Snowy - Fish Frenzy - ARF

KorNet · Post by **KorNet** » Mon Jan 02, 2006 5:39 am

Nice game and BAD game archives

you will look that it is possible to make in order to take out from there the resources

Mr.Mouse , Watto what say guys ?

Strobe · Post by **Strobe** » Tue Jan 03, 2006 9:33 am

The archive itself contains raw pictures,
(only pictures from what ive seen)

here is an example after some hexxing

Strobe · Post by **Strobe** » Tue Jan 03, 2006 9:54 am

Analyzed the archive a bit further.
unfortunately, im kind of bad in explaining things, so
i took a screenshot and tried my best to make an explanation
from what i THINK is a correct interpretation of the format.

friendsofwatto · Post by **friendsofwatto** » Tue Jan 03, 2006 1:15 pm

Nice work

- at least we know the type of files in there, as I could not find any filenames.

This is the specifications I have thus far - but I havn't coded or tested them yet.

Code: Select all

+--------------------------+
| Snowy: Fish Frenzy *.arf |
+--------------------------+

// ARCHIVE HEADER
  2 - Header (AR)
  2 - null
  4 - Number Of Files
  4 - Hash?
  4 - Directory Offset

X - Unknown Junk

// DIRECTORY
  // for each file
    2 - File ID (incremental from 1)
    2 - Unknown
    4 - File Offset
    4 - File Length
    4 - Hash
    
// FILE DATA
  // for each file
    X - File Data

WATTO
watto@watto.org
http://www.watto.org

Post by **Mr.Mouse** » Tue Jan 03, 2006 3:51 pm

It's easy. The filenames are right under your nose.

The "unknown" chunk is actually the filenames. They are XOR-encrypted and the XOR key is saved right there in the archive, right after the Number of Files.

After the pointer to the resource info offset, comes

Code: Select all


// For each resource

  [1]   Size of resourcename
  [n]   Encrypted resourcename

The XOR key is 4 bytes in length. To calculate the number of times you should apply the key to the filename in a row.

Code: Select all

KeyApplied = (Size of Resourcename - (Size of resourcename MOD 4)) / 4

The remainder of the resourcename is not encrypted (max 3 bytes).

I've coded a MultiEx Commander plugin for these files, to extract the files with the correct filename.

Get the plugin, and create an ARF archive in the data/plugins directory, then store there the Snowy.dll. Start MexCom and enjoy!

KorNet · Post by **KorNet** » Tue Jan 03, 2006 4:07 pm

Wow ......... Mr.Mouse , Watto , Strobe thanks guys

friendsofwatto · Post by **friendsofwatto** » Tue Jan 03, 2006 11:28 pm

Ah

I didn't even notice that junk section, I was supposed to come back to it after I worked out the rest of the format, but obviously I didn't

. Good work mate, glad someone was able to correct me.

I will look towards putting this in the next GE update.

WATTO
watto@watto.org
http://www.watto.org

KorNet · Post by **KorNet** » Wed Jan 04, 2006 12:30 am

Okey Watto

.... Am extracted files has been crypted..... all textures and sounds files.. Simple so not to open them

Post by **Mr.Mouse** » Wed Jan 04, 2006 9:37 am

The textures I've seen are not encrypted, they are more like raw pixeldata. The filenames suggest they came from DDS files though, so it could be that the authors have stripped the DDS file headers from these.

Something similar could then be the case with the sound files you mention.

friendsofwatto · Post by **friendsofwatto** » Wed Jan 04, 2006 10:55 am

Actually, the headers of the file data are encrypted - you can see the entry I just placed on the wiki. There is a 1-byte value that, if used on the file data, will give back the normal headers. Well, at least it gave me the DDS headers for the files I tried, so I would assume it would work for the other files too.

I think Mr Mouse is correct though, in that the texture data is not encrypted, so there must be some way to distinquish where to start/stop the decryption of the file data.

WATTO
watto@watto.org
http://www.watto.org

friendsofwatto · Post by **friendsofwatto** » Wed Jan 04, 2006 11:15 am

OK, it appears as though the first 20 bytes of the file data are XORed, and the remaining bytes are to be read as normal. I have tested it with all the DDS images in the sample archive and it worked fine.

WATTO
watto@watto.org
http://www.watto.org

Post by **Mr.Mouse** » Wed Jan 04, 2006 11:51 am

Okay, good. I fixed the MexCom Snowy plugin to include such decryption. See screenshot.

friendsofwatto · Post by **friendsofwatto** » Wed Jan 04, 2006 12:05 pm

Wow - finally I got one right

- usually I post the specs for something and you correct me.

WATTO
watto@watto.org
http://www.watto.org

Post by **Mr.Mouse** » Wed Jan 04, 2006 12:10 pm

friendsofwatto wrote:Wow - finally I got one right - usually I post the specs for something and you correct me.

lol

KorNet · Post by **KorNet** » Wed Jan 04, 2006 4:12 pm

Mr.Mouse , Watto BIG thanks

I knew that you guys me you will help

XeNTaX

XeNTaX

Snowy - Fish Frenzy - ARF

Snowy - Fish Frenzy - ARF

Pictures.

Analyzed.