oh sorry, I forgot, you have to decompress the file first, I did this for your example file, see here, simply skip the first 8 bytes and decompress the rest as a single zlib blob

greetz WV

here, I was bored, it extracts some tga's, but not all of them are useful, so this needs more guessing than mine, have a nice day

greetz

its encrypted, you need to supply at least the exe to have a chance

greetz

someone asked me about this, so I looked into it, its just a simple XOR encryption: class Program { static byte[] key = { 0x0B, 0xAD, 0xF0, 0x0D }; static void Main(string[] args) { if (args.Length != 1 || !File.Exists(args[0])) { ShowUsage(); return; } byte[] input = File.ReadAllBytes(args[0]); for...

you need to post a dumped exe first, without the code that reads the upk how should anyone guess it?

greetz

quick and dirty, there you go...


greetz WV

to the "unknown" parts, they probably store some additional settings you can set with bonds watch. previously unknown2 = volume sliders! (higher/left byte = music volume, lower/right byte = fx volume, 0..255, not visible in new tool, unk3 is now unk2) and here the list of cheat flags for t...

ok, all done now, edited the first post with the links, see y'all

greetz

ok nvm, I think I solved it^^ https://i.imgur.com/cSMKYI7.png here the hashfunction in C#: static UInt64 Hash(byte[] data) { uint seedLo = 0x3108B3C1; uint seedHi = 0x8F809F47; uint s1 = 0; UInt64 resultHi = 0; UInt64 resultLo = 0; for (int i = 0; i < data.Length; i++) { byte t8 = data[i]; uint t9 =...

more updates: CODE:80051EC0 readSaveGame CODE:800CF530 makeHash the hash is made with a seed as input, which is reused on next call of it, thats why different slots with the same data have different hashes, anyone wanna help me reverse that function? im already delving into it^^ greetz

https://github.com/zeroKilo/RLExplorerWV try my tool, is with source

greetz

just a little update on this:


I traced the calls back 3 caller functions (by stepping through every subfunction), one way leads to eeprom_access as write access and one as read access

greetz

well not much news, I just used the visual studio debugger to step the cpu and trace where the call came from, sofar I got: CODE:80015ED0 eeprom_access: //the function I first found, does one write access / 8 bytes CODE:80015340 eeprom_access2://calls above function twice, does at least one write ac...

https://pastebin.com/BzRVPvHS CODE:80015F40 loc_80015F40: # CODE XREF: writeEEpromLine+54↑j CODE:80015F40 3C 09 1F C0 35 29 07 C0 li $t1, 0x1FC007C0 # Load Immediate CODE:80015F48 3C 0A A4 80 lui $t2, 0xA480 # Load Upper Immediate #actual write to eeprom CODE:80015F4C AD 49 00 10 sw $t1, 0xA4800010...

https://pastebin.com/EzGqRN7G reads all times now! interestingly 10bit * 20 times = 200 bit needed; 200 bit / 8 bitPerByte = 25 bytes! (0x19) thats why the offsets are 0x19 far apart! (in bytes) Offset Agent Time : 0x12 Offset Secret Agent Time : 0x2B Offset 00 Agent Time : 0x44 so for one slot, th...