STFS
STFS (Secure Transacted File System) is the file system used by the Xbox 360 for all packages created and downloaded by the system. STFS is commonly found in Xbox 360 Content Packages (XContent), but is not limited to those only as the PEC (Profile Embedded Content) files employ STFS. The two known categories for STFS are read-only and writeable. Read-only content packages are found with a PIRS/LIVE signed header and writeable content packages are console signed (CON).
Volume Descriptor
| Offset | Length | Type | Information |
|---|---|---|---|
| 0x0 | 0x1 | byte | Reserved |
| 0x1 | 0x1 | byte | Block Seperation |
| 0x2 | 0x2 | signed short | File Table Block Count |
| 0x4 | 0x3 | signed int24 | File Table Block Number |
| 0x7 | 0x14 | bytes | Top Hash Table Hash |
| 0x1B | 0x4 | signed int | Total Allocated Block Count |
| 0x1F | 0x4 | signed int | Total Unallocated Block Count |
Directory Entries
The value at 0x37E (File Table Block Number on the XContent metadata structure) determines where the file table begins. As it is a block number, you will have to convert it to an offset. I'm not gonna write that all down atm, later.
Each embedded file starts at a 4096 (0x1000) byte boundary. The optional space between embedded files is filled with null bytes.
The file listing consists of entries which have the format below. The listing ends with an entry consisting of only null bytes.
| Offset | Length | Type | Information |
|---|---|---|---|
| 0x0 | 0x28 | ascii string | File name, null-padded |
| 0x28 | 0x1 | byte | Length of file name, plus flags |
| 0x29 | 0x3 | signed int24 | Number of blocks allocated for file (little endian) |
| 0x2C | 0x3 | signed int24 | Copy of 0x29 |
| 0x2F | 0x3 | signed int24 | Starting block number of file (little endian) |
| 0x32 | 0x2 | signed short | Path indicator (big endian) |
| 0x34 | 0x4 | unsigned int | Size of file in bytes (big endian) |
| 0x38 | 0x4 | signed int | Update date/time stamp of file |
| 0x3C | 0x4 | signed int | Access date/time stamp of file |
Byte 0x28 also has two flags: bit 6 and bit 7. The meaning of bit 6 is unknown, bit 7 indicates that the file is a directory.
The path indicator indicates the path of the file. -1 (0xFFFF) means that the file is in the root directory, any other value V refers to the (sub)directory which is listed as the Vth entry in the listing (counting from 0). Directories can nest.
The FAT format is used for the date/time stamps of the files.