ZenHAX

Free Game Research Forum | Official QuickBMS support | twitter @zenhax | SSL HTTPS://zenhax.com
It is currently Sat Nov 18, 2017 11:31 pm

All times are UTC




Post new topic  Reply to topic  [ 200 posts ]  Go to page Previous 16 7 8 9 10 Next
Author Message
PostPosted: Thu Sep 21, 2017 4:33 pm 

Joined: Sat May 16, 2015 11:58 pm
Posts: 31
aluigi wrote:
@Nobody
Do you mean that my script http://aluigi.org/papers/bms/others/unr ... ment_4.bms version 0.4.7 doesn't work? I doubt.


My mistake Aluigi. Script work perfect. Thanks a lot.


Top
   
PostPosted: Fri Sep 22, 2017 4:02 pm 

Joined: Fri Sep 22, 2017 3:32 pm
Posts: 2
Hello aluigi and the zenhax community!

I tested your latest script (0.4.7) with Marvel vs Capcom Infinite and I get this error message:
Code:
Error: incomplete input file 0: F:\MVCI\pakchunk0-WindowsNoEditor.pak
       Can't read 4 bytes from offset 786e636d000001c2.
       Anyway don't worry, it's possible that the BMS script has been written
       to exit in this way if it's reached the end of the archive so check it
       or contact its author or verify that all the files have been extracted.
       Please check the following coverage information to know if it's ok.

  coverage file 0     0%   44         24203445315 . offset 786e636d000001c2

Last script line before the error or that produced the error:
  185 get NAMESZ signed_long

There are 2 pak files in the game's folder and I get the exact same error with both, so I assume it's due to encryption (I don't even get to chose a key when running the script, it gives the error message directly).

I uploaded the big exe and the 2 files obtained with filecutter.bms with a MEGABYTES variable set to 10: http://www31.zippyshare.com/v/MszvgXTc/file.html

If you could find the key and update the ue4 bms script, I would be very grateful, it looks like there are many things to mess with in those files. ;)

If you need more files I'd be glad to provide them.


Top
   
PostPosted: Fri Sep 22, 2017 6:56 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 7110
Weird format.
It has absolutely nothing in common with the UE4 pak format and the only clear-text fields are 3 64bit fields at the end without a meaning.
The rest is obfuscated probably using a part of the 32 bytes string at the end of the archive.

I will not spend time on this, sorry.


Top
   
PostPosted: Fri Sep 22, 2017 7:56 pm 

Joined: Fri Sep 22, 2017 3:32 pm
Posts: 2
No problemo, I'm already glad that you took the time to look into the files so promptly.

It looks like most of the files are encrypted with the same method, not only pak files, but acb, acf, usm and uasset too.

Capcom really didn't want people to mess with their game (and that's understandable after the Street Fighter V constant datamining and leaks), but I'm not sure that making the game hard to mod will help the abysmal sales of the game on Steam (not even 15k players since release if steamspy is to be trusted and the game can already be found for less than 25$ on some sites...).

At least the game is fun to play but some part of it are so ugly (most of the UI); it would have been nice to be able to edit it.


Top
   
PostPosted: Tue Sep 26, 2017 1:43 pm 

Joined: Sat Apr 30, 2016 9:01 am
Posts: 3
Here's some more information about Marvel vs Capcom Infinite, the files that are encrypted in the end they have this same string mcnxyxcmvmcxyxcmskdldkjshagsdhfj (here is a sample file) http://www11.zippyshare.com/v/mddSJhW5/file.html
In the exe file there is a reference to that key:
ˆ úH....ÁÁÁÁ.Í[.ˆ úH..../sK...G¨‡.}ç7SÚ¥Á....... 0úH....Pš.I....@š.I.... 0úH.....dfpc...user32.dll......ntdll.dll.......kernelbase.dll..mcnxyxcmvmcxyxcmskdldkjshagsdhfj....\\.\........\\?\hid#........msvcrt.dll.........I.
The exe file has Denuvo inside it and this format SHA256 openssl.org now I do not know if they used the same encryption for the .pak file.

