Added XEO3 information, basic device lockout research, controller cod…

…enames (#64) * Added XEO3 (Xbox 360 Emu) pages * Add Unauthorized device lockout page * Added most controller codenames * Synced and minor codenames.md corrections
xboxoneresearch · Dec 11, 2023 · 1946106 · 1946106
1 parent 9b42df0
commit 1946106
Show file tree

Hide file tree

Showing 5 changed files with 64 additions and 3 deletions.
diff --git a/docs/NAVIGATION.md b/docs/NAVIGATION.md
@@ -24,6 +24,8 @@
   - [Protocol URIs (Deep links)](protocol-URIs.md)
   - [ODD Update Logs](optical-disc-drive/odd-firmware-update-log.md)
   - [Xbox Game Disc](xbox-game-disc.md)
+  - [XEO3 Emulator](xeo3.md)
+    - xeo3/*.md
   - [Xbox Operating System](xbox-operating-system.md)
   - [Xbox UI](xbox-ui.md)
   - [Xbox WinRT](winmd.md)
@@ -32,6 +34,7 @@
   - [Kiosk](kiosk.md)
   - [Exploits](exploits.md)
     - exploits/*.md
+  - [Unauthorized Xbox Device Lockout](unauthorized-device-lockout.md)
 - Xbox Live
   - [Xbox Live Error Codes](xbox-live/hresult-error-codes.md)
   - [XSTS Token](xbox-live/xsts-token.md)

diff --git a/docs/codenames.md b/docs/codenames.md
@@ -5,7 +5,7 @@ This page contains a list of known internal codenames for hardware, software, ac
 | Codename   |      Product / App Name     | Category |  Description or Comments |
 |----------|-------------|------|------|
 | Arden/Sparkman | Codename(s)? for the Xbox Series S/X secure AMD enclave | Hardware | N/A |
-| Keystone   | Unreleased Xbox Streaming platform / hardware device    | Hardware | N/A |
+| Keystone   | Shelved Xbox Streaming platform / hardware device    | Hardware | N/A |
 | Cordova    | Codename for one of the Xbox One ODD hardware revisions | Hardware | N/A |
 | Lancaster  | Codename for one of the Xbox One ODD hardware revisions | Hardware | N/A |
 | Monterey   | Codename for one of the Xbox One ODD hardware revisions | Hardware | N/A |
@@ -21,10 +21,21 @@ This page contains a list of known internal codenames for hardware, software, ac
 | Edmonton | Codename for the retail Xbox One S mainboard revision | Hardware | N/A |
 | Kingston | Codename for the retail Xbox One S mainboard revision - presumably same as edmonton | Hardware | Leaked schematics presumably refer to the Xbox One S as Kingston Retail |
 | Carmel | Codename for some mainboard revision - needs verification wether this is an Xbox One S flavour or is it Xbox One PHAT / Xbox One X! | Hardware | N/A |
-| Cactus | Codename for the retail Xbox One X maiboard | Hardware | The PCBs sometimes include the Cactus text |
-| Scorpio | Codename for the retail Xbox One X maiboard | Hardware | Used interchangeably with Cactus |
+| Cactus | Codename for the retail Xbox One X mainboard | Hardware | The PCBs sometimes include the Cactus text |
+| Scorpio | Codename for the retail Xbox One X mainboard | Hardware | Used interchangeably with Cactus |
 | Zurich | [Xbox One Digital Tv Tuner Adapter](https://www.amazon.de/Xbox-One-Digital-TV-Tuner/dp/B00E97HVJI)   |  Hardware | N/A |
 | Brittlebush | [XDK Transfer Device](xdk_transfer.md)   |  Hardware | N/A |
 | Zephyrus | Name of the EV2 revision of the Xbox Adaptive Controller | Hardware | Some prototype appeared online for sale in late 2023 |
 | Xiphos | Codename for the GIP (Gamepad Input Provider) service in SystemOS |  Software | N/A |
+| Merlin | Series X/S Controller | Hardware | Xbox Accessories App Image Names |
+| Troy | Elite (Generation One) Controller | Hardware | Xbox Accessories App Image Names |
+| Delphi | Elite (Generation Two) Controller | Hardware | Xbox Accessories App Image Names |
+| Crete | Xbox One Controller Revision (BT + 3.5mm) | Hardware | Xbox Accessories App Image Names |
+| Merlin | Series X/S Controller | Hardware | Xbox Accessories App Image Names |
+| Norland | Xbox Stereo Headset (Generation One) | Hardware | Xbox Accessories App Image Names |
+| Parkview | Xbox Stereo Headset (Generation Two) | Hardware | Xbox Accessories App Image Names |
+
+
+
+
 
