Commands

Commands Reference

This page documents the XeCLI command surface by workflow area. Command examples use the installed terminal command rgh.

The Example output blocks on this page are representative results from the shipped CLI. Exact spacing, colors, and secondary detail lines can vary by flags, console state, and whether JSON mode is enabled.

Find by Workflow

Use this table when you know the job you need done but not the exact command namespace yet.

Workflow	Start here
Check if the console is up	`rgh ping`, `rgh status`, `rgh title`
Find and connect to a console	`rgh start`, `rgh scan`, `rgh connect`, `rgh target`
Read or dump live memory	`rgh mem dump`, `rgh mem hexdump`, `rgh mem peek`
Change live memory	`rgh mem poke`, `rgh mem search --freeze`
Work with loaded modules	`rgh modules list`, `rgh modules info`, `rgh modules dump`, `rgh modules load`, `rgh modules unload`
Inspect threads or break execution	`rgh threads ...`, `rgh debug ...`
Pull files from the console	`rgh fs get`, `rgh ftp get`, `rgh xex dump`, `rgh screenshot`
Push files to the console	`rgh fs put`, `rgh ftp put`, `rgh save inject`, `rgh plugin enable`
Manage saves	`rgh save list`, `rgh save extract`, `rgh save inject`
Inspect or edit local CON/profile/GPD files	`rgh con ...`, `rgh profile ...`, `rgh xdbf ...`
Manage title content or DashLaunch plugins	`rgh content ...`, `rgh plugin ...`
Back up NAND or export XeLL keys	`rgh xell boot`, `rgh xell info`, `rgh xell kv export`, `rgh nand dump`
Inspect local XTAF/FATX disks or images	`rgh xtaf devices`, `rgh xtaf partitions`, `rgh xtaf scan`, `rgh xtaf info`, `rgh xtaf list`, `rgh xtaf find`, `rgh xtaf cat`, `rgh xtaf get`, `rgh xtaf extract`, `rgh xtaf dump`
Stage Original Xbox compatibility packs	`rgh ogxbox list`, `rgh ogxbox install hacked
Browse or install avatar items from the local or hosted collection	`rgh avatar library ...`, `rgh avatar games`, `rgh avatar items`, `rgh avatar choose`, `rgh avatar browse`, `rgh avatar install`
Send visible console messages	`rgh notify`, `rgh notify-icons`, `rgh jrpc2 notify`
Analyze XEX files	`rgh xex strings`, `rgh xex decompile`, `rgh xex ida-decompile`, `rgh ghidra ...`, `rgh ida ...`
Convert retail ISOs	`rgh god info`, `rgh god build`, `rgh god watch`

Command Model

XeCLI is organized into a few major namespaces:

Core commands: status, title, targeting, launch, reboot
XBDM-backed commands: modules, memory, threads, debug, screenshot, file system
JRPC2-backed commands: CPU key, temps, Title ID, dashboard, notifications, generic RPC
XeLL-backed backup commands: XeLL inspection, keyvault export, and read-only NAND backup over the XeLL HTTP service
FTP-backed commands: file access, saves, content, and plugin management
Local content commands: CON package inspection, profile editing, and raw XDBF/GPD record access
XTAF manager: local disk or image inspection, export, mutation, metadata, and repair workflows
Analysis commands: XEX, Ghidra, IDA, metadata
Packaging commands: Games on Demand conversion and watchdog mode

Shortcut equivalence:

rgh modules = rgh xbdm modules
rgh module = alias of rgh modules
rgh mem = rgh xbdm mem
rgh xex = rgh xbdm xex
rgh fs = rgh xbdm fs
rgh threads = rgh xbdm threads
rgh debug = rgh xbdm debug
rgh xtaf = primary FATX/XTAF manager for disks and images
rgh fatman = compatibility alias of rgh xtaf
rgh fatx = compatibility alias of rgh xtaf

High-traffic aliases:

rgh s = rgh start
rgh c = rgh connect
rgh discover = rgh scan
rgh shot = rgh screenshot
rgh run = rgh launch
rgh xnotify = rgh notify
rgh mem search = rgh mem find
rgh mem read = rgh mem peek
rgh mem write = rgh mem poke
rgh module remove = rgh modules unload
rgh module verify = rgh modules pending
rgh avatar apply = rgh avatar install
rgh fatman = compatibility alias of rgh xtaf
rgh fatx = compatibility alias of rgh xtaf

For the exact top-level help screen and the exact help output of every top-level command group, see CLI Help Output.

Common Options

XBDM-backed commands

Option	Description
`--ip <IP>`	Console IP. Uses the saved target if omitted.
`--port <PORT>`	XBDM TCP port. Default: `730`.
`--timeout <MS>`	Socket timeout in milliseconds.
`--json`	Emit JSON output when supported.

FTP-backed commands

Option	Description
`--ip <IP>`	Console IP. Uses the saved target if omitted.
`--port <PORT>`	FTP port. Default: `21`.
`--user <USER>`	FTP username. Default: `xboxftp`.
`--pass <PASS>`	FTP password. Default: `xboxftp`.
`--timeout <MS>`	FTP timeout in milliseconds.
`--json`	Emit JSON output when supported.

Discovery commands

Option	Description
`--ports <PORTS>`	Comma-separated TCP ports to probe. Default: `730,731`.
`--timeout <MS>`	Discovery timeout. Default: `400`.
`--no-nap`	Disable NAP broadcast discovery.
`--no-tcp`	Disable TCP scan discovery.
`--json`	Emit discovery results as JSON.

XeLL-backed commands

Option	Description
`--ip <IP>`	Console IP. Uses the saved target if omitted.
`--port <PORT>`	XBDM TCP port used while the console is still on the dashboard. Default: `730`.
`--timeout <MS>`	Socket timeout in milliseconds.
`--json`	Emit JSON output when supported.
`--force-xell`	Skip the XellLaunch shortcut path and force the direct reboot-into-XeLL path.

Notes:

XeCLI always asks for confirmation before the first automatic reboot into XeLL.
If the shell is non-interactive or XeLL cannot be launched automatically, XeCLI prints the manual eject-button fallback instead of guessing.
Once XeLL is requested, XeCLI waits up to 30 seconds for the XeLL HTTP service on port 80 and then uses the detected XeLL IP.

Core Commands

`rgh status`

Console summary view with XBDM identity, running XEX, JRPC-backed fields, drive layout, and sign-in information.

rgh status
rgh status --quick
rgh status --json
rgh status --no-drives --no-users

Notes:

--quick skips slower JRPC, drive, and sign-in probes.
Skipped fields are rendered as skipped instead of unknown.
When a pending module load or unload is being tracked across a reboot, status can surface that state.

