Free Game Research Forum | Official QuickBMS support | twitter @zenhax | SSL HTTPS://zenhax.com
It is currently Tue Oct 17, 2017 12:12 am

All times are UTC

Post new topic  Reply to topic  [ 1 post ] 
Author Message
PostPosted: Fri Jun 09, 2017 7:17 pm 

Joined: Fri Jun 09, 2017 3:52 pm
Posts: 1
In console version of Diablo 3 Blizzard used own format of archives. Extension of archives is CPK and they located at CPKs folder, but it is not CriWare format.
Signature of archive is \xA1 \xB2 \xC3 \xD4 and there is also second part - I think it is version of format or at least could be part of signature: \x00 \x00 \x00 \x06.
At least archive where cutscenes stored goes without any compression/encryption, since video stored in ogv format bounds of files could be easily determined by signature (OggS, theora, etc).
But header format is complicated. I was not able to find any clear values except of files count @ 0x14.
There is also plain list of filenames which order doesn't match the order of files placement in archive (at least in Cutscenes archive files stored in alphabetical order).

Results of my research:
// Header
DWORD dwSignature = A1 B2 C3 D4
DWORD // 00 00 00 06 always - version? part of signature?
QWORD qwSize // in Cutscenes it is size of archive from start of files (0x10000) in other archives - not
DWORD // 00 00 00 02 everywhere except Cutscenes (00) - level of compression? encryption indicator?
DWORD dwFilesCount // number of files in archive
DWORD // everywhere except cache archives = dwFilesCount
DWORD // some small number, in Act1-4 = 01
DWORD // another small number, in localization archives (xxXX_Act1-4, e.g. enGB_Act1) = 12-13
DWORD // in most cases = 01, cache archives = 08 / 07, Common = 02
DWORD // small number in range 16-1F
DWORD // equals previous
DWORD // small number in range 00-0F
DWORD // some value (not offset/size)
DWORD // always null (00 00 00 00)
DWORD // unknown value (not offset/size)
DWORD // unknown value (not offset/size)
DWORD // unknown value (not offset/size) seems like little endian
DWORD // unknown value, in cache small number in other archives - big
Next goes some structure or table or/of hashes, I don't know, size of this area depends on number of files stored in archive (more files - bigger size), which is separated from list of filenames with some set of dwords nearly similar to arithmetic series (arithmetic progression) with shift, differ from archive to archive (for example : 00, 2C, 5A, 89, B1...). Size of this set is equals to number of files stored in archive. After filelist there is blank area filled with zeroes (not fixed size, differ from archive to archive) and finally then goes the files themselves (till the EOF of archive).

Both known values (FilesCount and Size in Cutscenes) is big endian.

Here is the smallest archive example: plPL_CacheCommon.cpk (1 Mb)
Rest of archives (including Cutscenes (~1.1Gb) and CacheAct (smallest - 200 Mb) archives): PM me please
Default.xex (if anyone skilled in reversing Xbox binaries, I'm - not): Default.xex (17 Mb)

Display posts from previous:  Sort by  
Post new topic  Reply to topic  [ 1 post ] 

All times are UTC

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Powered by phpBB® Forum Software © phpBB Limited