Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Support for Obscure/Non-Standard Windows PE Specimens #225

Open
mariaWitch opened this issue Feb 12, 2023 · 0 comments
Open

Add Support for Obscure/Non-Standard Windows PE Specimens #225

mariaWitch opened this issue Feb 12, 2023 · 0 comments

Comments

@mariaWitch
Copy link

Currently, ROSE only supports Standard Windows Based Executables, however, there exists a subset of executables that were created for a Windows Based Enviroment, but can not be analyzed by ROSE, even though they should meet the specifications for receiving support. I am specifically referring to .XBE files, developed by Microsoft for the Original Xbox. As the Original Xbox runs a modified version of the Windows NT Kernel (based on Windows 2000), these are true Windows Binaries that were compiled with VS C++, and should be supported for those that are doing Investigative work into Applications on these systems.

However, currently ROSE does not recognize these files, but in fact should be able to. As they are only slightly modified in structure in order to provide some Xbox related header magic. Otherwise these files are nearly identical to Windows PE Executables. A breakdown of the binary structure of the files can be found here: http://www.caustik.com/cxbx/download/xbe.htm

Therefore, if the maintainers could look into potentially adding in hardcoded support for this Windows Based Executable format or at least provide some insight into how to add support for this, so that others could do this, that would be immensely helpful. There are some example .XBE executables located here: https://github.com/rizinorg/rizin-testbins/tree/master/xbe

Additionally, there are other XBE loading tools that have been created for Ghidra, that could be used for reference, here: https://github.com/mborgerson/ghidra-xbe and a parser has also been created for rust here: https://github.com/jonas-schievink/xbe

There is a growing need for support for this binary format in order to help understand this system, in order to further efforts to preserve and document its architecture

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant