Unreal Engine 4 pak-file Unpacker / unreal_tournament_4.bms [UE4 global topic]

[spiritovod]

@Firecube: It's not an easy task either and involving debugging mobile app with graphics debuggers (also, maybe there is simpler method to do so engine-wise). Still, it's easier than reverse-engineering paks format, especially with encrypted index.

Also, since only index is obfuscated or encrypted in those paks, but not files themselves, you can extract raw chunks from any pak with offzip ("offzip -a your.pak output_folder") and then merge them, following known UE4 assets patterns. For example, there will be 01.uasset, 02.dat, 03.dat, 04.uasset, 05.dat and so on. Here 01.uasset is a header and 02.dat/03.dat are parts of that uasset or ubulk. So, merging 01+02+03 into one uasset will get you one working asset (probably, because there are also headerless ubulk files).
But this approach is not effective at all, because there are many assets types out there and total amount of assets can be 10k+ easily.

In any case, you can't get anything from those paks, since devs not only xor'ed index, but also obfuscated its offset and size - that means you must r-e libUE4.so library to find out what they did there. Alternatively, I think it's possible to find out index's offset and size for every pak manually and extract them with modified bms script.

[NecroCrafts]

• Engine: UE 4.22 (Should be)
• Available on iOS and Android.
• No shipping.exe (Might be a problem for encryption grabbing dont know).
• I do have the paks from iOS as I'm jailbroken and can file tamper. Just let me know if you need them.

If anyone has the time to crack it, would be appreciated cheers!

[spiritovod]

I've noticed that PUBG Lite still have the same format as mobile version before (not encrypted, but with xor'ed index). For some reason pubg_mobile-extract script doesn't work with it, so here is working script for quickbms. Tested on latest version at the moment.

You can find the script in this post.

[sinnerclown380]

Hi spirtovod please my names is sarah Aes key
.

[yuehen]

Key:0x42163963B2E095A8D673B48B703B6DE016FE4DC36E0796CC14531C8DAE87E4BC
Download link：https://object.blue-protocol.com/setup/qe1MU2mMQlsRLDnpwby33hXq/BLUEPROTOCOL_Setup.exe

[GHFear]

AES Keys?
If anyone needs to get keys on newer games (UE4 versions 4.19 and above), try the tool in my signature.
Hope it can be of help to people looking for keys.
Good luck!

[sinnerclown380]

AES Keys?
If anyone needs to get keys on newer games (UE4 versions 4.19 and above), try the tool in my signature.
Hope it can be of help to people looking for keys.
Good luck!

. Thanks bro good work.

[Dark_VladislaV]

AES Keys?
If anyone needs to get keys on newer games (UE4 versions 4.19 and above), try the tool in my signature.
Hope it can be of help to people looking for keys.
Good luck!

Can this work for UE4 android game?

[GHFear]

AES Keys?
If anyone needs to get keys on newer games (UE4 versions 4.19 and above), try the tool in my signature.
Hope it can be of help to people looking for keys.
Good luck!

Can this work for UE4 android game?

Not yet. Perhaps in the future.

[TGGAMING]

@Firecube: It's not an easy task either and involving debugging mobile app with graphics debuggers (also, maybe there is simpler method to do so engine-wise). Still, it's easier than reverse-engineering paks format, especially with encrypted index.

Also, since only index is obfuscated or encrypted in those paks, but not files themselves, you can extract raw chunks from any pak with offzip ("offzip -a your.pak output_folder") and then merge them, following known UE4 assets patterns. For example, there will be 01.uasset, 02.dat, 03.dat, 04.uasset, 05.dat and so on. Here 01.uasset is a header and 02.dat/03.dat are parts of that uasset or ubulk. So, merging 01+02+03 into one uasset will get you one working asset (probably, because there are also headerless ubulk files).
But this approach is not effective at all, because there are many assets types out there and total amount of assets can be 10k+ easily.

In any case, you can't get anything from those paks, since devs not only xor'ed index, but also obfuscated its offset and size - that means you must r-e libUE4.so library to find out what they did there. Alternatively, I think it's possible to find out index's offset and size for every pak manually and extract them with modified bms script.

HOW CAN I MARGE EXTRACTED FILES ?

[TGGAMING]

Can anyone help me with this ?