Example output:

Status
IP               192.168.1.186
Execution State  start
Title ID         0xFFFE07D1
Title Name       Aurora
Signed In        Yes
Gamertag         ExampleUser

`rgh profiles`

Enumerates sign-in and profile information gathered from XBDM, JRPC/XAM, FTP, and F3 when available.

rgh profiles
rgh profiles --json
rgh profiles --no-ftp
rgh profiles --no-f3

Example output:

Signed-In Users
User 0   ExampleUser   state=SignedInToLive   xuid=0x<xuid>

Profiles (FTP)
72 profile containers found across Hdd1 and Usb devices

`rgh title`

Resolve the active title or look up a specific Title ID from the bundled database.

rgh title
rgh title --json
rgh title 415608C3
rgh title 415608C3 2B7302D6
rgh title active

Example output:

Active Title
Title ID     0xFFFE07D1
Title Name   Aurora
Media ID     unknown
Source       running xex path + bundled database

`rgh target`

Show, set, or clear the saved default XBDM target.

rgh target
rgh target --set <console-ip>
rgh target --set <console-ip> --port 730
rgh target --clear

Example output:

Default target
IP      192.168.1.186
Port    730

`rgh ping`

Fast XBDM connectivity check.

rgh ping

Example output:

OK 21 ms

`rgh reboot`

Cold reboot or title reboot.

rgh reboot
rgh reboot --title
rgh reboot --notify

Example output:

SUCCESS Reboot requested
cold reboot command sent to console

`rgh shutdown`

Power off the console through the JRPC power path.

rgh shutdown
rgh shutdown --notify

Example output:

SUCCESS Shutdown requested
power-off command sent to console

`rgh launch`

Launch a XEX with optional directory, arguments, title hint, and notification.

rgh launch Hdd1:\Aurora\Aurora.xex
rgh launch Hdd1:\Aurora\Aurora.xex --titleid FFFE07D1
rgh launch --xex Hdd1:\Aurora\Aurora.xex --args "debug=1"
rgh launch --xex Hdd1:\Aurora\Aurora.xex --dry-run

Example output:

SUCCESS Launch requested
Hdd1:\Aurora\Aurora.xex
Target title: Aurora (0xFFFE07D1)
Arguments: debug=1

`rgh language`

rgh language shows or changes the saved UI language XeCLI uses when no --lang override or XECLI_LANG environment variable is supplied.

rgh language
rgh language --set es
rgh language --set en
rgh language --clear

Example output:

Field               Value
Saved UI language   Español (es)
Effective language  Español (es)
CLI override        Use --lang en|es for one command

For Windows installation and PATH registration, use the published setup executable. rgh language is only for the saved CLI language preference.

`rgh homebrew install`

Download one or more public homebrew packages onto a USB drive, staging folder, or detected console drive.

rgh homebrew list
rgh homebrew install aurora --usb E:
rgh homebrew install all --usb E: --auto-confirm
rgh homebrew install aurora --device Hdd1 --ini-mode merge
rgh homebrew install all --device Hdd1 --ini-mode generated --auto-confirm
rgh homebrew install dashlaunch --usb A:\UsbStage --force-download
rgh homebrew install xm360 --usb E:
rgh homebrew install timefixer --usb E:
rgh homebrew install simple360 --usb E:
rgh homebrew install xelllaunch --usb E:

Example output:

SUCCESS Homebrew install complete
4 package(s) 326 MB -> E:\

Package            Installed To         Files   Size
Aurora 0.7b.2      E:\Aurora            167     38.69 MB
DashLaunch 3.21    E:\DashLaunch          8      2.52 MB
XeXMenu 1.2        E:\XeXMenu             1    203.37 MB
Freestyle Dash 3   E:\FreestyleDash      26     81.43 MB

Generated E:\launch.ini
Copied bundled console plugins into E:\Plugins

The current package catalog also includes XM360, TimeFixer, Simple 360 NAND Flasher, and XellLaunch.

Native read-only backup flows no longer depend on Simple 360 NAND Flasher. Use rgh xell ... and rgh nand dump when you want XeLL inspection, keyvault export, or a verified NAND backup directly from XeCLI.

Console install example output:

SUCCESS Console homebrew install complete
1 package(s) 2.52 MB -> Hdd1 on 192.168.1.186

Package            Console Path       Files   Size
DashLaunch 3.21    /Hdd1/DashLaunch   8       2.52 MB

Bundled plugins copied to /Hdd1/Plugins
Updated existing launch.ini plugin entries /Hdd1/launch.ini

Important options:

--usb <TARGET> accepts a drive letter, removable-drive selection number, or folder path
omit --usb to install directly onto the console through FTP
--device <DEVICE> targets a detected console drive such as Hdd1, Usb0, Usb1, or Usb2
--ini-mode <generated|merge|skip> chooses whether XeCLI creates a fresh launch.ini, updates plugin entries in the existing file, or leaves it alone
--ini <PATH> overrides the console-side launch.ini path when using direct console install
--cache <DIR> moves archive and staging storage to a different directory
--force-download refreshes cached archives
--auto-confirm skips the confirmation prompt before staging or direct console install
--json emits machine-readable package install output

`rgh ogxbox install`

Stage or install one of the public Original Xbox XeFu compatibility sets.

rgh ogxbox list
rgh ogxbox install hacked --usb E:
rgh ogxbox install hud --include-fixer --usb E:
rgh ogxbox install retail

Set choices:

hacked
- best default choice for modded consoles
- removes stock whitelist/restriction checks and targets wider compatibility
hud
- same hacked base, but keeps the full Xbox 360 guide enabled during original Xbox titles
- can cost performance or compatibility in some games
retail
- stock-style emulator files
- closest to the original Microsoft behavior

Example output:

SUCCESS Original Xbox compatibility install complete
Hacked XeFu Pack -> /HddX/Compatibility

Field                Value
Mode                 console
XeFu Set             Hacked XeFu Pack
Target               192.168.1.186
Compatibility Path   /HddX/Compatibility
Compatibility Files  Installed
Fixer Included       No
Files                23
Size                 31.42 MB

Important options:

--usb <TARGET> stages to a removable USB drive or folder instead of installing directly to the console
omit --usb to connect over FTP and target HddX:\Compatibility
--include-fixer also stages or installs HDD Compatibility Partition Fixer so you can create HddX on drives that do not have it yet
--cache <DIR> moves archive and staging storage to a different directory
--force-download refreshes cached archives
--auto-confirm skips the confirmation prompt
--json emits machine-readable install output

If HddX is missing and --include-fixer is not used, XeCLI stops before writing anything and tells you to rerun with the fixer included.

