2

I got some game compression data which I couldn't find any clue. All compressed file signature start with: [SK_ASC] and unknown compression method.

I got some information from RAM/Executive file but still didn't work. I think the compression is the lossless format (But it's not a LZO nor ZLIB). Can anyone help me figure out the compression, and how to decompress?

=== 10.25.14 ADDED ===

The list below compression method that I tested, but doesn't match:

  • LZ10
  • LZ11
  • LZ77
  • LZO1x-1
  • LZO1x-999
  • LZSS
  • LZW
  • LZMA
  • HUFF blocksize 4 & 8 byte
  • RLE
  • ZLIB

=== 10.26.14 ADDED ===

Today I analysis something via memory dump.

First of all, compressed EMnMenu.cmp file could be loaded when I enter the main menu by guessing it's file name. and there are very similar files which is unused. (EKisokMenu.cmp, EE3Menu.cmp)

So I try to check memory dump by replacing file each other. and I got dump_menu.ram, dump_e3menu.ram, dump_kioskmenu.ram. By comparing three different ram dump data,
I found out only specific offset data is changed.

By using this method, I finally got a decompression data dumped via offset: 0x80CA6980. Decompressed data is well known texture which was first 4 byte signature start with 0x00 0x20 0xAF 0x30. (check texture format here: http://goo.gl/UqLz3m)

I try to find compression algorithm by compressing the decompression data and compare with original data. but non of algorithm that I test above doesn't match.

Anyway, I uploaded several decompressed data via ram dump and compressed data so you can check here: goo.gl/JJQfl4

  • CMP is a compressed data which always start with SK_ASC.
  • BIN is a same as CMP.
  • DCMP is a instant copy from memory file, which was extracted from offset 0x80CA6980.
  • DMP is a data value correction by subtracted 0x80CA6980 because there so many memory scrapping dummy (so this is the cleaned decompressed data if I guess right)

ADDED Didn't work with regular deflate/zlib all compress level.

== 11.09.14 ==

I posted several forum to help, but no clue for weeks :(

== 11.15.14 ==

Other forum user said to me there are Gamecube DOL (executive file) plugin for IDA. So I use them and now I've found decompression main/algorithm subroutine. Would anyone help me find out describe how it works?

(I'm not well in dis-assembly, So I'm learning now)

http://goo.gl/2bQNfj

Power PC based Dis-Assembly skill Required

Improve this question
9
  • 2
    You should run signsrch on the binary doing decompression, not the compressed data. Though it's quite likely the algorithm is completely custom and you'll just have to reverse it.
    – Igor Skochinsky ♦
    Commented Oct 23, 2014 at 11:32
  • 2
    According to webcache.googleusercontent.com/…, SK_ASC is used for at least one game developed by Silicon Knights. The SK suggests that this is using an algorithm that's proprietary to Silicon Knights, as @IgorSkochinsky suggested.
    – Jason Geffner
    Commented Oct 23, 2014 at 14:07
  • @IgorSkochinsky, I used 'signsrch' on Executive/Memory file, not a compressed data. Anyway, algorithm is quite mess and still no clue.
    – NGC_KOR
    Commented Oct 25, 2014 at 1:50
  • Are you sure you uploaded the correct files? At a glance, they look very similar, and neither starts with SK_ASC.
    – Jongware
    Commented Oct 25, 2014 at 22:40
  • What I mean is it seems you uploaded the memory dump twice. I don't see the signature in either.
    – Jongware
    Commented Oct 26, 2014 at 2:07

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.