Edit1: Here is the exe file dumped during a game http://www14.zippyshare.com/v/RZ2xSjME/file.html
you can already notice the files that have been uploaded during the game /Game/..000./.G.a.m.e./.C.h.a.r.a./.%.s./.M.e.s.h./.P.e.r.s.i.s.t.e.n.t.M.a.t.e.r.i.a.l.A.s.s.e.t._.%.s...P.e.r.s.i.s.t.e.n.t.M.a.t.e.r.i.a.l.A.s.s.e.t


Top
   
PostPosted: Thu Sep 28, 2017 6:22 pm 

Joined: Sun Oct 04, 2015 2:27 am
Posts: 163
TerryXX wrote:
Here's some more information about Marvel vs Capcom Infinite, the files that are encrypted in the end they have this same string mcnxyxcmvmcxyxcmskdldkjshagsdhfj (here is a sample file) http://www11.zippyshare.com/v/mddSJhW5/file.html
In the exe file there is a reference to that key:
ˆ úH....ÁÁÁÁ.Í[.ˆ úH..../sK...G¨‡.}ç7SÚ¥Á....... 0úH....Pš.I....@š.I.... 0úH.....dfpc...user32.dll......ntdll.dll.......kernelbase.dll..mcnxyxcmvmcxyxcmskdldkjshagsdhfj....\\.\........\\?\hid#........msvcrt.dll.........I.
The exe file has Denuvo inside it and this format SHA256 openssl.org now I do not know if they used the same encryption for the .pak file.

Edit1: Here is the exe file dumped during a game http://www14.zippyshare.com/v/RZ2xSjME/file.html
you can already notice the files that have been uploaded during the game /Game/..000./.G.a.m.e./.C.h.a.r.a./.%.s./.M.e.s.h./.P.e.r.s.i.s.t.e.n.t.M.a.t.e.r.i.a.l.A.s.s.e.t._.%.s...P.e.r.s.i.s.t.e.n.t.M.a.t.e.r.i.a.l.A.s.s.e.t




Image


Top
   
PostPosted: Thu Sep 28, 2017 6:28 pm 

Joined: Fri Jun 03, 2016 5:24 pm
Posts: 13
godskin wrote:
TerryXX wrote:
Here's some more information about Marvel vs Capcom Infinite, the files that are encrypted in the end they have this same string mcnxyxcmvmcxyxcmskdldkjshagsdhfj (here is a sample file) http://www11.zippyshare.com/v/mddSJhW5/file.html
In the exe file there is a reference to that key:
ˆ úH....ÁÁÁÁ.Í[.ˆ úH..../sK...G¨‡.}ç7SÚ¥Á....... 0úH....Pš.I....@š.I.... 0úH.....dfpc...user32.dll......ntdll.dll.......kernelbase.dll..mcnxyxcmvmcxyxcmskdldkjshagsdhfj....\\.\........\\?\hid#........msvcrt.dll.........I.
The exe file has Denuvo inside it and this format SHA256 openssl.org now I do not know if they used the same encryption for the .pak file.

Edit1: Here is the exe file dumped during a game http://www14.zippyshare.com/v/RZ2xSjME/file.html
you can already notice the files that have been uploaded during the game /Game/..000./.G.a.m.e./.C.h.a.r.a./.%.s./.M.e.s.h./.P.e.r.s.i.s.t.e.n.t.M.a.t.e.r.i.a.l.A.s.s.e.t._.%.s...P.e.r.s.i.s.t.e.n.t.M.a.t.e.r.i.a.l.A.s.s.e.t




Image


Script??


Top
   
PostPosted: Thu Sep 28, 2017 6:35 pm 

Joined: Sun Oct 04, 2015 2:27 am
Posts: 163
## Marvel VS Capcom - Infinite ##

MvCI file decrypter + pak extraction script

https://github.com/AltimorTASDK/dfpslayer/releases

Usage: dfpslayer [file path]

Code:
Example:
dfpslayer "C:\Program Files (x86)\Steam\steamapps\common\MARVEL VS. CAPCOM INFINITE\MVCI\Content\Paks\pakchunk0-WindowsNoEditor.pak"


dfpslayer will output the decrypted file with ".decrypted" appended to the path. Once you've decrypted it you can extract pak contents with QuickBMS.
dfpslayer also works on other files within the MVCI/Content folder, not just the paks.

BMS script :
https://gist.githubusercontent.com/AltimorTASDK/a89d03d4c9c54c440756d0e5778bf2c8/raw/d6060548591622d4691a48a69e3bbbca629047f7/mvci.bms
Use with aluigi's QuickBMS. I can't link it here because reddit filters it for some reason.
Using QuickBMS to extract the pak contents is the same as SFV.
The game will load decrypted files.

Use -game=ue4.15 with UE viewer.


Top
   
PostPosted: Thu Sep 28, 2017 8:15 pm 

Joined: Sat Apr 30, 2016 9:01 am
Posts: 3
Godskin thx man for your work :)
P.S. question, create these "dumps" of exe files are they useful or do not serve anything?


