QiuckBMS and .arc files
Posted: Sun Apr 15, 2012 9:55 am
well hi there
,
so im trying my first attempts with QuickBMS to extract some sort of .arc file.
i know there might be some tools that works allready, but i really wanna learn to make this myself.
Heres i show u the start part of its file :

so as we can see we got 9 files
From start of file :
1. long is the idstring
2. short is some unkown yet
3. short are the files number
4. getdstring NAME 0x40 (including the 0's) is the filename
5. now heres the first long which i predict is the filetype of the archived file. so : get FILETYPE long
- first file : 07 D5 90 9F
6. get ZSIZE long (compressed)
- first file : 00 00 01 F0
7. get SIZE long (decompressed)
- first file : 00 00 8E 52
8. get OFFSET long (start offset of file)
- first file : 00 00 02 D8
When we look at our offset 0x2D8 we see the header : "68 81" which is some rare zlib compression header.
ok so now i have build a little script.
quickbms reverses all the values, which it shouldnt do because i.e. the offset "00 00 02 D8" should be "00 00 02 D8", but quickbms does "D8 02 00 00".

so my question is how i tell quickbms to not reverse my values?
another question would be: as i said the header of the beginning file is 68 81 (zlib compression) how do i decompress the unpacked file?
Thanks so much.
so im trying my first attempts with QuickBMS to extract some sort of .arc file.
i know there might be some tools that works allready, but i really wanna learn to make this myself.
Heres i show u the start part of its file :

so as we can see we got 9 files
From start of file :
1. long is the idstring
2. short is some unkown yet
3. short are the files number
4. getdstring NAME 0x40 (including the 0's) is the filename
5. now heres the first long which i predict is the filetype of the archived file. so : get FILETYPE long
- first file : 07 D5 90 9F
6. get ZSIZE long (compressed)
- first file : 00 00 01 F0
7. get SIZE long (decompressed)
- first file : 00 00 8E 52
8. get OFFSET long (start offset of file)
- first file : 00 00 02 D8
When we look at our offset 0x2D8 we see the header : "68 81" which is some rare zlib compression header.
ok so now i have build a little script.
quickbms reverses all the values, which it shouldnt do because i.e. the offset "00 00 02 D8" should be "00 00 02 D8", but quickbms does "D8 02 00 00".

so my question is how i tell quickbms to not reverse my values?
another question would be: as i said the header of the beginning file is 68 81 (zlib compression) how do i decompress the unpacked file?
Thanks so much.