New Korean MPQ corruption method

[ghost]

Hello, it's me again and yes it's again wc3 related. I hope that you will spare some of your patience and look at it. So here is what happens:

As per usual, due to the corruption / offset change MPQ Editor cannot open the file, which is understandable, I believe they did a MPQ shambling (speculating).

Here is the header, as you can see it is very different from usual W3X, as it does not have any indication of MPQ at offset 200, yet, if we move by a lot down we find this:

On offset 01C98A50 is MPQ (4D 50 51), which is supposed to be at offest 200. I tried moving hex data around, but to no avail.

Here is the map.

Eden RPG

The version I used is:

[ghost]

While searching for more hex data, I was able to make the MPQ at least openable, but with only 850 available files, but what I found in the hex data itself is this.

I guess they use multiple headers or possibly a mpq inside of mpq, unsure why, but that is what I got, hopefully you fill find a way to fix this.

[ladislav-zezula]

Hi, The file can be open with the latest StormLib. Can be open with the latest build of MPQ Editor as well, but that build is not out yet. I am still working on it. L. From: Tailer007 [mailto:notifications@github.com] Sent: Saturday, August 5, 2017 4:14 PM To: ladislav-zezula/StormLib <StormLib@noreply.github.com> Cc: Subscribed <subscribed@noreply.github.com> Subject: [ladislav-zezula/StormLib] New Korean MPQ corruption method (#105) Hello, it's me again and yes it's again wc3 related. I hope that you will spare some of your patience and look at it. So here is what happens: <https://user-images.githubusercontent.com/11413837/28996053-4e4d35cc-7a09-11e7-94e7-9b56ed3637b9.png> As per usual, due to the corruption / offset change MPQ Editor cannot open the file, which is understandable, I believe they did a MPQ shambling (speculating). <https://user-images.githubusercontent.com/11413837/28996054-4e4f6f0e-7a09-11e7-822a-80a4c5527d7b.png> Here is the header, as you can see it is very different from usual W3X, as it does not have any indication of MPQ at offset 200, yet, if we move by a lot down we find this: <https://user-images.githubusercontent.com/11413837/28996055-4e5124e8-7a09-11e7-9b75-18448b6c3668.png> On offset 01C98A50 is MPQ (4D 50 51), which is supposed to be at offest 200. I tried moving hex data around, but to no avail. Here is the map. Eden RPG <https://drive.google.com/open?id=0B7IzeujWsEasbDZaR2VyZHN1Yk0> The version I used is: <https://user-images.githubusercontent.com/11413837/28996056-4e52035e-7a09-11e7-8853-a31eede49f83.png> — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#105> , or mute the thread <https://github.com/notifications/unsubscribe-auth/ADGBRzsKv9dMfpS6b2nzjaBBR4HI-Z6kks5sVHjCgaJpZM4OueEq> . <https://github.com/notifications/beacon/ADGBR5iMSC8VbN7KUjm_YHGMsTir_364ks5sVHjCgaJpZM4OueEq.gif>

[ghost]

Very, very awesome. Thanks as usual, I cannot thank you enough. Will wait for new MPQ Editor to release.

[ladislav-zezula]

You can have a preview here: http://www.zezula.net/download/MPQEditor_test_en32.zip
Note that there are still issues with the file names that I need to solve.

There's a new feature for all them W3 map breakers: The Deep File Verification. As the protected map you sent me contains many fake files in the hash table (which don't actually exist in the MPQ), MPQ Editor can be opted-in for verifying every file in the MPQ by trying to read a few bytes from the file. This will indeed slow loading the MPQ, but will make sure that all files visible in the MPQ editor will really be there.

[ghost]

Well, now I feel bad, as I made you do a bit an overkill, but yes, it was creating tons of fakes files that were just filled with 00s, and each was 1-4 GB. Can't say how much I appreciate your work and dedication, thanks again, will surely test it as soon as I can!

Thank you once again,
Sandro.

[null15]

Thanks for the work, Zezula.

[ladislav-zezula]

The new MPQ Editor build is out.