This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=7936

umisery, posted Mon May 28, 2018 10:28 am (35348)

---

Would anyone know how to extract Forza zips with compression method 22?

Here's an example zip:

DISsumSAUCE, posted Mon May 28, 2018 4:40 pm (35354)

---

^^^^Seconded, it'd be a HUUUUGE help if anyone can figure this out.

PsYcHo_RaGE, posted Tue May 29, 2018 4:04 am (35374)

---

let's figure it out what it has.....intresting content

aluigi, posted Tue May 29, 2018 7:51 am (35377)

---

Considering the minimum compressed size being 0x234 even if the uncompressed size is smaller, I suspect there is some encryption/obfuscation (dictionary?) involved.
offset, comp_size, uncomp_size:

Code:

0x0000002e 0x00000234 0x00000430
0x0000029c 0x00000234 0x000002ac
0x00000510 0x00000234 0x000000ba
0x00000770 0x00000444 0x000026a6
0x00000bee 0x00000864 0x0000477a
0x00001481 0x00000c84 0x00007bf8
0x0000213a 0x00000654 0x000025c2
0x000027b7 0x000010a4 0x00008551
0x00003886 0x00000234 0x00000436
0x00003ae8 0x00000234 0x00000432
0x00003d4e 0x00000444 0x00000b25
0x000041c3 0x00000a74 0x000051ab
0x00004c66 0x00000654 0x00002b8c
0x000052f1 0x000033b4 0x000316d3
0x000086d6 0x000033b4 0x000315cf
0x0000bab6 0x00000234 0x00000446
0x0000bd18 0x00000444 0x0000158b
0x0000c18b 0x00005ae4 0x00060a1f
0x00011ca9 0x00000c84 0x000129f4
0x0001295b 0x00000234 0x00000427
0x00012bbf 0x00000444 0x00000f02
0x0001302b 0x00000234 0x000002e1
0x0001328b 0x00000234 0x00000095
0x000134f2 0x00000234 0x000000b6

umisery, posted Sat Jun 09, 2018 2:04 am (35380)

---

Encryption/obfuscation doesn't sound very good, I hope it gets figured out

aluigi, posted Sat Jun 09, 2018 6:40 am (35740)

---

There are some missing information in this topic.
Is it Forza 7?
For what platform? (and is this method 22 used on both the platforms?)
Do all the zip files use this method 22 or only few ones?

umisery, posted Sat Jun 09, 2018 9:31 am (35741)

---

It's Forza Horizon 3, in the later updates they used method 22 on some of the zips (not all afaik, I don't have the dumped game files right now to check).

From PC, I don't know what method(s) the Xbox version uses but I presume the same since this is a console port.

umisery, posted Fri Jun 22, 2018 1:57 pm (35901)

---

Here's some more method 22 zips:

https://www32.zippyshare.com/v/sKD4lSxd/file.html


https://www32.zippyshare.com/v/qxgNNfTZ/file.html

umisery, posted Thu Aug 16, 2018 11:32 am (37583)

---

Forza Horizon 4 uses method 22 on some zips as well, can't upload any files yet though. I'm hoping that someone will eventually make a script for this, it will be very helpful.

D3FEKT, posted Sat Oct 06, 2018 3:51 am (39161)

---

Unsure if there has been any progress for method 22 zips, but now with Forza Horizon 4 being released, can now note that most zips in that game are method 22.
Here is 5 more sample zips to go by.

https://www.mediafire.com/file/09m5q7y4 ... a.rar/file

Thanks

SoniKalien, posted Fri Apr 26, 2019 9:37 pm (47334)

---

Pertaining to Forza Horizon 4:

I own the game, but I didn't want to screw around with permissions etc because I actually play it as well :]

What I've been able to do is use R-Studio to copy a few archives from the install directory successfully to another drive. I unchecked "keep permissions and stuff" or something like that. That has given me 2 files (eg):

Code:

REN_5Turbo_HE_80.zip
REN_5Turbo_HE_80.zip.$efs

I opened the .$efs file with a hexeditor and it starts with:

Code:

.appx_...

followed by unreadable hex code (a bunch of number and letters lol)

So I am hoping that might be a clue into getting these extracted. I have tried various variations of forza studio and other extractors and the general consensus is that "this is not a valid archive". I'm guess that is because of encryption. Is the .$efs any help to getting them decrypted?

umisery, posted Tue Apr 30, 2019 12:28 pm (47460)

---

Did you just say that R-Studio completely bypassed EFS perms on FH4 and allowed it to be copied elsewhere? That in itself is huge news.

