neosophaux / amta-decompressor Goto Github PK

AMTA decompression for "Battle for the Galaxy" by AMTGames Ltd. Documentation by
https://github.com/neosophaux:
    A simple compression algorithm that wraps the data stream generated by another compression
algorithm known as LZO(Lempel–Ziv–Oberhumer) using an XOR technique.

Note: The AMTA files I analyzed are in little-endian format.

    Before the algorithm inflates it's data, a series of checks must be performed to ensure the
full recovery of the data. The first of those checks is a size check on the file data itself. If
the size of the file is <= 8, then the algorithm stops due to a lack of data(8 bytes is the header
length).

    Next, the algorithm then processes the file header. First, it ensures that the first 4 bytes
of the file contains the following magic bytes: [0x61, 0x6d, 0x74, 0x61] ('a', 'm', 't', 'a'). If
those bytes are not found, then the algorithm quits due to a mismatching header.

    The algorithm then reads the next 4 bytes of the file as an unsigned integer that is meant to
be the size of the original decompressed file. If it is 0, >= 0x6400001, or if the size doesn't
match the uncompressed data, then the algorithm will stop and raise an error.

    The first byte that comes after the header is then read and XOR'd with 0x56. The purpose of
it is unknown but my current assumption is it's to make the LZO stream valid. After the inflation
to an LZO stream, the original byte within the file data must be replaced with the XOR'd version.

    The rest of the file data is then processed in a loop that only iterates when a variable I will
call 'offset' is > 0. The offset variable is initiated with the data size of the AMTA archive. On
successful iteration of the loop, the offset variable is decremented by 1.

    In the loop, the file is read 1 byte at a time, but operations are performed on two neighboring
bytes called byte 'a' and byte 'b'. The first byte, byte 'a', is located by seeking to the value of
the offset variable(mentioned above) and then seeking 1 byte backwards. Byte 'b' is located in a
similar fashion, but instead of seeking 1 byte backwards, the algorithm will seek 2 bytes
backwards. To inflate, byte 'a' and byte 'b' are XOR'd together; the resulting byte is then placed
where byte 'a' once was.

    Finally, the inflated LZO stream is decompressed using the lzo1x decompression algorithm and
the length of the decompressed LZO stream is checked against the size determined in the AMTA
header. If it fails, then the decompressed data is invalid.