Commands Reference

This page documents the XeCLI command surface by workflow area. Command examples use the installed terminal command rgh.

The Example output blocks on this page are representative operator-facing results from the shipped CLI. Exact spacing, colors, and secondary detail lines can vary by flags, console state, and whether JSON mode is enabled.

Find by Workflow

Use this table when you know the job you need done but not the exact command namespace yet.

Command Model

XeCLI is organized into a few major namespaces:

• Core commands: status, title, targeting, launch, reboot
• XBDM-backed commands: modules, memory, threads, debug, screenshot, file system
• JRPC2-backed commands: CPU key, temps, Title ID, dashboard, notifications, generic RPC
• FTP-backed commands: file access, saves, content, and plugin management
• Analysis commands: XEX, Ghidra, metadata
• Packaging commands: Games on Demand conversion and watchdog mode

Shortcut equivalence:

• rgh modules = rgh xbdm modules
• rgh module = alias of rgh modules
• rgh mem = rgh xbdm mem
• rgh xex = rgh xbdm xex
• rgh fs = rgh xbdm fs
• rgh threads = rgh xbdm threads
• rgh debug = rgh xbdm debug

High-traffic aliases:

• rgh s = rgh start
• rgh c = rgh connect
• rgh discover = rgh scan
• rgh shot = rgh screenshot
• rgh run = rgh launch
• rgh xnotify = rgh notify
• rgh mem search = rgh mem find
• rgh mem read = rgh mem peek
• rgh mem write = rgh mem poke
• rgh module remove = rgh modules unload
• rgh module verify = rgh modules pending

For the exact top-level help screen and the exact help output of every top-level command group, see CLI-Help.md.

Common Options

XBDM-backed commands

FTP-backed commands

Discovery commands

Core Commands

rgh status

Console summary view with XBDM identity, running XEX, JRPC-backed fields, drive layout, and sign-in information.

rgh status
rgh status --quick
rgh status --json
rgh status --no-drives --no-users

Notes:

• --quick skips slower JRPC, drive, and sign-in probes.
• Skipped fields are rendered as skipped instead of unknown.
• When a pending module load or unload is being tracked across a reboot, status can surface that state.

Example output:

Status
IP               192.168.1.186
Execution State  start
Title ID         0xFFFE07D1
Title Name       Aurora
Signed In        Yes
Gamertag         Diamond KSG

rgh profiles

Enumerates sign-in and profile information gathered from XBDM, JRPC/XAM, FTP, and F3 when available.

rgh profiles
rgh profiles --json
rgh profiles --no-ftp
rgh profiles --no-f3

Example output:

Signed-In Users
User 0   Diamond KSG   state=SignedInToLive   xuid=0x5D83300C00000900

Profiles (FTP)
72 profile containers found across Hdd1 and Usb devices

rgh title

Resolve the active title or look up a specific Title ID from the bundled database.

rgh title
rgh title --json
rgh title 415608C3
rgh title 415608C3 2B7302D6
rgh title active

Example output:

Active Title
Title ID     0xFFFE07D1
Title Name   Aurora
Media ID     unknown
Source       running xex path + bundled database

rgh target

Show, set, or clear the saved default XBDM target.

rgh target
rgh target --set <console-ip>
rgh target --set <console-ip> --port 730
rgh target --clear

Example output:

Default target
IP      192.168.1.186
Port    730

rgh ping

Fast XBDM connectivity check.

rgh ping

Example output:

OK 21 ms

rgh reboot

Cold reboot or title reboot.

rgh reboot
rgh reboot --title
rgh reboot --notify

Example output:

SUCCESS Reboot requested
cold reboot command sent to console

rgh launch

Launch a XEX with optional directory, arguments, title hint, and notification.

rgh launch Hdd1:\Aurora\Aurora.xex
rgh launch Hdd1:\Aurora\Aurora.xex --titleid FFFE07D1
rgh launch --xex Hdd1:\Aurora\Aurora.xex --args "debug=1"
rgh launch --xex Hdd1:\Aurora\Aurora.xex --dry-run

Example output:

