ZenHAX

Free Game Research Forum | Official QuickBMS support | twitter @zenhax
It is currently Fri Aug 12, 2022 9:54 pm

All times are UTC




Post new topic  Reply to topic  [ 5 posts ] 
Author Message
PostPosted: Sat Dec 21, 2019 12:25 pm 
User avatar

Joined: Sun Jun 03, 2018 5:00 pm
Posts: 5
Good afternoon. Faced a problem. In the archive, each file has an identifier - 4 bytes. How do I know the decryption algorithm for this identifier?

For example (in big endian)

23 77 cb 6f - directory.txt

d9 65 77 b7 - AUDIO/RELEASE/MENU/MENU.FEV

d9 65 79 55 - AUDIO/RELEASE/MENU/MENU.FSB

What is this algorithm that creates such short names?

P.S. Game - split/second. Game used lzss compression. separately for each file


Top
   
PostPosted: Thu Mar 26, 2020 8:18 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 12982
quickbms has a script for scanning various crc algorithms but didn't find any result matching the crc and string you provided.
I tried using the following inputs:
AUDIO/RELEASE/MENU/MENU.FEV
AUDIO\RELEASE\MENU\MENU.FEV
audio/release/menu/menu.fev
audio\release\menu\menu.fev

It may be a different algorithm or a crc of the type instead of the filename, no idea.


Top
   
PostPosted: Thu Mar 26, 2020 8:52 pm 
User avatar

Joined: Tue Oct 13, 2015 1:26 pm
Posts: 561
Xenon wrote:
23 77 cb 6f - directory.txt
d9 65 77 b7 - AUDIO/RELEASE/MENU/MENU.FEV
d9 65 79 55 - AUDIO/RELEASE/MENU/MENU.FSB
How did you get those names?

_________________
Tribo Gamer Brasil


Top
   
PostPosted: Fri Jul 29, 2022 10:02 pm 

Joined: Thu Aug 28, 2014 8:57 pm
Posts: 5
not the guy who posted. Did some REing (used the Reloaded exe to bypass Securom's anti-debug) and
Code:
bp 0x571390 "ds esp+4;g"
in WinDBG spits out filename combined with the archive name. Was quicker for poking around than hooking a printf into that code.

When poking around with Ghidra and using a plugin for C++ parsing (they thankfully left RTTI data around) the entrance is in ArkLoader class. THats where that WinDBG breakpoint breaks and prints the value and immediately resumes.

Poking around the functions atm since the algorithm has to be near the function that handles file


Top
   
PostPosted: Tue Aug 02, 2022 10:57 pm 

Joined: Thu Aug 28, 2014 8:57 pm
Posts: 5
Got some progress. Hash function iterates bytewise over the filename, then multiplies the "old" value of checksum with 31 and then add the new byte. Got 30% or so coverage of the ARK files so far and still missing some files where i should have the name for... (running the game with -noark and the name-extracted files at correct spot triggers a crash, filename of the failed file is known since i watch with process-monitor)


Top
   
Display posts from previous:  Sort by  
Post new topic  Reply to topic  [ 5 posts ] 

All times are UTC


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Powered by phpBB® Forum Software © phpBB Limited