UnityPy icon indicating copy to clipboard operation
UnityPy copied to clipboard

Corrupt input data

Open kitsudog opened this issue 4 years ago • 3 comments

PARTS_01_SHIRTF.l2db.zip

CompressionHelper.py

  39:  try:
  40:      return dec.decompress(data[5:])
  41:  except:
  42:      return lzma.decompress(data)

it works.

kitsudog avatar Sep 30 '20 19:09 kitsudog

Thanks for the report. The fix you proposed wouldn't fix the root of the issue, which is probably a false flag detection. I will look into it in the coming days.

K0lb3 avatar Oct 07 '20 15:10 K0lb3

I noticed that the data in question is compressed via lzma.FORMAT_ALONE which is the legacy lzma format.

So I checked how the properties are encoded in that format and found the following code

void DecodeProperties(const Byte *properties)
  {
    unsigned d = properties[0];
    if (d >= (9 * 5 * 5))
      throw "Incorrect LZMA properties";
    lc = d % 9;
    d /= 9;
    pb = d / 5;
    lp = d % 5;
    dictSizeInProperties = 0;
    for (int i = 0; i < 4; i++)
      dictSizeInProperties |= (UInt32)properties[i + 1] << (8 * i);
    dictSize = dictSizeInProperties;
    if (dictSize < LZMA_DIC_MIN)
      dictSize = LZMA_DIC_MIN;
  }

which is pretty much the same as the current python code besides the min dict size.

So it's better to simply use lzma.decompress(data, format = lzma.FORMAT_ALONE) .

I'm going to run some tests now to confirm this.

K0lb3 avatar Oct 09 '20 20:10 K0lb3

Hm, according to my tests it's not exactly the same. I found a good way to identify the compression format tho.

When the ALONE format is used, data[5] equals 255, if the specific compressor is used, it equals 0.

I'm going to run some further tests and so how it goes with that.

K0lb3 avatar Oct 09 '20 21:10 K0lb3