This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=15192

itsmeft24, posted Mon Apr 26, 2021 1:34 am (63580)

---

I am trying to extract the files from the game's XBR archive with their original filenames. However, the archive doesn't seem to contain them anywhere. After consulting the rainbow_studios.BMS script for answers, I can see that they are hashed. Does anyone know how I should go about determining the algorithm?

Example Filename: C\Global\Chars\McQ\Tex\McQ_Body.dds
Location in Cars3.XBR: 0xFBEE000
Location as defined in Table: 0x0001F7DC (Multiply by 0x800 to get real location)
Hash as defined in Table: 0x89BF733F
Size as defined in Table: 0x40080

itsmeft24, posted Tue May 11, 2021 4:13 pm (63901)

---

I noticed that nobody has taken a look at it yet. I am bumping this post. If you have any clue, please let me know!

Ekey, posted Tue May 11, 2021 5:01 pm (63903)

---

You need to find a hashing algorithm. As I can see, this game did not come out on PC and therefore it will be problematic to do it

itsmeft24, posted Tue May 11, 2021 5:05 pm (63904)

---

I have tried the likes of Adler32 and CRC-32 to no avail. Do you think it is something custom or standard?

itsmeft24, posted Tue May 11, 2021 5:07 pm (63905)

---

Hmm... Would it be beneficial if I uploaded the default.xex binary? (This version is 360)

Ekey, posted Tue May 11, 2021 5:07 pm (63906)

---

It can be any 32-bit algorithm, not only CRC32. For example fnv32, murmur, rs, pjw, elf, bkdr, sdbm, djb, ap and more like this. It can also be custom algorithm

itsmeft24, posted Tue May 11, 2021 5:09 pm (63907)

---

I see... I will try some of those and get back to you.

Ekey, posted Tue May 11, 2021 5:12 pm (63908)

---

Anyway, there is nothing much we can do without reverse engineering.

itsmeft24, posted Tue May 18, 2021 7:08 pm (64127)

---

Upon closer inspection, the hashes of files that are close to each other are similar...

For example, the files Res\Data\C\Global\Chars\VehicleInfo.x360.mtl and Res\Data\C\Global\Chars\VehicleInfo.x360.res:

VehicleInfo.x360.mtl: Hash: 0xc9ea38c0, Size: 0x1ad28, Offset: 0x48ddf800
VehicleInfo.x360.res: Hash: 0xc9ea4c1d, Size: 0x13c594, Offset: 0x48dfa800

itsmeft24, posted Tue Aug 03, 2021 7:34 pm (65481)

---

It turns out they use DJB-2 in this game, or at least in the Xbox 360 version. Regardless, thank you so much!

Ekey, posted Wed Aug 04, 2021 4:52 pm (65505)

---

In that case, you need to find the initial hash for this algorithm (default is 5381 / 0x1505)

Ekey, posted Tue Aug 24, 2021 4:26 pm (65856)

---

I also want to warn you that the structure defined in rainbow_studios.bms is incorrect. Entry table is started from 0x18 offset and have next structure > hash, size, offset

itsmeft24, posted Wed Jan 12, 2022 12:26 am (69018)

---

They say hindsight is 2020. Looking back, there were TONS of signs pointing to DJB-2. MOT files (animation data) having DJB-2 default primes at the footer, the function itself being inlined into so many parts of the game's code (at least the Wii versions, though they don't use this archive), and it being used in BPB files for speeding up parameter lookups.

Also this reply is almost a year late lol most of these discoveries were made months ago, soon after I realized it was DJB-2

Note: A big resource for reverse-engineering Race-O-Rama is the Wii version. Though it behaves very differently from the Xbox 360/PS3 versions, looking at it can help to better understand how the game works. Simply load main.dol into Ghidra (with the appropriate plugin) with the cars3.wii.map symbol map (lmao incinerator left that shit in) and everything all starts to make sense...