Xbox Game Pass Support

[Aragas]

User story

As a user

I want to to be able to use a game from Xbox Game Pass PC

So that it can be modded

Requirements

I can confirm that at least Bannerlord is able to support modding on the Game Pass PC version of the game.
We're able to add new files and use custom executables that should be run instead of the originals.
This will require back support of GamePass via GameFinder, as I understand.

Design

(Any designs required for this story)

DOD

(Describe the expected behaviour from the users point of view. Create multiple DoD's if required to fully describe what should happen. Number each DoD)

Scenario 1

Given _______

When _______

Then _______

[erri120]

As I explained in the GameFinder README, I've deprecated Xbox Game Pass support, mainly because it wasn't used and modding Game Pass games wasn't really supported by anything when the service first came out.

Some interesting posts on the internet regarding modding Game Pass games:

• Advanced Installation and Management Features available for Insiders through the Xbox App for Windows
• Modding Bethesda Games on Game Pass - What we know so far and the linked Wrye Bash Wiki Entry
• ALL Game Pass Games with Official Mod Support as of 7 Jul 21
• Game Pass "Enable Mods"
• Modding on Game Pass PC Games

I'm personally not using Xbox Game Pass, so I'm curious what the modding experience is like. Games used to be installed into C:\Program Files\WindowsApps which is a protected directory that is inaccessible without changing permissions.

Can you provide more details on the modding experience? Where the game is installed, how you install mods, and which type of mods don't work for the Xbox Game Pass version?

[Aragas]

I was able to provide a custom path for the game installation.
From what I understand, the directory might be linked to the protected WindowsApps folder, not entirely sure here.
I can also confirm that other users did this too. We have guides from users that attempt to install Bannerlord mods in the GamePass game folder. Didn't see anything about the need to provide a custom install path tho!
The only quirk I found was the fact that the executable is both read and write protected. Everything else can be changed.

All types of mods work there. We have issues with the fact that they switched from .NET Framework to .NET Core, but not counting that everything works.

[erri120]

I'm not familiar with Bannerlord modding, do you use any code injection mods? Something like ReShade, ENB or some script extender which uses detours/hooks to inject custom code at runtime?

For Bethesda games (Skyrim/Fallout), these have been causing the most issues.

[Aragas]

Yep. We decided to provide our own executable as a workaround. It lacks Xbox Profile support and I'm not sure whether we can do something with adding it back. If now, we'll patch out any integration with it

[Aragas]

The game can work without code injection at start. Then the official executable is able to load custom installed mods

[TanninOne]

I haven't really concerned myself with game pass too much either but some things I've picked up, take with a grain of salt:
I don't think you can change permissions on WindowsApps usually. Afaik those directories are virtual, mounted in using a proprietary driver that only allows read access, the actual data is in an encrypted archive. For games that work this way it would be practically impossible to offer any kind of modding support.

However: Games can be released in a way that explicitly allows modding, those will be installed into a directory named "ModifiableWindowsApps", e.g. "c:\program files\modifiablewindowsapps\fallout 4 (PC)", those are, as the name implies, modifiable and modding should work mostly as usual.

Further: Not all games require mods to be installed into the game directory, mods for Sims 4 for example (which is available through game pass afaik) are installed to %USERPROFILE%\Documents\Electronic Arts so modding should be possible just fine (with the exception of reshade of course).

Vortex supports modding on a bunch of games installed through game pass, we can use that as reference for some testing.

[Sewer56]

I might aswell throw my hat in since I have some very limited experience with MSStore/GamePass [dating back to late last year].

Here's some info for installations outside of WindowsApps.

Detection

When you install a game outside of the WindowsApps directory; a .GamingRoot file is dropped to the root of each drive Xbox games can be found in

They seem to use the following structure

u8 magic[4]; // RGBX
u32 numDirectories; // I haven't verified this, might be worth double checking

for (int x = 0; x < numDirectories; x++) 
    Utf16String directory; // null terminated

Should be trivial to parse.

Read/Write Perms

For games using this system, the following seems to apply.

• Game files can be read/written/modified without any issue.

  • Game should see new files in its folder without issue either.

• No read/write perms on executable, not even for e.g. Windows Explorer

  • Even if you force your way around it, executable is encrypted.
  • This means we can't parse PE header and automate installing e.g. ReShade
  • And more importantly we can't hash it in NMA.

Runtime Quirks

Launching the game binaries will launch a stub launcher. What it does is anyone's guess. It could maybe decrypt the EXE, put it in a protected location and boot the game; or maybe it does something else; who knows.

Querying the location of the main module (EXE) from within the game will give a location like:

// Example: Persona 5 Royal, Release Version
C:\Program Files\WindowsApps\SEGAofAmericaInc.F0cb6b3aer_1.10.23.0_x64_USEU_s751p9cej88mt\P5R.exe

Regardless of where your game is installed to. This location seems to change every time the game is updated.

For some (all?) games, it's possible to dump unencrypted EXE at runtime using UWPDumper for research purposes.

What This Means

• We can't hash executable, or extract any info from it.

• ✅ Code loading based on DLL Hijacking works.

  • That is [for the unaware], dropping a stub DLL e.g. dinput8.dll that will be loaded by Windows' PE Loader.
  • But we can't automate it, since we can't parse PE header so must know DLL name for entry point in advance.
  • e.g. This is how ReShade, ASI mods and most standalone solutions of this kind operate.

• ❌ DLL Injection into suspended process does not work.

  • Because of the aforementioned stub, wrong process gets injected into.
  • e.g. Affects skse64_loader.exe, Reloaded-II [default mode]

[Aragas]

You can get access to the decrypted executable by dumping it from tools like Process Explorer or Hacker, don't rememeber which one. This way you could determine what stub dll to use for injection.
Decryption mangles it a bit, but at least for Bannerlord the executables seem to be the same for Game Pass and Steam/GOG/Epic

We could mimic this. Request a one time launch and parse the PE header to gain candidates for injection.

[Pickysaurus]

Game Detection for Xbox Game Pass https://modding.wiki/en/vortex/developer/game-detection#windows-store-xbox
(Already exists in Vortex)

[erri120]

Done in erri120/GameFinder#62

[Aragas]

Should another issue be created for the Xbox Game Pass integration within the App?

[erri120]

Should another issue be created for the Xbox Game Pass integration within the App?

Not necessary, this will be handled with a dependency update.