yuehen, posted Tue Apr 21, 2020 2:05 am (56133)

---

Key:0x42163963B2E095A8D673B48B703B6DE016FE4DC36E0796CC14531C8DAE87E4BC
Download link:https://object.blue-protocol.com/setup/qe1MU2mMQlsRLDnpwby33hXq/BLUEPROTOCOL_Setup.exe

GHFear, posted Tue Apr 21, 2020 5:37 pm (56150)

---

AES Keys?
If anyone needs to get keys on newer games (UE4 versions 4.19 and above), try the tool in my signature.
Hope it can be of help to people looking for keys.
Good luck!

sinnerclown380, posted Tue Apr 21, 2020 9:22 pm (56156)

---

GHFear wrote:

AES Keys?
If anyone needs to get keys on newer games (UE4 versions 4.19 and above), try the tool in my signature.
Hope it can be of help to people looking for keys.
Good luck!

. Thanks bro good work.

Dark_VladislaV, posted Wed Apr 22, 2020 1:35 am (56160)

---

GHFear wrote:

AES Keys?
If anyone needs to get keys on newer games (UE4 versions 4.19 and above), try the tool in my signature.
Hope it can be of help to people looking for keys.
Good luck!

Can this work for UE4 android game?

GHFear, posted Wed Apr 22, 2020 2:31 pm (56175)

---

Dark_VladislaV wrote:

GHFear wrote:

AES Keys?
If anyone needs to get keys on newer games (UE4 versions 4.19 and above), try the tool in my signature.
Hope it can be of help to people looking for keys.
Good luck!

Can this work for UE4 android game?

Not yet. Perhaps in the future.

TGGAMING, posted Thu Apr 23, 2020 8:02 am (56214)

---

spiritovod wrote:

@Firecube: It's not an easy task either and involving debugging mobile app with graphics debuggers (also, maybe there is simpler method to do so engine-wise). Still, it's easier than reverse-engineering paks format, especially with encrypted index.

Also, since only index is obfuscated or encrypted in those paks, but not files themselves, you can extract raw chunks from any pak with offzip ("offzip -a your.pak output_folder") and then merge them, following known UE4 assets patterns. For example, there will be 01.uasset, 02.dat, 03.dat, 04.uasset, 05.dat and so on. Here 01.uasset is a header and 02.dat/03.dat are parts of that uasset or ubulk. So, merging 01 02 03 into one uasset will get you one working asset (probably, because there are also headerless ubulk files).
But this approach is not effective at all, because there are many assets types out there and total amount of assets can be 10k easily.

In any case, you can't get anything from those paks, since devs not only xor'ed index, but also obfuscated its offset and size - that means you must r-e libUE4.so library to find out what they did there. Alternatively, I think it's possible to find out index's offset and size for every pak manually and extract them with modified bms script.

HOW CAN I MARGE EXTRACTED FILES ?

TGGAMING, posted Thu Apr 23, 2020 8:58 am (56218)

---

Can anyone help me with this ?

spiritovod, posted Thu Apr 23, 2020 4:15 pm (56227)

---

@TGGAMING: You're trying to extract mobile version with lite script, but they are not compatible.
And if you don't know how to merge files, google will help you (any hex editor will do). Anyway, if you don't know about internal structure of different UE4 assets, that method is of no use to your. It was just observation and it's not really useful way to explore pak contents.

spiritovod, posted Fri Apr 24, 2020 9:43 am (56251)

---

Wrote some POC for aes keys finder (one exe -> one key or not found). JRE 8 or above is required to run it. Readme is included in the archive (please read it carefully to avoid issues). Virustotal report for those who care: link.
Bleeding Edge is supported, unless they'll change something related in the code. Last Oasis is also supported in version 0.9c. Finder can detect protected games starting from version 0.9d. Small fixes in version 0.9e. Additional message in case if a key is not found in version 0.9f. Additional routine for some rare cases is now implemented in version 0.9g. Additional check is added to avoid false-positive detection of protection in version 0.9h.

POC for aes keys finder in mobile games added (one game -> one key or not found). JRE 8 or above is required to run it. Readme is included in the archive (please read it carefully to avoid issues). Virustotal report for those who care: link.
Fixed premature appearance of key.txt, fixed issue when finder could work more than expected, added total execution time to output message in version 0.9c. Some optimizations were removed to improve compatibility with newest games in version 0.9d. More optimizations were removed to improve compatibility with some old games in version 0.9e (previous version is recommended though).

