[ANY GAME] Tutorial FileResearch = How and What game does with files

[nesa24]

This tutorial works on any game/software
Once you got it right you can reverse any game and find out game format

Software used: API MONITOR [http://www.rohitab.com/apimonitor]

Setup

Code: Select all

Start API Monitor v2 64bit [ as administrator ]

In API filter uncheck all
DataAccess and Storage >> Local File Systems >> File Management >> check Kernel32.dll

Save filter

Tracking game

Code: Select all

Go to file >> Monitor new process >> Find NBA2K15.exe [ remember to run STEAM first so game starts up]
Select StaticImport and Click OK

Game will start

Wait until main menu and exit game [F4]

Go to File>Save to save monitoring

Reading results

In middle window there are calls

TO SEE BYTES CLICK PostCall Value under lpBuffer

this is one
# Time of Day Relative Time Thread Module API Return Value Error Duration
280 11:42:58.767 AM 0:00:01:282 1 NBA2K15.exe CreateFileA ( "0B", GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL ) 0x0000000000000278 0.0001616


at 280th call game opens OB file [ and all 0x0000000000000278 calls will be for OB ]

# Time of Day Relative Time Thread Module API Return Value Error Duration
281 11:42:58.767 AM 0:00:01:282 1 NBA2K15.exe GetFileSizeEx ( 0x0000000000000278, 0x0000000000b5f310 ) TRUE 0.0000123

at 281 we have that it calls it under 0x0000000000000278 handle


# Time of Day Relative Time Thread Module API Return Value Error Duration
282 11:42:58.767 AM 0:00:01:282 1 NBA2K15.exe ReadFile ( 0x0000000000000278, 0x0000000000b5faa8, 12, 0x0000000000b5f820, 0x0000000000b5f830 ) TRUE 0.0000725

at 282 it reads 12 bytes in big endianorder [and you have them on right side of screen 94ef3bff88000000 ]

# Time of Day Relative Time Thread Module API Return Value Error Duration
283 11:42:58.767 AM 0:00:01:282 1 NBA2K15.exe ReadFile ( 0x0000000000000278, 0x000000000586d54c, 124, 0x0000000000b5f820, 0x0000000000b5f830 ) TRUE 0.0000090

at 283 it reads file info

at 284 it reads 2840314 bytes [ and that is KD boot screen ]

on right side of screen you can see those bytes

So from IFF file size of KD TitleScreen is 2840450 bytes [12+124+2840314 call 282/283/284]
Open 0B with hexeditworkshop and search for bytes

Copy it to new file [2840450 bytes] and you have isolated file to research

[nesa24]

guess people here aren't researcher or tool making people

just clicking ones

[JBulls]

guess people here aren't researcher or tool making people

just clicking ones

Unfortunately, programmers seem to be few and far between here, and those that are programmers are already trying to reverse engineer the files like gregkwaste and vladzolajr. But I think you will make a few people curious and intrigued. Thanks for all the great work you have done so far, I remember you were the one that started the audio decryption and leftos joined in on the research, and then they took him from us!

[Kevin]

I actually might try this

[Manni Live]

guess people here aren't researcher or tool making people

just clicking ones

im actually trying to get into programming,thanks for the tutorial ima give this a shot

[A_Armella]

Just want to jump in this thread too and say thanks. I've been searching the web for a long time trying to figure out how to get into this type of work.

I'm definitely going to give this a try. I may not fully understand the process in time to help figure out 2k15 but seriously, I can't even express how much this helps me, just to get started down the path.

Threads like this are why the NLSC is my "go to" modding site.

[A_Armella]

Is Anyone else getting a Steam Error when trying to run the game?

I'm running the 64 bit version of API Monitor v2 as an Administrator.
I'm starting Steam before running the program.
The error only happens if I'm running API Monitor.
I've tried running the game via API Monitor (File --> Monitor new process Attach using Static Import)
And I've tried just starting the game as I normally would.

I'm sure I'm just overlooking something super simple