DSAR

dsar_codec.py | toc2.py (decompression.py | gdeflate.py) | Overstrike: DSAR.cs | rivet's format doc

Summary

Compression format used in game's archives. Variation of the format seems to be used in other games, such as Ghost of Tsushima (see script for QuickBMS tool).

Sample of DSAR asset, viewed in 010 Editor with binary template.

$\color{#0000FF}{◆}$ Header — lists the compressed blocks.

// little-endian

struct Header {
	uint32 magic; // 0x52415344 aka DSAR
	uint16 versionHigh; // 3
	uint16 versionLow; // 1
	uint32 blocksCount;
	uint32 offsetToData;
	uint64 uncompressedSize;
	byte padding[8];

	Block blocks[blocksCount]; // 32 bytes per block
}; 

struct Block {
	uint64 uncompressedOffset;
	uint64 compressedOffset;
	uint32 uncompressedSize;
	uint32 compressedSize;
	byte compressionType;
	byte padding[7];
};

If magic is not DSAR, archives files are considered uncompressed.

Versions are (3, 1) for MSMR, MM and RCRA.

For each asset, toc determines offset and size of its data in uncompressed stream. Using blocks array from header, find all blocks that correspond to that part of uncompressed stream, decompress them and concatenate corresponding parts as asset's data.

◆ Blocks data — rest of the file after header.

See blocks array from header to determine where each block's data starts and ends.

Blocks could be compressed in different way. Typically, all blocks within archive are compressed the same way. In MSMR and MM, it is always type=3, LZ4. In RCRA, it could also be type=2, GDeflate (for textures).

Compression types

Only described for MSMR, MM and RCRA. Could differ in other games.

LZ4

compressionType == 3

Typical LZ4.

ALERT uses lz4 Python module in dsar_codec.py and has custom implementation in decompression.py.

Overstrike uses K4os.Compression.LZ4 .NET package.

GDeflate

compressionType == 2

NVIDIA's compression based on DEFLATE. Used with Microsoft's DirectStorage API.

Both ALERT and Overstrike use a .dll built from NVIDIA's libdeflate fork. DirectStorage-like use of it is implemented in gdeflate.py and GDeflate.