{"id":18772584,"url":"https://github.com/emoose/xvdtool","last_synced_at":"2025-04-04T19:10:02.650Z","repository":{"id":39917052,"uuid":"84225193","full_name":"emoose/xvdtool","owner":"emoose","description":"A command-line tool for manipulating Xbox One XVD \u0026 XVC files.","archived":false,"fork":false,"pushed_at":"2024-12-09T20:04:36.000Z","size":420,"stargazers_count":144,"open_issues_count":14,"forks_count":28,"subscribers_count":21,"default_branch":"master","last_synced_at":"2025-03-28T18:14:23.952Z","etag":null,"topics":["file-formats","reverse-engineering","xbox","xbox-one","xvd"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/emoose.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-03-07T17:05:53.000Z","updated_at":"2025-03-23T22:16:17.000Z","dependencies_parsed_at":"2024-06-16T08:16:05.822Z","dependency_job_id":"08e87f15-9abe-48b2-b88f-7ef306685a41","html_url":"https://github.com/emoose/xvdtool","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/emoose%2Fxvdtool","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/emoose%2Fxvdtool/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/emoose%2Fxvdtool/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/emoose%2Fxvdtool/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/emoose","download_url":"https://codeload.github.com/emoose/xvdtool/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247234921,"owners_count":20905854,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["file-formats","reverse-engineering","xbox","xbox-one","xvd"],"created_at":"2024-11-07T19:29:34.992Z","updated_at":"2025-04-04T19:10:02.630Z","avatar_url":"https://github.com/emoose.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"# xvdtool\n\n[![GitHub Workflow - Build](https://img.shields.io/github/actions/workflow/status/emoose/xvdtool/build.yml?branch=master)](https://github.com/emoose/xvdtool/actions?query=workflow%3Abuild)\n\n⚠️ No support for leaked files or copyrighted source code is provided, issues or pull requests will be closed without further comment. ⚠️\n\n\nxvdtool is a C# command-line utility for manipulating Xbox One XVD/XVC packages. It can print detailed info about package headers, resign, rehash, en/decrypt and verify data integrity of a package, it can also convert decrypted XVD files to VHD or extract the filesystem itself.\n\nSo far it's only been tested with dev-crypted packages (which use a different 256-bit **Offline Distribution Key (ODK)** to retail packages), as the retail key is still unknown. **This currently makes the tool useless for 90% of people**, but developers looking into how XVD files work will find a detailed mapping of the XVD structures and near-complete methods for manipulating them.\n\nHowever **no encryption keys are provided with this tool**, you'll have to find them yourself. Hashes for the dev keys are provided below.\nIf you have an Xbox One development kit or GamingServices framework (Windows10-exclusive) installed, you can use DurangoKeyExtractor to extract the keys from there.\n\nAlso included is a tool for extracting files from the XBFS (Xbox Boot File System) inside the Xbox One NAND, based on tuxuser's original [NANDOne](https://github.com/tuxuser/NANDOne) work with a few small additions.\nThanks Kebob for providing [OpenXvd](https://github.com/Kebob/OpenXvd).