neosophaux/AMTA-Decompressor
Folders and files
| Name | Name | Last commit date | ||
|---|---|---|---|---|
Repository files navigation
AMTA decompression for "Battle for the Galaxy" by AMTGames Ltd. Documentation by https://github.com/neosophaux: A simple compression algorithm that wraps the data stream generated by another compression algorithm known as LZO(Lempel–Ziv–Oberhumer) using an XOR technique. Note: The AMTA files I analyzed are in little-endian format. Before the algorithm inflates it's data, a series of checks must be performed to ensure the full recovery of the data. The first of those checks is a size check on the file data itself. If the size of the file is <= 8, then the algorithm stops due to a lack of data(8 bytes is the header length). Next, the algorithm then processes the file header. First, it ensures that the first 4 bytes of the file contains the following magic bytes: [0x61, 0x6d, 0x74, 0x61] ('a', 'm', 't', 'a'). If those bytes are not found, then the algorithm quits due to a mismatching header. The algorithm then reads the next 4 bytes of the file as an unsigned integer that is meant to be the size of the original decompressed file. If it is 0, >= 0x6400001, or if the size doesn't match the uncompressed data, then the algorithm will stop and raise an error. The first byte that comes after the header is then read and XOR'd with 0x56. The purpose of it is unknown but my current assumption is it's to make the LZO stream valid. After the inflation to an LZO stream, the original byte within the file data must be replaced with the XOR'd version. The rest of the file data is then processed in a loop that only iterates when a variable I will call 'offset' is > 0. The offset variable is initiated with the data size of the AMTA archive. On successful iteration of the loop, the offset variable is decremented by 1. In the loop, the file is read 1 byte at a time, but operations are performed on two neighboring bytes called byte 'a' and byte 'b'. The first byte, byte 'a', is located by seeking to the value of the offset variable(mentioned above) and then seeking 1 byte backwards. Byte 'b' is located in a similar fashion, but instead of seeking 1 byte backwards, the algorithm will seek 2 bytes backwards. To inflate, byte 'a' and byte 'b' are XOR'd together; the resulting byte is then placed where byte 'a' once was. Finally, the inflated LZO stream is decompressed using the lzo1x decompression algorithm and the length of the decompressed LZO stream is checked against the size determined in the AMTA header. If it fails, then the decompressed data is invalid.