apollon08170, posted Fri Sep 15, 2017 8:56 pm (26530)

---

Hello ,

I'm not a developer, i have try to attached the file with VisualStudio to some extractor program.
But no success, sorry in advance for the noob question... I'm a beginner.
I do not know how to run this tool , Can you help me with a little tutorial please.

Best Regards

aluigi, posted Fri Sep 15, 2017 10:07 pm (26531)

---

I can try to write a quickbms script if someone can provide the aes keys and the nonce

aluigi, posted Tue Sep 19, 2017 5:17 pm (26620)

---

I leave my converted script here:
http://aluigi.org/bms/destiny2.bms

Obviously it has NOT been tested and it's probably wrong, in fact many files are just 1 byte and only the 24% of the decompressed filesystem is parsed, tested with one of the provided samples (with decryption disabled obviously).
I guess there is a problem in how the bitfields of the entries are read but the offsets/next_offsets and the sizes match, feel free to check and fix it.

Extreme110, posted Thu Oct 19, 2017 2:39 am (27464)

---

Preloading for the retail version went live today. I can launch the executable and arrive at the loadscreen. Not sure how to grab the AES/Nonce keys so I'd appreciate a bit of help there.

apollon08170, posted Sun Oct 22, 2017 4:01 pm (27604)

---

1 =)

ardvent, posted Wed Oct 25, 2017 3:24 pm (27686)

---

Sir Kane wrote:

It's AES-GCM with one of two static 128 bit keys (a flag in the block table entry indicates which to use). The 12 byte nonce is initialized using some static data, then modified with package ID and a constant that matches the pkg version or whatever it is. The authentication tag is the last 16 bytes in the block table entry.

I've managed to decrypt and decompress some data earlier and just need to make a usable tool.

Attached the source for a simple extraction tool with the keys and nonce stripped.

This is SO HELPFUL!
I'm working on the oo2core_3_win64.dll trying to create a process dump with tagging to pull out the keys.
Any way you wouldn't mind PMing the keys to add into the code?

GL ALL

ardvent, posted Wed Oct 25, 2017 3:32 pm (27687)

---

Untested: Destiny2ools looks like it can extract files from memory during play
https://github.com/Ernegien/Destiny2ools

Sir Kane, posted Mon Oct 30, 2017 7:50 pm (29567)

---

I just checked, the beta keys/nonce init values don't work anymore.

Ginsor, posted Tue Oct 31, 2017 4:20 pm (29588)

---

Sir Kane wrote:

I just checked, the beta keys/nonce init values don't work anymore.

hmm for most of the packages it still works for me. just for some (especially the smaller sized ones) it cant read the entry block data.

ardvent, posted Tue Oct 31, 2017 8:51 pm (29596)

---

Sir Kane wrote:

I just checked, the beta keys/nonce init values don't work anymore.

Could you PM me your beta keys so I can cross check the decompiled beta exe to my decompiled retail for the new keys/nonce?

ardvent, posted Wed Nov 01, 2017 9:21 pm (29635)

---

aluigi wrote:

I leave my converted script here:
http://aluigi.org/bms/destiny2.bms

Obviously it has NOT been tested and it's probably wrong, in fact many files are just 1 byte and only the 24% of the decompressed filesystem is parsed, tested with one of the provided samples (with decryption disabled obviously).
I guess there is a problem in how the bitfields of the entries are read but the offsets/next_offsets and the sizes match, feel free to check and fix it.

Still a WIP but I've been pulling AES Keys from Destiny2.exe out of memory at kernel mode.

Destiny 2 Beta:
[000000E44DBEE3C0] AES-256 decryption key: c7edbcad64907d8372d20872e011efe6b4163a5196f5c4f7fe2f68e78097a1a0

Destiny 2 Retail:
[000001D40800B220] AES-256 decryption key: 7a7a2230aae9fa491356143cf0de95c819d21106ff8a010de2f600eaf241cffa
[000001D4FF084060] AES-256 decryption key: c465a7db48eea10f5d38993505cb60d20fa106f7c78529fc6b0034f0eaa07093

Darpow, posted Sat Nov 04, 2017 4:51 pm (29739)

---

Following this post with intrigue.
Just installed my copy of Destiny 2 on PC, and ready to grab that awesome music from it

There is a guy on the destiny reddit that appears to have datamined it already 'TheEcumene' - https://www.reddit.com/r/DestinyTheGame ... _spoilers/
Maybe they can help?

Nik Burnt, posted Thu Jan 04, 2018 11:45 am (31277)

---

Can someone provide info about keys and nounce or how to obtain them?
Thank You!

Sir Kane, posted Thu Jan 04, 2018 6:16 pm (31287)

---

I was wrong about the keys/nonce having changed, they turned out to be the same as beta. The code just needed to deal with patch archives.

The files reference other files via a package ID and entry index packed into an uint32_t:

Code:

EntryID = (handle & 0x1FFF)
PkgID = (handle >> 13) & 0x3FF

Here's an example:

Code:

0x80A02446 & 0x1FFF = 0x446 (1094)
(0x80A02446 >> 13) & 0x1FF = 0x101

The localized text is obfuscated using a simple additive cipher.

