Quake Champions

April 11, 20251 yr

Author
Localization

speciose, posted Thu Aug 02, 2018 4:27 pm (37174)

Have anyone reached encrypted files?

April 11, 20251 yr

Author
Localization

z65536, posted Fri Aug 31, 2018 12:17 am (37965)

it is decrypted with this code.

Code:

    void NrRandom(ulong seed)
    {
      v = 4101842887655102017ULL;
      w = 1;

      u = v ^ seed ^ 0x412e2206; NextUInt64();
      v = u;                     NextUInt64();
      w = v;                     NextUInt64();
    }

April 11, 20251 yr

Author
Localization

buk0wski, posted Sun Sep 02, 2018 1:35 pm (38045)

z65536 wrote:

it is decrypted with this code.

Code:

    void NrRandom(ulong seed)
    {
      v = 4101842887655102017ULL;
      w = 1;

      u = v ^ seed ^ 0x412e2206; NextUInt64();
      v = u;                     NextUInt64();
      w = v;                     NextUInt64();
    }

Thanks a lot, works now.
Feel kinda stupid tho. How did you find it out?

April 11, 20251 yr

Author
Localization

z65536, posted Mon Sep 03, 2018 3:14 am (38070)

buk0wski wrote:

z65536 wrote:

it is decrypted with this code.

Code:

    void NrRandom(ulong seed)
    {
      v = 4101842887655102017ULL;
      w = 1;

      u = v ^ seed ^ 0x412e2206; NextUInt64();
      v = u;                     NextUInt64();
      w = v;                     NextUInt64();
    }

Thanks a lot, works now.
Feel kinda stupid tho. How did you find it out?

I used a debugger.

these are function NrRandom and quake_decrypt

Code:

signed __int64 __fastcall sub_141666740(_QWORD *a1, __int64 a2)
{
  _QWORD *v2; // r8
  __int64 v3; // rcx
  signed __int64 result; // rax

  v2 = a1;
  a1[1] = 4101842887655102017i64;
  a1[2] = 1i64;
  
  if ( qword_1430FB778 )
    a2 ^= *(_QWORD *)qword_1430FB778;     //As this lines was added, I set a breakpoint here

  *a1 = 2862933555777941757i64 * (a2 ^ a1[1])   7046029254386353087i64;
  v3 = a1[1] ^ (a1[1] >> 17);
  v2[1] = v3 ^ (v3 << 31) ^ ((v3 ^ (unsigned __int64)(v3 << 31)) >> 8);
  v2[2] = (v2[2] >> 32)   4294957665i64 * (unsigned int)v2[2];
  v2[1] = *v2;
  *v2 = 2862933555777941757i64 * *v2   7046029254386353087i64;
  v2[1] ^= (v2[1] >> 17) ^ ((v2[1] ^ (v2[1] >> 17)) << 31) ^ ((v2[1] ^ (v2[1] >> 17) ^ ((v2[1] ^ (v2[1] >> 17)) << 31)) >> 8);
  v2[2] = (v2[2] >> 32)   4294957665i64 * (unsigned int)v2[2];
  v2[2] = v2[1];
  *v2 = 2862933555777941757i64 * *v2   7046029254386353087i64;
  v2[1] ^= (v2[1] >> 17) ^ ((v2[1] ^ (v2[1] >> 17)) << 31) ^ ((v2[1] ^ (v2[1] >> 17) ^ ((v2[1] ^ (v2[1] >> 17)) << 31)) >> 8);
  result = (v2[2] >> 32)   4294957665i64 * (unsigned int)v2[2];
  v2[2] = result;
  return result;
}

Code:

