Leaderboard

Author: Myro Scope: Educational & research-oriented reverse engineering Status: Ongoing research Introduction: This thread documents an ongoing technical research project focused on analyzing the MPK container system used by Where Winds Meet (WWM). The goal is to understand the structure, behavior, and data flow of the game’s asset containers from a reverse-engineering and archival perspective, strictly for educational and analytical purposes. No proprietary assets, binaries, or tools will be distributed as part of this work. 1. Patch*#.mpk vs Resource*#.mpk — Structural Similarity, Semantic Differences At a container level, Patch#.mpk* and Resource#.mpk* share the same base format: Indexed via mpkinfo / mpkdb Entries contain: FileID Size Offset MpkIndex Use the same compression stack: LZ4 / ZSTD / LZMA EZST (AES-encrypted) However, despite this structural similarity, their extraction semantics differ significantly. 2. Patch*#.mpk — Partial Transparency, Direct Asset Access Patch MPKs behave primarily as delta / override containers: Assets retain near-original offsets Internal file structures remain largely recognizable Minimal indirection compared to Resource MPKs As a result: ~99% of audio assets can be recovered successfully A subset of Lua scripts becomes readable after decompression Non-audio assets (including some images) are present and partially accessible Testing on Patch3100.mpk confirmed that Patch archives are not limited to sound assets. Conclusion: Patch MPKs prioritize update efficiency and fast access, with limited transformation of payload data. 3. Resource*#.mpk — Indirection and Shared Data Resource MPKs represent the primary asset pool and introduce several additional complexities: The Size field often represents a logical or expanded size, not the physically stored payload Naïve extraction pipelines tend to: materialize padding and alignment blocks duplicate shared data blobs inflate archive size artificially (e.g. ~2 GB → tens of GB) This behavior explains why Resource MPKs appear far more “opaque” when extracted without validation. Important observations: Fixed headers such as 02 02 02 01 … frequently represent logical structures (e.g. texture containers with multiple mip blocks) Headers of the form size (4 bytes) + size × 20 bytes often describe lookup tables, not standalone assets Many assets are shared, aliased, or referenced indirectly Conclusion: While Patch and Resource MPKs share the same container format, they do not share the same extraction semantics. Resource MPKs require strict validation, deduplication, and asset-type verification to avoid false positives. 4. Audio Extraction & Tooling Initial testing with Ravioli Game Tools proved sub-optimal for this pipeline: Inconsistent parsing of Patch audio assets Unreliable WAV output in multiple cases Switching to vgmstream yielded significantly better results: Correct parsing of recovered audio data Clean, fully functional WAV output Proper handling of codec structures Current result: Audio extraction and conversion are fully verified and stable. 5. Resource.mpk Extraction – Current Progress Testing on Resources49.mpk (~740.9 MB) produced the following results: Successfully extracted: Audio assets → converted to valid .wav files Over 8,500 audio files identified in a single Resource MPK Video files (.mp4) → fully playable Lua scripts (.lua) → extracted but still encrypted / obfuscated Unresolved: Files detected as images (.png, .jpg, .bmp) Headers contain the string “messiah” Strongly suggests custom packing, encryption, or misclassification Currently not valid image data despite file extensions 6. Current Status ✔️All Patch*#.mpk, Resource*#.mpk, and lt*.mpk archives can be unpacked ✔ Audio assets fully recovered and validated ✔ MP4 video assets fully playable ✔ Lua scripts extracted but not yet readable 7. Next Steps Ongoing research will focus on: Reversing additional transformation layers in Resource*#.mpk Identifying: secondary encryption stages compression chaining block or stream reordering Investigating the custom image container format Further analysis of Lua encryption / obfuscation Automating Patch vs Resource handling as two distinct pipelines Notes on Tooling & Distribution All tools used in this project are: developed entirely from scratch created specifically for WWM research used strictly for educational purposes At this stage: no tools, binaries, or scripts will be released no proprietary assets will be redistributed Closing This thread is intended solely as a technical research and documentation log, not as a release, redistribution, or exploitation guide. In accordance with applicable intellectual property laws and forum policies, no tools, binaries, scripts, or extracted assets will be posted or shared, either publicly or privately. All game data, assets, file formats, and related materials discussed here remain the exclusive proprietary property of NetEase and the developers of Where Winds Meet. Any references to assets or file structures are made strictly for educational, analytical, and research purposes, with no intent to enable misuse, circumvention, or redistribution of protected content. Should any concerns arise regarding compliance or scope, I am fully open to cooperating with forum moderation and adjusting the visibility or content of this thread accordingly. Thank you for your understanding and for supporting responsible technical research. — Myro Below are a few illustrative screenshots and log excerpts from the current stage of the research, provided solely to contextualize the findings outlined above.

