Unprotecting a protected MIX - Revision history

MarkJFox: 11 revisions imported

2025-03-31T20:11:13Z

11 revisions imported

← Older revision	Revision as of 22:11, 31 March 2025
(No difference)

en>Aldrinjohnom: /* Recovering all File Names inside the MIX */

2023-11-07T13:25:46Z

Recovering all File Names inside the MIX

← Older revision		Revision as of 15:25, 7 November 2023
Line 100:		Line 100:
	<tr><th colspan="4">LMD ID</th><th colspan="4">LMD Body Offset</th><th colspan="4">LMD File Size</th></tr>		<tr><th colspan="4">LMD ID</th><th colspan="4">LMD Body Offset</th><th colspan="4">LMD File Size</th></tr>
	</table>		</table>
	Change the "nn nn nn nn" into the '''BodyOffset'''. Change then "NN NN NN NN" into the '''LMDSize'''.<br />		Change the "nn nn nn nn" into the '''BodyOffset'''. Change then "NN NN NN NN" into the '''LMDSize'''(Little Endian Order).<br />
	14) Save the Hex of the MIX, and try opening it with XCC Mixer, the File Names inside this MIX are now Recovered.<br />		14) Save the Hex of the MIX, and try opening it with XCC Mixer, the File Names inside this MIX are now Recovered.<br />

en>Aldrinjohnom: /* Recovering all File Names inside the MIX */

2023-11-06T16:19:49Z

Recovering all File Names inside the MIX

← Older revision		Revision as of 18:19, 6 November 2023
Line 88:		Line 88:
	<tr><th>X</th><th>C</th><th>C</th><th> </th><th>b</th><th>y</th><th> </th><th>O</th><th>l</th><th>a</th><th>f</th><th> </th><th>v</th><th>a</th><th>n</th><th> </th><th>d</th><th>e</th><th>r</th><th> </th><th>S</th><th>p</th><th>e</th><th>k</th></tr>		<tr><th>X</th><th>C</th><th>C</th><th> </th><th>b</th><th>y</th><th> </th><th>O</th><th>l</th><th>a</th><th>f</th><th> </th><th>v</th><th>a</th><th>n</th><th> </th><th>d</th><th>e</th><th>r</th><th> </th><th>S</th><th>p</th><th>e</th><th>k</th></tr>
	</table>		</table>
	7) Read the "nn nn nn nn", ~~remember~~ it as '''LMDSize'''~~(DO NOT CONVERT IT IN LITTLE-ENDIAN BECAUSE IT IS ALREADY IN LITTLE-ENDIAN FORMAT)~~.<br />		7) Read the "nn nn nn nn", then reorder the bytes in BIG-ENDIAN order(E0 53 00 00 becomes 00 00 53 E0). Remember it as '''LMDSize'''.<br />
	8) Determine the current position(Address/Location) of the first character we searched(position of the "X" or byte "58"). Common Hex editors projects the "Address" on its left-side (Your Hex Editor must support projecting Address/Location). Remember this as '''LMDOffset'''.<br />		8) Determine the current position(Address/Location) of the first character we searched(position of the "X" or byte "58"). Common Hex editors projects the "Address" on its left-side (Your Hex Editor must support projecting Address/Location). Remember this as '''LMDOffset'''.<br />
	9) Remember the '''BodySize'''?(7th(06) byte to 10th(09) byte of the '''Header''') If not, use your hex editor and go to very first line of this mix file, read the 7th(06) byte to 10th(09) byte of the '''Header''', ~~convert it~~ into ~~a "standard endianess" which is a~~ BIG-endian(E0 53 03 00 becomes 00 03 53 E0). Remember this as '''BodySize'''.<br />		9) Remember the '''BodySize'''?(7th(06) byte to 10th(09) byte of the '''Header''') If not, use your hex editor and go to very first line of this mix file, read the 7th(06) byte to 10th(09) byte of the '''Header''', reorder the bytes into BIG-endian order(E0 53 03 00 becomes 00 03 53 E0). Remember this as '''BodySize'''.<br />
	10) Use the Formula below to and calculate the '''BodyOffset'''. <br />		10) Use the Formula below to and calculate the '''BodyOffset'''. <br />
	<span style="font-size: large; font-weight: bold;"><code>BodyOffset = LMDOffset - BodySize</code></span><br />		<span style="font-size: large; font-weight: bold;"><code>BodyOffset = LMDOffset - BodySize</code></span><br />
Line 102:		Line 102:
	Change the "nn nn nn nn" into the '''BodyOffset'''. Change then "NN NN NN NN" into the '''LMDSize'''.<br />		Change the "nn nn nn nn" into the '''BodyOffset'''. Change then "NN NN NN NN" into the '''LMDSize'''.<br />
	14) Save the Hex of the MIX, and try opening it with XCC Mixer, the File Names inside this MIX are now Recovered.<br />		14) Save the Hex of the MIX, and try opening it with XCC Mixer, the File Names inside this MIX are now Recovered.<br />


