This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=16134

Tosyk, posted Fri Nov 26, 2021 10:03 am (67704)

---

Please help me to unpack this types of archives:
level.levelstream
gamedata.pak

this bms script doesn't work: http://aluigi.org/papers/bms/blur.bms

ramzidz15, posted Fri Nov 26, 2021 12:55 pm (67709)

---

I have the same file extracted from switch NSP pakchunk0-Switch.pak,I couldn't find a way to extract it.

aluigi, posted Fri Dec 03, 2021 2:59 pm (67847)

---

Open the blur.bms script and set the WORK_AROUND variable at line 11 from 0 to 1. It will immediately work.

No idea for the levelstream file.

Tosyk, posted Sat Dec 04, 2021 12:25 pm (67895)

---

can you check root.pak? I can't extract it

aluigi, posted Sat Dec 04, 2021 12:47 pm (67897)

---

Long story short the Blur format is a mess.
In this case the problem is caused by the compressed data which can't be decompressed and makes the whole extraction wrong, because the size of each file is calculated on the decompressed data but if the decompression fails (unzip_dynamic or zlib_noerror) the size of the decompressed chunk will be CHUNK_ZSIZE instead of CHUNK_SIZE.
I don't know why decompression isn't zlib or deflate.
So you can't extract anything.

Tosyk, posted Sat Dec 04, 2021 12:50 pm (67899)

---

It's impossible to know the compression type to add it the script?

Ekey, posted Mon Dec 06, 2021 2:00 pm (67990)

---

Code for decrypt PAK filenames (simple xor) :B

Key

Code:

xVXo40j3@$%\%`

Code:

        private static byte[] lpKey = new byte[] {
           0x78, 0x56, 0x58, 0x6F, 0x34, 0x30, 0x6A, 0x33, 0x40, 0x24, 0x25, 0x5C, 0x25, 0x60};

        static Byte[] iDecryptData(Byte[] lpBuffer)
        {
            for (Int32 i = 0; i < lpBuffer.Length;   i)
            {
                lpBuffer[i] ^= lpKey[(i   1) % 14];
            }

            return lpBuffer;
        }

Tosyk, posted Mon Dec 06, 2021 6:00 pm (67994)

---

Ekey wrote:

Code for decrypt PAK filenames (simple xor) :B

Key

Code:

xVXo40j3@$%\%`

Code:

        private static byte[] lpKey = new byte[] {
           0x78, 0x56, 0x58, 0x6F, 0x34, 0x30, 0x6A, 0x33, 0x40, 0x24, 0x25, 0x5C, 0x25, 0x60};

        static Byte[] iDecryptData(Byte[] lpBuffer)
        {
            for (Int32 i = 0; i < lpBuffer.Length;   i)
            {
                lpBuffer[i] ^= lpKey[(i   1) % 14];
            }

            return lpBuffer;
        }

Thank you, Ekey, how can I use it? How to implement it to bms? Or it's not for bms?

aluigi, posted Mon Dec 06, 2021 8:32 pm (67995)

---

At line 37 of blur.bms you can find the encryption command with the key.
Replace that line with the following:

Code:

encryption xor "xVXo40j3@$%\\%`"

Honestly I'm not exactly sure about it because the key of Ekey is exactly the same in the script with the only difference of being shifted of one character (look at the final 'x')... mah, try and let us know.

Tosyk, posted Tue Dec 07, 2021 6:20 pm (68015)

---

aluigi wrote:

At line 37 of blur.bms you can find the encryption command with the key.
Replace that line with the following:

Code:

encryption xor "xVXo40j3@$%\\%`"

Honestly I'm not exactly sure about it because the key of Ekey is exactly the same in the script with the only difference of being shifted of one character (look at the final 'x')... mah, try and let us know.

doesn't really work as I can judge

Ekey, posted Wed Dec 08, 2021 12:50 am (68020)

---

aluigi wrote:

At line 37 of blur.bms you can find the encryption command with the key.
Replace that line with the following:

Code:

encryption xor "xVXo40j3@$%\\%`"

Honestly I'm not exactly sure about it because the key of Ekey is exactly the same in the script with the only difference of being shifted of one character (look at the final 'x')... mah, try and let us know.

