Recherche avancée

Sur d’autres sites (8047)

• Reverse Engineering Clue Chronicles Compression

  15 janvier 2019, par Multimedia Mike — Game Hacking

  My last post described my exploration into the 1999 computer game Clue Chronicles : Fatal Illusion. Some readers expressed interest in the details so I thought I would post a bit more about how I have investigated and what I have learned.

  It’s frustrating to need to reverse engineer a compression algorithm that is only applied to a total of 8 files (out of a total set of 140), but here we are. Still, I’m glad some others expressed interest in this challenge as it motivated me to author this post, which in turn prompted me to test and challenge some of my assumptions.

  Spoiler : Commenter ‘m’ gave me the clue I needed : PKWare Data Compression Library used the implode algorithm rather than deflate. I was able to run this .ini data through an open source explode algorithm found in libmpq and got the correct data out.

  Files To Study
  I uploaded a selection of files for others to study, should they feel so inclined. These include the main game binary (if anyone has ideas about how to isolate the decompression algorithm from the deadlisting) ; compressed and uncompressed examples from 2 files (newspaper.ini and Drink.ini) ; and the compressed version of Clue.ini, which I suspect is the root of the game’s script.

  The Story So Far
  This ad-hoc scripting language found in the Clue Chronicles game is driven by a series of .ini files that are available in both compressed and uncompressed forms, save for a handful of them which only come in compressed flavor. I have figured out a few obvious details of the compressed file format :

  bytes 0-3 "COMP"
  bytes 4-11 unknown
  bytes 12-15 size of uncompressed data
  bytes 16-19 size of compressed data (filesize - 20 bytes)
  bytes 20- compressed payload
  

  The average compression ratio is on the same order as what could be achieved by running ‘gzip’ against the uncompressed files and using one of the lower number settings (i.e., favor speed vs. compression size, e.g., ‘gzip -2’ or ‘gzip -3’). Since the zlib/DEFLATE algorithm is quite widespread on every known computing platform, I thought that this would be a good candidate to test.

  Exploration
  My thinking was that I could load the bytes in the compressed ini file and feed it into Python’s zlib library, sliding through the first 100 bytes to see if any of them “catch” on the zlib decompression algorithm.

  Here is the exploration script :
  

  <script src="https://gist.github.com/multimediamike/c95f1a9cc58b959f4d8b2a299927d35e.js"></script>
  

  It didn’t work, i.e., the script did not find any valid zlib data. A commentor on my last post suggested trying bzip2, so I tried the same script but with the bzip2 decompressor library. Still no luck.

  Wrong Approach
  I realized I had not tested to make sure that this exploratory script would work on known zlib data. So I ran it on a .gz file and it failed to find zlib data. So it looks like my assumptions were wrong. Meanwhile, I can instruct Python to compress data with zlib and dump the data to a file, and then run the script against that raw zlib output and the script recognizes the data.

  I spent some time examining how zlib and gzip interact at the format level. It looks like the zlib data doesn’t actually begin on byte boundaries within a gzip container. So this approach was doomed to failure.

  A Closer Look At The Executable
  Installation of Clue Chronicles results in a main Windows executable named Fatal_Illusion.exe. It occurred to me to examine this again, specifically for references to something like zlib.dll. Nothing like that. However, a search for ‘compr’ shows various error messages which imply that there is PNG-related code inside (referencing IHDR and zTXt data types), even though PNG files are not present in the game’s asset mix.

  But there are also strings like “PKWARE Data Compression Library for Win32”. So I have started going down the rabbit hole of determining whether the compression is part of a ZIP format file. After all, a ZIP local file header data structure has 4-byte compressed and uncompressed sizes, as seen in this format.

  Binary Reverse Engineering
  At one point, I took the approach of attempting to reverse engineer the binary. When studying a deadlisting of the code, it’s easy to search for the string “COMP” and find some code that cares about these compressed files. Unfortunately, the code quickly follows an indirect jump instruction which makes it intractable to track the algorithm from a simple deadlisting.

  I also tried installing some old Microsoft dev tools on my old Windows XP box and setting some breakpoints while the game was running and do some old-fashioned step debugging. That was a total non-starter. According to my notes :

  Address 0x004A3C32 is the setup to the strncmp(“COMP”, ini_data, 4) function call. Start there.

  Problem : The game forces 640x480x256 mode and that makes debugging very difficult.

  Just For One Game ?
  I keep wondering if this engine was used for any other games. Clue Chronicles was created by EAI Interactive. As I review the list of games they are known to have created (ranging between 1997 and 2000), a few of them jump out at me as possibly being able to leverage the same engine. I have a few of them, so I checked those… nothing. Then I scrubbed some YouTube videos showing gameplay of other suspects. None of those strike me as having similar engine characteristics to Clue Chronicles. So this remains a mystery : did they really craft this engine with its own scripting language just for one game ?

  The post Reverse Engineering Clue Chronicles Compression first appeared on Breaking Eggs And Making Omelettes.

• FFPLAY produces black video output [closed]

  28 janvier 2020, par RooterTooter

  I’m having an issue playing videos with ffplay on an embedded arm device (imx6). The OS is based on yocto sumo and uses the meta-freescale layers for imx6.

