The AIN file format (System 4)

System 4 AIN files contain a game’s code and script.

Encryption

AIN files are encrypted by XORing each byte of the input with the output of a mersenne twister PRNG seeded with the key 0x5D3E3.

Sections

AIN files are broken into a number of sections, each beginning with a 4 byte ASCII magic word. The structure of each section varies. Not all sections are present in all versions of the AIN format.

VERS Section

KEYC Section

CODE Section

The CODE section contains the actual code of the game, compiled from the System 4 language down to bytecode.

Instructions in System 4 bytecode consist of a 16-bit opcode followed by a variable number of 32-bit arguments (depending on the opcode).

FUNC Section

Function Descriptors

Variable Descriptors

If the ‘Has value?’ field is 1, then:

• If the variable is a string, ‘Variable value’ is a null-terminated string value
• If the variable is a reference type or a delegate, ‘Variable value’ is not present
• Otherwise, ‘Variable value’ is a 32-bit value

If ‘Has value?’ is 0, then ‘Variable value’ is not present.

Type Descriptors

A type descriptor is a 3-tuple of a data type, struct type and array rank, sometimes followed by an additional type descriptor for the sub-type.

Starting with ain v11, the meaning of the ‘array rank’ value changes. Rather than giving the rank of an array, it becomes a boolean which indicates the presense of a sub-type. If this value is 1, then another type descriptor should be read recursively.

Return Type Descriptors

Before AIN v11, return type descripors inside of function and functype descriptors do not have an ‘array rank’ field like regular type descriptors.

Starting in AIN v11, return type descriptors are identical to regular type descriptors found elsewhere.

GLOB Section

Global Variable Descriptors

GSET Section

Global Initval Descriptors

If data type is AIN_STRING (12) then ‘Value’ is a null-terminated string. Otherwise it’s a 32-bit value.

STRT Section

Structure Descriptors

Interface Descriptors

MSG0 Section

MSG1 Section

Encrypted Strings

The encrypted data can be decrypted as follows,

for (int i = 0; i < len; i++) {
    data[i] -= (uint8_t)i;
    data[i] -= 0x60;
}

MAIN Section

MSGF Section

HLL0 Section

Library Descriptors

Library Function Descriptors

Argument Descriptors

SWI0 Section

Switch Descriptors

Case Descriptors

GVER Section

STR0 Section

FNAM Section

OJMP Section

FNCT Section

Functype Descriptors

DELG Section

OBJG Section

ENUM Section