MPQ Archives

Name breaking

What is name breaking ?

Jump directly to listfile table

In general, MPQ archives don't contain names of archived files. The files are stored by their name's hash value. The algorithm of calculating hash value is one-way only, so it's impossible to get back the original archived file name from the hash value. Some files can be found by monitoring calls of SFileOpenFileEx from the Storm.dll library and logging of file names. But most games contain files never used by the game itself. Names of these files cannot be found everywhere (except of hacking developer's server in Blizzard :-). So how to obtain the complete listfile, which is the one way how to extract all files from an MPQ archive ?

Name breaking is a way, using a brute-force attack method for searching names of files store in MPQs. It generates all possible combinations of a name and tests whether such file does exist in the MPQ archive.

When is the name breaking necessary ?

Since the game of StarCraft, programmers of Blizzard began to include listfiles in the MPQ archives. The listfile's name is "(listfile)". It seems that the battle is won, what is better than listfile obtained from the authors ? If you try to use this internal listfile, you'll notice that the listfile contains less than 10% of all archived files. What is such listfile good for ? If you explore MPQ archives from Diablo II, you'll find that the listfiles are complete. Warcraft III contains complete listfiles too. In the games of Diablo, StarCraft, Brood War and Warcraft II BNE the listfiles are missing or are incomplete. The lists can be downloaded from internet, they they are incomplete too.

Name breaking problems (Bad news)

A name of archived file usually includes directory, filename, (at the most 8 characters) and an extension. Let's think about a case when we know the directory and the extension and look the name only. It can consist of digits (10 combinations), uppercase letters (26 combinations) and the "underscore" character. If the file name length were one character, there is 10+26+1 = 37 total combinations of the file name. At two character length, there can be 37^2 (37*37) = 1369 of combinations. If we think about maximum name length 8 characters, we get 37^8 + 37^7 + 37^6 + 37^5 + 37^4 + 37^3 + 37^2 + 37 = 3,61 * 10^12 (over three trillions) of combinations. It is clear that if the test of one combination take 1 microsecond, the total estimated time to check all possible combinations is more that 1000 hours (41 days), not speaking about different extensions and different directories. It is not possible to ease the work using a dictionary, because the file names ave very often abbreviated. Fortunately, most file names in MPQ archives (where name breaking is necessary) are maximum 8 characters. Newer games (Warcraft III) have longer file names, often over 20-30 characters. Is it impossible to find such file names using brute force attack in geologically short time at all.

Name breaking optimizations (Good news)

There are some optimizations, which ease and speed-up the name breaking

  1. It is good to sort the names in the archive by their ordinal numbers in the archive. Because the archives are most often built from locally stored files in one batch, archived files from the same directory and the same file types mostly follow in a line.
  2. Some file names differ only by their index (flame1.cel, flame2.cel, ...). This can be used for quick guess of file names ("try to win")
  3. File size can tell something too. It is possible to get the size without decrypting the file.
  4. MPQ encryption contains a weakness, which can be used for quick detection of decryption key of compressed files. Most of archived files are compressed, except for the files that are compressed from nature, like SMKs or MP3s. So it is possible to extract the file and explore its structure. This allows us to quess the file type and thus, the extension.
  5. Like disk folders, MPQ directories often collect files of the same type. For example if all known files within a directory are WAVes, the unknowns will be most probably WAVes too.
  6. When checking names, it is possible to pre-calculate hash values for a given directory and then finish the calculation with plain name only. This greatly speeds up the computing of hash values and thus speeds up the complete name breaking process
  7. If a certain group of files seem to have the same prefix (e.g. 2 characters), it is possible to include this prefix into the searched directory and search only the remaining 6 characters of the name. This will shorten the necessary time for testing all names to minutes.

Name breaking implementation - The Name Breaker

The Name Breaker is a part of Ladik's MPQ Editor. It allows file viewing before name breaking, saving of current work and supports auto-detection of unknown file types, using weakness in MPQ encryption. Name breaking runs on the background with lower priority, so you can work or play games while name breaker will use the remaining CPU time. For quick access to the name breaker, run MPQ editor with the following parameters:

MPQEditor.exe /namebreaker mpqfile listfile

How much time the name breaking takes

The time necessary to search the whole range of the names depends on the name length. Here are aproximate values, which I measured on machine with CPU Intel Pentium IV, 2.4 GHz with 533 MHz FSB and DDRAM 333 MHz (512 MB):


The aim of this page is to create a project of name breaking, similar to the famous "seti@home". In this page, I will publish the latest MPQ filelists, for the games using MPQ archives. If you want to join me in name breaking, mail me of download the MPQ Editor and some listfiles and try to break some names. Visit the pages of StarcraftFreak, he deals with MPQ listfiles too.

