0

Currently, I am trying to understand .amxd file formats. I firstly tried to open it in VIM to see what this contains. Turns out there is a JSON file and others files also in the file (I can see PNG somewhere after the JSON).

So I guess it is compressed, but I can't find anywhere what this is compressed with.

Here is the header I got using od -tx1 file.amxd | head

0000000 61 6d 70 66 04 00 00 00 6d 6d 6d 6d 6d 65 74 61
0000020 04 00 00 00 07 00 00 00 70 74 63 68 c0 26 01 00           
0000040 6d 78 40 63 00 00 00 10 00 00 00 00 00 01 25 e8           
0000060 7b 0a 09 22 70 61 74 63 68 65 72 22 20 3a 20 09           
0000100 7b 0a 09 09 22 66 69 6c 65 76 65 72 73 69 6f 6e           
0000120 22 20 3a 20 31 2c 0a 09 09 22 61 70 70 76 65 72           
0000140 73 69 6f 6e 22 20 3a 20 09 09 7b 0a 09 09 09 22           
0000160 6d 61 6a 6f 72 22 20 3a 20 38 2c 0a 09 09 09 22           
0000200 6d 69 6e 6f 72 22 20 3a 20 30 2c 0a 09 09 09 22           
0000220 72 65 76 69 73 69 6f 6e 22 20 3a 20 30 2c 0a 09

I can find the same header in the other files.

When using file I get that it contains data, so I guess this doesn't really help me...

If someone can maybe help me on how to uncompress this, I would be very happy ! Thanks you !

Improve this question
4
  • Sorry but how to you conclude by seeing JSON and PNG data in the file that it is compressed? If you can see the full file data of JSON and PNG then this is an indicator that the file is not compressed. Instead the file just integrates multiple files into one. BTW: The common way to check an unknown file besides file is binwalk.
    – Robert
    Commented Jun 15, 2022 at 16:48
  • Okay, so if the file is not compressed, how can I separate each files from it ? I just tried binwalk and it can extract the PNG files but not the JSON one. Well that's still a big step ! Thanks you~
    – Vexcited
    Commented Jun 15, 2022 at 21:11
  • Try to run binwalk on the file and see if it works.
    – Ishan
    Commented Jun 16, 2022 at 15:12
  • @Ishan, it works but partially. Some resources aren't extracted like 3/4 of the images sometimes.
    – Vexcited
    Commented Jun 17, 2022 at 20:35

1 Answer 1

Reset to default
0

The overall structure of the file appears to be that of a RIFF file. This format consists of a number of separate 'chunks' of data each preceded by a header containing a 4 byte chunk type and a 4 byte (little-endian) length.

Your file begins -

 Offset   Type   Length   Data
======== ====== ========  ========
0000000: 'ampf' 00000004  'aaaa'
000000C: 'meta' 00000004  00000007    // probably the version of the AMXD file
0000028: 'ptch' 000126C0  ...
....

Looking at a couple of .amxd files online (with meta = 1) these only contain the ampf meta and ptch chunks and the ptch chunk in each case is total in json format.

This is not the case with your file (with meta = 7). Interestingly, the data in the ptch chunk seems have it's own header (with values in big-endian format) before the json data.

00000030: `ax@c` 00000010 00000000 000125E8

With only a single example it's hard to infer much from this other than the last value here is a length.

Edit: Looking at Infinity.amxd in the github repository you linked to sheds more light on the files with meta = 7.

The top-level structure it that of a RIFF file (with little-endian values)

00000000:   'ampf' 00000004 6D6D6D6D
0000000C:   'meta' 00000004 00000007
00000018:   'ptch' 0000D13A ....     // (This chunk contains the whole rest of the file)

Digging further, it appears that the ptch chunk itself contains nested chunks of data in a slightly different format (with big-endian values) -

00000020:   'mx@c' 00000010 000000000000CFFA
00000030:        ... blob of data ...
0000D01A:   'dlst' 00000140 
0000D012:       'dire' 00000068 
0000D02A:           'type' 0000000C 'JSON'
0000D036:           'fnam' 00000018 'Infinity.amxd'
0000D04E:           'sz32' 0000000C 0000CC39
0000D05A:           'of32' 0000000C 00000010
0000D066:           'vers' 0000000C 00000000
0000D072:           'flag' 0000000C 00000011 
0000D07E:           'mdat' 0000000C D9F0E203
0000D08A:       'dire' 00000068
0000D092:           'type' 0000000C 'PNG '
0000D09E:           'fnam' 00000018 'infinityyy.png'
0000D0B6:           'sz32' 0000000C 000002B6
0000D0C2:           'of32' 0000000C 0000CC49 
0000D0CE:           'vers' 0000000C 00000000
0000D0DA:           'flag' 0000000C 00000000
0000D0E6:           'mdat' 0000000C D6E92F11
0000D0F2:       'dire' 00000068
0000D0FA:           'type' 0000000C 'PNG '
0000D106:           'fnam' 00000018 'infinity13.png'
0000D11E:           'sz32' 0000000C 000000FB
0000D13A:           'of32' 0000000C 0000CEFF
0000D136:           'vers' 0000000C 00000000
0000D142:           'flag' 0000000C 00000000
0000D14E:           'mdat' 0000000C D6F90E73

This begins with a blob of data and is followed by a directory listing dlst. Each directory entry 'dire' references a file whose data can be found in the blob chunk using offset of32 (relative to the start of the ptch chunk data i.e. 00000020) and size sz32.

In summary the data in the Infinity.amxd file consists of a json file and 2x png files all of which should now be easy to extract.

Improve this answer
1
  • If you want, the .amxd files I'm trying are from this repository <github.com/mat1jaczyyy/outbreak>. I have looked into RIFF but as I don't really have a lot of knowledge about these things ; I'm quite lost - But thanks you for this answer !
    – Vexcited
    Commented Jun 17, 2022 at 20:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.