This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=4012

AnonBaiter, posted Sat Mar 25, 2017 6:50 pm (21758)

---

Here is a sample. It seems to be XOR judging from the beginning of the file.

aluigi, posted Tue Apr 18, 2017 6:15 pm (22377)

---

For example xored with the bytes: 0xb3 0x98 0xcc 0x66

AnonBaiter, posted Wed Apr 19, 2017 1:29 am (22393)

---

Okay, now I`m getting somewhere with this.

The script shows the whole progress I`ve been having with some of those Ubisoft games that used Jade engine(Ubisoft Montpellier`s post-2003 games, and the Prince of Persia trilogy courtesy of Ubisoft Montreal), or we were never told it was used in the first place(Just Dance(2009) by Ubisoft Paris).

jade_WIP.bms

aluigi, posted Wed Apr 19, 2017 6:21 am (22399)

---

It's a big script, the format seems quite complex

AnonBaiter, posted Wed Apr 19, 2017 3:17 pm (22412)

---

aluigi wrote:

It's a big script, the format seems quite complex

Well, I decided to just go and look out for Ubisoft games that used this format. Which is why the script grew this much.

ponaromixxx, posted Fri May 19, 2017 5:09 pm (23325)

---

AnonBaiter wrote:

Okay, now I`m getting somewhere with this.

The script shows the whole progress I`ve been having with some of those Ubisoft games that used Jade engine(Ubisoft Montpellier`s post-2003 games, and the Prince of Persia trilogy courtesy of Ubisoft Montreal), or we were never told it was used in the first place(Just Dance(2009) by Ubisoft Paris).

And for the game Peter Jackson's King Kong does not work . Is it possible to alter the script for this game?

AnonBaiter, posted Fri May 19, 2017 8:39 pm (23327)

---

ponaromixxx wrote:

And for the game Peter Jackson's King Kong does not work . Is it possible to alter the script for this game?

It`s because the script is not ready and I would rather fill in the puzzles for an entire filename of just one file than just extract the archives without the filenames(a.k.a. hashes as filenames, or just "").

ponaromixxx, posted Sat May 20, 2017 3:55 pm (23357)

---

AnonBaiter wrote:

ponaromixxx wrote:

And for the game Peter Jackson's King Kong does not work . Is it possible to alter the script for this game?

It`s because the script is not ready and I would rather fill in the puzzles for an entire filename of just one file than just extract the archives without the filenames(a.k.a. hashes as filenames, or just "").

Clearly, we will wait for the development of the script)

RibShark, posted Sun Jun 18, 2017 8:11 pm (24204)

---

This tool was found in a (likely unofficial) Russian installer for the game. It was named bftool.exe but it self-identifies as dpktool. It seems to sucessfully unpack Rayman4.bf at least partially, but always crashes in the same place while unpacking. It's meant to also have a function to repack back into a BF but that hasn't sucessfully worked for me yet. Maybe this EXE could be analysed to further decode the BF format?

AnonBaiter, posted Sun Jun 18, 2017 9:22 pm (24206)

---

Interesting how you managed to find that...

mzkoops56, posted Wed Jun 21, 2017 6:15 pm (24232)

---

Hi! I have the .bf archive from Just Dance 1 but the script won't extract any files from it. I tried using the debug function of quickbms to see what is wrong but I can't see what is happening. I have uploaded a sample to see if you would like to test or edit the script for it.
https://drive.google.com/open?id=0B-YcY ... EoyM3Qxbmc

AnonBaiter, posted Wed Jun 21, 2017 8:40 pm (24234)

---

mzkoops56 wrote:

Hi! I have the .bf archive from Just Dance 1 but the script won't extract any files from it. I tried using the debug function of quickbms to see what is wrong but I can't see what is happening.

It actually works well with my script, but it's still skeleton at its core. I advise you to read the entire thread for details as to why it won't work as you expect it to.

AnonBaiter, posted Wed Jun 21, 2017 10:20 pm (24236)

---

Okay, now here's a question for aluigi(although anyone can answer as well).

So, I've already XOR-ed the header, right? However, turns out it also affects the entire archive as well, right after the entire header(which is TOTAL_INFO_SIZE) since they didn't go through the same encryption process anyway.

I had this solution that could've XOR-ed everything back to normal after all the information has been obtained but it doesn't work:

Code:

      if BF_SIGN == "BUG"
         filexor "\xb3\x98\xcc\x66" OFFSET
      endif

See this file for example.

AnonBaiter, posted Sun Jun 25, 2017 9:58 pm (24293)

---

Never mind, I had thought of another method.

So I decided to do something like this:

Code:

log MEMORY_FILE OFFSET SIZE

So by logging MEMORY_FILE with the OFFSET and SIZE field you can see the script trying to get away with the whole "filexor" process by saving every single byte that came from the original archive with an encrypted header(Rayman4.bf in this case). I have updated the script so it now supports extraction, although its filename is assigned through a DUMMY1 variable.

ponaromixxx, posted Mon Jun 26, 2017 1:43 am (24298)

---

And there is a possibility how to extract files with names for example here such names are there for sounds en_de_03a_code_09.wad

Sound_Common.bf

AnonBaiter, posted Mon Jun 26, 2017 2:06 am (24300)

---

ponaromixxx wrote:

And there is a possibility how to extract files with names for example here such names are there for sounds en_de_03a_code_09.wad

Figuring out the directory tree is my highest priority, so until I find a way to support this tree assigning the filename to what was the original filename might be considered.

ponaromixxx, posted Mon Jun 26, 2017 3:30 am (24301)

---

AnonBaiter wrote:

ponaromixxx wrote:

And there is a possibility how to extract files with names for example here such names are there for sounds en_de_03a_code_09.wad

Figuring out the directory tree is my highest priority, so until I find a way to support this tree assigning the filename to what was the original filename might be considered.

