READ THE RULES: Click here

Follow us on Facebook: https://www.facebook.com/xentax/ :)

QUICKBMS GUIDE

Read or post any tutorial related to file format analysis for modding purposes.
User avatar
chrrox
Moderator
Posts: 2541
Joined: Sun May 18, 2008 3:01 pm
Has thanked: 57 times
Been thanked: 1269 times

QUICKBMS GUIDE

Post by chrrox » Sun Jun 07, 2009 7:57 pm

I am going to make a tutorial for using quickbms for extracting archives that are no extractors for.
I am going to start off easy then add more and more difficult archives so you can learn and write your own scripts.
the tools you need are just 4 things.
1. A HEX editor I use HxD
2.Quick BMS http://aluigi.org/papers/quickbms.zip
3. a text editor like wordpad
4. a calculator that supports hex like the one built into windows.
We will start with a game called FEZ (Fantasy Earth Zero)
this is a great archive format for someone to learn bms scripting from.
I attached a sample.
website http://tw.fez.gamania.com/
installer http://tw.dl.gamania.com/fez/FEZ_1103.exe
this game uses textures with wrong headers mainly dds and some tga and some kind of .mdl format.

ok so you can download the full installer
ok so open the file up in your hex editor so you see what I have open here
Image
so if you look to the right you will notice some readable text
Etc\aura.tex , Etc\cursor.tex , Etc\mahoujin.tex , Etc\env2.tex , and Etc\kaze.tex .
so just looking with out eyes we now know that there are at least 5 files in this bin file and after we extract them they will be placed in a folder called Etc.
so lets start looking at the other parts of the header in this file we will start with the first 4 bytes
Image
well we have 05 00 00 00
whenever you are working with archives for computer games 99% of the time you read the values in reverse so the above number
would not be 5,000,000 but instead would be read as 00 00 00 05 or 5
Well if we remember from earlier we saw 5 file names and our first 4 bytes of our file are equal to 5 so there is a good chance we just discovered where the file count is stored in this archive.
data is stored in groups of 4 bytes " a long" 2 bytes " a short" or 1 byte "a byte" so we have our first part of our script
get FILES long
this tells quickbms to read a long value "aka 4 bytes" and store it as the variable FILES.
ok the next 4 bytes 74 00 00 00 are not needed in order for quickbms to extract our files but it represents the total size of our header.
Image
so I will write the next line of code for quickbms
get HEADERSZ long
this stores the header size in the variable HEADERSZ
ok now we have 2 more bytes before the file name
so that is 0C 00 well 2 bytes is know as a short. but what does 00 0C stand for?
if we highlight the whole name of the file in out hex editor it shows us a length of C :)
we found the name length so we would write that as
get NSIZE short
this stores the 2 bytes in the variable NSIZE representing the length of the name
Image
well next comes the name so to store that as a word in bms language we will write the next line
getdstring NAME NSIZE
this is saying store a string "aka a word" in the variable NAME and its length is equal to the variable NSIZE.
ok now we have another 4 bytes after the name 7C 00 00 00
well we already know the name of the file so now to extract the file we need to know its size and location in the archive.
7C is not a very big number for the size of the file to lets see what happens if we go to offset 7C
in HxD press ctrl +E and type in 7c for the start and end then click ok.
Image
you should look like this after clicking ok
Image
hmm this looks good it looks like a file header IMG0 so we will write out line saying that is the start of the file
get OFFSET long
this stores the 4 bytes as the variable OFFSET
ok the next 4 bytes are 70 10 00 00 well that looks bigger so lets see if that is the size of out file so it will translate into 00 00 10 70 or 1070
so lets go to our offset 7C and then we will add in the length column 1070
Image
wow look at that I see TRUEVISION-XFILE that is a classic tga ending and we also end just before IMG0 which was the start of our first file
Image
so that means we found our size :)
we write that as
get SIZE long
this stores the 4 bytes in the variable SIZE
ok now we have 2 bytes then the next file name hmm that seems familiar
lets see 0E 00so that means it translates into 00 0E or E
well the last 2 bytes we had before a name was the name size lets see if it still holds true
Image
it does the name length is E :)
so that means we found where the pattern in the header repeats and we identified all that we need to extract the files so now we can finish our script and our extractor.
whenever the pattern starts you want to begin a loop so it will keep cycling through it until there are no files left. the easiest way to write that is.
for i = 0 < FILES
this means run the following commands until i = 0 and set i = FILES
so we will put that before our NSIZE variable because that is where the pattern starts.
next you want it to write out the file and we do that with the log command in the following format
log NAME OFFSET SIZE
this says write the file name and fill it with the data starting at the variable OFFSET and a length of SIZE.
now this is great but we want it to keep repeating the loop till there are no more files so we must add
next i
at the end so the loop continues.
ok so now save the file we created as extract.bms
and put Etc.pac extract.bms and quickbms.exe all in the same folder for wthis demo we will say c:\temp
so now at the command prompt change to that directory and type
quickbms.exe -l extract.bms Etc.pac .
this will list the the file contents and size or give you an error if your script is not correct.
Yay it worked :)
Image
now lets try extracting them create a folder in c:\temp called extracted
now type the command
quickbms.exe extract.bms Etc.pac extracted
yes it worked now they are in the filder and extracted.
Image

