Luigi Auriemma

aluigi.org (ARCHIVE-ONLY FORUM!)
It is currently 19 Jul 2012 12:32

All times are UTC [ DST ]





Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 4 posts ] 
Author Message
 Post subject: Dragon Ball Raging Blast....compression?
PostPosted: 01 May 2010 20:05 

Joined: 01 May 2010 19:57
Posts: 2
Hello,
Looking for a little bit of help as i suck at compression methods, heh. i am currently only assuming the data is compressed given the information i see in the file, but i could be wrong. Any help figuring things out would be appreciated. Also if you know of any good resources or tips on picking out compression methods, that would be useful.

Code:
struct STPZ_HEADER // appears to be big endian
{
   uint32 fileTag; // "STPZ"
   uint32 unknown0x04;
   uint32 unknown0x08;
   uint32 unknown0x0C;
};

struct _0DCS_HEADER // appears to be little endian
{
   uint32 fileTag; // "0DCS"
   uint32 uncompressedSize;
   uint32 compressedSize; // size of section? - includes this header
   uint32 unknown0x0C; // maximum uncompressed block size? - have not seen '0LCS' sections bigger than this size, but not sure if this is related
};

struct _0LCS_HEADER // appears to be little endian
{
   uint32 fileTag; // "0LCS"
   uint32 uncompressedSize;
   uint32 compressedSize; // size of section? - includes this header
   uint32 unknown0x0C;
};


Also what method do you usually use to extract usable code directly from a disassembled executable?

Thanks in advance.


Attachments:
File comment: sample files from extracted archives
extract.rar [178.46 KiB]
Downloaded 66 times
Top
 Profile  
 
 
 Post subject: Re: Dragon Ball Raging Blast....compression?
PostPosted: 01 May 2010 20:26 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
I already saw that topic on xentax but no, there are no news.
not much luck using the comtype scanner of quickbms with the data starting from offset 0x38.

for the "compression" I can't help at all.

while for ripping the function you need to have some knowledge of reversing and assembly and most depends by the function itself.
a simple function or a set of functions (all the calls are relative so it's the same as one function) without static buffers is a joke to dump and use on the fly.
while a function with static references (mov eax, dword[00123456+eax*4]) requires a bit of more time and some function could use particular arguments that differ from the usual "input input_size output output_size" or even make usage of calls to ReadFile.


Top
 Profile  
 
 Post subject: Re: Dragon Ball Raging Blast....compression?
PostPosted: 01 May 2010 20:52 

Joined: 01 May 2010 19:57
Posts: 2
Ah, ok. wasn't aware you had already seen it. apologies in that regard then.

i usually end up just re-implementing the method by hand from looking at the disassembled code, as it is often easier to maintain than a direct assembly code dump.

Well, thanks for even taking the time to look into it. i will have to see what i can make out from the ppc assembly from the main executable. The way it references memory can be a pain to step through at times as even ida cant always make out the references if they are redirected through other registers or the rtoc table. x86 and mips are far easier in this regard.


Top
 Profile  
 
 Post subject: Re: Dragon Ball Raging Blast....compression?
PostPosted: 01 May 2010 22:35 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
ah ok, if it's not x86 then the "function dumping" idea can't be applied.


Top
 Profile  
 
Display posts from previous:  Sort by  
Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 4 posts ] 

All times are UTC [ DST ]


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
cron