Known unsupported by the finder games: PUBG (all versions), Sea of Thieves.

-----------------------------------------------------------------------

All questions about any PUBG games will be ignored. All required information is available here in "all you should know about PUBG" section. No further support will be provided due to the reasons explained there.

-----------------------------------------------------------------------

I've desided to move all modified scripts to one post (this one). The reason why they can't be merged is because currently there is no way to distinguish them by archives names. Current method with scanning folder name for a pattern is not very effective, since pak archives can be moved anywhere.

Original post with modified script by ssh: viewtopic.php?t=1005&start=1200#p51805 (0.4.23.1a).
Latest official version of the script by aluigi: http://aluigi.org/bms/unreal_tournament_4.bms (0.4.25 at the moment).

Script with v9 paks support (for 4.25 games and below) - "unreal_tournament_4_0.4.25" in the attachment. Updated on 26.12.2020 to properly support base paths from mount points if present. Updated on 26.02.2021 to support auto-detection of compression types - therefore some scripts from specific scripts bundle were removed, because updated main script can handle those games now. Updated on 19.12.2021 to handle large non-chunked uncompressed assets over 3GB. Updated on 26.07.2022 to simplify embedding keys for more convenient usage. Updated on 17.04.2023 with additional check to ensure that correct version of quickbms is used.
Script with v11 paks support (for 4.26/4.27/UE5 games) - "unreal_tournament_4_0.4.27" in the attachment. It's not backward compatible with 4.25 and below games. Also, it only supports paks at the moment, but utoc/ucas support may be added later. Updated on 16.01.2021 to properly support files over 4GB. Updated on 23.04.2021 with ability to skip assets which are being addressed outside current package. Updated on 02.05.2021 with auto-detection of compression types and small fixes. Updated on 05.10.2021 with support for updated 4.27 packages format. Updated on 14.11.2021 with fix for proper omitting invalid entries. Updated on 19.12.2021 to handle large non-chunked uncompressed assets over 3GB. Updated on 08.01.2022 with proper support for unicode in folder names. Updated on 26.07.2022 to simplify embedding keys for more convenient usage. Updated on 17.04.2023 with additional check to ensure that correct version of quickbms is used.

You can also read "Alternative tools for paks" section from this topic.

Supported games (with specific scripts): Sea of Thieves, State of Decay 2 (latest versions), PUBG Lite, PUBG Mobile/Mobile Lite (only for 1.1.x and below), PUBG Mobile (chinese ver., including latest versions), Friday 13th: Game (PC/Switch), Friday 13th: Camp Blood, Bless Mobile, Dragon Quest XI - also works with S edition, Pinball Wicked (thanks to pipopipo/pipoman), Conan Exiles, Tekken 7, Fable Legends, Outriders (thanks to mobus_c352), Century: Age of Ashes, Miracle 2 (MU Origin 3), Super People, Back 4 Blood (supports both full and beta versions), Crayta, Tony Hawk's Pro Skater 1 2, Light Response / Lightning, Dead by Daylight Mobile (SEA version), QQ (software), Uncharted Waters Origin, Apex Legends Mobile (thanks to FabianFG), Zhu Xian World, Crystal of Atlan, Ash Echoes / Fraxinus Decay, Superfuse, Meet Your Maker (paks only), Blood Bowl 3, ArcheAge War, Dark and Darker, Farlight 84.

Sound extraction (readme included): Satisfactory (latest versions), R-Type Final 2, Gears 4, Sword and Fairy 7.

Some unrelated scripts for UE4 games: for save files from Life is Strange 2 (link), for "paka" files from Kingdoms Reborn (link), modified u4pak for creating Dragon Quest XI compatible packages (link), for decrypting/encrypting and converting save files from Dragon Quest XI S (link), for extracting some Tekken 7 mods (link), for merging resources into proper obb for Project W (link).

-----------------------------------------------------------------------

Some experimental scripts are now available in custom_UE4_scripts bundle. For more info please read included readme. Bundle updated on 26.11.2021 with some scripts for 4.26/4.27/UE5 games.

1) custom_extract: Provides the same functionality as native filter of quickbms, but on the script level. Created more for research purposes, but may be helpful in some cases.
2) get_hashes: Allow you to extract hashes (actually guids) and filenames of all assets from a pak. Resulted file can be used with extract_diff script.
3) extract_diff: Allow you to compare paks from different game versions and extract or list only new/updated files.
4) raw_extract: Allow you to extract raw assets from paks, if index is not available or obfuscated. That means you can extract all files, but without proper filenames.