__int16 __fastcall sub_141665F70(__int64 a1, _BYTE *a2, __int64 a3)
{
  __int64 v3; // r11
  _BYTE *v4; // r10
  __int64 i; // r9
  __int64 v6; // rcx
  char v7; // r8
  __int16 v8; // ax
  signed __int64 v9; // rax
  bool v10; // zf
  signed __int64 v11; // rdx

  v3 = a3;
  v4 = a2;
  for ( i = a1; v3; --v3 )
  {
    v6 = *(unsigned __int16 *)(i   186);
    v7 = *(_BYTE *)(v6   i   144);
    *(_BYTE *)(v6   i   144) = *v4;
    *v4 ^= v7 ^ *(_BYTE *)(i   176) & (unsigned __int64)(255i64 << 8 * (unsigned __int8)*(_WORD *)(i   184));
    v8 = *(_WORD *)(i   186);
      *(_WORD *)(i   184);
    LOWORD(v9) = ((_BYTE)v8   1) & 0x1F;
    v10 = *(_WORD *)(i   184) == 8;
    *(_WORD *)(i   186) = v9;
    if ( v10 )
    {
      *(_QWORD *)(i   192) = 2862933555777941757i64 * *(_QWORD *)(i   192)   7046029254386353087i64;
      *(_QWORD *)(i   200) ^= (*(_QWORD *)(i   200) >> 17) ^ ((*(_QWORD *)(i   200) ^ (*(_QWORD *)(i   200) >> 17)) << 31) ^ ((*(_QWORD *)(i   200) ^ (*(_QWORD *)(i   200) >> 17) ^ ((*(_QWORD *)(i   200) ^ (*(_QWORD *)(i   200) >> 17)) << 31)) >> 8);
      v11 = (*(_QWORD *)(i   208) >> 32)   4294957665i64 * *(unsigned int *)(i   208);
      *(_QWORD *)(i   208) = v11;
      v9 = v11 ^ (*(_QWORD *)(i   200)
                  (((*(_QWORD *)(i   192) ^ (*(_QWORD *)(i   192) << 21)) >> 35) ^ *(_QWORD *)(i   192) ^ (*(_QWORD *)(i   192) << 21) ^ 16i64 * (((*(_QWORD *)(i   192) ^ (*(_QWORD *)(i   192) << 21)) >> 35) ^ *(_QWORD *)(i   192) ^ (*(_QWORD *)(i   192) << 21))));
      *(_WORD *)(i   184) = 0;
      *(_QWORD *)(i   176) = v9;
    }
      v4;
  }
  return v9;
}

April 11, 20251 yr

Author
Localization

buk0wski, posted Fri Sep 07, 2018 4:45 pm (38183)

Thanks again, I got it.

They changed the constant in the latest patch. New, working code below.

Code:

void NrRandom(ulong seed)
    {
      v = 4101842887655102017ULL;
      w = 1;

      u = v ^ seed ^ 0x631A2028; NextUInt64();
      v = u;                     NextUInt64();
      w = v;                     NextUInt64();
    }

April 11, 20251 yr

Author
Localization

exhawk, posted Sat Sep 08, 2018 3:39 am (38191)

Can someone extract bj's voice lines or share script to do it myself? please

April 11, 20251 yr

Author
Localization

aluigi, posted Thu Sep 13, 2018 9:49 pm (38311)

I have just updated the script in case someone wants to test it:
http://aluigi.org/bms/quake_champions.bms

The only sample file I have here uses an older constant so I didn't test it.

April 11, 20251 yr

Author
Localization

OXOTHuK, posted Fri Sep 28, 2018 8:54 am (38858)

I will post my results here.
This is my first time using QuickBMS, so let me know if I'm doing something incorrectly.

I pointed QuickBMS to the shared.pak file (using the Steam version of Quake Champions).
[ steamapps\common\quakechampions\client\preload\paks\shared.pak ]
After selecting the output, my console output shows this:

Code:
insert the constant number for NrRandom initialization, it depends by the version of the game like 0x412e2206 and 0x631A2028

- please insert the content for the variable SEED2:

What do I do?

April 11, 20251 yr

Author
Localization

h3x3r, posted Sat Sep 29, 2018 1:33 pm (38877)

Seems like they update it again. None of them works.

April 11, 20251 yr

Author
Localization

Rev3n4nt, posted Mon Oct 01, 2018 10:46 pm (38929)

buk0wski wrote:

They changed the constant in the latest patch. New, working code below.

