This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=314

AlphaTwentyThree, posted Tue Oct 28, 2014 7:33 am (1298)

---

Hi folks!
I want to take a look at the source files of the above game. It consists of an "main_xbox.hdr" containing the TOC and a bunch of "main_xbox_#.ark" files with the data. The problem is that the main_xbox.hdr seems to be compressed. A scan with Luigi's compression scanner didn't come up with anything. At least not with the plain data.
Can anybody help me identify this compression? Would be great!
Thanks for your help!
Here's the main_xbox.hdr: http://*USE_ANOTHER_FILEHOSTING*/c799b34 ... n_xbox.hdr

aluigi, posted Tue Oct 28, 2014 9:43 am (1307)

---

Maybe it's encrypted (non block cipher, maybe rc4) or obfuscated with some custom algorithm.

Ekey, posted Tue Oct 28, 2014 11:28 am (1312)

---

AlphaTwentyThree wrote:

Hi folks!
I want to take a look at the source files of the above game. It consists of an "main_xbox.hdr" containing the TOC and a bunch of "main_xbox_#.ark" files with the data. The problem is that the main_xbox.hdr seems to be compressed. /main_xbox.hdr

Encrypted. Here algo

Code:

unsigned int pNextKey(unsigned int pBuffer)
{
   int dwSeed = (pBuffer / 0x1F31D) * 0xB14;
   int pResult = (pBuffer - ((pBuffer / 0x1F31D) * 0x1F31D)) * 0x41A7;

   pResult = pResult - dwSeed;

   if(pResult       pResult  = 0x7FFFFFFF;

   return pResult;
}

void pHDRDecrypt(unsigned char* pBuffer, int dwSize)
{
   unsigned int pKey = *(unsigned int*)pBuffer;
   for(int i = 4; i    {
      pKey = pNextKey(pKey);
      pBuffer[i] ^= pKey;
   }
}

aluigi, posted Tue Oct 28, 2014 2:18 pm (1316)

---

If you can provide also one of these ark archives I can make a full script

AlphaTwentyThree, posted Tue Oct 28, 2014 11:01 pm (1343)

---

sure thing: http://*USE_ANOTHER_FILEHOSTING*/46fe87a ... xbox_2.ark

aluigi, posted Wed Oct 29, 2014 7:48 am (1346)

---

I see that there are no OFFSET and ARK_NUM fields so I can extract nothing.
The following is the work-in-progress script, I have already parsed the whole HDR file so I don't have other things to evaluate:

Code:

get SIZE asize
get KEY long
savepos OFFSET
math SIZE -= OFFSET
log MEMORY_FILE OFFSET SIZE
for i = 0 < SIZE
    xmath KEY "((KEY - ((KEY / 0x1F31D) * 0x1F31D)) * 0x41A7) - ((KEY / 0x1F31D) * 0xB14)"
    if KEY <= 0
        math KEY  = 0x7fffffff
    endif

    getvarchr TMP MEMORY_FILE i
    math TMP ^= KEY
    putvarchr MEMORY_FILE i TMP
next i


get DUMMY long MEMORY_FILE  # 7
get VER long MEMORY_FILE    # 1
getdstring DUMMY 16 MEMORY_FILE
get ARKS long MEMORY_FILE
get ARKS long MEMORY_FILE
for i = 0 < ARKS
    get ARK_SIZE long MEMORY_FILE
next i
get ARKS long MEMORY_FILE
for i = 0 < ARKS
    get NAMESZ long MEMORY_FILE
    getdstring NAME NAMESZ MEMORY_FILE
    putarray 0 i NAME
next i
get ARKS long MEMORY_FILE
for i = 0 < ARKS
    get DUMMY long MEMORY_FILE
next i
get ARKS long MEMORY_FILE
for i = 0 < ARKS
    get FOLDERS long MEMORY_FILE
    for j = 0 < FOLDERS
        get NAMESZ long MEMORY_FILE
        getdstring NAME NAMESZ MEMORY_FILE
    next j
next i
get NAMES_SIZE long MEMORY_FILE
savepos OFFSET MEMORY_FILE
log MEMORY_FILE2 OFFSET NAMES_SIZE MEMORY_FILE
math OFFSET  = NAMES_SIZE
goto OFFSET MEMORY_FILE

get NUM long MEMORY_FILE
for i = 0 < NUM
    get DUMMY long MEMORY_FILE
    putarray 2 i DUMMY
next i

get FILES long MEMORY_FILE
for i = 0 < FILES
    get CRC long MEMORY_FILE
    get ZERO long MEMORY_FILE
    get NAME_IDX long MEMORY_FILE
    get FOLDER_IDX long MEMORY_FILE
    get SIZE long MEMORY_FILE
    get DUMMY long MEMORY_FILE  # ??? -2, 0 or big

    getarray FOLDER_OFF 2 FOLDER_IDX
    goto FOLDER_OFF MEMORY_FILE2
    get NAME string MEMORY_FILE2

    getarray NAME_OFF 2 NAME_IDX
    goto NAME_OFF MEMORY_FILE2
    get TMP string MEMORY_FILE2
    string NAME  = /
    string NAME  = TMP

    if SIZE != 0 # real file
        # need OFFSET and ARK_NUM!
        print "%SIZE|x% %NAME%"
    endif
next i

brendan19, posted Sat Jan 10, 2015 4:28 pm (2628)

---

Bumping with additional archive that contains the magics "CHNK" "MILO" and "LAYR".

There also seems to be some kind of folder structure in this archive as well as several others.

Hopefully this can provide some additional insight

http://www2.zippyshare.com/v/50115189/file.html