
Sample:
http://sendfile.su/1586990
https://mega.nz/file/fn4imDYT#F6Y8OF73G ... esPak_9C6w
Signature: RDAR
Code: Select all
get radr long
if radr != 0x52414452
cleanexit
endif
get num1 long
if num1 != 0xc
cleanexit
endif
get io1 longlong
get is1 longlong
get is2 longlong
get full_size longlong
if is2 == 0
log MEMORY_FILE io1 is1
math tn1 = -1
callfunction read_toc 1
else
cleanexit
endif
startfunction read_toc
goto 0 tn1
get toc1 long tn1
get toc2 long tn1
get toc3 longlong tn1
get toc4 long tn1
get toc5 long tn1
get toc6 long tn1
# first TOC (file checksum info)
for i1 = 0 < toc4
get entinf1 longlong tn1
get entinf2 time64 tn1
getdstring entinf3 0x14 tn1
getdstring entinf4 0x14 tn1
next i1
# second TOC (file offset + file size info)
for i2 = 0 < toc5
get entinf5 longlong tn1
get entinf6 long tn1
get entinf7 long tn1
log "" entinf5 entinf6 0
next i2
# third TOC (present in voice archives)
for i3 = 0 < toc6
get entinf8 longlong tn1
next i3
endfunction
Code: Select all
- 4376 files found in 54 seconds
coverage file 0 95% 180544507 189554688 . offset 000000000b4c5edc
Code: Select all
get radr long
if radr != 0x52414452 # "RDAR"/"RADR"
cleanexit
endif
get num1 long
if num1 != 0xc
cleanexit
endif
get io1 longlong
get is1 longlong
get is2 longlong
get full_size longlong
if is2 == 0
log MEMORY_FILE io1 is1
math tn1 = -1
callfunction read_toc 1
else
cleanexit
endif
startfunction read_toc
goto 0 tn1
get toc1 long tn1
get toc2 long tn1
get toc3 longlong tn1
get toc4 long tn1
get toc5 long tn1
get toc6 long tn1
math toc4_io = 0x1c
xmath toc5_io "toc4_io + (toc4 * 0x38)"
xmath toc6_io "toc5_io + (toc5 * 0x10)"
math toc4_sz = 0x38
math toc5_sz = 0x10
math toc6_sz = 8
goto toc4_io tn1
get hash1 longlong tn1
get date time64 tn1
get chunks_per_file long tn1
get init_en1 long tn1
get last_en1 long tn1
get init_en2 long tn1
get last_en2 long tn1
getdstring entinf4 0x14 tn1
math toc4_io + toc4_sz
xmath h1_1 "hash1 & 0xffffffff"
xmath h1_2 "(hash1 >> 32) & 0xffffffff"
string en1_fn p "%08x%08x" h1_2 h1_1
append
for j1 = init_en1 < last_en1
goto toc5_io tn1
get en1_ofst longlong tn1
get en1_sz1 long tn1
get en1_sz2 long tn1
math toc5_io + toc5_sz
if en1_sz1 == en1_sz2
log en1_fn en1_ofst en1_sz1 0
else
goto en1_ofst 0
get comp_id long 0
get original_size long 0
math comp_algo_is_found = 0
if comp_id == 0x4b52414b # "KARK"/"KRAK"
comtype oodle
math comp_algo_is_found = 1
else
string comp_id_2 = comp_id
print " unknown ID for compressed file - %comp_id_2% "
cleanexit
endif
if comp_algo_is_found = 1
xmath en1_comp_ofst "en1_ofst + 8"
xmath en1_sz3 "en1_sz1 - 8"
clog en1_fn en1_comp_ofst en1_sz3 en1_sz2 0
else
log en1_fn en1_ofst en1_sz1 0
endif
endif
next j1
append
for j1 = init_en2 < last_en2
goto toc6_io tn1
get entinf8 longlong tn1
math toc6_io + toc6_sz
next j1
next i1
endfunction
Code: Select all
####################################
comtype OODLE
get FNAME basename
idstring "RDAR"
get Version long
get TableOffset longlong
get ArchiveID longlong
get DUMMY longlong
get TotalFileSize longlong
GoTo TableOffset
get SIGN long
get HashTableSize long
get HashTableID longlong
get HashTableCount long
get ItemCount long
get DUMMY long
for i = 0 < HashTableCount
GetDString HASHES 0x38
next i
for i = 0 < ItemCount
get OFFSET longlong
get ZSIZE long
get SIZE long
if ZSIZE == SIZE
if SIZE u> 16
log MEMORY_FILE OFFSET SIZE
callfunction GETEX 1
endif
string NAME p "%s/%u.%s" FNAME OFFSET EXT
log NAME OFFSET SIZE
else
math OFFSET + 8
math ZSIZE - 8
if SIZE u> 16
clog MEMORY_FILE OFFSET ZSIZE SIZE
callfunction GETEX 1
endif
string NAME p "%s/%u.%s" FNAME OFFSET EXT
clog NAME OFFSET ZSIZE SIZE
endif
next i
startfunction GETEX
goto 0 MEMORY_FILE
get SIGN1 byte MEMORY_FILE
goto 0 MEMORY_FILE
getdstring SIGN3 3 MEMORY_FILE
goto 0 MEMORY_FILE
getdstring SIGN4 4 MEMORY_FILE
goto 4 MEMORY_FILE
getdstring SIGN8 4 MEMORY_FILE
goto 12 MEMORY_FILE
getdstring SIGN12 4 MEMORY_FILE
if SIGN4 == "KB2j" || SIGN4 == "BIKi"
set EXT string "bik"
elif SIGN4 == "CR2W"
set EXT string "cr2w"
elif SIGN4 == "DDS "
set EXT string "dds"
elif SIGN4 == "RIFF"
set EXT string "riff"
elif SIGN3 == "CFX" || SIGN3 == "GFX"
set EXT string "swf"
elif SIGN12 == "GDEF"
set EXT string "ttf"
elif SIGN3 == "NXS"
set EXT string "mesh"
elif SIGN4 == "KARK"
set EXT string "kraken"
elif SIGN4 == "BKHD"
set EXT string "bnk"
elif SIGN3 == "SND"
set EXT string "snd"
else
string EXT f= dat
endif
endfunction
tbmq008 wrote:the script has been updated with a massive difference in how the structure is handled.
in other words you won't get a folder with dozens of files anymore.
instead you'll get THE one file as the file structure was chunk-based and so there was no need to make up a separate folder with dozens of files inside.
Code: Select all
000000000007e02f 12 fb664fe9b43f1a5f\000000000000015d.dat
000000000007e03b 12 fb664fe9b43f1a5f\000000000000015e.dat
000000000007e047 240 fb664fe9b43f1a5f\000000000000015f.dat
000000000007e13f 420 fb664fe9b43f1a5f\0000000000000160.dat
000000000007e1df 24 fb664fe9b43f1a5f\0000000000000161.dat
000000000007e1f7 48 fb664fe9b43f1a5f\0000000000000162.dat
000000000007e227 240 fb664fe9b43f1a5f\0000000000000163.dat