Page 1 of 1
unknown Archiv MMO
Posted: Wed Oct 13, 2010 2:45 pm
by kataclysm
Hi
since im new to that ... some questions.
THX 4 Help
........
Archiv Files:
Data.lrs (47 MB)
Data.lrf (1,4 GB)
Filecutter (attachment):
archiv.7z
........
Both Files are not encrypted.
Data.lrs: various file paths included
Data.lrf: only data included
........
maybe there are only a few bits added / removed:
all fileformats included in the client (bmps , tgas, etc) have been editet like this (there have just a few bits been added bevore the headers) + rename to fantasy fileformat...
so i guess the archiv has been modified in a similar way.
But all modifications @ files and attemps to extract via various tools resulted negative
........
I´ve decompiled the game.exe
tried to find out how the exe is accessing the archiv
no chance untill now ... :/
Thx 4 help / ideas
sry for bad english
Re: unknown Archiv MMO
Posted: Wed Oct 13, 2010 7:03 pm
by kataclysm
*update*
traced the exe
start: first call of ".lrs" / ".lrf"
eof: random loading of files out of the archiv *i guess*
trace.7z
Re: unknown Archiv MMO
Posted: Fri Oct 15, 2010 1:49 pm
by kataclysm
*update*
game.exe loaded into OllyDBG 2
Search for -> Names
All the imports and exports @ dll s are listed now.
plus:
Code: Select all
Adress: 00400000 Type: Analyser | Name: <STRUCT IMAGE_DOS_HEADER>
Adress: 00400120 Type: Analyser | Name: <STRUCT IMAGE_NT_SIGNATURE>
Adress: 00400124 Type: Analyser | Name: <STRUCT IMAGE_FILE_HEADER>
Adress: 00400138 Type: Analyser | Name: <STRUCT IMAGE_OPTIONAL_HEADER>
Adress: 00400198 Type: Analyser | Name: <STRUCT IMAGE_DATA_DIRECTORY>
Adress: 00400218 Type: Analyser | Name: <STRUCT IMAGE_SECTION_HEADER>
Adress: 00400240 Type: Analyser | Name: <STRUCT IMAGE_SECTION_HEADER>
Adress: 00400268 Type: Analyser | Name: <STRUCT IMAGE_SECTION_HEADER>
Adress: 00400290 Type: Analyser | Name: <STRUCT IMAGE_SECTION_HEADER>
maybe they can tell me what to do? (asm)
but where can i find the code?
first visible address in modul game (cpu main thread) is 00401000
(in executable modules list the base of modul game is: 00400000 - so if it´s there ... how can i take a closer look?)
crypt.32.dll is also listed @ executable modules list. but no imports /exports.
Re: unknown Archiv MMO
Posted: Sat Oct 23, 2010 1:08 am
by kataclysm
*update*
found out what these analyser types are
since noone is able to help ... so it seems ... im trying now to identify the archiv access related functions within the main.exe.
... any tipps, infos or help would be nice
Re: unknown Archiv MMO
Posted: Sat Oct 23, 2010 1:55 am
by chrrox
what is the mmo
Re: unknown Archiv MMO
Posted: Sun Oct 24, 2010 1:24 pm
by kataclysm
Laghaim Korea
*update*
at about 95% of the games functions are restored now
going deeper into it...
Re: unknown Archiv MMO
Posted: Fri Dec 17, 2010 12:28 pm
by kataclysm
*update*
had not much time the last months but i found what ive searched for.
And ive learned a lot since then XD
Unfortunatly I dont have enough time to learn c++ as well to write a tool
+ understand exactly what the pseudocode functions do that ive localised responsible for archiv file eccess.
Im not sure if i should post this stuff here cause its public and thats a lot of code but if someone likes to take a look at it ... (and create `n extractor tool
)
Re: unknown Archiv MMO
Posted: Fri Dec 17, 2010 7:44 pm
by chrrox
post what you found and someone may be able to help.
Re: unknown Archiv MMO
Posted: Sun Dec 19, 2010 6:17 am
by kataclysm
hm as mentioned thats a lot of stuff ...
there are a lot functions following plus the needed links to the used global variables in the data area of the game.exe (+ the functions injecting values in these ones) ...
Re: unknown Archiv MMO
Posted: Wed Jul 25, 2012 7:38 pm
by bigsam
kataclysm, do you still have this information?
And do you have any update about this matter?