From ee3d4456483026da772992352d1569d5f2d297d1 Mon Sep 17 00:00:00 2001 From: PatrickvL Date: Wed, 20 May 2026 13:42:28 +0200 Subject: [PATCH 01/11] Add missing NTSTATUS codes - STATUS_INVALID_DEVICE_REQUEST (0xC0000010) - STATUS_SHARING_VIOLATION (0xC0000043) - STATUS_SUSPEND_COUNT_EXCEEDED (0xC000004A) - STATUS_CANCELLED (0xC0000120) --- lib/xboxkrnl/ntstatus.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/xboxkrnl/ntstatus.h b/lib/xboxkrnl/ntstatus.h index f18802e08..306ab304b 100644 --- a/lib/xboxkrnl/ntstatus.h +++ b/lib/xboxkrnl/ntstatus.h @@ -32,6 +32,7 @@ #define STATUS_IN_PAGE_ERROR ((DWORD)0xC0000006L) #define STATUS_INVALID_HANDLE ((DWORD)0xC0000008L) #define STATUS_INVALID_PARAMETER ((DWORD)0xC000000DL) +#define STATUS_INVALID_DEVICE_REQUEST ((DWORD)0xC0000010L) #define STATUS_END_OF_FILE ((DWORD)0xC0000011L) #define STATUS_NO_MEMORY ((DWORD)0xC0000017L) #define STATUS_ILLEGAL_INSTRUCTION ((DWORD)0xC000001DL) @@ -45,8 +46,10 @@ #define STATUS_OBJECT_NAME_NOT_FOUND ((DWORD)0xC0000034L) #define STATUS_OBJECT_NAME_COLLISION ((DWORD)0xC0000035L) #define STATUS_OBJECT_PATH_NOT_FOUND ((DWORD)0xC000003AL) +#define STATUS_SHARING_VIOLATION ((DWORD)0xC0000043L) #define STATUS_MUTANT_NOT_OWNED ((DWORD)0xC0000046L) #define STATUS_SEMAPHORE_LIMIT_EXCEEDED ((DWORD)0xC0000047L) +#define STATUS_SUSPEND_COUNT_EXCEEDED ((DWORD)0xC000004AL) #define STATUS_ARRAY_BOUNDS_EXCEEDED ((DWORD)0xC000008CL) #define STATUS_FLOAT_DENORMAL_OPERAND ((DWORD)0xC000008DL) #define STATUS_FLOAT_DIVIDE_BY_ZERO ((DWORD)0xC000008EL) @@ -75,6 +78,7 @@ #define STATUS_INVALID_PARAMETER_11 ((DWORD)0xC00000F9L) #define STATUS_INVALID_PARAMETER_12 ((DWORD)0xC00000FAL) #define STATUS_STACK_OVERFLOW ((DWORD)0xC00000FDL) +#define STATUS_CANCELLED ((DWORD)0xC0000120L) #define STATUS_CONTROL_C_EXIT ((DWORD)0xC000013AL) #define STATUS_TOO_MANY_SECRETS ((DWORD)0xC0000156L) #define STATUS_HANDLE_NOT_CLOSABLE ((DWORD)0xC0000235L) From 206eee5b6e6403ed0b54c43f2af28b239509941b Mon Sep 17 00:00:00 2001 From: PatrickvL Date: Wed, 20 May 2026 13:43:13 +0200 Subject: [PATCH 02/11] Add PROFILE_LEVEL and HIGH_LEVEL IRQL constants --- lib/xboxkrnl/xboxkrnl.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/xboxkrnl/xboxkrnl.h b/lib/xboxkrnl/xboxkrnl.h index 6ac83b721..4ca83a72d 100644 --- a/lib/xboxkrnl/xboxkrnl.h +++ b/lib/xboxkrnl/xboxkrnl.h @@ -71,6 +71,8 @@ typedef UCHAR KIRQL, *PKIRQL; #define PASSIVE_LEVEL 0 #define APC_LEVEL 1 #define DISPATCH_LEVEL 2 +#define PROFILE_LEVEL 27 +#define HIGH_LEVEL 31 typedef ULONG PFN_COUNT; typedef ULONG PFN_NUMBER, *PPFN_NUMBER; From c425da5de7cabf7e1f66d10417b544c2120d0b1d Mon Sep 17 00:00:00 2001 From: PatrickvL Date: Wed, 20 May 2026 13:43:31 +0200 Subject: [PATCH 03/11] Add KOBJECTS enum for dispatcher object types --- lib/xboxkrnl/xboxkrnl.h | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/lib/xboxkrnl/xboxkrnl.h b/lib/xboxkrnl/xboxkrnl.h index 4ca83a72d..91cbdbe0e 100644 --- a/lib/xboxkrnl/xboxkrnl.h +++ b/lib/xboxkrnl/xboxkrnl.h @@ -721,6 +721,17 @@ typedef struct _LAUNCH_DATA_PAGE #define LDT_LAUNCH_DASHBOARD_REASON_FORCE_ACCOUNT_NAME_CHANGE 11 #define