I'm working on converting a game originally developed to run on Windows for the web. I have a bunch of artwork for the game received from the artist in .tga image files which open fine in Photoshop. However I don't have the complete set of artwork and it cannot be found.
I also have a distribution of the Windows game which consists of .dlls, .lua files and a lot of .tga files. The .tga (Targa) files in the game distribution are named the same as the .tga files in the artwork I have received so I think it's safe to assume they are the same images. Even the images that I'm missing from the supplied artwork are present in the game distribution. Bingo! Well actually no…
The .tga files from the game won't open in Photoshop or Preview (mac) or Pixelmator (mac). So I think something has been done to the game .tga files to protect them and I want to reverse engineer them back to normal .tga files.
First I need to discover what the new files are and how they've been modified. Here's what I've tried so far:
- rockExplosion.tga (from artwork).
rockExplosion.tga: Targa image data - RGB 100 x 43
- rockExplosion.tga (from game).
Inspecting using hex viewer and diff
The two files are exactly the same byte length. The last ~15% of bytes are identical in each file and the first ~85% are completely different.
Binwalk didn't tell me anything for either file.
- What other techniques exist for reverse engineering unknown file formats?
- Is there a standard way of protecting images in .NET applications that could have been used?
- What other tools could I use to probe further?