Struct xbe::Xbe [−][src]
pub struct Xbe<'a> { /* fields omitted */ }An analyzed Xbox executable (XBE).
Using the parse method, you can parse an Xbe from raw bytes.
The Xbe type provides access to the information in the XBE header as well
as a few utility methods that make useful operations easier.
Methods
impl<'a> Xbe<'a>[src]
impl<'a> Xbe<'a>pub fn parse(data: &'a [u8]) -> Result<Self, Error>[src]
pub fn parse(data: &'a [u8]) -> Result<Self, Error>Tries to parse an XBE file from raw data.
pub fn title_name(&self) -> &str[src]
pub fn title_name(&self) -> &strReturns the decoded title name from the image's included certificate.
If the name contains invalid UTF-16, the returned string will have replacement characters in their place.
pub fn entry_point(&self) -> u32[src]
pub fn entry_point(&self) -> u32Returns the entry point of the XBE (virtual address).
This uses a heuristic to determine whether the entry point is encoded as for retail or debug XBEs.
pub fn kernel_thunk_table(&self) -> &KernelThunkTable[src]
pub fn kernel_thunk_table(&self) -> &KernelThunkTableGets the decoded kernel thunk table.
The thunk table stores IDs of kernel functions the XBE wants to import. These imports are resolved by the loader just before the XBE is launched.
The address of the kernel thunk table is encoded in a similar fashion as the entry point, and so also depends on the heuristic to determine the image kind.
ⓘImportant traits for Sections<'a>pub fn sections(&self) -> Sections[src]
pub fn sections(&self) -> SectionsReturns an iterator over the sections in this XBE.
pub fn find_section_containing(&self, virt_addr: u32) -> Option<Section>[src]
pub fn find_section_containing(&self, virt_addr: u32) -> Option<Section>Scans the section headers to find a section that contains the given virtual address.
pub fn find_address_info(&self, virt_addr: u32) -> AddressInfo[src]
pub fn find_address_info(&self, virt_addr: u32) -> AddressInfoScans the section headers for a section whose virtual address range contains the given address.
Returns an AddressInfo object for debug printing the address, its
containing section and its offset into the section.
pub fn cert(&self) -> &Certificate[src]
pub fn cert(&self) -> &CertificateGet a reference to the included certificate.
The certificate contains various information about the game (such as its title, region and ratings), as well as a few signing keys.
pub fn logo(&self) -> &LogoBitmap[src]
pub fn logo(&self) -> &LogoBitmapGet a reference to the logo bitmap included in the XBE image.
In most cases, this is unfortunately just the Microsoft logo instead of a game-specific one.
pub fn init_flags(&self) -> &InitFlags[src]
pub fn init_flags(&self) -> &InitFlagsInit / Loader flags.
pub fn base_address(&self) -> u32[src]
pub fn base_address(&self) -> u32Returns the XBE's base address.
This is similar to the base address in Portable Executable (PE) files. The XBE should be loaded into the virtual memory space of the program so that its first byte is at this virtual address.
pub fn header_size(&self) -> u32[src]
pub fn header_size(&self) -> u32Size of all the headers, starting at the beginning of the file.
The headers should be mapped into the XBE's address space at the
specified base_address.
pub fn stack_commit(&self) -> u32[src]
pub fn stack_commit(&self) -> u32Number of bytes of stack space to commit to RAM when loading the XBE.
The reserved amount of stack space doesn't seem to be configured in the header.
pub fn heap_reserve(&self) -> u32[src]
pub fn heap_reserve(&self) -> u32Number of bytes to reserve for the process heap.
Reserved memory exists as virtual memory, but has no backing storage in RAM or swap. Instead, backing memory is allocated when a page is first used.
The heap can also be configured to have a subset of its memory committed
at load time using heap_commit.
pub fn heap_commit(&self) -> u32[src]
pub fn heap_commit(&self) -> u32Number of heap bytes to commit to RAM at load time.
pub fn libraries(&self) -> &[LibraryVersion][src]
pub fn libraries(&self) -> &[LibraryVersion]Returns the list of libraries this XBE links against.
pub fn signature(&self) -> &[u8; 256][src]
pub fn signature(&self) -> &[u8; 256]Returns the XBE signature.
For legitimate XBE's, this is a Microsoft signature. For homebrew, this can contain garbage.
pub fn debug_path(&self) -> &str[src]
pub fn debug_path(&self) -> &strReturns the "debug path", the path to the source file of the XBE.
This is normally set to the path to the .exe that was converted to the
XBE format and is thus a path on the developer's machine.
pub fn debug_filename(&self) -> &str[src]
pub fn debug_filename(&self) -> &strReturns the "debug filename", the name of the source file of the XBE.
pub fn raw_data(&self) -> &[u8][src]
pub fn raw_data(&self) -> &[u8]Returns the raw image data this XBE was decoded from.