ZenHAX

Free Game Research Forum | Official QuickBMS support | twitter @zenhax | SSL HTTPS://zenhax.com
It is currently Wed Jul 18, 2018 5:08 am

All times are UTC




Post new topic  Reply to topic  [ 4 posts ] 
Author Message
 Post subject: --
PostPosted: Fri Aug 11, 2017 3:09 pm 

Joined: Tue May 30, 2017 3:28 pm
Posts: 10
--


Last edited by link12738 on Sat Dec 30, 2017 12:48 pm, edited 1 time in total.

Top
   
 Post subject: --
PostPosted: Fri Aug 11, 2017 4:38 pm 

Joined: Tue May 30, 2017 3:28 pm
Posts: 10
--


Last edited by link12738 on Sat Dec 30, 2017 12:48 pm, edited 2 times in total.

Top
   
PostPosted: Fri Aug 11, 2017 10:09 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 8468
Do you mean like this?
Code:
findloc OFFSET string "8CHN"
math OFFSET + 6
goto OFFSET
get SIZE asize
log MEMORY_FILE 0 OFFSET
goto OFFSET MEMORY_FILE
append
for OFFSET = OFFSET < SIZE
    get TMP1 short
    get TMP2 byte
    math TMP1 z 8
    math TMP2 z 4
    put TMP1 short MEMORY_FILE
    put TMP2 byte MEMORY_FILE
next OFFSET + 3
append

get NAME basename
get EXT extension
string NAME + "_ok."
string NAME + EXT
log NAME 0 SIZE MEMORY_FILE
The swapping starts from offset 0x104b0 of the sample you provided because it's the only way to match the file length with the 3 bytes step, you didn't provide info about that.


Top
   
 Post subject: --
PostPosted: Sat Aug 12, 2017 6:05 am 

Joined: Tue May 30, 2017 3:28 pm
Posts: 10
--


Top
   
Display posts from previous:  Sort by  
Post new topic  Reply to topic  [ 4 posts ] 

All times are UTC


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Powered by phpBB® Forum Software © phpBB Limited