diff --git a/images/parse_packet.png b/images/parse_packet.png new file mode 100644 index 0000000..c20df7f Binary files /dev/null and b/images/parse_packet.png differ diff --git a/images/parse_packet_header_a.png b/images/parse_packet_header_a.png new file mode 100644 index 0000000..c98f402 Binary files /dev/null and b/images/parse_packet_header_a.png differ diff --git a/images/parse_packet_header_b.png b/images/parse_packet_header_b.png new file mode 100644 index 0000000..46483f4 Binary files /dev/null and b/images/parse_packet_header_b.png differ diff --git a/images/parse_packet_header_c.png b/images/parse_packet_header_c.png new file mode 100644 index 0000000..976db5b Binary files /dev/null and b/images/parse_packet_header_c.png differ diff --git a/styles.css b/styles.css index 5b50cb4..d17b594 100644 --- a/styles.css +++ b/styles.css @@ -96,16 +96,21 @@ pre { summary { user-select: none; cursor: pointer; + color: #c7254e; } details { - background: lightblue; - border: 1px solid cornflowerblue; - padding: 4px; + background: #f9f2f4; + border: 1px solid #c7b3b8; + border-radius: 2px; + padding: 4px 8px; margin: 4px 0; overflow-x: auto; max-width: 100%; } +details code { + background: #fff; +} table.nav { padding-right: 1px; diff --git a/templates/base.html b/templates/base.html index cc93adb..b9b5a2b 100644 --- a/templates/base.html +++ b/templates/base.html @@ -7,7 +7,7 @@
Every packet starts with the magic byte 0xA0
. Following this is the content byte, the encoding byte,
and then the 2's compliment of the encoding byte.
Currently known possible values for the content byte are:
+Possible values for the content byte are:
Full names, schema only |
I haven't seen 0x44
, so no idea what that one does, before you ask.
Not totally cleaned these up yet, but the general concept of how packets are parsed can be seen fairly clearly.
+ At a high level, we have a single function that validates the header, parses out the schema, then goes to read
+ the body of the packet, if we're expecting it. The arguments to parse_packet_header
will make more
+ sense in a moment.
libavs-win32.dll:0x1003483
parse_packet_header
has a lot of things going on, so I'm just pulling out a few important snippets
+ here.
libavs-win32.dll:0x1003448c
We first read out four bytes from the start of the packet, and convert that to an integer; nothing especially
+ magic here. The next block however is potentially not the first that you might have expected to see. Based on
+ the two flags passed into the function arguments, we are going to subtract a value from this header.
+ Specifically, the first byte we subtract is always 0xa0
, then the second byte are those
+ C
value in the table above.
+
Finally, we mask out the first two bytes, and assert that they're both null. That is, they are exactly equal to + the value we subtracted from them. Of note here is that the caller to this function "decides" what sort of + packet it is expecting.
+We can also see the check for ~E
here. If that check passes, we return the E
byte,
+ otherwise we're going to error.
The encoding flag indicates the encoding for all string types in the packet (more on those later). Possible values are:
Data is assumed by default to be in ISO 8859 encoding. That is, for encodings 0x00
and
- 0x40
, no transformation is performed on the binary data to produce readable text.
0x40
, no transformation is performed on the binary data to produce readable text.
+
ASCII encoding is true 7-bit ASCII, with the 8th bit always set to 0. This is validated.
This part of the header defines the schema that the main payload uses.
