This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=12570

yuzuramen, posted Sat Sep 28, 2019 7:04 am (51029)

---

I've come across files that have something that looks like a tree structure as part of their header. The delimiters seem to be a decreasing number of 0's for each subtree, i.e., 0x00000000, then 0x0000, then 0x00, etc. Each leaf node then seems to have increasing short numbers. I'm wondering what this specific file could be, are there any common formats that use such a structure?

The original file can be found in viewtopic.php?f=9&t=12565 Here is what it looks like. I'm posting this is a new thread because this is a more specific/independent question.

yuzuramen, posted Sat Sep 28, 2019 2:02 pm (51050)

---

I've made some amount of progress on this, though I am still mostly clueless:

1. The file seems to consist of 4 parts: Header (32 bits), Some kind of table (variable size), another kind of table/tree (variable size), and the content data.
2. Header is [prefix][filesize][unk][unk][unk][table1_size][table2_size]
3. Table1 seems to contains some kind of increasing integers, looks like offsets. However, these offsets go past the file size. This leads me to believe that the file content is compressed and these are the offsets into the uncompressed data. I further confirmed this by looking at files of different sizes. The table1 size stays constant, but the offsets consistently go a little bit past the file size, but never too much.
4. Table 2 still seems like some kind of tree to me, but I could be wrong. I am clueless here, but I'm thinking this is what is used to actually used to compress the data. It could maybe be some kind of huffman encoding. I confirmed this by looking at files of different content sizes. The table2 size always grows proportionally with the content, while the table1 size stays pretty much constant.

yuzuramen, posted Sun Sep 29, 2019 2:52 am (51069)

---

Another small update. I looked at the diff of the same file(s) before and after an app update. Sometimes data is appended to such files. When data is appended, entries are appended to the second table as well. It always grows with the data. I no longer believe the second table is a tree, just some kind of table-like encoding/encryption for the data. However, I haven't been able to figure out how exactly it corresponds to the data, not of the offsets seem to be matching, and I don't understand why it would contain increasing integers.