\n\n## Usage\n```\nUsage  : xvdtool.exe [parameters] [filename]\n\nParameters:\n    -h (-help) - print xvdtool usage\n    -i (-info) - print info about package\n    -wi (-writeinfo) - write info about package to [filename].txt\n    -o (-output) \u003coutput-path\u003e - specify output filename\n\n    -m (-mount) - mount package\n    -um (-unmount) - unmount package\n    -mp (-mountpoint) - Mount point for package (e.g. \"X:\")\n\n    -lk (-listkeys) - List known keys including their hashes / availability\n\n    -signfile \u003cpath-to-file\u003e - Path to xvd sign key (RSA)\n    -odkfile \u003cpath-to-file\u003e - Path to Offline Distribution key\n    -cikfile \u003cpath-to-file\u003e - Path to Content Instance key\n\n    -sk (-signkey) \u003ckey-name\u003e - Name of xvd sign key to use\n    -odk (-odkid) \u003cid\u003e - Id of Offline Distribution key to use (uint)\n    -cik (-cikguid) \u003cGUID\u003e - Guid of Content Instance key to use\n\n    -nd (-nodatahash) - disable data hash checking, speeds up -l and -f\n    -ne (-noextract) - disable data (embedded XVD/user data) extraction, speeds up -l and -f\n\n    -eu (-decrypt) - decrypt output xvd\n    -ee (-encrypt) - encrypt output xvd\n        XVDs will have a new CIK generated (if CIK in XVD header is empty), which will be encrypted with the ODK and stored in the XVD header\n\n    -hd (-removehash) - remove hash tree/data integrity from package\n    -he (-addhash) - add hash tree/data integrity to package\n\n    -md (-removemdu) - remove mutable data (MDU) from package\n\n    -r (-rehash) - fix data integrity hashes inside package\n    -rs (-resign) - sign package using the private key from rsa3_key.bin\n\n    -xe (-extractembedded) \u003coutput-file\u003e - extract embedded XVD from package\n    -xu (-extractuserdata) \u003coutput-file\u003e - extract user data from package\n    -xv (-extractvhd) \u003coutput-vhd\u003e - extracts filesystem from XVD into a VHD file\n    -xi (-extractimage) \u003coutput-file\u003e - extract raw filesystem image\n    -xf (-extractfiles) \u003coutput-folder\u003e - extract files from XVD filesystem\n\n    The next two commands will write info about each package found to [filename].txt\n    also extracts embedded XVD and user data to [filename].exvd.bin / [filename].userdata.bin\n    -l (-filelist) \u003cpath-to-file-list\u003e - use each XVD specified in the list\n    -f (-folder) \u003cpath-to-folder\u003e - scan folder for XVD files\n\nTo mount a package in Windows you'll have to decrypt it and remove the hash tables \u0026 mutable data first (-eu -hd -md)\n```\n\nTo decrypt non-XVC packages you'll need the correct ODK. The devkit ODK is \"widely known\" and a hashes are provided below, but as mentioned above the retail key is currently unknown.\n\nDecrypting XVC packages is a different matter, XVC packages use a **Content Instance Key (CIK)** which appears to be stored somewhere outside the package, however where and how it's stored is currently unknown. If you have the correct deobfuscated CIK for a given package you should be able to use it to to decrypt the package.\n\nDevkit/test-signed XVC packages use a static CIK which is also \"widely known\" (Hash provided below).\n\n## Required Files\nTo make full use of this tool you'll need the following files, which **are not included**. The tool will work fine without them, but some functions might not work.\n\nYou can use the included tool \"DurangoKeyExtractor\" to extract these keys from the Microsoft.GamingServices framework available on Windows 10.\nJust check some DLL / SYS / EXE files - you might find them.\n\n- 33ec8436-5a0e-4f0d-b1ce-3f29c3955039.cik: CIK keys for XVC crypto.\nFirst entry should be the key used by SDK tools/devkits.\nFormat: `[16 byte encryption key GUID][32 byte CIK]`\n~~~\nMD5: C9E58F4E1DC611E110A849648DADCC9B\nSHA256: 855CCA97C85558AE8E5FF87D8EEDB44AE6B8510601EB71423178B80EF1A7FF7F\n~~~\n- RedOdk.odk: ODK key used by SDK tools/devkits\nFormat: `[32 byte ODK]`\n~~~\nMD5: A2BCFA87F6F83A560BD5739586A5D516\nSHA256: CA37132DFB4B811506AE4DC45F45970FED8FE5E58C1BACB259F1B96145B0EBC6\n~~~\n- RedXvdPrivateKey.rsa: Private RSA key used by SDK tools to verify/sign packages.