Difference between revisions of "DAT (Ever17)"

From Game Research Wiki
Jump to navigation Jump to search
 
(40 intermediate revisions by the same user not shown)
Line 1: Line 1:
[[Category:Archives]]
[[Category:Archives]]
 
Used in the following game(s):
Seen/used in the follow game(s):
* Ever17 (PC)
* Ever17


== Structure ==
== Structure ==
Line 14: Line 13:
| 4Bytes|| File Count ||
| 4Bytes|| File Count ||
|-
|-
| 8Bytes|| 0x00 Filler ||
| 8Bytes|| Padding || 0x00
|-
|-
!colspan="15"|Index
!colspan="15"|Index
Line 22: Line 21:
| 4Bytes || Offset || Starts from zero.
| 4Bytes || Offset || Starts from zero.
|-
|-
| 4Bytes|| File Size || Stored value is actual size doubled
| 4Bytes|| File Size || Stored value is double the actual size
|-
|-
| 24Bytes|| File name ||
| 24Bytes|| File name || Unused space will be padding (0x00).
|}
|}


Notes for 'wallpaper.dat'
== Notes ==
Extracting images straight from the container file will produce broken images. There is nothing wrong with the extraction process but rather the files themselves. Starting from offset 4352 and ending at 4608 in every single JPG, this 256 byte has been modified in some way.  
The files inside saver.dat, sysvoice.dat, and wallpaper.dat for Ever17 have had a small chunk data obfuscated. From offset 0x1100 to 0x1200 (256 bytes), data has been modified which breaks/corrupts the file. To undo this modification requires generating numbers to subtract from each byte in the affected area.
 
To generate these numbers, start off by adding each character in the file name of the file in question together, byte-by-byte. For example: 'test' 0x74 0x65 0x73 0x74 = 0x1C0 and then truncate the number down to 1 byte so 0xC0. This would be the first difference number out of the 256. The rest of the numbers are generated by using the previous number in a series of calculations.
* 1.) temp = previousNum + (previousNum * 2)
* 2.) temp = temp + (temp * 8)
* 3.) nextNum = previousNum + (temp * 4) + 1243
Note: This can probably be optimized to one statement to make it more readable.
 
y = x + (((x + (x * 2)) + (x + (x * 2) * 8))* 4) + 1243
 
y = 81x + 1243


There is a subroutine in the EXE that will take 1 byte from the JPG that is stored in memory, subtracted it by a number, then put it back. It does this 256 times, or the whole 256 byte chunk of data that is obstructed and only for locations between 4352 and 4608. The number that is subtracted from the raw value is not the same for each byte.
nextNum = (81 * previousNum) + 1243;


Subtraction numbers are generated by adding up the 14 characters i the file name and taking the last value (looking at it like a 8 bit number so, if total is 0x00000AE4, you only take E4). This is the first difference number out of 256, numbers then use the previous number to make the new number so... Please note, the case of the letters in the file name is important!
A C++ representation.
<syntaxhighlight lang="cpp">
unsigned char diff_array[256];


'a' starts off as the value of the previous number.
void diff_gen(std::string &incoming_filename)
{| class="wikitable"
{
|-
char firstValue = 0;
! Order !! Expression
for (int i = 0; i < incoming_filename.size(); i++) //Better be 14 bytes... Though adding 0x00 shouldn't affect output.
|-
{
| 1|| d = a + (a*2)
firstValue += incoming_filename[i];
|-
}
| 2 || d = d + (d*8)
 
|-
diff_array[0] = firstValue;
| 3|| a = a+(d*4)+1243
|}


One unknown thing so far that needs to be figured out for a condition that will do the following<br />
for (int i = 1; i < 255; i++)
0040D25F and    eax, 8000FFFFh<br />
{
0040D264 jns    short loc_40D26D<br />
                diff_array[i] = diff_array[i - 1] * 81 + 1243;
}
}
</syntaxhighlight>


My not even been needed. Changes register from 0x00000AE4 to 0x000000E4 for example.
== Tools ==
-n/a-

Latest revision as of 23:19, 5 October 2016

Used in the following game(s):

  • Ever17 (PC)

Structure

Header
Size Content Description
4Bytes Magic/ID
4Bytes File Count
8Bytes Padding 0x00
Index
Size Content Description
4Bytes Offset Starts from zero.
4Bytes File Size Stored value is double the actual size
24Bytes File name Unused space will be padding (0x00).

Notes

The files inside saver.dat, sysvoice.dat, and wallpaper.dat for Ever17 have had a small chunk data obfuscated. From offset 0x1100 to 0x1200 (256 bytes), data has been modified which breaks/corrupts the file. To undo this modification requires generating numbers to subtract from each byte in the affected area.

To generate these numbers, start off by adding each character in the file name of the file in question together, byte-by-byte. For example: 'test' 0x74 0x65 0x73 0x74 = 0x1C0 and then truncate the number down to 1 byte so 0xC0. This would be the first difference number out of the 256. The rest of the numbers are generated by using the previous number in a series of calculations.

  • 1.) temp = previousNum + (previousNum * 2)
  • 2.) temp = temp + (temp * 8)
  • 3.) nextNum = previousNum + (temp * 4) + 1243

Note: This can probably be optimized to one statement to make it more readable.

y = x + (((x + (x * 2)) + (x + (x * 2) * 8))* 4) + 1243

y = 81x + 1243

nextNum = (81 * previousNum) + 1243;

A C++ representation.

unsigned char diff_array[256];

void diff_gen(std::string &incoming_filename)
{
	char firstValue = 0;
	for (int i = 0; i < incoming_filename.size(); i++) //Better be 14 bytes... Though adding 0x00 shouldn't affect output.
	{
		firstValue += incoming_filename[i];
	}

	diff_array[0] = firstValue;

	for (int i = 1; i < 255; i++)
	{
                diff_array[i] = diff_array[i - 1] * 81 + 1243;
	}
}

Tools

-n/a-