Researching of a .dat archive with a .mnf file.

[TERAB1T]

I have an archive file (game0000.dat), that comes with some .mnf file (game.mnf). The files in .dat are simly following each other without any separator and can be unpacked without problems. They are compressed with zlib, so it's not a problem to get them. But I want to know their names and folders structure. So I'm sure, that .mnf file can help me with that. I think, that game.mnf is sort of a table with filenames, structures and maybe offsets for game0000.dat, but I can't open it and need your help with researching. I've uploaded the files here.

[chrrox]

what game is it?

[TERAB1T]

what game is it?

The Elder Scrolls Online.

[twisted]

could you pm me the launcher?

[Lord Vaako]

what's the status of your research?

I did some research myself and so far I've found offsets, sizes of packed and sizes of unpacked data blocks inside game0000.dat but still can't find filenames & directory structure I suppose it should be something like EsoUI/Art/Achievements/achievements_points_legendary.dds

I also did some research on other dat/mnf files. They are a bit different/more complex, ie. another compression, more data0xxxx parts, etc. This time I've found sizes and offsets but no file parts ;/

[Ekey]

Well trying make unpacker.

Code: Select all

[MNF] - have 3 compressed blocks
0x4 - szID (always MES2)
0x15 - unknown
0x4 - szFilesCount (endian BIG)
0x4 - szFilesCount (endian BIG)

0x4 - szBlockSize (endian BIG)
0x4 - szBlockZSize (endian BIG)
     [........Block........]

0x4 - szBlockSize (endian BIG)
0x4 - szBlockZSize (endian BIG)
     [........Block........]

0x4 - szBlockSize (endian BIG)
0x4 - szBlockZSize (endian BIG)
     [........Block........]

Blocks 1-2 unknown tables

Code: Select all

[Block 3] - Endian Little

0x4 - szFileSize
0x4 - szFileZSize
0x4 - szUnknown01
0x4 - szOffset
0x1 - szComType(0 - Not Compressed, 1 - Zlib, 2 - Snappy)
0x1 - szArchiveNum
0x2 - szUnknown02

I can not understand what's going on after func : sub_007522A0 (see attach) .. Seems func for generate sum (hash?) for file names. Passing 3 times with different paths: Example

Code: Select all

[1]
EsoUI/PregameLocalization/LocalizePregameGeneratedStrings.lua

[2]
esoui/pregamelocalization/localizepregamegeneratedstrings.lua

[3]
/esoui/pregamelocalization/localizepregamegeneratedstrings.lua

I did a test project for gen sums, but output sums not found in the three tables.. Who will help deal?

[Lord Vaako]

thanks for file number hint - I was blind

0x1 - szFlag (0 - Not Compressed, 1 - Compressed, 2 - Unknown (Compressed and Encrypted maybe))

I haven't tested it yet but imo 2 = compressed by snappy - https://code.google.com/p/snappy/
I'm sure they use it becouse by using brute force attempt I was able to unpack a lot of files - textures, etc. (i.e. I've found over 400 ingame maps). It's also listed inside thirdparty.rtf file

eso.mnf has extra data after 3rd zlibed block - do you know what's hidden there?

[Ekey]

Currently I'm interested in file names.

[Lord Vaako]

I think that I have found "something"
it's hidden inside files with ZOSFT header
inside that file you will find few zlib compressed blocks and then block of null-separated strings, i.e.

/esoui/app/app.txt
/esoui/app/loadingscreen/loadingscreen.lua
/esoui/app/loadingscreen/loadingscreen.xml
/esoui/art/achievements/achievements_points_05.dds
/esoui/art/achievements/achievements_points_10.dds
/esoui/art/achievements/achievements_points_15.dds
/esoui/art/achievements/achievements_points_50.dds
/esoui/art/achievements/achievements_points_legendary.dds
/esoui/art/actionbar/ability_keybindbg.dds
/esoui/art/actionbar/ability_ultimate_framedecobg.dds
...

how to link data from this file to mnf file is my next question/task ... but tomorrow

hmm, there are more files then filenames

[Ekey]

Hm i found only 1 ZOSFT in game0000.dat, in esoXXXX.dat not found also game0000.dat have only 2599 files, ZOSFT contain only 1574 records

[Lord Vaako]

same problem - not enough records
I've found another ZOSFT file inside eso0002, offset 1394821 (my eso0002 size is 38006249)

5657125,2755862,2041805319,1394821,1,2,0

but it has 50k records only and there are 200k+ files :/

but maybe files without names are just obsolete junk? it's beta but so many? :/

[Ekey]

same problem - not enough records
I've found another ZOSFT file inside eso0002, offset 1394821 (my eso0002 size is 38006249)

5657125,2755862,2041805319,1394821,1,2,0

but it has 50k records only and there are 200k+ files :/

but maybe files without names are just obsolete junk? it's beta but so many? :/

60k... Anyway need to find out for what used sums after Size and ZSize

Code: Select all

0x4 - szUnknown01

btw : 3 ZOSFT ->

Code: Select all

/filetable.dat
/animsfiletable.dat
/internalfiletable.dat

[Lord Vaako]

I had a tough day so could you explain this?

btw : 3 ZOSFT ->

Code: Select all

/filetable.dat
/animsfiletable.dat
/internalfiletable.dat

[Ekey]

I had a tough day so could you explain this?

btw : 3 ZOSFT ->

Code: Select all

/filetable.dat
/animsfiletable.dat
/internalfiletable.dat

nvm

[Lord Vaako]

I'm still trying to "link" mnf data and zosft data, so far no luck :/

i.e.

ZOSFT DATA: 04 00 00 00 69 00 00 00 E3 7E 19 4F 8E 72 19 6B
ZOSFT TEXT: /esoui/art/achievements/achievements_points_05.dds

MNF: 32896,6363,BBC31573,3310,1,0,0