{"id":20268960,"url":"https://github.com/patatetom/xtaf","last_synced_at":"2025-04-11T03:50:43.960Z","repository":{"id":256781122,"uuid":"122597784","full_name":"patatetom/xtaf","owner":"patatetom","description":"Xbox 360 file system","archived":false,"fork":false,"pushed_at":"2018-03-11T09:37:48.000Z","size":66,"stargazers_count":5,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-25T01:51:09.420Z","etag":null,"topics":["filesystem","forensic","forensics","fs","fuse","python","xbox360"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/patatetom.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-02-23T09:04:03.000Z","updated_at":"2024-04-11T17:37:15.000Z","dependencies_parsed_at":"2024-09-13T03:06:06.792Z","dependency_job_id":null,"html_url":"https://github.com/patatetom/xtaf","commit_stats":null,"previous_names":["patatetom/xtaf"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/patatetom%2Fxtaf","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/patatetom%2Fxtaf/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/patatetom%2Fxtaf/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/patatetom%2Fxtaf/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/patatetom","download_url":"https://codeload.github.com/patatetom/xtaf/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248339262,"owners_count":21087214,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["filesystem","forensic","forensics","fs","fuse","python","xbox360"],"created_at":"2024-11-14T12:22:01.056Z","updated_at":"2025-04-11T03:50:43.944Z","avatar_url":"https://github.com/patatetom.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# xtaf\nXbox 360 file system\n\n\n## xtaffuse module\nthis module use `xb360hd` module to read a xtaf partition\n\n```\nPython 3.6.4 (default, Jan  5 2018, 02:35:40) \n[GCC 7.2.1 20171224] on linux\nType \"help\", \"copyright\", \"credits\" or \"license\" for more information.\n\u003e\u003e\u003e # import module\n\u003e\u003e\u003e import xtaffuse\n\n\u003e\u003e\u003e # Xbox 360 hard drive is accessible from /dev/loop0\n\u003e\u003e\u003e dev = '/dev/loop0'\n\n\u003e\u003e\u003e # open data partition by default\n\u003e\u003e\u003e xtaf = xtaffuse.XtafFuse(dev)\n\u003e\u003e\u003e xtaf.xtaf\n(id: 2068792064, size: 244943675392, cluster size: 16384, table entry: 4, table size: 59801600,\nroot cluster: 1, volume name: Disque dur)\n\u003e\u003e\u003e xtaf.xtaf.device\n(name: /dev/loop0, serial number: 6VCT9Z2W, firmware revision: 0002CE02, model number: ST9250315AS,\nsize: 250059350016)\n\n\u003e\u003e\u003e # test readdir and getattr functions\n\u003e\u003e\u003e xtaf.readdir('/', 0)\n('.', '..', 'name.txt', 'Cache', 'Content')\n\u003e\u003e\u003e xtaf.readdir('/Content', 0)\n('.', '..', 'E00005538DC276AE', '0000000000000000')\n\u003e\u003e\u003e xtaf.getattr('/', 0)\n{'st_mode': 16749, 'st_nlink': 2, 'st_gid': 1000, 'st_uid': 1000, 'st_size': 4096, 'st_ctime':\n1520327391.0, 'st_mtime': 1520327391.0, 'st_atime': 1520327391.0}\n\u003e\u003e\u003e xtaf.getattr('/name.txt', 0)\n{'st_mode': 33060, 'st_nlink': 1, 'st_gid': 1000, 'st_uid': 1000, 'st_size': 22, 'st_ctime':\n1132660302.0, 'st_mtime': 1132660302.0, 'st_atime': 1132660302.0}\n\n\u003e\u003e\u003e # make the partition accessible through /tmp/xbox\n\u003e\u003e\u003e fuser = xtaffuse.FUSE(xtaf, '/tmp/xbox', foreground=True, nothreads=True, debug=True)\nFUSE library version: 2.9.7\nnullpath_ok: 0\nnopath: 0\nutime_omit_ok: 0\nunique: 1, opcode: INIT (26), nodeid: 0, insize: 56, pid: 0\nINIT: 7.26\nflags=0x001ffffb\nmax_readahead=0x00020000\n   INIT: 7.19\n   flags=0x00000011\n   max_readahead=0x00020000\n   max_write=0x00020000\n   max_background=0\n   congestion_threshold=0\n   unique: 1, success, outsize: 40\n```\nand in another