Support for NeFS version 0x10600 (DiRT Rally 1, F1, etc)
opcod3 opened this issue · comments
Dirt Rally uses a different NeFS format compared to Dirt Rally 2.0 and Dirt 4. After updating the header to the new format reading the archive still fails.
Apparently NeFS should support duplicate entries, this is also supported by the existence of the following function in F1 2018: neon::NeFileSystem::getFirstDuplicateEntry. Which uses the same NeFS format. So we should somehow figure out how that works.
List of NeFS versions used by different games. Posting this here for reference:
Dirt 3: 0x10501 (according to the miek/dirt3-modding github, although at a different offset)
Grid 2: 0x10600
DR1: 0x10600
F12017/2018: 0x10600
Grid 2019: 0x10600
D4: 0x20000
DR2: 0x20000
I played with it a little last week, it looked like there was 4 bytes difference in the header table of contents before the part offsets. Part 4 entries look different as well, I haven't been able to figure them out yet.
Appears to have references extracted offsets in 0x20000 increments (the last value is the extracted size).
Example part 4 excerpt:
00 00 02 00 04 00 B9 9F
00 00 04 00 04 00 B0 85
00 00 06 00 04 00 6B ED
00 00 08 00 04 00 D4 56
00 00 0A 00 04 00 F7 B0
00 00 0C 00 04 00 D3 25
00 00 0E 00 04 00 75 C1
00 00 10 00 04 00 95 AB
00 00 12 00 04 00 CD 8C
00 00 14 00 04 00 6B 2E
00 00 16 00 04 00 86 ED
00 00 18 00 04 00 AA 35
00 00 1A 00 04 00 98 E6
00 00 1C 00 04 00 DC 44
00 00 1E 00 04 00 6B 44
00 00 20 00 04 00 84 85
00 00 22 00 04 00 E9 32
00 00 24 00 04 00 86 23
00 00 26 00 04 00 3C A2
00 00 28 00 04 00 63 63
00 00 2A 00 04 00 38 FA
00 00 2C 00 04 00 61 A7
00 00 2E 00 04 00 AB E0
00 00 30 00 04 00 A5 DA
00 00 32 00 04 00 BE 55
00 00 34 00 04 00 59 6E
00 00 36 00 04 00 2C CB
00 00 38 00 04 00 E1 30
00 00 3A 00 04 00 A6 0E
00 00 3C 00 04 00 15 25
00 00 3E 00 04 00 64 F7
00 00 40 00 04 00 0A 2D
00 00 42 00 04 00 E8 60
00 00 44 00 04 00 69 E6
00 00 46 00 04 00 23 55
00 00 48 00 04 00 B2 DD
00 00 4A 00 04 00 FE 9E
00 00 4C 00 04 00 A1 F2
00 00 4E 00 04 00 F1 2C
00 00 50 00 04 00 C8 4D
00 00 52 00 04 00 E5 37
00 00 54 00 04 00 94 7B
00 00 56 00 04 00 06 2F
00 00 58 00 04 00 D4 AC
00 00 5A 00 04 00 5B 7D
00 00 5C 00 04 00 42 C6
00 00 5E 00 04 00 86 BA
00 00 60 00 04 00 95 E0
00 00 62 00 04 00 5B A0
00 00 64 00 04 00 A1 57
00 00 66 00 04 00 49 36
00 00 68 00 04 00 2A 54
00 00 6A 00 04 00 E2 FD
00 00 6C 00 04 00 E4 86
00 00 6E 00 04 00 5D 2D
00 00 70 00 04 00 2D 83
00 00 72 00 04 00 68 89
00 00 74 00 04 00 2E 64
00 00 76 00 04 00 AA AB
00 00 78 00 04 00 39 D4
00 00 7A 00 04 00 FB B3
00 00 7C 00 04 00 18 DB
00 00 7E 00 04 00 68 47
00 00 80 00 04 00 99 32
80 00 80 00 04 00 5C 8B
I have finished reversing the part 4 headers for version 0x10600, this is it.
| Start | Size | Description |
|---|---|---|
| 0x00 | 0x04 | Cumulative block size |
| 0x04 | 0x02 | Transformation type |
| 0x06 | 0x02 | Checksum (crc16 maybe) or simple checksum |
Edit: Figured out transformation type:
| Type | Transformation |
|---|---|
| 0x0 | No transformation |
| 0x4 | AES Decrypt |
| 0x7 | Zlib Decompress |
Support for 1.6 headers added in version 0.6.0. Also updated to handle duplicate items.