Guerrila Games Sample Thread

Extraction and unpacking of game archives and compression, encryption, obfuscation, decoding of unknown files
AnonBaiter
Posts: 1125
Joined: Tue Feb 02, 2016 2:35 am

Guerrila Games Sample Thread

Post by AnonBaiter »

Here are the .core sample files, starting with Killzone Liberation:
chapter1_mission1.rar

And here's the same format used in Killzone 2 Behind the Bullet:
levels.test_levels.zoic_commercial.audio_commentary_audio_commentary.rar
levels.test_levels.zoic_commercial.zoic_commercial_assets.rar - filecutter 24mb was used for this

And now the same format, used in the original Killzone game:
menuscript.frontend.rar

Although one can argue that this kind of structure is a mess(rather complex even), on the first 32 bytes or so it actually categorizes every file based on their type(be it textures, sounds, etc.). From there on there is this reference of hashes or something. Keep in mind that this kind of structure was used from Killzone Liberation onwards.
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Guerrila Games Sample Thread

Post by aluigi »

Maybe these files are just raw containers without an index.
One starts with "Core", almost all the others with "RTTI" and one with a compressed "RTTI", clearly archived files and not headers in my opinion.
AnonBaiter
Posts: 1125
Joined: Tue Feb 02, 2016 2:35 am

Re: Guerrila Games Sample Thread

Post by AnonBaiter »

Huh.
AnonBaiter
Posts: 1125
Joined: Tue Feb 02, 2016 2:35 am

Re: Guerrila Games Sample Thread

Post by AnonBaiter »

Well, here is my first attempt at writing a .core script:

Code: Select all

getdstring CORE_SIGN 0x10

if CORE_SIGN & "Core<"
   goto 0x10
   get DUMMY1 long
   get DUMMY2 long
   get DUMMY3 long
   for i = 0 < DUMMY3
      get NAMESZ long
      getdstring NAME NAMESZ
   next i
elif CORE_SIGN & "RTTIBin<"
   goto 8
   getdstring VERSION 6
   if VERSION == "<1.12>"
      get DUMMY1 long
      get DUMMY2 long
      get DUMMY3 long
   else
      get DUMMY0 short
      get DUMMY1 long
      get DUMMY2 long
      get DUMMY3 long
      get DUMMY4 long
   endif
else
   break
endif
I did this because I`m sure the archived .core files has hints as to how the files are stored. I`m sure of it.