  I have a number of test videos in different formats that I am sure are formatted correctly (They play fine on my laptop with ffplay). FFMPEG has all the necessary codecs, detects my streams, it plays audio without an issue, but the video is just black.

  It’s worth nothing that I’m running X11 and have xterm running, and when ffplay is trying to play, a black box will pop up on the screen in the correct dimensions like it thinks it’s decoding video, but it’s always blank.

  $DISPLAY=:0 ffplay test.mp4
  
  ffplay version 3.3.3 Copyright (c) 2003-2017 the FFmpeg developers
  
    built with gcc 7.3.0 (GCC)
  
    configuration: --disable-stripping --enable-pic --enable-shared --enable-pthreads --disable-libxcb --disable-libxcb-shm --disable-libxcb-xfixes --disable-libxcb-shape --enable-nonfree --cross-prefix=arm-poky-linux-gnueabi- --ld='arm-poky-linux-gnueabi-gcc -march=armv7-a -mfpu=neon -mfloat-abi=hard -mcpu=cortex-a9 --sysroot=/home/builder/imx-yocto-bsp/machine/tmp/work/cortexa9hf-neon-poky-linux-gnueabi/ffmpeg/3.3.3-r0/recipe-sysroot' --cc='arm-poky-linux-gnueabi-gcc -march=armv7-a -mfpu=neon -mfloat-abi=hard -mcpu=cortex-a9 --sysroot=/home/builder/imx-yocto-bsp/machine/tmp/work/cortexa9hf-neon-poky-linux-gnueabi/ffmpeg/3.3.3-r0/recipe-sysroot' --cxx='arm-poky-linux-gnueabi-g++ -march=armv7-a -mfpu=neon -mfloat-abi=hard -mcpu=cortex-a9 --sysroot=/home/builder/imx-yocto-bsp/machine/tmp/work/cortexa9hf-neon-poky-linux-gnueabi/ffmpeg/3.3.3-r0/recipe-sysroot' --arch=arm --target-os=linux --enable-cross-compile --extra-cflags=' -O2 -pipe -g -feliminate-unused-debug-types -fdebug-prefix-map=/home/builder/imx-yocto-bsp/machine/tmp/work/cortexa9hf-neon-poky-linux-gnueabi/ffmpeg/3.3.3-r0=/usr/src/debug/ffmpeg/3.3.3-r0 -fdebug-prefix-map=/home/builder/imx-yocto-bsp/machine/tmp/work/cortexa9hf-neon-poky-linux-gnueabi/ffmpeg/3.3.3-r0/recipe-sysroot-native= -fdebug-prefix-map=/home/builder/imx-yocto-bsp/machine/tmp/work/cortexa9hf-neon-poky-linux-gnueabi/ffmpeg/3.3.3-r0/recipe-sysroot= -march=armv7-a -mfpu=neon -mfloat-abi=hard -mcpu=cortex-a9 --sysroot=/home/builder/imx-yocto-bsp/machine/tmp/work/cortexa9hf-neon-poky-linux-gnueabi/ffmpeg/3.3.3-r0/recipe-sysroot' --extra-ldflags='-Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed' --sysroot=/home/builder/imx-yocto-bsp/machine/tmp/work/cortexa9hf-neon-poky-linux-gnueabi/ffmpeg/3.3.3-r0/recipe-sysroot --enable-hardcoded-tables --libdir=/usr/lib --shlibdir=/usr/lib --datadir=/usr/share/ffmpeg --disable-mipsdsp --disable-mipsdspr2 --cpu=cortex-a9 --pkg-config=pkg-config --enable-avcodec --enable-avdevice --enable-avfilter --enable-avformat --enable-avresample --enable-bzlib --enable-gpl --disable-libgsm --disable-indev=jack --disable-libvorbis --enable-lzma --disable-libmp3lame --enable-openssl --enable-postproc --disable-libschroedinger --enable-sdl2 --disable-libspeex --enable-swresample --enable-swscale --enable-libtheora --enable-vaapi --enable-vdpau --enable-libvpx --enable-libx264 --enable-outdev=xv
  
    libavutil      55. 58.100 / 55. 58.100
  
    libavcodec     57. 89.100 / 57. 89.100
  
    libavformat    57. 71.100 / 57. 71.100
  
    libavdevice    57.  6.100 / 57.  6.100
  
    libavfilter     6. 82.100 /  6. 82.100
  
    libavresample   3.  5.  0 /  3.  5.  0
  
    libswscale      4.  6.100 /  4.  6.100
  
    libswresample   2.  7.100 /  2.  7.100
  
    libpostproc    54.  5.100 / 54.  5.100
  
  Input #0, mov,mp4,m4a,3gp,3g2,mj2, from 'test.mp4':q=    0B f=0/0   
  
    Metadata:
  
      major_brand     : isom
  
      minor_version   : 512
  
      compatible_brands: isomiso2avc1mp41
  
      encoder         : Lavf58.20.100
  
    Duration: 00:00:30.88, start: 0.000000, bitrate: 143 kb/s
  
      Stream #0:0(und): Video: h264 (High) (avc1 / 0x31637661), yuv420p, 320x180, 67 kb/s, 21.08 fps, 21.08 tbr, 16192 tbn, 42.17 tbc (default)
  
