spiritovod, posted Thu Dec 10, 2020 2:46 am (61021)

---

@mike9k1: Well, it's time to reinvent the wheel then. Here is u4pak, modified for creating DQXI compatible paks. Tested only against orchestral mod and it produces exactly the same result. Though it appeared that orchestral mod is using non-original format - for example, you can't simply extract it with dq11 bms script - but it seems the game doesn't like original format in mods for some reason.
Python3 is required. Also, it's one big workaround, so can't promise anything about compatibility with S edition, but essentially it should work.

Update: Checked some maths and fixed the python script. v2 now produces the same format as in original games (DQXI and S). I think it will be better this way for compatibility reasons. Please use v2 to avoid possible issues.

u4pak_dq11_v2.zip

mike9k1, posted Thu Dec 10, 2020 11:33 pm (61042)

---

spiritovod wrote:

@mike9k1: Well, it's time to reinvent the wheel then. Here is u4pak, modified for creating DQXI compatible paks. Tested only against orchestral mod and it produces exactly the same result. Though it appeared that orchestral mod is using non-original format - for example, you can't simply extract it with dq11 bms script - but it seems the game doesn't like original format in mods for some reason.
Python3 is required. Also, it's one big workaround, so can't promise anything about compatibility with S edition, but essentially it should work.

Update: Checked some maths and fixed the python script. v2 now produces the same format as in original games (DQXI and S). I think it will be better this way for compatibility reasons. Please use v2 to avoid possible issues.

Sorry for the late response: but from what I can tell it seems to be working.

I am still in shock at this bombshell of a development. Here we are working on trying to update our Hook for the better part of a month and in less than 12 hours you reverse-engineer the pak format successfully -- something we tried (to no avail) back in March.

We can now move forward thanks to this, and the timing couldn't have been more crucial -- being able to get mods out closer to the release rather than later (if at all) is huge and you may have just saved our modding community as a result.

This is nothing short of legendary, and (at least for my part) any mod that requires the use of u4pak_dq11(_v2) will feature your name prominently.

Not sure any of the others come around on Zenhax (i'm sure you've had contact with Komodo on Gildor's forums), but we are all immensely grateful for your contribution(s).

spiritovod, posted Fri Dec 11, 2020 12:59 pm (61058)

---

@mike9k1: All RE was done by infogram back then, I've just implemented info from the bms script into u4pak. But thanks anyway. I doubt I could do that half a year ago though.

---------------------------------------------------------------------------

Generic raw_extract script added to custom scripts bundle. It allows you to extract raw assets from paks, if index is not available or obfuscated. That means you can extract all files, but without proper filenames. Due to its nature, this script is not very useful, except for specific situations (like "frozen index") or small archives. It was created more for research purposes.
Tested on all kind of archives (chunked, non-chunked, with compressed encrypted chunks, etc), so theoretically it should work with any UE4 game built with non-modified 4.25 and below (apparently it works with 4.26 paks as well). Obviously, if script will encounter an encrypted asset, it will ask for a key.

Diam000nd, posted Thu Dec 17, 2020 11:59 am (61153)

---

I need some help ? I used AES Finder to find a game's AES key made with UnrealEngine 4.23 and it found a key... but when I used the code on the umodel it says code is not working ... I used GHFear's AES Finder too and it gave the same code but when I enter it says its not working ... it used to work but since the game had an update its not working at all ... any advice or help ?

spiritovod, posted Thu Dec 17, 2020 12:53 pm (61155)

---

@Diam000nd: More info about the game would be nice.

Diam000nd, posted Thu Dec 17, 2020 2:24 pm (61158)

---

spiritovod wrote:

@Diam000nd: More info about the game would be nice.

its an Iranian game currently being developed and I used to get the AES for changing textures for guns and stuff for new skins and stuff but now after the last update its just not working with the code found by the AES Finder

the AES I found :
0xA9B62A2C185B5F9A7B9B3A24EB600395D90DFBC8DE31637B849B2696C9B9717F
and its not working with the paks

*LINK EXPIRED*
this is the Shipping.exe file if you can help me that would be appreciated

spiritovod, posted Thu Dec 17, 2020 7:28 pm (61168)

---

@Diam000nd: Key is correct, but AES function is customized. Though not sure if only key expansion subroutine is modified or something else too. I could take a look at it later, when I have time and if unmodified old version will be still available somewhere, but actually it's out of my scope.
Only index is encrypted though, so theoretically it's possible to grab decrypted index from memory at runtime and use it with the archive, but since the game is going to be constantly updated, I don't see the point in it.