	==Recovering the MIX using an Application==		==Recovering the MIX using an Application==

en>Aldrinjohnom at 15:24, 17 November 2020

2020-11-17T15:24:54Z

← Older revision		Revision as of 17:24, 17 November 2020
Line 55:		Line 55:

	==File Names Inside a MIX==		==File Names Inside a MIX==
	All MIX files that was created or modified by Olaf's XCC MIX Utilities like "XCC MIX Editor" and "XCC Mixer" appends a local mix database.dat(LMD for short). local mix database.dat is used by XCC MIX Utilities to identify all the possible file name entries that are found inside the MIX File, thus translating these file names into a CCRC generated ID~~, in~~ more simple terms~~, all IDs are detected by the~~ MIX ~~Utilities, but they~~ only ~~project~~ the file ~~names of these ID~~'s ~~to the User, if~~ its file name is ~~included~~ at ~~the~~ local mix database.dat .		All MIX files that was created or modified by Olaf's XCC MIX Utilities like "XCC MIX Editor" and "XCC Mixer" appends a "local mix database.dat"(LMD for short). "local mix database.dat" is used by XCC MIX Utilities to identify all the possible file name entries that are found inside the MIX File, thus translating these file names into a CCRC generated ID. In more simple terms:
			* If a corresponding file's name is '''NOT''' listed at "local mix database.dat" then XCC MIX Utility Tools will only let you see the corresponding file's name in hexadecimal format which is its "ID".
			* If a corresponding file's name is listed at "local mix database.dat" then XCC MIX Utility Tools will show this corresponding file's name properly.


Line 69:		Line 71:
	==How File Name Corruption Works==		==How File Name Corruption Works==
	As stated earlier, All files have an '''index''' and '''body''', so do the LMD too. Mix protectors tend to corrupt either:		As stated earlier, All files have an '''index''' and '''body''', so do the LMD too. Mix protectors tend to corrupt either:
	* The index(id reference entry) of the LMD - LeechKiller sets the 12 byte entry of the LMD to a pad of zeros, modern mix protectors set this to a random pattern style(scrambling).		* The index(id reference entry) of the LMD - LeechKiller sets the 12 byte entry of the LMD to a pad of zeros, modern mix protectors set this to a random pattern style aka '''scrambling'''. ''Using the Method below will surely recover the File Names inside the MIX File''.
	* The body(local mix database.dat) of the LMD - modern mix protectors removes the LMD.dat from the mix(~~mangling~~).		* The body(local mix database.dat) of the LMD - modern mix protectors removes the LMD.dat from the mix aka '''mangling'''. If Mix file has a Mangled LMD then ''it is Impossible to recover the File Names using the method below since the Original LMD was mangled. But it is possible to recover its file names if you create a new "local mix database.dat" with all possible file names inside that mix(although it is hazzle and time consuming but worth it if you try)''. This method is called '''LMD Fabrication'''.