On gamedata_boot.pak works fine, idk about other pak's

Tosyk, posted Wed Dec 08, 2021 4:00 pm (68033)

---

I'm trying to unpack root.pak from this post viewtopic.php?p=67895&sid=5fb7d99a21e8c14ca8910e05602d48fc#p67895
the only pak I have problem with right now

Ekey, posted Wed Dec 08, 2021 4:10 pm (68035)

---

It works on other paks from xbox? maybe there different key?

Tosyk, posted Wed Dec 08, 2021 5:38 pm (68040)

---

Ekey wrote:

It works on other paks from xbox? maybe there different key?

all the paks can be unpacked with original http://aluigi.org/papers/bms/blur.bms

the only error I get is from root.pak from this post: viewtopic.php?p=67895#p67895



if I change xor key then I get this error:

Ekey, posted Wed Dec 08, 2021 7:05 pm (68046)

---

aluigi wrote:

At line 37 of blur.bms you can find the encryption command with the key.
Replace that line with the following:

Code:

encryption xor "xVXo40j3@$%\\%`"

Honestly I'm not exactly sure about it because the key of Ekey is exactly the same in the script with the only difference of being shifted of one character (look at the final 'x')... mah, try and let us know.

I can offer you this variant

Code:

set MEMORY_FILE10 string "
void blur_decrypt(unsigned char* lpBuffer, int dwSize)
{
  unsigned char lpKey[14] = {0x78, 0x56, 0x58, 0x6F, 0x34, 0x30, 0x6A, 0x33, 0x40, 0x24, 0x25, 0x5C, 0x25, 0x60};
  for (int i = 0; i   {
     lpBuffer[i] ^= lpKey[(i   1) % 14];
  }
}
"

........
savepos OFFSET
log MEMORY_FILE OFFSET NAMES_SIZE
calldll MEMORY_FILE10 "blur_decrypt" "tcc" RET MEMORY_FILE NAMES_SIZE
math OFFSET  = NAMES_SIZE
math OFFSET x= MYALIGN
goto OFFSET
........

Tosyk, posted Wed Dec 08, 2021 9:21 pm (68051)

---

Ekey wrote:

<...>
I can offer you this variant

Code:

set MEMORY_FILE10 string "
void blur_decrypt(unsigned char* lpBuffer, int dwSize)
{
  unsigned char lpKey[14] = {0x78, 0x56, 0x58, 0x6F, 0x34, 0x30, 0x6A, 0x33, 0x40, 0x24, 0x25, 0x5C, 0x25, 0x60};
  for (int i = 0; i   {
     lpBuffer[i] ^= lpKey[(i   1) % 14];
  }
}
"

........
savepos OFFSET
log MEMORY_FILE OFFSET NAMES_SIZE
calldll MEMORY_FILE10 "blur_decrypt" "tcc" RET MEMORY_FILE NAMES_SIZE
math OFFSET  = NAMES_SIZE
math OFFSET x= MYALIGN
goto OFFSET
........

is this a bms script? how to use this code? sorry, I'm a little bit confused

aluigi, posted Thu Dec 09, 2021 8:57 am (68073)

---

Put the "set MEMORY_FILE10..." part at the beginning of the script.

The rest (from savepos to goto) overwrite the section of the script from line 36 to 42, it's easy to recognize because it's almost identical to the patch.

Ekey, posted Thu Dec 09, 2021 11:21 am (68077)

---

This should solve the decryption problem, but not the decompression of the files data for xbox paks.