----------------------------------------------------------------------

Dragon Quest XI script in the specific scripts bundle updated to v5. It can now handle Switch version of the game properly (based on Pokeytax's changes from this post).

Diam000nd, posted Fri Dec 18, 2020 10:06 am (61177)

---

@spiritovod: so how do leakers find every single version's AES for Fortnite and use them to extract everything? I have no idea how to use the key now ? cause I used to make skins for the game by extracting models and textures... isn't there any custom BMS files for extraction of these kind of files ? isn't there any other way for extraction ?

spiritovod, posted Fri Dec 18, 2020 1:23 pm (61179)

---

@Diam000nd: Fortnite is using standard aes encryption, so no problem with it. The only script that will work with the game at the moment would be raw_extract from custom scripts bundle, but it's not what you need - at least, not in the current form. Alternatives are learning how to grab decrypted index from memory and inserting it into archive or reversing modifications of encryption algorithm - or waiting until guess names feature will be implemented in raw_extract script (this way it will be kind of useful).

Diam000nd, posted Sat Dec 19, 2020 9:26 am (61184)

---

@spiritovod: isn't there any tutorials about "grabbing decrypted index from memory" ? cause I found an github project which finds AES from memory when an app is open but cause the game has "Anti-Debug or Anti-Cheat" it doesn't work and says "Failed to open the process". I don't know ? any help for bypass of Anti-Debug? or tutorials or custom script for it to work ?

https://github.com/mmozeiko/aes-finder
that project...

spiritovod, posted Sat Dec 19, 2020 1:47 pm (61187)

---

@Diam000nd: The mentioned project is for finding aes keys, which would be the same as you already found with my aes finder. Like it was already said, the problem is not the key, but custom encryption. Also, there is not any step-by-step solutions for such things. Sorry, but I'm not here to teach people how to reverse stuff.

Diam000nd, posted Sun Dec 20, 2020 7:53 am (61203)

---

@spiritovod: Ok! no problem thanks for your help <8

Zodake, posted Mon Dec 21, 2020 5:50 pm (61216)

---

Would like to know if anyone can help me.
I am about to start the creation of a free database website for Ashes of creation for the community and I'm having a hard time in identifying where i can find the items/equipments informations.
I just used quickbms with the new key and got all the files (used unreal_tournament_4_0.4.25 script).

I found some valuable informations of the items inside .uasset/.uexp files, the problem is how to properly open them? I know that they have Text inside.

I also used Umodel software and i successfully got some items images (still trying to figure out how to crop correct the atlas file)

@spiritovod maybe you know more about it? I'm a developer, so with some guidance I can create some tools for the community for this game

spiritovod, posted Mon Dec 21, 2020 9:39 pm (61226)

---

@Zodake: uasset uexp is universal container for any kind of assets in UE4. So to get or modify any info from them, you should deserialize them first. Basically, uasset contains some general info, such as assets version/size/guids/basic parameters, table of related assets (their names) and table of properties (classes) - while uexp contains actual serialized data.
Here is an example, how it would look in general: viewtopic.php?f=9&t=12764
It's quite easy to get information from text assets (like localizations), because uexp there can be parsed directly and it usually contains only offsets/text size/text itself and some additional parameters, which can be ignored. In all other cases, you should usually reverse game code to understand certain properties/classes or dig into UE4 code itself (since it's open source).

Zodake, posted Tue Dec 22, 2020 1:18 pm (61236)

---

spiritovod wrote:

@Zodake: uasset uexp is universal container for any kind of assets in UE4. So to get or modify any info from them, you should deserialize them first. Basically, uasset contains some general info, such as assets version/size/guids/basic parameters, table of related assets (their names) and table of properties (classes) - while uexp contains actual serialized data.
Here is an example, how it would look in general: viewtopic.php?f=9&t=12764
It's quite easy to get information from text assets (like localizations), because uexp there can be parsed directly and it usually contains only offsets/text size/text itself and some additional parameters, which can be ignored. In all other cases, you should usually reverse game code to understand certain properties/classes or dig into UE4 code itself (since it's open source).

Thanks a lot @spiritovod with these informations, i answered you in pm.