[spiritovod]

@TGGAMING: You're trying to extract mobile version with lite script, but they are not compatible.
And if you don't know how to merge files, google will help you (any hex editor will do). Anyway, if you don't know about internal structure of different UE4 assets, that method is of no use to your. It was just observation and it's not really useful way to explore pak contents.

[spiritovod]

Wrote some POC for aes keys finder (one exe -> one key or not found). JRE 8 or above is required to run it. Readme is included in the archive (please read it carefully to avoid issues). Virustotal report for those who care: link.
Bleeding Edge is supported, unless they'll change something related in the code. Last Oasis is also supported in version 0.9c. Finder can detect protected games starting from version 0.9d. Small fixes in version 0.9e. Additional message in case if a key is not found in version 0.9f. Additional routine for some rare cases is now implemented in version 0.9g.

POC for aes keys finder in mobile games added (one game -> one key or not found). JRE 8 or above is required to run it. Readme is included in the archive (please read it carefully to avoid issues). Virustotal report for those who care: link.
Fixed premature appearance of key.txt, fixed issue when finder could work more than expected, added total execution time to output message in version 0.9c. Some optimizations were removed to improve compatibility with newest games in version 0.9d. More optimizations were removed to improve compatibility with some old games in version 0.9e (previous version is recommended though).

Known unsupported by the finder games: PUBG (all versions), Sea of Thieves.

-----------------------------------------------------------------------

All questions about any PUBG games will be ignored. All required information is available here in "all you should know about PUBG" section. No further support will be provided due to the reasons explained there.

-----------------------------------------------------------------------

I've desided to move all modified scripts to one post (this one). The reason why they can't be merged is because currently there is no way to distinguish them by archives names. Current method with scanning folder name for a pattern is not very effective, since pak archives can be moved anywhere.

Original post with modified script by ssh: viewtopic.php?t=1005&start=1200#p51805 (0.4.23.1a).
Latest official version of the script by aluigi: http://aluigi.org/bms/unreal_tournament_4.bms (0.4.25 at the moment).

Script with v9 paks support (for 4.25 games and below) - "unreal_tournament_4_0.4.25" in the attachment. Updated on 26.12.2020 to properly support base paths from mount points if present. Updated on 26.02.2021 to support auto-detection of compression types - therefore some scripts from specific scripts bundle were removed, because updated main script can handle those games now. Updated on 19.12.2021 to handle large non-chunked uncompressed assets over 3GB. Updated on 26.07.2022 to simplify embedding keys for more convenient usage.
Script with v11 paks support (for 4.26/4.27/UE5 games) - "unreal_tournament_4_0.4.27" in the attachment. It's not backward compatible with 4.25 and below games. Also, it only supports paks at the moment, but utoc/ucas support may be added later. Updated on 16.01.2021 to properly support files over 4GB. Updated on 23.04.2021 with ability to skip assets which are being addressed outside current package. Updated on 02.05.2021 with auto-detection of compression types and small fixes. Updated on 05.10.2021 with support for updated 4.27 packages format. Updated on 14.11.2021 with fix for proper omitting invalid entries. Updated on 19.12.2021 to handle large non-chunked uncompressed assets over 3GB. Updated on 08.01.2022 with proper support for unicode in folder names. Updated on 26.07.2022 to simplify embedding keys for more convenient usage.

You can also read "Alternative tools for paks" section from this topic.

Supported games (with specific scripts): Sea of Thieves, State of Decay 2 (latest versions), PUBG Lite, PUBG Mobile/Mobile Lite (only for 1.1.x and below), PUBG Mobile (chinese ver., including latest versions), Friday 13th Game (PC/Switch), Bless Mobile, Dragon Quest XI - also works with S edition, Pinball Wicked (thanks to pipopipo/pipoman), Conan Exiles, Tekken 7, Fable Legends, Outriders (thanks to mobus_c352), Century: Age of Ashes, Miracle 2 (MU Origin 3), Super People, Back 4 Blood (supports both full and beta versions), Crayta, Tony Hawk's Pro Skater 1+2, Light Response / Lightning, Dead by Daylight Mobile (SEA version), QQ (software), Uncharted Waters Origin, Apex Legends Mobile (thanks to FabianFG), Zhu Xian World, Crystal of Atlan, Ash Echoes / Fraxinus Decay.

Sound extraction (readme included): Satisfactory (latest versions), R-Type Final 2, Gears 4, Sword and Fairy 7.

