Leaderboard

Hello. I would like to share with you my private tutorial links collection. These are useful topics from Xentax, Zenhax and any other reverse engineering related sites that I was able to find in the Internet. I have put them into categories. You may encounter situation when one tutorial fits to few categories, but it is placed only in the category that it fits most. Also, you may encounter tutorials with "[PL]" mark, these are tuts in Polish language. If you don't understand this language, just skip them. Also be aware that I haven't read/watch some of these tutorials yet, so I can't recommend you which tutorial is the best choice, sometimes I'm still learning new things just like you and on this list you may find tuts that are not very useful for you, so don't blame me for that. 🙂 Just pick your favourite category and start learning. If you are complete newbie, I would recommend to start with tuts from category "Basic knowledge". If you have any other good source of knowledge, you can write a comment below and I will update this tutorials collection. Also remember that those links may be dead some day, so don't blame me for that and just make a copy for private use 🙂 So that's it. Enjoy. 😄 Links to tutorials: Basic knowledge (you should start with these if you are new to reverse engineering) - Definitive Guide To Exploring File Formats - Beginner Learning Materials on Reverse Engineering Video Games - What is a File Format? - Analyzing and Reverse Engineering a Game Archive - Key points to successful hex reading - Overview of game file formats and archives - REWiki - Reverse engineering hints - HOWTO-Reverse Engineering - How to translate a ROM QuickBMS - [TUTORIAL] What is QuickBMS? How to export and import with QuickBMS? - QUICKBMS GUIDE - QUICKBMS GUIDE 2 ZLIB - QUICKBMS GUIDE 3 IF ELSE - Basic BMS Scripting - QuickBMS documentation - QuickBMS crc engine - QuickBMS - Reimporting files in the archives - QuickBMS - Scan all the supported compressions - Example of archive format reversing with QuickBMS (medium) - Practice with archives and quickbms scripts - [TUTORIAL] Making BMS Scripts MultiEx scripting - MultiEx Commander Manual - MultiEx Commander 4.5 YouTube tutorials - MexScript Documentation - Let's MultiEx Encryption tutorials - How to guess basic obfuscations: xor and sum/rot - Reverse simple decryption - Reversing AES Keys UE4 + AES Keys Collection - How To Get PAK RSA Key (Wolcen / CryEngine Games) - Retrieving ZIP passwords from games - the zero skills way - Retrieving ZIP passwords from games - the debugger way - Retrieving ZIP passwords from games using plain-text attack - Hacking Zip Passwords (C9) - Checksum / CRC scanning - Decrypt any vita game (no custom firmware needed) - How Unpack Themida 2.x.x or How Unpack Themida 2.x.x (WXP) - SM Hasher / Murmur3 hash + Wiki + Python implementation - LCG + sources + Cracking LCG + LCG in VC2 - Decrypt unity 3d files with Frida - [Tutorial] How to get Allegro passwords Hash tutorials - [Tutorial] How to restore hashed filenames from archives Compression tutorials - How to recognize the compression algorithms with your eyes - LZMA SDK (binaries + source code + specification) + LZMA Wiki - Bc7 and bc5 decompression and compression - Offzip - deflate/zlib scanning and extraction - ZSTD compression + documentation - Reverse Engineered old Compression Algorithm for Frogger - Oodle Data Compression + Oodle compressor + Oodle wiki page - RLE Compression explained + RLE Wiki + RLE in Python - LZ77 explained + LZ77 encoding + LZ77 decoding + LZ77 in Python - LZSS Compression + LZSS explained - LZ Compression + Open-source LZ Compressors Debugging / Decompilation / Disassembling - Lenas Reversing for Newbies - Reversing Spider-Man 2000 - Real World Decompilation with IDA Pro - IDAPython conditional breakpoints - The Beginner's Guide to IDAPython - Using IDAPython to Make Your Life Easier Part1 + Part 2 + Part 3 - Reverse Engineering with Ghidra - How to Reverse Engineer with IDA Pro Disassembler - How to reverse engineer functions - Debugging “Dust: A Tale of the Wired West” - Reverse Engineering Dust: Uncovering Game Scripts - Reverse Engineering an Xbox360 Game - Reverse engineering C programs - bin 0x10 - Memory Hacking — External Signature/Pattern Scanning Tutorial - Remote Debugging with IDA Pro (Windows) + Connecting host with VirtualBox - Remote Debugging with IDA Pro (Linux) - Basic IDA Python Scripting Hooking / DLL Injection - Simple C++ DLL Injector Source Code Tutorial - Quick and EZ - Dll Injection Explained (how it works + source code) - Manual Mapping DLL Injection Tutorial - Blizzhackers DLL Injection - API