Code:

void NrRandom(ulong seed)
    {
      v = 4101842887655102017ULL;
      w = 1;

      u = v ^ seed ^ 0x631A2028; NextUInt64();
      v = u;                     NextUInt64();
      w = v;                     NextUInt64();
    }

Thanks buk0wski, I wonder if it's possible to get constant for the now version? Can you write a script, or sort of crack\keygen like mini-app that gets that constant? Or just say where to look while debugging - if any of those options is possible, please note

April 11, 20251 yr

Author
Localization

z65536, posted Tue Oct 02, 2018 12:53 am (38930)

My script that can extract shared.pak is here.

Code:

# Quake Champions
# script for QuickBMS http://quickbms.aluigi.org

quickbmsver "0.8.0"
set MEMORY_FILE10 string "
typedef unsigned char uchar;
typedef unsigned short ushort;
typedef unsigned long long ulong;

    // Numerical Recipes 3rd edition
    static ulong u, v, w;

    ulong NextUInt64()
    {
      u = u * 2862933555777941757ULL   7046029254386353087ULL;
      v ^= v >> 17; v ^= v << 31; v ^= v >> 8;
      w = 4294957665U * (w & 0xffffffff)   (w >> 32);
      ulong x = u ^ (u << 21); x ^= x >> 35; x ^= x << 4;
      return (x   v) ^ w;
    }

    void NrRandom(ulong seed)
    {
      v = 4101842887655102017ULL;
      w = 1;

      u = v ^ seed ^ 0x631A2028; NextUInt64();
      v = u;                     NextUInt64();
      w = v;                     NextUInt64();
    }

// Quake Champions
static ulong    qc_seed = 0;
static uchar    qc_ivec[32] = {0};
static ushort   qc_seed_idx = 0;
static ushort   qc_ivec_idx = 0;

void quake_decrypt_init(uchar *key) {
   int     i;
   for(i = 0; i < sizeof(qc_ivec); i  ) {
      qc_ivec[i] = key[i];
   }
   qc_seed = *(ulong *)key;
   qc_seed_idx = 0;
   qc_ivec_idx = 0;
   NrRandom(qc_seed);
}

int quake_decrypt(unsigned char *data, int size) {
    int     i;
    for(i = 0; i < size; i  ) {
        uchar old = qc_ivec[qc_ivec_idx];
        qc_ivec[qc_ivec_idx] = data[i] ;
        data[i] ^= (qc_seed_idx == 0 ? qc_seed :0) ^ old ;
        qc_ivec_idx = (qc_ivec_idx   1) & 0x1f;
        if(  qc_seed_idx == 8) {
            qc_seed = NextUInt64();
            qc_seed_idx = 0;
        }
    }
    return size;
}
"

goto -40
getdstring KEY 40
calldll MEMORY_FILE10 "quake_decrypt_init" "tcc" RET KEY
findloc OFFSET binary "PK\x06\x06" 0 "" 0
goto OFFSET
idstring "PK\x06\x06"
   get ZERO byte
   get central_entries longlong
   get central_size longlong
   get central_offset longlong
   get DUMMY_offset longlong

goto central_offset
for i = 0 < central_entries

    savepos TMP
    log MEMORY_FILE TMP 0x2e
    calldll MEMORY_FILE10 "quake_decrypt" "tcc" RET MEMORY_FILE 0x2e
    goto 0x2e 0 SEEK_CUR

    goto 0 MEMORY_FILE
    idstring MEMORY_FILE "PK\x01\x02"
        get ver_made        short MEMORY_FILE
        get ver_need        short MEMORY_FILE
        get flag            short MEMORY_FILE
        get method          short MEMORY_FILE
        get modtime         short MEMORY_FILE
        get moddate         short MEMORY_FILE
        get zip_crc         long MEMORY_FILE
        get comp_size       long MEMORY_FILE
        get uncomp_size     long MEMORY_FILE
        get name_len        short MEMORY_FILE
        get extra_len       short MEMORY_FILE
        get comm_len        short MEMORY_FILE
        get disknum         short MEMORY_FILE
        get int_attr        short MEMORY_FILE
        get ext_attr        long MEMORY_FILE
        get rel_offset      long MEMORY_FILE

