Closed r3l1v3l1f3 closed 6 years ago
This file seems to have a small difference where the header starts -4 from the actual offset that is reported.
Here's the start of the file:
.bind:02B8E2FB mov [ebp+var_88], offset dword_2B901AC <--- Header Position
.bind:02B8E305 mov esi, [ebp-88h]
.bind:02B8E30B mov ecx, 0D0h
.bind:02B8E310 lea edi, [ebp-3C8h]
.bind:02B8E316 rep movsd
.bind:02B8E318 lea eax, [ebp-3C8h]
.bind:02B8E31E mov [ebp-3D4h], eax
.bind:02B8E324 mov dword ptr [ebp-404h], 0D6930FB7h <--- Xor Key
However, the header position is really -4 of what's seen there, otherwise the struct does not align correctly.
It's rather strange since this is the first 2.0 version file I have seen with this setup.
I'm trying to see where this accounts for the -4 shift, otherwise I may just toss in a small bandaid type fix for files that load with invalid header data based on assumed values.
Ignore that last part, my hex editor was setup for a different environment and was misaligning things. This variant of the 2.x stub uses a slighly different header than the others have conformed to. A fix has been pushed to support this now.
LEGOBatman.zip