Difference between revisions of "Packlist.dat"
Jump to navigation
Jump to search
m (fix cat) |
|||
| Line 1: | Line 1: | ||
{{DISPLAYTITLE:packlist.dat}} | {{DISPLAYTITLE:packlist.dat}} | ||
| − | '''{{c|packlist.dat}}''' is a file in the "Packs" folder in the TrackMania installation directory. It contains the encryption keys for the [[PAK|.pak files]] | + | '''{{c|packlist.dat}}''' is a file in the "Packs" folder in the TrackMania installation directory. It contains the encryption keys for the [[PAK|.pak files]]. |
There is no equivalent file for ManiaPlanet. | There is no equivalent file for ManiaPlanet. | ||
| Line 20: | Line 20: | ||
The name and the key of each entry are decrypted as follows. | The name and the key of each entry are decrypted as follows. | ||
| + | // md5() is a function that returns the MD5 hash of the input string | ||
nameKey = md5("6611992868945B0B59536FC3226F3FD0" + sprintf("%u", salt)); | nameKey = md5("6611992868945B0B59536FC3226F3FD0" + sprintf("%u", salt)); | ||
for (int i = 0; i < nameLength; i++) | for (int i = 0; i < nameLength; i++) | ||
| Line 30: | Line 31: | ||
key = md5(keyString + "NadeoPak") | key = md5(keyString + "NadeoPak") | ||
| − | {{c|name}} corresponds to the name of a .pak file, | + | {{c|name}} corresponds to the name of a .pak file, without the extension. {{c|key}} is the 16-byte key used during Blowfish decryption of the .pak file. |
== Signature verification == | == Signature verification == | ||
| − | {{c|packlist.dat}} has a 16-byte signature at the end for integrity checking. It is verified as follows: | + | {{c|packlist.dat}} has a 16-byte signature/checksum at the end for integrity checking. It is verified as follows: |
md5In = md5("E3554B5828AF14F11AA42A5EAF0AEFC8" + sprintf("%u", salt)); | md5In = md5("E3554B5828AF14F11AA42A5EAF0AEFC8" + sprintf("%u", salt)); | ||
Latest revision as of 14:54, 6 April 2024
packlist.dat is a file in the "Packs" folder in the TrackMania installation directory. It contains the encryption keys for the .pak files.
There is no equivalent file for ManiaPlanet.
File structure
- byte version (currently 1)
- byte numPacks
- uint32 crc32 (zero)
- uint32 salt
- PackEntry[numPacks]
- byte flags
- byte nameLength (must be < 32)
- byte encryptedName[nameLength]
- byte encryptedKeyString[0x20]
- byte signature[0x10]
Reading the pack entries
The name and the key of each entry are decrypted as follows.
// md5() is a function that returns the MD5 hash of the input string
nameKey = md5("6611992868945B0B59536FC3226F3FD0" + sprintf("%u", salt));
for (int i = 0; i < nameLength; i++)
name[i] = encryptedName[i] ^ nameKey[i % 16];
keyStringKey = md5(name + sprintf("%u", salt) + "B97C1205648A66E04F86A1B5D5AF9862")
for (int i = 0; i < 0x20; i++)
keyString[i] = encryptedKeyString[i] ^ keyStringKey[i % 16];
key = md5(keyString + "NadeoPak")
name corresponds to the name of a .pak file, without the extension. key is the 16-byte key used during Blowfish decryption of the .pak file.
Signature verification
packlist.dat has a 16-byte signature/checksum at the end for integrity checking. It is verified as follows:
md5In = md5("E3554B5828AF14F11AA42A5EAF0AEFC8" + sprintf("%u", salt));
md5Xor36 = pad(md5In, 0x40, '\0'); // Append 0x30 '00' bytes
md5Xor5C = pad(md5In, 0x40, '\0');
for (int i = 0; i < 0x40; i++)
{
md5Xor36[i] ^= 0x36;
md5Xor5C[i] ^= 0x5C;
}
signature = md5(md5Xor5C + md5(md5Xor36 + fileContent)) // fileContent is everything in packlist.dat except the signature
The calculated signature must match the signature in the file, or TrackMania will not accept the file.