Reverse engineering the extraction of Game Archives using QuickBMS/Python

[user3678]

Today I am gonna discuss on how we can reverse engineer the extraction of the game archives, sit back because this is where it starts to get interesting...

 

+==== TUTORIAL SECTION ====+

But how do those files store game assets like 3D Models, Textures, Sounds, Videos and etc...
Well, the anwser is simple, they usually bundle them, they pack them close together in their eighter compressed or even encrypted form (Rarely).
The packed file usually contains compressed data and a small separator/padding between them, hover it doesn't tell us the name and the path of the file we want to com press, whch is a problem.
Heck, we don't even know which compression method was used and which "flavour/version" and how the decompressed file should look like... That's where QuckBMS comes to help.

=| QuickBMS |=
QuickBMS has one very specific function I wanna talk about, it's "comptype unzip_dynamic" it supports millions methods and their "flavours/versions".
It has also a very fast perfomance and is good for extracting the multiple files out of the package at once.
There are also already lots of QuckBMS scripts out there for extracting specific archives, but I'll talk about that later.

=| PRACTICAL STEPS |=
As said previously, the block separators/markers are very usefull to identify but turns out most of the compression methods have their own headers and magic numbers, here are few of them:

Magic numbers:
ZLIB:
78 01 (NoComp)
78 5E (Fastest)
78 9C (Default)
78 DA (Maximum)
LZ4:
[No Magic Numbers]
LZ4 Frame:
04 22 4D 18 (Default)
LZW:
[No Magic Numbers]
LZO:
[No Magic Numbers]
BZIP/BZIP2:
42 5A 68
GZIP:
1F 8B 08

Edited yesterday at 12:15 AM by user3678