This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=17188

nubitol, posted Sat Jul 16, 2022 2:54 am (72618)

---

I'm an old time gamer want to extract card image in thanos cardgames.
website: https://thanoscardgames.jimdofree.com/
download storage: https://sabercathost.com/folder/1939/thanoscardgames

Games are non-solitaire games (against CPU AI), all freeware, written in VB6 and actually released in 2003, only modified slightly in 2016.
One downloaded just open *.cab file, for modern system you just need the main .exe and its *.pak file
The executable upon started without presence of pak file, seems to try find resources files manually under .\res\[resource type]\*.* directory. So I think game might be able run without pak file (extracted mode).

The pack file has 16 bytes header started with "PACK" (not quake), then TOC size, then number of files (toc size / 64) and after that is 64bytes file structure:
filename (ansi) max 56 chars, padded with space hex(20), immediately followed by 4bytes (little endian) offset, and finally immediately follewed by 4bytes (little endian) size. The content itself altered by hex( 1).

Please help!!

EDIT:
my quickbms is version 0.5.31a (when it was just 6mb)

h3x3r, posted Sun Jul 17, 2022 2:59 pm (72628)

---

Code:

####################################
get FILENAME basename
idstring "PACK"
get HEADERSIZE long
get TOCSIZE long
get FILES long

for i = 0 < FILES
   getDString NAME 0x38
   get OFFSET long
   math OFFSET   1
   get SIZE long
   string NAME p= "%s/%s" FILENAME NAME
   log NAME OFFSET SIZE
next i

nubitol, posted Mon Jul 18, 2022 12:40 am (72631)

---

h3x3r wrote:

Code:

####################################
get FILENAME basename
idstring "PACK"
get HEADERSIZE long
get TOCSIZE long
get FILES long

for i = 0 < FILES
   getDString NAME 0x38
   get OFFSET long
   math OFFSET   1
   get SIZE long
   string NAME p= "%s/%s" FILENAME NAME
   log NAME OFFSET SIZE
next i

thanks, i didn't meant math OFFSET 1, rather some content (e.g spades.rar) has content "encrypted" by add each byte with 1 eg. RIFF -> SJGG, i think its FileRot 0x01?. Some however do not.

nubitol, posted Mon Jul 18, 2022 1:10 am (72632)

---

i got it, for ecrypted pak, it is

####################################
get FILENAME basename
idstring "PACK"
get HEADERSIZE long
get TOCSIZE long
get FILES long

for i = 0 < FILES
getDString NAME 0x38
get OFFSET long
get SIZE long
FileRot -1
string NAME p= "%s/%s" FILENAME NAME
log NAME OFFSET SIZE
FileRot ""
next i

nubitol, posted Mon Jul 18, 2022 3:26 am (72634)

---

Okay just extra info, I have successfully convert the game to run in "extracted mode"


extract res*.pak into this path format: res\[first substring "_" of NAME]\[remaining of NAME]
however in encrypted pak, NAME has prefix X (Xitmaps instead of bitmaps) so they has to be fixed first
chop off the content part of res*.pak so it only contain header and toc
convert *.jpg to *.bmp
atttrib all files under res\ to read only, so they dont get deleted once game quit

now the game will use files under res\ directory.

h3x3r, posted Mon Jul 18, 2022 4:07 pm (72644)

---

nubitol wrote:

thanks, i didn't meant math OFFSET 1, rather some content (e.g spades.rar) has content "encrypted" by add each byte with 1 eg. RIFF -> SJGG, i think its FileRot 0x01?. Some however do not.

It's not related to what you said before. This is how it works. Don't know why offsets are 1 byte before actuall file strat.