Skip to content

Xbox kernel header improvements #770

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
PatrickvL wants to merge 11 commits into
base: master
Choose a base branch
from
+54 −12
Draft

Xbox kernel header improvements #770

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
ee3d445
Add missing NTSTATUS codes
PatrickvL May 20, 2026
206eee5
Add PROFILE_LEVEL and HIGH_LEVEL IRQL constants
PatrickvL May 20, 2026
c425da5
Add KOBJECTS enum for dispatcher object types
PatrickvL May 20, 2026
5177264
Add SLIST_ENTRY typedef alias for SINGLE_LIST_ENTRY
PatrickvL May 20, 2026
37ea1af
Add IRP_MJ_* major function code constants
PatrickvL May 20, 2026
b64463d
Add REG_* registry value type constants
PatrickvL May 20, 2026
b3db1ec
Add DUPLICATE_CLOSE_SOURCE constant for NtDuplicateObject
PatrickvL May 20, 2026
2930955
Fix type errors in kernel header declarations
PatrickvL May 20, 2026
13a3a02
Fix ExInterlockedAddLargeInteger stdcall decoration (@16 -> @12)
PatrickvL May 19, 2026
9e80468
Fix return types: RtlSnprintf, RtlSprintf, RtlVsnprintf, RtlVsprintf …
PatrickvL May 20, 2026
c756c44
Fix RtlVsprintf/RtlVsnprintf: take VA_LIST, not variadic arguments
PatrickvL May 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions lib/xboxkrnl/ntstatus.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@
#define STATUS_IN_PAGE_ERROR ((DWORD)0xC0000006L)
#define STATUS_INVALID_HANDLE ((DWORD)0xC0000008L)
#define STATUS_INVALID_PARAMETER ((DWORD)0xC000000DL)
#define STATUS_INVALID_DEVICE_REQUEST ((DWORD)0xC0000010L)
#define STATUS_END_OF_FILE ((DWORD)0xC0000011L)
#define STATUS_NO_MEMORY ((DWORD)0xC0000017L)
#define STATUS_ILLEGAL_INSTRUCTION ((DWORD)0xC000001DL)
Expand All @@ -45,8 +46,10 @@
#define STATUS_OBJECT_NAME_NOT_FOUND ((DWORD)0xC0000034L)
#define STATUS_OBJECT_NAME_COLLISION ((DWORD)0xC0000035L)
#define STATUS_OBJECT_PATH_NOT_FOUND ((DWORD)0xC000003AL)
#define STATUS_SHARING_VIOLATION ((DWORD)0xC0000043L)
#define STATUS_MUTANT_NOT_OWNED ((DWORD)0xC0000046L)
#define STATUS_SEMAPHORE_LIMIT_EXCEEDED ((DWORD)0xC0000047L)
#define STATUS_SUSPEND_COUNT_EXCEEDED ((DWORD)0xC000004AL)
#define STATUS_ARRAY_BOUNDS_EXCEEDED ((DWORD)0xC000008CL)
#define STATUS_FLOAT_DENORMAL_OPERAND ((DWORD)0xC000008DL)
#define STATUS_FLOAT_DIVIDE_BY_ZERO ((DWORD)0xC000008EL)
Expand Down Expand Up @@ -75,6 +78,7 @@
#define STATUS_INVALID_PARAMETER_11 ((DWORD)0xC00000F9L)
#define STATUS_INVALID_PARAMETER_12 ((DWORD)0xC00000FAL)
#define STATUS_STACK_OVERFLOW ((DWORD)0xC00000FDL)
#define STATUS_CANCELLED ((DWORD)0xC0000120L)
#define STATUS_CONTROL_C_EXIT ((DWORD)0xC000013AL)
#define STATUS_TOO_MANY_SECRETS ((DWORD)0xC0000156L)
#define STATUS_HANDLE_NOT_CLOSABLE ((DWORD)0xC0000235L)
Expand Down
2 changes: 2 additions & 0 deletions lib/xboxkrnl/xboxdef.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,8 @@ typedef ULONGLONG QUAD;
typedef ULONG ULONG_PTR;
typedef LONG LONG_PTR;