XeLL and Backup Commands

These commands use XeLL Reloaded's HTTP services for read-only backup operations. XeCLI supports both older endpoint layouts such as /rawflash and the current XeLL Reloaded layout such as /FLASH, /FUSE, /KV, /KVRAW, /KVRAW2, /LOG, and /REBOOT.

`rgh xell boot`

Detect the current mode, prompt before the first dashboard-to-XeLL reboot, and attach to the XeLL web service when it comes up.

rgh xell boot
rgh xell boot --force-xell
rgh xell boot --json

Notes:

If the console is already in XeLL, the command reuses the active XeLL session.
If the console is on the dashboard, XeCLI asks before launching XeLL automatically.
If auto-launch is unavailable, XeCLI tells you to boot XeLL manually with eject and rerun the command.
The standalone XeCLI-XellFetch repo can be used as the minimal XeLL-side bootstrap when you want the automated NAND flow without the broader desktop bundle. See XeCLI-XellFetch for the payload model and workflow boundaries.

Example output:

SUCCESS XeLL ready
XeLL IP: 192.168.88.99

`rgh xell info`

Inspect the XeLL HTTP service and show which backup-related endpoints are currently exposed.

rgh xell info
rgh xell info --force-xell
rgh xell info --json

Example output:

Field           Value
XeLL IP         192.168.88.99
Flash Dump      /FLASH
Key Vault       /KV
Raw Key Vault   /KVRAW
CPU Key         E64E0C1D4E2D...
CPU Key Source  /FUSE
Startup Log     /LOG
Fuse Dump       available
Reboot          /REBOOT

`rgh xell kv export`

Export the XeLL keyvault output, capture the CPU key, and package a verified backup set.

rgh xell kv export
rgh xell kv export --output kv_backup.bin
rgh xell kv export --raw

Notes:

Default mode downloads the decrypted keyvault from /KV. --raw switches to /KVRAW or /KVRAW2.
The export requires a CPU key. If XeLL does not expose one, XeCLI fails rather than producing an incomplete set.
Host output includes your chosen KV filename, KV+CPU KEY.txt, a sibling *.CPUKEY.txt, optional *.fuses.txt, *.sha256.txt, and a .zip.
The archive is normalized to stable names such as KV.bin or KV_RAW.bin, CPUKEY.txt, KV+CPU KEY.txt, fuses.txt, and manifest.sha256.txt.

Example output:

SUCCESS Keyvault export complete
KV: A:\Backups\kv_backup.bin
CPU key: A:\Backups\kv_backup.CPUKEY.txt
Combined text: A:\Backups\KV+CPU KEY.txt
Archive: A:\Backups\kv_backup.zip
Manifest: A:\Backups\kv_backup.sha256.txt

`rgh nand dump`

Boot XeLL Reloaded, download a flash dump, verify repeated reads, and package the result as a safe backup set.

rgh nand dump
rgh nand dump --single
rgh nand dump --output nand_backup.bin
rgh nand dump --force-xell

Notes:

This workflow is read-only. XeCLI never writes to NAND.
In v1.0.6 this is the single PC-side entry point for the automated NAND dump flow.
rgh nand dump takes the first dump, reboots back into XeLL, and compares the next dump byte-for-byte against the reference.
If the verification dump differs, XeCLI retries the second dump up to three more times before failing hard with "Do not flash these files."
After the bytes match, XeCLI verifies the copied output file, writes a SHA-256 manifest, builds a zip, and re-verifies every archive entry against the source files.
Host output includes the NAND image, optional *.cpukey.txt, optional *.startup-log.txt, *.sha256.txt, and a verified .zip.
--single and --no-verify skip the repeated-dump loop, but the archive and manifest are still verified.
XeCLI stages the helper/linker assets required by the automated workflow so the operator does not have to assemble them manually.

Example output:

SUCCESS NAND dump verified
NAND: A:\Backups\nand_backup_20260323_024501.bin
Archive: A:\Backups\nand_backup_20260323_024501.zip
Manifest: A:\Backups\nand_backup_20260323_024501.sha256.txt
CPU key: A:\Backups\nand_backup_20260323_024501.cpukey.txt
NAND verified — safe to flash
Archive and manifest verified.

Fatman

Fatman is XeCLI's read-only FATX manager for local Xbox 360 disks and images. The current release cut focuses on image recovery, partition dumping, inspection, search, and export, not on write, mount, format, or repair operations.

Current command surface

rgh fatman devices
rgh fatman partitions
rgh fatman scan
rgh fatman info
rgh fatman list
rgh fatman find
rgh fatman cat
rgh fatman get
rgh fatman extract
rgh fatman dump

Manual open by offset

use --offset to open a FATX/XTAF volume directly from a byte offset
use --length with --offset when you want to clamp the manual partition size
both values accept decimal bytes or 0x-prefixed hex
use rgh fatman scan first when you need candidate offsets for a nonstandard image

rgh fatman scan --image .\Unknown.img
rgh fatman info --image .\Unknown.img --offset 0xB6600000
rgh fatman list --image .\Unknown.img --offset 0xB6600000 --path /
rgh fatman dump --image .\Unknown.img --offset 0xB6600000 --length 0x10000000 --out .\partition-dump

What it will do

detect FATX-capable disks or image sources
inspect partitions and volume details
browse directories and locate entries
search by name or path
recover data from .img and .bin sources
print small files in the terminal
dump partitions to a host directory
export selected files or directory trees to the host

Validation note

the runtime has been verified against a synthetic FATX fixture image
manual-open and scan flows were also validated against a nonstandard AMPED HDD image, where Fatman surfaced real XTAF offsets and opened the compatibility volume by bounded offset

What it does not do in the first cut

write files back to FATX volumes
format or repartition disks
mount a virtual filesystem
repair damaged volumes
modify security sectors or low-level disk metadata

Example output

Fatman Sources
0  Disk 0  932.51 GB  Xbox 360 HDD
1  Disk 1   32.00 GB  USB Flash Drive

Selected source: Disk 0 / Hdd1
Partitions:
Hdd1  419.41 GB  FATX
HddX    1.00 GB  FATX

Discovery Commands

`rgh start`

rgh start is the manual version of the discovery flow that the installer can launch immediately after setup.

rgh start
rgh start --json

Example output:

Detected Consoles
#1  192.168.1.186  Jtag  0037XXXXXXXX190
Default target updated to 192.168.1.186

`rgh connect`

rgh connect is the manual follow-up when you already know the discovery result you want to target.

rgh connect 1
rgh connect <console-ip>

Example output:

SUCCESS Target updated
192.168.1.186:730

`rgh scan`

rgh scan is the discovery-only path. The installer uses a quieter variant of this flow after setup and only prompts when a console is found.

rgh scan
rgh scan --json

Example output:

Detected Consoles
#1  192.168.1.186  Jtag  0037XXXXXXXX190  tcp+nap

Screenshot Commands

`rgh screenshot`

rgh screenshot --out .\screen.bmp
rgh screenshot --out .\screen.bmp --force

The command emits decoded frame-buffer metadata after a successful capture.