I have released an early version of the tool that can do just meshes with their material names/skeleton:

I Finally got materials and textures to load dynamically, so far only works on Conker will have to work in some tweaks to support other models

We are currently testing whether we can retrieve character IDs from the database and read all related data

Apparently there is a bug with Default Berri's hair Fur Shells are currently merging her Hair and Body material, due to an oversight in how the shells are drawn, getting a fix done now EDIT Here's the updated script RBMimport_12.py

Here is the newest version most animations should work, I haven't tested everything yet added a search bar to make it easier to find assets you have loaded I tried to speed up the animation loading, but I don't think there is a real way to do it at this moment unless I worked on the memory stuff, right now its decrypting each frame, then keyframing it, so they can take about 3 to 4 minutes if you want to load another animation, its better to just refresh the scene, current bug is that the animation unloader has some memory cache'd for a few bones that I haven't been able to quash yet. sometimes the clear animation buttons works though I'm currently working on another Conker project, if that goes anywhere then I'll announce it here RBMimport_12.py

Movement now works Here is the new script RBMimport_12.py Whats new Script will create custom materials based on shader, for example, Conker will now have proper material setups for his eyes and fur Fur support Animation support: currently only Conker's animations work from the Anims/Conker/default.rbm file to import an animation load model settings must look like this to work find animation rbm *Anims/Conker/Default.rbm* select the animation you want wait for it to process (Can be slow due to printing debug logs)

just to update everyone, I've gotten close, I had to scrap what I was doing multiple time, and decided the only way to get the animation to properly import is if I mirrored the stack building exactly, which I've seemingly accomplished, now the new issue is, I need to fix the skeleton's orientation upon import, because even though the animation pose imports, Conker looks dead this animation is the stance clip, used for his idle animation as you can see, once I fix the bind pose on the imported models, it should allow for the animation to be positioned correctly

Let the SLPS in the same folder of out2.car and use this script below in quickbms selecting out2.car #Konjiki no Gashbell extractor by Rabatini open FDSE "SLPS_254.40" 1 get ARCHIVE_SIZE asize 0 get SLPS_SIZE asize 1 set BASE_LSN long 311 set VADDR_BASE long 0x247A80 set FILE_BASE long 0x148A80 set SCAN_START long 0x001000 math SCAN_END = SLPS_SIZE math SCAN_END - 0x1c set FOUND long 0 for POS = SCAN_START < SCAN_END goto POS 1 get NAME_PTR long 1 get TAG long 1 get LSN long 1 get SECTORS long 1 get ALLOC long 1 get SIZE long 1 get FLAGS long 1 if TAG == 0xFFFFFFFE math EXPECT = SECTORS math EXPECT * 0x800 if EXPECT == ALLOC if SIZE > 0 if SIZE <= ALLOC math OFFSET = LSN math OFFSET - BASE_LSN if OFFSET >= 0 math OFFSET * 0x800 math END_OFF = OFFSET math END_OFF + SIZE if END_OFF <= ARCHIVE_SIZE set DUP long 0 for J = 0 < FOUND getarray OLDLSN 0 J if OLDLSN == LSN set DUP long 1 break endif next J if DUP == 0 putarray 0 FOUND LSN math FOUND + 1 string NAME p= "files/%05d_%08x_%08x.bin" FOUND LSN SIZE # tenta resolver o nome pelo ponteiro da entrada math NAME_OFF = NAME_PTR math NAME_OFF - VADDR_BASE math NAME_OFF + FILE_BASE if NAME_OFF >= 0 if NAME_OFF < SLPS_SIZE goto NAME_OFF 1 getct TMP string 0x00 1 if TMP != "" string NAME = TMP endif endif endif log NAME OFFSET SIZE 0 endif endif endif endif endif endif endif # o for adiciona +1 no next, então aqui somamos +3 = passo real de 4 bytes math POS + 3 next POS Konjiki no Gashbell extractor by Rabatini.zip