diff --git a/docs/unauthorized-device-lockout.md b/docs/unauthorized-device-lockout.md
@@ -0,0 +1,11 @@
+#### PRELIMINARY RESEARCH
+
+# Unauthorized Xbox Device Lockout & Enforcement
+
+### \hklm\osdata\software\microsoft\durango\Enforcement
+Early research suggests that the lockout of unauthorized Xbox devices is controlled by the above reg key.
+On a Retail Series X console, the value is set to "UnauthorizedDeviceFlag : 1" in the PublicInsider10 (Skip Ahead) ring. In theory, deleting the key would disable the lockout system, however this has yet to be tested.
+
+#### Notes
+* The [LiveSettings](https://settings-win.data.microsoft.com/settings/v3.0/xbox/XboxOneShellFeatures) flighting system provisions the key, it is believed to be based on the value: `AccessoryEnforcement
+A91B1992-AE37-4936-A220-5384CC830F88`
diff --git a/docs/xeo3.md b/docs/xeo3.md
@@ -0,0 +1,30 @@
+# XEO3
+XEO3 is the Xbox 360 and Original Xbox emulator executable for the Xbox One/Series's ERA partition.
+
+## Executable Arguments
+| Argument         | Description                                       | Example Usage          |
+|------------------|---------------------------------------------------|------------------------|
+| `-compiler`      | Select the JIT compiler (default option)          | Unknown                |
+| `-interpreter`   | Select the interpreter                            | Unknown                |
+| `-dvd pathname`  | Specify host path for simulated DVD               | -dvd D:\Game           |
+| `-flash pathname`| Specify host path for simulated Flash Filesystem  | -flash D:\Flash        |
+| `-disk pathname` | Specify host path for simulated Hard disk         | -disk D:\HardDisk      |
+| `-mu0 pathname`  | Specify host path for simulated memory unit 0     | -mu0 D:\MUOne          |
+| `-mu1 pathname`  | Specify host path for simulated memory unit 1     | -mu1 D:\MUTwo          |
+| `-log pathname`  | Specify host path for write logging files         | -log D:\xeo3logs       |
+| `-testpass`      | Enable data gathering for test pass               | Unknown                |
+| `-msaa [on or off]` | Enable/disable multisample anti-aliasing (default is enabled) | -msaa on|
+| `-fs`            | Run in full screen mode                           | -fs                    |
+| `-net[:macaddress]` | Enable networking                              | -net:12-34-56-78-9a-bc |
+| `-xma`           | Enable XMA emulation via CMODEL or Hardware       | Unknown                |
+| `-kernel filename` | Specify host path to the guest kernel binary    | -kernel D:\xboxkrnlce.exe|
+| `-hvdata filename` | Specify host path to the guest hypervisor data blob | -hvdata D:\xboxkrnlce.hvdata |
+
+### Notes
+* xboxkrnlce.exe and .hvdata can be found in the Flash folder of a Backwards Compat game's XVC. Version 17003 has leaked publicly.
+* The emulated Xbox 360 does not display a serial number.
+* If a BC Game is deployed in Dev Mode, the XDK's Xbox Console Manager (The GDK dropped this functionality) can be used to capture kernel debug logging from the emulated kernel, when launching the game from the Console Manager.
+
+
+### Discovery
+XEO3, known as emu.exe, was first located by TitleOS who dumped it from a plaintext XVDP of eratools captured from a Xbox Live update before releasing it via Twitter.
diff --git a/docs/xeo3/shaders.md b/docs/xeo3/shaders.md
@@ -0,0 +1,6 @@
+## XEO3 Shaders
+Little is currently known about the XEO3 shader format, for example how the original shaders from Xbox 360 games are converted into the DirectX 11 Durango format. While it is known that that Backwards Compat games' XVCs contain DirectX 11 Durango format shaders in the DLL file format, creation or rendering of these shaders is not currently possible. 
+
+These shaders appear critical to running any graphical xex, as evidenced by attempting to run [XeXMenu on the emulator](https://twitter.com/XB1_HexDecimal/status/1382326180490010630). 
+
+Example: xeo3_3bfc9c1a_932fc286_956f016e_98ef8821_6b9d46d0.dll (From CastleCrashers)