paq解包脚本如何写

byp100

分析了半天还是没分析出解压脚本
苏洋的解包动画也看不到。。。。007能分析指导一下吗？
- p% ^. Y$ `  ]6 n# `8 O8 j, e. x0 Kget IDSTRING long
% E4 S! w& B& g3 VIDSTRING "paq"
get UNK1 long 
2 _2 k' u, r' W* _getdstring NAME 0x13
get ZSIZE long
2 b6 h$ m. Q- S) U* G9 a8 E% kget SIZE long
get OFFSET long
clog NAME OFFSET ZSIZE SIZE 

6 @6 S" O4 o- |% n/ u  u+ J- H解压不出东西

shane007

收到，你先说说你分析出了点什么。
8 G' F* g: p2 g) x) }是如何分析出的，根据是什么。

可以先手工试试看。offzip.

sylar

解到tga格式文件就出错了。。格式不一样的。。

IDSTRING "paq\\x00"
Math Files += 0xFFFFFF
- B6 G8 g# }' B6 M7 n9 w, p" Mfor i = 0 < FILES
savepos TEMSET
3 c$ e7 p$ |9 V# u# X5 b" afindloc NAMESET STRING "\\x00"
math NAMESET -= TEMSET
- k  }8 J2 u3 B7 Qgoto TEMSET
getdstring NAME NAMESET
% J3 O  Z* r/ F) W; O/ s. Hget UNK1 short
' I# t! p3 r, Y4 z! h" s( @8 `# H1 l$ {get UNK2 long
; P) d+ x4 S, ?) G( Z& kget ZSIZE long
/ N& s; e$ K' }9 Q# n9 o0 Oget SIZE long
savepos OFFSET
* g* z5 ?0 t+ P. t- c0 Vclog NAME OFFSET ZSIZE SIZE
math OFFSET += ZSIZE
goto OFFSET
next i

shane007

http://aluigi.altervista.org/mytoolz/offzip.zip

* V& c$ N8 r( s! ?9 }8 c9 ^Offset file unzipper 0.3.3 (offzip) .image.
' ^! r( e, K5 v3 M) xa very useful tool to unpack the zip (zlib/gzip/deflate) data contained in any type of file included raw files, packets, zip archives, executables and anything else.
it's needed only to specify the offset where the zip data starts or using the useful -S search options able to find any possible zip block contained in the provided file.
naturally there are also other options for extracting all the zip blocks which have been found or dumping them as in their original compressed form.
it's also possible to choose a windowBits value for scanning both the zlib (RFC1950) and deflate (RFC1951) blocks (for example -z -15 for common zip files and so on).

