[Archive] Analysis of the CASC filesystem
[Archive] Analysis of the CASC filesystem
11-04-2025, 10:37 AM
Original source
Quote: Hello folks,
When I was bored I spent the last few days analysing Blizzard's new CASC (Content Addressable Storage Container) filesystem used in the WoD Alpha. I've found out a lot already - so when I found several threads over here discussing the format, I thought I'd share my knowledge
I put my knowledge into a standalone file extractor without any DLL injection hooks and it is currently able to extract about 420k files (>99% of all) without any differences from when I extracted them using the hooking method. However, I will not share this code with you (sorry). What you'll get is all I know about the format, though - so it won't take any semi-experienced programmer more than a few hours to produce the same code.
All you need is attached to this post.
Please feel free to distribute and improve my analysis - however I'd be happy to be mentioned in the credits...
Greetings, Caali
// Edit
- v1.1 release (thanks to TOM_RUS for his feedback):- v1.2 release
- FileTable renamed to "encoding" file
- Manifest File renamed to "root" file
- Noted that BlizzHash is actually Bob Jenkins' hash
- Added information about the "download" and "install" files
- Analysis of the 'data/config/' folder
![[Image: wink.png]](https://www.ownedcore.com/forums/images/smilies/wink.png)
![[Image: tongue.gif]](https://www.ownedcore.com/forums/images/smilies/tongue.gif)
![[Image: paperclip.svg]](https://www.ownedcore.com/forums/images/styles/OwnedCoreFX/misc/paperclip.svg)
Attached Files![[Image: zip.gif]](https://www.ownedcore.com/forums/images/styles/OwnedCoreFX/attach/zip.gif)
CASC_Filesystem_v1-2.zip
(5.8 KB, 832 views)
CASC_Filesystem_v1-1.zip
(5.1 KB, 57 views)
CASC_Filesystem_v1-0.zip
(4.9 KB, 50 views)
rektbyfaith
11-04-2025, 10:37 AM #1Archived author: caali • Posted: 2025-11-04T11:37:48.262434
Original source
Quote: Hello folks,
When I was bored I spent the last few days analysing Blizzard's new CASC (Content Addressable Storage Container) filesystem used in the WoD Alpha. I've found out a lot already - so when I found several threads over here discussing the format, I thought I'd share my knowledge
I put my knowledge into a standalone file extractor without any DLL injection hooks and it is currently able to extract about 420k files (>99% of all) without any differences from when I extracted them using the hooking method. However, I will not share this code with you (sorry
Please feel free to distribute and improve my analysis - however I'd be happy to be mentioned in the credits...
Greetings, Caali
// Edit
- v1.1 release (thanks to TOM_RUS for his feedback):- v1.2 release
- FileTable renamed to "encoding" file
- Manifest File renamed to "root" file
- Noted that BlizzHash is actually Bob Jenkins' hash
- Added information about the "download" and "install" files
- Analysis of the 'data/config/' folder
Attached Files
CASC_Filesystem_v1-2.zip
(5.8 KB, 832 views)
CASC_Filesystem_v1-1.zip
(5.1 KB, 57 views)
CASC_Filesystem_v1-0.zip
(4.9 KB, 50 views)
11-04-2025, 10:37 AM
Original source
Quote: how do I even use it lol ?
rektbyfaith
11-04-2025, 10:37 AM #2Archived author: zifron • Posted: 2025-11-04T11:37:48.262434
Original source
Quote: how do I even use it lol ?
11-04-2025, 10:37 AM
Original source
Quote: "FileTable" file is actually called "encoding" file
"Manifest" file is actually called "root" file
There's also 2 more special files in data.XXX: "download" file and "install" file
"BlizzHash" is actually Bob Jenkins's hash (http://burtleburtle.net/bob/c/lookup3.c: hashlittle2: return 2 32-bit hash values)
rektbyfaith
11-04-2025, 10:37 AM #3Archived author: TOM_RUS • Posted: 2025-11-04T11:37:48.262434
Original source
Quote: "FileTable" file is actually called "encoding" file
"Manifest" file is actually called "root" file
There's also 2 more special files in data.XXX: "download" file and "install" file
"BlizzHash" is actually Bob Jenkins's hash (http://burtleburtle.net/bob/c/lookup3.c: hashlittle2: return 2 32-bit hash values)
11-04-2025, 10:37 AM
Original source
Quote: v1.1 has been released.
Originally Posted by zifron
how do I even use it lol ?
Unless you know how to interpret it and code a program to read the files - you don't and it's not intended for you, sorry
Originally Posted by TOM_RUS
"FileTable" file is actually called "encoding" file
"Manifest" file is actually called "root" file
There's also 2 more special files in data.XXX: "download" file and "install" file
"BlizzHash" is actually Bob Jenkins's hash (http://burtleburtle.net/bob/c/lookup3.c: hashlittle2: return 2 32-bit hash values)
Thanks! I suppose you found out the special file names through reverse engineering? All I re'd was the hashing function, so I just gave meaningful names to those files
![[Image: lastpost-right.svg]](https://www.ownedcore.com/forums/images/styles/OwnedCoreFX/buttons/lastpost-right.svg)
rektbyfaith
11-04-2025, 10:37 AM #4Archived author: caali • Posted: 2025-11-04T11:37:48.262434
Original source
Quote: v1.1 has been released.