typedef __builtin_va_list VA_LIST;

typedef ULONG_PTR DWORD_PTR;

typedef struct _FLOATING_SAVE_AREA
Expand Down
2 changes: 1 addition & 1 deletion lib/xboxkrnl/xboxkrnl.exe.def
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ EXPORTS
ExEventObjectType @ 16 NONAME DATA
ExFreePool@4 @ 17 NONAME
ExInitializeReadWriteLock@4 @ 18 NONAME
ExInterlockedAddLargeInteger@16 @ 19 NONAME
ExInterlockedAddLargeInteger@12 @ 19 NONAME
@ExInterlockedAddLargeStatistic@8 @ 20 NONAME
@ExInterlockedCompareExchange64@12 @ 21 NONAME
ExMutantObjectType @ 22 NONAME DATA
Expand Down
58 changes: 47 additions & 11 deletions lib/xboxkrnl/xboxkrnl.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,8 @@ typedef UCHAR KIRQL, *PKIRQL;
#define PASSIVE_LEVEL 0
#define APC_LEVEL 1
#define DISPATCH_LEVEL 2
#define PROFILE_LEVEL 27
#define HIGH_LEVEL 31

typedef ULONG PFN_COUNT;
typedef ULONG PFN_NUMBER, *PPFN_NUMBER;
Expand Down Expand Up @@ -719,6 +721,17 @@ typedef struct _LAUNCH_DATA_PAGE
#define LDT_LAUNCH_DASHBOARD_REASON_FORCE_ACCOUNT_NAME_CHANGE 11
#define LDT_LAUNCH_DASHBOARD_REASON_FORCE_BILLING_CHANGE 12

typedef enum _KOBJECTS {
EventNotificationObject = 0,
EventSynchronizationObject = 1,
MutantObject = 2,
QueueObject = 4,
SemaphoreObject = 5,
ThreadObject = 6,
TimerNotificationObject = 8,
TimerSynchronizationObject = 9,
} KOBJECTS;

typedef struct _DISPATCHER_HEADER
{
UCHAR Type;
Expand Down Expand Up @@ -1082,6 +1095,8 @@ typedef struct _SINGLE_LIST_ENTRY
struct _SINGLE_LIST_ENTRY *Next; /**< Pointer to the next (or first, if this is a header) entry in the singly linked list (NULL if there is none) */
} SINGLE_LIST_ENTRY, *PSINGLE_LIST_ENTRY;

typedef SINGLE_LIST_ENTRY SLIST_ENTRY, *PSLIST_ENTRY;

/**
* Serves as a header for a singly linked list. Initialized by ExInitializeSListHead
*/
Expand Down Expand Up @@ -1237,12 +1252,21 @@ typedef NTSTATUS (NTAPI *PDRIVER_DISPATCH) (
IN struct _IRP *Irp
);

#define IRP_MJ_CREATE 0x00
#define IRP_MJ_CLOSE 0x01
#define IRP_MJ_READ 0x02
#define IRP_MJ_WRITE 0x03
#define IRP_MJ_FLUSH_BUFFERS 0x06
#define IRP_MJ_DEVICE_CONTROL 0x0A
#define IRP_MJ_INTERNAL_DEVICE_CONTROL 0x0B
#define IRP_MJ_MAXIMUM_FUNCTION 0x0D

@JayFoxRox JayFoxRox May 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are these the correct ones for Xbox? I believe they differ between Xbox and common Windows.
(Edit: Maybe we should also have a code-comment about the fact that these have a different value in the original Xbox kernel)

@LoveMHz LoveMHz May 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Image

Based on FatxDriverObject these should be:

