XeNTaX Forum Index
Forum MultiEx Commander Tools Tools Home
It is currently Tue Sep 26, 2017 12:11 pm

All times are UTC + 1 hour


Forum rules


Please click here to view the forum rules



Post new topic Reply to topic  [ 3 posts ] 
Author Message
 Post subject: Diablo 3 console CPK format (not CRI!)
PostPosted: Fri Jun 09, 2017 7:57 pm 
Offline
ultra-n00b

Joined: Wed Feb 23, 2011 12:33 pm
Posts: 5
Has thanked: 2 times
Have thanks: 0 time

In console version of Diablo 3 Blizzard used own format of archives. Extension of archives is CPK and they located at CPKs folder, but it is not CRI-CPK format.
Signature of archive is \xA1 \xB2 \xC3 \xD4 and there is also second part I think it is version of format or at least could be part of signature: \x00 \x00 \x00 \x06.
At least archive where cutscenes stored goes without any compression/encryption, since video stored in ogv format bounds of files could be easily determined by signature (OggS, theora, etc).
But header format is complicated. I was not able to find any clear values except of files count @ 0x14.
There is also plain list of filenames which order doesn't match the order of files placement in archive (at least in Cutscenes archive files stored in alphabetical order).

Results of my research:
Code:
// Header
DWORD dwSignature = A1 B2 C3 D4
DWORD // 00 00 00 06 always - version? part of signature?
QWORD qwSize // in Cutscenes it is size of archive from start of files (0x10000) in other archives - not
DWORD // 00 00 00 02 everywhere except Cutscenes (00) - level of compression? encryption indicator?
DWORD dwFilesCount // number of files in archive
DWORD // everywhere except cache archives = dwFilesCount
DWORD // some small number, in Act1-4 = 01
DWORD // another small number, in localization archives (xxXX_Act1-4, e.g. enGB_Act1) = 12-13
DWORD // in most cases = 01, cache archives = 08 / 07, Common = 02
DWORD // small number in range 16-1F
DWORD // equals previous
DWORD // small number in range 00-0F
DWORD // some value (not offset/size)
DWORD // always null (00 00 00 00)
DWORD // unknown value (not offset/size)
DWORD // unknown value (not offset/size)
DWORD // unknown value (not offset/size) seems like little endian
DWORD // unknown value, in cache small number in other archives - big
...
Next goes some structure or table or/of hashes, I don't know, size of this area depends on number of files stored in archive (more files - bigger size), which is separated from list of filenames with some set of dwords nearly similar to arithmetic series (arithmetic progression) with shift, differ from archive to archive (for example : 00, 2C, 5A, 89, B1...). Size of this set is equals to number of files stored in archive. After filelist there is blank area filled with zeroes (not fixed size, differ from archive to archive) and finally then goes the files themselves (till the EOF of archive).

Both known values (FilesCount and Size in Cutscenes) is big endian.

Here is the smallest archive example: example.cpk (1 Mb)
Rest of archives (including Cutscenes (~1.1Gb) and CacheAct (smallest - 200 Mb) archives): PM if you need it
Default.xex (if anyone skilled in reversing Xbox binaries, I'm - not): PM me

You can make the ads go away by registering



Top
 Profile  
 
 Post subject: Re: Diablo 3 console CPK format (not CRI!)
PostPosted: Sun Jun 11, 2017 2:24 am 
Offline
VIP member
VIP member

Joined: Wed Nov 05, 2008 12:16 pm
Posts: 869
Has thanked: 1854 times
Have thanks: 451 times
in your archive.unk sample the first part after header looks obfuscated to me, i can't find a pattern. :?
the next part which at 0xa0a9 begins a table of relative offsets for the file names starting at 0xcc41,
big-endian
0x00 = 0xcc41
0x2a = 0xcc6b
0x4e = 0xcc8f
etc

the data likely starts at 0x30000 and it looks zlib compressed with "78 DA" identifier
for i
----2bytes - size of uncompressed data
----2bytes - unk
----2bytes - size of compressed data
----2bytes - "78 DA" identifier
----compressed data
next

you can extract the files using offzip until a better solution is comes around. :D

_________________
Noesis
Hex2obj
QuickBMS
TextureFinder
Unity Assets Bundle Extractor


Last edited by AceWell on Thu Aug 31, 2017 9:50 am, edited 3 times in total.

Top
 Profile  
 
 Post subject: Re: Diablo 3 console CPK format (not CRI!)
PostPosted: Thu Aug 31, 2017 8:33 am 
Offline
ultra-n00b

Joined: Wed Feb 23, 2011 12:33 pm
Posts: 5
Has thanked: 2 times
Have thanks: 0 time
Solution still not came :(
This is what my bookmarks in Hex Workshop looks like so far:
Image
(Content.cpk)
I've tried look into XEX, but couldn't clearly understand what happens in archive read function, some complicated operations performed with header like
Code:
v36 = ((unsigned __int64)(*(__int64 *)((char *)&v33 - 4) >> 13) >> 50) + v27 + 0x3FFF;
which I couldn't understand (I even can't tell which variable what place represent).
I've also tried with xenia, but its debug capabilities limited.
Any help welcome.



Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 3 posts ] 

All times are UTC + 1 hour


Who is online

Users browsing this forum: Google [Bot] and 7 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group