Recherche avancée

Sur d’autres sites (10148)

• Reverse Engineering Clue Chronicles Compression

  15 janvier 2019, par Multimedia Mike — Game Hacking

  My last post described my exploration into the 1999 computer game Clue Chronicles : Fatal Illusion. Some readers expressed interest in the details so I thought I would post a bit more about how I have investigated and what I have learned.

  It’s frustrating to need to reverse engineer a compression algorithm that is only applied to a total of 8 files (out of a total set of 140), but here we are. Still, I’m glad some others expressed interest in this challenge as it motivated me to author this post, which in turn prompted me to test and challenge some of my assumptions.

  Spoiler : Commenter ‘m’ gave me the clue I needed : PKWare Data Compression Library used the implode algorithm rather than deflate. I was able to run this .ini data through an open source explode algorithm found in libmpq and got the correct data out.

  Files To Study
  I uploaded a selection of files for others to study, should they feel so inclined. These include the main game binary (if anyone has ideas about how to isolate the decompression algorithm from the deadlisting) ; compressed and uncompressed examples from 2 files (newspaper.ini and Drink.ini) ; and the compressed version of Clue.ini, which I suspect is the root of the game’s script.

  The Story So Far
  This ad-hoc scripting language found in the Clue Chronicles game is driven by a series of .ini files that are available in both compressed and uncompressed forms, save for a handful of them which only come in compressed flavor. I have figured out a few obvious details of the compressed file format :

  bytes 0-3 "COMP"
  bytes 4-11 unknown
  bytes 12-15 size of uncompressed data
  bytes 16-19 size of compressed data (filesize - 20 bytes)
  bytes 20- compressed payload
  

  The average compression ratio is on the same order as what could be achieved by running ‘gzip’ against the uncompressed files and using one of the lower number settings (i.e., favor speed vs. compression size, e.g., ‘gzip -2’ or ‘gzip -3’). Since the zlib/DEFLATE algorithm is quite widespread on every known computing platform, I thought that this would be a good candidate to test.

  Exploration
  My thinking was that I could load the bytes in the compressed ini file and feed it into Python’s zlib library, sliding through the first 100 bytes to see if any of them “catch” on the zlib decompression algorithm.

  Here is the exploration script :
  

  <script src="https://gist.github.com/multimediamike/c95f1a9cc58b959f4d8b2a299927d35e.js"></script>
  

  It didn’t work, i.e., the script did not find any valid zlib data. A commentor on my last post suggested trying bzip2, so I tried the same script but with the bzip2 decompressor library. Still no luck.

  Wrong Approach
  I realized I had not tested to make sure that this exploratory script would work on known zlib data. So I ran it on a .gz file and it failed to find zlib data. So it looks like my assumptions were wrong. Meanwhile, I can instruct Python to compress data with zlib and dump the data to a file, and then run the script against that raw zlib output and the script recognizes the data.

  I spent some time examining how zlib and gzip interact at the format level. It looks like the zlib data doesn’t actually begin on byte boundaries within a gzip container. So this approach was doomed to failure.

  A Closer Look At The Executable
  Installation of Clue Chronicles results in a main Windows executable named Fatal_Illusion.exe. It occurred to me to examine this again, specifically for references to something like zlib.dll. Nothing like that. However, a search for ‘compr’ shows various error messages which imply that there is PNG-related code inside (referencing IHDR and zTXt data types), even though PNG files are not present in the game’s asset mix.

  But there are also strings like “PKWARE Data Compression Library for Win32”. So I have started going down the rabbit hole of determining whether the compression is part of a ZIP format file. After all, a ZIP local file header data structure has 4-byte compressed and uncompressed sizes, as seen in this format.

  Binary Reverse Engineering
  At one point, I took the approach of attempting to reverse engineer the binary. When studying a deadlisting of the code, it’s easy to search for the string “COMP” and find some code that cares about these compressed files. Unfortunately, the code quickly follows an indirect jump instruction which makes it intractable to track the algorithm from a simple deadlisting.

  I also tried installing some old Microsoft dev tools on my old Windows XP box and setting some breakpoints while the game was running and do some old-fashioned step debugging. That was a total non-starter. According to my notes :

  Address 0x004A3C32 is the setup to the strncmp(“COMP”, ini_data, 4) function call. Start there.

  Problem : The game forces 640x480x256 mode and that makes debugging very difficult.

