[X360] NFS Shift

[Simon]

Hello!

Can you please have a look into this files? (Unpacker QuickBMS Script would be nice)

And one Question whats the XTX-Textures any way to open them?

I attach you some BFF Files .. and they from title 1 update

http://uploaded.to/file/aqzhkh

[rstratton]

are these files from xbox360?

[Simon]

Yes

[Mr.Mouse]

Code: Select all

IDString 0 "PAK " ;
Get D Long 0 ;
Get FN Long 0 ;
ReverseLong FN ;
Get DHigh Long 0 ;
ReverseLong High ;
Get DLow Long 0 ;
ReverseLong Low ;
Get PadSize Long 0 ;
ReverseLong PadSize ;
GetDString PAKNAME 256 0 ;
Get EXTOffset Long 0 ;
ReverseLong EXTOffset ;
Get EXTSH Long 0 ;
ReverseLong EXTSH ;
Get EXTSL Long 0 ;
ReverseLong EXTSL ;
Get D Long 0 ;
Get D Long 0 ;
Get D Long 0 ;
SavePos FIS 0 ;
SavePos D 0 ;
Math D += EXTOffset ;
GoTo D 0 ;
GetDString EX 4 0 ;
Get EXSIZE Long 0 ;
ReverseLong EXSIZE ;
GetDString EXNAME 256 0 ;
GetDString EXPath 256 0 ;
GetDString EXPlatform 256 0 ;
SavePos NIS 0 ;
Set J Long 16 ;
Math J *= FN ;
Math NIS += J ;
For T = 1 To FN ;
Math FIS += 12 ;
GoTo FIS 0 ;
Get OFF Long 0 ;
ReverseLong OFF ;
Get SIZE Long 0 ;
ReverseLong SIZE ;
SavePos FIS 0 ;
Math FIS += 22 ;
GoTo NIS 0 ;
Get NS Byte 0 ;
GetDString FName NS 0 ;
SavePos NIS 0 ;
Set PAD String PAKNAME ;
String PAD += "\" ;
String PAD += FName ;
Log PAD OFF SIZE 0 0 ;
Next T ;

That will do it in MultiEx Commander. Take the .bms file below and add it to the MRF file (see BMS menu). Follow instructions and then open BFF files.

[Simon]

Sorry maybe I'm dumb but it's outputting binary crap

[rstratton]

the bms script extracts the files fine but it seems the files are either still encrypted or are just jibberish
\vehicles\bmw_135\bmw_135_body.vud using old script
<?xml version="1.0" ?>
<body_upgrades>
<stage level="0">
<mesh name_pattern="_KIT00_CHASSIS_" />
<mesh name_pattern="_KIT00_BODYWORK_" />
<mesh name_pattern="_KIT00_BUMPER_F_" />
<mesh name_pattern="_KIT00_BUMPER_R_" />
<mesh name_pattern="_KIT00_BOOT_" />
<mesh name_pattern="_KIT00_BONNET_" />
</stage>
and using new script
ÿ
ô R± 4# UÀ §}”îÚÚîÆ"‘µ6R°ð„jÛnËa·±×Vÿÿ°þ @ Í ‚
YèÒiM1‰09 =TZwNw{{¨À­½Žì\ZªJ'.5.‰
ÿßø Ì AÁ4PPQʶŸ‚«¼aìd„Ýöï}Ñ{K
¯ð|ëÄÞû!½¦¦µš=…>>ìÏÀ¬,Üx2l¿K\†Ä8>žz^÷éϻ塷oÁù1MDIJT󶧆¢ÙÖ×öN¯¥¹ Ýõëj¾ük5“Tø¤½{«ô`Ó
³ävÚ`¥Ú‰$zûO0)¡aŒƒ€÷0ACÔ{/Ã3ÚÖýºÐÄɯÓ
?àÃÆ·ŒXeŽÛA¡Ë¦J1y &5ŠÝÁ™vß~m÷|OÕ´ÔÔbý¬Ld'—jÚ #?ͦ
f!–>P—³ã#nܘ[{0Ê®vòˆ@ A 2{J"}‰Ù¤¢Üêþ@¼BØkŠ`"‹+ý\(£ŽÑâû¥z!5

