YPF - Revision history

Orin: /* Structure */

2015-03-31T07:08:17Z

Structure

← Older revision		Revision as of 07:08, 31 March 2015
Line 25:		Line 25:
	\| 4Bytes\|\| Unknown1 \|\|		\| 4Bytes\|\| Unknown1 \|\|
	\|-		\|-
	\| 1Bytes\|\| Filename Length \|\| XOR 0xFF, then table lookup.		\| 1Bytes\|\| Filename Length \|\| XOR 0xFF, then table lookup (see below).
	\|-		\|-
	\| ?Bytes\|\| Filename \|\| XOR 0xFF then XOR 0x40		\| ?Bytes\|\| Filename \|\| XOR 0xFF then XOR 0x40

Orin: /* Comments */

2015-03-31T07:07:51Z

Comments

← Older revision		Revision as of 07:07, 31 March 2015
Line 42:		Line 42:
	==Comments==		==Comments==
	To decode the filenames, each byte in the filename is XOR by 0xFF and then 0x40. However, the filenames are not null terminated so 1 byte is stored before the filename that represents the the filename's length. This value is protected like the filename but is slightly different (as far as I can tell). XOR by 0xFF and then do a table lookup.		To decode the filenames, each byte in the filename is XOR by 0xFF and then 0x40. However, the filenames are not null terminated so 1 byte is stored before the filename that represents the the filename's length. This value is protected like the filename but is slightly different (as far as I can tell). XOR by 0xFF and then do a table lookup.
	The table is generated at runtime and swaps around 38 values ~~in the table~~.		The table is generated at runtime and swaps around a number of values.
	<syntaxhighlight lang="cpp">		<syntaxhighlight lang="cpp">
	char lookup(char incoming)		char lookup(char incoming)
Line 94:		Line 94:
	</syntaxhighlight>		</syntaxhighlight>

	~~Example~~: ~~0xEC ^ 0xFF = 0x13~~		ToDo:
	~~Table lookup 0x13 -> 0x0D~~		Figure out what the unknown values are for repacking function.
	~~Which means~~ the ~~filename length is 13.~~

	~~Nothing else appears protected (file sizes and offset) however there is still a few~~ unknown values ~~that will need to be researched if a packing tool is to be made.~~

	~~Not the most optimized method and I could still be overlooking something or not realizing something important.~~.~~. oh well. It works, right? ^^; Table can even work when repacking too! :D~~

Orin: Copied wrong, broken table. Replaced with working one.

2015-03-31T06:44:42Z

Copied wrong, broken table. Replaced with working one.

← Older revision		Revision as of 06:44, 31 March 2015
Line 54:		Line 54:
	case 0x0C:		case 0x0C:
	return 0x10;		return 0x10;
			case 0x0D:
			return 0x13;
	case 0x10:		case 0x10:
	return 0x0C;		return 0x0C;
Line 64:		Line 66:
	case 0x19:		case 0x19:
	return 0x11;		return 0x11;
	case ~~0x1b~~:		case 0x1B:
	return 0x15;		return 0x15;
	case 0x1C:		case 0x1C:
Line 80:		Line 82:
	case 0x2C:		case 0x2C:
	return 0x2F;		return 0x2F;
			case 0x2E:
			return 0x32;
	case 0x2F:		case 0x2F:
	return 0x2C;		return 0x2C;
			case 0x32:
			return 0x2E;
	default:		default:
	return incoming;		return incoming;

Orin at 15:46, 16 March 2015

2015-03-16T15:46:53Z

← Older revision		Revision as of 15:46, 16 March 2015
Line 94:		Line 94:
	Nothing else appears protected (file sizes and offset) however there is still a few unknown values that will need to be researched if a packing tool is to be made.		Nothing else appears protected (file sizes and offset) however there is still a few unknown values that will need to be researched if a packing tool is to be made.

	Not the most optimized method and I could still be overlooking something or not realizing something important... oh well. It works, right? ^^;		Not the most optimized method and I could still be overlooking something or not realizing something important... oh well. It works, right? ^^; Table can even work when repacking too! :D

Orin: /* Comments */

2015-03-16T06:04:09Z

Comments

@@ Line 44: / Line 44: @@
 The table is generated at runtime and swaps around 38 values in the table.
 <syntaxhighlight lang="cpp">
-unsigned char test[256],
+char lookup(char incoming)
+{
-	test[a] = a;
+	switch (incoming)
+}
 </syntaxhighlight>

Orin at 05:35, 16 March 2015

2015-03-16T05:35:19Z

← Older revision		Revision as of 05:35, 16 March 2015
Line 97:		Line 97:

	Nothing else appears protected (file sizes and offset) however there is still a few unknown values that will need to be researched if a packing tool is to be made.		Nothing else appears protected (file sizes and offset) however there is still a few unknown values that will need to be researched if a packing tool is to be made.

			Not the most optimized method and I could still be overlooking something or not realizing something important... oh well. It works, right? ^^;

Orin: /* Comments */

2015-03-16T05:31:52Z

Comments

← Older revision		Revision as of 05:31, 16 March 2015
Line 44:		Line 44:
	The table is generated at runtime and swaps around 38 values in the table.		The table is generated at runtime and swaps around 38 values in the table.
	<syntaxhighlight lang="cpp">		<syntaxhighlight lang="cpp">
	unsigned char test[~~0xFF~~],		unsigned char test[256],
	eax, ecx, edx;		eax, ecx, edx;

	for (int a = 0; a < ~~255~~; a++)		for (int a = 0; a < 256; a++)
	{		{
	test[a] = a;		test[a] = a;

Orin at 05:31, 16 March 2015

2015-03-16T05:31:17Z

← Older revision		Revision as of 05:31, 16 March 2015
Line 95:		Line 95:
	Table lookup 0x13 -> 0x0D		Table lookup 0x13 -> 0x0D
	Which means the filename length is 13.		Which means the filename length is 13.

			Nothing else appears protected (file sizes and offset) however there is still a few unknown values that will need to be researched if a packing tool is to be made.

Orin: /* Comments */

2015-03-16T05:30:35Z

Comments

@@ Line 41: / Line 41: @@
 ==Comments==
-Index data may be protected.
+To decode the filenames, each byte in the filename is XOR by 0xFF and then 0x40. However, the filenames are not null terminated so 1 byte is stored before the filename that represents the the filename's length. This value is protected like the filename but is slightly different (as far as I can tell). XOR by 0xFF and then do a table lookup.
-XOR by FF then XOR by 40 may work.
+for (int a = 0; a < 255; a++)

Orin: /* Structure */

2015-03-16T05:20:50Z

Structure

← Older revision		Revision as of 05:20, 16 March 2015
Line 25:		Line 25:
	\| 4Bytes\|\| Unknown1 \|\|		\| 4Bytes\|\| Unknown1 \|\|
	\|-		\|-
	\| 1Bytes\|\| Filename Length \|\| ~~Value protected~~		\| 1Bytes\|\| Filename Length \|\| XOR 0xFF, then table lookup.
	\|-		\|-
	\| ?Bytes\|\| Filename \|\| XOR 0xFF then XOR 0x40		\| ?Bytes\|\| Filename \|\| XOR 0xFF then XOR 0x40