XeNTaX

Posted: **Tue Jan 12, 2016 2:37 pm**

Hello...
I created an app over the course of a couple years of hacking the .pkg files that loads World of Tanks Maps.
http://worldoftanks.curseforge.com/wot- ... ne/images/

The last version of World of Tanks has removed the .chunk files from the .pkg files.
.chunk files contain all the information about what models belong to each chunk and their transforms.
Maps are made of "chunks' put together to from a much larger area.

It looks like all this chunk information has been moved to a single and fairly large file called "space.bin"

What I know so far.
The beginning of the file is nothing more than a table.
Each entry has a 4 character heading followed by 5 int32 values.
The first table entry describes the table its self.
The 2nd int32 in this the length of the table including the first row.
The 5th int32 looks to be the additional number rows in the table. Each row is 24 bytes long or 6 int32s (including the 4 byte character heading)
We can test this.
For the ENSK map.. the entry count is 18 hex or 24.
24 * 24 = 576. The 1st row says the table length is 258 hex or 600.
IF we add the 24 for the very first row they equal each other.

1st... The order of table entries is probably not going to be the same on every map.
Wargaming likes to scramble things when they export things from their tools.
The first table entry starts with "BWTB" I'd guess this means "BigWorld Table".. BigWorld is the game engine.

The 2nd row in the table has a heading of "BWST" ST could mean "Section Table"
In this row, the 2nd int32 after the header characters = 258h which is the start of the data. (also the total lenght of the table)
the 4th entry + 258h points to the end of the first section. It is the length of the data for this table entry.

Looking at the start of this data, It looks like a list of 4 int32s that are info on the sections.
String length, some index? data index? Chunk end?

I need help sorting this out if anyone wants to give it a try.

Posted: **Tue Jan 12, 2016 5:04 pm**

This is what I have figured out so far....

Posted: **Tue Jan 12, 2016 6:21 pm**

This is really interesting.... Maybe we could use this on older versions of WoT to acquire the maps WG removed.

Posted: **Tue Jan 12, 2016 6:37 pm**

Portugalotaku wrote:This is really interesting.... Maybe we could use this on older versions of WoT to acquire the maps WG removed.

I can already read the old maps.. Its the new way they are storing the data thats screwed me over.

There is a file called Map_list.txt or something like that in the install folder of Terra!.. It tells the app what maps to look for.
You could edit that and remove all the maps and add in only the ones you want.
CURSE has info on all this and how to edit that file.
Be aware.. you can NOT load any maps after the last WoT update.

Posted: **Tue Jan 12, 2016 6:48 pm**

Ok..
Here is a partial dump of the items in the first table:

Code: Select all

content/Environment/env440_borders/border_c2_90.primitives
content/Buildings/bld4505_coverright2/normal/lod2/bld4505_coverright2_lod2.primitives/indices
content/Environment/env030_MilkCans/env030_MilkCans_NM.dds
maps/spots/Nature/Grass_edge_NM.dds
content/Environment/env440_borders/border_c2_90.model
content/Environment/envWGL_001_Banner/normal/lod0/WGL_Banner_08.primitives
fffffffco.cdata/terrain2
content/Environment/env012_Chairs/env012_Chairs.dds
content/Buildings/bld002_MiddleWoodShed/bld002_MiddleWoodShed_NM.dds
g_useNormalPackDXT1_safe
content/MilitaryEnvironment/mle016_BoxesHowitzer/mle016_BoxesHowitzer.dds
content/Environment/env415_TownBench/normal/lod0/env415_TownBench2.primitives/indices
content/Buildings/bld6113_shed/normal/lod0/bld6113_shed_lod0.model
content/Environment/env610_HorizontalBar/normal/lod0/env610_HorizontalBar.primitives
content/Environment/env019_Rubbish/normal/lod0/env019_Rubbish3.primitives/vertices
content/Buildings/bld6101_thouse/bld6101_02_details_SM.dds
content/Environment/env208_Log_Firewood/normal/lod0/env208_Log_Firewood07.primitives/indices
inf_env004_Telega_01
content/Buildings/bld6112_shed/normal/lod1/bld6112_shed_lod0.primitives/indices
content/Buildings/bld6108_thouse/normal/lod2/bld6108_thouse.primitives/indices
content/Environment/env601_BunchLogs/normal/lod1/env601_BunchLogs5.primitives/vertices
maps/spots/Damage/RoadTrash_01.dds
content/Buildings/bld_Constructor01/bld_Constructor01R.dds
content/Railway/rw004_Carriage/normal/lod0/rw004_Carriage4.primitives
content/GatesAndFences/gaf005_FactoryGates/normal/lod0/gaf005_FactoryGates.model
content/Environment/env414_Pole/normal/lod0/env414_Pole3.primitives/indices
content/Buildings/bld4204_rHouse/normal/lod0/bld4204_rHouse.primitives/vertices
content/Buildings/bld003_LittleWoodShed/normal/lod0/bld003_LittleWoodShed.primitives/indices
content/Environment/envWGL_001_Banner/normal/lod0/WGL_Banner_10.model
content/Buildings/bld000_base/normal/lod0/bld000_base.model
inf_env610_HorizontalBar

Looking at this has me thinking they are storing the models in this space.bin file.. Maybe not but seeing what looks like are parts of the .visual in here as well tells me there is a lot data from all the models that make up a map.

