Difference between revisions of "ZiPatch File Structure"

Revision as of 20:01, 6 June 2019

History

ZiPatch (.patch) files are a compressed file format for FINAL FANTASY XIV. This file format was later modified in 2012 for DRAGON QUEST X and FINAL FANTASY XIV: A Realm Reborn, which are more similar in their DAT structure to each other than to FINAL FANTASY XIV. As such, many of the block types that are found in this version have been deprecated. However, static analysis of the A Realm Reborn executables indicate that they may still be able to read this version.

Initial, minimal research of the ZiPatch file format was made publically available [1] in 2013 by Jean-Philip Desjardins for his open-source server emulator for FINAL FANTASY XIV, SeventhUmbral [2]. This implementation allowed the ZiPatch files that were backed up by Krizz [3] and others in the community to be applied to a new installation and incorrectly update the client to 1.23b.

File Header

ZiPatch files have a unique file header (12 bytes), which is used to identify the file format. The ZiPatch File Header is immediately followed by n blocks, each of which provide ffxivupdater.exe with information to carry out specific instructions.

91 5A 49 50 41 54 43 48 0D 0A 1A 0A            ‘ZIPATCH....

Block Structure

struct block_t
{
    int size;          // LE
    char data[];       // size + 4
    unsigned long crc; // CRC32 (RFC 1952) of data
}

The slice of data[0..3] is a string used to identify the block type. Static analysis of ffxivupdater.exe indicates the following block types as valid.

"FHDR"
"APLY"
"APFS"
"ETRY"
"ADIR"
"DELD"

FHDR

FHDR blocks are an abstract of the changes that should occur as a result of applying the ZiPatch in terms of the type and count of the changes to be made.

struct fhdr_t
{
    char version[4];  // [00 00 02 00] observed; Static analysis of ffxivupdater.exe indicates FileHeaderV2
    char result[4];   // "DIFF" or "HIST" observed
    int numEntryFile; // LE
    int numAddDir;    // LE
    int numDeleteDir; // LE
};

APLY

APLY blocks have not been reversed. Two APLY blocks appear to immediately follow the FHDR block.

struct aply_t
{
    int unknown1; // [00 00 00 01]; [00 00 00 02] observed
    int unknown2; // [00 00 00 04] observed
    int unknown3; // [00 00 00 01] observed
};

APFS

APFS blocks have not been observed directly in ZiPatch files. It is assumed that this may deal with the filesystem in some way.

struct apfs_t
{
};

It is unknown whether the following referenced text strings are involved with APFS blocks or APLY blocks.

"Total incremental file size: %lld"
"Total incremental disk size: %lld"
"Total incremental max disk size: %lld"

ETRY

ETRY blocks provide the information for ffxivupdater.exe to make changes directly to the filesystem by performing explicit operations on the specified file path, relative to the installation directory. The operation is dependent on the chunk_t mode.

struct etry_t
{
    int pathSize;     // LE
    char path[];      // pathSize
    int count;        // LE
    chunk_t chunks[]; // count
};

struct chunk_t
{
    int mode;            // [41 00 00 00] 'A' (add); [44 00 00 00] 'D' (delete); [4D 00 00 00] 'M' (modify) observed
    char prevHash[20];   // SHA-1
    char nextHash[20];   // SHA-1
    int compressionMode; // [4E 00 00 00] 'N' (none); [5A 00 00 00] 'Z' (zlib) observed
    int size;            // LE
    int prevSize;        // LE
    int nextSize;        // LE
    char data[];         // size
};

The chunk_t mode indicates whether the specific entry file chunk_t will be added, deleted, or modified. In order to validate the operation, SHA-1 hashes are used to verify file deltas. The chunk_t compressionMode indicates whether the specific entry file chunk_t is compressed with the zlib algorithm.

ADIR

ADIR blocks provide the information for ffxivupdater.exe to make changes directly to the filesystem by creating a new directory for the specified path, relative to the installation directory, if it does not already exist.

struct adir_t
{
    int pathSize; // LE
    char path[];  // pathSize
};

DELD

DELD blocks provide the information for ffxivupdater.exe to make changes directly to the filesystem by deleting the specified directory, relative to the installation directory, if it exists.

struct deld_t
{
    int pathSize; // LE
    char path[];  // pathSize
};