Config.meg file format from Grey Goo

Banshee

Hey guys. I've recently bought Grey Goo, the latest RTS game from Petroglyph. I've played a quick campaign tutorial and dropped the game to go straight to the point: how to mod them.

When I tried to open these .meg files with OS BIG Editor and FinalBIG, I've noticed that these programs were years behind the progress of the ALAMO engine. With this documentation, I've managed to make OS BIG Editor open most of the .meg files, but... I've noticed that they've heavily protected their big boss: config.meg with something completely different than anything else in terms of .meg files.

The format is something like this:

Header:
+0000h id1 uint32 ; Unknown field, 0xFFFFFF8F
+0004h id2 uint32 ; Unknown field, always 0x3F7D70A4
+0008h dataStart uint32 ; Offset in file of start of data
+000Ch numFilenames uint32 ; Number of filenames in the Filename Table
+0010h numFiles uint32 ; Number of files in the File Table
+0014h filenamesSize uint32 ; Size, in bytes, of the Filename Table

The real changes start at the File Table record. We do not have a int16 with the length and filenames. I believe that the filenames are there, but they are either encoded, encrypted or something like that. I couldn't figure it out yet.

File Table record:
+0000h one uint16 ; Always 1
other 32 unknown bytes. Perhaps the first four are CRC, but everything else looks completely different.

Each file table record is exactly 34 bytes long.

That's all what I know so far. As anyone taken a look at it? With an encoded config.meg, all attempts to mod the game are useless.

ApolloTD · Commander **Joined**: 19 Nov 2003

Petroglyph already added this encryption after Universe At War so its been around for awhile now.

Anyhow that 4th byte 8F seems to tell the game to treat it as encrypted, seemingly the only reason they extended the header mainly.

Bad part is that, the whole file contents are also enciphered (or XML are binary...), not just filenames and file tables.

Filesize wise can tell it is a encryption only (no compression seemingly), be it xor or whatever method.

I doubt they have any intent of allowing modding.

Mike_nl · Civilian **Joined**: 14 Jun 2015

Hey Guys

Mike.nl from http://modtools.petrolution.net/ here.

I recently bought Grey Goo and looked into the mod support. I, like you, noticed the Confg.meg is encrypted.

Through some targeted reverse engineering of the game I was able to discover the decryption key.

The game uses 128-bit AES in CBC mode to decrypt blocks of 16 bytes. The 128-bit AES key is:

0x63223401b27efb502ec657b134a92561 (the MD5 of "{CAF1CCE6-CC1D-40CE-AF2D-792BC446FD87}{83733AEE-CB3D-426E-BE9C-8CCB92E35B75}")

AES needs an initial vector (IV), which for Grey Goo is

0x954fd996438b8fd035a5c7ffb6f6066b (the MD5 of "Goo")

Encrypted MEG files differ from regular ones as follows:
- The id1 field in the header has 0x8FFFFFFF.
- The blob with all the filenames is encrypted as a whole.
- Each individual file table entry is encrypted. Note: the first 16 bits are not encrypted. This is the flag field that indicates if it's encrypted (1) or not (0). If encrypted, the file table entry (normally 18 bytes) is padded and encrypted so it becomes 32 bytes (a multiple of AES's 16 byte block size). So take care here.
- The entire rest of the MEG file (the file data blob) is encrypted as a whole.

I intend to update my tool (http://modtools.petrolution.net/tools/MegEditor) at some point, but this might take a few days before I have the time, so this way everyone has the information.

Banshee · Posted: Mon Jun 15, 2015 2:57 am Post subject:

Thanks a lot, buddy. I'll eventually implement it in OS BIG Editor as soon as I can, although it might take a while because right now my priority is to finish my doctorade thesis proposal document.

Mike_nl · Civilian **Joined**: 14 Jun 2015

So I've managed to update my MegEditor on Petrolution to support Grey Goo, including encrypted Mega Files!

I don't know how moddable the game is, but at the very least everyone can have a look in Config.meg now.

Banshee · Posted: Wed Jul 29, 2015 11:04 pm Post subject:

It is definitely quite moddable, thanks to your tool.

In Config.meg, people should start looking at the DATA/XML directory. There are directory for Structures, Units, AI... all of them with many XML files that humans may understand.

There are also CLP files related to AI that are also understandable.

Mike_nl · Civilian **Joined**: 14 Jun 2015

Quote:

It is definitely quite moddable, thanks to your tool.

Not necessarily. It's readable now, but not necessarily editable. Unlike EaW/FoC, Grey Goo might ignore physical files. It might do a checksum on the Config.meg before starting to ensure it hasn't been "tampered" with.

So while this opens up some areas of exploration, I'm not confident at all to say that Grey Goo can now be modded.

Banshee · Posted: Thu Jul 30, 2015 8:24 am Post subject:

But can't you place the XML files in different .meg files and cite them in MEGAFILES.XML (in Data directory)?

I thought it could be used to "replace" a XML file, since, at least in other games, it uses the file from the last .meg file. At least, this is in your own MEG File Format document:

Quote:

It is common or just possible for Petroglyph's games to have multiple Mega Files, and even Mega Files for user mods. All used Mega Files are listed in MegaFiles.xml in a game directory. Petroglyph's games read this file and, load all Mega Files and merge their File Table to create one Master File Table. If a file occurs in multiple Mega Files, the file in the Mega File listed last in MegaFiles.xml will be used.

MegaFiles.xml exists in GreyGoo and it is used for DLCs.

Mike_nl · Civilian **Joined**: 14 Jun 2015

Maybe it works, maybe it won't.

I'm just not making any promises. I'm as curious as you are to see if it works Smile

Banshee · Posted: Fri Dec 23, 2016 6:21 am Post subject:

Guess what? OS BIG Editor finally supports it as well and it also supports 8-Bit Armies/Hordes/Invaders too, since Mike_nl has shared the AES key/IV in his site. Thanks, buddy Smile

.