Offsets, names and the shape of a track
2026-10-23, second session, with GameFrame's Claude Code plugin loaded.
Where the offsets point
Every container starts with a table of entry offsets. The question left from the first session was whether they count bytes of the decoded stream or bytes of the raw file, which also holds a 4-byte checksum at the end of each block. Inside the first block both readings agree, so most files cannot tell them apart: 89 of the 98 have a single entry.
The game's seek routine, FUN_00468dc4, reads the block at offset - offset % BLOCK and starts inside it at offset % BLOCK. That only makes sense for raw positions. The track files settle it. They have ten entries reaching deep into the file, and mapped as raw positions every one lands on the start of a name. Read as stream positions they land in the middle of other data. No offset in any file falls inside a checksum word.
The same check explained an odd value. The last entry in every track decodes to 0x0F7E, the track key. A raw zero is the only word that decodes to the key, so unused entries are simply zeros in the file.
Names have their own cipher
The section names inside a track did not decode with the container key. The game reads them with FUN_00468958: a length byte, that many bytes, and then each byte XORed with a key that starts at 0xFF and drops by one per byte. The first name in a track entry is MEDIUM.
The track loader compares many names with NEANT, French for "nothing". A section called NEANT is absent, and the loader clears that part of the game state instead.
Every track looks the same from outside
All 36 track files have ten entries and version 3. Entry 0 is the track itself, which the loader reads as a long chain of sections. Entries 1 to 8 start with difficulty names in the same order in every file: MEDIUM HARD, an odd record, MEDIUM HARD EASY, MEDIUM HARD. They are probably the race settings per difficulty and mode. Entry 9 is unused.
The tracks page lists the loader's reads in order. All 144 names decode and encode back byte-identical.
A change of course
The first milestone is now an asset viewer: show every picture, texture, sound and string the game has, before decoding the parts only the simulation reads. That puts the texture block first. The track, car, font and chrome loaders all call the same routine, FUN_0046aca0, so one decoder there opens the textures of all of them. The menu images (.IMG), the sound banks (.MEG) and the text tables (.BMD) come next.