Log in

View Full Version : Reversing an unknown image format?


sporadic
November 12th, 2003, 15:57
Heyas,
Never posted here, but always enjoy browsing the site. I usually find my answers via search, so haven't had a need to post. And I'm not even sure if this is the right place to ask this, but I'm sure you all will have ideas

I'm currently working on reversing a texture file format for a game. The file format seems pretty easy to parse and supports both 32bit and Indexed images. The 32bit images are read in bottom-to-top like a DIB and render perfectly in my utility. The Indexed images have a color table, followed by 1byte per pixel that represents an offset in the color table. The problem though, is that the scan for indexed images doesn't seem sequential and the rendering is all jumbled. The color lookups seem to be correct though (by ratio of colors in the output). I've noticed a few patterns in the final rendering, but none that will clue me in on the scan order. Any clues on why the pixels wouldn't be represented in a linear fashion or has anyone exprienced something like this w/ another graphics files format? Below are my notes on the format (.img) and links to 2 jpg's that show the correct texture and my parsed texture - right and wrong (the correct one was taken from an older version of the game, when they used .png's). I've yet to figure out any use for the 4 unknown DWORD's listed below. Both 32 bit and Indexed images usually have a value < 0x0F in them.

right: hxxp://linux.wku.edu/~sporadic/gfx/right.jpg
wrong: hxxp://linux.wku.edu/~sporadic/gfx/wrong.jpg

Code:

// note: non-indexed pixel data is last scanline first (read reverse)
// -- still unsure on scan order of indexed pixel data

-= IMG header =-
0x00: 02 00 00 00
0x04: 30 02 41 00 (IMG file type)
0x08: Unkown 4 Byte field
0x0C: Unkown 4 Byte field
0x10: Unkown 4 Byte field
0x14: Unkown 4 Byte field
0x18: 2 Byte Width
0x1A: 2 Byte Height
0x1C: 4 Byte Color Table Size / Offset of Pixel Data
-- end of IMG header

if file is indexed (0x1C > 0) {
-= Color Table =-
0x20: 4 Byte RGBA Quad
... repeats for 0x1C / 4 (# of colors)
-- end of Color Table
-= Begin Pixel Data =-
0x??: 1 Byte Index (points to RGBA Quad in Color Table)
... repeats for 0x18*0x1A (width*height)
-- end of Pixel Data
} else {
-= Begin Pixel Data =-
0x20: 4 Byte RGBA Quad
... repeats for 0x18*0x1A (width*height)
-- end of Pixel Data
}
-- end of file



i'm looking for help on this, as it's kinda kicking my arse atm
thanks!,
-sporadic

dELTA
November 13th, 2003, 20:15
And you are sure it's not compressed in any way? If you do a statistical analysis of the raw data, does it have more random characteristics than non-compressed images? In that case it might very well be compressed, which might explain your failed attempts to reverse it "by hand".

JH1979
December 11th, 2003, 19:54
Just a suggestion, but how about debugging the game to see how what it does (i.e. how it processes and stores) the image on loading it? Or, how about replacing some image files in the game directory with ones you create yourself, this will give you clue if it is some weird non-linear scan. e.g. what you think is a simple image with a horizontal line gets mapped to...? personally, i think delta is on the right track and that the data is compressed somehow.

JH

p.s. and another thing - you mention an older version of the game using pngs, are there are graphics (logos etc) that are the same as in the new version? if so, you should be able to compare these to determine the scan.

evn
December 20th, 2003, 08:54
I would think that using compression on the image would somehow alter the color table, unless the before and after color similarities are coincidental.

Have you checked the other data files for anything that may be of any help (there may be encode/decode information in other files, such as byte order or build pattern).

If you think that it is just the pixel order that is incorrect, try coding a small app to count the number of each pixel of each color in the image. If they're equal then its likely not that huge of a problem to correct, else everything takes a turn for the worse

Compression normally involves the reduction of data size (or at least an alteration in data size), and from what you've posted, the image looks to have dimensions in-tact. And the fact that the data stretches to the extremities of the image show pretty conclusively that the algorithm (if any) hasn't padded the data to keep size.

I cant really help without seeing the raw data, but i'm not sure if posting that is permitted (no posting of target file). This is an image rather than a reversing problem though, so i don't see why it would be disallowed.

dELTA
December 20th, 2003, 18:37
You can post data from sample images here, no problem.