Arcade game .dat decompression

finalscream · Post by **finalscream** » Sat Jun 10, 2017 7:19 am

I have 2 .dat files that I'm not quite sure how to decompress. I tried scanning them with quickbms but haven't found anything, so I'm assuming its custom. I provided 2 samples of compressed and uncompressed files (I don't have access to whatever decompressed them heh).

Any help would really be appreciated!

aluigi · Post by **aluigi** » Sat Jun 10, 2017 8:19 am

Name of the game?
I bet that *uncompressed.dat is a memory dump, the algorithm is 99% lzss with 0x00 initializer but then the data is garbage from a certain point.

finalscream · Post by **finalscream** » Sat Jun 10, 2017 8:25 am

aluigi wrote:Name of the game?
I bet that *uncompressed.dat is a memory dump, the algorithm is 99% lzss with 0x00 initializer but then the data is garbage from a certain point.

It's a konami based arcade game. I'd rather not say for a multitude of reasons lol. I know for a fact that it isn't a memory dump though. Pretty sure the garbage data you're seeing is SSL certs (check it with binwalk)

aluigi · Post by **aluigi** » Sat Jun 10, 2017 8:43 am

I have tried various settings of lzss but the problem remains, the output is very similar to the *uncompressed.dat file but then the decompression starts to be wrong. That's clearly visible by using this script:

Code: Select all

comtype lzss "12 4 2 2 0"
get TYPE byte # 1
savepos OFFSET
get ZSIZE asize
math ZSIZE - OFFSET
xmath SIZE "ZSIZE * 2"
get NAME basename
clog NAME OFFSET ZSIZE SIZE

The differences start from offset 0xa9 and become worst

finalscream · Post by **finalscream** » Sat Jun 10, 2017 9:13 am

aluigi wrote:I have tried various settings of lzss but the problem remains, the output is very similar to the *uncompressed.dat file but then the decompression starts to be wrong. That's clearly visible by using this script:
Code: Select all
comtype lzss "12 4 2 2 0"
get TYPE byte # 1
savepos OFFSET
get ZSIZE asize
math ZSIZE - OFFSET
xmath SIZE "ZSIZE * 2"
get NAME basename
clog NAME OFFSET ZSIZE SIZE
The differences start from offset 0xa9 and become worst

I see what you mean. Whats's weird is that there's big chunks with matching data farther down the file. No clue what the issue is.

finalscream · Post by **finalscream** » Sat Jun 10, 2017 9:37 am

I only see one other konami AC game (Dancing Evolution Arcade), which also happens to use lzss0, but it seems like this might be something custom?

aluigi · Post by **aluigi** » Sat Jun 10, 2017 9:42 am

That's possible.
I can only suggest you to post on https://encode.ru and I'm quite sure someone can check it, after all it's a lzss derivate so there are better chances of success.

finalscream · Post by **finalscream** » Sat Jun 10, 2017 7:22 pm

aluigi wrote:That's possible.
I can only suggest you to post on https://encode.ru and I'm quite sure someone can check it, after all it's a lzss derivate so there are better chances of success.

I posted over there just in case. I have a DLL that im pretty sure has the decompression function in it, but I'm not sure where it's located.

aluigi · Post by **aluigi** » Sun Jun 11, 2017 12:16 pm

Cool, I will add it to the next version of quickbms

https://encode.ru/threads/2772-Finding- ... #post52946

ZenHAX

Arcade game .dat decompression

Arcade game .dat decompression

Re: Arcade game .dat decompression

Re: Arcade game .dat decompression

Re: Arcade game .dat decompression

Re: Arcade game .dat decompression

Re: Arcade game .dat decompression

Re: Arcade game .dat decompression

Re: Arcade game .dat decompression

Re: Arcade game .dat decompression