SUCCESS Launch requested
Hdd1:\Aurora\Aurora.xex
Target title: Aurora (0xFFFE07D1)
Arguments: debug=1

rgh install

Install or remove the command shim, or add/remove the machine PATH entry.

rgh install
rgh install --machine-path
rgh install --uninstall

Example output:

Created by Pew - Se7ensins
SUCCESS Install complete
rgh is now available in new terminals

Discovery Commands

rgh start

rgh start
rgh start --json

Example output:

Detected Consoles
#1  192.168.1.186  Jtag  0037XXXXXXXX190
Default target updated to 192.168.1.186

rgh connect

rgh connect 1
rgh connect <console-ip>

Example output:

SUCCESS Target updated
192.168.1.186:730

rgh scan

rgh scan
rgh scan --json

Example output:

Detected Consoles
#1  192.168.1.186  Jtag  0037XXXXXXXX190  tcp+nap

Screenshot Commands

rgh screenshot

rgh screenshot --out .\screen.bmp
rgh screenshot --out .\screen.bmp --force

The command emits decoded frame-buffer metadata after a successful capture.

Example output:

SUCCESS Screenshot captured
1024x576  pitch=4096  format=0x00000012
.\screen.bmp

XBDM Root Commands

rgh xbdm info

rgh xbdm info
rgh xbdm info --json

Example output:

XBDM Info
Debug Name    Jtag
DM Version    2.0.21076.11
Flavor        Natelx did, of course

rgh xbdm raw

rgh xbdm raw --cmd "modules"
rgh xbdm raw --cmd "dirlist name=Hdd:\\"

Example output:

(202) multiline response follows
name="xam.xex" base=0x82000000 size=0x001C0000
name="Aurora.xex" base=0x90F00000 size=0x00480000

rgh xbdm screenshot

rgh xbdm screenshot --out .\screen.bmp

Example output:

SUCCESS Screenshot captured
.\screen.bmp

Module Commands

rgh modules list

rgh modules list
rgh modules list --json
rgh modules list --sections

Example output:

Modules
xboxkrnl.exe   0x80010000   0x005A0000
xam.xex        0x82000000   0x001C0000
Aurora.xex     0x90F00000   0x00480000

rgh modules info

rgh modules info --name Aurora.xex
rgh modules info --name xam.xex --sections

Example output:

Module Info
Name         Aurora.xex
Base         0x90F00000
Size         0x00480000
Path         \Device\Harddisk0\Partition1\Aurora\Aurora.xex

rgh modules dump

rgh modules dump --name xam.xex --out .\xam.bin
rgh modules dump --all --dir .\modules

Example output:

SUCCESS Module dump complete
xam.xex -> .\xam.bin

rgh modules load

rgh modules load --path Hdd:\HvP2.xex
rgh modules load --path Hdd:\HvP2.xex --system
rgh modules load --path Hdd:\HvP2.xex --system --reboot-expected
rgh modules load --path Hdd:\HvP2.xex --dry-run

Important options:

• --flags <N> kernel load flags, default 8
• --system runs the load on a system thread instead of the default title thread
• --reboot-expected persists pending verification if the console disconnects as part of the load
• --notify sends the default console success notification

Example output:

SUCCESS Module loaded
HvP2.xex at 0x91340000

rgh modules unload

rgh modules unload --name HvP2.xex --force
rgh modules unload --handle 0x91340000 --force
rgh modules unload --name HvP2.xex --force --notify

Important options:

• --force is required
• --skip-mark disables the sysdll unload marker write at handle+0x40
• --dry-run resolves the target without modifying memory

Example output:

SUCCESS Module unloaded
0x91340000 HvP2.xex

rgh modules pending

rgh modules pending

Use this after:

rgh modules load --path Hdd:\HvP2.xex --system --reboot-expected

Example output:

SUCCESS Pending module load verified
HvP2.xex at 0x91340000

Memory Commands

rgh mem dump

rgh mem dump --addr 0x82000000 --size 0x20000 --out .\mem.bin

Example output:

SUCCESS Memory dump complete
0x82000000 length=0x00020000 -> .\mem.bin

rgh mem hexdump

rgh mem hexdump --addr 0x30000000 --size 0x40

Example output:

0x30000000 DE AD BE EF 01 02 03 04 05 06 07 08 09 0A 0B 0C  ................
0x30000010 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F  ................

rgh mem regions

rgh mem regions
rgh mem regions --json

Example output:

Memory Regions
0x80000000  0x02000000  protect=0x00000020
0x82000000  0x01000000  protect=0x00000004

rgh mem peek

rgh mem peek --addr 0x82000000 --type u32
rgh mem peek --addr 0x82000000 --type ascii --len 32

Example output:

0x82000000 = 0x12345678 (u32)

rgh mem poke

rgh mem poke --addr 0x82000000 --type u32 --value 0x12345678
rgh mem poke --addr 0x82000000 --type float --value 1337
rgh mem poke --addr 0x82000000 --type string --value "XeCLI"

Type aliases include:

• u8, u16, u32, u64
• s8, s16, s32, s64
• f32, f64
• byte, int, uint, float
• ascii, string, hex, bytes

Example output:

SUCCESS Memory write complete
0x82000000 <= 0x12345678 (u32)

rgh mem watch

rgh mem watch --addr 0x82000000 --size 0x40
rgh mem watch --addr 0x82000000 --size 0x40 --interval 100 --count 10

Example output:

watch 1  0x82000000  78 56 34 12 ...
watch 2  0x82000000  79 56 34 12 ...

rgh mem strings

rgh mem strings --addr 0x82000000 --size 0x20000 --min 6
rgh mem strings --addr 0x82000000 --size 0x20000 --json

Example output:

0x82014020  ascii    xam.xex
0x82014210  ascii    XeKeysExecute

rgh mem search

Alias of rgh mem find.

rgh mem search --addr 0x30000000 --size 0x1000 --pattern DEADBEEF
rgh mem search --addr 0x82000000 --size 0x20000 --ascii "xam.xex"
rgh mem search --addr 0x82000000 --size 0x20000 --pattern 00000000 --out .\hits.json

Freeze options:

rgh mem search --addr 0x82000000 --size 0x20000 --pattern 00000000 --freeze --freeze-type u32 --freeze-value 305419896
rgh mem search --addr 0x82000000 --size 0x20000 --pattern 00000000 --freeze --freeze-all --freeze-count 5

Example output:

Hits
0x82000120
0x820004A8
0x820019F0

XEX Commands

rgh xex dump

rgh xex dump --out .\title.xex
rgh xex dump --path Hdd1:\Aurora\Aurora.xex --out .\aurora.xex

Example output:

SUCCESS XEX dump complete
\Device\Harddisk0\Partition1\Aurora\Aurora.xex -> .\aurora.xex

rgh xex strings

rgh xex strings --running --unicode --min 6
rgh xex strings --ftp-path /Hdd1/Aurora/Aurora.xex --out .\strings.txt
rgh xex strings --in .\title.xex --json

Example output:

XEX Strings
0x00000000  ascii    XEX2
0x0005B8A0  utf16le  Aurora

rgh xex decompile

rgh xex decompile --in .\title.xex --out .\decomp
rgh xex decompile --running --out .\decomp --max 200

Example output:

SUCCESS Ghidra decompile complete
200 function files written to .\decomp

File-System Commands

XBDM-backed

rgh fs list --path Hdd:\
rgh fs get --path Hdd:\launch.ini --out .\launch.ini
rgh fs put --path Hdd:\launch.ini --in .\launch.ini
rgh fs cat --path Hdd:\launch.ini
rgh fs rm --path Hdd:\temp\old.txt
rgh fs mkdir --path Hdd:\temp\newdir
rgh fs mv --from Hdd:\old.txt --to Hdd:\new.txt

Example output:

