PDA

View Full Version : CoD4 Remastered Config



DjTranceFire
5th November 2016, 11:41
Hey guys.
I'm just wondering if there is any way to read the config from the new cod4 remastered.
http://pastebin.com/yQrdDStW
Its basically the same config as in every other cod, but its not plain text.
For example:


seta 0xBC3E3CAE "5"

seems to be:


seta sensitivity "5"

kung foo man
5th November 2016, 13:52
Well, probably hashed with some function, but you would need to reverse engineer it a bit, because it's probably using a seed/salt aswell.


E.g. hash function like this:

https://github.com/SheetJS/js-crc32/blob/master/crc32.js


function crc32_str(str, seed) {
var C = seed ^ -1;
for(var i = 0, L=str.length, c, d; i < L;) {
c = str.charCodeAt(i++);
if(c < 0x80) {
C = (C>>>8) ^ T[(C ^ c)&0xFF];
} else if(c < 0x800) {
C = (C>>>8) ^ T[(C ^ (192|((c>>6)&31)))&0xFF];
C = (C>>>8) ^ T[(C ^ (128|(c&63)))&0xFF];
} else if(c >= 0xD800 && c < 0xE000) {
c = (c&1023)+64; d = str.charCodeAt(i++)&1023;
C = (C>>>8) ^ T[(C ^ (240|((c>>8)&7)))&0xFF];
C = (C>>>8) ^ T[(C ^ (128|((c>>2)&63)))&0xFF];
C = (C>>>8) ^ T[(C ^ (128|((d>>6)&15)|((c&3)<<4)))&0xFF];
C = (C>>>8) ^ T[(C ^ (128|(d&63)))&0xFF];
} else {
C = (C>>>8) ^ T[(C ^ (224|((c>>12)&15)))&0xFF];
C = (C>>>8) ^ T[(C ^ (128|((c>>6)&63)))&0xFF];
C = (C>>>8) ^ T[(C ^ (128|(c&63)))&0xFF];
}
}
return C ^ -1;
}

DjTranceFire
5th November 2016, 18:22
Reverse engineering? So no easy way for me. :D

voron00
5th November 2016, 18:55
Why, exactly, you even need this? There is nothing interesting so far most of those are available in settings and the rest probably will be forced to default on game start.

IzNoGoD
5th November 2016, 20:27
To be fair, infinite warfare is a good game until the part where you can select your next mission. Then it becomes just too damn slow paced.

mwr is just reskinned cod4, nothing more, nothing less. Dont expect any mods for it ever though.

Seems mwr files are packaged identically to cod:aw files, same magic number even. Might be worth a shot trying to extract those and getting some high-res textures for cod4.

DjTranceFire
5th November 2016, 21:00
Why, exactly, you even need this? There is nothing interesting so far most of those are available in settings and the rest probably will be forced to default on game start.
Yes, probably it will be forced, but atleast it could be tested. ;)
I've spend many hours on my config for cod4, there is nothing wrong about changing a config :P


To be fair, infinite warfare is a good game until the part where you can select your next mission. Then it becomes just too damn slow paced.

mwr is just reskinned cod4, nothing more, nothing less. Dont expect any mods for it ever though.

Seems mwr files are packaged identically to cod:aw files, same magic number even. Might be worth a shot trying to extract those and getting some high-res textures for cod4.

I didnt played infinite warfare, i dont like the future stuff. :/
MWR is realy bad if you compare it to the original cod4, but atleast its a little bit more active.
You are right, no mods and that wont change. Thats why MWR will die quickyl.

IzNoGoD
5th November 2016, 21:31
You should give infinite a try, it's fun up to the "select what mission you want to do next" part at least (2 hours in)

Probably made the first few hours more fun so any quickreview would be positive.

kung foo man
6th November 2016, 03:24
You can try this neat tool: http://reveng.sourceforge.net/readme.htm



SEARCHING FOR CRC MODELS

The most important feature of CRC RevEng is the ability to recover the parameters of a CRC algorithm from a handful of codewords created by that algorithm. In general at least four data points are needed, either as known parameters or as message-CRC pairs. Extra data points help to eliminate false results and to confirm models that are found.

So we have one pair, "sensitivity" == "BC3E3CAE", but at least 4 are needed. Wanna search? ^^

Also made a little crc brute force for FireBug testing:





function test(from, to, str, compareTo) {
for (var i=from; i<to; i++)
{
// >>>0 basically transforms int to unsigned int
var ret = (crc32_str(str, i)>>>0).toString(16);
if (ret == compareTo) {
console.log("FOUND i", i)
return i;
}
}
console.log("FAILED> done searching for: from", from, "to", to);
}

console.log("just select the code and press ctrl+enter to execute it in FireBug")
console.log("or change 0 to 1 and execute everything with ctrl+enter (nothing selected)")
if (0) test(0, 1000000, "sensitivity", "BC3E3CAE".toLowerCase())
if (0) test(0, 1000000, "sensitivity", "AE3C3EBC".toLowerCase()) // flipped endianess
if (1) test(0, 1000000, "sensitivity", "Fc90af37".toLowerCase()) // crc of "sensitivity", to see if it actually works



function signed_crc_table() {
var c = 0, table = new Array(256);

for(var n =0; n != 256; ++n){
c = n;
c = ((c&1) ? (-306674912 ^ (c >>> 1)) : (c >>> 1));
c = ((c&1) ? (-306674912 ^ (c >>> 1)) : (c >>> 1));
c = ((c&1) ? (-306674912 ^ (c >>> 1)) : (c >>> 1));
c = ((c&1) ? (-306674912 ^ (c >>> 1)) : (c >>> 1));
c = ((c&1) ? (-306674912 ^ (c >>> 1)) : (c >>> 1));
c = ((c&1) ? (-306674912 ^ (c >>> 1)) : (c >>> 1));
c = ((c&1) ? (-306674912 ^ (c >>> 1)) : (c >>> 1));
c = ((c&1) ? (-306674912 ^ (c >>> 1)) : (c >>> 1));
table[n] = c;
}

return typeof Int32Array !== 'undefined' ? new Int32Array(table) : table;
}

var T = signed_crc_table();

function crc32_str(str, seed) {
var C = seed ^ -1;
for(var i = 0, L=str.length, c, d; i < L;) {
c = str.charCodeAt(i++);
if(c < 0x80) {
C = (C>>>8) ^ T[(C ^ c)&0xFF];
} else if(c < 0x800) {
C = (C>>>8) ^ T[(C ^ (192|((c>>6)&31)))&0xFF];
C = (C>>>8) ^ T[(C ^ (128|(c&63)))&0xFF];
} else if(c >= 0xD800 && c < 0xE000) {
c = (c&1023)+64; d = str.charCodeAt(i++)&1023;
C = (C>>>8) ^ T[(C ^ (240|((c>>8)&7)))&0xFF];
C = (C>>>8) ^ T[(C ^ (128|((c>>2)&63)))&0xFF];
C = (C>>>8) ^ T[(C ^ (128|((d>>6)&15)|((c&3)<<4)))&0xFF];
C = (C>>>8) ^ T[(C ^ (128|(d&63)))&0xFF];
} else {
C = (C>>>8) ^ T[(C ^ (224|((c>>12)&15)))&0xFF];
C = (C>>>8) ^ T[(C ^ (128|((c>>6)&63)))&0xFF];
C = (C>>>8) ^ T[(C ^ (128|(c&63)))&0xFF];
}
}
return C ^ -1;
}







All 32bit crc algorithms from reveng (reveng.exe -D):



reveng.exe -c 73656e7369746976697479 -m CRC-32/POSIX
reveng.exe -c 73656e7369746976697479 -m CRC-32/MPEG-2
reveng.exe -c 73656e7369746976697479 -m CRC-32/BZIP2
reveng.exe -c 73656e7369746976697479 -m JAMCRC
reveng.exe -c 73656e7369746976697479 -m CRC-32
reveng.exe -c 73656e7369746976697479 -m CRC-32C
reveng.exe -c 73656e7369746976697479 -m CRC-32Q
reveng.exe -c 73656e7369746976697479 -m CRC-32D
reveng.exe -c 73656e7369746976697479 -m CRC-32/AUTOSAR


Just dumped all, sorted the output in Notepad++ and multiline-edited it for reveng. Can then be dumped into cmd.exe. But all 32 bit hashes are different.

