intuicion
Thanks for the files provided.
FW_ALL.BIN is a file saved in the RGN-tool from the GCD.
RGN14.BIN is a file obtained using rrgn command.
Unfortunately, I didn't have to work with IDA.
But the HEX editor helped me make a few observations:
1. The size of the FW_ALL.BIN is always 556 bytes larger than the size of the RGN14.BIN !
Therefore, it can be argued that FW_ALL.BIN is not compressed RGN14.BIN, but encrypted!
2. The first double word (four bytes) of the FW_ALL.BIN file is always equal to the size of this file minus 4 and corresponds to the size of the remaining encrypted part of this file.Code:Please Login or Register to see the links
[Only registered and activated users can see links. ]
It remains to find out what the "extra" 552 (= 556-4) bytes are for.
Perhaps these are some kind of key or encryption table.
Or some other service information that is not written directly to the region.
Both of these observations also apply to the pair of BOOT.BIN (encrypted) and RGN12.BIN (unencrypted) files.
PS:
As for the title of this topic.
The problem is not with the new GCD format. The format is old.
The problem is that the executable binaries are encrypted now.



Likes: 


Reply With Quote

Bookmarks