So, so far there is no way to assign names in any other way?

AnonBaiter, posted Mon Jun 26, 2017 3:36 am (24302)

---

ponaromixxx wrote:

AnonBaiter wrote:

ponaromixxx wrote:

And there is a possibility how to extract files with names for example here such names are there for sounds en_de_03a_code_09.wad

Figuring out the directory tree is my highest priority, so until I find a way to support this tree assigning the filename to what was the original filename might be considered.

So, so far there is no way to assign names in any other way?

There are currently two choices:
1. Assign the filename by the NAME variable, at which point you need to modify a few lines.
2. Assign the filename as a 32-bit hash value(what the script does).

ponaromixxx, posted Mon Jun 26, 2017 5:00 am (24303)

---

AnonBaiter wrote:

ponaromixxx wrote:

AnonBaiter wrote:

Figuring out the directory tree is my highest priority, so until I find a way to support this tree assigning the filename to what was the original filename might be considered.

So, so far there is no way to assign names in any other way?

There are currently two choices:
1. Assign the filename by the NAME variable, at which point you need to modify a few lines.
2. Assign the filename as a 32-bit hash value(what the script does).

Sorry, but I do not understand scripts very well, and I can not fix it myself, could you help me !?

AnonBaiter, posted Mon Jun 26, 2017 1:55 pm (24308)

---

ponaromixxx wrote:

Sorry, but I do not understand scripts very well, and I can not fix it myself, could you help me !?

Help you through what exactly?
Also I just updated the script for you.

ponaromixxx, posted Mon Jun 26, 2017 3:21 pm (24309)

---

AnonBaiter wrote:

ponaromixxx wrote:

Sorry, but I do not understand scripts very well, and I can not fix it myself, could you help me !?

Help you through what exactly?
Also I just updated the script for you.

And you already made changes to the script! Sorry did not notice. Thanks a lot for your help!

AnonBaiter, posted Thu Oct 19, 2017 7:42 pm (27475)

---

So, I decided to do this thing...

Code:

   if BF_EXT == "001"
      sortarray 0 1
      math BF_NUM = 1
      math BF_OFF = 0
      get BF_SIZE asize
      for f2 = 0 < FILES
         getarray OFFSET 5 f2
         getarray SIZE 6 f2
         getarray NAME 10 f2
         math OFFSET   4
         math TMP_OFF = OFFSET
         math OFFSET - BF_OFF
         if OFFSET >= BF_SIZE
            math BF_NUM   1
            string BF_EXT p "d" BF_NUM
            open FDDE BF_EXT
            math BF_OFF   OFFSET
            get BF_SIZE asize
            math OFFSET = 0
         endif
         string FNAME p= "x." DUMMY1
         if BF_SIGN == "BUG"
            log MEMORY_FILE OFFSET SIZE
            get SIGN1 long MEMORY_FILE
            log NAME 0 SIZE MEMORY_FILE
         else
            log NAME OFFSET SIZE
         endif
      next f2
   endif

Basically, I want to load the splitted archive based on the offset field. Although it works only with sequential offsets, in the case of the archive I'm trying to handle with there are offset fields that bounce back-and-forth from one file to the next, like this one right here:

Code:

.
. 00000000000000c6
. 00000000 getarr  OFFSET     0x000000002bc09800 5:198
. 00000000 getarr  SIZE       0x00000000000037fc 6:198
. 00000000 getarr  NAME       "de_ha_05a_trex_05.wad" 10:198
. 0000000000000000 get     BF_SIZE    0x0000000018c07000 -2   # .002
. 0000000000000000 get     SIGN1      0x00000000fba13169 4
  0000000000000000 14332      de_ha_05a_trex_05.wad
.
. 00000000000000c7
. 00000000 getarr  OFFSET     0x000000002bc3a800 5:199
. 00000000 getarr  SIZE       0x000000000000affc 6:199
. 00000000 getarr  NAME       "de_ha_05a_trex_17.wad" 10:199
. 0000000000000000 get     SIGN1      0x00000000280aba90 4
  0000000000000000 45052      de_ha_05a_trex_17.wad
.
. 00000000000000c8
. 00000000 getarr  OFFSET     0x000000000e8c6000 5:200   <-- .001
. 00000000 getarr  SIZE       0x00000000000007fc 6:200
. 00000000 getarr  NAME       "fe21468a.bin" 10:200

Regardless, when executed, the script will still stick to the latest loaded extension when it reaches to this point, therefore it's guaranteed to throw out an error when the script is faced with an offset from another splitted part of the archive that it can't reach.

Any ideas as to how I can actually handle this?

AnonBaiter, posted Sat Oct 21, 2017 3:46 pm (27512)

---

Ahh, nevermind I seem to have found a solution.
All I had to do was to replace this:

Code:

sortarray 0 1

With this:

Code:

sortarray 5 6

Now if only I could edit my previous post right now... aluigi what did you do with this message board!?

aluigi, posted Sat Oct 21, 2017 5:28 pm (27518)

---

AnonBaiter wrote:

Now if only I could edit my previous post right now... aluigi what did you do with this message board!?

Eh unfortunately I had to limit the editing time due to some users abusing it to delete their posts after they got help and to avoid/limit a possible spamming technique already seen in the past.
I know, I hate it but there are no alternatives.
Sorry.