Research Report Hash08

Hash08 static probe report

Outcome

No reproducible algorithmic hit was found. The strongest result is that the IDCL header at +0x08 is not a direct hash of the archive metadata: the custom chunk_26_hash1.resources and chunk_26_oracle.resources have identical values at +0x08 (3533df45c7f9b1d2) but differ at +0x20 and within the metadata byte range [0x698, 0x69c). This latter mutation also changes the value at +0x20 from 8447767104e04232 to fb64ec38103aa09d.

This suggests that a mount/package identity value (or a value retained from the package manifest) is more plausible than a content checksum. It also explains why modifying +0x08 alone in chunk_26_mountprobe.resources produces a different value without any corresponding changes to the file content.

Reproducible command and result

Run from the repository root:

python -u re_probes\hash08_scratch\inspect.py

The script utilizes three intentionally dissimilar retail metadata sets (chunk_8.resources, patch_4_chunkbase_6.resources, and gameresources.resources) and returns:

retail 3
direct_matches []
name_matches []

direct_matches [] covers FarmHash64, CityHash64, unseeded XXH64, and both endiannesses of MD5/SHA-1 first/last 64-bit slices across ten distinct regions: header, full metadata, header-normalized (+0x08 zeroed and +0x08/+0x20 zeroed), [0x10:], [0x28:], [0x78:], entry table, and string/pool/table regions. name_matches [] independently tests Farm/City/XXH unseeded variants over filename/stem, lower-case forms, and four base path spellings for all 24 retail archive filenames.

The same invocation prints these independently useful differential checks:

diff hash1 chunk_26_mountprobe.resources [('0x8', '0x10', 8)]
diff hash1 chunk_26_oracle.resources [('0x20', '0x28', 8), ('0x698', '0x69c', 4)]

The expected header value from the custom oracle is 3533df45c7f9b1d2; the alternative 6e9d625602ddbc9e is not derived by any of the tested candidates. Two custom artifacts with the old metadata marker are intentionally rejected by the parser; the probe reports that instead of treating their inferred regions as valid (IdclError: end of metadata magic is 00000000, expected IDCL). The parse-valid custom artifacts (hash2, mountprobe_v2, and oracle) also yield no direct Farm/City/XXH metadata hit.

Excluded / not excluded

Excluded: unseeded FarmHash64/CityHash64/XXH64 direct forms over the listed metadata and path spellings; the listed MD5/SHA truncations; and a direct metadata-content interpretation (via the differential counterexample).

Not excluded: seeded/secret-keyed variants, CRC64 variants or combinations, and a package-map/VFS-derived identifier. Static samples cannot distinguish a secret seed from a value supplied externally by the mount manifest.

Best next oracle

Perform one isolated loader oracle that holds the complete container bytes fixed while changing only the mount identity (filename or package-map chunk identity). If the requested wants value changes, capture the filename, chunk/basechunk IDs, and wanted u64 for at least three identities. This approach is far more discriminating than further raw-byte hash sweeps and can reveal the exact manifest/VFS input to reverse-engineer without altering game data.