This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=3656

luxox, posted Sun Jan 08, 2017 9:55 pm (20026)

---

hello! Finally I have access to some ps4 games so right now I'm analyzing the files from Killzone Shadow Fall but these files instead its predecessors from Kz3 and Kz2 are compressed.

I've seen this compression before. In the files there are text string but with incomplete letters in some cases, also there are indices with a weird order or incomplete patterns. so, I supposed that are compressed.

this is the header structure in all files with respective variants obviouslly.
The original header of the file is RTTIBin so again I suppose that this header represents the compression.



Here are some examples:

http://www.mediafire.com/file/5uky77vxc ... racter.rar

http://www.mediafire.com/file/sqq4da1v5 ... racter.rar

http://www.mediafire.com/file/5cw54krmv ... racter.rar

http://www.mediafire.com/file/gd39oldxm ... _lines.rar

http://www.mediafire.com/file/98becwe11 ... racter.rar

Someone can recognize and figure out the compression?

Thanks!

chrrox, posted Mon Jan 09, 2017 1:11 am (20027)

---

quickbms script

Code:

comtype LZ4
get NAME basename
string NAME   .dec
idstring "\x83\xC1\x10\xCB"
get CHUNKSIZE long
get TSIZE longlong
getdstring HASH 0x10
set CCOUNT TSIZE
MATH CCOUNT / CHUNKSIZE
MATH CCOUNT  = 1
for i = 0 < CCOUNT
get ZSIZE long
putarray 0 i ZSIZE
next i
savepos OFFSET
append
for i = 0 < CCOUNT
getarray ZSIZE 0 i
if TSIZE > CHUNKSIZE
clog NAME OFFSET ZSIZE CHUNKSIZE
math TSIZE -= CHUNKSIZE
else
clog NAME OFFSET ZSIZE TSIZE
endif
math OFFSET  = ZSIZE
next i

luxox, posted Mon Jan 09, 2017 2:35 am (20030)

---

thanks a lot! works perfectly!