Just a quick hint- FFXV_s.exe base is dynamic, therefore patch:
Code: [Select]
(replacing 0x60, 2nd bit from 1 to 0)
this will disable ASLR and base image on 0x140000000
any further notes I'll write here will consider 0x140000000 as the base instead of 0x00007FF*
If you're using IDA make sure to rebase the database last time by Edit>Segment>Rebase, for CE or Olly it doesn't matter, anyway I'll try to post relative addresses like ffxv_s.exe+0xFFFF like in CE style
Okay, about XML20 (exml):
Xmb2document:
Code: [Select]
Code:
00000000 identifier dd ?00000004 fileSize dd ?00000008 flags dw ?0000000A version dw ?0000000C rootElementOffset dd ? <-- relative to root
Getting elements (useful for offset shit):
Code: [Select]
Code:
SQEX::Luminous::Xml::Xmb2Element::GetElementByName(Xmb2Element el, char* name);
example:
000000016459061C SQEX::Luminous::Xml::Xmb2Element <elementStartOffset_: 0B44h, attributeStartOffset_: 0F58h, elementCount: 1, attribCount: 1h>
int64 i = 0;
var v7 = &xmb->elementStartOffset + 4* i + xmb->elementStartOffset + *((xmb->elementStartOffset)+&xmb->elementStartOffset)
Let's simplify it: we just jump to relative pointer of i * 4 of pointer address of XMB document + element start offset, like this:
Code: [Select]
Code:
uint64 pointer = XMBdocument + elementStartOffset + i*4;uint64 v7 = pointer + *(pointer);
Now the unknown pointer:
char* v8 = v7 + (*(v7 + 4)+4);
if v8 is not null, then treat as array of objects:
v10 = v9 + *(v9+5) + 5
UPDATE2:
The abstraction level of everything here is so high... struct with struct with struct, that's not assembler-level friendly.
UPDATE3:
initialize1.exml:
Code: [Select]
Code:
0: reference1: entities_.common_textures_list2: entities_.initialize1_list3: entities_.system_no_autoload4: entities_5: hasTransform_6: bool7: position_8: float49: rotation_10: scaling_11: float12: canManipulate_13: sourcePath_14: common/initialize1.ebex15: string16: name_17: dff7c814-9313-45a9-b8fd-5fc7ca670db718: isTemplateTraySourceReference_19: isShared_20: startupLoad_21: object22: initialize123: SQEX.Ebony.Framework.Entity.EntityPackage24:25: filePath_26: textures/ebony_required_textures.txt27: isAutoLoad_28: common_textures_list29: Black.Entity.Data.EarcResourceList30: common/initialize1_list.txt31: initialize1_list32: common/system_no_autoload.txt33: system_no_autoload34: objects35: package
UPDATE4:
Looks like it's raw data that is treated via struct. Currently it looks like the pointers and attribute+element count is stored in the middle of the file.
ai/commonai/commontpslibrary.exml ->
debug::63140000 = XMB2
debug::6314016C = XMBDocument
Looks like EXML contains many XMBDocuments
