Skip to content

Commit

Permalink
Update xbfs/sbfs pages
Browse files Browse the repository at this point in the history
  • Loading branch information
@tuxuser
tuxuser committed Mar 26, 2024
1 parent 3cf4e5f commit 8d51c06
Show file tree
Hide file tree
Showing 4 changed files with 133 additions and 45 deletions.
3 changes: 3 additions & 0 deletions .gitignore
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,9 @@
# Windows
Thumbs.db

# Obsidian
docs/.obsidian

# mkdocs build dir
.cache/
site/
Expand Down
1 change: 1 addition & 0 deletions docs/NAVIGATION.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@
- [Bootloaders](bootloaders.md)
- [Certificates](certificates.md)
- [Flash (XBFS)](xbox-boot-file-system.md)
- [Southbridge filesystem (SBFS)](southbridge-file-system.md)
- [Hard drive](harddrive.md)
- [Security Processor](security-processor.md)
- [USB NTFS Overrides](usb-ntfs-overrides.md)
Expand Down
73 changes: 73 additions & 0 deletions docs/southbridge-file-system.md
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,73 @@
# SBFS

The "Series"-era of Xbox consoles has, additional to [XBFS](xbox-boot-file-system.md), a filesystem called SBFS.

It is not exposed to the operating itself transparently.

## Filesystem sizes

Unknown

## SBFS Header offsets

Checking if a filetable exists is done by checking for
SBFS_HEADER-\>Magic.

Absolute offsets:

- 0x1_0000
- 0x1_1000

## SBFS Structures

Byteorder: Little endian

MAX_FILE_COUNT: 24

PAGE_SIZE: 0x1000

### SBFS_HEADER

Size: 0x1C0

| Offset | Length | Type | Information |
| ------ | ----------------------------------------- | ---------------------- | ------------------ |
| 0x00 | 0x04 | uint | Magic (SFBS) |
| 0x04 | 0x01 | byte | Format Version |
| 0x05 | 0x01 | byte | Sequence Version\* |
| 0x06 | 0x02 | ushort | Layout Version |
| 0x08 | 0x08 | uint64 | Unknown |
| 0x10 | 0x08 | uint64 | Unknown |
| 0x18 | 0x08 | uint64 | Unknown |
| 0x20 | MAX_FILE_COUNT \* sizeof(SBFS_FILE_ENTRY) | struct SBFS_FILE_ENTRY | File Entries |
| 0x1A0 | 0x20 | byte\[\] | SHA256 Hash |


- Sequence number: Wraps around, aka 0xFF -\> 0x00. 0x00 would be
latest.

### SBFS_FILE_ENTRY

Size: 0x10

| Offset | Length | Type | Information |
| ------ | ------ | ------ | ------------------- |
| 0x00 | 0x04 | uint32 | Offset (page count) |
| 0x04 | 0x04 | uint32 | Size (page count) |
| 0x08 | 0x08 | uint64 | Unknown |

## File Entries


| Index | Name | Format | Plaintext | Information | Per console |
| ----- | ------------ | ------ | --------- | ----------------------------- | ----------- |
| 01 | smcfw.bin | binary | no | SMC firmware | ? |
| 02 | psp1sp.bin | binary | no | Bootloaders | yes |
| 03 | speaker.bin | binary | ? | (likely) Startup/eject sounds | no |
| 04 | smcerr.log | binary | no | SMC error log | yes |
| 05 | smc_d.cfg | binary | no | Dynamic SMC config | yes |
| 06 | certkeys.smc | binary | no | SMC boot capability cert | yes |

## Tools

- [sbfs-tool](https://github.com/RetroTechCorner/sbfs-tool) - (Go) Parsing/extracting a raw SBFS image
101 changes: 56 additions & 45 deletions docs/xbox-boot-file-system.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@
Xbox Boot File System, or XBFS for short, refers to the console flash
filesystem.

On Xbox Series-consoles there is also [SBFS](southbridge-file-system.md).

## Filesystem sizes

Durango (pre-series-S/X):
Expand All @@ -28,21 +30,22 @@ XBFS_HEADER-\>Magic.

