CSTR compressed streams

A PAK entry whose attribute value is 2 is a CSTR stream: a 16-byte header followed by blocks, each a raw deflate stream of at most 65,531 decoded bytes, or the same bytes stored as they are. The stream is compressed_size bytes long in the PAK and decodes to the entry’s size. Proven · all 31,227 streams of the 336 PAKs

Big-endian throughout.

CSTR header16 bytesSHRED100% known

Followed by the blocks to the end of the stream.

ProvenObservedSourcedInferredUnknownNot described

0

1

2

3

4

5

6

7

8

9

A

B

C

D

E

F

0x0

magicchar[4] = CSTR

byte_order_marku16 = 0xFEED

versionu16 = 1

block_countu16

thresholdu16 = 0xF32F

uncompressed_sizeu32

Offset	Size	Type	Field	Confidence	Notes
0x0	4	char[4] = CSTR	magic	Proven
0x4	2	u16 = 0xFEED	byte_order_mark	Proven
0x6	2	u16 = 1	version	Proven
0x8	2	u16	block_count	Proven	exactly the number of blocks in every stream
0xA	2	u16 = 0xF32F	threshold	Proven	62,255; the compression-selection threshold the loader compares with
0xC	4	u32	uncompressed_size	Proven

CSTR block4 + stored_sizeSHRED100% known

Blocks follow one another with no padding.

ProvenObservedSourcedInferredUnknownNot described

0

1

2

3

4

5

6

7

8

9

A

B

C

D

E

F

0x0

stored_sizeu16

decoded_sizeu16

0x4

payloadu8[]

Offset	Size	Type	Field	Confidence	Notes
0x0	2	u16	stored_size	Proven	bytes of payload
0x2	2	u16	decoded_size	Proven	bytes the block decodes to; at most 65,531
0x4	stored_size	u8[]	payload	Proven	raw deflate (no zlib header) when stored_size differs from decoded_size, otherwise the bytes themselves

Across the disc there are 111,391 blocks: 107,170 are deflate and 4,221 are stored (equal sizes). The decoded sizes of a stream’s blocks sum to its header size, and the stored sizes plus headers fill its range in the PAK. Proven · all 31,227 streams The threshold is 0xF32F and the largest decoded block is 65,531 bytes (0xFFFB). Proven · all 31,227 streams

How the loader chooses

The executable reads the block header, then inflates the block when the stored size is at most the threshold and the decoded size is above 0xFFFB − threshold (3,276 bytes); otherwise it copies the stored bytes. Observed · static reading of the executable That rule and “inflate when the two sizes differ” give the same answer on every one of the 111,391 blocks of the disc and on the 260 blocks of the script archive. Proven · all blocks Its working buffers are 0xFFFB bytes each, which would explain why no block decodes to more. Inferred How the writer picks stored or deflate is not shown by the data, and the threshold’s meaning on the writing side is not established. Unknown

The script archive (SCRIPTS.SDAT decrypted) holds 252 streams in 260 blocks, all compressed, with the same threshold. Observed

Why are some blocks stored?

4,221 blocks are stored. Small blocks and data that deflate cannot shrink are both possible reasons; the split between them was not measured.