Directory
Aurora           Dir
launch.ini       File   12794

FTP-backed

Target management:

rgh ftp target
rgh ftp target --set <console-ip> --user <ftp-user> --pass <ftp-pass>
rgh ftp target --clear

rgh ftp list --path /Hdd1/
rgh ftp find --path /Hdd1/ --name *.xex
rgh ftp get --path /Hdd1/launch.ini --out .\launch.ini
rgh ftp put --path /Hdd1/launch.ini --in .\launch.ini
rgh ftp cat --path /Hdd1/launch.ini
rgh ftp rm --path /Hdd1/temp/old.txt
rgh ftp mkdir --path /Hdd1/newdir
rgh ftp mv --from /Hdd1/old.txt --to /Hdd1/new.txt

Example output:

SUCCESS FTP upload complete
.\launch.ini -> /Hdd1/launch.ini (12.49 KB)

Thread and Debug Commands

Threads

rgh threads list
rgh threads context --id 0xFB000008
rgh threads suspend --id 0xFB000008
rgh threads resume --id 0xFB000008

Example output:

Threads
0xFB000008  priority=100  state=Running
0xFB000009  priority=100  state=Waiting

Debug control

rgh debug stop
rgh debug go
rgh debug watch

Example output:

execution stopped
execution started

Breakpoints

rgh debug break add --addr 0x82001000
rgh debug break remove --addr 0x82001000
rgh debug break clearall

Example output:

SUCCESS Breakpoint added
0x82001000

Data breakpoints

rgh debug databreak add --addr 0x82100000 --size 4 --type write
rgh debug databreak remove --addr 0x82100000 --size 4 --type write

Example output:

SUCCESS Data breakpoint added
addr=0x82100000 size=4 type=write

JRPC2 Commands

rgh jrpc2 cpu-key
rgh jrpc2 temps
rgh jrpc2 temps --sensor gpu
rgh jrpc2 title-id
rgh jrpc2 dashboard
rgh jrpc2 motherboard
rgh jrpc2 resolve --module xam.xex --ordinal 526
rgh jrpc2 notify --message "XeCLI"
rgh jrpc2 call --module xam.xex --ordinal 526 --ret int --arg int:0

Example output:

CPU Key     587AC7...
Dashboard   17559
Motherboard Trinity

Notification Commands

rgh notify "Success :)"
rgh notify "XeCLI connected" 14
rgh notify --message "XeCLI connected" --icon info
rgh notify-icons list
rgh notify-icons show 14
rgh notify-icons add --name success --logo 0x24
rgh notify-icons remove --name success

For the full XNotify explanation, icon IDs, direct numeric usage, and integration notes, see XNotify.md.

Example output:

SUCCESS Notification sent
message="XeCLI connected" logo=14 (Flashing happy face)

rgh notify-icons show

rgh notify-icons show 14
rgh notify-icons show success
rgh notify-icons show achievement

Example output:

Input     14
Logo ID   14
Label     Flashing happy face
Notes     Common success/smiley icon

Hardware and Session Commands

rgh signin state

rgh signin state
rgh signin state --json

Example output:

Signed In   Yes
State       Signed in locally
Gamertag    Diamond KSG
XUID        0x5D83300C00000900
Slot        0

rgh led set

rgh led set --preset quadrant1
rgh led set --preset all-green --notify
rgh led set --tl green --tr off --bl off --br off

Example output:

SUCCESS Ring light updated
TL=green, TR=off, BL=off, BR=off

rgh led state

rgh led state
rgh led state --json

Example output:

Source        Last XeCLI-applied ring-light state
Preset        quadrant1
Top Left      green
Top Right     off
Bottom Left   off
Bottom Right  off

rgh fan set

rgh fan set --speed 55 --channel both
rgh fan set --speed 45 --channel primary
rgh fan set --speed 60 --channel secondary --notify

Example output:

SUCCESS Fan command sent
50% requested for both

rgh fan show

rgh fan show
rgh fan show --json

Example output:

Source   Last XeCLI-applied manual setting
Speed    50%
Channel  both

rgh smc version

rgh smc version
rgh smc version --json

Example output:

SUCCESS SMC version
2.3

Read Hardware-and-System.md for the deeper operational notes around sign-in state, LED presets, fan command behavior, and SMC version availability.

