need some info on process of res extraction

[duncan]

Hi,

I want to code a python RES extractor.

Only problem i face at the moment is where to obtain the names to the files that are packed in the res? They do not seem recorded in the res.

Anyone around that perhaps remembers from discussions of old?

Cheers,
Duncan

[Jeff]

I found the following ancient quote from Solidox. I think the two lines I put in bold might help.

From: Solidox

Hardwar .RES File format
this format has been puzzling me for some time now and it still is
but now at least i've got a bit of it worked out.

Basically it's file after file after file with the header at the end.
the last 4 bytes of the file is the offset of where the header starts

anyways i'll keep working at it and once i find out a bit more about
the format i'll make a file extractor or summin'

char sr[] = "SOFTWAREREFINERY";

struct
{
int dunno; //no idea always seems to be 2
char filename[16]; //filename is XOR'd by sr; filename ^= sr
int offset; //where the file starts
int length; //how long the file is
} FILE;

struct
{
short num_files; //how many files are in the .res
short unknown; // ??
FILE [num_files]; //array of file info
} HEADER;

int = 32bit, short = 16bit, char = 8bit

[duncan]

Awesome this community. Thanks, that was very helpfull, it proofs the filename is encrypted. Looks like a relatively simple substitution matrix for each character in the name string. Must be able to work that out with the data I got.

[Jeff]

I found a simple example of XOR Encryption/Decryption with Python that might do what you need.

www.evanfosmark.com/2008/06/xor-encryption-with-python/

[duncan]

It does!!
Amazing, so simple, just one line of code to encode.

data = 'stringtoencode'
key = 'keystringofsuffiecientlength'

#encode
encoded = ''.join([chr(ord(data)^ord(key)) for i in range(len(data))])

#and decode:
decoded = ''.join([chr(ord(encoded)^ord(key)) for i in range(len(encoded))])


Works!

Wish I learned of that before i spent hours on frequency analysis and touching up - did make a table that worked for my file.

[duncan]

wanted to post code here, but pretty useless if indentation is removed by the forums scipts. also if i use the code block indentation also removed in code block

[duncan]

replaced indentation of spaces by tabs, lets see if that works

#Python 3.2 (r32:88452, Feb 20 2011, 10:19:59)

#Hardwar res extractor
#Duncan June 2010

#script does the job, but is pretty minimal
#no error checking, and assumes folders for write operations are present
#note: only extracts files of types specified in filter, and spr to subdir SPR
#doesnt create the folders if missing
#i tend to run from IDLE by copy/paste, hence the opening with 'for once...'
# to avoids indentation errors


for once in range(1):
## file and paths
respath = 'path_to_res_file/'
resname = 'hardwar.res'


#destination path
dpath = 'path_to_destination_folder/'



##read lines from res file of packed fileinfo
res = open(respath+resname,'rb')
ressize = res.seek(0,2)

import array
resheader = array.array('L')

dump = res.seek(ressize-4)
resheader.fromfile(res,1)


dump = res.seek(resheader[0])

resnumfiles = array.array('H')
resnumfiles.fromfile(res,2)


resfile = array.array('B')

resfiles = []
for i in range(resnumfiles[0]):
resfile.fromfile(res,28)
resfiles.append(resfile.tolist())
for ii in range(len(resfile)):
dump = resfile.pop()

res.close()




##decode res header filename according to smi and smii tables
##also add offset and size data


global resdata
resdata = []
resfdat = array.array('L')
key = 'SOFTWAREREFINERY'


for i in range(len(resfiles)):

resfdat.frombytes(bytes(resfiles[i][20:28]))


#XOR decode
decoded = ''.join([chr(resfiles[i][4+ii]^ord(key[ii])) for ii in range(12)])


#strip spaces
temp =''
for ii in range(len(decoded)):
if decoded[ii] == ' ': pass
else: temp = temp+decoded[ii]


resdata.append([temp,resfdat[0],resfdat[1]])
dump = resfdat.pop()
dump = resfdat.pop()



##write files, note separate function
def reswrite():

res = open(respath+resname,'rb')

filter = ['WLD','WXP','MAT','PAL','SPR']

for i in range(len(resdata)):
sprfolder = ''
for extension in filter:
if resdata[i][0][len(resdata[i][0])-3:len(resdata[i][0])] == extension:
if extension == 'SPR': sprfolder = 'SPR/'
dfile = open(dpath+sprfolder+resdata[i][0],'wb')

res.seek(resdata[i][1])
dfile.write(res.read(resdata[i][2]))
dfile.close()

res.close()



[duncan]

***BUMP***

Hi Sushi - here a python script that should extract the RES file.