#define IRP_MJ_CREATE 0x00
#define IRP_MJ_CLOSE 0x01
#define IRP_MJ_READ 0x02
#define IRP_MJ_WRITE 0x03
#define IRP_MJ_QUERY_INFORMATION 0x04
#define IRP_MJ_SET_INFORMATION 0x05
#define IRP_MJ_FLUSH_BUFFERS 0x06
#define IRP_MJ_QUERY_VOLUME_INFORMATION 0x07
#define IRP_MJ_DIRECTORY_CONTROL 0x08
#define IRP_MJ_FILE_SYSTEM_CONTROL 0x09
#define IRP_MJ_DEVICE_CONTROL 0x0A
#define IRP_MJ_??? 0x0B
#define IRP_MJ_??? 0x0C
#define IRP_MJ_CLEANUP 0x0D
#define IRP_MJ_MAXIMUM_FUNCTION 0x0D
Image

Based on IoBuildDeviceIoControlRequest it's safe to assume 0x0B is IRP_MJ_INTERNAL_DEVICE_CONTROL

Image

The only reference I could find to 0x0C is in IoBuildAsynchronousFsdRequest. Based on context I would say it's safe to assume that 0x0C is IRP_MJ_SHUTDOWN.

Final:

#define IRP_MJ_CREATE 0x00
#define IRP_MJ_CLOSE 0x01
#define IRP_MJ_READ 0x02
#define IRP_MJ_WRITE 0x03
#define IRP_MJ_QUERY_INFORMATION 0x04
#define IRP_MJ_SET_INFORMATION 0x05
#define IRP_MJ_FLUSH_BUFFERS 0x06
#define IRP_MJ_QUERY_VOLUME_INFORMATION 0x07
#define IRP_MJ_DIRECTORY_CONTROL 0x08
#define IRP_MJ_FILE_SYSTEM_CONTROL 0x09
#define IRP_MJ_DEVICE_CONTROL 0x0A
#define IRP_MJ_INTERNAL_DEVICE_CONTROL 0x0B
#define IRP_MJ_SHUTDOWN 0x0C
#define IRP_MJ_CLEANUP 0x0D
#define IRP_MJ_MAXIMUM_FUNCTION 0x0D

@PatrickvL PatrickvL May 20, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this detailed feedback!

Shall I amend the commit these symbols reside in, or push a fix-up commit? (I would prefer to amend, if you don't mind, but will wait a while for guidance.)

@RadWolfie RadWolfie May 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

First of all, thanks for the depth details on IRP_MJ_ defines @LoveMHz. For sure it is more than what I had documented. There's one question I have to ask, is the FatxDriverObject info came from your own documentation you had discovered? I'm just wondering.

@LoveMHz LoveMHz May 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@RadWolfie yes, it's from my research using recovered cv meta from 5849 (and older kernels) using ghidra-coff-process-cv.

@thrimbor thrimbor May 28, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shall I amend the commit these symbols reside in, or push a fix-up commit? (I would prefer to amend, if you don't mind, but will wait a while for guidance.)

Definitely amend. I'd even say that if the commits don't conflict, I'd prefer this PR be split into a few smaller ones that only contain related commits (like the fixes for the printf-style functions). I've only looked at a few commits so far and they look reasonable, but I'd like to check more closely and that would prevent the discussions from potentially becoming unwieldy.
Please also adjust the commit messages, like starting the title with xboxkrnl: and keeping them short enough so they don't get cut off in GH, avoid using the @ sign or wrap it in backticks to prevent GH turning it into a tag. We don't often use commit messages that consist of more than a commit title, but I'm not against it if it provides useful detail or context.


typedef struct _DRIVER_OBJECT
{
PDRIVER_STARTIO DriverStartIo;
PDRIVER_DELETEDEVICE DriverDeleteDevice;
PDRIVER_DISMOUNTVOLUME DriverDismountVolume;
PDRIVER_DISPATCH MajorFunction[0x0E];
PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1];
} DRIVER_OBJECT, *PDRIVER_OBJECT;

typedef struct _DEVICE_OBJECT
Expand Down Expand Up @@ -1853,19 +1877,19 @@ XBAPI ULONG NTAPI RtlWalkFrameChain
IN ULONG Flags
);

XBAPI VOID CDECL RtlVsprintf
XBAPI INT CDECL RtlVsprintf
(
CHAR *,
CONST CHAR*,
...
VA_LIST
);

XBAPI VOID CDECL RtlVsnprintf
XBAPI INT CDECL RtlVsnprintf
(
CHAR *,
SIZE_T,
CONST CHAR*,
...
VA_LIST
);

