paq解包脚本如何写

byp100

分析了半天还是没分析出解压脚本
. }/ Z4 D0 P( k7 r" _6 }苏洋的解包动画也看不到。。。。007能分析指导一下吗？
get IDSTRING long
3 S  J: @; d8 d; P3 p+ S3 @IDSTRING "paq"
! ~$ n% I4 t0 Y" u* Pget UNK1 long 
getdstring NAME 0x13
, J0 x0 l7 k+ a7 z* P2 x. aget ZSIZE long
get SIZE long
get OFFSET long
. A* S0 `' h* q: i5 }; P6 q2 ]" nclog NAME OFFSET ZSIZE SIZE 

解压不出东西

byp100

引用第6楼shane007于2009-11-11 17:43发表的  :
用这个命令可以解包到目录1下，去掉前面4个字节就是jpg图片
2 r6 K. _. P% b7 G- _. \6 zoffzip.exe -a crimson.paq 1 0 

如果要dump的话,就是，这样的话分析格式就相当简单了
offzip.exe -A crimson.paq 1 0 
+ U$ w" n9 N& ^% ?* n4 Z$ i.......

谢谢指导，我发现好像是要2次解包，这些天在弄个独立游戏，没时间试试看。

shane007

用这个命令可以解包到目录1下，去掉前面4个字节就是jpg图片
offzip.exe -a crimson.paq 1 0  

; w, I3 m9 m2 R' C8 B7 m* j如果要dump的话,就是，这样的话分析格式就相当简单了
offzip.exe -A crimson.paq 1 0  

+ R# @  C9 G& _9 f放上一张解包后的图片

shane007

offzip.exe -S crimson.paq 1.txt 0  >log.txt  
/ J4 Y2 U4 S4 ?5 R! @+ t" |
1 G' {' p& S" K# q) l, u以上命令执行结果如下

. r" X0 U1 C& i/ ~) IOffset file unzipper 0.3.3
by Luigi Auriemma
9 K! @8 E5 U2 ]* O, \+ Ke-mail: [email protected]
7 R( m( R( L% s5 L3 h# jweb:    aluigi.org
& w# {0 Y5 ]5 O9 c; D! E# i
- open input file:    crimson.paq
8 X# f3 M; i' c" p+ p8 H. P) q- zip data to check:  32 bytes
- zip windowBits:     15
- seek offset:        0x00000000  (0)
; j* W9 @2 A" @. {, F2 E+ L
+------------+-------------+-------------------------+
| hex_offset | blocks_dots | zip_size --> unzip_size |
+------------+-------------+-------------------------+
  0x0000001f . 1084 --> 1392
5 l/ W' g$ }9 O. h3 B* M  0x00000478 . 717 --> 911
: B2 f  J' g; v) s8 Y. ^  0x0000076a . 1750 --> 2235
  0x00000e64 . 1419 --> 1803
/ T; d0 O  K, Y8 J; J  0x00001414 . 1435 --> 1859
- i" R' n! w, T9 B. H+ C3 o! D" a  0x000019d3 . 1175 --> 1587
) ?! o+ W' [3 s' X  i" |  0x00001e8a . 336 --> 595
/ g- ]- y" g" L  0x00001ff9 . 628 --> 805
! }7 r* X4 C$ I1 F- K' u. Z  x  0x0000228b . 874 --> 1096
  0x00002618 . 518 --> 727
  0x00002840 . 510 --> 717
  p+ D% _$ W1 b, n( G7 M* P8 B" D  0x00002a5d . 795 --> 1038
  0x00002d99 . 730 --> 1068
  0x00003096 . 765 --> 1030
9 b% c3 }4 X# l3 ^  0x000033b2 . 862 --> 1124
  0x0000372f . 1000 --> 1162
  0x00003b37 . 1564 --> 1974
- o* {; M- a2 y; Q* S  0x00004174 . 836 --> 1152
* q0 |- @5 a# P7 z8 H# C6 b  0x000044d9 ....... 13016 --> 30039
  0x000077d1 ... 5949 --> 6860
6 X, P$ J/ C! j2 J. K/ n" D  0x00008f2f ...... 11007 --> 13484
" u+ n) K; s9 y+ D6 {  0x0000ba4a . 1140 --> 1395
4 [/ _; X# |$ ]7 b  0x0000beda . 1204 --> 1490
  0x0000c3aa . 1299 --> 1599
  0x0000c8d9 . 1288 --> 1575
, \: l7 ~4 y- @$ J! K7 F# l7 S% k  0x0000cdfd . 1790 --> 2366
( S/ }6 M5 f" D! O  0x0000d51a . 445 --> 692
  0x0000d6f5 . 448 --> 674
4 k- o* S/ }( [. @/ \  0x0000d8d8 ....... 13638 --> 15287
  0x00010e42 .. 2438 --> 4831
- g- ~  }) U! q! X( M9 V/ q0 ~  0x000117eb .. 2263 --> 3624
  0x000120e7 .. 3339 --> 5509
) b. X* n; G6 H; n, k  0x00012e13 . 1927 --> 3442
0 v$ J! c0 H$ G  0x000135bc .... 6722 --> 11728
$ P+ V! h. h" k, c, _# L$ H  0x00015022 .... 6691 --> 11567
  0x00016a63 .............. 28392 --> 34046
* Y* F+ T5 z" j! z* U9 O  0x0001d96c . 1105 --> 1390
  0x0001dddc ... 5061 --> 5906
  0x0001f1c3 . 1230 --> 1492
1 @' r+ G. Y3 X2 |  0x0001f6b5 . 527 --> 742
3 Y- |- M! K6 U5 X& g  0x0001f8e7 ... 5383 --> 10576
  0x00020e09 ...... 11923 --> 12569
  0x00023cb7 ......... 16573 --> 17231
5 C3 t; K0 ^' _7 }! {: h7 i  0x00027d8f ........... 20913 --> 21508
  0x0002cf5b ... 4584 --> 5270
  0x0002e164 .......... 18692 --> 29425
& r- }* u* G3 ?$ ^6 o/ S6 I4 Y% E* q$ k" @  0x00032a89 ........... 20813 --> 31402
  0x00037bf7 ........... 21530 --> 32091
  0x0003d032 .......... 20218 --> 30856
2 E2 c' N* X' T8 i& Z  y& V- A  0x00041f4d ............. 24876 --> 35585
  0x0004809a ............. 25487 --> 36286
, N8 p# m- h* J4 y* p. M/ N  0x0004e44a ........ 14995 --> 26091
  0x00051efe ........ 15273 --> 26325
  0x00055f87 . 1116 --> 1347
7 l# X/ A2 z! U: b  0x00056bb0 .... 7441 --> 8336
: z$ g& ?' k- e# p, P" I( ~0 C. a  0x000588df . 1736 --> 1944
  0x00071d94 .......... 19391 --> 20105
+ ]; @8 q  Z/ a/ {  0x0007be7d ................. 33201 --> 51406
  0x0009ac56 ................................................ 97337 --> 121280
  0x000b28ab . 895 --> 1152
  0x000b2c48 .......... 19701 --> 24422
  0x000b795b ........ 14367 --> 17136
3 o6 O/ ]9 i" G9 s8 n* {# s  0x000bb197 ................. 34478 --> 46125
  0x000c3867 . 1101 --> 1331
: {' c) i: K: ~( w  @+ F  0x000c3cd4 ............... 28739 --> 52702
  0x000cad33 .. 3841 --> 5660
' _  x1 S8 J- A  0x000cbc55 .............................................................................................. 190797 --> 239555
  0x000fa5c3 ............................................ 88794 --> 115842
  0x001100bb ........................ 47271 --> 63393
  0x0011b97f ............................ 55292 --> 70019
3 l: h9 U9 q! h+ w* C  q2 T5 `

