Page 1 of 1

MS-OXRTFCP compression format

Posted: Sun Apr 08, 2012 6:03 pm
by gooms9
Hello, I'm trying to decompress a block of data from an XBox 360 archive (Kinect Disneyland Adventures). I've run the data through quickbms, but didn't find any solid matches. However, the output created by COMP_LZFU_RAW did seem to provide some interesting results. I noticed some strings in the decompressed output like

Code: Select all

\fdecor MS ... and \fmodtbl....{\rtf1\ans !MS Sans SerifSym.oman \f.
I googled fdecor MS and the first link was to a microsoft compression protocol called MS-OXRTFCP. http://msdn.microsoft.com/en-us/library ... g.80).aspx Does anyone have any experience with this format or know of a tool that I can run my data through to verify weather it's the compression algorithm I'm looking for?


Here is a sample of the files i'm trying to decompress in case anyone else has any good ideas! http://cl.ly/1R411l2e1u2L3N1l0U03
Thanks

Re: MS-OXRTFCP compression format

Posted: Mon Apr 09, 2012 10:17 am
by aluigi
don't consider the lzfu compression.
it's specifical for rtf output, that's why you see those text strings in it

I have scanned the file but I don't see interesting output but I don't know what's the original content (text, image or raw) so this doesn't help.

Re: MS-OXRTFCP compression format

Posted: Tue Apr 10, 2012 3:22 am
by gooms9
Thanks, you just saved me from a wild goose chase. I think I'll decompile the binary and see if I can figure out what's going on from that.