Skip to content

NeFS Notes

Jump to bottom
victorbush edited this page Jul 17, 2022 · 8 revisions

Non-compressed files

There are a handful of files that are not compressed in the archive. A file is known to be non-comrpessed when the index into part 4 is -1 (0xFFFFFFFF). For car archives this is usually the *.ctf file.

Example: fr2.nefs (not encrypted)

Header Part 1
-----------------------------------------------------------
Data Offset         Metadata index      Index to Part 4     Id
0x1970A71           0x18                0xFFFFFFFF          0xB    (fr2.ctf)
0x1970D51           0x19                0x2EE               0xC

Header Part 2
-----------------------------------------------------------
Directory Id        First child Id      Part 3 offset       Extracted size      Id
0x2                 0xB                 0xBD                0x2D8               0xB

There is a strange quirk with these files. The extracted file size is shown to be 8 bytes too short. The exception to this is for the encrypted archives - the extracted file size is correct.

Example: c4r.nefs (encrypted)

Header Part 1
-----------------------------------------------------------
Data Offset         Metadata index      Index to Part 4     Id
0x17F8AB0           0x11                0xFFFFFFFF          0xB    (c4r.ctf)
0x17F8D90           0x12                0x31A               0xC

Header Part 2
-----------------------------------------------------------
Directory Id        First child Id      Part 3 offset       Extracted size      Id
0x2                 0xB                 0x96                0x2E0               0xB

There is another twist. Car archives have a file at the end of the archive that is 1 byte long. The offset to part 4 is -1, so it is considered not compressed. However, the extracted size is correct.

Example: fr2.nefs -- file name is "fr2"

Header Part 1
-----------------------------------------------------------
Directory Id        First child Id      Part 3 offset       Extracted size      Id
0x99C3388           0x79                0xFFFFFFFF          0x79

Game.dat/game.bin files

For DiRT Rally 2, game.dat files are NeFS data files with the header information stored in the game executable.

Different games have different variations of this (DiRT Rally has game.bin, Grid 2 has dr.nic, etc.). The header information is stored in the game's executable, and the data is stored in a separate file.

The header in the executable is split up into two parts. Parts 1 through 5 (along with part 8) are stored together like normal somewhere in the exe. Part 6 and 7 are stored in a different section of the exe (in the ".data" section). It's possible for some games to have multiple game.dat files.

So the executable layout is something like this:

PE Header
...
NeFS Header 1
...
NeFS Header 2
...
[.data section]
...
Part6 (for header 1)
Part7 (for header 1)
...
Part6 (for header 2)
Part7 (for header 2)

NefsLib has some functionality to search through an exe and find headers and part6/7 data.

Unknown Stuff

Needs research.

Header intro

  • 0x70 - 0x8 bytes - has "zlib" constant (for DR2 nefs, but not for F1)
  • 0x78 - 0x8 bytes - unknown

Table of contents

  • 0xA4 - 0x5c bytes - unknown

Part 8 All unknown data. NefsEdit was writing this to 0 when replacing files. Its unknown how the size of part 8 is determined. We can compute the size of part 8 in an existing archive (subtract part 8 offset from header size). But knowing how that value was chosen is unknown.

Clone this wiki locally