XEX

XEX (Xbox Executable) is the format used by the Xbox 360 for games and apps. Each one is contains a PE executable file and is both encrypted and compressed.

Header

Header
Name	Data Type	Position	Length
Magic	String	0	0x4
Flags	Integer	0x4	0x4
PE Data Offset	Integer	0x8	0x4
Reserved	Integer	0xC	0x4
Security Info Location	Integer	0x10	0x4
Optional Headers Count	Integer	0x14	0x4

Flags
Name	Bit
Title Module	0
Exports To Title	1
System Debugger	2
DLL Module	3
Module Patch	4
Full Patch	5
Delta Patch	6
User Mode	7

Following the header directly, there are a number of optional other headers that tell of the file's details.

Optional Headers

Optional Header
Name	Data Type	Position	Length
Image Key	Image Key	0	0x4
Data	Byte Array	0x4	…

'Data' is going to differ depending on 'Image Key'. Below, the formats for each type is documented.

The basis of each format can be determined by using the binary operator, AND, on the value with 0xFF.

When the output is 0x1, then there is no specific organization. The first integer may or may not be the address to the actual information.

When the output is 0xFF, then the first integer is the length of the data.

When the output is anything besides the previously stated, then the length is the output in count of integers.

Image Key
Name	value
Resource Information	0x2FF
Basefile Format	0x3FF
Base Refenerence	0x405
Delta Patch Descriptor	0x5FF
Bounding Path	0x80FF
Device ID	0x8105
Original Base Address	0x10001
Entry Point	0x10100
Image Base Address	0x10201
Import Libraries	0x103FF
Image Checksum Timestamp	0x18002
Callcap Enabled	0x18102
Fastcall Enabled	0x18200
Original PE Image Name	0x183FF
Static Libraries	0x200FF
TLS Information	0x20104
Default Stack Size	0x20200
Default Filesystem Cache Size	0x20301
Default Heap Size	0x20401
Page Heap Size & Flags	0x28002
System Flags	0x30000
Execution ID	0x40006
Title Workspace Size	0x40201
Game Ratings	0x40310
LAN Key	0x40404
Includes Xbox 360 Logo	0x405FF
Multi-Disc Media IDs	0x406FF
Alternate Title IDs	0x407FF
Additional Title Memory	0x40801
Includes Exports By Name	0xE10402

Resource Information
Name	Data Type	Position	Length
Size	Integer	0	0x4

Resource Information Entry
Name	Data Type	Position	Length
Name	String	0	0x8
Location	Integer	0x8	0x4
Size	Integer	0xC	0x4

Basefile Format
Name	Data Type	Position	Length
Size	Integer	0	0x4
Encryption	Integer	0x4	0x4
Compression	Compression	0x8	0x4

Compression
Name	Value
Not Compressed	0x1
Compressed	0x2
Delta Compressed	0x3

Delta Patch Descriptor
Name	Data Type	Position	Length
Size	Integer	0	0x4
Target Version	Integer	0x4	0x4
Source Version	Integer	0x8	0x4
Source Hash	SHA-1	0xC	0x14
Encryption Seed	Byte Array	0x20	0x10
Target Headers Length	Integer	0x30	0x4
Delta Headers Source Location	Integer	0x34	0x4
Delta Headers Source Size	Integer	0x38	0x4
Delta Headers Target Location	Integer	0x3C	0x4
Delta Image Source Location	Integer	0x40	0x4
Delta Image Source Size	Integer	0x44	0x4
Delta Image Target Location	Integer	0x48	0x4
Delta Header Patch Data	Byte Array	0x4C	…

Bounding Path
Name	Data Type	Position	Length
Size	Integer	0	0x4
Path	String	0x4	…

Import Libraries
Name	Data Type	Position	Length
Size	Integer	0	0x4
Library Entries Size	Integer	0x4	0x4
Library Entry Count	String	0x8	0x4
Library Names	Unicode String Array	0xC	∞

Blocks

Blocks are used for a variety of information in XVD packages. They are put into use directly after the header. Each block consists of 0x1000 (4096) bytes that contain padding at the end. This padding is always null and a length of 0x10 bytes, essentially meaning each block can hold 0xFF0 bytes of information.

The master hash table rests at 0x3000 and then 0x6000 for packages containing XVC information. This specific table contains hashes of the regular hash tables.

Regular hash tables start after the master hash table. They contain hashes for the blocks following them, which contain actual content.

The hashes for the Hash Table data type are truncated to 0x18 bytes, after usually being 0x20. Each table can contain 0xAA (170) hashes.

Hash Table Entry
Name	Data Type	Position	Length
Hash	SHA-2	0	0x18