{"action":"created","issue":{"url":"https://api.github.com/repos/morkt/GARbro/issues/26","repository_url":"https://api.github.com/repos/morkt/GARbro","labels_url":"https://api.github.com/repos/morkt/GARbro/issues/26/labels{/name}","comments_url":"https://api.github.com/repos/morkt/GARbro/issues/26/comments","events_url":"https://api.github.com/repos/morkt/GARbro/issues/26/events","html_url":"https://github.com/morkt/GARbro/issues/26","id":156626814,"number":26,"title":"Some info regarding Kourin no Machi, Lavender no Shoujo","user":{"login":"fro0116","id":18626656,"avatar_url":"https://avatars.githubusercontent.com/u/18626656?v=3","gravatar_id":"","url":"https://api.github.com/users/fro0116","html_url":"https://github.com/fro0116","followers_url":"https://api.github.com/users/fro0116/followers","following_url":"https://api.github.com/users/fro0116/following{/other_user}","gists_url":"https://api.github.com/users/fro0116/gists{/gist_id}","starred_url":"https://api.github.com/users/fro0116/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fro0116/subscriptions","organizations_url":"https://api.github.com/users/fro0116/orgs","repos_url":"https://api.github.com/users/fro0116/repos","events_url":"https://api.github.com/users/fro0116/events{/privacy}","received_events_url":"https://api.github.com/users/fro0116/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-05-24T22:48:05Z","updated_at":"2016-05-25T04:38:13Z","closed_at":"2016-05-25T04:38:13Z","body":"Hi! I was pointed to this repo by @rr- after [requesting support](https://github.com/vn-tools/arc_unpacker/issues/45) for this game in arc_unpacker. @rr- suggested I should share the following findings with you in order to help speed up the process:\r\n\r\n> \r\n1. The entry point to the whole thing seems to be located at lavender.tpm+0xE70. Specifically, it can be reached by analyzing references to zlib's uncompress function, and comparing it to kirikiri source code by tracking down usages of TVPXP3ArchiveExtractionFilter upwards.\r\n2. I also noticed the game executes code from dynamically allocated regions, which probably means that it uses dynamic assembly like CXDEC did. Also, it too uses \"encryption control block\" as well as two constants in form of (x & A) + B, all looking familiar to CXDEC, but don't let it fool you - later it does everything differently, and I think it starts with compiling repeatedly mini-functions that serve as LCGs at a later time.\r\n3. To prove without doubt that it's not CXDEC, there's not even one mention of 0x41C64E6D, which served an essential role in the CXDEC as a part of its RNG.\r\n\r\nIt's all way beyond my own technical comprehension, but I hope that helped! Thank you for your work!"},"comment":{"url":"https://api.github.com/repos/morkt/GARbro/issues/comments/221471249","html_url":"https://github.com/morkt/GARbro/issues/26#issuecomment-221471249","issue_url":"https://api.github.com/repos/morkt/GARbro/issues/26","id":221471249,"user":{"login":"fro0116","id":18626656,"avatar_url":"https://avatars.githubusercontent.com/u/18626656?v=3","gravatar_id":"","url":"https://api.github.com/users/fro0116","html_url":"https://github.com/fro0116","followers_url":"https://api.github.com/users/fro0116/followers","following_url":"https://api.github.com/users/fro0116/following{/other_user}","gists_url":"https://api.github.com/users/fro0116/gists{/gist_id}","starred_url":"https://api.github.com/users/fro0116/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fro0116/subscriptions","organizations_url":"https://api.github.com/users/fro0116/orgs","repos_url":"https://api.github.com/users/fro0116/repos","events_url":"https://api.github.com/users/fro0116/events{/privacy}","received_events_url":"https://api.github.com/users/fro0116/received_events","type":"User","site_admin":false},"created_at":"2016-05-25T04:38:13Z","updated_at":"2016-05-25T04:38:13Z","body":"Thank you so much @morkt!\r\n\r\nGave it a try just now and it worked perfectly! =)"}}
{"actor":{"display_login":"fro0116"}}