koko, posted Mon Mar 06, 2023 3:00 pm (75718)

---

@cn_halloweeks Can you tell me what you use to decrypt XOR?

cn_halloweeks, posted Tue Mar 07, 2023 8:37 am (75731)

---

koko wrote:

@cn_halloweeks Can you tell me what you use to decrypt XOR?

https://github.com/halloweeks/file-xor-chiper

koko, posted Tue Mar 07, 2023 3:35 pm (75734)

---

cn_halloweeks wrote:

koko wrote:

@cn_halloweeks Can you tell me what you use to decrypt XOR?

https://github.com/halloweeks/file-xor-chiper

koko, posted Tue Mar 07, 2023 3:59 pm (75735)

---

@spiritovod

I like the model and other resources in "chinese_pubg" very much, but the encryption of this game seems to change every time the game is updated. I can't wait for the update of Spiritovod every time. That's shameless. I don't know how to write Bms scripts, but I want to learn. Can you give me some advice, such as where to start learning

Meonpie, posted Sat Mar 11, 2023 8:00 am (75797)

---

????
Using UE4.26
Pak shows unknown format, encrypted!

apk :https://m.apkpure.com/tw/dian-feng-ji-su/com.tencent.tmgp.dfjs

spiritovod, posted Sat Mar 18, 2023 1:15 pm (75975)

---

@Meonpie: I guess that's chinese version of Racing Master. It has customized package format, custom encryption with randomized seed and protected library, so it can't be properly analyzed or debugged (even if I had compatible with it device, while I don't).

TUNBudi06, posted Tue Apr 04, 2023 3:53 am (76210)

---

spiritovod wrote:

Wrote some POC for aes keys finder (one exe -> one key or not found). JRE 8 or above is required to run it. Readme is included in the archive (please read it carefully to avoid issues). Virustotal report for those who care: link.
Bleeding Edge is supported, unless they'll change something related in the code. Last Oasis is also supported in version 0.9c. Finder can detect protected games starting from version 0.9d. Small fixes in version 0.9e. Additional message in case if a key is not found in version 0.9f. Additional routine for some rare cases is now implemented in version 0.9g. Additional check is added to avoid false-positive detection of protection in version 0.9h.

POC for aes keys finder in mobile games added (one game -> one key or not found). JRE 8 or above is required to run it. Readme is included in the archive (please read it carefully to avoid issues). Virustotal report for those who care: link.
Fixed premature appearance of key.txt, fixed issue when finder could work more than expected, added total execution time to output message in version 0.9c. Some optimizations were removed to improve compatibility with newest games in version 0.9d. More optimizations were removed to improve compatibility with some old games in version 0.9e (previous version is recommended though).

Known unsupported by the finder games: PUBG (all versions), Sea of Thieves.

-----------------------------------------------------------------------

All questions about any PUBG games will be ignored. All required information is available here in "all you should know about PUBG" section. No further support will be provided due to the reasons explained there.

-----------------------------------------------------------------------

I've desided to move all modified scripts to one post (this one). The reason why they can't be merged is because currently there is no way to distinguish them by archives names. Current method with scanning folder name for a pattern is not very effective, since pak archives can be moved anywhere.

Original post with modified script by ssh: viewtopic.php?t=1005&start=1200#p51805 (0.4.23.1a).
Latest official version of the script by aluigi: http://aluigi.org/bms/unreal_tournament_4.bms (0.4.25 at the moment).