	==Recovering all File Names inside the MIX==		==Recovering all File Names inside the MIX==
	This is a little bit harder and need some tool.		This is a little bit harder and need some tool.<br />
	1) Make sure that the MIX header is UNPROTECTED(can be opened by xcc mixer or xcc mix editor), if not, then unprotect it first by following the steps above.<br />		1) Make sure that the MIX header is UNPROTECTED(can be opened by xcc mixer or xcc mix editor), if not, then unprotect it first by following the steps above.<br />
	2) Download and install [http://xhp.xwis.net/utilities/XCC_Utilities.exe XCC Mix Editor].<br />		2) Download and install [http://xhp.xwis.net/utilities/XCC_Utilities.exe XCC Mix Editor].<br />
Line 103:		Line 105:

	==Recovering the MIX using an Application==		==Recovering the MIX using an Application==
	If you find it hard to do all of these technical stuffs, you can use [[Unprotector:RA2YR_MIX_Unprotector_Master\|RA2YR MIX Unprotector Master]] to completely recover the MIX's header and the file names inside it.		If you find it hard to do all of these technical stuffs, you can use [[Unprotector:RA2YR_MIX_Unprotector_Master\|RA2YR MIX Unprotector Master]] to completely recover the MIX's header and the file names inside it. But this application cannot recover file names if the MIX File's LMD was mangled.


	==See also==		==See also==

en>Aldrinjohnom at 14:56, 3 December 2019

2019-12-03T14:56:36Z

← Older revision		Revision as of 16:56, 3 December 2019
Line 62:		Line 62:
	<pre>		<pre>
	byte 1 - 4 : (Little-Endian) - File ID		byte 1 - 4 : (Little-Endian) - File ID
	byte 5 - 8 : (Little-Endian) - File ~~'''~~Body~~'''~~ Offset Address/Location		byte 5 - 8 : (Little-Endian) - File Body Offset Address/Location
	byte 9 - 12 : (Little-Endian) - File Size		byte 9 - 12 : (Little-Endian) - File Size
	</pre>		</pre>

en>TAK02: /* See also */ Grammar correction.That was just sour.

2019-11-27T20:03:44Z

See also: Grammar correction.That was just sour.

← Older revision		Revision as of 22:03, 27 November 2019
Line 108:		Line 108:
	==See also==		==See also==
	*''This tutorial is a reformatted version of a tutorial posted originally on [http://www.ppmsite.com/forum/viewtopic.php?p=307837#307837 PPM] and then cross-posted here by its author, aristurtle.''		*''This tutorial is a reformatted version of a tutorial posted originally on [http://www.ppmsite.com/forum/viewtopic.php?p=307837#307837 PPM] and then cross-posted here by its author, aristurtle.''
	*''The ~~Author~~ of "File Names Inside MIX" that tackles ~~about~~ recovering all ~~File~~ names inside the MIX ~~File was made by~~ aldrinjohnom.''		*''The author of "File Names Inside MIX" that tackles recovering all file names inside the MIX file is aldrinjohnom.''
	*[http://forums.renegadeprojects.com/showthread.php?tid=414&pid=6822#pid6822 DCoder summing up MIX protection in 2006]		*[http://forums.renegadeprojects.com/showthread.php?tid=414&pid=6822#pid6822 DCoder summing up MIX protection in 2006]
	*[[MIX\|MIX Files]]		*[[MIX\|MIX Files]]

en>Aldrinjohnom at 12:44, 27 November 2019

2019-11-27T12:44:46Z

← Older revision		Revision as of 14:44, 27 November 2019
Line 100:		Line 100:
	Change the "nn nn nn nn" into the '''BodyOffset'''. Change then "NN NN NN NN" into the '''LMDSize'''.<br />		Change the "nn nn nn nn" into the '''BodyOffset'''. Change then "NN NN NN NN" into the '''LMDSize'''.<br />
	14) Save the Hex of the MIX, and try opening it with XCC Mixer, the File Names inside this MIX are now Recovered.<br />		14) Save the Hex of the MIX, and try opening it with XCC Mixer, the File Names inside this MIX are now Recovered.<br />