  Just For One Game ?
  I keep wondering if this engine was used for any other games. Clue Chronicles was created by EAI Interactive. As I review the list of games they are known to have created (ranging between 1997 and 2000), a few of them jump out at me as possibly being able to leverage the same engine. I have a few of them, so I checked those… nothing. Then I scrubbed some YouTube videos showing gameplay of other suspects. None of those strike me as having similar engine characteristics to Clue Chronicles. So this remains a mystery : did they really craft this engine with its own scripting language just for one game ?

  The post Reverse Engineering Clue Chronicles Compression first appeared on Breaking Eggs And Making Omelettes.

• How can I reset the path of FFMPEG in Java ?

  30 octobre 2018, par Figgyja

  I accidentally set the path for FFMPEG to a different folder, and I can’t change it back.

  I’m using Processing (the API and its IDE) and the user created Video Export library to capture and write an mp4 video file. The library required FFMPEG, so I downloaded and installed it. After I installed it, I ran the code, and the library called Java to request the path of FFMPEG. I wrongly set the path to a different folder, which I eventually deleted. I knew I set it to the wrong folder, and ran the code again to see if I could trigger the Java prompt again to reset the folder.

  ---

  The console response I received was : (I’m sure most of it doesn’t have to do with the actual issue. However, I wanted to show all of it in case it somehow does.)

  Oct 24, 2016 10:23:25 PM java.util.prefs.WindowsPreferences
  WARNING : Could not open/create prefs root node Software\JavaSoft\Prefs
  at root 0x80000002. Windows RegCreateKeyEx(...) returned error code 5.
  java.io.IOException : Cannot run program
  "C :...\Processing\Octree_Graphics\data\FFMPEG\ff-prompt.bat" :
  CreateProcess error=2, The system cannot find the file specified at
  java.lang.ProcessBuilder.start(ProcessBuilder.java:1048) at
  com.hamoid.VideoExport.startFfmpeg(Unknown Source) at
  com.hamoid.VideoExport.initialize(Unknown Source) at
  com.hamoid.VideoExport.saveFrame(Unknown Source) at
  Octree_Graphics.draw(Octree_Graphics.java:90) at
  processing.core.PApplet.handleDraw(PApplet.java:2399) at
  processing.opengl.PSurfaceJOGL$DrawListener.display(PSurfaceJOGL.java:731)
  at
  jogamp.opengl.GLDrawableHelper.displayImpl(GLDrawableHelper.java:692)
  at jogamp.opengl.GLDrawableHelper.display(GLDrawableHelper.java:674)
  at
  jogamp.opengl.GLAutoDrawableBase$2.run(GLAutoDrawableBase.java:443)
  at
  jogamp.opengl.GLDrawableHelper.invokeGLImpl(GLDrawableHelper.java:1293)
  at
  jogamp.opengl.GLDrawableHelper.invokeGL(GLDrawableHelper.java:1147)
  at com.jogamp.newt.opengl.GLWindow.display(GLWindow.java:759) at
  com.jogamp.opengl.util.AWTAnimatorImpl.display(AWTAnimatorImpl.java:81)
  at com.jogamp.opengl.util.AnimatorBase.display(AnimatorBase.java:452)
  at
  com.jogamp.opengl.util.FPSAnimator$MainTask.run(FPSAnimator.java:178)
  at java.util.TimerThread.mainLoop(Timer.java:555) at
  java.util.TimerThread.run(Timer.java:505) Caused by :
  java.io.IOException : CreateProcess error=2, The system cannot find the
  file specified at java.lang.ProcessImpl.create(Native Method) at
  java.lang.ProcessImpl.(ProcessImpl.java:386) at
  java.lang.ProcessImpl.start(ProcessImpl.java:137) at
  java.lang.ProcessBuilder.start(ProcessBuilder.java:1029) ... 17 more
  VideoExport error : Ffmpeg failed. Study
  C :...\Processing\Octree_Graphics\basic.mp4.txt for more details.

  ---

  I need to find a way to reset the path of FFMPEG that Java has. I have tried uninstalling and reinstalling the library, but I haven’t tried Java (I don’t want to mess with anything it has in its current state).

  P.S. The file listed at the end of the console response (basic.mp4.txt) was empty because it had not begun writing to the file yet.

• tools/target_dec_fuzzer : Fix parser_avctx memleak on error path

  30 juin 2018, par Michael Niedermayer

  tools/target_dec_fuzzer : Fix parser_avctx memleak on error path
  Fixes : oss-fuzz issue 9195
  Found-by : continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
  
  Signed-off-by : Michael Niedermayer <michael@niedermayer.cc>
  

  • [DH] tools/target_dec_fuzzer.c