Orin at 01:58, 31 December 2017

2017-12-31T01:58:48Z

← Older revision		Revision as of 01:58, 31 December 2017
Line 1:		Line 1:
	Another Bruns format.		Another Bruns format.

	~~This appears~~ to be ~~script data~~. ~~Seems to be protected in a specific way~~. ~~First 3~~ bytes ~~might be an ID from what debugger shows~~ that is ~~being checked~~. ~~Data afterwards might be~~ the ~~actual~~ data. ~~First 8 bytes~~ might be ~~used in validation~~ and ~~maybe part of~~ the ~~protection~~. ~~Still looking into this~~...		After loading the entire file into memory, the program will then attempt to validate the file by comparing the first few bytes. Usually 0x45, 0x45 and 0x4E. The forth byte may be different depending on the file type being loaded. Script files are 0x5A and image files (?) are 0x43. The next 4 bytes after that is the uncompressed file size. The rest of the data is probably the compressed/protected data space. The validation process does branch off a bit but I didn’t explore the alternative paths much. I did do some testing and found the engine will load unprotected/uncompressed files with no issue so this branching might be checking if the file is protected and type but if it doesn’t match, it treats it as unprotected.


			I haven’t figured out the decompression/decryption process yet so this was just dumped from memory.


			Also, the music files, which end in *.um3 are just Ogg files XOR by 0xFF.


			This is based on a random game I downloaded which was labled as using “Bruns2.01”. The executable for the game I used wasn’t protected so debuggers worked fine.


			(Am I the only one that keeps typing it as “Burns” rather than “Bruns”? ^^;)

Orin: Created page with "Another Bruns format. This appears to be script data. Seems to be protected in a specific way. First 3 bytes might be an ID from what debugger shows that is being checked. Da..."

2017-12-30T01:01:44Z

Created page with "Another Bruns format. This appears to be script data. Seems to be protected in a specific way. First 3 bytes might be an ID from what debugger shows that is being checked. Da..."

New page

Another Bruns format.

This appears to be script data. Seems to be protected in a specific way. First 3 bytes might be an ID from what debugger shows that is being checked. Data afterwards might be the actual data. First 8 bytes might be used in validation and maybe part of the protection. Still looking into this...

BSO - Revision history

Orin at 01:58, 31 December 2017

Orin: Created page with "Another Bruns format. This appears to be script data. Seems to be protected in a specific way. First 3 bytes might be an ID from what debugger shows that is being checked. Da..."