This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=4299

Googlemo, posted Thu Jun 08, 2017 3:54 am (23917)

---

Hello, I would like to ask you guys a question, if its possible for you to open client's files(I don't need to put them back together either, at least for now!) of this game:
Moonlight Blade

aluigi, posted Thu Jun 08, 2017 8:46 am (23921)

---

Why don't you use Google?
viewtopic.php?t=2844
viewtopic.php?t=3926

Then you opened one topic for 2 games, without providing samples and in the wrong section.
Please pay more attention next time, thanks.

Googlemo, posted Thu Jun 08, 2017 12:29 pm (23929)

---

I saw first topic, but I assumed .sfc files are for models and graphics stuff not really what Im looking for.

aluigi, posted Thu Jun 08, 2017 3:06 pm (23938)

---

What's the file you want to extract?
Upload it.

Googlemo, posted Thu Jun 08, 2017 9:26 pm (23954)

---

Im not sure, as I need files with texts, Would be amazing if you could help me locating it, here some samples that may be what we need:

https://yadi.sk/d/BV-8wFEX3JxDGr

aluigi, posted Fri Jun 09, 2017 10:44 am (23969)

---

I can confirm that the scripts are:
http://aluigi.org/bms/qq_sfc.bms
http://aluigi.org/bms/dzs_qq.bms

I have just updated dzs_qq.bms because it didn't decompress the files, I hope to have not broken compatibility with other archived

Ekey, posted Fri Feb 09, 2018 9:58 am (32298)

---

Filenames is encrypted with AES/256/ECB mode. Key is (VFS_DEFAULT_AES_KEY)

aluigi, posted Sun Feb 11, 2018 1:35 pm (32370)

---

Do you have a sample archive for testing my script?

Ekey, posted Mon Feb 12, 2018 4:33 am (32401)

---

https://www.sendspace.com/file/c2fa8m

aluigi, posted Mon Feb 12, 2018 10:51 am (32408)

---

Thanks, do you know if the TOC is EVER encrypted or only when the filenames are encrypted too?

Ekey, posted Mon Feb 12, 2018 11:15 am (32409)

---

0x38 offset in each archive > byte is flag (1 - encrypted), next 16 bytes is a MD5 hash of encryption key

aluigi, posted Mon Feb 12, 2018 11:32 am (32410)

---

ok, I still have some doubts about the various formats and samples I have seen in the past... but I no longer have them so my only option is keeping the original "heuristic" file-dumping part of the script and adding the new encryption and TOC handling.
Script 0.3:
http://aluigi.org/bms/dzs_qq.bms

It seems to work well with the provided sample, can't guarantee if it works with the others but it's enough to set OLD_SCRIPT to 1 for using the old version of the script.

Ekey, posted Mon Feb 12, 2018 1:13 pm (32413)

---

Works fine

flowersun, posted Mon Apr 30, 2018 1:18 pm (34525)

---

Ekey wrote:

Works fine

Great Job! I have another question about .SFC file in moonlight blade(http://aluigi.altervista.org/bms/qq_sfc.bms). Do you know what's the 8 bytes dummy header of each subfile? It seems to be some kind of hash of origin filename. Such as
icon_64_ShiShiZhuangCaiLiao_XiQue => 0c8c28b400ac6e0e
ICON_40_Blue => 0d770a0303e3bd67
I'm wondering is there any hope to find out the function? It will be much useful.

Ekey, posted Mon Apr 30, 2018 1:59 pm (34526)

---

8 bytes is a hash of file name in upper case

flowersun, posted Mon Apr 30, 2018 2:12 pm (34527)

---

Ekey wrote:

8 bytes is a hash of file name in upper case

Did you mean first do toUpperCase("ICON_40_Blue") => "ICON_40_BLUE",
and then calculate the hash of 'ICON_64_BLUE' ? So do you know what's the hash function? Thanks a lot.

Ekey, posted Mon Apr 30, 2018 3:35 pm (34533)

---

Simple algorithm

C#

Code:

        static UInt64 iGetHashFromString(string m_String)
        {
            UInt64 dwHash = 0x1712E27F4D2960DB;
            m_String = m_String.ToUpper();
            for (int i = 0; i < m_String.Length; i  )
            {
                dwHash = (dwHash * 67)   ((byte)m_String[i]);
            }
            return dwHash;
        }

flowersun, posted Mon Apr 30, 2018 4:47 pm (34535)

---

Ekey wrote:

Simple algorithm

C#

Code:

        static UInt64 iGetHashFromString(string m_String)
        {
            UInt64 dwHash = 0x1712E27F4D2960DB;
            m_String = m_String.ToUpper();
            for (int i = 0; i             {
                dwHash = (dwHash * 67)   ((byte)m_String[i]);
            }
            return dwHash;
        }

You're awesome!!! How did you found this piece of code? Decompile client or write by yourself? I have tested it, but unfortunately the hash string couldn't match. Something like hash value of "aaa1.png" minus hash value of "aaa2.png" should be 20151121(67^4). And that could be shown from this snippet. So I'm wondering if I should concat some prefix to filename like "/huashu40.tga" or is the dwHash init value mistyped?
Sorry for my bad English and thanks a lot again!! I'm also glad to receive PM.

