Skip to content

Add Support for Obscure/Non-Standard Windows PE Specimens #225

@mariaWitch

Description

@mariaWitch

Currently, ROSE only supports Standard Windows Based Executables, however, there exists a subset of executables that were created for a Windows Based Enviroment, but can not be analyzed by ROSE, even though they should meet the specifications for receiving support. I am specifically referring to .XBE files, developed by Microsoft for the Original Xbox. As the Original Xbox runs a modified version of the Windows NT Kernel (based on Windows 2000), these are true Windows Binaries that were compiled with VS C++, and should be supported for those that are doing Investigative work into Applications on these systems.

However, currently ROSE does not recognize these files, but in fact should be able to. As they are only slightly modified in structure in order to provide some Xbox related header magic. Otherwise these files are nearly identical to Windows PE Executables. A breakdown of the binary structure of the files can be found here: http://www.caustik.com/cxbx/download/xbe.htm

Therefore, if the maintainers could look into potentially adding in hardcoded support for this Windows Based Executable format or at least provide some insight into how to add support for this, so that others could do this, that would be immensely helpful. There are some example .XBE executables located here: https://github.com/rizinorg/rizin-testbins/tree/master/xbe

Additionally, there are other XBE loading tools that have been created for Ghidra, that could be used for reference, here: https://github.com/mborgerson/ghidra-xbe and a parser has also been created for rust here: https://github.com/jonas-schievink/xbe

There is a growing need for support for this binary format in order to help understand this system, in order to further efforts to preserve and document its architecture

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions