Identity V Assets (.npk) zlib compression

[TeaEffTeu]

8 minutes ago, Zambies said:

im sorry for question but when i run exe it show console flash then never does anything else 😥 do i put exe somewhere special or download other files? i put on desktop and ran 😥 sry

This is a command-line tool, you'll need to run it through cmd or any other console.

[Zambies]

thank u!!! it works well now!! 🙌

[Aerlene_]

On 2/10/2025 at 9:32 PM, Zambies said:

thank u!!! it works well now!! 🙌

Heyy could you please tell me how you ran that tool? I tried cmd but this is what its showing. I don't know how to navigate beyond this. 

[TeaEffTeu]

You can run `nxre help export` for more info. Otherwise, just run `nxre export file.npk` to quickly export one or more NPKs.

[Aerlene_]

On 3/4/2025 at 6:49 PM, TeaEffTeu said:

You can run `nxre help export` for more info. Otherwise, just run `nxre export file.npk` to quickly export one or more NPKs.

What is the string of characters that we need to type in the cmd after the `nxre help export`? 

sorry actually i don't have much idea on how to use cmd so i just need to know what exactly to type in.

[JohnSmith]

15 hours ago, Aerlene_ said:

What is the string of characters that we need to type in the cmd after the `nxre help export`? 

sorry actually i don't have much idea on how to use cmd so i just need to know what exactly to type in.

example: ./nxre.exe export res.npk

[ymnex]

error

res.rar

[TeaEffTeu]

On 3/15/2025 at 1:21 AM, ymnex said:

error

res.rar 2.49 MB · 8 downloads

The NPK seems to be encrypted in a new format.

[wq223]

Is there a bms script or other script that decrypts nxs3 available, I have tried multiple nxs3 decryption scripts since the text file was encrypted to nxs3, but they all have errors
I've also tried writing scripts from quickbms myself, but it seems to be prompting for related errors for the key

Edited March 20 by wq223

[TeaEffTeu]

14 minutes ago, wq223 said:

Is there a bms script or other script that decrypts nxs3 available, I have tried multiple nxs3 decryption scripts since the text file was encrypted to nxs3, but they all have errors
I've also tried writing scripts from quickbms myself, but it seems to be prompting for related errors for the key

I believe NeoXtractor does, but I'm not sure if the latest research has been published.

[Zhang189509]

似乎已经更新了加密版本，对于新的script.npk所开包的文件全是nxs3，目前还有bms的更新脚本吗？

[wq223]

2 hours ago, Zhang189509 said:

似乎已经更新了加密版本，对于新的script.npk所开包的文件全是nxs3，目前还有bms的更新脚本吗？

 

2 hours ago, Zhang189509 said:

似乎已经更新了加密版本，对于新的script.npk所开包的文件全是nxs3，目前还有bms的更新脚本吗？

There is a tool written by a master on github, denpk2, but because the required dependency pytools was deleted by master, the program cannot be compiled and run. I deleted other contents of this tool and canceled the pytools dependency, only targeted the decryption logic of nxs3, and adjusted the script

All .nxs files in one folder can now be processed in batches and outputted to another folder

Just locate the Cargo.toml directory and use

cargo build --release command compiler

You will get a new folder and include the executable program

Create a folder to import the .nxs file and run the executable command

cargo run --release -- input folder output folder

denpk2.zip

[ymnex]

On 3/20/2025 at 6:06 AM, TeaEffTeu said:

NPK 似乎以一种新的格式加密。

Is this doable?

[TeaEffTeu]

9 hours ago, ymnex said:

Is this doable?

Unfortunately, the NPK has an encrypted header (this is new) and an updated index table format (and possibly also encrypted). Without knowing either of the encryption methods/keys, it's incredibly difficult. It's not feasible to come up with a clean solution without brute forcing each NPK.

[Zhang189509]

So now the npk have a newer encryption，There seems to be no perfect solution at the moment。So sadly。

[ymnex]

On 4/2/2025 at 4:31 AM, TeaEffTeu said:

不幸的是，NPK 有一个加密的标头（这是新的）和更新的索引表格式（可能也是加密的）。在不知道任何加密方法/密钥的情况下，这非常困难。如果不对每个 NPK 进行暴力破解，就想出一个干净的解决方案是不可行的。

I extracted npk files from an installation package from 2018 and found there's no standard header. This seems to have been the case for many years.