XBAPI VOID NTAPI RtlUpperString
Expand Down Expand Up @@ -1937,7 +1961,7 @@ XBAPI NTSTATUS NTAPI RtlUnicodeToMultiByteN
ULONG BytesInUnicodeString
);

XBAPI NTSTATUS XBAPI RtlUnicodeStringToInteger
XBAPI NTSTATUS NTAPI RtlUnicodeStringToInteger
(
PUNICODE_STRING String,
ULONG Base,
Expand Down Expand Up @@ -1985,14 +2009,14 @@ XBAPI BOOLEAN NTAPI RtlTimeFieldsToTime
OUT PLARGE_INTEGER Time
);

XBAPI VOID CDECL RtlSprintf
XBAPI INT CDECL RtlSprintf
(
CHAR *,
CONST CHAR *,
...
);

XBAPI VOID CDECL RtlSnprintf
XBAPI INT CDECL RtlSnprintf
(
CHAR *,
SIZE_T,
Expand Down Expand Up @@ -2972,6 +2996,8 @@ XBAPI NTSTATUS NTAPI NtFlushBuffersFile
OUT PIO_STATUS_BLOCK IoStatusBlock
);

#define DUPLICATE_CLOSE_SOURCE 0x00000001

XBAPI NTSTATUS NTAPI NtDuplicateObject
(
IN HANDLE SourceHandle,
Expand Down Expand Up @@ -3050,7 +3076,7 @@ XBAPI NTSTATUS NTAPI NtDeviceIoControlFile
);


XBAPI BOOLEAN NTAPI NtDeleteFile
XBAPI NTSTATUS NTAPI NtDeleteFile
(
IN POBJECT_ATTRIBUTES ObjectAttributes
);
Expand Down Expand Up @@ -3637,7 +3663,7 @@ XBAPI PLIST_ENTRY NTAPI KeRemoveQueue
XBAPI BOOLEAN NTAPI KeRemoveEntryDeviceQueue
(
IN PKDEVICE_QUEUE DeviceQueue,
IN PKDEVICE_QUEUE DeviceQueueEntry
IN PKDEVICE_QUEUE_ENTRY DeviceQueueEntry
);

XBAPI PKDEVICE_QUEUE_ENTRY NTAPI KeRemoveDeviceQueue
Expand Down Expand Up @@ -3703,7 +3729,7 @@ XBAPI VOID NTAPI KeLeaveCriticalRegion (void);
* Checks whether the code is executed in a DPC context
* @return TRUE if the code is running in a DPC context, FALSE otherwise
**/
XBAPI BOOLEAN NTAPI KeIsExecutingDpc (void);
XBAPI ULONG NTAPI KeIsExecutingDpc (void);

XBAPI volatile KSYSTEM_TIME KeInterruptTime;

Expand Down Expand Up @@ -4216,6 +4242,16 @@ XBAPI PFN_COUNT NTAPI FscGetCacheSize (void);
XBAPI OBJECT_TYPE ExTimerObjectType;
XBAPI OBJECT_TYPE ExSemaphoreObjectType;

/* Registry value types */
#define REG_NONE 0
#define REG_SZ 1
#define REG_EXPAND_SZ 2
#define REG_BINARY 3
#define REG_DWORD 4
#define REG_DWORD_LITTLE_ENDIAN 4
#define REG_DWORD_BIG_ENDIAN 5
#define REG_MULTI_SZ 7
Comment on lines +4243 to +4251

@thrimbor thrimbor May 29, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not aware of these being used with the kernel API, is there value in nxdk providing these, considering there is no registry?

@ergo720 ergo720 May 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To my knowledge, REG_BINARY and REG_DWORD are the only ones used in ExQueryNonVolatileSetting to specify the type of the queried value. See here and here for how they are used in cxbxr


/* Offsets for ExSaveNonVolatileSetting / ExQueryNonVolatileSetting */
#define XC_TIMEZONE_BIAS 0x0000
#define XC_TZ_STD_NAME 0x0001
Expand Down
Loading