ZenHAX

Free Game Research Forum | Official QuickBMS support | twitter @zenhax | SSL HTTPS://zenhax.com
It is currently Mon Mar 08, 2021 9:44 pm

Unanswered topics | Active topics


»

All times are UTC



Post new topic  Reply to topic  Page 4 of 5
  [ 87 posts ]  Go to page Previous 1 2 3 4 5 Next
  Print view Previous topic | Next topic 
Author Message
aluigi
PostPosted: Fri May 11, 2018 9:41 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 12013
It's a custom obfuscation so no way to figure out it easily without reverse engineering.
But it's possible to (ab)use a bug in the obfuscation and a particular feature of the format for guessing the 128 bytes used for encrypting the data, in fact this sort of key changes for every entry so it's necessary to calculate the new one every time... you have been very lucky this time.
Download the script version 0.1.21 :D
http://aluigi.org/bms/warinc.bms
Top
   
Reply with quote  
arowsky
PostPosted: Fri May 11, 2018 10:00 pm 

Joined: Fri May 11, 2018 1:45 pm
Posts: 6
Dude, you are crazy :D Thanks man!
Top
   
Reply with quote  
aluigi
PostPosted: Sat May 12, 2018 2:04 am 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 12013
Script 0.1.21a, it's an important fix so redownload the script and run it again.
Now ALL the files are correctly extracted except 32 files (directx shaders cache) that are skipped... 32 on 30900 is not bad at all :)
Top
   
Reply with quote  
mariana12
PostPosted: Thu Sep 06, 2018 6:27 pm 

Joined: Tue Feb 07, 2017 1:39 pm
Posts: 12
https://ufile.io/nl91d

Update script.
Top
   
Reply with quote  
aluigi
PostPosted: Thu Sep 13, 2018 7:27 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 12013
@mariana12
please upload the 2 files generated by http://aluigi.org/bms/filecutter.bms on ez_01.bin
Top
   
Reply with quote  
tiktokzzz
PostPosted: Sun Sep 16, 2018 6:01 pm 

Joined: Sun Sep 16, 2018 5:52 pm
Posts: 7
sir aluigi can you help me please.
i can't exctract .bin file.
this file https://drive.google.com/file/d/19tseJv ... sp=sharing
Error: unknown TYPE 99, contact me

- 0 files found in 0 seconds
coverage file 0 2199% 6748904 306786 . offset 0000001c
coverage file 1 0% 0 1073741822 . offset 00000000
coverage file -1 0% 865 4612864 . offset 00000128

Press ENTER or close the window to quit
Top
   
Reply with quote  
aluigi
PostPosted: Sun Sep 16, 2018 6:13 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 12013
@tiktokzzz
same thing I wrote in my previous post
Top
   
Reply with quote  
tiktokzzz
PostPosted: Sun Sep 16, 2018 6:15 pm 

Joined: Sun Sep 16, 2018 5:52 pm
Posts: 7
:cry:


Last edited by tiktokzzz on Mon Sep 17, 2018 12:19 pm, edited 1 time in total.

Top
   
Reply with quote  
tiktokzzz
PostPosted: Sun Sep 16, 2018 6:18 pm 

Joined: Sun Sep 16, 2018 5:52 pm
Posts: 7
this last version warinc.bms don't work.


Last edited by tiktokzzz on Mon Sep 17, 2018 12:19 pm, edited 1 time in total.

Top
   
Reply with quote  
tiktokzzz
PostPosted: Sun Sep 16, 2018 6:38 pm 

Joined: Sun Sep 16, 2018 5:52 pm
Posts: 7
:cry:


Last edited by tiktokzzz on Mon Sep 17, 2018 12:20 pm, edited 1 time in total.

Top
   
Reply with quote  
aluigi
PostPosted: Sun Sep 16, 2018 6:55 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 12013
aluigi wrote:
please upload the 2 files generated by http://aluigi.org/bms/filecutter.bms on ez_01.bin
Top
   
Reply with quote  
tiktokzzz
PostPosted: Sun Sep 16, 2018 7:14 pm 

Joined: Sun Sep 16, 2018 5:52 pm
Posts: 7
Here it is https://drive.google.com/file/d/15E22rk ... sp=sharing
Thank you very much.
Top
   
Reply with quote  
aluigi
PostPosted: Sun Sep 16, 2018 8:47 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 12013
The format can't be supported because the OFFSET field used in it is fake.
Example of the data meant to be at the real offset 0x150ac but said to be at 0x8ba7:
Code:
. 00000378 getdstr NAME       "avutil-50.dll" 260
    61 76 75 74 69 6c 2d 35 30 2e 64 6c 6c 00 00 00   avutil-50.dll...
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00                                       ....
. 0000047c get     TYPE       0x00000063 1
.
. 0000047d get     PACK       0x00000000 1
. 0000047e get     SIZE       0x00017a0e 4
. 00000482 get     OFFSET     0x00008ba7 4
. 00000486 get     CRC        0x988dbb38 4
. 0000048a get     ZSIZE      0x0000d5ba 4
. 0000048e getdstr DUMMY      "" 18
    01 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00                                             ..
Top
   
Reply with quote  
tiktokzzz
PostPosted: Sun Sep 16, 2018 8:54 pm 

Joined: Sun Sep 16, 2018 5:52 pm
Posts: 7
What should I do for extract this file.
Top
   
Reply with quote  
aluigi
PostPosted: Sun Sep 16, 2018 8:54 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 12013
Anyway I have updated the script for ignoring the error with type 99 just in case the file provided by you and the other user are not related, that would explain why the offset is different :)
http://aluigi.org/bms/warinc.bms
Top
   
Reply with quote  
tiktokzzz
PostPosted: Sun Sep 16, 2018 9:09 pm 

Joined: Sun Sep 16, 2018 5:52 pm
Posts: 7
:'(
Top
   
Reply with quote  
Gamerioder
PostPosted: Sat Dec 29, 2018 12:48 pm 

Joined: Sat Dec 29, 2018 12:34 pm
Posts: 2
Hello.
ViralHZ not unpack don't working.


VHZ_00.bin = https://ufile.io/5xhag

help me!
Top
   
Reply with quote  
oneped555
PostPosted: Mon Jan 07, 2019 9:38 pm 

Joined: Mon Jan 07, 2019 9:36 pm
Posts: 4
https://ufile.io/4nwgc

Update script.
Top
   
Reply with quote  
aluigi
PostPosted: Sat Jan 12, 2019 12:48 am 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 12013
@oneped555
At line 324 of the script replace 0x12 with 0x62:
getdstring DUMMY 0x62 MEMORY_FILE
Top
   
Reply with quote  
oneped555
PostPosted: Wed Feb 13, 2019 1:09 pm 

Joined: Mon Jan 07, 2019 9:36 pm
Posts: 4
Thank You

https://ufile.io/7c3n6

Update script.
Top
   
Reply with quote  
Display posts from previous:  Sort by  
Post new topic  Reply to topic  Page 4 of 5
  [ 87 posts ]  Go to page Previous 1 2 3 4 5 Next

»

All times are UTC

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Powered by phpBB® Forum Software © phpBB Limited