This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=280

everlast, posted Wed Oct 22, 2014 12:20 pm (1129)

---

It's online game and i take the files with URL Snooper.
Here example file: http://www50.zippyshare.com/v/81154049/file.html

Thanks for the help

aluigi, posted Wed Oct 22, 2014 2:10 pm (1131)

---

You can try with this quickbms script:

Code:

comtype lzma86head
get SIZE asize
clog MEMORY_FILE 0 SIZE SIZE

endian big
get MEM_SIZE asize MEMORY_FILE

# xml
get SIZE short MEMORY_FILE
savepos OFFSET MEMORY_FILE
log "" OFFSET SIZE MEMORY_FILE
math OFFSET  = SIZE
goto OFFSET MEMORY_FILE

get SIZE long MEMORY_FILE
get FILES long MEMORY_FILE
for i = 0 < FILES
    get NAMESZ long MEMORY_FILE
    getdstring NAME NAMESZ MEMORY_FILE
    get SIZE long MEMORY_FILE
    savepos OFFSET MEMORY_FILE
    log NAME OFFSET SIZE MEMORY_FILE
    math OFFSET  = SIZE
    goto OFFSET MEMORY_FILE
next i

xmath SIZE "MEM_SIZE - OFFSET"
log "" OFFSET SIZE MEMORY_FILE

Basically:
- the bin file is compressed with lzma
- there is an xml file at the beginning
- there are various files after the xml
- there is a certain amount of bytes after the files that is dumped as-is