So, a few days ago I decided to speedcode an XBox emulator. Nothing special, just wanted to get it up and running partially, which I've nearly done. I have it converting xbe->exe, intercepting the kernel functions, etc. Now the last big part is the function matcher.
Since the XBox is a stable platform, it was possible for developers to inline all non-kernel calls into their program. This introduces a problem for emulation, since you can't simply execute this without emulating the low level parts of DirectX.
There have been two xbox emulation projects thus far:
- CXBX by caustik, the first XBox emulator to really get anywhere
- Xeon by SF, the first XBox emulator to play Halo
CXBX tackled the aforementioned problem by hand-writing signatures for each function that needs to be found. This works well, but is an extremely tedious method.
Xeon included a file called 'Halo.ini' that had the addresses in the original Halo where each function was located. This obviously works well, but only for the games which have these built, and I can only imagine it was written by hand as well.
Kiro is so awesome I'm moist.
The method I've come up with is automated and works just as well. If you have the libraries the inlined functions came from (from the XDK, specifically) then you can look at these libraries to generate patterns. The process is fairly simple. For each function in the library:
1) Find all the relocations in the function and store their locations and original value
2) Find a sequence of 8 (or as many as possible) bytes that aren't relocatable and are unique to this function pattern
3) Hash the function in its entirety
4) Store the function's base, relocations, unique bytes (and their base address), and hash
Store all of the function patterns in a database identified by the library version.
To match, look up the version of the library in question (it's in the XBE header) and open that database. For each function in the database:
1) Search for its unique bytes
2) Unrelocate the addresses from the pattern, checking to ensure that they match
3) Hash the function and see that it matches the hash from the pattern
4) If everything matches, patch the function's beginning to call the proper function, otherwise go back to 1
Once this is done for every function, you've got a completely intercepted XBox binary without any manual detection or signature building. I think this is the method that could allow XBox emulation to really take off.
The current project, Treefingers will hopefully have this matching capability soon. The project is split up into a number of portions:
- Treefingers - Python component that converts XBE files and will soon do the pattern matching
- Sclera - C component that does the actual emulation
- Airbag - Simple Python XDVDFS dumper
- Optimistic - Python component to generate signature databases
Time to get haxing.
iu,
~blumfelter