Script with v9 paks support (for 4.25 games and below) - "unreal_tournament_4_0.4.25" in the attachment. Updated on 26.12.2020 to properly support base paths from mount points if present. Updated on 26.02.2021 to support auto-detection of compression types - therefore some scripts from specific scripts bundle were removed, because updated main script can handle those games now. Updated on 19.12.2021 to handle large non-chunked uncompressed assets over 3GB. Updated on 26.07.2022 to simplify embedding keys for more convenient usage.
Script with v11 paks support (for 4.26/4.27/UE5 games) - "unreal_tournament_4_0.4.27" in the attachment. It's not backward compatible with 4.25 and below games. Also, it only supports paks at the moment, but utoc/ucas support may be added later. Updated on 16.01.2021 to properly support files over 4GB. Updated on 23.04.2021 with ability to skip assets which are being addressed outside current package. Updated on 02.05.2021 with auto-detection of compression types and small fixes. Updated on 05.10.2021 with support for updated 4.27 packages format. Updated on 14.11.2021 with fix for proper omitting invalid entries. Updated on 19.12.2021 to handle large non-chunked uncompressed assets over 3GB. Updated on 08.01.2022 with proper support for unicode in folder names. Updated on 26.07.2022 to simplify embedding keys for more convenient usage.

You can also read "Alternative tools for paks" section from this topic.

Supported games (with specific scripts): Sea of Thieves, State of Decay 2 (latest versions), PUBG Lite, PUBG Mobile/Mobile Lite (only for 1.1.x and below), PUBG Mobile (chinese ver., including latest versions), Friday 13th: Game (PC/Switch), Friday 13th: Camp Blood, Bless Mobile, Dragon Quest XI - also works with S edition, Pinball Wicked (thanks to pipopipo/pipoman), Conan Exiles, Tekken 7, Fable Legends, Outriders (thanks to mobus_c352), Century: Age of Ashes, Miracle 2 (MU Origin 3), Super People, Back 4 Blood (supports both full and beta versions), Crayta, Tony Hawk's Pro Skater 1 2, Light Response / Lightning, Dead by Daylight Mobile (SEA version), QQ (software), Uncharted Waters Origin, Apex Legends Mobile (thanks to FabianFG), Zhu Xian World, Crystal of Atlan, Ash Echoes / Fraxinus Decay, Superfuse, Meet Your Maker (paks only), Blood Bowl 3.

Sound extraction (readme included): Satisfactory (latest versions), R-Type Final 2, Gears 4, Sword and Fairy 7.

Some unrelated scripts for UE4 games: for save files from Life is Strange 2 (link), for "paka" files from Kingdoms Reborn (link), modified u4pak for creating Dragon Quest XI compatible packages (link), for decrypting/encrypting and converting save files from Dragon Quest XI S (link), for extracting some Tekken 7 mods (link), for merging resources into proper obb for Project W (link).

-----------------------------------------------------------------------

Some experimental scripts are now available in custom_UE4_scripts bundle. For more info please read included readme. Bundle updated on 26.11.2021 with some scripts for 4.26/4.27/UE5 games.

1) custom_extract: Provides the same functionality as native filter of quickbms, but on the script level. Created more for research purposes, but may be helpful in some cases.
2) get_hashes: Allow you to extract hashes (actually guids) and filenames of all assets from a pak. Resulted file can be used with extract_diff script.
3) extract_diff: Allow you to compare paks from different game versions and extract or list only new/updated files.
4) raw_extract: Allow you to extract raw assets from paks, if index is not available or obfuscated. That means you can extract all files, but without proper filenames.

Basically, get hashes from pak of the old game version, put them near pak of updated game version and extract or list new/updated files. There are additional options in the extract_diff script, but no backward compatibility yet (for example, you can't guess, which files were completely removed in the updated game version). Please note that those scripts are very experimental and may have some bugs/limitations.

-----------------------------------------------------------------------

How to repack assets back in form of mods:

It was already explained multiple times here and there. Please read some related posts before asking about it: first post, second post (and base instruction, part 3.10.1). Alternatively, you can use instruction by masagrator (it works for PC games as well), which is mentioned in the posts above.

