This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=13984

Lucas Hood, posted Sun Aug 16, 2020 1:56 pm (58096)

---

Hello, currently i wants to extract resources from the game Kishin Hishou Demonbane, however i have tried all the tools but none of them worked. The files are all in .pak, much appreciated if anyone can help me with this. I can upload the game if you guys need.



Editted: Solved, big thanks to Ekey.

Ekey, posted Sun Aug 16, 2020 2:36 pm (58097)

---

Upload sample files.

Lucas Hood, posted Sun Aug 16, 2020 2:47 pm (58098)

---

Ekey wrote:

Upload sample files.

Here's the one that you might need

https://drive.google.com/file/d/15GEq0Y ... sp=sharing

This is what happen when i used Garbro, as you can see it's unreadable

Ekey, posted Sun Aug 16, 2020 4:21 pm (58101)

---

Entry table compressed by zlib but fields with size, offsets and etc. values is encrypted/obfuscated (also with files data), there is nothing much we can do without reverse engineering.

Lucas Hood, posted Sun Aug 16, 2020 5:25 pm (58102)

---

Ekey wrote:

Entry table compressed by zlib but fields with size, offsets and etc. values is encrypted/obfuscated (also with files data), there is nothing much we can do without reverse engineering.

Do you need me to upload the whole game? Maybe you guys can check or something

Ekey, posted Sun Aug 16, 2020 5:33 pm (58104)

---

Lucas Hood wrote:

Do you need me to upload the whole game?

Yeah, sure.

spiritovod, posted Sun Aug 16, 2020 9:29 pm (58110)

---

There is already draft for this format: https://aluigi.altervista.org/bms/nitro_plus.bms
But since it's just experimental script, some adjustments are required.

Lucas Hood, posted Mon Aug 17, 2020 1:59 am (58111)

---

Ekey wrote:

Lucas Hood wrote:

Do you need me to upload the whole game?

Yeah, sure.

Okay, sorry for late reply, here's the game you need

https://drive.google.com/file/d/1n2mAPd ... sp=sharing

Much appreciated if anyone can help

Lucas Hood, posted Mon Aug 17, 2020 7:51 am (58113)

---

My friend used quick bms to extract, but all of his images are like this

Much appreciated if anyone can help us to fix

Ekey, posted Mon Aug 17, 2020 3:15 pm (58118)

---

Code:

# KishinHisho PAK format
# script for QuickBMS http://quickbms.aluigi.org

set MEMORY_FILE10 string "
int pak_gethash(const char* m_String)
{
  char bTemp;
  int result;

  bTemp = *m_String;
  for ( result = 0; bTemp;   m_String )
  {
    result = bTemp   137 * result;
    bTemp = m_String[1];
  }
  return result;
}

void pak_decrypt(unsigned char* lpBuffer, int dwKey, int dwSize, int dwFullData)
{
  if (!dwFullData){
    if (dwSize > 1024){
        dwSize = 1024;
      }
  }

  int dwTemp;
  int* dwBlock = (int*)lpBuffer;

  dwSize >>= 2;
  while(dwSize-- > 0)
  {
     dwTemp = *dwBlock ^ dwKey;
     *dwBlock   = dwTemp;
  }
}"

get VERSION long #4
getdstring ID 256 #KishinHisyouDB

get PAD long #100
get TABLE_SIZE long
get FILES long
get TABLE_ZSIZE long
savepos TABLE_OFFSET

math PAD ^= TABLE_ZSIZE
math PAD  = 276

calldll MEMORY_FILE10 "pak_gethash" "tcc" TABLE_KEY ID # 0xCC09DBB5 (3051030988)

math FILES ^= TABLE_KEY
math TABLE_SIZE ^= TABLE_KEY

comtype zlib_noerror
clog MEMORY_FILE TABLE_OFFSET TABLE_SIZE TABLE_ZSIZE

for i = 0 < FILES
   get NSIZE long MEMORY_FILE
   getdstring NAME NSIZE MEMORY_FILE
   calldll MEMORY_FILE10 "pak_gethash" "tcc" ENTRY_KEY NAME
   
   codepage 932
   set NAME to_unicode NAME  # jis -> utf16 (unicode)
   codepage "utf8"
   set NAME unicode NAME     # utf16 -> utf8
     
   get OFFSET long MEMORY_FILE
   get SIZE long MEMORY_FILE
   get DUMMY1 long MEMORY_FILE
   get ZIP long MEMORY_FILE
   get ZSIZE long MEMORY_FILE

   math ZIP ^= ENTRY_KEY
   math OFFSET ^= ENTRY_KEY
   math OFFSET  = PAD
   math SIZE ^= ENTRY_KEY
   math ZSIZE ^= ENTRY_KEY

   if ZIP == 0
      log MEMORY_FILE2 OFFSET SIZE
   else
      clog MEMORY_FILE2 OFFSET ZSIZE SIZE
   endif
   
   if EXT == "NPS"
      calldll MEMORY_FILE10 "pak_decrypt" "tcc" RET MEMORY_FILE2 ENTRY_KEY SIZE 1
   else
      calldll MEMORY_FILE10 "pak_decrypt" "tcc" RET MEMORY_FILE2 ENTRY_KEY SIZE 0
   endif

   log NAME 0 SIZE MEMORY_FILE2
next i

Lucas Hood, posted Mon Aug 17, 2020 3:50 pm (58119)

---

Thanks for the script, so all i have to do is put it into a text document file in my Quickbms folder?

Update: IT WORKED! THANK YOU, THANK YOU VERY MUCH!