Tosyk, posted Fri Dec 10, 2021 6:48 pm (68147)

---

okay, right now I have this output


also my script look like this:

Code:

# Blur (script 0.3.3)
#   note that I have tried to support multiple versions of the Blur
#   archives with the result of being possibly not 100% compatible
#   with some of them.
#   would be required a full rewrite for each version but finding
#   all the old files is a pain at the moment
#   in case of problems set WORK_AROUND to 1
# script for QuickBMS http://quickbms.aluigi.org

set MEMORY_FILE10 string

# set WORK_AROUND to 1 if you get an error
math WORK_AROUND = 0

getdstring SIGN 4
if SIGN == "2KAP"
elif SIGN == "PAK2"
    comtype xmemdecompress
    endian big
else
    cleanexit
endif
if WORK_AROUND != 0
    string SIGN r SIGN
endif

get PAK_SIZE asize

get VERSION long
get MYALIGN long
goto 0x38
get NAMES_SIZE long
if NAMES_SIZE == 0
    goto MYALIGN
    get NAMES_SIZE long
endif

savepos OFFSET
log MEMORY_FILE OFFSET NAMES_SIZE
calldll MEMORY_FILE10 "blur_decrypt" "tcc" RET MEMORY_FILE NAMES_SIZE
math OFFSET  = NAMES_SIZE
math OFFSET x= MYALIGN
goto OFFSET

get FILES long
get DUMMY long
get DUMMY long
for i = 0     get NAME_OFF long
    get DUMMY long
    get SIZE long
    get TIMESTAMP longlong
    get OFFSET longlong
    if SIGN == "2KAP"
        if VERSION >= 2
            get CHUNK_SIZE long
            get CHUNK_ZSIZE long
        endif
    endif
    get ZERO long
    if ZERO == 0
        getdstring DUMMY 0x18
    endif

    if OFFSET != -1
        math OFFSET *= MYALIGN
        savepos TMP
        goto OFFSET

        math CHUNK_SIZE  = 0x10000
        math CHUNK_ZSIZE = 0

        if SIGN == "PAK2"
            get CHUNK_ZSIZE long
            #math CHUNK_ZSIZE -= 4    # ???
            savepos OFFSET
            get CHUNK_SIZE long
            if CHUNK_SIZE != SIZE
                get CHUNK_ZSIZE long
            else
                goto OFFSET
            endif
        else
            get CHUNK_SIZE long
            if CHUNK_SIZE != SIZE
                comtype unzip_dynamic   #deflate
                get CHUNK_ZSIZE long
            else
                comtype unzip_dynamic   #zlib
                goto OFFSET
                if VERSION                     get CHUNK_ZSIZE long
                endif
            endif
        endif

        savepos OFFSET

        # lame work-around for another gamedata.pak file
        if CHUNK_SIZE u> PAK_SIZE
            math OFFSET -= 8
            math CHUNK_SIZE = SIZE
            math CHUNK_ZSIZE = SIZE
        elif CHUNK_ZSIZE u> CHUNK_SIZE
            math OFFSET -= 4
            math CHUNK_ZSIZE = CHUNK_SIZE
        endif

        goto TMP

        goto NAME_OFF MEMORY_FILE
        get NAME string MEMORY_FILE

        math TMP = CHUNK_ZSIZE
        math TMP x= MYALIGN

        math TMP2 = PAK_SIZE
        math TMP2 -= OFFSET

        savepos TMP_OFF
        if SIZE == TMP
            if SIZE > TMP2
                math SIZE = TMP2
            endif
            log NAME OFFSET SIZE
        elif SIZE == CHUNK_ZSIZE
            if SIZE > TMP2
                math SIZE = TMP2
            endif
            if SIGN == "PAK2"
                log NAME OFFSET SIZE
            else
                clog NAME OFFSET SIZE SIZE
            endif
        else
            if i == 0
                # just a compression check
                if SIGN == "PAK2"
                    comtype zlib_noerror
                    clog MEMORY_FILE3 OFFSET CHUNK_ZSIZE SIZE
                    get XSIZE asize MEMORY_FILE3
                    if XSIZE                         comtype xmemdecompress
                    else
                        comtype unzip_dynamic   #zlib
                    endif
                endif
            endif