    savepos TMP
    log MEMORY_FILE TMP name_len
    calldll MEMORY_FILE10 "quake_decrypt" "tcc" RET MEMORY_FILE name_len
    goto name_len 0 SEEK_CUR

    goto 0 MEMORY_FILE
        getdstring name     name_len MEMORY_FILE

        # not encrypted
        getdstring extra    extra_len
        getdstring comment  comm_len

      if extra_len >= 12
         getvarchr extra_id extra 0 short
         if extra_id == 0x0001
            if rel_offset == 0xffffffff
               getvarchr rel_offset extra 4 longlong
            endif
         endif
      endif
      
    math offset = 0x1e
    math offset   rel_offset

        if method == 0
            Log name offset uncomp_size # same as comp_size
            #Log name offset comp_size   # was uncomp_size before AES
        else
            if method == 8
                ComType deflate
            else
                print "unsupported compression method %method%"
                cleanexit
            endif
            CLog name offset comp_size uncomp_size
        endif
next i

April 11, 20251 yr

Author
Localization

Rev3n4nt, posted Tue Oct 02, 2018 9:41 am (38937)

z65536 Thanks for the effort, but it's not working with current Quake Champions version on Steam.
It still asks for SEED2, constants: 0x631A2028 OR 0x412e2206 apparently are not working for my latest version on Steam. I assume seed/constant changes vor newer versions, that's why I asked how to get those variables in post above.

April 11, 20251 yr

Author
Localization

z65536, posted Tue Oct 02, 2018 2:10 pm (38941)

Rev3n4nt wrote:

z65536 Thanks for the effort, but it's not working with current Quake Champions version on Steam.
It still asks for SEED2, constants: 0x631A2028 OR 0x412e2206 apparently are not working for my latest version on Steam. I assume seed/constant changes vor newer versions, that's why I asked how to get those variables in post above.

Really?
I redownloaded Quake Champions today. this script still working.

April 11, 20251 yr

Author
Localization

peterzhenhh, posted Tue Oct 02, 2018 3:29 pm (38945)

It works! THX!

April 11, 20251 yr

Author
Localization

Rev3n4nt, posted Tue Oct 02, 2018 8:40 pm (38956)

z65536

Quote:

Really?
I redownloaded Quake Champions today. this script still working.

My bad. You're right, it works. Something was on my side: I deleted all Quake Champions files and redownloaded - extracts as it should. Thanks

April 11, 20251 yr

Author
Localization

Rev3n4nt, posted Sun Oct 14, 2018 7:16 pm (39571)

I used unpacker script, and got all files out.
Models are seems to be *.TPL files(at least static ones).
Textures are *.PCT
from Xentax forum:

Quote:

GRiNDERKILLER wrote:
About TPL files they have a string S3DRESOURCE means SABER 3D RESOURCE. MESH maybe?... I tried H2O but no luck. Since i still don't know where starts VTBlock and which size has.

Quote:

GRiNDERKILLER wrote:
PCT are only textures. TCIP header means PICTURE. Btw textures are easily convertable by Rawtex. You must just set start offset of raw data sometimes guess compression. But mostly they are BC7 - RGB/sRGB

I used Ninja Ripper for extracting weapon models & textures before - back then UV's were ripped fine, now they're mess. Since size is same(tris&vertex) in new version, I upload old ripped model with textures for comparison and maybe help to recognize new format.
http://www.mediafire.com/file/2fg1bci3hi6dr6m/qc_rge_ripp.zip/file
If anybody figure out how to read\convert models and textures files into common models and textures format with keeping UV's for models - I upload models and textures for that as well.
http://www.mediafire.com/file/t88wuha6ps44qcg/qc_rge_textures.zip/file
http://www.mediafire.com/file/c3e9vfxrs9elc6p/qc_rge_tpl.zip/file

April 11, 20251 yr

Author
Localization

Psychotic Care Bear, posted Mon Oct 15, 2018 2:22 am (39585)

is this still working after the 10/11 update, or am I just doing it wrong

quickbms -> qc.bms -> pak -> folder, that is right?

just trying to get at the pct's in initial.pak

April 11, 20251 yr

Author
Localization

h3x3r, posted Mon Oct 15, 2018 4:19 pm (39592)

Doesn't work since last HUGE update. Seems like seed key was changed too... Output looked weird.