The first part you copy paste in IDLE and press enter twice to run.
The second part (the reswrite function), you also copy paste and press enter twice, but it will run only after calling the function by typing:
reswrite()

Make sure to set the right file paths

[sushi]

Nothing happens... My destination folder C:\Extraction remains empty.

for once in range(1):
   ## file and paths
   respath = 'G:\/'
   resname = 'hardwar.res'


   #destination path
   dpath = 'C:\Extraction\ResExtraction.res/'



Even if i write
- dpath = 'C:\Extraction\ResExtraction/'
- dpath = 'C:\Extraction\ResExtraction.txt/'
- dpath = 'C:\Extraction\/'

And then, when I write "reswrite()" in Idle I have :

================================
>>>
>>> reswrite()
Traceback (most recent call last):
File "<pyshell#2>", line 1, in <module>
reswrite()
File "C:/Extraction/Resextraction.py", line 100, in reswrite
dfile = open(dpath+sprfolder+resdata[0],'wb')
FileNotFoundError: [Errno 2] No such file or directory: 'C:\\Extraction\\ResExtraction.res/SPR/UPSELL.SPR'
>>>

Sorry for being so stupid with all this coding


An other question, in the filter script I don't see any ".FNT" but many others that I don't need "filter = ['WLD','WXP','MAT','PAL','SPR']".
Could I write only "filter = ['FNT']" instead ?

@+

[riedquat]

Hey! You are not stupid at coding! The problem are the teachers!!

Stupid question nº 1: Why do you want a new res extractor? What happened with the old one?

Stupid question nº 2: Isn't there a way to put "the script" in a stand alone bat or something?

[duncan]

Feb 22, 2013 13:07:44 GMT -5 riedquat said:

Hey! You are not stupid at coding! The problem are the teachers!!

Haha - I agree with that - I always though why is it that the smart people need to go to university, because the material really is not that hard - It is just that the teachers are crap at teaching.

Stupid question nº 1: Why do you want a new res extractor? What happened with the old one?

Indeed, that may be easier - to use the old one. It slipped my mind.

[duncan]

Feb 21, 2013 4:46:04 GMT -5 sushi said:

Nothing happens... My destination folder C:\Extraction remains empty.

for once in range(1):
   ## file and paths
   respath = 'G:\/'
   resname = 'hardwar.res'


   #destination path
   dpath = 'C:\Extraction\ResExtraction.res/'



Even if i write
- dpath = 'C:\Extraction\ResExtraction/'
- dpath = 'C:\Extraction\ResExtraction.txt/'
- dpath = 'C:\Extraction\/'

And then, when I write "reswrite()" in Idle I have :

================================
>>>
>>> reswrite()
Traceback (most recent call last):
File "<pyshell#2>", line 1, in <module>
reswrite()
File "C:/Extraction/Resextraction.py", line 100, in reswrite
dfile = open(dpath+sprfolder+resdata[0],'wb')
FileNotFoundError: [Errno 2] No such file or directory: 'C:\\Extraction\\ResExtraction.res/SPR/UPSELL.SPR'
>>>

Sorry for being so stupid with all this coding


An other question, in the filter script I don't see any ".FNT" but many others that I don't need "filter = ['WLD','WXP','MAT','PAL','SPR']".
Could I write only "filter = ['FNT']" instead ?

@+

Yes you would want the ones ending in FNT. Spotted very well.

To build your path you need to use only / or only \.
It will only work with one of those - i believe you need /
A mix of / and \ will not work.

Almost there.

[sushi]

Nothing... Maybe it doesn't work with the FR version...