) j: [  }, A  a/ k! o: w6 x- 70 valid zip blocks found

byp100

引用第2楼sylar于2009-11-10 17:43发表的  :
; [8 j/ s5 H. ^  J解到tga格式文件就出错了。。格式不一样的。。

不错，确实能解压一部分，我参考参考写法
# X9 Z; [* a6 p$ G+ }& `* `' i$ c
也研究研究下007提供的offzip

shane007

http://aluigi.altervista.org/mytoolz/offzip.zip
% Y$ B$ p+ q2 y2 ?1 n$ `
Offset file unzipper 0.3.3 (offzip) .image.
a very useful tool to unpack the zip (zlib/gzip/deflate) data contained in any type of file included raw files, packets, zip archives, executables and anything else.
it's needed only to specify the offset where the zip data starts or using the useful -S search options able to find any possible zip block contained in the provided file.
4 Y) V+ i8 X6 Enaturally there are also other options for extracting all the zip blocks which have been found or dumping them as in their original compressed form.
it's also possible to choose a windowBits value for scanning both the zlib (RFC1950) and deflate (RFC1951) blocks (for example -z -15 for common zip files and so on).

sylar

解到tga格式文件就出错了。。格式不一样的。。

IDSTRING "paq\\x00"
Math Files += 0xFFFFFF
for i = 0 < FILES
savepos TEMSET
; `3 d, g! r; ]3 h& ofindloc NAMESET STRING "\\x00"
math NAMESET -= TEMSET
goto TEMSET
getdstring NAME NAMESET
" h" E8 V( O$ K' Q+ d9 @get UNK1 short
- g1 f8 R+ X3 X+ D. }4 k0 Jget UNK2 long
get ZSIZE long
get SIZE long
$ t7 _% ~5 Z2 j- ^0 Xsavepos OFFSET
% o. p5 V. A  Fclog NAME OFFSET ZSIZE SIZE
! K; `6 ]2 }4 V0 Qmath OFFSET += ZSIZE
8 L! F! E" ~" |$ }0 Ugoto OFFSET
! F  g% f, G' vnext i

shane007

收到，你先说说你分析出了点什么。
是如何分析出的，根据是什么。

+ T% h6 K1 ]6 Z  g: m可以先手工试试看。offzip.