📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Target Specific - General  >>  File Formats

Topic created on: June 29, 2006 19:43 CDT by BloodyShade .

Hi there people, it's my first topic here.
I'm still a novice at reversing and my assembly skills aren't that great, but I want to document a file format of a game(or at least know how it works).
The game name is Darkeden, and the version I'm trying to get info is the Chinese one.
Well, I don't know how to start this ^^ I was trying to debug the main exe file and try to understand how it reads the files, no luck :/
After some google searching, I've met this site, and I've read a topic made by Daeken, about file formats, no luck searching for zlib compressed data. I think it has it's own kind of compression or else.
I've noted that for the image files, there are always some kind of really small sized files with the same name with a 'i' in the end of the ext. Which "I think", that is some kind of information file. (like: SkillIcon.spk and SkillIcon.spki)
Still they don't make sense to me Oo.
If someone could help me out with this..

Thanks for the support,
Bye

  igorsk     June 30, 2006 06:43.49 CDT
Well, for start you could check files with a hex editor to see if there are some common patterns. E.g. if they all have the same signature (first few bytes), you can try looking for it in the exe; this way you will find the place where the files are parsed.

  BloodyShade   June 30, 2006 22:56.47 CDT
Well, looks like there is some kind of pattern, but they aren't the same thing in all files, like:
In one: 0D 00 36 00 36 00 39 00 01 00 00 00 36
Other : 09 00 37 00 46 00 3A 00 01 00 00 00 37
Like this, looks like they follow a kind of pattern as I said,  but I need to analyze this better, I think I've found the function that reads these files(in the main .exe) but I can't understand much of it ^^

Thanks for the help,
Bye

  MohammadHosein     July 2, 2006 13:53.18 CDT
www.blackhat.com/presentations/bh-jp-05/bh-jp-05-sutton-greene.pdf

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit