According to https://moddingwiki.shikadi.net/wiki/Paganitzu, Paganitzu has three data files that are “PCX Library” files.  That same site has good information about the format of these PCX Library files (https://moddingwiki.shikadi.net/wiki/PCX_Library).

Use this link to see all the posts in this “Reverse Engineering Paganitzu” series.

PCX Library – Header

There should be a 122 byte header that has 10 bytes of “id”, 50 bytes of “copyright”, a UINT16LE (16-bit unsigned integer… 2 bytes) “version”, 40 bytes of “label”, and 20 bytes of “xtra”.  The “id” should the 6 characters “pcxLib” followed by a 0 byte (a single byte that has the value 0) followed by 3 bytes of unused data (they could be anything).

Let’s head to our old friend, the hex editor and see what’s in one of these PCX Library files.  We’ll take a look at PAGA1.004 since it’s the first PCX Library file of the three (PAGA1.004, PAGA1.006, and PAGA1.009).

I’ve colored the parts of the header to make it easier to see them.  Sure enough, there’s the “pcxLib” followed by a 00 followed by 3 unused bytes in the first 10 bytes (red), then a copyright message in the next 50 bytes (blue).  Then 2 bytes of the “version” (green).  The two bytes are 5E and 01.  IBM Compatible PC’s used a CPU made by Intel which was “Little Endian”.  This means that when a number spans more than one byte, the smaller part comes first followed by the larger part.  In this case, the version is actually 1 followed by 5E.  5E in hex is 94 in decimal.  I’m guessing the “version” of this PCX Library file is 1.94.  Then we get 40 bytes of “label” (yellow).  Looks like “gibberish” to me, so I’m guessing the “label” wasn’t used and it just has 40 random bytes.  Then the 20 bytes of “xtra”, just filler that’s not used. The original DOS software that used this format probably included an extra 20 bytes so they could expand the header to include more data without have to change the size of the header.

PCX Library – The Files Contained Within

Following the header should be data for however ever many files are packed into this PCX Library file.  The format was originally designed to hold PCX files, which was an image file back in the DOS era similar to JPG and PNG today.  However, any file types could be stored in a PCX Library file.  What kind of files does Paganitzu have in its PCX Library files?  PCX files are well documented all over the Internet, so I was hoping that’s what would be inside.  Each “file” after the PCX Library “header” consists of an 84 byte header.

A UINT8 is a 1-byte unsigned integer. For the “synch” byte, it has to be 1.  Anything other than and it means either you’ve miscalculated how many bytes you’ve read into the PCX Library file and you’re not really looking at the first byte of a file header contained within it, OR the PCX Library file has been corrupted.  The “synch” byte is a “sanity check” so you can make sure you’re still on track.

The next 13 bytes are the filename followed by 00.  In the old DOS days, filenames were limited to 8 characters, a dot, and 3 characters (“8.3” format).  8 + 1 (for the dot) + 3 + 1 (for the 00) comes out to 13.  The INT32LE (32-bit signed integer… 4 bytes) following is the size of the file (number of bytes of data in the file).  The date and timestamp on the file are stored in the next 4 bytes, followed by 2 bytes of “Packing type” (not really sure what that is, hopefully not important).  Then 40 bytes of “Image note” and 20 bytes of “xtra” filler, probably to reserve space for future additions to the file header.

The “size” field tells how many bytes should immediately follow the file’s 84-byte header.  Immediately following THOSE bytes will either be the end of the PCX Library file (no more bytes), or the start of another file (first byte should be a 1).

The next thing to do is return to the trusty hex editor and see if we see something following the 122-byte header that looks like a file header.  We can already see from the hex editor screenshot above that the next byte after the 122-byte header is indeed a 01 (our “synch” byte), so this is a good sign!

Conclusion

It’s late, I’m tired, and I’m going to stop here.  We’ll pick up in my next post and dig deeper into the files contained in the PCX Library file and see what they turn out to be.