ZenHAX

Free Game Research Forum | Official QuickBMS support | twitter @zenhax | SSL HTTPS://zenhax.com
It is currently Sun May 26, 2019 11:15 am

All times are UTC




Post new topic  Reply to topic  [ 28 posts ]  Go to page 1 2 Next
Author Message
 Post subject: Forza Method 22 (.zip)
PostPosted: Mon May 28, 2018 10:28 am 

Joined: Mon May 28, 2018 10:23 am
Posts: 10
Would anyone know how to extract Forza zips with compression method 22?

Here's an example zip:


Attachments:
camera.zip [79.33 KiB]
Downloaded 33 times
Top
   
PostPosted: Mon May 28, 2018 4:40 pm 

Joined: Mon May 28, 2018 4:38 pm
Posts: 1
^^^^Seconded, it'd be a HUUUUGE help if anyone can figure this out.


Top
   
PostPosted: Tue May 29, 2018 4:04 am 

Joined: Tue May 29, 2018 4:02 am
Posts: 1
let's figure it out what it has.....intresting content


Top
   
PostPosted: Tue May 29, 2018 7:51 am 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 10284
Considering the minimum compressed size being 0x234 even if the uncompressed size is smaller, I suspect there is some encryption/obfuscation (dictionary?) involved.
offset, comp_size, uncomp_size:
Code:
0x0000002e 0x00000234 0x00000430
0x0000029c 0x00000234 0x000002ac
0x00000510 0x00000234 0x000000ba
0x00000770 0x00000444 0x000026a6
0x00000bee 0x00000864 0x0000477a
0x00001481 0x00000c84 0x00007bf8
0x0000213a 0x00000654 0x000025c2
0x000027b7 0x000010a4 0x00008551
0x00003886 0x00000234 0x00000436
0x00003ae8 0x00000234 0x00000432
0x00003d4e 0x00000444 0x00000b25
0x000041c3 0x00000a74 0x000051ab
0x00004c66 0x00000654 0x00002b8c
0x000052f1 0x000033b4 0x000316d3
0x000086d6 0x000033b4 0x000315cf
0x0000bab6 0x00000234 0x00000446
0x0000bd18 0x00000444 0x0000158b
0x0000c18b 0x00005ae4 0x00060a1f
0x00011ca9 0x00000c84 0x000129f4
0x0001295b 0x00000234 0x00000427
0x00012bbf 0x00000444 0x00000f02
0x0001302b 0x00000234 0x000002e1
0x0001328b 0x00000234 0x00000095
0x000134f2 0x00000234 0x000000b6


Top
   
PostPosted: Sat Jun 09, 2018 2:04 am 

Joined: Mon May 28, 2018 10:23 am
Posts: 10
Encryption/obfuscation doesn't sound very good, I hope it gets figured out :)


Top
   
PostPosted: Sat Jun 09, 2018 6:40 am 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 10284
There are some missing information in this topic.
Is it Forza 7?
For what platform? (and is this method 22 used on both the platforms?)
Do all the zip files use this method 22 or only few ones?


Top
   
PostPosted: Sat Jun 09, 2018 9:31 am 

Joined: Mon May 28, 2018 10:23 am
Posts: 10
It's Forza Horizon 3, in the later updates they used method 22 on some of the zips (not all afaik, I don't have the dumped game files right now to check).

From PC, I don't know what method(s) the Xbox version uses but I presume the same since this is a console port.


Top
   
PostPosted: Fri Jun 22, 2018 1:57 pm 

Joined: Mon May 28, 2018 10:23 am
Posts: 10
Here's some more method 22 zips:

https://www32.zippyshare.com/v/sKD4lSxd/file.html


https://www32.zippyshare.com/v/qxgNNfTZ/file.html


Top
   
PostPosted: Thu Aug 16, 2018 11:32 am 

Joined: Mon May 28, 2018 10:23 am
Posts: 10
Forza Horizon 4 uses method 22 on some zips as well, can't upload any files yet though. I'm hoping that someone will eventually make a script for this, it will be very helpful.