-A tag definition looks like:
+A tag definition follows one of the following three formats:
+Compressed names:
+0 | +1 | +2 | +3 | +4 | +5 | +6 | +7 | +8 | +9 | +10 | +11 | +12 | +13 | +14 | +15 | +
Type | +nlen | +Tag name | ++ | ||||||||||||
Attributes and children | +FE | +
Full names, short length:
+0 | +1 | +2 | +3 | +4 | +5 | +6 | +7 | +8 | +9 | +10 | +11 | +12 | +13 | +14 | +15 | +
Type | +0x40-0x64 | +Tag name | ++ | ||||||||||||
Attributes and children | +FE | +
Full names, long length:
+0 | +1 | +2 | +3 | +4 | +5 | +6 | +7 | +8 | +9 | +10 | +11 | +12 | +13 | +14 | +15 | +
Type | +0x80-0x8f | +0x00-0xff | +Tag name | ++ | |||||||||||
Attributes and children | +FE | +
0 | -1 | -2 | -3 | -4 | -5 | -6 | -7 | -8 | -9 | -10 | -11 | -12 | -13 | -14 | -15 | -|
Type | -nlen | -Tag name | -- | |||||||||||||
Attributes and children | -FE | -
The encoding of structure names varies depending on the packet content byte. If the content flag indicates we have
- full names, then nlen
will be masked with 0x40
. The string length is the unmasked value,
- +1 (0-length names make no sense anyway). We can then read off the correct number of bytes, and decode accordingly.
+
The encoding of structure names varies depending on the packet content byte. If the content flag indicated we have a
+ full string, we first need to check if the value of the first byte exceeds 0x7f
. If it does, we need to
+ read an additional byte. In the single byte case, we subtract 0x3f
1 to get our real length.
+ In the two byte case we subtract 0x7fbf
2. In the latter case, the maximum allowed length is
+ 0x1000
.
+ 1 simplified from (length & ~0x40) + 0x01
+ 2 simplified from (length & ~0x8000) + 0x41
If we are instead parsing packed names, then the names are encoded as densely packed 6 bit values. The length prefix
(nlen
) determines the length of the final unpacked string. The acceptable alphabet is
0123456789:ABCDEFGHIJKLMNOPQRSTUVWXYZ_abcdefghijklmnopqrstuvwxyz
, and the packed values are indecies
- within this alphabet.
+ within this alphabet. The maximum length for a name in this mode is 36 bytes (0x24
).
The children can be a combination of either attribute names, or child tags. Attribute names are represented by
the byte 0x2E
followed by a length prefixed name as defined above. Child tags follow the above
- format. Type 0x2E
must therefore be considered reserved as a possible structure type.
0x2E
must therefore be considered reserved as a possible structure type. As they carry
+ special meaning in text-bsaed XML encoding, attribute names beginning with __
are disallowed.
+
+I'm not going to labour this one, so if you want to go look yourself:
+libavs-win32.dll:0x10009f90
libavs-win32.dll:0x1000a110
libavs-win32.dll:0x10034a57
, with the __
checking starting
+ at libavs-win32:0x10034cfd
for attributes (i.e. the JZ
at 0x10034a7c
)
+ Attributes (type 0x2E
) represent a string attribute. Any other attribute must be defined as a child
tag. Is it notable that 0 children is allowable, which is how the majority of values are encoded.
All valid IDs, and their respective type, are listed in the following table. The bucket column here will be used later when unpacking the main data, so we need not worry about it for now, but be warned it exists and is possibly the least fun part of this format.
@@ -766,7 +890,9 @@ optional, however should be stripped during decoding.All of these IDs are & 0x3F
. Any value can be turned into an array by setting the 7th bit
high (| 0x40
). Arrays of this form, in the data section, will be an aligned size: u32
- immediately followed by size
bytes' worth of (unaligned!) values of the unmasked type.
size
bytes' worth of (unaligned!) values of the unmasked type. Despite being a
+ u32
, the maximum length allowed is 0xffffff
.
+
This seems to suggest that internally arrays are represented as a normal node, with the array
type, however when serializing it's converted into the array types we're used to (well, will be after the
- next sections) by masking 0x40 onto the contained type.
0x40
onto the contained type.
Also of interest from this snippet is the fact that void
, bin
, str
,
and attr
cannot be arrays. void
and attr
make sense, however
str
and bin
are more interesting. I suspect this is because konami want to be able