Wednesday, July 07, 2004

Rcomp differences

The format for RSC binary files as mentioned in the series 60 SDk calls for offset 0x2 of the file to be the size of the file index in bytes. Each entry in the index is two bytes long. It follows that offset 0x2 can never be odd. I added this into dumprsc as something suspicious. Emxrsc also tags this as suspicous, so i assumed this was correct. Then I looked at a few actual RSC files. Offset 0x2 is always equal to 1 byte more than the size of the file index.

Perhaps this was due to a mistake in implementation of the latest version of Rcomp. I put together a few simple RSC files to see what the current version places in offset 0x2. 1 byte more, every time. I hunted down my Symbian ver. 5 SDK disk to get the previous rcomp. It produces RSC files with the proper size at offset 0x2.

More spelunking in the Rcomp source is necessary. Meanwhile even at offset 0x2 means Symbian OS 5 and odd means OS 6+.

No comments:

Protecting the ‘Metaverse ecosystem’…: Openness is healthy

Meta’s Reality Labs has an opening for “Malware Reverse Engineer” . Not an uncommon role, but this particular one is a bit more specific whe...