MemeGang, posted Sun Mar 20, 2016 6:16 am (12105)

---

Yeah, id-deamon, it works for all the archives.

Not sure if it works for the thumbs.dat and packagedefinitions.txt

id-daemon, posted Sun Mar 20, 2016 6:59 am (12106)

---

Ok, good. Yet I have a feeling that files are still compressed by some simple algorithm. Because most of the text is readable, but it breaks with some strange bytes from time to time. Maybe it was the same in previous hitman games, I never worked with hitman before.

Also it seems the resource table files are not xored (as I can see by the final 16MB part provided), and Luigi's script xores them all for the moment.

aluigi, posted Sun Mar 20, 2016 8:00 am (12108)

---

Script 0.2 with everything implemented
http://aluigi.org/bms/hitman_2016.bms

id-daemon, posted Sun Mar 20, 2016 8:07 am (12109)

---

aha! So it was lz4 indeed.

Ekey, posted Sun Mar 20, 2016 10:45 am (12110)

---

Here script for unpack with names. Lots of duplicates of files.

Hitman6_Hashes.zip

MemeGang, posted Sun Mar 20, 2016 10:48 am (12111)

---

Man, I don't even know what to say.
Huge thanks to anyone working on this.

Ekey's script removed a whole bunch of PNG's and files. Script still may need work yet.

id-daemon, posted Sun Mar 20, 2016 11:50 am (12115)

---

aluigi wrote:

Script 0.2 with everything implemented
http://aluigi.org/bms/hitman_2016.bms

I think these "type" names must be reversed. Like DXET = TEXD

Also some files that supposed to be not xored are xored now. Must be some flag for that.
Namely the types of:

TEXD (textures), WWEM (wwise), GFXV (video?)

aluigi, posted Sun Mar 20, 2016 12:01 pm (12116)

---

@MemeGang
remember to use quickbms_4gb_files.exe for the extraction because the hashes are 64bit (quickbms.exe is limited to 32bit integers).

@id-daemon2
Apparently those non-compressed (ZSIZE 0) may be non obfuscated, any confirmation?

aluigi, posted Sun Mar 20, 2016 12:04 pm (12117)

---

I have updated the script with the reversed TYPE and the obfuscation applied only to the compressed files.

id-daemon, posted Sun Mar 20, 2016 12:24 pm (12118)

---

aluigi wrote:

Apparently those non-compressed (ZSIZE 0) may be non obfuscated, any confirmation?

No.

It seems now TEXD & WWEM files are OK, but WWEV are not. WWEV were OK last time.

aluigi, posted Sun Mar 20, 2016 12:28 pm (12119)

---

Just to recap, "TEXD" and "WWEM" are the only non obfuscated types of files. Right?

id-daemon, posted Sun Mar 20, 2016 12:31 pm (12120)

---

I'm not sure now. I didn't check them all.

id-daemon, posted Sun Mar 20, 2016 12:46 pm (12122)

---

Ok, it seems that 0x80000000 flag in size is an obfuscation flag.

All WWEV files are obfuscated, but only some of them are compressed.

aluigi, posted Sun Mar 20, 2016 12:50 pm (12124)

---

Script 0.2.2

id-daemon, posted Sun Mar 20, 2016 1:11 pm (12125)

---

Looks all OK now

MemeGang, posted Mon Mar 21, 2016 5:04 am (12160)

---

Ekey wrote:

Here script for unpack with names. Lots of duplicates of files.

Where did you get the hash list from? would it be possible to get the rest of the hashes?

Also Aluigi
All the WWEM files are Exporting as .wav, they should be .wem.
All the GFXV files are Exporting as .cri, they should be .usm.
Hopefully we can get the other hashes and that will fix the above.


Also, when using the 4gb executable & ekey's hash list, the script doesn't folder explore Unknown correctly or something because it misses the PNG files, and everything is not sorted by folders.

Script 0.3 when?

Ekey, posted Mon Mar 21, 2016 11:36 am (12164)

---

MemeGang wrote:

Where did you get the hash list from? would it be possible to get the rest of the hashes?

From alpha version.

Godxon 1, posted Tue Mar 22, 2016 5:08 pm (12178)

---

So, we have unpacked files and for that I thank you very much. Working someone on repacking/packing?

aluigi, posted Wed Mar 23, 2016 10:34 am (12199)

---

Reimporting via quickbms is supported by the script so you can try that solution.

BOTLANNER, posted Wed Mar 23, 2016 1:27 pm (12206)

---

aluigi wrote:

Is it so simple?

Code:

idstring "GKPR"
get FILES long
get OFFSET long
get SIZE long
for i = 0 < FILES
    get HASH longlong
    get OFFSET longlong
    get SIZE long
    putarray 0 i OFFSET
next i
get OFFSET asize
putarray 0 i OFFSET
for i = 0 < FILES
    getarray OFFSET 0 i
    math i   1
    getarray SIZE   0 i
    math SIZE - OFFSET
    encryption xor "\xdc\x45\xa6\x9c\xd3\x72\x4c\xab"
    log "" OFFSET SIZE
next

How would I test this?

aluigi, posted Wed Mar 23, 2016 1:50 pm (12208)

---

In no way because that script is old.

You need:
QuickBMS http://quickbms.aluigi.org
latest script http://aluigi.org/bms/hitman_2016.bms

Godxon 1, posted Wed Mar 23, 2016 2:41 pm (12210)

---

aluigi wrote:

Reimporting via quickbms is supported by the script so you can try that solution.

It doesn't work. I will send you screenshot of the error later today...

BOTLANNER, posted Wed Mar 23, 2016 3:31 pm (12213)

---

Ekey wrote:

Here script for unpack with names. Lots of duplicates of files.

How do I use this with the .bms script?

aluigi, posted Wed Mar 23, 2016 4:01 pm (12214)

---

@Godxon 1
If you get an error related to the size of the files, that's normal and it's a limitation of the method.
Your modified files must be smaller/equal than the original (both their uncompressed and compressed size).

@BOTLANNER
Have you read what I wrote in the previous post?

Godxon 1, posted Wed Mar 23, 2016 4:58 pm (12215)

---

aluigi wrote:

@Godxon 1
If you get an error related to the size of the files, that's normal and it's a limitation of the method.
Your modified files must be smaller/equal than the original (both their uncompressed and compressed size).

I don't get any error, it only show, that was reimported 0 files...