ESO Research Notes

====================== FILE STRUCTURE ANALYSIS ======================
------ DAT: Decompiled ------
0x4 - ID string ('2SEP'/'PES2')
0x2 - always 1 (little endian)
0x4 - always 0
0x4 - always 0E (14 in decimal). Seems to be the absolute offset of the data start


------ MNF: Decompiled ------
0x4 - ID string ('2SEM'/'MES2')
0x2 - always 2 (little endian)
0x1 - number of DAT files
0x4 - always 0
0x4 - EOF_offset: offset after block 3

------ ZOSFT ----------------
0x5 - ID string ('ZOSFT')
0x4 - always 06 00 10 00
0x6 - unknown
0x4 - number of records, little endian
for(i=0; i<3; i++) {
	0x4 - always 03 00 04 00
	0x6 - unknown
	0x4 - number of records
	0x4 - number of records
	0x4 - block size
	0x4 - block zsize
		[block]
	0x4 - block size
	0x4 - block zsize
		[block]
	0x4 - block size
	0x4 - block zsize
		[block]
}
0x4 - bytes until end of filetable
	[filenames: 0-terminated strings]
0x5 - ZOSFT

====================== ZLIB BLOCKS ANALYSIS ======================
------ MNF ------------------
BLOCK 1
for(i=0; i<filecount; i++) {
    (0x4 - dummy)* - 00 00 00 00, 0 or more times
    0x4 (little endian) - FILE_ID = 2147483648 of 00 00 00 80 + i
    (0x4 - dummy)* - 00 00 00 00, 0 or more times
}

BLOCK 2
for(i=0; i<filecount; i++) {
    0x4 (little endian) - file_number
    0x2 (little endian) - 00 00 or 01 00 in game, but can be anything in ESO
    0x1 (little endian) - 00 80 or 00 00 in game, but can be 00 60, 00 40 or 00 20 in ESO as well!
}

BLOCK 3
for(i=0; i<filecount; i++) {
    0x4 - file_size
    0x4 - file_zsize
    0x4 - filename_hash (http://rdf3x.googlecode.com/svn/trunk/infra/util/Hash.cpp - http://rdf3x.googlecode.com/svn/trunk/include/infra/util/Hash.hpp - init by 0xA8396u)
    0x4 - file_offset
    0x1 - file_comtype (0 - Not Compressed, 1 - Zlib, 2 - Snappy)
    0x1 - archive_number
    0x2 - unknown
}

------ ZOSFT ----------------
- blocks 1_1, 2_1 or 3_1 is list of FILE IDs
- 1772 filenames in game.zosft, EC600000!

BLOCK 1_1
for(i=0; i<record_count; i++) {
    0x4 (little endian) - FILE_ID = 2147483648 or 00 00 00 80 + i
    (0x4 - dummy)* - 00 00 00 00, 0 or more times
}

BLOCK 1_2
for(i=0; i<record_count; i++) {
    0x8 (little endian) - complex_number
}

BLOCK 1_3 (simple count to record_count in game, but not in eso)
for(i=1; i<=record_count; i++) {
    0x4 (little endian) - file_number (unique)
}

BLOCK 2_1
for(i=0; i<record_count; i++) {
    0x4 (little endian) - FILE_ID = 2147483648 or 00 00 00 80 + i
    (0x4 - dummy)* - 00 00 00 00, 0 or more times
}

BLOCK 2_2
same as block 1_3

BLOCK 2_3 = the most important! -------------- link to MNF block 2
for(i=0; i<record_count; i++) {
    0x4 (little endian) - file_number (same as in block 1_3 and 2_2)
    0x4 - filename_offset (relative, after number indicating bytes until end of filetable)
    0x8 - complex_number (same as in block 1_2)
}

BLOCK 3: important for eso.mnf?
BLOCK 3_1: Empty in game.mnf
BLOCK 3_2: Not in game.mnf
BLOCK 3_3: Not in game.mnf