byp100

引用第2楼sylar于2009-11-10 17:43发表的  :
, O& t( f1 e# \解到tga格式文件就出错了。。格式不一样的。。

# t+ p& B' Q5 `* k2 D% [! C不错，确实能解压一部分，我参考参考写法

8 Z3 ?7 Y$ g. P0 V- |4 H也研究研究下007提供的offzip

shane007

offzip.exe -S crimson.paq 1.txt 0  >log.txt  
/ I% U5 ?  X2 a$ s: ]; j
以上命令执行结果如下
. C* R. I9 B2 k7 l9 C
% @' ~& E+ B" K7 P9 l3 W7 F. U5 NOffset file unzipper 0.3.3
by Luigi Auriemma
e-mail: [email protected]
web:    aluigi.org
( G! W/ ^' J% D' A! e" F
' d$ e9 ?( ^( e1 @- open input file:    crimson.paq
2 F; c: ~" }4 F: _5 U6 U, _- zip data to check:  32 bytes
+ A% B7 ?0 e3 l  y+ y, W- zip windowBits:     15
& O2 X+ ^# C, D# [, F; }, A' _- seek offset:        0x00000000  (0)
: }- f$ B8 M. \5 H+ B% i
+------------+-------------+-------------------------+
8 J1 k; c) k9 w0 m8 a| hex_offset | blocks_dots | zip_size --> unzip_size |
+------------+-------------+-------------------------+
  0x0000001f . 1084 --> 1392
0 W# o, E% ^" ^8 X( Y; V8 `  0x00000478 . 717 --> 911
  0x0000076a . 1750 --> 2235
* c* Y! }7 v4 K  0x00000e64 . 1419 --> 1803
  0x00001414 . 1435 --> 1859
# n. R- i3 J& |* @  0x000019d3 . 1175 --> 1587
# L) {# V+ ]+ J  b! v$ H$ [  0x00001e8a . 336 --> 595
  0x00001ff9 . 628 --> 805
  0x0000228b . 874 --> 1096
/ i+ o; v# i2 }1 \% ?3 [$ m1 |  0x00002618 . 518 --> 727
+ o8 q9 k- O* h) c  0x00002840 . 510 --> 717
  0x00002a5d . 795 --> 1038
( P' ]3 b% L( z# _1 h) m: K: R  0x00002d99 . 730 --> 1068
( P* O2 m5 j) P( u0 O  0x00003096 . 765 --> 1030
0 v1 c" |$ S" J. N: t3 R7 e  K  0x000033b2 . 862 --> 1124
9 r0 Q* k# z  @6 w  0x0000372f . 1000 --> 1162
  0x00003b37 . 1564 --> 1974
. Y( M- o3 e) t  0x00004174 . 836 --> 1152
  0x000044d9 ....... 13016 --> 30039
- `4 P/ m$ D9 f- |0 s0 w6 V* ~  0x000077d1 ... 5949 --> 6860
2 R) B1 d  ]) E6 Q$ E  0x00008f2f ...... 11007 --> 13484
# N  h& `# i- a  0x0000ba4a . 1140 --> 1395
  0x0000beda . 1204 --> 1490
! H  }; e& i, c, R7 Q1 k  0x0000c3aa . 1299 --> 1599
  0x0000c8d9 . 1288 --> 1575
. o4 I/ p5 `8 Y$ T( I  0x0000cdfd . 1790 --> 2366
  0x0000d51a . 445 --> 692
6 G$ F  K6 F5 M+ j& f  0x0000d6f5 . 448 --> 674
/ P3 d# {1 _% U3 `, S  0x0000d8d8 ....... 13638 --> 15287
# y* U1 C& o% ^3 q1 J: _% F" Q6 k  0x00010e42 .. 2438 --> 4831
: v1 _" h" M& V$ E3 v4 j  W  0x000117eb .. 2263 --> 3624
  0x000120e7 .. 3339 --> 5509
  0x00012e13 . 1927 --> 3442
  0x000135bc .... 6722 --> 11728
7 F4 M/ ~/ e+ h$ M  0x00015022 .... 6691 --> 11567
4 p$ \- R) m0 B% a) ]! H2 o  0x00016a63 .............. 28392 --> 34046
- R) D( H- u8 p$ l. F" j  0x0001d96c . 1105 --> 1390
# X  `: n2 L% E5 {) e4 B2 ^  0x0001dddc ... 5061 --> 5906
6 X, n$ C7 ?$ F$ d; t+ ]  0x0001f1c3 . 1230 --> 1492
/ J$ d' `+ s8 K) n. R  0x0001f6b5 . 527 --> 742
  0x0001f8e7 ... 5383 --> 10576
  0x00020e09 ...... 11923 --> 12569
' D/ A# P. U. f9 H  0x00023cb7 ......... 16573 --> 17231
  0x00027d8f ........... 20913 --> 21508
/ ^. R! I1 [% Z5 G- v' L! O, [  0x0002cf5b ... 4584 --> 5270
  0x0002e164 .......... 18692 --> 29425
  0x00032a89 ........... 20813 --> 31402
1 g& E: v+ b( v( `/ o; m' B  0x00037bf7 ........... 21530 --> 32091
  0x0003d032 .......... 20218 --> 30856
  0x00041f4d ............. 24876 --> 35585
$ N- x$ u( S* G; [- M# ^/ |  0x0004809a ............. 25487 --> 36286
7 `: f# ~0 p1 k& o) v  0x0004e44a ........ 14995 --> 26091
- r2 }2 J2 |6 f9 Q7 _  0x00051efe ........ 15273 --> 26325
* K/ u0 ?6 Z; b4 {( v4 L  0x00055f87 . 1116 --> 1347
1 M  {3 {3 Q  M  0x00056bb0 .... 7441 --> 8336
  0x000588df . 1736 --> 1944
5 |; `' m7 l  P3 F  0x00071d94 .......... 19391 --> 20105
" a/ t9 U: _1 `5 a  0x0007be7d ................. 33201 --> 51406
5 l5 I9 q, e( M% E( J$ \  0x0009ac56 ................................................ 97337 --> 121280
9 U. C/ s9 L& w$ `) q6 c  0x000b28ab . 895 --> 1152
  0x000b2c48 .......... 19701 --> 24422
- N& j8 s# q1 t" L8 N  0x000b795b ........ 14367 --> 17136
. n. h7 H) c0 \! y4 h" G  0x000bb197 ................. 34478 --> 46125
1 U; I. J% S* d7 \0 N9 H' f- ?3 N  0x000c3867 . 1101 --> 1331
& G, e/ k7 Q- V7 u6 U+ u  0x000c3cd4 ............... 28739 --> 52702
  0x000cad33 .. 3841 --> 5660
  0x000cbc55 .............................................................................................. 190797 --> 239555
  0x000fa5c3 ............................................ 88794 --> 115842
) o6 }# c. M( |2 W1 M  V  0x001100bb ........................ 47271 --> 63393
  0x0011b97f ............................ 55292 --> 70019


- 70 valid zip blocks found

shane007

用这个命令可以解包到目录1下，去掉前面4个字节就是jpg图片
, j; Q& G+ l. v. w% E$ Noffzip.exe -a crimson.paq 1 0  
4 `" r2 a: y$ M7 d6 f2 P8 I* L
如果要dump的话,就是，这样的话分析格式就相当简单了
offzip.exe -A crimson.paq 1 0  

/ m, E5 O% M6 T# U放上一张解包后的图片

byp100

引用第6楼shane007于2009-11-11 17:43发表的  :
6 n9 E, {2 U5 N/ ?用这个命令可以解包到目录1下，去掉前面4个字节就是jpg图片
2 c( q: _7 W. M3 F. Goffzip.exe -a crimson.paq 1 0 
. f+ [3 g2 C2 Y- u- F: O$ @  n( i
1 k3 v: H/ i+ f) H; ]如果要dump的话,就是，这样的话分析格式就相当简单了
! R% M3 t2 v2 T% m+ b* A% y  Z1 U6 doffzip.exe -A crimson.paq 1 0 
4 I# g1 Q; r1 h# R.......

* @  t. I/ \  k! U6 J3 ?% Z谢谢指导，我发现好像是要2次解包，这些天在弄个独立游戏，没时间试试看。