Remedy Archive System

Latest revision as of 15:47, 22 November 2025

Remedy Archive System is used to store game data for Remedy Entertainment games such as Max Payne and Max Payne 2. The metadata (central directory) following the header is encrypted.

[edit] Identification

Files begin with signature bytes 52 41 53 00.

[edit] Format details

Numbers are in little-endian byte order.

[edit] Metadata

The file's header has the following structure:

struct RASHeader {
  uint8_t magic[4]; // "RAS\0"
  int32_t encryptionKey;
};

The next section of the header must be decrypted first:

// decrypted structure
struct RASMetadata {
  uint32_t fileCount;
  uint32_t dirCount;
  uint32_t fileListLength;
  uint32_t dirListLength;
  float32_t version; // binary32 according to IEEE 754
  uint32_t unknown5;
  uint32_t unknown6;
  uint32_t unknown7;
  uint32_t compatibility;
};

The following version and compatibility values are known:

What follows are fileListLength encrypted bytes of file metadata that can be decrypted using encryptionKey. (It is not necessary to remember the last value of key from decrypting RASMetadata.) Each entry has the following structure:

// decrypted structure
struct RASFileListEntry {
  char name[]; // NUL-terminated
  uint32_t uncompressedSize;
  uint32_t compressedSize;
  uint32_t unknown2;
  uint32_t dirIndex;
  uint32_t unknown4;
  uint32_t compressionMode; // 1 = some form of Lempel-Ziv, 3 = uncompressed
  RASTimestamp timestamp;
};

Next is a directory list of dirCount elements which must be decrypted similarly.

// decrypted structure
struct RASDirListEntry {
  char name[]; // NUL-terminated
  RASTimestamp timestamp;
};

Each directory is listed with its full name which starts and ends with a backslash (\). The top-most directory is named \. A file's dirIndex is a 0-based index into the directory list.

Timestamps are encoded using the same structure as SYSTEMTIME on Windows:

struct RASTimestamp {
  uint16_t year;
  uint16_t month;
  uint16_t dayOfWeek; // 0 = Sunday, 1 = Monday, ..., 6 = Saturday
  uint16_t day;
  uint16_t hour;
  uint16_t minute;
  uint16_t second;
  uint16_t millisecond;
};

[edit] Data

The file data follows directly after the file and directory lists. Each file is stored in turn with no padding; skipping to a specific file requires adding up the compressedSize members of all files preceding it.

[edit] Encryption

Depending on the generation of the RAS file format, different encryption schemes are used.

[edit] RAS1+2 (Max Payne 1+2)

void decrypt(uint8_t *buf, size_t count, int32_t key) {
  size_t i;

  if (key == 0) {
    key = 1;
  }
  for (i = 0; i < count; i++) {
    uint8_t a = buf[i];
    uint8_t b = ((uint8_t)(i % 5)) & 7;
    buf[i] = rotateLeftByte(a, b);
    key = key * 171 + (key / 177) * -30269;
    buf[i] = (uint8_t)((((((int8_t)i) + 3) * 6) ^ buf[i]) + ((int8_t)key));
  }
}

If your programming language doesn't support the rotateLeftByte operation, it can be emulated using:

uint8_t rotateLeftByte(uint8_t a, uint8_t b) {
  return (uint8_t)((a << b) | (a >> (8 - b)));
}

Note that the algorithm relies heavily on signed-integer wraparound and C's integer promotion rules; an operation like ((int8_t)i) + 3 will sign-extend the 8-bit value of i to 32 bits before adding 3.