terminal\n```\n$ ./isXb360Hd /dev/loop0 -v \u0026\u0026 echo OK || echo KO\ndevice: /dev/loop0\nserial number: 6VCT9Z2W\nfirmware revision: 0002CE02\nmodel number: ST9250315AS\nsize: 488397168 bytes\nxtaf at 0x10c080000: ok\nxtaf at 0x118eb0000: ok\nxtaf at 0x120eb0000: ok\nxtaf at 0x130eb0000: ok\nOK\n\n$ mount | grep /tmp/xbox\nXtafFuse on /tmp/xbox type fuse (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000)\n\n$ ll -gG /tmp/xbox/\ntotal 0\ndr-xr-xr-x 2 4096 22 nov.   2005 Cache\ndr-xr-xr-x 2 4096 22 nov.   2005 Content\n-r--r--r-- 1   22 22 nov.   2005 name.txt\n\n$ tree /tmp/xbox/\n/tmp/xbox/\n├── Cache\n│   ├── NB_E0005AE6S4TLE.0000002000000\n│   ├── TK_080J90B_A35H6O7QL7FVA.03KR2R4PMB8C2\n│   ├── TK_1CKHGOD_7UDM61KKOO9UV.03KR2R4PVDFFI\n│   ├── TK_2NHCVSM_BU78383MFBO42.03KR2R4PR916I\n│   ├── VC_17SA802_BQFIBU8CS8UT5.03KR2R5IH7L72\n│   └── XT_000007V_FK000001H7RBB.03KR2R5C4LKI2\n├── Content\n│   ├── 0000000000000000\n│   │   └── FFFE07DF\n│   │       └── 00040000\n│   │           ├── (DELETED:XlfsUploadCache.dat)\n│   │           └── ContentCache.pkg\n│   └── E00005538DC276AE\n│       ├── 454109C3\n│       │   └── 00000001\n│       │       ├── Career 20051122140822\n│       │       ├── Career 20051122143225\n│       │       ├── Career 20051122143331\n│       │       └── Settings 20051122143332\n│       └── FFFE07D1\n│           └── 00010000\n│               └── E00005538DC276AE\n└── name.txt\n10 directories, 14 files\n\n$ iconv -f utf-16 /tmp/xbox/name.txt\nDisque dur\n\n$ xxd /tmp/xbox/Content/E00005538DC276AE/454109C3/00000001/Settings\\ 20051122143332 | head\n00000000: 434f 4e20 01a8 576c 276a e558 3835 3334  CON ..Wl'j.X8534\n00000010: 3239 2d30 3031 0000 0000 0000 0000 0002  29-001..........\n00000020: 3037 2d31 392d 3131 0001 0001 31a0 b991  07-19-11....1...\n00000030: 4e02 1ca9 0eb1 782c 1c81 60ea b0b5 d29d  N.....x,..`.....\n00000040: 420d fb43 89a7 ad2c 871d 2aad 9916 8498  B..C...,..*.....\n00000050: f89d 7c2d b6a0 892c ee57 909e f0f5 3259  ..|-...,.W....2Y\n00000060: 939e 9e47 9d28 27f3 cb64 67a1 51fa d309  ...G.('..dg.Q...\n00000070: ac86 1253 9aad 0aa6 9558 61ef 4aba bdd1  ...S.....Xa.J...\n00000080: e167 cfc3 0a72 dc89 2db6 b93d b0be df85  .g...r..-..=....\n00000090: 3699 5ca3 9711 56b1 5f62 d6bf c415 5961  6.\\...V._b....Ya\n```\n\n\n## xb360hd module\nthis module is used by `xtaffuse` module to read a xtaf partition : you can use it to debug the module or try to restore a deleted file.\n\n```\nPython 3.6.4 (default, Jan  5 2018, 02:35:40) \n[GCC 7.2.1 20171224] on linux\nType \"help\", \"copyright\", \"credits\" or \"license\" for more information.\n\u003e\u003e\u003e # import module\n\u003e\u003e\u003e import xb360hd\n\n\u003e\u003e\u003e # Xbox 360 hard drive is accessible from /dev/loop0\n\u003e\u003e\u003e dev = '/dev/loop0'\n\n\u003e\u003e\u003e # open data partition by default\n\u003e\u003e\u003e xtaf = xb360hd.Xtaf(dev)\n\u003e\u003e\u003e xtaf\n(id: 2068792064, size: 244943675392, cluster size: 16384, fat entry: 4, fat size: 59801600,\nroot cluster: 1, volume name: Disque dur)\n\u003e\u003e\u003e xtaf.device\n(device name: /dev/loop0, serial number: 6VCT9Z2W, firmware revision: 0002CE02, model number: ST9250315AS,\nnumber of sectors: 488397168, logical size: 250059350016)\n\u003e\u003e\u003e xtaf.root\n{'name.txt': (filename: name.txt, attribute: 0, size: 22, creation date: 20051122125142,\nmodification date: 20051122125142, first cluster: 2), 'Cache': (filename: Cache, attribute: 16, size: 0,\ncreation date: 20051122125142, modification date: 20051122125142, first cluster: 3),\n'Content': (filename: Content, attribute: 16, size: 0, creation date: 20051122125642,\nmodification date: 20051122125642, first cluster: 4)}\n\u003e\u003e\u003e xtaf.fat[:16]\n[4294967288, 4294967295, 