Batman Arkham Origins Blackgate (ARA)

[aluigi]

http://aluigi.org/papers/bms/others/batman_ara.bms

The magic is "ARMA".
The format is probably used also by other games of Armature Studios.
Strange archive format having no filenames (there is an archived file containing some names but their amount doesn't match) and two tables that are basically useless considering the lack of other information to use.

[Ekey]

Thanks Luigi. They using fnv1a as hash. I will try make unpacker with detecting names based on your script

[aluigi]

Ok.
Would be cool to have a feature of quickbms to automatically retrieving filenames through their crc from a database file.
But it should be a new command due to performance necessary for the database scanning.

[Ekey]

Would be cool to have a feature of quickbms to automatically retrieving filenames through their crc from a database file.

Also i planning to make plugin for detecting names. Easy realization. Load DLL, send in function hash and it returns real name or name as a hash like __Unknown\FD77A2A5

[Ekey]

Detecting names for QuickBMS!

[aluigi]

Those names seem the same available in one of the first files of the archive, 0x302a filenames with a format of variable4 NAMESZ followed by the NAME.

[Ekey]

Yup but only ~4k

PS: here experemental version for tests

[cyanic]

Pretty cool stuff. I had an occasion to use something similar a couple of weeks ago. I made a program that parses file names, CRC them, and store them in a compressed flat file. Any interest?

[Ekey]

Updated base

[aluigi]

@cyanic
ok, post it

[cyanic]

The program was made for Gun Metal, with most of the filenames obtained via hooking OutputDebugString into the game code. The CRC format is a bit different than usual, but it can be easily replaced by other hashes if you have the code for them. There are two parsers, one for plain text list of files, and one for parsing output from DebugView. Working CRC database is stored as a bunch of CRC-filename pairs, while the release database is stored as an initial CRC, deltas using 7BitInt, then a list of strings, all deflated.

[Ekey]

You need hook hash code to obtain file name

[cyanic]

In Gun Metal I actually placed the hook before the hashing code to get original file names. They lowercase all the file names when hashing. It was also extremely slow, about 20 times the typical loading time. In any case, it was to get an initial batch of names, and from there I can parse files to get more names.