RaiderZ Online MSF/MRF Unpacker

[lhgh20]

PHP CODE

# RealSpace 3.0 MSF/MRF Unpacker 
# BMS code written by wrs 
# Version 0.4 

# Thanks to aluigi for adding the msf comtype 
# and of course for his wonderful QuickBMS! 

# Download at: http://aluigi.org/quickbms.htm 

##################################################  ################## 

# version msf compression was added 
quickbmsver 0.5.2 

# Could make sure the right input file was read? 
# When script runs, it finds it from the directory 
#open FDSE "fileindex.msf" 

# read fileindex uncompressed size 
get USIZE long 

# remaining filesize 
get SIZE asize 
math SIZE -= 4 

# save remaining file to mem 
log MEMORY_FILE 4 SIZE 

# create the xor table (only once is needed) 
callfunction CreateXORTable 

# xor data 
callfunction DataXOR 

# compression type (aluigi with his own dump2func tool) 
comtype msf 

# dump the fileindex to memory 
clog MEMORY_FILE3 0 SIZE USIZE MEMORY_FILE 


# OPTIONALLY log the unencrypted fileindex 
#log "fileindex_raw" 0 USIZE MEMORY_FILE3 



# parse the filelist structure 
# this was posted on xentax.com by wrs 

get baseDir input_folder 

set LASTMRF string "" 
set POS3 long 0 

for 
  goto POS3 MEMORY_FILE3 

  get FSIZE long MEMORY_FILE3    # unpacked size 
  get FMRFPOS long MEMORY_FILE3  # position in the mrf block 
  get FZSIZE long MEMORY_FILE3   # packed size 
  get FMRFLEN short MEMORY_FILE3 # mrf filename length 
  get FNLEN short MEMORY_FILE3   # filename length 
  get FUN long MEMORY_FILE3      # unknown 

  getdstring FMRFN FMRFLEN MEMORY_FILE3 

  # completely longwinded script to swap slashes around 
  # i'm reminded qbms treats everything as strings too.. 
  # hence the sprintf looking stuff 

  savepos POS MEMORY_FILE3 

  set tmpstr string "" 
  set hasslash long 0 

  for i = 0 to FMRFLEN 

    getvarchr FNCHAR MEMORY_FILE3 POS 
    math pos -= 1 

    if FNCHAR == '/' 
      if hasslash == 0 
        math hasslash = 1 
      endif 

      math FNCHAR = 0x5c # backslash ascii 
    endif 

    if hasslash == 1 
      string tmpstr p= "%s%c" tmpstr FNCHAR 
    endif 

  next i 

  # mrf directory :) 
  string FMRFDIR r tmpstr 

  getdstring FN FNLEN MEMORY_FILE3 

  savepos POS3 MEMORY_FILE3 

  # finished parsing the fileindex record 

  if LASTMRF != FMRFN 
    # open the mrf file for reading 
    string LASTMRF = FMRFN 

    # next allocated file index 
    open "." LASTMRF 
  
  endif 

  # copy the msf file from the mrf block 
  # we reuse the memory file for the xor function 
  log MEMORY_FILE FMRFPOS FZSIZE 

  # copy size value for function 
  set SIZE long FZSIZE 

  # xor data 
  callfunction DataXOR 

  # oddity: escape character has no effect 
  set TMPNAME string "" 
  string TMPNAME p= "%s%s" FMRFDIR FN 


  # then save it :) 
  clog TMPNAME 0 FZSIZE FSIZE MEMORY_FILE 

  # check we aren't at eof in the unencrypted fileindex 
  if POS3 == USIZE 
    cleanexit 
  endif 

next 


# exit here, only funtions below 
cleanexit 

##################################################  ################## 

# converted from the assembly function 
# pseudo-c code has been posted on ragezone too 

startfunction CreateXORTable 

  putvarchr MEMORY_FILE2 0x10000 0 

  for i = 0 < 0x10000 

    set r long i 
    math r += 1 

    for j = 0 < 8 

      set tmp_r long r 

      math tmp_r &= 1 
      math tmp_r -= 1 
      math tmp_r ~= tmp_r 

      set poly long 0x85F24C5A 
      math poly &= tmp_r 

      set tmp_r long r 
      math tmp_r >>= 1 
      math tmp_r ^= poly 

      math r = tmp_r 

    next j 

    putvarchr MEMORY_FILE2 i r 

  next i 

endfunction 

startfunction DataXOR 

  # last character 
  set LCHAR long SIZE 
  math LCHAR -= 1 

  # second last character 
  math SLCHAR = LCHAR 
  math SLCHAR -= 1 

  # i wasn't sure how to use "next i" to decrement 
  for i = 0 to SLCHAR 
     
    set EAX long LCHAR 
    math EAX -= i 

    # get the next unmodified byte from the end of file 

    set EBX long EAX 
    math EBX -= 1 
    getvarchr CL MEMORY_FILE EBX 

    # shift right 
    math CL >>= 1 

    # mask byte position by xor table size 

    set EBX long EAX 
    math EBX &= 0xFFFF 

    # get xor value at masked position 

    getvarchr XVAL MEMORY_FILE2 EBX 

    # xor values 
    math CL ^= XVAL 

    # xor with byte 
    getvarchr DL MEMORY_FILE EAX 
    math DL ^= CL 
    putvarchr MEMORY_FILE EAX DL 

  next i 

  # xor first byte with last byte (simplified) 

  getvarchr AL MEMORY_FILE LCHAR # from end of data 
  math AL >>= 1 
  getvarchr DL MEMORY_FILE2 0 # from xor table 
  math AL ^= DL 
  getvarchr DL MEMORY_FILE 0 # from start of data 
  math DL ^= AL 
  putvarchr MEMORY_FILE 0 DL # move back to start of data 
   

endfunction 

##################################################  ################## 
# eof

You must be registered to see links

who can down this theard attachments.thx

 

[Eda]

Why do you even need that one?
There are lots of other working Unpackers for the new client and the old ones.