Code: Select all

get FILES long
get HEADERSZ long
for i = 0 < FILES
get NSIZE short
getdstring NAME NSIZE
get OFFSET long
get SIZE long

log NAME OFFSET SIZE
next i
Let me know what you think of this tutorial and if you want me to continue on with more examples and more compex scripts.
Last edited by chrrox on Tue Jun 09, 2009 2:49 pm, edited 1 time in total.

AceAngel
veteran
Posts: 115
Joined: Sun Feb 08, 2009 5:45 pm
Has thanked: 35 times
Been thanked: 7 times

Re: QUICKBMS GUIDE

Post by AceAngel » Sun Jun 07, 2009 9:40 pm

Excellent tutorial mate! I'm no genius, but this guide for dummies like me is EXCELLENT!

The only problem would be the 'format' of the tutorial, it's...abit messy, but still readable.

User avatar
aluigi
VVIP member
VVIP member
Posts: 1917
Joined: Thu Dec 08, 2005 12:26 pm
Location: www.ZENHAX.com
Has thanked: 4 times
Been thanked: 644 times
Contact:

Re: QUICKBMS GUIDE

Post by aluigi » Sun Jun 07, 2009 10:16 pm

well done chrrox and just in time for the new version of QuickBMS with (experimental) support for the recursive functions :)

Rheini
Moderator
Posts: 652
Joined: Wed Oct 18, 2006 9:48 pm
Location: Germany
Has thanked: 19 times
Been thanked: 40 times
Contact:

Re: QUICKBMS GUIDE

Post by Rheini » Sun Jun 07, 2009 11:00 pm

Good job, but it's a bit messy as already has been said.
Maybe you should use something like LaTeX and create a neat little pdf file :)

Kataah
beginner
Posts: 39
Joined: Thu May 24, 2007 7:21 pm
Has thanked: 12 times
Been thanked: 4 times

Re: QUICKBMS GUIDE

Post by Kataah » Mon Jun 08, 2009 12:53 am

Yeah great tut thx a lot for it.
Thats exactly what newbies needs - maybe a few more and different examples - then i think many people can help other guys to unpack simple containers ;)

stevenx
veteran
Posts: 130
Joined: Sat Nov 01, 2008 12:02 pm
Has thanked: 3 times

Re: QUICKBMS GUIDE

Post by stevenx » Mon Jun 08, 2009 4:46 am

Really good job!
I want to see more a bit complex sample.

