From wowdev
Jump to: navigation, search


The header contains the signature-version. The current version is:


The versions are checked when loading. RELEASE is the so called "scope string". In release versions of WoW, there are no alternatives to all values.


Entries are seperated by \r\n (new line). The different values are divided by semicolons (;).

'base' or a locale id ('enGB', 'deDE' etc.)
'c' or 'e'
signature ('0002EED5F13B614C781AE654EAD524E2')
filename ('World\Generic\Human\Passive Doodads\RUGS\GeneralBearSkinRug01.m2')

base-files are used on all versions, if a locale id is given, it is only active if the right client is used.


At the end of the file, there is a SIGN-"chunk". Its not exactely a chunk since it does not have a chunk-size field but only the reverse-order name. Its a 256bit signature.

For information on how to decrypt it, have a look at:

SIG_initCheck+24B  8B 45 FC                       mov     eax, [ebp+filecontent]   ; .text:004028FB -
SIG_initCheck+24E  50                             push    eax
SIG_initCheck+24F  E8 AC 3D 2E 00                 call    sub_6E66B0
SIG_initCheck+254  5F                             pop     edi
SIG_initCheck+255  5E                             pop     esi
SIG_initCheck+256  5B                             pop     ebx
SIG_initCheck+257  8B E5                          mov     esp, ebp
SIG_initCheck+259  5D                             pop     ebp
SIG_initCheck+25A  C3                             retn