Hardware reverse engineering
XEX2 writer for real console hardware
A from-scratch, native-Linux writer and validator for Xbox 360 XEX2 containers that reproduces a closed loader format byte-for-byte and replaces months of trial-and-error reboots with an offline validator.
Xbox 360 · XEX2 · reverse engineering · LZX · loaders
Xbox 360 modules are wrapped in Microsoft’s undocumented XEX2 container: LZX compression, a per-page SHA-1 hash chain, and an RSA signature, all fed to a loader that either accepts the module or silently refuses it. xex-patcher is a from-scratch, native-Linux tool that writes and validates these containers without any Windows or Wine dependency, built to reverse-engineer the loader’s exact byte-level acceptance rules for a homebrew game preservation project. The goal was to end a debugging loop where every hypothesis cost a reboot on real hardware and the only feedback was “it loaded” or “it didn’t.”
The turning point was a single control experiment. The team had spent months blaming the container. Taking a known-good module and recompressing and re-signing it — changing nothing about the content — showed it still loaded, which proved the container recipe was never the problem and collapsed the entire hypothesis space onto the module’s synthesized import table. That narrowing is preserved as a five-module regression corpus, each entry verified on a live console, that doubles as an offline test suite. From it, a linter (xexlint) turns a silent loader rejection into a named, byte-level field error with no console in the loop.
The deepest engineering is a native LZX encoder. The one genuinely missing open-source piece was a correct compression writer, so the project adapted an existing encoder core through a series of bitstream patches, several of which were only discovered by building a compress-then-decode round-trip self-test before trusting any format document. The hardest single change generalized a fixed sliding window to slide over an arbitrarily large image. The payoff is exact: compressing the real 8.38 MB image and comparing against the proprietary reference tool, the decompressed image is byte-identical and all 134 per-page digests match — every value the loader actually verifies — even though the raw compressed bytes differ.
The from-scratch container loaded on real hardware the same day it was first written. Along the way, a second, unrelated bug was traced from a live crash register down to a single string constant, exonerating the packer for one whole failure mode. The result writes Wine out of the build pipeline entirely.