SqPack
Used in the following game(s):
- Final Fantasy XIV: A Realm Reborn
Common file names:
- <hex>.win32.dat0
- <hex>.win32.dat1
- <hex>.win32.dat2
- <hex>.win32.index
- <hex>.win32.index2
Structure
| Header | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Size | Content | Description | ||||||||||||
| 6Bytes | Magic | SqPack | ||||||||||||
| 6Bytes | Padding? | |||||||||||||
| 4Bytes | Unknown | |||||||||||||
| 4Bytes | Unknown | |||||||||||||
| 4Bytes | Unknown | |||||||||||||
| 8Bytes | Unknown | |||||||||||||
| 4Bytes | Unknown | FF FF FF FF | ||||||||||||
Research
Probably going to be a pretty tough one to figure out. Lots of padding used in index at the very least. Unknown if compression is used. No obvious file names seen. Going to need to use a dissembler however using a debugger might not be wise nor work due it being an MMO so can't do a step by step instruction kind of thing without risk of exposing my account. Though... not that it would really matter. All I need the game engine to initialize and start. Could take over once it is at login screen and block connection with firewall. Just need to see how data is handled. Would really suck if file names are stored inside EXE but that doesn't make much sense. Filenames are probably just built in memory rather than stored in the EXE, hardcoded. Indexes don't look consitant. Need to compare to other files. First step I suppose is checking process/file monitor to see how much data is reads from the files at a time. Only including "win32.index" and "win32.dat" for filter. I remember once they had command line arugments in plaintext that would point to a data director and session ID and stuff. Seems they fix that long ago after they heard hackers were lifting people's sessions ID's to hijack accounts cause for some stupid reason, the sessions were valid until another one was generated.
Notes: Because this is an MMO, I will only be making unpacking tools.