Absolute offsets (pre-series-S/X consoles):

- 0x1_0000
- 0x81_0000
- 0x82_0000
- 0x1_0000 (Bootslot A)
- 0x81_0000 (Bootslot B)
- 0x82_0000 (Bootslot C)

Absolute offsets (Series S/X)

- 0x0
- 0x1800_8000
- ?

## Series S/X

The Xbox Series S/X consoles have a big internal NVME drive, which has a dedicated section to hold XBFS.
For some yet unknown reasons, when calculating the start offset of a file in XBFS, `0x6000` needs to be substracted to
receive the correct start offset.

Possibly, when dumping the raw image, the initial 0x6000 are not being included.
## Checking for file existance

Iterate through the array of XBFS_FILE_ENTRY and check if
Expand All @@ -52,26 +55,26 @@ XBFS_FILE_ENTRY.Size \> 0.

Byteorder: Little endian

FILE_COUNT: variable
MAX_FILE_COUNT: 58

PAGE_SIZE: 0x1000

### XBFS_HEADER

Size: 0x400

| Offset | Length | Type | Information |
| ------ | ---------------------------------------- | ------------------------ | ------------------ |
| 0x00 | 0x04 | uint | Magic (SFBX) |
| 0x04 | 0x01 | byte | Format Version |
| 0x05 | 0x01 | byte | Sequence Version\* |
| 0x06 | 0x02 | ushort | Layout Version |
| 0x08 | 0x08 | uint64 | Unknown |
| 0x10 | 0x08 | uint64 | Unknown |
| 0x18 | 0x08 | uint64 | Unknown |
| 0x20 | FILE_COUNT \* sizeof(XBFS_FILE_ENTRY) | struct XBFS_FILE_ENTRY | File Entries |
| 0x3D0 | 0x10 | byte\[\] | UUID |
| 0x3E0 | 0x20 | byte\[\] | SHA256 Hash |
| Offset | Length | Type | Information |
| ------ | ----------------------------------------- | ---------------------- | ------------------ |
| 0x00 | 0x04 | uint | Magic (SFBX) |
| 0x04 | 0x01 | byte | Format Version |
| 0x05 | 0x01 | byte | Sequence Version\* |
| 0x06 | 0x02 | ushort | Layout Version |
| 0x08 | 0x08 | uint64 | Unknown |
| 0x10 | 0x08 | uint64 | Unknown |
| 0x18 | 0x08 | uint64 | Unknown |
| 0x20 | MAX_FILE_COUNT \* sizeof(XBFS_FILE_ENTRY) | struct XBFS_FILE_ENTRY | File Entries |
| 0x3D0 | 0x10 | byte\[\] | UUID |
| 0x3E0 | 0x20 | byte\[\] | SHA256 Hash |

- Sequence number: Wraps around, aka 0xFF -\> 0x00. 0x00 would be
latest.
Expand All @@ -88,33 +91,33 @@ Size: 0x10