			==Recovering the MIX using an Application==
			If you find it hard to do all of these technical stuffs, you can use [[Unprotector:RA2YR_MIX_Unprotector_Master\|RA2YR MIX Unprotector Master]] to completely recover the MIX's header and the file names inside it.

en>Aldrinjohnom at 14:57, 25 November 2019

2019-11-25T14:57:10Z

← Older revision		Revision as of 16:57, 25 November 2019
Line 81:		Line 81:
	5) Grab your Favorite Hex Editor and "String Search" for "XCC by Olaf van der Spek" without quotation marks.<br />		5) Grab your Favorite Hex Editor and "String Search" for "XCC by Olaf van der Spek" without quotation marks.<br />
	6) If an Instance was found, clarify if the arrangement of byte is like this:<br />		6) If an Instance was found, clarify if the arrangement of byte is like this:<br />
	<~~pre~~>		<table class="wikitable">
	~~X C C b y O l a f v a n d e r S p e k~~		<tr><th colspan="32">Important 32 bytes field that should exist</th><th colspan="4">LMDSize</th></tr>
	58 43 43 20 62 79 20 ~~4f 6c~~ 61 66 20 76 61 6e 20 64 65 72 20 53 70 65 ~~6b 1a~~ 04 17 27 10 19 80 00 nn nn nn nn		<tr><th>58</th><th>43</th><th>43</th><th>20</th><th>62</th><th>79</th><th>20</th><th>4F</th><th>6C</th><th>61</th><th>66</th><th>20</th><th>76</th><th>61</th><th>6E</th><th>20</th><th>64</th><th>65</th><th>72</th><th>20</th><th>53</th><th>70</th><th>65</th><th>6B</th><th>1A</th><th>04</th><th>17</th><th>27</th><th>10</th><th>19</th><th>80</th><th>00</th><th>nn</th><th>nn</th><th>nn</th><th>nn</th></tr>
	~~^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^~~		<tr><th>X</th><th>C</th><th>C</th><th> </th><th>b</th><th>y</th><th> </th><th>O</th><th>l</th><th>a</th><th>f</th><th> </th><th>v</th><th>a</th><th>n</th><th> </th><th>d</th><th>e</th><th>r</th><th> </th><th>S</th><th>p</th><th>e</th><th>k</th></tr>
	~~Important field that should exist LMDSize~~		</table>
	</~~pre~~>
	7) Read the "nn nn nn nn", remember it as '''LMDSize'''(DO NOT CONVERT IT IN LITTLE-ENDIAN BECAUSE IT IS ALREADY IN LITTLE-ENDIAN FORMAT).<br />		7) Read the "nn nn nn nn", remember it as '''LMDSize'''(DO NOT CONVERT IT IN LITTLE-ENDIAN BECAUSE IT IS ALREADY IN LITTLE-ENDIAN FORMAT).<br />
	8) Determine the current position(Address/Location) of the first character we searched(position of the "X"). Common Hex editors projects the "Address" on its left-side (Your Hex Editor must support projecting Address/Location). Remember this as '''LMDOffset'''.<br />		8) Determine the current position(Address/Location) of the first character we searched(position of the "X" or byte "58"). Common Hex editors projects the "Address" on its left-side (Your Hex Editor must support projecting Address/Location). Remember this as '''LMDOffset'''.<br />
	9) Remember the '''BodySize'''?(7th(06) byte to 10th(09) byte of the '''Header''') If not, use your hex editor and go to very first line of this mix file, read the 7th(06) byte to 10th(09) byte of the '''Header''', convert it into a "standard endianess" which is a BIG-endian(E0 53 03 00 becomes 00 03 53 E0). Remember this as '''BodySize'''.<br />		9) Remember the '''BodySize'''?(7th(06) byte to 10th(09) byte of the '''Header''') If not, use your hex editor and go to very first line of this mix file, read the 7th(06) byte to 10th(09) byte of the '''Header''', convert it into a "standard endianess" which is a BIG-endian(E0 53 03 00 becomes 00 03 53 E0). Remember this as '''BodySize'''.<br />
	10) Use the Formula below to and calculate the '''BodyOffset'''. <br />		10) Use the Formula below to and calculate the '''BodyOffset'''. <br />
Line 95:		Line 94:
	12) MOVE KEYBOARD FOCUS of your Hex Editor at the starting of this mix file(topleft-most), just simply left-click the very first byte to do this. then put your Hex Editor in "Hex Search Mode"(Your Hex Editor must support that) and search for "1f 05 6e 36" without quotation marks.("1f 05 6e 36" is the ID of the LMD that is always present)<br />		12) MOVE KEYBOARD FOCUS of your Hex Editor at the starting of this mix file(topleft-most), just simply left-click the very first byte to do this. then put your Hex Editor in "Hex Search Mode"(Your Hex Editor must support that) and search for "1f 05 6e 36" without quotation marks.("1f 05 6e 36" is the ID of the LMD that is always present)<br />
	13) when the first occurence was found, the format you will see is like this:<br />		13) when the first occurence was found, the format you will see is like this:<br />
	<~~pre~~>		<table class="wikitable">
	1f 05 6e 36 nn nn nn nn NN NN NN NN		<tr><th>1F</th><th>05</th><th>6E</th><th>36</th><th>nn</th><th>nn</th><th>nn</th><th>nn</th><th>NN</th><th>NN</th><th>NN</th><th>NN</th></tr>
	</~~pre~~>		<tr><th colspan="4">LMD ID</th><th colspan="4">LMD Body Offset</th><th colspan="4">LMD File Size</th></tr>
	Change the "nn nn nn nn" into the '''BodyOffset'''. Change then "NN NN NN NN" into the '''LMDSize'''<br />		</table>
			Change the "nn nn nn nn" into the '''BodyOffset'''. Change then "NN NN NN NN" into the '''LMDSize'''.<br />
	14) Save the Hex of the MIX, and try opening it with XCC Mixer, the File Names inside this MIX are now Recovered.<br />		14) Save the Hex of the MIX, and try opening it with XCC Mixer, the File Names inside this MIX are now Recovered.<br />

