Category Archives: Game Hacking

Flash Traffic Coding Puzzle

I am studying the data files for an old interactive movie named Flash Traffic: City of Angels. It is the purest I-movie I have encountered to date (and I’ve been exposed to more than the ordinary gamer due to my unhealthy interest in multimedia technology): It plays a movie and then presents the user with 3 clickable options. There aren’t even any extra side puzzles.


Flash Traffic: City of Angels -- screenshot

This game seems to consist of BFI multimedia files along with CVN files (ConVersatioN?). We know the BFI format. I am trying to sort out the CVN format. It seems straightforward at first with text strings paired with numbers that lead to BFI files with the same number. However, there is something unique about the text coding format. Observe:

   20 6C 61 62  20 64 6F 77  6E 74 6F 77  6E 20 61 74   lab downtown at
   20 6D 69 64  41 91 09 74  2C 20 74 68  65 79 20 67   midA..t, they g
   41 56 13 6E  74 6F 20 61  20 73 65 72  69 6F 75 73  AV.nto a serious

The start of the second line should have “midnight”. Somehow, the 4 letters n, i, g, and h get replaced with only 3 bytes 0x41, 0x91, and 0x09. Similarly, on the third line, the characters o, t, space, and i are substituted by 3 apparently unrelated bytes. One theory I have is that perhaps this forms an index into a dictionary in the header of the CVN file, except that I can’t find any of the characters in question at the start of the file either. And that would be a fairly useless compression algorithm. These substitutions often begin with ‘A’.

If you are interested in studying the format and solving the puzzle (and I know you are), here’s a sample file: 4001.CVN, which is where the snippet above comes from.

VP3 In The Wild

I can’t believe I actually found a usage of On2’s VP3 video codec in the wild– on a 2006 Windows game called Time To Ride: Saddles and Stables. The most amazing part about this is that software based on my FFmpeg VP3 decoder plays one of the files correctly while the official VP3 decoder installed with the game exhibits some serious bugs.

Official decoder, distributed with the game:


VP3 incorrect decoding

Same file, played with FFmpeg’s FFplay (it’s supposed to have a grainy film feel to it):


VP3 looks right

This makes me almost as proud as finding that an Apple QuickTime trailer for a particular 2000 movie that used to work in QT 4 was able to play with my xine QuickTime demuxer but not with QT 6. (To be fair, the same trailer works again under QT 7.)

Solid Snake Oggs

I was studying a file called vox.dat scavenged from the GameCube version of Metal Gear Solid: The Twin Snakes, the seminal, tactical, tip-toeing game starring Solid Snake. The file contains a lot of multi-lingual subtitle strings as well as the actual English speech recited along with the subtitle presentation. What format does this commercial game use? Would you believe Ogg Vorbis? The constituent audio streams are all tagged with the string “Xiph.Org libVorbis I 20020717”, which is quite old. The current version of the Xiph’s ogg123 playback tool does not decode a stream properly. Some of the data is audible, but a lot of audio chunks are skipped. FFmpeg fares a little bit better but still scrambles some audio.


Metal Gear Solid logo

Is this a case of poor backwards compatibility? Or perhaps the creators — Silicon Knights — deliberately monkeyed with the bitstream? I found that last situation a bit implausible as I assumed developers would treat this third party codec stuff as a black box. But as an experiment, let’s go back in time, courtesy of Xiph’s source control:

svn co -r {20020717} http://svn.xiph.org/trunk/ogg ogg-svn
svn co -r {20020717} http://svn.xiph.org/trunk/vorbis vorbis-svn
svn co -r {20020717} http://svn.xiph.org/trunk/vorbis-tools vorbis-tools-svn

I removed all of the related components on my system for good measure. With a little persistence and a lot of disabled options while building the tool set, I was finally able to get the components to build. Those old tools still have the same trouble with these Ogg Vorbis files:

$ oggdec mgs1-sample1.ogg
OggDec 1.0
Decoding "mgs1-sample1.ogg" to "mgs1-sample1.wav"
        [  1.5%]Warning: hole in data
        [  4.5%]Warning: hole in data
        [  6.5%]Warning: hole in data
[...]
        [127.5%]Warning: hole in data
        [130.5%]Warning: hole in data
        [132.5%]Warning: hole in data
        [134.5%]

Or maybe the tool is just extremely capable if it can decode more than 130% of the file.

I have placed three manually ripped samples in the archive; each is 512 KB. I would start ripping at offsets where I saw an ‘OggS’ marker that was followed soon after by the libVorbis ID string. If you care enough, have a look. And to what end? Isn’t it obvious? To create a “Learn English With Solid Snake And Friends” application.


Solid Snake and Liquid Snake

Learn handy, everyday phrases like, “I’m no rookie!” and “Don’t think! Shoot!” English speakers will be able to learn the same phrases in other languages, though they won’t have the benefit of pronunciation.

I’m still working out the details of the vox.dat file format. I have some things sorted out. Perhaps readers who know German, French, Italian, or Spanish, and who understand non-ASCII character encodings can answer whether these schemes fit any well-known encodings (I know that the 0x0A is a line break in the subtitle):

             53 70 72 69  63 68 20 6E  69 63 68 74      Sprich nicht
20 7A 75 20  6D 69 72 20  77 69 65 20  7A 75 0A 65   zu mir wie zu.e
69 6E 65 6D  20 41 6E 66  1F 0B 6E 67  65 72 21     inem Anf..nger!

             4C 61 20 66  65 72 6D 65  2C 20 6C 1F      La ferme, l.
09 2D 64 65  64 61 6E 73  20 21                     .-dedans !

             5A 69 74 74  6F 20 6C 1F  09 20 64 65      Zitto l.. de
6E 74 72 6F  21                                     ntro!

             1F 42 1F 42  41 20 71 75  1F 0F 20 65       .B.BA qu.. e
73 74 1F 08  73 20 65 73  70 65 72 61  6E 64 6F 21  st..s esperando!
21 0A 1F 42  1F 42 44 69  73 70 61 72  61 21 21     !..B.BDispara!!

Empirical analysis simply implies that a character 0x1F is followed immediately by a character not in the standard ASCII set.

MDEC Comeback

I just wanted to draw attention to a recent effort by one Michael Sabin who has been building a Java application called jPSXdec to play back videos ripped from the Sony PlayStation 1.


Sony PlayStation

To review, the original PlayStation had a bit of dedicated hardware called the motion decoder (MDEC) which decoded specially formatted blocks of what were essentially motion JPEG data. Assorted games also compressed the blocks using Huffman codes which were decoded by software. While the MDEC hardware was rigid in the data it would accept, PS programmers could deploy whatever Huffman tables they chose. I always thought it would be an interesting project (and a natural extension of my usual efforts) to catalog the various tables needed to play movies from different games, as well as different strategies that games have used to store the data on the disc.

Michael S. has been doing just that. There is a blog to document jPSXdec’s progress. Near and dear to my heart, however, is the fact that he is building a remarkable document (seen in the project’s download list) that explains precisely how to decode this data, from the perspective of a non-multimedia geek, no less.