April 11, 20251 yr

Author
Localization

aluigi, posted Mon Oct 15, 2018 5:57 pm (39597)

Just new seed or new format too?

April 11, 20251 yr

Author
Localization

h3x3r, posted Mon Oct 15, 2018 7:39 pm (39599)

This is what script throw...

Code:



  offset           filesize   filename
--------------------------------------

- the script needs to load a pre-compiled function from the dll or code
  MEMORY_FILE10
  do you want to continue with this and any other requested dll/code (y/N)?
  y
- library MEMORY_FILE10 loaded at address 00BC2F40
- function found at offset 00BC10AD
- function found at offset 00BC113A
  000000000000001e 140        [dOtabase]?_\abiliey_cooldwn.tpl

- it's not possible to create that file due to its filename or related
  incompatibilities (for example already exists a folder with that name), so
  now you must choose a new filename for saving it.
  if you press ENTER a new name will be generated automatically.
  - old: [dOtabase]?_\abiliey_cooldwn.tpl
  - new: a

- signature of 4 bytes at offset 0x0000000000000000 doesn't match the one
  expected by the script:

  this one: "]Lo"
  5d 18 4c f5                                       ].L.

  expected: "PK"
  50 4b 01 02                                       PK..

- 1 files found in 231 seconds
  coverage file 0     0%   8463       13477777408 . offset 00000003234418eb
  coverage file -1    8%   4          46         . offset 0000000000000004
  coverage file -10   0%   0          1508       . offset 0000000000000000

Press ENTER or close the window to quit

April 11, 20251 yr

Author
Localization

z65536, posted Wed Oct 17, 2018 2:25 am (39631)

The constant was changed. The new one is 0x0F10C856F

April 11, 20251 yr

Author
Localization

Rhoken, posted Wed Oct 17, 2018 2:43 pm (39656)

Seems doesn't work also with the new constant: 0x0F10C856F

Give me this error and no files are extracted. tried with the "quakechampions.bms" script and quickBMS 4gb file...

April 11, 20251 yr

Author
Localization

z65536, posted Wed Oct 17, 2018 4:21 pm (39660)

Rhoken wrote:

Seems doesn't work also with the new constant: 0x0F10C856F

Give me this error and no files are extracted. tried with the "quakechampions.bms" script and quickBMS 4gb file...

Try this script

Code:

# Quake Champions
# script for QuickBMS http://quickbms.aluigi.org

quickbmsver "0.8.0"
set MEMORY_FILE10 string "
typedef unsigned char uchar;
typedef unsigned short ushort;
typedef unsigned long long ulong;

    // Numerical Recipes 3rd edition
    static ulong u, v, w;

    ulong NextUInt64()
    {
      u = u * 2862933555777941757ULL   7046029254386353087ULL;
      v ^= v >> 17; v ^= v > 8;
      w = 4294957665U * (w & 0xffffffff)   (w >> 32);
      ulong x = u ^ (u > 35; x ^= x       return (x   v) ^ w;
    }

    void NrRandom(ulong seed)
    {
      v = 4101842887655102017ULL;
      w = 1;

      u = v ^ seed ^ 0x0F10C856F; NextUInt64();
      v = u;                     NextUInt64();
      w = v;                     NextUInt64();
    }

// Quake Champions
static ulong    qc_seed = 0;
static uchar    qc_ivec[32] = {0};
static ushort   qc_seed_idx = 0;
static ushort   qc_ivec_idx = 0;

void quake_decrypt_init(uchar *key) {
   int     i;
   for(i = 0; i       qc_ivec[i] = key[i];
   }
   qc_seed = *(ulong *)key;
   qc_seed_idx = 0;
   qc_ivec_idx = 0;
   NrRandom(qc_seed);
}

