Scribd
Upload
170 views2 pages

Ndfbin Reversing

The document describes various data types used to store property values in a binary file format, including basic types like integers, floats, and strings, as well as more complex types like objects, arrays, maps, and blobs. The first 4 bytes of each property indicate its data type, such as 00 00 00 00 for a boolean, 01 00 00 00 for an int8, and 09 00 00 00 followed by an instance ID for an object reference.

Uploaded by

aaronsmith812732
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
170 views2 pages

Ndfbin Reversing

The document describes various data types used to store property values in a binary file format, including basic types like integers, floats, and strings, as well as more complex types like objects, arrays, maps, and blobs. The first 4 bytes of each property indicate its data type, such as 00 00 00 00 for a boolean, 01 00 00 00 for an int8, and 09 00 00 00 followed by an instance ID for an object reference.

Uploaded by

aaronsmith812732
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 2

typical very basic instance:

ABABABAB
4 bytes - class index
{
for each property:
4 bytes property index
4 bytes type index
4 bytes value
}
00 00 00 00 is bool (1 byte)
01 00 00 00 maybe its an Int8
02 00 00 00 is int
<- pretty sure thats singed int
03 00 00 00 is uint
<- cant confirm 8 bytes long for that i
suspect uint32
04 00 00 00 is a c++ time64_t
05 00 00 00 is single float (4 bytes)
06 00 00 00 is double float (8bytes)
07 00 00 00 is string with a 4 bytes STRG table reference
08 00 00 00 is WideString, 4 bytes uint describe the length, which has to be rea
d encoded UTF-16 (Unicode)
09 00 00 00 BB BB BB BB is a object reference, following 4 bytes are the instanc
e id classId is next 4 bytes
09 00 00 00 AA AA AA AA are TRANS table references 4 bytes uint as index followi
ng
0B 00 00 00 is 12 byte vector: 4byte x, 4byte y, 4byte z (single float all)
0C 00 00 00 is a 16 bytes Color A R G B
0D 00 00 00 is Color 4 bytes A R G B one byte each
0E 00 00 00 is a Tripple int32 12 bytes 4 bytes for each int
11 00 00 00 is an array, following 4 bytes are the length of the array (offset E
095 for a good example (string list)
12 00 00 00 seems to be a map list first 4bytes arraySize; element: 8byte string
type/value; usual object reference 16 byte
14 00 00 00 is a data blobb
18 00 00 00 (seems to be 2 bytes) {TLoadableQuadTextureAnimatedBlade} : {Alignem
entY} (signed short?)
19 00 00 00 2 bytes 88 / 550 "InitStage" might ne short int (int16) probably uns
igned
1A 00 00 00 is a GUID for descriptors
1c 00 00 00 is string for filenames 4 bytes STRG table reference
1D 00 00 00 is 8 byte, its a localisation hash -> points to an entry of the *.di
c (TRAD) files
1E 00 00 00 seems to be a ZIP block / content block
1F 00 00 00 It might be a int32 pair
{TEugBMutableInt2}: Value
{TConstantInt2}: Value
{TInt2OptionFlashDescriptor}: {DegradationMapping}

21 00 00 00 is 8 byte, look like some kind of double float too me but we alreay
have that.
22 00 00 00 Marks an entry of a list as "map" entry: string-value pair
25 00 00 00 is 16 bytes {APrioriHashToSusbtitutedSourceHash} i suspect md5 hash
here.
14 00 00 00 is a data blobb:
struct blobHead {
DWORD blobMagic; // 14 00 00 00
DWORD sumLength;
//blob block[sumLength];
}
struct subBlock {
DWORD subLengthCompressed
DWORD subLengthUncompressed
blob subBlock[subLengthCompressed];
}

11 00 00 00
DWORD length
object list {
09 00 00 00 BB BB BB BB marks an entry
DWORD object index
DWORD classid
}

You might also like