Can i get the source code for aes finder mobile sir?

koko, posted Wed Apr 05, 2023 12:20 pm (76235)

---

TUNBudi06 wrote:

spiritovod wrote:

Wrote some POC for aes keys finder (one exe -> one key or not found). JRE 8 or above is required to run it. Readme is included in the archive (please read it carefully to avoid issues). Virustotal report for those who care: link.
Bleeding Edge is supported, unless they'll change something related in the code. Last Oasis is also supported in version 0.9c. Finder can detect protected games starting from version 0.9d. Small fixes in version 0.9e. Additional message in case if a key is not found in version 0.9f. Additional routine for some rare cases is now implemented in version 0.9g. Additional check is added to avoid false-positive detection of protection in version 0.9h.

POC for aes keys finder in mobile games added (one game -> one key or not found). JRE 8 or above is required to run it. Readme is included in the archive (please read it carefully to avoid issues). Virustotal report for those who care: link.
Fixed premature appearance of key.txt, fixed issue when finder could work more than expected, added total execution time to output message in version 0.9c. Some optimizations were removed to improve compatibility with newest games in version 0.9d. More optimizations were removed to improve compatibility with some old games in version 0.9e (previous version is recommended though).

Known unsupported by the finder games: PUBG (all versions), Sea of Thieves.

-----------------------------------------------------------------------

All questions about any PUBG games will be ignored. All required information is available here in "all you should know about PUBG" section. No further support will be provided due to the reasons explained there.

-----------------------------------------------------------------------

I've desided to move all modified scripts to one post (this one). The reason why they can't be merged is because currently there is no way to distinguish them by archives names. Current method with scanning folder name for a pattern is not very effective, since pak archives can be moved anywhere.

Original post with modified script by ssh: viewtopic.php?t=1005&start=1200#p51805 (0.4.23.1a).
Latest official version of the script by aluigi: http://aluigi.org/bms/unreal_tournament_4.bms (0.4.25 at the moment).

Script with v9 paks support (for 4.25 games and below) - "unreal_tournament_4_0.4.25" in the attachment. Updated on 26.12.2020 to properly support base paths from mount points if present. Updated on 26.02.2021 to support auto-detection of compression types - therefore some scripts from specific scripts bundle were removed, because updated main script can handle those games now. Updated on 19.12.2021 to handle large non-chunked uncompressed assets over 3GB. Updated on 26.07.2022 to simplify embedding keys for more convenient usage.
Script with v11 paks support (for 4.26/4.27/UE5 games) - "unreal_tournament_4_0.4.27" in the attachment. It's not backward compatible with 4.25 and below games. Also, it only supports paks at the moment, but utoc/ucas support may be added later. Updated on 16.01.2021 to properly support files over 4GB. Updated on 23.04.2021 with ability to skip assets which are being addressed outside current package. Updated on 02.05.2021 with auto-detection of compression types and small fixes. Updated on 05.10.2021 with support for updated 4.27 packages format. Updated on 14.11.2021 with fix for proper omitting invalid entries. Updated on 19.12.2021 to handle large non-chunked uncompressed assets over 3GB. Updated on 08.01.2022 with proper support for unicode in folder names. Updated on 26.07.2022 to simplify embedding keys for more convenient usage.

You can also read "Alternative tools for paks" section from this topic.

Supported games (with specific scripts): Sea of Thieves, State of Decay 2 (latest versions), PUBG Lite, PUBG Mobile/Mobile Lite (only for 1.1.x and below), PUBG Mobile (chinese ver., including latest versions), Friday 13th: Game (PC/Switch), Friday 13th: Camp Blood, Bless Mobile, Dragon Quest XI - also works with S edition, Pinball Wicked (thanks to pipopipo/pipoman), Conan Exiles, Tekken 7, Fable Legends, Outriders (thanks to mobus_c352), Century: Age of Ashes, Miracle 2 (MU Origin 3), Super People, Back 4 Blood (supports both full and beta versions), Crayta, Tony Hawk's Pro Skater 1 2, Light Response / Lightning, Dead by Daylight Mobile (SEA version), QQ (software), Uncharted Waters Origin, Apex Legends Mobile (thanks to FabianFG), Zhu Xian World, Crystal of Atlan, Ash Echoes / Fraxinus Decay, Superfuse, Meet Your Maker (paks only), Blood Bowl 3.

