another .cab/.hdr sample

Extraction and unpacking of game archives and compression, encryption, obfuscation, decoding of unknown files
AnonBaiter
Posts: 1125
Joined: Tue Feb 02, 2016 2:35 am

another .cab/.hdr sample

Post by AnonBaiter »

oyy

so i downloaded the PC demo thingy of a game that used to be called Colin McRae DiRT(from somewhere else i didnt have to suffer through slooooooooooooooooooooooooooooooooooow download speeds for), unpacked the demo's contents(it was an .exe) and then i was faced with a bunch of .cab/.hdr files i tried to handle with my own

what i did was take this script and modify it into something like this

Code: Select all

# InstallShield (version?) HDR/CAB (script 0.2)
#   original struct information by wattostudios
#   https://zenhax.com/viewtopic.php?t=4279&p=23854#p23854
# script for QuickBMS http://quickbms.aluigi.org

comtype deflatex

open FDDE "hdr" 0 HDR_EXISTS
if HDR_EXISTS == 0
    open FDDE "cab"
endif
open FDDE "cab" 1

idstring "ISc("
get VER long
xmath max_ver "VER >> 16"
get ZERO long
get INFO_OFF long
get INFO_SIZE long
get HDR_SIZE long

goto INFO_OFF
get OFFSET long
get ZERO long
get DUMMY1 long
get SIZE long
get ZERO long
get DUMMY_SIZE long
get DUMMY_SIZE long
get FOLDERS long
get ZERO long
get DUMMY2 long
get FILES long
get DUMMY3 long

# at 0x230 there is a lot of info pertaining to string offsets, info offsets and the like
# what the script is supposed to do here is to reach these offsets so it can parse them completely
# what comes below is just stuff that doesnt involve the target directory of all things

math INFO_OFF + SIZE
goto INFO_OFF

for i = 0 < FOLDERS
    get directory_name_offset long
    savepos TMP
    math directory_name_offset + INFO_OFF
    goto directory_name_offset
    get directory_name_string string
    goto TMP
    putarray 1 i directory_name_string
next i

for i = 0 < FILES
    get cab_01 short
    get cab_02 longlong
    get cab_03 longlong
    get cab_04 longlong
    getdstring cab_05 0x10
    getdstring cab_06 0x10
    get file_name_offset long
    savepos TMP
    math file_name_offset + INFO_OFF
    goto file_name_offset
    get file_name_offset string
    goto TMP
    get cab_08 short
    getarray directory_name_string 1 cab_08
    get cab_09 long
    get cab_number_01 long
    get cab_11 long
    get cab_12 long
    get cab_13 long
    get cab_14 byte
    get cab_number_02 short
next i
here are the samples by the way
data1_hdr_cab.7z
if any of you need the exe let me know
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: another .cab/.hdr sample

Post by aluigi »

Script 0.2.1.
Feel free to post others if you see any failure.
AnonBaiter
Posts: 1125
Joined: Tue Feb 02, 2016 2:35 am

Re: another .cab/.hdr sample

Post by AnonBaiter »

oh my god what is this shit

Code: Select all

.
. 000000000000000e
. 0000000000005cd0 get     TYPE       0x0000000000000004 2
. 0000000000005cd2 get     SIZE       0x0000000000240036 8
. 0000000000005cda get     ZSIZE      0x000000000019949d 8
. 0000000000005ce2 get     OFFSET     0x0000000000317bc0 8
. 0000000000005cea getdstr HASH       "" 16
    aa fb 29 21 92 6e 36 de 7c 61 bc ad de 5a 14 2e   ..)!.n6.|a...Z..
. 0000000000005cfa get     DUMMY      0x0000000000000000 2
. 0000000000005cfc get     DUMMY      0x0000000000000000 2
. 0000000000005cfe get     DUMMY      0x0000000000000000 2
. 0000000000005d00 get     DUMMY      0x0000000000000000 2
. 0000000000005d02 get     ZERO       0x0000000000000000 8
. 0000000000005d0a get     NAME_OFF   0x0000000000035efc 4
. 0000000000005d0e get     ZERO       0x0000000000000000 2
. 0000000000005d10 get     FLAGS      0x0000000000000021 4
. 0000000000005d14 get     DUMMY      0x00000000717236a2 4
. 0000000000005d18 get     FOLDER     0x0000000000000001 4
. 0000000000005d1c getdstr DUMMY      "" 9
    00 00 00 00 00 00 00 00 00                        .........
. 0000000000005d25 get     SOMETHING  0x0000000000000001 2
.
. 00000000 getarr  PATH       "cars" 0:1
. 000000000003b47e get     NAME       "bbrd1.BMP" -1
apparently bbrd1.BMP is in the "cars" directory