I wonder if this is a python dump of some kind. They are doing that with WoWS.
I don't know python well enough to know what it looks like.

This data is all from 06_ensk.pkg
Look in /spaces/

I attached the entire list of items. (Actually.. this is just the first group of string entries. There are more)

Posted: **Tue Jan 12, 2016 7:11 pm**

I have been digging in the scripts folder for WoTs and
I see they have a obfuscators.pyc file in there.

This may make it totally impossible to figure this out.
If you don't know what obfuscation is, read THIS

Posted: **Tue Jan 12, 2016 9:43 pm**

Coffee wrote:This may make it totally impossible to figure this out.

Looks like it's used for password storing:

Code: Select all

# Embedded file name: scripts/client/helpers/obfuscators.py
import base64
from debug_utils import LOG_CURRENT_EXCEPTION

class XORObfuscator:
    __PREFIX = '#obfuscate:'

    def __init__(self, key):
        if len(key) < 1:
            raise ValueError, 'Key length must be at least one character'
        self.__key = key

    def __doXor(self, data):
        kIdx = 0
        processed = []
        for x in range(len(data)):
            processed.append(chr(ord(data[x]) ^ ord(self.__key[kIdx])))
            kIdx = (kIdx + 1) % len(self.__key)

        return ''.join(processed)

    def obfuscate(self, data):
        return base64.b64encode(self.__PREFIX + self.__doXor(data))

    def unobfuscate(self, data):
        if len(data.strip()) % 4 != 0:
            return data
        try:
            decode = base64.b64decode(data)
        except:
            LOG_CURRENT_EXCEPTION()
            return data

        if decode.startswith(self.__PREFIX):
            return self.__doXor(decode[len(self.__PREFIX):])
        return data


class PasswordObfuscator(XORObfuscator):

    def __init__(self):
        XORObfuscator.__init__(self, '416c34666745786b'.decode('hex'))

Posted: **Tue Jan 12, 2016 9:52 pm**

Where is that code from?
Can you decompile Python?

Posted: **Tue Jan 12, 2016 10:21 pm**

Coffee wrote:Can you decompile Python?

Of course I can :)))
http://sourceforge.net/projects/easypythondecompiler/

Posted: **Wed Jan 13, 2016 4:12 am**

Andrakann wrote:
Coffee wrote:Can you decompile Python?
Of course I can ))
http://sourceforge.net/projects/easypythondecompiler/

yeah, I've no idea why WoT scripts can be decompiled and WoWS scripts can't

Posted: **Wed Jan 13, 2016 11:59 am**

Your topic on Russian language -> http://www.koreanrandom.com/forum/topic/29351-/

Posted: **Wed Jan 13, 2016 4:01 pm**

TheSeeker wrote:yeah, I've no idea why WoT scripts can be decompiled and WoWS scripts can't

WoWS devs obfuscated all python scripts because they dont want python mods in game with near cheating possibilites, like in WoT.
So, they got mods for aiming point without using python - sad but true

Posted: **Thu Jan 14, 2016 11:35 am**

I too did some digging. I noticed those strings

content/Buildings/bld4505_coverright2/normal/lod2/bld4505_coverright2_lod2.primitives/indices
content/Environment/env019_Rubbish/normal/lod0/env019_Rubbish3.primitives/vertices

now, indicies and vertices are actually parts of primitives file. So I dug out those .primitives files refered (note, that most of .primitives and .dds files used in maps dissapeared or been moved to shared_content_sandbox), took those parts (vertices/indicies) and halleluja, found a match inside .bin file.
So the contents most likely aren't encrypted/compressed.

Also notice, that LOD (level of detail) is actually directly referred in these. That is weird, because now user can't change quality of objects on map....

EDIT: the primitives are inside the BWSG chunk
EDIT2: contents of last primitive mentioned in that list of string aren't at the end of the BWSG chunk. Maybe there are more parts, that aren't identified by string....

Posted: **Thu Jan 14, 2016 2:24 pm**

UDOS - User Data Object Section
CENT - Content

Posted: **Sat Jan 16, 2016 7:42 pm**

BSMI points at matrices.
16 floats per item

It looks like the first int32 in a data section is the length of the data for each entry.
I already figured out that the next int32 is the number of entries in that data section.

Some other basic info..
Any time you see a .dds image, this is a decal. Decals are laid over the top of the terrain to add more detail.
Decal's have a matrix just like any other item.
The above is WRONG... There seems to be image files for models as well in the data. WHY???

So I can get the items names and the items transforms... That is.. if the matrices are listed in the same order as the list of items that are in string format.
There is some trick shit going on because the matrix count = 4584. There are only 1585 items in string format listed for the items.
BUT... a lot of items are reused .. like light poles or fence sections. One item might have 5-10 or even 20 matrices that are associated with it.
That being said, there must be a list in the data some where that tells us how many of each item there is on the map.

XeNTaX

World of Tanks Map format.

World of Tanks Map format.

Re: World of Tanks Map format.

Re: World of Tanks Map format.

Re: World of Tanks Map format.

Re: World of Tanks Map format.

Re: World of Tanks Map format.

Re: World of Tanks Map format.

Re: World of Tanks Map format.

Re: World of Tanks Map format.

Re: World of Tanks Map format.

Re: World of Tanks Map format.

Re: World of Tanks Map format.

Re: World of Tanks Map format.

Re: World of Tanks Map format.

Re: World of Tanks Map format.