I think I can see why the script skips to all of the "UZ\x03\x04", but that is not the right way to do it.
For the cases where the "Flag" has value 9, these are when you are reading the primitives and models.
It looks like images have "method" value of 8.
Check out the attached file.
I've cut out two file entries based on idstring, and if you jump to the 2nd idstring, you'll see two integers right before it.
Now highlight all of the ""UZ\x03\x04" and then go to the second one.
Look at the previous 16 bytes, and you'll see this
Code: Select all
char[4] "UZ\x07\x08"
dword ?
dword compressed size
dword size
It should not be coincidental that the size of the data is exactly the size that's shown.
However it doesn't seem like the compression method used is deflate.
Try this out:
Code: Select all
# Heroes:Scions of Phoenix Online
# script for QuickBMS http://aluigi.org/papers.htm#quickbms
# updated Feb 18, 2012 by Tsukihime
for
findloc start string "UZ\x03\x04"
goto start
idstring "UZ\x03\x04"
get ver short
get flag short
get method short
get timedate long
get crc long
get comp_size long
get uncomp_size long
get name_len short
get extra_len short
filexor 0xb2
getdstring name name_len
filexor ""
getdstring extra extra_len
savepos offset
if flag == 9
#comtype ???
FindLoc NEXT STRING "UZ\x07\x08"
goto NEXT
idstring "UZ\x07\x08"
get unk LONG
get ZSIZE long
get SIZE long
savepos curr
#clog NAME offset ZSIZE SIZE --- I don't know compression format
print "%NAME% %ZSIZE% %SIZE%"
goto curr
else
comtype deflate
if method == 0
Log name offset uncomp_size
elif method == 8
print %name%
CLog name offset comp_size uncomp_size
else
print "unsupported compression method %method%"
cleanexit
endif
math offset += comp_size
goto offset
endif
next
All you need is to specify the compression format used for those particular files when the flag == 9.
Maybe. Lol
You do not have the required permissions to view the files attached to this post.