Hooking and DLL Injection on Windows - [PL]ReverseCraft #7 - Inline hooks, DLL injection - [PL]DLL INjection by Maciej Pakulski (PDF) - C++ Detour / Hooking Function Tutorial - [Tutorial] The different ways of hooking - API Hooking with MS Detours + MS Detours 4.0.1 description + source - Hooking tutorials - Inline hooking in Windows - C++ Internal Trampoline Hook Tutorial - OpenGL Hook - MinHook - The Minimalistic x86/x64 API Hooking Library + source on github - DLL Hijacking - [Tutorial] Simplest function hooking with IDA, Detours & C++ - [Tutorial] DetourFunction __thiscall - How to Hook Functions - Code Detouring Guide - Resources About Hooking - [Tutorial] Hooking Java Functions - [TUTORIAL] Hooking Android bytecode with Frida Console Tutorials - PS2 Texture Swizzling - PS1 LibCrypt tutorial + LibCrypt Sectors Mappings + LibCrypt Bible - Gears: A look Inside the Final Fantasy VII Game Engine - Convert Ps3 to Debug 4.21 - Extract Samples and MIDI files from Square PS2 Games - Extracting Xbox 360 game files - Reverse Engineering Xbox360 SaveGame (Dead Space) - Extract + Decrypt 3ds Roms - [HOW-TO] Assembling 3DS Homebrew for Gateway - [Tutorial] How to Decrypt, Extract & Rebuild 3DS|CIA|CXI Files - PS2 Hidden files + this + this + this + IsoBuster + Ratchet and Clank PS2 discoveries + Ratchet and Clank Hidden files extractor + this - PS2 Modding Tutorials + PS2 Modding Tools + PS2 AIO Project - [TUTORIAL] [PS2DEV] An Introduction to PS2DEV and it's History - Racing Lagoon Hacking Deep Dive (Translating PS1 games - tutorial) DOS Tutorials - DOS games reverse engineering guide - DOS file formats / encryptions / compressions etc. - DOS game "Nomad" (1993) documentation and tools Audio - The basics of VGM ripping + VGM Ripping Tools - Common Sound Formats - How to scan audio codecs with ffmpeg - Tutorial on vg-resource - Extract Binary Domain's Music/Sound (CRI .cpk bgm) - Batman Arkham Knight - Extract Soundtrack - Multimedia Wiki (Audio, Video, Codecs) - TXTH files documentation Graphics - Finding graphics - Graphics/Texture finders and viewers - Xentax Wiki - Image file formats - Tutorial : How to edit EA's FIFA PS2 TEXTURE Source code + documentation - PS1 BRender Engine (Harry Potter 1, Harry Potter 2 etc.) - PS1 BuggyBunny (Bugs Bunny) - Python Tools Collection - KAO2_PAK + documentation - J2ME game Stalker - Soul Calibur 3 Reversing Books - Reverse Engineering for Beginners + Reverse Engineering challenges + Compiler Explorer - Game Hacking: Developing Autonomous Bots for Online Games - Reversing: Secrets of Reverse Engineering - The IDA Pro Book, 2nd Edition: The Unofficial Guide to the World's Most Popular Disassembler - Mastering Reverse Engineering - Practical Reverse Engineering - [PL]Gynvael Coldwind Praktyczna inżynieria wsteczna - [PL]Asembler. Sztuka programowania 3D Models - Approaches of Parsing Bone Representations - Noesis tutorial Basic Model - Video tutorials on model formats reversing - Make_obj (C source) - Extracting simple models - Analyzing and Extracting a Game Model - [Tutorial] How to extract bones from any games with Noesis - Sanae3D - 3D format converter - Background Knowledge of Bone Stuffs - Extract 3D models from binary files - Writing an Obj Convertor in C - [crash course] How to get multiple submeshes using Make_H2O - Very Basic model format conversion (Shaiya). - INTEL GPA mesh ripper tutorial + tool (x32,x64,DX9,10,11) - 3ds Ram Dump - [Tutorial] Exploring model formats: 9 Dragon - Noesis tutorial Zlib - Video tutorial on full model format reversing (Planetside) krystalgamer's Lair - Marvel Avengers - Writing a server emulator - Spider-Man 2000 - Save file protection - Spider-Man 2000 - Re-enabling a cheat code - Spider-Man 2000 - Save file content exploration - Spider-Man 2000 - PKR Format - Spider-Man 2000 - Custom File Loader - Spider-Man 2000 - Apple to the Rescue! Mobile (Android, iOS, J2ME) - OWASP guide - OWASP guide crackmes source code (Warning! Big spoilers!) - Beginners Guide to Reverse Engineering Android Apps - [Android] Decrypt unity 3d files with Frida - Mobile Game Asset Download - [PL]Reverse engineering mobile app (Niebezpiecznik) - J2ME Reverse Engineering Capture The Flag - Solving CTF Challenges Part1 and Part 2 - [PL]Capture the flag Tutorials playlist Other - The Ultimate Game Hacking Resource - Low-Level Programming University - 1024bar tutorial - [PL]ReverseCraft blog and ReverseCraft playlist - [PL/ENG]Modding tutorials - UE4 games texture replace - nullsecurity.org - crackmes.one - RCE Tools Library - GHB1 - Start Here Beginner Guide to Game Hacking - Ripping Tutorials - Searching text strings using Total Commander

