This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=8264

shawminator, posted Mon Jul 30, 2018 11:47 am (37099)

---

Not sure if this is the correct place to post this but I will give it a shot.
I am currently looking into a texture file for PES 2018 and hit a brick wall with the compression on the below file.
http://www.mediafire.com/file/boc7t5r2g ... ex000/file

so far I can see that the first 4 bytes are the uncompressed size, the next 4 are compressed size which u read from 0x8.
what i could find out was that it may be a modded lz77 method ot even a lzss method of compression,

i found a prs compression method on github but it fails after the first 8 bytes (possible first block) due to the look behind being a negative offset.


I have ran a signsrch on the exe and returned the following:-

offset num description [bits.endian.size]
--------------------------------------------
0019ff57 2053 RIPEMD-128 InitState [32.le.16&]
0025e396 3048 DMC compression [32.le.16&]
00440fa8 3051 compression algorithm seen in the game DreamKiller [32.be.12&]
011bfceb 882 Initial hash value H for SHA-512 [64.le.64&]
011bfcef 876 SHA256 Initial hash value H (0x6a09e667UL) [32.le.32&]
011ee606 1030 SHA256 [32.le.288&]
0136b885 1018 MD5 digest [32.le.272&]
01c3193d 2639 LZSS (N 4096, F 18, T 2) [32.le.16&]
01fe3b30 641 CRC-32-IEEE 802.3 [crc32.0x04c11db7 le rev int_min.1024]
01fe3b30 648 CRC-32-IEEE 802.3 [crc32.0xedb88320 lenorev 1.1024]
01fe3f30 129 Adler CRC32 (0x191b3141) [32.le.1024]
01fe4330 131 Adler CRC32 (0x01c26a37) [32.le.1024]
01fe4730 133 Adler CRC32 (0xb8bc6765) [32.le.1024]
01fe4b30 645 CRC-32-IEEE 802.3 [crc32.0x04c11db7 be rev int_min.1024]
01fe4b30 652 CRC-32-IEEE 802.3 [crc32.0xedb88320 benorev 1.1024]
01fe4f30 130 Adler CRC32 (0x191b3141) [32.be.1024]
01fe5330 132 Adler CRC32 (0x01c26a37) [32.be.1024]
01fe5730 134 Adler CRC32 (0xb8bc6765) [32.be.1024]
01fe5bb0 2289 zinflate_lengthStarts [16.le.58]
01fe5c30 2296 zinflate_distanceStarts [16.le.60]
01fea0b0 799 CRC-64-ECMA-182 [crc64.0x42f0e1eba9ea3693 lenorev int_min.2048]
01fea0b0 810 CRC-64-ECMA-182 [crc64.0xc96c5795d7870f42 le rev 1.2048]
01fee6b0 948 DES [32.le.20&]
01fee6b0 949 DES [32.be.20&]
0203abf5 2417 MBC2 [32.le.248&]
0203ad6f 2418 MBC2 [32.be.248&]
023c0c50 878 Hash constant words K for SHA-384 and SHA-512 [64.le.640]
0242b3be 1038 padding used in hashing algorithms (0x80 0 ... 0) [..64]
02454cc0 2415 Misty md5const [32.le.256]
02454de4 1016 MD4 digest [32.le.24&]
02454de4 1036 SHA1 / SHA0 / RIPEMD-160 initialization [32.le.20&]
02454de4 2402 Lucifer (outerbridge) DFLTKY [..16]
02454e20 874 SHA256 Hash constant words K (0x428a2f98) [32.le.256]
02454f20 2176 SHA224_DS [32.le.32]
02454f20 1028 SHA224 [32.le.288&]
02454f44 2364 Crypton kp [32.le.16]
02455200 1034 SHA512 [64.le.704&]
02455240 1032 SHA384 [64.le.704&]
02455240 880 Initial hash value H for SHA-384 and SHA-512 [64.le.64&]
02456c00 260 CRC-8-Dallas/Maxim [crc8.0x8c lenorev 1.256]
02456c00 257 CRC-8-Dallas/Maxim [crc8.0x31 le rev int_min.256]
