NPA: Difference between revisions
Line 17: | Line 17: | ||
| ? Bytes || Protected Index Data || | | ? Bytes || Protected Index Data || | ||
|- | |- | ||
| ? Bytes || File Data || | | ? Bytes || Protected File Data || | ||
|} | |} | ||
Revision as of 17:24, 7 July 2015
Used in the following game(s):
- Demonbane
- Steins;Gate
May be more than one version and possibly using one or more methods for obstructing data.
Structure
Overall | ||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Size | Content | Description | ||||||||||||
4 Bytes | Index Size | |||||||||||||
? Bytes | Protected Index Data | |||||||||||||
? Bytes | Protected File Data |
Index | ||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Size | Content | Description | ||||||||||||
4 Bytes | File count | |||||||||||||
Index Entry | ||||||||||||||
4 Bytes | Filename Length | |||||||||||||
? Bytes | Filename | |||||||||||||
4 Bytes | File Size? | |||||||||||||
4 Bytes | Offset? | |||||||||||||
4 Bytes | Unknown |
Research
The index data is protected. The way the program reads and processes this space is by first loading 4 bytes at the start of the file that is the size of the protected index. It then loads the whole index into memory. It then puts some data into the XMM0 register, which looks like the key. So far, it looks like it's static but I'll have to check if that's true for other files. It then enters the main decoding loop and loads 16 bytes into the next register, XMM1. It then XOR XMM1 by XMM0. It then puts the decoded part back into memory.
Some notes about structure. File names appear to be 2 byte char strings (wstrings?).
Key = BD AA BC B4 AB B6 BC B4