Kein, posted Tue Dec 22, 2020 5:45 pm (61240)

---

spiritovod
Your updated quickBMS script is no longer an "updated version" of it, it is a different script. Original value of quickBMS version of the pak-unpacker was that it preserved root name/path of the pack, for example, "GameName/Content/Materials" and would extract content of the pack int it. Your variant now behaves exactly like built-in tool UnrealPak which just dumps the content without respect to the root path.

spiritovod, posted Tue Dec 22, 2020 7:33 pm (61241)

---

@Kein: I quite understand what you're talking about. UE 4.9 and below were using relative paths for assets - so you have base path (/GameName/) and relative paths for assets (/Textures/t.1, /Sounds/s.1). Starting from 4.10 it's using absolute paths and mount point. That means you have full paths like "/GameName/Textures/t.1", "/GameName/Sounds/s.1" for all assets in base paks. But sometimes mount point is different and you can get "/Textures/t.1" from additinal paks even from games built with latest UE4 versions. There is no way to somehow "respect" this, because mount points are making sense only for UE4, where all paks are handled as single structure, while quickbms and unrealpak works with each pak separately. Though I think some workaround can be implemented in base script, if you provide some particular example (I've only done it for Fable Legends script, which is obviously can't be used with latest games).

P.S. This part of UE4 script was not modified for more than two years, so if something is "broken" now, it's not me. Again, it's not actually "broken" per se.

axlzero25, posted Sat Dec 26, 2020 3:20 am (61286)

---

Hi, I'm new, I trying open .ueassets from SFV but my ue4 4.250 editor cant see them. Any thougs how to do that ?
thank you

spiritovod, posted Sat Dec 26, 2020 5:04 pm (61297)

---

@axlzero25: It doesn't work that way, because unreal editor doesn't support cooked assets. You can start with reading this tutorial and googling for SFV modding, I believe there are plenty resources for it, including videos.

----------------------------------------------------------------------

Latest UE4 bms script updated to version 0.4.25a, which now properly supports base paths in mount points if present (explained in this post). I didn't test it much, so if you'll have problems with it, please report them.

Kein, posted Wed Dec 30, 2020 6:01 am (61384)

---

spiritovod wrote:

But sometimes mount point is different and you can get "/Textures/t.1" from additinal paks even from games built with latest UE4 versions. There is no way to somehow "respect" this, because mount points are making sense only for UE4, where all paks are handled as single structure, while quickbms and unrealpak works with each pak separately. Though I think some workaround can be implemented in base script, if you provide some particular example (I've only done it for Fable Legends script, which is obviously can't be used with latest games).

Can you elaborate, may be I never encountered it? In the pak, the first entry in name list is the root entry. For example, let's say you pack Content/Data/ and Data contains Materials/, Scripts/, Whatever/. The first root entry will be "Content/Data/", depending on where it is, can be ".../Content/Data/" or "../../../Content/Data/" but it will be there ALWAYS. if you are packing multiple entries in root entry like, Dir1/, Dir2, Dir3, then, again, depending where these are in the hierarchy, it will be either "../" or "../../../".
What are you saying (if I understand it correctly) makes no sense, there could not be 2 root entries or files OUTSIDE of it. Whole logic behind PAK structure limits it.

spiritovod, posted Wed Dec 30, 2020 1:11 pm (61396)

---

@Kein: The difference between simple root entry and mount point is that in second case actual root entry can be inherited according to mount point and may not present in a pak. But that's just theoretically and I doubt you'll encounter something like that in usual 4.25- games. That's why I've decided to treat mount point as simple root entry for the latest 0.4.25a fix, it should work like you've described in most cases.
But if you're interested in the difference, you can take a look at v11 paks (with new zen loader structure, aside from utoc/ucas) or Gears 5 / Tactics. Here is an example from Gears 5, how folder structure will look without proper use of mount point (screenshot).

Kein, posted Wed Dec 30, 2020 10:57 pm (61402)

---

spiritovod wrote:

how folder structure will look without proper use of mount point (screenshot).

What's wrong with it? You have root entry here as I can see?

spiritovod, posted Thu Dec 31, 2020 12:23 am (61404)

---

@Kein: VFX_002 and cin folders should be subfolders of Cinematics.

Kein, posted Sun Jan 03, 2021 8:50 am (61452)

---

spiritovod wrote:

@Kein: VFX_002 and cin folders should be subfolders of Cinematics.

Where do you see this from? Are these entries taken from separate packs?

spiritovod, posted Sun Jan 03, 2021 1:27 pm (61455)

---

@Kein: I've just provided the sample for demonstration that in some cases things can be different. And like it was already said, if you're interested, you can take a look by yourself. Gears 5 is not a good example, but I don't have decent v11 paks sample at the moment, because there are not working scripts for it to visualize folders structure.