llnl / llnl/rose

Add Support for Obscure/Non-Standard Windows PE Specimens

Open
#273 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
688
Forks
144
PR merge metrics
No merged PRs in 30d

Description

Currently, ROSE only supports Standard Windows Based Executables, however, there exists a subset of executables that were created for a Windows Based Enviroment, but can not be analyzed by ROSE, even though they should meet the specifications for receiving support. I am specifically referring to .XBE files, developed by Microsoft for the Original Xbox. As the Original Xbox runs a modified version of the Windows NT Kernel (based on Windows 2000), these are true Windows Binaries that were compiled with VS C++, and should be supported for those that are doing Investigative work into Applications on these systems.

However, currently ROSE does not recognize these files, but in fact should be able to. As they are only slightly modified in structure in order to provide some Xbox related header magic. Otherwise these files are nearly identical to Windows PE Executables. A breakdown of the binary structure of the files can be found here: http://www.caustik.com/cxbx/download/xbe.htm

Therefore, if the maintainers could look into potentially adding in hardcoded support for this Windows Based Executable format or at least provide some insight into how to add support for this, so that others could do this, that would be immensely helpful. There are some example .XBE executables located here: https://github.com/rizinorg/rizin-testbins/tree/master/xbe

Additionally, there are other XBE loading tools that have been created for Ghidra, that could be used for reference, here: https://github.com/mborgerson/ghidra-xbe and a parser has also been created for rust here: https://github.com/jonas-schievink/xbe

There is a growing need for support for this binary format in order to help understand this system, in order to further efforts to preserve and document its architecture

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing ROSE's existing PE binary support and comparing it with the XBE structure described at caustik.com. Use the example XBE executables in rizin-testbins and consult the Ghidra and Rust XBE implementations for reference. Done means ROSE recognizes and can analyze the supported XBE specimens.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers, operating-systems, reverse-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.