Example output:

SUCCESS Screenshot captured
1024x576  pitch=4096  format=0x00000012
.\screen.bmp

XBDM Root Commands

`rgh xbdm info`

rgh xbdm info
rgh xbdm info --json

Example output:

XBDM Info
Debug Name    Jtag
DM Version    2.0.21076.11
Flavor        Natelx did, of course

`rgh xbdm raw`

rgh xbdm raw --cmd "modules"
rgh xbdm raw --cmd "dirlist name=Hdd:\\"

Example output:

(202) multiline response follows
name="xam.xex" base=0x82000000 size=0x001C0000
name="Aurora.xex" base=0x90F00000 size=0x00480000

`rgh xbdm screenshot`

rgh xbdm screenshot --out .\screen.bmp

Example output:

SUCCESS Screenshot captured
.\screen.bmp

Module Commands

`rgh modules list`

rgh modules list
rgh modules list --json
rgh modules list --sections

Example output:

Modules
xboxkrnl.exe   0x80010000   0x005A0000
xam.xex        0x82000000   0x001C0000
Aurora.xex     0x90F00000   0x00480000

`rgh modules info`

rgh modules info --name Aurora.xex
rgh modules info --name xam.xex --sections

Example output:

Module Info
Name         Aurora.xex
Base         0x90F00000
Size         0x00480000
Path         \Device\Harddisk0\Partition1\Aurora\Aurora.xex

`rgh modules dump`

rgh modules dump --name xam.xex --out .\xam.bin
rgh modules dump --all --dir .\modules

Example output:

SUCCESS Module dump complete
xam.xex -> .\xam.bin

`rgh modules load`

rgh modules load --path Hdd:\HvP2.xex
rgh modules load --path Hdd:\HvP2.xex --system
rgh modules load --path Hdd:\HvP2.xex --system --reboot-expected
rgh modules load --path Hdd:\HvP2.xex --dry-run

Important options:

--flags <N> kernel load flags, default 8
--system runs the load on a system thread instead of the default title thread
--reboot-expected persists pending verification if the console disconnects as part of the load
--notify sends the default console success notification

Example output:

SUCCESS Module loaded
HvP2.xex at 0x91340000

`rgh modules unload`

rgh modules unload --name HvP2.xex --force
rgh modules unload --handle 0x91340000 --force
rgh modules unload --name HvP2.xex --force --notify

Important options:

--force is required
--skip-mark disables the sysdll unload marker write at handle+0x40
--dry-run resolves the target without modifying memory

Example output:

SUCCESS Module unloaded
0x91340000 HvP2.xex

`rgh modules pending`

rgh modules pending

Use this after:

rgh modules load --path Hdd:\HvP2.xex --system --reboot-expected

Example output:

SUCCESS Pending module load verified
HvP2.xex at 0x91340000

Memory Commands

`rgh mem dump`

rgh mem dump --addr 0x82000000 --size 0x20000 --out .\mem.bin

Example output:

SUCCESS Memory dump complete
0x82000000 length=0x00020000 -> .\mem.bin

`rgh mem hexdump`

rgh mem hexdump --addr 0x30000000 --size 0x40

Example output:

0x30000000 DE AD BE EF 01 02 03 04 05 06 07 08 09 0A 0B 0C  ................
0x30000010 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F  ................

`rgh mem regions`

rgh mem regions
rgh mem regions --json

Example output:

Memory Regions
0x80000000  0x02000000  protect=0x00000020
0x82000000  0x01000000  protect=0x00000004

`rgh mem peek`

rgh mem peek --addr 0x82000000 --type u32
rgh mem peek --addr 0x82000000 --type ascii --len 32

Example output:

0x82000000 = 0x12345678 (u32)

`rgh mem poke`

rgh mem poke --addr 0x82000000 --type u32 --value 0x12345678
rgh mem poke --addr 0x82000000 --type float --value 1337
rgh mem poke --addr 0x82000000 --type string --value "XeCLI"

Type aliases include:

u8, u16, u32, u64
s8, s16, s32, s64
f32, f64
byte, int, uint, float
ascii, string, hex, bytes

Example output:

SUCCESS Memory write complete
0x82000000 <= 0x12345678 (u32)

`rgh mem watch`

rgh mem watch --addr 0x82000000 --size 0x40
rgh mem watch --addr 0x82000000 --size 0x40 --interval 100 --count 10

Example output:

watch 1  0x82000000  78 56 34 12 ...
watch 2  0x82000000  79 56 34 12 ...

`rgh mem strings`

rgh mem strings --addr 0x82000000 --size 0x20000 --min 6
rgh mem strings --addr 0x82000000 --size 0x20000 --json

Example output:

0x82014020  ascii    xam.xex
0x82014210  ascii    XeKeysExecute

`rgh mem search`

Alias of rgh mem find.

rgh mem search --addr 0x30000000 --size 0x1000 --pattern DEADBEEF
rgh mem search --addr 0x82000000 --size 0x20000 --ascii "xam.xex"
rgh mem search --addr 0x82000000 --size 0x20000 --pattern 00000000 --out .\hits.json

Freeze options:

rgh mem search --addr 0x82000000 --size 0x20000 --pattern 00000000 --freeze --freeze-type u32 --freeze-value 305419896
rgh mem search --addr 0x82000000 --size 0x20000 --pattern 00000000 --freeze --freeze-all --freeze-count 5

Example output:

Hits
0x82000120
0x820004A8
0x820019F0

XEX Commands

`rgh xex dump`

rgh xex dump --out .\title.xex
rgh xex dump --path Hdd1:\Aurora\Aurora.xex --out .\aurora.xex

Example output:

SUCCESS XEX dump complete
\Device\Harddisk0\Partition1\Aurora\Aurora.xex -> .\aurora.xex

`rgh xex strings`

rgh xex strings --running --unicode --min 6
rgh xex strings --ftp-path /Hdd1/Aurora/Aurora.xex --out .\strings.txt
rgh xex strings --in .\title.xex --json

Example output:

XEX Strings
0x00000000  ascii    XEX2
0x0005B8A0  utf16le  Aurora

`rgh xex decompile`

rgh xex decompile --in .\title.xex --out .\decomp
rgh xex decompile --running --out .\decomp --max 200

Example output:

