NPA: Difference between revisions
| Line 44: | Line 44: | ||
Some notes about structure. File names appear to be 2 byte char strings (wstrings?). | Some notes about structure. File names appear to be 2 byte char strings (wstrings?). | ||
Key = BD AA BC B4 AB B6 BC B4 | |||
Revision as of 17:16, 7 July 2015
Used in the following game(s):
- Demonbane
- Steins;Gate
May be more than one version and possibly using one or more methods for obstructing data.
Structure
| Overall | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Size | Content | Description | ||||||||||||
| 4 Bytes | Index Size | |||||||||||||
| ? Bytes | Protected Index Data | |||||||||||||
| ? Bytes | File Data | |||||||||||||
| Index | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Size | Content | Description | ||||||||||||
| 4 Bytes | File count | |||||||||||||
| Index Entry | ||||||||||||||
| 4 Bytes | Filename Length | |||||||||||||
| ? Bytes | Filename | |||||||||||||
| 4 Bytes | Unknown | |||||||||||||
| 4 Bytes | Unknown | |||||||||||||
| 4 Bytes | Unknown | |||||||||||||
Research
The index data is protected. The way the program reads and processes this space is by first loading 4 bytes at the start of the file that is the size of the protected index. It then loads the whole index into memory. It then puts some data into the XMM0 register, which looks like the key. So far, it looks like it's static but I'll have to check if that's true for other files. It then enters the main decoding loop and loads 16 bytes into the next register, XMM1. It then XOR XMM1 by XMM0. It then puts the decoded part back into memory.
Some notes about structure. File names appear to be 2 byte char strings (wstrings?).
Key = BD AA BC B4 AB B6 BC B4