Hey there people! I've been lurking these forums for years now, Zenhax and Xentax as well, but haven't shared my tools (mainly because there were already working solutions from other people). This whole community is about sharing your knowledge and tools (and I know some people who have tools for other games, but won't share it with the community). Because I've just created a working solution I'd thought it would be best to share it with you guys. This would be my first post here, but don't let that distract you 🙂 HOW IT WORKS: 1. First you need to open your GMAIL account and open a Google Colab page ( https://colab.research.google.com/ ). 2. Click on the "New Notebook" option. 3. You'll see a folder that contains files, click on it! You'll have to wait a few seconds before it connects to the server. 4. Once you see the file structure (like the "sample_data" folder), drag and upload your original "gameresources_patch1_pc.resources" and your modified "strings" file there. 5. If it's done, then on the top you can see a console with a play button. Insert the whole script I've sent you, then press the Play button. 6. After a few seconds the console / log on the bottom should say that it's finished, and on the left you'll see a file called "NEW_gameresources_patch1_pc.resources". 7. Download that file and insert it into your game folder, renaming and replacing the original one (make sure you create a backup of it). 8. Run the game and it should work with your new strings. EDIT: My script targets the English language files and replaces the strings there. If you want to replace another language's files (maybe because of the fonts), you can update the script's eb value. EN_US (original): eb = 0x3D858 AR_SA: eb = 0x3D8E8 DE_DE: eb = 0x3DA98 ES_ES: eb = 0x3DB28 ES_MX: eb = 0x3DD68 FR_FR: eb = 0x3D978 IT_IT: eb = 0x3DA08 JA_JP: eb = 0x3DCD8 KO_KR: eb = 0x3DFA8 PL_PL: eb = 0x3DC48 PT_BR: eb = 0x3DDF8 RU_RU: eb = 0x3DBB8 ZH_CN: eb = 0x3DF18 ZH_TW: eb = 0x3DE88 Have fun! EDIT 2: I've updated my script, so it will automatically download the file with the correct name once it's done patching it, and also I've created a patcher for the PS5 version (since the original tool was only working for the PC version). Note that the entries differ for the PS5 version, so you can't use the above "eb" values for it! script_ps5.py script_pc.py

Modding tools in progress (details in discord, forum thread will be created later). The first ever custom model in DS2. Extracted from the game, modified, and put back into it.

I've updated my browser to include ChaCha20 stuff by Lazorr. Seems to work fine, but i guess once he updates his gui (currently it's even worse than this here :P), mine won't be needed anymore. Let's GO!!! 😄 Crimson Browser3.zip

We are currently rewriting the code to support all animations.

I've been so busy at work lately, but here is the version with fixed material batching RBMimport_noAnimation5.py

Here is an updated version of the script What Changed: Added shader type detection Specular textures will now correctly pipe into the specular node Textures with a Cutout Alpha now correctly pipe into the alpha channel Fur is currently being worked on Added more attributes to the model Vertex Color is now supported Fur Length is now being collected (not fully implemented yet) Fixed an issue where some models never importing textures or materials I'll also update the original script post EDIT I'll be updating it again soon, appears some models have separate specular textures rather than them just deriving from the alpha, mostly the Barn_outside models RBMimport_noAnimation2.py

I'm trying my best to make it load somehow

There are at least two types of i3d file formats, used within the .i3d files used in ape escape 3 and Rule of Rose uses .i3d files in .mdl files. I3D_BIN: Mesh ✔️ Bones ✔️ Skin ❌ I3D_I3M: Animation ❌ Tools: https://github.com/Durik256/Noesis-Plugins/blob/master/fmt_i3dg.py - Supports meshes. fmt_RuleOfRose_PS2__i3d.zip - Supports bones (made by Bigchillghost from xentax, reuploaded into reshax for quicker accessibility)

I forgot all about this thread, I have skin weights imported, and level support

New Version of TASM 1+2 Tools Audio is now sorted/named Also sorted into languages.

