First 4 bytes of a WRS telling you which WRS format it is.
A8 uses WRS4 (0x57 0x52 0x53 0x34), followed by 32 bytes for the name.
Now, thats the header of the file. How do we decrypt it?
After every 32 bytes, the name of the file follows.
Now we simply XOR all the data content by the value 0xAA for WRS4.
This works for every gamestudio WRS packer since A4.
The only thing changed was the XOR byte.
Pro: XOR is fast
Con: Why not change the XOR bytes with the current reading offset? Thats so easy to reverse..
Would take some more time to figure out...
Seriously, just pack a .exe in WRS and look at the first 2 bytes (always MZ, called PE Signature)
Now you can simply figure out which byte was used to xor (simple math)
Last edited by Ch40zzC0d3r; 01/17/15 16:38.