2

I got some game compression data which I couldn't find any clue. All compressed file signature start with: [SK_ASC] and unknown compression method.

I got some information from RAM/Executive file but still didn't work. I think the compression is the lossless format (But it's not a LZO nor ZLIB). Can anyone help me figure out the compression, and how to decompress?

=== 10.25.14 ADDED ===

The list below compression method that I tested, but doesn't match:

  • LZ10
  • LZ11
  • LZ77
  • LZO1x-1
  • LZO1x-999
  • LZSS
  • LZW
  • LZMA
  • HUFF blocksize 4 & 8 byte
  • RLE
  • ZLIB

=== 10.26.14 ADDED ===

Today I analysis something via memory dump.

First of all, compressed EMnMenu.cmp file could be loaded when I enter the main menu by guessing it's file name. and there are very similar files which is unused. (EKisokMenu.cmp, EE3Menu.cmp)

So I try to check memory dump by replacing file each other. and I got dump_menu.ram, dump_e3menu.ram, dump_kioskmenu.ram. By comparing three different ram dump data,
I found out only specific offset data is changed.

By using this method, I finally got a decompression data dumped via offset: 0x80CA6980. Decompressed data is well known texture which was first 4 byte signature start with 0x00 0x20 0xAF 0x30. (check texture format here: http://goo.gl/UqLz3m)

I try to find compression algorithm by compressing the decompression data and compare with original data. but non of algorithm that I test above doesn't match.

Anyway, I uploaded several decompressed data via ram dump and compressed data so you can check here: goo.gl/JJQfl4

  • CMP is a compressed data which always start with SK_ASC.
  • BIN is a same as CMP.
  • DCMP is a instant copy from memory file, which was extracted from offset 0x80CA6980.
  • DMP is a data value correction by subtracted 0x80CA6980 because there so many memory scrapping dummy (so this is the cleaned decompressed data if I guess right)

ADDED Didn't work with regular deflate/zlib all compress level.

== 11.09.14 ==

I posted several forum to help, but no clue for weeks :(

== 11.15.14 ==

Other forum user said to me there are Gamecube DOL (executive file) plugin for IDA. So I use them and now I've found decompression main/algorithm subroutine. Would anyone help me find out describe how it works?

(I'm not well in dis-assembly, So I'm learning now)

http://goo.gl/2bQNfj

Power PC based Dis-Assembly skill Required

  • 2
    You should run signsrch on the binary doing decompression, not the compressed data. Though it's quite likely the algorithm is completely custom and you'll just have to reverse it. – Igor Skochinsky Oct 23 '14 at 11:32
  • 2
    According to webcache.googleusercontent.com/…, SK_ASC is used for at least one game developed by Silicon Knights. The SK suggests that this is using an algorithm that's proprietary to Silicon Knights, as @IgorSkochinsky suggested. – Jason Geffner Oct 23 '14 at 14:07
  • @IgorSkochinsky, I used 'signsrch' on Executive/Memory file, not a compressed data. Anyway, algorithm is quite mess and still no clue. – NGC_KOR Oct 25 '14 at 1:50
  • Are you sure you uploaded the correct files? At a glance, they look very similar, and neither starts with SK_ASC. – usr2564301 Oct 25 '14 at 22:40
  • What I mean is it seems you uploaded the memory dump twice. I don't see the signature in either. – usr2564301 Oct 26 '14 at 2:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.