Looking to see if anyone is interested in this, 3D models/geometry isn't exactly my strongest skillset (which I'm sure you will soon notice). I was originally inspired by an old thread on Xentax for other Rareware games (primarily Grabbed by the Ghoulies) however Live and Reloaded seemed to get skipped over since no one could figure out the compression the game was using. Fast forward a few years and i learned that Xemu had a debugging feature with support for IDA which is a tool I'm fairly familiar with, using this i was able to extract the x86 assembly instructions the game uses to decompress the game assets and write a wrapper for it allowing me to unpack the files to a state similar to what's used in other Rareware titles. You can check out that tool here: https://github.com/birdytsc/clr_unpack I'm currently in the process of reversing the games model format but my limited experience with 3d models/formats is hindering my progress. While some of the data is pretty straightforward to obtain some are packed away in pushbuffer instructions, one example is the tri's/faces data: This makes it a little more annoying to tell what set of vertexes they belong to but they are (so far) stored in order that you will find any vertex data one problem i am having is im not sure whether im extracting the data properly, example: the first part for conkers main model is broken into 3 sets of triangles all sharing a single set of vertexes, uv's etc. the model only looks correct if i separate the 3 sets of tri's into there own mesh, keeping them together creates artifacts: Another issue im having is Texture alignment, the game stores the textures as raw DXT data (usually DXT1 or DXT5) even in simpler models that only consist of a single set of triangles im still having alignment issues, for example: Perhaps this is a sign that there is indeed an issue with how im extracting the Tri's? If anyone wants to play around with this stuff ive included some files in the zip: aid_bfdmodel_characters_conker.py - a script for ModelResearcherPro that will load the verts/tris for the main conker model retail_aid_zpackage_general_singleplayer.rbm.listfile.csv - list of file names (if they havnt been stripped from the asset packer) and offsets retail_aid_zpackage_general_singleplayer.rbm.unpacked - just the decompressed version of the file found in the retail game retail_aid_zpackage_general_singleplayer.rbm.unpacked.mapped - same file as above but after its had a bunch of pointers mapped, useful for diffing against the original to find pointers. retail_aid_zpackage_general_singleplayer.rbm.unpacked.mapped.hexpat - imhex pattern file for the previous file. conker_stuff.zip

got the poses to actually work, the blocker was a stupid piece of debug code I didn't notice was causing the orientation to flip when baking to the skeleton

Here is experimental version of dump tool for full version of Battlefield 6. (attached in the end of this post) For almost a whole year now since beta versions it was possible to use my set of tools to get ANY files from it, be that beta or full version. The only problem was "update" folder that was not supported as it is. To get it dumped, you had to move files from update folder to data folder. Each subfolder inside "update" has "data" inside, and you have to move contents to main "data" folder. It does not overlap and work as intended. Now i made this new version which must scan update folder and add data from it. Important change of .INI file is that now game path must NOT include "data" in the end: C:\games\bf6 D:\dump all After dumping, you can use same set of tools from here: bf6_update.7z

good news is I now got animation poses showing correctly Bad news, I need to fix the bind pose for the imported armature

I got the initial pose to show decent, still some areas where the rotation isn't exactly right, mostly the limbs,

Here you go - plugin for Blender 5.0 Imports meshes, skeletons, animations and textures Some animation files may fail to import (could not figure it out) io_scene_until_dawn_demo.zip

Syberia_II_rle.py

Thank you, with this I was able to put the image ImageHeat (see first image) and export it as a .png, and after modifying the .atlas to read the .png, I was able to lead the animation in my Spine Viewer However, he looks weird, with most of the problems around the edges (like his collar or his eyes), which may have something to do with the outline that I think is in "rim-DEFAULT." However, I can't seem to figure out a way to export the texture from rim properly. kermit.zip

Right, sorry, I didn't notice that you read them as half floats. Here is the updated plugin. Note that Noesis will hide parts of the mesh in the preview unless you change the blend mode from "Alpha + alpha test" to "None" with F11. fmt_juiced2_d9m.py

looks like somebody managed all already? need to test though https://www.nexusmods.com/crimsondesert/mods/62 Crimson Desert Unpacker

I've fixed pngs and added reimport (only smaller or same size files without compression etc. for now) and it surprisingly worked first try 😄 Will update later.