int quake_decrypt(unsigned char *data, int size) {
    int     i;
    for(i = 0; i         uchar old = qc_ivec[qc_ivec_idx];
        qc_ivec[qc_ivec_idx] = data[i] ;
        data[i] ^= (qc_seed_idx == 0 ? qc_seed :0) ^ old ;
        qc_ivec_idx = (qc_ivec_idx   1) & 0x1f;
        if(  qc_seed_idx == 8) {
            qc_seed = NextUInt64();
            qc_seed_idx = 0;
        }
    }
    return size;
}
"

goto -40
getdstring KEY 40
calldll MEMORY_FILE10 "quake_decrypt_init" "tcc" RET KEY
findloc OFFSET binary "PK\x06\x06" 0 "" 0
goto OFFSET
idstring "PK\x06\x06"
   get ZERO byte
   get central_entries longlong
   get central_size longlong
   get central_offset longlong
   get DUMMY_offset longlong

goto central_offset
for i = 0 
    savepos TMP
    log MEMORY_FILE TMP 0x2e
    calldll MEMORY_FILE10 "quake_decrypt" "tcc" RET MEMORY_FILE 0x2e
    goto 0x2e 0 SEEK_CUR

    goto 0 MEMORY_FILE
    idstring MEMORY_FILE "PK\x01\x02"
        get ver_made        short MEMORY_FILE
        get ver_need        short MEMORY_FILE
        get flag            short MEMORY_FILE
        get method          short MEMORY_FILE
        get modtime         short MEMORY_FILE
        get moddate         short MEMORY_FILE
        get zip_crc         long MEMORY_FILE
        get comp_size       long MEMORY_FILE
        get uncomp_size     long MEMORY_FILE
        get name_len        short MEMORY_FILE
        get extra_len       short MEMORY_FILE
        get comm_len        short MEMORY_FILE
        get disknum         short MEMORY_FILE
        get int_attr        short MEMORY_FILE
        get ext_attr        long MEMORY_FILE
        get rel_offset      long MEMORY_FILE

    savepos TMP
    log MEMORY_FILE TMP name_len
    calldll MEMORY_FILE10 "quake_decrypt" "tcc" RET MEMORY_FILE name_len
    goto name_len 0 SEEK_CUR

    goto 0 MEMORY_FILE
        getdstring name     name_len MEMORY_FILE

        # not encrypted
        getdstring extra    extra_len
        getdstring comment  comm_len

      if extra_len >= 12
         getvarchr extra_id extra 0 short
         if extra_id == 0x0001
            if rel_offset == 0xffffffff
               getvarchr rel_offset extra 4 longlong
            endif
         endif
      endif
      
    math offset = 0x1e
    math offset   rel_offset

        if method == 0
            Log name offset uncomp_size # same as comp_size
            #Log name offset comp_size   # was uncomp_size before AES
        else
            if method == 8
                ComType deflate
            else
                print "unsupported compression method %method%"
                cleanexit
            endif
            CLog name offset comp_size uncomp_size
        endif
next i

April 11, 20251 yr

Author
Localization

Rhoken, posted Wed Oct 17, 2018 4:53 pm (39661)

z65536 wrote:

Rhoken wrote:

Seems doesn't work also with the new constant: 0x0F10C856F

Give me this error and no files are extracted. tried with the "quakechampions.bms" script and quickBMS 4gb file...

Try this script

Code:

# Quake Champions
# script for QuickBMS http://quickbms.aluigi.org

quickbmsver "0.8.0"
set MEMORY_FILE10 string "
typedef unsigned char uchar;
typedef unsigned short ushort;
typedef unsigned long long ulong;

    // Numerical Recipes 3rd edition
    static ulong u, v, w;

    ulong NextUInt64()
    {
      u = u * 2862933555777941757ULL   7046029254386353087ULL;
      v ^= v >> 17; v ^= v > 8;
      w = 4294957665U * (w & 0xffffffff)   (w >> 32);
      ulong x = u ^ (u > 35; x ^= x       return (x   v) ^ w;
    }

    void NrRandom(ulong seed)
    {
      v = 4101842887655102017ULL;
      w = 1;

      u = v ^ seed ^ 0x0F10C856F; NextUInt64();
      v = u;                     NextUInt64();
      w = v;                     NextUInt64();
    }