      Metadata:
  
        handler_name    : VideoHandler
  
      Stream #0:1(und): Audio: aac (LC) (mp4a / 0x6134706D), 48000 Hz, mono, fltp, 66 kb/s (default)
  
      Metadata:
  
        handler_name    : SoundHandler

  I’ve tried h264 and mp2 video with the same results. Has anyone seen this before

• Having problem in video stegano, the hiden message always lost

  5 avril 2022, par user7025125

  friend, i am currently looking for a way to video stegano. I successfully in splitting frames from video file and hide messages inside them. But when i combine these frames into video and trying to extract info from the hiden video, i always failed. I guess here is problem with video compression.

  


  Here is my code.

  


  from stegano import lsb
from os.path import isfile, join

import time  # install time ,opencv,numpy modules
import cv2
import numpy as np
import math
import os
import shutil
from moviepy.editor import *
from subprocess import call, STDOUT


def split_string(s_str, count=10):
    per_c = math.ceil(len(s_str)/count)
    c_cout = 0
    out_str = ''
    split_list = []
    for s in s_str:
        out_str += s
        c_cout += 1
        if c_cout == per_c:
            split_list.append(out_str)
            out_str = ''
            c_cout = 0
    if c_cout != 0:
        split_list.append(out_str)
    return split_list


def frame_extraction(video):
    if not os.path.exists("./tmp"):
        os.makedirs("tmp")    
    temp_folder = "./tmp"
    print("[INFO] tmp directory is created")

    vidcap = cv2.VideoCapture(video)
    count = 0

    while True:
        success, image = vidcap.read()
        if not success:
            break
        cv2.imwrite(os.path.join(temp_folder, "{:d}.png".format(count)), image)
        count += 1
        print("[INFO] frame {} is extracted".format(count))


def encode_string(input_string, root="./tmp/"):
    split_string_list = split_string(input_string)
    for i in range(0, len(split_string_list)):
        f_name = "{}{}.png".format(root, i)
        secret_enc = lsb.hide(f_name, split_string_list[i])
        secret_enc.save(f_name)
        print("[INFO] frame {} holds {}".format(f_name, lsb.reveal(f_name)))


def decode_string(video):
    frame_extraction(video)
    secret = []
    root = "./tmp/"
    for i in range(len(os.listdir(root))):
        f_name = "{}{}.png".format(root, i)
        print("[INFO] frame {} is decoding".format(f_name))
        secret_dec = lsb.reveal(f_name)
        if secret_dec == None:
            break
        secret.append(secret_dec)
    print("[INFO] secret is {}".format("".join(secret)))
    print(''.join([i for i in secret]))
    # clean_tmp()


def clean_tmp(path="./tmp"):
    if os.path.exists(path):
        shutil.rmtree(path)
        print("[INFO] tmp files are cleaned up")


def main():
    input_string = input("Enter the input string: ")
    f_name = input("enter the name of video: ")

    # 从源文件分离出帧
    frame_extraction(f_name)
    
    # 分离文件路径和扩展名
    file_path, file_extraction = os.path.splitext(f_name)
    
    # 创建输出音频文件
    audio_path = file_path + "_temp.mp3"
    video = VideoFileClip(f_name)
    video.audio.write_audiofile(audio_path)

    # 加密字符
    encode_string(input_string)

    # 从tmp文件夹的图片创建没有声音的视频
    fps=30
    img_root = r"./tmp/"
    # fourcc = cv2.VideoWriter_fourcc(*'mp4v')
    fourcc = cv2.VideoWriter_fourcc(*'XVID')
    video_file_path = file_path + "_temp.avi"
    # 获取tmp文件夹第一张视频的尺寸
    img = cv2.imread(img_root + "0.png")
    height, width, layers = img.shape
    size=(width,height)
    videoWriter = cv2.VideoWriter(video_file_path,fourcc=fourcc,fps=fps,frameSize=size)
    for i in range(len(os.listdir(img_root))):
        frame = cv2.imread(img_root+str(i)+'.png')
        videoWriter.write(frame)
    videoWriter.release()

    # 合并视频和音频     audio_path   video_file_path
    video = VideoFileClip(video_file_path)
    audio_clip = AudioFileClip(audio_path)
    video = video.set_audio(audio_clip)
    video.write_videofile(file_path + "_hide.avi")
    clean_tmp()


if __name__ == "__main__":
    while True:
        print("1.Hide a message in video 2.Reveal the secret from video")
        print("any other value to exit")
        choice = input()
        if choice == '1':
            main()
        elif choice == '2':
            decode_string(input("enter the name of video with extension: "))
        else:
            break



  


  I have tried mp4, avi, wov format. But none of them worked.

  


  IF YOU HAVE ANY IDEA OR SUGGESTION GIVEN TO ME, I WOULD BE VERY GRATEFUL