Based on MrIkso’s research, I had Codex slap together a basic browser that can display various file types and includes a few extra bonus features. It also properly decompresses LZ4 files, but don’t get your hopes up when you see the crimson_chacha20_key.hex file... that’s only useful if someone manages to extract the actual key from the executable or from memory. I’ve also included vgmstream-win in the folder so you can preview the game’s audio files, which was my main goal anyway 😛 Just adjust ARCHIVES_PATH = r"D:\SteamLibrary\steamapps\common\Crimson Desert" in the Python file so it points to your game directory and the tool can find the archives. It may look like the program is hanging on startup, but it’s actually busy parsing everything, including its best guesses at the folder structure. Give it a minute or so... Run it with: python crimson_browser.py You might need to install a few dependencies first via pip. Crimson Browser.zip

Here's a quick little texture extractor for blender import a map, or model open, or paste the script in the script editor edit the output path to where you want them to go press run script all textures currently in your scene are exported refresh the scene if you want to keep the textures tidy you will have some missing textures, because I forgot to reimplement the extra textures stored inside the texture handles, it will get reimplemented soon batch_imgextract.py

Try the attached script for XMF files. I also adjusted the XCF script to read the triangles strips a bit differently, though both mesh types still have some random edges. There were also some DX textures in the level archive, so I added support for them to the XTF script. fmt_fight_club_xcf.py fmt_fight_club_xmf.py fmt_fight_club_xtf.py

The attached Noesis plugin should work on the .xtf textures. The colours might still need some tweaking, as they look a bit greyed out. The section after the header might be a colour palette, though I don't know how to parse it. fmt_fight_club_xtf.py

HAPPY NEW YEARS, and to you Uber, thanks for the script man. HAPPY HOLIDAYS!

This looks correct. The palette is RGB5551, but is swizzled with the same method as the image (not the standard PS2 palette shift). Patrick should be able to confirm if that can be added to ImageHeat as a palette swizzle option.

I don't know if there are more models in that unpacked folder, you need to check that so examine each file there. Just remember that characters use shorts in vertices buffer, I think I saw other file with floats but maybe that file is not a character or maybe it is but with floats, I really don't know, lol. Here is the script if you want to test it: fmt_black_ps2_prototype_DB.py

I've just released new version of ImageHeat 🙂 https://github.com/bartlomiejduda/ImageHeat/releases/tag/v0.39.1 Changelog: - Added new Nintendo Switch unswizzle modes (2_16 and 4_16) - Added support for PSP_DXT1/PSP_DXT3/PSP_DXT5/BGR5A3 pixel formats - Fixed issue with unswizzling 4-bit GameCube/WII textures - Added support for hex offsets (thanks to @MrIkso ) - Moved image rendering logic to new thread (thanks to @MrIkso ) - Added Ukrainian language (thanks to @MrIkso ) - Added support for LZ4 block decompression - Added Portuguese Brazillian language (thanks to @lobonintendista ) - Fixed ALPHA_16X decoding - Adjusted GRAY4/GRAY8 naming - Added support section in readme file

Actually the LZSS provide above, is wrong, for the files. I did the reverse enginner of the algorithim, Try the tool, see if the image get right TenchuWoH_DeCompressor.zip

So I was wrong, Conker's Eyes don't rely on a shader to make them look correct, the eyes have 3 UV channels for the Pupil, Highlight, and the Eye Lids. I just recently implemented the Multi UV Channel support

Those BSTEX files are just containers for PS Vita GXT image files. Here's a file format https://rewiki.miraheze.org/wiki/GXT_Image If you remove manually 32 bytes from BSTEX file in hex editor and change file extension from BSTEX to GXT, you will be able to open them in Scarlet. Unfortunately PVRTII4BPP is not supported by Scarlet, so you will be able to convert only BC/DXT textures this way. While doing research on your samples, I discovered that ImageHeat had a bug while unswizzling 4bpp PS Vita textures. I fixed this bug in v0.26.3, so you can use this version (or newer) to properly view PVRTII4BPP textures:

