This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=686

AlphaTwentyThree, posted Mon Mar 02, 2015 2:02 pm (3567)

---

Hi there!
Can somebody take a look at the pak archives from this game? I don't know how to read the TOC. :\
Here's a sample snippet: http://*USE_ANOTHER_FILEHOSTING*/c37bc64 ... a/sound.7z
Thanks!

aluigi, posted Mon Mar 02, 2015 2:32 pm (3569)

---

http://aluigi.org/papers/bms/others/tot ... attila.bms

AlphaTwentyThree, posted Mon Mar 02, 2015 3:36 pm (3571)

---

Thanks Luigi!

AlphaTwentyThree, posted Mon Mar 02, 2015 3:47 pm (3573)

---

There seems to be a problem with the music archive: http://*USE_ANOTHER_FILEHOSTING*/0bb0da3 ... .pack_16mb
Are the files encrypted?

aluigi, posted Mon Mar 02, 2015 4:18 pm (3574)

---

I'm not really sure if it's obfuscated.
For sure it's not a block cipher algorithm and not a compression.
Maybe it's just a particular codec?

AlphaTwentyThree, posted Mon Mar 02, 2015 4:38 pm (3575)

---

The weird thing is that the wem and bnk files have the same structure (16bytes repeating structure at the start) but of course the bnk files should begin with a BKHD identifier. Take a look: http://*USE_ANOTHER_FILEHOSTING*/1f93014 ... wem_bnk.7z
That's why I suspected some kind of encryption.
The problem only occurs with the music.pack and music_en_shared_rome2.pack.

AlphaTwentyThree, posted Mon Mar 02, 2015 4:44 pm (3576)

---

Here are samples of both types of bnk archives: http://*USE_ANOTHER_FILEHOSTING*/f7ca0f8 ... samples.7z

aluigi, posted Mon Mar 02, 2015 6:41 pm (3579)

---

Ok, it's an obfuscation.
The files are xored with a sequence of bytes that starts with: f2 6d 59 bf a6 67 bb b0 82 dd 24 ba ...
The key is the same for both bnk and wem files but I think it's generated at runtime.

AlphaTwentyThree, posted Mon Mar 02, 2015 10:09 pm (3590)

---

Is it possible to obtain that key through the executable file? http://*USE_ANOTHER_FILEHOSTING*/9d514b9 ... /Attila.7z

aluigi, posted Mon Mar 02, 2015 10:25 pm (3591)

---

I already tried it (attila.dll)

Mygoshi, posted Mon Mar 02, 2015 10:33 pm (3592)

---

I wanted to help you but I don't think I'm experienced enough ^^

AlphaTwentyThree, posted Mon Mar 02, 2015 10:35 pm (3594)

---

Well, thanks for trying anyway

Mygoshi, posted Mon Mar 02, 2015 10:36 pm (3595)

---

:/