Line 104:		Line 104:
	==See also==		==See also==
	*''This tutorial is a reformatted version of a tutorial posted originally on [http://www.ppmsite.com/forum/viewtopic.php?p=307837#307837 PPM] and then cross-posted here by its author, aristurtle.''		*''This tutorial is a reformatted version of a tutorial posted originally on [http://www.ppmsite.com/forum/viewtopic.php?p=307837#307837 PPM] and then cross-posted here by its author, aristurtle.''
			*''The Author of "File Names Inside MIX" that tackles about recovering all File names inside the MIX File was made by aldrinjohnom.''
	*[http://forums.renegadeprojects.com/showthread.php?tid=414&pid=6822#pid6822 DCoder summing up MIX protection in 2006]		*[http://forums.renegadeprojects.com/showthread.php?tid=414&pid=6822#pid6822 DCoder summing up MIX protection in 2006]
	*[[MIX\|MIX Files]]		*[[MIX\|MIX Files]]
	*[[MIX Protector]], [[User:CnCVK\|VK]]'s tool for MIX protection		*[[MIX Protector]], [[User:CnCVK\|VK]]'s tool for MIX protection
	*[[XRML Leechkiller]], [[User:Saberhawk\|Saberhawk]]'s tool for MIX protection		*[[XRML Leechkiller]], [[User:Saberhawk\|Saberhawk]]'s tool for MIX protection
			*[[Unprotector:RA2YR_MIX_Unprotector_Master\|RA2YR MIX Unprotector Master]] can recover any protected MIX Files including all file names.


