Need help extracting .paz / .pamt files from Crimson Desert (BlackSpace Engine)

[gotjisan]

Hello everyone,

I'm currently trying to extract the localization and UI text files to create a translation mod for Crimson Desert.

The game uses Pearl Abyss's new BlackSpace Engine. The archive structure still uses files, but the meta index file is now in format (unlike the old in BDO). Old BDO extractors like PAZ-Unpacker and UnPAZ do not work anymore due to the new engine's structure and likely different encryption keys. 0.paz 0.pamtpad00000.meta

Has anyone started reverse-engineering the BlackSpace Engine or found the new encryption keys? Any help with a QuickBMS script or an updated extractor for these new / files would be greatly appreciated. 0.pamt 0.paz

Thanks in advance!.

[adastmin]

no crypt files

[Lord Vaako]

I've done some research regarding Crimson Desert pamt/paz files and managed to unpack some files, for example some dds or mp4 files.

Some of files inside paz files are unencrypted/raw data and unpacked nicely - see the attached screenshot for some DDS examples from 0007 dir.

I could be wrong, but it looks like many others - such as the UI textures or localization files - are encrypted or packed somehow. I suspect that the ICE (modified?) algorithm is being used here.

I’m currently stuck because I don't know how to locate the ICE key to test my theory. Debugging and assembly aren't really my thing - does anyone here have the skills to track it down within CrimsonDesert.exe? 🙂

The UI files (or at least some of them) can be found in the 0012 directory, while the English localization file is located in the 0020 directory.

[marvelmaster]

Hello, I am completely new to this and not sure what I am doing but maybe this helps somebody. I was Working with the steamapps\common\Crimson Desert\0002\0.pamt
to get a folder structure and maybe filenames.
 

Here is what I found out so far:

Header: 32 bytes (Contains a hash/version instead of file sizes).
Tree Start: The actual directory tree starts at offset 0x20.
String Format: [1 Byte String Length] [String] [4 Bytes Metadata/Pointer]
Block Separator: The engine uses FF FF FF FF as a marker to indicate the end of a folder/block.
 

Here is my research on github with the bms script and its output:
https://github.com/marvelmaster/CrimsonDesertModdingResearch


No idea what I am doing just want to edit files and make the game better.

 

 

[MrIkso]

2 hours ago, Lord Vaako said:

CrimsonDesert.exe

The task will not be easy, game use DRM Denuvo, exe packed and obfuscated. Static analysis not possible.

[MrIkso]

On 3/21/2026 at 7:26 PM, marvelmaster said:

Hello, I am completely new to this and not sure what I am doing but maybe this helps somebody. I was Working with the steamapps\common\Crimson Desert\0002\0.pamt
to get a folder structure and maybe filenames.
 

Here is what I found out so far:

Header: 32 bytes (Contains a hash/version instead of file sizes).
Tree Start: The actual directory tree starts at offset 0x20.
String Format: [1 Byte String Length] [String] [4 Bytes Metadata/Pointer]
Block Separator: The engine uses FF FF FF FF as a marker to indicate the end of a folder/block.
 

Here is my research on github with the bms script and its output:
https://github.com/marvelmaster/CrimsonDesertModdingResearch


No idea what I am doing just want to edit files and make the game better.

 

 

my reasearch of .pamt file, nammed as PackMeta in exe, its imhex template
 

struct Header {
    u32 crc;
    u32 pazCount;
    u32 unk1;
};

struct PazInfo {
    u32 index;
    u32 crc;
    u32 fileSize;
};

struct String {
    u8 size;
    char text[size];
};

// 20 bytes
struct FileInfo {
    u32 fileNameOffset;
    u32 offset;
    u32 compressSize;
    u32 decompressSize;
    u16 pazIndex;
    u16 flags; // stores encryption type and compression type
};

struct DirEntry {
    String dirRoot;
    String dirPath1;
    String dirPath2;
};

struct DirHashTable{
    u32 hash;
    u32 unk1;
    u32 unk2;
    u32 fileCount;
};

struct PackMeta {
    Header header;
    
    PazInfo pazInfo[header.pazCount];
    u32 dirBlockSize;
    u8 dirData[dirBlockSize];
    u32 fileNamesBlockSize;
   
    u8 filenamesData[fileNamesBlockSize];
    
    u32 dirHashTableCount;
    DirHashTable dirHashTable[dirHashTableCount];
    u32 filesCount;
    FileInfo fileInfo[filesCount];
};

PackMeta packMeta @ 0x0;

And my simplre unpacker, source code included. Unpacks paz archive but does not decrypt or decompress. There are several of them in game. Basically, what I have seen are files encrypted with ChaCha20 and files with Patrical Compression (сustom game to their own) or LZ4. See source code for more information

 

PackMetaParser.zip


Update, code uploaded to GitHub, added decompressor, decryptor and hash generator
https://github.com/MrIkso/CrimsonDesertTools

Edited March 22 by MrIkso
uplod source code to github

[Ize]

This is good progress honestly... i was able to unpack stuff with python but also noticed the encrypted files, mainly the ui and gameplay stuff.

