This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=12629

bonder, posted Wed Oct 09, 2019 12:56 am (51404)

---

Trying to decrypt and unpack Indivisible (PC)'s .pkg archives. Very new at this so not sure what to do.
Here are downloads for the executable and data_1.pkg.

Ekey, posted Wed Oct 09, 2019 2:23 am (51405)

---

Data is xored with very long key (1779080 bytes) - attached. Format: here. Files are compressed with LZ4

bonder, posted Wed Oct 09, 2019 3:05 am (51406)

---

Ekey wrote:

Data is xored with very long key (1779080 bytes) - attached. Format: here. Files are compressed with LZ4

Thank you! I've tried running the skullgirls bms script but nothing happens. How do I apply the key? Sorry, I'm very new at this.

aluigi, posted Wed Oct 09, 2019 8:07 am (51411)

---

@Ekey
Are you sure about the key?
The data from offset 0x19EF55 is wrong.

Anyway this is the script once the file is decrypted:

Code:

# Indivisible PKG / Reverge Package File
#   thanks Ekey https://zenhax.com/viewtopic.php?p=51405#p51405
#   FILE MUST BE DECRYPTED!

endian big
get OFFSET long

get NAMESZ longlong
getdstring NAME NAMESZ
if NAME & "Reverge"
else
    print "Error: unknown package file: %s" NAME
    cleanexit
endif

get NAMESZ longlong
getdstring NAME NAMESZ

get FILES longlong
for i = 0 < FILES
    get NAMESZ longlong
    getdstring NAME NAMESZ
    get SIZE longlong
    get DUMMY long  # 1
    log NAME OFFSET SIZE
    math OFFSET   SIZE
next i

Ekey, posted Wed Oct 09, 2019 4:58 pm (51420)

---

Seems compressed data also xored with this key. if interested, I attached pseudo-code for key generation and data decompression.

obfuscation.zip

Ekey, posted Mon Oct 14, 2019 8:58 pm (51530)

---

aluigi wrote:

@Ekey
Are you sure about the key?
The data from offset 0x19EF55 is wrong.

Key are correct. Here a solution. Check this, works fine for me

Code:

void lpDecrypt(BYTE* lpBuffer, DWORD dwSize)
{
  for (int i = 0; i   {
    lpBuffer[i] ^= lpKey[i % 1779072]; //v7 = v6 - 8;
  }
}

yuxin123, posted Thu Oct 17, 2019 5:31 pm (51587)

---

hi,@Ekey

I found your name in the dzs_qq.bms script. I got troblem with the filenames while extracting asura vfs fileshttps://www.zenhax.com/viewtopic.php?f=13&t=12656, as aluigi said something like codepage is wrong. I tried as much as I can then dont know waht to do.

Really wish you can help me.
vfs file:https://drive.google.com/open?id=1xchzvob3um5jP5gRajrYo8vZzD6BqGOG

bonder, posted Tue Oct 22, 2019 3:26 pm (51681)

---

The key worked fine for decrypting the main PKGs, but now I'm stuck again trying to get into these .lz4 files. Here is an upload from the data2.pkg, of Latigo's cutscene textures. What is my next step?

Szkaradek123, posted Fri Dec 27, 2019 4:25 pm (52812)

---

Hi
Need help to decrypt lz4 files

sample:
http://www.mediafire.com/file/046i0vljx ... s.lz4/file

and here decrypted pkg
http://www.mediafire.com/file/7rhxy91q3 ... crypt/file

Ekey, posted Sat Dec 28, 2019 12:34 am (52825)

---

Szkaradek123 wrote:

Hi
Need help to decrypt lz4 files

sample:
http://www.mediafire.com/file/046i0vljx ... s.lz4/file

and here decrypted pkg
http://www.mediafire.com/file/7rhxy91q3 ... crypt/file

Your files are not fully decrypted. Here is my solution.

1) Decrypt PKG's with utility -> IPKGDecryptor (here). Usage as always simple:

Example

Code:

IPKGDecryptor e:\Games\Indivisible\pkgs\data_1.pkg

2) Use a new script below on PKG with prefix _decrypted
3) Profit.

Code:

# Indivisible PKG / Reverge Package File
#   thanks Ekey https://zenhax.com/viewtopic.php?p=51405#p51405
#   FILE MUST BE DECRYPTED! Use IPKGDecryptor https://zenhax.com/viewtopic.php?p=52847#p52847

endian big
get OFFSET long

get NAMESZ longlong
getdstring NAME NAMESZ
if NAME & "Reverge"
else
    print "Error: unknown package file: %s" NAME
    cleanexit
endif

get NAMESZ longlong
getdstring NAME NAMESZ

get FILES longlong
for i = 0 < FILES
    get NAMESZ longlong
    getdstring NAME NAMESZ
    get SIZE longlong
    get DUMMY long  # 1
   
    set EXT extension NAME
   
    if EXT == "LZ4"
       comtype lz4f
       math FSIZE = 0x400000 #I think this is enough :)
       math FSIZE * 10
       clog NAME OFFSET SIZE FSIZE
    else
       log NAME OFFSET SIZE
    endif
    math OFFSET   SIZE
next i

Szkaradek123, posted Sat Dec 28, 2019 6:37 pm (52843)

---

Thank you Ekey for the tool.

I have a little problem to force a tool to work.

Bat file is not working and i wonder what is problem ?