Sound extraction (readme included): Satisfactory (latest versions), R-Type Final 2, Gears 4, Sword and Fairy 7.

Some unrelated scripts for UE4 games: for save files from Life is Strange 2 (link), for "paka" files from Kingdoms Reborn (link), modified u4pak for creating Dragon Quest XI compatible packages (link), for decrypting/encrypting and converting save files from Dragon Quest XI S (link), for extracting some Tekken 7 mods (link), for merging resources into proper obb for Project W (link).

-----------------------------------------------------------------------

Some experimental scripts are now available in custom_UE4_scripts bundle. For more info please read included readme. Bundle updated on 26.11.2021 with some scripts for 4.26/4.27/UE5 games.

1) custom_extract: Provides the same functionality as native filter of quickbms, but on the script level. Created more for research purposes, but may be helpful in some cases.
2) get_hashes: Allow you to extract hashes (actually guids) and filenames of all assets from a pak. Resulted file can be used with extract_diff script.
3) extract_diff: Allow you to compare paks from different game versions and extract or list only new/updated files.
4) raw_extract: Allow you to extract raw assets from paks, if index is not available or obfuscated. That means you can extract all files, but without proper filenames.

Basically, get hashes from pak of the old game version, put them near pak of updated game version and extract or list new/updated files. There are additional options in the extract_diff script, but no backward compatibility yet (for example, you can't guess, which files were completely removed in the updated game version). Please note that those scripts are very experimental and may have some bugs/limitations.

-----------------------------------------------------------------------

How to repack assets back in form of mods:

It was already explained multiple times here and there. Please read some related posts before asking about it: first post, second post (and base instruction, part 3.10.1). Alternatively, you can use instruction by masagrator (it works for PC games as well), which is mentioned in the posts above.

Can i get the source code for aes finder mobile sir?

lifegame, posted Thu Apr 06, 2023 10:23 pm (76245)

---

I opened the encrypted. pak file, but I found that the. ini and. uasset files are also encrypted. How can I open them? Thank you, my friends. Have a nice day

https://mega.nz/folder/xI9FkJZb#P7xwaz3f3ToKGoe0ngGcEw
Game files AES:0xB179A15FBC246D2B758CEC4077C0A582325AD82CF81FD25AE2590E6A063E2F65

FModel can display a list of files, but cannot preview them

Code:

If you're having an issue with FModel, make sure to let us know on Discord at https://fmodel.app/discord/

[WRN] Could not load localized resources in 'English', language may not exist
[ERR] Newtonsoft.Json.JsonSerializationException: Unexpected end when deserializing object. Path 'Contents', line 3165, position 0.
   at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.ThrowUnexpectedEndException(JsonReader reader, JsonContract contract, Object currentObject, String message)
[ERR] CUE4Parse.UE4.Exceptions.ParserException: Invalid uasset magic: 0x4120657A != 0x9E2A83C1
   at CUE4Parse.UE4.Objects.UObject.FPackageFileSummary..ctor(FArchive Ar)

UnrealPak cannot be unpacked

spiritovod, posted Sat Apr 08, 2023 1:24 am (76289)

---

Script for extracting ArcheAge War is added to specific scripts bundle, available via my signature. It should work with both mobile and desktop versions of the game.

lifegame, posted Sat Apr 08, 2023 5:38 am (76295)

---

spiritovod wrote:

Script for extracting ArcheAge War is added to specific scripts bundle, available via my signature. It should work with both mobile and desktop versions of the game.

Thank you very very very much!

lifegame, posted Sat Apr 08, 2023 9:08 am (76299)

---

spiritovod wrote:

Script for extracting ArcheAge War is added to specific scripts bundle, available via my signature. It should work with both mobile and desktop versions of the game.

