Skip to content

Xbox Boot file system

Xbox Boot File System, or XBFS for short, refers to the console flash filesystem.

On Xbox Series-consoles there is also SBFS.

Filesystem sizes

Durango (pre-series-S/X):

  • RAW: 0x1_3C00_0000 (5056 MB)
  • Logical: 0x1_3B00_0000 (5040 MB)

Series S/X:

  • Logical: 0x4000_0000 (1024 MB / 1 GB)

XBFS Header offsets

The Flash can contain 3 different revisions of filetables, differentiated via its sequence number. Highest sequence number is the active one.

Checking if a filetable exists is done by checking for XBFS_HEADER->Magic.

Absolute offsets (pre-series-S/X consoles):

  • 0x1_0000 (Bootslot A)
  • 0x81_0000 (Bootslot B)
  • 0x82_0000 (Bootslot C)

Absolute offsets (Series S/X)

  • 0x0
  • 0x1800_8000

Series S/X

The Xbox Series S/X consoles have a big internal NVME drive, which has a dedicated section to hold XBFS. For some yet unknown reasons, when calculating the start offset of a file in XBFS, 0x6000 needs to be substracted to receive the correct start offset.

Possibly, when dumping the raw image, the initial 0x6000 are not being included.

Checking for file existance

Iterate through the array of XBFS_FILE_ENTRY and check if XBFS_FILE_ENTRY.Size > 0.

XBFS Structures

Byteorder: Little endian


PAGE_SIZE: 0x1000


Size: 0x400

Offset Length Type Information
0x00 0x04 uint Magic (SFBX)
0x04 0x01 byte Format Version
0x05 0x01 byte Sequence Version*
0x06 0x02 ushort Layout Version
0x08 0x08 uint64 Unknown
0x10 0x08 uint64 Unknown
0x18 0x08 uint64 Unknown
0x20 MAX_FILE_COUNT * sizeof(XBFS_FILE_ENTRY) struct XBFS_FILE_ENTRY File Entries
0x3D0 0x10 byte[] UUID
0x3E0 0x20 byte[] SHA256 Hash
  • Sequence number: Wraps around, aka 0xFF -> 0x00. 0x00 would be latest.


Size: 0x10

Offset Length Type Information
0x00 0x04 uint32 Offset (page count)
0x04 0x04 uint32 Size (page count)
0x08 0x08 uint64 Unknown

File Entries

Index Name Format Plaintext Information Per console
01 1smcbl_a.bin binary no SMC bootloader, slot A no
02 header.bin binary yes XBFS header no
03 devkit.ini binary no devkit ini unknown
04 mtedata.cfg binary no MTE data unknown
05 certkeys.bin binary yes SP/SMC Bootcap cert yes
06 smcerr.log binary no SMC error log no
07 system.xvd xvd yes SystemOS VM partition no
08 $sosrst.xvd xvd yes SystemOS restore no
09 download.xvd xvd yes Download ??? no
10 smc_s.cfg binary no SMC config - static unknown
11 sp_s.cfg binary partially SP - static (console cert) yes
12 os_s.cfg binary no OS config - static unknown
13 smc_d.cfg binary no SMC config - dynamic unknown
14 sp_d.cfg binary no SP config - dynamic unknown
15 os_d.cfg binary no OS config - dynamic unknown
16 smcfw.bin binary no SMC firmware unknown
17 boot.bin binary no Bootloaders unknown
18 host.xvd xvd yes HostOS partition no
19 settings.xvd xvd yes Settings no
20 1smcbl_b.bin binary no SMC bootloader, slot B no
21 bootanim.dat binary yes Bootanimation no
22 sostmpl.xvd xvd yes SystemOS template no
23 update.cfg binary yes Update config / log? unknown
24 sosinit.xvd xvd yes SystemOS init no
25 hwinit.cfg binary no Hardware init config unknown

Note: Only XVD header is plaintext, data portion is encrypted as usual. Per Console: Is file encrypted via console specific keys or locked to console by SocId.

Access via SRA/SystemOS

Access to the Flash from SystemOS is possible via the provided pipes:

\\.\Xvuc\FlashFs\ - Connects to the Flash's NTFS filter driver on host, providing a NTFS like environment compatible with most Win32 file APIs. Reading specific files is possible by simply appending them to the pipe path. Ex: \\.\Xvuc\FlashFs\sp_s.cfg would give you a file handle to sp_s.cfg.

\\.\Xvuc\Flash\ - Unlike the filtered pipe above, this pipe provides direct access to the flash, without any kind of file system filter. Refer above for more information.


QuantumTunnel - (.NET Core) XBFS dumping tool that runs in SystemOS to dump the XBFS from the console. It does require Administrator/NT System privileges.

xvdtool (XBFSTool) - (.NET Core)Parsing / extraction of a raw XBFS image.

xbfs-tool-(C) Parsing / extraction / injection of raw XBFS images.

Authors: tuxuser