Reverse-engineering tooling
jeff — XEX-to-COFF splitter for Xbox 360
Hardened a Rust decompilation toolkit to carve retail Xbox 360 executables into linkable COFF objects, including a from-scratch control-flow-analysis rewrite promoted with zero non-trivial diffs against a real production target.
Rust · PowerPC · COFF · control-flow analysis
Game-preservation decompilation projects need a tool that can take a shipped executable and carve it back into individual, linkable object files — function boundaries, relocations, jump tables, and C++ vtables all recovered — so a build pipeline can compile clean-room C++ and diff it byte-for-byte against the original. The GameCube/Wii scene has a mature tool for this (decomp-toolkit); the Xbox 360 scene did not. jeff is my fork of an Xbox 360 port of that toolkit, and my layer of work — 115 commits since January 2026 — is about making its core xex split command survive real retail binaries rather than hand-picked test cases.
The centerpiece is a from-scratch rewrite of the control-flow-analysis engine, the virtual machine that interprets PowerPC opcodes to trace reachable code. I ran the rewrite like a zero-downtime database migration: seven staged phases with both engines executing side by side, shadow-digest parity gates, an environment-variable rollback lever, and quantitative promotion criteria. On the real production target the new engine detected 69,336 functions with zero crashes and produced byte-identical output to the legacy engine — zero non-trivial diffs. Only after every gate passed did a same-day commit delete roughly 6,400 lines of old engine and scaffolding. The analyzer’s test fixtures are cross-validated against two independent reference decompilers (m2c and Ghidra with VMX128 vector support), so both would have to be wrong in the same way for a fixture to lie.
Beyond the rewrite: tail-block detection for MSVC’s habit of emitting code fragments past a function’s unwind metadata, a vtable-discovery pass so C++ object layouts survive the split, and — most recently — census-first boundary surgery, where 596 lines of read-only diagnostic tooling statistically size the remaining error classes before any fix is written. There is also a fully quantified out-of-memory post-mortem: one cloned HashSet of 88,062 symbol names, multiplied across 2,223 split objects, cost about 28.4 GB versus roughly 13 MB shared.
The project is active and feeds two downstream game-decompilation efforts. It is a case study in stewarding twice-inherited infrastructure with migration-grade rigor: parity baselines, shadow execution, rollback levers, and measurement before surgery.