0

I have a file with the extension of "TOC" I assumed it meant Table of Contents, and the contents of said file represent that it indeed is one.

It's full of content such as this:

117dbdd0 15 cardcropHD400.jpg.zib
345cbe0 15 cardcropHD401.jpg.zib
144800a 50 D3D11\characters\m10658_number_104_masquerade\m10658_number_104_masquerade.phyre
121dffc 50 D3D11\characters\m3800_blue_eyes_white_dragon\m3800_blue_eyes_white_dragon.phyre
121602c 3e D3D11\characters\m3806_dark_magician\m3806_dark_magician.phyre
12d2eb7 4e D3D11\characters\m3815_red_eyes_black_dragon\m3815_red_eyes_black_dragon.phyre
1223774 48 D3D11\characters\m4766_dark_magician_girl\m4766_dark_magician_girl.phyre
114145a 4a D3D11\characters\m6653_elemental_hero_neos\m6653_elemental_hero_neos.phyre
1117979 62 D3D11\characters\m7344_arcana_force_ex_the_light_ruler\m7344_arcana_force_ex_the_light_ruler.phyre
1d2edd5 42 D3D11\characters\m7734_stardust_dragon\m7734_stardust_dragon.phyre
128872f 4c D3D11\characters\m7735_red_dragon_archfiend\m7735_red_dragon_archfiend.phyre
116a658 44 D3D11\characters\m9575_number_39_utopia\m9575_number_39_utopia.phyre
1488223 58 D3D11\characters\m9656_number_17_leviathan_dragon\m9656_number_17_leviathan_dragon.phyre
17c81f4 60 D3D11\characters\m9708_sephylon_the_ultimate_timelord\m9708_sephylon_the_ultimate_timelord.phyre

Now, I figured the first line is a hex encoded size which checks out for the corresponding DAT size (Minus 6ish MB), the last column is obviously the file name. But, I don't know where to start on what the middle value is, it's a HEX encoding of something, but if you convert it and add them together it exceeds the left over buffer room.

Anyone have any advice or how I could start looking into the EXE to see how it's handling the file? (I've tried running it through x64dbg but the munmbo jumbo of ASM means nothing to me)

1

the second column appears to be the length of the string in the third column

from whatever was pasted as sample

the file so.txt contains the posted sample data

:\>awk "{ printf( \"%x \" , length($3)) ;print  $2}" so.txt
15 15
15 15
50 50
50 50
3e 3e
4e 4e
48 48
4a 4a
62 62
42 42
4c 4c
44 44
58 58
60 60

:\>
  • That checks out from the testing I've done :). I should've thought it was something so simple... Then again, not entirely sure why it needs to have it's own column. But oh well. Thanks again bud! :D – Jalomba Mar 29 '17 at 8:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.