            putvarchr MEMORY_FILE2 SIZE 0
            log MEMORY_FILE2 0 0
            append
            for
                clog MEMORY_FILE2 OFFSET CHUNK_ZSIZE CHUNK_SIZE
                get MYSIZE asize MEMORY_FILE2
                if MYSIZE >= SIZE
                    break
                endif
                math OFFSET  = CHUNK_ZSIZE
                goto OFFSET
                get CHUNK_ZSIZE long
                savepos OFFSET
            next
            append
            log NAME 0 SIZE MEMORY_FILE2
        endif
        goto TMP_OFF
    endif
next i

Ekey, posted Fri Dec 10, 2021 6:54 pm (68148)

---

You should be copy this part

Code:

set MEMORY_FILE10 string "
void blur_decrypt(unsigned char* lpBuffer, int dwSize)
{
  unsigned char lpKey[14] = {0x78, 0x56, 0x58, 0x6F, 0x34, 0x30, 0x6A, 0x33, 0x40, 0x24, 0x25, 0x5C, 0x25, 0x60};
  for (int i = 0; i < dwSize; i  )
  {
     lpBuffer[i] ^= lpKey[(i   1) % 14];
  }
}
"

instead of

Code:

set MEMORY_FILE10 string

Tosyk, posted Fri Dec 10, 2021 7:04 pm (68149)

---

Ekey wrote:

You should be copy this part

Code:

set MEMORY_FILE10 string "
void blur_decrypt(unsigned char* lpBuffer, int dwSize)
{
  unsigned char lpKey[14] = {0x78, 0x56, 0x58, 0x6F, 0x34, 0x30, 0x6A, 0x33, 0x40, 0x24, 0x25, 0x5C, 0x25, 0x60};
  for (int i = 0; i   {
     lpBuffer[i] ^= lpKey[(i   1) % 14];
  }
}
"

instead of

Code:

set MEMORY_FILE10 string

in this case I have the same message from qbms:

aluigi, posted Fri Dec 10, 2021 7:58 pm (68154)

---

@Tosyk
No, you didn't change anything because that error happens only with the incomplete command you used.
It's just a copy&paste, how did you mess it up?

Tosyk, posted Sat Dec 11, 2021 12:06 am (68162)

---

aluigi wrote:

@Tosyk
No, you didn't change anything because that error happens only with the incomplete command you used.
It's just a copy&paste, how did you mess it up?

I'm sorry, I didn't knew it can be that hard. I have this script rn and I'm using it only on root.pak because all other paks are extractable with previous versions.

Code:

# Blur (script 0.3.3)
#   note that I have tried to support multiple versions of the Blur
#   archives with the result of being possibly not 100% compatible
#   with some of them.
#   would be required a full rewrite for each version but finding
#   all the old files is a pain at the moment
#   in case of problems set WORK_AROUND to 1
# script for QuickBMS http://quickbms.aluigi.org

set MEMORY_FILE10 string "
void blur_decrypt(unsigned char* lpBuffer, int dwSize)
{
  unsigned char lpKey[14] = {0x78, 0x56, 0x58, 0x6F, 0x34, 0x30, 0x6A, 0x33, 0x40, 0x24, 0x25, 0x5C, 0x25, 0x60};
  for (int i = 0; i < dwSize; i  )
  {
     lpBuffer[i] ^= lpKey[(i   1) % 14];
  }
}
"