Code: Select all

.
. 0000000000000824
. 0000000000031c4a get     TYPE       0x0000000000000004 2
. 0000000000031c4c get     SIZE       0x000000000001b6ad 8
. 0000000000031c54 get     ZSIZE      0x000000000000cb0a 8
. 0000000000031c5c get     OFFSET     0x0000000005fd429f 8
. 0000000000031c64 getdstr HASH       "" 16
    f0 65 07 ea 7d 1a 47 da 28 f5 ec 7d 5e 0c 0a d8   .e..}.G.(..}^...
. 0000000000031c74 get     DUMMY      0x0000000000000000 2
. 0000000000031c76 get     DUMMY      0x0000000000000000 2
. 0000000000031c78 get     DUMMY      0x0000000000000000 2
. 0000000000031c7a get     DUMMY      0x0000000000000000 2
. 0000000000031c7c get     ZERO       0x0000000000000000 8
. 0000000000031c84 get     NAME_OFF   0x000000000003f739 4
. 0000000000031c88 get     ZERO       0x0000000000000087 2
. 0000000000031c8a get     FLAGS      0x0000000000000021 4
. 0000000000031c8e get     DUMMY      0x00000000703536a2 4
. 0000000000031c92 get     FOLDER     0x0000000000000008 4
. 0000000000031c96 getdstr DUMMY      "" 9
    00 00 00 00 00 00 00 00 00                        .........
. 0000000000031c9f get     SOMETHING  0x0000000000000008 2

Code: Select all

.
. 0000000000000802
. 00000000000310bc get     TYPE       0x0000000000000004 2
. 00000000000310be get     SIZE       0x000000000022daf8 8
. 00000000000310c6 get     ZSIZE      0x000000000021dbe4 8
. 00000000000310ce get     OFFSET     0x0000000003d4f09c 8
. 00000000000310d6 getdstr HASH       "" 16
    70 6d 41 3c cb 3b c8 43 ee 14 4a 59 1b 16 d4 0a   pmA<.;.C..JY....
. 00000000000310e6 get     DUMMY      0x0000000000000000 2
. 00000000000310e8 get     DUMMY      0x0000000000000000 2
. 00000000000310ea get     DUMMY      0x0000000000000000 2
. 00000000000310ec get     DUMMY      0x0000000000000000 2
. 00000000000310ee get     ZERO       0x0000000000000000 8
. 00000000000310f6 get     NAME_OFF   0x000000000003f553 4
. 00000000000310fa get     ZERO       0x0000000000000000 2
. 00000000000310fc get     FLAGS      0x0000000000000021 4
. 0000000000031100 get     DUMMY      0x00000000621b36aa 4
. 0000000000031104 get     FOLDER     0x0000000000000008 4
. 0000000000031108 getdstr DUMMY      "" 9
    00 00 00 00 00 00 00 00 00                        .........
. 0000000000031111 get     SOMETHING  0x0000000000000008 2
but something that contains actual information(like what these two snippets of quickbms "debugging" are proving) isnt parsed for some insane reason - yes its that same sample i posted in the first post of this very thread

oh yeah now that you mention it, there are also quite a few .cab/.hdr samples i'd like to share here
[02]data1_cab_hdr.7z
[03]data1_cab_hdr.7z
[04]data1_cab_hdr.7z
[05]data1_cab_hdr.7z
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: another .cab/.hdr sample

Post by aluigi »

I have fixed the problem with the http/https names and added support for the unicode strings used in one of your samples.

