Understanding LIVE/PIRS/CON files, need help

Discussion about modding Halo 3.
User avatar
HaLo2FrEeEk





Posts: 170
Joined: Fri Aug 10, 2007 9:25 pm

Understanding LIVE/PIRS/CON files, need help

Post by HaLo2FrEeEk »

First I want to say I'm sorry if there is a better section for this, I couldn't find one.

I've been researching LIVE/PIRS/CON files. I found a page on free60.com that has all the information about them and it's been really helpful, but I'm having a few problems.

The site says that the file list starts at offset 0xC000 if the two bytes starting at 0xC032 are equal to FFFF, which they always are in retail games and downloads. The offset 0xD000 is only used in kiosk disks. So, starting at the file list, each file entry can be 64 bytes long:

0x00 - Filename is 40 bytes
0x28 - length of filename is 1 byte
0x29 - size of file in 4096 byte blocks is 3 bytes long and is in Little Endian
0x2C - the next 3 bytes are a copy of the previous 3
0x2F - the next 3 bytes is the starting cluster number in Little Endian
0x32 - Path indicator is 2 bytes
0x34 - size of file in bytes is 4 bytes in Big Endian
0x38 - timestamp of update of file is the next 4 bytes
0x3C - timestamp of last access is the last 4 bytes.

So, judging by that, to find each entry I would look at relative offset 0x2F for each file entry to find the starting cluster number. Clusters go in 4096 byte segments, so to find the starting cluster I would do list start + (4096 * value at 0x2F). That's all fine. Then I'd need to find the filesize, so I'd get the 4-byte value in Big Endian from 0x34, then I would navigate to 0xC000 + cluster start and select a block [filesize] bytes in length and I should be at the end of the file, right?

Well therein lies my problem. I opened the Cold Storage map LIVE file in Hex Workshop and navigated to 0xC000 (since the 2 bytes starting at 0xC032 were equal to FFFF) and found chilout.map, the filename, went to relative offset 0x2F and got the starting cluster, 1, so 0xC000 + 4096 bytes, which is 0xD000. Great. So then I change to Big Endian and go to 0x34 and get the int32 value of those 4 bytes: 119,709,696. So then I navigate to 0xD000 and select a block 119,709,696 in length, starting from the cursor position, and it doesn't select the whole map, it ends a long way before. It does select most of it, just not all?

Is there something I'm doing wrong?
User avatar
Eaton




Enthraller

Posts: 1639
Joined: Thu Jun 14, 2007 4:16 pm
Location: USA

Re: Understanding LIVE/PIRS/CON files, need help

Post by Eaton »

A lot of information on that website is incorrect. That's probably what is wrong.
Image
User avatar
unknownv2





Posts: 1041
Joined: Sun Oct 14, 2007 8:31 am
Location: Florida

Re: Understanding LIVE/PIRS/CON files, need help

Post by unknownv2 »

Your selection problem is largely due to the fact that you aren't considering the hash tables littered across a map pack that big.
User avatar
HaLo2FrEeEk





Posts: 170
Joined: Fri Aug 10, 2007 9:25 pm

Re: Understanding LIVE/PIRS/CON files, need help

Post by HaLo2FrEeEk »

Well what could I do. I didn't think I had to worry about any extra data because I was doing the Cold Storage map, so there was only one map in the LIVE file.

Another problem I have is with themes, I'll read the file list and start at the beginning of a png file that might be the background image, then I'll select a block "length" bytes in size, specified in the file list, and it'll select the whole thing from the header of the png to the ending bytes and when I save it it won't be viewable or editable in Paint, I can open it in Photoshop and it's all distorted. Why would that happen? I can get some of the icons just fine, and for premium themes I can pull out some of the graphics, but some others don't work.
User avatar
unknownv2





Posts: 1041
Joined: Sun Oct 14, 2007 8:31 am
Location: Florida

Re: Understanding LIVE/PIRS/CON files, need help

Post by unknownv2 »

HaLo2FrEeEk wrote:Well what could I do. I didn't think I had to worry about any extra data because I was doing the Cold Storage map, so there was only one map in the LIVE file.

