Retail 5838 BIOS Size and Layout

Retail 5838 BIOS: size, memory layout and comparison

This page describes the operator-supplied xbox-5838.bin, not X3, Complex, or a patched retail derivative. It publishes original numeric measurements and public-interface relationships. Firmware bytes, private strings, recovered instructions, pseudocode, pointer-table values and reconstructed control-flow graphs remain private. No SpiritBoot implementation was derived from reference instructions.

Date: 2026-10-10. Page size: 4,096 bytes. KiB means 1,024 bytes. Ranges exclude their end. Compare Complex-BIOS-Size-and-Layout, SpiritBoot-BIOS-Size-and-Layout and Memory-Reduction-Targets.

1. Why it appears so small

The supplied ROM is 256 KiB, but its expanded kernel envelope is 625,824 bytes. Compression explains why the ROM can be smaller than the loaded image. It does not explain runtime RAM use.

The more useful split is 180,392 bytes of named non-INIT contents versus 444,626 bytes of INIT contents. The INIT boundary is at RVA 0x2c3c0 (181,184 bytes). If normal initialization discards the subsequent pages, the remaining image would occupy approximately 45 pages / 180 KiB, including headers and shared boundary content. That is a layout-derived expectation; it is not a completed retail runtime measurement.

Plain SpiritBoot main has 328,932 bytes of .text, compared with 156,912 bytes in retail 5838: a 172,020-byte / 167.988 KiB text-content difference. The separately analyzed optional ROM+pool candidate has 330,352 text bytes; it is not merged main. Both executable sections also contain data/padding; this comparison is not a certified instruction count. The conventional SpiritBoot image remains 102 pages / 408 KiB, versus the measured 45 pages / 180 KiB for the retained Complex reference. A more specialized runtime, shorter helper/framework closures and different live object/worker populations are the targets. The measurements do not prove that retail achieved this through ROM calls. Plain-main exact bodies are in SpiritBoot-Main-Emitted-Extent-Ledger, and all 332 unavailable pages are accounted for in SpiritBoot-Main-Physical-Ownership.

The retail image alone cannot tell us what must stay allocated elsewhere: stacks, caches, pool pages, page tables, allocator databases and device objects also count. Our physical walk records these mapping/content facts without pretending every owner is known.

2. Artifact and experiment identity

Item	Identity / scope
Supplied file	xbox-5838.bin, 262,144 bytes; original unchanged
Emulator	xemu 0.8.136-0-g050174b03ff6, local optional X3-ID branch; no X3 device enabled in this experiment
Guest RAM	64 MiB / 16,384 pages
Encoder	xcalibur
Boot handoff	Public fancy-mouse rev1 boot ROM at commit b4b62ed6786ea4e39a4dedf94dc340e3df584bc8
EEPROM	Separate revision-1.6 fixture generated by xemu's existing function; shared/operator EEPROM unchanged
Disk	Disposable FATX seed, with unchanged public allocation/lifetime probe as C:\xboxdash.xbe; snapshot writes
Display	Local Xvfb / software OpenGL; no performance claims from these launches
Capture	Full 64 MiB physical snapshot with CR3 0x0000f000
Capture state	Loaded kernel, incomplete pre-probe boot; not a settled title checkpoint

The public boot-ROM project documents the rev1 handoff for newer retail kernels: fancy-mouse source and description. xemu documents missing retail security/DRM compatibility: required files. These are experiment limitations, not excuses to treat an incomplete run as a successful memory census.

3. Every advertised image section

Section	Virtual start	Contents bytes	Executable flag	Writable flag	Discardable flag
.text	0x800102c0	156912	True	False	False
IDEXPRDT	0x800367c0	264	False	True	False
.data	0x800368e0	21996	False	True	False
STICKY	0x8003bee0	1220	False	True	False
INIT	0x8003c3c0	444626	True	True	True

Section contents sum to 625,018 bytes. The difference from SizeOfImage is 806 bytes of header/alignment envelope. A section flag is not a complete permission/lifetime contract: exported writable objects can reside in an executable-flag section and have writable aliases.

4. Current mapping, including the pre-probe INIT pages

Region	RAM backing pages	Unmapped pages	ROM-backed pages	Other backing
.text	39	0	0	0
IDEXPRDT	1	0	0	0
.data	6	0	0	0
STICKY	2	0	0	0
INIT	109	0	0	0
headers	1	0	0	0

Rows share boundary pages; summing their page counts double-counts shared backing. The complete image currently maps 153 unique physical pages / 612 KiB. All 109 INIT-intersecting virtual pages are still mapped at this incomplete boot capture. That is why the expected 180 KiB post-discard image cannot be substituted for observed current RAM. The header and advertised sections are RAM-backed at this epoch; this does not establish the backing of every possible late/error/reset execution path.