God of War Ragnarok tool is in progress. Allows to export characters with bones/weights. It will be posted here after some testing 😉 The tool currently relies on Hitmanhimself's tool, so assets must be first exported with his tool, and then converted.

I'm still looking into the bones, trying to get them working correctly. The ones that don't work correctly yet are the models with over 256 bones, such as the one below. The vertex data only uses bytes for the indices, so it has to remap the bones into smaller groups of 0-255. They could have just used Shorts for the indices and it would have been no problem. Had a bit of success with some bones being remapped correctly, but others still not. It seems like some bones maybe aren't needed, or are used for something else. This is pl036 with some bones being moved correctly.

I'm gonna share my findings about spiderman 2, 3 and wolverine assets here. So far I made a few first tools for archives. I have a list of assets present and now comparing them. Here some examples: Heres what i found so far: Spiderman 2 (official release v1.05) has about 400k assets. And its the first game of theirs with no names in archive. But luckily we have a list of names in ... Spiderman 3 early build, which also has about 400k assets, with names, but a little different. It has about 300 new assets, and missing about 3000 old ones. So it looks like for some first tests of SM3 they removed most of the map or something, and started adding some new models and map parts. I can see it comparing the lists. Wolverine has only 39k assets built, as everybody know probably, its just a little part of new game for tests. Now i'm gonna dump some models and make tools to convert them. Progress details on discord.

I'm going to do tools for it, and release it here on reshax. I plan to support characters and maps, like it was before with FF7 remake.

First release:

Good news. Issues with missing objects and incorrect normals were fixed. Now tool is really close to release.

Did some first tests.

I'm working on a set of tools for Dragon Age Veilguard. So far, i have dump tool to extract all files, all models can be converted. Also i have fixed the usual frostbite distorted faces. Now checking if something needs to be done with unified skeleton or textures, and then tools will be published here.