# set WORK_AROUND to 1 if you get an error
math WORK_AROUND = 0

getdstring SIGN 4
if SIGN == "2KAP"
elif SIGN == "PAK2"
    comtype xmemdecompress
    endian big
else
    cleanexit
endif
if WORK_AROUND != 0
    string SIGN r SIGN
endif

get PAK_SIZE asize

get VERSION long
get MYALIGN long
goto 0x38
get NAMES_SIZE long
if NAMES_SIZE == 0
    goto MYALIGN
    get NAMES_SIZE long
endif

savepos OFFSET
log MEMORY_FILE OFFSET NAMES_SIZE
calldll MEMORY_FILE10 "blur_decrypt" "tcc" RET MEMORY_FILE NAMES_SIZE
math OFFSET  = NAMES_SIZE
math OFFSET x= MYALIGN
goto OFFSET

get FILES long
get DUMMY long
get DUMMY long
for i = 0 < FILES
    get NAME_OFF long
    get DUMMY long
    get SIZE long
    get TIMESTAMP longlong
    get OFFSET longlong
    if SIGN == "2KAP"
        if VERSION >= 2
            get CHUNK_SIZE long
            get CHUNK_ZSIZE long
        endif
    endif
    get ZERO long
    if ZERO == 0
        getdstring DUMMY 0x18
    endif

    if OFFSET != -1
        math OFFSET *= MYALIGN
        savepos TMP
        goto OFFSET

        math CHUNK_SIZE  = 0x10000
        math CHUNK_ZSIZE = 0

        if SIGN == "PAK2"
            get CHUNK_ZSIZE long
            #math CHUNK_ZSIZE -= 4    # ???
            savepos OFFSET
            get CHUNK_SIZE long
            if CHUNK_SIZE != SIZE
                get CHUNK_ZSIZE long
            else
                goto OFFSET
            endif
        else
            get CHUNK_SIZE long
            if CHUNK_SIZE != SIZE
                comtype unzip_dynamic   #deflate
                get CHUNK_ZSIZE long
            else
                comtype unzip_dynamic   #zlib
                goto OFFSET
                if VERSION <= 1
                    get CHUNK_ZSIZE long
                endif
            endif
        endif

        savepos OFFSET

        # lame work-around for another gamedata.pak file
        if CHUNK_SIZE u> PAK_SIZE
            math OFFSET -= 8
            math CHUNK_SIZE = SIZE
            math CHUNK_ZSIZE = SIZE
        elif CHUNK_ZSIZE u> CHUNK_SIZE
            math OFFSET -= 4
            math CHUNK_ZSIZE = CHUNK_SIZE
        endif

        goto TMP

        goto NAME_OFF MEMORY_FILE
        get NAME string MEMORY_FILE

        math TMP = CHUNK_ZSIZE
        math TMP x= MYALIGN

        math TMP2 = PAK_SIZE
        math TMP2 -= OFFSET

        savepos TMP_OFF
        if SIZE == TMP
            if SIZE > TMP2
                math SIZE = TMP2
            endif
            log NAME OFFSET SIZE
        elif SIZE == CHUNK_ZSIZE
            if SIZE > TMP2
                math SIZE = TMP2
            endif
            if SIGN == "PAK2"
                log NAME OFFSET SIZE
            else
                clog NAME OFFSET SIZE SIZE
            endif
        else
            if i == 0
                # just a compression check
                if SIGN == "PAK2"
                    comtype zlib_noerror
                    clog MEMORY_FILE3 OFFSET CHUNK_ZSIZE SIZE
                    get XSIZE asize MEMORY_FILE3
                    if XSIZE < SIZE
                        comtype xmemdecompress
                    else
                        comtype unzip_dynamic   #zlib
                    endif
                endif
            endif

            putvarchr MEMORY_FILE2 SIZE 0
            log MEMORY_FILE2 0 0
            append
            for
                clog MEMORY_FILE2 OFFSET CHUNK_ZSIZE CHUNK_SIZE
                get MYSIZE asize MEMORY_FILE2
                if MYSIZE >= SIZE
                    break
                endif
                math OFFSET  = CHUNK_ZSIZE
                goto OFFSET
                get CHUNK_ZSIZE long
                savepos OFFSET
            next
            append
            log NAME 0 SIZE MEMORY_FILE2
        endif
        goto TMP_OFF
    endif
next i