File table is at the end, each file entry is pretty long with a lot of different values but you can figure out where the OFFSET, SIZE, and ZSIZE are.
I believe there is encryption, cause looking at the DDS files we have a a 128 byte header that appears to be XOR'd with something. But the pixel data is not encrypted. Similarly, looking at the model files, the first 128 bytes are encrypted, but the rest is clear cut...
Audio files have no encryption, so you can just play them directly.
Seeking to a couple model offsets, you can see an index buffer clearly along with strings.
Here's a half-assed script to unpack it. The first 128 bytes of many files are encrypted, and that's pretty much the only thing that's in the way of getting models and textures. And probably animation.
Code: Select all
#TZ Online evp unpacker
getdstring magic 36
get len long
getdstring pack_type len
get unk long
get TABLE_OFS long
get unk2 long
get FILES long
goto TABLE_OFS
for i = 0 < FILES
get len long
getdstring NAME len
get OFFSET long
if OFFSET = 0
get size long
get unk long
else
get ZSIZE long #compressed size
get SIZE long #original size
get FLAG long
get null long
get null long
get unk2 long
get unk3 long
get unk4 long
get unk5 long
endif
log NAME OFFSET SIZE
next iThe 4 unknowns at the bottom might be the XOR key....or maybe one of them..
the FLAG I wrote down changes depending on the file type. Audio files have flag == 1, csv and lua files have flag == 5, models and textures have flag == 6.
That might indicate whether the first 128 bytes are encrypted or not.
