math SIZE 0x200 goto SEEK_END savepos OFFSET math OFFSET SIZE callfunc

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
math SIZE = 0x200
goto 0 0 SEEK_END
savepos OFFSET
math OFFSET -= SIZE
callfunction DECRYPT 1
idstring MEMORY_FILE "WIBO"
get DUMMY long MEMORY_FILE
get FILES long MEMORY_FILE
get EXTRA_FILES long MEMORY_FILE
get DUMMY long MEMORY_FILE
get DUMMY long MEMORY_FILE
get DUMMY long MEMORY_FILE
get DUMMY long MEMORY_FILE
print "Files: %FILES|x%"
print "Extra files: %EXTRA_FILES|x%"
math SIZE = FILES
math SIZE += EXTRA_FILES
math SIZE *= 0x150
goto 0 0 SEEK_END
savepos INFO_OFF
math INFO_OFF -= 0x200
for INFO_OFF -= SIZE >= 0
if INFO_OFF % 0x200
math INFO_OFF -= 0x10
else
break
endif
next
print "FileTable offset: %INFO_OFF|x%"
for i = 0 < FILES
math SIZE = 0x150
math OFFSET = INFO_OFF
callfunction DECRYPT 1
math INFO_OFF += 0x150
getdstring NAME 0x108 MEMORY_FILE
get OFFSET longlong MEMORY_FILE
get SIZE longlong MEMORY_FILE
get XSIZE longlong MEMORY_FILE # used for encryption alignment?
get ZSIZE long MEMORY_FILE # ???
getdstring DUMMY 16 MEMORY_FILE
get DUMMY1 long MEMORY_FILE
get TIMESTAMP longlong MEMORY_FILE
get TIMESTAMP longlong MEMORY_FILE
get DUMMY2 longlong MEMORY_FILE
#set EXT extension NAME
#if EXT == "sqlite3"
# encryption aes? ???
#endif
log NAME OFFSET SIZE # don't use clog for the moment
#encryption "" ""
next i
startfunction DECRYPT
encryption aes_128_cbc "\x32\x1F\x2A\xEE\xAA\x58\x4A\xB4\x9A\x6C\x9E\x09\xD5\x9E\x9C\x6F"
log MEMORY_FILE OFFSET SIZE
encryption "" ""
endfunction