	[[Category:General Tutorials]] [[Category:RA2/YR Tutorials]]		[[Category:General Tutorials]] [[Category:RA2/YR Tutorials]]

en>Aldrinjohnom at 23:30, 24 November 2019

2019-11-24T23:30:52Z

← Older revision		Revision as of 01:30, 25 November 2019
Line 5:		Line 5:
	TS/RA2 Mix files consist of a header, an index, and a body.		TS/RA2 Mix files consist of a header, an index, and a body.
	* The '''header''' includes basic information about the MIX (does it have a checksum, is it encrypted, how many files are in it, how big is it).		* The '''header''' includes basic information about the MIX (does it have a checksum, is it encrypted, how many files are in it, how big is it).
	* The '''index''' includes the ~~size~~, ~~location~~, and ~~checksum~~ of each file in the mix.		* The '''index''' includes the ID, Address/Location, and size of each file in the mix.
	* The '''body''' contains the actual files.		* The '''body''' contains the actual files.

Line 12:		Line 12:
	First, it is necessary to understand how the headers are laid out. The first four bytes are the encryption and checksum flags. If the MIX is has encrypted headers (not to be confused with "protected": "encrypted" refers to the Blowfish encryption that Westwood used on its own mixes; XCC breaks this just fine) the flags are 00 02 00 00. If the MIX has a checksum, the flags are 00 01 00 00. Neither of the current MIX Protector programs work on files with encrypted headers, (although they could be modified to do so with some effort), so I won't go into that right now.		First, it is necessary to understand how the headers are laid out. The first four bytes are the encryption and checksum flags. If the MIX is has encrypted headers (not to be confused with "protected": "encrypted" refers to the Blowfish encryption that Westwood used on its own mixes; XCC breaks this just fine) the flags are 00 02 00 00. If the MIX has a checksum, the flags are 00 01 00 00. Neither of the current MIX Protector programs work on files with encrypted headers, (although they could be modified to do so with some effort), so I won't go into that right now.

	On unencrypted MIXes (i.e. all the ones you will need to break), after the flags comes the "header". The header consists of a 16-bit integer that equals the number of files in the MIX, and a 32-bit integer that equals the size of the body of the MIX (the size of the MIX file minus the size of the header and index). These numbers are "~~big~~-endian", which means the bytes are arranged backwards (but the bits within each byte are arranged normally). (This is because the Intel x86 architecture is semi-retarded). So if bytes 04 and 05 (the number of files) are 0xB801, you need to rearrange this to 0x01B8 to get the actual number of files. (0x01B8 in decimal is 440, you can use Google Calculator to convert if necessary.)		On unencrypted MIXes (i.e. all the ones you will need to break), after the flags comes the "header". The header consists of a 16-bit integer that equals the number of files in the MIX, and a 32-bit integer that equals the size of the body of the MIX (the size of the MIX file minus the size of the header and index). These numbers are "little-endian", which means the bytes are arranged backwards (but the bits within each byte are arranged normally). (This is because the Intel x86 architecture is semi-retarded). So if bytes 04 and 05 (the number of files) are 0xB801, you need to rearrange this to 0x01B8 to get the actual number of files. (0x01B8 in decimal is 440, you can use Google Calculator to convert if necessary.)

	===Header summary===		===Header summary===
Line 21:		Line 21:
	byte 02 : always 00 (VK's Mix Protector will overwrite this with garbage)		byte 02 : always 00 (VK's Mix Protector will overwrite this with garbage)
	byte 03 : always 00 (VK's Mix Protector will overwrite this with garbage)		byte 03 : always 00 (VK's Mix Protector will overwrite this with garbage)
	byte 04-05: ~~big~~-endian number containing the number of files.		byte 04-05: little-endian number containing the number of files.
	byte 06-09: ~~big~~-endian number containing MIX body size. (LeechKiller and VK's Mix Protector will both overwrite bytes 06 and 07 with garbage).</pre>		byte 06-09: little-endian number containing MIX body size. (LeechKiller and VK's Mix Protector will both overwrite bytes 06 and 07 with garbage).</pre>

	Then you have the index (12 bytes per index entry) and then the body.		Then you have the index (12 bytes per index entry) and then the body.
Line 39:		Line 39:
	You see, the index has twelve bytes for each file, the header has four bytes for flags, two bytes for the number of files, and four bytes for the body size.		You see, the index has twelve bytes for each file, the header has four bytes for flags, two bytes for the number of files, and four bytes for the body size.

	Don't forget, the body size and the number of files are all in ~~big~~-endian form, and must be inserted as such.		Don't forget, the body size and the number of files are all in little-endian form, and must be inserted as such.

	==In short, for the impatient==		==In short, for the impatient==
Line 48:		Line 48:
	#Take the file size. We'll call this number F.		#Take the file size. We'll call this number F.
	#F - H = B.		#F - H = B.
	#Convert B to hex. Pad the front with zeroes until it is eight hex digits long. Rearrange the bytes in ~~big~~-endian order (e.g. 00 94 26 7F becomes 7F 26 94 00)		#Convert B to hex. Pad the front with zeroes until it is eight hex digits long. Rearrange the bytes in little-endian order (e.g. 00 94 26 7F becomes 7F 26 94 00)
	#Overwrite the next four bytes (bytes 06-09) with this corrected value.		#Overwrite the next four bytes (bytes 06-09) with this corrected value.
	#Save the MIX file and exit your hex editor.		#Save the MIX file and exit your hex editor.

	==~~Notes~~==
	*This will ''not'' ~~recover~~ the ~~filenames~~ of ~~each~~ file in the MIX~~. Those~~ are ~~gone forever~~.
			==File Names Inside a MIX==
			All MIX files that was created or modified by Olaf's XCC MIX Utilities like "XCC MIX Editor" and "XCC Mixer" appends a local mix database.dat(LMD for short). local mix database.dat is used by XCC MIX Utilities to identify all the possible file name entries that are found inside the MIX File, thus translating these file names into a CCRC generated ID, in more simple terms, all IDs are detected by the MIX Utilities, but they only project the file names of these ID's to the User, if its file name is included at the local mix database.dat .


			==Understanding the MIX Index==
			All files have ID entries(aka '''index'''), they are always found Between the MIX '''Header'''(starting 10 bytes that we fixed above) and the '''Body'''. Each File ID entries occupy '''12 bytes'''.
			<pre>
			byte 1 - 4 : (Little-Endian) - File ID
			byte 5 - 8 : (Little-Endian) - File '''Body''' Offset Address/Location
			byte 9 - 12 : (Little-Endian) - File Size
			</pre>


			==How File Name Corruption Works==
			As stated earlier, All files have an '''index''' and '''body''', so do the LMD too. Mix protectors tend to corrupt either:
			* The index(id reference entry) of the LMD - LeechKiller sets the 12 byte entry of the LMD to a pad of zeros, modern mix protectors set this to a random pattern style(scrambling).
			* The body(local mix database.dat) of the LMD - modern mix protectors removes the LMD.dat from the mix(mangling).


