This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=12904

JohnHudeski, posted Sat Dec 14, 2019 11:56 pm (52580)

---

So I cam across an old xbox game that uses the most annoying encryption of all time. It injects FF at seemingly random intervals (mostly 9).
I think its a zip/ pak file not too sure (Signature: DF? 50 4B 03 04 14 E9 32)
Anyone have any tips on dealing with this?

JohnHudeski, posted Sun Dec 15, 2019 1:36 am (52586)

---

I think it is a zip file but there are characters injected at fixed intervals
like 0xDF means the next one is in 9 bytes 0xFF in 8 bytes
This was my working assumption until they started potentially xoring
so it is ridiculous

I made the assumption due to the consistent nature of the padding

Allen, posted Sun Dec 15, 2019 11:24 am (52594)

---

It looks like LZSS compression. From the data after decompression, it seems that only the PK file header of ZIP is added, but there is no compression, not double compression.
Just a hint, it may not be correct.

JohnHudeski, posted Mon Dec 16, 2019 10:28 pm (52624)

---

That's a little confusing considering there are multiple pk headers in the file .
I'm still new to this. What tool did you use for your decompression (python is refusing to install lzss for me right now)

I tried using offzip on the file you uploaded but no luck so it is probably not a zip at all

Allen, posted Mon Dec 23, 2019 2:50 pm (52752)

---

I reviewed the data today and found that it is LZSS compression, but the buffer size is 1024 bytes. Not 4096.
lzss.c in the attachment can be used after compilation.
test_lzss.exe is a C # program that I ported from C.
test_lzss usage, drag directly file to the program.
You can also refer to the C source code to port to Python.

Untitled1_decom.zip

aluigi, posted Sun Feb 16, 2020 4:03 pm (54063)

---

BMS Script:

Code:

comtype lzss "10 4 2 2 0"
get ZSIZE asize
xmath SIZE "ZSIZE * 10"
clog "output.zip" 0 ZSIZE SIZE

Allen, posted Mon Feb 17, 2020 1:10 am (54069)

---

aluigi wrote:

BMS Script:

Code:

comtype lzss "10 4 2 2 0"
get ZSIZE asize
xmath SIZE "ZSIZE * 10"
clog "output.zip" 0 ZSIZE SIZE

Thank you Aluigi.
Learned.

JohnHudeski, posted Thu Feb 20, 2020 5:21 am (54109)

---

Wait what?