Xbox kernel header improvements#770
Conversation
- STATUS_INVALID_DEVICE_REQUEST (0xC0000010) - STATUS_SHARING_VIOLATION (0xC0000043) - STATUS_SUSPEND_COUNT_EXCEEDED (0xC000004A) - STATUS_CANCELLED (0xC0000120)
Define the Xbox-specific IRP major function codes and use IRP_MJ_MAXIMUM_FUNCTION to size the MajorFunction dispatch table. Values verified against Xbox kernel memory dump.
- NtDeleteFile: return NTSTATUS, not BOOLEAN - KeIsExecutingDpc: return ULONG, not BOOLEAN - KeRemoveEntryDeviceQueue: second param is PKDEVICE_QUEUE_ENTRY, not PKDEVICE_QUEUE - RtlUnicodeStringToInteger: fix calling convention (NTAPI, not XBAPI) The .def has correct @12 decoration; mismatched XBAPI caused callers to omit stack compensation, corrupting locals after multiple calls.
Xbox kernel's ExInterlockedAddLargeInteger takes only (PLARGE_INTEGER, LARGE_INTEGER) without the PKSPIN_LOCK parameter present in the NT version (Xbox is single-CPU). The @16 decoration incorrectly accounted for a spinlock argument that doesn't exist. Correct size: PLARGE_INTEGER (4) + LARGE_INTEGER (8) = 12 bytes.
…return INT, not VOID These are the kernel's _snprintf/_sprintf/_vsnprintf/_vsprintf exports. They return the number of characters written (or -1 on truncation), matching MSVC's CRT behavior.
The 'v' variants (_vsprintf/_vsnprintf) receive a pre-built argument list, not variadic arguments directly. Add VA_LIST typedef to xboxdef.h (backed by __builtin_va_list) and use it in the declarations. This is type-compatible with stdarg.h's va_list since pdclib defines va_list as __builtin_va_list on the Xbox platform.
| #define IRP_MJ_FLUSH_BUFFERS 0x06 | ||
| #define IRP_MJ_DEVICE_CONTROL 0x0A | ||
| #define IRP_MJ_INTERNAL_DEVICE_CONTROL 0x0B | ||
| #define IRP_MJ_MAXIMUM_FUNCTION 0x0D |
There was a problem hiding this comment.
Are these the correct ones for Xbox? I believe they differ between Xbox and common Windows.
(Edit: Maybe we should also have a code-comment about the fact that these have a different value in the original Xbox kernel)
There was a problem hiding this comment.
Based on FatxDriverObject these should be:
#define IRP_MJ_CREATE 0x00
#define IRP_MJ_CLOSE 0x01
#define IRP_MJ_READ 0x02
#define IRP_MJ_WRITE 0x03
#define IRP_MJ_QUERY_INFORMATION 0x04
#define IRP_MJ_SET_INFORMATION 0x05
#define IRP_MJ_FLUSH_BUFFERS 0x06
#define IRP_MJ_QUERY_VOLUME_INFORMATION 0x07
#define IRP_MJ_DIRECTORY_CONTROL 0x08
#define IRP_MJ_FILE_SYSTEM_CONTROL 0x09
#define IRP_MJ_DEVICE_CONTROL 0x0A
#define IRP_MJ_??? 0x0B
#define IRP_MJ_??? 0x0C
#define IRP_MJ_CLEANUP 0x0D
#define IRP_MJ_MAXIMUM_FUNCTION 0x0D
Based on IoBuildDeviceIoControlRequest it's safe to assume 0x0B is IRP_MJ_INTERNAL_DEVICE_CONTROL
The only reference I could find to 0x0C is in IoBuildAsynchronousFsdRequest. Based on context I would say it's safe to assume that 0x0C is IRP_MJ_SHUTDOWN.
Final:
#define IRP_MJ_CREATE 0x00
#define IRP_MJ_CLOSE 0x01
#define IRP_MJ_READ 0x02
#define IRP_MJ_WRITE 0x03
#define IRP_MJ_QUERY_INFORMATION 0x04
#define IRP_MJ_SET_INFORMATION 0x05
#define IRP_MJ_FLUSH_BUFFERS 0x06
#define IRP_MJ_QUERY_VOLUME_INFORMATION 0x07
#define IRP_MJ_DIRECTORY_CONTROL 0x08
#define IRP_MJ_FILE_SYSTEM_CONTROL 0x09
#define IRP_MJ_DEVICE_CONTROL 0x0A
#define IRP_MJ_INTERNAL_DEVICE_CONTROL 0x0B
#define IRP_MJ_SHUTDOWN 0x0C
#define IRP_MJ_CLEANUP 0x0D
#define IRP_MJ_MAXIMUM_FUNCTION 0x0DThere was a problem hiding this comment.
