This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=2223

Godxon 1, posted Sat Mar 12, 2016 11:21 am (11921)

---

Hello,
I want to extract files from new Hitman game, but script for Absolution from Aluigi don't work. Can someone please help me?

There is example of the files: https://mega.nz/#F!uVUA2YKD!KOKRyKzgInfzZNDr5GggRw

THX

biosmanager, posted Sat Mar 12, 2016 11:36 am (11922)

---

I tried the scripts from http://zenhax.com/viewtopic.php?t=1201 but unfortunately they didn't work. It seems they changed the archive format.

aluigi, posted Sat Mar 12, 2016 1:32 pm (11924)

---

Please use the filecutter script to upload only a part of the file, open it with notepad and use 16 where it's written "math MEGABYTES = 2":
http://aluigi.org/bms/filecutter.bms

Ekey, posted Sat Mar 12, 2016 1:44 pm (11927)

---

They changed format. Now it's looks like this

Code:

struct RPKGHeader
{
   uint32_t   dwID; // Always GKPR
   uint32_t   dwTotalFiles;
   uint32_t   dwResourceTableOffset; // Table with headers for files
   uint32_t   dwResourceTableSize;
};

struct RPKGEntry
{
   uint64_t   dwHash; // Filename hash
   uint64_t   dwOffset;
   uint32_t   dwSize; // dwSize & 0x3FFFFFFF
}

struct RPKGResources
{
   uint32_t   int dwType;
   uint32_t   int dwReferencesChunkSize;
   uint32_t   int dwStatesChunkSize;
   uint32_t   int dwDataSize;
   uint32_t   int dwSystemMemoryRequirement;
   uint32_t   int dwVideoMemoryRequirement;
};

Files data can be also compressed. I have tryed comtype_scanner but without good results. Real size can be found in resource table for each entry. Actually i do not know how to interact with that table and get headers for each files.

Cutted: https://www.sendspace.com/file/kcontd

Godxon 1, posted Sat Mar 12, 2016 1:51 pm (11928)

---

aluigi wrote:

Please use the filecutter script to upload only a part of the file, open it with notepad and use 16 where it's written "math MEGABYTES = 2":
http://aluigi.org/bms/filecutter.bms

Here is it, Aluigi.
https://mega.nz/#F!6BkmBQ4D!QlQwHjemHq4imptQelgt6w

aluigi, posted Sat Mar 12, 2016 4:29 pm (11929)

---

In my opinion there is no compression.
What's there looks like a xor with an 8 bytes key that changes for every file.

AnonBaiter, posted Sat Mar 12, 2016 10:07 pm (11932)

---

aluigi wrote:

In my opinion there is no compression.
What's there looks like a xor with an 8 bytes key that changes for every file.

So is there any way to extract them?

Ekey, posted Sat Mar 12, 2016 11:28 pm (11936)

---

aluigi wrote:

In my opinion there is no compression.
What's there looks like a xor with an 8 bytes key that changes for every file.

I found only encryption for config files (packagedefinition.txt and thumbs.dat). It's XTEA. But I'm not sure that the same algorithm is used for encryption data in archives.

SPooKMasTeR, posted Sun Mar 13, 2016 9:12 am (11941)

---

There is also this Thumbs.db file which appears to be a sort of a config file according to someone who has been digging. It maybe possible to enable the console through that file.

BOTLANNER, posted Mon Mar 14, 2016 8:13 am (11965)

---

biosmanager wrote:

I tried the scripts from http://zenhax.com/viewtopic.php?t=1201 but unfortunately they didn't work. It seems they changed the archive format.

Is it not still .RPKG?

aluigi, posted Mon Mar 14, 2016 9:38 am (11968)

---

@Ekey
I guess it's a custom obfuscation because the sequence of bytes remains almost the same except for some few bytes that change, look at offset 0x350290. That's not possible with XTEA or other block ciphers where the whole block changes when the input changes.

Ekey, posted Mon Mar 14, 2016 5:29 pm (11982)

---

Well, i have no ideas about that obfuscation. Denuvo does not give any chance to debug game for reversing algorithm..

Ekey, posted Wed Mar 16, 2016 11:37 am (12022)

---

We have a chance to find a data obfuscation algorithm by hooking API functions CreateFileA, CreateFileW, ReadFile, SetFilePointer and etc. Actually decryption/deobfuscation algorithm are close to these API.
API Monitor v2 is great tool but it not displays the address where called from HITMAN.exe. Maybe there are similar tools with this capability?

BOTLANNER, posted Thu Mar 17, 2016 7:57 pm (12041)

---

The models and textures used in the game can be acquired using Ninja Ripper.

SPooKMasTeR, posted Fri Mar 18, 2016 12:30 pm (12057)

---

Just so you guys know I am really looking forward to decrypting these stuff. Keep the good work up guys! ? ?_? ??TAKE MY ENERGY ? ? ?_? ??.

id-daemon, posted Sat Mar 19, 2016 4:16 pm (12086)

---

aluigi wrote:

In my opinion there is no compression.
What's there looks like a xor with an 8 bytes key that changes for every file.

Why do you think it changes? As I can see, its always dc45a69cd3724cab

The illusion of it changing is only because all the files start with different offset. But all the files in this first 16M cut are xored with the same key

aluigi, posted Sat Mar 19, 2016 4:35 pm (12088)

---

I guess I checked the whole extracted file and the sequence of bytes changed at different offsets.
Just trying to remember...

id-daemon, posted Sat Mar 19, 2016 4:37 pm (12089)

---

aluigi wrote:

I guess I checked the whole extracted file and the sequence of bytes changed at different offsets.
Just trying to remember...

yes because files are NOT PADDED

the key is the same

aluigi, posted Sat Mar 19, 2016 4:55 pm (12090)

---

Is it so simple?

Code:

idstring "GKPR"
get FILES long
get OFFSET long
get SIZE long
for i = 0 < FILES
    get HASH longlong
    get OFFSET longlong
    get SIZE long
    putarray 0 i OFFSET
next i
get OFFSET asize
putarray 0 i OFFSET
for i = 0 < FILES
    getarray OFFSET 0 i
    math i   1
    getarray SIZE   0 i
    math SIZE - OFFSET
    encryption xor "\xdc\x45\xa6\x9c\xd3\x72\x4c\xab"
    log "" OFFSET SIZE
next

id-daemon, posted Sat Mar 19, 2016 5:10 pm (12091)

---

I don't have the game or the full 3,7Gig file, but it seems so.

Godxon 1, posted Sat Mar 19, 2016 5:13 pm (12092)

---

Thank you very much, Aluigi

AnonBaiter, posted Sat Mar 19, 2016 9:53 pm (12099)

---

Wow aluigi. It's very unusual of you to post the script in its entirety instead of posting a link of the .bms file. I'll appreciate it either way,

MemeGang, posted Sun Mar 20, 2016 4:25 am (12101)

---

Just wanted to say huge thanks to Aluigi and Ekey for working on this!

How long could we be waiting for a hash list to be implemented in the script?

Obviously we don't have a plain text hash file to work from anymore. But it's probably still there somewhere obviously.

id-daemon, posted Sun Mar 20, 2016 5:36 am (12103)

---

Can anyone at least CONFIRM that the key that I've found is working for all game files?