This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=13475

Habanero, posted Fri Apr 17, 2020 6:55 am (56015)

---

Hello. I wuold like to extract the two PAC files present in this MEGA folder (mainly to get the audio). I've included the filecutter results as well. I don't recognize any headers in HxD (looks like gibberish). Just for the hell of it, I tried the scripts on the QuickBMS page that have "pac" in them (none worked, of course). Thank you for any assistance.

https://mega.nz/folder/I9QBkKrQ#W3rQGAyJ05_5cL7rVq4yDg

aluigi, posted Fri Apr 17, 2020 9:47 am (56020)

---

There is some obfuscation in place.

32bit equal to one, followed by 0x40 bytes xored with 0x40 (example of GameData.pac):

Code:

ba b1 8a 56 42 45 53 45 30 30 2e 49 4d 47 00 00   ...VBESE00.IMG..
7e e9 d1 77 00 00 40 00 60 90 39 01 f6 0c 10 00   ~..w..@.`.9.....
90 e9 d1 77 60 90 39 01 00 00 40 00 10 1f 54 00   ...w`[email protected].
00 00 40 00 00 00 00 00 c0 ff 12 00 43 b2 82 56   [email protected]

Followed by a 32bit offset field but not sure what's the content from 0x48 to that offset, it's for sure xored with the same 0xac since there are some readable strings there.
I suppose it's compressed with some lzss algorithm and this reminds me of some game that used that algorithm with the data of the copy opcode xored with some constant that (if I remember correctly) was just 0xac.

Unfortunately I don't remember what was the game or maybe I'm confusing it with the lzss used in Allegro which uses xor on the flag and repeated characters.

Habanero, posted Sat Apr 25, 2020 7:39 am (56266)

---

Hmm, I'll try to ask around some more. It's a fun game, so I might want to try and go for a UI translation at least.

Habanero, posted Mon Apr 27, 2020 7:35 pm (56327)

---

aluigi wrote:

There is some obfuscation in place.

32bit equal to one, followed by 0x40 bytes xored with 0x40 (example of GameData.pac):

Code:

ba b1 8a 56 42 45 53 45 30 30 2e 49 4d 47 00 00   ...VBESE00.IMG..
7e e9 d1 77 00 00 40 00 60 90 39 01 f6 0c 10 00   ~..w..@.`.9.....
90 e9 d1 77 60 90 39 01 00 00 40 00 10 1f 54 00   ...w`[email protected].
00 00 40 00 00 00 00 00 c0 ff 12 00 43 b2 82 56   [email protected]

Followed by a 32bit offset field but not sure what's the content from 0x48 to that offset, it's for sure xored with the same 0xac since there are some readable strings there.
I suppose it's compressed with some lzss algorithm and this reminds me of some game that used that algorithm with the data of the copy opcode xored with some constant that (if I remember correctly) was just 0xac.

Unfortunately I don't remember what was the game or maybe I'm confusing it with the lzss used in Allegro which uses xor on the flag and repeated characters.

I asked HCS and got an answer (posting here in case you were interested):

"For the sound in SoundData.PAC, no data is obfuscated EXCEPT some sort of "file list" i.e. filenames, positions, metadata & such, as aluigi stated. You just search for "RIFF" headers starting at 0x1FC8. 128 tracks. Use vgm toolbox's (RIFF) WAV extractor."