\nFormat: `RSAFULLPRIVATEBLOB` struct\n~~~\nMD5: 2DC371F46B67E29FFCC514C5B134BF73\nSHA256: 8E2B60377006D87EE850334C42FC200081386A838C65D96D1EA52032AA9628C5\n~~~\n\nFor other known keys and their hashes use the `-listkeys` cmdline switch.\nTo chose a specific key use the following cmdline switches:\n```\n    -sk (-signkey) \u003ckey-name\u003e - Name of xvd sign key to use\n    -odk (-odkid) \u003cid\u003e - Id of Offline Distribution key to use (uint)\n    -cik (-cikguid) \u003cGUID\u003e - Guid of Content Instance key to use\n```\n\n### Mounting XVDs\n\nFor mounting of XVD/XVC files, you require DLLs from [GamingServices](https://www.microsoft.com/en-us/p/gaming-services/9mwpm2cqnlhn?activetab=pivot:overviewtab) component.\nDownload \u0026 install it via the Microsoft Store and you should be good to go.\n\n## Possible locations to store keys\nXVDTool will create configuration/keys folders on first start - Global and local to the app.\n\nGlobal configuration folder:\n* Windows: `C:\\Users\\\u003cusername\u003e\\AppData\\Local\\xvdtool`\n* Linux: `/home/\u003cusername\u003e/.config/xvdtool`\n* Mac OS X: `/Users/\u003cusername\u003e/.config/xvdtool`\n\nLocal configuration folder is the current directory of the executable.\n\nInside these folders you can can store your keys to be autoloaded.\n\n* Xvd Signing keys: `\u003cconfig dir\u003e/XvdSigningKey/`\n* Content Instance keys: `\u003cconfig dir\u003e/Cik/`\n* Offline distribution keys: `\u003cconfig dir\u003e/Odk/`\n\nAdditionally, you can provide keys from arbitrary filesystem locations via the respective cmdline switches: `-signfile, -odkfile, -cikfile`\n\n### Naming the keys\nFor CIK it is not important how the keys are named if they have the binary structure of `[16 byte encryption key GUID][32 byte CIK]`.\nXVD signing keys should have a distinct identifier so you can refer to them via the `-sk (-signkey)` cmdline switch.\nODK needs to be named either by OdkIndex (`\u003cindex\u003e.odk`) or by its identifier: `RedOdk.odk, StandardOdk.odk etc.`\nFor detailed up-to-date info refer to: `LibXboxOne/Keys/`\n\n## What are XVDs?\nXVD packages are a secured file format used by the Xbox One to store data, an analogue to the Xbox 360's STFS packages. XVD files are usually used to store system images/data while XVCs (a slightly modified variant of XVDs) are used to store game data.\n\nFor a more detailed explanation of XVD files see xvd_info.md\n\n## Third party libraries used\n* BouncyCastle (https://www.bouncycastle.org/csharp/)\n* NDesk.Options (http://www.ndesk.org/Options)\n* DiscUtils (https://github.com/DiscUtils/DiscUtils)\n\n## Building from source\n\n### Requirements\n\n- [.NET 7.0 SDK](https://dotnet.microsoft.com/en-us/download/dotnet/7.0) - Choose Installer x64 for ease of use\n\n### Building\n\n- After installing the SDK, open up a new powershell window\n- Clone the repository\n```\ngit clone https://github.com/emoose/xvdtool\n```\n- Navigate into the directory\n```\ncd xvdtool\n```\n- Build\n```\ndotnet build -c Release\n```\n\nNOTE: If you want to build as DEBUG, either omit `-c Release` or supply `-c Debug` instead.\n\n## Help / Support\nxvdtool has been tested on Windows and MacOS but it should work on all systems supported by .NET Core.\n\nThere's no help given for this tool besides this readme, it's also currently **very** experimental and **very** likely to blow up in your face. If you do encounter any bugs please submit a description of what happened to the issue tracker.\n\nIf you want to help out with development feel free, just make a fork of this repo, make your changes in a new branch of that fork and then submit a pull request from that branch to the master branch of this repo.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Femoose%2Fxvdtool","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Femoose%2Fxvdtool","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Femoose%2Fxvdtool/lists"}