0

This is the first time i write a post looking for help after so so many years watch at StackOverflow. I started everythings from 0 to my current level with great works. I can't get it withou StackOverflow. This time i really need help for a file Decompression... It's start with

AF 1B B1 FA 10 00 00 00

after take a look to discover i found this file type

  1. GLS_BINARY_LSB_FIRST
  2. application/octet-stream

More info ... i can look some small files in it *.dll

  • Assembly-CSharp-firstpass.dll
  • Assembly-UnityScript-firstpass.dll
  • zlib.net.dll (These file i can look in 010 editor by hex in plain text i think there are no encryption) .... and alot more ...

Yes i'm looking for help that what compression type it is How to decompress and recompress it ...

You can take a demo file at: https://mega.nz/#!K8Rm3CxD!O6dDHyLwbr6OdG18b9-1R6foBibbbQnRkMimyDdhJb0

Thank you commnunity ! Love you all. Great StackOverflow.

============================================================

p/s: for more detail: this file name is global-metadata.dat it's stored at

AppName\Payload\qjmu.app\Data\Managed\Metadata

This application for iOS, i changed file extension of iOS app to .zip and extracted these files. In another version of this iOS application there are no file pack or compression that i found these child files:

Assembly-CSharp.dll Assembly-CSharp-firstpass.dll Assembly-UnityScript.dll Assembly-UnityScript-firstpass.dll Boo.Lang.dll ICSharpCode.SharpZipLib.dll Ionic.Zlib.CF.dll Mono.Security.dll mscorlib.dll NSpeex.dll System.Core.dll System.dll System.Xml.dll System.Xml.Linq.dll UMGameAnalyticsLibForiOS.dll UnityEngine.dll UnityScript.Lang.dll zlib.net.dll

Phạm Như Thái
  • 31
  • 2
  • 5
  • I'm amost sure this is a game made with Unity3D engine. What is the archive filename please? – Luca D'Amico May 09 '16 at 09:06
  • Hello Luca, Yes, i've discover this is from il2cpp unity 3d. Archive file name is global-metadata.dat it's store *.dll files inside and what i need is decompress it to dll files and recompress it again ... thank you for your assistant. – Phạm Như Thái May 09 '16 at 10:15
  • Are you sure this is a compressed archive and not just some stored dlls in sequential order + header? In this case you might be able to understand how to extract them just by looking at the header with an hex editor. – Luca D'Amico May 09 '16 at 10:48
  • That file is not compressed, it contains plain text and a lot of "empty" space. Its clearly structured somehow. – Alex K. May 09 '16 at 12:00
  • Hello LucaD'Amico and AlexK. , I'm pretty sure yes this is a compressed archive and it's storing dlls in that .dat file. I'm not really good at reverse enginneering. If there a tutorial about extracting by looking at the header with hex editor is very good option for me now. While replying this ... i'm doing a google search all about it. Thank you for reply. – Phạm Như Thái May 13 '16 at 04:18
  • i had heard that the guy Mila432 can reverse engineering il2cpp but no details so far. I have seen he converted native to C# by dumping something that we all don't know https://www.alphagamers.net/threads/report-il2cpp-apps-here.196901/ –  Sep 23 '16 at 16:46

1 Answers1

1

That file compresses by a factor of four, so it is not already compressed. Also a search showed no embedded deflate (zlib) compressed data.

Mark Adler
  • 101,978
  • 13
  • 118
  • 158