This is an archive of the useful list originally from https://forum.xentax.com/viewtopic.php?t=15540, which seemed a fitting first topic for graphic file formats. Some links are broken because they pointed to internal downloads on Xentax :'(, but most work :). ------------------------------------------------------------------------------------------------------------------------ Post by ikskoks » Fri Nov 25, 2016 2:13 pm TextureFinder 1.3.2 Designed to find textures inside any uncompressed files. Any size, any pixel bit format, any binary file. It only requires that the file be uncompressed. This tool is intended to be used by researchers and developers with a good understanding of bitmap formats. VERSION 1.3.2 is the last one of this first series. Formats implemented so far: TRUE COLOUR (RGBA) FORMATS : 64bits 16x4 48bits 16x3 32bits 8888 24bits 888 16bits 565 15+1bits 1555 12+4bits 4444 08+8bits 8332 08bits 332 06+2bits 2222 PALETTE FORMATS : P8 256 colours P4 16 colours P1 2 colours QUAD FORMATS (alpha channel implemented only in series 2) : DXT1 DXT3 DXT5 TextureFinder 2.1 Newer and better version of TextureFinder. Tile Molester 0.16 Tile Molester, or TM for short, is a program that facilitates the viewing and editing of raw graphics data; that is, graphics contained in arbitrary binary files, where one usually doesn't have initial knowledge about the location and/or format of the graphics. The main area of application thus far has been videogame console binaries. In most cases, these files contain a large variety of data, not just graphics -- sound data and actual game code are two examples. Collections of data in one and the same file may be interspersed in any conceivable fashion, subject to hardware/software-constraints of the intended runtime-environment as well as the decisions made by the producers of the binary (the developers). TM is a kind of visual explorer of such files, in that it allows the file contents to be interpreted and displayed in a multitude of ways. By perusing the file and tweaking the settings of the renderer, the binary data that corresponds to graphics may be made accessible in the way they are intended, and edited to the satisfaction of the user. TiledGGD 2.0.3.0 A generic graphics dumping tool, based on the elusive program GGD TiledGGD - basically it’s GGD (General Graphical Dump tool), with some extra features: Currently working (extra) features: * Support for tiled graphics (tiles of any size) and palettes (tile sizes are restricted, because they need to fit a 16*16 grid) * Copy visible graphics and palette directly to clipboard * ‘Go To Offset’ functionality * Toggle Endianness of graphics and palette separately * Save the entire graphics * Built-in NCGR/NCBR and NCLR support (I’m not using all the data from the files, so there are most likely still some bugs) * Lua plugin support DOWNLOAD TOOLS If you know any other useful programs to search for graphics in files, you can share here. 🙂 ------------------------------------------------------------------------------------------------------------------------ Post by ikskoks » Sun Jun 18, 2017 3:39 am Rainbow is a tool intended to convert different graphics formats from video games assets to and from user editable images (like png). It currently supports almost every variant of the TIM2 format. The main difference with other great tools like Tile Molester and Crystal Tile 2 is to provide direct support to proprietary graphics formats found in "new generation" consoles, like PS2, PSP, Wii, etc., instead of dealing with just the raw image data. Features The underlying image library has almost complete support to TIM2 texture files usually found in PS2 and PSP games. The app supports multi-layer, multi-clut, swizzled (PSP)/unswizzled TIM2 images with both linear, interleaved palettes, and segments headers eventually extended with custom user data (usually used by programmers). Can open textures in any format supported by the underlying image library. Can open whole folders in search of supported texture formats. All known texture files are then displayed in a list. Can export and import textures in suitable image formats for editing (like png). Any additional information specific to the texture is preserved when exporting/importing (like the TIM2 header data), in order to have a one-to-one correspondence with the original texture. Customizable background color for transparent and semi-transparent images with chessboard like pattern. Finally, Rainbow supports parameters via command line: the first parameter is the name of a texture you would like to open. DOWNLOAD Console Texture Explorer (PSP/PS2) is an application that allows working with PSP and PS2 textures. It helps to minimize manual work during texture resources manual scanning and graphics data research in raw archives. Version: 1.0b Designed and made by: Dageron Year: 2012 ====== Supported platforms: PSP and PS2 Supported formats: any texture dictionaries with 4bpp/8bpp graphics data DOWNLOAD ------------------------------------------------------------------------------------------------------------------------ Post by ikskoks » Sun Jun 03, 2018 7:04 am Raw texture previewer/converter Download here: viewtopic.php?f=18&t=16461 ------------------------------------------------------------------------------------------------------------------------ Post by ikskoks » Mon Jul 16, 2018 2:28 am PVRTexTool Download: https://community.imgtec.com/downloads/windows-installer-powervr-tools-and-sdk-2018-r1/ ------------------------------------------------------------------------------------------------------------------------ Post by ikskoks » Mon Aug 10, 2020 7:29 am Cheat Engine - Graphical Memory View CHEAT ENGINE DOWNLOAD ------------------------------------------------------------------------------------------------------------------------ Post by ikskoks » Tue Sep 08, 2020 11:52 am AMD Compressonator --> https://gpuopen.com/compressonator/ https://github.com/GPUOpen-Tools/compressonator ------------------------------------------------------------------------------------------------------------------------ Post by ikskoks » Wed Oct 21, 2020 11:35 am Some new tools are listed here --> https://tcrf.net/Help:Contents/Finding_Content/Finding_graphics ------------------------------------------------------------------------------------------------------------------------ Post by ikskoks » Tue Dec 15, 2020 6:01 am RAW pixels viewer This application allows you analyze raw image data, you can display memory dumps of frame buffers, video buffers and uncompressed video files. Play with image parameters below to explore world of colors. https://imgur.com/a/ZJQtO8B http://rawpixels.net/ ------------------------------------------------------------------------------------------------------------------------ Post by ikskoks » Thu May 20, 2021 10:32 am TileShop and ImageMagitek TileShop is a WPF application for Windows that implements ImageMagitek and allows end-users to manage specialized graphics in a modern GUI environment. ImageMagitek is an internal .NET library written in C# to view, edit, and organize common and complex retro videogame system graphics. Emphasis is given to the features most valuable to the common, cumbersome tasks when encountering graphics embedded within binaries without any distinguishable headers or identifiers. Exporting and importing is supported to allow advanced editing features to be performed in third-party image editors that operate on standard PNG. https://github.com/stevemonaco/ImageMagitek ------------------------------------------------------------------------------------------------------------------------ Post by th3ru » Sat Jun 05, 2021 11:33 am Raw Image Viewer module of Kuriimu2. + live preview as you change parameters. - no drag&drop, to be launched from K2, extracts only to png. https://github.com/FanTranslatorsInternational/Kuriimu2 ------------------------------------------------------------------------------------------------------------------------ Post by ikskoks » Thu Nov 04, 2021 12:25 pm Mumm-Ra's Game Graphics Tool Download: old version -> https://drive.google.com/file/d/1ZeRQcU-cqOO5gdRGV_kgvsrq_jBoCFgH/view?usp=sharing version 96 -> https://drive.google.com/file/d/1kw1YVDzPATMCS5fZYDTiPwosqhGjVpmO/view version 100 --> https://drive.google.com/file/d/1mc8gGTt_O7HpcthqXQfEc30TgV_2f4ze/view ------------------------------------------------------------------------------------------------------------------------ Post by Sharppy » Sun Nov 07, 2021 8:51 am Pixel Reader by Leo2236 Open any file to view it in pixel format Creator Site http://lgt.createaforum.com/index.php ------------------------------------------------------------------------------------------------------------------------ Post by ikskoks » Fri Dec 23, 2022 4:23 am TextureFinder by Durik256 (Noesis) [updated 2023-11-26] Download: https://github.com/Durik256/Noesis-Plugins/blob/master/tool_TextureFinder.py Original usage instructions: https://web.archive.org/web/20231012104059/https://forum.xentax.com/viewtopic.php?t=26113 ------------------------------------------------------------------------------------------------------------------------ Post by ikskoks » Tue Dec 27, 2022 6:33 am GIMP - Load Image from Raw Data How to use this functionality: 1. Download GIMP 2.10 2. Change your file's extension to *.data 3. Open GIMP 4. Go to File > Open in GIMP 5. Load your *.data file in GIMP 6. Click "Open" in the new window. ------------------------------------------------------------------------------------------------------------------------ Post by th3ru » Mon Mar 06, 2023 7:47 am PixelDbg - view any type of file as image data, using a number of different formats. Downloads: https://sourceforge.net/projects/pixeldbg/ (source + binaries for Windows and Linux) (originally found on tcrf | not tested personally) ------------------------------------------------------------------------------------------------------------------------ Post by ikskoks » Tue Oct 24, 2023 4:16 am Game Extractor