[wq223]

37 minutes ago, ymnex said:

我从 2018 年的安装包中提取了 npk 文件，发现没有标准头文件。这种情况似乎已经持续了很多年了。

I'm very interested in knowing which game this is, is it that every file keeps the same head? It seems to be valid plaintext after the head, but not sure if it contains compression

[ymnex]

23 hours ago, wq223 said:

I'm very interested in knowing which game this is, is it that every file keeps the same head? It seems to be valid plaintext after the head, but not sure if it contains compression

lifeafter.exe

The header of each NPK file is different.

[ymnex]

23 hours ago, wq223 said:

I'm very interested in knowing which game this is, is it that every file keeps the same head? It seems to be valid plaintext after the head, but not sure if it contains compression

script.py3.npk is the core file where all game logic is contained.

[ymnex]

On 4/2/2025 at 4:31 AM, TeaEffTeu said:

Unfortunately, the NPK has an encrypted header (this is new) and an updated index table format (and possibly also encrypted). Without knowing either of the encryption methods/keys, it's incredibly difficult. It's not feasible to come up with a clean solution without brute forcing each NPK.

Actually, currently there's only one cracking method, which is to examine the decryption process through IDA debugging. The NPK contains a decryption script with a unique key and modified opcodes. To be precise, in the Android client, the .so file functions like a virtual machine and custom interpreter. The underlying decryption is still implemented using Python scripts.

Because some NPK files and documentation have already indicated this, they do contain decryption functions. This decryption process is implemented in the libclient.so file. And the game I found has a PC version, which is more suitable for debugging.

[wq223]

3 hours ago, ymnex said:

script.py3.npk 是包含所有游戏逻辑的核心文件。

I remember that scripts are usually found in script.npk file. Has this been renamed?

[ymnex]

1 hour ago, wq223 said:

I remember that scripts are usually found in script.npk file. Has this been renamed?

It should involve unpacking or decryption functions, but we'll only know for sure after debugging.

[wq223]

2 hours ago, ymnex said:

It should involve unpacking or decryption functions, but we'll only know for sure after debugging.

script.npk seems to be some kind of special encryption, that is, it is not zlib compressed nxs, nor is it a rot starting with 1D04.
I can't tell the logic at the moment, it seems to use a more advanced encryption method, they don't have the same byte statement that the key is also dynamically adjusted like nxs
Outside script.npk, other patches seem to contain zstd compression, I can't find the index part, so I tried brute force extraction
I used to unpack another game before
The files you provide, they do not seem to have zstd compressed flags, which are very similar to uncompressed files, but they are extracted and cannot be used
In the file you provide, it seems that each file is preceded by F2 00
I also found something interesting
The first 16 bytes of each file should be the same (probably some kind of validation or something)
I used brute force teardown script before, if needed, only patches with zstd compression

cj.py jy.py fl.py

[ymnex]

19 hours ago, wq223 said:

script.npk seems to be some kind of special encryption, that is, it is not zlib compressed nxs, nor is it a rot starting with 1D04.
I can't tell the logic at the moment, it seems to use a more advanced encryption method, they don't have the same byte statement that the key is also dynamically adjusted like nxs
Outside script.npk, other patches seem to contain zstd compression, I can't find the index part, so I tried brute force extraction
I used to unpack another game before
The files you provide, they do not seem to have zstd compressed flags, which are very similar to uncompressed files, but they are extracted and cannot be used
In the file you provide, it seems that each file is preceded by F2 00
I also found something interesting
The first 16 bytes of each file should be the same (probably some kind of validation or something)
I used brute force teardown script before, if needed, only patches with zstd compression

cj.py 2.14 kB · 3 downloads jy.py 1.89 kB · 5 downloads fl.py 2.25 kB · 3 downloads

success

Unpacked.zip

[wq223]

12 hours ago, ymnex said:

成功

解压后.zip 64.77 千字节 · 0 次下载

Have you found a way? Are they encrypted or compressed?