SUCCESS Ghidra decompile complete
200 function files written to .\decomp

File-System Commands

XBDM-backed

rgh fs list --path Hdd:\
rgh fs get --path Hdd:\launch.ini --out .\launch.ini
rgh fs put --path Hdd:\launch.ini --in .\launch.ini
rgh fs cat --path Hdd:\launch.ini
rgh fs rm --path Hdd:\temp\old.txt
rgh fs mkdir --path Hdd:\temp\newdir
rgh fs mv --from Hdd:\old.txt --to Hdd:\new.txt

Example output:

Directory
Aurora           Dir
launch.ini       File   12794

FTP-backed

Target management:

rgh ftp target
rgh ftp target --set <console-ip> --user <ftp-user> --pass <ftp-pass>
rgh ftp target --clear

rgh ftp list --path /Hdd1/
rgh ftp find --path /Hdd1/ --name *.xex
rgh ftp get --path /Hdd1/launch.ini --out .\launch.ini
rgh ftp put --path /Hdd1/launch.ini --in .\launch.ini
rgh ftp cat --path /Hdd1/launch.ini
rgh ftp rm --path /Hdd1/temp/old.txt
rgh ftp mkdir --path /Hdd1/newdir
rgh ftp mv --from /Hdd1/old.txt --to /Hdd1/new.txt

Example output:

SUCCESS FTP upload complete
.\launch.ini -> /Hdd1/launch.ini (12.49 KB)

Thread and Debug Commands

Threads

rgh threads list
rgh threads context --id 0xFB000008
rgh threads suspend --id 0xFB000008
rgh threads resume --id 0xFB000008

Example output:

Threads
#  ID         Image         Start Addr.  End Addr.    Stack Base  Stack Limit
1  0xFB000008 xboxkrnl.exe  0x8012E3C0   0x801F0000   0x7A020000  0x7A010000
2  0xF9000004 Aurora.xex    0x82458C90   0x82BF0000   0x700A0000  0x70060000

threads list now resolves the thread start routine address and, when that address lands inside a loaded image, also shows the containing image name and end boundary. End Addr. is the containing image end boundary, not a recovered function end.

rgh threads list --json includes ImageName, StartAddress, and EndAddress for the same reason.

Debug control

rgh debug stop
rgh debug go
rgh debug watch

Example output:

execution stopped
execution started

Breakpoints

rgh debug break add --addr 0x82001000
rgh debug break remove --addr 0x82001000
rgh debug break clearall

Example output:

SUCCESS Breakpoint added
0x82001000

Data breakpoints

rgh debug databreak add --addr 0x82100000 --size 4 --type write
rgh debug databreak remove --addr 0x82100000 --size 4 --type write

Example output:

SUCCESS Data breakpoint added
addr=0x82100000 size=4 type=write

JRPC2 Commands

rgh jrpc2 cpu-key
rgh jrpc2 temps
rgh jrpc2 temps --sensor gpu
rgh jrpc2 title-id
rgh jrpc2 dashboard
rgh jrpc2 motherboard
rgh jrpc2 resolve --module xam.xex --ordinal 526
rgh jrpc2 notify --message "XeCLI"
rgh jrpc2 call --module xam.xex --ordinal 526 --ret int --arg int:0

Example output:

CPU Key     587AC7...
Dashboard   17559
Motherboard Trinity

Notification Commands

rgh notify "Success :)"
rgh notify "XeCLI connected" 14
rgh notify --message "XeCLI connected" --icon info
rgh notify-icons list
rgh notify-icons show 14
rgh notify-icons add --name success --logo 0x24
rgh notify-icons remove --name success

For the full XNotify explanation, icon IDs, direct numeric usage, and integration notes, see XNotify.

Example output:

SUCCESS Notification sent
message="XeCLI connected" logo=14 (Flashing happy face)

`rgh notify-icons show`

rgh notify-icons show 14
rgh notify-icons show success
rgh notify-icons show achievement

Example output:

Input     14
Logo ID   14
Label     Flashing happy face
Notes     Common success/smiley icon

Hardware and Session Commands

`rgh signin state`

rgh signin state
rgh signin state --json

Example output:

Signed In   Yes
State       Signed in locally
Gamertag    ExampleUser
XUID        0x<xuid>
Slot        0

`rgh led set`

rgh led set --preset quadrant1
rgh led set --preset all-green --notify
rgh led set --tl green --tr off --bl off --br off

Example output:

SUCCESS Ring light updated
TL=green, TR=off, BL=off, BR=off

`rgh led state`

rgh led state
rgh led state --json

Example output:

Source        Last XeCLI-applied ring-light state
Preset        quadrant1
Top Left      green
Top Right     off
Bottom Left   off
Bottom Right  off

`rgh fan set`

rgh fan set --speed 55 --channel both
rgh fan set --speed 45 --channel primary
rgh fan set --speed 60 --channel secondary --notify

Example output:

SUCCESS Fan command sent
50% requested for both

`rgh fan show`

rgh fan show
rgh fan show --json

Example output:

Source   Last XeCLI-applied manual setting
Speed    50%
Channel  both

`rgh smc version`

rgh smc version
rgh smc version --json

Example output:

SUCCESS SMC version
2.3

Read Hardware and System Controls for the deeper operational notes around sign-in state, LED presets, fan command behavior, and SMC version availability.

`rgh tray open` / `rgh tray close`

Open or close the physical disc tray through the JRPC/XAM path.

rgh tray open
rgh tray close

Example output:

SUCCESS Disc tray opened

SUCCESS Disc tray closed

`rgh popup show`

Show a native Xbox 360 popup. This is the trainer-style popup path, not a standard XNotify toast.

rgh popup show --title "XeCLI" --body "Connected to console"
rgh popup show --title "Warning" --body "Module reload required" --preset warning
rgh popup show --title "Question" --body "Continue?" --preset question
rgh popup show --title "Raw Style" --body "Testing" --style 3

Preset values:

none
error
warning
question

Example output:

SUCCESS Popup requested
Title="XeCLI" Preset=warning Buttons=1

`rgh spoof gt`

Reads or writes the current in-game gamertag for supported titles. gamertag and name remain compatibility aliases, but gt is the canonical command group.

Spoof confirmation notifications use the bottom position by default when --notify is supplied. The command also caches the original gamertag/XUID for the current target and title the first time you spoof, so rgh spoof reset can restore it later even if the signed-in user is no longer resolvable.

For BO2, this is the supported local spoof path. XeCLI keeps the visible name, the local XUID surfaces, and the deeper local account block aligned during a gamertag-only spoof.

rgh spoof gt
rgh spoof gt ExampleTag
rgh spoof gt set --value ExampleTag --notify
rgh spoof gamertag ExampleTag

Example output:

Game            Call of Duty: Black Ops II
Gamertag        ExampleTag
Address         0x841E1B30

Write example:

SUCCESS Gamertag spoof applied
XeCliTmp

`rgh spoof xuid`

Reads or writes the current in-game XUID for supported titles.