I attached the updated code that works with the release version of the game.

bobross, posted Sun Mar 11, 2018 12:59 pm (33089)

---

I'm very interested in these files. If anyone could help me understand how to find the keys/nonce I would greatly appreciate it.

zaramot, posted Mon Mar 12, 2018 8:48 am (33126)

---

Yes, I'm also very interested in destinty 2. Does anyone was acrually able to extract 3d models/textures? If someone could explain how to extract files from .pkg or could provide some samples of 3d model files, that would be great! Thank you

NepsyNeptune, posted Sat Jun 09, 2018 10:55 am (35742)

---

anyone have luck ripping destiny 2 yet ?? id love to get a hold of the In game Hud ui textures >.<

Sir Kane, posted Sat Jun 16, 2018 11:42 pm (35963)

---

Code:

const static uint8_t g_AESKey0[16] = {
   0xD6, 0x2A, 0xB2, 0xC1, 0x0C, 0xC0, 0x1B, 0xC5, 0x35, 0xDB, 0x7B, 0x86, 0x55, 0xC7, 0xDC, 0x3B,
};

const static uint8_t g_AESKey1[16] = {
   0x3A, 0x4A, 0x5D, 0x36, 0x73, 0xA6, 0x60, 0x58, 0x7E, 0x63, 0xE6, 0x76, 0xE4, 0x08, 0x92, 0xB5,
};

static const uint8_t s_NonceInit[12] = {
   0x84, 0xDF, 0x11, 0xC0,
   0xAC, 0xAB, 0xFA, 0x20,
   0x33, 0x11, 0x26, 0x99,
};

onetwothree, posted Sun Jul 08, 2018 7:34 pm (36596)

---

Would assume no tools were made yet for D2?

aluigi, posted Mon Jul 09, 2018 5:33 am (36605)

---

There is my script that I "suppose" works correctly when you copy&paste the keys provided by Sir Kane in the 3 variables at the beginning of the script:
http://aluigi.org/bms/destiny2.bms

Example:

Code:

set g_AESKey0   string "0xD6, 0x2A, 0xB2, 0xC1, 0x0C, 0xC0, 0x1B, 0xC5, 0x35, 0xDB, 0x7B, 0x86, 0x55, 0xC7, 0xDC, 0x3B"
set g_AESKey1   string "0x3A, 0x4A, 0x5D, 0x36, 0x73, 0xA6, 0x60, 0x58, 0x7E, 0x63, 0xE6, 0x76, 0xE4, 0x08, 0x92, 0xB5,"
set s_NonceInit string "0x84, 0xDF, 0x11, 0xC0, 0xAC, 0xAB, 0xFA, 0x20, 0x33, 0x11, 0x26, 0x99,"

Let us know if it works

Derik, posted Mon Jul 09, 2018 3:32 pm (36635)

---

Hello everybody,
I compiled and tested the cpp file by Sir Kane.
As a result you get binary files from the respective package. Currently only certain files can be identified (RIFF format).
At the moment I'm trying to convert these back to normal .wav files, so far I have not been successful.

Greetings...

Ginsor, posted Tue Jul 10, 2018 8:14 am (36651)

---

I will release a tool in the next couple of days which will support audio/sound files, textures/images, videos, and all kind of text files (dialogs, names, lore, descriptions, etc). I didnt make a final decision what I will put into the first release but it will definitely include a "one-click-solution" where you just have to select a PKG and can view the assets of the given filetypes mentioned above.

Models is still too early in WIP progress and will not be supported in the first release, but me and others are working on this.

You can see a first preview of this tools right here: Destiny 2 Tool (Youtube Preview)
(Its likely that a lot of it will be changed in terms of functionality and interface)

Derik, posted Sun Jul 15, 2018 2:10 pm (36783)

---

Hey,
@Ginsor
The program looks very interesting, how did you actually manage to get the pictures from the UI packages?

Only as side information how you can get the audio files:
Simply use the ww2ogg program to convert the binary files with a special PCB package.

Best regards and
happy data mining

Derik, posted Thu Jul 19, 2018 1:36 pm (36866)

---

Good day everybody,
can you help me with one thing?

I have been trying to extract the package w64_ui_02af_12.pkg for a few days, but unfortunately I get the following error: "Block 0 uses non-loaded patch ID 1."

What I have found out so far:
- The patch ID of the header is 12
- The patch ID of the block is 1

The script assumes, however, that the patch ID of the block is exactly the same as that of the header.
I would be interested to know what these PatchID's say, does one of you know by chance?

Thanks and best regards.

Ginsor, posted Thu Jul 19, 2018 2:11 pm (36867)

---

Derik wrote:

Good day everybody,
can you help me with one thing?

I have been trying to extract the package w64_ui_02af_12.pkg for a few days, but unfortunately I get the following error: "Block 0 uses non-loaded patch ID 1."

What I have found out so far:
- The patch ID of the header is 12
- The patch ID of the block is 1

The script assumes, however, that the patch ID of the block is exactly the same as that of the header.
I would be interested to know what these PatchID's say, does one of you know by chance?

Thanks and best regards.

you have to keep the other w64_ui_02af_*.pkg files in the same folder. in your example it looks for w64_ui_02af_1.pkg but cant find it