Ekey, posted Mon Apr 30, 2018 8:05 pm (34543)

---

flowersun wrote:

You're awesome!!! How did you found this piece of code? Decompile client or write by yourself?

Reverse engineering and debugging client.

flowersun wrote:

I have tested it, but unfortunately the hash string couldn't match. Something like hash value of "aaa1.png" minus hash value of "aaa2.png" should be 20151121(67^4). And that could be shown from this snippet. So I'm wondering if I should concat some prefix to filename like "/huashu40.tga"

No

flowersun wrote:

the dwHash init value?

Yes

flowersun wrote:

mistyped

No

flowersun wrote:

And that could be shown from this snippet. So I'm wondering if I should concat some prefix to filename like "/huashu40.tga" or is the dwHash init value mistyped?
Sorry for my bad English and thanks a lot again!! I'm also glad to receive PM.

No, prefixes are not needed here. You can check hashes in archive > TableBin.sfc

Code:

B4E123F458669A32 - CACHE\DATA\CLIENTTABLE_KR\ACTIVITYCOMMONREWARDTABLE.BIN

flowersun, posted Fri Aug 31, 2018 2:39 am (37966)

---

aluigi wrote:

ok, I still have some doubts about the various formats and samples I have seen in the past... but I no longer have them so my only option is keeping the original "heuristic" file-dumping part of the script and adding the new encryption and TOC handling.
Script 0.3:
http://aluigi.org/bms/dzs_qq.bms

It seems to work well with the provided sample, can't guarantee if it works with the others but it's enough to set OLD_SCRIPT to 1 for using the old version of the script.

Hello, I could provide one quite small vfs example file(8kb), but it extract nothing. I tried extract the filename list first, and it seems to contain 2 files. Using 0.3.1 version script, it can extract about 70% files on average(tested more than 10 vfs files), and some of the files is broken. Hopes you can find out where the problem lies by inspecting this file. I could provide one 3gb big file if needed.
Thanks for your great work! Hope for good news!

---
uploaded the 3gb file, data_bas_1.vfs:
https://mega.nz/#!0F4XzbTZ!Am2ha92fyz_I ... EKP5dtJzvw
one broken extracted file path example, only 3MB, should be exactly 4MB:

Quote:

\DATA\IMAGESETS\MAP\WORLDMAP\YY_MINIMAP.DDS

LokiReborn, posted Fri Jun 21, 2019 5:08 am (48941)

---

Not to necro old topics but a few people asked me if an English translation would be possible for Moonlight blade so I've been playing with the files and have made some corrections to successfully get most of the files out with the proper paths & names. I attached the program I'm using for testing if anyone would like to try it.

Things I found were:
What is called ALIGN at the start of the script is the block size to be used, in each data segment the first long value DUMMY is the number of blocks in the segment so the total length should equal block size * block count
Best I can tell OTHER_OFF is a list of unused / trash / old blocks from replacing files where they didn't want to regenerate the whole file and fix all of the existing entries and offsets
If the data segment has REF_OFF set that extends the current block, mostly used with the next note & with chaining the trash entries from what I've seen.
While the basic extract function is correct there is another use case. There is another entry in the Info tables after FLAGS it is a long value and if it is not equal to 0 (the value I've encountered is 0x400000) after you read block count & REF_OFF you need to read an array of longs until you hit a 0x78 0x9C, this list/array are the lengths of the back to back zlib entries that need to be decompressed and combined to create the original file.

Additional Notes: The script adjustment needed for Ring of Elysium appears to be from a damaged file and also needs to be accounted for when extracting files as it screws up the block alignment from there forward when using the offsets in the info table.

I also didn't include lzma support as I never encountered it in the current Moonlight blade or in the Ring of Elysium data 4 files I tested for compatibility.

Edit: Removed exe as it was update in other post.

aluigi, posted Sun Jun 23, 2019 8:44 am (48982)

---

Interesting, probably one day I have to return on the script again.
If anyone wants to provide a patch for the script, that's welcome

LokiReborn, posted Mon Jun 24, 2019 5:56 pm (49017)

---

I'd offer to do it but I've never used QuickBMS so I wouldn't know how to implement some of the stuff, I've attached an updated exe to support cancellation and also cleaned up the source some and added notes and attached that as well if anyone wants to do the port.

The Program is written in C# for anyone that wants to play with it.

VFS Extractor Source.zip

VFS Extractor.zip

peterzhenhh, posted Sun Dec 29, 2019 4:25 pm (52877)

---

LokiReborn wrote:

I'd offer to do it but I've never used QuickBMS so I wouldn't know how to implement some of the stuff, I've attached an updated exe to support cancellation and also cleaned up the source some and added notes and attached that as well if anyone wants to do the port.

The Program is written in C# for anyone that wants to play with it.

Is there any way to extract .sfc with filenames?