N64 logo and Rareware logo work aswell, forgot to test them

I got meshes with multiple materials to properly import their materials, aswell as finally implementing vertex normals for example Neo Conker has two materials for his body mesh, the hands and jacket, originally it was only importing the jacket texture for the full mesh

public static Byte[] iDecrypt(Byte[] lpBuffer) { Byte bTemp = lpBuffer[lpBuffer.Length - 1]; for (Int32 i = 0; i < lpBuffer.Length; i++) { bTemp = (Byte)(lpBuffer[i] ^ (87 * i + 85)); lpBuffer[i] = (Byte)(bTemp ^ 0xAA); } return lpBuffer; } Just drag and drop those dat files🙂 IKV.DatDecryptor.zip

Well so here's everything I know so far. Models are pain. Can't figure out monstrous table which has info about buffer id, vertex count, index count. I output only element buffers. I only know about vertex buffer. At cars they are mostly 8 bytes stride, int16 data type. Not sure what are others buffers. But they have type id. Textures on the other hand are simple. You can get pretty much all of them. I also looked into the sound files. Some are wav, but most of them are unexplored... need some time to research. Also those wav files are named by id which is described in track_table file which is also unexplored yet... So here's bms script. You can use it on any file from *.pack file which you can unpack with 7Zip. And here's Noesis for *.jtex files. from inc_noesis import * import noesis import rapi import os def registerNoesisTypes(): handle = noesis.register("Asphalt 9 Legends - Texture", ".jtex") noesis.setHandlerTypeCheck(handle, noepyCheckType) noesis.setHandlerLoadRGBA(handle, noepyLoadRGBA) noesis.logPopup() return 1 def noepyCheckType(data): bs = NoeBitStream(data) if len(data) < 20: return 0 return 1 def noepyLoadRGBA(data, texList): bs = NoeBitStream(data) baseName = rapi.getExtensionlessName(rapi.getLocalFileName(rapi.getInputName())) TextureWidth = bs.readUShort() TextureHeight = bs.readUShort() bs.read(1) PixelFormat = bs.readUByte() BufferSize = bs.readUInt() data = bs.readBytes(BufferSize) if PixelFormat == 34: print("Pixel Format > BC7 ", PixelFormat) elif PixelFormat == 35: print("Pixel Format > BC6H ", PixelFormat) elif PixelFormat == 36: print("Pixel Format > BC5 ", PixelFormat) elif PixelFormat == 5: print("Pixel Format > RGB8", PixelFormat) elif PixelFormat == 6: print("Pixel Format > RGBA8", PixelFormat) else: print("Unknown Pixel Format > ", PixelFormat) if PixelFormat == 34: data = rapi.imageDecodeDXT(data, TextureWidth, TextureHeight, noesis.FOURCC_BC7) texFmt = noesis.NOESISTEX_RGBA32 elif PixelFormat == 35: data = rapi.imageDecodeDXT(data, TextureWidth, TextureHeight, noesis.FOURCC_BC6H) texFmt = noesis.NOESISTEX_RGBA32 elif PixelFormat == 36: data = rapi.imageDecodeDXT(data, TextureWidth, TextureHeight, noesis.FOURCC_BC5) texFmt = noesis.NOESISTEX_RGBA32 elif PixelFormat == 5: texFmt = noesis.NOESISTEX_RGB24 elif PixelFormat == 6: texFmt = noesis.NOESISTEX_RGBA32 texList.append(NoeTexture(rapi.getInputName(), TextureWidth, TextureHeight, data, texFmt)) return 1

The tool you mentioned does not work with single-line JSON files. I wrote this tool for you, so give it a try. Let me know if you encounter any problems. Single Line Dialogue Editor.rar

This seems to indicate that it's a matter of how the triangle strips are generated automatically. Speaking for me only I never saw this issue. Holes, yes, but bigger ones, not these "one-face-holes". There should exist scripts to fix this. (I'll check meshlab for such a feature when I'm back to office.) edit: well, the feature Filters > Remeshing, Simplification and Reconstruction > Close Holes does increase the holes. So it not meant to be used with one-face-holes, seems. Blender, Non-Manifold operator Works with v2.79 (disadvantage see pictures) That's too less. For character models there must be other indicators (material IDs, vertex groups, whatever) to group vertex blocks together.