I don't think there is any problem with the path of the filenames since there are no other choices or fields representing this value.
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: another .cab/.hdr sample

Post by aluigi »

The only alternative is just disabling the folder. Probably that's better so I made a micro update with that
AnonBaiter
Posts: 1125
Joined: Tue Feb 02, 2016 2:35 am

Re: another .cab/.hdr sample

Post by AnonBaiter »

i appreciate your efforts but i think youre lost here
see this code for example

Code: Select all

if TMP u<= 0x10 # VER 0x01009500

    math CHUNK_SIZE = 0x8000
    for i = 0 < FILES
        get TYPE short
        get SIZE longlong
        get ZSIZE longlong
        get OFFSET longlong
        getdstring HASH 16
        get DUMMY short # 0 or 1
        get DUMMY short # 0 or 0xa
        get DUMMY short # 0 or 0xee
        get DUMMY short # 0
        get ZERO longlong
        get NAME_OFF long
        get ZERO short
        get FLAGS long
        get DUMMY long
        get FOLDER long
        math FOLDER = 0 # there is no FOLDER field
        getdstring DUMMY 9
        get SOMETHING short

        if SOMETHING <= 1   # 2 is wrong
            callfunction DUMP 1
        endif
    next i
    cleanexit
now see my modded code

Code: Select all

if TMP u<= 0x10 # VER 0x01009500

    math CHUNK_SIZE = 0x8000
    for i = 0 < FILES
        get TYPE short
        get SIZE longlong
        get ZSIZE longlong
        get OFFSET longlong
        getdstring HASH 16
        get DUMMY short # 0 or 1
        get DUMMY short # 0 or 0xa
        get DUMMY short # 0 or 0xee
        get DUMMY short # 0
        get ZERO longlong
        get NAME_OFF long
        get FOLDER short
        get FLAGS long
        get DUMMY long
        get CAB_PART_01 long
        getdstring DUMMY 9
        get CAB_PART_02 short

        callfunction DUMP 1
    next i
    cleanexit
with that said the FOLDER field can get messy at times(i used the installed Colin McRae DiRT PC demo directory as a reference) but thats just me
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: another .cab/.hdr sample

Post by aluigi »

Eh no, that's wrong too because that one is ever zero for the extracted files. Already tried it.

Additionally you need to handle the SOMETHING field which is referred or you will get errors, the extraction is already 99%
AnonBaiter
Posts: 1125
Joined: Tue Feb 02, 2016 2:35 am

Re: another .cab/.hdr sample

Post by AnonBaiter »

yaa but what about that one sample from the first post of this thread?
i used that file most of the time for testing the script youre right, it does do its job (kinda) but based on what i actually saw about the .hdr format a cloud of doubt came into my head

for example, i just found out that that SOMETHING field could very well be the actually the number of .cab files, not to mention there are a lot of referenced files that are stored in anything beyond data1.cab too

Code: Select all

22/05/2007  12:10         7.063.909 data1.cab
22/05/2007  12:10           287.328 data1.hdr
22/05/2007  12:11       106.708.992 data2.cab
22/05/2007  12:11       115.343.360 data3.cab
22/05/2007  12:11       115.343.360 data4.cab
22/05/2007  12:11       115.343.360 data5.cab
22/05/2007  12:12       115.343.360 data6.cab
22/05/2007  12:12       115.343.360 data7.cab
22/05/2007  12:13       115.343.360 data8.cab
22/05/2007  12:13        16.527.275 data9.cab
im not making that up
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: another .cab/.hdr sample

Post by aluigi »

Do you mean there were 8 other cab belonging to the first sample you provided?
That would have been useful to know :)
Script 0.2.3
AnonBaiter
Posts: 1125
Joined: Tue Feb 02, 2016 2:35 am

Re: another .cab/.hdr sample

Post by AnonBaiter »

sorry i didnt tell you this from the beginning
but yeah that was exactly what i had in mind(thanks for the update anyway!), heck i even tried to tell you this but you went all close-minded for some insane reason

still there is quite a lot of stuff your script hasnt had it covered yet so if i see anything unusual ill let you know
AnonBaiter
Posts: 1125
Joined: Tue Feb 02, 2016 2:35 am

Re: another .cab/.hdr sample

Post by AnonBaiter »

alright i noticed something strange with your script
i used the .cab/.hdr files from Colin McRae DiRT PC demo for testing

see the error here

Code: Select all

QuickBMS generic files extractor and reimporter 0.9.0 (64bit test)
by Luigi Auriemma
e-mail: me@aluigi.org
web:    aluigi.org
        (Jun 17 2018 - 11:42:41)

                   quickbms.aluigi.org  Homepage
                            zenhax.com  ZenHAX Forum
                     @zenhax @quickbms  Twitter & Scripts