Another problem I have is with themes, I'll read the file list and start at the beginning of a png file that might be the background image, then I'll select a block "length" bytes in size, specified in the file list, and it'll select the whole thing from the header of the png to the ending bytes and when I save it it won't be viewable or editable in Paint, I can open it in Photoshop and it's all distorted. Why would that happen? I can get some of the icons just fine, and for premium themes I can pull out some of the graphics, but some others don't work.

Once again you're not calculating in the hash tables to the block length. When you extract files, you always have to make sure you don't include the hash tables in them. That's your problem.
User avatar
HaLo2FrEeEk





Posts: 170
Joined: Fri Aug 10, 2007 9:25 pm

Re: Understanding LIVE/PIRS/CON files, need help

Post by HaLo2FrEeEk »

Ok, I don't know how to do that. I've just started looking at this sort of stuff about a week ago. It would help if there was information that I could read that wasn't incorrect, like free60 apparently is.
User avatar
HaLo2FrEeEk





Posts: 170
Joined: Fri Aug 10, 2007 9:25 pm

Re: Understanding LIVE/PIRS/CON files, need help

Post by HaLo2FrEeEk »

Here's another decent example of what I'd like to do. I'm not sure if this is going to be the same thing with the hashes and whatnot, but I'm trying. Videos downloaded from XBL are in WMV format for the most part. Most of the free videos have no DRM on them, they're just packaged into the LIVE file. So here's what I did:

Opened the "Halo Times Ten: Halo Wars Vidon #1" video and went to 0xC000, the file list. Under that I found default.wmv, the name. At relative offset 0x2F I read the 3 bytes in little endian, the starting cluster number is 1, so the contest starts at 0xD000. I then read the 4 bytes at 0x34 in Big Endian and got the filesize in bytes: 212,343,040. So I went to offset 0xD000 and selected a block 212343040 in length, copied and pasted into a new file (taking care to paste as Hex Workshow data...) and saved as default.wmv. The file doesn't generate a thumbnail, so something's wrong, and when I play it it'll go for about 3 or 4 seconds then pause for a few more then restart. Why does it do this? Do videos have hashes, too? If so, will someone please help me figure out how to get around them. I'm not trying to pirate the videos, they're free, I just want to better my personal knowledge of this sort of thing.
User avatar
unknownv2





Posts: 1041
Joined: Sun Oct 14, 2007 8:31 am
Location: Florida

Re: Understanding LIVE/PIRS/CON files, need help

Post by unknownv2 »

Every file in a container has hash tables.

You need to remove the hash tables from the video file for it to work.
User avatar
HaLo2FrEeEk





Posts: 170
Joined: Fri Aug 10, 2007 9:25 pm

Re: Understanding LIVE/PIRS/CON files, need help

Post by HaLo2FrEeEk »

Can you help me figure out how to do that? Free60.com says that the hash table starts at 0xB000 and is 4096 bytes in length, but that wouldn't interfere with the video, which started at 0xD000. Where is the hash for the files?
User avatar
unknownv2





Posts: 1041
Joined: Sun Oct 14, 2007 8:31 am
Location: Florida

Re: Understanding LIVE/PIRS/CON files, need help

Post by unknownv2 »

HaLo2FrEeEk wrote:Can you help me figure out how to do that? Free60.com says that the hash table starts at 0xB000 and is 4096 bytes in length, but that wouldn't interfere with the video, which started at 0xD000. Where is the hash for the files?
There are multiple hash tables. When one table gets full, another one is made. So for files with large sizes, there will be multiple tables.
User avatar
HaLo2FrEeEk





Posts: 170
Joined: Fri Aug 10, 2007 9:25 pm

Re: Understanding LIVE/PIRS/CON files, need help

Post by HaLo2FrEeEk »

Where do I look for them?
User avatar
unknownv2





Posts: 1041
Joined: Sun Oct 14, 2007 8:31 am
Location: Florida

Re: Understanding LIVE/PIRS/CON files, need help

Post by unknownv2 »

HaLo2FrEeEk wrote:Where do I look for them?
Besides the first hash table, the other tables begin at 0xB8000/0xB9000 (two blocks of 0x1000 bytes, either can be used) and from there on, every 0xAC000 there is another.
User avatar
HaLo2FrEeEk





Posts: 170
Joined: Fri Aug 10, 2007 9:25 pm

Re: Understanding LIVE/PIRS/CON files, need help

Post by HaLo2FrEeEk »

So these hash tables can be inserted right in the middle of the content? Like I might have something like

content
content
content
hash
content
content
content
hash

etc.? I'll look for them and get back to you.

