2

Continues from Unknown game data compression method (Gamecube)
I have compression data which was start with: [ * SK_ASC* ] and unknown compression method.
The list below compression method that I tested, but doesn't match:

  • LZ10
  • LZ11
  • LZ77
  • LZO1x-1
  • LZO1x-999
  • LZSS
  • LZW
  • LZMA
  • HUFF blocksize 4 & 8 byte
  • RLE
  • ZLIB

Researching for 2 weeks, I knew that compression algorithms is slightly modified, better than zlib/gzip.
It maybe xored or encrypted so it doesn't match with regular one.
Finally, I've found decompression subroutine from main executive file via IDA Pro.

Subroutine & example uploaded here: http://goo.gl/2bQNfj
(PowerPC Architecture Assembly skill required)


I have no idea what It mean because I'm not well in PPC disassemble.
Could anyone help found out what the code mean? Could you describe it as C Language or other readable language?




P.S. I already posted several forum to help.

  • http:// zenhax.com/viewtopic.php?f=9&t=313&sid=3172c154c5da95476795ac742501fec1
  • http:// encode.ru/threads/2074-Identifying-compression-method

2 Answers 2

1

You can try to use retargetable decompiler with your code.

1
  • I tried to do that, but full decompilation takes more than allowed 5 minutes. You have 2 options: 1 - register on the site, it will give you 10 minutes instead of 5 for decompilation 2 - you can follow instructions from Guntram Blohm's answer.
    – w s
    Commented Nov 16, 2014 at 12:04
2

Based on w s 's answer, do the following:

Extract the decompression function from the binary. (On Linux, use dd if=Start.dol bs=1 skip=1292664 count=7364 of=decomp.ppc).

Set the retargetable decompiler to raw machine code, decomp.ppc, file format doesn't matter, power pc, big endian, section address and entry point addess = 0x8013FC58.

With these parameters, you'll get your code decompiled. The result isn't exactly what i'd call readable, though.

You'll still have the problem that the code calls some more functions that aren't in the snipped file, but you can probably handle them in the same way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.