NULL mag Issue 05 21 Ripping media from executables

eZine lover (@eZine)

Published in 

null magazine

 · 3 years ago

  

        __  _                        __ _                           _  __ 
  ______\ \_\\_______________________\///__________________________//_/ /______ 
  \___\                                                                   /___/ 
   | .__                                 __                                  | 
   | |                   ___  __________/  |________                         | 
   |                     \  \/  / ____/\   __\_  __ \                        | 
   ;                      >    < <_|  | |  |  |  | \/                        ; 
   :                     /__/\_ \__   | |__|  |__|                           : 
   .                           \/  |__|                                      . 
   .                                                                         . 
   :           H/Q Another Droid BBS - andr01d.zapto.org:9999                : 
   ;                                                                         ; 
   + --- --  -   .     -        ---    ---    ---        -     .    - -- --- + 
   :                                                                         : 
   |                     Check files for included files                      | 
   :                                                                         : 
   ` --- --  -   .     -        ---    ---    ---        -     .    - -- --- ' 

   Its a common practice in the demoscene and not only, to include files,  
   like music, art, text inside the main executable of an app/demo or in  
   a separate .data file. The same practice i use for NULL. All music and  
   files are included in the main executable. 
    
   Back then, when you listen to a good song from a demo, there were some  
   utilities called "rippers" that could extract the included files. Some  
   of them were damn good and you could find all sort of files in emags  
   and demos, like .gif, .mod, .s3m, .pcx, .bmp etc. PC games also were  
   "targets" of file ripping. This way you could have an awesome  
   wallpaper for your Win3.11 machine from your favorite game. 
    
   But how those ripping utils work? First you have to identify that the  
   target file has a file you want to extract. Almost all file formats  
   have a unique id, which we can search for and identify them. This id  
   can be a series of bytes or a string with fixed values or in more  
   complex occasions can be bytes with calculated values in predefined  
   positions, even worst... the file format can not be identified. 
    
   So lets write a simple program to search for S3M files, which is a  
   format for track music. First we check the file format. You can find  
   the format specs here:  
            https://github.com/lclevy/unmo3/blob/master/spec/s3m.txt 
             
   As we see, this file format, has a fixed id in position 45d. So if we  
   search for this ID in the target file and find we know for sure  (or  
   99%) that a S3M file is included. 
    
   Below is a simple Pascal program to search for the ID of the S3M file  
   format. Instead of searching for the whole 4 byte ID, we search first  
   to match the first byte, if we find it, check if the second matches  
   etc. Its more simple this way, instead of reading 4 bytes at once,  
   check the values, go back to the original position, cause by reading 4  
   bytes we changed it by 4... etc. etc. etc. 
    
   If you compile the program and check the second issue of NULL you will  
   find a match ;) 
    
   + --- --  - CUT HERE -       ---    ---    ---        -     .    - -- --- ' 
    
   program filetype; 

    uses  
      crt, 
      sysutils; 

    var 
      b:byte; 
      f:file; 
       
    begin 
      assign(f,paramstr(1)); 
      reset(f,1); 
      while not eof(f) do begin 
        blockread(f,b,1); 
        if chr(b)='S' then begin 
          blockread(f,b,1); 
          if chr(b)='C' then begin 
            blockread(f,b,1); 
            if chr(b)='R' then begin 
              blockread(f,b,1); 
                if chr(b)='M' then begin 
                  writeln('S3M ID found in Position: '+inttostr(filepos(f)-3)) 
                end; 
            end; 
          end; 
        end; 
       
      end;   
      close(f); 
    end. 

   + --- --  -   .     -        ---    ---    ---        -     .    - -- --- ' 
         _____         _   _              ____          _   _  
        |  _  |___ ___| |_| |_ ___ ___   |    \ ___ ___|_|_| |        8888 
        |     |   | . |  _|   | -_|  _|  |  |  |  _| . | | . |     8 888888 8 
        |__|__|_|_|___|_| |_|_|___|_|    |____/|_| |___|_|___|     8888888888 
                                                                   8888888888 
                DoNt Be aNoTHeR DrOiD fOR tHe SySteM               88 8888 88 
                                                                   8888888888 
 /: HaM RaDiO   /: ANSi ARt!     /: MySTiC MoDS   /: DooRS         '88||||88' 
 /: NeWS        /: WeATheR       /: FiLEs         /: SPooKNet       ''8888"' 
 /: GaMeS       /: TeXtFiLeS     /: PrEPardNeSS   /: FsxNet            88 
 /: TuTors      /: bOOkS/PdFs    /: SuRVaViLiSM   /: ArakNet    8 8 88888888888 
                                                              888 8888][][][888 
   TeLNeT : andr01d.zapto.org:9999 [UTC 11:00 - 20:00]          8 888888##88888 
   SySoP  : xqtr                   eMAiL: xqtr@gmx.com          8 8888.####.888 
   DoNaTe : https://paypal.me/xqtr                              8 8888##88##888