Some unrelated scripts for UE4 games: for save files from Life is Strange 2 (link), for "paka" files from Kingdoms Reborn (link), modified u4pak for creating Dragon Quest XI compatible packages (link), for decrypting/encrypting and converting save files from Dragon Quest XI S (link), for extracting some Tekken 7 mods (link), for merging resources into proper obb for Project W (link).

-----------------------------------------------------------------------

Some experimental scripts are now available in custom_UE4_scripts bundle. For more info please read included readme. Bundle updated on 26.11.2021 with some scripts for 4.26/4.27/UE5 games.

1) custom_extract: Provides the same functionality as native filter of quickbms, but on the script level. Created more for research purposes, but may be helpful in some cases.
2) get_hashes: Allow you to extract hashes (actually guids) and filenames of all assets from a pak. Resulted file can be used with extract_diff script.
3) extract_diff: Allow you to compare paks from different game versions and extract or list only new/updated files.
4) raw_extract: Allow you to extract raw assets from paks, if index is not available or obfuscated. That means you can extract all files, but without proper filenames.

Basically, get hashes from pak of the old game version, put them near pak of updated game version and extract or list new/updated files. There are additional options in the extract_diff script, but no backward compatibility yet (for example, you can't guess, which files were completely removed in the updated game version). Please note that those scripts are very experimental and may have some bugs/limitations.

-----------------------------------------------------------------------

How to repack assets back in form of mods:

It was already explained multiple times here and there. Please read some related posts before asking about it: first post, second post (and base instruction, part 3.10.1). Alternatively, you can use instruction by masagrator (it works for PC games as well), which is mentioned in the posts above.

[blenux]

Awesome stuff spiritovod!

[GHFear]

Wrote some POC for aes keys finder (one exe -> one key or not found). JRE 8 or above is required to run it. Readme is included in the archive (please read it carefully to avoid issues). Virustotal report for those who care: link.
Bleeding Edge is supported, unless they'll change something related in the code. Last Oasis is also supported in version 0.9c.

Known unsupported games: PUBG, Sea of Thieves, all mobile games (because optimized dalvik code doesn't have any recognizable patterns).

-----------------------------------------------------------------------

I've desided to move all modified scripts to one post (this one). The reason why they can't be merged is because currently there is no way to distinguish them by archives names. Current method with scanning folder name for a pattern is not very effective, since pak archives can be moved anywhere.

Original post with modified script by ssh: viewtopic.php?t=1005&start=1200#p51805 (0.4.23.1a).
Latest official version of the script by aluigi: http://aluigi.org/bms/unreal_tournament_4.bms (0.4.24b at the moment).

Supported games (with specific scripts): Sea of Thieves (SOT), State of Decay 2 (SOD2, latest versions), PUBG Lite.

Really nice :]
This will help a lot of people.

[spiritovod]

^ Thanks. The only downside is that the list with keys will not be updated frequently like before. I encourage all people using GHFear's or my key finders to post their results if that key is not present in the list or outdated there. It will be especially helpful in case of protected games (like UWP games).

Anyway, now I'm looking into aes keys in mobile games built with UE4. If you know any such game with known or unknown keys, let me know. The games I'm already aware of: M.A.D. 8 (key known), Injustice 2 Mobile (key known), Dead by Daylight (key unknown), Traha (key unknown), Bless Mobile (key unknown), Blade And Soul Revolution (key known) and Blade II (key known). If you'll mention some asian games which are hard to get, you can also PM me lib\arm64-xxx\libUE4.so from extracted apk, and a sample pak. Can't promise anything though, because it's more for research purposes at the moment, but it will be appreciated.
I know a little about that stuff, but it's probably good exercise for neural networks / deep learning devs, considering specifics of that "brute-force" approach to keys.

[TGGAMING]

@spiritovod
I would like to try a method that allows things to be shown in runtime, and I think it requires some values. What is the way to do this?

[Vaziayu]

..

[spiritovod]

@Vaziayu: You either have more than one exe besides AES_finder in the same folder (it can't handle more than one game exe at a time) or you forgot to remove steam protection from the exe. Just tested my finder and it works just fine. Next time please read included readme carefully.

@TGGAMING: It has been already explained before that it's not an easy task, and there is no complete guide about how to it as well. And I'm not going to write such guide too.

[Vaziayu]

..