sylph-xexdb — the title's XEX, as a queryable database
sylph-xexdb dis <disc.iso|default.xex> --db sylpheed.db --analyze sql
tools/zq.py dis 0x82341a20 0x82341b00 # then query it
Extract the PE image, disassemble it, detect functions, resolve cross-references and RTTI, and write the lot to DuckDB.
Where it came from, and what did not come with it
This was xenia-rs — a from-scratch Rust Xbox 360 emulator, started because
Canary would not run on Linux. Canary later did, with fixes from us, and the
emulator was retired. The static analysis is the part that stayed useful, so
it came here and the emulator did not: no interpreter, no JIT, no scheduler, no
GPU, no kernel. About 17,000 lines of ~71,000.
That was possible because the coupling was three symbols — decoder::decode,
disasm::DisasmItem, disasm::format — now sylpheed-ppc.
| crate | what it is |
|---|---|
sylpheed-xex |
the XEX2 container: decrypt, LZX, PE image, resources, and the disc image it may live in |
sylpheed-ppc |
PowerPC decode and disassembly |
sylpheed-xexdb |
the analysis passes, the schema, and this binary |
⚠️ Two things that will mislead you
The database is DuckDB. xenia-rs's own --db help said "SQLite" in two
places and was wrong. Query it with python3 -c "import duckdb", or zq.py.
indirect_dispatch_candidates is deliberately not a cross product. A
bcctrl through this->vptr at offset 0 matches nearly every class, so one
site can claim 700+ callees. Sites past --max-indirect-candidates record a
truthful candidate_count with truncated set and emit no candidate rows.
On this title that is 6,556 of 6,983 sites, standing for 1,801,075 candidates
that are counted rather than materialised. An older database built without the
ceiling has ~1.8M more rows in that table and in xrefs, and they say nothing
extra.
The export table
Import names come from docs/reference/xbox360-exports.json — 2,913 ordinals,
compiled in by build.rs.
🔴 It used to come from Canary's xboxkrnl_table.inc through a relative path
to a sibling checkout, which printed a warning and produced an empty table
whenever that checkout was not there. Every import in the database then resolved
to nothing, and the build still succeeded. Now the source is in this repository
and a missing file fails the build.