Top
   
PostPosted: Thu Sep 28, 2017 9:20 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 7110
Apparently the encryption algorithm is very simple and the final header of 0x1c2 bytes is useless.
I have made a script and it works well but I don't know why the final data of the rebuilt filecutted file doesn't match what I expected, anyway I don't see errors:
http://aluigi.org/bms/mvci_dec.bms

P.S.: I have seen the key in the edited bms that has been posted but in the 10Mb filecutted sample I have here all the files were not-encrypted, is that key necessary only for some files? (some UE4 games needed a key for some ini files so that's perfectly possible here too)


Top
   
PostPosted: Fri Sep 29, 2017 7:34 am 

Joined: Sun Oct 04, 2015 2:27 am
Posts: 163
aluigi wrote:
Apparently the encryption algorithm is very simple and the final header of 0x1c2 bytes is useless.
I have made a script and it works well but I don't know why the final data of the rebuilt filecutted file doesn't match what I expected, anyway I don't see errors:
http://aluigi.org/bms/mvci_dec.bms

P.S.: I have seen the key in the edited bms that has been posted but in the 10Mb filecutted sample I have here all the files were not-encrypted, is that key necessary only for some files? (some UE4 games needed a key for some ini files so that's perfectly possible here too)


and how to extract .uexp (sound File) ?


Top
   
PostPosted: Sat Sep 30, 2017 12:59 am 

Joined: Wed Mar 11, 2015 6:40 am
Posts: 23
godskin wrote:
## Marvel VS Capcom - Infinite ##

MvCI file decrypter + pak extraction script

https://github.com/AltimorTASDK/dfpslayer/releases

Usage: dfpslayer [file path]

Code:
Example:
dfpslayer "C:\Program Files (x86)\Steam\steamapps\common\MARVEL VS. CAPCOM INFINITE\MVCI\Content\Paks\pakchunk0-WindowsNoEditor.pak"


dfpslayer will output the decrypted file with ".decrypted" appended to the path. Once you've decrypted it you can extract pak contents with QuickBMS.
dfpslayer also works on other files within the MVCI/Content folder, not just the paks.

BMS script :
https://gist.githubusercontent.com/AltimorTASDK/a89d03d4c9c54c440756d0e5778bf2c8/raw/d6060548591622d4691a48a69e3bbbca629047f7/mvci.bms
Use with aluigi's QuickBMS. I can't link it here because reddit filters it for some reason.
Using QuickBMS to extract the pak contents is the same as SFV.
The game will load decrypted files.

Use -game=ue4.15 with UE viewer.


where to put the files extracted from the PAK files?


Top
   
PostPosted: Sat Sep 30, 2017 10:49 pm 

Joined: Wed Mar 11, 2015 6:40 am
Posts: 23
godskin wrote:
aluigi wrote:
Apparently the encryption algorithm is very simple and the final header of 0x1c2 bytes is useless.
I have made a script and it works well but I don't know why the final data of the rebuilt filecutted file doesn't match what I expected, anyway I don't see errors:
http://aluigi.org/bms/mvci_dec.bms

P.S.: I have seen the key in the edited bms that has been posted but in the 10Mb filecutted sample I have here all the files were not-encrypted, is that key necessary only for some files? (some UE4 games needed a key for some ini files so that's perfectly possible here too)


and how to extract .uexp (sound File) ?



This guy find a way aparently:

https://www.youtube.com/watch?v=nx49UfC ... Aw&index=1


Top
   
PostPosted: Mon Oct 02, 2017 1:56 am 

Joined: Fri Dec 11, 2015 3:38 pm
Posts: 32
aluigi wrote:
Apparently the encryption algorithm is very simple and the final header of 0x1c2 bytes is useless.
I have made a script and it works well but I don't know why the final data of the rebuilt filecutted file doesn't match what I expected, anyway I don't see errors:
http://aluigi.org/bms/mvci_dec.bms

P.S.: I have seen the key in the edited bms that has been posted but in the 10Mb filecutted sample I have here all the files were not-encrypted, is that key necessary only for some files? (some UE4 games needed a key for some ini files so that's perfectly possible here too)

I keep getting an error when I try to reimport a texture in MvCI using the eaxtractor script.

