User:HertzDevil/Reverse-engineering notes/Basic data types

Almost all .bin.lz files under  are LZ11-compressed archives that can be decompressed using FEAT. This compression format is apparently also used in the 3DS Fire Emblem games.

C++ is used here to notate the data types that appear in these files, because this is the most convenient.

Primitive data types

 * uint8_t, uint16_t, uint32_t, uint64_t: Fixed-width unsigned integer types, as defined in &lt;cstdint&gt;.
 * int8_t, int16_t, int32_t, int64_t: Fixed-width two's complement signed integer types, as defined in &lt;cstdint&gt;. Signed integers are used only for fields that are known to use negative values.
 * bool: 1-byte boolean where all non-zero values represent true. Booleans are used only for 1-byte fields that do not use any values other than 0 or 1.
 * char: UTF-8 byte.
 * time_t: 64-bit signed integer representing POSIX time (seconds since ), as defined in &lt;ctime&gt;.

XOR ciphers
Most data fields are encrypted by bitwise XOR operations. The same member from the same type always uses the same XOR value for all objects of that type. For primitive types these values are shown next to the members, e.g.: This means the value of  should be XOR'ed with , because all values are little-endian. Struct subobjects apply their own XOR ciphers recursively; arrays of primitive types apply the given XOR cipher to each array element, regardless of the array size. Strings apply XOR ciphers slightly differently; they are described below at.

file_ptr_t
Generic absolute file offset pointer. The actual pointed-to file offset is the value of the pointer +, since the archives have a 32-byte header. As a special case,  points to nowhere, and is used to indicate absence of pointed-to data (much like the real  ). The template parameter  is only used to show the pointed-to data type.

File offsets inside the data section of each archive are replaced with absolute pointers to raw memory when the archives are loaded into memory. File pointers on the relocatable pointer list (, shown below) are never null; if their value is , they point to the pointer at.

file_tag_t
Generic absolute file offset pointer that additionally associates the pointed-to data with a tag string.


 * ptr: Same as, but with 32 bits instead of 64.
 * tag: Pointer to unencrypted UTF-8 string inside  that is associated with the data. Usually represents filenames.

hsdarc_buffer
The contents of an HSDArc archive.


 * archive_size: Size of the HSDArc archive in bytes.
 * ptr_list_offset: Absolute file offset pointer into the relocatable pointer list. Like, the actual pointed-to file offset is.
 * ptr_list_length: Number of entries of the relocatable pointer list.
 * tag_list_length: Number of tag strings present in tag_list.
 * magic: 0 on HSDArc archive files,   once the archive is loaded into memory.
 * data: The actual data.
 * ptr_list: The relocatable pointer list. Each entry on this table points to another file offset pointer, which may point to anything depending on interpretation. While loading the archive into memory, pointers referred to by this table are converted into absolute memory pointers, by adding the address of  to their values; pointers on this list itself remain unaltered. (Note that this allows archive files to be restored from raw memory.)
 * tag_list: A list of objects with tag strings associated to them.
 * tags: Null-terminated tag strings. It is possible that some of the tag strings are not associated with any object.

crypt_string
Null-terminated UTF-8 string of unspecified length. The  type parameter is used to show the XOR cipher used by the string. Because these strings are variable-length in nature, the cipher is repeated end-to-end for longer strings, and data bytes that match the respective cipher bytes are not XOR'ed in order to preserve the string length of the encrypted buffer. So far the following ciphers have been identified:

An example of decrypting internal string identifiers in Ruby:

obj_list
Generic object list. A variety of files consist of a single list, pointed from the first relocatable pointer (always to ).


 * list: Pointer to the array of objects of type . Usually   (points to  ).
 * size: Number of objects on the list.

reward_info
Reward item. determines how to read the parameters for this reward. This struct is variable-length in nature (see ) and never created directly. None of the data members are further XOR-encrypted.


 * kind: Discriminator for the reward item type.  to   were probably used for the different Shard / Crystal types at one point.
 * count: Number of item units given out by the reward. Rewards that do not display item counts do not have this member.
 * id_tag: UTF-8 internal string identifier of the reward. Starts with  for Hero and Forging Bonds conversation rewards,   for Sacred Seals,   for Accessories, and   for background music from the Concert Hall. For Aether Stones they match the currency names defined in.
 * len: Byte count of id_tag. (Strings are not null-terminated.)
 * rarity: Rarity of the Hero rewarded.
 * is_crystal: True if this reward gives Crystals, false if this reward gives Shards.
 * great: True if this reward gives Great Badges, false if this reward gives Badges.
 * color: The color for Shard / Crystal / Badge / Great Badge rewards.
 * aa_kind: The kind of Arena Assault item this reward gives.
 * {|class="wikitable default sortable mw-collapsed mw-collapsible"

! Value !! Kind
 * 0x00 ||
 * 0x01 ||
 * 0x02 ||
 * 0x03 ||
 * 0x04 ||
 * 0x05 ||
 * 0x06 ||
 * 0x07 ||
 * 0x08 ||
 * 0x09 ||
 * }
 * element: The season during which the rewarded Blessing is active.
 * support_rank: Support rank of the Forging Bonds conversation.
 * {|class="wikitable default sortable mw-collapsed mw-collapsible"
 * 0x07 ||
 * 0x08 ||
 * 0x09 ||
 * }
 * element: The season during which the rewarded Blessing is active.
 * support_rank: Support rank of the Forging Bonds conversation.
 * {|class="wikitable default sortable mw-collapsed mw-collapsible"
 * element: The season during which the rewarded Blessing is active.
 * support_rank: Support rank of the Forging Bonds conversation.
 * {|class="wikitable default sortable mw-collapsed mw-collapsible"

! Value !! Rank
 * 0 || C
 * 1 || B
 * 2 || A
 * 3 || S
 * }
 * throne_type: Rank of the Throne item.
 * {|class="wikitable default sortable mw-collapsed mw-collapsible"
 * 3 || S
 * }
 * throne_type: Rank of the Throne item.
 * {|class="wikitable default sortable mw-collapsed mw-collapsible"

! Value !! Kind
 * 0x00 ||
 * 0x01 ||
 * 0x02 ||
 * }
 * move_type: Move type for Dragonflowers.
 * 0x02 ||
 * }
 * move_type: Move type for Dragonflowers.

reward_definition
Reward data used in various files, including all scenario definitions and event information of various game modes.


 * reward_count: Number of  structs present.
 * buf: The actual reward data, comprising instances of  laid out contiguously (with no padding in between).
 * checksum: HMAC-SHA256 checksum of the bytes from reward_count to buf, with secret key.
 * _unknown1: Random garbage data.

reward_payload
The actual payload used in files that define reward data. Two payloads that give the same rewards always consist of identical bytes.


 * data: The  data encrypted by AES-128-CTR with key   and IV given by iv. The length of the entire payload is usually specified next to the pointer to that payload; the actual   consists of everything up to checksum.
 * magic: Magic number of the payload that must be exactly equal to the given value.
 * iv: 128-bit initialization vector for the AES encryption.