I haven't managed to find a file table. I searched for the offsets, but haven't found any for the files themselves, and I've had trouble finding the beginning of each file header, they seem to be variable length, which makes me think that they contain an encrypted filename. For instance, infront of every mp3 (the entire second half of the archive after offset 265979867 seems to be mp3s) is a variable length set of bytes(could be the filename?), then the bytes 0x0080 then the file size. After that it's a variable length of bytes until you get to an mp3 header (0xFFF29040 or any number of valid mp3 headers). For about the first 50 mp3 files after that, the length of bytes after the file size is 87, but then it changes.
As for finding and uncompressing the zlib blocks, I used python and hex workshop. I got the idea for using python from an article I read at OpenRCE about extracting everquest 2 archives...but I had to modify it to go faster and find invalid archives. The original script iterated through all the bytes in the archive and tried to uncompress the whole thing...which really slow when the archive is 300+ meg.
I found all the zlib blocks with this script:
Code:
import mmap
import os
import sys
import zlib
f = open("Data.wz", "rb")
start = 0
f.seek(0, 2)
size = f.tell()
f.seek(0)
obj = zlib.decompressobj()
buf = ""
while start < size:
offset = start
obj = zlib.decompressobj()
buf = ""
try:
while offset < size:
d = obj.decompress(f.read(1))
if len(obj.unused_data) > 0:
break
buf += d
offset += 1
except zlib.error, details:
if str(details) == "Error -3 while decompressing: invalid stored block lengths" and len(buf) > 0:
print "offset:", start
print "compressed:", offset - start - 1, "uncompressed:", len(buf)
start += 1
f.seek(start)
continue
print "offset:", start
print "compressed:", offset - start - 1, "uncompressed:", len(buf)
start += 1
f.seek(start)
f.close()
After that I go to the offset, look 5 bytes before to get the file size...then go back to the offset and cut out the data to a new file with hex workshop.
Then I use this script to uncompress the zlib data.
Code:
import mmap
import os
import sys
import zlib
if len(sys.argv) < 2:
print "usage: extract.py <file>"
sys.exit(1)
offset = 0
fd = os.open(sys.argv[1], os.O_RDONLY | os.O_BINARY)
m = mmap.mmap(fd, 0, None, mmap.ACCESS_READ)
size = len(m)
obj = zlib.decompressobj()
buf = ""
try:
while offset < size:
d = obj.decompress(m[offset])
if len(obj.unused_data) > 0:
break
buf += d
offset += 1
except zlib.error, details:
print "offset:", offset, "length:", offset - 1
print details
m.close()
os.close(fd)
sys.exit(1)
print "compressed:", offset - start - 1, "uncompressed:", len(buf)
f = open(sys.argv[1] + ".dump", "wb")
f.write(buf)
f.close()
m.close()
os.close(fd)
As for actually viewing the image data...I wrote a quick c# program that just loads the data into a 16 bit bitmap (I tried 8, 16, 24, and 32 bit...16 is the only format that gives me the right image dimensions), and lets me modify the width of the image until it looks right :p Since I haven't been able to find width and height for all the images (partially I think cause most of the images are split up into smaller chunks).
I'll try to add an attachment of what I got for the golem data...you'll clearly see the golem, but the colors are all wrong cause can't figure out the exact image format.
Login
Register
FAQ
Search
