This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=4748

link12738, posted Fri Aug 11, 2017 3:09 pm (25391)

---

--

link12738, posted Fri Aug 11, 2017 4:38 pm (25395)

---

--

aluigi, posted Fri Aug 11, 2017 10:09 pm (25404)

---

Do you mean like this?

Code:

findloc OFFSET string "8CHN"
math OFFSET   6
goto OFFSET
get SIZE asize
log MEMORY_FILE 0 OFFSET
goto OFFSET MEMORY_FILE
append
for OFFSET = OFFSET < SIZE
    get TMP1 short
    get TMP2 byte
    math TMP1 z 8
    math TMP2 z 4
    put TMP1 short MEMORY_FILE
    put TMP2 byte MEMORY_FILE
next OFFSET   3
append

get NAME basename
get EXT extension
string NAME   "_ok."
string NAME   EXT
log NAME 0 SIZE MEMORY_FILE

The swapping starts from offset 0x104b0 of the sample you provided because it's the only way to match the file length with the 3 bytes step, you didn't provide info about that.

link12738, posted Sat Aug 12, 2017 6:05 am (25410)

---

--