Can I use it to reimport files? I cannot read the game when using UnrealPak to package files, which was normal in the previous version. I suspect that files need to be packaged in the same way to be read. Is there any way for UnrealPak to package them in a new way? thank you

spiritovod, posted Sat Apr 08, 2023 2:44 pm (76311)

---

@lifegame: Reimporting and modding in general are out of scope of this topic, especially in cases of custom package formats like this. I'm not aware of any third-part tool, which is able to create 4.26 compatible packages, so the only option is to modify unrealpak code in UE itself - but even if properly modified, it probably will not work out of the box, because the game is using signatures for integrity checks.

lifegame, posted Sat Apr 08, 2023 5:22 pm (76315)

---

spiritovod wrote:

@lifegame: Reimporting and modding in general are out of scope of this topic, especially in cases of custom package formats like this. I'm not aware of any third-part tool, which is able to create 4.26 compatible packages, so the only option is to modify unrealpak code in UE itself - but even if properly modified, it probably will not work out of the box, because the game is using signatures for integrity checks.

I have bypassed the integrity check of the game signature by other means, thank you for your very comprehensive instructions and help, thank you very much, I wish you a happy life~

spiritovod, posted Sat Apr 15, 2023 6:18 pm (76400)

---

Script for extracting latest versions of Dark and Darker is added to specific script bundle, available via my signature. It's a temporary solution though and it skips around one file in every package.

Update: Dark and Darker script is updated to handle packages properly. You need to run quickbms with "-w" option, because it will fix packages before extracting them. By default it will both fix and extract, but you can change respective option in the script to only fix packages and use other compatible tools for viewing/extraction.

Savage, posted Mon Apr 17, 2023 7:06 am (76422)

---

To @spiritovod i tried your bms script (unreal_tournament_4_0.4.27d) with the game Gripper (https://www.gog.com/game/gripper) and after a while unpacking i get this error message, i have 60 GB of free space left, and i'm using the quickbms v0.12.0 (for windows).

Code:

  80293835 3221226154 Gripper\Content\UI\Fonts\NotoSans\Korean\FontFace_NotoSans_KR_Regular.uasset

Error: impossible to write 0xc00002aa bytes (total 0xc00002aa)
       Check your disk space or the script is wrong

Last script line before the error or that produced the error:
  191 log NAME OFFSET DIFF 0 XSIZE

- OFFSET       0x80293835
- SIZE         0xc00002aa
  coverage file 0    85%   1072362277 1258619490 . offset 80293835
  coverage file -5   52%   656097     1258676    . offset 0011479a

spiritovod, posted Mon Apr 17, 2023 12:15 pm (76428)

---

@Savage: You need to use quickbms_4gb_files even for packages smaller than 4GB with most UE scripts due to limitations of usual quickbms version.

--------------------------------------------------------------

Both 4.25 and 4.27 scripts were updated with additional check to ensure that they're used with correct version of quickbms. This check would be implemented in the rest of scripts a bit later.

Savage, posted Mon Apr 17, 2023 4:51 pm (76430)

---

@spiritovod
Thanks, it worked!

Classified, posted Tue Apr 18, 2023 2:21 am (76439)

---

Hello. I have a packed project on ue5 and I would like to know how it can be unpacked and get animations?

MrOwl, posted Thu Apr 20, 2023 10:22 pm (76477)

---

@spiritovod Hi, is there a way we could contact to you privately? is for a business proposition.

jinzhuoer, posted Fri Apr 21, 2023 4:35 pm (76492)

---

spiritovod wrote:

Script for extracting ArcheAge War is added to specific scripts bundle, available via my signature. It should work with both mobile and desktop versions of the game.

Hello,I try to extracting ArcheAge War PC version,but the 'unreal_tournament_4_0.4.27d_archeage_war.bms' cant work after I enter AES_key.