LDT_LAUNCH_DASHBOARD_REASON_FORCE_BILLING_CHANGE 12 +typedef enum _KOBJECTS { + EventNotificationObject = 0, + EventSynchronizationObject = 1, + MutantObject = 2, + QueueObject = 4, + SemaphoreObject = 5, + ThreadObject = 6, + TimerNotificationObject = 8, + TimerSynchronizationObject = 9, +} KOBJECTS; + typedef struct _DISPATCHER_HEADER { UCHAR Type; From 51772646781a677d3593ae1ac2acc6e1447c69b1 Mon Sep 17 00:00:00 2001 From: PatrickvL Date: Wed, 20 May 2026 13:43:53 +0200 Subject: [PATCH 04/11] Add SLIST_ENTRY typedef alias for SINGLE_LIST_ENTRY --- lib/xboxkrnl/xboxkrnl.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/xboxkrnl/xboxkrnl.h b/lib/xboxkrnl/xboxkrnl.h index 91cbdbe0e..f6b458729 100644 --- a/lib/xboxkrnl/xboxkrnl.h +++ b/lib/xboxkrnl/xboxkrnl.h @@ -1095,6 +1095,8 @@ typedef struct _SINGLE_LIST_ENTRY struct _SINGLE_LIST_ENTRY *Next; /**< Pointer to the next (or first, if this is a header) entry in the singly linked list (NULL if there is none) */ } SINGLE_LIST_ENTRY, *PSINGLE_LIST_ENTRY; +typedef SINGLE_LIST_ENTRY SLIST_ENTRY, *PSLIST_ENTRY; + /** * Serves as a header for a singly linked list. Initialized by ExInitializeSListHead */ From 37ea1aff41fe6b0dc348c1dd33d37d35020c8cb0 Mon Sep 17 00:00:00 2001 From: PatrickvL Date: Wed, 20 May 2026 13:44:18 +0200 Subject: [PATCH 05/11] Add IRP_MJ_* major function code constants Define the Xbox-specific IRP major function codes and use IRP_MJ_MAXIMUM_FUNCTION to size the MajorFunction dispatch table. Values verified against Xbox kernel memory dump. --- lib/xboxkrnl/xboxkrnl.h | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/lib/xboxkrnl/xboxkrnl.h b/lib/xboxkrnl/xboxkrnl.h index f6b458729..523fa89f8 100644 --- a/lib/xboxkrnl/xboxkrnl.h +++ b/lib/xboxkrnl/xboxkrnl.h @@ -1252,12 +1252,21 @@ typedef NTSTATUS (NTAPI *PDRIVER_DISPATCH) ( IN struct _IRP *Irp ); +#define IRP_MJ_CREATE 0x00 +#define IRP_MJ_CLOSE 0x01 +#define IRP_MJ_READ 0x02 +#define IRP_MJ_WRITE 0x03 +#define IRP_MJ_FLUSH_BUFFERS 0x06 +#define IRP_MJ_DEVICE_CONTROL 0x0A +#define IRP_MJ_INTERNAL_DEVICE_CONTROL 0x0B +#define IRP_MJ_MAXIMUM_FUNCTION 0x0D + typedef struct _DRIVER_OBJECT { PDRIVER_STARTIO DriverStartIo; PDRIVER_DELETEDEVICE DriverDeleteDevice; PDRIVER_DISMOUNTVOLUME DriverDismountVolume; - PDRIVER_DISPATCH MajorFunction[0x0E]; + PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1]; } DRIVER_OBJECT, *PDRIVER_OBJECT; typedef struct _DEVICE_OBJECT From b64463d31c76d91a2e8cf448fa890841e9b14202 Mon Sep 17 00:00:00 2001 From: PatrickvL Date: Wed, 20 May 2026 13:44:41 +0200 Subject: [PATCH 06/11] Add REG_* registry value type constants --- lib/xboxkrnl/xboxkrnl.h | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/lib/xboxkrnl/xboxkrnl.h b/lib/xboxkrnl/xboxkrnl.h index 523fa89f8..7fa39510a 100644 --- a/lib/xboxkrnl/xboxkrnl.h +++ b/lib/xboxkrnl/xboxkrnl.h @@ -4240,6 +4240,16 @@ XBAPI PFN_COUNT NTAPI FscGetCacheSize (void); XBAPI OBJECT_TYPE ExTimerObjectType; XBAPI OBJECT_TYPE ExSemaphoreObjectType; +/* Registry value types */ +#define REG_NONE 0 +#define REG_SZ 1 +#define REG_EXPAND_SZ 2 +#define REG_BINARY 3 +#define REG_DWORD 4 +#define REG_DWORD_LITTLE_ENDIAN 4 +#define REG_DWORD_BIG_ENDIAN 5 +#define REG_MULTI_SZ 7 + /* Offsets for ExSaveNonVolatileSetting / ExQueryNonVolatileSetting */ #define XC_TIMEZONE_BIAS 0x0000 #define XC_TZ_STD_NAME 0x0001 From b3db1ec929035181c2307ebabbeda912baf95ffd Mon Sep 17 00:00:00 2001 From: PatrickvL Date: Wed, 20 May 2026 13:45:03 +0200 Subject: [PATCH 07/11] Add DUPLICATE_CLOSE_SOURCE constant for NtDuplicateObject --- lib/xboxkrnl/xboxkrnl.