This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=16136

Baam, posted Sat Nov 27, 2021 5:40 am (67714)

---

nekodata file can't extract with AssetStudio.
https://drive.google.com/file/d/1SnNzcgM8KtV-pLO1IedQhN74ghi7a6iX/view?usp=sharing

aluigi, posted Fri Dec 03, 2021 2:54 pm (67846)

---

In my opinion this is an archive containing various unity files.
The "magic" is "pixelneko filesystem" followed by a 32bit zero, an 8bit 0x01 and then the lz4 compressed data of the first file (I didn't check if it's really lz4, just saw the 0xfx byte).
I don't see any index table with information about the archived files so I suppose it's stored in another file with a different extension, that's what we need..

Baam, posted Thu Dec 09, 2021 2:19 am (68056)

---

aluigi wrote:

In my opinion this is an archive containing various unity files.
The "magic" is "pixelneko filesystem" followed by a 32bit zero, an 8bit 0x01 and then the lz4 compressed data of the first file (I didn't check if it's really lz4, just saw the 0xfx byte).
I don't see any index table with information about the archived files so I suppose it's stored in another file with a different extension, that's what we need..

I see, i only found these files in the game folder.
I apologize if i was late to reply.

aluigi, posted Thu Dec 09, 2021 8:45 am (68071)

---

So the table is probably encrypted at the end of the nekodata file.
Currently I can't help but if someone will provide the details I would easily write the script.
In the meantime I confirm that all the archived files are compressed with lz4.

Baam, posted Thu Dec 09, 2021 12:09 pm (68081)

---

aluigi wrote:

So the table is probably encrypted at the end of the nekodata file.
Currently I can't help but if someone will provide the details I would easily write the script.
In the meantime I confirm that all the archived files are compressed with lz4.

This person said this about extracting the files.

Lico, posted Wed Dec 22, 2021 3:34 pm (68430)

---

Baam wrote:

aluigi wrote:

So the table is probably encrypted at the end of the nekodata file.
Currently I can't help but if someone will provide the details I would easily write the script.
In the meantime I confirm that all the archived files are compressed with lz4.

This person said this about extracting the files.

That person is me, I have open sourced my tool already https://github.com/lico-n/unneko
It's probably not a very SEO friendly name but when else do you have the chance to fill your code basis with neko.

aluigi, posted Thu Jan 06, 2022 5:11 pm (68758)

---

@Lico
Smart way for bypassing the (I guess) missing/encrypted index
So you search the compressed json that contains the table (like '{"files'), brute force its decompression increasing the size, brute force the size of each file sequentially until the obtained checksum matches the one in the json, and use the name and compressed/uncompressed sizes there for dumping it.

But is the real index stored somewhere?

Lico, posted Tue Jan 11, 2022 5:30 pm (69008)

---

aluigi wrote:

@Lico
Smart way for bypassing the (I guess) missing/encrypted index
So you search the compressed json that contains the table (like '{"files'), brute force its decompression increasing the size, brute force the size of each file sequentially until the obtained checksum matches the one in the json, and use the name and compressed/uncompressed sizes there for dumping it.

But is the real index stored somewhere?

There is a pretty sizable datablock at the end of the nekodata file. It's pretty high entropy and not part of any decompressed file.
It grows with the number of files contained in the nekodata.

I guess this is the index but I didn't reverse engineer it. The functions to do that are in a ndk lib and trying to understand what it is doing is pain.
As long as my method is working I don't really see a need do it either way. I might take a look at it again if they break it.