Understanding LIVE/PIRS/CON files, need help

[HaLo2FrEeEk]

I tried it in VLC, it does the same thing as in WMP.

Ok, so moving on from videos, I tried something even smaller, an old style theme, pre-NXE. I'm using the Bare Your Teeth theme from Gears of War 2. I loaded up the file in Hex Workshop and went to offset 0xB6000 and deleted 2 4096 byte blocks (so 8192 bytes in total), then I went forward 0xA0000 bytes from 0xB6000 and deleted another 8192 bytes. Then using the file list at 0xC000 I tried extracting the wallpapers. Everything worked fine using the numbers in the list until I got to "wallpaper4", the list said that it started at cluster 278, so 278*4096 = 1,138,688 + 0xC000 = 1,187,840. I went there. The file list said that this file is 509,416 bytes long. I tred selecting a block that long from offset 1,187,840 and it dinged at me, saying that length is out of bounds. Ok, so I start over, but this time I only delete 4096 bytes from 0xB6000 + 0xA0000, and this time it's perfect, I select a block of length 509,416 starting at offset 1,187,840 and I save the file as wallpaper4.png. When I view it though...it's all distorted. All the others work perfectly fine, but this one has a load of green, blue, and yellow dots on the bottom half, like it's corrupt.

What am I doing wrong? There are no other hashes after the 0xB6000 + 0xA0000, so it's not that, and I saved the whole file...what gives?

[ManBearPig_06]

wait, you went forward 0xA0000 bytes AFTER you deleted the blocks? Wouldn't you need to move forward by 0x9E000(A0000-2000) to get to the correct place if you deleted 8192 bytes?

[HaLo2FrEeEk]

Is that how it works? So I'd go forward 0xA0000 and then back 0x2000. I still don't know if it's another 2 blocks for each hash table after the first or if it's just one. How do I find that stuff out?

[ManBearPig_06]

^maybe you could try marking every hash table with out deleting it somehow, like replacing everything with a certain byte so after you do it to all of them you can go back and delete them? Or writing down the first 8 bytes of each hash table, then search and delete 0x2000 bytes from the beginning of them? I don't really have a con I can test it on right now, so idk. This is just how it seems it would work logically to me, if I'm wrong I hope someone will correct me.

[HaLo2FrEeEk]

I still don't understand how to find them. It can't really be so simple a looking every 0xA0000 - 0x2000 bytes, that seems so...easy.

[OwnZ joO]

Well if it's so easy then try it and find out. If it's wrong then you haven't wasted that much time have you?

[mxrider108]

I'm interested in learning more about the specifics of STFS packages myself. I have some info which may be helpful for you about this that was passed on to me by someone else. If you want to chat, send me a message on AIM at punkjuice108. Also, a suggestion I would make is to try using wxPirs to extract the file then use that to compare to the data you have inside the package and see how it differs (it will help in differentiating hash tables from video data, for example).

[HaLo2FrEeEk]

I just need someone to help me out, was manbearpig right, that I need to go forward 0xA0000 - 0x2000 from 0xB6000, or do I just go forward 0xA0000? I'm trying to extract all the images out of a premium theme and if I just delete the hash at 0xB6000 then when I get to a certain image, it'll go to the right starting cluster, but it's selecting too few bytes, if I navigate 0xA0000 bytes forward from 0xB6000 and delete 8192 bytes, then it won't go to the right starting cluster at all.

Edit: For the record I'm using the Halo 3 Splatter Spree Theme (premium). I'm using the information at the 0xC000 file list. The image I'm having a problem with is FloorLayer1.png. It says it starts at cluster 335, which is byte 1,372,160. I navigate there and it's the right place, my cursor is right before the header of a png image. The file list says that the image is 456,288 bytes long, so I select that many bytes starting at 1,372,160 and I come up 4096 bytes too short. This means that the hash is somewhere inside that image, right? The thing is, 0xB6000 + 0xA0000 isn't inside that image, it's before it, some someone's numbers are wrong. I also read that the first hash table is at 0xB6000 and the next one is 169*171*4096 bytes later, which would put it at 118,370,304 which in this case can't be right because there aren't that many bytes in the file. Please someone help me out.

Edit edit: Ok, on further research, I copied the selected amount plus the extra 4096 bytes for FloorLayer1.png into a new file and saved it. As expected, it showed up as corrupt. So I did a search for 00 bytes, knowing that the last 16 bytes of a hash table are always set to 00 (I think). I found the bytes at the end of the hash and navigated 4096 bytes up the file, then selected 4096 bytes and deleted them, resaved and viola, the image worked. Weird thing is, I went back to the original file and found the same has in it and it starts at offset 0x160000. That's not 0xB6000 + 0xA0000, as far as I can tell...it's 0xB6000 + 0xAA000, an extra 4096*10 bytes. Am I right?

So what I'm saying is the first hash is at 0xB6000 and is 0x2000, or 8192 bytes, long. After that there is a 4096-byte hash every 0xAA000 bytes. From what I understand, if the file is large enough to warrant another Master Hash table, it will be at 0x719A000 and will be 8192 bytes. Is this correct? It seems to have worked for me, I'm able to extract images out of this theme file that I couldn't get before because of the hash, I deleted 4096 bytes every 0xAA000 bytes after 0xB6000 and it's working great now!

[mxrider108]

I feel like there is a lot of incomplete/incorrect information about STFS packages floating around out there. Would someone be willing to post a complete and proper whitepaper for everyone to use, assuming one exists?

[HaLo2FrEeEk]

I could post what I've learned but it's nowhere near complete. All I know is how to find the file list, how to read the file list, where the hashes are, etc. I'd love it if someone posted a complete writeup on the stucture of the files, it would make a lot of things a lot easier, but I think back how the people did it before they had programs to help them...they had to do it all by hand, so that's what I'm trying to do. I could use wxPirs to extract out the video files or the pictures out of the themes, but I don't learn anything.

[mxrider108]

Well... I'm not talking about what you would learn to actually program an app--I'm talking about the STFS structure. Everyone talks about how the free60 article is wrong, and many people know exactly how it works, but I'm asking if they would put pen to paper and release a public whitepaper for everyone. I'd be glad to contribute what I know if needed.

[grimdoomer]

Here is something that might help you understand containers better.