Sync

<!-- TITLE: Bootloaders -->

<!-- SUBTITLE: A quick summary of Bootloaders -->

# Bootloaders

Bootloaders used on Xbox One.

## SPBL

Primary bootloader that is used for initialising the Security Processor,

decrypting the future stages, verifying the console certificates, fuses

and more. This sequence is split into 3 boot stages.

  - 0SP : Stored in SP ROM (factory)

  - 1SP : Patched into boot.bin

  - 2SP : Patched into boot.bin

## SMC

## 2BL

Started after the SP has completed its boot. Proceeds to intialise the

rest of the console and then begins booting into the Host VBI.

## SCP

Unknown, somewhere in between 2BL and VBI.

## VBI

Final boot stage which initialises the critical components of the

operating system and essentially acts as a bootstrap.

 No newline at end of file

<!-- TITLE: Certificates -->

<!-- SUBTITLE: A quick summary of Certificates -->

# Certificates

For verification of the console and as well as a method of securely

determining the capabalities to enable.

## Console Certificate

Per-console certificate to verify and define the device. Stored in

**sp_s.cfg** (offset: 0x5400) inside [XBFS](xbox-boot-file-system).

Total Size: 0x400 bytes

| Offset | Length | Type     | Information                    |

| ------ | ------ | -------- | ------------------------------ |

| 0x00   | 0x02   | ushort   | Magic (CC)                     |

| 0x02   | 0x02   | ushort   | Size                           |

| 0x04   | 0x02   | ushort   | IssuerKeyId                    |

| 0x06   | 0x02   | ushort   | ProtocolVersion                |

| 0x08   | 0x04   | uint32   | IssueDate                      |

| 0x0C   | 0x04   | uint32   | PspRevisionId                  |

| 0x10   | 0x10   | byte\[\] | SocId                          |

| 0x20   | 0x02   | ushort   | GenerationId                   |

| 0x22   | 0x01   | byte     | ConsoleRegion                  |

| 0x23   | 0x01   | byte     | Reserved0                      |

| 0x24   | 0x04   | uint32   | Reserved1                      |

| 0x28   | 0x08   | byte\[\] | VendorId                       |

| 0x30   | 0x100  | byte\[\] | AttestationPublicKey           |

| 0x130  | 0x100  | byte\[\] | ReservedPublicKey              |

| 0x230  | 0x0C   | byte\[\] | ConsoleSerialNumber            |

| 0x23C  | 0x08   | byte\[\] | ConsoleSku                     |

| 0x244  | 0x20   | byte\[\] | ConsoleSettingsDigest (SHA256) |

| 0x264  | 0x0C   | byte\[\] | ConsolePartNumber              |

| 0x270  | 0x10   | byte\[\] | HwSpecificData                 |

| 0x280  | 0x180  | byte\[\] | RsaSignature                   |

## Boot Capability Certificate

Used to determine what type of developer features the console can use.

Stored in **certkeys.bin** inside [XBFS](xbox-boot-file-system).

