NPA
Used in the following game(s):
- Demonbane
- Steins;Gate
May be more than one version and possibly using one or more methods for obstructing data.
Structure
| Overall | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Size | Content | Description | ||||||||||||
| 4 Bytes | Index Size | |||||||||||||
| ? Bytes | Protected Index Data | |||||||||||||
| ? Bytes | File Data | |||||||||||||
| Index | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Size | Content | Description | ||||||||||||
| 4 Bytes | File count | |||||||||||||
| Index Entry | ||||||||||||||
| 4 Bytes | Filename Length | |||||||||||||
| ? Bytes | Filename | |||||||||||||
| 4 Bytes | File Size? | |||||||||||||
| 4 Bytes | Offset? | |||||||||||||
| 4 Bytes | Unknown | |||||||||||||
Research
The index data is protected. The way the program reads and processes this space is by first loading 4 bytes at the start of the file that is the size of the protected index. It then loads the whole index into memory. It then puts some data into the XMM0 register, which looks like the key. So far, it looks like it's static but I'll have to check if that's true for other files. It then enters the main decoding loop and loads 16 bytes into the next register, XMM1. It then XOR XMM1 by XMM0. It then puts the decoded part back into memory.
Some notes about structure. File names appear to be 2 byte char strings (wstrings?).
Key = BD AA BC B4 AB B6 BC B4