5. What the function walk proves

The current rooted inventory contains 638 inferred entries, including 329 distinct public callable entries, 28 nonzero public OBJECT_TYPE callback slots, and 49 installed IDT gate roots. Callback/gate counts include repeated destinations; they are not additional distinct-function counts. Seven discovery passes reach a fixed point over known direct-entry edges.

The instruction-byte union is 81,114 bytes, including 78,986 retained .text bytes and 2,128 INIT bytes. 1,196 union bytes are shared by multiple entry walks. A row's address envelope is not an exact original compiler function size. Indirect dispatch, internal callbacks, fallthrough, jump tables, tail sharing and untargeted initialization paths leave gaps. Every gap is recorded, rather than assigned a fabricated function name or marked dead.

Full list: Retail-5838-Function-Ledger. All public ordinal comparisons: Retail-5838-Public-API-Comparison.

Section	All contents bytes	Decoded instruction union	Format/public ABI data	Unclassified bytes
.text	156912	78986	2194	75732
IDEXPRDT	264	0	0	264
.data	21996	0	0	21996
STICKY	1220	0	0	1220
INIT	444626	2128	0	442498

These columns reconcile each section exactly once. The 75,732 unclassified .text bytes are neither proved dead code nor guaranteed tables. More dynamic entry discovery is needed before assigning them to routines. Public ABI footprints establish only the declared object extent, not a surrounding private allocation.

6. Walking every physical page

The audit visits all 16,384 pages, not only the image. It walks the active page directory and every reachable page table, resolves large mappings, counts aliases, and records zero/nonzero content without publishing the content. It charges unique physical pages once:

Disjoint classification at this epoch	Pages	KiB
unclassified physical RAM	16213	64852
page-table backing	18	72
kernel image backing	153	612

The 18 page-table pages are established from active CR3/PDE references. The 153 image pages are established from actual virtual-to-physical translations. The remaining 16,213 pages are explicitly unresolved allocation ownership. Direct RAM aliases can map both free and allocated memory. Zero-filled RAM can still be owned; nonzero RAM can be freed/stale. None of those predicates is an allocator census.

There are 6,364 nonzero physical pages in the snapshot. This is a content statistic, not 24.86 MiB of firmware overhead. The complete private CSV contains one row per PFN, mapping aliases, image intersections, zero status and the unresolved-owner warning. The publishable known-page atlas and complete typed-data list are in Retail-5838-Data-and-Physical-Atlas.

7. Why the public allocation probe is not yet qualified

The original EEPROM attempt stopped before IDE traffic. A separate revision-1.6 EEPROM allows storage initialization: the bounded trace records 34 IDE commands. A correctly stepped public file-open observation records:

Public request	Returned NTSTATUS	Meaning in this experiment
\Device\CdRom0\default.xbe with empty DVD	0xc0000013	No media, expected for this disk setup
\Device\Harddisk0\Partition2\xboxdash.xbe	0x00000000	The supplied public dashboard probe opens successfully

Opening the file is not running its entry point. The probe emits no BEGIN/END records yet. A bounded debugger attempt at the public PKCS1 verification export and its current dispatcher target records zero interventions; it did not bypass the remaining launch rejection. Kernel loads and storage reads therefore establish progress, not a successful guest test.

The first public file observer was discarded because it repeatedly stopped at the same breakpoint without stepping over; its repeated hits are not repeated file opens. The corrected observer disables an entry breakpoint until its recorded return, and retains returned statuses. No bogus call-frequency claim is carried into this report.

Next requirement: identify the actual XBE-launch rejection, permit only the owned public probe through a logged diagnostic handoff, require all allocation/thread API statuses and END, and then repeat the same dashboard launch route under Complex/SpiritBoot. The earlier Complex DVD-route totals remain valid at their own pinned checkpoint; they do not automatically become identical-route retail comparisons.

8. What cannot yet be concluded

• Retail total settled unavailable RAM, exact allocator/pool/thread owners and cold-vs-warm lifetime differences remain unmeasured.
• 45 pages is expected post-discard image backing; 153 pages is observed pre-probe image backing. Neither is total firmware ownership.
• Neither a small public thunk nor a large inferred routine identifies a removable compatibility service by itself.
• No function is approved for deletion because a bounded run failed to call it.
• ROM mapping, optional SpiritBoot ROM execution, compressed ROM size and resident kernel RAM are distinct mechanisms.
• This work produces a removal-investigation list. It has not changed firmware, proved game compatibility, or achieved memory parity.

Three BIOS comparison guide

Memory-Comparison-and-Removal-Guide reconciles the initial and post-activity gaps, distinguishes image from runtime backing, and lists the owner/lifetime proof needed for each saving. Memory-Three-BIOS-Public-API-Comparison places all 366 reference ordinals in one table, keeping inferred reference walks separate from exact owned compiler extents.