Pro Pilot 99 compression

Extraction and unpacking of game archives and compression, encryption, obfuscation, decoding of unknown files
wattostudios
Posts: 20
Joined: Fri Jun 02, 2017 2:15 pm

Pro Pilot 99 compression

Post by wattostudios »

Hi experts.

The game Pro Pilot 99 (downloadable from https://archive.org/details/pro-pilot-99 ) has some VOL archives that are simple enough, but almost every file in the archive is compressed. I've run them through the QuickBMS compression finder but they don't find an appropriate compression method.

Whether deliberate or not, some of the files in one of the archive, actually exist as separate files in on the disk as well, and the file sizes match the decompressed file sizes reported in the VOL archive, so I'm pretty certain that for at least these few files, I have a Compressed and a Decompressed file that represent the same data.

I'm interested in working out what the decompression code would be. I don't know if it helps to have some of these files as both Compressed and Decompressed copies, but in case it does, I have attached some here.

Separately, I'm new to disassemblers and debuggers in this fashion, but am trying to learn. If it turns out that it's easiest to find the decompression code from the executable, I'd be very appreciative if anyone would be able to find it, or even assist with a few pointers on how to locate the decompression code. I think I was able to find where the code was trying to read each of the files from a VOL archive, however couldn't find anything that I assume was the decompression code.

If anyone is able to assist with this, I'd be very much appreciative.

Thanks.
Ekey
Posts: 1383
Joined: Sat Aug 09, 2014 2:34 pm

Re: Pro Pilot 99 compression

Post by Ekey »

Hey Watto :) Looks like it's LZH / LZHUF

d_code table
Image

d_len table
Image

Function (addr > 0x518A60) which in screenshots is decompression

Just follow to RTTI / vftable and you can see this :)
Image
wattostudios
Posts: 20
Joined: Fri Jun 02, 2017 2:15 pm

Re: Pro Pilot 99 compression

Post by wattostudios »

Thanks for that, I actually stumbled across that function while I was debugging, so was good to know I wasn't totally off base, but I still haven't found how to take that back to the RTTI LZHRStream. I'm very new to debuggers - I understand some of the concepts, but still trying to work out how to use them properly.

I can see that the tables in your screenshots match with the LZH tables, but I've run the LZH decompressor on all offsets in the file and it's not able to decompress it, so I'm still not really any closer to getting the decompressed content. :-(

I appreciate the assistance you've provided, wish it was as simple as you implied :-)
Ekey
Posts: 1383
Joined: Sat Aug 09, 2014 2:34 pm

Re: Pro Pilot 99 compression

Post by Ekey »

Maybe you extract files by incorrect offsets?

Edited: Interesting repos > https://github.com/oftn-oswg/DynVol and https://github.com/SkaZzMaSTaH/Dynamix-GDS-Extractor
wattostudios
Posts: 20
Joined: Fri Jun 02, 2017 2:15 pm

Re: Pro Pilot 99 compression

Post by wattostudios »

> Maybe you extract files by incorrect offsets?
Yeah that's what I thought too, but I tried all the offsets into the compressed data, and it didn't make any difference, unfortunately.

Thanks for the repos you listed - I implemented the LZW code in the second one, but that doesn't seem to work.
From looking at those repos, plus a few others that I found (eg https://www.vogons.org/viewtopic.php?t=32587&start=100) , they don't seem to be relevant - I mean, you clearly found the d_code/d_len tables (which aligns with LZH) bit all the other compression methods use different sizes of tables - eg a single table of size 0x4000. So I think this is getting further away from the compression.

I appreciate all the help you've provided so far, and you're certainly under no obligation to assist any further, but you're welcome to investigate further if you'd like the challenge :-)