XbeTool v0.3 - loser july 2002
------------------------------

XbeTool v0.3 - loser july 2002
Usage: XbeTool <options> <Xbe File>
       a    list all header info
       x    list xbe header info
       c    list certificate header info
       s    list section header info
       t    list thread header info
       l    list library header info
       b    dump to binary file
       e    dump to exe file
       i    dump idc file


:: whats it do?
this tool can print out info on xbox XBE files as well as helping to
disassemble them by dumping them to a binary file, creating an idc file
and also converting to an exe file.


:: convert to an exe file
you can convert the xbe file into a 'regular' exe file using the 'e' option.
this allows for easy disassembling, just load it as a normal pc exe file.
it also means u can use the many existing pc exe tools to explore it etc.
(note: if u want to know the "xapi_start_" and "main_" function addresses,
create an idc file and open it in a text editor. at the top u will see the
addresses for these functions.)


:: listing XBE details
you can choose to only list some or all of the details in the xbe file
headers depending on which options you choose. you can select multiple
options to list a few different header details at once.
to list all details of the xbe file, use the 'a' option.
eg "XbeTool a default.xbe"
to list only the xbe header and certificate info use the 'x' and 'c' options.
eg "XbeTool x c default.xbe"


:: dumping XBE file to binary file
to dump xbe file to a binary file use the 'b' option.
eg "XbeTool b default.xbe"

this will dump the binary version of default.xbe to the file "default.xbe.bin".
It will also list the sections as it dumps them and the base address and entry
point of the binary file.


:: create an IDC file for the binary dump of the XBE file
an IDC file can be created to help disassembling the binary dump using IDA.
to do so use the 'i' option.
eg "XbeTool i default.xbe"

The IDC file currently defines the sections present in the binary file, as well
as the functions: "start_", "xapi_start_", and "main_".


:: disassembling an XBE binary dump in IDA
note: the binary file created can be disassembled in any disassembler.
(use the base address given when creating a binary file for the offset of the
binary file in memory. this is usually 0x00010000.)

to disassemble an XBE in IDA first create an IDC file and a binary dump of the
XBE file using XbeTool. once you have a *.bin and a *.idc file,
start up IDA and select the binary file. on the load file dialog select
the following options:

processor type:  intel 80x86 metapc
loading segment: 0x00000000
loading offset:  use the base address given when dumping the binary file
                 (usually this is 0x00010000)
make sure 'create segments' is unticked

now press OK and then OK again.
now load the IDC file (press F2 and select the IDC file created earlier)

your binary file has now been loaded, all segments created, and the start
and main functions defined.


loser
email:   loser@loser-console.org
webpage: www.loser-console.org