Save Commands

rgh save list

rgh save list --titleid FFFE07D1 --device Hdd1
rgh save list --titleid 415608C3 --profile E00012AA8D7879B4

Example output:

Save Files
/Hdd1/Content/E00012AA8D7879B4/415608C3/00010000/savegame.svg

rgh save extract

rgh save extract --titleid 415608C3 --out .\saves
rgh save extract --titleid 415608C3 --profile E00012AA8D7879B4 --device Hdd1 --overwrite

Example output:

SUCCESS Save extract complete
3 file(s)  8.2 MB -> .\saves\Grand Theft Auto V (0x415608C3)

rgh save inject

rgh save inject --titleid 415608C3 --in .\saves --device Hdd1
rgh save inject --titleid 415608C3 --profile E00012AA8D7879B4 --in .\save.bin --overwrite

Example output:

SUCCESS Save inject complete
1 file(s)  128 KB -> /Hdd1/Content/E00012AA8D7879B4/415608C3

Content Commands

rgh content list

rgh content list
rgh content list --device Hdd1 --show-types
rgh content list --titleid 415608C3

Example output:

Installed Content
415608C3  Grand Theft Auto V  Game
415608C3  Grand Theft Auto V  Title Update

rgh content delete

rgh content delete --titleid 415608C3 --type "Title Update"

Treat delete operations as destructive.

Example output:

SUCCESS Content delete complete
Title Update for 0x415608C3 removed

Plugin Commands

rgh plugin list

rgh plugin list

Example output:

DashLaunch Plugins
slot1  Hdd:\xbdm.xex
slot5  Hdd:\XDRPC.xex

rgh plugin enable

rgh plugin enable --slot 5 --path Hdd:\XDRPC.xex
rgh plugin enable --slot 5 --path Hdd:\XDRPC.xex --backup

Example output:

SUCCESS Plugin enabled
slot 5 -> Hdd:\XDRPC.xex

rgh plugin disable

rgh plugin disable --slot 5

These commands edit launch.ini over FTP. Back up first when changing a live configuration.

Example output:

SUCCESS Plugin disabled
slot 5 cleared

GOD Commands

rgh god info

rgh god info .\game.iso

Example output:

ISO Info
Title ID   415608C3
Name       Grand Theft Auto V
Media      DVD1

rgh god build

rgh god build .\game.iso .\god
rgh god build .\game.iso .\god --trim end --threads 2

Example output:

SUCCESS GoD build complete
output written to .\god\415608C3

rgh god watch

rgh god watch .\incoming --dest .\god
rgh god watch .\incoming --dest .\god --recursive --move-done .\done --move-failed .\failed
rgh god watch .\incoming --dest .\god --once

The watchdog waits for file stability before starting conversion and can process a directory once and exit for automation use.

Example output:

Watching .\incoming
queued   game.iso
done     game.iso -> .\god\415608C3

Ghidra Commands

rgh ghidra config

rgh ghidra config --path "C:\Tools\ghidra" --java "C:\Java"

Example output:

SUCCESS Ghidra config updated
path=C:\Tools\ghidra
java=C:\Java

rgh ghidra analyze

rgh ghidra analyze --in .\title.xex
rgh ghidra analyze --running
rgh ghidra analyze --ftp-path /Hdd1/Aurora/Aurora.xex

Example output:

SUCCESS Ghidra analysis complete
project=title  loader=xex

rgh ghidra decompile

rgh ghidra decompile --in .\title.xex --out .\decomp
rgh ghidra decompile --running --out .\decomp --max 200

Example output:

SUCCESS Ghidra decompile complete
200 function files written to .\decomp

rgh ghidra verify

rgh ghidra verify --dir .\decomp
rgh ghidra verify --dir .\decomp --json

Example output:

No flagged files found.

Practical Workflows

Fast console health check

rgh ping
rgh status --quick
rgh title

Pull a running title for analysis

rgh xex dump --out .\title.xex
rgh xex strings --in .\title.xex --unicode --min 6
rgh ghidra decompile --in .\title.xex --out .\decomp

Verify a reboot-expected module load

rgh modules load --path Hdd:\HvP2.xex --system --reboot-expected
rgh modules pending