To help people get started with py360 I written a simple example (simple at least compared to report360.py). gamertags.py takes an Xbox 360 disk image and prints out the gamertags of all the profiles present.
It produces output like:
Gamertag: Han Solo, Type: Gold (Paid)
Gamertag: Chewbacca, Type: Silver (Free)
The code is simple enough that I've included it below, it's also now in the git repository.
# An example of using py360 to extract all the GamerTags on a drive. # Where does this data live? # GamerTags are inside the Account block of a user STFS container # located on the XTAF partition. # How do you find user STFS containers? # Gamer profiles are located in the /Content directory in subdirectories # named with 16 hex characters starting with an 'E' such as # E00012DD5A4FAEE5. The STFS container is located in the # FFFE07D1/00010000 subdirectory and is named the same as the # profile directory. # Example: /Content/E00012DD5A4FAEE5/FFFE07D1/00010000/E00012DD5A4FAEE5 from py360 import partition, stfs, account import sys # First, open the xbox 360 image part = partition.Partition(sys.argv) # Second, find profile STFS containers for directory in part.allfiles['/Content'].files: if len(directory) == 16 and directory == 'E': # Open each STFS container and look for the Account block # The STFS class can take either an actual file or a file-like object, # we're using an file-like object to avoid having to use a temp file. path = '/Content/%s/FFFE07D1/00010000/%s' % (directory, directory) # This test is to exclude deleted profiles and defunct directories if path in part.allfiles: profile = stfs.STFS(filename = None, fd = part.open_fd(path)) # The account block is always at /Account in the STFS archive # we'll read it in, decode it and then print out the gamertag acc = account.Account(profile.read_file(profile.allfiles['/Account'])) print "Gamertag: %s, Type: %s" % (acc.get_gamertag(), acc.live_type)