RaiderZ filesystem

[chrrox]

This is the same compression used in tales of xillia

[iaw]

update!

The new version fileindex.msf ,can't unpack them


<link removed due forum rules violation>

[kudpro]

How to pack back?

[Jesemo]

Could someone make an mrf unpacker for the Alpha Test NA client? I will provide the fileindex.msf.

[Jesemo]

Could someone please help?

[Jesemo]

NO LINKS TO ORIGINAL FILES ALLOWED. Ban.

These files are from the Alpha Test of RaiderZ PWE.

[WRS]

tiny status update, but I will find time to work on the new clients.

only the initial scrambling has changed (same filelist formats, compression algos)

[Raider]

This is great! Thanks for working on it WRS.

[Raider]

WRS, do you have a new status update for us?

[Raider]

I hope you can help us, like making a guide to let the script unpack the new files.

[WRS]

so after nearly a month of idle progress, i've got something that has dumped the filesystem for me.

i've had to think about to how to package it for XeNTaX, so I'm using aluigi's self-described 'lame patcher' - http://aluigi.org/mytoolz.htm#lpatch

you need to read the instructions, and make sure you make a copy of your client's exe before you patch it!

NOTE
if you want to check individual progress, download a debug message viewer like http://technet.microsoft.com/en-us/sysi ... 96647.aspx

edit 4

had the pmang and pwe clients mixed up. hopefully this fixes everything. download: http://www.sendspace.com/file/ddtsr7


FS Changes

I have defined the fileindex.msf structure (which hasn't changed) as:

Code: Select all

//
//	fileindex.msf structure
//	20-bytes
//	
//	NOTE: FILEINDEX_ENTRY records follows a 1-byte compression flag
//
//		3 known types (RaiderZ only uses type 0)
//		
//		0	Compressed		Data should be fed through XorData() before decompressing
//		1	Compressed++	Data needs unscrambling, which converts it to type 0
//		2	Uncompressed	(GUNZ2 FSB) Raw data - BUT the values have been scrambled (TODO)
//
struct FILEINDEX_ENTRY
{
	DWORD size;		// Uncompressed filesize
	DWORD offset;	// MRF file position
	DWORD zsize;	// Size of compressed data
	DWORD xorkey;	// 
	short lenMRFN;	// MRF container name length
	short lenName;	// Filename length
};

Files with a compression byte of 0x0:

• Are first read into a memory buffer (from their container)
• Using the '.xorkey' attribute are xor'd in 32-bit chunks:
  

  Code: Select all

  	DWORD dBlocks = srcSize >> 2;
  	while( dBlocks )
  	{
  		DWORD tmp;
  		tmp = *(DWORD *)srcBuffer; // read 32-bit value
  		
  		xorkey += tmp;
  		tmp ^= xorkey;
  		
  		*(DWORD *)srcBuffer = tmp; // write 32-bit value
  		srcBuffer += 4;
  		--dBlocks;
  	}
  

  ( the remaining bytes are converted to a 32-bit integer then xor'd in the same way )
• The data is then decompressed. I haven't looked any further (http://aluigi.altervista.org/quickbms.htm# comtype scanner) - but some of the xml data is fairly legible after this early step

Files with a compression byte of 0x1 are handled in a similar manner to the fileindex in that the data is sent through a function which does some additional decryption which can alter the expected zsize

The uncompressed files (0x2) in GunZ2 scramble their size values somehow. I've not looked any further into this.


My Z3 module defines 4 functions which are called within the various clients:

• GetValues - which returns 2 values that are somehow related to RSA (?)
• PartialDec - the function which uses the keys to partial decrypt the data - used by the filelist (any 0x1 comtypes?)
• XorData - a very simple xor function (code above) which xors based on the fileindex record
• Uncompress - the decompression function

Once the filelist is decrypted (my code does this separately from the client) the 'regular' compressed files (0x0) are xor'ed and decrypted, before saved.

[WRS]

edit Links to the new PMANG open-beta!

http://file.nowcdn.co.kr/down/NeowizGam ... 070418.exe
http://file.nowcdn.co.kr/down/NeowizGam ... 70418_1.7Z

[skyflox]

filesystem.msf uses a simple XOR-encrypted key (AD C3 C8 A0 D2 D1 B5 31 ...), which is generated by the program based on the Raiderz.exe arrays, and possibly, the first bytes of filesystem.msf. In the version what I have, the data begin at byte 29h.

Next, the file is decompressed and get a standard structure filesystem.msf described by WRM.

All files are archived as before, are archived. Let us unpack a simple example (rel_const.lua - first file in Script.mrf).

Use XOR = 0x42CFD1B6 (From filesystem.msf)

Important elements I've highlighted in color.
FE 77 - Encrypted file size control.

Code: Select all

	int a = 0;
	int b = 0;
	int len = fileLen;
	while(a<0x20){
	 BYTE bl = data[0];
	 src++;
	 len--;
	 int c = bl & 0x7F;
	 byte cl = a;
	 c = c << cl;
         b = b | c;
	 a +=7;
	 if(bl<0x80) break;
	};

As a result, we obtain the value of 3B FF (equal to the value of filesystem.msf), and the Data pointer moves to the top of the archival data.

F0 42 - control code, in this case, "write the 42h byte to uncompressed data."

OD 29 - back to 29h bytes and copy out 7h bytes ("\0x0aCONST_")

64 - write the 1Ah bytes to the uncompressed data

Thus, using the simple instructions step by step we restore the original file.

Code: Select all

	BYTE a = data[0];
	LPBYTE ldic = dic;
	LPBYTE ldic2 = dic2;
	ldic +=a*2;
	BYTE cl = *(BYTE *)ldic;
	WORD b = *(WORD *)ldic;
	WORD edx = (b >> 11);
	data++;dataLen--;
	DWORD ebp = *(DWORD *)data;
	ldic2 +=edx*4;
	DWORD edi = *(DWORD *)ldic2;
	data+=edx;dataLen-=edx;
	edi &=ebp;
	edx = cl;
	if(a & 3 ){
	 //Insert text from buffer
	}else{
	 //Copy text from archive
	}

dic,dic2- dictionary from Raiderz.exe

Extracting the data - easy enough, but here is the creation of the packer can be difficult.

[WRS]

hi skyflox, i appreciate your input!

can you tell me which version of raiderz is this from? (EU?)

edit
just discovered the 34991 download links..
http://download.frogster-online.com/FOG ... etup-1.bin
http://download.frogster-online.com/FOG ... etup-2.bin

[skyflox]

I'm not sure, but I think that the EU.

Fileindex from this version (Size = 898328b)
http://dl.dropbox.com/u/96128597/fileindex.msf

Unpacked
http://dl.dropbox.com/u/96128597/fileindex_up.msf