DjTranceFire
6th November 2016, 10:43
So we have one pair, "sensitivity" == "BC3E3CAE", but at least 4 are needed. Wanna search? ^^




"BC3E3CAE" == "sensitivity"
"8572B2C7" == "cg_fov"
"DB27C739" == "r_displayRefresh"
"D6B0695E" == "sv_hostname"
"4D4FADFD" == "con_gameMsgWindow0Filter"
"CCDAD8FC" == "con_gameMsgWindow1Filter"
"EDF26B1F" == "con_gameMsgWindow2Filter"
"118929AD" == "r_mode"


Not part of the config but maybe that helps too:


"F264C46C" == "com_maxfps"
"79A1090F" == "cg_fovscale"
"07AC182B" == "cg_gun_x"

kung foo man
6th November 2016, 13:47
Tried it now, took quite some time to calculate, but it "found no models":



G:\>reveng -w 32 -Fs BC3E3CAE 8572B2C7 DB27C739 D6B0695E
reveng: searching: width=32 poly=0x10000001 refin=false refout=false
reveng: searching: width=32 poly=0x20000001 refin=false refout=false
reveng: searching: width=32 poly=0x30000001 refin=false refout=false
reveng: searching: width=32 poly=0x40000001 refin=false refout=false
reveng: searching: width=32 poly=0x50000001 refin=false refout=false
reveng: searching: width=32 poly=0x60000001 refin=false refout=false
reveng: searching: width=32 poly=0x70000001 refin=false refout=false
reveng: searching: width=32 poly=0x80000001 refin=false refout=false
reveng: searching: width=32 poly=0x90000001 refin=false refout=false
reveng: searching: width=32 poly=0xa0000001 refin=false refout=false
reveng: searching: width=32 poly=0xb0000001 refin=false refout=false
reveng: searching: width=32 poly=0xc0000001 refin=false refout=false
reveng: searching: width=32 poly=0xd0000001 refin=false refout=false
reveng: searching: width=32 poly=0xe0000001 refin=false refout=false
reveng: searching: width=32 poly=0xf0000001 refin=false refout=false
reveng: searching: width=32 poly=0x10000001 refin=true refout=true
reveng: searching: width=32 poly=0x20000001 refin=true refout=true
reveng: searching: width=32 poly=0x30000001 refin=true refout=true
reveng: searching: width=32 poly=0x40000001 refin=true refout=true
reveng: searching: width=32 poly=0x50000001 refin=true refout=true
reveng: searching: width=32 poly=0x60000001 refin=true refout=true
reveng: searching: width=32 poly=0x70000001 refin=true refout=true
reveng: searching: width=32 poly=0x80000001 refin=true refout=true
reveng: searching: width=32 poly=0x90000001 refin=true refout=true
reveng: searching: width=32 poly=0xa0000001 refin=true refout=true
reveng: searching: width=32 poly=0xb0000001 refin=true refout=true
reveng: searching: width=32 poly=0xc0000001 refin=true refout=true
reveng: searching: width=32 poly=0xd0000001 refin=true refout=true
reveng: searching: width=32 poly=0xe0000001 refin=true refout=true
reveng: searching: width=32 poly=0xf0000001 refin=true refout=true
reveng: no models found


Are you able to figure out every string2hash? Kinda via dvarlist and then change every cvar one by one, /dumpconfig test.cfg or /writeconfig test.cfg and figure out the change in the .cfg, repeat. Would be some work, but then you could make a simple JavaScript/HTML page with 2 buttons:

First Button "Hash to Normal": just iterate over the string2hash array and replace everything
Second Button "Normal to Hash": just iterate over the string2hash array and replace everything in reverse

Figuring out the actual algorithm isn't even needed, if you spend the time to make the string2hash list. The .html site to do the replace work would be done in 5 minutes.

DjTranceFire
6th November 2016, 21:35
There is no way to figure out the actual dvars/cvars.
The stuff that i found is basic stuff. Everything else is almost impossible.
Atleast only while opening the config. It seems like there are other ways to find them because someone created a tool to change the fps/fovscale.
Seems like he found a way to find the values he needs.