My commands were something like that:

IPKGDecryptor d:\Indivisible\pkgs\data_3.pkg

IPKGDecryptor d:/Indivisible/pkgs/data_3.pkg

"d:\Indivisible\pkgs\IPKGDecryptor.exe" "d:\Indivisible\pkgs\data_3.pkg"

IPKGDecryptor "d:\Indivisible\pkgs\data_3.pkg"

I have very slowly Python decryptor maked by your algorithm.

Code:

def pkgParser(filename):
   new=open(filename ".decrypt","wb")
   
   keyFile=open("key.dat","rb")
   keyBin=BinaryReader(keyFile)
   keydata=keyBin.b(keyBin.fileSize())
   
   pkgFile=open(filename,'rb')
   pkgFile.seek(0,2)
   size=pkgFile.tell()
   print size
   pkgFile.seek(0)
   #for i  in  range(size):
   i=0
   while(True):
      b=struct.unpack('b',pkgFile.read(1))[0]
      b^=keydata[i % 1779072]
      new.write(struct.pack('b',b))
      if i==size:break
      i =1
   keyFile.close()
   new.close()
   pkgFile.close()

It works for me and using bms to extract data from decrypted pkg files i get needed images and other files.

Animated sprites are build in files with "art" extension. They are local swizzled.
http://www.mediafire.com/file/62unppy1w ... o.art/file

Ekey, posted Sat Dec 28, 2019 8:01 pm (52847)

---

Szkaradek123 wrote:

Thank you Ekey for the tool.

I have a little problem to force a tool to work.

Bat file is not working and i wonder what is problem ?

My commands were something like that:

IPKGDecryptor d:\Indivisible\pkgs\data_3.pkg

IPKGDecryptor d:/Indivisible/pkgs/data_3.pkg

"d:\Indivisible\pkgs\IPKGDecryptor.exe" "d:\Indivisible\pkgs\data_3.pkg"

IPKGDecryptor "d:\Indivisible\pkgs\data_3.pkg"

Oops, my bad. I fixed it

IPKGDecryptor_0.1_fixed.rar

ili, posted Wed Apr 08, 2020 6:19 am (55623)

---

thanks

Wonderful, posted Sun Apr 12, 2020 12:01 pm (55817)

---

This thread was super helpful for me -- I was able to use the IPKGDecryptor and the new BMS script to turn the data_*.pkg files into folders full of files -- however, I'm pretty stuck on how to properly extract the various .lz4 files. The BMS script doesn't seem to have extracted them, and a variety of things I've tried haven't worked yet.

Using data_2.pkg/lz4/foits/golem.art.lz4 as an example:
* I downloaded and ran the lz4.exe tool on the file, but I get "Error 44 : Unrecognized header : file cannot be decoded"
* I downloaded the python lz4 module and tried using lz4.block.decompress(), but get "_block.LZ4BlockError: Decompression failed: corrupt input or insufficient space in destination buffer. Error code: 4"
* I tried the same lz4.block.decompress() with an uncompressed_size=X, but I get the same error up until X is too large.
* I tried lz4.frame.decompress(), but get "RuntimeError: LZ4F_getFrameInfo failed with code: ERROR_frameType_unknown"
* I tried all of the above a second time, after running the file through IPKGDecryptor.exe just in case. The errors make me think that at that point the file's just corrupted, so I don't think it needs to be decrypted?

I'm not very familiar with QuickBMS or LZ4, so I haven't tried further experiments with the BMS scripts or with trying to understand the .lz4 file header info. Any chance someone could help me with the proper steps to take one of these .lz4 files and actually get it properly extracting?

Thank you!!!

swat, posted Wed Oct 20, 2021 5:09 pm (67102)

---

Ekey wrote:

Szkaradek123 wrote:

Thank you Ekey for the tool.

I have a little problem to force a tool to work.

Bat file is not working and i wonder what is problem ?

My commands were something like that:

IPKGDecryptor d:\Indivisible\pkgs\data_3.pkg

IPKGDecryptor d:/Indivisible/pkgs/data_3.pkg

"d:\Indivisible\pkgs\IPKGDecryptor.exe" "d:\Indivisible\pkgs\data_3.pkg"

IPKGDecryptor "d:\Indivisible\pkgs\data_3.pkg"

Oops, my bad. I fixed it

I have decrypted data_1.pkg
extract files with quickbms
and import with quickbms
but
how to crypt data_1_decrypted.pkg
because game crashed

Vannbin, posted Tue Mar 15, 2022 4:29 am (70495)

---

I've pretty much gone through every .pkg file for the game but can't really go past the .lz4 files in there, the .art, .dds and other files under the .lz4 are ones I can't figure out and can't fine any real options around even through a few searches(I'll keep trying but the concluding I keep getting is that it's pretty much impossible) still, I took a moment to think, 'sure I'm stumped but there's no point in giving up. If I can't do it maybe someone else can, no point in me just trashing my work after all.' And so that leads to this moment.

https://drive.google.com/file/d/1rGdH-X ... sp=sharing

I am stumped on getting past .lz4 part of the files, I managed to semi get past one for a .art file but have no clue or resource to get past it. I pretty much just used all the tips and directions from here to even get this much done but as of that I can't do anything else.

Zeek_McGee, posted Thu Jun 30, 2022 3:07 pm (72354)

---

Example dds.lz4
Rename to .dds

Open with Gimp or convert to .png

u win!

FreetoThinkFree, posted Sat Aug 20, 2022 3:18 am (73086)

---

Zeek_McGee wrote:

Example dds.lz4
Rename to .dds

Open with Gimp or convert to .png

u win!

I tried doing that with .art files, .lz4 files and .art.lz4 files. It didn't work. Any other way?