /* private fields */ }

An analyzed Xbox executable (XBE).

Using the parse method, you can parse an Xbe from raw bytes.

The Xbe type provides access to the information in the XBE header as well as a few utility methods that make useful operations easier.

Implementations

impl<'a> Xbe<'a>

pub fn parse(data: &'a [u8]) -> Result<Self, Error>

Tries to parse an XBE file from raw data.

pub fn title_name(&self) -> &str

Returns the decoded title name from the image’s included certificate.

If the name contains invalid UTF-16, the returned string will have replacement characters in their place.

pub fn entry_point(&self) -> u32

Returns the entry point of the XBE (virtual address).

This uses a heuristic to determine whether the entry point is encoded as for retail or debug XBEs.

pub fn kernel_thunk_table(&self) -> &KernelThunkTable

Gets the decoded kernel thunk table.

The thunk table stores IDs of kernel functions the XBE wants to import. These imports are resolved by the loader just before the XBE is launched.

The address of the kernel thunk table is encoded in a similar fashion as the entry point, and so also depends on the heuristic to determine the image kind.

pub fn sections(&self) -> Sections<'_>

Returns an iterator over the sections in this XBE.

pub fn find_section_containing(&self, virt_addr: u32) -> Option<Section<'_>>

Scans the section headers to find a section that contains the given virtual address.

pub fn find_address_info(&self, virt_addr: u32) -> AddressInfo<'_>

Scans the section headers for a section whose virtual address range contains the given address.

Returns an AddressInfo object for debug printing the address, its containing section and its offset into the section.

pub fn cert(&self) -> &Certificate

Get a reference to the included certificate.

The certificate contains various information about the game (such as its title, region and ratings), as well as a few signing keys.

pub fn logo(&self) -> &LogoBitmap

Get a reference to the logo bitmap included in the XBE image.

In most cases, this is unfortunately just the Microsoft logo instead of a game-specific one.

pub fn init_flags(&self) -> &InitFlags

Init / Loader flags.

pub fn base_address(&self) -> u32

Returns the XBE’s base address.

This is similar to the base address in Portable Executable (PE) files. The XBE should be loaded into the virtual memory space of the program so that its first byte is at this virtual address.

pub fn header_size(&self) -> u32

Size of all the headers, starting at the beginning of the file.

The headers should be mapped into the XBE’s address space at the specified base_address.

pub fn stack_commit(&self) -> u32

Number of bytes of stack space to commit to RAM when loading the XBE.

The reserved amount of stack space doesn’t seem to be configured in the header.

pub fn heap_reserve(&self) -> u32

Number of bytes to reserve for the process heap.

Reserved memory exists as virtual memory, but has no backing storage in RAM or swap. Instead, backing memory is allocated when a page is first used.

The heap can also be configured to have a subset of its memory committed at load time using heap_commit.

pub fn heap_commit(&self) -> u32

Number of heap bytes to commit to RAM at load time.

pub fn libraries(&self) -> &[LibraryVersion]

Returns the list of libraries this XBE links against.

pub fn signature(&self) -> &[u8; 256]

Returns the XBE signature.

For legitimate XBE’s, this is a Microsoft signature. For homebrew, this can contain garbage.

pub fn debug_path(&self) -> &str

Returns the “debug path”, the path to the source file of the XBE.

This is normally set to the path to the .exe that was converted to the XBE format and is thus a path on the developer’s machine.

pub fn debug_filename(&self) -> &str

Returns the “debug filename”, the name of the source file of the XBE.

pub fn raw_data(&self) -> &[u8]

Returns the raw image data this XBE was decoded from.

Trait Implementations

impl<'a> Debug for Xbe<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.