## File Entries

| Index | Name | Format | Plaintext | Information | Per console |
| ----- | ------------- | ------- | ----------|------------------------------- | ----------- |
| 01 | 1smcbl_a.bin | binary | no | SMC bootloader, slot A | no |
| 02 | header.bin | binary | yes | XBFS header | no |
| 03 | devkit.ini | binary | no | devkit ini | unknown |
| 04 | mtedata.cfg | binary | no | MTE data | unknown |
| 05 | certkeys.bin | binary | yes | Keyblobs & console certificate | yes |
| 06 | smcerr.log | binary | no | SMC error log | no |
| 07 | system.xvd | xvd | yes | SystemOS VM partition | no |
| 08 | $sosrst.xvd | xvd | yes | SystemOS restore | no |
| 09 | download.xvd | xvd | yes | Download ??? | no |
| 10 | smc_s.cfg | binary | no | SMC config - static | unknown |
| 11 | sp_s.cfg | binary | partially | SP config - static | yes |
| 12 | os_s.cfg | binary | no | OS config - static | unknown |
| 13 | smc_d.cfg | binary | no | SMC config - dynamic | unknown |
| 14 | sp_d.cfg | binary | no | SP config - dynamic | unknown |
| 15 | os_d.cfg | binary | no | OS config - dynamic | unknown |
| 16 | smcfw.bin | binary | no | SMC firmware | unknown |
| 17 | boot.bin | binary | no | Bootloaders | unknown |
| 18 | host.xvd | xvd | yes | HostOS partition | no |
| 19 | settings.xvd | xvd | yes | Settings | no |
| 20 | 1smcbl_b.bin | binary | no | SMC bootloader, slot B | no |
| 21 | bootanim.dat | binary | yes | Bootanimation | no |
| 22 | sostmpl.xvd | xvd | yes | SystemOS template | no |
| 23 | update.cfg | binary | yes | Update config / log? | unknown |
| 24 | sosinit.xvd | xvd | yes | SystemOS init | no |
| 25 | hwinit.cfg | binary | no | Hardware init config | unknown |
| Index | Name | Format | Plaintext | Information | Per console |
| ----- | ------------ | ------ | --------- | --------------------------------------------- | ----------- |
| 01 | 1smcbl_a.bin | binary | no | SMC bootloader, slot A | no |
| 02 | header.bin | binary | yes | XBFS header | no |
| 03 | devkit.ini | binary | no | devkit ini | unknown |
| 04 | mtedata.cfg | binary | no | MTE data | unknown |
| 05 | certkeys.bin | binary | yes | [SP/SMC Bootcap cert](certificates.md) | yes |
| 06 | smcerr.log | binary | no | SMC error log | no |
| 07 | system.xvd | xvd | yes | SystemOS VM partition | no |
| 08 | $sosrst.xvd | xvd | yes | SystemOS restore | no |
| 09 | download.xvd | xvd | yes | Download ??? | no |
| 10 | smc_s.cfg | binary | no | SMC config - static | unknown |
| 11 | sp_s.cfg | binary | partially | [SP - static (console cert)](certificates.md) | yes |
| 12 | os_s.cfg | binary | no | OS config - static | unknown |
| 13 | smc_d.cfg | binary | no | SMC config - dynamic | unknown |
| 14 | sp_d.cfg | binary | no | SP config - dynamic | unknown |
| 15 | os_d.cfg | binary | no | OS config - dynamic | unknown |
| 16 | smcfw.bin | binary | no | SMC firmware | unknown |
| 17 | boot.bin | binary | no | [Bootloaders](bootloaders.md) | unknown |
| 18 | host.xvd | xvd | yes | HostOS partition | no |
| 19 | settings.xvd | xvd | yes | Settings | no |
| 20 | 1smcbl_b.bin | binary | no | SMC bootloader, slot B | no |
| 21 | bootanim.dat | binary | yes | [Bootanimation](bootanimation.md) | no |
| 22 | sostmpl.xvd | xvd | yes | SystemOS template | no |
| 23 | update.cfg | binary | yes | Update config / log? | unknown |
| 24 | sosinit.xvd | xvd | yes | SystemOS init | no |
| 25 | hwinit.cfg | binary | no | Hardware init config | unknown |

Note: Only XVD header is plaintext, data portion is encrypted as usual.
Per Console: Is file encrypted via console specific keys or locked to console by SocId.
Expand All @@ -125,4 +128,12 @@ Access to the Flash from SystemOS is possible via the provided pipes:

`\\.\Xvuc\FlashFs\` - Connects to the Flash's NTFS filter driver on host, providing a NTFS like environment compatible with most Win32 file APIs. Reading specific files is possible by simply appending them to the pipe path. Ex: `\\.\Xvuc\FlashFs\sp_s.cfg` would give you a file handle to sp_s.cfg.

`\\.\Xvuc\Flash\` - Unlike the filtered pipe above, this pipe provides direct access to the flash, without any kind of file system filter. Refer above for more information.
`\\.\Xvuc\Flash\` - Unlike the filtered pipe above, this pipe provides direct access to the flash, without any kind of file system filter. Refer above for more information.

## Tools

[QuantumTunnel](https://github.com/XboxOneResearch/QuantumTunnel) - (.NET Core) XBFS dumping tool that runs in [SystemOS](xbox-operating-system.md#system) to dump the XBFS from the console. It does require Administrator/NT System privileges.

[xvdtool (XBFSTool)](https://github.com/emoose/xvdtool) - (.NET Core)Parsing / extraction of a raw XBFS image.

[xbfs-tool](https://github.com/RetroTechCorner/xbfs-tool)-(C) Parsing / extraction / injection of raw XBFS images.

0 comments on commit 8d51c06

Please sign in to comment.