Spoof confirmation notifications use the bottom position by default when --notify is supplied. The original local identity is cached per target and title before the spoof is applied.

rgh spoof xuid
rgh spoof xuid <xuid>
rgh spoof xuid set --value <xuid>

Example output:

Game            Call of Duty: Black Ops II
XUID            <xuid>
Stored          <stored-xuid>
Binary Addr     0x841E1B50
Text Addr       0x841E1B58

BO2 notes:

rgh spoof xuid show and rgh spoof xuid set are supported on BO2
run them after BO2 has reached the multiplayer front-end or a live lobby
XeCLI updates the visible local XUID surfaces plus the known BO2 account/persona caches
this remains an in-title memory spoof, not a real signed-in Xbox Live account swap or entitlement change

`rgh spoof remote`

Overwrites remote-player text slots for supported titles. The simple positional form applies the same text to every supported slot in the current title. This does not change the local in-game gamertag block.

Remote spoof confirmations also use the bottom position by default when --notify is supplied. If you later run rgh spoof reset, XeCLI will prefer the cached pre-spoof local identity for the same target/title when no explicit override is supplied.

BO2's verified remote layout is exposed as slots 2-12 because the first title-local slot is reserved.

Full feature notes, supported titles, and workflow examples are covered in Remote Spoofing.

rgh spoof remote XeCliRemote
rgh spoof remote list
rgh spoof remote apply --slot 1 --text HostName
rgh spoof remote apply --all --text XeCLI-{slot}

Example output:

SUCCESS Remote spoof applied
Call of Duty: Black Ops II => XeCliRemote

Slot  Verified       Address
2     XeCliRemote    0x841E7334
...
12    XeCliRemote    0x8421E2E4

`rgh spoof reset`

Restores the in-game identity from the signed-in user or explicit values. Use --clear-remote if you also want to clear supported remote slot names.

If no explicit --gamertag or --xuid is provided, XeCLI first tries the cached pre-spoof identity for the same target/title, then falls back to the currently signed-in user when available.

On BO2, reset is the supported path for restoring the local GT spoof state and optionally clearing the remote slots. It is not documented as a full BO2 account handoff, and on the live validation box it handed the session back out to Aurora after restoring the identity.

rgh spoof reset --current-user
rgh spoof reset --gamertag <gamertag> --xuid <xuid>
rgh spoof reset --current-user --clear-remote

Example output:

SUCCESS Spoof reset applied
Local identity restored and remote slots cleared

Save Commands

`rgh save list`

rgh save list --titleid FFFE07D1 --device Hdd1
rgh save list --titleid 415608C3 --profile E00012AA8D7879B4

Example output:

Save Files
/Hdd1/Content/E00012AA8D7879B4/415608C3/00010000/savegame.svg

`rgh save extract`

rgh save extract --titleid 415608C3 --out .\saves
rgh save extract --titleid 415608C3 --profile E00012AA8D7879B4 --device Hdd1 --overwrite

Example output:

SUCCESS Save extract complete
3 file(s)  8.2 MB -> .\saves\Grand Theft Auto V (0x415608C3)

`rgh save inject`

rgh save inject --titleid 415608C3 --in .\saves --device Hdd1
rgh save inject --titleid 415608C3 --profile E00012AA8D7879B4 --in .\save.bin --overwrite

Example output:

SUCCESS Save inject complete
1 file(s)  128 KB -> /Hdd1/Content/E00012AA8D7879B4/415608C3

Content Commands

`rgh content list`

rgh content list
rgh content list --device Hdd1 --show-types
rgh content list --titleid 415608C3

Example output:

Installed Content
415608C3  Grand Theft Auto V  Game
415608C3  Grand Theft Auto V  Title Update

`rgh content delete`

rgh content delete --titleid 415608C3 --type "Title Update"

Treat delete operations as destructive.

Example output:

SUCCESS Content delete complete
Title Update for 0x415608C3 removed

Local Content Commands

These commands operate on local files on the PC, not live console memory. A typical workflow is:

Use rgh profiles --json or rgh content list to locate the container on the console.
Pull it locally with rgh ftp get or rgh fs get.
Inspect or edit it with rgh con, rgh profile, and rgh xdbf.
Validate the result with rgh con verify before copying it back anywhere else.

For profile packages, XeCLI writes changes back into the local container, refreshes STFS hashes, and preserves a valid CON signature when the package is a console-signed profile.

`rgh con`

Use con for package-level metadata, verification, rehash, resign, and FATX-path derivation.

rgh con info .\E00012AA8D7879B4.con
rgh con verify .\E00012AA8D7879B4.con
rgh con rehash .\E00012AA8D7879B4.con
rgh con resign .\E00012AA8D7879B4-copy.con
rgh con magic-name .\E00012AA8D7879B4.con
rgh con fatx-path .\E00012AA8D7879B4.con --fix-name

Example output:

Path             .\E00012AA8D7879B4.con
Signature Type   Console
Content Type     Profile
STFS             valid
FATX Path        Content\E00012AA8D7879B4\FFFE07D1\00010000\E00012AA8D7879B4

`rgh profile`

Use profile for decoded profile/package workflows: package summary, account extraction, embedded GPD extraction, title records, achievements, settings, and avatar colors.

rgh profiles and rgh profile are different:

rgh profiles discovers live console profiles over XBDM/JRPC/FTP/F3
rgh profile works on one local pulled profile container such as E000xxxxxxxxxxxx.con

rgh profile info .\E00012AA8D7879B4.con
rgh profile extract .\E00012AA8D7879B4.con .\profile-files
rgh profile account show .\E00012AA8D7879B4.con
rgh profile account extract .\E00012AA8D7879B4.con .\Account
rgh profile account set-gamertag .\E00012AA8D7879B4.con XeCliTest
rgh profile gpd list .\E00012AA8D7879B4.con
rgh profile gpd extract .\E00012AA8D7879B4.con .\FFFE07D1.gpd --dashboard
rgh profile gpd extract .\E00012AA8D7879B4.con .\415607E7.gpd --titleid 415607E7
rgh profile titles list .\E00012AA8D7879B4.con
rgh profile achievements list .\E00012AA8D7879B4.con --titleid 415607E7
rgh profile achievements unlock .\E00012AA8D7879B4.con --titleid 415607E7 --achievementid 0x00000004
rgh profile achievements lock .\E00012AA8D7879B4.con --titleid 415607E7 --achievementid 0x00000004
rgh profile settings list .\E00012AA8D7879B4.con
rgh profile settings get .\E00012AA8D7879B4.con 0x10040006
rgh profile settings set .\E00012AA8D7879B4.con 0x10040006 1337
rgh profile avatar-colors get .\E00012AA8D7879B4.con
rgh profile avatar-colors set .\E00012AA8D7879B4.con --hair 0xFF112233 --face-paint 0xFF556677

Notes:

profile account extract exports the raw Account payload without needing a full package extract.
profile gpd list surfaces the dashboard GPD plus each embedded title GPD found in the container.
profile gpd extract is the targeted path when you only want FFFE07D1.gpd or one game GPD.
profile settings set can update existing records or create missing records when --type is supplied.
profile avatar-colors edits the dashboard avatar blob stored in setting 0x63E80044.
Mutating commands are safest on a disposable copy until you are comfortable with the exact workflow.