older script is as follows

Code: Select all

# Need for Speed: Shift
# script for QuickBMS http://aluigi.org/papers.htm#quickbms

comtype XMemDecompress

idstring " KAP"
get DUMMY long
get FILES long

goto 0x118
get X118 long
goto 0x120
get X120 long
math X120 -= 0x308
goto 0x12d
get X12d byte

if X12d == 1
    print "X12d equal to %X12d% has not been tested, contact me"
    cleanexit
endif

callfunction X12dset
log MEMORY_FILE 0x130 X118

callfunction X12dset
set X120OFFSET long 0x438
math X120OFFSET += X118
log MEMORY_FILE2 X120OFFSET X120

for i = 0 < FILES
    encryption "" ""    # reset here instead to do it after each *log

    get CRC1    long MEMORY_FILE
    get CRC2    long MEMORY_FILE
    get OFFSET  long MEMORY_FILE
    get DUMMY1  long MEMORY_FILE
    get ZSIZE   long MEMORY_FILE
    get SIZE    long MEMORY_FILE
    get DUMMY   long MEMORY_FILE
    get DUMMY   long MEMORY_FILE
    get TYPE    byte MEMORY_FILE
    get DUMMY   byte MEMORY_FILE
    get DUMMY   long MEMORY_FILE
    get DUMMY3  long MEMORY_FILE

    get NAMEOFF long MEMORY_FILE2
    get DUMMY   long MEMORY_FILE2
    get DUMMY   long MEMORY_FILE2
    get DUMMY   long MEMORY_FILE2

    savepos TMP MEMORY_FILE2
    math NAMEOFF -= X120OFFSET
    goto NAMEOFF MEMORY_FILE2
    get NAMESZ  byte MEMORY_FILE2
    getdstring  NAME NAMESZ MEMORY_FILE2
    goto TMP MEMORY_FILE2

    callfunction X12dset
    if TYPE == 0
        log NAME OFFSET SIZE
    else if TYPE == 2
        clog NAME OFFSET ZSIZE SIZE
    else
        print "TYPE equal to %TYPE% has not been tested, contact me"
        cleanexit
    endif
next i

startfunction X12dset
    if X12d == 1    # ignored at the moment
        math TMPSZ += 0xf
        math TMPSZ &= 0xfffffff0
    endif
    if X12d == 2
        encryption rc4 "@lLy0urRaC3ar3bE"
    endif
endfunction

[Simon]

To mention older Script = PC Version

But output should be the same

[Mr.Mouse]

Okay, yeah, I noticed that some were encrypted and some not. So does the old script work on the xbox files? Then our job is done here.

[dieinafire]

To clarify,

Here's a PC header from physicsmenu.bff from the full game:



Here's the same file from Xbox 360 DLC2:



If you want to play with both here they are.

The "old" unpacker we have works fine on PC, but not on 360, and the new script succeeds in getting files out of the container, but they're still compressed/encrypted from the look of things.

Basically the reason this is coming up is because the new DLC containing 10 Ferraris is only out for the 360. A lot of the file formats - .fev, .fsb, .meb, and all the extensions they made up like .vud and .cdf and .hdt which simply read as .xml, ought to contain the same data between 360 and PC, and in the hands of some modders could probably be easily brought across to the PC. But the unpacker we've got for the PC version doesn't get us very far, the PC version of Shift won't natively read those 360 .bffs, and the new script which does get them out of the 360 container doesn't leave us with readable files.

[Mr.Mouse]

Ok, I'll see what I can do. The encryption code for the PC version was @lLy0urRaC3ar3bE apparently.
Mind, that reads: "All Your Race Are Be(long to us)", always funny, these programmers.

[dieinafire]

Yeah that's pretty funny the devs are one of those groups who are almost all ex-modders so I'm sure they knew someone would find that eventually and have a giggle

[rstratton]

99% of these ferrari's are in shift already. all that is missing is the models

[Simon]

Nope ..

Some Textures, some Physic Files, some Gauges, many vdf files and this things ...

[Mr.Mouse]

The best option is to adapt the script for QuickBMS. The XBOX files are in Big Endian and have a slight change in structure. Perhaps Chrrox can help you, or Luigi.

[dieinafire]

A-ha, I thought it might be the endian thing.

Thanks for taking a look, I will see how much sense I can make of mexscript and probably get to HELLO WORLD by the time aluigi gets back