- current_folder: G:\quickbms
- bms_folder:     G:\FUTUREMARK
- exe_folder:     G:\quickbms
- file_folder:    G:\CODEMASTERS\WINDOWS\COLIN_MCRAE_DIRT\DEMO
- output_folder:  G:\quickbms
- temp_folder:    C:\Users\rebec\AppData\Local\Temp\
- open input file G:\CODEMASTERS\WINDOWS\COLIN_MCRAE_DIRT\DEMO\data1.hdr
- open script G:\FUTUREMARK\installshield_cab2.bms
- set output folder .

  offset           filesize   filename
--------------------------------------
- enter in folder G:\CODEMASTERS\WINDOWS\COLIN_MCRAE_DIRT\DEMO
  coverage file 0     0%   0          287328     . offset 0000000000000000
- open input file G:\CODEMASTERS\WINDOWS\COLIN_MCRAE_DIRT\DEMO\data1.hdr
- enter in folder G:\CODEMASTERS\WINDOWS\COLIN_MCRAE_DIRT\DEMO
- open input file G:\CODEMASTERS\WINDOWS\COLIN_MCRAE_DIRT\DEMO\data1.cab
- enter in folder G:\CODEMASTERS\WINDOWS\COLIN_MCRAE_DIRT\DEMO
  coverage file 1    99%   7063397    7063909    . offset 00000000006bb397
- open input file G:\CODEMASTERS\WINDOWS\COLIN_MCRAE_DIRT\DEMO\data2.cab
- enter in folder G:\CODEMASTERS\WINDOWS\COLIN_MCRAE_DIRT\DEMO
  coverage file 1    98%   105595013  106708992  . offset 000000000649c63c
- open input file G:\CODEMASTERS\WINDOWS\COLIN_MCRAE_DIRT\DEMO\data3.cab
- enter in folder G:\CODEMASTERS\WINDOWS\COLIN_MCRAE_DIRT\DEMO
  coverage file 1    76%   88793178   115343360  . offset 00000000065bc798
- open input file G:\CODEMASTERS\WINDOWS\COLIN_MCRAE_DIRT\DEMO\data4.cab
- enter in folder G:\CODEMASTERS\WINDOWS\COLIN_MCRAE_DIRT\DEMO
  coverage file 1    97%   112632507  115343360  . offset 0000000006da169c
- open input file G:\CODEMASTERS\WINDOWS\COLIN_MCRAE_DIRT\DEMO\data5.cab
- enter in folder G:\CODEMASTERS\WINDOWS\COLIN_MCRAE_DIRT\DEMO
  coverage file 1    95%   110322150  115343360  . offset 0000000006958702
- open input file G:\CODEMASTERS\WINDOWS\COLIN_MCRAE_DIRT\DEMO\data6.cab
- enter in folder G:\CODEMASTERS\WINDOWS\COLIN_MCRAE_DIRT\DEMO
  coverage file 1    94%   109063718  115343360  . offset 00000000066a0d71
- open input file G:\CODEMASTERS\WINDOWS\COLIN_MCRAE_DIRT\DEMO\data7.cab

-------------------
*EXCEPTION HANDLER*
-------------------
An error or crash occurred:

*EH* ExceptionCode      c0000005 access violation
*EH* ExceptionFlags     00000000
*EH* ExceptionAddress   00C54D00
                        00B20000 + 00134d00 quickbms_4gb_files.exe
*EH* NumberParameters   00000002
*EH*                    00000000
*EH*                    82567D52

Last script line before the error or that produced the error:
  141 clog MEMORY_FILE OFFSET CHUNK_ZSIZE CHUNK_SIZE 1
for an detailed report of what actually happened see data1.txt
let me know if you need any more samples
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: another .cab/.hdr sample

Post by aluigi »

The script is doing the correct thing but there is something wrong in the data file.

We have:
SIZE 0x0000000000058e67
ZSIZE 0x0000000000001a92
OFFSET 0x00000000069bc0f4

So the script opens the new data7.cab (DATA_ID 7), goes to offset 69bc0f4 and reads the 16bit chunk size which is going to be expected being <= than ZSIZE.
ZSIZE is 0x1a92 while the chunk size is 0x6ff7 (bigger?!) and decompression fails.

The other fields are not much different than those of the previously successful file.
Maybe I will try downloading the demo and check by myself but from the log I don't see errors made by the script.
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: another .cab/.hdr sample

Post by aluigi »

I downloaded the demo and can replicate the problem but it's all correct, so no idea.
AnonBaiter
Posts: 1125
Joined: Tue Feb 02, 2016 2:35 am

Re: another .cab/.hdr sample

Post by AnonBaiter »

:thinking: