Skip to content
All projects

projects/rb3-xenon

Rock Band 3 (Xbox 360) — decompiling a symbol-less binary

Byte-exact decompilation of a symbol-less Xbox 360 binary: 44,226 of 69,301 functions matched in ten weeks by fleets of Claude Code agents — 78.9% of the game and engine code.

activeMay 2026 – Presentfreeqaz/rb3-xenon
DecompilationXbox 360agent orchestrationreverse engineering
Retail box art for Rock Band 3 on Xbox 360
Fuzzy match, game + engine target scope
78.9%
of 69,301 functions matched
44,226
Commits over ten weeks
~2,800

Progress

Matched code (fuzzy, game + engine target scope)

78.9%

as of August 4, 2026

Use the left and right arrow keys to step through data points.

Matched code (fuzzy, game + engine target scope) over time, currently 78.9%0%40%80%May 2026Aug 2026Jun 2026
Matched code (fuzzy, game + engine target scope)MilestonesCommits (bright = major)
  • May 26, 2026: AI decomp effort begins — First fork commits scaffold the engine and build pipeline from the sibling Dance Central 3 decompilation.
  • Jun 11, 2026: 978 names from Wii sibling — Cross-compiler symbol identification ships 978 vetted function identities from the Wii decompilation.
  • Jun 21, 2026: Cheap veins declared exhausted — Wave-20 close-out declares the cheap-matching format exhausted and pivots strategy.
  • Jul 8, 2026: Retarget to Title Update 5 — Mid-flight switch to the final updated executable, peaking at 190 commits in a day.
  • Jul 17, 2026: +1,871 names in a mega-run — Identification stack (fingerprints, Ghidra, BinDiff) names 1,871 functions in one push.
  • Jul 19, 2026: COMDAT-scatter fix: +1,176 in a day — Diagnosing linker-scattered code attribution yields 1,176 new byte-exact matches in a single day.
  • Jul 21, 2026: Splits repin expands the denominator — Batch repins pull more retail code into scored scope — the percentage dips honestly while absolute coverage rises.
  • Jul 26, 2026: Gapfill lane: +11k matched in two days — A lane sweeping small unclaimed functions pushes matched counts from ~27.6k to ~39k.
  • Aug 2, 2026: Funclet-signature pairings disclosed — The objdiff fork now flags duplicate exception-handler funclets paired by byte signature in the matched-function count. Percentages unaffected.
  • May 26, 2026: 34 commits — Effort begins: engine scaffolded from DC3 sibling
  • Jul 10, 2026: 190 commits — Busiest day: 190 commits
  • Jul 19, 2026: 110 commits — COMDAT-scatter day
  • Jul 26, 2026: 199 commits — Gapfill lane opens

Source: self-measured with objdiff-cli 4.2.3 (decomp-synth progress-history job 6d53): per-commit fork measurements, dtk-era pinned; 0% anchored on the eve of the fork's first commit (2026-05-26) — day one imported the sibling engine scaffold, giving immediate partial credit; extended 2026-07-20 through 2026-08-04 with per-day self-measurements on the repo's current objdiff fork (same scoring keys; the 2026-07-19 calibration overlap agrees with the pinned series within 0.1)

A matching decompilation of Rock Band 3 for the Xbox 360, held to the strictest standard the console-preservation community recognizes: clean-room C++ that, when compiled with the original Microsoft toolchain at retail optimization flags, produces machine code byte-identical to the shipped executable. The twist is scale and method — over roughly ten weeks and 2,800 commits, a single person orchestrating fleets of Claude Code agents pushed a retail binary that shipped with zero debug symbols to 44,226 of 69,301 functions matched.

With no symbols, every function starts as an anonymous address. The project bootstraps identification by treating two sibling decompilations as Rosetta Stones: rjkiv's Dance Central 3 decomp (same engine, same compiler, symbols available) serves as the engine and toolchain oracle, while DarkRTA's Wii decomp of the same game serves as the game-code oracle — both born in the MiloHax community, whose scaffolding (rjkiv also started this repo) made the whole campaign possible. Fingerprint matching over strings, callees, and constants — plus structural diffing through Ghidra and BinDiff with a custom SLEIGH fork for the Xenon vector ISA — triangulates names into the stripped binary.

The infrastructure is as much the story as the matches. Dozens of concurrent agents work through an eleven-tool MCP orchestrator backed by SQLite, isolated in a copy-on-write reflink worktree pool so no agent can corrupt another’s build. A content-addressed compiler cache cut cold rebuilds from about five minutes to 3.5 seconds. Evidence-graded state documents let an AI coordinator classify dead ends honestly and escalate genuine resourcing decisions back to the human.

The hardest problem was a large pool of correctly named functions stuck at 0% match. The diagnosis: the linker scatters per-function COMDAT sections freely across the binary, so functions were being attributed to the wrong translation units — the source was right; the linker’s layout was lying. Diagnosing this and applying three byte-neutral fix shapes produced +1,176 strict matches in a single day.

Current state, measured 2026-08-04: 81.7% of game code and 77.4% of the shared engine fuzzy-matched (78.9% size-weighted across the target scope), and 46.4% of the entire 10.7 MB executable including SDK and middleware nobody will ever match. The project is active — the long tail is routed to automated grind machinery while several techniques (COMDAT-scatter fixes, empirically gated precompiled headers, object-symbol-table patchers) ship back to the wider decompilation community through shared tool forks.

Screenshots

objdiff terminal UI diffing a retail function against its clean-room reconstruction at 99.8%: anonymous fn_ addresses on the left, recovered C++ names on the right
Rock Band 3 (Xbox 360) — decompiling a symbol-less binary | Free Wortley