Hmm this seems to be zlib compression I am going to look at the format myself and see if I see anything.
Signsrch 0.1.4
by Luigi Auriemma
e-mail:
aluigi@autistici.orgweb: aluigi.org
optimized search function from Andrew
http://www.team5150.com/~andrew/- open file "f:\un_huxleymmogame.exe"
- 17125376 bytes allocated
- load signatures
- open file C:\signsrch\signsrch.sig
- 1294834 bytes allocated for the signatures
- 1869 signatures in the database
- WARNING:
the file loaded in memory is very big so the scanning could take many time
- start signatures scanning:
offset num description [bits.endian.size]
--------------------------------------------
00b64858 31 Adler CRC32 (0x191b3141) [32.le.1024]
00b65858 32 Adler CRC32 (0x191b3141) [32.be.1024]
00b64c58 33 Adler CRC32 (0x01c26a37) [32.le.1024]
00b65c58 34 Adler CRC32 (0x01c26a37) [32.be.1024]
00b65058 35 Adler CRC32 (0xb8bc6765) [32.le.1024]
00b66058 36 Adler CRC32 (0xb8bc6765) [32.be.1024]
00b64458 83 CRC-32-IEEE 802.3 poly 0x04C11DB7 [32.le rev.1024]
00b65458 84 CRC-32-IEEE 802.3 poly 0x04C11DB7 [32.be rev.1024]
00c32a90 142 ACSS reverse sbox [..256]
00019b6e 307 SHA1 / SHA0 / RIPEMD-160 initialization [32.le.20&]
00c0a080 309 padding used in hashing algorithms (0x80 0 ... 0) [..64]
00b68228 357 Zlib dist_code [..512]
00b68428 358 Zlib length_code [..256]
00b68528 359 Zlib base_length [32.le.116]
00b685a0 361 Zlib base_dist [32.le.120]
00b68528 1085 Rar29 LDecode [32.le.112]
00c32a90 1210 FFT and FHT routines rv_tbl [..128]
00019b83 1303 RIPEMD-128 InitState [32.le.16&]
00265058 1499 TEA1_DS [32.le.4]
00b67be0 1541 zinflate_lengthExtraBits [32.le.116]
00b67bdd 1542 zinflate_lengthExtraBits [32.be.116]
00b67c58 1545 zinflate_distanceExtraBits [32.le.120]
00b67c55 1546 zinflate_distanceExtraBits [32.be.120]
004ac43a 1783 anti-debug: Dongle protection [..3]
00ebbffa 1812 anti-debug: Softice \\.\SICE [..9]
00ebc00e 1813 anti-debug: Softice \\.\NTICE [..10]
00ebc003 1814 anti-debug: Softice \\.\SIWVID [..11]
Author