This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=5044

RageX, posted Tue Oct 03, 2017 5:22 pm (27013)

---

Hi, previous FIFA 17 was known to contain ZSTD streams and it was pretty easy to pick them up by their headers. FIFA 18 also seems to have ZSTD streams but at many places the headers are not even complete (modified?) so its hard to pick ZSTD streams and dump them out.

Can anyone please find a solution to dump all the found ZSTD streams in a CAS file of this game ?

Sample file:

Code:

https://www.mediafire.com/file/f5ovyzca66532ys/cas_01.cas

If you want a smaller sample please tell here.

aluigi, posted Tue Oct 03, 2017 6:37 pm (27017)

---

Can you provide a sample of FIFA17 (maybe the same cas_01.cas if available) so we can check what changed?

RageX, posted Tue Oct 03, 2017 7:30 pm (27019)

---

aluigi wrote:

Can you provide a sample of FIFA17 (maybe the same cas_01.cas if available) so we can check what changed?

Here:

Code:

http://www4.zippyshare.com/v/mwoIobM3/file.html

aluigi, posted Tue Oct 03, 2017 9:51 pm (27020)

---

Ok so the format is the one covered by frostbite.bms.
Do you have the "cat" of fifa18?

RageX, posted Wed Oct 04, 2017 1:48 pm (27040)

---

aluigi wrote:

Ok so the format is the one covered by frostbite.bms.
Do you have the "cat" of fifa18?

Ok, I have attached the cas.cat file associated with that cas_01.cas.
Also here's another set of FIFA 18 samples in case you need it:

Code:

http://www91.zippyshare.com/v/jC5IBBre/file.html

aluigi, posted Thu Oct 05, 2017 9:59 am (27050)

---

I bet the problem is the finalSize 32bit field that apparently is a 24bit:

Code:

01 00 04 60 0f 70 00 b0

So 0x460 is read as 0x01000460.

Are you using FB2Dumper.py?
If yes then find the following line:

Code:

finalSize, magic, payloadLen = unpack(">IHH", cas.read(8))

and add this line after it:

Code:

finalSize &= 0x00ffffff

RageX, posted Thu Oct 05, 2017 10:44 am (27054)

---

aluigi wrote:

Are you using FB2Dumper.py?

Actually I only want to dump out zstd compressed streams, both in compressed (raw,as-it-is) and decompressed forms. Can you help with it ?

aluigi, posted Thu Oct 05, 2017 12:17 pm (27056)

---

No, I can't.
First because it's not clear what type of zstd it's used in fifa18 since zstd06 gives just invalid files and then some chunks use oodle or are no compressed at all.

What I did was updating my frostbite script to version 0.3.1, I will upload it in the next hours

RageX, posted Thu Oct 05, 2017 1:06 pm (27057)

---

aluigi wrote:

No, I can't.
First because it's not clear what type of zstd it's used in fifa18 since zstd06 gives just invalid files and then some chunks use oodle or are no compressed at all.

What I did was updating my frostbite script to version 0.3.1, I will upload it in the next hours

Hmmm maybe thats why in most of the cas files I wasnt even able to detect zstd unlike in FIFA 17 where I could find zstd everywhere, in FIFA 18 along with very few legit zstd chunks, only part of zstd headers were there so maybe they are not even zstd, they were oodle instead like you said.

aluigi, posted Thu Oct 05, 2017 1:49 pm (27058)

---

What's strange is that these invalid zstd chunks have the same 0x0f70 flag of the good ones, the only difference is that 0x01000000 added to the decompressed chunk size which is just another flag (so the size is 24bit).
Trying all the legacy zstd gave the same invalid results and even scanning all the compression algorithms was the same.

aluigi, posted Thu Oct 05, 2017 10:36 pm (27076)

---

The new script is available:
http://aluigi.org/bms/frostbite.bms

deepshit, posted Sat Oct 07, 2017 2:58 pm (27131)

---

ZSTD files in FIFA 18 are using pre defined dictiomary.
The buffer size has changed from 64K to 256K but the compressed size in header is now 24 bits and because of that we see 0x70 , 0x71,0x72,0x73.
The lower bits should be added to compressed size.