Thanks for this detailed feedback!
Shall I amend the commit these symbols reside in, or push a fix-up commit? (I would prefer to amend, if you don't mind, but will wait a while for guidance.)
There was a problem hiding this comment.
First of all, thanks for the depth details on IRP_MJ_ defines @LoveMHz. For sure it is more than what I had documented. There's one question I have to ask, is the FatxDriverObject info came from your own documentation you had discovered? I'm just wondering.
There was a problem hiding this comment.
@RadWolfie yes, it's from my research using recovered cv meta from 5849 (and older kernels) using ghidra-coff-process-cv.
There was a problem hiding this comment.
Shall I amend the commit these symbols reside in, or push a fix-up commit? (I would prefer to amend, if you don't mind, but will wait a while for guidance.)
Definitely amend. I'd even say that if the commits don't conflict, I'd prefer this PR be split into a few smaller ones that only contain related commits (like the fixes for the printf-style functions). I've only looked at a few commits so far and they look reasonable, but I'd like to check more closely and that would prevent the discussions from potentially becoming unwieldy.
Please also adjust the commit messages, like starting the title with xboxkrnl: and keeping them short enough so they don't get cut off in GH, avoid using the @ sign or wrap it in backticks to prevent GH turning it into a tag. We don't often use commit messages that consist of more than a commit title, but I'm not against it if it provides useful detail or context.
nit: I recently notice the commit's title and body with "at" symbol usage cause link to user's profile by mistake. I recommend to drop the "at" symbol and perhaps use the quote or another method. |
| /* Registry value types */ | ||
| #define REG_NONE 0 | ||
| #define REG_SZ 1 | ||
| #define REG_EXPAND_SZ 2 | ||
| #define REG_BINARY 3 | ||
| #define REG_DWORD 4 | ||
| #define REG_DWORD_LITTLE_ENDIAN 4 | ||
| #define REG_DWORD_BIG_ENDIAN 5 | ||
| #define REG_MULTI_SZ 7 |
There was a problem hiding this comment.
I'm not aware of these being used with the kernel API, is there value in nxdk providing these, considering there is no registry?
6 participants
This pull request is the result of Cxbx-Reloaded/xbox_kernel_test_suite#112 which fleshes out unit tests for all Xbox kernel API's, during which a few nxdk-related issues where discovered and solved via this PR;
This PR makes several updates and additions to the Xbox kernel header files to improve NTSTATUS code coverage, kernel object definitions, IRP major function handling, and function signatures for better type safety and clarity. The changes also introduce new type definitions and registry value constants, and correct some function prototypes.
I'm creating this as a draft, so reserve the liberty to rebase, squash, merge or otherwise modify the commit history. But still, each change has been committed separately, to facilitate cherry-picking if so desired, or when this PR as a whole needs discussion / adjustment / more work.
The most important changes are:
NTSTATUS codes and kernel object constants
STATUS_INVALID_DEVICE_REQUEST,STATUS_SHARING_VIOLATION,STATUS_SUSPEND_COUNT_EXCEEDED, andSTATUS_CANCELLEDtontstatus.h. [1] [2] [3]PROFILE_LEVEL,HIGH_LEVEL) and added aKOBJECTSenum for kernel object types inxboxkrnl.h. [1] [2]Type and macro additions
VA_LISTtypedef for variadic function handling, and addedSLIST_ENTRYas an alias forSINGLE_LIST_ENTRY. [1] [2]REG_SZ,REG_DWORD) for use with registry-related APIs.IRP and driver object improvements
IRP_MJ_CREATE,IRP_MJ_CLOSE) and updated theDRIVER_OBJECTstructure to use these codes for theMajorFunctionarray size.Function signature and prototype corrections
RtlVsprintf,RtlVsnprintf,RtlSprintf, andRtlSnprintfto returnINTinstead ofVOID, and usingVA_LISTfor variadic arguments. [1] [2]NtDeleteFilefromBOOLEANtoNTSTATUS, and changed the return type ofKeIsExecutingDpcfromBOOLEANtoULONG. [1] [2]Miscellaneous corrections
ExInterlockedAddLargeIntegerin the module definition file.DUPLICATE_CLOSE_SOURCEflag forNtDuplicateObject.KeRemoveEntryDeviceQueue.RtlUnicodeStringToInteger.