From further investigation, it seems that some meshes use up to 8 bone weights/indices, where others only use 4. It also looks like they're split into 2 groups of 4 in the vertex data - i.e 4 weights/4 indices/2nd set of 4 weights/2nd set of 4 indices. So I'll need to redo the way bones are processed to see if that fixes it.

I'm looking at the textures/materials now, trying to allocate them properly. Just a few tests so far:

Here you can find my tutorial for Horizon Forbidden West. HUGE thanks to daemon for helping me with all this and a few others on discord. Finally we have something that can work efficently. All the tools are provided in the links. Daemons tool can be found on his page in Horizon. Have any questions feel free to ask here on on discord. Tutorial Tool Usage https://sites.google.com/view/sharp-design/tutorials/horizon-forbidden-west-tutorial HFW Animation Tools https://drive.google.com/file/d/1-c4_OEFfKCLzqyqMYME0CRZBlh9Hjiye/view?usp=drive_link CMD context reg https://drive.google.com/file/d/1lrS7KsaNDha_QeajP2XvS5TPImdhbANW/view?usp=drive_link ASCII blender importer https://drive.google.com/file/d/13an1_Ct65NIRbRU436ZkIeeEkLSNpulU/view?usp=drive_link

*(test first topic)(orig topic on Xentax) what worked for me: CASCExplorer.exe CASCExplorer.exe File>Open Online Strorage>Diablo IV (Beta) after: select CDN Build> 41428_Win64Client_0_9_0_b wait "Loading" in Explorer select all(or those that are needed) files in: -"Root(Read only)>base>meta>Apperarance" -"Root(Read only)>base>payload>Apperarance" click LMB>Extract> yourFolder After extraction, the folder structure will be preserved. meta file and data file have the same names I made a converter AppToOBJ.exe (I used my 3D library written in pure C#), It opens a meta file and looks for a data file in the specified folder "path with dataAPP" with the same name as the meta file, if this folder is not specified it looks for a data file near the meta file with the same name but as "*_data.app" *(This is a test application, tested on random models, I do not guarantee that all models will work. There will be no further work on this application.) AppToOBJ.exe Zombie.zip

Its getting there, I have more objects placed now. But still not all.