And the pre defined ditionary is encrypted in initfs_Win32.

aluigi, posted Sat Oct 07, 2017 5:37 pm (27135)

---

Interesting.
So first of all we need the dictionary to use when the first 8bit flag is 1.
Anyone?

That thing regarding 0x7* is not very clear, for example here I have "00 04 00 00 00 74 00 00" so I must copy 0x40000 bytes without compression to destination and should I append 4 zeroes to it?

In the meantime there was a typo in my script (FLAGS >= 0 instead of != 0) so I have updated it.

deepshit, posted Mon Oct 09, 2017 9:17 am (27180)

---

aluigi wrote:

That thing regarding 0x7* is not very clear, for example here I have "00 04 00 00 00 74 00 00" so I must copy 0x40000 bytes without compression to destination and should I append 4 zeroes to it?

you should copy 0x40000 bytes without compression and you don't need to append anything.
I have decrypted initfs and obtained the dictionary and I have tested it.
Decompression works fine.

If there's no legal concerns I can share it.

aluigi, posted Mon Oct 09, 2017 9:22 am (27183)

---

So why you said "The lower bits should be added to compressed size"?
That means 0x40004 based on what you said.

Yeah, share the dict

deepshit, posted Mon Oct 09, 2017 11:11 am (27190)

---

aluigi wrote:

So why you said "The lower bits should be added to compressed size"?

What I meant was :
00 04 00 00 15 71 A9 9C => ((71 & 0xF) 0x1A99C

Here's the Dictionary.

aluigi, posted Mon Oct 09, 2017 11:55 am (27191)

---

Does the game still use zstd 0.6?
Because I still get invalid data using the dictionary

aluigi, posted Mon Oct 09, 2017 12:06 pm (27192)

---

I answer to myself: no, it uses the new one.
The bad thing is that there is no way to know if it's the old (fifa17) or new one (fifa18)

aluigi, posted Mon Oct 09, 2017 12:16 pm (27193)

---

Script 0.3.3
http://aluigi.org/bms/frostbite.bms

deepshit, posted Mon Oct 09, 2017 12:21 pm (27194)

---

aluigi wrote:

The bad thing is that there is no way to know if it's the old (fifa17) or new one (fifa18)

Actually there is.
Fifa17 zstd compression starts with : 0xFD2FB526
Fifa18 zstd compression starts with : 0xFD2FB528

Of course if you mean the compression.

aluigi, posted Mon Oct 09, 2017 12:27 pm (27195)

---

ZSTD_MAGICNUMBER, good catch

RageX, posted Tue Oct 10, 2017 4:33 pm (27216)

---

^The script works great now, thanks . and @deepshit.

cyberspeed, posted Thu Dec 14, 2017 12:57 am (30738)

---

aluigi wrote:

I bet the problem is the finalSize 32bit field that apparently is a 24bit:

Code:

01 00 04 60 0f 70 00 b0

So 0x460 is read as 0x01000460.

Are you using FB2Dumper.py?
If yes then find the following line:

Code:

finalSize, magic, payloadLen = unpack(">IHH", cas.read(8))

and add this line after it:

Code:

finalSize &= 0x00ffffff

Hi aluigi,

I am using that script you mention on MEA game, and no matter if I add the line you mention or not, I still get the following error after it extracts/dumps some files,

Code:

Traceback (most recent call last):
  File "C:\MEADumper (2).py", line 319, in 
    dumpRoot(g_MainDataRoot)
  File "C:\MEADumper (2).py", line 289, in dumpRoot
    dump(fname, g_TargetDirectory)
  File "C:\MEADumper (2).py", line 203, in dump
    casPayload(entry, targetPath, sourcePath, entry.size)
  File "C:\MEADumper (2).py", line 263, in casPayload
    finalSize, magic, payloadLen = unpack(">IHH", cas.read(8))
error: unpack requires a string argument of length 8

any clue as to how can I get passed it ?