Originally Posted by zifron
how do I even use it lol ?
Unless you know how to interpret it and code a program to read the files - you don't and it's not intended for you, sorry
Originally Posted by TOM_RUS
"FileTable" file is actually called "encoding" file
"Manifest" file is actually called "root" file
There's also 2 more special files in data.XXX: "download" file and "install" file
"BlizzHash" is actually Bob Jenkins's hash (http://burtleburtle.net/bob/c/lookup3.c: hashlittle2: return 2 32-bit hash values)
Thanks! I suppose you found out the special file names through reverse engineering? All I re'd was the hashing function, so I just gave meaningful names to those files
11-04-2025, 10:37 AM
Original source
Quote: Originally Posted by caali
Thanks! I suppose you found out the special file names through reverse engineering? All I re'd was the hashing function, so I just gave meaningful names to those files
Those files are referenced in "Build Configuration". It can be found in Data\config\80\6f\806f4fd265de05a9b328310fcc42eed0 or online.
rektbyfaith
11-04-2025, 10:37 AM #5Archived author: TOM_RUS • Posted: 2025-11-04T11:37:48.262434
Original source
Quote: Originally Posted by caali
Thanks! I suppose you found out the special file names through reverse engineering? All I re'd was the hashing function, so I just gave meaningful names to those files
Those files are referenced in "Build Configuration". It can be found in Data\config\80\6f\806f4fd265de05a9b328310fcc42eed0 or online.
11-04-2025, 10:37 AM
Original source
Quote: Ah I see, that makes sense. I guess that's also how to properly locate those files within the data.XXX files, instead of simply assuming they're at the beginning of data.000 like I did. I updated the specification with information about the 'data/config/' folder.
rektbyfaith
11-04-2025, 10:37 AM #6Archived author: caali • Posted: 2025-11-04T11:37:48.262434
Original source
Quote: Ah I see, that makes sense. I guess that's also how to properly locate those files within the data.XXX files, instead of simply assuming they're at the beginning of data.000 like I did. I updated the specification with information about the 'data/config/' folder.
11-04-2025, 10:37 AM
Original source
Quote: is there a way to get the full listfile
rektbyfaith
11-04-2025, 10:37 AM #7Archived author: raeef • Posted: 2025-11-04T11:37:48.262434
Original source
Quote: is there a way to get the full listfile
11-04-2025, 10:37 AM
Original source
Quote: Originally Posted by raeef
is there a way to get the full listfile
Bruteforce or hack blizzard.
rektbyfaith
11-04-2025, 10:37 AM #8Archived author: TOM_RUS • Posted: 2025-11-04T11:37:48.262434
Original source
Quote: Originally Posted by raeef
is there a way to get the full listfile
Bruteforce or hack blizzard.
11-04-2025, 10:37 AM
Original source
Quote: Im trying to get the ogredraenorarmorer.m2 and thx for the big list you releast before are you going to update it
rektbyfaith
11-04-2025, 10:37 AM #9Archived author: raeef • Posted: 2025-11-04T11:37:48.262434
Original source
Quote: Im trying to get the ogredraenorarmorer.m2 and thx for the big list you releast before are you going to update it
11-04-2025, 10:37 AM
Original source
Quote: Originally Posted by caali
Ah I see, that makes sense. I guess that's also how to properly locate those files within the data.XXX files, instead of simply assuming they're at the beginning of data.000 like I did. I updated the specification with information about the 'data/config/' folder.
The data.XXX files are dynamically generated from the real data files ('the archives') based on your locale and the demands of the client (since streaming is still an option). AFAIK, the index files are used to tell your installation which files that your specific set of data.XXX files contains.
Everything you need to know - all of the raw data files (before they become data.XXX), and the location of download, install, etc is obvious once you have the config files. They list the md5s of the files, which is all you need to know because Blizzard FTPs only use MD5s and not real filenames under NGDP.
Originally Posted by raeef
Im trying to get the ogredraenorarmorer.m2 and thx for the big list you releast before are you going to update it
That file doesn't exist.
I've identified every single M2 file contained within the game now, and there are none with that name.
rektbyfaith
11-04-2025, 10:37 AM #10Archived author: CatsNimo • Posted: 2025-11-04T11:37:48.262434
Original source
Quote: Originally Posted by caali
Ah I see, that makes sense. I guess that's also how to properly locate those files within the data.XXX files, instead of simply assuming they're at the beginning of data.000 like I did. I updated the specification with information about the 'data/config/' folder.
The data.XXX files are dynamically generated from the real data files ('the archives') based on your locale and the demands of the client (since streaming is still an option). AFAIK, the index files are used to tell your installation which files that your specific set of data.XXX files contains.
Everything you need to know - all of the raw data files (before they become data.XXX), and the location of download, install, etc is obvious once you have the config files. They list the md5s of the files, which is all you need to know because Blizzard FTPs only use MD5s and not real filenames under NGDP.
Originally Posted by raeef
Im trying to get the ogredraenorarmorer.m2 and thx for the big list you releast before are you going to update it
That file doesn't exist.
I've identified every single M2 file contained within the game now, and there are none with that name.
Recently Browsing
1 Guest(s)
1 Guest(s)
Recently Browsing
1 Guest(s)
1 Guest(s)