Not sure if this helps but heres a list of signatures found using signsrch on the decrypted xex from the xbox version:luluxiu wrote:Provided file does not contain a compressed file, so I need to guess in these areas, which is why it does not work. Currently I have checked, but not much luck of the various algorithms....
Code: Select all
offset num description [bits.endian.size]
--------------------------------------------
00004400 31 Adler CRC32 (0x191b3141) [32.le.1024]
00003400 32 Adler CRC32 (0x191b3141) [32.be.1024]
00004800 33 Adler CRC32 (0x01c26a37) [32.le.1024]
00003800 34 Adler CRC32 (0x01c26a37) [32.be.1024]
00004c00 35 Adler CRC32 (0xb8bc6765) [32.le.1024]
00003c00 36 Adler CRC32 (0xb8bc6765) [32.be.1024]
000aa2c0 116 ADPCM index table (step variation) [32.be.64]
000aa300 118 ima_adpcm step table [16.be.178]
000c8aa8 122 MS ADPCM AdaptationTable [32.be.64]
000c8aa8 128 Creative ADPCM table [32.be.32]
000106e0 135 libavutil ff_log2_tab [..256]
00019418 142 ACSS reverse sbox [..256]
019aaf10 163 AES Rijndael Logtable [..256]
019ab010 164 AES Rijndael Alogtable [..256]
019ab110 165 AES Rijndael S / ARIA S1 [..256]
019ab210 166 AES Rijndael Si / ARIA X1 [..256]
019ab310 168 Rijndael Te0 (0xc66363a5U) [32.be.1024]
019ab710 170 Rijndael Te1 (0xa5c66363U) [32.be.1024]
019abb10 172 Rijndael Te2 (0x63a5c663U) [32.be.1024]
019abf10 174 Rijndael Te3 (0x6363a5c6U) [32.be.1024]
019ac310 177 Rijndael Td0 (0x51f4a750U) [32.be.1024]
019ac710 179 Rijndael Td1 (0x5051f4a7U) [32.be.1024]
019acb10 181 Rijndael Td2 (0xa75051f4U) [32.be.1024]
019acf10 183 Rijndael Td3 (0xf4a75051U) [32.be.1024]
019ae410 185 Rijndael rcon [32.le.40]
019ae413 186 Rijndael rcon [32.be.40]
001037c5 309 padding used in hashing algorithms (0x80 0 ... 0) [..64]
00002c10 357 Zlib dist_code [..512]
00002e10 358 Zlib length_code [..256]
00002f13 360 Zlib base_length [32.le.116]
00002f10 361 Zlib base_length [32.be.116]
00002f88 363 Zlib base_dist [32.be.120]
019a7a04 439 G.721 qtab [16.be.14]
019a73b8 461 ulaw table [16.be.512]
019a73b8 720 libaf ulaw_decode [16.be.256]
019a94f0 759 libavcodec COOK quant_centroid_tab [float.be.392]
000109e0 856 Generic bitmask table [32.be.128]
019c3470 1015 mp3lib huffman tab1 [16.be.14]
019c3480 1017 mp3lib huffman tab2 [16.be.34]
019c34a4 1019 mp3lib huffman tab3 [16.be.34]
019c34c8 1021 mp3lib huffman tab5 [16.be.62]
019c3508 1023 mp3lib huffman tab6 [16.be.62]
019c3548 1025 mp3lib huffman tab7 [16.be.142]
019c35d8 1027 mp3lib huffman tab8 [16.be.142]
019c3668 1029 mp3lib huffman tab9 [16.be.142]
019c36f8 1031 mp3lib huffman tab10 [16.be.254]
019c37f8 1033 mp3lib huffman tab11 [16.be.254]
019c38f8 1035 mp3lib huffman tab12 [16.be.254]
019c39f8 1037 mp3lib huffman tab13 [16.be.1022]
019c3df8 1039 mp3lib huffman tab15 [16.be.1022]
019c41f8 1041 mp3lib huffman tab16 [16.be.1022]
019c45f8 1043 mp3lib huffman tab24 [16.be.1022]
019c49f8 1045 mp3lib huffman tab_c0 [16.be.62]
019c4a38 1047 mp3lib huffman tab_c1 [16.be.62]
019c12b0 1050 mp3lib intwinbase [32.be.1028]
019ccc28 1177 Vorbis FLOOR1_fromdB_LOOKUP [float.be.1024]
00019418 1198 FFT and FHT routines rv_tbl [..128]
01b4de50 1228 rfc3548 Base 64 Encoding with URL and Filename Safe Alphabet [..
62]
01b4de50 1237 B64EncodeTable [..64]
000025c8 1526 zinflate_lengthExtraBits [32.be.116]
00002653 1529 zinflate_distanceExtraBits [32.le.120]
00002650 1530 zinflate_distanceExtraBits [32.be.120]
019ae42f 1637 Noekeon Nessie round [32.le.68]
019ae42c 1638 Noekeon Nessie round [32.be.68]
00010960 1811 bitmask [32.be.128]
000079dc 2254 unlzx table_one [..32]
000109e0 2260 unlzx table_three [32.be.64]
00087100 2270 DMC compression [32.be.16&]
000109d0 2271 compression algorithm seen in the game DreamKiller [32.le.12&]
000109cd 2272 compression algorithm seen in the game DreamKiller [32.be.12&]
- 70 signatures found in the file