// Quake Champions
static ulong    qc_seed = 0;
static uchar    qc_ivec[32] = {0};
static ushort   qc_seed_idx = 0;
static ushort   qc_ivec_idx = 0;

void quake_decrypt_init(uchar *key) {
   int     i;
   for(i = 0; i       qc_ivec[i] = key[i];
   }
   qc_seed = *(ulong *)key;
   qc_seed_idx = 0;
   qc_ivec_idx = 0;
   NrRandom(qc_seed);
}

int quake_decrypt(unsigned char *data, int size) {
    int     i;
    for(i = 0; i         uchar old = qc_ivec[qc_ivec_idx];
        qc_ivec[qc_ivec_idx] = data[i] ;
        data[i] ^= (qc_seed_idx == 0 ? qc_seed :0) ^ old ;
        qc_ivec_idx = (qc_ivec_idx   1) & 0x1f;
        if(  qc_seed_idx == 8) {
            qc_seed = NextUInt64();
            qc_seed_idx = 0;
        }
    }
    return size;
}
"

goto -40
getdstring KEY 40
calldll MEMORY_FILE10 "quake_decrypt_init" "tcc" RET KEY
findloc OFFSET binary "PK\x06\x06" 0 "" 0
goto OFFSET
idstring "PK\x06\x06"
   get ZERO byte
   get central_entries longlong
   get central_size longlong
   get central_offset longlong
   get DUMMY_offset longlong

goto central_offset
for i = 0 
    savepos TMP
    log MEMORY_FILE TMP 0x2e
    calldll MEMORY_FILE10 "quake_decrypt" "tcc" RET MEMORY_FILE 0x2e
    goto 0x2e 0 SEEK_CUR

    goto 0 MEMORY_FILE
    idstring MEMORY_FILE "PK\x01\x02"
        get ver_made        short MEMORY_FILE
        get ver_need        short MEMORY_FILE
        get flag            short MEMORY_FILE
        get method          short MEMORY_FILE
        get modtime         short MEMORY_FILE
        get moddate         short MEMORY_FILE
        get zip_crc         long MEMORY_FILE
        get comp_size       long MEMORY_FILE
        get uncomp_size     long MEMORY_FILE
        get name_len        short MEMORY_FILE
        get extra_len       short MEMORY_FILE
        get comm_len        short MEMORY_FILE
        get disknum         short MEMORY_FILE
        get int_attr        short MEMORY_FILE
        get ext_attr        long MEMORY_FILE
        get rel_offset      long MEMORY_FILE

    savepos TMP
    log MEMORY_FILE TMP name_len
    calldll MEMORY_FILE10 "quake_decrypt" "tcc" RET MEMORY_FILE name_len
    goto name_len 0 SEEK_CUR

    goto 0 MEMORY_FILE
        getdstring name     name_len MEMORY_FILE

        # not encrypted
        getdstring extra    extra_len
        getdstring comment  comm_len

      if extra_len >= 12
         getvarchr extra_id extra 0 short
         if extra_id == 0x0001
            if rel_offset == 0xffffffff
               getvarchr rel_offset extra 4 longlong
            endif
         endif
      endif
      
    math offset = 0x1e
    math offset   rel_offset

        if method == 0
            Log name offset uncomp_size # same as comp_size
            #Log name offset comp_size   # was uncomp_size before AES
        else
            if method == 8
                ComType deflate
            else
                print "unsupported compression method %method%"
                cleanexit
            endif
            CLog name offset comp_size uncomp_size
        endif
next i

Seems to work now, thanks. Now on the go to find how to open the various "proprietary" extension files

April 11, 20251 yr

Author
Localization

Rhoken, posted Wed Oct 17, 2018 5:15 pm (39662)

Alright, after i extracted the files... now seems impossible to use this files.

.PCT files are the texture files but ANY version of QCPCT give me a corrupted images
.hkx files remember me some animation files from Skyrim
.TPL files maybe is the model but i don't find any tool to extract it.

So now is a good goal that we have a working method to extract files from pak (before they release a new update), but the problem begin now on how to extract these files..

Quake Champions

Featured Replies

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Account

Navigation

Search

Configure browser push notifications

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)