Example output:

Profile Package
Profile ID      0xE00003608D3F513F
Signature       Console
Gamertag        ExampleUser
Dashboard GPD   present
Account         present
Titles          3
Gamerscore      50

`rgh xdbf`

Use xdbf when you want raw record-level access to a pulled *.gpd or other XDBF-backed file.

rgh xdbf list .\FFFE07D1.gpd --show-sync
rgh xdbf get .\FFFE07D1.gpd settings 0x0000000010040006
rgh xdbf get .\FFFE07D1.gpd settings 0x0000000010040006 --out .\gamerscore-setting.bin
rgh xdbf extract .\415607E7.gpd .\records
rgh xdbf sync-status .\415607E7.gpd

Notes:

--origin profile|pec controls how sync records are interpreted for profile-backed versus PEC-backed files.
--show-sync and sync-status are useful when you need to understand which records are dirty before or after a profile edit.
xdbf is the low-level inspection path; prefer profile ... when XeCLI already exposes a higher-level decoded command.

Example output:

XDBF Records
Namespace    Settings (0x0003)
ID           0x0000000010040006
Size         24
Offset       0x0000091C
Pending      yes

Avatar Commands

The avatar surface now has three operator paths:

rgh avatar choose for a terminal picker
rgh avatar browse for a Windows picker
rgh avatar install for direct one-item or full-title installs

All three use the same local or hosted Avatar-Item-Collection index, ownership patching, caching, and upload pipeline.

Validated behavior:

rgh avatar install patches ownership for the target XUID before upload.
rgh avatar apply is an alias of rgh avatar install.
Standard avatar content layouts under 00009000 are supported.
Irregular title-root payload layouts are also supported.
If FTP is unavailable, install can fall back to XBDM upload and XBDM verification automatically.
--remote switches the browser/install flow to the hosted manifest and content cache.
rgh avatar choose --remote --titleid 58410A5D --all --current-user --overwrite was validated live against 192.168.1.186.

`rgh avatar library show`

rgh avatar library show
rgh avatar library show --json

Example output:

Mode                local
Configured Library  auto
Effective Library   A:\Downloads\12\em\Avatar-Item-Collection
Configured Cache    default
Effective Cache     C:\Users\B\AppData\Roaming\XeCLI\avatar-index.v3.json
Manifest URL        https://raw.githubusercontent.com/SaveEditors/Avatar-Item-Collection/main/avatar-manifest.json
Content Base URL    https://raw.githubusercontent.com/SaveEditors/Avatar-Item-Collection/main/

`rgh avatar library set`

rgh avatar library set --path A:\Downloads\12\em\Avatar-Item-Collection
rgh avatar library set --cache C:\Users\B\AppData\Roaming\XeCLI
rgh avatar library set --clear

Example output:

SUCCESS Avatar library settings updated
Library: A:\Downloads\12\em\Avatar-Item-Collection
Cache:   C:\Users\B\AppData\Roaming\XeCLI\avatar-index.v3.json

`rgh avatar games`

rgh avatar games
rgh avatar games --search "Black Ops"
rgh avatar games --remote --search "Black Ops"
rgh avatar games --limit 20
rgh avatar games --no-cache

Example output:

Avatar Games
0x415608C3   COD: Black Ops II   37 items   7.44 MB   Activision

`rgh avatar items`

rgh avatar items --titleid 415608C3 --limit 10
rgh avatar items --search hoodie
rgh avatar items --titleid 58410A5D --limit 5
rgh avatar items --remote --titleid 415608C3 --limit 10

Example output:

Avatar Items
0x415608C3   COD: Black Ops II   COD: Black Ops II Logo Shirt White - Female   000000080DF3B242CAE65A52415608C3   00009000   116 KB
0x58410A5D   Destination Arcade   A cool hoodie                                  0000020800060102C383304058410A5D   root      112 KB

`rgh avatar choose`

rgh avatar choose --search "Black Ops" --current-user
rgh avatar choose --remote --titleid 58410A5D --all --current-user --overwrite

What it does:

resolves one title interactively or from --titleid
lets you select items in terminal, unless --all is set
hands the chosen set to the same install pipeline used by rgh avatar install

Example output:

Avatar download 3 item(s) file 2/3 | Destination Arcade - 0000020800069131C14650A158410A5D: 21%
Current user: ExampleUser | XUID: 0x<xuid> | State: Signed in to Xbox Live
SUCCESS Avatar install complete
3 item(s)  512 KB -> /Hdd1/Content/0000000000000000/58410A5D/0000020800060102C383304058410A5D via FTP

`rgh avatar browse`

rgh avatar browse --remote
rgh avatar browse --remote --titleid 415608C3 --search hoodie

What it does:

opens the Windows avatar picker
shows title search, item search, tag filtering, multi-select, select-all, and clear
displays the current signed-in user when that information can be resolved
installs the selected set through the same pipeline used by rgh avatar install

Notes:

browse is Windows-only.
gui is an alias of browse.
the picker shares the same hosted/local backend and download cache as the CLI commands.

`rgh avatar install`

rgh avatar install --contentid 000000080DF3B242CAE65A52415608C3 --current-user
rgh avatar install --contentid 0000020800060102C383304058410A5D --current-user
rgh avatar install --titleid 415608C3 --all --current-user
rgh avatar install --contentid 000000080DF3B242CAE65A52415608C3 --current-user --dry-run
rgh avatar install --remote --titleid 415608C3 --all --current-user

Notes:

Use --current-user or --xuid <XUID> for ownership targeting.
--gamertag <NAME> is only a local output label when --xuid is explicit.
--overwrite replaces an existing remote item.
--device defaults to Hdd1.
When FTP is closed on the console, XeCLI can fall back to XBDM upload and XBDM verification automatically.
Multi-item installs emit batch progress plus per-item transfer bars.

