XeNTaX

aluigi

looks like they are zip files protected with password and probably using a sort of obfuscation on the filenames

aluigi

no the offset doesn't get ignored, you must just set the correct one since from what I have understood the whole table starting from 0x10 is xored and it's possible that the key is not used like you see there. I mean the offset is 0x10 ok but maybe the key is used not from its beginning (the'i') but...

aluigi

the usual zip xored with 0x55, it's used in various games but I have not seen a common developer/publisher since they look all different (paradox, ubi, a german one and others).
for the other games google "filexor 0x55" :)

aluigi

it's a matter of where the key gets applied. filexor applies that key from offset 0x00 so if you want to start to apply it from a different offset you must specify it, example: filexor "0x11 0x22 ... 0xff" OFFSET in this case I see that 0x1d must be xored with the byte of the key at offset...

aluigi

I have found it: e43037

Code: Select all

filexor  "0x65 0x34 0x33 0x30 0x33 0x37" OFFSET

aluigi

thanx for the feedback. well, the crash obviously a problem in any case and so I will fix it. but for the rest the putct command acted correctly. in short putct with char 0x20 (the space) on a string like "test test" will store "test " in your file you have the first string equal...

aluigi

ops for the 'O/0' :)

can you put the following line before the clog command?

Code: Select all

print "XXX %SIZE% %ZSIZE%"

and then tell me what get reported by quickbms.
just to be sure that the file is compressed

aluigi

try with "ufed80c5":

Code: Select all

  filexor  "0x75 0x66 0x65 0x64 0x38 0x30 0x63 0x35" OFFSET

aluigi

what a shame... I forgot "fseek(filein,1,SEEK_SET);"... ah ah ah encryption aes "TIMOTEI_ZION\0\0\0\0" get ALIGN byte savepos OFFSET get SIZE asize math SIZE -= OFFSET math SIZE -= ALIGN get NAME basename string NAME += ".str" log NAME OFFSET SIZE ok, after this stupid ...

aluigi

for YBIG try the following:
http://aluigi.org/papers/bms/yeti2.bms

but note that I remember there was something wrong or incomplete so don't hope in a good result

aluigi

uhmmm no there are invalid things: 1) the source code recompiled doesn't decrypt correctly 2) it's the exact key I have used in my script for testing aes, I have tried both the 0 padding and TIMOTEI_ZIONTIMO without success I'm using aes_128_cbc and I have tried also the others 3) your executable de...

aluigi

but what's the key?
I have tested "TIMOTEI_ZION\0\0\0\0" but it's not ok

aluigi

ok so it's another format to reverse, I don't understand why EA makes these games using the BGFA format with some differences in each one... mah

aluigi

in the meantime try also the script I wrote for NBA jam fire:
http://aluigi.org/papers/bms/others/nbajamfire.bms
maybe it's the same format, I hope

aluigi

Code: Select all

endian big
idstring "CCZ!"
get DUMMY long
get DUMMY long
get SIZE long
savepos OFFSET
get ZSIZE asize
math ZSIZE -= OFFSET
get NAME basename
clog NAME OFFSET ZSIZE SIZE

XeNTaX

XeNTaX

Search found 1910 matches

Re: [Request] God Man .PAK Files

Re: Battle Hearts DAT (Trying Decrypt)

Re: Arthur And Revenge Of Maltazards (*.PHX)

Re: Battle Hearts DAT (Trying Decrypt)

Re: The *.PAK file format of the Orneon Limited games

Re: quickbms ( PutCT command )

Re: The *.PAK file format of the Orneon Limited games

Re: The *.PAK file format of the Orneon Limited games

Re: About .set files

Re: ghost recon future soldier

Re: About .set files

Re: About .set files

Re: NCAA Football 13 .AST Files

Re: NCAA Football 13 .AST Files

Re: Compressed PVR files