Edit: I want to clarify here, all I have to do is navigate to 0xB8000 and delete the next 1000 bytes (or 0xB9000? how do I know if I'm really at the hash table? Is there a way of telling?)
User avatar
unknownv2





Posts: 1041
Joined: Sun Oct 14, 2007 8:31 am
Location: Florida

Re: Understanding LIVE/PIRS/CON files, need help

Post by unknownv2 »

HaLo2FrEeEk wrote:So these hash tables can be inserted right in the middle of the content? Like I might have something like

content
content
content
hash
content
content
content
hash

etc.? I'll look for them and get back to you.

Edit: I want to clarify here, all I have to do is navigate to 0xB8000 and delete the next 1000 bytes (or 0xB9000? how do I know if I'm really at the hash table? Is there a way of telling?)
Yes.

You delete two blocks ( 0xB8000 and 0xB9000 ) because both of those are "reserved" for hashes.
User avatar
HaLo2FrEeEk





Posts: 170
Joined: Fri Aug 10, 2007 9:25 pm

Re: Understanding LIVE/PIRS/CON files, need help

Post by HaLo2FrEeEk »

And from what I read each successive hash block is 169*171*4096 bytes further into the file? Is that right?

I'm trying this on a smaller video, the Making of the Believe Diaorama video and I got the hash at 0xB8000 and deleted 4096 bytes, or 0x1000 bytes, then I deleted again another 4096 bytes. So I deleted the first hash table, then I tried to go forward 169*171*4096 bytes and it wouldn't let me, it was past the end of the file. I know there's another hash table though because when I save the video file after deleting the first hash table it does play a few seconds longer, but it still stops partway through. How do I find the next hash tables?
User avatar
grimdoomer




System Engineer

Posts: 1440
Joined: Mon Oct 09, 2006 4:36 pm

Re: Understanding LIVE/PIRS/CON files, need help

Post by grimdoomer »

If I remember correctly, there is a hash table every 0xA0000 bytes. These files are layed out in blocks, so you will find areas that have 2 consecutive hash tables. I have this written down somewhere, I just don't remember where. But these files are basically blocks of data and hashes inside a much larger block that has a "Parent Hash" which all have hashes in the "Master Block".
Image
AI Zones in MP | Ambiance | Gravemind Beta v1.1
Aumaan Anubis wrote:Grimdoomer. The first person ever to mod Halo 2 Vista.
User avatar
HaLo2FrEeEk





Posts: 170
Joined: Fri Aug 10, 2007 9:25 pm

Re: Understanding LIVE/PIRS/CON files, need help

Post by HaLo2FrEeEk »

What if the file is too small and only contains the one hash at 0xB6000 and no more, but when I remove that and save the video file it still won't play all the way through? What then?
User avatar
unknownv2





Posts: 1041
Joined: Sun Oct 14, 2007 8:31 am
Location: Florida

Re: Understanding LIVE/PIRS/CON files, need help

Post by unknownv2 »

HaLo2FrEeEk wrote:What if the file is too small and only contains the one hash at 0xB6000 and no more, but when I remove that and save the video file it still won't play all the way through? What then?
Did you remove the 0xB7000 table as well?
User avatar
HaLo2FrEeEk





Posts: 170
Joined: Fri Aug 10, 2007 9:25 pm

Re: Understanding LIVE/PIRS/CON files, need help

Post by HaLo2FrEeEk »

I removed 4096 bytes from 0xB6000 and 0xB7000 and the video only plays to about 23 seconds.
User avatar
Veegie




Socialist Architect Coroner Golden Age
Mad Hatter Acolyte Translator New Age
ONI

Posts: 3638
Joined: Wed Nov 26, 2003 2:28 pm
Location: Redmond, WA

Re: Understanding LIVE/PIRS/CON files, need help

Post by Veegie »

bro throw that shit in vlc naw mean
Image
Hijikata wrote:The fact you love Jesus doesn't change the fact you're a *** mental patient. It just means you're a mental patient with a great imaginary friend.
Post Reply