TDF File Format
The TDF file format is pretty basic.
The first 14 bytes are taken up by a "bitmap" header. Which contains some reserved values, the type, and an offset.
struct sBITMAP
{
__int16 bfType; // 2 bytes
unsigned int bfSize; // 4 bytes
__int16 bfReserved1; // 2 bytes
__int16 bfReserved2; // 2 bytes
unsigned int bfOffBits; // 4 bytes
};
After the bitmap header, it checks to see if it needs to offset. So when bfType == 19778 it sets bfSize off.
if (Bitmap.bfType == 19778) {
fseek(tdf->m_fp, Bitmap.bfSize, 0);
} else
fseek(tdf->m_fp, 0, 0);
After the bitmap header, the version is read. These are fairly basic and only 2 shorts / unsigned int 16. The first int16 denotes the Major version (2b), the second one the minor (2b). (In the leaked server files, these are 1 (Major) and 4 (Minor))
struct sVersion
{
unsigned __int16 Major; // 2 Bytes
unsigned __int16 Minor; // 2 bytes
}; // 4 bytes
After version, another header follows with 20 bytes in total length. First a date (4b), containing an int16 for year (2b), and 1 char (1b) for month and one for day.
struct sDate
{
unsigned __int16 Year; // 2 bytes
char Month; // 1 byte
char Day; // 1 byte
}; // 4 bytes
After the date, follows a flag (4b), offset (4b), the total column count (4b) and the total row count (4b).
struct sHeader
{
sDate Date; // 4 bytes
unsigned int Flag; // 4 bytes
unsigned int Offset; // 4 bytes
unsigned int Col; // 4 bytes
unsigned int Row; // 4 bytes
}; // 20 bytes
After the header, a data table follows, this is not used in the leaked server. It is basically useless. The size of the int array is total column count * total row count.
int dataTable[header.Col*header.Row]
After the data table, the most important part follows. The restable. It's basically just an array of unicode strings (So 00 bytes after each character, and at the end two 00 bytes.)
The size of this is always the header offset - the total column count * 4 * the total row count + 24.
char resTable[header.Offset - (header.Col * 4 * header.Row + 24)]