4294967295, 4294967295, 4294967295, 4294967295, 4294967295, 4294967295, 9, 10, 11,\n19, 4294967295, 4294967295, 4294967295, 16]\n\n\u003e\u003e\u003e # bad offset\n\u003e\u003e\u003e xtaf = xb360hd.Xtaf(dev, 0x118EB0001, 0x8000000)\nTraceback (most recent call last):\n  File \"\u003cstdin\u003e\", line 1, in \u003cmodule\u003e\n  File \"/tmp/xb360hd.py\", line 83, in __init__\n    if magic != b'XTAF' : raise ValueError('bad magic (0x{})'.format(hexlify(magic).decode('ascii')))\nValueError: bad magic (0x54414645)\n\n\u003e\u003e\u003e # open second sysext partition in verbose mode\n\u003e\u003e\u003e xtaf = xb360hd.Xtaf(dev, 0x118EB0000, 0x8000000, verbose = True)\nreading 92 bytes at offset 0x2000\nreading 16 bytes at offset 0x118eb0000\nreading 20480 bytes at offset 0x118eb1000\nreading cluster 1\nreading 16384 bytes at offset 0x118eb6000\n\u003e\u003e\u003e xtaf.root\n{'online': (filename: online, attribute: 16, size: 0, creation date: 20120105170952,\nmodification date: 20120105170952, first cluster: 2)}\n\n\u003e\u003e\u003e # play with online directory\n\u003e\u003e\u003e xtaf.getEntry('online')\nTraceback (most recent call last):\n  File \"\u003cstdin\u003e\", line 1, in \u003cmodule\u003e\n  File \"/tmp/xtaf/xb360hd.py\", line 194, in getEntry\n    if not pathName.startswith('/') : raise ValueError('path name must start with /')\nValueError: path name must start with /\n\u003e\u003e\u003e xtaf.getEntry('/online')\nget entry for \"/online\"\n(file name: online, attribute: 16, size: 0, creation date: 20120105170952, modification date: 20120105170952,\nfirst cluster: 2)\n\u003e\u003e\u003e xtaf.getEntry('/online').isDirectory()\nget entry for \"/online\"\nTrue\n\u003e\u003e\u003e xtaf.getDirectoryEntries(xtaf.getEntry('/online'))\nget entry for \"/online\"\nget directory entries for online\nreading cluster 2\nreading 16384 bytes at offset 0x118eba000\n{'system.online.manifest.0D1C80138EC7534F': (file name: system.online.manifest.0D1C80138EC7534F,\nattribute: 0, size: 6580, creation date: 20171121145842, modification date: 20171121145842,\nfirst cluster: 3), '20446700': (file name: 20446700, attribute: 16, size: 0,\ncreation date: 20171121145940, modification date: 20171121145940, first cluster: 4),\n'(DELETED:system.online.manifest.0CC449508B377299)': (file name:\n(DELETED:system.online.manifest.0CC449508B377299), attribute: 0, size: 0, creation date: 20161222095904,\nmodification date: 20161222095904, first cluster: 1175), '(DELETED:system.online.manifest.082EED04ABC0B778)':\n(file name: (DELETED:system.online.manifest.082EED04ABC0B778), attribute: 0, size: 0, creation date:\n20140827114954, modification date: 20140827114954, first cluster: 1151),\n'(DELETED:system.online.manifest.05675B3DBE8B7702)': (file name:\n(DELETED:system.online.manifest.05675B3DBE8B7702), attribute: 0, size: 0, creation date: 20121127181532,\nmodification date: 20121127181532, first cluster: 1454)}\n\n\u003e\u003e\u003e # play with system.online.manifest.0D1C80138EC7534F file\n\u003e\u003e\u003e xtaf.getEntry('/online/system.online.manifest.0D1C80138EC7534F').isDirectory()\nget entry for \"/online/system.online.manifest.0D1C80138EC7534F\"\nFalse\n\u003e\u003e\u003e for data in xtaf.readFile(xtaf.getEntry('/online/system.online.manifest.0D1C80138EC7534F')):\n...  print(data)\n... \nget entry for \"/online/system.online.manifest.0D1C80138EC7534F\"\nreading cluster 3\nreading 16384 bytes at offset 0x118ebe000\nb'XMNPV\\xdf\\'7.\\x1a~5\\xdd\\xfa\\x93\\xb4\\x8b\\x94\\x02\\xd1\\x85*\\x13\n…\nNewLiveSignup.xex\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpatatetom%2Fxtaf","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpatatetom%2Fxtaf","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpatatetom%2Fxtaf/lists"}