CON file format - Hashes

[Gargan]

I've done some research into the file format of a CON file but I'm having trouble with something. It looks like for every hash table in the CON file there's another hash table immediately after it, which is an almost perfect copy of the previous table. So for the MHT at 0xB6000 there's another MHT table at 0xB7000. Also for every SHT there's a table immediately after it.  Now, what I'm having trouble with is that the CON file seems to use one table or the other when verifying hashes.. I.e., the SHA1 hash at 0x381 which is supposed to be an SHA1 hash of the first MHT in the CON file might be a hash of 0xB6000-0xB7000 or 0xB7000-0xB8000. Which one is it? The same goes for each entry in the MHT, a particular SHA1 hash in the MHT might be for the SHT at 0x164000 or it might be for the SHT at 0x165000... And so on and so forth. So when verifying that the hashes are correct, which table am I supposed to look at?  I also know that there's 4 bytes of data immediately after each hash, but I'm unsure as to what these bytes mean? I know that this has probably been done before, but I can't find any verifiable information on the proper format for a CON file...

[dschu012]

I can't be of much help but hopefully this can help you a bit if you haven't seen it.

http://www.free60.org/Generic_Xbox_360_File_Container#STFS_Header_Information

Also the 4 bytes of data after each hash I believe point the where the next block of data is located for a given file. For files contained in the CON they are broken into 0x1000 byte chunks and each chunk does not need to be located one after another (though in most cases they are). If the 4 bytes = 0x0FFFFFF that means that that block is the last block in a file.

[Gargan]

I have seen that site. Actually, that's where I started when researching the CON file format. But i've come to find out that some of the information there is incorrect and most is missing for CON files.  Thanks for the heads up about those 4 bytes after each hash, I'll look into that to see if that's what's going on. Also, as best as I can tell, the byte at 0x37B is what determines which of the two MHT's to use: 0x00 for the first at 0xB6000 and 0x02 for the second at 0xB7000.  Also, it looks like bit 30 in the 4 bytes (so looking at these 4 bytes in little-endian mode, bit 30 would be the second MSB or bit 6 of the first byte following the hash, i.e. x0/1xxxxxx xxxxxxxx xxxxxxxx xxxxxxxx) after each SHA1 hash in the MHT determines which subhash table is being hashed, 0 for the first subhash table and 1 for the second.