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/xboxkrnl/xboxkrnl.h b/lib/xboxkrnl/xboxkrnl.h index 7fa39510a..6a86cd2d9 100644 --- a/lib/xboxkrnl/xboxkrnl.h +++ b/lib/xboxkrnl/xboxkrnl.h @@ -2996,6 +2996,8 @@ XBAPI NTSTATUS NTAPI NtFlushBuffersFile OUT PIO_STATUS_BLOCK IoStatusBlock ); +#define DUPLICATE_CLOSE_SOURCE 0x00000001 + XBAPI NTSTATUS NTAPI NtDuplicateObject ( IN HANDLE SourceHandle, From 29309558f30fe092fd50ee61926ee9a75436d741 Mon Sep 17 00:00:00 2001 From: PatrickvL Date: Wed, 20 May 2026 13:45:52 +0200 Subject: [PATCH 08/11] Fix type errors in kernel header declarations - NtDeleteFile: return NTSTATUS, not BOOLEAN - KeIsExecutingDpc: return ULONG, not BOOLEAN - KeRemoveEntryDeviceQueue: second param is PKDEVICE_QUEUE_ENTRY, not PKDEVICE_QUEUE - RtlUnicodeStringToInteger: fix calling convention (NTAPI, not XBAPI) The .def has correct @12 decoration; mismatched XBAPI caused callers to omit stack compensation, corrupting locals after multiple calls. --- lib/xboxkrnl/xboxkrnl.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/xboxkrnl/xboxkrnl.h b/lib/xboxkrnl/xboxkrnl.h index 6a86cd2d9..685eb37f1 100644 --- a/lib/xboxkrnl/xboxkrnl.h +++ b/lib/xboxkrnl/xboxkrnl.h @@ -1961,7 +1961,7 @@ XBAPI NTSTATUS NTAPI RtlUnicodeToMultiByteN ULONG BytesInUnicodeString ); -XBAPI NTSTATUS XBAPI RtlUnicodeStringToInteger +XBAPI NTSTATUS NTAPI RtlUnicodeStringToInteger ( PUNICODE_STRING String, ULONG Base, @@ -3076,7 +3076,7 @@ XBAPI NTSTATUS NTAPI NtDeviceIoControlFile ); -XBAPI BOOLEAN NTAPI NtDeleteFile +XBAPI NTSTATUS NTAPI NtDeleteFile ( IN POBJECT_ATTRIBUTES ObjectAttributes ); @@ -3663,7 +3663,7 @@ XBAPI PLIST_ENTRY NTAPI KeRemoveQueue XBAPI BOOLEAN NTAPI KeRemoveEntryDeviceQueue ( IN PKDEVICE_QUEUE DeviceQueue, - IN PKDEVICE_QUEUE DeviceQueueEntry + IN PKDEVICE_QUEUE_ENTRY DeviceQueueEntry ); XBAPI PKDEVICE_QUEUE_ENTRY NTAPI KeRemoveDeviceQueue @@ -3729,7 +3729,7 @@ XBAPI VOID NTAPI KeLeaveCriticalRegion (void); * Checks whether the code is executed in a DPC context * @return TRUE if the code is running in a DPC context, FALSE otherwise **/ -XBAPI BOOLEAN NTAPI KeIsExecutingDpc (void); +XBAPI ULONG NTAPI KeIsExecutingDpc (void); XBAPI volatile KSYSTEM_TIME KeInterruptTime; From 13a3a02cf816a9c480f7c78d35a375fe622feb61 Mon Sep 17 00:00:00 2001 From: PatrickvL Date: Wed, 20 May 2026 01:00:18 +0200 Subject: [PATCH 09/11] Fix ExInterlockedAddLargeInteger stdcall decoration (@16 -> @12) Xbox kernel's ExInterlockedAddLargeInteger takes only (PLARGE_INTEGER, LARGE_INTEGER) without the PKSPIN_LOCK parameter present in the NT version (Xbox is single-CPU). The @16 decoration incorrectly accounted for a spinlock argument that doesn't exist. Correct size: PLARGE_INTEGER (4) + LARGE_INTEGER (8) = 12 bytes. --- lib/xboxkrnl/xboxkrnl.exe.def | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/xboxkrnl/xboxkrnl.exe.def b/lib/xboxkrnl/xboxkrnl.exe.def index cce520347..a607e6a4f 100644 --- a/lib/xboxkrnl/xboxkrnl.exe.def +++ b/lib/xboxkrnl/xboxkrnl.exe.def @@ -23,7 +23,7 @@ EXPORTS ExEventObjectType @ 16 NONAME DATA ExFreePool@4 @ 17 NONAME ExInitializeReadWriteLock@4 @ 18 NONAME - ExInterlockedAddLargeInteger@16 @ 19 NONAME + ExInterlockedAddLargeInteger@12 @ 19 NONAME @ExInterlockedAddLargeStatistic@8 @ 20 NONAME @ExInterlockedCompareExchange64@12 @ 21 NONAME ExMutantObjectType @ 22 NONAME DATA From 9e8046896bd7b69fac4a4972a1ce7b42ea1bdd6f Mon Sep 17 00:00:00 2001 From: PatrickvL Date: Wed, 20 May 2026 09:49:46 +0200 Subject: [PATCH 10/11] Fix return types: RtlSnprintf, RtlSprintf, RtlVsnprintf, RtlVsprintf return INT, not VOID These are the kernel's _snprintf/_sprintf/_vsnprintf/_vsprintf exports. They return the number of characters written (or -1 on truncation), matching MSVC's CRT behavior. --- lib/xboxkrnl/xboxkrnl.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/xboxkrnl/xboxkrnl.h b/lib/xboxkrnl/xboxkrnl.h index 685eb37f1..ef55ef669 100644 --- a/lib/xboxkrnl/xboxkrnl.h +++ b/lib/xboxkrnl/xboxkrnl.h @@ -1877,14 +1877,14 @@ XBAPI ULONG NTAPI RtlWalkFrameChain IN ULONG Flags ); -XBAPI VOID CDECL RtlVsprintf +XBAPI INT CDECL RtlVsprintf ( CHAR *, CONST CHAR*, ... ); -XBAPI VOID CDECL RtlVsnprintf +XBAPI INT CDECL RtlVsnprintf ( CHAR *, SIZE_T, @@ -2009,14 +2009,14 @@ XBAPI BOOLEAN NTAPI RtlTimeFieldsToTime OUT PLARGE_INTEGER Time ); -XBAPI VOID CDECL RtlSprintf +XBAPI INT CDECL RtlSprintf ( CHAR *, CONST CHAR *, ... ); -XBAPI VOID CDECL RtlSnprintf +XBAPI INT CDECL RtlSnprintf ( CHAR *, SIZE_T, From c756c44e29b9b990fbd94c93bcfd0c428b76e2dc Mon Sep 17 00:00:00 2001 From: PatrickvL Date: Wed, 20 May 2026 09:50:08 +0200 Subject: [PATCH 11/11] Fix RtlVsprintf/RtlVsnprintf: take VA_LIST, not variadic arguments The 'v' variants (_vsprintf/_vsnprintf) receive a pre-built argument list, not variadic arguments directly. Add VA_LIST typedef to xboxdef.h (backed by __builtin_va_list) and use it in the declarations. This is type-compatible with stdarg.h's va_list since pdclib defines va_list as __builtin_va_list on the Xbox platform. --- lib/xboxkrnl/xboxdef.h | 2 ++ lib/xboxkrnl/xboxkrnl.h | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/xboxkrnl/xboxdef.h b/lib/xboxkrnl/xboxdef.h index 095b503ef..46b2533a3 100644 --- a/lib/xboxkrnl/xboxdef.h +++ b/lib/xboxkrnl/xboxdef.h @@ -48,6 +48,8 @@ typedef ULONGLONG QUAD; typedef ULONG ULONG_PTR; typedef LONG LONG_PTR; +typedef __builtin_va_list VA_LIST; + typedef ULONG_PTR DWORD_PTR; typedef struct _FLOATING_SAVE_AREA diff --git a/lib/xboxkrnl/xboxkrnl.h b/lib/xboxkrnl/xboxkrnl.h index ef55ef669..a288dc2a5 100644 --- a/lib/xboxkrnl/xboxkrnl.h +++ b/lib/xboxkrnl/xboxkrnl.h @@ -1881,7 +1881,7 @@ XBAPI INT CDECL RtlVsprintf ( CHAR *, CONST CHAR*, - ... + VA_LIST ); XBAPI INT CDECL RtlVsnprintf @@ -1889,7 +1889,7 @@ XBAPI INT CDECL RtlVsnprintf CHAR *, SIZE_T, CONST CHAR*, - ... + VA_LIST ); XBAPI VOID NTAPI RtlUpperString