Basically, get hashes from pak of the old game version, put them near pak of updated game version and extract or list new/updated files. There are additional options in the extract_diff script, but no backward compatibility yet (for example, you can't guess, which files were completely removed in the updated game version). Please note that those scripts are very experimental and may have some bugs/limitations.

-----------------------------------------------------------------------

How to repack assets back in form of mods:

It was already explained multiple times here and there. Please read some related posts before asking about it: first post, second post (and base instruction, part 3.10.1). Alternatively, you can use instruction by masagrator (it works for PC games as well), which is mentioned in the posts above.

UE4_specific_scripts.zip

unreal_tournament_4_0.4.25e.zip

unreal_tournament_4_0.4.27e.zip

AES_finder_0.9h.zip

custom_UE4_scripts.zip

sound_extraction_UE4.zip

AES_finder_mobile_0.9e.zip

blenux, posted Sun Apr 26, 2020 6:13 am (56288)

---

Awesome stuff spiritovod!

GHFear, posted Sun Apr 26, 2020 12:20 pm (56295)

---

spiritovod wrote:

Wrote some POC for aes keys finder (one exe -> one key or not found). JRE 8 or above is required to run it. Readme is included in the archive (please read it carefully to avoid issues). Virustotal report for those who care: link.
Bleeding Edge is supported, unless they'll change something related in the code. Last Oasis is also supported in version 0.9c.

Known unsupported games: PUBG, Sea of Thieves, all mobile games (because optimized dalvik code doesn't have any recognizable patterns).

-----------------------------------------------------------------------

I've desided to move all modified scripts to one post (this one). The reason why they can't be merged is because currently there is no way to distinguish them by archives names. Current method with scanning folder name for a pattern is not very effective, since pak archives can be moved anywhere.

Original post with modified script by ssh: viewtopic.php?t=1005&start=1200#p51805 (0.4.23.1a).
Latest official version of the script by aluigi: http://aluigi.org/bms/unreal_tournament_4.bms (0.4.24b at the moment).

Supported games (with specific scripts): Sea of Thieves (SOT), State of Decay 2 (SOD2, latest versions), PUBG Lite.

Really nice :]
This will help a lot of people.

spiritovod, posted Tue Apr 28, 2020 8:55 pm (56354)

---

^ Thanks. The only downside is that the list with keys will not be updated frequently like before. I encourage all people using GHFear's or my key finders to post their results if that key is not present in the list or outdated there. It will be especially helpful in case of protected games (like UWP games).

Anyway, now I'm looking into aes keys in mobile games built with UE4. If you know any such game with known or unknown keys, let me know. The games I'm already aware of: M.A.D. 8 (key known), Injustice 2 Mobile (key known), Dead by Daylight (key unknown), Traha (key unknown), Bless Mobile (key unknown), Blade And Soul Revolution (key known) and Blade II (key known). If you'll mention some asian games which are hard to get, you can also PM me lib\arm64-xxx\libUE4.so from extracted apk, and a sample pak. Can't promise anything though, because it's more for research purposes at the moment, but it will be appreciated.
I know a little about that stuff, but it's probably good exercise for neural networks / deep learning devs, considering specifics of that "brute-force" approach to keys.

TGGAMING, posted Wed Apr 29, 2020 10:10 am (56371)

---

@spiritovod
I would like to try a method that allows things to be shown in runtime, and I think it requires some values. What is the way to do this?

Vaziayu, posted Thu Apr 30, 2020 6:15 pm (56425)

---

..

spiritovod, posted Thu Apr 30, 2020 6:44 pm (56426)

---

@Vaziayu: You either have more than one exe besides AES_finder in the same folder (it can't handle more than one game exe at a time) or you forgot to remove steam protection from the exe. Just tested my finder and it works just fine. Next time please read included readme carefully.

@TGGAMING: It has been already explained before that it's not an easy task, and there is no complete guide about how to it as well. And I'm not going to write such guide too.

Vaziayu, posted Thu Apr 30, 2020 8:32 pm (56428)

---

..

Amagakuro, posted Thu Apr 30, 2020 9:54 pm (56430)

---

spiritovod wrote:

^ Thanks. The only downside is that the list with keys will not be updated frequently like before. I encourage all people using GHFear's or my key finders to post their results if that key is not present in the list or outdated there. It will be especially helpful in case of protected games (like UWP games).

Anyway, now I'm looking into aes keys in mobile games built with UE4. If you know any such game with known or unknown keys, let me know. The games I'm already aware of: M.A.D. 8 (key known), Injustice 2 Mobile (key known), Dead by Daylight (key unknown). If you'll mention some asian games which are hard to get, you can also PM me lib\arm64-xxx\libUE4.so from extracted apk, and a sample pak. Can't promise anything though, because it's more for research purposes at the moment, but it will be appreciated.
I know a little about that stuff, but it's probably good exercise for neural networks / deep learning devs, considering specifics of that "brute-force" approach to keys.

If you don't mind then, i'll try to reinstall both Bless Mobile and Traha and provide you the files tomorrow.
Blade And Soul Revolution and Blade II also have known key.

spiritovod, posted Fri May 01, 2020 2:02 am (56435)

---

@Amagakuro: Other person already provided required files for Traha and Bless Mobile, I'll edit my post to avoid confusion and future suggestions of those games. And I'll check Blade And Soul Revolution and Blade II, since they're available in play market without region restrictions. Thanks for the suggestions, I totally forgot about those two games, considering they are in the list with known keys.
Also, Bless Mobile has slightly modified pak format, so current bms script or umodel will not work even if key will be found.

client1676, posted Sat May 02, 2020 6:36 pm (56476)

---

Hello!

Can't get access to Auto Chess (UE4 v4.22.3.0) game resources.

unreal_tournament_4.bms (script 0.4.24b) asks for a key.

@GHFear: AES Key Finder 1.8 doesn't help - key.txt is empty.
@spiritovod: AES finder - key.txt says "Key not found, sorry."

EXE: https://mega.nz/file/DAxDUCyS#Ij49mOOCK ... 6YGrzwcfTc

Thank you in advance!

WollieWoltaz, posted Sat May 02, 2020 6:52 pm (56477)

---

Client1676 is right. An AES key is required now after the latest update.
Hope this key can be found.

spiritovod, posted Sun May 03, 2020 3:01 am (56493)

---

@client1676: That's because the exe is protected. I've added simple detection of protection to version 0.9d.

Update: rin forums are now up again, so key added to the list. Please ask any keys related questions there and keep this topic for more general stuff (pak format, bms scripts and so on).

client1676, posted Sun May 03, 2020 6:17 am (56497)

---

spiritovod wrote:

@client1676: That's because the exe is protected. I've added simple detection of protection to version 0.9d. Since rin forum is not up yet (it should start working in a day btw), here is key: 0x14CAE532C500DE84709358A69EC4962B9CA29EA1F19A4CE48A8D964F807FDEA5

Thank you very much! It works now!

keeknr, posted Mon May 04, 2020 11:28 am (56522)

---

spiritovod wrote:

Wrote some POC for aes keys finder (one exe -> one key or not found). JRE 8 or above is required to run it. Readme is included in the archive (please read it carefully to avoid issues). Virustotal report for those who care: link.
Bleeding Edge is supported, unless they'll change something related in the code. Last Oasis is also supported in version 0.9c. Finder can detect protected games starting from version 0.9d.

Known unsupported games: PUBG, Sea of Thieves, all mobile games (because optimized dalvik code doesn't have any recognizable patterns).

-----------------------------------------------------------------------

I've desided to move all modified scripts to one post (this one). The reason why they can't be merged is because currently there is no way to distinguish them by archives names. Current method with scanning folder name for a pattern is not very effective, since pak archives can be moved anywhere.

Original post with modified script by ssh: viewtopic.php?t=1005&start=1200#p51805 (0.4.23.1a).
Latest official version of the script by aluigi: http://aluigi.org/bms/unreal_tournament_4.bms (0.4.24b at the moment).

Supported games (with specific scripts): Sea of Thieves (SOT), State of Decay 2 (SOD2, latest versions), PUBG Lite.

I have used your SOT script but it doesn't work. It's still asking for the AES Key. "The archive is encrypted, select the number of the key to use or type yours:"

Any idea what I'm doing wrong?

spiritovod, posted Mon May 04, 2020 12:27 pm (56526)

---

@keeknr: It's asking for the key, because archives are encrypted. You can find the key in the list, check my signature.

keeknr, posted Mon May 04, 2020 12:50 pm (56528)

---

spiritovod wrote:

@keeknr: It's asking for the key, because archives are encrypted. You can find the key in the list, check my signature.

Thanks, I just made the mistake to export all instead of just the .pak files. It works now.