Top
   
PostPosted: Sat Oct 06, 2018 3:51 am 

Joined: Sat Oct 06, 2018 3:43 am
Posts: 1
Unsure if there has been any progress for method 22 zips, but now with Forza Horizon 4 being released, can now note that most zips in that game are method 22.
Here is 5 more sample zips to go by.

https://www.mediafire.com/file/09m5q7y4 ... a.rar/file

Thanks


Top
   
PostPosted: Fri Apr 26, 2019 9:37 pm 

Joined: Fri Apr 26, 2019 9:32 pm
Posts: 6
Pertaining to Forza Horizon 4:

I own the game, but I didn't want to screw around with permissions etc because I actually play it as well :]

What I've been able to do is use R-Studio to copy a few archives from the install directory successfully to another drive. I unchecked "keep permissions and stuff" or something like that. That has given me 2 files (eg):

Code:
REN_5Turbo_HE_80.zip
REN_5Turbo_HE_80.zip.$efs


I opened the .$efs file with a hexeditor and it starts with:
Code:
.appx_...

followed by unreadable hex code (a bunch of number and letters lol)

So I am hoping that might be a clue into getting these extracted. I have tried various variations of forza studio and other extractors and the general consensus is that "this is not a valid archive". I'm guess that is because of encryption. Is the .$efs any help to getting them decrypted?


Top
   
PostPosted: Tue Apr 30, 2019 12:28 pm 

Joined: Mon May 28, 2018 10:23 am
Posts: 10
Did you just say that R-Studio completely bypassed EFS perms on FH4 and allowed it to be copied elsewhere? That in itself is huge news.

Would you be able to upload both those files please? If they're openable, copyable and editable then this is insane as the game can't even be dumped from kernel with any sorts of perms due to how strong EFS is on FH4.


Last edited by umisery on Wed May 01, 2019 1:41 pm, edited 1 time in total.

Top
   
PostPosted: Tue Apr 30, 2019 5:17 pm 
User avatar

Joined: Tue Apr 30, 2019 5:10 pm
Posts: 6
Here is the 2 files efs still in there but we have the *efs files, if anyone know how to do that we are happy to know that.

https://www65.zippyshare.com/v/1Hv8DFsy/file.html


Top
   
PostPosted: Tue Apr 30, 2019 5:34 pm 

Joined: Sun Apr 28, 2019 4:53 pm
Posts: 3
Can anyone explain how its done using R-Studio? I want to look into it a little bit.


Top
   
PostPosted: Tue Apr 30, 2019 5:40 pm 
User avatar

Joined: Tue Apr 30, 2019 5:10 pm
Posts: 6
You need the use recover file feature, simply go to game files select recover what you want.


Top
   
PostPosted: Wed May 01, 2019 12:48 am 

Joined: Fri Apr 26, 2019 9:32 pm
Posts: 6
I'm glad my success has been replicated :)

Yes it's easy to copy the files with R-Studio. I run my pc using 3 partitioned o/s's (all win 10) the first is my main... let's call it "work" os and the third is for my legit stuff (games) so I'm using RStudio in my "work" os to copy from the legits o/s to another drive. Just to avoid messing up stuff.

As for opening/editing... no the zip cannot be extracted. I suspect because of encryption. I have tried ForzaStudio which has so far been able to extract the .zips from previous titles.

here's my 2 files. https://www34.zippyshare.com/v/wV4KoisM/file.html


Top
   
PostPosted: Wed May 01, 2019 1:43 pm 

Joined: Mon May 28, 2018 10:23 am
Posts: 10
Still has EFS encryption, just without perms restricted user-access anymore. But this step one, progress is being made.


Top
   
PostPosted: Wed May 01, 2019 11:37 pm 

Joined: Fri Apr 26, 2019 9:32 pm
Posts: 6
I've just done some comparisons:

ctrl-c vs my AUD_RS2_95.zip.$efs - same file size, last 16 bytes are different (offset(h)-86)

My AUD_RS2_95.zip.$efs vs my REN_5Turbo_HE_80.zip.$efs - same file size, last 40 bytes different starting offset(h)-6E


Top
   
PostPosted: Wed May 08, 2019 1:37 am 
User avatar

Joined: Tue Apr 30, 2019 5:10 pm
Posts: 6
Looks like Potato_of_Doom manage to dump the game, I'm not sure how he did tho.

Here is the a car file without EFS.

https://www13.zippyshare.com/v/LFONAlvO/file.html


Top
   
PostPosted: Wed May 08, 2019 1:51 am 

Joined: Fri Apr 26, 2019 9:32 pm
Posts: 6
Yea there's a dump going around but I understand it's from pre-release or demo that didn't have the updated efs/uwp and as such is missing a lot of cars.


Top
   
Display posts from previous:  Sort by  
Post new topic  Reply to topic  [ 28 posts ]  Go to page 1 2 Next

All times are UTC


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Powered by phpBB® Forum Software © phpBB Limited