Remedy Archive System

Revision as of 13:24, 22 November 2025

Remedy Archive System is used to store game data for Remedy Entertainment games such as Max Payne and Max Payne 2. The metadata (central directory) following the header is encrypted.

Identification

Files begin with signature bytes 52 41 53 00.

Format details

Numbers are in little-endian byte order.

The file's header has the following structure:

struct RASHeader {
  uint8_t magic[4]; // "RAS\0"
  uint32_t encryptionKey;
};

The next section of the header must be decrypted first:

// decrypted structure
struct RASMetadata {
  uint32_t fileCount;
  uint32_t dirCount;
  uint32_t fileListLength;
  uint32_t dirListLength;
  float32_t version; // binary32 according to IEEE 754
  uint32_t unknown5;
  uint32_t unknown6;
  uint32_t unknown7;
  uint32_t compatibility;
};

The following version and compatibility values are known:

What follows are fileListLength encrypted bytes of file metadata that can be decrypted using encryptionKey. (It is not necessary to remember the last value of key from decrypting RASMetadata.) Each entry has the following structure:

// decrypted structure
struct RASFileListEntry {
  char name[]; // NUL-terminated
  uint32_t uncompressedSize;
  uint32_t compressedSize;
  uint32_t unknown2;
  uint32_t dirIndex;
  uint32_t unknown4;
  uint32_t compressionMode; // 1 = ???, 3 = uncompressed
  RASTimestamp timestamp;
};

Next is a directory list of dirCount elements which must be decrypted similarly.

// decrypted structure
struct RASDirListEntry {
  char name[]; // NUL-terminated
  RASTimestamp timestamp;
};

Each directory is listed with its full name which starts and ends with a backslash (\). The top-most directory is named \.

Timestamps are encoded using the same structure as SYSTEMTIME on Windows:

struct RASTimestamp {
  uint16_t year;
  uint16_t month;
  uint16_t dayOfWeek; // 0 = Sunday, 1 = Monday, ..., 6 = Saturday
  uint16_t day;
  uint16_t hour;
  uint16_t minute;
  uint16_t second;
  uint16_t millisecond;
};

Encryption

Depending on the generation of the RAS file format, different encryption schemes are used.

RAS1 (Max Payne)

void decrypt(uint8_t *buf, size_t count, int32_t key) {
  size_t i;

  if (key == 0) {
    key = 1;
  }
  for (i = 0; i < count; i++) {
    uint8_t a = buf[i];
    uint8_t b = ((uint8_t)(i % 5)) & 7;
    buf[i] = rotateLeftByte(a, b);
    key = key * 171 + (key / 177) * -30269;
    buf[i] = (uint8_t)((((((int8_t)i) + 3) * 6) ^ buf[i]) + ((int8_t)key));
  }
}

If your programming language doesn't support the rotateLeftByte operation, it can be emulated using:

uint8_t rotateLeftByte(uint8_t a, uint8_t b) {
  return (uint8_t)((a << b) | (a >> (8 - b)));
}