Asset lists for both PS4 & PS5 versions. Here's how they work: body variants - describe each and every variation of human characters. More than 1000. You can export and combine them to get actual combinations controlled entities - all robots are actially those. Also animals and a few other things. I did not check them all, so some of them are still under question, but all robots are there faces - or heads - self-explanatory outfits - aloy outfits. Hopefully these are all, got them automatically. some may be missing all_assets_ps5 is the main game asset tree partially decoded. It contains useful info about most interesting parts. For example, detailed description of all robots, body variants, and other skeletal meshes For example, if you need a face or outfit, you just use the number from the list. But if you need to get a full robot, you need to search for its code in all_assets_ps5 file to find its model parts, skeletons, helpers, destructibles etc. Note that there's no such thing as complete robot description in the game. Robot is a combination of its "entity", model, and other parts. Some robots use same entity, but a little different model (such as horse and goat). Some use same model, but spawns with different destructible parts. It all can be found in the tree. Same if you need a body combined, search for its code and get codes for all its parts An example spawn setup for a robot: B85 SpawnSetup: Entity ---> 55C 7D Entitycomponent ---> 4E7 D SkinnedModelResource Entitycomponent ---> 55C 43 RagdollComponentResource Entitycomponent ---> B80 3 DestructibilityResource AI context = CONTEXT_ARMADILLO_WALK In this example, setup tells the game to spawn an entity 55C (which is armadillo), with a ragdoll also from package 55C, destructible parts described in B80, and a model from 4E7. Ragdoll - will have physics skeleton. Destructibility resource - will have destructible parts description, or links to where they are. Model will have main skeleton, helpers, and all meshes: 4E7 SkinnedModelResource: Modelpart 4E7 2F Modelpart 4E7 9F Modelpart 4E7 56 .... Modelpart 4E7 6F Modelpart 4E7 1F4 Modelpart 4E7 118 SkeletonHelpers 4E7 11F SkeletonHelpers 4E7 7F SkeletonHelpers 4E7 2BF Skeleton ---> 4E7 0 Here we can see that skeleton, helpers, and all parts are in the same package - 4E7, but its not always like that. hfw_ps4_lists.7ziphfw_ps5_lists.7zip

Adding materials... thats probably last thing its missing before release

Things are getting better. Almost everything is in place now.

Tool v1.2 posted. Work is not finished, i'm looking into getting custom characters now. Also maybe i can get real hairs later. Textures not supported yet, but they can be extracted with tools for other frostbite games.

I've run out of ideas. For now I can offer this script for 3ds Max. Can import geometry and UVs for main characters. Everything else can't. Basically, I just found the required offsets and choise its depending on the file name. The path to the file is written in line 50 I still have a long way to go before deciphering the format, so I decided to post this temporary script. List of supported files in the spoiler. AW2_tmp_236.zip

This is my initial manual testing of one of the Alan models - nowhere near the scripting stage yet though, although others are working on it too.

