ZenHAX

Free Game Research Forum | Official QuickBMS support | twitter @zenhax | SSL HTTPS://zenhax.com
It is currently Tue Jun 27, 2017 12:16 am

All times are UTC




Post new topic  Reply to topic  [ 9 posts ] 
Author Message
PostPosted: Sat Jun 10, 2017 7:19 am 

Joined: Sat Jun 10, 2017 7:11 am
Posts: 5
I have 2 .dat files that I'm not quite sure how to decompress. I tried scanning them with quickbms but haven't found anything, so I'm assuming its custom. I provided 2 samples of compressed and uncompressed files (I don't have access to whatever decompressed them heh).

Any help would really be appreciated!


Last edited by finalscream on Sat Jun 10, 2017 9:44 am, edited 1 time in total.

Top
   
PostPosted: Sat Jun 10, 2017 8:19 am 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 6163
Name of the game?
I bet that *uncompressed.dat is a memory dump, the algorithm is 99% lzss with 0x00 initializer but then the data is garbage from a certain point.


Top
   
PostPosted: Sat Jun 10, 2017 8:25 am 

Joined: Sat Jun 10, 2017 7:11 am
Posts: 5
aluigi wrote:
Name of the game?
I bet that *uncompressed.dat is a memory dump, the algorithm is 99% lzss with 0x00 initializer but then the data is garbage from a certain point.

It's a konami based arcade game. I'd rather not say for a multitude of reasons lol. I know for a fact that it isn't a memory dump though. Pretty sure the garbage data you're seeing is SSL certs (check it with binwalk)


Top
   
PostPosted: Sat Jun 10, 2017 8:43 am 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 6163
I have tried various settings of lzss but the problem remains, the output is very similar to the *uncompressed.dat file but then the decompression starts to be wrong. That's clearly visible by using this script:
Code:
comtype lzss "12 4 2 2 0"
get TYPE byte # 1
savepos OFFSET
get ZSIZE asize
math ZSIZE - OFFSET
xmath SIZE "ZSIZE * 2"
get NAME basename
clog NAME OFFSET ZSIZE SIZE
The differences start from offset 0xa9 and become worst


Top
   
PostPosted: Sat Jun 10, 2017 9:13 am 

Joined: Sat Jun 10, 2017 7:11 am
Posts: 5
aluigi wrote:
I have tried various settings of lzss but the problem remains, the output is very similar to the *uncompressed.dat file but then the decompression starts to be wrong. That's clearly visible by using this script:
Code:
comtype lzss "12 4 2 2 0"
get TYPE byte # 1
savepos OFFSET
get ZSIZE asize
math ZSIZE - OFFSET
xmath SIZE "ZSIZE * 2"
get NAME basename
clog NAME OFFSET ZSIZE SIZE
The differences start from offset 0xa9 and become worst

I see what you mean. Whats's weird is that there's big chunks with matching data farther down the file. No clue what the issue is.


Top
   
PostPosted: Sat Jun 10, 2017 9:37 am 

Joined: Sat Jun 10, 2017 7:11 am
Posts: 5
I only see one other konami AC game (Dancing Evolution Arcade), which also happens to use lzss0, but it seems like this might be something custom?


Top
   
PostPosted: Sat Jun 10, 2017 9:42 am 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 6163
That's possible.
I can only suggest you to post on https://encode.ru and I'm quite sure someone can check it, after all it's a lzss derivate so there are better chances of success.


Top
   
PostPosted: Sat Jun 10, 2017 7:22 pm 

Joined: Sat Jun 10, 2017 7:11 am
Posts: 5
aluigi wrote:
That's possible.
I can only suggest you to post on https://encode.ru and I'm quite sure someone can check it, after all it's a lzss derivate so there are better chances of success.

I posted over there just in case. I have a DLL that im pretty sure has the decompression function in it, but I'm not sure where it's located.


Top
   
PostPosted: Sun Jun 11, 2017 12:16 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 6163
Cool, I will add it to the next version of quickbms :D
https://encode.ru/threads/2772-Finding- ... #post52946


Top
   
Display posts from previous:  Sort by  
Post new topic  Reply to topic  [ 9 posts ] 

All times are UTC


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Powered by phpBB® Forum Software © phpBB Limited