Validated install proofs:

Standard layout:
- source item:
  - A:\Downloads\12\em\Avatar-Item-Collection\415608C3\00009000\000000080DF3B242CAE65A52415608C3
- verified remote path:
  - /Hdd1/Content/0000000000000000/415608C3/00009000/000000080DF3B242CAE65A52415608C3
Root layout:
- source item:
  - A:\Downloads\12\em\Avatar-Item-Collection\58410A5D\0000020800060102C383304058410A5D
- verified remote path:
  - /Hdd1/Content/0000000000000000/58410A5D/0000020800060102C383304058410A5D

Example output:

Current user: ExampleUser | XUID: 0x<xuid> | State: Signed in to Xbox Live
SUCCESS Avatar install complete
1 item(s)  116 KB -> /Hdd1/Content/0000000000000000/415608C3/00009000/000000080DF3B242CAE65A52415608C3 via XBDM

`rgh avatar apply`

rgh avatar apply is an alias of rgh avatar install.

rgh avatar apply --contentid 000000080DF3B242CAE65A52415608C3 --current-user
rgh avatar apply --titleid 415608C3 --all --current-user

Plugin Commands

`rgh plugin list`

rgh plugin list

Example output:

DashLaunch Plugins
slot1  Hdd:\xbdm.xex
slot5  Hdd:\XDRPC.xex

`rgh plugin enable`

rgh plugin enable --slot 5 --path Hdd:\XDRPC.xex
rgh plugin enable --slot 5 --path Hdd:\XDRPC.xex --backup

Example output:

SUCCESS Plugin enabled
slot 5 -> Hdd:\XDRPC.xex

`rgh plugin disable`

rgh plugin disable --slot 5

These commands edit launch.ini over FTP. Back up first when changing a live configuration.

Example output:

SUCCESS Plugin disabled
slot 5 cleared

GOD Commands

`rgh god info`

rgh god info .\game.iso

Example output:

ISO Info
Title ID   415608C3
Name       Grand Theft Auto V
Media      DVD1

`rgh god build`

rgh god build .\game.iso .\god
rgh god build .\game.iso .\god --trim end --threads 2

Example output:

SUCCESS GoD build complete
output written to .\god\415608C3

`rgh god watch`

rgh god watch .\incoming --dest .\god
rgh god watch .\incoming --dest .\god --recursive --move-done .\done --move-failed .\failed
rgh god watch .\incoming --dest .\god --once

The watchdog waits for file stability before starting conversion and can process a directory once and exit for automation use.

Example output:

Watching .\incoming
queued   game.iso
done     game.iso -> .\god\415608C3

Ghidra Commands

Ghidra is external and documented in the CLI as (Free). XeCLI does not bundle Ghidra or Java. After rgh ghidra config --path <dir>, XeCLI can install XEXLoaderWV into that Ghidra install with rgh ghidra install-loader.

`rgh ghidra config`

rgh ghidra config --path "C:\Tools\ghidra" --java "C:\Java"

Example output:

SUCCESS Ghidra config updated
path=C:\Tools\ghidra
java=C:\Java

`rgh ghidra install-loader`

rgh ghidra install-loader
rgh ghidra install-loader --archive .\ghidra_12.0_PUBLIC_20251209_XEXLoaderWV.zip

Example output:

SUCCESS Ghidra XEX loader installed
XEXLoaderWV -> C:\Tools\ghidra\Ghidra\Extensions\XEXLoaderWV\lib\XEXLoaderWV.jar

`rgh ghidra analyze`

rgh ghidra analyze --in .\title.xex
rgh ghidra analyze --running
rgh ghidra analyze --ftp-path /Hdd1/Aurora/Aurora.xex

Example output:

SUCCESS Ghidra analysis complete
project=title  loader=xex

`rgh ghidra decompile`

rgh ghidra decompile --in .\title.xex --out .\decomp
rgh ghidra decompile --running --out .\decomp --max 200

Example output:

SUCCESS Ghidra decompile complete
200 function files written to .\decomp

`rgh ghidra verify`

rgh ghidra verify --dir .\decomp
rgh ghidra verify --dir .\decomp --json

Example output:

No flagged files found.

IDA Commands

IDA is external and not bundled by XeCLI. The supported XeCLI baseline is pinned to IDA Pro 9.1.250226 with idaxex 0.42b. Do not broaden that claim to idaxex 0.43 or IDA 9.2 until that exact combination is validated.

`rgh ida config`

rgh ida config --path "C:\Program Files\IDA Professional 9.1" --python python
rgh ida config

Example output:

SUCCESS IDA settings updated
Stored IDA install, python, and backend settings were saved.

`rgh ida check`

rgh ida check
rgh ida check --json

Example output:

Install              C:\Program Files\IDA Professional 9.1
Batch EXE            C:\Program Files\IDA Professional 9.1\idat.exe
IDA build            9.1.25.0226 (supported)
idaxex               0.42b (supported)
TIL files            present
idalib import        ok

`rgh ida install-loader`

rgh ida install-loader
rgh ida install-loader --archive .\idaxex-0.42b.zip

Example output:

SUCCESS IDA loader installed
idaxex 0.42b -> C:\Program Files\IDA Professional 9.1\loaders\idaxex.dll

`rgh ida analyze`

rgh ida analyze --in .\title.xex --out-db .\title.i64 --overwrite
rgh ida analyze --ftp-path /Hdd1/Aurora/Aurora.xex --out-db .\Aurora.i64 --overwrite

Example output:

SUCCESS IDA analysis complete
.\Aurora.i64 segments 7 functions 40129

`rgh ida decompile`

rgh ida decompile --in .\Aurora.i64 --out .\ida-decomp --backend idalib --max 50
rgh ida decompile --running --out .\ida-decomp --out-db .\Aurora.i64 --keep-db

Example output:

SUCCESS IDA decompile complete
1 file(s) backend idalib output .\ida-decomp

`rgh ida verify`

rgh ida verify --dir .\ida-decomp
rgh ida verify --dir .\ida-decomp --json

Example output:

No flagged files found.

`rgh xex ida-decompile`

rgh xex ida-decompile --ftp-path /Hdd1/Aurora/Aurora.xex --out .\ida-decomp --max 50 --out-db .\Aurora.i64 --keep-db

Practical Workflows

Fast console health check

rgh ping
rgh status --quick
rgh title

Pull a running title for analysis

rgh xex dump --out .\title.xex
rgh xex strings --in .\title.xex --unicode --min 6
rgh ghidra decompile --in .\title.xex --out .\decomp
rgh xex ida-decompile --in .\title.xex --out .\ida-decomp --max 50 --out-db .\title.i64 --keep-db

Verify a reboot-expected module load

rgh modules load --path Hdd:\HvP2.xex --system --reboot-expected
rgh modules pending

Capture a verified NAND backup

rgh xell info
rgh xell kv export --output .\kv_backup.bin
rgh nand dump --output .\nand_backup.bin

XeCLI documentation for the rgh command. For release downloads, use the latest release.