This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=14567

rkthelegend, posted Mon Dec 07, 2020 7:55 pm (60969)

---

Topic closed

aluigi, posted Sun May 16, 2021 2:37 pm (64082)

---

Each entry containing offset and size of the file is encrypted, check the two "DUMMY" fields below:

Code:

. 000000c8 get     DUMMY      0xbb316aa3 4
. 000000cc get     DUMMY      0xc59b254d 4
. 000000d0 get     DUMMY      0x00000001 4
. 000000d4 get     SOME_CRC   0x03c39c18 4
. 000000d8 getdstr NAME       "SND_vo_lvl_pro_s360_002_kra" 56
    53 4e 44 5f 76 6f 5f 6c 76 6c 5f 70 72 6f 5f 73   SND_vo_lvl_pro_s
    33 36 30 5f 30 30 32 5f 6b 72 61 00 00 00 00 00   360_002_kra.....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
    00 00 00 00 00 00 00 00                           ........

The good thing is that all the archived files are BKHD and so you can just dump them by looking for the "BKHD" magic field:

Code:

findloc OFFSET binary "BKHD"
do
    goto OFFSET
    get DUMMY long
    findloc NEXT_OFFSET binary "BKHD" 0 ""
    if NEXT_OFFSET == ""
        get SIZE asize
    else
        math SIZE = NEXT_OFFSET
    endif
    math SIZE -= OFFSET
    log "" OFFSET SIZE
    math OFFSET = NEXT_OFFSET
while NEXT_OFFSET != ""