Call of Duty : MW2 fast file

[Gagarin]

Hey there guys. yesteaday was release MW2.

Can someone help me with extracting source files ?

Here is an example

[aluigi]

there is a zlib block in the middle which contains the 2 files I have attached.
the rest of the data is unknown, not xor/rot with a fixed byte and if it's compressed it uses an unknown algorithm

[Gagarin]

thx. How u can extracted them ?

previous fast file version contains 12-bytes header and zlib archive "78 DA"

But now in this version I didn't know how to extract them. Now .ff have 13 (??) bytes header and no zlib bytes

[aluigi]

I simply extracted the first block at offset 0x4015 through a scanning with offzip.
then I opened the extracted file and noticed it had other zlib blocks in it and so I did another scan and renamed the files using the names found in that file before the zlib blocks.

[Gagarin]

ahhh, it's hard for me =(

Can u write about ur "manual" more detailed ? If is not so hard ,surely

[aluigi]

ok, I try.
I have used offzip for the job.
I didn't know what type of data was contained in the file so I launched offzip in scan mode for checking if there was a zlib block somewhere:

Code: Select all

offzip -S localized_code_pre_gfx_mp.ff 0 0

and it reported a block at offset 0x4015 so I launched it in scan+extract mode to dump it:

Code: Select all

offzip -a localized_code_pre_gfx_mp.ff output_folder 0

now I opened the obtained file 00004015.dat with a hex editor to check what it contained and I noticed the 0x78 byte after the first filename "default_mp.cfg" so I simple did the same as before launching offzip with -S and then -a for extracting the compressed zlib blocks.

the last step was renaiming the two files using the names found in that file.
that's all

[Gagarin]

ok, thx so much. all works fine i'm extracter two .dat files. But I didn't understnd what names are they. I mean how I can rename them right ?

[aluigi]

if you watch in 00004015.dat you see a name at offset 0x68 followed by the zlib data, that's the first name of the first dumped file.
the second one is at offset 0x13e

[Gagarin]

ok , thx , all working fine now

well, this method is good for few-some files. But if I extracted much files in different folders - it's so hard to rename them and put into right folders

thx again

[aluigi]

this is NOT a definitive method, I simply told you how I got those 2 files but there is all the rest of the FF archive to figure first

[Gagarin]

I understood. Do u have any ideas how to extract files more easily ?

[Gocha]

Any clue where should be game font(s) & sub-text, if I want to translate it

[Savage]

Activision don't like modding in CODmw2 maybe this is the reason the ff's of multiplayer are crypted.
And more info here:
viewtopic.php?p=33117#p33117

[Caboose]

The files ending or starting with "_mp" will not load if they're modified on the Xbox 360, they encrypt a hash with RSA. I'm not sure if they do the same for the PC files.

[iamLXM]

The files ending or starting with "_mp" will not load if they're modified on the Xbox 360, they encrypt a hash with RSA. I'm not sure if they do the same for the PC files.

compraring with COD4:MW, every .ff file related to MP is encrpted, add some byte to check the file between offset 00 000CH - 00 4014H , total 16,393 Bytes. After 00 4015H, it is a zlib block after 00 4014H, the same to COD4:MW .ff.

I wonder who can recovering the iw4mp.exe to cr*ck the .ff