Edited March 22 by Ize

[wolf1987]

localizationstring_eng.rar

[Ize]

Based on MrIkso’s research, I had Codex slap together a basic browser that can display various file types and includes a few extra bonus features. It also properly decompresses LZ4 files, but don’t get your hopes up when you see the crimson_chacha20_key.hex file... that’s only useful if someone manages to extract the actual key from the executable or from memory.

I’ve also included vgmstream-win in the folder so you can preview the game’s audio files, which was my main goal anyway 😛

Just adjust
ARCHIVES_PATH = r"D:\SteamLibrary\steamapps\common\Crimson Desert"
in the Python file so it points to your game directory and the tool can find the archives.

It may look like the program is hanging on startup, but it’s actually busy parsing everything, including its best guesses at the folder structure. Give it a minute or so...

Run it with:
python crimson_browser.py

You might need to install a few dependencies first via pip.

Crimson Browser.zip

[wolf1987]

pip install opencv-python
pip install lz4

 

 

Edited March 22 by wolf1987

[Ize]

I've fixed pngs and added reimport (only smaller or same size files without compression etc. for now) and it surprisingly worked first try 😄

Will update later.

Edited March 22 by Ize

[marvelmaster]

oh man you guys are amazing...that browser is so nice...do you think we can access the graphics settings xml stuff? I cant find them because they might be encrypted still but I want to deeply change the graphics settings

[wolf1987]

Great work

Can the software you're working on solve the game's problem? Here are some texts you should look at.

 

localizationstring_eng.rar

Edited March 22 by wolf1987

[skarba07]

Please tell me, is it possible to extract the audio VO with the RU subs and then pack them back in?

Edited March 22 by skarba07

[Ize]

Audio files (Korean, Chinese, and English) and subtitles are stored separately. The audio uses standard Wwise .wem and .bnk files, so editing or replacing those is relatively straightforward. The subtitles and other text data are stored in .paloc files, which unfortunately appear to be encrypted with ChaCha20.

File replacement itself is already possible, but for now my scuffed tool can only reinsert files into the original .paz archives if the replacement is the same size or smaller. Proper rebuilding or creating new .paz archives is outside the scope for now, and honestly not all that important until somebody manages to recover the ChaCha20 key(s).

[skarba07]

38 minutes ago, Ize said:

Audio files (Korean, Chinese, and English) and subtitles are stored separately. The audio uses standard Wwise .wem and .bnk files, so editing or replacing those is relatively straightforward. The subtitles and other text data are stored in .paloc files, which unfortunately appear to be encrypted with ChaCha20.

File replacement itself is already possible, but for now my scuffed tool can only reinsert files into the original .paz archives if the replacement is the same size or smaller. Proper rebuilding or creating new .paz archives is outside the scope for now, and honestly not all that important until somebody manages to recover the ChaCha20 key(s).

Can you please share how to replace the audio?

Edited March 22 by skarba07

[marvelmaster]

looks like somebody managed all already? need to test though
https://www.nexusmods.com/crimsondesert/mods/62

Crimson Desert Unpacker

[Ize]

I've updated my browser to include ChaCha20 stuff by Lazorr. 
Seems to work fine, but i guess once he updates his gui (currently it's even worse than this here :P), mine won't be needed anymore.

Let's GO!!! 😄

Crimson Browser3.zip

Edited March 22 by Ize

[skarba07]

thank you very much!!!

 

[wolf1987]

[marvelmaster]

head to head race at least your gui has a reimport button...gonna test now^^

Edited March 22 by marvelmaster

[Ize]

Reimport isn't 100% yet, and lz4 and me aren't friends so far but i can say that it works, most of time... sometimes... like my camera mod:

[marvelmaster]

how can we fix that filesize match? i edited a file and fiddle so long until it imported, but game crashed on level load 😞

[Ize]

Try this version but make sure the files stay exactly the same size.

crimson_browser.py

[wolf1987]

Ok thanks