Code:
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/005_RSMA.ubulk"
< 00000000146c419b 53566      MVCI\Content\Chara\005\Mesh\005_RSMA.ubulk
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/005_RSMA.ubulk"
< 00000000146d12d9 52028      MVCI\Content\Chara\005\Mesh\005_RSMA.ubulk
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/005_RSMA.ubulk"
< 00000000146dde15 55863      MVCI\Content\Chara\005\Mesh\005_RSMA.ubulk
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/005_RSMA.ubulk"
< 00000000146eb84c 15071      MVCI\Content\Chara\005\Mesh\005_RSMA.ubulk
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/2P/005_COLOR.uasset"
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/2P/005_COLOR.ubulk"
< 00000000146f1ae9 32929      MVCI\Content\Chara\005\Mesh\2P\005_COLOR.ubulk
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/2P/005_COLOR.ubulk"
< 00000000146f9b8a 37504      MVCI\Content\Chara\005\Mesh\2P\005_COLOR.ubulk
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/2P/005_COLOR.ubulk"
< 0000000014702e0a 39092      MVCI\Content\Chara\005\Mesh\2P\005_COLOR.ubulk
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/2P/005_COLOR.ubulk"
< 000000001470c6be 39705      MVCI\Content\Chara\005\Mesh\2P\005_COLOR.ubulk
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/2P/005_COLOR.ubulk"
< 00000000147161d7 38536      MVCI\Content\Chara\005\Mesh\2P\005_COLOR.ubulk
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/2P/005_COLOR.ubulk"
< 000000001471f85f 38623      MVCI\Content\Chara\005\Mesh\2P\005_COLOR.ubulk
- REIMPORT MEMORY_FILE WORK-AROUND: "MVCI/Content/Chara/005/Mesh/2P/005_COLOR.ubulk"
- compressed size too big, I try using the zopfli method (may be slow)
- compressed size too big, I try using the uberflate/kzip method (may be very slow!)

-------------------
*EXCEPTION HANDLER*
-------------------
An error or crash occurred:

*EH* ExceptionCode      c0000005 access violation
*EH* ExceptionFlags     00000000
*EH* ExceptionAddress   747386b0
                        746B0000 + 000886b0 msvcrt.dll
*EH* NumberParameters   00000002
*EH*                    00000000
*EH*                    d5619db8

Last script line before the error or that produced the error:
  65  clog MEMORY_FILE CHUNK_OFFSET CHUNK_ZSIZE CHUNK_SIZE

L:\Program Files (x86)\Marvel VS Capcom - Infinite\MVCI\Content\Paks>pause
Press any key to continue . . .


I don't understand how the script can think the modded file is too big. Original file is 0x2AA000 Bytes - Modded File is 0x2AA000 Bytes --->Exact same size


Top
   
PostPosted: Mon Oct 02, 2017 6:12 am 

Joined: Wed Aug 13, 2014 10:00 am
Posts: 117
It says "compressed size too big" so your modded file, can't be compressed to original size (written in the archive). That's why it's using other compression variants.


Top
   
PostPosted: Mon Oct 02, 2017 10:33 am 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 7110
Chunked files... it would probably not work anyway.


Top
   
PostPosted: Mon Oct 02, 2017 12:52 pm 

Joined: Fri Dec 11, 2015 3:38 pm
Posts: 32
EDIT:

The game will run from unpacked files, so disregard my inquiry.


Top
   
PostPosted: Sun Oct 22, 2017 7:59 am 

Joined: Sun Oct 22, 2017 7:58 am
Posts: 1
godskin wrote:
## Marvel VS Capcom - Infinite ##

MvCI file decrypter + pak extraction script

https://github.com/AltimorTASDK/dfpslayer/releases

Usage: dfpslayer [file path]

Code:
Example:
dfpslayer "C:\Program Files (x86)\Steam\steamapps\common\MARVEL VS. CAPCOM INFINITE\MVCI\Content\Paks\pakchunk0-WindowsNoEditor.pak"


dfpslayer will output the decrypted file with ".decrypted" appended to the path. Once you've decrypted it you can extract pak contents with QuickBMS.
dfpslayer also works on other files within the MVCI/Content folder, not just the paks.

BMS script :
https://gist.githubusercontent.com/AltimorTASDK/a89d03d4c9c54c440756d0e5778bf2c8/raw/d6060548591622d4691a48a69e3bbbca629047f7/mvci.bms
Use with aluigi's QuickBMS. I can't link it here because reddit filters it for some reason.
Using QuickBMS to extract the pak contents is the same as SFV.
The game will load decrypted files.

Use -game=ue4.15 with UE viewer.



Video Tutorial please.. thanks...


Top
   
PostPosted: Tue Oct 31, 2017 3:29 am 

Joined: Sat May 14, 2016 8:03 pm
Posts: 10
Faith of Danschant is currently not compatible with the script/UModel.
I would like to share the exe and PAK, but the thing is 3gb.

Is there an easier way or just upload the entire thing?


Top
   
PostPosted: Tue Oct 31, 2017 9:48 am 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 7110
Use this script to generate 2 files to upload:
http://aluigi.org/bms/filecutter.bms


Top
   
Display posts from previous:  Sort by  
Post new topic  Reply to topic  [ 200 posts ]  Go to page Previous 16 7 8 9 10 Next

All times are UTC


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Powered by phpBB® Forum Software © phpBB Limited