Identify Unknown Compression

Extraction and unpacking of game archives and compression, encryption, obfuscation, decoding of unknown files
ngc_kor
Posts: 11
Joined: Tue Oct 28, 2014 4:11 am

Re: Identify Unknown Compression

Post by ngc_kor »

I use JPN version mainly. I've tested the US version to compare with JPN version, but all of routines and structures are the same except that memory location is different.
So all of break point offsets and relevant things that I mention is only work in JPN version. (If you need JPN ver, pm to me)
And I manually created a charts, to show look better. I did not use the program.

Wulf, I'm wondering what you mean to setup the comfortable debug.
I know that Dolphin's basic debug mode isn't good tool.
but it just enough to do simple debugging and there no other options AFAIK.
Or is there any other method to do debugging better?

Wulf wrote:ngc, I still haven't given it my best shot but I haven't been able to get Dolphin into any sort of debug setup that I'm comfortable working in. I'm not giving up yet, but if I can't figure out how to set it up how I need, I won't be able to figure it out.

Argonaut, if that was directed at me then I've got too many projects going on to take a look. If it wasn't, you'll probably have better luck creating a new topic.

edit: Just read viewtopic.php?p=1829#p1921 closer, that definitely seems like you're close. I'll take another crack at it tonight, focusing on that area.
Are you working with the US or JPN version mainly? Also, what did you use to generate those charts? They look pretty slick.
Wulf
Posts: 49
Joined: Mon Oct 27, 2014 8:30 pm

Re: Identify Unknown Compression

Post by Wulf »

On the PS3 I'm used to having a lot more information at my disposal.

I can have one large window showing the contents of memory live, highlighting anything that changes in red. Split it vertically, have the left half showing the section of memory that it's reading from and the right showing where it's writing to. Set a breakpoint on reading the source and a breakpoint on writing to the destination, tap F5 a few times to see which registers change and which remain constant. It will also show the contents of the stack, so you can tell that you're 7 functions deep from the main game loop for example.

I suppose that goes beyond the needs of a pure debugger, but it's incredibly useful to have all the information so nicely presented.

Tonight's the night though. After my kid goes to bed I'll sit down and give it my best shot, and declare either victory or failure.

Do you know the NTSC function/memory locations for the information you posted previously? And what's on the screen when it's decrypting the files? During/after the intros, or do you need to press a key first?
Wulf
Posts: 49
Joined: Mon Oct 27, 2014 8:30 pm

Re: Identify Unknown Compression

Post by Wulf »

Well, I'm gonna have to give up on solving this directly. I'm just out of my element with GC/Wii emulation and things aren't clicking together for me.

On your chart, which variables can you identify? Are any of them constant through every run? At what point is the variable encrypted, and at what point is it fully decrypted? If you edit the memory so that the encrypted data is entirely zeros, does the decrypted data have any sort of repeating pattern to it? With 1s? With 2s? If you replace half with 0s and half with 1s, does the decrypted data switch to the 1s pattern at exactly the point the encrypted data did?

If you change the first byte, does the entire decrypted block become corrupted? If you change the middle byte? Does a corrupt byte cause a predictable decrypted corruption?
Wulf
Posts: 49
Joined: Mon Oct 27, 2014 8:30 pm

Re: Identify Unknown Compression

Post by Wulf »

I guess you've given up on this topic by now. Sorry I wasn't able to help, and good luck figuring it out.