			==Recovering all File Names inside the MIX==
			This is a little bit harder and need some tool.
			1) Make sure that the MIX header is UNPROTECTED(can be opened by xcc mixer or xcc mix editor), if not, then unprotect it first by following the steps above.<br />
			2) Download and install [http://xhp.xwis.net/utilities/XCC_Utilities.exe XCC Mix Editor].<br />
			3) OpenXCC MIX Editor and browse the MIX file you want to recover the filenames.<br />
			4) Click on "Compact" Button(this will append a new '''index''' suited for the LMD incase that there are no presend LMD ID), then close the XCC MIX Editor.<br />
			5) Grab your Favorite Hex Editor and "String Search" for "XCC by Olaf van der Spek" without quotation marks.<br />
			6) If an Instance was found, clarify if the arrangement of byte is like this:<br />
			<pre>
			X C C b y O l a f v a n d e r S p e k
			58 43 43 20 62 79 20 4f 6c 61 66 20 76 61 6e 20 64 65 72 20 53 70 65 6b 1a 04 17 27 10 19 80 00 nn nn nn nn
			^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^
			Important field that should exist LMDSize
			</pre>
			7) Read the "nn nn nn nn", remember it as '''LMDSize'''(DO NOT CONVERT IT IN LITTLE-ENDIAN BECAUSE IT IS ALREADY IN LITTLE-ENDIAN FORMAT).<br />
			8) Determine the current position(Address/Location) of the first character we searched(position of the "X"). Common Hex editors projects the "Address" on its left-side (Your Hex Editor must support projecting Address/Location). Remember this as '''LMDOffset'''.<br />
			9) Remember the '''BodySize'''?(7th(06) byte to 10th(09) byte of the '''Header''') If not, use your hex editor and go to very first line of this mix file, read the 7th(06) byte to 10th(09) byte of the '''Header''', convert it into a "standard endianess" which is a BIG-endian(E0 53 03 00 becomes 00 03 53 E0). Remember this as '''BodySize'''.<br />
			10) Use the Formula below to and calculate the '''BodyOffset'''. <br />
			<span style="font-size: large; font-weight: bold;"><code>BodyOffset = LMDOffset - BodySize</code></span><br />
			11) Convert the calculated result into little-endian(00 0F 21 23 becomes 23 21 0F 00), remember this as '''BodyOffset'''.<br />
			12) MOVE KEYBOARD FOCUS of your Hex Editor at the starting of this mix file(topleft-most), just simply left-click the very first byte to do this. then put your Hex Editor in "Hex Search Mode"(Your Hex Editor must support that) and search for "1f 05 6e 36" without quotation marks.("1f 05 6e 36" is the ID of the LMD that is always present)<br />
			13) when the first occurence was found, the format you will see is like this:<br />
			<pre>
			1f 05 6e 36 nn nn nn nn NN NN NN NN
			</pre>
			Change the "nn nn nn nn" into the '''BodyOffset'''. Change then "NN NN NN NN" into the '''LMDSize'''<br />
			14) Save the Hex of the MIX, and try opening it with XCC Mixer, the File Names inside this MIX are now Recovered.<br />


	==See also==		==See also==

en>Renegade: Adding link to MIX, fixing VK's link.

2009-04-19T01:02:55Z

Adding link to MIX, fixing VK's link.

← Older revision		Revision as of 03:02, 19 April 2009
Line 58:		Line 58:
	*''This tutorial is a reformatted version of a tutorial posted originally on [http://www.ppmsite.com/forum/viewtopic.php?p=307837#307837 PPM] and then cross-posted here by its author, aristurtle.''		*''This tutorial is a reformatted version of a tutorial posted originally on [http://www.ppmsite.com/forum/viewtopic.php?p=307837#307837 PPM] and then cross-posted here by its author, aristurtle.''
	*[http://forums.renegadeprojects.com/showthread.php?tid=414&pid=6822#pid6822 DCoder summing up MIX protection in 2006]		*[http://forums.renegadeprojects.com/showthread.php?tid=414&pid=6822#pid6822 DCoder summing up MIX protection in 2006]
	*[[MIX Protector]], [[VK]]'s tool for MIX protection		*[[MIX\|MIX Files]]
			*[[MIX Protector]], [[User:CnCVK\|VK]]'s tool for MIX protection
	*[[XRML Leechkiller]], [[User:Saberhawk\|Saberhawk]]'s tool for MIX protection		*[[XRML Leechkiller]], [[User:Saberhawk\|Saberhawk]]'s tool for MIX protection


	[[Category:General Tutorials]] [[Category:RA2/YR Tutorials]]		[[Category:General Tutorials]] [[Category:RA2/YR Tutorials]]