Author: Myro Scope: Educational & research-oriented reverse engineering Status: Ongoing research Introduction: This thread documents an ongoing technical research project focused on analyzing the MPK container system used by Where Winds Meet (WWM). The goal is to understand the structure, behavior, and data flow of the game’s asset containers from a reverse-engineering and archival perspective, strictly for educational and analytical purposes. No proprietary assets, binaries, or tools will be distributed as part of this work. 1. Patch*#.mpk vs Resource*#.mpk — Structural Similarity, Semantic Differences At a container level, Patch#.mpk* and Resource#.mpk* share the same base format: Indexed via mpkinfo / mpkdb Entries contain: FileID Size Offset MpkIndex Use the same compression stack: LZ4 / ZSTD / LZMA EZST (AES-encrypted) However, despite this structural similarity, their extraction semantics differ significantly. 2. Patch*#.mpk — Partial Transparency, Direct Asset Access Patch MPKs behave primarily as delta / override containers: Assets retain near-original offsets Internal file structures remain largely recognizable Minimal indirection compared to Resource MPKs As a result: ~99% of audio assets can be recovered successfully A subset of Lua scripts becomes readable after decompression Non-audio assets (including some images) are present and partially accessible Testing on Patch3100.mpk confirmed that Patch archives are not limited to sound assets. Conclusion: Patch MPKs prioritize update efficiency and fast access, with limited transformation of payload data. 3. Resource*#.mpk — Indirection and Shared Data Resource MPKs represent the primary asset pool and introduce several additional complexities: The Size field often represents a logical or expanded size, not the physically stored payload Naïve extraction pipelines tend to: materialize padding and alignment blocks duplicate shared data blobs inflate archive size artificially (e.g. ~2 GB → tens of GB) This behavior explains why Resource MPKs appear far more “opaque” when extracted without validation. Important observations: Fixed headers such as 02 02 02 01 … frequently represent logical structures (e.g. texture containers with multiple mip blocks) Headers of the form size (4 bytes) + size × 20 bytes often describe lookup tables, not standalone assets Many assets are shared, aliased, or referenced indirectly Conclusion: While Patch and Resource MPKs share the same container format, they do not share the same extraction semantics. Resource MPKs require strict validation, deduplication, and asset-type verification to avoid false positives. 4. Audio Extraction & Tooling Initial testing with Ravioli Game Tools proved sub-optimal for this pipeline: Inconsistent parsing of Patch audio assets Unreliable WAV output in multiple cases Switching to vgmstream yielded significantly better results: Correct parsing of recovered audio data Clean, fully functional WAV output Proper handling of codec structures Current result: Audio extraction and conversion are fully verified and stable. 5. Resource.mpk Extraction – Current Progress Testing on Resources49.mpk (~740.9 MB) produced the following results: Successfully extracted: Audio assets → converted to valid .wav files Over 8,500 audio files identified in a single Resource MPK Video files (.mp4) → fully playable Lua scripts (.lua) → extracted but still encrypted / obfuscated Unresolved: Files detected as images (.png, .jpg, .bmp) Headers contain the string “messiah” Strongly suggests custom packing, encryption, or misclassification Currently not valid image data despite file extensions 6. Current Status ✔️All Patch*#.mpk, Resource*#.mpk, and lt*.mpk archives can be unpacked ✔ Audio assets fully recovered and validated ✔ MP4 video assets fully playable ✔ Lua scripts extracted but not yet readable 7. Next Steps Ongoing research will focus on: Reversing additional transformation layers in Resource*#.mpk Identifying: secondary encryption stages compression chaining block or stream reordering Investigating the custom image container format Further analysis of Lua encryption / obfuscation Automating Patch vs Resource handling as two distinct pipelines Notes on Tooling & Distribution All tools used in this project are: developed entirely from scratch created specifically for WWM research used strictly for educational purposes At this stage: no tools, binaries, or scripts will be released no proprietary assets will be redistributed Closing This thread is intended solely as a technical research and documentation log, not as a release, redistribution, or exploitation guide. In accordance with applicable intellectual property laws and forum policies, no tools, binaries, scripts, or extracted assets will be posted or shared, either publicly or privately. All game data, assets, file formats, and related materials discussed here remain the exclusive proprietary property of NetEase and the developers of Where Winds Meet. Any references to assets or file structures are made strictly for educational, analytical, and research purposes, with no intent to enable misuse, circumvention, or redistribution of protected content. Should any concerns arise regarding compliance or scope, I am fully open to cooperating with forum moderation and adjusting the visibility or content of this thread accordingly. Thank you for your understanding and for supporting responsible technical research. — Myro Below are a few illustrative screenshots and log excerpts from the current stage of the research, provided solely to contextualize the findings outlined above.

I made an importer that import every tmd2 model correctly. it can read models with more than 255 bones, all uv layers, all vertex color layers, tangents, binormals, both sets of normals, etc... https://www.nexusmods.com/bleachrebirthofsouls/mods/63

Okay, here's a little bit of an update. I've added support for all the vertex types, and the textures should all load correctly now. I've also included the extra UVs where available, although they're not presently used. The bones are still messed up in a lot of cases, so that still needs some work. The materials also need more work. I've disabled the vertex colours for now as that was messing up a lot of the meshes as well. bleach_rebirth_tmd2.zip

Tool released. Its an early version (as usual), but already makes very good results.

Horizon Forbidden West tool. There are versions for PS4 and PS5. Extracts all (or almost all) characters/robots with skeletons, animations and textures, also static meshes. h2_ps4.7ziph2_ps5.7zip

Here is a modification of Durik256's fmt_bin.py with support for mdl bone binding in noesis. Some tri-strip sill show up inside out, Just toggle the culling setting to make all face visible. fmt_bin_bones.py

Update 2.00 - Alan Wake 2 *.binFBX Blender Addon added rigged skeleton support, including non-human meshes (let me know if you get anything unexpected, still rough around the edges!) added support for some other meshes i can't remember more debug logs for anyone interested in the format died and came back to life Roadmap material generation proper reverse engineering of mesh file (every mesh file being supported without manually finding offsets) mesh/submesh replacing (might be coming the soonest) io_scene_binfbx.zip

I have released an early version of the tool that can do just meshes with their material names/skeleton:

Got staticmeshes working, now time to place them on a map.