02456d00 408 CRC-16-CCITT modem/x25/kermit [crc16.0x8408 lenorev 1.512]
02456d00 401 CRC-16-CCITT modem/x25/kermit [crc16.0x1021 le rev int_min.512]
0245b860 1087 Zlib length_code [..256]
0245b960 1086 Zlib dist_code [..512]
0245bb60 2294 zinflate_lengthExtraBits [32.le.116]
0245bbdd 2304 zinflate_distanceExtraBits [32.be.120]
0245bbe0 2303 zinflate_distanceExtraBits [32.le.120]
0245c1bd 1090 Zlib base_length [32.be.116]
0245c1c0 1089 Zlib base_length [32.le.116]
0245c240 1091 Zlib base_dist [32.le.120]
02645f10 2875 libavcodec ff_mjpeg_val_ac_luminance [..162]
02645fc0 2876 libavcodec ff_mjpeg_val_ac_chrominance [..162]
026465e0 1115 Jpeg dct 14 bit aanscales [16.le.128]
02646660 1119 Jpeg dct AA&N scale factor [double.le.64]
02646a20 3038 unlzx table_three [32.le.64]
02646b40 1809 libdjvu GPixmap dither table [..256]
02647830 871 ACSS reverse sbox [..256]
02647830 1963 FFT and FHT routines rv_tbl [..128]
02692c70 2508 Electronic Arts TQI base_table2 [..64]
02692cd0 1563 libavcodec ff_zigzag_direct [..64]
02694f00 538 CRC-16-IBM maxim/usb [crc16.0xa001 le rev 1.512]
02694f00 527 CRC-16-IBM maxim/usb [crc16.0x8005 lenorev int_min.512]
02ce7774 2545 anti-debug: IsDebuggerPresent [..17]
02ce7d8c 1283 Windows CryptAcquireContext [..21]
02ce8385 1289 Windows CryptDecrypt [..13]
02de21a0 1996 rfc3548 Base 64 Encoding with URL and Filename Safe Alphabet [..62]
02de21a0 2005 B64EncodeTable [..64]
02df6200 1221 lpc encode rmst table [32.le.256]
02df642d 1230 SA LPC-10 Voice Coder TAU [32.be.240]
02df6430 1229 SA LPC-10 Voice Coder TAU [32.le.240]
02df664d 1220 lpc decode detau table [32.be.512]
02df6650 1219 lpc decode detau table [32.le.512]
02df6c5d 1218 HAM84 DAC tab [32.be.512]
02df6c60 1217 HAM84 DAC tab [32.le.512]
02df6e60 1223 bsynz kexc table [32.le.100]
02df6ed0 2065 Haval init [32.le.32&]
02df6ed0 919 Blowfish bfp table [32.le.72]
02df6ef0 1054 Haval hash pass2 [32.le.128&]
02df6f20 2335 Blowfish_s_init [32.le.4096]
02df6f20 921 Blowfish ks0 table [32.le.1024]
02df6f78 2067 Haval mc3 [32.le.128]
02df6fd8 2219 HAVAL2_DS [32.le.32]
02df6ff8 2069 Haval mc4 [32.le.128]
02df7058 2217 HAVAL1_DS [32.le.32]
02df7078 2071 Haval mc5 [32.le.128]
02df7320 923 Blowfish ks1 table [32.le.1024]
02df7720 925 Blowfish ks2 table [32.le.1024]
02df7b20 927 Blowfish ks3 table [32.le.1024]

- 89 signatures found in the file in 41 seconds
- done

i dont really know what to try now. hoping to at least get pointed in the right direction
cheers

aluigi, posted Tue Jul 31, 2018 5:08 am (37123)

---

Yeah, it's lzss:

Code:

comtype lzss0
endian big
get SIZE long
get ZSIZE long
savepos OFFSET
get NAME basename
string NAME   "."
clog NAME OFFSET ZSIZE SIZE

shawminator, posted Tue Jul 31, 2018 10:09 am (37129)

---

Thanks Aluigi, that's perfect
much appreciated.

shawminator, posted Sun Aug 05, 2018 3:25 pm (37240)

---

could I ask for the compress script to use quickbms?

shawminator, posted Sun Aug 05, 2018 4:31 pm (37242)

---

Its ok, got it working