Would you be able to upload both those files please? If they're openable, copyable and editable then this is insane as the game can't even be dumped from kernel with any sorts of perms due to how strong EFS is on FH4.

CTRLC, posted Tue Apr 30, 2019 5:17 pm (47467)

---

Here is the 2 files efs still in there but we have the *efs files, if anyone know how to do that we are happy to know that.

https://www65.zippyshare.com/v/1Hv8DFsy/file.html

ThatsJustLogic, posted Tue Apr 30, 2019 5:34 pm (47468)

---

Can anyone explain how its done using R-Studio? I want to look into it a little bit.

CTRLC, posted Tue Apr 30, 2019 5:40 pm (47469)

---

You need the use recover file feature, simply go to game files select recover what you want.

SoniKalien, posted Wed May 01, 2019 12:48 am (47476)

---

I'm glad my success has been replicated

Yes it's easy to copy the files with R-Studio. I run my pc using 3 partitioned o/s's (all win 10) the first is my main... let's call it "work" os and the third is for my legit stuff (games) so I'm using RStudio in my "work" os to copy from the legits o/s to another drive. Just to avoid messing up stuff.

As for opening/editing... no the zip cannot be extracted. I suspect because of encryption. I have tried ForzaStudio which has so far been able to extract the .zips from previous titles.

here's my 2 files. https://www34.zippyshare.com/v/wV4KoisM/file.html

umisery, posted Wed May 01, 2019 1:43 pm (47495)

---

Still has EFS encryption, just without perms restricted user-access anymore. But this step one, progress is being made.

SoniKalien, posted Wed May 01, 2019 11:37 pm (47522)

---

I've just done some comparisons:

ctrl-c vs my AUD_RS2_95.zip.$efs - same file size, last 16 bytes are different (offset(h)-86)

My AUD_RS2_95.zip.$efs vs my REN_5Turbo_HE_80.zip.$efs - same file size, last 40 bytes different starting offset(h)-6E

CTRLC, posted Wed May 08, 2019 1:37 am (47658)

---

Looks like Potato_of_Doom manage to dump the game, I'm not sure how he did tho.

Here is the a car file without EFS.

https://www13.zippyshare.com/v/LFONAlvO/file.html

SoniKalien, posted Wed May 08, 2019 1:51 am (47659)

---

Yea there's a dump going around but I understand it's from pre-release or demo that didn't have the updated efs/uwp and as such is missing a lot of cars.

CTRLC, posted Wed May 08, 2019 2:17 am (47660)

---

I think it's new version of the game but not sure tho, we have to hear him from himself.

umisery, posted Wed May 08, 2019 7:48 am (47663)

---

It's presumably the latest version.

Edit: It is and it's uploaded!

CTRLC, posted Wed May 08, 2019 7:43 pm (47677)

---

I still can't believe how they dump the game using x64dbg, uploaded game version is May 7th 2019(UPDATE 9 included.)

SoniKalien, posted Wed May 08, 2019 7:46 pm (47678)

---

Just saw the post on cs.rin - yes PoD is very clever and this is great

I was looking at methods to dump decrypted files directly from ram without much success. I hadn't come across this one yet

Forza studio will extract decrypted FH4 zips too

Just discovered that Winrar can extract the zips now too!

CTRLC wrote:

I still can't believe how they dump the game using x64dbg, uploaded game version is May 7th 2019(UPDATE 9 included.)

I have got LogerMan torrent from cs.rin and cannot find the update 9 cars. Which release are you looking at?