Hey, since Xentax went down, it seems that the only threads about the game extraction tools and the links to the tools for extracting models out of Tomb Raider 2013, Rise and Shadow of the Tomb Raider disappeared. I figured that I'll just make a megathread about it here. This is about the rebooted trilogy, older games and potentially the upcoming Unreal Engine Tomb Raider 12 will get new threads. Unfortunately I didn't save any of the links so I can't post any here, but I do have some of the tools on my computer. Not sure if I want to reupload them if the links to the existing fileshares exist. If you have the links to the tools (if I don't reupload the ones I have on my computer to somewhere), please comment them below and I will add them here. ============================= Note that some of the links are from this thread from the Tomb Raider forum. Majority disappeared with Xentax unfortunately. Tomb Raider (2013) fmt_TRAS_mesh_1_3_1_1-tex.py - Version 1.3.1 (Aman) - 27/10/15 fmt_TRAS_mesh_1_3_1_1-tex.py fmt_tombraider_mesh (pulled from Xentax, probably some older demo version of the asset extractor) fmt_tombraider_mesh.py TR9 BigFile extractor (Same as Definitive Edition): tombraider9-r117_b74.rar TR9 DRM unpacker TR9DRMDumper_v1.0.1.2.rar Tomb Raider Definitive Edition fmt_TRDE_mesh_1_3_1.py Rise of the Tomb Raider fmt_TR2_mesh_1_5.py DRM + Tiger unpacker, updated Noesis script I'm pretty sure I got from NexusModding. That site also has far more updated modding tools for Rise, which I'm pretty sure work just well, if not better. ROTR Tools Mega.rar Shadow of the Tomb Raider TIGER + DRM unpacker and model format extractor for Noesis SOTR tool.rar Note that I'm not sure what the patcher was for, I got it from the SOTR Xentax thread but that's about as much as I know. Edit: There's a new mod tool and asset extractor for Shadow of the Tomb Raider that works the same as the one made for ROTR. Available here: https://www.nexusmods.com/shadowofthetombraider/mods/185?tab=description Appears to have Blender support and supports extraction of morphs. If you want to export the model with the skeleton, there's usually a file called Section XXXX.skl in the DTP folder of the model archive. Move that file in the mesh folder, then rename it to skeleton.skl, then in Noesis, press the red humanoid figure button and you will see that the model has a skeleton. You can then export the model in FBX or DAE format and include both the original weight painting and skeleton. However, sometimes, if I recall, the skeleton file isn't clearly marked, so you just have to go through all of the DTP files. I've noticed that the skeleton tends to be named either pretty close or exactly to the same section number as the model you're looking for. For ROTR, the skeletons are always called "Section XXX.skl" in the middle of all of the Section XXX.DTP files, both in the older extraction tools and on the newer tools on Nexus Modding. As for SOTR, with the older 2018 extraction tools, the skeletons are never properly named, but it doesn't matter any more as the new Nexus mod tools automatically extract the skeletons belonging to the model you want. With the newer SOTR Blender importer, it will automatically export both shape keys and the armature, but if you use the old tool, what I explained works there. If you however use the ROTR Extractor from Nexus, it gives the models their proper names, so you may run into trouble with finding the right skeleton, unless you use the old 2016 extracting tools. But from what I obeserved, a lot of the models have their proper skeleton files marked under the skl format in ROTR, I think it was SOTR that had a random name with the skeletons, but this is no longer an issue thanks to the new Blender importer addon. id-daemon's Purehair tool (works with Deus Ex: Mandkind Divided, Rise and Shadow of the Tomb Raider) ROTR + SOTR Purehair.rar Example, SOTR "swampthingloose" hair from the Porvenir Oil Fields level: Find the biggest DTP file, then drag and drop it onto PureHair_2c.exe. Then put .c file onto PureHair.exe and it'll output an obj file with the Purehair system made out of polygon edges. If you want to recreate the in-game hair, you can use these either as reference or for example in Blender, convert them with other toolsets to haircards or particle systems. However, I noticed that it separates the root vertices from the rest of the edge lines, so you have a bunch of loose geometry and shorter hair.

Tool released yesterday: https://dtzxporter.com/tools/hunter

Hi Guys, As per zenhax and xentax is dead, and now this site it will be our new home, i will provide my github with various tools and quick bms scripts that i made over years. BMS SCRIPTS TOOLS C/C++/C#, PYTHON Best Regards.

Hi, @AmrShaheen61 and DKDave working on tool, right now, beta version is currently available, maybe it will be useful to someone https://github.com/amrshaheen61/Alan-Wake-2-RMDTOC-Tool