diff --git a/.gitignore b/.gitignore index b501f6a..1d530be 100644 --- a/.gitignore +++ b/.gitignore @@ -5,6 +5,9 @@ # Windows Thumbs.db +# Obsidian +docs/.obsidian + # mkdocs build dir .cache/ site/ diff --git a/docs/NAVIGATION.md b/docs/NAVIGATION.md index bc9cfa9..a0ccc5a 100644 --- a/docs/NAVIGATION.md +++ b/docs/NAVIGATION.md @@ -18,6 +18,7 @@ - [Bootloaders](bootloaders.md) - [Certificates](certificates.md) - [Flash (XBFS)](xbox-boot-file-system.md) + - [Southbridge filesystem (SBFS)](southbridge-file-system.md) - [Hard drive](harddrive.md) - [Security Processor](security-processor.md) - [USB NTFS Overrides](usb-ntfs-overrides.md) diff --git a/docs/southbridge-file-system.md b/docs/southbridge-file-system.md new file mode 100644 index 0000000..608b86f --- /dev/null +++ b/docs/southbridge-file-system.md @@ -0,0 +1,73 @@ +# SBFS + +The "Series"-era of Xbox consoles has, additional to [XBFS](xbox-boot-file-system.md), a filesystem called SBFS. + +It is not exposed to the operating itself transparently. + +## Filesystem sizes + +Unknown + +## SBFS Header offsets + +Checking if a filetable exists is done by checking for +SBFS_HEADER-\>Magic. + +Absolute offsets: + +- 0x1_0000 +- 0x1_1000 + +## SBFS Structures + +Byteorder: Little endian + +MAX_FILE_COUNT: 24 + +PAGE_SIZE: 0x1000 + +### SBFS_HEADER + +Size: 0x1C0 + +| Offset | Length | Type | Information | +| ------ | ----------------------------------------- | ---------------------- | ------------------ | +| 0x00 | 0x04 | uint | Magic (SFBS) | +| 0x04 | 0x01 | byte | Format Version | +| 0x05 | 0x01 | byte | Sequence Version\* | +| 0x06 | 0x02 | ushort | Layout Version | +| 0x08 | 0x08 | uint64 | Unknown | +| 0x10 | 0x08 | uint64 | Unknown | +| 0x18 | 0x08 | uint64 | Unknown | +| 0x20 | MAX_FILE_COUNT \* sizeof(SBFS_FILE_ENTRY) | struct SBFS_FILE_ENTRY | File Entries | +| 0x1A0 | 0x20 | byte\[\] | SHA256 Hash | + + + - Sequence number: Wraps around, aka 0xFF -\> 0x00. 0x00 would be + latest. + +### SBFS_FILE_ENTRY + +Size: 0x10 + +| Offset | Length | Type | Information | +| ------ | ------ | ------ | ------------------- | +| 0x00 | 0x04 | uint32 | Offset (page count) | +| 0x04 | 0x04 | uint32 | Size (page count) | +| 0x08 | 0x08 | uint64 | Unknown | + +## File Entries + + +| Index | Name | Format | Plaintext | Information | Per console | +| ----- | ------------ | ------ | --------- | ----------------------------- | ----------- | +| 01 | smcfw.bin | binary | no | SMC firmware | ? | +| 02 | psp1sp.bin | binary | no | Bootloaders | yes | +| 03 | speaker.bin | binary | ? | (likely) Startup/eject sounds | no | +| 04 | smcerr.log | binary | no | SMC error log | yes | +| 05 | smc_d.cfg | binary | no | Dynamic SMC config | yes | +| 06 | certkeys.smc | binary | no | SMC boot capability cert | yes | + +## Tools + +- [sbfs-tool](https://github.com/RetroTechCorner/sbfs-tool) - (Go) Parsing/extracting a raw SBFS image \ No newline at end of file diff --git a/docs/xbox-boot-file-system.md b/docs/xbox-boot-file-system.md index aa7d340..9a1647e 100644 --- a/docs/xbox-boot-file-system.md +++ b/docs/xbox-boot-file-system.md @@ -5,6 +5,8 @@ Xbox Boot File System, or XBFS for short, refers to the console flash filesystem. +On Xbox Series-consoles there is also [SBFS](southbridge-file-system.md). + ## Filesystem sizes Durango (pre-series-S/X): @@ -28,14 +30,14 @@ XBFS_HEADER-\>Magic. Absolute offsets (pre-series-S/X consoles): -- 0x1_0000 -- 0x81_0000 -- 0x82_0000 +- 0x1_0000 (Bootslot A) +- 0x81_0000 (Bootslot B) +- 0x82_0000 (Bootslot C) Absolute offsets (Series S/X) +- 0x0 - 0x1800_8000 -- ? ## Series S/X @@ -43,6 +45,7 @@ The Xbox Series S/X consoles have a big internal NVME drive, which has a dedicat For some yet unknown reasons, when calculating the start offset of a file in XBFS, `0x6000` needs to be substracted to receive the correct start offset. +Possibly, when dumping the raw image, the initial 0x6000 are not being included. ## Checking for file existance Iterate through the array of XBFS_FILE_ENTRY and check if @@ -52,7 +55,7 @@ XBFS_FILE_ENTRY.Size \> 0. Byteorder: Little endian -FILE_COUNT: variable +MAX_FILE_COUNT: 58 PAGE_SIZE: 0x1000 @@ -60,18 +63,18 @@ PAGE_SIZE: 0x1000 Size: 0x400 -| Offset | Length | Type | Information | -| ------ | ---------------------------------------- | ------------------------ | ------------------ | -| 0x00 | 0x04 | uint | Magic (SFBX) | -| 0x04 | 0x01 | byte | Format Version | -| 0x05 | 0x01 | byte | Sequence Version\* | -| 0x06 | 0x02 | ushort | Layout Version | -| 0x08 | 0x08 | uint64 | Unknown | -| 0x10 | 0x08 | uint64 | Unknown | -| 0x18 | 0x08 | uint64 | Unknown | -| 0x20 | FILE_COUNT \* sizeof(XBFS_FILE_ENTRY) | struct XBFS_FILE_ENTRY | File Entries | -| 0x3D0 | 0x10 | byte\[\] | UUID | -| 0x3E0 | 0x20 | byte\[\] | SHA256 Hash | +| Offset | Length | Type | Information | +| ------ | ----------------------------------------- | ---------------------- | ------------------ | +| 0x00 | 0x04 | uint | Magic (SFBX) | +| 0x04 | 0x01 | byte | Format Version | +| 0x05 | 0x01 | byte | Sequence Version\* | +| 0x06 | 0x02 | ushort | Layout Version | +| 0x08 | 0x08 | uint64 | Unknown | +| 0x10 | 0x08 | uint64 | Unknown | +| 0x18 | 0x08 | uint64 | Unknown | +| 0x20 | MAX_FILE_COUNT \* sizeof(XBFS_FILE_ENTRY) | struct XBFS_FILE_ENTRY | File Entries | +| 0x3D0 | 0x10 | byte\[\] | UUID | +| 0x3E0 | 0x20 | byte\[\] | SHA256 Hash | - Sequence number: Wraps around, aka 0xFF -\> 0x00. 0x00 would be latest. @@ -88,33 +91,33 @@ Size: 0x10 ## File Entries -| Index | Name | Format | Plaintext | Information | Per console | -| ----- | ------------- | ------- | ----------|------------------------------- | ----------- | -| 01 | 1smcbl_a.bin | binary | no | SMC bootloader, slot A | no | -| 02 | header.bin | binary | yes | XBFS header | no | -| 03 | devkit.ini | binary | no | devkit ini | unknown | -| 04 | mtedata.cfg | binary | no | MTE data | unknown | -| 05 | certkeys.bin | binary | yes | Keyblobs & console certificate | yes | -| 06 | smcerr.log | binary | no | SMC error log | no | -| 07 | system.xvd | xvd | yes | SystemOS VM partition | no | -| 08 | $sosrst.xvd | xvd | yes | SystemOS restore | no | -| 09 | download.xvd | xvd | yes | Download ??? | no | -| 10 | smc_s.cfg | binary | no | SMC config - static | unknown | -| 11 | sp_s.cfg | binary | partially | SP config - static | yes | -| 12 | os_s.cfg | binary | no | OS config - static | unknown | -| 13 | smc_d.cfg | binary | no | SMC config - dynamic | unknown | -| 14 | sp_d.cfg | binary | no | SP config - dynamic | unknown | -| 15 | os_d.cfg | binary | no | OS config - dynamic | unknown | -| 16 | smcfw.bin | binary | no | SMC firmware | unknown | -| 17 | boot.bin | binary | no | Bootloaders | unknown | -| 18 | host.xvd | xvd | yes | HostOS partition | no | -| 19 | settings.xvd | xvd | yes | Settings | no | -| 20 | 1smcbl_b.bin | binary | no | SMC bootloader, slot B | no | -| 21 | bootanim.dat | binary | yes | Bootanimation | no | -| 22 | sostmpl.xvd | xvd | yes | SystemOS template | no | -| 23 | update.cfg | binary | yes | Update config / log? | unknown | -| 24 | sosinit.xvd | xvd | yes | SystemOS init | no | -| 25 | hwinit.cfg | binary | no | Hardware init config | unknown | +| Index | Name | Format | Plaintext | Information | Per console | +| ----- | ------------ | ------ | --------- | --------------------------------------------- | ----------- | +| 01 | 1smcbl_a.bin | binary | no | SMC bootloader, slot A | no | +| 02 | header.bin | binary | yes | XBFS header | no | +| 03 | devkit.ini | binary | no | devkit ini | unknown | +| 04 | mtedata.cfg | binary | no | MTE data | unknown | +| 05 | certkeys.bin | binary | yes | [SP/SMC Bootcap cert](certificates.md) | yes | +| 06 | smcerr.log | binary | no | SMC error log | no | +| 07 | system.xvd | xvd | yes | SystemOS VM partition | no | +| 08 | $sosrst.xvd | xvd | yes | SystemOS restore | no | +| 09 | download.xvd | xvd | yes | Download ??? | no | +| 10 | smc_s.cfg | binary | no | SMC config - static | unknown | +| 11 | sp_s.cfg | binary | partially | [SP - static (console cert)](certificates.md) | yes | +| 12 | os_s.cfg | binary | no | OS config - static | unknown | +| 13 | smc_d.cfg | binary | no | SMC config - dynamic | unknown | +| 14 | sp_d.cfg | binary | no | SP config - dynamic | unknown | +| 15 | os_d.cfg | binary | no | OS config - dynamic | unknown | +| 16 | smcfw.bin | binary | no | SMC firmware | unknown | +| 17 | boot.bin | binary | no | [Bootloaders](bootloaders.md) | unknown | +| 18 | host.xvd | xvd | yes | HostOS partition | no | +| 19 | settings.xvd | xvd | yes | Settings | no | +| 20 | 1smcbl_b.bin | binary | no | SMC bootloader, slot B | no | +| 21 | bootanim.dat | binary | yes | [Bootanimation](bootanimation.md) | no | +| 22 | sostmpl.xvd | xvd | yes | SystemOS template | no | +| 23 | update.cfg | binary | yes | Update config / log? | unknown | +| 24 | sosinit.xvd | xvd | yes | SystemOS init | no | +| 25 | hwinit.cfg | binary | no | Hardware init config | unknown | Note: Only XVD header is plaintext, data portion is encrypted as usual. Per Console: Is file encrypted via console specific keys or locked to console by SocId. @@ -125,4 +128,12 @@ Access to the Flash from SystemOS is possible via the provided pipes: `\\.\Xvuc\FlashFs\` - Connects to the Flash's NTFS filter driver on host, providing a NTFS like environment compatible with most Win32 file APIs. Reading specific files is possible by simply appending them to the pipe path. Ex: `\\.\Xvuc\FlashFs\sp_s.cfg` would give you a file handle to sp_s.cfg. -`\\.\Xvuc\Flash\` - Unlike the filtered pipe above, this pipe provides direct access to the flash, without any kind of file system filter. Refer above for more information. \ No newline at end of file +`\\.\Xvuc\Flash\` - Unlike the filtered pipe above, this pipe provides direct access to the flash, without any kind of file system filter. Refer above for more information. + +## Tools + +[QuantumTunnel](https://github.com/XboxOneResearch/QuantumTunnel) - (.NET Core) XBFS dumping tool that runs in [SystemOS](xbox-operating-system.md#system) to dump the XBFS from the console. It does require Administrator/NT System privileges. + +[xvdtool (XBFSTool)](https://github.com/emoose/xvdtool) - (.NET Core)Parsing / extraction of a raw XBFS image. + +[xbfs-tool](https://github.com/RetroTechCorner/xbfs-tool)-(C) Parsing / extraction / injection of raw XBFS images.