diff --git a/BinaryObjectScanner/Packer/ClickteamInstallMaker.cs b/BinaryObjectScanner/Packer/ClickteamInstallMaker.cs index 6546a378..de0353d2 100644 --- a/BinaryObjectScanner/Packer/ClickteamInstallMaker.cs +++ b/BinaryObjectScanner/Packer/ClickteamInstallMaker.cs @@ -4,9 +4,22 @@ namespace BinaryObjectScanner.Packer public class ClickteamInstallMaker { // All data stored in the overlay + // Header is zlib-compressed. Samples seem to indicate that // there is a 19-byte "header" before the compressed header - // data. + // data. 5 bytes before the compressed data appears to be a + // 32-bit value that represents the decompressed header size. + // It is followed by a single byte + + // Possible layout of pre-compressed header: + // 0x00-0x03 - Unknown [77 77 67 54] (1416066935) + // 0x04-0x07 - Unknown [29 48 35 14] (339036201) + // 0x08-0x09 - Unknown [01 00] (1) + // 0x0A-0x0D - Size of compressed data? [54 02 00 00] (596) + // This seems shorter than the expected 604 + // 0x0E-0x11 - Size of decompressed data [26 08 00 00] (2086) + // 0x12 - Unknown [01] (1) + // The decompressed header data has no easily-recognized // structures like offsets or sizes. @@ -15,6 +28,20 @@ namespace BinaryObjectScanner.Packer // can be found. This results in the entries all being read // at the same time and failing to extract as a result. + // It is possible there is an 8-byte "prefix" before the entries + // in the data itself, but no values have been correllated + // to either the compressed or extracted sizes yet. + // This prefix could also be a data trailer, as multiple values + // have been found seemingly-appended to data extracted + // from these bz2 entries. + + // Possible layout of pre-compressed entry: + // 0x00-0x03 - Unknown [10 9D 01 00] (105744) + // 0x04-0x07 - Size of compressed data? [DA 12 02 00] (135898) + // This seems shorter than the expected 137949 + // What is in the 2051 bytes remaining? + // 0x08 - Unknown [02] (2) + // When manually extracted, each BZ2 block is a correct // set of compressed data. Without a notable filename map, // the extracted data is difficult to work with.