Total Size: 0x180 bytes

| Offset | Length | Type       | Information       |

| ------ | ------ | ---------- | ----------------- |

| 0x00   | 0x02   | ushort     | Magic (CP)        |

| 0x02   | 0x02   | ushort     | Size              |

| 0x04   | 0x02   | ushort     | ProtocolVersion   |

| 0x06   | 0x02   | ushort     | IssuerKeyId       |

| 0x08   | 0x08   | uint64     | Issue Date        |

| 0x10   | 0x10   | byte\[\]   | SoC ID            |

| 0x20   | 0x02   | ushort     | GenerationId      |

| 0x22   | 0x01   | byte       | AllowedStates     |

| 0x23   | 0x01   | byte       | LastCapability    |

| 0x24   | 0x04   | uint       | Flags             |

| 0x28   | 0x01   | byte       | ExpireCentury     |

| 0x29   | 0x01   | byte       | ExpireYear        |

| 0x2A   | 0x01   | byte       | ExpireMonth       |

| 0x2B   | 0x01   | byte       | ExpireDayOfMonth  |

| 0x2C   | 0x01   | byte       | ExpireHour        |

| 0x2D   | 0x01   | byte       | ExpireMinute      |

| 0x2E   | 0x01   | byte       | ExpireSecond      |

| 0x2F   | 0x01   | byte       | MinimumSpVersion  |

| 0x30   | 0x08   | uint64     | Minimum2blVersion |

| 0x38   | 0x10   | byte\[\]   | Nonce             |

| 0x48   | 0x38   | byte\[\]   | Reserved          |

| 0x80   | 0x200  | ushort\[\] | Capabilities      |

| 0x280  | 0x180  | byte\[\]   | RsaSignature      |

 No newline at end of file

<!-- TITLE: Compiling For Xbox -->

<!-- SUBTITLE: A quick summary of Compiling For Xbox -->

# Compiling for Xbox

Since the Xbox One's System operating system is based on OneCore we can use the libraries provided in Visual Studio and the Windows SDK. The primary library that will solve our needs is named: 'OneCore.lib' or 'OneCoreUAP.lib'. This is known as an umbrella library which links the common Win32 API's that are common among all Windows 10 devices. You can learn more here: <https://docs.microsoft.com/en-us/windows/win32/apiindex/windows-umbrella-libraries>

## Requirements

  - Recommended: CMake

  - Visual Studio 2019/2017 w/ the following (depending on version):

      - MSVC v141 - VS 2017 C++ x64/x86 build tools (v14.16) & MSVC v141

        - VS 2017 C++ x64/x86 Spectre-mitigated libs

      - MSVC v142 - VS 2019 C++ x64/x86 build tools (v14.22) & MSVC v142

        - VS 2019 C++ x64/x86 Spectre-mitigated libs

      - Windows Universal CRT SDK

  - Windows 10 SDK (Latest)

 No newline at end of file

<!-- TITLE: Console Revisions -->

<!-- SUBTITLE: A quick summary of Console Revisions -->

# Console revisions

## Revisions

| Revision        | Enum | Information            |

| --------------- | ---- | ---------------------- |

| DURANGO         | 0x10 | First retail revision. |

| SILVERTON ZORRO | 0x20 | TBD                    |

| SILVERTON MANDA | 0x21 | TBD                    |

| CARMEL BASE     | 0x30 | TBD                    |

| CARMEL 4K       | 0x31 | TBD                    |

| EDMONTON        | 0x40 | TBD                    |

| SCORPIO         | 0x50 | TBD                    |

## Reading revision via software

C code

```

#define CPUID_HW_REV 0x4000000D

#define HW_REV_DURANGO         0x10

#define HW_REV_SILVERTON_ZORRO 0x20

#define HW_REV_SILVERTON_MANDA 0x21

#define HW_REV_CARMEL_BASE     0x30

#define HW_REV_CARMEL_4K       0x31

#define HW_REV_EDMONTON        0x40

#define HW_REV_SCORPIO         0x50

int regs[4];

__cpuid(regs, CPUID_HW_REV);

int consoleRevId = regs[2] & 0xFFFF;

char *consoleRev = (char *)calloc(1, 0x100);

switch (consoleRevId)

{

case HW_REV_DURANGO:

   consoleRev = "Durango";

   break;

case HW_REV_SILVERTON_ZORRO:

   consoleRev = "Silverton Zorro";

   break;

case HW_REV_SILVERTON_MANDA:

   consoleRev = "Silverton Manda";

   break;

case HW_REV_CARMEL_BASE:

   consoleRev = "Carmel Base";

   break;

case HW_REV_CARMEL_4K:

   consoleRev = "Carmel 4K";

   break;

case HW_REV_EDMONTON:

   consoleRev = "Edmonton";

   break;

case HW_REV_SCORPIO:

   consoleRev = "Scorpio";

   break;

default:

   consoleRev = "Unknown";

}

printf("Console Revision: %s (0x%04X)\n", consoleRev, consoleRevId);

```

## Physical identification

Not known yet

 No newline at end of file

<!-- TITLE: Development -->

<!-- SUBTITLE: A quick summary of Development -->

# Development

## Projects

[XRF](https://github.com/xboxoneresearch/XRF)

XRF is a small utility written for the Xbox One System OS.

[xvdtool](https://github.com/emoose/xvdtool)

A command-line tool for manipulating Xbox One XVD & XVC files.

## Resources

[Installing Compatible software](installing-compatible-software)

 No newline at end of file