Here is the log:
- start the scanning of the input folder: J:\Games\ArcheAgeWAR
- open input file J:\Games\ArcheAgeWAR\ArcheAgeWAR_Launcher.exe
- open script J:\Games\unpacktools\UE4_specific_scripts\unreal_tournament_4_0.4.27d_archeage_war.bms
- set output folder J:\Games\archwar\un

offset filesize filename
--------------------------------------
The archive is encrypted, you need to provide the key

- please insert the content for the variable KEY:
0xB179A15FBC246D2B758CEC4077C0A582325AD82CF81FD25AE2590E6A063E2F65
KEY: ?y?_?$m u??@w???2Z?,??Z?Yj>/e

Error: the requested amount of bytes to allocate is negative (0x87d8ca49)

Last script line before the error or that produced the error:
65 log MEMORY_FILE5 OFFSET SIZE

- OFFSET 0x78617331
- SIZE 0x87d8ca49
coverage file 0 0% 110 3817032 . offset 78617331

Press ENTER or close the window to quit

Hope you can help me, thx! @spiritovod

spiritovod, posted Sun Apr 23, 2023 12:31 am (76510)

---

@Classified: It depends on the game. If you want to get animations, you don't need to extract anything unless the game in question is using custom package format. You can check either respective forum section at gildor forums or fmodel for possible solutions, but in general it's out of scope of this topic.

@MrOwl: I don't accept any commissions, but if you have particular troubles while using UE scripts, provided here, which you don't want to discuss in public for some reason (for example to provide assets from games under NDA), you can write a PM at other resources like gildor forums or rin.

@jinzhuoer: It can be anything, like changed key or updated package format, though latest android version didn't change at all (due to regional restrictions it's hardly possible to get anything for tests, except for base android package). You can read topic from my signature and provide required files there for further investigation.

jinzhuoer, posted Sun Apr 23, 2023 5:33 am (76514)

---

spiritovod wrote:

@Classified: It depends on the game. If you want to get animations, you don't need to extract anything unless the game in question is using custom package format. You can check either respective forum section at gildor forums or fmodel for possible solutions, but in general it's out of scope of this topic.

@MrOwl: I don't accept any commissions, but if you have particular troubles while using UE scripts, provided here, which you don't want to discuss in public for some reason (for example to provide assets from games under NDA), you can write a PM at other resources like gildor forums or rin.

@jinzhuoer: It can be anything, like changed key or updated package format, though latest android version didn't change at all (due to regional restrictions it's hardly possible to get anything for tests, except for base android package). You can read topic from my signature and provide required files there for further investigation.

@spiritovod, Hi spiritovod,maybe I make a mistake in my process of extract. For now,I do it.
The The correct way is:
1 Search '.pak' in folder of game.
2 paste all '.pak' file to a new folder.
3 Run QuickBms and set archives taget to this new folder full with the game '.pak'.
4 Paste AES key to extract every pak when tips appears,after this step all 'uassets' would be extracted(without any encryption).
5 run 'umodel' to export '.psk'model and textures.
But umodel cant extract animation file,I dont find method yet.

It may be a very clumsy solution, but it does work.
Thank you for the script and the helpful suggestions!Wish you all the best!

spiritovod, posted Sun Apr 23, 2023 11:53 am (76517)

---

@jinzhuoer: If you've already extracted assets successfully, the rest is out of scope of this topic. You can create a topic at gildor forums for umodel issues, but without samples nobody will help you anyway, because the game is not accessible outside korea at the moment.

jinzhuoer, posted Mon Apr 24, 2023 3:52 pm (76532)

---

spiritovod wrote:

@jinzhuoer: If you've already extracted assets successfully, the rest is out of scope of this topic. You can create a topic at gildor forums for umodel issues, but without samples nobody will help you anyway, because the game is not accessible outside korea at the moment.

@spiritovod The model and texture resources are indeed successfully extracted, but using umodel to extract the animation resources will report an error and exit the program, and using 3DMAX to convert the model file will also have the problem that the material cannot find the texture.
Thanks for the suggestion, I'll try to ask for a solution on gildor's forum afterwards.
Thanks again!