aluigi wrote:confirmed, it's XMemDecompress

how to find XMemDecompress functions?
in one dll of the dlls in the bin directory?

Mr.Mouse wrote:Good, now thank me by clicking the <thank post> button dammit! Do you realise the amount of work that has gone into deciphering this format and programming that tool?

I do. This tool is great.

OK.it works on the updated vfs files.
Thank you,Mr.Mouse.

it works on .vfs in patch file, not xxz.vfs.

The contents of this post was deleted because of possible forum rules violation.

well.plz ignor errors and I will try again. I don't know how to use filecutter.
thanks.

Crash again.
I can extract all files from xxz.vfs before updating client, and I can extract files from res_patch.vfs in the patch file.
here 's debug.txt.
Thks.

Mr.Mouse wrote:http://www.xentax.com/?p=223 There's an update.

Great Done!Thks Mr.Mouse.

when analyzing xxz.vfs archive (618,389,304 bytes after updating the game client), it occurs:

Mr.Mouse wrote:I'll have a tool for you ready soon.

Thanks!

form xxshell dump files, we can find some xml file(book.xml, item.xml ,etc.) . but there're not in out-folder.maybe their size are so large that quickbms can't extract them from vfs file.

there're 13128 files in out-folder. but while extracting, many files were overwritten by files with same filename.so > 13128. maybe there are many files which have same filename in diff directorys.

ok.it works.
but quickbms sends error information after extracting 13128 files from zzx.vfs.

Great work! OPEN vfs.dll with ida pro, and we find: push offset aVfsStartReadFd ; "[VFS]Start Read fdt" call sub_100033B8 pop ecx mov ecx, [ebp+var_2C] mov eax, [ecx] push esi push offset a_?fdt ; ".?fdt" call dword ptr [eax+8Ch] cmp eax, edi mov [ebp+var_34], eax mov ecx, esi jz...

Thanks!

after installation of game, we can launch the client and enter game account(acc:869222041,pwd: xentaxforum).then it will give error information,we can dump the xxzshell with hxd. and now we can find the filenames of all file and other information.

The contents of this post was deleted because of possible forum rules violation.