NPA: Difference between revisions
Jump to navigation
Jump to search
No edit summary |
No edit summary |
||
| Line 17: | Line 17: | ||
| ? Bytes || Index Data || | | ? Bytes || Index Data || | ||
|} | |} | ||
== Research == | |||
The index data is protected. The way the program reads and processes this space is by first loading 4 bytes at the start of the file that is the size of the protected index. It then loads the whole index into memory. It then puts some data into the XMM0 register, which looks like the key. So far, it looks like it's static but I'll have to check if that's true for other files. It then enters the main decoding loop and loads 16 bytes into the next register, XMM1. It then XOR XMM1 by XMM0. It then puts the decoded part back into memory. | |||
Some notes about structure. File names appear to be 2 byte char strings (wstrings?). | |||
Revision as of 16:02, 7 July 2015
Used in the following game(s):
- Demonbane
- Steins;Gate
May be more than one version and possibly using one or more methods for obstructing data.
Structure
| WIP | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Size | Content | Description | ||||||||||||
| 4 Bytes | Index Size | |||||||||||||
| ? Bytes | Index Data | |||||||||||||
Research
The index data is protected. The way the program reads and processes this space is by first loading 4 bytes at the start of the file that is the size of the protected index. It then loads the whole index into memory. It then puts some data into the XMM0 register, which looks like the key. So far, it looks like it's static but I'll have to check if that's true for other files. It then enters the main decoding loop and loads 16 bytes into the next register, XMM1. It then XOR XMM1 by XMM0. It then puts the decoded part back into memory.
Some notes about structure. File names appear to be 2 byte char strings (wstrings?).