This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=4308

finalscream, posted Sat Jun 10, 2017 7:19 am (23986)

---

I have 2 .dat files that I'm not quite sure how to decompress. I tried scanning them with quickbms but haven't found anything, so I'm assuming its custom. I provided 2 samples of compressed and uncompressed files (I don't have access to whatever decompressed them heh).

Any help would really be appreciated!

aluigi, posted Sat Jun 10, 2017 8:19 am (23988)

---

Name of the game?
I bet that *uncompressed.dat is a memory dump, the algorithm is 99% lzss with 0x00 initializer but then the data is garbage from a certain point.

finalscream, posted Sat Jun 10, 2017 8:25 am (23989)

---

aluigi wrote:

Name of the game?
I bet that *uncompressed.dat is a memory dump, the algorithm is 99% lzss with 0x00 initializer but then the data is garbage from a certain point.

It's a konami based arcade game. I'd rather not say for a multitude of reasons lol. I know for a fact that it isn't a memory dump though. Pretty sure the garbage data you're seeing is SSL certs (check it with binwalk)

aluigi, posted Sat Jun 10, 2017 8:43 am (23990)

---

I have tried various settings of lzss but the problem remains, the output is very similar to the *uncompressed.dat file but then the decompression starts to be wrong. That's clearly visible by using this script:

Code:

comtype lzss "12 4 2 2 0"
get TYPE byte # 1
savepos OFFSET
get ZSIZE asize
math ZSIZE - OFFSET
xmath SIZE "ZSIZE * 2"
get NAME basename
clog NAME OFFSET ZSIZE SIZE

The differences start from offset 0xa9 and become worst

finalscream, posted Sat Jun 10, 2017 9:13 am (23992)

---

aluigi wrote:

I have tried various settings of lzss but the problem remains, the output is very similar to the *uncompressed.dat file but then the decompression starts to be wrong. That's clearly visible by using this script:

Code:

comtype lzss "12 4 2 2 0"
get TYPE byte # 1
savepos OFFSET
get ZSIZE asize
math ZSIZE - OFFSET
xmath SIZE "ZSIZE * 2"
get NAME basename
clog NAME OFFSET ZSIZE SIZE

The differences start from offset 0xa9 and become worst

I see what you mean. Whats's weird is that there's big chunks with matching data farther down the file. No clue what the issue is.

finalscream, posted Sat Jun 10, 2017 9:37 am (23994)

---

I only see one other konami AC game (Dancing Evolution Arcade), which also happens to use lzss0, but it seems like this might be something custom?

aluigi, posted Sat Jun 10, 2017 9:42 am (23995)

---

That's possible.
I can only suggest you to post on https://encode.ru and I'm quite sure someone can check it, after all it's a lzss derivate so there are better chances of success.

finalscream, posted Sat Jun 10, 2017 7:22 pm (24009)

---

aluigi wrote:

That's possible.
I can only suggest you to post on https://encode.ru and I'm quite sure someone can check it, after all it's a lzss derivate so there are better chances of success.

I posted over there just in case. I have a DLL that im pretty sure has the decompression function in it, but I'm not sure where it's located.

aluigi, posted Sun Jun 11, 2017 12:16 pm (24036)

---

Cool, I will add it to the next version of quickbms
https://encode.ru/threads/2772-Finding- ... #post52946