User avatar
shekofte
mega-veteran
mega-veteran
Posts: 220
Joined: Sun Jan 18, 2009 1:45 pm
Location: Sagittarius
Has thanked: 242 times
Been thanked: 12 times
Contact:

Re: QUICKBMS GUIDE

Post by shekofte » Mon Jun 08, 2009 3:19 pm

thanks chrrox , you are realy benevolence :bravo:
i realy need this tutorial @
is it possible to learn us some methods for recognizing of vertex and faces in 3d extracted files too , i think it is related to ability of working with IDA pro or HEXRAY !
i hope i don't be avaricious !
ILLUSORY VIDEO GAMES ARE MORE IMPORTANT THAN PRECIOUS INTERNATIONAL FOOTBALLs

User avatar
shekofte
mega-veteran
mega-veteran
Posts: 220
Joined: Sun Jan 18, 2009 1:45 pm
Location: Sagittarius
Has thanked: 242 times
Been thanked: 12 times
Contact:

Re: QUICKBMS GUIDE

Post by shekofte » Wed Jun 10, 2009 3:10 pm

whenever you are working with archives for computer games 99% of the time you read the values in reverse so the above number
whether you mean the 99% of them are "little endian" ?
ILLUSORY VIDEO GAMES ARE MORE IMPORTANT THAN PRECIOUS INTERNATIONAL FOOTBALLs

User avatar
chrrox
Moderator
Posts: 2541
Joined: Sun May 18, 2008 3:01 pm
Has thanked: 57 times
Been thanked: 1269 times

Re: QUICKBMS GUIDE

Post by chrrox » Thu Jun 11, 2009 10:56 pm

This is little endian
You read the numbers from right to left so 01 00 00 00 would be equal to 00 00 00 01 or the number 1
while if it was big endian you would read the above number as
01 00 00 00 would be equal to 0x1000000 and in decimal that would be 16777216

http://en.wikipedia.org/wiki/Endianness

If you want to be able to view / edit the tga files you extracted in this lesson just delete the first 0x40 bytes of the file and then save it.
now it is a normal tga file.

Rheini
Moderator
Posts: 652
Joined: Wed Oct 18, 2006 9:48 pm
Location: Germany
Has thanked: 19 times
Been thanked: 40 times
Contact:

Re: QUICKBMS GUIDE

Post by Rheini » Fri Jun 12, 2009 4:19 am

Don't ever care. Most normal formats are in little endian while most console formats are in big endian.

User avatar
aluigi
VVIP member
VVIP member
Posts: 1917
Joined: Thu Dec 08, 2005 12:26 pm
Location: www.ZENHAX.com
Has thanked: 4 times
Been thanked: 644 times
Contact:

Re: QUICKBMS GUIDE

Post by aluigi » Mon Sep 28, 2009 10:51 pm

finally I have written a bit of documentation about all the available commands of QuickBMS.
tell me if you have doubts so I can improve it (although I'm very lazy ih ih ih):
http://aluigi.org/papers/quickbms.txt

Haro
beginner
Posts: 24
Joined: Tue Jul 28, 2009 6:14 pm
Been thanked: 1 time

Re: QUICKBMS GUIDE

Post by Haro » Fri Feb 05, 2010 3:34 pm

hmm seems i can't use this tutorial for my files...
viewtopic.php?f=13&t=4118

NMCM
n00b
Posts: 19
Joined: Wed Apr 15, 2009 7:02 am
Been thanked: 1 time

Re: QUICKBMS GUIDE

Post by NMCM » Sun Jun 13, 2010 1:38 am

I would really like one using one of the SD!2 Pac files. I've been trying to do this for the longest.

User avatar
Mr.Mouse
Site Admin
Posts: 4041
Joined: Wed Jan 15, 2003 6:45 pm
Location: Dungeons of Doom
Has thanked: 412 times
Been thanked: 561 times
Contact:

Re: QUICKBMS GUIDE

Post by Mr.Mouse » Sun Jun 13, 2010 9:31 am

NMCM wrote:I would really like one using one of the SD!2 Pac files. I've been trying to do this for the longest.
Wrong thread.

NMCM
n00b
Posts: 19
Joined: Wed Apr 15, 2009 7:02 am
Been thanked: 1 time

Re: QUICKBMS GUIDE

Post by NMCM » Mon Jun 14, 2010 3:39 pm

What I meant was, that I would like to see more examples, but using a .pac file from SD!2.

Post Reply