Download the last version of MPQ listfiles


The following table contains overview of number of unknown files in MPQ archives. You can download the most recent version of the listfiles in the Download section. Thanks to people who participated on building listfiles:

Diablo I Beta
  Setup.exe Complete 06.11.04 - Christopher, Mystery
  Diabdat.mpq Complete 09.05.05 - Ojan, Ladik, Christopher, Mystery
Diablo I
  Autorun.exe Complete 09.05.03 - Ladik, StarcraftFreak
  Battle.snp Complete 04.05.03 - Ladik, StarcraftFreak
  Diabdat.mpq Complete 13.06.03 - Ladik, Thalick, StarcraftFreak
  Patch 1.09b.exe Complete 04.05.03 - Ladik, StarcraftFreak
  Patch_rt.mpq Complete 04.05.03 - Ladik, StarcraftFreak
  Spawn.mpq Complete 13.06.03 - Ladik, Thalick, StarcraftFreak
  single_*.sv, multi_*.sv Complete 17.05.03 - Thalick, Ladik
  d1221a.mpq Complete 09.06.03 - Thalick
  Hellfire.mpq Complete 04.07.03 - Ladik, StarcraftFreak
  Hfmonk.mpq Complete 28.05.03 - Ladik, StarcraftFreak
  Hfmusic.mpq Complete 04.05.03 - Ladik, StarcraftFreak
  Hfvoice.mpq Complete 04.05.03 - Ladik, StarcraftFreak
Lords of Magic
  Demo version Complete 22.08.03 - Thalick, Ladik
  gs.mpq Complete 12.09.03 - Ladik
  imp.mpq Complete 10.09.03 - Ladik
  pic.mpq 1 Unknown 16.09.03 - Ladik
  sndfx.mpq Complete 27.03.05 - DW, Ladik
  special.mpq Complete 16.09.03 - Ladik
  Battle.snp Complete 04.05.03 - StarcraftFreak
  Install.exe (v 2 Unknowns 27.03.05 - DW, Ojan, Ladik, Thalick, StarcraftFreak
  SC-1152.exe Complete 16.08.08 - Ojan, Ladik, StarcraftFreak
  Patch_rt.mpq Complete 04.05.03 - StarcraftFreak
  Standard.snp Complete 04.05.03 - StarcraftFreak
  StarDat.mpq 4 Unknowns 11.07.03 - Thalick, Ladik, StarcraftFreak
Brood War
  Battle.snp Complete 04.05.03 - StarcraftFreak
  BrooDat.mpq Complete 09.05.03 - Ladik, StarcraftFreak
  Install.exe ( 2 Unknowns 27.03.05 - DW, Ojan, Ladik, StarcraftFreak
  BW-1152.exe Complete 16.08.08 - Ojan, Ladik, StarcraftFreak
  Patch_rt.mpq Complete 04.05.03 - StarcraftFreak
  Standard.snp Complete 04.05.03 - StarcraftFreak
Warcraft II Edition
  Battle.snp Complete 04.05.03 - StarcraftFreak
  Install.exe (UK) 2 Unknowns 20.07.03 - Thalick, Ladik, StarcraftFreak
  War2Patch_202.exe Complete 04.05.03 - StarcraftFreak
  Patch_W2.mpq Complete 04.05.03 - StarcraftFreak
  War2Dat.mpq (UK) 1 Unknown 20.08.03 - Thalick, Ladik, StarcraftFreak
Diablo II
  D2data.mpq Complete 04.05.03 - StarcraftFreak
  D2char.mpq Complete 04.05.03 - StarcraftFreak
  D2music.mpq Complete 04.05.03 - StarcraftFreak
  D2sfx.mpq Complete 09.06.03 - Thalick, StarcraftFreak
  D2speech.mpq Complete 04.05.03 - StarcraftFreak
  D2video.mpq Complete 09.05.03 - Ladik, StarcraftFreak
  D2Patch_111b.exe Complete 16.08.08 - Ojan
  Patch_D2.mpq Complete 09.05.03 - Ladik, StarcraftFreak
  Setup.mpq Complete 09.05.03 - Thalick, Ladik, StarcraftFreak
Diablo II
Lord of Destruction
  D2xmusic.mpq Complete 04.05.03 - StarcraftFreak
  D2xtalk.mpq Complete 09.05.03 - Ladik, StarcraftFreak
  D2xvideo.mpq Complete 09.05.03 - Ladik, StarcraftFreak
  D2Patch_111b.exe Complete 16.08.08 - Ojan
  Patch_D2.mpq (1.10) Complete 16.01.04 - Uzume, Ladik, StarcraftFreak
  Setup.mpq Complete 03.07.03 - Ladik, Thalick, StarcraftFreak
Warcraft III
Reign of Chaos
  Patch 1.13.exe Complete 27.12.03 - Ladik, StarcraftFreak
  Patch_War3.mpq (1.13) Complete 27.12.03 - Ladik
  Patch_War3_Low.mpq Complete 03.08.03 - Ladik
  Patch_War3_Med.mpq Complete 03.08.03 - Ladik
  Setup.mpq Complete 27.03.05 - Ojan, Ladik
  War3.mpq Complete (Incl. Embedded MPQs) 09.05.03 - Ladik, StarcraftFreak
  War3patch.mpq Complete 09.05.03 - Ladik, StarcraftFreak
Warcraft III
The Frozen Throne
  Patch 1.13.exe Complete 27.12.03 - Ladik
  Setup.mpq Complete 03.07.03 - Ladik
  War3.mpq Complete 27.03.05 - Ojan, Ladik
  War3Patch.mpq (1.23) Complete 22.12.13 - Ladik
  War3x.mpq Complete (Incl. Embedded MPQs) 03.07.03 - Ladik
  War3xLocal.mpq Complete 03.07.03 - Ladik
  War3x_low.mpq Complete 16.07.03 - Ladik
  War3x_med.mpq Complete 16.07.03 - Ladik

World of Warcraft

Internal listfiles are complete

Starcraft II

Internal listfiles are complete