ZenHAX

Free Game Research Forum | Official QuickBMS support | twitter @zenhax | SSL HTTPS://zenhax.com
It is currently Wed Jun 19, 2019 9:49 am

All times are UTC




Post new topic  Reply to topic  [ 8 posts ] 
Author Message
PostPosted: Thu Jun 06, 2019 9:45 pm 
User avatar

Joined: Fri Apr 20, 2018 12:41 am
Posts: 219
The file is a ZIP file given by the PK file header but I cannot decompress the assets from it due to errors occuring with no matter archiving program/plugin what I use on it, will someone figure this file out? filedropper.com/data_4, file from the Android version.


Last edited by LolHacksRule on Sun Jun 09, 2019 4:45 am, edited 2 times in total.

Top
   
PostPosted: Thu Jun 06, 2019 11:19 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 10542
It states that it's using the compression algorithm 34 which is custom.
The data starts with the byte 0x1b followed by the 16 bit decompressed size (so it's probably chunked) followed by the raw compressed data which is nothing like lzss/lz4 or other "easy" algorithms where parts of the original data are visible.


Top
   
PostPosted: Fri Jun 07, 2019 12:04 am 
User avatar

Joined: Fri Apr 20, 2018 12:41 am
Posts: 219
Ok then how would I extract it then? This file is also used in the Win10 build, preferably in versions newer than 3.18.12091.0, 2.11.1807.1002 and 1.9.1.50210.


Top
   
PostPosted: Sun Jun 09, 2019 11:35 pm 
User avatar

Joined: Fri Apr 20, 2018 12:41 am
Posts: 219
Hello?


Top
   
PostPosted: Mon Jun 10, 2019 5:23 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 10542
What answer should I give you?
You have data compressed with an algorithm that you don't know.
The only solution is reverse engineering it.


Top
   
PostPosted: Mon Jun 10, 2019 5:30 pm 
User avatar

Joined: Fri Apr 20, 2018 12:41 am
Posts: 219
Darn, guess I'll RE the Win10 version to find the mechanism...


Top
   
PostPosted: Mon Jun 10, 2019 5:34 pm 

Joined: Sat Aug 09, 2014 2:34 pm
Posts: 801
Main library is Solitaire.dll - used functions from ClrCompression library (FxCore package). By function names, you can see that this is from a series of zlib (possibly modified).

Code:
crc32
deflateInit2_
inflateInit2_
deflate
inflate
crc32
inflateEnd
deflateEnd


Attachments:
clrcompression.rar [35.28 KiB]
Downloaded 2 times
Top
   
PostPosted: Mon Jun 10, 2019 7:49 pm 
User avatar

Joined: Fri Apr 20, 2018 12:41 am
Posts: 219
Ok then I was going to RE it but that helps.


Top
   
Display posts from previous:  Sort by  
Post new topic  Reply to topic  [ 8 posts ] 

All times are UTC


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Powered by phpBB® Forum Software © phpBB Limited